Merge pull request 'release: v1.7.0 — Telegram Mini App embedding enhancements' (#138) from development into master

.claude/skills/deploy-check/SKILL.md

@@ -1,89 +0,0 @@
----
-name: deploy-check
-description: "Use before any deploy-touching change to this repo — phrases like '/deploy-check', 'is this prod-safe', 'before we deploy', 'deploy safety review', 'проверь перед деплоем', 'это безопасно для прода'. Runs a pre-deploy checklist of this project's hard-won runtime constraints against the current diff, so the crash classes that have bitten live environments get caught before shipping instead of after."
----
-
-# Pre-deploy runtime-constraint check
-
-Triggered before shipping anything that touches the deploy contour (Dockerfiles,
-`deploy/`, Caddyfile, compose, migrations, boot guards, the Telegram side-service,
-edge config). The worst frictions in this repo were never logic bugs — they were
-**environment mismatches that crashed a live env and forced a redesign**. Run this
-list against the diff first; turn crash-and-redesign into a single pass.
-
-This checklist is a prompt, **not** the source of truth. The canonical detail
-lives in `deploy/README.md`, `docs/ARCHITECTURE.md`, `docs/EDGE_HTTP3.md`, and the
-agent memory files referenced below — read them when an item is in play, and add a
-new class here when a new incident teaches one.
-
-## How to run it
-
-1. `git diff <base>...HEAD --stat` to see what the change actually touches.
-2. For every risk class below that the diff touches, perform the **Check** and
-   report PASS / FAIL with the exact file:line to fix. Skip classes the diff does
-   not touch — say which you skipped and why.
-3. Remember: **deploy-job green ≠ healthy**. CI's deploy probe has historically
-   passed with a dead backend (it only checked static landing+gateway). Verify the
-   real feature live (`/readyz`, the actual flow) after deploy, not just the green.
-
-## Risk classes
-
-### 1. Container user — distroless nonroot UID 65532
-- **Bit us:** TLS keys `chmod 600` for the host owner crash-looped gateway + bot at
-  boot with "permission denied" — service images run UID 65532.
-- **Check:** any new/changed mounted secret, key, or config file must be readable by
-  UID 65532 (`0644`, not `0600`). Scan the diff for file modes, `chmod`, and new
-  volume mounts. (memory: `distroless-nonroot-mounted-secrets`)
-
-### 2. Caddy header pipeline ordering
-- **Bit us:** `header_up delete` after `set` nulled the value (the honeypot tag went
-  empty); it passed CI and only showed up live.
-- **Check:** in any Caddyfile change, verify the `set` / `delete` / `header_up`
-  ordering for every affected route, and test the tripwire/route on the live
-  contour, not just CI.
-
-### 3. Edge Alt-Svc / HTTP3
-- **Bit us:** edge advertised `Alt-Svc: h3` while UDP/443 was never exposed
-  (docker tcp-only + ufw tcp-only); clients cached it 30 days and stalled on dead
-  QUIC before falling back to h2 — Mini App "hangs on load".
-- **Check:** any edge/caddy change keeps `Alt-Svc: clear` (or only advertises h3 if
-  UDP/443 is genuinely exposed). (memory: `tg-app-load-stall-dead-http3-altsvc`,
-  `docs/EDGE_HTTP3.md`)
-
-### 4. Prod caddy config recreate
-- **Bit us:** prod rolling deploy did **not** recreate caddy on a config-only change
-  (pinned `caddy:2-alpine` + `admin off`), so a new Caddyfile deployed GREEN but
-  stayed inert until a manual `docker restart`.
-- **Check:** a config-only edge change must `--force-recreate` caddy in
-  `prod-deploy.sh` `roll()`; never trust deploy-green for edge config.
-  (memory: `prod-deploy-caddy-config-recreate`)
-
-### 5. DICT_VERSION / dictionary boot
-- **Bit us:** an early `DICT_VERSION` refuse-boot guard was wrong and crashed the
-  live env when bumped on a seeded volume; it had to be redesigned to "marker-wins".
-- **Check:** any change touching `DICT_VERSION`, dict load, or the boot guard must
-  keep marker-wins semantics and survive a seeded volume **and** an image rollback.
-  `DICT_VERSION` is a required build-arg (no default), single-sourced. A new dict
-  goes live via the admin console upload, not a redeploy. (memory:
-  `dict-version-deploy-verify`, `contour-schema-change-wipe`)
-
-### 6. Migrations — expand-contract + rollback safety
-- **Bit us / risk:** a non-backward-compatible migration breaks image rollback (DB
-  ahead of rolled-back code).
-- **Check:** migrations must be **expand-contract** (backward-compatible). A schema
-  change adds the maintenance window + a consistent `pg_dump` in prod-deploy. On the
-  **test contour**, a schema/wire-label change needs `DROP SCHEMA backend CASCADE` +
-  backend restart (new code vs old persisted DB), else the contour breaks. (memory:
-  `contour-schema-change-wipe`)
-
-### 7. Telegram permission model
-- **Bit us:** permissions are an **AND-intersection** — default-allow with explicit
-  denies, not default-deny; inverting it broke access.
-- **Check:** any change to the Telegram permission / relay logic preserves the
-  AND-intersection default-allow shape. (memory: `telegram-forum-relay-gotchas`)
-
-## Output
-
-A short PASS/FAIL table over the classes the diff touches, each FAIL with the exact
-file:line and the fix. If every touched class passes, say so plainly and name the
-post-deploy live check to run (not just "CI green").

.claude/vk-games-integration.md

@@ -1,175 +0,0 @@
-# VK Mini App / VK Games — integration reference
-
-Captured research + our implementation map, so a future session does not need to re-fetch
-the VK docs. Authoritative external source: <https://dev.vk.com/> (the `dev.vk.com` portal
-does not render via plain HTTP fetch; the facts below were cross-checked against the VKCOM
-reference repos cited at the end and verified against our own Go implementation).
-
-A VK **game** is technically a **VK Mini App**: an HTML5 SPA VK loads in an **iframe inside
-vk.com** (desktop + mobile web) and in a **WebView** inside the VK mobile apps (iOS/Android).
-We serve our existing SPA under a dedicated `/vk/` path, mirroring the Telegram `/telegram/`
-entry — the single-origin, path-routed model.
-
-## 1. Embedding model
-
-- VK loads the app at the **Web iframe URL** configured in the app settings (HTTPS + valid
-  cert required), appending the signed launch parameters as the **URL query string**.
-- An optional separate **Mobile iframe URL** is used by the VK mobile apps (we use the same).
-- No special `X-Frame-Options` / CSP `frame-ancestors` is required from us — VK frames the
-  configured origin. (Our edge sets **no** framing headers today, so VK works as-is; see the
-  clickjacking note in §Security.)
-- URL must match the settings exactly (scheme, host, no stray `www`/whitespace).
-
-## 2. Launch parameters (URL query)
-
-VK appends these to the iframe `src`. The `vk_*` set is what the signature covers.
-
-| Param | Meaning |
-| --- | --- |
-| `vk_user_id` | signed-in VK user numeric id — **the identity** |
-| `vk_app_id` | our registered app id |
-| `vk_is_app_user` | 0/1 — user authorized/installed the app |
-| `vk_are_notifications_enabled` | 0/1 |
-| `vk_language` | 2-letter UI language (`ru`, `en`, …) |
-| `vk_platform` | `mobile_iphone` \| `mobile_android` \| `mobile_web` \| `desktop_web` \| … |
-| `vk_ts` | unix seconds when VK generated the params |
-| `vk_ref` | where the app was opened from (`catalog`, `feed`, …) |
-| `vk_access_token_settings` | comma-separated granted scopes (often empty) |
-| `vk_group_id`, `vk_viewer_group_role`, `vk_is_favorite`, `vk_client` | optional/contextual |
-| `sign` | **the signature** (see §3) — NOT part of the signed set |
-
-Always present: `vk_user_id`, `vk_app_id`, `vk_platform`, `vk_ts`, `sign`.
-
-The user's **name is NOT in the launch params** (only `vk_user_id`). Read it client-side via
-`VKWebAppGetUserInfo` (see §4) — unsigned, so treat it as a cosmetic display seed only.
-
-## 3. Signature verification (`sign`)  — CONFIRMED base64url, not hex
-
-Algorithm (verified against our `gateway/internal/vkauth` + an independent Python reference):
-
-1. Collect the query params whose key starts with `vk_` (exclude `sign`).
-2. Sort by key (alphabetical).
-3. Serialize as a URL-encoded query string `k=v&k=v…` (Go `url.Values.Encode()` matches VK's
-   reference serialization for the constrained launch-param charset).
-4. `HMAC-SHA256(serialized, secret)` where `secret` = the app's **«Защищённый ключ»**
-   (protected / secure key, a.k.a. client_secret) from the app settings.
-5. **base64url, no padding** (`+`→`-`, `/`→`_`, strip `=`).
-6. Constant-time compare against `sign`.
-
-VK launch params have **no built-in expiry** (unlike Telegram's `auth_date`). We do NOT enforce
-freshness — the minted server session is the short-lived credential; a replay only
-re-authenticates the same `vk_user_id`.
-
-Verified against the official doc <https://dev.vk.com/ru/mini-apps/development/launch-params-sign>
-(prose + PHP example: base64url = `strtr('+/','-_')` + `rtrim('=')`) and reproduced identically by
-independent Node `crypto` + Python references. **Doc-example caveat**: that page shows secret
-`wvl68m4dR1UpLrVRli` → sign `exTIBP…`, but the secret is a **placeholder** — recomputing with it does
-NOT yield the shown sign (it was made with the real, unshown key). Don't chase the mismatch; our
-`vkauth.Verify` is correct (`gateway/internal/vkauth/vkauth_test.go` carries cross-checked vectors,
-incl. the `%2C` comma case for `vk_access_token_settings`).
-
-## 4. VK Bridge (client SDK)
-
-`@vkontakte/vk-bridge` (npm, v3.x; bundled — `default` export `bridge`). Methods we use / may use:
-
-- `VKWebAppInit` — **required**: tells VK the Mini App loaded (dismisses VK's loading cover).
-- `VKWebAppGetUserInfo` — `{ id, first_name, last_name, photo_200, … }`; no extra scope needed.
-- `VKWebAppGetLaunchParams` — parsed `vk_*` **without** `sign` (so NOT usable for our server
-  verification — read `window.location.search` instead, which carries `sign`).
-- `VKWebAppGetAuthToken` — OAuth access token for VK API calls (only if we ever call VK API).
-- `VKWebAppShare` — native share dialog (the friend-code invite uses it; `navigator.share` is absent
-  in the desktop VK iframe). **Used.**
-- `VKWebAppCopyText` — clipboard copy that works inside the VK iframe, where `navigator.clipboard` is
-  blocked. **Used** as the copy-code / copy-link path.
-- `VKWebAppUpdateConfig` (subscribe) — light/dark scheme; the app follows it while the theme pref is
-  "auto" (the VK webview's prefers-color-scheme does not track it). **Used.**
-- `VKWebAppSetViewSettings` / `VKWebAppSetSwipeSettings` — viewport / swipe-back (mobile); not used.
-- `VKWebAppUpdateInsets` (+ `VKWebAppUpdateConfig`) — device safe-area insets; the app **max'es** them
-  with CSS `env(safe-area-inset-*)` (viewport-fit=cover) so the bottom home bar is cleared. The bridge
-  value is needed on Android, where the VK webview exposes no `env()` inset. **Used.**
-
-The bridge talks to the embedding VK client over postMessage; it is NOT an external fetch, so
-it has no telegram.org-style load-hang risk. The SDK reads browser globals at import — we import
-it **lazily** so the pure URL helpers stay node-test-importable.
-
-**Deep links — NOT possible on VK (confirmed on the contour).** The VK iframe receives ONLY the signed
-`vk_*` launch params (+ `sign`); VK strips any custom data from the app link. The documented
-`vk.com/app<id>#<payload>` form is eaten by the vk.com SPA (which owns the URL hash), and a
-`vk.com/app<id>?hash=<payload>` query is dropped (the diagnostic showed `rawSearch` with only `vk_*`
-and an empty `hash`). So the friend-code invite link is just `vk.com/app<id>` (`vkShareLink`, app id
-from `vk_app_id`); the recipient enters the **copied code by hand** (`VKWebAppCopyText` works). The
-`vkStartParam` reader + the `bootVK` routing stay as a no-op today, ready if a post-moderation VK
-channel (e.g. an invite API) ever delivers a payload.
-
-## 5. Test mode (to verify before moderation)
-
-1. App already registered (we have the App ID).
-2. In the app settings (dev.vk.com / `vk.com/editapp?act=settings&app_id=<id>`):
-   - Category = **Игра** (Game).
-   - **Web iframe URL** = our public HTTPS `/vk/` (the test-contour origin for contour testing,
-     prod `https://erudit-game.ru/vk/` later). Mobile iframe URL = same.
-   - Copy the **«Защищённый ключ»** → set as `GATEWAY_VK_APP_SECRET` (Gitea `TEST_`/`PROD_` secret).
-   - Add own VK id to **testers**; open in test mode.
-3. Test mode = visible only to admins/testers, no payments processed.
-
-## 6. Auth / identity (our model)
-
-- `vk_user_id` (from verified params) → backend identity `kind='vk'`, `external_id=vk_user_id`,
-  auto-confirmed (a platform identity). First contact seeds language from `vk_language` and the
-  display name from the client-supplied `VKWebAppGetUserInfo` name (placeholder if empty).
-- No VK access token / VK API call needed for the launch+login MVP.
-
-## 7. Payments / monetization
-
-VK Pay / «голоса» (votes) are **optional**, not required to publish a free game. Not planned.
-
-## 8. ToS / moderation (pre-publish, analyzed — no blocker for a free «Эрудит»)
-
-- **Trademark**: "Scrabble" is trademarked. Our public brand is **«Эрудит»** (erudit-game.ru),
-  a generic Russian word-game name → fine. Ensure the VK-registered app name is «Эрудит»/word-game,
-  NOT "Scrabble". The repo name is internal and irrelevant to moderation.
-- **Pre-publish requirements**: public **Privacy Policy** + **ToS** URLs (disclose collected data:
-  `vk_user_id`, language; mention VK), **age rating** (likely 6+/12+), icon, description.
-- **Dictionary**: standard word lists; VK may expect offensive-word filtering — likely fine for a
-  dictionary game, flag if moderation asks.
-- **In-game chat (UGC)**: we already have a moderated chat + support relay → covered.
-- Moderation reviews after submission (commonly ~24–72h); rejects on violence/hate/sexual/illegal
-  content or IP infringement — none apply.
-
-## 9. Platforms
-
-Desktop web (iframe), mobile web (iframe), VK iOS app (WKWebView), VK Android app (WebView). Bridge
-methods behave per-platform; the app's own back chevron + app-shell document-pin cover navigation
-without VK-specific code. Theme/viewport fine-tuning is best verified live in the real VK client
-(not reproducible in Playwright — like the iOS gesture caveats).
-
-## 10. Our implementation map (what to touch for VK)
-
-- **Wire**: `pkg/fbs/scrabble.fbs` → `VKLoginRequest{ params, browser_tz, display_name }`
-  (regen: `make -C pkg fbs` + `pnpm -C ui codegen`).
-- **Gateway**: `internal/vkauth/` (the §3 verify), `internal/transcode` op `auth.vk`
-  (registered via `WithVKAuth(secret)` option; `DomainCode` → `invalid_vk_params`),
-  `internal/backendclient` `VKAuth` → `POST /api/v1/internal/sessions/vk`,
-  config `GATEWAY_VK_APP_SECRET`, SPA mount `/vk/` in `internal/connectsrv/server.go`.
-- **Backend**: `internal/account` `KindVK` + `ProvisionVK`/`vkSeed` + `confirmed` for platform
-  kinds; `internal/server/handlers_auth.go` `handleVKAuth` + route; migration
-  `00005_vk_identity.sql` (widen `identities_kind_chk` to include `'vk'`, expand-contract).
-- **UI**: `src/lib/vk.ts` (`onVKPath`/`vkLaunchParams`/`insideVK`/`vkInit`/`vkUserName` plus `vkAppId`/
-  `vkStartParam`/`vkShare`/`vkCopyText`/`vkOnScheme`), `app.svelte.ts` `bootVK` (+ deep-link routing
-  and VK scheme→theme) + the `/vk/` dispatch branch + shared `retryMiniAppBoot`, `codec.ts`
-  `encodeVKLogin`, `transport.ts`/`client.ts`/`mock/client.ts` `authVK`, `deeplink.ts` `vkShareLink`,
-  `Friends.svelte` (VK share/copy), `app.css` `--tg-safe-*` defaulting to `env(safe-area-inset-*)`.
-- **Edge/deploy**: `deploy/caddy/Caddyfile` `/vk` path; `GATEWAY_VK_APP_SECRET` in
-  `docker-compose.yml` + `.env.example` + `ci.yaml` (`TEST_…` secret) + `prod-deploy.yaml`
-  (`PROD_…` secret, deploy-main).
-- **Deferred**: payments (VK Pay / votes), native (Capacitor) VK, account-linking a vk identity to an
-  existing account, VK push. (Done after the launch+auth MVP — Group B: native share + clipboard via
-  the bridge, the friend-code deep link, the auto-theme follow, and the home-bar safe area.)
-
-## Sources
-
-- VKCOM/vk-bridge — <https://github.com/VKCOM/vk-bridge>
-- VKCOM/vk-apps-launch-params (canonical signature examples) — <https://github.com/VKCOM/vk-apps-launch-params>
-- kravetsone/vk-launch-params — <https://github.com/kravetsone/vk-launch-params>
-- SevereCloud/vksdk `vkapps.ParamsVerify` (Go reference) — <https://pkg.go.dev/github.com/SevereCloud/vksdk/v2/vkapps>
-- VK Mini Apps API — <https://github.com/VKCOM/vk-mini-apps-api>

.gitea/workflows/ci.yaml

@@ -31,7 +31,7 @@ on:
 # unit/integration jobs inherit it. The deploy job overrides it per contour with
 # vars.TEST_DICT_VERSION (the seed for a fresh volume), see deploy/README.md.
 env:
-  DICT_VERSION: v1.3.1
+  DICT_VERSION: v1.3.0
 
 jobs:
   # changes detects which areas a PR/push touched, so the test jobs can skip when
@@ -73,9 +73,6 @@ jobs:
             go=false; ui=false
             if echo "$files" | grep -qE '^(backend/|pkg/|gateway/|platform/|loadtest/|go\.work)'; then go=true; fi
             if echo "$files" | grep -qE '^ui/'; then ui=true; fi
-            # The render sidecar bundles ui/src/lib, so its dir rides the ui lane (the
-            # deploy's compose build picks it up either way).
-            if echo "$files" | grep -qE '^renderer/'; then ui=true; fi
             # A workflow or deploy change re-runs everything as a safety net.
             if echo "$files" | grep -qE '^(\.gitea/workflows/|deploy/)'; then go=true; ui=true; fi
           else
@@ -202,14 +199,6 @@ jobs:
       - name: Bundle-size budget
         run: node scripts/bundle-size.mjs
 
-      # The render sidecar executes the shared ui/src/lib/gameimage.ts on skia-canvas;
-      # its smoke test guards the bundling + skia seam (docs/TESTING.md).
-      - name: Render sidecar test
-        working-directory: renderer
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm test
-
       - name: Install Playwright browsers
         run: pnpm exec playwright install chromium webkit
         timeout-minutes: 5
@@ -218,66 +207,11 @@ jobs:
         run: pnpm run test:e2e
         timeout-minutes: 5
 
-  # conformance proves the client's local move preview (the ported dawg reader +
-  # validator, ui/src/lib/dict) byte-for-byte against the authoritative Go engine:
-  # a Go step generates golden parity vectors from the release dictionaries, then the
-  # gated Vitest suite replays them. It spans both toolchains, so it runs whenever the
-  # Go engine side or the UI side changed.
-  conformance:
-    needs: changes
-    if: ${{ needs.changes.outputs.go == 'true' || needs.changes.outputs.ui == 'true' }}
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    env:
-      GOPRIVATE: gitea.iliadenisov.ru/*
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Fetch dictionary DAWGs
-        run: |
-          mkdir -p "${GITHUB_WORKSPACE}/dawg"
-          curl -fsSL -o /tmp/dawg.tar.gz "https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/${DICT_VERSION}/scrabble-dawg-${DICT_VERSION}.tar.gz"
-          tar xzf /tmp/dawg.tar.gz -C "${GITHUB_WORKSPACE}/dawg"
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.work
-          cache: true
-
-      - name: Generate golden parity vectors
-        run: |
-          go run ./backend/cmd/dictgen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out /tmp/dictgold
-          go run ./backend/cmd/validategen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out /tmp/validgold
-
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Install pnpm
-        run: npm install -g pnpm@11.0.9
-
-      - name: Install deps
-        working-directory: ui
-        run: pnpm install --frozen-lockfile
-
-      - name: Local-eval conformance (reader + validator vs the Go engine)
-        working-directory: ui
-        env:
-          DICT_DAWG_DIR: ${{ github.workspace }}/dawg
-          DICT_GOLD_DIR: /tmp/dictgold
-          DICT_VALID_DIR: /tmp/validgold
-        run: pnpm exec vitest run src/lib/dict/
-
   # gate is the single branch-protection required check. It always runs and passes
   # only when each upstream job succeeded or was skipped (a path-filtered no-op),
   # failing the merge if any actually failed or was cancelled.
   gate:
-    needs: [unit, integration, ui, conformance]
+    needs: [unit, integration, ui]
     if: always()
     runs-on: ubuntu-latest
     defaults:
@@ -287,7 +221,7 @@ jobs:
       - name: Aggregate required checks
         run: |
           fail=
-          for r in "unit:${{ needs.unit.result }}" "integration:${{ needs.integration.result }}" "ui:${{ needs.ui.result }}" "conformance:${{ needs.conformance.result }}"; do
+          for r in "unit:${{ needs.unit.result }}" "integration:${{ needs.integration.result }}" "ui:${{ needs.ui.result }}"; do
             name="${r%%:*}"; res="${r#*:}"
             echo "$name = $res"
             case "$res" in
@@ -327,22 +261,6 @@ jobs:
           GRAFANA_ADMIN_PASSWORD: ${{ secrets.TEST_GRAFANA_ADMIN_PASSWORD }}
           TELEGRAM_BOT_TOKEN: ${{ secrets.TEST_TELEGRAM_BOT_TOKEN }}
           TELEGRAM_PROMO_BOT_TOKEN: ${{ secrets.TEST_TELEGRAM_PROMO_BOT_TOKEN }}
-          # VK Mini App protected key (offline HMAC for the launch-param signature); empty
-          # leaves the VK auth path (auth.vk) disabled until the operator sets the secret.
-          GATEWAY_VK_APP_SECRET: ${{ secrets.TEST_GATEWAY_VK_APP_SECRET }}
-          # Signs the finished-game export download URLs (backend + compose interpolation).
-          EXPORT_SIGN_KEY: ${{ secrets.TEST_EXPORT_SIGN_KEY }}
-          # Transactional email via the shared Selectel relay. Empty host leaves the
-          # backend on the log mailer (email disabled) but the contour still boots.
-          SMTP_RELAY_USER: ${{ secrets.TEST_SMTP_RELAY_USER }}
-          SMTP_RELAY_PASS: ${{ secrets.TEST_SMTP_RELAY_PASS }}
-          SMTP_RELAY_HOST: ${{ vars.TEST_SMTP_RELAY_HOST }}
-          SMTP_RELAY_PORT: ${{ vars.TEST_SMTP_RELAY_PORT }}
-          SMTP_RELAY_TLS: ${{ vars.TEST_SMTP_RELAY_TLS }}
-          SMTP_RELAY_FROM: ${{ vars.TEST_SMTP_RELAY_FROM }}
-          # Canonical public origin for links in the email (this contour's URL);
-          # required by the backend whenever SMTP_RELAY_HOST is set.
-          PUBLIC_BASE_URL: ${{ vars.TEST_PUBLIC_BASE_URL }}
           GM_BASICAUTH_USER: ${{ vars.TEST_GM_BASICAUTH_USER }}
           GRAFANA_ROOT_URL: ${{ vars.TEST_GRAFANA_ROOT_URL }}
           CADDY_SITE_ADDRESS: ${{ vars.TEST_CADDY_SITE_ADDRESS }}
@@ -359,7 +277,6 @@ jobs:
           VITE_TELEGRAM_BOT_ID: ${{ vars.TEST_VITE_TELEGRAM_BOT_ID }}
           VITE_TELEGRAM_LINK: ${{ vars.TEST_VITE_TELEGRAM_LINK }}
           VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.TEST_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
-          VITE_VK_APP_LINK: ${{ vars.TEST_VITE_VK_APP_LINK }}
           VITE_GATEWAY_URL: ${{ vars.TEST_VITE_GATEWAY_URL }}
           # Unset vars render empty -> the compose ":-" defaults apply.
           POSTGRES_DB: ${{ vars.TEST_POSTGRES_DB }}
@@ -420,23 +337,6 @@ jobs:
           docker logs --tail 50 scrabble-backend || true
           exit 1
 
-      - name: Probe the /dict edge route reaches the gateway
-        run: |
-          set -u
-          # The client fetches each game's dictionary blob at {edge}/dict/{variant}/{version}
-          # for the local move preview. If caddy does not route /dict to the gateway the request
-          # falls to the static landing and the client silently gets a non-dawg blob. Probed
-          # unauthenticated it must be the gateway's 401 (the route reaches the gateway), never a
-          # 404/200 from the landing catch-all.
-          out="$(docker run --rm --network edge alpine:3.20 wget -S -q -O /dev/null http://scrabble/dict/scrabble_en/v1 2>&1 || true)"
-          echo "$out" | grep -E "HTTP/" || true
-          if echo "$out" | grep -q " 401"; then
-            echo "ok: /dict reaches the gateway (401 unauthenticated)"
-          else
-            echo "FAIL: /dict did not reach the gateway (expected 401) — caddy route missing?"
-            exit 1
-          fi
-
       - name: Probe the Telegram validator and bot liveness
         run: |
           set -u

.gitea/workflows/prod-deploy.yaml

@@ -40,7 +40,6 @@ jobs:
       VITE_TELEGRAM_BOT_ID: ${{ vars.PROD_VITE_TELEGRAM_BOT_ID }}
       VITE_TELEGRAM_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
       VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.PROD_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
-      VITE_VK_APP_LINK: ${{ vars.PROD_VITE_VK_APP_LINK }}
       VITE_GATEWAY_URL: ${{ vars.PROD_VITE_GATEWAY_URL }}
       POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }}
       GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
@@ -59,10 +58,10 @@ jobs:
         working-directory: deploy
         run: |
           export TAG="${{ steps.ver.outputs.tag }}" APP_VERSION="${{ steps.ver.outputs.tag }}" SCRABBLE_CONFIG_DIR=.
-          # The main-stack images via compose (reuses the build args, incl. VERSION);
+          # The four main-stack images via compose (reuses the build args, incl. VERSION);
           # the bot separately, since it is profiled out of the prod compose.
           docker compose -f docker-compose.yml -f docker-compose.prod.yml build
-          docker compose -f docker-compose.yml -f docker-compose.prod.yml push backend gateway landing validator renderer
+          docker compose -f docker-compose.yml -f docker-compose.prod.yml push backend gateway landing validator
           docker build -f ../platform/telegram/Dockerfile --target bot --build-arg VERSION="$TAG" -t "$REGISTRY/scrabble-telegram-bot:$TAG" ..
           docker push "$REGISTRY/scrabble-telegram-bot:$TAG"
 
@@ -83,17 +82,6 @@ jobs:
       GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
       GRAFANA_ADMIN_PASSWORD: ${{ secrets.PROD_GRAFANA_ADMIN_PASSWORD }}
       TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
-      GATEWAY_VK_APP_SECRET: ${{ secrets.PROD_GATEWAY_VK_APP_SECRET }}
-      # Signs the finished-game export download URLs (backend BACKEND_EXPORT_SIGN_KEY).
-      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
-      # Transactional email via the shared Selectel relay (confirm-codes).
-      SMTP_RELAY_USER: ${{ secrets.PROD_SMTP_RELAY_USER }}
-      SMTP_RELAY_PASS: ${{ secrets.PROD_SMTP_RELAY_PASS }}
-      SMTP_RELAY_HOST: ${{ vars.PROD_SMTP_RELAY_HOST }}
-      SMTP_RELAY_PORT: ${{ vars.PROD_SMTP_RELAY_PORT }}
-      SMTP_RELAY_TLS: ${{ vars.PROD_SMTP_RELAY_TLS }}
-      SMTP_RELAY_FROM: ${{ vars.PROD_SMTP_RELAY_FROM }}
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
       PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
       PROD_BOTLINK_GATEWAY_CERT: ${{ secrets.PROD_BOTLINK_GATEWAY_CERT }}
       PROD_BOTLINK_GATEWAY_KEY: ${{ secrets.PROD_BOTLINK_GATEWAY_KEY }}
@@ -148,15 +136,6 @@ jobs:
           export APP_VERSION='$TAG'
           export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
           export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
-          export GATEWAY_VK_APP_SECRET='$GATEWAY_VK_APP_SECRET'
-          export EXPORT_SIGN_KEY='$EXPORT_SIGN_KEY'
-          export SMTP_RELAY_HOST='$SMTP_RELAY_HOST'
-          export SMTP_RELAY_PORT='$SMTP_RELAY_PORT'
-          export SMTP_RELAY_TLS='$SMTP_RELAY_TLS'
-          export SMTP_RELAY_USER='$SMTP_RELAY_USER'
-          export SMTP_RELAY_PASS='$SMTP_RELAY_PASS'
-          export SMTP_RELAY_FROM='$SMTP_RELAY_FROM'
-          export PUBLIC_BASE_URL='$PUBLIC_BASE_URL'
           export GATEWAY_ABUSE_BAN_ENABLED='true'
           EOF
           printf '%s\n' "$PROD_BOTLINK_CA"           > stage/certs-main/ca.crt

CLAUDE.md

@@ -125,10 +125,9 @@ gateway/                     # module scrabble/gateway: Connect-RPC edge, embeds
 ui/                          # Svelte + Vite SPA + landing (Node project, not in go.work)
 pkg/                         # shared: telemetry, version, wire/FlatBuffers, proto, mtls
 platform/telegram/           # Telegram side-service: cmd/validator (HMAC, no VPN) + cmd/bot (Bot API; dials gateway over reverse mTLS bot-link)
-renderer/                    # image-render sidecar (Node + skia-canvas): runs ui/src/lib/gameimage.ts server-side for the finished-game PNG export
 loadtest/                    # module scrabble/loadtest: the load/stress harness
 docs/  .gitea/workflows/  CLAUDE.md  README.md
-backend/Dockerfile gateway/Dockerfile platform/telegram/Dockerfile loadtest/Dockerfile renderer/Dockerfile  # multi-stage distroless (renderer: node:22-slim + skia-canvas + fonts); gateway/Dockerfile has the `landing` target, platform/telegram/Dockerfile has `validator`+`bot` targets
+backend/Dockerfile gateway/Dockerfile platform/telegram/Dockerfile loadtest/Dockerfile  # multi-stage distroless; gateway/Dockerfile has the `landing` target, platform/telegram/Dockerfile has `validator`+`bot` targets
 deploy/                      # docker-compose (+ prod overlay + bot host) + ansible provisioning + caddy + landing + otelcol (OTLP + docker_stats) + prometheus/tempo/grafana + node_exporter + postgres_exporter; prod-deploy.sh
 ```
 
@@ -144,7 +143,6 @@ go run ./backend/cmd/backend    # /healthz, /readyz on :8080
 
 cd ui && pnpm install && pnpm check && pnpm test:unit && pnpm build  # the UI
 pnpm start                      # UI mock mode: lobby -> game, no backend
-cd renderer && pnpm install && pnpm test  # image-render sidecar (bundles ui/src/lib/gameimage.ts, skia smoke)
 
 docker build --build-arg DICT_VERSION=v1.3.0 -f backend/Dockerfile -t scrabble-backend .  # DICT_VERSION required (no default); gateway embeds the SPA
 docker build -f gateway/Dockerfile --target gateway -t scrabble-gateway .

assets/icons/README.md

@@ -1,41 +0,0 @@
-# Erudit — site icons + Open Graph card
-
-The favicon set and the `og:image` link-preview card for the public landing
-(`ui/landing.html`) and the SPA shell (`ui/index.html`). Same design language as the
-[VK loading-screen logo](../vk/README.md): the wooden Erudit «Э» tile (score `8`),
-with the wordmark on the app's dark board green (`ui/src/app.css` tokens).
-
-| Output (committed to `ui/public/`) | Purpose |
-|------|---------|
-| `favicon.svg` | Vector favicon, transparent; tile + «Э» only (the score is illegible below ~32 px). |
-| `favicon.ico` | 32×32 PNG-in-ICO fallback (also answers the browsers' blind `/favicon.ico` probe). |
-| `apple-touch-icon.png` | 180×180 opaque full-bleed tile; iOS masks its own corners. |
-| `og-image.png` | 1200×630 card: tile + «Эрудит / Скрэббл — игра в слова». Referenced absolutely as `https://erudit-game.ru/og-image.png`. |
-
-## How it works
-
-`build/extract.js` extracts the needed glyph outlines (tile glyphs + every wordmark
-character) from LiberationSans (Arial-metric, the game's font stack) with their
-advance widths into `build/glyphs.json` (committed). `build/generate.js` composes
-plain SVG from those outlines — no font is needed at generation time — writes
-`favicon.svg` and rasterises the PNG/ICO outputs by screenshotting the SVGs with the
-`ui` package's Playwright chromium (`@playwright/test`); the `.ico` container is
-assembled in-script (a single PNG entry). Raster bytes therefore depend on the
-installed chromium version; the SVG sources are deterministic.
-
-## Regenerate
-
-Requirements: Node ≥ 18, `ui` installed (`pnpm install`, provides Playwright).
-`extract.js` additionally needs `opentype.js` (`npm i opentype.js`); **`generate.js`
-needs no extra packages**.
-
-```sh
-cd assets/icons
-
-# 1. (optional) re-extract the glyphs — only if the font or the wordmark changes:
-#    default font: /usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf
-node build/extract.js [/path/to/font.ttf]      # -> build/glyphs.json
-
-# 2. regenerate everything in ui/public/:
-node build/generate.js
-```

assets/icons/build/extract.js

@@ -1,78 +0,0 @@
-'use strict';
-// Extract the glyph outlines the site icons and the og-image wordmark need from a
-// grotesque font (LiberationSans = Arial-metric, matching the game's system-ui/Arial
-// stack) and emit cubic-bezier contours per character, baseline at y=0, y-down,
-// plus the advance width so generate.js can lay out words without the font.
-// Same outline conversion as ../../vk/build/extract.js, generalised to a char set.
-const opentype = require('opentype.js');
-const fs = require('fs');
-
-const FONT = process.argv[2] || '/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf';
-const b = fs.readFileSync(FONT);
-const font = opentype.parse(b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength));
-const FS = 1000; // em scale
-
-// The tile glyphs («Э», «8») + every character of the og-image wordmark lines
-// («Эрудит», «Скрэббл — игра в слова»). The space carries only an advance.
-const CHARS = [...new Set('Э8рудитСкэббл—игра в слова')];
-
-function glyphData(ch) {
-  const g = font.charToGlyph(ch);
-  const p = g.getPath(0, 0, FS); // baseline at y=0, y-down
-  const contours = [];
-  let cur = null, prev = null;
-  for (const c of p.commands) {
-    if (c.type === 'M') {
-      if (cur) contours.push(cur);
-      cur = [{ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] }];
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'L') {
-      cur.push({ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'C') {
-      cur[cur.length - 1].o = [c.x1, c.y1];
-      cur.push({ v: [c.x, c.y], i: [c.x2, c.y2], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Q') {
-      const c1 = [prev.x + 2 / 3 * (c.x1 - prev.x), prev.y + 2 / 3 * (c.y1 - prev.y)];
-      const c2 = [c.x + 2 / 3 * (c.x1 - c.x), c.y + 2 / 3 * (c.y1 - c.y)];
-      cur[cur.length - 1].o = c1;
-      cur.push({ v: [c.x, c.y], i: c2, o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Z') {
-      if (cur && cur.length > 1) {
-        const last = cur[cur.length - 1], first = cur[0];
-        if (Math.hypot(last.v[0] - first.v[0], last.v[1] - first.v[1]) < 1e-3) {
-          first.i = last.i; // fold the duplicate closing point into the first
-          cur.pop();
-        }
-      }
-      if (cur) { contours.push(cur); cur = null; }
-    }
-  }
-  if (cur) contours.push(cur);
-
-  let minx = Infinity, miny = Infinity, maxx = -Infinity, maxy = -Infinity;
-  const out = contours.map(ct => {
-    const v = [], i = [], o = [];
-    ct.forEach(pt => {
-      v.push(pt.v);
-      i.push([pt.i[0] - pt.v[0], pt.i[1] - pt.v[1]]);
-      o.push([pt.o[0] - pt.v[0], pt.o[1] - pt.v[1]]);
-      minx = Math.min(minx, pt.v[0]); maxx = Math.max(maxx, pt.v[0]);
-      miny = Math.min(miny, pt.v[1]); maxy = Math.max(maxy, pt.v[1]);
-    });
-    return { i, o, v, c: true };
-  });
-  const bbox = out.length
-    ? { x: minx, y: miny, w: maxx - minx, h: maxy - miny }
-    : { x: 0, y: 0, w: 0, h: 0 }; // the space has no outline
-  return { adv: g.advanceWidth * (FS / font.unitsPerEm), bbox, contours: out };
-}
-
-const glyphs = {};
-for (const ch of CHARS) glyphs[ch] = glyphData(ch);
-
-const out = __dirname + '/glyphs.json';
-fs.writeFileSync(out, JSON.stringify({ em: FS, glyphs }));
-console.log('wrote', out, fs.statSync(out).size, 'bytes;', CHARS.length, 'glyphs:', CHARS.join(''));

assets/icons/build/generate.js

@@ -1,128 +0,0 @@
-'use strict';
-// Site icons + the Open Graph card for the public landing, drawn from the same
-// design as ../../vk (the wooden Erudit tile: face «Э», score «8») and the app's
-// board palette (ui/src/app.css). Everything is composed as SVG from the committed
-// glyph outlines (build/extract.js -> glyphs.json), so no font is needed at build
-// time; the PNG/ICO rasters are screenshots taken with the ui package's Playwright
-// chromium (@playwright/test re-exports the browser API). Outputs go straight to
-// ui/public/:
-//   favicon.svg          96 viewBox, transparent, tile + «Э» (the score is illegible small)
-//   favicon.ico          32x32 PNG-in-ICO render of the same
-//   apple-touch-icon.png 180x180 opaque full-bleed tile (iOS masks its own corners)
-//   og-image.png         1200x630 card: tile + wordmark on the board green
-const fs = require('fs');
-const path = require('path');
-
-const G = JSON.parse(fs.readFileSync(path.join(__dirname, 'glyphs.json'), 'utf8'));
-const UI = path.resolve(__dirname, '../../../ui');
-const OUT = path.join(UI, 'public');
-
-// ---- palette (vk loader tile + app.css board tokens) ------------------------
-const FACE = '#D9B978', BORDER = '#B49559', GLYPH = '#1A1A1A';
-const BOARD_DARK = '#2a3330', TEXT = '#e7ece8', TEXT_MUTED = '#cdd6cf';
-
-// ---- glyph outlines -> SVG path data ----------------------------------------
-const r2 = n => Math.round(n * 100) / 100;
-// pathD renders one glyph's contours scaled by sc and translated by (tx, ty).
-function pathD(g, sc, tx, ty) {
-  const pt = (v, d) => `${r2(v[0] * sc + tx + d[0] * sc)} ${r2(v[1] * sc + ty + d[1] * sc)}`;
-  const Z = [0, 0];
-  return g.contours.map(ct => {
-    const n = ct.v.length;
-    let d = `M${pt(ct.v[0], Z)}`;
-    for (let k = 1; k <= n; k++) {
-      const a = k - 1, b = k % n;
-      d += `C${pt(ct.v[a], ct.o[a])} ${pt(ct.v[b], ct.i[b])} ${pt(ct.v[b], Z)}`;
-    }
-    return d + 'Z';
-  }).join('');
-}
-// glyphAt centres a glyph's bbox at (cx, cy) with the given pixel cap height, the
-// same placement rule as the vk loader's glyph(). stroke fattens it slightly.
-function glyphAt(ch, capPx, cx, cy, stroke, colour) {
-  const g = G.glyphs[ch], sc = capPx / g.bbox.h;
-  const d = pathD(g, sc, cx - (g.bbox.x + g.bbox.w / 2) * sc, cy - (g.bbox.y + g.bbox.h / 2) * sc);
-  return `<path d="${d}" fill="${colour}" stroke="${colour}" stroke-width="${r2(stroke)}"/>`;
-}
-// textLine lays out a string on a baseline from the per-glyph advances; capPx sets
-// the capital height (measured on «Э»). Returns the combined path + the width.
-function textLine(str, capPx, x, y, colour) {
-  const sc = capPx / G.glyphs['Э'].bbox.h;
-  let d = '', w = 0;
-  for (const ch of str) {
-    const g = G.glyphs[ch];
-    if (g.contours.length) d += pathD(g, sc, x + w, y);
-    w += g.adv * sc;
-  }
-  return { svg: `<path d="${d}" fill="${colour}"/>`, width: w };
-}
-// tile draws the rounded wooden tile centred at (cx, cy): size px wide/high, with
-// the vk loader's corner (6/52) and rim proportions, «Э» and optionally the «8».
-function tile(cx, cy, size, withScore) {
-  const h = size / 2, rx = size * (6 / 52), rim = size * (1.8 / 52);
-  let s = `<rect x="${r2(cx - h + rim / 2)}" y="${r2(cy - h + rim / 2)}" width="${r2(size - rim)}" height="${r2(size - rim)}" rx="${r2(rx)}" fill="${FACE}" stroke="${BORDER}" stroke-width="${r2(rim)}"/>`;
-  s += glyphAt('Э', size * (32 / 52), cx, cy - size * (1 / 52), size * (1 / 52), GLYPH);
-  if (withScore) s += glyphAt('8', size * (8.5 / 52), cx + size * (19.5 / 52), cy + size * (18.5 / 52), size * (0.5 / 52), GLYPH);
-  return s;
-}
-const svg = (w, h, body) => `<svg xmlns="http://www.w3.org/2000/svg" width="${w}" height="${h}" viewBox="0 0 ${w} ${h}">${body}</svg>`;
-
-// ---- favicon.svg (the committed vector master) -------------------------------
-const favicon = svg(96, 96, tile(48, 48, 88, false)) + '\n';
-
-// ---- apple-touch-icon: opaque full bleed, iOS applies its own corner mask ----
-const appleTouch = svg(180, 180,
-  `<rect width="180" height="180" fill="${FACE}"/>` +
-  `<rect x="8" y="8" width="164" height="164" rx="18" fill="none" stroke="${BORDER}" stroke-width="4"/>` +
-  glyphAt('Э', 100, 90, 88, 3, GLYPH) +
-  glyphAt('8', 26, 146, 142, 1.5, GLYPH));
-
-// ---- og-image: tile + wordmark, centred as one group on the board green ------
-function ogImage() {
-  const W = 1200, H = 630, tileSize = 340, gap = 84;
-  const l1 = textLine('Эрудит', 112, 0, 0, TEXT);
-  const l2 = textLine('Скрэббл — игра в слова', 44, 0, 0, TEXT_MUTED);
-  const textW = Math.max(l1.width, l2.width);
-  const left = (W - (tileSize + gap + textW)) / 2;
-  const tx = left + tileSize + gap;
-  // Two baselines around the vertical centre; the tile centre sits between them.
-  const b1 = 295, b2 = 408;
-  const body =
-    `<rect width="${W}" height="${H}" fill="${BOARD_DARK}"/>` +
-    tile(left + tileSize / 2, H / 2, tileSize, true) +
-    textLine('Эрудит', 112, tx, b1, TEXT).svg +
-    textLine('Скрэббл — игра в слова', 44, tx, b2, TEXT_MUTED).svg;
-  console.log(`og-image: text ${Math.round(textW)}px wide, group left ${Math.round(left)}px`);
-  return svg(W, H, body);
-}
-
-// ---- rasterisation (Playwright chromium from ui/node_modules) ----------------
-async function shoot(page, markup, w, h, transparent) {
-  await page.setViewportSize({ width: w, height: h });
-  await page.setContent(`<body style="margin:0">${markup}</body>`);
-  return page.screenshot({ omitBackground: transparent });
-}
-// icoFromPNG wraps one PNG as a single-entry .ico (ICONDIR + ICONDIRENTRY + PNG).
-function icoFromPNG(png, sizePx) {
-  const h = Buffer.alloc(22);
-  h.writeUInt16LE(0, 0); h.writeUInt16LE(1, 2); h.writeUInt16LE(1, 4); // icon, 1 image
-  h.writeUInt8(sizePx, 6); h.writeUInt8(sizePx, 7);                    // 32x32
-  h.writeUInt16LE(1, 10); h.writeUInt16LE(32, 12);                     // planes, 32bpp
-  h.writeUInt32LE(png.length, 14); h.writeUInt32LE(22, 18);            // size, offset
-  return Buffer.concat([h, png]);
-}
-
-(async () => {
-  fs.writeFileSync(path.join(OUT, 'favicon.svg'), favicon);
-  const { chromium } = require(path.join(UI, 'node_modules', '@playwright/test'));
-  const browser = await chromium.launch();
-  const page = await browser.newPage();
-  const fav32 = await shoot(page, svg(32, 32, tile(16, 16, 29.33, false)), 32, 32, true);
-  fs.writeFileSync(path.join(OUT, 'favicon.ico'), icoFromPNG(fav32, 32));
-  fs.writeFileSync(path.join(OUT, 'apple-touch-icon.png'), await shoot(page, appleTouch, 180, 180, false));
-  fs.writeFileSync(path.join(OUT, 'og-image.png'), await shoot(page, ogImage(), 1200, 630, false));
-  await browser.close();
-  for (const f of ['favicon.svg', 'favicon.ico', 'apple-touch-icon.png', 'og-image.png']) {
-    console.log('wrote', path.join(OUT, f), fs.statSync(path.join(OUT, f)).size, 'bytes');
-  }
-})();

assets/vk/README.md

@@ -1,115 +0,0 @@
-# Erudit — VK loading-screen logo (Lottie)
-
-Animated logo for the **VK app loading screen** (shown before the SPA assets load).
-The Erudit «Э» tile (score `8`) **drops in under gravity, lands with a soft squash —
-its left/right edges bulging into a cushion — then springs back up**, looping. A light
-"glint" is caught at the moment of the bounce.
-
-| File | Purpose |
-|------|---------|
-| `erudit-loader.json` | The Lottie to upload to VK. |
-| `erudit-loader-preview.gif` | Looping preview. Rendered on a green "baize" background **only in the preview** — the real asset has a **transparent** background. |
-| `build/` | The reproducible build pipeline (see *Regenerate*). |
-
-**VK requirements met:** 96×96 px · vector Lottie JSON · ≤ 24 KB (~11 KB) · seamless
-~1.1 s loop · transparent background.
-
-Design reference: a photo of the physical wooden Erudit tile.
-
----
-
-## How it works
-
-A single flat layer holds the tile — a rounded-rect **face path**, the two glyphs, and
-a thin border — and everything is driven by that layer's transform plus a few colour /
-shape tracks. The anchor sits on the tile's **bottom edge**, so the squash happens
-against the floor.
-
-### Bounce (gravity)
-`position.y` of the bottom edge goes apex → floor → apex with **no dwell** (the apex is
-an instantaneous turn-around). The fall uses a strong **ease-in** (accelerate) and the
-rise a strong **ease-out** (decelerate), so it reads as real gravity. While falling fast
-the tile slightly **stretches** (tall+thin); that is the squash-and-stretch setup.
-
-### Soft cushion (squash)
-On contact the layer **squashes** (scaleY↓, scaleX↑) about the bottom anchor, with a
-touch of skew. Crucially the squash/cushion is **decoupled from the fall speed** — it
-eases in and out *slowly* (`ES`), so the landing feels soft even though the fall is
-fast. The squash is deliberately gentle (≈ 86 % / 112 %).
-
-### The cushion shape (the hard part)
-The face is **not** a plain rounded rect — it is a path whose left/right contour bows
-out into a convex cushion on impact:
-- the rest rounded-rect outline is sampled (fine corner arcs + edge mids), and on impact
-  every point is pushed outward by a smooth **barrel** profile `f(y) = b·(1 − (y/HH)²)`
-  (max at the middle, fading to zero at the top/bottom);
-- so the **whole side — corners included — bows out as one piece**, never just the
-  straight middle;
-- bezier handles are computed as a **chordal spline** (handle length ∝ the adjacent
-  chord), which stays smooth across the uneven corner/edge point spacing. This is what
-  keeps the corner↔cushion junction kink-free — both at rest and fully bulged — which a
-  naïve uniform Catmull-Rom (or moving discrete points with fixed tangents) does not.
-
-### Glint
-At the bounce the face flashes a little lighter (`FACE_GLINT`) and the glyphs warm
-toward brown-red (`BLACK_LIT`), then settle back. A cheap, warm "catch the light".
-
-### Border & background
-The tile carries a thin static **border** a touch darker than the face (`BORDER`) so it
-reads on any background. The **green baize background is added only when rendering the
-preview GIF** — the Lottie itself is transparent.
-
-### Player compatibility
-Only plain 2-D shapes (`ddd:0`) — no 3-D layers, expressions or effects — so every
-Lottie player (lottie-web on the web, rlottie on native) renders it identically.
-
----
-
-## Glyphs
-
-`Э` (U+042D) and `8` are **real outlines from LiberationSans-Regular** — metric-
-compatible with Arial, matching the game's `--font: system-ui … Arial` stack
-(see `ui/src/app.css`). `build/extract.js` pulls the contours into `build/glyphs.json`
-as Lottie cubic paths; a hair of same-colour stroke adds a touch of weight.
-
----
-
-## Regenerate
-
-Requirements: Node ≥ 18. `extract.js` additionally needs `opentype.js`
-(`npm i opentype.js`); **`generate.js` has no dependencies**.
-
-```sh
-cd assets/vk
-
-# 1. (optional) re-extract the glyphs — only if you change the font:
-#    default font: /usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf
-node build/extract.js [/path/to/font.ttf]      # -> build/glyphs.json
-
-# 2. build the animation (reads build/glyphs.json):
-node build/generate.js erudit-loader.json      # -> erudit-loader.json
-
-# 3. (optional) live preview — needs lottie-web (npm i lottie-web):
-node build/build-preview.js erudit-loader.json preview.html
-#    then open preview.html in a browser.
-```
-
-The preview GIF is assembled by rendering the Lottie frame-by-frame (lottie-web canvas,
-filled with the green baize) and stitching with `ffmpeg`; the live HTML preview is the
-quickest way to eyeball changes.
-
-## Tunables (top of `build/generate.js`)
-
-| Symbol | Meaning |
-|--------|---------|
-| `OP`, `FR` | loop length (frames) / fps — overall speed |
-| `T_HIT / T_PEAK / T_LIFT / T_REC` | beats: contact / squash peak / lift-off / cushion recovered |
-| `EI / EO / ES` | easings: fast fall / fast rise / slow soft cushion |
-| `APEX`, `FLOOR` | bottom-edge screen-y at the top of the bounce / at rest |
-| `HW`, `HH`, `CR` | tile half-width / half-height / corner radius |
-| `scl` squash values | the squash amount (scaleX↑ / scaleY↓) |
-| `bulge` `b` | cushion depth (how far the sides bow out) |
-| `FACE / FACE_GLINT` | wood face / glint flash |
-| `BORDER` | tile rim colour |
-| `BLACK / BLACK_LIT` | glyph / glyph-at-glint (brown-red) |
-| preview bg `#3C7858` | the green-baize colour used **only** in the GIF |

assets/vk/build/build-preview.js

@@ -1,31 +0,0 @@
-'use strict';
-const fs = require('fs');
-const data = fs.readFileSync(process.argv[2] || 'erudit.json', 'utf8');
-const lottiePath = __dirname + '/node_modules/lottie-web/build/player/lottie.min.js';
-const html = `<!doctype html><html><head><meta charset="utf8"><style>
-body{margin:0;background:#2b2b2b;font-family:sans-serif;color:#ccc}
-.row{display:flex;gap:18px;padding:18px;align-items:flex-end;flex-wrap:wrap}
-.cell{text-align:center}
-.chk{background-image:linear-gradient(45deg,#8a8a8a 25%,transparent 25%),linear-gradient(-45deg,#8a8a8a 25%,transparent 25%),linear-gradient(45deg,transparent 75%,#8a8a8a 75%),linear-gradient(-45deg,transparent 75%,#8a8a8a 75%);background-size:16px 16px;background-position:0 0,0 8px,8px -8px,-8px 0;background-color:#b5b5b5}
-.s96{width:96px;height:96px}.big{width:336px;height:336px}small{font-size:11px}
-</style></head><body><div class="row" id="row"></div>
-<script src="./lottie.min.js"></script>
-<script>
-const animationData=${data};window.AD=animationData;
-const row=document.getElementById('row');window.anims=[];
-function make(cls,frame,label){
-  const cell=document.createElement('div');cell.className='cell';
-  const box=document.createElement('div');box.className='chk '+cls;cell.appendChild(box);
-  cell.appendChild(document.createElement('br'));
-  const cap=document.createElement('small');cap.textContent=label;cell.appendChild(cap);
-  row.appendChild(cell);
-  const a=lottie.loadAnimation({container:box,renderer:'svg',loop:false,autoplay:false,animationData:JSON.parse(JSON.stringify(animationData))});
-  a.addEventListener('DOMLoaded',()=>a.goToAndStop(frame,true));
-  window.anims.push(a);
-}
-[0,22,45,68].forEach(f=>make('s96',f,'f'+f));
-make('big',22,'f22 x3.5');
-window.__ready=true;
-</script></body></html>`;
-fs.writeFileSync(process.argv[3] || 'preview.html', html);
-console.log('wrote', process.argv[3] || 'preview.html');

assets/vk/build/extract.js

@@ -1,67 +0,0 @@
-'use strict';
-// Extract the Cyrillic "Э" (U+042D) and the digit "8" outlines from a grotesque
-// font (LiberationSans = Arial-metric, matching the game's system-ui/Arial stack)
-// and emit Lottie cubic-bezier contours, centred at the origin, y-down.
-const opentype = require('opentype.js');
-const fs = require('fs');
-
-const FONT = process.argv[2] || '/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf';
-const b = fs.readFileSync(FONT);
-const font = opentype.parse(b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength));
-const FS = 1000; // em scale
-
-function glyphContours(ch) {
-  const p = font.charToGlyph(ch).getPath(0, 0, FS); // baseline at y=0, y-down
-  const contours = [];
-  let cur = null, prev = null;
-  for (const c of p.commands) {
-    if (c.type === 'M') {
-      if (cur) contours.push(cur);
-      cur = [{ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] }];
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'L') {
-      cur.push({ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'C') {
-      cur[cur.length - 1].o = [c.x1, c.y1];
-      cur.push({ v: [c.x, c.y], i: [c.x2, c.y2], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Q') {
-      const c1 = [prev.x + 2 / 3 * (c.x1 - prev.x), prev.y + 2 / 3 * (c.y1 - prev.y)];
-      const c2 = [c.x + 2 / 3 * (c.x1 - c.x), c.y + 2 / 3 * (c.y1 - c.y)];
-      cur[cur.length - 1].o = c1;
-      cur.push({ v: [c.x, c.y], i: c2, o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Z') {
-      if (cur && cur.length > 1) {
-        const last = cur[cur.length - 1], first = cur[0];
-        if (Math.hypot(last.v[0] - first.v[0], last.v[1] - first.v[1]) < 1e-3) {
-          first.i = last.i;            // fold the duplicate closing point into the first
-          cur.pop();
-        }
-      }
-      if (cur) { contours.push(cur); cur = null; }
-    }
-  }
-  if (cur) contours.push(cur);
-
-  let minx = Infinity, miny = Infinity, maxx = -Infinity, maxy = -Infinity;
-  const out = contours.map(ct => {
-    const v = [], i = [], o = [];
-    ct.forEach(pt => {
-      v.push(pt.v);
-      i.push([pt.i[0] - pt.v[0], pt.i[1] - pt.v[1]]);
-      o.push([pt.o[0] - pt.v[0], pt.o[1] - pt.v[1]]);
-      minx = Math.min(minx, pt.v[0]); maxx = Math.max(maxx, pt.v[0]);
-      miny = Math.min(miny, pt.v[1]); maxy = Math.max(maxy, pt.v[1]);
-    });
-    return { i, o, v, c: true };
-  });
-  return { contours: out, bbox: { x: minx, y: miny, w: maxx - minx, h: maxy - miny } };
-}
-
-const E = glyphContours('Э');
-const D8 = glyphContours('8');
-fs.writeFileSync('glyphs.json', JSON.stringify({ em: FS, E, D8 }));
-console.log('Э bbox', E.bbox, 'contours', E.contours.map(c => c.v.length));
-console.log('8 bbox', D8.bbox, 'contours', D8.contours.map(c => c.v.length));

assets/vk/build/generate.js

@@ -1,153 +0,0 @@
-'use strict';
-// VK preloader Lottie: a flat wooden Erudit tile ("Э" + score "8") that drops in
-// under gravity, squashes on impact (convex cushion bulging out the left/right edges
-// + a touch of skew), and springs back up — looping. A light "glint" is caught at the
-// moment of the bounce. Pure 2D shapes (ddd:0). Glyphs are real LiberationSans
-// outlines (Arial-metric, = the game's font stack); see extract.js -> glyphs.json.
-const fs = require('fs');
-const G = JSON.parse(fs.readFileSync(__dirname + '/glyphs.json', 'utf8'));
-
-// ---- canvas / timing -------------------------------------------------------
-const W = 96, H = 96, cx = 48;
-const FR = 30, OP = 34;                      // ~1.13 s loop (dynamic, 25% faster)
-// keyframe beats (frames): fast fall -> soft squash -> lift -> fast rise -> apex (no dwell)
-const T_HIT = 13, T_PEAK = 18, T_LIFT = 19, T_REC = 28;
-
-// ---- geometry --------------------------------------------------------------
-const HW = 26, HH = 26, CR = 6;              // tile half-width / half-height / corner radius
-const FLOOR = 90, APEX = 60;                 // bottom-centre screen-y at rest / at the top of the bounce
-
-// ---- palette ---------------------------------------------------------------
-const col = h => [parseInt(h.slice(1,3),16)/255, parseInt(h.slice(3,5),16)/255, parseInt(h.slice(5,7),16)/255];
-const FACE = col('#D9B978');                 // wood face (flat)
-const FACE_GLINT = col('#E7CD95');           // face flash caught on impact (gentle, not blinding)
-const BORDER = col('#B49559');               // tile rim: a touch darker than the face, reads on any bg
-const BLACK = col('#1A1A1A');
-const BLACK_LIT = col('#421A0B');            // glyph warms to brown-red on the glint
-const lerp = (a, b, t) => a.map((v, i) => v + (b[i] - v) * t);
-
-// ---- property / easing helpers ---------------------------------------------
-const still = v => ({ a: 0, k: v });
-const EI = { o: { x: [0.82], y: [0] }, i: { x: [1], y: [1] } };  // strong accelerate (gravity fall)
-const EO = { o: { x: [0], y: [0] }, i: { x: [0.18], y: [1] } };  // strong decelerate (rise to apex)
-const ES = { o: { x: [0.42], y: [0] }, i: { x: [0.58], y: [1] } }; // soft/slow (the cushion)
-function anim(samples) {                      // samples: {t, v, e?} ; e = easing toward the NEXT key
-  return { a: 1, k: samples.map((s, idx) => {
-    const kf = { t: s.t, s: s.v };
-    if (idx < samples.length - 1) { const e = s.e || ES; kf.o = e.o; kf.i = e.i; }
-    return kf;
-  }) };
-}
-const animColor = s => anim(s.map(x => ({ t: x.t, v: [...x.v, 1], e: x.e })));
-
-// ---- shape helpers ---------------------------------------------------------
-const tr = () => ({ ty: 'tr', p: still([0,0]), a: still([0,0]), s: still([100,100]), r: still(0), o: still(100) });
-const grp = (items, nm) => ({ ty: 'gr', it: [...items, tr()], nm });
-const fill = c => ({ ty: 'fl', c, o: still(100), r: 1, bm: 0 });
-const stroke = (c,w) => ({ ty: 'st', c: still(c), o: still(100), w: still(w), lc: 2, lj: 2, ml: 4, bm: 0 });
-function glyph(gd, hpx, px, py, bold, colour, nm) {  // font glyph -> filled+stroked group
-  const sc = hpx / gd.bbox.h;
-  const bcx = gd.bbox.x + gd.bbox.w / 2, bcy = gd.bbox.y + gd.bbox.h / 2;
-  const shapes = gd.contours.map(ct => ({
-    ty: 'sh', d: 1, ks: still({
-      i: ct.i.map(p => [p[0]*sc, p[1]*sc]), o: ct.o.map(p => [p[0]*sc, p[1]*sc]),
-      v: ct.v.map(p => [(p[0]-bcx)*sc + px, (p[1]-bcy)*sc + py]), c: true,
-    }),
-  }));
-  return grp([...shapes, fill(colour), stroke(BLACK, bold)], nm);
-}
-
-// Sample the rest rounded-rect outline (clockwise): fine corner arcs + one mid point
-// per straight edge, so a smooth interpolant reproduces it cleanly.
-function arc(ccx, ccy, a0, a1, n) {
-  const out = [];
-  for (let i = 0; i < n; i++) { const a = (a0 + (a1 - a0) * i / (n - 1)) * Math.PI / 180; out.push([ccx + CR*Math.cos(a), ccy + CR*Math.sin(a)]); }
-  return out;
-}
-const REST = (() => {
-  const NC = 7, yi = HH - CR, xi = HW - CR;
-  const C = [ arc(xi,-yi,-90,0,NC), arc(xi,yi,0,90,NC), arc(-xi,yi,90,180,NC), arc(-xi,-yi,180,270,NC) ];
-  const pts = [];
-  for (let k = 0; k < 4; k++) {
-    pts.push(...C[k]);
-    const a = C[k][NC-1], b = C[(k+1)%4][0];
-    pts.push([(a[0]+b[0])/2, (a[1]+b[1])/2]);   // straight-edge mid point (keeps the edge straight)
-  }
-  return pts;
-})();
-// The whole left/right contour (corners + side) bows out by one smooth barrel profile;
-// Catmull-Rom tangents (from neighbours) make every junction C1-smooth -> no kink, the
-// corners follow the cushion and the cushion melts into the corners, bulged or not.
-function facePath(b) {
-  const f = y => b * (1 - (y/HH) * (y/HH));                       // 0 at top/bottom, max at the middle
-  const V = REST.map(([x, y]) => [x + Math.sign(x) * f(y), y]);   // push the sides out, top/bottom stay
-  const n = V.length, I = [], O = [];
-  for (let k = 0; k < n; k++) {
-    const p0 = V[(k-1+n)%n], p1 = V[k], p2 = V[(k+1)%n];
-    let dx = p2[0]-p0[0], dy = p2[1]-p0[1];                       // tangent direction (neighbours)
-    const dl = Math.hypot(dx, dy) || 1; dx /= dl; dy /= dl;
-    const ln = Math.hypot(p2[0]-p1[0], p2[1]-p1[1]) / 3;          // handles ~ 1/3 of the adjacent chord
-    const lp = Math.hypot(p1[0]-p0[0], p1[1]-p0[1]) / 3;          // -> chordal spline, no overshoot/facets
-    O.push([dx*ln, dy*ln]); I.push([-dx*lp, -dy*lp]);
-  }
-  return { i: I, o: O, v: V, c: true };
-}
-const facePathKeys = samples => ({ a: 1, k: samples.map((s, idx) => {
-  const kf = { t: s.t, s: [facePath(s.b)] };
-  if (idx < samples.length - 1) { const e = s.e || ES; kf.o = e.o; kf.i = e.i; }
-  return kf;
-}) });
-
-// ---- animation tracks ------------------------------------------------------
-// bottom-centre screen-y (the tile rests/squashes on its bottom edge)
-const posY = anim([
-  { t: 0,      v: [cx, APEX, 0],  e: EI },           // apex -> immediately falls (no dwell)
-  { t: T_HIT,  v: [cx, FLOOR, 0], e: ES },           // FAST fall (accelerate) -> floor
-  { t: T_LIFT, v: [cx, FLOOR, 0], e: EO },           // sit on the floor while the cushion absorbs
-  { t: OP,     v: [cx, APEX, 0] },                   // FAST rise (decelerate) -> apex = loop start
-]);
-// scale about the bottom anchor: stretch while falling, gentle/slow cushion squash on impact
-const scl = anim([
-  { t: 0,        v: [100, 100, 100], e: ES },
-  { t: T_HIT-5,  v: [95, 106, 100], e: ES },         // stretch while falling fast
-  { t: T_HIT,    v: [104, 95, 100], e: ES },         // touch down
-  { t: T_PEAK,   v: [112, 86, 100], e: ES },         // soft squash peak (gentler, less plче)
-  { t: T_REC,    v: [100, 100, 100], e: ES },        // slow cushion release -> soft landing
-  { t: OP,       v: [100, 100, 100] },
-]);
-// a touch of skew through the squash (organic deform), back to 0
-const skw = anim([
-  { t: T_HIT, v: [0], e: ES }, { t: T_PEAK, v: [4], e: ES }, { t: T_REC, v: [0] }, { t: OP, v: [0] },
-]);
-// left/right cushion bulge: 0 -> gentle peak -> 0 (never inward)
-const bulge = facePathKeys([
-  { t: T_HIT, b: 0, e: ES }, { t: T_PEAK, b: 4, e: ES }, { t: T_REC, b: 0 }, { t: OP, b: 0 },
-]);
-// glint: face + glyph catch the light at the bounce
-const faceCol = animColor([
-  { t: T_HIT-2, v: FACE, e: ES }, { t: T_PEAK, v: FACE_GLINT, e: ES }, { t: T_REC, v: FACE }, { t: OP, v: FACE },
-]);
-const glyphCol = animColor([
-  { t: T_HIT-2, v: BLACK, e: ES }, { t: T_PEAK, v: BLACK_LIT, e: ES }, { t: T_REC, v: BLACK }, { t: OP, v: BLACK },
-]);
-
-// ---- layer (face + glyphs share the bounce/squash transform) ---------------
-const faceShape = grp([ { ty: 'sh', d: 1, ks: bulge }, fill(faceCol), stroke(BORDER, 1.8) ], 'face');
-const glyphE = glyph(G.E,  32, 0, -1, 1.0, glyphCol, 'E');                 // centred Э
-const glyph8 = glyph(G.D8, 8.5, HW-6.5, HH-7.5, 0.5, glyphCol, 'score');   // 8 in the corner
-
-const tile = {
-  ddd: 0, ind: 1, ty: 4, nm: 'tile', sr: 1,
-  ks: { o: still(100), r: still(0), p: posY, a: still([0, HH, 0]), s: scl, sk: skw, sa: still(0) },
-  ao: 0, shapes: [ glyph8, glyphE, faceShape ], ip: 0, op: OP, st: 0, bm: 0,
-};
-
-const root = {
-  v: '5.7.4', fr: FR, ip: 0, op: OP, w: W, h: H, nm: 'erudit-vk-loader', ddd: 0,
-  assets: [], layers: [ tile ], markers: [],
-};
-
-const out = process.argv[2] || 'erudit.json';
-const round = (k, v) => (typeof v === 'number' ? Math.round(v * 100) / 100 : v);
-fs.writeFileSync(out, JSON.stringify(root, round));
-console.log('wrote', out, fs.statSync(out).size, 'bytes');

backend/README.md

@@ -43,10 +43,8 @@ per-user blocks, and per-game chat with nudges folded in as a message kind; chat
 messages are length-capped, content-filtered (no links/emails/phone numbers,
 including obfuscated forms) and stored with the sender's IP. Each message carries an
 `unread_seats` read bitmask (a set bit per recipient seat still to read it); `MarkRead`
-clears a reader's bit when they open the move history or chat, a wired `NudgeClearer`
+clears a reader's bit when they open the move history or chat, and a wired `NudgeClearer`
-clears a nudge when its recipient moves, and a wired `NudgeExpirer` clears **all** of a game's
+clears a nudge when its recipient moves — both record the publish-to-read latency.
-nudges when it finishes (any completion path) — the first two record the publish-to-read latency,
-the completion expiry does not (it is not a read); chat messages stay unread on completion.
 A friend request (or block) aimed at a **disguised pooled robot** is recorded per game+seat
 in `robot_friend_requests` / `robot_blocks`, never against the shared robot account; a
 background reaper drops a robot friend request once its game has been finished for **7 days**.
@@ -214,13 +212,11 @@ internal/banview/    # gateway active-ban mirror: the console's Active IP bans p
 | `BACKEND_LOBBY_ROBOT_WAIT` | `10s` | Auto-match wait before a robot is substituted for a missing human. |
 | `BACKEND_LOBBY_REAPER_INTERVAL` | `1s` | How often the substitution reaper scans for over-waited players. |
 | `BACKEND_ROBOT_DRIVE_INTERVAL` | `30s` | How often the robot driver scans for due robot turns. |
-| `BACKEND_SMTP_HOST` | — | Confirm-code relay host. **Empty selects the development log mailer** (the code is logged, not sent). |
+| `BACKEND_SMTP_HOST` | — | Email relay host. **Empty selects the development log mailer** (the confirm-code is logged, not sent). |
-| `BACKEND_SMTP_PORT` | `587` | Relay port. No client certificate is needed (the server cert is validated against the system roots). |
+| `BACKEND_SMTP_PORT` | `587` | Email relay port. |
-| `BACKEND_SMTP_TLS` | — | Transport security: `ssl` (implicit TLS from connect) or `starttls`. Empty derives it from the port (implicit on `465`, STARTTLS otherwise); set it for a relay on a non-standard port (e.g. Selectel's `1127` = SSL, `1126` = STARTTLS). |
+| `BACKEND_SMTP_USERNAME` | — | SMTP user; empty relays without authentication. |
-| `BACKEND_SMTP_USERNAME` | — | SMTP AUTH user; empty relays without authentication. |
+| `BACKEND_SMTP_PASSWORD` | — | SMTP password. |
-| `BACKEND_SMTP_PASSWORD` | — | SMTP AUTH password. |
+| `BACKEND_SMTP_FROM` | `no-reply@localhost` | Envelope/From address for confirm-codes. |
-| `BACKEND_SMTP_FROM` | `no-reply@localhost` | From address. A deployed contour must use the prod domain (the relay only accepts its verified sender domain). |
-| `BACKEND_PUBLIC_BASE_URL` | — | Canonical public origin (scheme + host) for links in the email. **Required when `BACKEND_SMTP_HOST` is set.** Never derived from a request Host header (anti-injection). |
 | `BACKEND_CONNECTOR_ADDR` | — | the gateway bot-link relay gRPC address for admin-console operator broadcasts. Empty disables broadcasts. |
 | `BACKEND_GUEST_REAP_INTERVAL` | `1h` | How often the abandoned-guest reaper sweeps. |
 | `BACKEND_GUEST_RETENTION` | `720h` | Account age past which a guest with no game seat is deleted. |

backend/cmd/backend/main.go

@@ -33,7 +33,6 @@ import (
 	"scrabble/backend/internal/postgres"
 	"scrabble/backend/internal/pushgrpc"
 	"scrabble/backend/internal/ratewatch"
-	"scrabble/backend/internal/render"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/server"
 	"scrabble/backend/internal/session"
@@ -162,15 +161,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		zap.Duration("interval", cfg.GuestReapInterval),
 		zap.Duration("retention", cfg.GuestRetention))
 
-	// Purge the account-deletion legal dossier past its retention TTL: the
-	// retained-identities journal, and the feedback thread + dossier PII of long-deleted
-	// accounts (chat is kept). Checked daily; the TTL is a two-year policy constant.
-	retentionReaper := account.NewRetentionReaper(accounts, account.RetentionTTL, logger)
-	go retentionReaper.Run(ctx, 24*time.Hour)
-	logger.Info("retention reaper started",
-		zap.Duration("interval", 24*time.Hour),
-		zap.Duration("retention", account.RetentionTTL))
-
 	// Re-evaluate moderated-chat write access when a temporary block self-expires:
 	// no operator action fires then, so the sweeper emits the chat-access-changed
 	// event for lapsed blocks and the gateway re-pushes the chat-gate command.
@@ -183,20 +173,15 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	// Lobby & social domains. Their REST and stream surface lives in the gateway,
 	// so they are handed to the server (like the route groups) for the handlers.
 	mailer := newMailer(cfg.SMTP, logger)
-	emails := account.NewEmailService(accounts, mailer, cfg.PublicBaseURL)
+	emails := account.NewEmailService(accounts, mailer)
-	// Throttle confirm-code sends per recipient: at most one per minute and five per
-	// rolling hour, guarding against email bombing and the relay's own quota.
-	emails.SetSendLimiter(account.NewSendLimiter(time.Minute, 5))
 	// Account linking & merge: the orchestrator over the account, merge and
 	// session layers. Wired to the /api/v1/user/link REST surface below.
 	links := link.NewService(emails, accounts, accountmerge.NewMerger(db), sessions)
 	socialSvc := social.NewService(social.NewStore(db), accounts, games)
 	socialSvc.SetNotifier(hub)
 	socialSvc.SetMetrics(tel.MeterProvider().Meter("scrabble/backend/social"))
-	// A nudge the recipient answered by moving is marked read on the move path; every nudge in a
+	// A nudge the recipient answered by moving is marked read on the move path.
-	// game is marked read when the game finishes (a stale badge), on any completion path.
 	games.SetNudgeClearer(socialSvc.ClearNudges)
-	games.SetNudgeExpirer(socialSvc.ExpireNudges)
 	// Reap per-game disguised-robot friend requests once their game is long finished
 	// (the robot ignores them; the row only pins the in-game "request sent" state).
 	robotReqReaper := social.NewRobotFriendRequestReaper(socialSvc, logger)
@@ -245,13 +230,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	// block and the banner admin console section.
 	adsSvc := ads.NewService(ads.NewStore(db))
 
-	// The image-render sidecar client for the PNG export artifact; nil (PNG
-	// download answers 404) when BACKEND_RENDERER_URL is unset.
-	var renderer *render.Client
-	if cfg.RendererURL != "" {
-		renderer = render.New(cfg.RendererURL)
-	}
-
 	srv := server.New(cfg.HTTPAddr, server.Deps{
 		Logger:        logger,
 		DB:            db,
@@ -273,8 +251,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		BanView:       banView,
 		Ads:           adsSvc,
 		Notifier:      hub,
-		ExportSignKey: cfg.ExportSignKey,
-		Renderer:      renderer,
 	})
 	pushSrv := pushgrpc.NewServer(cfg.GRPCAddr, hub, logger)
 

backend/cmd/dictgen/main.go

@@ -1,193 +0,0 @@
-// Command dictgen dumps golden parity vectors from the committed dawg
-// dictionaries so the TypeScript dawg reader can be checked byte-for-byte
-// against the authoritative Go dafsa reader.
-//
-// For each *.dawg file it writes, into the output directory:
-//
-//   - <name>.words.bin — every stored word as alphabet-index bytes, in index
-//     order, framed as [1-byte length][length index bytes]. The word at stream
-//     position k has IndexOfB == k.
-//   - <name>.neg.bin — negative lookups (sequences whose IndexOfB is -1), same
-//     framing, to exercise the not-found path at varying depths.
-//   - <name>.meta.json — NumAdded/NumNodes/NumEdges plus the alphabet size, for
-//     a header-parse sanity cross-check on the TS side.
-//
-// It is a development tool (not built into any service), analogous to
-// cmd/jetgen. Run it from the repository root:
-//
-//	go run ./backend/cmd/dictgen -dawg-dir ../scrabble-solver/dawg -out <dir>
-package main
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"math/rand"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-
-	dawg "github.com/iliadenisov/dafsa"
-)
-
-// meta is the per-dictionary sanity payload cross-checked by the TS reader.
-type meta struct {
-	NumAdded int `json:"numAdded"`
-	NumNodes int `json:"numNodes"`
-	NumEdges int `json:"numEdges"`
-	Alphabet int `json:"alphabet"`
-}
-
-func main() {
-	dawgDir := flag.String("dawg-dir", "../scrabble-solver/dawg", "directory holding the .dawg files")
-	outDir := flag.String("out", "", "output directory for the golden files (required)")
-	negCount := flag.Int("neg", 20000, "number of negative lookups to emit per dictionary")
-	flag.Parse()
-
-	if *outDir == "" {
-		fail("-out is required")
-	}
-	if err := os.MkdirAll(*outDir, 0o755); err != nil {
-		fail("mkdir out: %v", err)
-	}
-
-	files, err := filepath.Glob(filepath.Join(*dawgDir, "*.dawg"))
-	if err != nil {
-		fail("glob: %v", err)
-	}
-	sort.Strings(files)
-	if len(files) == 0 {
-		fail("no .dawg files in %s", *dawgDir)
-	}
-
-	for _, f := range files {
-		if err := process(f, *outDir, *negCount); err != nil {
-			fail("%s: %v", filepath.Base(f), err)
-		}
-	}
-}
-
-// process emits the golden files for a single dawg dictionary.
-func process(path, outDir string, negCount int) error {
-	name := strings.TrimSuffix(filepath.Base(path), ".dawg")
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return err
-	}
-	finder, err := dawg.Read(bytes.NewReader(data), 0)
-	if err != nil {
-		return fmt.Errorf("read dawg: %w", err)
-	}
-	defer finder.Close()
-
-	// Stream every stored word in index order; keep a decimated sample and the
-	// maximum alphabet index for negative generation.
-	wf, err := os.Create(filepath.Join(outDir, name+".words.bin"))
-	if err != nil {
-		return err
-	}
-	bw := bufio.NewWriter(wf)
-
-	var (
-		count  int
-		maxIx  byte
-		sample [][]byte
-	)
-	finder.EnumerateB(func(index int, word []byte, final bool) int {
-		if !final {
-			return 0 // Continue
-		}
-		if index != count {
-			panic(fmt.Sprintf("%s: enumerate index gap: got %d want %d", name, index, count))
-		}
-		writeWord(bw, word)
-		for _, b := range word {
-			if b > maxIx {
-				maxIx = b
-			}
-		}
-		if count%4 == 0 && len(sample) < 60000 {
-			sample = append(sample, append([]byte(nil), word...))
-		}
-		count++
-		return 0 // Continue
-	})
-	if err := bw.Flush(); err != nil {
-		return err
-	}
-	if err := wf.Close(); err != nil {
-		return err
-	}
-	if count != finder.NumAdded() {
-		return fmt.Errorf("word count %d != NumAdded %d", count, finder.NumAdded())
-	}
-
-	alphabet := int(maxIx) + 1
-
-	// Negatives: mutate sampled real words and keep the ones the reader rejects.
-	nf, err := os.Create(filepath.Join(outDir, name+".neg.bin"))
-	if err != nil {
-		return err
-	}
-	nbw := bufio.NewWriter(nf)
-	rng := rand.New(rand.NewSource(1))
-	neg := 0
-	for neg < negCount && len(sample) > 0 {
-		base := sample[rng.Intn(len(sample))]
-		cand := append([]byte(nil), base...)
-		switch rng.Intn(3) {
-		case 0: // extend by one index
-			cand = append(cand, byte(rng.Intn(alphabet)))
-		case 1: // flip one index
-			if len(cand) > 0 {
-				cand[rng.Intn(len(cand))] = byte(rng.Intn(alphabet))
-			}
-		case 2: // drop the tail and flip the new last index
-			if len(cand) > 1 {
-				cand = cand[:len(cand)-1]
-				cand[len(cand)-1] = byte(rng.Intn(alphabet))
-			}
-		}
-		if finder.IndexOfB(cand) == -1 {
-			writeWord(nbw, cand)
-			neg++
-		}
-	}
-	if err := nbw.Flush(); err != nil {
-		return err
-	}
-	if err := nf.Close(); err != nil {
-		return err
-	}
-
-	m := meta{NumAdded: finder.NumAdded(), NumNodes: finder.NumNodes(), NumEdges: finder.NumEdges(), Alphabet: alphabet}
-	mb, err := json.MarshalIndent(m, "", "  ")
-	if err != nil {
-		return err
-	}
-	if err := os.WriteFile(filepath.Join(outDir, name+".meta.json"), mb, 0o644); err != nil {
-		return err
-	}
-
-	fmt.Printf("%-12s words=%d negatives=%d alphabet=%d nodes=%d edges=%d\n",
-		name, count, neg, alphabet, finder.NumNodes(), finder.NumEdges())
-	return nil
-}
-
-// writeWord frames one index-byte word as [length][bytes].
-func writeWord(w *bufio.Writer, word []byte) {
-	if len(word) > 255 {
-		panic(fmt.Sprintf("word too long to frame: %d", len(word)))
-	}
-	w.WriteByte(byte(len(word)))
-	w.Write(word)
-}
-
-func fail(format string, args ...any) {
-	fmt.Fprintf(os.Stderr, "dictgen: "+format+"\n", args...)
-	os.Exit(1)
-}

backend/cmd/validategen/main.go

@@ -1,486 +0,0 @@
-// Command validategen produces golden conformance fixtures for the TypeScript
-// move validator (ui/src/lib/dict/validate.ts). For each variant it self-plays
-// greedy games with the authoritative scrabble-solver engine to build realistic
-// board positions, then records a battery of candidate plays — the engine's own
-// top move, letter-mutated variants, random scatters and (on the empty board) an
-// off-centre translation — each paired with the ground-truth result of
-// ValidatePlayOpts (legal, score, the words formed). The TS conformance test
-// replays these and must agree exactly.
-//
-// It is a development tool (not built into any service), analogous to
-// cmd/dictgen. Run it from the repository root:
-//
-//	go run ./backend/cmd/validategen -dawg-dir ../scrabble-solver/dawg -out <dir>
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"math/rand"
-	"os"
-	"path/filepath"
-
-	"gitea.iliadenisov.ru/developer/scrabble-solver/board"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rack"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rules"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/scrabble"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/selfplay"
-	dawg "github.com/iliadenisov/dafsa"
-)
-
-// blankTile marks a blank tile in a drawn hand (matches selfplay).
-const blankTile byte = 0xff
-
-// variantSpec pairs a variant label with its ruleset and dawg file.
-type variantSpec struct {
-	name  string
-	rules *rules.Ruleset
-	dawg  string
-}
-
-// cell is an occupied board square or a placement (alphabet-index letter).
-type cell struct {
-	R, C, Letter int
-	Blank        bool
-}
-
-// word mirrors scrabble.Word in index space.
-type word struct {
-	Row, Col, Dir int
-	Letters       []int
-	Blanks        []bool
-	Score         int
-}
-
-// fixture is one candidate play with the engine's ground-truth verdict.
-type fixture struct {
-	Board            int    `json:"board"` // index into the boards list
-	Dir              int    `json:"dir"`
-	IgnoreCrossWords bool   `json:"ignoreCrossWords"`
-	Tiles            []cell `json:"tiles"`
-	Legal            bool   `json:"legal"`
-	Score            int    `json:"score"`
-	Bonus            int    `json:"bonus"`
-	Main             *word  `json:"main,omitempty"`
-	Cross            []word `json:"cross,omitempty"`
-}
-
-// alphaEntry mirrors one row of the per-variant alphabet table the server sends the
-// client (index, concrete letter as the ruleset emits it, tile value), so the adapter
-// cross-test can drive the letter-space client path exactly as production does.
-type alphaEntry struct {
-	Index  int    `json:"index"`
-	Letter string `json:"letter"`
-	Value  int    `json:"value"`
-}
-
-// variantFile is the whole conformance payload for one variant.
-type variantFile struct {
-	Variant  string       `json:"variant"`
-	Rows     int          `json:"rows"`
-	Cols     int          `json:"cols"`
-	Center   int          `json:"center"`
-	RackSize int          `json:"rackSize"`
-	Bingo    int          `json:"bingo"`
-	Values   []int        `json:"values"`
-	Premiums []int        `json:"premiums"` // row-major rules.Premium codes
-	Alphabet []alphaEntry `json:"alphabet"`
-	Boards   [][]cell     `json:"boards"`
-	Fixtures []fixture    `json:"fixtures"`
-}
-
-func main() {
-	dawgDir := flag.String("dawg-dir", "../scrabble-solver/dawg", "directory holding the .dawg files")
-	outDir := flag.String("out", "", "output directory for the fixture files (required)")
-	games := flag.Int("games", 6, "self-play games per (variant, rule)")
-	plies := flag.Int("plies", 40, "maximum plies captured per game")
-	flag.Parse()
-	if *outDir == "" {
-		fail("-out is required")
-	}
-	if err := os.MkdirAll(*outDir, 0o755); err != nil {
-		fail("mkdir out: %v", err)
-	}
-
-	specs := []variantSpec{
-		{"scrabble_en", rules.English(), "en_sowpods.dawg"},
-		{"scrabble_ru", rules.RussianScrabble(), "ru_scrabble.dawg"},
-		{"erudit_ru", rules.Erudit(), "ru_erudit.dawg"},
-	}
-	for _, sp := range specs {
-		if err := generate(sp, *dawgDir, *outDir, *games, *plies); err != nil {
-			fail("%s: %v", sp.name, err)
-		}
-	}
-}
-
-func generate(sp variantSpec, dawgDir, outDir string, games, plies int) error {
-	data, err := os.ReadFile(filepath.Join(dawgDir, sp.dawg))
-	if err != nil {
-		return err
-	}
-	finder, err := dawg.Read(bytes.NewReader(data), 0)
-	if err != nil {
-		return fmt.Errorf("read dawg: %w", err)
-	}
-	defer finder.Close()
-
-	rs := sp.rules
-	solver := scrabble.NewSolver(rs, finder)
-
-	out := variantFile{
-		Variant: sp.name, Rows: rs.Rows, Cols: rs.Cols, Center: rs.Center,
-		RackSize: rs.RackSize, Bingo: rs.Bingo, Values: rs.Values,
-		Premiums: premiumCodes(rs), Alphabet: alphabetOf(rs),
-	}
-
-	// Capture under both the standard rule and the single-word rule, building the
-	// board with the same rule so positions are reachable under it.
-	for _, ignore := range []bool{false, true} {
-		opts := scrabble.PlayOptions{IgnoreCrossWords: ignore}
-		for g := range games {
-			seed := int64(g*1000) + boolseed(ignore) + variantSeed(sp.name)
-			playAndCapture(&out, rs, solver, opts, seed, plies)
-		}
-	}
-
-	b, err := json.Marshal(&out)
-	if err != nil {
-		return err
-	}
-	if err := os.WriteFile(filepath.Join(outDir, sp.name+".fixtures.json"), b, 0o644); err != nil {
-		return err
-	}
-	fmt.Printf("%-12s boards=%d fixtures=%d\n", sp.name, len(out.Boards), len(out.Fixtures))
-	return nil
-}
-
-// playAndCapture greedily self-plays one game, recording candidate plays against
-// each board position along the way.
-func playAndCapture(out *variantFile, rs *rules.Ruleset, solver *scrabble.Solver, opts scrabble.PlayOptions, seed int64, plies int) {
-	rng := rand.New(rand.NewSource(seed))
-	bag := selfplay.NewBag(rs, seed)
-	b := board.New(rs.Rows, rs.Cols)
-	hands := [2][]byte{bag.Draw(rs.RackSize), bag.Draw(rs.RackSize)}
-
-	passes := 0
-	for turn := range plies {
-		p := turn % 2
-		rk := rackOf(hands[p], rs.Size())
-		moves := solver.GenerateMovesOpts(b, rk, scrabble.Both, opts)
-		if len(moves) == 0 {
-			if passes++; passes >= 4 {
-				break
-			}
-			continue
-		}
-		passes = 0
-		top := moves[0]
-
-		boardIdx := len(out.Boards)
-		out.Boards = append(out.Boards, boardCells(b))
-		captureCandidates(out, rs, solver, opts, b, boardIdx, top, rng)
-
-		scrabble.Apply(b, top)
-		hands[p] = removeUsed(hands[p], top)
-		if need := rs.RackSize - len(hands[p]); need > 0 {
-			hands[p] = append(hands[p], bag.Draw(need)...)
-		}
-		if len(hands[p]) == 0 && bag.Len() == 0 {
-			break
-		}
-	}
-}
-
-// captureCandidates records the engine's top move plus derived candidates for one
-// board, each with its ValidatePlayOpts verdict.
-func captureCandidates(out *variantFile, rs *rules.Ruleset, solver *scrabble.Solver, opts scrabble.PlayOptions, b *board.Board, boardIdx int, top scrabble.Move, rng *rand.Rand) {
-	size := rs.Size()
-	record := func(tiles []scrabble.Placement) {
-		if len(tiles) == 0 {
-			return
-		}
-		out.Fixtures = append(out.Fixtures, makeFixture(solver, opts, b, boardIdx, tiles))
-	}
-
-	// The engine's own top move (legal).
-	record(top.Tiles)
-
-	// Letter-mutated variants: usually reject on the dictionary, occasionally form
-	// a different legal word.
-	for range 3 {
-		mut := clonePlacements(top.Tiles)
-		i := rng.Intn(len(mut))
-		mut[i].Letter = byte((int(mut[i].Letter) + 1 + rng.Intn(size-1)) % size)
-		record(mut)
-	}
-
-	// Random scatters: exercise geometry, dictionary and connectivity paths.
-	for range 3 {
-		record(randomScatter(b, size, 2+rng.Intn(4), rng))
-	}
-
-	// Single tiles abutting the board exercise the direction inference — a single
-	// tile is ambiguous, its orientation resolved from which axis it extends.
-	for range 3 {
-		if t, ok := randomAdjacentSingle(b, size, rng); ok {
-			record([]scrabble.Placement{t})
-		}
-	}
-
-	// On the empty board, an off-centre translation of the first move exercises the
-	// first-move centre rule.
-	if b.IsEmpty() {
-		shifted := clonePlacements(top.Tiles)
-		ok := true
-		for i := range shifted {
-			shifted[i].Row++
-			shifted[i].Col++
-			if !b.InBounds(shifted[i].Row, shifted[i].Col) {
-				ok = false
-				break
-			}
-		}
-		if ok {
-			record(shifted)
-		}
-	}
-}
-
-// makeFixture validates a candidate against board b and serializes it with its
-// ground truth. Word breakdown is recorded only for legal plays (the TS test
-// checks words only then); an illegal play records legal=false alone.
-func makeFixture(solver *scrabble.Solver, opts scrabble.PlayOptions, b *board.Board, boardIdx int, tiles []scrabble.Placement) fixture {
-	// Infer the orientation exactly as the backend evaluate does (dir-less), so the
-	// fixture matches the real eval path and pins the client's ported inference.
-	dir := playDirectionMirror(solver, b, tiles, opts)
-	fx := fixture{
-		Board:            boardIdx,
-		Dir:              int(dir),
-		IgnoreCrossWords: opts.IgnoreCrossWords,
-		Tiles:            placementCells(tiles),
-	}
-	m, err := solver.ValidatePlayOpts(b, dir, tiles, opts)
-	if err == nil {
-		fx.Legal = true
-		fx.Score = m.Score
-		fx.Bonus = m.Bonus
-		fx.Main = toWord(m.Main)
-		for _, cw := range m.Cross {
-			fx.Cross = append(fx.Cross, *toWord(cw))
-		}
-	}
-	return fx
-}
-
-func placementCells(ts []scrabble.Placement) []cell {
-	cs := make([]cell, len(ts))
-	for i, t := range ts {
-		cs[i] = cell{R: t.Row, C: t.Col, Letter: int(t.Letter), Blank: t.Blank}
-	}
-	return cs
-}
-
-func toWord(w scrabble.Word) *word {
-	letters := make([]int, len(w.Letters))
-	for i, l := range w.Letters {
-		letters[i] = int(l)
-	}
-	return &word{
-		Row: w.Row, Col: w.Col, Dir: int(w.Dir),
-		Letters: letters, Blanks: append([]bool(nil), w.Blanks...), Score: w.Score,
-	}
-}
-
-func alphabetOf(rs *rules.Ruleset) []alphaEntry {
-	n := rs.Alphabet.Size()
-	out := make([]alphaEntry, n)
-	for i := range n {
-		ch, _ := rs.Alphabet.Character(byte(i))
-		out[i] = alphaEntry{Index: i, Letter: ch, Value: rs.Values[i]}
-	}
-	return out
-}
-
-func premiumCodes(rs *rules.Ruleset) []int {
-	codes := make([]int, rs.Rows*rs.Cols)
-	for i := range codes {
-		codes[i] = int(rs.PremiumAt(i))
-	}
-	return codes
-}
-
-func boardCells(b *board.Board) []cell {
-	var cs []cell
-	for r := 0; r < b.Rows(); r++ {
-		for c := 0; c < b.Cols(); c++ {
-			if b.Filled(r, c) {
-				v := b.At(r, c)
-				cs = append(cs, cell{R: r, C: c, Letter: int(v&0x3f) - 1, Blank: v&0x80 != 0})
-			}
-		}
-	}
-	return cs
-}
-
-func clonePlacements(ts []scrabble.Placement) []scrabble.Placement {
-	return append([]scrabble.Placement(nil), ts...)
-}
-
-// randomScatter picks n distinct empty in-bounds squares with random letters.
-func randomScatter(b *board.Board, size, n int, rng *rand.Rand) []scrabble.Placement {
-	seen := map[[2]int]bool{}
-	var ts []scrabble.Placement
-	for tries := 0; tries < n*20 && len(ts) < n; tries++ {
-		r := rng.Intn(b.Rows())
-		c := rng.Intn(b.Cols())
-		if seen[[2]int{r, c}] || b.Filled(r, c) {
-			continue
-		}
-		seen[[2]int{r, c}] = true
-		ts = append(ts, scrabble.Placement{Row: r, Col: c, Letter: byte(rng.Intn(size)), Blank: rng.Intn(10) == 0})
-	}
-	return ts
-}
-
-// randomAdjacentSingle picks a random empty in-bounds square abutting at least one
-// filled square, with a random letter — a single-tile play whose orientation the
-// inference must resolve. It returns ok=false on an empty board.
-func randomAdjacentSingle(b *board.Board, size int, rng *rand.Rand) (scrabble.Placement, bool) {
-	var cands [][2]int
-	for r := 0; r < b.Rows(); r++ {
-		for c := 0; c < b.Cols(); c++ {
-			if b.Filled(r, c) {
-				continue
-			}
-			if b.Filled(r-1, c) || b.Filled(r+1, c) || b.Filled(r, c-1) || b.Filled(r, c+1) {
-				cands = append(cands, [2]int{r, c})
-			}
-		}
-	}
-	if len(cands) == 0 {
-		return scrabble.Placement{}, false
-	}
-	rc := cands[rng.Intn(len(cands))]
-	return scrabble.Placement{Row: rc[0], Col: rc[1], Letter: byte(rng.Intn(size)), Blank: rng.Intn(10) == 0}, true
-}
-
-// playDirectionMirror mirrors engine (*Game).playDirection: the geometric
-// resolution, except a single tile under the single-word rule tries both
-// orientations through the solver and keeps the higher-scoring legal one (H wins
-// ties). It reproduces the orientation the backend evaluate infers.
-func playDirectionMirror(solver *scrabble.Solver, b *board.Board, placements []scrabble.Placement, opts scrabble.PlayOptions) scrabble.Direction {
-	geo := resolveDirectionMirror(b, placements)
-	if len(placements) != 1 || !opts.IgnoreCrossWords {
-		return geo
-	}
-	best, found, bestScore := geo, false, 0
-	for _, dir := range [...]scrabble.Direction{scrabble.Horizontal, scrabble.Vertical} {
-		m, err := solver.ValidatePlayOpts(b, dir, placements, opts)
-		if err != nil {
-			continue
-		}
-		if !found || m.Score > bestScore {
-			best, found, bestScore = dir, true, m.Score
-		}
-	}
-	return best
-}
-
-// resolveDirectionMirror mirrors engine.resolveDirection.
-func resolveDirectionMirror(b *board.Board, placements []scrabble.Placement) scrabble.Direction {
-	if len(placements) >= 2 {
-		row := placements[0].Row
-		for _, p := range placements[1:] {
-			if p.Row != row {
-				return scrabble.Vertical
-			}
-		}
-		return scrabble.Horizontal
-	}
-	if len(placements) == 1 {
-		p := placements[0]
-		h := runLengthMirror(b, p.Row, p.Col, scrabble.Horizontal)
-		v := runLengthMirror(b, p.Row, p.Col, scrabble.Vertical)
-		if v >= 2 && v > h {
-			return scrabble.Vertical
-		}
-		if h >= 2 {
-			return scrabble.Horizontal
-		}
-		if v >= 2 {
-			return scrabble.Vertical
-		}
-	}
-	return scrabble.Horizontal
-}
-
-// runLengthMirror mirrors engine.runLength.
-func runLengthMirror(b *board.Board, row, col int, dir scrabble.Direction) int {
-	dr, dc := 0, 1
-	if dir == scrabble.Vertical {
-		dr, dc = 1, 0
-	}
-	n := 1
-	for r, c := row-dr, col-dc; b.Filled(r, c); r, c = r-dr, c-dc {
-		n++
-	}
-	for r, c := row+dr, col+dc; b.Filled(r, c); r, c = r+dr, c+dc {
-		n++
-	}
-	return n
-}
-
-// rackOf builds a generation rack from a hand of tiles (reimplemented from the
-// unexported selfplay helper).
-func rackOf(tiles []byte, size int) rack.Rack {
-	r := rack.New(size)
-	for _, t := range tiles {
-		if t == blankTile {
-			r.AddBlank()
-		} else {
-			r.Add(t)
-		}
-	}
-	return r
-}
-
-// removeUsed returns the hand with the tiles consumed by m removed.
-func removeUsed(tiles []byte, m scrabble.Move) []byte {
-	out := append([]byte(nil), tiles...)
-	for _, p := range m.Tiles {
-		want := p.Letter
-		if p.Blank {
-			want = blankTile
-		}
-		for i, t := range out {
-			if t == want {
-				out = append(out[:i], out[i+1:]...)
-				break
-			}
-		}
-	}
-	return out
-}
-
-func boolseed(b bool) int64 {
-	if b {
-		return 500000
-	}
-	return 0
-}
-
-func variantSeed(name string) int64 {
-	var s int64
-	for _, r := range name {
-		s = s*131 + int64(r)
-	}
-	return s
-}
-
-func fail(format string, args ...any) {
-	fmt.Fprintf(os.Stderr, "validategen: "+format+"\n", args...)
-	os.Exit(1)
-}

backend/go.mod

@@ -13,7 +13,6 @@ require (
 	github.com/pressly/goose/v3 v3.27.1
 	github.com/testcontainers/testcontainers-go v0.42.0
 	github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0
-	github.com/wneessen/go-mail v0.7.3
 	go.opentelemetry.io/otel v1.43.0
 	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0
@@ -110,7 +109,7 @@ require (
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

backend/go.sum

@@ -279,8 +279,6 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
 github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
-github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
-github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
@@ -402,8 +400,6 @@ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
 golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=

backend/internal/account/account.go

@@ -22,13 +22,12 @@ import (
 	"scrabble/backend/internal/postgres/jet/backend/table"
 )
 
-// Identity kinds recognised by the backend. Telegram and VK are platform identities,
+// Identity kinds recognised by the backend. Email is modelled as an identity
-// auto-confirmed on first contact. Email is modelled as an identity alongside them; its
+// alongside platform identities; its confirmed flag is driven by the email
-// confirmed flag is driven by the email confirm-code flow. Robot is a synthetic kind:
+// confirm-code flow. Robot is a synthetic kind: each pooled
-// each pooled robot opponent is a durable account bound to one robot identity.
+// robot opponent is a durable account bound to one robot identity.
 const (
 	KindTelegram = "telegram"
-	KindVK       = "vk"
 	KindEmail    = "email"
 	KindRobot    = "robot"
 )
@@ -121,44 +120,13 @@ func (s *Store) ProvisionByIdentity(ctx context.Context, kind, externalID string
 }
 
 // ProvisionEmail returns the account owning the email identity externalID, creating
-// it on first contact with browserTZ — the client's detected "±HH:MM" UTC offset —
+// it (unconfirmed) on first contact with browserTZ — the client's detected "±HH:MM"
-// seeded into its time zone, language seeded from the client's UI language, and its
+// UTC offset — seeded into its time zone. Like ProvisionByIdentity it is race-safe
-// display name seeded from the email's local part (so it is not left nameless). Like
+// and leaves an existing account untouched, so a returning user's saved zone is never
-// ProvisionByIdentity it is race-safe and leaves an existing account untouched, so a
+// overwritten. The email account is created here (the code-request step), not at the
-// returning user's saved zone, language and name are never overwritten. The email account is
+// later login, so this is where its zone is seeded.
-// created here (the code-request step), not at the later login, so this is where its
+func (s *Store) ProvisionEmail(ctx context.Context, externalID, browserTZ string) (Account, error) {
-// zone and language are seeded. It is created flagged is_guest with an unconfirmed
+	return s.provision(ctx, KindEmail, externalID, provisionSeed{timeZone: seedZone(browserTZ)})
-// email identity: an abandoned, never-confirmed login is then reaped like any guest,
-// freeing the reserved address, and confirming the code clears the guest flag.
-func (s *Store) ProvisionEmail(ctx context.Context, externalID, browserTZ, language string) (Account, error) {
-	return s.provision(ctx, KindEmail, externalID, provisionSeed{
-		displayName:       emailDisplayName(externalID),
-		timeZone:          seedZone(browserTZ),
-		preferredLanguage: supportedLanguage(language),
-		isGuest:           true,
-	})
-}
-
-// emailDisplayName derives a display name from an email address — the local part
-// before '@', trimmed and capped to the column width — so a new email account is not
-// left nameless. It is only the first-contact seed; the user can rename it later.
-func emailDisplayName(email string) string {
-	local, _, _ := strings.Cut(email, "@")
-	local = strings.TrimSpace(local)
-	if r := []rune(local); len(r) > maxDisplayName {
-		local = strings.TrimRight(string(r[:maxDisplayName]), " ")
-	}
-	return local
-}
-
-// supportedLanguage returns code normalised to a supported UI language ("en" or
-// "ru"), or "" when it maps to neither, so a new account keeps the 'en' default. It
-// accepts region-tagged codes ("ru-RU").
-func supportedLanguage(code string) string {
-	if lang, _, _ := strings.Cut(strings.ToLower(strings.TrimSpace(code)), "-"); lang == "en" || lang == "ru" {
-		return lang
-	}
-	return ""
 }
 
 // ProvisionRobot provisions (or finds) the durable account backing a robot pool
@@ -217,28 +185,6 @@ func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode,
 	return acc, created, err
 }
 
-// ProvisionVK provisions (or finds) the account bound to a VK identity, reporting
-// whether this call created it (first contact). On first contact only, it seeds the new
-// account's preferred language from the VK languageCode (vk_language, when it maps to a
-// supported language) and its display name sanitized from displayName — the name read
-// client-side via VKWebAppGetUserInfo, since VK omits it from the signed launch params —
-// falling back to a generated placeholder when it yields no letters; an already-existing
-// account is returned unchanged, so a later profile edit is never overwritten.
-func (s *Store) ProvisionVK(ctx context.Context, externalID, languageCode, displayName, browserTZ string) (Account, bool, error) {
-	// Pre-check whether the identity already exists so the caller can act on first
-	// contact (mirrors ProvisionTelegram); a create race only mis-reports created for
-	// that one call.
-	_, err := s.findByIdentity(ctx, KindVK, externalID)
-	created := errors.Is(err, ErrNotFound)
-	if err != nil && !created {
-		return Account{}, false, err
-	}
-	seed := vkSeed(languageCode, displayName)
-	seed.timeZone = seedZone(browserTZ)
-	acc, err := s.provision(ctx, KindVK, externalID, seed)
-	return acc, created, err
-}
-
 // provision finds the account for (kind, externalID) or creates it with seed,
 // collapsing a concurrent-create race on the identity unique constraint into a
 // re-read of the winner's account.
@@ -270,11 +216,6 @@ type provisionSeed struct {
 	preferredLanguage string
 	displayName       string
 	timeZone          string
-	// isGuest creates the account flagged is_guest. It is set for an email-login
-	// account, which stays a guest until the address is confirmed (so an abandoned,
-	// never-confirmed login is reaped and its address freed); confirming clears the
-	// flag. Platform identities (telegram/vk) are durable from creation.
-	isGuest bool
 }
 
 // seedZone returns browserTZ when it is a well-formed zone to persist at account
@@ -317,24 +258,6 @@ func telegramSeed(languageCode, username, firstName string) provisionSeed {
 	return seed
 }
 
-// vkSeed derives the create-time seed from VK launch fields: a supported preferred
-// language from languageCode (vk_language, normally a 2-letter code) and a display name
-// from displayName (sanitized to the editable format), falling back to a generated
-// placeholder in the seeded language when the name yields no usable letters. Unlike
-// telegramSeed there is no @username fallback — VK provides only the name.
-func vkSeed(languageCode, displayName string) provisionSeed {
-	var seed provisionSeed
-	if lang, _, _ := strings.Cut(strings.ToLower(strings.TrimSpace(languageCode)), "-"); lang == "en" || lang == "ru" {
-		seed.preferredLanguage = lang
-	}
-	name := sanitizeDisplayName(displayName)
-	if name == "" {
-		name = placeholderDisplayName(seed.preferredLanguage)
-	}
-	seed.displayName = name
-	return seed
-}
-
 // GetByID loads the account identified by id, or ErrNotFound when it is absent.
 func (s *Store) GetByID(ctx context.Context, id uuid.UUID) (Account, error) {
 	stmt := postgres.SELECT(table.Accounts.AllColumns).
@@ -483,8 +406,8 @@ func (s *Store) create(ctx context.Context, kind, externalID string, seed provis
 			tz = "UTC"
 		}
 		insertAccount := table.Accounts.
-			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage, table.Accounts.TimeZone, table.Accounts.IsGuest).
+			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage, table.Accounts.TimeZone).
-			VALUES(accountID, seed.displayName, lang, tz, seed.isGuest).
+			VALUES(accountID, seed.displayName, lang, tz).
 			RETURNING(table.Accounts.AllColumns)
 
 		var row model.Accounts
@@ -498,7 +421,7 @@ func (s *Store) create(ctx context.Context, kind, externalID string, seed provis
 			table.Identities.Kind,
 			table.Identities.ExternalID,
 			table.Identities.Confirmed,
-		).VALUES(identityID, accountID, kind, externalID, kind == KindTelegram || kind == KindVK)
+		).VALUES(identityID, accountID, kind, externalID, kind == KindTelegram)
 		if _, err := insertIdentity.ExecContext(ctx, tx); err != nil {
 			return err
 		}

backend/internal/account/email.go

@@ -5,7 +5,6 @@ import (
 	crand "crypto/rand"
 	"crypto/sha256"
 	"database/sql"
-	"encoding/base64"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -27,22 +26,6 @@ const (
 	emailCodeTTL = 15 * time.Minute
 	// emailCodeMaxAttempts caps wrong-code submissions before a code is dead.
 	emailCodeMaxAttempts = 5
-	// linkTokenBytes is the entropy of a confirm deeplink token: 256 bits.
-	linkTokenBytes = 32
-	// emailConfirmPath is the SPA route the one-tap confirm deeplink opens (the token
-	// is appended). The SPA is served under /app/ behind a hash router.
-	emailConfirmPath = "/app/#/confirm/"
-)
-
-// Confirmation purposes recorded on a pending confirm-code row. They select what
-// verifying the code or the deeplink token does: sign in (login), link/confirm the
-// address on the current account (link), or replace the account's confirmed email with
-// a new address (change). Account deletion adds a further purpose in a later stage.
-const (
-	purposeLogin  = "login"
-	purposeLink   = "link"
-	purposeChange = "change"
-	purposeDelete = "delete"
 )
 
 // Errors returned by the email confirm-code flow.
@@ -63,12 +46,6 @@ var (
 	ErrTooManyAttempts = errors.New("account: too many confirmation attempts")
 	// ErrCodeMismatch is returned when the submitted code does not match.
 	ErrCodeMismatch = errors.New("account: confirmation code does not match")
-	// ErrTooManyRequests is returned when confirm-code sends to an address are being
-	// requested too frequently (the resend cooldown or the rolling-hour cap).
-	ErrTooManyRequests = errors.New("account: too many code requests")
-	// ErrNoEmail is returned when an email-code step-up is requested for an account that
-	// holds no confirmed email (the caller must use the typed-phrase path instead).
-	ErrNoEmail = errors.New("account: no confirmed email")
 )
 
 // EmailService runs the email confirm-code flow: it issues a 6-digit code over a
@@ -78,80 +55,14 @@ var (
 // account is refused (ErrEmailTaken) — merging two accounts is the link/merge flow —
 // and using an email as a login reuses this mechanism.
 type EmailService struct {
-	store   *Store
+	store  *Store
-	mailer  Mailer
+	mailer Mailer
-	baseURL string
+	now    func() time.Time
-	limiter *SendLimiter
-	now     func() time.Time
 }
 
-// NewEmailService constructs an EmailService over store, sending via mailer. baseURL
+// NewEmailService constructs an EmailService over store, sending via mailer.
-// is the canonical public origin (scheme + host) used to build the one-tap confirm
+func NewEmailService(store *Store, mailer Mailer) *EmailService {
-// deeplink and the email footer landing link; an empty baseURL omits the deeplink
+	return &EmailService{store: store, mailer: mailer, now: func() time.Time { return time.Now().UTC() }}
-// (development / log mailer).
-func NewEmailService(store *Store, mailer Mailer, baseURL string) *EmailService {
-	return &EmailService{store: store, mailer: mailer, baseURL: baseURL, now: func() time.Time { return time.Now().UTC() }}
-}
-
-// SetSendLimiter installs a per-recipient send throttle. When unset (nil), sends are
-// not throttled — production wires a limiter; tests leave it off.
-func (s *EmailService) SetSendLimiter(l *SendLimiter) { s.limiter = l }
-
-// allowSend reports whether a confirm-code send to email is permitted now, recording
-// it when so. A nil limiter permits every send.
-func (s *EmailService) allowSend(email string) bool {
-	return s.limiter == nil || s.limiter.Allow(email)
-}
-
-// issueCode generates a fresh confirm-code and one-tap deeplink token for (accountID,
-// email), replaces any prior pending confirmation, and mails the branded code in
-// locale; purpose selects the email wording and what verifying does. Only the SHA-256
-// hashes of the code and token are stored.
-func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email, purpose, locale string) error {
-	code, codeHash, err := generateCode()
-	if err != nil {
-		return err
-	}
-	token, tokenHash, err := generateLinkToken()
-	if err != nil {
-		return err
-	}
-	if err := s.store.replacePendingConfirmation(ctx, accountID, email, codeHash, tokenHash, purpose, s.now().Add(emailCodeTTL)); err != nil {
-		return err
-	}
-	// Account deletion is never a one-tap link (a prefetch or a stray click must not delete
-	// an account): the delete code is entered in the app only, so the email omits the
-	// deeplink and ConfirmByToken refuses a delete token.
-	deeplink := s.confirmURL(token, locale)
-	if purpose == purposeDelete {
-		deeplink = ""
-	}
-	msg, err := renderConfirmationEmail(purpose, code, deeplink, s.baseURL, locale)
-	if err != nil {
-		return err
-	}
-	msg.To = email
-	return s.mailer.Send(ctx, msg)
-}
-
-// confirmURL builds the absolute one-tap confirm deeplink for token in locale, or ""
-// when no public base URL is configured. The locale rides the fragment as ?lang so the
-// confirm screen (opened in a browser with no session) renders in the email's language.
-func (s *EmailService) confirmURL(token, locale string) string {
-	if s.baseURL == "" {
-		return ""
-	}
-	return strings.TrimRight(s.baseURL, "/") + emailConfirmPath + token + "?lang=" + normalizeLocale(locale)
-}
-
-// accountLocale returns the account's preferred UI language for localising email,
-// defaulting to "en" when the account cannot be loaded.
-func (s *EmailService) accountLocale(ctx context.Context, accountID uuid.UUID) string {
-	acc, err := s.store.GetByID(ctx, accountID)
-	if err != nil {
-		return "en"
-	}
-	return acc.PreferredLanguage
 }
 
 // RequestCode issues a fresh confirm-code for email to accountID and mails it,
@@ -162,9 +73,6 @@ func (s *EmailService) RequestCode(ctx context.Context, accountID uuid.UUID, ema
 	if err != nil {
 		return err
 	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
 	owner, ok, err := s.store.confirmedEmailAccount(ctx, addr)
 	if err != nil {
 		return err
@@ -175,7 +83,16 @@ func (s *EmailService) RequestCode(ctx context.Context, accountID uuid.UUID, ema
 		}
 		return ErrEmailTaken
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID))
+	code, hash, err := generateCode()
+	if err != nil {
+		return err
+	}
+	if err := s.store.replacePendingConfirmation(ctx, accountID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return err
+	}
+	subject := "Your Scrabble confirmation code"
+	body := fmt.Sprintf("Your confirmation code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	return s.mailer.Send(ctx, addr, subject, body)
 }
 
 // ConfirmCode verifies code for accountID and email. On success it attaches a
@@ -206,35 +123,36 @@ func (s *EmailService) ConfirmCode(ctx context.Context, accountID uuid.UUID, ema
 	if err := s.store.confirmEmailIdentity(ctx, conf.id, accountID, addr, s.now()); err != nil {
 		return Account{}, err
 	}
-	// Binding the first confirmed email promotes a guest to a durable account, matching the
-	// link and deeplink flows (defence-in-depth: no confirmed-email path leaves is_guest set).
-	if err := s.store.ClearGuest(ctx, accountID); err != nil {
-		return Account{}, err
-	}
 	return s.store.GetByID(ctx, accountID)
 }
 
 // RequestLoginCode issues a login confirm-code to the account that owns email,
-// provisioning a fresh (unconfirmed) guest account when the email is new — it becomes
+// provisioning a fresh (unconfirmed) durable account when the email is new. It is
-// durable once the code is confirmed. It is the unauthenticated email-login entry
+// the unauthenticated email-login entry point and, unlike RequestCode,
-// point and, unlike RequestCode, does not refuse an already-confirmed email — that is
+// does not refuse an already-confirmed email — that is the ordinary returning-user
-// the ordinary returning-user login. The code is mailed to the address, so only its
+// login. The code is mailed to the address, so only its real owner can complete
-// real owner can complete the login. On first contact browserTZ (the client's
+// the login. On first contact browserTZ (the client's detected "±HH:MM" UTC offset)
-// detected "±HH:MM" UTC offset) seeds the new account's time zone and language its UI
+// seeds the new account's time zone. It returns the target account id for the
-// language. It returns the target account id for the subsequent LoginWithCode.
+// subsequent LoginWithCode.
-func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ, language string) (uuid.UUID, error) {
+func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ string) (uuid.UUID, error) {
 	addr, err := normalizeEmail(email)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	if !s.allowSend(addr) {
+	acc, err := s.store.ProvisionEmail(ctx, addr, browserTZ)
-		return uuid.UUID{}, ErrTooManyRequests
-	}
-	acc, err := s.store.ProvisionEmail(ctx, addr, browserTZ, language)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	if err := s.issueCode(ctx, acc.ID, addr, purposeLogin, language); err != nil {
+	code, hash, err := generateCode()
+	if err != nil {
+		return uuid.UUID{}, err
+	}
+	if err := s.store.replacePendingConfirmation(ctx, acc.ID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return uuid.UUID{}, err
+	}
+	subject := "Your Scrabble login code"
+	body := fmt.Sprintf("Your login code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	if err := s.mailer.Send(ctx, addr, subject, body); err != nil {
 		return uuid.UUID{}, err
 	}
 	return acc.ID, nil
@@ -273,104 +191,9 @@ func (s *EmailService) LoginWithCode(ctx context.Context, email, code string) (A
 	if err := s.store.confirmEmailLogin(ctx, conf.id, acc.ID, addr, s.now()); err != nil {
 		return Account{}, err
 	}
-	if err := s.store.ClearGuest(ctx, acc.ID); err != nil {
-		return Account{}, err
-	}
 	return s.store.GetByID(ctx, acc.ID)
 }
 
-// LinkConfirmation is the outcome of confirming a one-tap deeplink token: what the
-// transport layer must finish. Purpose is the pending row's purpose. For a login,
-// Account is the account to sign in. For a link, Account is the account the email was
-// (or would be) attached to; NeedsMerge is set when another account (MergeOwner)
-// already owns the address, so the caller drives the interactive merge instead of a
-// plain link — the token is left unconsumed for that merge step.
-type LinkConfirmation struct {
-	Purpose    string
-	Account    uuid.UUID
-	NeedsMerge bool
-	MergeOwner uuid.UUID
-}
-
-// IsLogin reports whether the confirmation is a login (the caller mints a session)
-// rather than a link (attach the identity, or drive a merge).
-func (r LinkConfirmation) IsLogin() bool { return r.Purpose == purposeLogin }
-
-// ConfirmByToken verifies a one-tap deeplink token and performs its purpose. A login
-// confirms the email identity, clears the guest flag and returns the account to sign
-// in. A link attaches the confirmed email to the pending account when the address is
-// free, or reports NeedsMerge when another account already owns it (leaving the token
-// live so the caller's merge step can re-verify). It returns ErrNoPendingCode when the
-// token matches no live confirmation and ErrCodeExpired when it has lapsed. The token
-// is high-entropy, so there is no wrong-attempt counter.
-func (s *EmailService) ConfirmByToken(ctx context.Context, token string) (LinkConfirmation, error) {
-	pend, err := s.store.pendingByTokenHash(ctx, hashCode(token))
-	if err != nil {
-		return LinkConfirmation{}, err
-	}
-	if s.now().After(pend.expiresAt) {
-		return LinkConfirmation{}, ErrCodeExpired
-	}
-	switch pend.purpose {
-	case purposeLogin:
-		if err := s.store.confirmEmailLogin(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		if err := s.store.ClearGuest(ctx, pend.accountID); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeLogin, Account: pend.accountID}, nil
-	case purposeLink:
-		owner, ok, err := s.store.confirmedEmailAccount(ctx, pend.email)
-		if err != nil {
-			return LinkConfirmation{}, err
-		}
-		if ok {
-			if owner == pend.accountID {
-				if err := s.store.consumeConfirmation(ctx, pend.id, s.now()); err != nil {
-					return LinkConfirmation{}, err
-				}
-				return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID}, nil
-			}
-			return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID, NeedsMerge: true, MergeOwner: owner}, nil
-		}
-		if err := s.store.confirmEmailIdentity(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		// Binding the first email promotes a guest to a durable account, matching the
-		// code-based link flow (which clears the guest flag in the link service).
-		if err := s.store.ClearGuest(ctx, pend.accountID); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID}, nil
-	case purposeChange:
-		owner, ok, err := s.store.confirmedEmailAccount(ctx, pend.email)
-		if err != nil {
-			return LinkConfirmation{}, err
-		}
-		if ok && owner != pend.accountID {
-			// The new address is confirmed by a different account: refuse without
-			// disclosing it (anti-enumeration). Unlike a link, a change never merges.
-			return LinkConfirmation{}, ErrEmailTaken
-		}
-		if ok && owner == pend.accountID {
-			if err := s.store.consumeConfirmation(ctx, pend.id, s.now()); err != nil {
-				return LinkConfirmation{}, err
-			}
-			return LinkConfirmation{Purpose: purposeChange, Account: pend.accountID}, nil
-		}
-		if err := s.store.replaceEmailIdentity(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeChange, Account: pend.accountID}, nil
-	case purposeDelete:
-		// Deletion is confirmed in the app with the code, never via a one-tap link.
-		return LinkConfirmation{}, fmt.Errorf("account: deletion cannot be confirmed by link")
-	default:
-		return LinkConfirmation{}, fmt.Errorf("account: unsupported confirmation purpose %q", pend.purpose)
-	}
-}
-
 // emailConfirmation is a pending confirm-code row in domain form.
 type emailConfirmation struct {
 	id        uuid.UUID
@@ -399,30 +222,9 @@ func (s *Store) confirmedEmailAccount(ctx context.Context, email string) (uuid.U
 	return row.AccountID, true, nil
 }
 
-// confirmedEmailOf returns the account's confirmed email address and true, or ("", false)
-// when it holds none. It backs the deletion step-up, which mails a code to the account's
-// own address.
-func (s *Store) confirmedEmailOf(ctx context.Context, accountID uuid.UUID) (string, bool, error) {
-	stmt := postgres.SELECT(table.Identities.ExternalID).
-		FROM(table.Identities).
-		WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))).
-				AND(table.Identities.Confirmed.EQ(postgres.Bool(true))),
-		).LIMIT(1)
-	var row model.Identities
-	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return "", false, nil
-		}
-		return "", false, fmt.Errorf("account: confirmed email of %s: %w", accountID, err)
-	}
-	return row.ExternalID, true, nil
-}
-
 // replacePendingConfirmation clears any pending code for (accountID, email) and
 // inserts a fresh one, inside one transaction.
-func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.UUID, email, codeHash, linkTokenHash, purpose string, expiresAt time.Time) error {
+func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.UUID, email, codeHash string, expiresAt time.Time) error {
 	id, err := uuid.NewV7()
 	if err != nil {
 		return fmt.Errorf("account: new confirmation id: %w", err)
@@ -439,8 +241,7 @@ func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.U
 		ins := table.EmailConfirmations.INSERT(
 			table.EmailConfirmations.ConfirmationID, table.EmailConfirmations.AccountID,
 			table.EmailConfirmations.Email, table.EmailConfirmations.CodeHash, table.EmailConfirmations.ExpiresAt,
-			table.EmailConfirmations.LinkTokenHash, table.EmailConfirmations.Purpose,
+		).VALUES(id, accountID, email, codeHash, expiresAt)
-		).VALUES(id, accountID, email, codeHash, expiresAt, linkTokenHash, purpose)
 		if _, err := ins.ExecContext(ctx, tx); err != nil {
 			return fmt.Errorf("insert confirmation: %w", err)
 		}
@@ -473,54 +274,6 @@ func (s *Store) latestPendingConfirmation(ctx context.Context, accountID uuid.UU
 	}, nil
 }
 
-// pendingConfirmation is a pending confirm-code row loaded by its deeplink token, in
-// domain form.
-type pendingConfirmation struct {
-	id        uuid.UUID
-	accountID uuid.UUID
-	email     string
-	purpose   string
-	expiresAt time.Time
-}
-
-// pendingByTokenHash loads the unconsumed confirmation whose deeplink token hashes to
-// tokenHash, or ErrNoPendingCode. The high-entropy token needs no attempt counter, so
-// a partial-unique index guarantees at most one match.
-func (s *Store) pendingByTokenHash(ctx context.Context, tokenHash string) (pendingConfirmation, error) {
-	stmt := postgres.SELECT(table.EmailConfirmations.AllColumns).
-		FROM(table.EmailConfirmations).
-		WHERE(
-			table.EmailConfirmations.LinkTokenHash.EQ(postgres.String(tokenHash)).
-				AND(table.EmailConfirmations.ConsumedAt.IS_NULL()),
-		).LIMIT(1)
-	var row model.EmailConfirmations
-	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return pendingConfirmation{}, ErrNoPendingCode
-		}
-		return pendingConfirmation{}, fmt.Errorf("account: load confirmation by token: %w", err)
-	}
-	return pendingConfirmation{
-		id:        row.ConfirmationID,
-		accountID: row.AccountID,
-		email:     row.Email,
-		purpose:   row.Purpose,
-		expiresAt: row.ExpiresAt,
-	}, nil
-}
-
-// consumeConfirmation marks a confirmation consumed without writing an identity, used
-// for the idempotent already-linked deeplink path.
-func (s *Store) consumeConfirmation(ctx context.Context, id uuid.UUID, now time.Time) error {
-	upd := table.EmailConfirmations.UPDATE(table.EmailConfirmations.ConsumedAt).
-		SET(postgres.TimestampzT(now)).
-		WHERE(table.EmailConfirmations.ConfirmationID.EQ(postgres.UUID(id)))
-	if _, err := upd.ExecContext(ctx, s.db); err != nil {
-		return fmt.Errorf("account: consume confirmation: %w", err)
-	}
-	return nil
-}
-
 // bumpConfirmationAttempts increments a code's wrong-attempt counter by one.
 func (s *Store) bumpConfirmationAttempts(ctx context.Context, id uuid.UUID) error {
 	stmt := table.EmailConfirmations.
@@ -567,69 +320,6 @@ func (s *Store) confirmEmailIdentity(ctx context.Context, confirmationID, accoun
 	return nil
 }
 
-// replaceEmailIdentity consumes the confirmation, deletes the account's existing email
-// identity (freeing the old address) and inserts newEmail as its confirmed email, inside
-// one transaction. It backs the change-email flow. A unique-constraint violation — the
-// new address was confirmed elsewhere in the meantime — surfaces as ErrEmailTaken. When
-// the account holds no email identity yet the delete is a no-op, so this doubles as an
-// attach.
-func (s *Store) replaceEmailIdentity(ctx context.Context, confirmationID, accountID uuid.UUID, newEmail string, now time.Time) error {
-	identityID, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("account: new identity id: %w", err)
-	}
-	err = withTx(ctx, s.db, func(tx *sql.Tx) error {
-		upd := table.EmailConfirmations.
-			UPDATE(table.EmailConfirmations.ConsumedAt).
-			SET(postgres.TimestampzT(now)).
-			WHERE(table.EmailConfirmations.ConfirmationID.EQ(postgres.UUID(confirmationID)))
-		if _, err := upd.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("consume confirmation: %w", err)
-		}
-		// Journal the outgoing email before replacing it, so the legal dossier keeps the
-		// address the account used to hold (see retention.go).
-		var old model.Identities
-		sel := postgres.SELECT(
-			table.Identities.ExternalID, table.Identities.Confirmed, table.Identities.CreatedAt,
-		).FROM(table.Identities).WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))),
-		).LIMIT(1)
-		switch err := sel.QueryContext(ctx, tx, &old); {
-		case err == nil:
-			if err := retainIdentityTx(ctx, tx, accountID, KindEmail, old.ExternalID, old.Confirmed, old.CreatedAt, retainChange); err != nil {
-				return err
-			}
-		case errors.Is(err, qrm.ErrNoRows):
-			// No prior email (this doubles as an attach); nothing to retain.
-		default:
-			return fmt.Errorf("load outgoing email identity: %w", err)
-		}
-		del := table.Identities.DELETE().WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))),
-		)
-		if _, err := del.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("delete old email identity: %w", err)
-		}
-		ins := table.Identities.INSERT(
-			table.Identities.IdentityID, table.Identities.AccountID, table.Identities.Kind,
-			table.Identities.ExternalID, table.Identities.Confirmed,
-		).VALUES(identityID, accountID, KindEmail, newEmail, true)
-		if _, err := ins.ExecContext(ctx, tx); err != nil {
-			return err
-		}
-		return nil
-	})
-	if err != nil {
-		if isUniqueViolation(err) {
-			return ErrEmailTaken
-		}
-		return fmt.Errorf("account: replace email identity: %w", err)
-	}
-	return nil
-}
-
 // confirmEmailLogin consumes the login code and marks the existing email
 // identity confirmed, inside one transaction. The identity already exists (a
 // login provisioned it), so this updates rather than inserts and is idempotent
@@ -677,18 +367,6 @@ func generateCode() (code, hash string, err error) {
 	return code, hashCode(code), nil
 }
 
-// generateLinkToken returns a fresh opaque one-tap confirm deeplink token (URL-safe
-// base64, 256-bit) and its hex SHA-256 hash. Only the hash is stored; the token
-// travels only in the emailed link, mirroring the session-token model.
-func generateLinkToken() (token, hash string, err error) {
-	buf := make([]byte, linkTokenBytes)
-	if _, err := crand.Read(buf); err != nil {
-		return "", "", fmt.Errorf("account: generate link token: %w", err)
-	}
-	token = base64.RawURLEncoding.EncodeToString(buf)
-	return token, hashCode(token), nil
-}
-
 // hashCode returns the hex-encoded SHA-256 of a confirm-code.
 func hashCode(code string) string {
 	sum := sha256.Sum256([]byte(code))

backend/internal/account/emailtemplate.go

@@ -1,239 +0,0 @@
-package account
-
-import (
-	"fmt"
-	"html/template"
-	"strings"
-	tmpltext "text/template"
-	"time"
-)
-
-// emailBrandColor is the single accent used in the confirmation email — a calm
-// tile green, matching the "no riot of colours" brief.
-const emailBrandColor = "#2f7d4f"
-
-// confirmEmailView is the fully-localised data the confirmation email templates
-// render. Every string is resolved before rendering, so the templates carry no
-// localisation logic.
-type confirmEmailView struct {
-	Brand        string
-	Heading      string
-	Intro        string
-	Code         string
-	Expiry       string
-	CTALabel     string
-	DeeplinkURL  string
-	FooterIgnore string
-	LandingURL   string
-	LandingLabel string
-	Preheader    string
-	Locale       string
-	Accent       string
-}
-
-// emailCopy is the purpose- and locale-specific wording of a confirmation email.
-type emailCopy struct {
-	Subject      string
-	Preheader    string
-	Heading      string
-	Intro        string
-	CTALabel     string
-	FooterIgnore string
-}
-
-// confirmEmailCopy holds the wording per (purpose, locale). Unknown purposes fall
-// back to the neutral link wording and unknown locales fall back to English.
-var confirmEmailCopy = map[string]map[string]emailCopy{
-	purposeLogin: {
-		"en": {
-			Subject:      "Your Erudit sign-in code",
-			Preheader:    "Your sign-in code",
-			Heading:      "Sign in to Erudit",
-			Intro:        "Enter this code to sign in:",
-			CTALabel:     "Sign in with one tap",
-			FooterIgnore: "If you didn't request this email, you can safely ignore it.",
-		},
-		"ru": {
-			Subject:      "Код для входа в Эрудит",
-			Preheader:    "Ваш код для входа",
-			Heading:      "Вход в Эрудит",
-			Intro:        "Введите этот код, чтобы войти в игру:",
-			CTALabel:     "Войти одним нажатием",
-			FooterIgnore: "Если вы не запрашивали это письмо, просто проигнорируйте его.",
-		},
-	},
-	purposeLink: {
-		"en": {
-			Subject:      "Your Erudit confirmation code",
-			Preheader:    "Your confirmation code",
-			Heading:      "Confirm your e-mail",
-			Intro:        "Enter this code to confirm your address:",
-			CTALabel:     "Confirm with one tap",
-			FooterIgnore: "If you didn't request this email, you can safely ignore it.",
-		},
-		"ru": {
-			Subject:      "Код подтверждения Эрудит",
-			Preheader:    "Ваш код подтверждения",
-			Heading:      "Подтверждение e-mail",
-			Intro:        "Введите этот код, чтобы подтвердить адрес:",
-			CTALabel:     "Подтвердить одним нажатием",
-			FooterIgnore: "Если вы не запрашивали это письмо, просто проигнорируйте его.",
-		},
-	},
-	purposeChange: {
-		"en": {
-			Subject:      "Confirm your new Erudit e-mail",
-			Preheader:    "Confirm your new address",
-			Heading:      "Confirm your new e-mail",
-			Intro:        "Enter this code to switch your account to this address:",
-			CTALabel:     "Confirm with one tap",
-			FooterIgnore: "If you didn't request this change, you can safely ignore it — your address stays the same.",
-		},
-		"ru": {
-			Subject:      "Подтвердите новый e-mail в Эрудит",
-			Preheader:    "Подтвердите новый адрес",
-			Heading:      "Смена e-mail",
-			Intro:        "Введите этот код, чтобы привязать аккаунт к новому адресу:",
-			CTALabel:     "Подтвердить одним нажатием",
-			FooterIgnore: "Если вы не запрашивали смену, просто проигнорируйте письмо — адрес останется прежним.",
-		},
-	},
-	purposeDelete: {
-		"en": {
-			Subject:      "Confirm your Erudit account deletion",
-			Preheader:    "Confirm account deletion",
-			Heading:      "Delete your account",
-			Intro:        "Enter this code in the app to permanently delete your account:",
-			CTALabel:     "",
-			FooterIgnore: "If you didn't request this, ignore it — your account stays as it is.",
-		},
-		"ru": {
-			Subject:      "Подтвердите удаление аккаунта Эрудит",
-			Preheader:    "Подтверждение удаления аккаунта",
-			Heading:      "Удаление аккаунта",
-			Intro:        "Введите этот код в приложении, чтобы удалить аккаунт без восстановления:",
-			CTALabel:     "",
-			FooterIgnore: "Если вы не запрашивали удаление, проигнорируйте письмо — аккаунт останется.",
-		},
-	},
-}
-
-// emailBrand is the brand wordmark per locale.
-var emailBrand = map[string]string{"en": "Erudit", "ru": "Эрудит"}
-
-// emailExpiry formats the code-lifetime line per locale (abbreviated minutes to
-// avoid plural agreement).
-func emailExpiry(locale string, d time.Duration) string {
-	min := int(d / time.Minute)
-	if locale == "ru" {
-		return fmt.Sprintf("Код действует %d мин.", min)
-	}
-	return fmt.Sprintf("The code is valid for %d minutes.", min)
-}
-
-// normalizeLocale maps an account language to a supported email locale, defaulting
-// to English.
-func normalizeLocale(locale string) string {
-	if locale == "ru" {
-		return "ru"
-	}
-	return "en"
-}
-
-// renderConfirmationEmail builds the branded confirmation email for purpose in
-// locale: a large readable code plus a one-tap deeplink button, with an
-// ignore-notice footer and a landing link. Both a plain-text body and an HTML
-// alternative are produced. deeplinkURL is the absolute /confirm link and
-// landingURL the public landing origin.
-func renderConfirmationEmail(purpose, code, deeplinkURL, landingURL, locale string) (Message, error) {
-	loc := normalizeLocale(locale)
-	byLocale, ok := confirmEmailCopy[purpose]
-	if !ok {
-		byLocale = confirmEmailCopy[purposeLink]
-	}
-	cp := byLocale[loc]
-	view := confirmEmailView{
-		Brand:        emailBrand[loc],
-		Heading:      cp.Heading,
-		Intro:        cp.Intro,
-		Code:         code,
-		Expiry:       emailExpiry(loc, emailCodeTTL),
-		CTALabel:     cp.CTALabel,
-		DeeplinkURL:  deeplinkURL,
-		FooterIgnore: cp.FooterIgnore,
-		LandingURL:   landingURL,
-		LandingLabel: emailBrand[loc],
-		Preheader:    cp.Preheader,
-		Locale:       loc,
-		Accent:       emailBrandColor,
-	}
-	var html strings.Builder
-	if err := confirmEmailHTML.Execute(&html, view); err != nil {
-		return Message{}, fmt.Errorf("account: render confirmation email (html): %w", err)
-	}
-	var text strings.Builder
-	if err := confirmEmailText.Execute(&text, view); err != nil {
-		return Message{}, fmt.Errorf("account: render confirmation email (text): %w", err)
-	}
-	return Message{Subject: cp.Subject, Text: text.String(), HTML: html.String()}, nil
-}
-
-// confirmEmailHTML is a compact, image-free, mobile-friendly HTML email. Layout is
-// table-based for broad mail-client compatibility and all styling is inlined
-// because clients strip <style> blocks.
-var confirmEmailHTML = template.Must(template.New("confirmEmailHTML").Parse(`<!DOCTYPE html>
-<html lang="{{.Locale}}">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>{{.Brand}}</title>
-</head>
-<body style="margin:0;padding:0;background:#f4f5f7;">
-<span style="display:none;max-height:0;overflow:hidden;opacity:0;">{{.Preheader}}</span>
-<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f4f5f7;padding:24px 12px;">
-<tr><td align="center">
-<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:460px;background:#ffffff;border:1px solid #e5e7eb;border-radius:14px;overflow:hidden;font-family:-apple-system,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
-<tr><td style="padding:28px 32px 4px;">
-<div style="font-size:15px;font-weight:700;letter-spacing:.04em;color:{{.Accent}};">{{.Brand}}</div>
-</td></tr>
-<tr><td style="padding:8px 32px 0;">
-<h1 style="margin:0;font-size:20px;line-height:1.3;color:#111827;font-weight:600;">{{.Heading}}</h1>
-<p style="margin:12px 0 0;font-size:15px;line-height:1.5;color:#374151;">{{.Intro}}</p>
-</td></tr>
-<tr><td style="padding:18px 32px 0;">
-<div style="font-size:34px;font-weight:700;letter-spacing:8px;text-align:center;color:#111827;background:#f3f4f6;border-radius:10px;padding:18px 0;font-family:'SFMono-Regular',Consolas,Menlo,monospace;">{{.Code}}</div>
-<p style="margin:10px 0 0;font-size:13px;line-height:1.5;color:#6b7280;text-align:center;">{{.Expiry}}</p>
-</td></tr>
-{{if .DeeplinkURL}}<tr><td style="padding:22px 32px 0;" align="center">
-<a href="{{.DeeplinkURL}}" style="display:inline-block;background:{{.Accent}};color:#ffffff;text-decoration:none;font-size:15px;font-weight:600;padding:12px 26px;border-radius:9px;">{{.CTALabel}}</a>
-</td></tr>
-{{end}}<tr><td style="padding:26px 32px 28px;">
-<hr style="border:none;border-top:1px solid #eceef1;margin:0 0 16px;">
-<p style="margin:0;font-size:12px;line-height:1.6;color:#9ca3af;">{{.FooterIgnore}}</p>
-<p style="margin:10px 0 0;font-size:12px;color:#9ca3af;"><a href="{{.LandingURL}}" style="color:#6b7280;text-decoration:none;">{{.LandingLabel}}</a></p>
-</td></tr>
-</table>
-</td></tr>
-</table>
-</body>
-</html>
-`))
-
-// confirmEmailText is the plain-text alternative (and multipart fallback).
-var confirmEmailText = tmpltext.Must(tmpltext.New("confirmEmailText").Parse(`{{.Brand}}
-
-{{.Heading}}
-
-{{.Intro}}
-
-    {{.Code}}
-
-{{.Expiry}}
-
-{{if .DeeplinkURL}}{{.CTALabel}}:
-{{.DeeplinkURL}}
-
-{{end}}—
-{{.FooterIgnore}}
-{{.LandingLabel}} — {{.LandingURL}}
-`))

backend/internal/account/emailtemplate_test.go

@@ -1,54 +0,0 @@
-package account
-
-import (
-	"strings"
-	"testing"
-)
-
-// TestRenderConfirmationEmail checks that each (purpose, locale) renders a localised
-// subject, embeds the code and the one-tap deeplink in both bodies, and produces HTML.
-func TestRenderConfirmationEmail(t *testing.T) {
-	const deeplink = "https://erudit-game.ru/app/#/confirm/tok123"
-	cases := []struct {
-		name, purpose, locale, subjectSub string
-	}{
-		{"login ru", purposeLogin, "ru", "вход"},
-		{"login en", purposeLogin, "en", "sign-in"},
-		{"link ru", purposeLink, "ru", "подтвержд"},
-		{"link en", purposeLink, "en", "confirmation"},
-		{"change ru", purposeChange, "ru", "новый"},
-		{"change en", purposeChange, "en", "new"},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			msg, err := renderConfirmationEmail(c.purpose, "123456", deeplink, "https://erudit-game.ru", c.locale)
-			if err != nil {
-				t.Fatalf("render: %v", err)
-			}
-			if !strings.Contains(strings.ToLower(msg.Subject), c.subjectSub) {
-				t.Errorf("subject %q does not contain %q", msg.Subject, c.subjectSub)
-			}
-			if !strings.Contains(msg.Text, "123456") || !strings.Contains(msg.HTML, "123456") {
-				t.Error("code missing from a body")
-			}
-			if !strings.Contains(msg.Text, deeplink) || !strings.Contains(msg.HTML, "confirm/tok123") {
-				t.Error("deeplink missing from a body")
-			}
-			if !strings.Contains(msg.HTML, "<html") {
-				t.Error("HTML body is not HTML")
-			}
-		})
-	}
-}
-
-// TestRenderConfirmationEmailUnknownLocaleDefaultsEnglish falls back to English for an
-// unsupported locale rather than erroring or emitting an empty subject.
-func TestRenderConfirmationEmailUnknownLocaleDefaultsEnglish(t *testing.T) {
-	msg, err := renderConfirmationEmail(purposeLogin, "000000", "", "https://erudit-game.ru", "de")
-	if err != nil {
-		t.Fatalf("render: %v", err)
-	}
-	if !strings.Contains(strings.ToLower(msg.Subject), "sign-in") {
-		t.Errorf("unknown locale should default to English, got subject %q", msg.Subject)
-	}
-}

backend/internal/account/link.go

@@ -2,7 +2,6 @@ package account
 
 import (
 	"context"
-	"database/sql"
 	"errors"
 	"fmt"
 	"time"
@@ -17,68 +16,6 @@ import (
 // belongs to another account; the caller turns it into a merge.
 var ErrIdentityTaken = errors.New("account: identity already linked to another account")
 
-// ErrLastIdentity is returned when removing an identity would leave the account with
-// none, making it unreachable after logout. The admin email-erase refuses it.
-var ErrLastIdentity = errors.New("account: cannot remove the last identity")
-
-// RemoveIdentity deletes the account's identity of the given kind (and, for an email,
-// any pending confirmations for it), freeing it for reuse. It refuses when that is the
-// account's only identity (ErrLastIdentity) — which would leave the account
-// unreachable — and returns ErrNotFound when the account has no identity of that kind.
-// It backs the profile Unlink control and the admin "erase email" action.
-func (s *Store) RemoveIdentity(ctx context.Context, accountID uuid.UUID, kind string) error {
-	ids, err := s.Identities(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	var toRetain []Identity
-	others := 0
-	for _, id := range ids {
-		if id.Kind == kind {
-			toRetain = append(toRetain, id)
-		} else {
-			others++
-		}
-	}
-	if len(toRetain) == 0 {
-		return ErrNotFound
-	}
-	if others == 0 {
-		return ErrLastIdentity
-	}
-	return withTx(ctx, s.db, func(tx *sql.Tx) error {
-		// Journal the detached credential before removing it, so the legal dossier
-		// survives while the identity frees for reuse (see retention.go).
-		for _, id := range toRetain {
-			if err := retainIdentityTx(ctx, tx, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, retainUnlink); err != nil {
-				return err
-			}
-		}
-		delID := table.Identities.DELETE().WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(kind))),
-		)
-		if _, err := delID.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("account: delete %s identity %s: %w", kind, accountID, err)
-		}
-		if kind == KindEmail {
-			delConf := table.EmailConfirmations.DELETE().WHERE(
-				table.EmailConfirmations.AccountID.EQ(postgres.UUID(accountID)),
-			)
-			if _, err := delConf.ExecContext(ctx, tx); err != nil {
-				return fmt.Errorf("account: delete email confirmations %s: %w", accountID, err)
-			}
-		}
-		return nil
-	})
-}
-
-// RemoveEmailIdentity erases the account's email identity. It backs the admin console's
-// "erase email" action; the user-facing profile never unlinks email (it is changed).
-func (s *Store) RemoveEmailIdentity(ctx context.Context, accountID uuid.UUID) error {
-	return s.RemoveIdentity(ctx, accountID, KindEmail)
-}
-
 // RequestLinkCode issues and mails a confirm-code for email to accountID,
 // replacing any prior pending code. Unlike RequestCode it never refuses up front
 // (taken or already-confirmed): possession of the address is the authorization for
@@ -89,10 +26,16 @@ func (s *EmailService) RequestLinkCode(ctx context.Context, accountID uuid.UUID,
 	if err != nil {
 		return err
 	}
-	if !s.allowSend(addr) {
+	code, hash, err := generateCode()
-		return ErrTooManyRequests
+	if err != nil {
+		return err
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID))
+	if err := s.store.replacePendingConfirmation(ctx, accountID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return err
+	}
+	subject := "Your Scrabble confirmation code"
+	body := fmt.Sprintf("Your confirmation code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	return s.mailer.Send(ctx, addr, subject, body)
 }
 
 // ConfirmLink verifies code for (accountID, email) and reports the address's
@@ -127,100 +70,6 @@ func (s *EmailService) ConfirmLink(ctx context.Context, accountID uuid.UUID, ema
 	return accountID, true, nil
 }
 
-// RequestChangeCode issues and mails a confirm-code to newEmail for an authenticated
-// email change on accountID, replacing any prior pending code. Like RequestLinkCode it
-// never refuses up front on "taken" (anti-enumeration): possession of newEmail is the
-// authorization, and a conflict with another account is revealed only at confirm — as a
-// non-disclosing refusal, never a merge.
-func (s *EmailService) RequestChangeCode(ctx context.Context, accountID uuid.UUID, newEmail string) error {
-	addr, err := normalizeEmail(newEmail)
-	if err != nil {
-		return err
-	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
-	return s.issueCode(ctx, accountID, addr, purposeChange, s.accountLocale(ctx, accountID))
-}
-
-// ConfirmChange verifies code for (accountID, newEmail) and atomically replaces the
-// account's confirmed email with newEmail, freeing the old address. When newEmail is
-// already confirmed by another account it refuses with ErrEmailTaken (surfaced to the
-// user as a non-disclosing "check the address or contact support"), never merging; when
-// the account already owns newEmail it is an idempotent no-op. It returns the usual
-// confirm-code errors (ErrNoPendingCode, ErrCodeExpired, ErrTooManyAttempts,
-// ErrCodeMismatch) and the updated account on success.
-func (s *EmailService) ConfirmChange(ctx context.Context, accountID uuid.UUID, newEmail, code string) (Account, error) {
-	addr, err := normalizeEmail(newEmail)
-	if err != nil {
-		return Account{}, err
-	}
-	conf, err := s.verifyPendingCode(ctx, accountID, addr, code)
-	if err != nil {
-		return Account{}, err
-	}
-	owner, ok, err := s.store.confirmedEmailAccount(ctx, addr)
-	if err != nil {
-		return Account{}, err
-	}
-	if ok && owner != accountID {
-		return Account{}, ErrEmailTaken
-	}
-	if ok && owner == accountID {
-		if err := s.store.consumeConfirmation(ctx, conf.id, s.now()); err != nil {
-			return Account{}, err
-		}
-		return s.store.GetByID(ctx, accountID)
-	}
-	if err := s.store.replaceEmailIdentity(ctx, conf.id, accountID, addr, s.now()); err != nil {
-		return Account{}, err
-	}
-	return s.store.GetByID(ctx, accountID)
-}
-
-// HasEmail reports whether accountID owns a confirmed email. The account-deletion step-up
-// mails a confirm-code when it does, and falls back to a typed phrase otherwise.
-func (s *EmailService) HasEmail(ctx context.Context, accountID uuid.UUID) (bool, error) {
-	_, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	return ok, err
-}
-
-// RequestDeleteCode mails an account-deletion confirm-code to the account's own confirmed
-// email (no deeplink — deletion is confirmed in the app). It returns ErrNoEmail when the
-// account holds no email, ErrTooManyRequests when throttled.
-func (s *EmailService) RequestDeleteCode(ctx context.Context, accountID uuid.UUID) error {
-	addr, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	if !ok {
-		return ErrNoEmail
-	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
-	return s.issueCode(ctx, accountID, addr, purposeDelete, s.accountLocale(ctx, accountID))
-}
-
-// VerifyDeleteCode verifies the account-deletion code against the account's own email and
-// consumes it on success. It returns ErrNoEmail (no email), the usual confirm-code errors
-// (ErrNoPendingCode, ErrCodeExpired, ErrTooManyAttempts, ErrCodeMismatch), or nil when the
-// code is valid — the caller then performs the deletion.
-func (s *EmailService) VerifyDeleteCode(ctx context.Context, accountID uuid.UUID, code string) error {
-	addr, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	if !ok {
-		return ErrNoEmail
-	}
-	conf, err := s.verifyPendingCode(ctx, accountID, addr, code)
-	if err != nil {
-		return err
-	}
-	return s.store.consumeConfirmation(ctx, conf.id, s.now())
-}
-
 // verifyPendingCode loads and checks the pending confirm-code for (accountID,
 // addr), counting a wrong attempt. It returns the confirmation on success.
 func (s *EmailService) verifyPendingCode(ctx context.Context, accountID uuid.UUID, addr, code string) (emailConfirmation, error) {

backend/internal/account/mailer.go

@@ -3,78 +3,33 @@ package account
 import (
 	"context"
 	"fmt"
-	"strconv"
+	"net"
-	"strings"
+	"net/smtp"
-	"time"
 
-	"github.com/wneessen/go-mail"
 	"go.uber.org/zap"
 )
 
-// Message is a transactional email to send through a Mailer. Text is the
-// required plain-text body and doubles as the multipart/alternative fallback;
-// HTML, when non-empty, is the preferred body a capable client renders instead.
-type Message struct {
-	To      string
-	Subject string
-	Text    string
-	HTML    string
-}
-
 // Mailer delivers a transactional email. It is the seam behind which the email
 // confirm-code flow sends codes, so the relay is swappable and unit tests use a
-// fixture (see docs/TESTING.md: no real network in tests). The context bounds the
+// fixture (see docs/TESTING.md: no real network in tests). The context is offered
-// delivery and is honoured by the SMTP implementation.
+// for cancellation; the standard-library SMTP implementation sends synchronously
+// and ignores it.
 type Mailer interface {
-	Send(ctx context.Context, msg Message) error
+	Send(ctx context.Context, to, subject, body string) error
 }
 
 // SMTPConfig configures the SMTP relay. An empty Host selects the LogMailer
 // instead, so a deployment without a relay still runs (the code lands in the log).
-// TLS is always used and no client certificate is required — only the server
-// certificate is validated against the system roots.
 type SMTPConfig struct {
 	Host     string
 	Port     string
 	Username string
 	Password string
 	From     string
-	// TLS selects the transport security: "ssl" for implicit TLS from connect, or
-	// "starttls" to upgrade a plaintext connection. Empty derives the mode from the
-	// port (implicit TLS on 465, STARTTLS otherwise); set it explicitly for a relay on
-	// a non-standard port (e.g. Selectel's 1127 = SSL, 1126 = STARTTLS).
-	TLS string
 }
 
-const (
+// SMTPMailer sends mail through an SMTP relay using the standard library. When a
-	// SMTP transport-security modes for SMTPConfig.TLS.
+// username is set it authenticates with PLAIN; otherwise it relays unauthenticated.
-	smtpTLSImplicit = "ssl"
-	smtpTLSSTARTTLS = "starttls"
-	// smtpDialTimeout bounds a single relay connect-and-send. The confirm-code send
-	// is synchronous on the request path, so an unreachable relay must fail fast
-	// rather than hold the request open.
-	smtpDialTimeout = 15 * time.Second
-)
-
-// tlsMode resolves the transport-security mode for the relay: the explicitly
-// configured SMTPConfig.TLS, or — when unset — implicit TLS on the conventional SSL
-// port 465 and STARTTLS on any other port.
-func (cfg SMTPConfig) tlsMode(port int) string {
-	switch strings.ToLower(strings.TrimSpace(cfg.TLS)) {
-	case smtpTLSImplicit, "tls":
-		return smtpTLSImplicit
-	case smtpTLSSTARTTLS:
-		return smtpTLSSTARTTLS
-	}
-	if port == 465 {
-		return smtpTLSImplicit
-	}
-	return smtpTLSSTARTTLS
-}
-
-// SMTPMailer sends mail through an SMTP relay using go-mail. When a username is
-// set it authenticates, auto-discovering the strongest mechanism the relay
-// advertises; otherwise it relays unauthenticated.
 type SMTPMailer struct {
 	cfg SMTPConfig
 }
@@ -84,49 +39,29 @@ func NewSMTPMailer(cfg SMTPConfig) SMTPMailer {
 	return SMTPMailer{cfg: cfg}
 }
 
-// Send delivers a UTF-8 message to msg.To via the configured relay. When msg.HTML
+// Send delivers a plain-text UTF-8 message to to via the configured relay.
-// is set the message is multipart/alternative (plain text plus HTML); otherwise
+func (m SMTPMailer) Send(_ context.Context, to, subject, body string) error {
-// it is plain text only.
+	addr := net.JoinHostPort(m.cfg.Host, m.cfg.Port)
-func (m SMTPMailer) Send(ctx context.Context, msg Message) error {
+	var auth smtp.Auth
-	port, err := strconv.Atoi(m.cfg.Port)
-	if err != nil {
-		return fmt.Errorf("account: invalid SMTP port %q: %w", m.cfg.Port, err)
-	}
-	opts := []mail.Option{mail.WithPort(port), mail.WithTimeout(smtpDialTimeout)}
-	if m.cfg.tlsMode(port) == smtpTLSImplicit {
-		opts = append(opts, mail.WithSSL())
-	} else {
-		opts = append(opts, mail.WithTLSPortPolicy(mail.TLSMandatory))
-	}
 	if m.cfg.Username != "" {
-		opts = append(opts,
+		auth = smtp.PlainAuth("", m.cfg.Username, m.cfg.Password, m.cfg.Host)
-			mail.WithSMTPAuth(mail.SMTPAuthAutoDiscover),
-			mail.WithUsername(m.cfg.Username),
-			mail.WithPassword(m.cfg.Password),
-		)
 	}
-	client, err := mail.NewClient(m.cfg.Host, opts...)
+	if err := smtp.SendMail(addr, auth, m.cfg.From, []string{to}, message(m.cfg.From, to, subject, body)); err != nil {
-	if err != nil {
+		return fmt.Errorf("account: send mail to %s: %w", to, err)
-		return fmt.Errorf("account: build mail client: %w", err)
-	}
-	out := mail.NewMsg()
-	if err := out.From(m.cfg.From); err != nil {
-		return fmt.Errorf("account: set From %q: %w", m.cfg.From, err)
-	}
-	if err := out.To(msg.To); err != nil {
-		return fmt.Errorf("account: set To %q: %w", msg.To, err)
-	}
-	out.Subject(msg.Subject)
-	out.SetBodyString(mail.TypeTextPlain, msg.Text)
-	if msg.HTML != "" {
-		out.AddAlternativeString(mail.TypeTextHTML, msg.HTML)
-	}
-	if err := client.DialAndSendWithContext(ctx, out); err != nil {
-		return fmt.Errorf("account: send mail to %s: %w", msg.To, err)
 	}
 	return nil
 }
 
+// message renders a minimal RFC 5322 plain-text email.
+func message(from, to, subject, body string) []byte {
+	return []byte("From: " + from + "\r\n" +
+		"To: " + to + "\r\n" +
+		"Subject: " + subject + "\r\n" +
+		"MIME-Version: 1.0\r\n" +
+		"Content-Type: text/plain; charset=UTF-8\r\n" +
+		"\r\n" + body + "\r\n")
+}
+
 // LogMailer logs the message instead of sending it. It is the default when no
 // SMTP relay is configured and is intended for development only: it logs the body,
 // which carries the confirm-code, so it must not be used in production.
@@ -139,12 +74,11 @@ func NewLogMailer(log *zap.Logger) LogMailer {
 	return LogMailer{log: log}
 }
 
-// Send logs the message at info level and reports success. It logs the plain-text
+// Send logs the message at info level and reports success.
-// body only (which carries the confirm-code); the HTML alternative is omitted.
+func (m LogMailer) Send(_ context.Context, to, subject, body string) error {
-func (m LogMailer) Send(_ context.Context, msg Message) error {
 	if m.log != nil {
 		m.log.Info("email not sent (log mailer)",
-			zap.String("to", msg.To), zap.String("subject", msg.Subject), zap.String("body", msg.Text))
+			zap.String("to", to), zap.String("subject", subject), zap.String("body", body))
 	}
 	return nil
 }

backend/internal/account/mailer_test.go

@@ -1,29 +0,0 @@
-package account
-
-import "testing"
-
-// TestSMTPTLSMode covers the explicit TLS mode and the port-based fallback, including
-// the non-standard Selectel ports (1127 = SSL, 1126 = STARTTLS) that the 465 heuristic
-// alone cannot classify.
-func TestSMTPTLSMode(t *testing.T) {
-	cases := []struct {
-		name string
-		tls  string
-		port int
-		want string
-	}{
-		{"explicit ssl on a custom port (Selectel 1127)", "ssl", 1127, smtpTLSImplicit},
-		{"explicit starttls on a custom port (Selectel 1126)", "starttls", 1126, smtpTLSSTARTTLS},
-		{"tls is an alias for ssl", "TLS", 2525, smtpTLSImplicit},
-		{"empty derives implicit TLS on 465", "", 465, smtpTLSImplicit},
-		{"empty derives STARTTLS on 587", "", 587, smtpTLSSTARTTLS},
-		{"an unknown value falls back to the port heuristic", "bogus", 465, smtpTLSImplicit},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			if got := (SMTPConfig{TLS: c.tls}).tlsMode(c.port); got != c.want {
-				t.Errorf("tlsMode(TLS=%q, port=%d) = %q, want %q", c.tls, c.port, got, c.want)
-			}
-		})
-	}
-}

backend/internal/account/provision_test.go

@@ -75,55 +75,3 @@ func TestTelegramSeedTruncatesLongName(t *testing.T) {
 		t.Errorf("display name rune count = %d, want %d", n, maxDisplayName)
 	}
 }
-
-// TestVKSeed covers the pure mapping from VK launch fields to the create-time account
-// seed: supported-language detection from vk_language (bare and region-tagged) and the
-// display name sanitized from the client-supplied name. Unlike Telegram there is no
-// @username fallback — VK provides only the name.
-func TestVKSeed(t *testing.T) {
-	cases := map[string]struct {
-		languageCode, displayName string
-		wantLang, wantName        string
-	}{
-		"ru bare":          {"ru", "Иван", "ru", "Иван"},
-		"en region-tagged": {"en-US", "John", "en", "John"},
-		"full name kept":   {"ru", "Иван Петров", "ru", "Иван Петров"},
-		"unknown language": {"uk", "Тарас", "", "Тарас"},
-		"empty language":   {"", "Neo", "", "Neo"},
-		"trimmed":          {" RU ", "  Anna  ", "ru", "Anna"},
-		"emoji stripped":   {"en", "🎮Kaya🎮", "en", "Kaya"},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			got := vkSeed(tc.languageCode, tc.displayName)
-			if got.preferredLanguage != tc.wantLang {
-				t.Errorf("preferredLanguage = %q, want %q", got.preferredLanguage, tc.wantLang)
-			}
-			if got.displayName != tc.wantName {
-				t.Errorf("displayName = %q, want %q", got.displayName, tc.wantName)
-			}
-		})
-	}
-}
-
-// TestVKSeedPlaceholder checks a VK name with no usable letters falls back to a
-// generated placeholder in the seeded language ("Player-NNNNN" / "Игрок-NNNNN").
-func TestVKSeedPlaceholder(t *testing.T) {
-	cases := map[string]struct {
-		languageCode, displayName string
-		wantRe                    string
-	}{
-		"en empty":     {"en", "", `^Player-\d{5}$`},
-		"ru empty":     {"ru", "", `^Игрок-\d{5}$`},
-		"default en":   {"uk", "", `^Player-\d{5}$`},
-		"name garbage": {"ru", "123!@#", `^Игрок-\d{5}$`},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			got := vkSeed(tc.languageCode, tc.displayName).displayName
-			if !regexp.MustCompile(tc.wantRe).MatchString(got) {
-				t.Errorf("displayName = %q, want match %s", got, tc.wantRe)
-			}
-		})
-	}
-}

backend/internal/account/ratelimit.go

@@ -1,66 +0,0 @@
-package account
-
-import (
-	"sync"
-	"time"
-)
-
-// SendLimiter throttles confirm-code sends per recipient address: it enforces a
-// minimum cooldown between two sends and a cap over a rolling hour. It guards against
-// email bombing and protects the relay's own quota. State is in-memory (per process,
-// reset on restart) and keyed by the normalised recipient address, which is adequate
-// for the single-instance backend. Safe for concurrent use.
-type SendLimiter struct {
-	mu       sync.Mutex
-	cooldown time.Duration
-	perHour  int
-	now      func() time.Time
-	sends    map[string][]time.Time
-}
-
-// NewSendLimiter returns a SendLimiter allowing at most one send per cooldown and at
-// most perHour sends over any rolling hour, to the same recipient.
-func NewSendLimiter(cooldown time.Duration, perHour int) *SendLimiter {
-	return &SendLimiter{
-		cooldown: cooldown,
-		perHour:  perHour,
-		now:      func() time.Time { return time.Now() },
-		sends:    make(map[string][]time.Time),
-	}
-}
-
-// Allow reports whether a send to key is permitted now, recording the send when it is.
-// It is denied when the last send was within the cooldown or the rolling-hour cap is
-// already reached.
-func (l *SendLimiter) Allow(key string) bool {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	now := l.now()
-	cutoff := now.Add(-time.Hour)
-	kept := l.sends[key][:0]
-	for _, t := range l.sends[key] {
-		if t.After(cutoff) {
-			kept = append(kept, t)
-		}
-	}
-	if n := len(kept); n > 0 && now.Sub(kept[n-1]) < l.cooldown {
-		l.set(key, kept)
-		return false
-	}
-	if len(kept) >= l.perHour {
-		l.set(key, kept)
-		return false
-	}
-	l.set(key, append(kept, now))
-	return true
-}
-
-// set stores the retained send times for key, dropping the entry entirely once empty
-// so the map stays bounded to recipients active within the last hour.
-func (l *SendLimiter) set(key string, times []time.Time) {
-	if len(times) == 0 {
-		delete(l.sends, key)
-		return
-	}
-	l.sends[key] = times
-}

backend/internal/account/ratelimit_test.go

@@ -1,43 +0,0 @@
-package account
-
-import (
-	"testing"
-	"time"
-)
-
-// TestSendLimiter checks the per-recipient cooldown and the rolling-hour cap, and
-// that recipients are throttled independently.
-func TestSendLimiter(t *testing.T) {
-	base := time.Now()
-	now := base
-	l := NewSendLimiter(time.Minute, 3)
-	l.now = func() time.Time { return now }
-
-	if !l.Allow("a") {
-		t.Fatal("send 1 should be allowed")
-	}
-	if l.Allow("a") {
-		t.Fatal("immediate resend must be blocked by the cooldown")
-	}
-	if !l.Allow("b") {
-		t.Fatal("a different recipient is independent")
-	}
-
-	now = base.Add(time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("send 2 after the cooldown should be allowed")
-	}
-	now = base.Add(2 * time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("send 3 should be allowed")
-	}
-	now = base.Add(3 * time.Minute)
-	if l.Allow("a") {
-		t.Fatal("send 4 within the hour must be blocked by the cap")
-	}
-
-	now = base.Add(time.Hour + time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("after the rolling hour the cap resets")
-	}
-}

backend/internal/account/retention.go

@@ -1,222 +0,0 @@
-package account
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/go-jet/jet/v2/postgres"
-	"github.com/go-jet/jet/v2/qrm"
-	"github.com/google/uuid"
-	"go.uber.org/zap"
-
-	"scrabble/backend/internal/postgres/jet/backend/model"
-	"scrabble/backend/internal/postgres/jet/backend/table"
-)
-
-// RetentionTTL bounds how long the account-deletion legal dossier is kept before the
-// reaper purges it: two years from the detach/deletion event (owner policy, 2026-07-03).
-const RetentionTTL = 2 * 365 * 24 * time.Hour
-
-// Reasons recorded on a retained_identities row: what detached the credential from its
-// account. The row is written just before the live identities row is removed, preserving
-// the legal dossier (which email/vk/tg was linked, and when) even as the identity frees
-// for reuse. See docs/ARCHITECTURE.md §9.1.
-const (
-	retainUnlink = "unlink"
-	retainChange = "change"
-	retainDelete = "delete"
-)
-
-// retainIdentityTx appends a retention-journal row for one identity being detached, inside
-// tx. linkedAt is the identity's original creation time; detached_at defaults to now(). It
-// must run in the same transaction as the identity removal, so the dossier and the live
-// state can never diverge.
-func retainIdentityTx(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, kind, externalID string, confirmed bool, linkedAt time.Time, reason string) error {
-	id, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("account: new retained id: %w", err)
-	}
-	ins := table.RetainedIdentities.INSERT(
-		table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
-		table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
-		table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
-		table.RetainedIdentities.Reason,
-	).VALUES(id, accountID, kind, externalID, confirmed, linkedAt, reason)
-	if _, err := ins.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("account: retain identity (%s, %s): %w", kind, externalID, err)
-	}
-	return nil
-}
-
-// StampLastLogin records the account's last cold-load time and client IP, but only when
-// the stored value is missing or older than an hour — so it costs at most one write per
-// account per hour (its caller, the profile fetch, runs once per cold app-load). It is a
-// best-effort audit signal that feeds the account-deletion dossier.
-func (s *Store) StampLastLogin(ctx context.Context, accountID uuid.UUID, ip string) error {
-	now := time.Now().UTC()
-	upd := table.Accounts.UPDATE(table.Accounts.LastLoginAt, table.Accounts.LastLoginIP).
-		SET(postgres.TimestampzT(now), postgres.String(ip)).
-		WHERE(
-			table.Accounts.AccountID.EQ(postgres.UUID(accountID)).
-				AND(
-					table.Accounts.LastLoginAt.IS_NULL().
-						OR(table.Accounts.LastLoginAt.LT(postgres.TimestampzT(now.Add(-time.Hour)))),
-				),
-		)
-	if _, err := upd.ExecContext(ctx, s.db); err != nil {
-		return fmt.Errorf("account: stamp last login %s: %w", accountID, err)
-	}
-	return nil
-}
-
-// ReapExpiredRetention purges retention data whose event is older than cutoff: every
-// retained_identities row by its detached_at (covering unlink/change on live accounts as
-// well as deleted ones), plus — for accounts tombstoned before cutoff — the retained
-// feedback thread and the dossier PII (deleted_display_name, last_login_ip). Chat is kept
-// (a shared game artifact), and the tombstone account row itself stays (its no-cascade
-// foreign keys). It returns how many journal rows and feedback messages were removed.
-func (s *Store) ReapExpiredRetention(ctx context.Context, cutoff time.Time) (identities, feedback int64, err error) {
-	cut := postgres.TimestampzT(cutoff)
-	delJournal := table.RetainedIdentities.DELETE().
-		WHERE(table.RetainedIdentities.DetachedAt.LT(cut))
-	res, err := delJournal.ExecContext(ctx, s.db)
-	if err != nil {
-		return 0, 0, fmt.Errorf("account: reap retained identities: %w", err)
-	}
-	identities, _ = res.RowsAffected()
-
-	expired := postgres.SELECT(table.Accounts.AccountID).
-		FROM(table.Accounts).
-		WHERE(table.Accounts.DeletedAt.IS_NOT_NULL().AND(table.Accounts.DeletedAt.LT(cut)))
-	delFeedback := table.FeedbackMessages.DELETE().
-		WHERE(table.FeedbackMessages.AccountID.IN(expired))
-	fbRes, err := delFeedback.ExecContext(ctx, s.db)
-	if err != nil {
-		return identities, 0, fmt.Errorf("account: reap deleted feedback: %w", err)
-	}
-	feedback, _ = fbRes.RowsAffected()
-
-	clearPII := table.Accounts.UPDATE(table.Accounts.DeletedDisplayName, table.Accounts.LastLoginIP).
-		SET(postgres.NULL, postgres.NULL).
-		WHERE(
-			table.Accounts.DeletedAt.IS_NOT_NULL().
-				AND(table.Accounts.DeletedAt.LT(cut)).
-				AND(table.Accounts.DeletedDisplayName.IS_NOT_NULL().
-					OR(table.Accounts.LastLoginIP.IS_NOT_NULL())),
-		)
-	if _, err := clearPII.ExecContext(ctx, s.db); err != nil {
-		return identities, feedback, fmt.Errorf("account: clear expired dossier PII: %w", err)
-	}
-	return identities, feedback, nil
-}
-
-// RetainedIdentity is one row of the retention journal, for the admin dossier.
-type RetainedIdentity struct {
-	Kind       string
-	ExternalID string
-	Reason     string
-	Confirmed  bool
-	LinkedAt   time.Time
-	DetachedAt time.Time
-}
-
-// RetainedIdentities returns the account's retention-journal rows (the legal dossier of
-// detached credentials), newest detach first, for the admin console.
-func (s *Store) RetainedIdentities(ctx context.Context, accountID uuid.UUID) ([]RetainedIdentity, error) {
-	var rows []model.RetainedIdentities
-	err := postgres.SELECT(table.RetainedIdentities.AllColumns).
-		FROM(table.RetainedIdentities).
-		WHERE(table.RetainedIdentities.AccountID.EQ(postgres.UUID(accountID))).
-		ORDER_BY(table.RetainedIdentities.DetachedAt.DESC()).
-		QueryContext(ctx, s.db, &rows)
-	if err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return nil, fmt.Errorf("account: retained identities %s: %w", accountID, err)
-	}
-	out := make([]RetainedIdentity, 0, len(rows))
-	for _, r := range rows {
-		out = append(out, RetainedIdentity{
-			Kind: r.Kind, ExternalID: r.ExternalID, Reason: r.Reason,
-			Confirmed: r.Confirmed, LinkedAt: r.LinkedAt, DetachedAt: r.DetachedAt,
-		})
-	}
-	return out, nil
-}
-
-// DeletionInfo is a tombstoned account's dossier header, for the admin console.
-type DeletionInfo struct {
-	DeletedAt          *time.Time
-	DeletedDisplayName string
-	LastLoginAt        *time.Time
-	LastLoginIP        string
-}
-
-// DeletionInfo reads the account's deletion tombstone + last-login dossier fields.
-func (s *Store) DeletionInfo(ctx context.Context, accountID uuid.UUID) (DeletionInfo, error) {
-	var row model.Accounts
-	err := postgres.SELECT(
-		table.Accounts.DeletedAt, table.Accounts.DeletedDisplayName,
-		table.Accounts.LastLoginAt, table.Accounts.LastLoginIP,
-	).FROM(table.Accounts).
-		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(accountID))).
-		QueryContext(ctx, s.db, &row)
-	if err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return DeletionInfo{}, ErrNotFound
-		}
-		return DeletionInfo{}, fmt.Errorf("account: deletion info %s: %w", accountID, err)
-	}
-	info := DeletionInfo{DeletedAt: row.DeletedAt, LastLoginAt: row.LastLoginAt}
-	if row.DeletedDisplayName != nil {
-		info.DeletedDisplayName = *row.DeletedDisplayName
-	}
-	if row.LastLoginIP != nil {
-		info.LastLoginIP = *row.LastLoginIP
-	}
-	return info, nil
-}
-
-// RetentionReaper periodically purges expired account-deletion retention data via
-// Store.ReapExpiredRetention, mirroring GuestReaper: one background goroutine started once
-// from main.
-type RetentionReaper struct {
-	store *Store
-	ttl   time.Duration
-	clock func() time.Time
-	log   *zap.Logger
-}
-
-// NewRetentionReaper constructs a reaper purging retention data older than ttl. log may be
-// nil.
-func NewRetentionReaper(store *Store, ttl time.Duration, log *zap.Logger) *RetentionReaper {
-	if log == nil {
-		log = zap.NewNop()
-	}
-	return &RetentionReaper{
-		store: store,
-		ttl:   ttl,
-		clock: func() time.Time { return time.Now().UTC() },
-		log:   log,
-	}
-}
-
-// Run purges expired retention data on each tick until ctx is cancelled.
-func (r *RetentionReaper) Run(ctx context.Context, interval time.Duration) {
-	ticker := time.NewTicker(interval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			idn, fb, err := r.store.ReapExpiredRetention(ctx, r.clock().Add(-r.ttl))
-			if err != nil {
-				r.log.Warn("retention reap failed", zap.Error(err))
-			} else if idn > 0 || fb > 0 {
-				r.log.Info("reaped expired retention", zap.Int64("identities", idn), zap.Int64("feedback", fb))
-			}
-		}
-	}
-}

backend/internal/account/userlist.go

@@ -19,9 +19,6 @@ type UserListItem struct {
 	PreferredLanguage string
 	IsGuest           bool
 	IsRobot           bool
-	// IsDeleted marks a tombstoned account (deleted_at set), shown as a badge — a search
-	// spans both lists, so a result can be either live or deleted.
-	IsDeleted bool
 	// FlaggedHighRateAt is the soft high-rate marker (zero when unflagged), shown
 	// as a badge in the console list.
 	FlaggedHighRateAt time.Time
@@ -29,17 +26,13 @@ type UserListItem struct {
 }
 
 // UserFilter narrows the admin user list: Robots selects robot accounts (otherwise the
-// non-robot "people"); Deleted selects tombstoned accounts (every other scope hides them);
+// non-robot "people"); NameMask and ExternalIDMask are glob masks ('*' = any run, '?' =
-// NameMask and ExternalIDMask are glob masks ('*' = any run, '?' = one char) matched
+// one char) matched case-insensitively against the display name / any identity's external
-// case-insensitively against the display name / any identity's external id; EmailExact is a
+// id. An empty mask means no filter on that field.
-// strict (exact) match against an account's email identity. An empty value means no filter
-// on that field.
 type UserFilter struct {
 	Robots         bool
-	Deleted        bool
 	NameMask       string
 	ExternalIDMask string
-	EmailExact     string
 }
 
 // robotExists is the correlated subquery testing whether account a is a robot.
@@ -58,42 +51,17 @@ func (s *Store) IsRobot(ctx context.Context, accountID uuid.UUID) (bool, error)
 	return ok, nil
 }
 
-// userListWhere builds the shared WHERE clause and its positional args (from $1). On the
+// userListWhere builds the shared WHERE clause and its positional args (from $1).
-// Robots tab it lists/searches robots only. Otherwise a search (any of the name /
-// external-id / email filters) spans live and deleted people alike — never robots — so the
-// operator finds a match from one query regardless of the People / Deleted tab; the search
-// also looks in the retention journal, so a deleted account is still found by the email /
-// external id it held (those rows moved from identities to retained_identities on deletion)
-// and by its retained real name. With no search, the People / Deleted tab scope applies.
 func userListWhere(f UserFilter) (string, []any) {
-	name := LikePattern(f.NameMask)
+	args := []any{f.Robots}
-	ext := LikePattern(f.ExternalIDMask)
+	where := robotExists + ` = $1`
-	email := strings.ToLower(strings.TrimSpace(f.EmailExact))
+	if name := LikePattern(f.NameMask); name != "" {
-	searching := name != "" || ext != "" || email != ""
-
-	var args []any
-	var where string
-	switch {
-	case f.Robots:
-		where = robotExists + ` = true`
-	case searching:
-		where = robotExists + ` = false`
-	case f.Deleted:
-		where = robotExists + ` = false AND a.deleted_at IS NOT NULL`
-	default:
-		where = robotExists + ` = false AND a.deleted_at IS NULL`
-	}
-	if name != "" {
 		args = append(args, name)
-		where += fmt.Sprintf(` AND (a.display_name ILIKE $%d ESCAPE '\' OR a.deleted_display_name ILIKE $%d ESCAPE '\')`, len(args), len(args))
+		where += fmt.Sprintf(` AND a.display_name ILIKE $%d ESCAPE '\'`, len(args))
 	}
-	if ext != "" {
+	if ext := LikePattern(f.ExternalIDMask); ext != "" {
 		args = append(args, ext)
-		where += fmt.Sprintf(` AND (EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.external_id ILIKE $%d ESCAPE '\') OR EXISTS (SELECT 1 FROM backend.retained_identities r WHERE r.account_id = a.account_id AND r.external_id ILIKE $%d ESCAPE '\'))`, len(args), len(args))
+		where += fmt.Sprintf(` AND EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.external_id ILIKE $%d ESCAPE '\')`, len(args))
-	}
-	if email != "" {
-		args = append(args, email)
-		where += fmt.Sprintf(` AND (EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.kind = 'email' AND i.external_id = $%d) OR EXISTS (SELECT 1 FROM backend.retained_identities r WHERE r.account_id = a.account_id AND r.kind = 'email' AND r.external_id = $%d))`, len(args), len(args))
 	}
 	return where, args
 }
@@ -101,7 +69,7 @@ func userListWhere(f UserFilter) (string, []any) {
 // ListUsers returns the filtered admin user list, newest first, paginated.
 func (s *Store) ListUsers(ctx context.Context, f UserFilter, limit, offset int) ([]UserListItem, error) {
 	where, args := userListWhere(f)
-	q := `SELECT a.account_id, a.display_name, a.preferred_language, a.is_guest, a.flagged_high_rate_at, a.created_at, ` + robotExists + ` AS is_robot, (a.deleted_at IS NOT NULL) AS is_deleted
+	q := `SELECT a.account_id, a.display_name, a.preferred_language, a.is_guest, a.flagged_high_rate_at, a.created_at, ` + robotExists + ` AS is_robot
 FROM backend.accounts a WHERE ` + where +
 		fmt.Sprintf(` ORDER BY a.created_at DESC LIMIT $%d OFFSET $%d`, len(args)+1, len(args)+2)
 	args = append(args, limit, offset)
@@ -114,7 +82,7 @@ FROM backend.accounts a WHERE ` + where +
 	for rows.Next() {
 		var it UserListItem
 		var flagged sql.NullTime
-		if err := rows.Scan(&it.ID, &it.DisplayName, &it.PreferredLanguage, &it.IsGuest, &flagged, &it.CreatedAt, &it.IsRobot, &it.IsDeleted); err != nil {
+		if err := rows.Scan(&it.ID, &it.DisplayName, &it.PreferredLanguage, &it.IsGuest, &flagged, &it.CreatedAt, &it.IsRobot); err != nil {
 			return nil, fmt.Errorf("account: scan user: %w", err)
 		}
 		if flagged.Valid {

backend/internal/accountdelete/delete.go

@@ -1,223 +0,0 @@
-// Package accountdelete deactivates an account as legal retention, not erasure: it keeps
-// the account row as a tombstone (its chat/complaint foreign keys have no cascade, so a
-// hard delete is impossible) while journalling and freeing the account's credentials,
-// anonymising the live surfaces, and dropping the account's own social/ephemeral rows.
-// The retained_identities journal plus the tombstone (deleted_at, deleted_display_name,
-// last_login_at/ip) form the admin/legal dossier; messages are deliberately kept. Session
-// revocation and active-game forfeit are orchestrated one layer up (they need the session
-// cache and the game service). See docs/ARCHITECTURE.md §9.1 and the retention TTL reaper.
-package accountdelete
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/go-jet/jet/v2/postgres"
-	"github.com/go-jet/jet/v2/qrm"
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/postgres/jet/backend/model"
-	"scrabble/backend/internal/postgres/jet/backend/table"
-)
-
-// AnonymizedName is the label a deleted account shows to opponents. Display names are
-// stored strings resolved identically for every viewer (no per-viewer localisation in this
-// codebase), so a single canonical label is used. The brackets are deliberate: the
-// editable-name rule (account.displayNameRe) forbids them, so a live player can never set a
-// name that impersonates a deleted account.
-const AnonymizedName = "[Deleted]"
-
-// retainDelete is the retained_identities reason written when a credential is journalled
-// because its account is being deleted.
-const retainDelete = "delete"
-
-// Deleter performs the SQL-atomic part of account deletion over a Postgres handle.
-type Deleter struct {
-	db  *sql.DB
-	now func() time.Time
-}
-
-// NewDeleter constructs a Deleter over db.
-func NewDeleter(db *sql.DB) *Deleter {
-	return &Deleter{db: db, now: func() time.Time { return time.Now().UTC() }}
-}
-
-// AnonymizeAndTombstone retires accountID atomically: it journals every live identity into
-// retained_identities (reason=delete) then removes them so the credentials free for reuse,
-// snapshots the real display name into deleted_display_name and scrubs the live one to
-// AnonymizedName, sets deleted_at, anonymises the account's game-seat snapshots, and drops
-// its friendships, blocks, invitations, friend codes, drafts and pending codes. Chat,
-// feedback and complaints are kept (the surviving tombstone keeps their no-cascade foreign
-// keys valid). It is idempotent-safe on an already-tombstoned account (re-journalling
-// nothing, since the identities are already gone).
-func (d *Deleter) AnonymizeAndTombstone(ctx context.Context, accountID uuid.UUID) error {
-	now := d.now()
-	return withTx(ctx, d.db, func(tx *sql.Tx) error {
-		if err := journalAndDropIdentities(ctx, tx, accountID, now); err != nil {
-			return err
-		}
-		if err := tombstone(ctx, tx, accountID, now); err != nil {
-			return err
-		}
-		if _, err := table.GamePlayers.UPDATE(table.GamePlayers.DisplayName).
-			SET(postgres.String(AnonymizedName)).
-			WHERE(table.GamePlayers.AccountID.EQ(postgres.UUID(accountID))).
-			ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountdelete: anonymise seats: %w", err)
-		}
-		return dropSocialAndEphemerals(ctx, tx, accountID)
-	})
-}
-
-// dropAllRobotGamesSQL deletes every game in which the account plays and no other seat is a
-// human — a robot seat is one whose account holds a 'robot' identity, so this covers both
-// honest vs-AI games and disguised auto-match substitutes. The game rows are deleted; their
-// moves/chat/players/complaints fall away through ON DELETE CASCADE.
-const dropAllRobotGamesSQL = `
-DELETE FROM games g
-WHERE EXISTS (
-    SELECT 1 FROM game_players p WHERE p.game_id = g.game_id AND p.account_id = $1
-) AND NOT EXISTS (
-    SELECT 1 FROM game_players o
-    WHERE o.game_id = g.game_id AND o.account_id <> $1
-      AND NOT EXISTS (
-          SELECT 1 FROM identities i WHERE i.account_id = o.account_id AND i.kind = 'robot'
-      )
-)`
-
-// DropAllRobotGames deletes the account's games that have no human opponent (solo vs-AI or
-// auto-match-robot games), returning how many were removed. Games with any human seat are
-// kept — their seat is anonymised by AnonymizeAndTombstone instead. Run it after the
-// account's active games are resigned, so no live game is removed under the robot driver.
-func (d *Deleter) DropAllRobotGames(ctx context.Context, accountID uuid.UUID) (int64, error) {
-	res, err := d.db.ExecContext(ctx, dropAllRobotGamesSQL, accountID)
-	if err != nil {
-		return 0, fmt.Errorf("accountdelete: drop all-robot games: %w", err)
-	}
-	n, err := res.RowsAffected()
-	if err != nil {
-		return 0, fmt.Errorf("accountdelete: dropped games count: %w", err)
-	}
-	return n, nil
-}
-
-// journalAndDropIdentities copies the account's live identities into the retention journal
-// (reason=delete) and then removes them, freeing each (kind, external_id) for reuse.
-func journalAndDropIdentities(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, now time.Time) error {
-	var ids []model.Identities
-	err := postgres.SELECT(table.Identities.AllColumns).
-		FROM(table.Identities).
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(accountID))).
-		QueryContext(ctx, tx, &ids)
-	if err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return fmt.Errorf("accountdelete: load identities: %w", err)
-	}
-	for _, id := range ids {
-		rid, err := uuid.NewV7()
-		if err != nil {
-			return fmt.Errorf("accountdelete: new retained id: %w", err)
-		}
-		ins := table.RetainedIdentities.INSERT(
-			table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
-			table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
-			table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
-			table.RetainedIdentities.DetachedAt, table.RetainedIdentities.Reason,
-		).VALUES(rid, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, now, retainDelete)
-		if _, err := ins.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountdelete: retain identity %s: %w", id.Kind, err)
-		}
-	}
-	if _, err := table.Identities.DELETE().
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(accountID))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete identities: %w", err)
-	}
-	return nil
-}
-
-// tombstone marks the account deleted, snapshotting the real display name into
-// deleted_display_name (evaluated from the old row) before scrubbing the live one.
-func tombstone(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, now time.Time) error {
-	upd := table.Accounts.UPDATE(
-		table.Accounts.DeletedAt, table.Accounts.DeletedDisplayName,
-		table.Accounts.DisplayName, table.Accounts.UpdatedAt,
-	).SET(
-		postgres.TimestampzT(now), table.Accounts.DisplayName,
-		postgres.String(AnonymizedName), postgres.TimestampzT(now),
-	).WHERE(table.Accounts.AccountID.EQ(postgres.UUID(accountID)))
-	if _, err := upd.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: tombstone account: %w", err)
-	}
-	return nil
-}
-
-// dropSocialAndEphemerals removes the account's own friendships, blocks, invitations
-// (as inviter and as invitee), friend codes, drafts and pending confirm-codes. These are
-// the deleting user's private data with no dossier value; chat and feedback are kept.
-func dropSocialAndEphemerals(ctx context.Context, tx *sql.Tx, accountID uuid.UUID) error {
-	id := postgres.UUID(accountID)
-	// Friendships and blocks are two-account edges keyed on either endpoint.
-	if _, err := table.Friendships.DELETE().
-		WHERE(table.Friendships.RequesterID.EQ(id).OR(table.Friendships.AddresseeID.EQ(id))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete friendships: %w", err)
-	}
-	if _, err := table.Blocks.DELETE().
-		WHERE(table.Blocks.BlockerID.EQ(id).OR(table.Blocks.BlockedID.EQ(id))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete blocks: %w", err)
-	}
-	// Invitations: drop the account's invitee rows, then its own invitations' invitees and
-	// the invitations themselves (children first, to respect the foreign key).
-	if _, err := table.GameInvitationInvitees.DELETE().
-		WHERE(table.GameInvitationInvitees.AccountID.EQ(id)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete invitee rows: %w", err)
-	}
-	ownInvitations := postgres.SELECT(table.GameInvitations.InvitationID).
-		FROM(table.GameInvitations).
-		WHERE(table.GameInvitations.InviterID.EQ(id))
-	if _, err := table.GameInvitationInvitees.DELETE().
-		WHERE(table.GameInvitationInvitees.InvitationID.IN(ownInvitations)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete own invitation invitees: %w", err)
-	}
-	if _, err := table.GameInvitations.DELETE().
-		WHERE(table.GameInvitations.InviterID.EQ(id)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete invitations: %w", err)
-	}
-	// Ephemerals: friend codes, move drafts, pending confirm-codes.
-	if _, err := table.FriendCodes.DELETE().
-		WHERE(table.FriendCodes.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete friend codes: %w", err)
-	}
-	if _, err := table.GameDrafts.DELETE().
-		WHERE(table.GameDrafts.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete drafts: %w", err)
-	}
-	if _, err := table.EmailConfirmations.DELETE().
-		WHERE(table.EmailConfirmations.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete confirmations: %w", err)
-	}
-	return nil
-}
-
-// withTx runs fn inside a transaction, committing on success and rolling back on error.
-func withTx(ctx context.Context, db *sql.DB, fn func(tx *sql.Tx) error) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("accountdelete: begin tx: %w", err)
-	}
-	if err := fn(tx); err != nil {
-		_ = tx.Rollback()
-		return err
-	}
-	if err := tx.Commit(); err != nil {
-		return fmt.Errorf("accountdelete: commit tx: %w", err)
-	}
-	return nil
-}

backend/internal/adminconsole/render_test.go

@@ -24,7 +24,6 @@ func TestRendererRendersEveryPage(t *testing.T) {
 		{"dashboard", DashboardView{Accounts: 3, Variants: []VariantVersions{{Variant: "scrabble_en", Latest: "v1", Versions: []string{"v1"}}}}, "Dashboard"},
 		{"users", UsersView{Items: []UserRow{{ID: "a1", DisplayName: "Kaya", FlaggedHighRate: true}}, Pager: NewPager(1, 50, 1)}, "high-rate"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", HasStats: true, Stats: StatsRow{Wins: 2}, TelegramID: "123", ConnectorEnabled: true}, "Send Telegram message"},
-		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", VKID: "494075"}, "vk.com/id494075"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", FlaggedHighRateAt: "2026-06-10 12:00"}, "Clear high-rate flag"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", Roles: []string{"feedback_banned"}, KnownRoles: []string{"feedback_banned"}}, "feedback_banned"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya",

backend/internal/adminconsole/templates/pages/user_detail.gohtml

@@ -101,29 +101,6 @@
 {{else}}<tr><td colspan="4"><span class="note">no identities (guest)</span></td></tr>{{end}}
 </tbody>
 </table>
-{{if .HasEmail}}
-<form class="form" method="post" action="/_gm/users/{{.ID}}/remove-email" onsubmit="return confirm('Erase the email identity from this account? The address will be freed.')">
-<button type="submit">Erase email</button>
-</form>
-{{end}}
-</section>
-<section class="panel"><h2>Deletion &amp; retention</h2>
-{{if .LastLoginAt}}<p class="note">Last login: {{.LastLoginAt}}{{if .LastLoginIP}} — <code>{{.LastLoginIP}}</code>{{end}}</p>{{end}}
-{{if .Deleted}}<p><span class="warn">Deleted</span> at {{.DeletedAt}}{{if .DeletedName}} — was <code>{{.DeletedName}}</code>{{end}}</p>{{end}}
-{{if .Retained}}
-<h3>Retention journal (legal dossier of detached credentials)</h3>
-<table class="list">
-<thead><tr><th>Kind</th><th>Credential</th><th>Reason</th><th>Detached</th></tr></thead>
-<tbody>
-{{range .Retained}}<tr><td>{{.Kind}}</td><td><code>{{.ExternalID}}</code></td><td>{{.Reason}}</td><td>{{.DetachedAt}}</td></tr>{{end}}
-</tbody>
-</table>
-{{end}}
-{{if not .Deleted}}
-<form class="form" method="post" action="/_gm/users/{{.ID}}/delete" onsubmit="return confirm('Delete this account? Its credentials are journalled and freed, its data anonymised, and its sessions revoked. This cannot be undone.')">
-<button type="submit">Delete user</button>
-</form>
-{{end}}
 </section>
 <section class="panel"><h2>Friends</h2>
 <table class="list">
@@ -165,11 +142,6 @@
 {{else}}<p class="note">connector not configured (set BACKEND_CONNECTOR_ADDR)</p>{{end}}
 </section>
 {{end}}
-{{if .VKID}}
-<section class="panel"><h2>VK</h2>
-<p>VK ID: <code>{{.VKID}}</code> · <a href="https://vk.com/id{{.VKID}}" target="_blank" rel="noopener">open profile</a></p>
-</section>
-{{end}}
 <section class="panel"><h2>Games</h2>
 <table class="list">
 <thead><tr><th>Game</th><th>Variant</th><th>Status</th><th class="num">Players</th><th>Updated</th></tr></thead>

backend/internal/adminconsole/templates/pages/users.gohtml

@@ -2,15 +2,13 @@
 <h1>Users</h1>
 {{with .Data}}
 <nav class="subnav">
-<a href="/_gm/users"{{if and (not .Robots) (not .Deleted)}} class="active"{{end}}>People</a> ·
+<a href="/_gm/users"{{if not .Robots}} class="active"{{end}}>People</a> ·
-<a href="/_gm/users?kind=deleted"{{if .Deleted}} class="active"{{end}}>Deleted</a> ·
 <a href="/_gm/users?kind=robots"{{if .Robots}} class="active"{{end}}>Robots</a>
 </nav>
 <form class="form" method="get" action="/_gm/users">
-{{if .Robots}}<input type="hidden" name="kind" value="robots">{{end}}{{if .Deleted}}<input type="hidden" name="kind" value="deleted">{{end}}
+{{if .Robots}}<input type="hidden" name="kind" value="robots">{{end}}
 <input name="name" value="{{.NameMask}}" placeholder="display name mask (* ?)">
 <input name="ext" value="{{.ExternalIDMask}}" placeholder="external id mask (* ?)">
-<input name="email" value="{{.EmailExact}}" placeholder="email (exact)" type="search">
 <button type="submit">Filter</button>
 </form>
 <table class="list">
@@ -19,7 +17,7 @@
 {{range .Items}}
 <tr>
 <td><a href="/_gm/users/{{.ID}}">{{.ID}}</a></td>
-<td>{{.DisplayName}}{{if .Deleted}} <span class="pill">deleted</span>{{end}}{{if .Guest}} <span class="pill">guest</span>{{end}}{{if .FlaggedHighRate}} <span class="pill">high-rate</span>{{end}}</td>
+<td>{{.DisplayName}}{{if .Guest}} <span class="pill">guest</span>{{end}}{{if .FlaggedHighRate}} <span class="pill">high-rate</span>{{end}}</td>
 <td>{{.Kind}}</td>
 <td>{{.Language}}</td>
 <td>{{.CreatedAt}}</td>

backend/internal/adminconsole/views.go

@@ -60,10 +60,8 @@ type UsersView struct {
 	// be emitted verbatim — interpolated as a plain string it would have its "=" and "&"
 	// percent-encoded again by the contextual escaper.
 	Robots         bool
-	Deleted        bool
 	NameMask       string
 	ExternalIDMask string
-	EmailExact     string
 	FilterQuery    template.URL
 }
 
@@ -76,7 +74,6 @@ type UserRow struct {
 	Kind            string
 	Language        string
 	Guest           bool
-	Deleted         bool
 	FlaggedHighRate bool
 	CreatedAt       string
 	HasMoveStats    bool
@@ -153,34 +150,19 @@ type UserDetailView struct {
 	// MergedInto is the primary account id when this account has been retired by a
 	// merge, or empty for a live account.
 	MergedInto string
-	// The account-deletion dossier. Deleted marks a tombstoned account; DeletedAt and
-	// DeletedName are its deletion time and retained real name; LastLoginAt/IP are the
-	// last cold-load stamp (shown for any account); Retained is the credential journal.
-	Deleted     bool
-	DeletedAt   string
-	DeletedName string
-	LastLoginAt string
-	LastLoginIP string
-	Retained    []RetainedRow
 	// FlaggedHighRateAt is the pre-formatted soft high-rate marker timestamp,
 	// empty for an unflagged account; the card shows it with the Clear action.
 	FlaggedHighRateAt string
 	HintBalance       int
 	// HintGrantMax is the per-grant cap the operator's "add hints" form enforces (it mirrors the
 	// server's maxHintGrant), passed through so the policy value lives in one place.
-	HintGrantMax int
+	HintGrantMax     int
-	CreatedAt    string
+	CreatedAt        string
-	HasStats     bool
+	HasStats         bool
-	Stats        StatsRow
+	Stats            StatsRow
-	Identities   []IdentityRow
+	Identities       []IdentityRow
-	// HasEmail gates the "Erase email" action; set when the account carries an email identity.
+	Games            []GameRow
-	HasEmail bool
-	Games    []GameRow
-	// TelegramID and VKID are the account's platform external ids (empty when absent).
-	// TelegramID gates the "Send Telegram message" operator action; VKID surfaces the VK
-	// user id with a link to the VK profile (there is no VK messaging to drive).
 	TelegramID       string
-	VKID             string
 	ConnectorEnabled bool
 	// MoveChart is the pre-rendered inline SVG of the account's per-move-number think
 	// time (min/mean/max), empty when the account has no timed move.
@@ -248,17 +230,6 @@ type IdentityRow struct {
 	CreatedAt  string
 }
 
-// RetainedRow is one credential in the account-deletion retention journal (the legal
-// dossier of detached credentials): what was detached, when, and why.
-type RetainedRow struct {
-	Kind       string
-	ExternalID string
-	Reason     string
-	Confirmed  bool
-	LinkedAt   string
-	DetachedAt string
-}
-
 // GameRow is one game row in a list.
 type GameRow struct {
 	ID        string

backend/internal/config/config.go

@@ -4,7 +4,6 @@ package config
 
 import (
 	"fmt"
-	"net/url"
 	"os"
 	"strconv"
 	"time"
@@ -43,12 +42,6 @@ type Config struct {
 	// SMTP configures the email relay used for confirm-codes. An empty Host
 	// selects the development log mailer (the code is logged, not sent).
 	SMTP account.SMTPConfig
-	// PublicBaseURL is the canonical public origin (scheme + host, e.g.
-	// https://erudit-game.ru) used to build absolute links in outgoing email — the
-	// confirm deeplink and the footer landing link. It is deliberately not derived
-	// from a request Host header, which would let an attacker inject a phishing link
-	// into the email. Required whenever an SMTP relay is configured.
-	PublicBaseURL string
 	// ConnectorAddr is the gRPC address of the Telegram platform connector
 	// side-service, used by the admin console to send operator broadcasts. Empty
 	// disables broadcasts (the admin broadcast actions report "not configured").
@@ -58,12 +51,6 @@ type Config struct {
 	// GuestRetention is the account age past which an unused guest (no game seat)
 	// is eligible for deletion by the reaper.
 	GuestRetention time.Duration
-	// ExportSignKey signs the finished-game export download URLs. Empty leaves
-	// the export-URL endpoints disabled (503 on mint, 404 on download).
-	ExportSignKey string
-	// RendererURL is the base URL of the internal image-render sidecar (e.g.
-	// http://renderer:8090). Empty disables the PNG export artifact.
-	RendererURL string
 }
 
 // Defaults applied when the corresponding environment variable is unset.
@@ -148,7 +135,6 @@ func Load() (Config, error) {
 		Username: os.Getenv("BACKEND_SMTP_USERNAME"),
 		Password: os.Getenv("BACKEND_SMTP_PASSWORD"),
 		From:     envOr("BACKEND_SMTP_FROM", "no-reply@localhost"),
-		TLS:      os.Getenv("BACKEND_SMTP_TLS"),
 	}
 
 	c := Config{
@@ -162,12 +148,9 @@ func Load() (Config, error) {
 		Robot:             rb,
 		RateWatch:         rw,
 		SMTP:              smtp,
-		PublicBaseURL:     os.Getenv("BACKEND_PUBLIC_BASE_URL"),
 		ConnectorAddr:     os.Getenv("BACKEND_CONNECTOR_ADDR"),
 		GuestReapInterval: guestReapInterval,
 		GuestRetention:    guestRetention,
-		ExportSignKey:     os.Getenv("BACKEND_EXPORT_SIGN_KEY"),
-		RendererURL:       os.Getenv("BACKEND_RENDERER_URL"),
 	}
 	if err := c.validate(); err != nil {
 		return Config{}, err
@@ -212,14 +195,6 @@ func (c Config) validate() error {
 	if c.GuestRetention <= 0 {
 		return fmt.Errorf("config: BACKEND_GUEST_RETENTION must be positive")
 	}
-	if c.SMTP.Host != "" {
-		if c.PublicBaseURL == "" {
-			return fmt.Errorf("config: BACKEND_PUBLIC_BASE_URL must be set when BACKEND_SMTP_HOST is configured")
-		}
-		if u, err := url.Parse(c.PublicBaseURL); err != nil || u.Scheme == "" || u.Host == "" {
-			return fmt.Errorf("config: BACKEND_PUBLIC_BASE_URL %q must be an absolute URL (scheme://host)", c.PublicBaseURL)
-		}
-	}
 	return nil
 }
 

backend/internal/engine/registry.go

@@ -21,13 +21,11 @@ var dictFiles = map[Variant]string{
 	VariantErudit:          "ru_erudit.dawg",
 }
 
-// entry is one resident dictionary: the loaded finder, the solver built over it
+// entry is one resident dictionary: the loaded finder and the solver built over
-// and the file it was loaded from. The finder is retained so Close can release
+// it. The finder is retained so Close can release it.
-// it; path is retained so the raw bytes can be re-read for the client download.
 type entry struct {
 	finder dawg.Finder
 	solver *scrabble.Solver
-	path   string
 }
 
 // Registry holds the dictionaries resident in memory, addressed by variant and
@@ -132,7 +130,7 @@ func (r *Registry) Load(v Variant, version, dir string) error {
 	if old, ok := r.entries[v][version]; ok {
 		_ = old.finder.Close()
 	}
-	r.entries[v][version] = entry{finder: finder, solver: scrabble.NewSolver(rs, finder), path: path}
+	r.entries[v][version] = entry{finder: finder, solver: scrabble.NewSolver(rs, finder)}
 	r.latest[v] = version
 	return nil
 }
@@ -204,30 +202,6 @@ func (r *Registry) Versions(v Variant) []string {
 	return versions
 }
 
-// DictBytes returns the raw serialized DAWG for the (variant, version) pair,
-// re-read from the file it was loaded from — the same immutable bytes the solver
-// holds. It backs the client-side dictionary download for the local move
-// preview. It returns ErrUnknownVariant or ErrUnknownVersion when that dictionary
-// is not resident, and wraps any read error. The file is read outside the lock.
-func (r *Registry) DictBytes(v Variant, version string) ([]byte, error) {
-	r.mu.RLock()
-	versions, ok := r.entries[v]
-	if !ok {
-		r.mu.RUnlock()
-		return nil, fmt.Errorf("%w: %s", ErrUnknownVariant, v)
-	}
-	e, ok := versions[version]
-	r.mu.RUnlock()
-	if !ok {
-		return nil, fmt.Errorf("%w: %s/%s", ErrUnknownVersion, v, version)
-	}
-	data, err := os.ReadFile(e.path)
-	if err != nil {
-		return nil, fmt.Errorf("engine: read %s/%s dictionary bytes from %s: %w", v, version, e.path, err)
-	}
-	return data, nil
-}
-
 // Lookup reports whether word is present in the (variant, version) dictionary,
 // backing the unlimited word-check tool. It returns ErrUnknownVariant or
 // ErrUnknownVersion when that dictionary is not resident, and an error when word

backend/internal/game/service.go

@@ -54,14 +54,8 @@ type Service struct {
 	// have committed a move (a nudge answered by moving stops counting as unread). It is
 	// best-effort and kept as a func so the game package never imports the social package.
 	clearNudges func(ctx context.Context, gameID, accountID uuid.UUID) error
-	// expireNudges, when set, marks every pending nudge in a game read once the game
+	metrics     *gameMetrics
-	// finishes (the nudge badge is stale on a completed game). Unlike clearNudges it is
+	log         *zap.Logger
-	// keyed by game alone — it clears all seats' nudges, not one mover's — and runs on
-	// every completion path through commit. Best-effort; a func so the game package never
-	// imports the social package.
-	expireNudges func(ctx context.Context, gameID uuid.UUID) error
-	metrics      *gameMetrics
-	log          *zap.Logger
 }
 
 // NewService constructs a Service. store and accounts wrap the same pool;
@@ -113,15 +107,6 @@ func (svc *Service) SetNudgeClearer(fn func(ctx context.Context, gameID, account
 	svc.clearNudges = fn
 }
 
-// SetNudgeExpirer installs the hook that marks every pending nudge in a game read once the
-// game finishes, on any completion path (a closing move, a resignation, a turn-timeout or a
-// forfeit). It must be called during startup wiring; the default (nil) leaves a finished
-// game's nudges to expire only when a recipient opens the move history or chat. The social
-// package wires its ExpireNudges here. Chat messages are deliberately left unread.
-func (svc *Service) SetNudgeExpirer(fn func(ctx context.Context, gameID uuid.UUID) error) {
-	svc.expireNudges = fn
-}
-
 // SetFirstMoveEntropy overrides the entropy source for the first-move draw
 // (docs/ARCHITECTURE.md §6). It must be called during wiring or test setup before any
 // game is created; the production default is crypto/rand and is never overridden.
@@ -714,16 +699,6 @@ func (svc *Service) commit(ctx context.Context, gameID uuid.UUID, g *engine.Game
 	}
 	if c.finished {
 		svc.cache.remove(gameID)
-		// A finished game's nudges are stale, so clear them all here — every completion path
-		// funnels through commit (a closing move, a resignation, a forfeit or a turn-timeout),
-		// and only the move path also clears the mover's nudge on its own. Best-effort like
-		// clearNudges: the finish has committed, so a cleanup failure is logged, not surfaced.
-		// ExpireNudges leaves chat messages unread.
-		if svc.expireNudges != nil {
-			if err := svc.expireNudges(ctx, gameID); err != nil {
-				svc.log.Warn("expire nudges on game finish", zap.Error(err))
-			}
-		}
 	}
 	post, err := svc.store.GetGame(ctx, gameID)
 	if err != nil {
@@ -1363,53 +1338,30 @@ func (svc *Service) SetupDraws(ctx context.Context, gameID uuid.UUID) ([]SetupDr
 	return svc.store.SetupDraws(ctx, gameID)
 }
 
-// ExportView returns a finished game with its journal and per-seat display names —
+// ExportGCG renders a game as GCG text from the journal alone (no dictionary). It
-// the material every export artifact (the GCG text, the PNG render payload) is built
+// is allowed only on a finished game: exporting an in-progress game would leak the
-// from. It is allowed only on a finished game: exporting an in-progress game would
+// full move journal mid-play, so an active game yields ErrGameActive.
-// leak the full move journal mid-play, so an active game yields ErrGameActive. In an
+func (svc *Service) ExportGCG(ctx context.Context, gameID uuid.UUID) (string, error) {
-// honest-AI game the robot seat is labelled "AI", not its pool name.
-func (svc *Service) ExportView(ctx context.Context, gameID uuid.UUID) (Game, []HistoryMove, []string, error) {
 	g, err := svc.store.GetGame(ctx, gameID)
 	if err != nil {
-		return Game{}, nil, nil, err
+		return "", err
 	}
 	if g.Status != StatusFinished {
-		return Game{}, nil, nil, ErrGameActive
+		return "", ErrGameActive
 	}
 	moves, err := svc.store.GetJournal(ctx, gameID)
 	if err != nil {
-		return Game{}, nil, nil, err
+		return "", err
 	}
 	names := svc.seatNames(ctx, g)
 	if g.VsAI {
+		// Label the robot seat "AI" in an honest-AI game's export, not its pool name.
 		for _, s := range g.Seats {
 			if robot, err := svc.accounts.IsRobot(ctx, s.AccountID); err == nil && robot {
 				names[s.Seat] = aiPlayerName
 			}
 		}
 	}
-	return g, moves, names, nil
-}
-
-// EnsureExportable reports whether a game may be exported (it exists and is
-// finished) without loading the journal — the export-URL mint check.
-func (svc *Service) EnsureExportable(ctx context.Context, gameID uuid.UUID) error {
-	g, err := svc.store.GetGame(ctx, gameID)
-	if err != nil {
-		return err
-	}
-	if g.Status != StatusFinished {
-		return ErrGameActive
-	}
-	return nil
-}
-
-// ExportGCG renders a game as GCG text from the journal alone (no dictionary).
-func (svc *Service) ExportGCG(ctx context.Context, gameID uuid.UUID) (string, error) {
-	g, moves, names, err := svc.ExportView(ctx, gameID)
-	if err != nil {
-		return "", err
-	}
 	return writeGCG(g, names, moves), nil
 }
 
@@ -1488,24 +1440,13 @@ func (svc *Service) voidGame(ctx context.Context, pre Game, g *engine.Game) erro
 	if err != nil {
 		return err
 	}
-	if err := svc.store.VoidGame(ctx, voidCommit{
+	return svc.store.VoidGame(ctx, voidCommit{
 		gameID:    pre.ID,
 		endReason: g.Reason().String(),
 		scores:    scores,
 		now:       svc.clock(),
 		stats:     buildStats(g, statSeats),
-	}); err != nil {
+	})
-		return err
-	}
-	// A voided game is finished (as a draw) but bypasses commit, so clear its now-stale nudges
-	// here too. Best-effort, like the commit path: the void has persisted, so a cleanup failure
-	// is logged, not surfaced.
-	if svc.expireNudges != nil {
-		if err := svc.expireNudges(ctx, pre.ID); err != nil {
-			svc.log.Warn("expire nudges on voided game", zap.Error(err))
-		}
-	}
-	return nil
 }
 
 // replayMove re-applies one journalled move to g through the decoded engine API.
@@ -1672,14 +1613,6 @@ func (svc *Service) lookupWord(variant engine.Variant, version, word string) (bo
 	return present, nil
 }
 
-// DictBytes returns the raw serialized dictionary for the (variant, version) pair
-// from the registry, backing the client-side dictionary download used by the
-// local move preview. It surfaces engine.ErrUnknownVariant /
-// engine.ErrUnknownVersion when that dictionary is not resident.
-func (svc *Service) DictBytes(variant engine.Variant, version string) ([]byte, error) {
-	return svc.registry.DictBytes(variant, version)
-}
-
 // hintsRemaining is a player's remaining hint budget: the unspent per-game
 // allowance plus the profile wallet.
 func hintsRemaining(allowance, used, wallet int) int {

backend/internal/inttest/account_test.go

@@ -154,53 +154,6 @@ func TestProvisionTelegramSeedsNewAccountOnly(t *testing.T) {
 	}
 }
 
-// TestProvisionVKSeedsNewAccountOnly checks VK first contact seeds the new account's
-// language, display name and time zone from the launch fields / detected offset, records
-// the vk identity as confirmed (a platform identity), and never overwrites an existing
-// account on a later launch. It also exercises the widened identities.kind CHECK — a
-// 'vk' row must insert.
-func TestProvisionVKSeedsNewAccountOnly(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	ext := "vk-" + uuid.NewString()
-
-	acc, created, err := store.ProvisionVK(ctx, ext, "ru", "Иван Петров", "+03:00")
-	if err != nil {
-		t.Fatalf("provision vk: %v", err)
-	}
-	if !created {
-		t.Error("created = false on first contact, want true")
-	}
-	if acc.PreferredLanguage != "ru" {
-		t.Errorf("PreferredLanguage = %q, want ru", acc.PreferredLanguage)
-	}
-	if acc.DisplayName != "Иван Петров" {
-		t.Errorf("DisplayName = %q, want Иван Петров", acc.DisplayName)
-	}
-	if acc.TimeZone != "+03:00" {
-		t.Errorf("TimeZone = %q, want the seeded +03:00", acc.TimeZone)
-	}
-	// A VK identity is a platform identity: confirmed on insert.
-	if !identityConfirmed(t, account.KindVK, ext) {
-		t.Error("vk identity must be confirmed")
-	}
-
-	// A later launch with different fields returns the same account, unchanged.
-	again, created, err := store.ProvisionVK(ctx, ext, "en", "Other Name", "+09:00")
-	if err != nil {
-		t.Fatalf("re-provision vk: %v", err)
-	}
-	if created {
-		t.Error("created = true on a repeat launch, want false")
-	}
-	if again.ID != acc.ID {
-		t.Errorf("re-provision id = %s, want %s", again.ID, acc.ID)
-	}
-	if again.PreferredLanguage != "ru" || again.DisplayName != "Иван Петров" || again.TimeZone != "+03:00" {
-		t.Errorf("existing account overwritten: lang=%q name=%q tz=%q", again.PreferredLanguage, again.DisplayName, again.TimeZone)
-	}
-}
-
 // TestProvisionSeedsTimeZone checks the create-time time-zone seed across paths: a
 // valid detected offset is stored verbatim (even "+00:00", which is deliberately
 // distinct from the unset "UTC" default), a guest is seeded the same way, and a

backend/internal/inttest/adminemail_test.go

@@ -1,83 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-)
-
-// TestRemoveEmailIdentity erases an account's email identity but refuses when the
-// email is the account's only identity (which would leave it unreachable).
-func TestRemoveEmailIdentity(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-
-	// Email is the only identity → refuse.
-	solo, err := store.ProvisionEmail(ctx, "solo-"+uuid.NewString()+"@example.com", "", "en")
-	if err != nil {
-		t.Fatalf("provision email: %v", err)
-	}
-	if err := store.RemoveEmailIdentity(ctx, solo.ID); !errors.Is(err, account.ErrLastIdentity) {
-		t.Fatalf("remove last identity = %v, want ErrLastIdentity", err)
-	}
-
-	// Telegram + email → erase the email, keep Telegram.
-	tg, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision telegram: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, tg.ID, account.KindEmail, "dual-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	if err := store.RemoveEmailIdentity(ctx, tg.ID); err != nil {
-		t.Fatalf("remove email: %v", err)
-	}
-	ids, err := store.Identities(ctx, tg.ID)
-	if err != nil {
-		t.Fatalf("identities: %v", err)
-	}
-	if len(ids) != 1 || ids[0].Kind != account.KindTelegram {
-		t.Errorf("identities after erase = %+v, want only telegram", ids)
-	}
-}
-
-// TestListUsersEmailExact matches accounts strictly (exactly) by their email identity.
-func TestListUsersEmailExact(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	email := "find-" + uuid.NewString() + "@example.com"
-	acc, err := store.ProvisionEmail(ctx, email, "", "en")
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-
-	items, err := store.ListUsers(ctx, account.UserFilter{EmailExact: email}, 50, 0)
-	if err != nil {
-		t.Fatalf("list: %v", err)
-	}
-	found := false
-	for _, it := range items {
-		if it.ID == acc.ID {
-			found = true
-		}
-	}
-	if !found {
-		t.Error("the exact email filter did not find the account")
-	}
-
-	other, err := store.ListUsers(ctx, account.UserFilter{EmailExact: "nope-" + uuid.NewString() + "@example.com"}, 50, 0)
-	if err != nil {
-		t.Fatalf("list (no match): %v", err)
-	}
-	for _, it := range other {
-		if it.ID == acc.ID {
-			t.Error("a non-matching email filter must not return the account")
-		}
-	}
-}

backend/internal/inttest/chatread_test.go

@@ -138,65 +138,6 @@ func TestNudgeClearedByMove(t *testing.T) {
 	}
 }
 
-// TestGameCompletionExpiresNudgesKeepsChat checks that finishing a game by turn-timeout marks every
-// pending nudge in it read — the lobby's nudge badge is stale once the game is over — while leaving
-// real chat messages unread. It reproduces the reported bug: the timeout path commits the finish
-// directly, bypassing the move path's per-mover nudge clear, so without a completion-driven expiry
-// the awaited seat's nudge lingered as a badge on the finished game.
-func TestGameCompletionExpiresNudgesKeepsChat(t *testing.T) {
-	ctx := context.Background()
-	gameSvc := newGameService()
-	socialSvc := newSocialService()
-	gameSvc.SetNudgeExpirer(socialSvc.ExpireNudges)
-
-	seats := []uuid.UUID{provisionAccount(t), provisionAccount(t)}
-	g, err := gameSvc.Create(ctx, game.CreateParams{
-		Variant: engine.VariantEnglish, Seats: seats, TurnTimeout: time.Hour, Seed: openingSeed(t),
-	})
-	if err != nil {
-		t.Fatalf("create: %v", err)
-	}
-
-	// Seat 1 nudges the to-move seat 0 (the awaited player), and seat 0 posts a real chat message,
-	// which seat 1 then holds unread. So before the timeout each side has exactly one unread entry:
-	// seat 0 a nudge, seat 1 a message — letting HasUnread isolate each kind.
-	if _, err := socialSvc.Nudge(ctx, g.ID, seats[1]); err != nil {
-		t.Fatalf("nudge: %v", err)
-	}
-	if _, err := socialSvc.PostMessage(ctx, g.ID, seats[0], "good luck", ""); err != nil {
-		t.Fatalf("post message: %v", err)
-	}
-	if unread, _ := socialSvc.HasUnread(ctx, g.ID, seats[0]); !unread {
-		t.Fatal("seat 0 should hold the nudge unread before the timeout")
-	}
-	if unread, _ := socialSvc.HasUnread(ctx, g.ID, seats[1]); !unread {
-		t.Fatal("seat 1 should hold the message unread before the timeout")
-	}
-
-	// Age the turn past its deadline and time seat 0 out; an empty away window keeps this
-	// deterministic regardless of the wall clock. The sweep finishes the game through the direct
-	// commit path, never the move path.
-	backdate(t, g.ID, time.Now().UTC().Add(-2*time.Hour))
-	setAway(t, seats[0], "UTC", "00:00", "00:00")
-	if n, err := gameSvc.SweepTimeouts(ctx, time.Now().UTC()); err != nil || n < 1 {
-		t.Fatalf("sweep swept %d (err %v), want >= 1", n, err)
-	}
-	if status, reason := gameStatus(t, gameSvc, g.ID); status != game.StatusFinished || reason != "timeout" {
-		t.Fatalf("game not timed out: status %q reason %q", status, reason)
-	}
-
-	// The nudge is stale on a finished game and must be cleared; the chat message must survive.
-	if unread, _ := socialSvc.HasUnread(ctx, g.ID, seats[0]); unread {
-		t.Error("the nudge should be expired once the game has finished")
-	}
-	if unread, _ := socialSvc.HasUnread(ctx, g.ID, seats[1]); !unread {
-		t.Error("a real chat message must stay unread after the game finishes")
-	}
-	if msg, _ := socialSvc.HasUnreadMessage(ctx, g.ID, seats[1]); !msg {
-		t.Error("the chat message must remain flagged as an unread message after completion")
-	}
-}
-
 // TestChatToRobotIsBornRead checks a text message to a disguised robot opponent (a pooled
 // robot substituted into an ordinary, non-AI game) is born read: the robot never opens the
 // chat, so the message must not linger unread (skewing the count and the read metric).

backend/internal/inttest/delete_test.go

@@ -1,322 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-	"scrabble/backend/internal/accountdelete"
-	"scrabble/backend/internal/engine"
-	"scrabble/backend/internal/game"
-)
-
-// deletedFields reads a tombstoned account's retained real name and its deleted_at.
-func deletedFields(t *testing.T, accountID uuid.UUID) (name string, deletedAt sql.NullTime) {
-	t.Helper()
-	var dn sql.NullString
-	err := testDB.QueryRowContext(context.Background(),
-		"SELECT deleted_display_name, deleted_at FROM accounts WHERE account_id = $1", accountID).
-		Scan(&dn, &deletedAt)
-	if err != nil {
-		t.Fatalf("read deleted fields %s: %v", accountID, err)
-	}
-	return dn.String, deletedAt
-}
-
-// TestAnonymizeAndTombstone: deletion journals + frees the credentials, tombstones the
-// account, scrubs the live name while retaining the real one, and frees the creds for a
-// new account to reuse.
-func TestAnonymizeAndTombstone(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "handle", "Иван", "+03:00")
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	email := "del-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, email, true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	before, err := store.GetByID(ctx, acc.ID)
-	if err != nil {
-		t.Fatalf("load before: %v", err)
-	}
-
-	if err := deleter.AnonymizeAndTombstone(ctx, acc.ID); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-
-	// The live identities are gone.
-	if ids, err := store.Identities(ctx, acc.ID); err != nil || len(ids) != 0 {
-		t.Fatalf("identities after delete = %+v (err %v), want none", ids, err)
-	}
-	// Both credentials are journalled with reason=delete.
-	got := retainedRows(t, acc.ID)
-	if len(got) != 2 {
-		t.Fatalf("retained rows = %+v, want 2", got)
-	}
-	for _, r := range got {
-		if r.reason != "delete" {
-			t.Errorf("retained reason = %q, want delete", r.reason)
-		}
-	}
-	// The live name is scrubbed; the real one is retained; deleted_at is set.
-	after, err := store.GetByID(ctx, acc.ID)
-	if err != nil {
-		t.Fatalf("load after: %v", err)
-	}
-	if after.DisplayName != accountdelete.AnonymizedName {
-		t.Errorf("live display name = %q, want %q", after.DisplayName, accountdelete.AnonymizedName)
-	}
-	name, deletedAt := deletedFields(t, acc.ID)
-	if name != before.DisplayName {
-		t.Errorf("retained name = %q, want %q", name, before.DisplayName)
-	}
-	if !deletedAt.Valid || time.Since(deletedAt.Time) > time.Minute {
-		t.Errorf("deleted_at = %+v, want a recent timestamp", deletedAt)
-	}
-	// The credentials are free: a new account can claim the same email.
-	other, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Other", "")
-	if err != nil {
-		t.Fatalf("provision other: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, other.ID, account.KindEmail, email, true); err != nil {
-		t.Fatalf("email should be free after deletion, got: %v", err)
-	}
-}
-
-// TestDeletionDossierReaders: after deletion the admin readers expose the credential
-// journal and the tombstone dossier.
-func TestDeletionDossierReaders(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "handle", "Иван", "+03:00")
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, "dos-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	if err := deleter.AnonymizeAndTombstone(ctx, acc.ID); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-
-	rets, err := store.RetainedIdentities(ctx, acc.ID)
-	if err != nil || len(rets) != 2 {
-		t.Fatalf("RetainedIdentities = (%+v, %v), want 2 rows", rets, err)
-	}
-	for _, r := range rets {
-		if r.Reason != "delete" {
-			t.Errorf("retained reason = %q, want delete", r.Reason)
-		}
-	}
-	info, err := store.DeletionInfo(ctx, acc.ID)
-	if err != nil {
-		t.Fatalf("DeletionInfo: %v", err)
-	}
-	if info.DeletedAt == nil {
-		t.Error("DeletionInfo.DeletedAt should be set")
-	}
-	if info.DeletedDisplayName != "Иван" {
-		t.Errorf("DeletionInfo.DeletedDisplayName = %q, want Иван", info.DeletedDisplayName)
-	}
-}
-
-// listHasID reports whether the user list contains accountID.
-func listHasID(items []account.UserListItem, id uuid.UUID) bool {
-	for _, it := range items {
-		if it.ID == id {
-			return true
-		}
-	}
-	return false
-}
-
-// TestUserListDeletedFilter: a tombstoned account is hidden from the default People list and
-// shown only under the Deleted scope.
-func TestUserListDeletedFilter(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	live, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Live", "")
-	if err != nil {
-		t.Fatalf("provision live: %v", err)
-	}
-	goneTg := "tg-" + uuid.NewString()
-	gone, _, err := store.ProvisionTelegram(ctx, goneTg, "en", "", "Gone", "")
-	if err != nil {
-		t.Fatalf("provision gone: %v", err)
-	}
-	goneEmail := "gone-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, gone.ID, account.KindEmail, goneEmail, true); err != nil {
-		t.Fatalf("attach gone email: %v", err)
-	}
-	if err := deleter.AnonymizeAndTombstone(ctx, gone.ID); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-
-	people, err := store.ListUsers(ctx, account.UserFilter{}, 5000, 0)
-	if err != nil {
-		t.Fatalf("list people: %v", err)
-	}
-	if listHasID(people, gone.ID) {
-		t.Error("a deleted account must not appear in the default People list")
-	}
-	if !listHasID(people, live.ID) {
-		t.Error("a live account must appear in the default People list")
-	}
-	deleted, err := store.ListUsers(ctx, account.UserFilter{Deleted: true}, 5000, 0)
-	if err != nil {
-		t.Fatalf("list deleted: %v", err)
-	}
-	if !listHasID(deleted, gone.ID) {
-		t.Error("a deleted account must appear in the Deleted list")
-	}
-	if listHasID(deleted, live.ID) {
-		t.Error("a live account must not appear in the Deleted list")
-	}
-
-	// A search spans both lists and reaches the retention journal: a deleted account is
-	// still found by the email and external id it held (both moved to retained_identities
-	// on deletion, out of the live identities table).
-	byEmail, err := store.ListUsers(ctx, account.UserFilter{EmailExact: goneEmail}, 5000, 0)
-	if err != nil {
-		t.Fatalf("search by email: %v", err)
-	}
-	if !listHasID(byEmail, gone.ID) {
-		t.Error("a deleted account must be found by the email it held (retention journal)")
-	}
-	byExt, err := store.ListUsers(ctx, account.UserFilter{ExternalIDMask: goneTg}, 5000, 0)
-	if err != nil {
-		t.Fatalf("search by external id: %v", err)
-	}
-	if !listHasID(byExt, gone.ID) {
-		t.Error("a deleted account must be found by the external id it held (retention journal)")
-	}
-}
-
-// TestConfirmCodeClearsGuest: confirming an email on a guest via ConfirmCode promotes it to
-// a durable account (defence-in-depth — no confirmed-email path leaves is_guest set).
-func TestConfirmCodeClearsGuest(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	guest, err := store.ProvisionGuest(ctx, "")
-	if err != nil {
-		t.Fatalf("provision guest: %v", err)
-	}
-	email := "cc-" + uuid.NewString() + "@example.com"
-	if err := svc.RequestCode(ctx, guest.ID, email); err != nil {
-		t.Fatalf("request code: %v", err)
-	}
-	if _, err := svc.ConfirmCode(ctx, guest.ID, email, sixDigit.FindString(mailer.lastBody)); err != nil {
-		t.Fatalf("confirm code: %v", err)
-	}
-	after, err := store.GetByID(ctx, guest.ID)
-	if err != nil {
-		t.Fatalf("load: %v", err)
-	}
-	if after.IsGuest {
-		t.Error("confirming an email must clear the guest flag")
-	}
-}
-
-// TestDropAllRobotGames drops the deletee's solo vs-AI game but keeps a game with a human
-// opponent.
-func TestDropAllRobotGames(t *testing.T) {
-	ctx := context.Background()
-	gsvc := newGameService()
-	robots := newRobotService(t, gsvc)
-	if err := robots.EnsurePool(ctx); err != nil {
-		t.Fatalf("ensure pool: %v", err)
-	}
-	mm := newMatchmaker(t, robots, time.Minute, 0)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	user := provisionAccount(t)
-	other := provisionAccount(t)
-
-	aiRes, err := mm.StartVsAI(ctx, user, engine.VariantEnglish, true)
-	if err != nil {
-		t.Fatalf("start vs AI: %v", err)
-	}
-	humanGame, err := gsvc.Create(ctx, game.CreateParams{
-		Variant: engine.VariantEnglish, Seats: []uuid.UUID{user, other}, TurnTimeout: time.Hour, Seed: 1,
-	})
-	if err != nil {
-		t.Fatalf("create human game: %v", err)
-	}
-
-	n, err := deleter.DropAllRobotGames(ctx, user)
-	if err != nil {
-		t.Fatalf("drop: %v", err)
-	}
-	if n != 1 {
-		t.Fatalf("dropped %d games, want 1 (the vs-AI game)", n)
-	}
-	if _, err := gsvc.GameByID(ctx, aiRes.Game.ID); err == nil {
-		t.Error("the vs-AI game should be dropped")
-	}
-	if _, err := gsvc.GameByID(ctx, humanGame.ID); err != nil {
-		t.Errorf("the human game should be kept, got: %v", err)
-	}
-}
-
-// TestDeleteStepUpEmail: an email account's delete code verifies (wrong code rejected, no
-// deeplink in the mail); a platform-only account has no email and cannot request a code.
-func TestDeleteStepUpEmail(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, "del-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	if has, err := svc.HasEmail(ctx, acc.ID); err != nil || !has {
-		t.Fatalf("HasEmail = (%v, %v), want true", has, err)
-	}
-	if err := svc.RequestDeleteCode(ctx, acc.ID); err != nil {
-		t.Fatalf("request delete code: %v", err)
-	}
-	if strings.Contains(mailer.lastBody, "/confirm/") {
-		t.Error("a delete email must not carry a one-tap deeplink")
-	}
-	code := sixDigit.FindString(mailer.lastBody)
-	if err := svc.VerifyDeleteCode(ctx, acc.ID, "000000"); err == nil {
-		t.Error("a wrong delete code must be rejected")
-	}
-	if err := svc.VerifyDeleteCode(ctx, acc.ID, code); err != nil {
-		t.Fatalf("verify correct delete code: %v", err)
-	}
-
-	noEmail, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision no-email: %v", err)
-	}
-	if has, _ := svc.HasEmail(ctx, noEmail.ID); has {
-		t.Error("HasEmail must be false for a platform-only account")
-	}
-	if err := svc.RequestDeleteCode(ctx, noEmail.ID); !errors.Is(err, account.ErrNoEmail) {
-		t.Errorf("request delete for no-email account = %v, want ErrNoEmail", err)
-	}
-}

backend/internal/inttest/email_test.go

@@ -19,8 +19,8 @@ import (
 // recover the confirm-code from the body.
 type capturingMailer struct{ lastBody string }
 
-func (m *capturingMailer) Send(_ context.Context, msg account.Message) error {
+func (m *capturingMailer) Send(_ context.Context, _, _, body string) error {
-	m.lastBody = msg.Text
+	m.lastBody = body
 	return nil
 }
 
@@ -32,7 +32,7 @@ func TestEmailConfirmFlow(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)
 
 	acc := provisionAccount(t)
 	email := "user-" + uuid.NewString() + "@example.com"
@@ -67,7 +67,7 @@ func TestEmailAlreadyTakenByAnotherAccount(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)
 
 	owner := provisionAccount(t)
 	email := "taken-" + uuid.NewString() + "@example.com"
@@ -89,7 +89,7 @@ func TestEmailCodeExpires(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)
 
 	acc := provisionAccount(t)
 	email := "expire-" + uuid.NewString() + "@example.com"
@@ -111,7 +111,7 @@ func TestEmailTooManyAttempts(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)
 
 	acc := provisionAccount(t)
 	email := "lock-" + uuid.NewString() + "@example.com"
@@ -203,10 +203,10 @@ func TestUpdateProfileOffsetTimezone(t *testing.T) {
 func TestEmailLoginFlow(t *testing.T) {
 	ctx := context.Background()
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(account.NewStore(testDB), mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(account.NewStore(testDB), mailer)
 	email := "login-" + uuid.NewString() + "@example.com"
 
-	accountID, err := svc.RequestLoginCode(ctx, email, "+02:00", "en")
+	accountID, err := svc.RequestLoginCode(ctx, email, "+02:00")
 	if err != nil {
 		t.Fatalf("request login code: %v", err)
 	}
@@ -233,7 +233,7 @@ func TestEmailLoginFlow(t *testing.T) {
 	}
 
 	// A second login for the same email is the returning user: same account.
-	if _, err := svc.RequestLoginCode(ctx, email, "", "ru"); err != nil {
+	if _, err := svc.RequestLoginCode(ctx, email, ""); err != nil {
 		t.Fatalf("second request: %v", err)
 	}
 	acc2, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody))
@@ -244,182 +244,3 @@ func TestEmailLoginFlow(t *testing.T) {
 		t.Errorf("returning login account = %s, want %s", acc2.ID, accountID)
 	}
 }
-
-// TestEmailLoginProvisionsGuestUntilConfirmed covers the squat fix: an email-login
-// account is a guest (reapable, so an abandoned never-confirmed login frees its
-// address) until the code is confirmed, which promotes it to a durable account.
-func TestEmailLoginProvisionsGuestUntilConfirmed(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	email := "squat-" + uuid.NewString() + "@example.com"
-
-	id, err := svc.RequestLoginCode(ctx, email, "", "en")
-	if err != nil {
-		t.Fatalf("request login code: %v", err)
-	}
-	before, err := store.GetByID(ctx, id)
-	if err != nil {
-		t.Fatalf("get before confirm: %v", err)
-	}
-	if !before.IsGuest {
-		t.Error("an unconfirmed email-login account must be a guest so it is reapable")
-	}
-
-	if _, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody)); err != nil {
-		t.Fatalf("login: %v", err)
-	}
-	after, err := store.GetByID(ctx, id)
-	if err != nil {
-		t.Fatalf("get after confirm: %v", err)
-	}
-	if after.IsGuest {
-		t.Error("confirming the login must clear the guest flag (promote to durable)")
-	}
-}
-
-// confirmToken extracts the one-tap deeplink token from the /app/#/confirm/<token> link
-// the branded email carries.
-var confirmToken = regexp.MustCompile(`/confirm/([A-Za-z0-9_-]+)`)
-
-func tokenFromMail(t *testing.T, body string) string {
-	t.Helper()
-	m := confirmToken.FindStringSubmatch(body)
-	if m == nil {
-		t.Fatalf("no confirm token in mail body %q", body)
-	}
-	return m[1]
-}
-
-// TestConfirmByTokenLogin: the one-tap deeplink token completes an email login,
-// clearing the guest flag.
-func TestConfirmByTokenLogin(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	email := "tok-login-" + uuid.NewString() + "@example.com"
-
-	id, err := svc.RequestLoginCode(ctx, email, "", "en")
-	if err != nil {
-		t.Fatalf("request login: %v", err)
-	}
-	res, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody))
-	if err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	if !res.IsLogin() || res.Account != id {
-		t.Fatalf("login result = %+v, want login for %s", res, id)
-	}
-	if !identityConfirmed(t, account.KindEmail, email) {
-		t.Error("email identity must be confirmed after the token login")
-	}
-	if acc, _ := store.GetByID(ctx, id); acc.IsGuest {
-		t.Error("the token login must clear the guest flag")
-	}
-}
-
-// TestConfirmByTokenLink: the token attaches a free email to the requesting account.
-func TestConfirmByTokenLink(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	acc := provisionAccount(t)
-	email := "tok-link-" + uuid.NewString() + "@example.com"
-
-	if err := svc.RequestLinkCode(ctx, acc, email); err != nil {
-		t.Fatalf("request link: %v", err)
-	}
-	res, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody))
-	if err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	if res.IsLogin() || res.NeedsMerge || res.Account != acc {
-		t.Fatalf("link result = %+v, want a plain link for %s", res, acc)
-	}
-	if !identityConfirmed(t, account.KindEmail, email) {
-		t.Error("email identity must be confirmed after the token link")
-	}
-}
-
-// TestConfirmByTokenLinkMerge: a token for an address owned by another account signals
-// a merge (leaving the token unconsumed for the interactive step).
-func TestConfirmByTokenLinkMerge(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	email := "tok-merge-" + uuid.NewString() + "@example.com"
-
-	owner := provisionAccount(t)
-	if err := svc.RequestCode(ctx, owner, email); err != nil {
-		t.Fatalf("owner request: %v", err)
-	}
-	if _, err := svc.ConfirmCode(ctx, owner, email, sixDigit.FindString(mailer.lastBody)); err != nil {
-		t.Fatalf("owner confirm: %v", err)
-	}
-
-	other := provisionAccount(t)
-	if err := svc.RequestLinkCode(ctx, other, email); err != nil {
-		t.Fatalf("link request: %v", err)
-	}
-	res, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody))
-	if err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	if !res.NeedsMerge || res.MergeOwner != owner {
-		t.Fatalf("merge result = %+v, want NeedsMerge with owner=%s", res, owner)
-	}
-}
-
-// TestEmailAccountSeedsDisplayName seeds a new email account's display name from the
-// email's local part, so an email login is not left nameless.
-func TestEmailAccountSeedsDisplayName(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	svc := account.NewEmailService(store, &capturingMailer{}, "https://erudit-game.ru")
-	local := "kaya-" + uuid.NewString()[:8]
-
-	id, err := svc.RequestLoginCode(ctx, local+"@example.com", "", "en")
-	if err != nil {
-		t.Fatalf("request login: %v", err)
-	}
-	acc, err := store.GetByID(ctx, id)
-	if err != nil {
-		t.Fatalf("get: %v", err)
-	}
-	if acc.DisplayName != local {
-		t.Errorf("display name = %q, want the email local part %q", acc.DisplayName, local)
-	}
-}
-
-// TestConfirmByTokenLinkClearsGuest: binding an email to a guest via the deeplink
-// promotes the guest to a durable account (the deeplink path must match the
-// code-based link flow, which clears the guest flag).
-func TestConfirmByTokenLinkClearsGuest(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	guest, err := store.ProvisionGuest(ctx, "")
-	if err != nil {
-		t.Fatalf("provision guest: %v", err)
-	}
-	email := "guest-link-" + uuid.NewString() + "@example.com"
-
-	if err := svc.RequestLinkCode(ctx, guest.ID, email); err != nil {
-		t.Fatalf("request link: %v", err)
-	}
-	if _, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody)); err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	acc, err := store.GetByID(ctx, guest.ID)
-	if err != nil {
-		t.Fatalf("get: %v", err)
-	}
-	if acc.IsGuest {
-		t.Error("linking an email via the deeplink must promote the guest to durable")
-	}
-}

backend/internal/inttest/link_change_test.go

@@ -1,174 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-)
-
-// emailOf returns the external id of the account's email identity, or "" when it has none.
-func emailOf(t *testing.T, store *account.Store, id uuid.UUID) string {
-	t.Helper()
-	ids, err := store.Identities(context.Background(), id)
-	if err != nil {
-		t.Fatalf("identities %s: %v", id, err)
-	}
-	for _, i := range ids {
-		if i.Kind == account.KindEmail {
-			return i.ExternalID
-		}
-	}
-	return ""
-}
-
-// TestUnlinkProviderKeepsOthers detaches one provider from a multi-identity account and
-// refuses to remove the last remaining identity.
-func TestUnlinkProviderKeepsOthers(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision telegram: %v", err)
-	}
-	email := "unlink-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, email, true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-
-	// Removing a kind the account does not hold reports not-found.
-	if err := store.RemoveIdentity(ctx, acc.ID, account.KindVK); !errors.Is(err, account.ErrNotFound) {
-		t.Fatalf("remove absent vk = %v, want ErrNotFound", err)
-	}
-
-	// Detach Telegram: the email identity remains.
-	if err := store.RemoveIdentity(ctx, acc.ID, account.KindTelegram); err != nil {
-		t.Fatalf("remove telegram: %v", err)
-	}
-	ids, err := store.Identities(ctx, acc.ID)
-	if err != nil {
-		t.Fatalf("identities: %v", err)
-	}
-	if len(ids) != 1 || ids[0].Kind != account.KindEmail {
-		t.Fatalf("identities after unlink = %+v, want only email", ids)
-	}
-
-	// The email is now the last identity, so unlinking it is refused.
-	if err := store.RemoveIdentity(ctx, acc.ID, account.KindEmail); !errors.Is(err, account.ErrLastIdentity) {
-		t.Fatalf("remove last email = %v, want ErrLastIdentity", err)
-	}
-}
-
-// TestChangeEmailReplaces switches an account's confirmed email to a free address,
-// freeing the old one.
-func TestChangeEmailReplaces(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	oldAddr := "old-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, oldAddr, true); err != nil {
-		t.Fatalf("attach old email: %v", err)
-	}
-	newAddr := "new-" + uuid.NewString() + "@example.com"
-
-	if err := svc.RequestChangeCode(ctx, acc.ID, newAddr); err != nil {
-		t.Fatalf("request change: %v", err)
-	}
-	code := sixDigit.FindString(mailer.lastBody)
-	if _, err := svc.ConfirmChange(ctx, acc.ID, newAddr, code); err != nil {
-		t.Fatalf("confirm change: %v", err)
-	}
-	if got := emailOf(t, store, acc.ID); got != newAddr {
-		t.Fatalf("email after change = %q, want %q", got, newAddr)
-	}
-	if !identityConfirmed(t, account.KindEmail, newAddr) {
-		t.Error("the new email identity must be confirmed")
-	}
-	// The old address is freed: another account can now claim it.
-	other, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision other: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, other.ID, account.KindEmail, oldAddr, true); err != nil {
-		t.Fatalf("old address should be free after change, got: %v", err)
-	}
-}
-
-// TestChangeEmailRefusesTaken refuses (without merging) a new address already confirmed by
-// another account, leaving the caller's email untouched.
-func TestChangeEmailRefusesTaken(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision caller: %v", err)
-	}
-	mine := "mine-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, mine, true); err != nil {
-		t.Fatalf("attach caller email: %v", err)
-	}
-	other, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision other: %v", err)
-	}
-	taken := "taken-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, other.ID, account.KindEmail, taken, true); err != nil {
-		t.Fatalf("attach other email: %v", err)
-	}
-
-	if err := svc.RequestChangeCode(ctx, acc.ID, taken); err != nil {
-		t.Fatalf("request change: %v", err)
-	}
-	code := sixDigit.FindString(mailer.lastBody)
-	if _, err := svc.ConfirmChange(ctx, acc.ID, taken, code); !errors.Is(err, account.ErrEmailTaken) {
-		t.Fatalf("confirm change to taken = %v, want ErrEmailTaken", err)
-	}
-	if got := emailOf(t, store, acc.ID); got != mine {
-		t.Errorf("caller email after refused change = %q, want unchanged %q", got, mine)
-	}
-}
-
-// TestChangeEmailViaDeeplink switches the email through the one-tap confirm token.
-func TestChangeEmailViaDeeplink(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, "old-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach old email: %v", err)
-	}
-	newAddr := "dl-" + uuid.NewString() + "@example.com"
-	if err := svc.RequestChangeCode(ctx, acc.ID, newAddr); err != nil {
-		t.Fatalf("request change: %v", err)
-	}
-	res, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody))
-	if err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	if res.IsLogin() || res.NeedsMerge || res.Account != acc.ID {
-		t.Fatalf("deeplink change result = %+v, want a plain change for %s", res, acc.ID)
-	}
-	if got := emailOf(t, store, acc.ID); got != newAddr {
-		t.Fatalf("email after deeplink change = %q, want %q", got, newAddr)
-	}
-}

backend/internal/inttest/merge_test.go

@@ -119,7 +119,7 @@ func seatGame(t *testing.T, seats []uuid.UUID, timeout time.Duration) uuid.UUID
 
 func newLinkService(mailer account.Mailer) *link.Service {
 	store := account.NewStore(testDB)
-	emails := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	emails := account.NewEmailService(store, mailer)
 	sessions := session.NewService(session.NewStore(testDB), session.NewCache())
 	return link.NewService(emails, store, accountmerge.NewMerger(testDB), sessions)
 }

backend/internal/inttest/retention_test.go

@@ -1,192 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-	"scrabble/backend/internal/accountdelete"
-)
-
-// lastLoginIP reads an account's stamped last-login IP ("" when unset).
-func lastLoginIP(t *testing.T, accountID uuid.UUID) string {
-	t.Helper()
-	var ip sql.NullString
-	err := testDB.QueryRowContext(context.Background(),
-		"SELECT last_login_ip FROM accounts WHERE account_id = $1", accountID).Scan(&ip)
-	if err != nil {
-		t.Fatalf("read last_login_ip %s: %v", accountID, err)
-	}
-	return ip.String
-}
-
-// retainedRow is one row of the retention journal, read directly for assertions.
-type retainedRow struct {
-	kind, externalID, reason string
-}
-
-// retainedRows reads the retention journal for an account, oldest detach first.
-func retainedRows(t *testing.T, accountID uuid.UUID) []retainedRow {
-	t.Helper()
-	rows, err := testDB.QueryContext(context.Background(),
-		"SELECT kind, external_id, reason FROM retained_identities WHERE account_id = $1 ORDER BY detached_at",
-		accountID)
-	if err != nil {
-		t.Fatalf("query retained_identities %s: %v", accountID, err)
-	}
-	defer rows.Close()
-	var out []retainedRow
-	for rows.Next() {
-		var r retainedRow
-		if err := rows.Scan(&r.kind, &r.externalID, &r.reason); err != nil {
-			t.Fatalf("scan retained row: %v", err)
-		}
-		out = append(out, r)
-	}
-	return out
-}
-
-// TestUnlinkJournalsRetainedIdentity: detaching a provider records it in the retention
-// journal (reason=unlink) before the live identity is removed.
-func TestUnlinkJournalsRetainedIdentity(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-
-	tgExt := "tg-" + uuid.NewString()
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, tgExt)
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	email := "keep-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, email, true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-
-	if err := store.RemoveIdentity(ctx, acc.ID, account.KindTelegram); err != nil {
-		t.Fatalf("unlink telegram: %v", err)
-	}
-	got := retainedRows(t, acc.ID)
-	if len(got) != 1 || got[0].kind != account.KindTelegram || got[0].externalID != tgExt || got[0].reason != "unlink" {
-		t.Fatalf("retained rows = %+v, want one unlink telegram %q", got, tgExt)
-	}
-}
-
-// TestChangeEmailJournalsOldAddress: an email change records the outgoing address in the
-// retention journal (reason=change).
-func TestChangeEmailJournalsOldAddress(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	oldAddr := "old-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, oldAddr, true); err != nil {
-		t.Fatalf("attach old email: %v", err)
-	}
-	newAddr := "new-" + uuid.NewString() + "@example.com"
-	if err := svc.RequestChangeCode(ctx, acc.ID, newAddr); err != nil {
-		t.Fatalf("request change: %v", err)
-	}
-	if _, err := svc.ConfirmChange(ctx, acc.ID, newAddr, sixDigit.FindString(mailer.lastBody)); err != nil {
-		t.Fatalf("confirm change: %v", err)
-	}
-	got := retainedRows(t, acc.ID)
-	if len(got) != 1 || got[0].kind != account.KindEmail || got[0].externalID != oldAddr || got[0].reason != "change" {
-		t.Fatalf("retained rows = %+v, want one change email %q", got, oldAddr)
-	}
-}
-
-// TestStampLastLoginThrottles: the first cold-load stamp writes the IP; a second within
-// the hour is a no-op (throttled), so it costs at most one write per account per hour.
-func TestStampLastLoginThrottles(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.StampLastLogin(ctx, acc.ID, "1.2.3.4"); err != nil {
-		t.Fatalf("first stamp: %v", err)
-	}
-	if got := lastLoginIP(t, acc.ID); got != "1.2.3.4" {
-		t.Fatalf("first stamp ip = %q, want 1.2.3.4", got)
-	}
-	if err := store.StampLastLogin(ctx, acc.ID, "9.9.9.9"); err != nil {
-		t.Fatalf("second stamp: %v", err)
-	}
-	if got := lastLoginIP(t, acc.ID); got != "1.2.3.4" {
-		t.Fatalf("throttled ip = %q, want unchanged 1.2.3.4", got)
-	}
-}
-
-// TestReapExpiredRetention: the reaper keeps journal rows newer than the cutoff and purges
-// older ones, and drops a long-deleted account's feedback thread + dossier PII.
-func TestReapExpiredRetention(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	// An unlinked provider leaves a journal row detached "now".
-	tgExt := "tg-" + uuid.NewString()
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, tgExt)
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, "keep-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	if err := store.RemoveIdentity(ctx, acc.ID, account.KindTelegram); err != nil {
-		t.Fatalf("unlink: %v", err)
-	}
-	// A cutoff before the detach keeps the row.
-	if _, _, err := store.ReapExpiredRetention(ctx, time.Now().Add(-time.Hour)); err != nil {
-		t.Fatalf("reap (early cutoff): %v", err)
-	}
-	if got := retainedRows(t, acc.ID); len(got) != 1 {
-		t.Fatalf("journal after early-cutoff reap = %+v, want kept", got)
-	}
-	// A cutoff after the detach purges it.
-	if _, _, err := store.ReapExpiredRetention(ctx, time.Now().Add(time.Hour)); err != nil {
-		t.Fatalf("reap (late cutoff): %v", err)
-	}
-	if got := retainedRows(t, acc.ID); len(got) != 0 {
-		t.Fatalf("journal after late-cutoff reap = %+v, want purged", got)
-	}
-
-	// A deleted account past the cutoff loses its feedback thread and dossier PII.
-	del, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "", "Иван", "")
-	if err != nil {
-		t.Fatalf("provision deletee: %v", err)
-	}
-	if _, err := testDB.ExecContext(ctx,
-		"INSERT INTO feedback_messages (message_id, account_id, body, channel) VALUES ($1, $2, 'hi', 'web')",
-		uuid.New(), del.ID); err != nil {
-		t.Fatalf("insert feedback: %v", err)
-	}
-	if err := deleter.AnonymizeAndTombstone(ctx, del.ID); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-	if _, fb, err := store.ReapExpiredRetention(ctx, time.Now().Add(time.Hour)); err != nil || fb == 0 {
-		t.Fatalf("reap deleted = (fb %d, err %v), want fb>=1", fb, err)
-	}
-	if name, _ := deletedFields(t, del.ID); name != "" {
-		t.Errorf("deleted_display_name after reap = %q, want cleared", name)
-	}
-	var fbCount int
-	if err := testDB.QueryRowContext(ctx, "SELECT count(*) FROM feedback_messages WHERE account_id = $1", del.ID).Scan(&fbCount); err != nil {
-		t.Fatalf("count feedback: %v", err)
-	}
-	if fbCount != 0 {
-		t.Errorf("feedback rows after reap = %d, want 0", fbCount)
-	}
-}

backend/internal/notify/events.go

@@ -155,13 +155,6 @@ func Notification(userID uuid.UUID, kind string) Intent {
 	return Intent{UserID: userID, Kind: KindNotification, Payload: b.FinishedBytes(), EventID: eventID()}
 }
 
-// ProfileChanged is a payload-free "re-fetch your profile" signal to userID, emitted
-// when the viewer's own account changed out of band — an email confirmed through the
-// one-tap deeplink opened in another browser.
-func ProfileChanged(userID uuid.UUID) Intent {
-	return Notification(userID, NotifyProfile)
-}
-
 // NotificationAccount builds a lobby notification of one of the friend_* kinds carrying the
 // account it concerns (the requester, the new friend or the decliner), so the client updates its
 // requests/friends lists and the in-game "add friend" state without a refetch.

backend/internal/notify/notify.go

@@ -69,10 +69,6 @@ const (
 	// it re-fetches profile.get to show or hide the banner. It carries no payload (the
 	// banner set rides the profile response). In-app only.
 	NotifyBanner = "banner"
-	// NotifyProfile tells the client that the viewer's own profile changed out of band
-	// (e.g. an email was confirmed via the one-tap deeplink opened in another browser),
-	// so it re-fetches profile.get. It carries no payload. In-app only.
-	NotifyProfile = "profile"
 	// NotifyUserBlocked confirms to the blocker that a per-user block took effect,
 	// carrying the blocked account, so every one of the blocker's sessions updates the
 	// in-game block/add-friend controls and the struck name in place. It is delivered

backend/internal/postgres/jet/backend/model/accounts.go

@@ -32,8 +32,4 @@ type Accounts struct {
 	MergedAt               *time.Time
 	FlaggedHighRateAt      *time.Time
 	VariantPreferences     pq.StringArray
-	LastLoginAt            *time.Time
-	LastLoginIP            *string
-	DeletedAt              *time.Time
-	DeletedDisplayName     *string
 }

backend/internal/postgres/jet/backend/model/email_confirmations.go

@@ -21,6 +21,4 @@ type EmailConfirmations struct {
 	Attempts       int16
 	ConsumedAt     *time.Time
 	CreatedAt      time.Time
-	Purpose        string
-	LinkTokenHash  *string
 }

backend/internal/postgres/jet/backend/model/retained_identities.go

@@ -1,24 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package model
-
-import (
-	"github.com/google/uuid"
-	"time"
-)
-
-type RetainedIdentities struct {
-	RetainedID uuid.UUID `sql:"primary_key"`
-	AccountID  uuid.UUID
-	Kind       string
-	ExternalID string
-	Confirmed  bool
-	LinkedAt   time.Time
-	DetachedAt time.Time
-	Reason     string
-}

backend/internal/postgres/jet/backend/table/accounts.go

@@ -35,10 +35,6 @@ type accountsTable struct {
 	MergedAt               postgres.ColumnTimestampz
 	FlaggedHighRateAt      postgres.ColumnTimestampz
 	VariantPreferences     postgres.ColumnStringArray
-	LastLoginAt            postgres.ColumnTimestampz
-	LastLoginIP            postgres.ColumnString
-	DeletedAt              postgres.ColumnTimestampz
-	DeletedDisplayName     postgres.ColumnString
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -98,12 +94,8 @@ func newAccountsTableImpl(schemaName, tableName, alias string) accountsTable {
 		MergedAtColumn               = postgres.TimestampzColumn("merged_at")
 		FlaggedHighRateAtColumn      = postgres.TimestampzColumn("flagged_high_rate_at")
 		VariantPreferencesColumn     = postgres.StringArrayColumn("variant_preferences")
-		LastLoginAtColumn            = postgres.TimestampzColumn("last_login_at")
+		allColumns                   = postgres.ColumnList{AccountIDColumn, DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, FlaggedHighRateAtColumn, VariantPreferencesColumn}
-		LastLoginIPColumn            = postgres.StringColumn("last_login_ip")
+		mutableColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, FlaggedHighRateAtColumn, VariantPreferencesColumn}
-		DeletedAtColumn              = postgres.TimestampzColumn("deleted_at")
-		DeletedDisplayNameColumn     = postgres.StringColumn("deleted_display_name")
-		allColumns                   = postgres.ColumnList{AccountIDColumn, DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, FlaggedHighRateAtColumn, VariantPreferencesColumn, LastLoginAtColumn, LastLoginIPColumn, DeletedAtColumn, DeletedDisplayNameColumn}
-		mutableColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, FlaggedHighRateAtColumn, VariantPreferencesColumn, LastLoginAtColumn, LastLoginIPColumn, DeletedAtColumn, DeletedDisplayNameColumn}
 		defaultColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, VariantPreferencesColumn}
 	)
 
@@ -129,10 +121,6 @@ func newAccountsTableImpl(schemaName, tableName, alias string) accountsTable {
 		MergedAt:               MergedAtColumn,
 		FlaggedHighRateAt:      FlaggedHighRateAtColumn,
 		VariantPreferences:     VariantPreferencesColumn,
-		LastLoginAt:            LastLoginAtColumn,
-		LastLoginIP:            LastLoginIPColumn,
-		DeletedAt:              DeletedAtColumn,
-		DeletedDisplayName:     DeletedDisplayNameColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/jet/backend/table/email_confirmations.go

@@ -25,8 +25,6 @@ type emailConfirmationsTable struct {
 	Attempts       postgres.ColumnInteger
 	ConsumedAt     postgres.ColumnTimestampz
 	CreatedAt      postgres.ColumnTimestampz
-	Purpose        postgres.ColumnString
-	LinkTokenHash  postgres.ColumnString
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -76,11 +74,9 @@ func newEmailConfirmationsTableImpl(schemaName, tableName, alias string) emailCo
 		AttemptsColumn       = postgres.IntegerColumn("attempts")
 		ConsumedAtColumn     = postgres.TimestampzColumn("consumed_at")
 		CreatedAtColumn      = postgres.TimestampzColumn("created_at")
-		PurposeColumn        = postgres.StringColumn("purpose")
+		allColumns           = postgres.ColumnList{ConfirmationIDColumn, AccountIDColumn, EmailColumn, CodeHashColumn, ExpiresAtColumn, AttemptsColumn, ConsumedAtColumn, CreatedAtColumn}
-		LinkTokenHashColumn  = postgres.StringColumn("link_token_hash")
+		mutableColumns       = postgres.ColumnList{AccountIDColumn, EmailColumn, CodeHashColumn, ExpiresAtColumn, AttemptsColumn, ConsumedAtColumn, CreatedAtColumn}
-		allColumns           = postgres.ColumnList{ConfirmationIDColumn, AccountIDColumn, EmailColumn, CodeHashColumn, ExpiresAtColumn, AttemptsColumn, ConsumedAtColumn, CreatedAtColumn, PurposeColumn, LinkTokenHashColumn}
+		defaultColumns       = postgres.ColumnList{AttemptsColumn, CreatedAtColumn}
-		mutableColumns       = postgres.ColumnList{AccountIDColumn, EmailColumn, CodeHashColumn, ExpiresAtColumn, AttemptsColumn, ConsumedAtColumn, CreatedAtColumn, PurposeColumn, LinkTokenHashColumn}
-		defaultColumns       = postgres.ColumnList{AttemptsColumn, CreatedAtColumn, PurposeColumn}
 	)
 
 	return emailConfirmationsTable{
@@ -95,8 +91,6 @@ func newEmailConfirmationsTableImpl(schemaName, tableName, alias string) emailCo
 		Attempts:       AttemptsColumn,
 		ConsumedAt:     ConsumedAtColumn,
 		CreatedAt:      CreatedAtColumn,
-		Purpose:        PurposeColumn,
-		LinkTokenHash:  LinkTokenHashColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/jet/backend/table/retained_identities.go

@@ -1,99 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package table
-
-import (
-	"github.com/go-jet/jet/v2/postgres"
-)
-
-var RetainedIdentities = newRetainedIdentitiesTable("backend", "retained_identities", "")
-
-type retainedIdentitiesTable struct {
-	postgres.Table
-
-	// Columns
-	RetainedID postgres.ColumnString
-	AccountID  postgres.ColumnString
-	Kind       postgres.ColumnString
-	ExternalID postgres.ColumnString
-	Confirmed  postgres.ColumnBool
-	LinkedAt   postgres.ColumnTimestampz
-	DetachedAt postgres.ColumnTimestampz
-	Reason     postgres.ColumnString
-
-	AllColumns     postgres.ColumnList
-	MutableColumns postgres.ColumnList
-	DefaultColumns postgres.ColumnList
-}
-
-type RetainedIdentitiesTable struct {
-	retainedIdentitiesTable
-
-	EXCLUDED retainedIdentitiesTable
-}
-
-// AS creates new RetainedIdentitiesTable with assigned alias
-func (a RetainedIdentitiesTable) AS(alias string) *RetainedIdentitiesTable {
-	return newRetainedIdentitiesTable(a.SchemaName(), a.TableName(), alias)
-}
-
-// Schema creates new RetainedIdentitiesTable with assigned schema name
-func (a RetainedIdentitiesTable) FromSchema(schemaName string) *RetainedIdentitiesTable {
-	return newRetainedIdentitiesTable(schemaName, a.TableName(), a.Alias())
-}
-
-// WithPrefix creates new RetainedIdentitiesTable with assigned table prefix
-func (a RetainedIdentitiesTable) WithPrefix(prefix string) *RetainedIdentitiesTable {
-	return newRetainedIdentitiesTable(a.SchemaName(), prefix+a.TableName(), a.TableName())
-}
-
-// WithSuffix creates new RetainedIdentitiesTable with assigned table suffix
-func (a RetainedIdentitiesTable) WithSuffix(suffix string) *RetainedIdentitiesTable {
-	return newRetainedIdentitiesTable(a.SchemaName(), a.TableName()+suffix, a.TableName())
-}
-
-func newRetainedIdentitiesTable(schemaName, tableName, alias string) *RetainedIdentitiesTable {
-	return &RetainedIdentitiesTable{
-		retainedIdentitiesTable: newRetainedIdentitiesTableImpl(schemaName, tableName, alias),
-		EXCLUDED:                newRetainedIdentitiesTableImpl("", "excluded", ""),
-	}
-}
-
-func newRetainedIdentitiesTableImpl(schemaName, tableName, alias string) retainedIdentitiesTable {
-	var (
-		RetainedIDColumn = postgres.StringColumn("retained_id")
-		AccountIDColumn  = postgres.StringColumn("account_id")
-		KindColumn       = postgres.StringColumn("kind")
-		ExternalIDColumn = postgres.StringColumn("external_id")
-		ConfirmedColumn  = postgres.BoolColumn("confirmed")
-		LinkedAtColumn   = postgres.TimestampzColumn("linked_at")
-		DetachedAtColumn = postgres.TimestampzColumn("detached_at")
-		ReasonColumn     = postgres.StringColumn("reason")
-		allColumns       = postgres.ColumnList{RetainedIDColumn, AccountIDColumn, KindColumn, ExternalIDColumn, ConfirmedColumn, LinkedAtColumn, DetachedAtColumn, ReasonColumn}
-		mutableColumns   = postgres.ColumnList{AccountIDColumn, KindColumn, ExternalIDColumn, ConfirmedColumn, LinkedAtColumn, DetachedAtColumn, ReasonColumn}
-		defaultColumns   = postgres.ColumnList{ConfirmedColumn, DetachedAtColumn}
-	)
-
-	return retainedIdentitiesTable{
-		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
-
-		//Columns
-		RetainedID: RetainedIDColumn,
-		AccountID:  AccountIDColumn,
-		Kind:       KindColumn,
-		ExternalID: ExternalIDColumn,
-		Confirmed:  ConfirmedColumn,
-		LinkedAt:   LinkedAtColumn,
-		DetachedAt: DetachedAtColumn,
-		Reason:     ReasonColumn,
-
-		AllColumns:     allColumns,
-		MutableColumns: mutableColumns,
-		DefaultColumns: defaultColumns,
-	}
-}

backend/internal/postgres/jet/backend/table/table_use_schema.go

@@ -34,7 +34,6 @@ func UseSchema(schema string) {
 	GameSetupDraws = GameSetupDraws.FromSchema(schema)
 	Games = Games.FromSchema(schema)
 	Identities = Identities.FromSchema(schema)
-	RetainedIdentities = RetainedIdentities.FromSchema(schema)
 	Sessions = Sessions.FromSchema(schema)
 	SuspensionReasons = SuspensionReasons.FromSchema(schema)
 }

backend/internal/postgres/migrations/00005_vk_identity.sql

@@ -1,13 +0,0 @@
--- Admit the 'vk' platform identity (VK Mini App users) into the identities.kind check
--- constraint, alongside telegram/email/robot. Expand-contract: widening the allowed set
--- is backward-compatible, so a backend image rollback stays DB-safe — the older code
--- simply never writes a 'vk' row. The table shape is unchanged (only the CHECK), so the
--- generated go-jet model is not regenerated.
-
--- +goose Up
-ALTER TABLE backend.identities DROP CONSTRAINT identities_kind_chk;
-ALTER TABLE backend.identities ADD CONSTRAINT identities_kind_chk CHECK ((kind = ANY (ARRAY['telegram'::text, 'vk'::text, 'email'::text, 'robot'::text])));
-
--- +goose Down
-ALTER TABLE backend.identities DROP CONSTRAINT identities_kind_chk;
-ALTER TABLE backend.identities ADD CONSTRAINT identities_kind_chk CHECK ((kind = ANY (ARRAY['telegram'::text, 'email'::text, 'robot'::text])));

backend/internal/postgres/migrations/00006_email_confirm_deeplink.sql

@@ -1,27 +0,0 @@
--- Add the confirm deeplink token and the confirmation purpose to email_confirmations.
--- purpose tags what verifying the code/token does (email login, identity link, email
--- change, or account deletion); link_token_hash holds the SHA-256 hex of the one-click
--- deeplink token (only the hash is stored, mirroring the session-token model).
--- Expand-contract: both columns are additive. purpose gets a NOT NULL DEFAULT so
--- existing rows fill in; link_token_hash is nullable with a partial-unique index. A
--- backend image rollback stays DB-safe — older code simply ignores the new columns. The
--- table shape changes, so the generated go-jet model for this table is regenerated.
-
--- +goose Up
-ALTER TABLE backend.email_confirmations
-    ADD COLUMN purpose text NOT NULL DEFAULT 'link',
-    ADD COLUMN link_token_hash text;
-ALTER TABLE backend.email_confirmations
-    ADD CONSTRAINT email_confirmations_purpose_chk
-        CHECK ((purpose = ANY (ARRAY['login'::text, 'link'::text, 'change'::text, 'delete'::text])));
-CREATE UNIQUE INDEX email_confirmations_link_token_hash_key
-    ON backend.email_confirmations (link_token_hash)
-    WHERE link_token_hash IS NOT NULL;
-
--- +goose Down
-DROP INDEX IF EXISTS backend.email_confirmations_link_token_hash_key;
-ALTER TABLE backend.email_confirmations
-    DROP CONSTRAINT IF EXISTS email_confirmations_purpose_chk;
-ALTER TABLE backend.email_confirmations
-    DROP COLUMN IF EXISTS link_token_hash,
-    DROP COLUMN IF EXISTS purpose;

backend/internal/postgres/migrations/00007_account_deletion_retention.sql

@@ -1,47 +0,0 @@
--- Account deletion as legal retention (not erasure). Two additive pieces.
---
--- retained_identities is an append-only journal of every credential detached from an
--- account — on unlink, email change, or account deletion (reason). It preserves the legal
--- dossier (which email/vk/tg was linked, and when) while the live identities row is
--- removed, so the (kind, external_id) frees for a new account to reuse. No unique
--- constraint and no kind CHECK: the same credential may recur across accounts and events,
--- and the log stays robust to future identity kinds. detached_at drives the retention TTL.
---
--- accounts gains: last_login_at / last_login_ip (stamped on a cold app-load, throttled),
--- deleted_at (the tombstone marker), and deleted_display_name (the real name retained for
--- the admin dossier after the live display_name is scrubbed to the anonymised label).
---
--- Expand-contract: everything is additive (a new table plus nullable columns), so a
--- backend image rollback stays DB-safe — older code simply ignores them. The accounts
--- table shape changes, so its generated go-jet model is regenerated.
-
--- +goose Up
-CREATE TABLE backend.retained_identities (
-    retained_id uuid NOT NULL,
-    account_id uuid NOT NULL,
-    kind text NOT NULL,
-    external_id text NOT NULL,
-    confirmed boolean DEFAULT false NOT NULL,
-    linked_at timestamp with time zone NOT NULL,
-    detached_at timestamp with time zone DEFAULT now() NOT NULL,
-    reason text NOT NULL,
-    CONSTRAINT retained_identities_pkey PRIMARY KEY (retained_id),
-    CONSTRAINT retained_identities_reason_chk
-        CHECK ((reason = ANY (ARRAY['unlink'::text, 'change'::text, 'delete'::text])))
-);
-CREATE INDEX retained_identities_account_id_idx ON backend.retained_identities (account_id);
-CREATE INDEX retained_identities_detached_at_idx ON backend.retained_identities (detached_at);
-
-ALTER TABLE backend.accounts
-    ADD COLUMN last_login_at timestamp with time zone,
-    ADD COLUMN last_login_ip text,
-    ADD COLUMN deleted_at timestamp with time zone,
-    ADD COLUMN deleted_display_name text;
-
--- +goose Down
-ALTER TABLE backend.accounts
-    DROP COLUMN last_login_at,
-    DROP COLUMN last_login_ip,
-    DROP COLUMN deleted_at,
-    DROP COLUMN deleted_display_name;
-DROP TABLE backend.retained_identities;

backend/internal/render/render.go

@@ -1,61 +0,0 @@
-// Package render is the backend's client for the internal image-render sidecar: it POSTs
-// a finished game's export payload and receives the rasterized PNG. The sidecar runs the
-// same drawing code the web client unit-tests (ui/src/lib/gameimage.ts on skia-canvas);
-// authentication and the signed public URL live in the server layer — this client only
-// carries bytes.
-package render
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"time"
-)
-
-// maxPNG caps a render response; a scale-2 export of the largest plausible game is well
-// under 2 MiB, so anything bigger is a sidecar malfunction, not a valid image.
-const maxPNG = 8 << 20
-
-// Client calls the render sidecar over the internal network.
-type Client struct {
-	base string
-	http *http.Client
-}
-
-// New returns a client for the sidecar at baseURL (e.g. http://renderer:8090). A render
-// of a full game takes well under a second; the timeout leaves room for a cold start.
-func New(baseURL string) *Client {
-	return &Client{base: baseURL, http: &http.Client{Timeout: 15 * time.Second}}
-}
-
-// Render posts payload (the JSON request shape the sidecar consumes) and returns the PNG.
-func (c *Client) Render(ctx context.Context, payload any) ([]byte, error) {
-	body, err := json.Marshal(payload)
-	if err != nil {
-		return nil, fmt.Errorf("render: marshal payload: %w", err)
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.base+"/render", bytes.NewReader(body))
-	if err != nil {
-		return nil, fmt.Errorf("render: build request: %w", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("render: %w", err)
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("render: sidecar status %d", resp.StatusCode)
-	}
-	png, err := io.ReadAll(io.LimitReader(resp.Body, maxPNG+1))
-	if err != nil {
-		return nil, fmt.Errorf("render: read response: %w", err)
-	}
-	if len(png) > maxPNG {
-		return nil, fmt.Errorf("render: response exceeds %d bytes", maxPNG)
-	}
-	return png, nil
-}

backend/internal/server/banner.go

@@ -45,34 +45,9 @@ type bannerTimingsDTO struct {
 func (s *Server) profileResponse(ctx context.Context, acc account.Account) profileResponse {
 	r := profileResponseFor(acc)
 	r.Banner = s.bannerFor(ctx, acc)
-	s.fillLinkedIdentities(ctx, &r, acc.ID)
 	return r
 }
 
-// fillLinkedIdentities sets the profile's confirmed email address and platform-linked
-// flags from the account's identities, so the client offers the right link / unlink /
-// change-email controls. A read failure leaves them zero (no controls), logged as a
-// warning so the profile response still succeeds.
-func (s *Server) fillLinkedIdentities(ctx context.Context, r *profileResponse, accountID uuid.UUID) {
-	ids, err := s.accounts.Identities(ctx, accountID)
-	if err != nil {
-		s.log.Warn("profile: identities read failed", zap.String("account", accountID.String()), zap.Error(err))
-		return
-	}
-	for _, id := range ids {
-		switch id.Kind {
-		case account.KindEmail:
-			if id.Confirmed {
-				r.Email = id.ExternalID
-			}
-		case account.KindTelegram:
-			r.TelegramLinked = true
-		case account.KindVK:
-			r.VkLinked = true
-		}
-	}
-}
-
 // bannerFor builds the advertising-banner block for the account's profile, or
 // nil when the ads service is not configured or the viewer is not eligible to
 // see a banner. The message language follows the account's bot (service)

backend/internal/server/dto.go

@@ -56,13 +56,6 @@ type profileResponse struct {
 	// see the banner (a free account with an empty hint wallet and without the
 	// no_banner role), absent otherwise. See banner.go.
 	Banner *bannerDTO `json:"banner,omitempty"`
-	// Email is the account's confirmed email address ("" when none); TelegramLinked and
-	// VkLinked report whether a platform identity is attached. They drive the profile's
-	// link / unlink / change-email controls, and are filled outside the pure projection
-	// (they read the account's identities). See Server.profileResponse.
-	Email          string `json:"email"`
-	TelegramLinked bool   `json:"telegram_linked"`
-	VkLinked       bool   `json:"vk_linked"`
 }
 
 // tileDTO is one placed (or to-place) tile.

backend/internal/server/dto_test.go

@@ -30,7 +30,6 @@ func TestStatusForError(t *testing.T) {
 		"illegal play":   {engine.ErrIllegalPlay, http.StatusUnprocessableEntity, "illegal_play"},
 		"email taken":    {account.ErrEmailTaken, http.StatusConflict, "email_taken"},
 		"code mismatch":  {account.ErrCodeMismatch, http.StatusUnauthorized, "code_invalid"},
-		"too many codes": {account.ErrTooManyRequests, http.StatusTooManyRequests, "too_many_requests"},
 		"session gone":   {session.ErrNotFound, http.StatusUnauthorized, "session_invalid"},
 		"chat forbidden": {social.ErrForbiddenContent, http.StatusUnprocessableEntity, "chat_rejected"},
 		"no hint move":   {game.ErrNoHintAvailable, http.StatusConflict, "no_hint_available"},

backend/internal/server/export.go

@@ -1,310 +0,0 @@
-// Finished-game export downloads: a signed, short-lived, relative URL minted for a
-// participant and later fetched with no credentials at all — the platforms' native
-// download calls (Telegram downloadFile, VKWebAppDownloadFile, a plain browser
-// anchor) strip cookies and headers, so the HMAC in the URL is the whole grant.
-// The client resolves the relative path against its own origin; the edge routes
-// /dl/* to the gateway, which forwards it here (/api/v1/public/dl/...).
-package server
-
-import (
-	"crypto/hmac"
-	"crypto/sha256"
-	"encoding/base64"
-	"fmt"
-	"net/http"
-	"net/url"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"github.com/google/uuid"
-	"go.uber.org/zap"
-
-	"scrabble/backend/internal/engine"
-	"scrabble/backend/internal/game"
-)
-
-// exportURLTTL is how long a minted download URL stays valid. Long enough for the
-// platform's download dialog and a retry, short enough that a leaked link dies fast.
-const exportURLTTL = 10 * time.Minute
-
-// Query/label size caps: the presentation params ride the signed URL, so they are
-// bounded defensively (they only ever hold a BCP-47 tag and four short UI words).
-const (
-	maxDateLocaleLen = 35
-	maxLabelsLen     = 120
-	maxTimeZoneLen   = 50
-)
-
-// exportActionOrder fixes the position of each non-play move label in the `t` CSV.
-var exportActionOrder = [4]string{"pass", "exchange", "resign", "timeout"}
-
-// signExport computes the URL signature over the canonical parameter string. The
-// canonical form is independent of the public path prefix, so the gateway may mount
-// the route anywhere.
-func (s *Server) signExport(gameID, kind, exp, dateLocale, timeZone, labels string) string {
-	mac := hmac.New(sha256.New, s.exportKey)
-	fmt.Fprintf(mac, "%s|%s|%s|%s|%s|%s", gameID, kind, exp, dateLocale, timeZone, labels)
-	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
-}
-
-// exportURLDTO is the minted link: a relative signed path plus the download filename.
-type exportURLDTO struct {
-	Path     string `json:"path"`
-	Filename string `json:"filename"`
-}
-
-// handleExportURL mints the signed download path for a finished game's artifact.
-// GET /api/v1/user/games/:id/export-url?kind=png|gcg&dl=<date-locale>&tz=<IANA zone>&t=<labels CSV>
-func (s *Server) handleExportURL(c *gin.Context) {
-	if len(s.exportKey) == 0 {
-		c.AbortWithStatusJSON(http.StatusServiceUnavailable,
-			errorResponse{Error: errorBody{Code: "export_unavailable", Message: "export signing is not configured"}})
-		return
-	}
-	_, gameID, ok := s.userGame(c)
-	if !ok {
-		return
-	}
-	kind := c.Query("kind")
-	if kind != "png" && kind != "gcg" {
-		abortBadRequest(c, "invalid kind")
-		return
-	}
-	dateLocale := c.Query("dl")
-	timeZone := c.Query("tz")
-	labels := c.Query("t")
-	if len(dateLocale) > maxDateLocaleLen || len(labels) > maxLabelsLen || len(timeZone) > maxTimeZoneLen {
-		abortBadRequest(c, "presentation params too long")
-		return
-	}
-	if err := s.games.EnsureExportable(c.Request.Context(), gameID); err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	exp := strconv.FormatInt(time.Now().Add(exportURLTTL).Unix(), 10)
-	sig := s.signExport(gameID.String(), kind, exp, dateLocale, timeZone, labels)
-	q := url.Values{"e": {exp}, "s": {sig}}
-	if dateLocale != "" {
-		q.Set("l", dateLocale)
-	}
-	if timeZone != "" {
-		q.Set("z", timeZone)
-	}
-	if labels != "" {
-		q.Set("t", labels)
-	}
-	c.JSON(http.StatusOK, exportURLDTO{
-		Path:     "/dl/" + gameID.String() + "/" + kind + "?" + q.Encode(),
-		Filename: exportFilename(gameID, kind),
-	})
-}
-
-func exportFilename(gameID uuid.UUID, kind string) string {
-	return "game-" + gameID.String()[:8] + "." + kind
-}
-
-// handleExportDownload serves a minted artifact. It is a public route: the signature
-// and expiry are the only authorization (see the package comment). Every failure is
-// a plain 404 so the endpoint is not a validity oracle.
-// GET /api/v1/public/dl/:id/:kind?e=&l=&z=&t=&s=
-func (s *Server) handleExportDownload(c *gin.Context) {
-	if len(s.exportKey) == 0 {
-		c.String(http.StatusNotFound, "not found")
-		return
-	}
-	gameID, err := uuid.Parse(c.Param("id"))
-	kind := c.Param("kind")
-	exp := c.Query("e")
-	dateLocale := c.Query("l")
-	timeZone := c.Query("z")
-	labels := c.Query("t")
-	sig := c.Query("s")
-	if err != nil || (kind != "png" && kind != "gcg") ||
-		len(dateLocale) > maxDateLocaleLen || len(labels) > maxLabelsLen || len(timeZone) > maxTimeZoneLen {
-		c.String(http.StatusNotFound, "not found")
-		return
-	}
-	want := s.signExport(gameID.String(), kind, exp, dateLocale, timeZone, labels)
-	if subtleNeq(sig, want) {
-		c.String(http.StatusNotFound, "not found")
-		return
-	}
-	if unix, err := strconv.ParseInt(exp, 10, 64); err != nil || time.Now().Unix() > unix {
-		c.String(http.StatusNotFound, "not found")
-		return
-	}
-
-	filename := exportFilename(gameID, kind)
-	if kind == "gcg" {
-		gcg, err := s.games.ExportGCG(c.Request.Context(), gameID)
-		if err != nil {
-			c.String(http.StatusNotFound, "not found")
-			return
-		}
-		serveAttachment(c, filename, "text/plain; charset=utf-8", []byte(gcg))
-		return
-	}
-
-	if s.renderer == nil {
-		c.String(http.StatusNotFound, "not found")
-		return
-	}
-	g, moves, names, err := s.games.ExportView(c.Request.Context(), gameID)
-	if err != nil {
-		c.String(http.StatusNotFound, "not found")
-		return
-	}
-	payload, err := renderPayload(g, moves, names, dateLocale, timeZone, labels, c.GetHeader("X-Public-Host"))
-	if err != nil {
-		s.log.Warn("export render payload", zap.Error(err))
-		c.String(http.StatusNotFound, "not found")
-		return
-	}
-	png, err := s.renderer.Render(c.Request.Context(), payload)
-	if err != nil {
-		s.log.Warn("export render", zap.Error(err))
-		c.String(http.StatusServiceUnavailable, "render unavailable")
-		return
-	}
-	serveAttachment(c, filename, "image/png", png)
-}
-
-// subtleNeq compares two signature strings in constant time.
-func subtleNeq(got, want string) bool {
-	return !hmac.Equal([]byte(got), []byte(want))
-}
-
-// serveAttachment writes bytes as a named file download. Content-Length is set
-// explicitly: a body over net/http's write buffer otherwise goes out chunked, and
-// Android's system DownloadManager (which VKWebAppDownloadFile delegates to) hangs
-// forever on a download of unknown length.
-func serveAttachment(c *gin.Context, filename, contentType string, data []byte) {
-	c.Header("X-Content-Type-Options", "nosniff")
-	c.Header("Content-Disposition", `attachment; filename="`+sanitizeFilename(filename)+`"`)
-	c.Header("Cache-Control", "private, max-age=0")
-	c.Header("Content-Length", strconv.Itoa(len(data)))
-	c.Data(http.StatusOK, contentType, data)
-}
-
-// --- the render-sidecar request payload (the ui-model shapes drawGameImage consumes) ---
-
-type renderSeatJSON struct {
-	Seat        int    `json:"seat"`
-	AccountID   string `json:"accountId"`
-	DisplayName string `json:"displayName"`
-	Score       int    `json:"score"`
-	HintsUsed   int    `json:"hintsUsed"`
-	IsWinner    bool   `json:"isWinner"`
-}
-
-type renderGameJSON struct {
-	ID               string           `json:"id"`
-	Variant          string           `json:"variant"`
-	Status           string           `json:"status"`
-	Players          int              `json:"players"`
-	LastActivityUnix int64            `json:"lastActivityUnix"`
-	Seats            []renderSeatJSON `json:"seats"`
-}
-
-type renderTileJSON struct {
-	Row    int    `json:"row"`
-	Col    int    `json:"col"`
-	Letter string `json:"letter"`
-	Blank  bool   `json:"blank"`
-}
-
-type renderMoveJSON struct {
-	Player  int              `json:"player"`
-	Action  string           `json:"action"`
-	Dir     string           `json:"dir"`
-	MainRow int              `json:"mainRow"`
-	MainCol int              `json:"mainCol"`
-	Tiles   []renderTileJSON `json:"tiles"`
-	Words   []string         `json:"words"`
-	Count   int              `json:"count"`
-	Score   int              `json:"score"`
-	Total   int              `json:"total"`
-}
-
-type renderAlphaJSON struct {
-	Index  int    `json:"index"`
-	Letter string `json:"letter"`
-	Value  int    `json:"value"`
-}
-
-type renderRequestJSON struct {
-	Game       renderGameJSON    `json:"game"`
-	Moves      []renderMoveJSON  `json:"moves"`
-	Alphabet   []renderAlphaJSON `json:"alphabet"`
-	Labels     map[string]string `json:"labels"`
-	DateLocale string            `json:"dateLocale"`
-	TimeZone   string            `json:"timeZone"`
-	Hostname   string            `json:"hostname"`
-}
-
-// renderPayload assembles the sidecar request from the export view. Letters are
-// upper-cased for display exactly as the client codec does; the localized non-play
-// labels arrive as a positional CSV (see exportActionOrder) minted into the URL.
-func renderPayload(g game.Game, moves []game.HistoryMove, names []string, dateLocale, timeZone, labelsCSV, host string) (renderRequestJSON, error) {
-	alpha, err := engine.AlphabetTable(g.Variant)
-	if err != nil {
-		return renderRequestJSON{}, fmt.Errorf("alphabet for %s: %w", g.Variant, err)
-	}
-	req := renderRequestJSON{
-		Game: renderGameJSON{
-			ID:      g.ID.String(),
-			Variant: g.Variant.String(),
-			Status:  g.Status,
-			Players: g.Players,
-		},
-		Labels:     map[string]string{},
-		DateLocale: dateLocale,
-		TimeZone:   timeZone,
-		Hostname:   host,
-	}
-	finished := g.UpdatedAt
-	if g.FinishedAt != nil {
-		finished = *g.FinishedAt
-	}
-	req.Game.LastActivityUnix = finished.Unix()
-	for _, st := range g.Seats {
-		name := st.DisplayName
-		if st.Seat < len(names) {
-			name = names[st.Seat]
-		}
-		req.Game.Seats = append(req.Game.Seats, renderSeatJSON{
-			Seat: st.Seat, AccountID: st.AccountID.String(), DisplayName: name,
-			Score: st.Score, HintsUsed: st.HintsUsed, IsWinner: st.IsWinner,
-		})
-	}
-	for _, m := range moves {
-		mv := renderMoveJSON{
-			Player: m.Seat, Action: m.Action, Dir: m.Dir,
-			MainRow: m.MainRow, MainCol: m.MainCol,
-			Words: make([]string, 0, len(m.Words)),
-			Count: len(m.Exchanged), Score: m.Score, Total: m.RunningTotal,
-			Tiles: make([]renderTileJSON, 0, len(m.Tiles)),
-		}
-		for _, w := range m.Words {
-			mv.Words = append(mv.Words, strings.ToUpper(w))
-		}
-		for _, t := range m.Tiles {
-			mv.Tiles = append(mv.Tiles, renderTileJSON{Row: t.Row, Col: t.Col, Letter: strings.ToUpper(t.Letter), Blank: t.Blank})
-		}
-		req.Moves = append(req.Moves, mv)
-	}
-	for _, a := range alpha {
-		req.Alphabet = append(req.Alphabet, renderAlphaJSON{Index: int(a.Index), Letter: strings.ToUpper(a.Letter), Value: a.Value})
-	}
-	if labelsCSV != "" {
-		parts := strings.Split(labelsCSV, ",")
-		for i, action := range exportActionOrder {
-			if i < len(parts) && parts[i] != "" {
-				req.Labels[action] = parts[i]
-			}
-		}
-	}
-	return req, nil
-}

backend/internal/server/export_test.go

@@ -1,148 +0,0 @@
-package server
-
-import (
-	"net/http"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-	"scrabble/backend/internal/engine"
-	"scrabble/backend/internal/game"
-	"scrabble/backend/internal/session"
-)
-
-// newExportServer is the routing harness with a signing key installed, so the
-// pre-service branches of the export endpoints are reachable.
-func newExportServer() *Server {
-	return New(":0", Deps{
-		Sessions:      &session.Service{},
-		Accounts:      &account.Store{},
-		Games:         &game.Service{},
-		ExportSignKey: "test-key",
-	})
-}
-
-func TestSignExportIsDeterministicAndTamperEvident(t *testing.T) {
-	s := newExportServer()
-	sig := s.signExport("g1", "png", "123", "ru", "Europe/Moscow", "пас,обмен")
-	if sig != s.signExport("g1", "png", "123", "ru", "Europe/Moscow", "пас,обмен") {
-		t.Fatal("same inputs produced different signatures")
-	}
-	for _, tampered := range []string{
-		s.signExport("g2", "png", "123", "ru", "Europe/Moscow", "пас,обмен"),
-		s.signExport("g1", "gcg", "123", "ru", "Europe/Moscow", "пас,обмен"),
-		s.signExport("g1", "png", "124", "ru", "Europe/Moscow", "пас,обмен"),
-		s.signExport("g1", "png", "123", "en", "Europe/Moscow", "пас,обмен"),
-		s.signExport("g1", "png", "123", "ru", "UTC", "пас,обмен"),
-		s.signExport("g1", "png", "123", "ru", "Europe/Moscow", "пас"),
-	} {
-		if tampered == sig {
-			t.Fatal("tampered input produced the same signature")
-		}
-	}
-}
-
-func TestExportURLWithoutKeyIs503(t *testing.T) {
-	s := New(":0", Deps{Sessions: &session.Service{}, Accounts: &account.Store{}, Games: &game.Service{}})
-	rec := do(t, s, http.MethodGet, "/api/v1/user/games/"+uuid.NewString()+"/export-url?kind=png", "",
-		map[string]string{"X-User-ID": uuid.NewString()})
-	if rec.Code != http.StatusServiceUnavailable {
-		t.Fatalf("mint without key = %d, want 503", rec.Code)
-	}
-}
-
-func TestExportURLRejectsBadParams(t *testing.T) {
-	s := newExportServer()
-	uid := map[string]string{"X-User-ID": uuid.NewString()}
-	gid := uuid.NewString()
-
-	if rec := do(t, s, http.MethodGet, "/api/v1/user/games/"+gid+"/export-url?kind=exe", "", uid); rec.Code != http.StatusBadRequest {
-		t.Fatalf("bad kind = %d, want 400", rec.Code)
-	}
-	long := strings.Repeat("x", maxLabelsLen+1)
-	if rec := do(t, s, http.MethodGet, "/api/v1/user/games/"+gid+"/export-url?kind=png&t="+long, "", uid); rec.Code != http.StatusBadRequest {
-		t.Fatalf("oversized labels = %d, want 400", rec.Code)
-	}
-}
-
-func TestExportDownloadRejectsBadSignatures(t *testing.T) {
-	s := newExportServer()
-	gid := uuid.NewString()
-	exp := strconv.FormatInt(time.Now().Add(time.Minute).Unix(), 10)
-
-	// A wrong signature never reaches the domain (404 before any service call).
-	url := "/api/v1/public/dl/" + gid + "/png?e=" + exp + "&s=forged"
-	if rec := do(t, s, http.MethodGet, url, "", nil); rec.Code != http.StatusNotFound {
-		t.Fatalf("forged signature = %d, want 404", rec.Code)
-	}
-
-	// A valid signature over an EXPIRED timestamp is refused the same way.
-	old := strconv.FormatInt(time.Now().Add(-time.Minute).Unix(), 10)
-	url = "/api/v1/public/dl/" + gid + "/png?e=" + old + "&s=" + s.signExport(gid, "png", old, "", "", "")
-	if rec := do(t, s, http.MethodGet, url, "", nil); rec.Code != http.StatusNotFound {
-		t.Fatalf("expired link = %d, want 404", rec.Code)
-	}
-
-	// An unknown kind is refused before signature checks.
-	url = "/api/v1/public/dl/" + gid + "/exe?e=" + exp + "&s=x"
-	if rec := do(t, s, http.MethodGet, url, "", nil); rec.Code != http.StatusNotFound {
-		t.Fatalf("bad kind = %d, want 404", rec.Code)
-	}
-}
-
-func TestRenderPayloadMapsTheExportView(t *testing.T) {
-	gid := uuid.New()
-	finished := time.Unix(1_782_997_629, 0)
-	g := game.Game{
-		ID:         gid,
-		Variant:    engine.VariantRussianScrabble,
-		Status:     game.StatusFinished,
-		Players:    2,
-		FinishedAt: &finished,
-		Seats: []game.Seat{
-			{Seat: 0, Score: 42, IsWinner: true, DisplayName: "snapshot"},
-			{Seat: 1, Score: 30},
-		},
-	}
-	moves := []game.HistoryMove{
-		{
-			Seat: 0, Action: "play", Dir: "H", MainRow: 7, MainCol: 4,
-			Tiles: []engine.TileRecord{{Row: 7, Col: 4, Letter: "ч", Blank: false}},
-			Words: []string{"чика"}, Score: 9, RunningTotal: 9,
-		},
-		{Seat: 1, Action: "exchange", Exchanged: []string{"а", "б"}, RunningTotal: 0},
-	}
-	names := []string{"Аня", "Боб"}
-
-	p, err := renderPayload(g, moves, names, "ru", "Europe/Moscow", "пас,обмен,сдался,таймаут", "erudit-game.ru")
-	if err != nil {
-		t.Fatalf("renderPayload: %v", err)
-	}
-	if p.Game.LastActivityUnix != finished.Unix() {
-		t.Fatalf("lastActivityUnix = %d, want %d", p.Game.LastActivityUnix, finished.Unix())
-	}
-	if p.Game.Seats[0].DisplayName != "Аня" || !p.Game.Seats[0].IsWinner {
-		t.Fatalf("seat 0 = %+v, want the resolved name and the winner flag", p.Game.Seats[0])
-	}
-	if p.Moves[0].Words[0] != "ЧИКА" || p.Moves[0].Tiles[0].Letter != "Ч" {
-		t.Fatalf("letters not upper-cased: %+v", p.Moves[0])
-	}
-	if p.Moves[1].Count != 2 {
-		t.Fatalf("exchange count = %d, want 2", p.Moves[1].Count)
-	}
-	if p.Labels["pass"] != "пас" || p.Labels["timeout"] != "таймаут" {
-		t.Fatalf("labels not mapped positionally: %v", p.Labels)
-	}
-	if len(p.Alphabet) == 0 || p.Hostname != "erudit-game.ru" || p.TimeZone != "Europe/Moscow" {
-		t.Fatalf("alphabet/hostname/zone missing: %d entries, host %q, tz %q", len(p.Alphabet), p.Hostname, p.TimeZone)
-	}
-	for _, a := range p.Alphabet {
-		if a.Letter != strings.ToUpper(a.Letter) {
-			t.Fatalf("alphabet letter %q not upper-cased", a.Letter)
-		}
-	}
-}

backend/internal/server/handlers.go

@@ -27,11 +27,9 @@ func (s *Server) registerRoutes() {
 	if s.sessions != nil && s.accounts != nil {
 		in := s.internal
 		in.POST("/sessions/telegram", s.handleTelegramAuth)
-		in.POST("/sessions/vk", s.handleVKAuth)
 		in.POST("/sessions/guest", s.handleGuestAuth)
 		in.POST("/sessions/email/request", s.handleEmailRequest)
 		in.POST("/sessions/email/login", s.handleEmailLogin)
-		in.POST("/sessions/email/confirm-link", s.handleEmailConfirmLink)
 		in.POST("/sessions/resolve", s.handleResolveSession)
 		in.POST("/sessions/revoke", s.handleRevokeSession)
 		// Out-of-app push routing for the platform side-service: the
@@ -74,16 +72,6 @@ func (s *Server) registerRoutes() {
 		u.POST("/link/email/merge", s.handleLinkEmailMerge)
 		u.POST("/link/telegram", s.handleLinkTelegram)
 		u.POST("/link/telegram/merge", s.handleLinkTelegramMerge)
-		u.POST("/link/unlink", s.handleUnlink)
-		// Change the account's confirmed email: mail a code to the new address, then
-		// atomically switch on confirm (a new address owned by another account is
-		// refused without disclosure, never merged).
-		u.POST("/link/email/change/request", s.handleChangeEmailRequest)
-		u.POST("/link/email/change/confirm", s.handleChangeEmailConfirm)
-		// Account deletion (legal retention, not erasure): step-up via a mailed code
-		// (email accounts) or a typed phrase (platform-only), then tombstone + free creds.
-		u.POST("/delete/request", s.handleRequestDelete)
-		u.POST("/delete/confirm", s.handleConfirmDelete)
 	}
 	if s.games != nil {
 		u.GET("/games", s.handleListGames)
@@ -98,17 +86,9 @@ func (s *Server) registerRoutes() {
 		u.POST("/games/:id/complaint", s.handleComplaint)
 		u.GET("/games/:id/history", s.handleHistory)
 		u.GET("/games/:id/gcg", s.handleExportGCG)
-		u.GET("/games/:id/export-url", s.handleExportURL)
 		u.GET("/games/:id/draft", s.handleGetDraft)
 		u.PUT("/games/:id/draft", s.handleSaveDraft)
 		u.POST("/games/:id/hide", s.handleHideGame)
-		// Raw dictionary download for the client-side local move preview, keyed by
-		// the game's pinned (variant, version); immutable, so cached hard.
-		u.GET("/dict/:variant/:version", s.handleDictBytes)
-		// The signed finished-game export download — the only public data route:
-		// the URL's HMAC + expiry are the whole grant (export.go), because the
-		// platforms' native download calls carry no credentials.
-		s.public.GET("/dl/:id/:kind", s.handleExportDownload)
 	}
 	if s.feedback != nil {
 		u.POST("/feedback", s.handleFeedbackSubmit)
@@ -241,8 +221,6 @@ func statusForError(err error) (int, string) {
 		return http.StatusUnprocessableEntity, "illegal_play"
 	case errors.Is(err, account.ErrEmailTaken), errors.Is(err, account.ErrIdentityTaken):
 		return http.StatusConflict, "email_taken"
-	case errors.Is(err, account.ErrLastIdentity):
-		return http.StatusConflict, "last_identity"
 	case errors.Is(err, accountmerge.ErrActiveGameConflict):
 		return http.StatusConflict, "merge_active_game_conflict"
 	case errors.Is(err, account.ErrInvalidEmail):
@@ -250,8 +228,6 @@ func statusForError(err error) (int, string) {
 	case errors.Is(err, account.ErrCodeMismatch), errors.Is(err, account.ErrCodeExpired),
 		errors.Is(err, account.ErrNoPendingCode), errors.Is(err, account.ErrTooManyAttempts):
 		return http.StatusUnauthorized, "code_invalid"
-	case errors.Is(err, account.ErrTooManyRequests):
-		return http.StatusTooManyRequests, "too_many_requests"
 	case errors.Is(err, session.ErrNotFound):
 		return http.StatusUnauthorized, "session_invalid"
 	case errors.Is(err, social.ErrChatBlocked), errors.Is(err, social.ErrMessageTooLong),

backend/internal/server/handlers_admin_console.go

@@ -61,8 +61,6 @@ func (s *Server) registerConsole(router *gin.Engine) {
 	gm.POST("/users/:id/unblock", s.consoleUnblockUser)
 	gm.POST("/users/:id/grant-role", s.consoleGrantRole)
 	gm.POST("/users/:id/revoke-role", s.consoleRevokeRole)
-	gm.POST("/users/:id/remove-email", s.consoleRemoveEmail)
-	gm.POST("/users/:id/delete", s.consoleDeleteUser)
 	gm.GET("/reasons", s.consoleReasons)
 	gm.POST("/reasons", s.consoleCreateReason)
 	gm.POST("/reasons/:id/update", s.consoleUpdateReason)
@@ -134,10 +132,8 @@ func (s *Server) consoleUsers(c *gin.Context) {
 	page := consolePage(c)
 	filter := account.UserFilter{
 		Robots:         c.Query("kind") == "robots",
-		Deleted:        c.Query("kind") == "deleted",
 		NameMask:       c.Query("name"),
 		ExternalIDMask: c.Query("ext"),
-		EmailExact:     c.Query("email"),
 	}
 	total, _ := s.accounts.CountUsers(ctx, filter)
 	items, err := s.accounts.ListUsers(ctx, filter, adminPageSize, (page-1)*adminPageSize)
@@ -149,38 +145,28 @@ func (s *Server) consoleUsers(c *gin.Context) {
 	if filter.Robots {
 		q.Set("kind", "robots")
 	}
-	if filter.Deleted {
-		q.Set("kind", "deleted")
-	}
 	if strings.TrimSpace(filter.NameMask) != "" {
 		q.Set("name", filter.NameMask)
 	}
 	if strings.TrimSpace(filter.ExternalIDMask) != "" {
 		q.Set("ext", filter.ExternalIDMask)
 	}
-	if strings.TrimSpace(filter.EmailExact) != "" {
-		q.Set("email", filter.EmailExact)
-	}
 	view := adminconsole.UsersView{
 		Pager:  adminconsole.NewPager(page, adminPageSize, total),
-		Robots: filter.Robots, Deleted: filter.Deleted, NameMask: filter.NameMask, ExternalIDMask: filter.ExternalIDMask,
+		Robots: filter.Robots, NameMask: filter.NameMask, ExternalIDMask: filter.ExternalIDMask,
-		EmailExact:  filter.EmailExact,
 		FilterQuery: template.URL(q.Encode()),
 	}
 	ids := make([]uuid.UUID, 0, len(items))
 	for _, it := range items {
 		kind := "registered"
-		switch {
+		if it.IsRobot {
-		case it.IsRobot:
 			kind = "robot"
-		case it.IsDeleted:
+		} else if it.IsGuest {
-			kind = "deleted"
-		case it.IsGuest:
 			kind = "guest"
 		}
 		view.Items = append(view.Items, adminconsole.UserRow{
 			ID: it.ID.String(), DisplayName: it.DisplayName, Kind: kind,
-			Language: it.PreferredLanguage, Guest: it.IsGuest, Deleted: it.IsDeleted,
+			Language: it.PreferredLanguage, Guest: it.IsGuest,
 			FlaggedHighRate: !it.FlaggedHighRateAt.IsZero(), CreatedAt: fmtTime(it.CreatedAt),
 		})
 		ids = append(ids, it.ID)
@@ -370,37 +356,12 @@ func (s *Server) consoleUserDetail(c *gin.Context) {
 	}
 	if ids, err := s.accounts.Identities(ctx, id); err == nil {
 		for _, idn := range ids {
-			if idn.Kind == account.KindEmail {
-				view.HasEmail = true
-			}
 			view.Identities = append(view.Identities, adminconsole.IdentityRow{Kind: idn.Kind, ExternalID: idn.ExternalID, Confirmed: idn.Confirmed, CreatedAt: fmtTime(idn.CreatedAt)})
 		}
 	}
-	if info, err := s.accounts.DeletionInfo(ctx, id); err == nil {
-		if info.LastLoginAt != nil {
-			view.LastLoginAt = fmtTime(*info.LastLoginAt)
-		}
-		view.LastLoginIP = info.LastLoginIP
-		if info.DeletedAt != nil {
-			view.Deleted = true
-			view.DeletedAt = fmtTime(*info.DeletedAt)
-			view.DeletedName = info.DeletedDisplayName
-		}
-	}
-	if rets, err := s.accounts.RetainedIdentities(ctx, id); err == nil {
-		for _, r := range rets {
-			view.Retained = append(view.Retained, adminconsole.RetainedRow{
-				Kind: r.Kind, ExternalID: r.ExternalID, Reason: r.Reason,
-				Confirmed: r.Confirmed, LinkedAt: fmtTime(r.LinkedAt), DetachedAt: fmtTime(r.DetachedAt),
-			})
-		}
-	}
 	if tg, err := s.accounts.IdentityExternalID(ctx, id, account.KindTelegram); err == nil {
 		view.TelegramID = tg
 	}
-	if vk, err := s.accounts.IdentityExternalID(ctx, id, account.KindVK); err == nil {
-		view.VKID = vk
-	}
 	if games, err := s.games.ListForAccount(ctx, id); err == nil {
 		for _, g := range games {
 			view.Games = append(view.Games, gameRow(g))
@@ -987,41 +948,6 @@ func (s *Server) consoleGrantHints(c *gin.Context) {
 	s.renderConsoleMessage(c, "Granted", fmt.Sprintf("added %d hint(s); the wallet is now %d", n, balance), back)
 }
 
-// consoleRemoveEmail deletes the account's bound email identity (and any pending
-// confirmations), freeing the address. It refuses to remove the account's only
-// identity, which would leave it unreachable.
-func (s *Server) consoleRemoveEmail(c *gin.Context) {
-	id, ok := s.consoleUUID(c, "/_gm/users")
-	if !ok {
-		return
-	}
-	back := "/_gm/users/" + id.String()
-	switch err := s.accounts.RemoveEmailIdentity(c.Request.Context(), id); {
-	case errors.Is(err, account.ErrLastIdentity):
-		s.renderConsoleMessage(c, "Can't remove", "the email is this account's only identity — removing it would leave the account unreachable", back)
-	case err != nil:
-		s.consoleError(c, err)
-	default:
-		s.renderConsoleMessage(c, "Removed", "the email identity was erased and the address freed", back)
-	}
-}
-
-// consoleDeleteUser deletes an account from the console — the operator-initiated equivalent
-// of the in-app deletion (legal retention, not erasure): the account is tombstoned, its
-// credentials journalled + freed, its live surfaces anonymised, and its sessions revoked.
-func (s *Server) consoleDeleteUser(c *gin.Context) {
-	id, ok := s.consoleUUID(c, "/_gm/users")
-	if !ok {
-		return
-	}
-	back := "/_gm/users/" + id.String()
-	if err := s.deleteAccount(c.Request.Context(), id); err != nil {
-		s.consoleError(c, err)
-		return
-	}
-	s.renderConsoleMessage(c, "Deleted", "the account was deleted: its credentials were journalled and freed, its data anonymised, and its sessions revoked", back)
-}
-
 // consoleBlockUser manually blocks an account: it records the suspension (permanent or until a
 // parsed deadline, snapshotting the chosen reason's en/ru text) and forfeits the player's active
 // games, removing them from matchmaking. The block takes effect on the player's next request.

backend/internal/server/handlers_auth.go

@@ -9,7 +9,6 @@ import (
 	"go.uber.org/zap"
 
 	"scrabble/backend/internal/account"
-	"scrabble/backend/internal/notify"
 )
 
 // The /api/v1/internal/sessions/* endpoints are gateway-only: the gateway has
@@ -66,37 +65,6 @@ func (s *Server) handleTelegramAuth(c *gin.Context) {
 	s.mintSession(c, acc)
 }
 
-// vkAuthRequest carries the identity the gateway extracted from verified VK launch
-// params. LanguageCode (vk_language) and DisplayName (read client-side via
-// VKWebAppGetUserInfo, since VK omits the name from the signed params) seed a brand-new
-// account's language and display name; BrowserTZ (the client's detected "±HH:MM" UTC
-// offset) seeds its time zone. All seeds apply on first contact only.
-type vkAuthRequest struct {
-	ExternalID   string `json:"external_id"`
-	LanguageCode string `json:"language_code"`
-	DisplayName  string `json:"display_name"`
-	BrowserTZ    string `json:"browser_tz"`
-}
-
-// handleVKAuth provisions (or finds) the account bound to a VK identity and mints a
-// session for it, seeding a new account's language and display name from the supplied VK
-// fields (first contact only). Unlike Telegram there is no moderated-chat re-evaluation
-// or deep-link variant seed: a fresh VK account has no Telegram chat eligibility and the
-// MVP carries no launch deep link.
-func (s *Server) handleVKAuth(c *gin.Context) {
-	var req vkAuthRequest
-	if err := c.ShouldBindJSON(&req); err != nil || req.ExternalID == "" {
-		abortBadRequest(c, "external_id is required")
-		return
-	}
-	acc, _, err := s.accounts.ProvisionVK(c.Request.Context(), req.ExternalID, req.LanguageCode, req.DisplayName, req.BrowserTZ)
-	if err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	s.mintSession(c, acc)
-}
-
 // pushTargetRequest asks for a user's out-of-app push routing data by account id.
 type pushTargetRequest struct {
 	UserID string `json:"user_id"`
@@ -173,7 +141,6 @@ func (s *Server) handleGuestAuth(c *gin.Context) {
 type emailRequest struct {
 	Email     string `json:"email"`
 	BrowserTZ string `json:"browser_tz"`
-	Language  string `json:"language"`
 }
 
 // handleEmailRequest issues a login confirm-code to the email. It always reports
@@ -185,7 +152,7 @@ func (s *Server) handleEmailRequest(c *gin.Context) {
 		abortBadRequest(c, "email is required")
 		return
 	}
-	if _, err := s.emails.RequestLoginCode(c.Request.Context(), req.Email, req.BrowserTZ, req.Language); err != nil {
+	if _, err := s.emails.RequestLoginCode(c.Request.Context(), req.Email, req.BrowserTZ); err != nil {
 		s.abortErr(c, err)
 		return
 	}
@@ -213,56 +180,6 @@ func (s *Server) handleEmailLogin(c *gin.Context) {
 	s.mintSession(c, acc)
 }
 
-// confirmLinkResponse is the outcome of a one-tap deeplink confirmation. For a login,
-// Session carries the freshly minted credential (the deeplink page signs in with it);
-// for a link, Status is "confirmed" or "merge_required" (the app completes the merge).
-type confirmLinkResponse struct {
-	Purpose string           `json:"purpose"`
-	Status  string           `json:"status"`
-	Session *sessionResponse `json:"session,omitempty"`
-}
-
-// handleEmailConfirmLink verifies a one-tap deeplink token. A login mints a session
-// (the deeplink page signs in with it); a link attaches the confirmed email, reporting
-// "merge_required" when the address is owned by another account so the app drives the
-// interactive merge. The token, not a request session, is the authorization — the page
-// need not be signed in.
-func (s *Server) handleEmailConfirmLink(c *gin.Context) {
-	var req tokenRequest
-	if err := c.ShouldBindJSON(&req); err != nil || req.Token == "" {
-		abortBadRequest(c, "token is required")
-		return
-	}
-	res, err := s.emails.ConfirmByToken(c.Request.Context(), req.Token)
-	if err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	if res.IsLogin() {
-		acc, err := s.accounts.GetByID(c.Request.Context(), res.Account)
-		if err != nil {
-			s.abortErr(c, err)
-			return
-		}
-		token, _, err := s.sessions.Create(c.Request.Context(), acc.ID)
-		if err != nil {
-			s.abortErr(c, err)
-			return
-		}
-		sess := sessionResponseFor(token, acc)
-		c.JSON(http.StatusOK, confirmLinkResponse{Purpose: "login", Status: "confirmed", Session: &sess})
-		return
-	}
-	if res.NeedsMerge {
-		c.JSON(http.StatusOK, confirmLinkResponse{Purpose: "link", Status: "merge_required"})
-		return
-	}
-	// A free link attached the email; nudge the account's in-app session(s) to re-fetch
-	// the profile, so a link confirmed in another browser reflects at once.
-	s.notifier.Publish(notify.ProfileChanged(res.Account))
-	c.JSON(http.StatusOK, confirmLinkResponse{Purpose: "link", Status: "confirmed"})
-}
-
 // tokenRequest carries an opaque session token.
 type tokenRequest struct {
 	Token string `json:"token"`

backend/internal/server/handlers_delete.go

@@ -1,131 +0,0 @@
-package server
-
-import (
-	"context"
-	"net/http"
-	"strings"
-
-	"github.com/gin-gonic/gin"
-	"github.com/google/uuid"
-	"go.uber.org/zap"
-
-	"scrabble/backend/internal/accountdelete"
-	"scrabble/backend/internal/game"
-)
-
-// Account deletion is legal retention, not erasure (docs/ARCHITECTURE.md §9.1): the account
-// row survives as a tombstone while its credentials are journalled + freed, its live
-// surfaces anonymised, and its own social/ephemeral data dropped. Messages are kept. The
-// step-up is a mailed code for an account with a confirmed email, or a typed phrase for a
-// platform-only account (possession-proof is unattainable there, so the phrase is
-// anti-impulse only).
-
-// deletePhrase is the fixed confirmation phrase a no-email account types to delete.
-// Compared case-insensitively; the client localises only the surrounding instruction.
-const deletePhrase = "DELETE"
-
-// deleteRequestResponse tells the client which step-up the account uses.
-type deleteRequestResponse struct {
-	Method string `json:"method"` // "email" | "phrase"
-}
-
-// handleRequestDelete starts account deletion: it mails a delete code to an account with a
-// confirmed email, or reports the typed-phrase path otherwise.
-func (s *Server) handleRequestDelete(c *gin.Context) {
-	uid, ok := userID(c)
-	if !ok {
-		abortBadRequest(c, "missing identity")
-		return
-	}
-	ctx := c.Request.Context()
-	hasEmail, err := s.emails.HasEmail(ctx, uid)
-	if err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	if !hasEmail {
-		c.JSON(http.StatusOK, deleteRequestResponse{Method: "phrase"})
-		return
-	}
-	if err := s.emails.RequestDeleteCode(ctx, uid); err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	c.JSON(http.StatusOK, deleteRequestResponse{Method: "email"})
-}
-
-// deleteConfirmBody carries the step-up proof: a mailed code (email account) or the typed
-// phrase (platform-only account).
-type deleteConfirmBody struct {
-	Code   string `json:"code"`
-	Phrase string `json:"phrase"`
-}
-
-// handleConfirmDelete verifies the step-up and deletes the account.
-func (s *Server) handleConfirmDelete(c *gin.Context) {
-	uid, ok := userID(c)
-	if !ok {
-		abortBadRequest(c, "missing identity")
-		return
-	}
-	var req deleteConfirmBody
-	if err := c.ShouldBindJSON(&req); err != nil {
-		abortBadRequest(c, "invalid request body")
-		return
-	}
-	ctx := c.Request.Context()
-	hasEmail, err := s.emails.HasEmail(ctx, uid)
-	if err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	if hasEmail {
-		if err := s.emails.VerifyDeleteCode(ctx, uid, req.Code); err != nil {
-			s.abortErr(c, err)
-			return
-		}
-	} else if !strings.EqualFold(strings.TrimSpace(req.Phrase), deletePhrase) {
-		abortBadRequest(c, "confirmation phrase does not match")
-		return
-	}
-	if err := s.deleteAccount(ctx, uid); err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	c.JSON(http.StatusOK, okResponse{OK: true})
-}
-
-// deleteAccount runs the deletion orchestration after the step-up passed: it resigns the
-// account's active games (so opponents are not stranded and robot games end cleanly),
-// drops its all-robot games, tombstones + anonymises the account (journalling and freeing
-// its credentials), and revokes its sessions. The tombstone is the point of no return —
-// its failure aborts; the game cleanup and session revocation around it are best-effort.
-func (s *Server) deleteAccount(ctx context.Context, uid uuid.UUID) error {
-	deleter := accountdelete.NewDeleter(s.db)
-	if s.games != nil {
-		if games, err := s.games.ListForAccount(ctx, uid); err == nil {
-			for _, g := range games {
-				if g.Status != game.StatusActive {
-					continue
-				}
-				if _, err := s.games.Resign(ctx, g.ID, uid); err != nil {
-					s.log.Warn("delete: resign game failed", zap.String("game", g.ID.String()), zap.Error(err))
-				}
-			}
-		} else {
-			s.log.Warn("delete: list games failed", zap.Error(err))
-		}
-	}
-	if _, err := deleter.DropAllRobotGames(ctx, uid); err != nil {
-		s.log.Warn("delete: drop all-robot games failed", zap.Error(err))
-	}
-	if err := deleter.AnonymizeAndTombstone(ctx, uid); err != nil {
-		return err
-	}
-	if s.sessions != nil {
-		if err := s.sessions.RevokeAllForAccount(ctx, uid); err != nil {
-			s.log.Warn("delete: revoke sessions failed", zap.Error(err))
-		}
-	}
-	return nil
-}

backend/internal/server/handlers_dict.go

@@ -1,31 +0,0 @@
-package server
-
-import (
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-
-	"scrabble/backend/internal/engine"
-)
-
-// handleDictBytes streams the raw serialized dictionary for a (variant, version)
-// pair so the client can validate and score moves locally — the local move
-// preview — instead of a network round trip per tile arrangement. It is reached
-// only through the gateway's session-gated /dict route (which resolves the
-// X-User-ID this group requires), and served with a long immutable cache lifetime
-// because a published dictionary version never changes. An unknown variant or a
-// version that is not resident is a 404.
-func (s *Server) handleDictBytes(c *gin.Context) {
-	variant, err := engine.ParseVariant(c.Param("variant"))
-	if err != nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": "unknown variant"})
-		return
-	}
-	data, err := s.games.DictBytes(variant, c.Param("version"))
-	if err != nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": "dictionary not found"})
-		return
-	}
-	c.Header("Cache-Control", "public, max-age=31536000, immutable")
-	c.Data(http.StatusOK, "application/octet-stream", data)
-}

backend/internal/server/handlers_link.go

@@ -7,7 +7,6 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 
-	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/link"
 )
 
@@ -67,89 +66,6 @@ func (s *Server) handleLinkEmailRequest(c *gin.Context) {
 	c.JSON(http.StatusOK, okResponse{OK: true})
 }
 
-// unlinkBody carries the provider kind to detach.
-type unlinkBody struct {
-	Kind string `json:"kind"`
-}
-
-// handleUnlink detaches a platform identity (telegram or vk) from the caller's
-// account, refusing to remove the last identity (ErrLastIdentity). Email is never
-// unlinked — it is replaced through the change-email flow — so an email kind is
-// rejected. It returns the refreshed profile so the client updates its controls.
-func (s *Server) handleUnlink(c *gin.Context) {
-	uid, ok := userID(c)
-	if !ok {
-		abortBadRequest(c, "missing identity")
-		return
-	}
-	var req unlinkBody
-	if err := c.ShouldBindJSON(&req); err != nil {
-		abortBadRequest(c, "invalid request body")
-		return
-	}
-	if req.Kind != account.KindTelegram && req.Kind != account.KindVK {
-		abortBadRequest(c, "only telegram or vk can be unlinked")
-		return
-	}
-	ctx := c.Request.Context()
-	if err := s.accounts.RemoveIdentity(ctx, uid, req.Kind); err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	acc, err := s.accounts.GetByID(ctx, uid)
-	if err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	r := s.profileResponse(ctx, acc)
-	c.JSON(http.StatusOK, linkResultResponse{Status: "unlinked", Profile: &r})
-}
-
-// handleChangeEmailRequest mails a confirm-code to a new address for an authenticated
-// email change. Like the link request it never signals "taken" up front — a conflict is
-// only revealed (non-disclosingly) at confirm.
-func (s *Server) handleChangeEmailRequest(c *gin.Context) {
-	uid, ok := userID(c)
-	if !ok {
-		abortBadRequest(c, "missing identity")
-		return
-	}
-	var req linkEmailRequestBody
-	if err := c.ShouldBindJSON(&req); err != nil {
-		abortBadRequest(c, "invalid request body")
-		return
-	}
-	if err := s.emails.RequestChangeCode(c.Request.Context(), uid, req.Email); err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	c.JSON(http.StatusOK, okResponse{OK: true})
-}
-
-// handleChangeEmailConfirm verifies the code and atomically switches the account to the
-// new address, returning the refreshed profile. A new address confirmed by another
-// account is refused (ErrEmailTaken → the non-disclosing message), never merged.
-func (s *Server) handleChangeEmailConfirm(c *gin.Context) {
-	uid, ok := userID(c)
-	if !ok {
-		abortBadRequest(c, "missing identity")
-		return
-	}
-	var req linkEmailConfirmBody
-	if err := c.ShouldBindJSON(&req); err != nil {
-		abortBadRequest(c, "invalid request body")
-		return
-	}
-	ctx := c.Request.Context()
-	acc, err := s.emails.ConfirmChange(ctx, uid, req.Email, req.Code)
-	if err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	r := s.profileResponse(ctx, acc)
-	c.JSON(http.StatusOK, linkResultResponse{Status: "changed", Profile: &r})
-}
-
 // handleLinkEmailConfirm verifies the code and binds a free email or reports a
 // required merge.
 func (s *Server) handleLinkEmailConfirm(c *gin.Context) {

backend/internal/server/handlers_user.go

@@ -25,10 +25,6 @@ func (s *Server) handleProfile(c *gin.Context) {
 		s.abortErr(c, err)
 		return
 	}
-	// The SPA fetches the profile once per cold app-load, so stamp the account's last
-	// login time and client IP here (throttled to at most once an hour). Best-effort: it
-	// feeds the deletion dossier, never blocks the profile read.
-	_ = s.accounts.StampLastLogin(c.Request.Context(), uid, clientIP(c))
 	c.JSON(http.StatusOK, s.profileResponse(c.Request.Context(), acc))
 }
 

backend/internal/server/server.go

@@ -29,7 +29,6 @@ import (
 	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/notify"
 	"scrabble/backend/internal/ratewatch"
-	"scrabble/backend/internal/render"
 	"scrabble/backend/internal/session"
 	"scrabble/backend/internal/social"
 	"scrabble/backend/internal/telemetry"
@@ -97,12 +96,6 @@ type Deps struct {
 	// signal the banner/hint/role console actions emit. A nil Notifier discards
 	// them (notify.Nop).
 	Notifier notify.Publisher
-	// ExportSignKey signs the finished-game export download URLs (export.go). An
-	// empty key leaves the export-URL endpoints answering 503/404.
-	ExportSignKey string
-	// Renderer is the image-render sidecar client for the PNG export artifact. A
-	// nil Renderer makes the PNG download answer 404 (the GCG artifact still works).
-	Renderer *render.Client
 }
 
 // Server owns the gin engine, the underlying HTTP server and the readiness
@@ -131,8 +124,6 @@ type Server struct {
 	ads         *ads.Service
 	notifier    notify.Publisher
 	console     *adminconsole.Renderer
-	exportKey   []byte
-	renderer    *render.Client
 
 	public   *gin.RouterGroup
 	user     *gin.RouterGroup
@@ -182,12 +173,8 @@ func New(addr string, deps Deps) *Server {
 		banview:       deps.BanView,
 		ads:           deps.Ads,
 		notifier:      notifier,
-		renderer:      deps.Renderer,
 		http:          &http.Server{Addr: addr, Handler: engine},
 	}
-	if deps.ExportSignKey != "" {
-		s.exportKey = []byte(deps.ExportSignKey)
-	}
 	s.registerProbes(engine)
 	s.registerAPIGroups(engine)
 	s.registerRoutes()

backend/internal/social/chatread.go

@@ -55,25 +55,6 @@ func (svc *Service) ClearNudges(ctx context.Context, gameID, accountID uuid.UUID
 	return nil
 }
 
-// ExpireNudges marks every pending nudge in the game read, for when the game finishes: a nudge
-// badge is stale once the game is over, so completion clears them all for every seat. Chat
-// messages are left untouched (they stay unread). It satisfies game.NudgeExpirer and is wired
-// into the completion path; failures are the caller's to log (the game has already finished).
-// Unlike ClearNudges it records no publish-to-read latency — a completion is an expiry, not the
-// recipient reading the nudge — so the latency metric is not skewed by games that end hours later.
-func (svc *Service) ExpireNudges(ctx context.Context, gameID uuid.UUID) error {
-	ctx, span := svc.tracer.Start(ctx, "social.ExpireNudges",
-		trace.WithAttributes(attribute.String("game.id", gameID.String())))
-	defer span.End()
-	n, err := svc.store.expireNudges(ctx, gameID)
-	if err != nil {
-		span.RecordError(err)
-		return err
-	}
-	span.SetAttributes(attribute.Int64("expired.count", n))
-	return nil
-}
-
 // UnreadGames returns the set of games in which viewerID has at least one unread chat
 // entry, for seeding the lobby's per-card unread badge in a single query.
 func (svc *Service) UnreadGames(ctx context.Context, viewerID uuid.UUID) (map[uuid.UUID]bool, error) {
@@ -159,21 +140,6 @@ RETURNING m.created_at`
 	return out, rows.Err()
 }
 
-// expireNudges marks every still-unread nudge in the game read for all seats at once, used when
-// the game finishes. It returns the number of nudge entries it cleared. Only 'nudge' rows are
-// touched, so chat messages keep their unread bits; it returns no post times because a completion
-// is an expiry, not a player reading, and must not feed the publish-to-read latency metric.
-func (s *Store) expireNudges(ctx context.Context, gameID uuid.UUID) (int64, error) {
-	const q = `UPDATE backend.chat_messages
-SET unread_seats = 0
-WHERE game_id = $1 AND kind = 'nudge' AND unread_seats <> 0`
-	res, err := s.db.ExecContext(ctx, q, gameID)
-	if err != nil {
-		return 0, fmt.Errorf("social: expire nudges: %w", err)
-	}
-	return res.RowsAffected()
-}
-
 // unreadGames returns the games where viewerID has an unread entry, resolving their
 // seat per game through the game_players join.
 func (s *Store) unreadGames(ctx context.Context, viewerID uuid.UUID) (map[uuid.UUID]bool, error) {

deploy/.env.example

@@ -21,30 +21,6 @@ DICT_VERSION=v1.3.0
 # --- Logging ----------------------------------------------------------------
 LOG_LEVEL=info
 
-# --- Finished-game export ----------------------------------------------------
-# HMAC key signing the public export download URLs (/dl/*). Required; generate a
-# real contour value with `openssl rand -base64 32` (Gitea TEST_/PROD_EXPORT_SIGN_KEY).
-EXPORT_SIGN_KEY=dev-export-sign-key
-
-# --- Transactional email (Selectel relay) -----------------------------------
-# Confirm-code email via the shared Selectel relay (one relay for every contour;
-# limit 100 msgs / 5 min). Empty SMTP_RELAY_HOST makes the backend log codes instead
-# of sending (dev). Port 465 = implicit TLS, else STARTTLS; no client cert is needed.
-# TLS is implicit on port 465 and STARTTLS otherwise, unless SMTP_RELAY_TLS forces it
-# (ssl|starttls) — required for Selectel's non-standard ports (1127 = SSL, 1126 =
-# STARTTLS). FROM must use the prod domain (Selectel only accepts the verified sender
-# domain), so it is the same on every contour; a display name is fine
-# (`"Игра Эрудит" <no-reply@erudit-game.ru>`). PUBLIC_BASE_URL is the canonical https
-# origin for links in the email — the contour's own public URL. Gitea
-# TEST_/PROD_SMTP_RELAY_* + TEST_/PROD_PUBLIC_BASE_URL.
-SMTP_RELAY_HOST=
-SMTP_RELAY_PORT=465
-SMTP_RELAY_TLS=                        # empty = auto by port; ssl | starttls to force
-SMTP_RELAY_USER=                       # secret
-SMTP_RELAY_PASS=                       # secret
-SMTP_RELAY_FROM=no-reply@erudit-game.ru
-PUBLIC_BASE_URL=                       # required when SMTP_RELAY_HOST is set (e.g. https://erudit-game.ru)
-
 # --- Edge / caddy -----------------------------------------------------------
 # Test: ":80" (the host caddy terminates TLS and forwards to scrabble:80 on the
 # external `edge` network). Prod: a domain so caddy does its own ACME.
@@ -56,7 +32,6 @@ GM_BASICAUTH_HASH=                     # required; `caddy hash-password` bcrypt
 VITE_TELEGRAM_BOT_ID=
 VITE_TELEGRAM_LINK=                                 # friend-invite Mini App link (full URL, e.g. https://t.me/<bot>/<app>)
 VITE_TELEGRAM_GAME_CHANNEL_NAME=                    # landing "Play in Telegram" link, the bot's game channel
-VITE_VK_APP_LINK=                                   # landing "Play on VK" link (full URL, https://vk.com/app<id>)
 VITE_GATEWAY_URL=
 
 # --- Grafana ----------------------------------------------------------------
@@ -80,9 +55,3 @@ TELEGRAM_PROMO_START_PARAM=           # promo button startapp payload — a vari
 TELEGRAM_MINIAPP_URL=                  # required
 TELEGRAM_TEST_ENV=false
 TELEGRAM_API_BASE_URL=
-
-# --- VK Mini App ------------------------------------------------------------
-# The VK app's "protected key" (client_secret): the gateway verifies the Mini App
-# launch-parameter signature in-process under it (a pure offline HMAC, no VK API call).
-# Empty disables the VK auth path (auth.vk). Set from the Gitea TEST_/PROD_ secret.
-GATEWAY_VK_APP_SECRET=

deploy/README.md

@@ -16,7 +16,6 @@ operational reference for **every environment variable**.
 | `landing` | built (`gateway/Dockerfile`, target `landing`) | Static landing page at `/` (caddy:2-alpine + the shared Vite build, `deploy/landing/Caddyfile`); absorbs stray public paths. |
 | `backend` | built (`backend/Dockerfile`) | Domain service; bakes in the DAWG dictionaries; runs migrations at boot. |
 | `postgres` | `postgres:17-alpine` | Database (named volume, `pg_isready` healthcheck). |
-| `renderer` | built (`renderer/Dockerfile`) | Finished-game image-render sidecar (Node + skia-canvas running the shared `ui/src/lib/gameimage.ts`); internal-only HTTP at `renderer:8090`, called by the backend for the PNG export artifact. |
 | `validator` | built (`platform/telegram/Dockerfile`, target `validator`) | Telegram HMAC validator (no VPN, no Bot API); internal gRPC at `validator:9091`. Game login depends only on this. |
 | `vpn` + `bot` | sidecar + built (`platform/telegram/Dockerfile`, target `bot`) | Telegram bot, gated to the **`telegram-local`** profile; egresses through the AmneziaWG sidecar and dials the gateway bot-link (mTLS) at `gateway:9443`. The test contour activates the profile; the prod **main** host omits it and runs the bot standalone on its **own host** (`docker-compose.bot.yml`, no VPN — native Bot API egress). |
 | `otelcol` | `otel/opentelemetry-collector-contrib` | OTLP/gRPC `:4317` → Prometheus scrape (`:9464`) + Tempo. |
@@ -63,7 +62,6 @@ compose binds from this directory.
 | `POSTGRES_PASSWORD` | secret | Postgres password (also embedded in `BACKEND_POSTGRES_DSN`). |
 | `GM_BASICAUTH_HASH` | secret | bcrypt hash gating `/_gm` (admin console + Grafana). Generate with `docker run --rm caddy:2-alpine caddy hash-password --plaintext '<pw>'`. |
 | `TELEGRAM_MINIAPP_URL` | variable | The Mini App URL the bot hands out in deep links / buttons. |
-| `EXPORT_SIGN_KEY` | secret | HMAC key signing the public finished-game export download URLs (`/dl/*`). Generate with `openssl rand -base64 32`. |
 
 **Plus the bot token** — `TELEGRAM_BOT_TOKEN` (secret), shared by the validator (HMAC
 secret) and the bot (Bot API). It defaults to empty in compose, but both **fail at
@@ -94,17 +92,9 @@ without it Docker's resolver handles `otelcol`, `gateway` and `api.telegram.org`
 | `VITE_TELEGRAM_BOT_ID` | variable | _(empty)_ | UI build-arg: numeric bot id for the web Login Widget. |
 | `VITE_TELEGRAM_LINK` | variable | _(empty)_ | UI build-arg: friend-invite Mini App link (full URL, `https://t.me/<bot>/<app>` — `<app>` is the Mini App short name from BotFather). |
 | `VITE_TELEGRAM_GAME_CHANNEL_NAME` | variable | _(empty)_ | UI build-arg: the landing "Play in Telegram" link, the bot's game channel (e.g. `https://t.me/Erudit_Game`). |
-| `VITE_VK_APP_LINK` | variable | _(empty)_ | UI build-arg: the landing "Play on VK" link, the VK Mini App (full URL, `https://vk.com/app<id>`). |
 | `VITE_GATEWAY_URL` | variable | _(empty)_ | UI build-arg: gateway origin; empty = same-origin (the usual single-origin deploy). |
-| `SMTP_RELAY_HOST` | variable | _(empty)_ | Selectel SMTP relay host for confirm-code email. Empty leaves the backend on the log mailer (email disabled) — the contour still boots. One relay for every contour (limit 100 msgs / 5 min). |
-| `SMTP_RELAY_PORT` | variable | `465` | Relay port. No client certificate is needed (the server cert is validated against the system roots). |
-| `SMTP_RELAY_TLS` | variable | _(empty)_ | Transport security: `ssl` (implicit TLS) or `starttls`. Empty derives it from the port (implicit on `465`, STARTTLS otherwise); required for a relay on a non-standard port (e.g. Selectel's `1127` = SSL, `1126` = STARTTLS). |
-| `SMTP_RELAY_USER` | secret | _(empty)_ | Relay SMTP AUTH username. |
-| `SMTP_RELAY_PASS` | secret | _(empty)_ | Relay SMTP AUTH password. |
-| `SMTP_RELAY_FROM` | variable | `no-reply@localhost` | Sender address. **Must use the prod domain** (`no-reply@erudit-game.ru`) — Selectel only accepts the verified sender domain — so it is the same on every contour. |
-| `PUBLIC_BASE_URL` | variable | _(empty)_ | Canonical public https origin for links in the email (the contour's own URL, e.g. `https://erudit-game.ru`). **Required by the backend whenever `SMTP_RELAY_HOST` is set** — it is never derived from a request Host header (anti-injection). |
 
-The six `VITE_*` are **build-args** baked into the gateway and landing images at
+The five `VITE_*` are **build-args** baked into the gateway and landing images at
 build time (both targets share one UI build stage — keep the args identical so it is
 built once), so changing them requires a rebuild (`--build`), not just a restart.
 
@@ -115,8 +105,7 @@ at each other on the `internal` network — listed here so they are not mistaken
 missing config: `BACKEND_POSTGRES_DSN` (→ `postgres`, `search_path=backend`),
 `GATEWAY_BACKEND_HTTP_URL`/`_GRPC_ADDR` (→ `backend`),
 `GATEWAY_VALIDATOR_ADDR` (→ `validator:9091`), `BACKEND_CONNECTOR_ADDR` (→ the gateway
-bot-link relay `gateway:9092`), `BACKEND_RENDERER_URL` (→ `renderer:8090`, the image-render
+bot-link relay `gateway:9092`), the bot's `TELEGRAM_GATEWAY_ADDR` (→ `gateway:9443`,
-sidecar), the bot's `TELEGRAM_GATEWAY_ADDR` (→ `gateway:9443`,
 mTLS) with the `GATEWAY_BOTLINK_*` / `TELEGRAM_BOTLINK_*` cert paths under `/certs` (the
 mTLS material is generated by `deploy/gen-certs.sh`, gitignored, regenerated each
 deploy), and all services' `*_OTEL_*_EXPORTER=otlp` →
@@ -204,14 +193,12 @@ players arrive.
 
 **`PROD_` Gitea set** (mirrors `TEST_`, mapped onto the unprefixed names above) — secrets:
 `PROD_{POSTGRES_PASSWORD, GM_BASICAUTH_HASH, GRAFANA_ADMIN_PASSWORD, TELEGRAM_BOT_TOKEN,
-TELEGRAM_PROMO_BOT_TOKEN, EXPORT_SIGN_KEY, REGISTRY_PASSWORD, SSH_KEY, SSH_KNOWN_HOSTS, BOTLINK_CA,
+TELEGRAM_PROMO_BOT_TOKEN, REGISTRY_PASSWORD, SSH_KEY, SSH_KNOWN_HOSTS, BOTLINK_CA,
-BOTLINK_GATEWAY_CERT, BOTLINK_GATEWAY_KEY, BOTLINK_BOT_CERT, BOTLINK_BOT_KEY,
+BOTLINK_GATEWAY_CERT, BOTLINK_GATEWAY_KEY, BOTLINK_BOT_CERT, BOTLINK_BOT_KEY}`; variables:
-SMTP_RELAY_USER, SMTP_RELAY_PASS}`; variables:
 `PROD_{REGISTRY_USER, MAIN_HOST, TG_HOST, CADDY_SITE_ADDRESS, GM_BASICAUTH_USER,
 GRAFANA_ROOT_URL, LOG_LEVEL, DICT_VERSION, TELEGRAM_MINIAPP_URL, TELEGRAM_GAME_CHANNEL_ID,
 TELEGRAM_CHAT_ID, TELEGRAM_BOT_USERNAME, VITE_TELEGRAM_BOT_ID, VITE_TELEGRAM_LINK,
-VITE_TELEGRAM_GAME_CHANNEL_NAME, VITE_VK_APP_LINK,
+VITE_TELEGRAM_GAME_CHANNEL_NAME}`.
-SMTP_RELAY_HOST, SMTP_RELAY_PORT, SMTP_RELAY_TLS, SMTP_RELAY_FROM, PUBLIC_BASE_URL}`.
 
 ## Host-side setup (outside this repo)
 

deploy/caddy/Caddyfile

@@ -1,6 +1,6 @@
 # Edge reverse proxy for the Scrabble contour. A single Basic-Auth gate covers
 # every operator surface under /_gm (the backend-rendered admin console and the
-# Grafana subpath); the game SPA (/app/, /telegram/, /vk/) and the Connect edge go to
+# Grafana subpath); the game SPA (/app/, /telegram/) and the Connect edge go to
 # the gateway; the catch-all — notably the public landing at / — goes to the
 # static landing container, so stray traffic never reaches the Go edge.
 # Mirrors ../galaxy-game's /_gm model.
@@ -53,7 +53,7 @@
 	# The game SPA and the Connect edge are served by the gateway. Strip any
 	# client-supplied X-Scrabble-Honeypot here so the gateway only ever honours the
 	# tag the honeypot block sets below (a client cannot self-tag a real request).
-	@gateway path /app /app/* /telegram /telegram/* /vk /vk/* /dict/* /dl/* /metrics/* /scrabble.edge.v1.Gateway/*
+	@gateway path /app /app/* /telegram /telegram/* /scrabble.edge.v1.Gateway/*
 	handle @gateway {
 		reverse_proxy gateway:8081 {
 			header_up -X-Scrabble-Honeypot

deploy/docker-compose.prod.yml

@@ -50,13 +50,6 @@ services:
         limits:
           memory: 384M
 
-  renderer:
-    image: ${REGISTRY:?set REGISTRY}/scrabble-renderer:${TAG:?set TAG}
-    deploy:
-      resources:
-        limits:
-          memory: 160M
-
   validator:
     image: ${REGISTRY:?set REGISTRY}/scrabble-telegram-validator:${TAG:?set TAG}
     deploy:

deploy/docker-compose.yml

@@ -61,36 +61,6 @@ services:
           memory: 512M
     networks: [internal]
 
-  # The finished-game image-render sidecar: internal-only, called by the backend for the
-  # PNG export artifact. It runs the same ui/src/lib/gameimage.ts the web client
-  # unit-tests, on skia-canvas (renderer/README.md). node:22-slim carries a shell, so —
-  # uniquely among the built services — it has a real container healthcheck the backend's
-  # depends_on gates on.
-  renderer:
-    container_name: scrabble-renderer
-    image: scrabble-renderer:latest
-    build:
-      context: ..
-      dockerfile: renderer/Dockerfile
-      args:
-        VERSION: ${APP_VERSION:-dev}
-    restart: unless-stopped
-    logging: *default-logging
-    environment:
-      RENDERER_PORT: "8090"
-    healthcheck:
-      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8090/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
-      interval: 10s
-      timeout: 3s
-      retries: 12
-    # A render peaks well under 100 MiB (a 2-MP canvas + skia); idle sits near 60 MiB.
-    deploy:
-      resources:
-        limits:
-          cpus: "1.0"
-          memory: 192M
-    networks: [internal]
-
   backend:
     container_name: scrabble-backend
     image: scrabble-backend:latest
@@ -110,15 +80,9 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
-      renderer:
-        condition: service_healthy
     environment:
       # search_path=backend matches the migrations (00001 creates the schema).
       BACKEND_POSTGRES_DSN: postgres://${POSTGRES_USER:-scrabble}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-scrabble}?sslmode=disable&search_path=backend
-      # The finished-game export: the render sidecar address + the HMAC key signing the
-      # public download URLs (deploy env: TEST_/PROD_EXPORT_SIGN_KEY).
-      BACKEND_RENDERER_URL: http://renderer:8090
-      BACKEND_EXPORT_SIGN_KEY: ${EXPORT_SIGN_KEY:?set EXPORT_SIGN_KEY — the export download URL signing secret}
       # The pool caps at 25 conns (~28 backends) around 500 players; 40 gives headroom
       # for bursts. Postgres (2 cores / 512 MiB) handles it.
       BACKEND_POSTGRES_MAX_OPEN_CONNS: "40"
@@ -136,21 +100,6 @@ services:
       # GOMAXPROCS matches the CPU limit below so the Go scheduler aligns with the
       # cgroup quota (the runtime otherwise sees all of the host's cores).
       GOMAXPROCS: "2"
-      # Transactional email (confirm-codes) via the shared Selectel relay. An empty
-      # host makes the backend log codes instead of sending them (dev default). TLS is
-      # implicit on port 465 and STARTTLS otherwise, unless SMTP_RELAY_TLS forces it
-      # (ssl|starttls) — needed for Selectel's non-standard ports (1127 = SSL, 1126 =
-      # STARTTLS). The From uses the prod domain (Selectel only accepts the verified
-      # sender domain), so it is the same on every contour. PUBLIC_BASE_URL is the
-      # canonical origin for links in the email (never a request Host header) —
-      # required whenever the relay host is set.
-      BACKEND_SMTP_HOST: ${SMTP_RELAY_HOST:-}
-      BACKEND_SMTP_PORT: ${SMTP_RELAY_PORT:-465}
-      BACKEND_SMTP_TLS: ${SMTP_RELAY_TLS:-}
-      BACKEND_SMTP_USERNAME: ${SMTP_RELAY_USER:-}
-      BACKEND_SMTP_PASSWORD: ${SMTP_RELAY_PASS:-}
-      BACKEND_SMTP_FROM: ${SMTP_RELAY_FROM:-no-reply@localhost}
-      BACKEND_PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-}
     # The dictionary lives on a named volume seeded from the image on first boot
     # (the image's /opt/dawg is owned by the nonroot UID, which the fresh volume
     # inherits). The admin console writes new version subdirectories here, and the
@@ -185,7 +134,6 @@ services:
         VITE_TELEGRAM_BOT_ID: ${VITE_TELEGRAM_BOT_ID:-}
         VITE_TELEGRAM_LINK: ${VITE_TELEGRAM_LINK:-}
         VITE_TELEGRAM_GAME_CHANNEL_NAME: ${VITE_TELEGRAM_GAME_CHANNEL_NAME:-}
-        VITE_VK_APP_LINK: ${VITE_VK_APP_LINK:-}
         VITE_GATEWAY_URL: ${VITE_GATEWAY_URL:-}
         VITE_APP_VERSION: ${APP_VERSION:-dev}
         # Go binary version (the SPA's VITE_APP_VERSION is the same git tag).
@@ -199,10 +147,6 @@ services:
       GATEWAY_BACKEND_GRPC_ADDR: backend:9090
       # Telegram auth validates against the home validator (plaintext, internal).
       GATEWAY_VALIDATOR_ADDR: validator:9091
-      # VK Mini App auth verifies the launch-parameter signature in-process under the VK
-      # app's protected key (a pure offline HMAC, no VK API round-trip). Empty disables
-      # the VK auth path (auth.vk is then unregistered).
-      GATEWAY_VK_APP_SECRET: ${GATEWAY_VK_APP_SECRET:-}
       # The reverse bot-link: the bot dials :9443 over mTLS; the backend admin relay
       # reaches the gateway at :9092 (plaintext, internal). In the test contour both
       # listeners stay on the internal network (the bot shares the VPN netns); in prod
@@ -259,7 +203,6 @@ services:
         VITE_TELEGRAM_BOT_ID: ${VITE_TELEGRAM_BOT_ID:-}
         VITE_TELEGRAM_LINK: ${VITE_TELEGRAM_LINK:-}
         VITE_TELEGRAM_GAME_CHANNEL_NAME: ${VITE_TELEGRAM_GAME_CHANNEL_NAME:-}
-        VITE_VK_APP_LINK: ${VITE_VK_APP_LINK:-}
         VITE_GATEWAY_URL: ${VITE_GATEWAY_URL:-}
         VITE_APP_VERSION: ${APP_VERSION:-dev}
     restart: unless-stopped

deploy/grafana/dashboards/users.json

@@ -4,7 +4,7 @@
   "tags": ["scrabble"],
   "timezone": "",
   "schemaVersion": 39,
-  "version": 2,
+  "version": 1,
   "refresh": "30s",
   "time": { "from": "now-7d", "to": "now" },
   "panels": [
@@ -29,33 +29,6 @@
       "gridPos": { "h": 8, "w": 24, "x": 0, "y": 8 },
       "datasource": { "type": "prometheus", "uid": "prometheus" },
       "targets": [{ "refId": "A", "expr": "sum(accounts_created_total) by (kind)", "legendFormat": "{{kind}}" }]
-    },
-    {
-      "type": "timeseries",
-      "title": "App opens vs dictionary fills (cumulative)",
-      "description": "Local move-preview adoption. App opens are client cold starts; dictionary fills are IndexedDB downloads of a dawg. The gap between them is how many launches reuse an already-cached dictionary. Client-reported, best-effort (a batched beacon), so slightly lossy.",
-      "gridPos": { "h": 8, "w": 12, "x": 0, "y": 16 },
-      "datasource": { "type": "prometheus", "uid": "prometheus" },
-      "targets": [
-        { "refId": "A", "expr": "sum(local_eval_cold_start_total)", "legendFormat": "app opens (cold start)" },
-        { "refId": "B", "expr": "sum(local_eval_dict_load_total{result=\"fetched\"})", "legendFormat": "dictionary fills (IndexedDB)" }
-      ]
-    },
-    {
-      "type": "timeseries",
-      "title": "Dictionary loads by result (rate)",
-      "description": "Client dictionary loads for the local preview, by tier: fetched (network download), cache_hit (IndexedDB), miss (a warm-up that failed or timed out — trips the bad-connection breaker).",
-      "gridPos": { "h": 8, "w": 12, "x": 12, "y": 16 },
-      "datasource": { "type": "prometheus", "uid": "prometheus" },
-      "targets": [{ "refId": "A", "expr": "sum(rate(local_eval_dict_load_total[1h])) by (result)", "legendFormat": "{{result}}" }]
-    },
-    {
-      "type": "timeseries",
-      "title": "Move previews by path (rate)",
-      "description": "Where the move preview is computed: local (on-device, the accelerator) vs network (the fallback to game.evaluate). The local share is the backend load shed.",
-      "gridPos": { "h": 8, "w": 24, "x": 0, "y": 24 },
-      "datasource": { "type": "prometheus", "uid": "prometheus" },
-      "targets": [{ "refId": "A", "expr": "sum(rate(local_eval_preview_total[1h])) by (path)", "legendFormat": "{{path}}" }]
     }
   ]
 }

deploy/prod-deploy.sh

@@ -134,7 +134,6 @@ fi
 
 # Roll one service at a time, least -> most dependent; any failure rolls everything back.
 roll postgres  health_postgres                              || { rollback; exit 1; }
-roll renderer  health_running scrabble-renderer             || { rollback; exit 1; }
 roll backend   health_backend                               || { rollback; exit 1; }
 roll gateway   health_running scrabble-gateway              || { rollback; exit 1; }
 roll landing   health_landing                               || { rollback; exit 1; }

docs/ARCHITECTURE.md

@@ -149,18 +149,11 @@ arrive from a platform rather than completing a mandatory registration).
 
 - The gateway validates the originating credential **once** — Telegram `initData`
   (delegated to the **validator's** `ValidateInitData` RPC, which holds the bot token —
-  the HMAC secret — so it never reaches the gateway), a **VK Mini App** launch (verified
+  the HMAC secret — so it never reaches the gateway), an email-code login, or a guest
-  **in-process** by `gateway/internal/vkauth`: HMAC-SHA256 over the signed `vk_*` params
-  under the VK app's protected key `GATEWAY_VK_APP_SECRET`, base64url — a pure offline check,
-  as VK signing needs no API round-trip, so no side-service), an email-code login, or a guest
   bootstrap — then mints a **thin opaque server session token** (`session_id`). First
-  Telegram/VK contact seeds the new account's language (Telegram's `language_code` / VK's
+  Telegram contact seeds the new account's language (from the launch `language_code`)
-  `vk_language`) and display name (§4; VK omits the name from the signed params, so the client
+  and display name (§4). The validator runs on the main host and never reaches the Bot
-  reads it via `VKWebAppGetUserInfo` as an unsigned, cosmetic seed). The validator runs on the
+  API, so login does not depend on Telegram or the remote bot being up (§10, §12).
-  main host and never reaches the Bot API, so login does not depend on Telegram or the remote
-  bot being up (§10, §12). VK launch params carry no built-in expiry (unlike Telegram's
-  `auth_date`), so freshness is not enforced — the minted session is the short-lived credential,
-  and a replay only re-authenticates the same `vk_user_id`.
 - **Single bot.** The platform side-service runs **one bot** (one token + one optional
   game channel), split into a home **validator** and a remote **bot** that share the
   token. `ValidateInitData` (the validator) validates `initData` against that single
@@ -232,25 +225,9 @@ arrive from a platform rather than completing a mandatory registration).
   `confirmed` flag. A synthetic `kind='robot'` identity backs each pooled
   robot opponent (§7). The **email confirm-code flow** binds an email to the
   authenticated account: a 6-digit code (stored only as a SHA-256 hash, 15-minute
-  TTL, ≤ 5 attempts) is sent as a **branded HTML + plain-text email** through a
+  TTL, ≤ 5 attempts) is sent through a `Mailer` seam (an SMTP relay, or a
-  `Mailer` seam (go-mail over the shared relay — TLS chosen by port, implicit on
+  development log mailer when none is configured) and, once verified, attaches a
-  465 and STARTTLS otherwise, or forced by config for a non-standard port; the
+  confirmed email identity. Accounts and identities use application-generated
-  server certificate validated against the system roots, no client certificate; a
-  development log mailer when no relay is configured) and, once
-  verified, attaches a confirmed email identity. Sends are throttled per recipient
-  (a 60-second cooldown and a five-per-hour cap). Links in the email are built from
-  a configured public base URL, never a request Host header (anti-injection). The email
-  also carries a **one-tap confirm deeplink** (`/app/#/confirm/<token>`, an opaque
-  256-bit token stored only as its SHA-256, 12-hour TTL): a login mints a session in the
-  browser that opens it (magic-link), a link confirms the identity and emits a `notify`
-  profile-refresh to the in-app session, a change switches the account's email in place,
-  and a would-be merge is deferred to the interactive flow. The confirm runs on load; the token rides the URL fragment (never
-  sent to the server), so a plain link prefetch cannot reach it, and the manual
-  six-digit code is the fallback if an aggressive scanner runs the page. An
-  **email-login** account is created flagged `is_guest` and stays reapable until the
-  code is confirmed — so an abandoned, never-confirmed login frees its reserved
-  address — with confirming clearing the flag. Accounts and identities use
-  application-generated
   **UUIDv7** primary keys. A service flag `paid_account` (lifetime one-time
   payment; no purchase flow yet) is carried on the account and ORed on a merge.
 - **Linking** is initiated from an authenticated profile and proves
@@ -263,35 +240,6 @@ arrive from a platform rather than completing a mandatory registration).
   is revealed **only after** the proof is verified and is performed behind an
   explicit, irreversible confirmation. A free identity is simply attached (and a
   guest is promoted to durable, clearing `is_guest`).
-- **Unlink** detaches a platform identity (`telegram`/`vk`) from the profile. The
-  backend **refuses removing the last identity** (`ErrLastIdentity`), so an account
-  never becomes unreachable; the UI mirrors the guard by hiding Unlink when only one
-  method remains. **Email is never unlinked — it is changed.**
-- **Change email** mails a confirm-code (`purpose=change`) to the new address on the
-  authenticated account and, on confirm (code or one-tap deeplink), **atomically
-  replaces** the account's email identity with the new one, freeing the old address. A
-  new address already confirmed by **another** account is refused **without disclosure**
-  (a neutral "check the address or contact support") and **never merged** — the anti-
-  enumeration check is only reachable by someone who controls the new mailbox.
-- **Deletion is legal retention, not erasure** (`internal/accountdelete`). The account row
-  survives as a **tombstone** (`accounts.deleted_at`) — its chat/complaint foreign keys
-  have no cascade, so a hard delete is impossible. `AnonymizeAndTombstone` **journals**
-  every live identity into an append-only **`retained_identities`** log (the legal dossier)
-  then removes it, freeing the `(kind, external_id)` for a new account to reuse; it scrubs
-  the live `display_name` → **`[Deleted]`** (an unspoofable sentinel — the editable-name
-  rule forbids brackets) while snapshotting the real name into `deleted_display_name`,
-  anonymises the game-seat snapshots, and drops the account's own friendships / blocks /
-  invitations / friend-codes / drafts / pending-codes. **Chat, feedback and complaints are
-  kept.** The orchestration a layer up resigns the account's active games (so opponents are
-  not stranded), **drops its all-robot games** (no human opponent; children cascade), and
-  revokes its sessions. Every credential detachment — **unlink, email change and delete** —
-  writes a `retained_identities` row (`reason`), so the dossier keeps the full timeline.
-  Step-up is a mailed code (`purpose=delete`, no deeplink — a stray click must not delete;
-  `ConfirmByToken` refuses a delete token) for an email account, else a typed phrase.
-  `last_login_at` / `last_login_ip` are stamped on the cold-load profile fetch (throttled
-  to once an hour). A **two-year TTL reaper** (from the event) purges the whole dossier —
-  the journal, plus a deleted account's feedback thread and dossier PII — while the chat and
-  the tombstone row stay.
 - **Merge** retires the account that owns the linked identity into the **current**
   account, in a single transaction (`internal/accountmerge`): statistics summed
   (counters incl. moves/hints added, max points kept, and the per-variant best moves
@@ -397,17 +345,6 @@ Key points:
 - History is dictionary-independent (§9.1): the engine emits decoded
   `MoveRecord`s and reconstructs the board from them with `engine.ReplayBoard`
   (alphabet only, no dictionary).
-- The **client mirrors this validation path for an instant move preview** (the
-  local eval, `ui/src/lib/dict`): the dawg reader and the
-  validate/score/direction slice are ported to TypeScript, byte-for-byte against
-  this engine and pinned by the `conformance` CI job. Composing a move is scored
-  on-device with no round trip. It is an **advisory accelerator only** —
-  `submit_play` re-validates on the server, so a wrong or spoofed local result
-  cannot corrupt a game. The pinned per-game dictionary blob is fetched once
-  through a **session-gated `GET /dict/{variant}/{version}`** edge route
-  (immutable; cached in IndexedDB best-effort) and reused across sessions; any
-  miss, storage eviction or a bad-connection breaker falls back to the network
-  `evaluate`. The warm-up overlay is `docs/UI_DESIGN.md`.
 
 ## 6. Game rules
 
@@ -702,11 +639,7 @@ in either direction (the enqueue excludes the caller's `BlockedWith` set);
   robot instead clears when the robot answers by moving, as for a human. A seat's bit clears when that player **opens the move history or the chat**
   (`POST /games/:id/chat/read`, which the client sends only when it holds unread, so a
   history open is not a constant backend call), and a **nudge additionally clears when its
-  recipient answers by moving** (the move path calls a wired `NudgeClearer`); and **every nudge in
+  recipient answers by moving** (the move path calls a wired `NudgeClearer`). The mask is
-  a game is marked read when that game finishes** — on any completion path (a closing move, a
-  resignation, a forfeit or a turn-timeout, all funnelling through the shared `commit`), since the
-  nudge badge is stale once the game is over (a wired `NudgeExpirer`; chat messages stay unread and
-  this expiry records no read latency). The mask is
   inverted so "anything unread" is a plain `unread_seats <> 0`, which the per-viewer
   `unread_chat` game-view flag (seeding the lobby and in-game unread **dot**), the admin
   unread filter and the unread gauge all use. A second per-viewer flag, **`unread_messages`**
@@ -716,9 +649,8 @@ in either direction (the enqueue excludes the caller's `BlockedWith` set);
   REST-seed-then-event-bump lifecycle (the live-event game-view leaves them false; a nudge
   event raises only `unread_chat`, a message event raises both). The lobby additionally
   **floats games with any unread entry to the top** of the your-turn and opponent-turn
-  sections (the finished section keeps its activity order). On each player-driven clear the
+  sections (the finished section keeps its activity order). On each clear the publish-to-read
-  publish-to-read latency is recorded — the completion expiry records none (it is not a read);
+  latency is recorded; the read time itself is not retained.
-  the read time itself is not retained.
 - **Profile**: `preferred_language` (en/ru; tracks the interface language — §4), display name, email
   (confirm-code binding, see §4), **timezone**, the daily **away window**, the
   **variant preferences** (`variant_preferences`, the matchable-variant set that gates New
@@ -830,40 +762,9 @@ the same rows and is likewise self-contained — we ship our own writer (the sol
 exposes none): the standard Poslfit dialect (UTF-8, `#player`/`#lexicon`
 pragmas, `8G`/`H8` coordinates, lower-case blanks, `.` pass-throughs, `-TILES`
 exchanges), plus `#note` lines for resignations and timeouts, which the standard
-does not cover. **Export is offered only on a finished game** (`game.ErrGameActive`
+does not cover. **GCG export is offered only on a finished game** (`game.ErrGameActive`
-otherwise), so an in-progress journal is never leaked mid-play.
+otherwise), so an in-progress journal is never leaked mid-play; the client
-
+shares the `.gcg` file via the Web Share API where available, else downloads it.
-**Export delivery — the signed download URL.** Both export artifacts — the `.gcg` text
-and the rendered **PNG of the final position** — travel one uniform route on every
-platform: the client calls the authenticated `game.export_url` op, the backend mints a
-**relative, HMAC-signed, short-lived path**
-(`/dl/{game}/{kind}?e=<expiry>&…&s=<HMAC-SHA256>`, 10-minute TTL,
-`BACKEND_EXPORT_SIGN_KEY`), and the client resolves it against its **own origin** (no
-service ever needs to know the public host) and hands it to the best affordance
-each platform has: Telegram Android/desktop `downloadFile` (Bot API 8.0; the
-chooser there is the native showPopup — activation-free bridge calls end to end),
-Telegram iOS the OS share sheet with the fetched file (the app-modal click supplies
-the user activation a popup callback lacks), VK iOS `VKWebAppDownloadFile` for both
-formats, VK Android the native image viewer (PNG) + the clipboard (GCG) — its
-DownloadFile hangs regardless of Content-Length/Range — the OS share sheet on a
-mobile browser, or a plain anchor download (desktop browsers and the VK desktop
-iframe). The gateway serves the bytes via
-`http.ServeContent` (Content-Length + Range/206 — Android's system DownloadManager
-hangs on chunked bodies of unknown length). The GET is the gateway's
-**only unauthenticated data route** (`/dl/*` — in the caddy `@gateway` matcher and the
-per-IP public rate limiter): the native download calls carry no cookies or headers, so
-the URL's signature — verified by the backend on its `/api/v1/public` group in constant
-time, every failure a uniform 404 — is the whole grant, and minting requires an
-authenticated caller on a finished game. The PNG is rasterized on demand by the
-**`renderer` sidecar** (internal-only Node + skia-canvas running the same
-`ui/src/lib/gameimage.ts` the web project unit-tests — one renderer, no drift;
-`renderer/README.md`); the backend rebuilds the render payload from the journal +
-`engine.AlphabetTable`, and the client's date locale, IANA time zone and UI-localized
-non-play labels ride the signed URL so the server render matches the player's
-presentation. Nothing is stored: the artifact is re-derived from the immutable
-finished journal on each GET. The only degraded platform is a legacy Telegram client
-predating `downloadFile`, where the GCG falls back to the old clipboard copy and the
-image option is not offered.
 
 The alphabet-on-the-wire transport does **not** touch this invariant: the live edge
 exchanges alphabet indices, but the persisted journal (and everything derived from it —
@@ -969,10 +870,7 @@ edge-pause, scroll speed, and the fade-out → gap → fade-in transition) are o
 eligibility inputs (grants hints, grants/revokes `no_banner`; a future payment flow sets
 `paid_account`), the backend emits a `notify` **`banner`** sub-kind (a payload-free re-poll signal),
 and the open client re-fetches `profile.get` to show or hide the banner in place. Operator *content*
-edits take effect on the next `profile.get` (open/reconnect/foreground), not mid-session. The same
+edits take effect on the next `profile.get` (open/reconnect/foreground), not mid-session.
-mechanism carries a **`profile`** sub-kind — a payload-free re-fetch signal emitted when a viewer's
-own account changed out of band (an email confirmed through the one-tap deeplink opened in another
-browser), so an open in-app session reflects it at once.
 
 > A single `app.load` bootstrap aggregator (collapsing `profile.get` + lobby + badge fetches into
 > one round-trip) was **considered and deferred**: client↔gateway is HTTP/2 (h2c), so the bootstrap
@@ -1032,20 +930,6 @@ browser), so an open in-app session reflects it at once.
   distinct accounts that performed an authenticated edge action in the window. The
   gauge is single-process by design (single-instance MVP, §10): it is correct for one
   gateway, resets on restart, and is a live operational figure, not a billing count.
-- **Local-preview adoption (client-reported):** three gateway counters measure uptake of
-  the local move-preview accelerator (§5), fed by a small, best-effort client beacon
-  (`POST /metrics/local-eval`, session-gated) that batches counter deltas and posts them
-  on a 60 s timer and when the app is backgrounded — **never on the gameplay path** (the
-  in-app counters are plain in-memory increments; only the periodic flush touches the
-  network, fire-and-forget). `local_eval_cold_start_total` counts app cold starts (the
-  adoption denominator); `local_eval_dict_load_total` (`result` = fetched/cache_hit/miss)
-  splits a dawg download that fills IndexedDB from a cache hit and from a warm-up that
-  failed or timed out; `local_eval_preview_total` (`path` = local/network) is the share of
-  previews computed on-device versus the network `evaluate` fallback — the backend load
-  shed. It answers the owner's adoption question — how often the app opens versus how often
-  it fills IndexedDB — and is surfaced on the **Scrabble — Users** dashboard. Lossy by
-  design (a dropped beacon just retries its batch on the next flush); it is telemetry, never
-  a game input.
 - **Rate-limit observability:** every limiter rejection increments the gateway
   counter `gateway_rate_limited_total` (`class` = user/public/email/admin — aggregate
   only, honouring the no-per-user-label discipline above) and logs one **Debug** line;
@@ -1157,39 +1041,24 @@ valid-code population). Brute-forcing a 6-digit friend code within these limits
 accepted MVP risk with low blast radius (an unwanted friendship is removable/blockable);
 a dedicated redeem sub-limit or a longer code is the hardening step if abuse appears.
 
-**Client source exposure.** The production UI build ships **no sourcemaps**
-(`vite.config.ts` gates `build.sourcemap` off when `mode === 'production'`), so the gateway
-and landing images serve only minified JS and the full TypeScript/Svelte source is not
-recoverable from a served `.map` at the edge. Dev and the `mock` e2e build (`vite build
---mode mock`) keep maps for debugging. This is surface reduction, not secrecy — the single
-minified bundle still carries all platform code paths and is reversible with effort.
-
 ## 13. Deployment (informational)
 
 Single public origin, path-routed. The Vite build has two entries: a lightweight
 **landing page** and the game **SPA**. The gateway **embeds** the SPA build
 (`go:embed`, baked in by a node stage in `gateway/Dockerfile`) and serves it at
-`/app/` (web), `/telegram/` (the Telegram Mini App; on that path without sign-in data
+`/app/` (web) and `/telegram/` (the Telegram Mini App; on that path without sign-in data
 — no `initData` — the client renders a compact, shareable launch-diagnostic screen instead
-of redirecting away) and `/vk/` (the VK Mini App; the client reads the signed `vk_*` launch
+of redirecting away); a stray hit on the gateway's `/`
-parameters from the URL and the gateway verifies them in-process — §12); a stray hit on the
+308-redirects to `/app/`. The **landing** ships in its own static container: the
-gateway's `/` 308-redirects to `/app/`. The **landing** ships in its own static container: the
 `landing` target of `gateway/Dockerfile` (caddy:2-alpine + the same Vite build,
 `deploy/landing/Caddyfile`) serves it at `/`, so stray public traffic is absorbed by
-static file serving and never reaches the Go edge. The landing shell carries the site's
+static file serving and never reaches the Go edge. Hash-named `/assets/*` are served
-static SEO head — Russian title/description, the Open Graph card (Telegram/VK link
-previews), JSON-LD and a canonical link — with absolute URLs pinned to the production
-origin, so the test contour canonicalises to production instead of being indexed as a
-separate site; the SPA shell is `noindex`, and the landing always boots in Russian (no
-browser-language detection — crawlers render with arbitrary languages). The favicon set,
-`og-image.png` and `robots.txt` ship unhashed from `ui/public/` (generated by
-`assets/icons/`, same tile design as the VK loader). Hash-named `/assets/*` are served
 `immutable` (a relaunch is a cache hit, not a re-download); the HTML shells are
 `no-cache` so a new deploy is picked up — both containers apply the same caching. An
 in-compose **caddy** is the contour's edge: it owns a single `/_gm` Basic-Auth and
 routes `/_gm/grafana/*` to **Grafana** (anonymous-admin, so the one shared login gates
 it with no per-user Grafana accounts) and the rest of `/_gm/*` to the backend-rendered
-**admin console**; `/app/`, `/telegram/`, `/vk/` and the Connect path go to the gateway; the
+**admin console**; `/app/`, `/telegram/` and the Connect path go to the gateway; the
 catch-all — notably the landing at `/` — goes to the landing container. The
 **Telegram validator** runs as a separate container with **no public ingress**,
 answering only internal gRPC (HMAC, no Telegram egress). The **Telegram bot** holds

docs/FUNCTIONAL.md

@@ -16,34 +16,14 @@ the top-1 hint, the unlimited word-check with complaint, per-game chat and nudge
 real-time in-app updates, switching interface language (en/ru) and theme, and a
 read-only profile. It also handles managing friends (including one-time friend
 codes) and blocks, friend-game invitations, editing the profile and binding an
-email, the statistics screen, and the in-game history viewer with GCG / PNG-image export.
+email, the statistics screen, and the in-game history viewer with GCG export.
 Settings also pick the board's bonus-label style (beginner / classic / none). A hint **lays the suggested tiles on the board** for the player to confirm and
 costs nothing when the rack has no legal move. The word-check accepts only the
 variant's alphabet, remembers answers within the session and rate-limits repeats.
 A public **landing page** at the site root introduces the game, switches language and
-theme, and links to the Telegram game channel and the VK Mini App; the game itself runs at
+theme, and links to the matching per-language Telegram channel; the game itself runs at
-`/app/` (web), `/telegram/` (the Telegram Mini App) and `/vk/` (the VK Mini App). The landing's theme is ephemeral
+`/app/` (web) and `/telegram/` (the Telegram Mini App). The landing's theme is ephemeral
-(it follows the system scheme, not the saved preference); its language choice is saved. The
+(it follows the system scheme, not the saved preference); its language choice is saved.
-landing always opens in **Russian** — the browser language is never auto-detected (crawlers
-render with arbitrary languages, so detection would make the indexed content
-nondeterministic); a saved 🌐 choice still wins. The page carries a static Russian SEO head
-(title/description, the Open Graph card Telegram/VK link previews use, a canonical link
-pinned to the production origin, JSON-LD, the favicon set and `robots.txt`), while the SPA
-shell is `noindex` — the landing is the only indexable page.
-
-### First-run onboarding
-The first time a player opens the app it walks them through the interface with a light
-**coachmark overlay**: a dimmed layer draws one hint bubble at a time, each pointing — with a
-tail — at a real control, and a **tap anywhere** advances to the next; after the last hint the
-overlay is gone for good. Two independent series run. The **lobby** series points at the
-⚙️ settings, ✏️ statistics and 🎲 new-game tabs. The **game** series, on the player's first game
-board, points at the scoreboard header (move history / chat / word-check), the 🔄 pass-and-exchange,
-🛟 hints and 🔀 shuffle controls, and the rack. A series counts as seen only **after its last hint**,
-so leaving mid-way replays it from the start next time; it is remembered per device. Arriving at the
-lobby is the lobby trigger, so a player who deep-links straight into Settings → Friends still gets the
-lobby walk-through on their first trip back. Both series work the same in portrait and landscape (the
-bubbles re-anchor to wherever the controls move) and the hint texts are localized (en/ru). The
-advertising banner hides while the overlay is up and returns when it closes.
 
 ### Identity & sessions
 A player arrives from a platform (Telegram first), via email login, or as an
@@ -55,22 +35,6 @@ the device safe-area, and — on first contact — seeds the new account's inter
 language from the Telegram client. If a launch cannot reach the backend (for example during a
 deployment), the Mini App retries quietly and then shows a small "couldn't load" screen with a
 **Retry** button, rather than dropping to the web sign-in, which has no place inside Telegram.
-A **VK Mini App** launch works the same way: it authenticates from VK's signed launch parameters
-(verified by the gateway), and on first contact seeds the new account's interface language from
-`vk_language` and its display name from the VK profile (read on the client, since VK does not put
-the name in the signed launch). While the theme preference is "auto" the app follows the VK
-client's light/dark scheme, and the layout clears the VK mobile home bar. The same quiet-retry
-"couldn't load" screen applies inside VK.
-**Email** sign-in (web) mails a branded six-digit confirmation code — localized
-(en/ru), no images — to the address; entering it signs the player in. A new address
-is provisioned on the first request but only becomes a durable account once the code
-is confirmed, so an abandoned, never-confirmed attempt is cleaned up and its address
-freed. Sends are rate-limited (a short cooldown between codes and a small hourly cap
-per address), so a mistyped address or an impatient tap cannot flood an inbox. The email
-also carries a **one-tap link** that confirms the address — or signs the player straight
-in — in a single tap; opening it in another browser reflects in the app at once, and a
-mail scanner that merely fetches the link cannot reach it — the token rides the URL
-fragment, which is never sent to the server.
 Telegram runs a **single bot**: every player uses
 the same bot, and all of its chat and out-of-app notifications are written in the
 player's own **interface language** (en/ru). A separate optional **promo bot** can run alongside the
@@ -96,6 +60,10 @@ reconnect), and pending reads resume on their own — the interface stays usable
 flashing a red banner each time.
 
 ### Accounts, linking & merge
+_Sign-in is currently provider-only, so the in-profile linking UI is temporarily hidden; it
+returns once the anonymous `/app/` guest (whose upgrade path this is) ships. The flow below
+describes it for when it does._
+
 First platform contact auto-provisions a durable account. From the profile a player
 links an email (via a confirm code) or their Telegram (via the web sign-in); a guest
 who links their first identity becomes a durable account. The "already taken" status
@@ -107,26 +75,6 @@ when a guest links an identity that already has a durable account, where the dur
 account is kept and the guest's games move into it. A merge is blocked only while the
 two accounts share a game still in progress.
 
-The profile lists the account's **sign-in methods**. On the web a player can add
-Telegram; adding VK on the web is not offered yet, and inside a Mini App the host
-platform is already linked. A linked provider can be **unlinked** — except the last
-remaining sign-in method, which is refused so the account stays reachable. **Email is
-never unlinked; it is changed**: the player enters a new address, confirms a code
-mailed to it, and the account switches to it atomically, freeing the old address. A new
-address that already belongs to another account is refused with a neutral "check the
-address or contact support" — the switch never merges and never reveals the other
-account.
-
-A player can **delete their account**. This is a legal-retention removal, not an erasure:
-the account is deactivated and its live surfaces anonymised (opponents see "[Deleted]"), its
-sign-in methods are freed for reuse, and its sessions are revoked — but a dossier (the
-credentials that were linked, the last login, and the player's messages) is retained for
-the operator and purged after two years. Confirming deletion needs a mailed code for an
-account with an email, or a typed phrase otherwise. Active games are forfeited so opponents
-are not stranded; solo games against the AI are removed, while games with a human opponent
-are kept under the anonymised name and the player's chat stays. Reopening the app after
-deletion simply creates a fresh account.
-
 ### Lobby & matchmaking
 On a cold open the lobby greets the player with a brief **loading splash** — Scrabble tiles
 spelling **ЭРУДИТ / ЗАГРУЗКА / ОЖИДАНИЕ** as a small crossword — that clears the moment the
@@ -173,8 +121,7 @@ and any incidental perpendicular words are ignored and not scored — while on i
 standard Scrabble. English games are always standard and show no such toggle. In auto-match
 the choice joins the pairing key, so a player only meets opponents who picked the same rule. Friend games (2–4) are
 formed by inviting players from the friend list (an invitation, like a friend code,
-is shareable as a Telegram deep link that opens it directly — on VK, which forwards no payload to the
+is shareable as a Telegram deep link that opens it directly): the inviter chooses the
-Mini App, the link only opens the app and the recipient enters the copied code by hand): the inviter chooses the
 settings and the game starts once every invitee has accepted — any decline cancels it, and an unanswered invitation
 expires after seven days.
 
@@ -195,10 +142,7 @@ tile that extends
 an existing word (down a column or across a row) is accepted. A play is validated
 against the game's dictionary at submit time and scored; an unlimited preview
 reports the word(s) a tentative move would form and its score, or that it is not
-legal, and the move is offered for submission only once it is confirmed legal. The preview is
+legal, and the move is offered for submission only once it is confirmed legal. The dictionary check tool is
-computed **on-device** for an instant response once the game's dictionary has loaded — a
-brief warm-up shows on the first open otherwise — and falls back to the server whenever the
-local dictionary is unavailable. The dictionary check tool is
 unlimited and offers a complaint on any result; for a word it finds, it also links out to an
 external reference dictionary (gramota.ru for Russian games, scrabblewordfinder.org for
 English) to look it up. Hints are governed per game —
@@ -295,8 +239,7 @@ entry — a message **or a nudge** from an opponent — raises a small **dot** n
 in the **lobby** and on the game's **score bar**, **red when an unread message is waiting and a
 softer amber when only nudges are**. Opening the **move history** counts as reading
 the chat, even without entering it: the dot clears and the 💬 icon **fade-blinks twice**. A nudge
-also clears the moment its recipient **takes their move**, and **all of a game's nudges clear once
+also clears the moment its recipient **takes their move**.
-the game finishes** (the badge is stale once the game is over) — but unread chat messages stay unread.
 
 ### Profile & settings
 Edit the display name (letters joined by a single space / "." / "_" separator, with an
@@ -344,44 +287,11 @@ silently ignores their messages) or clear a thread's messages. This is independe
 Feedback above — it serves people who write to the bot directly rather than through the app.
 
 ### History & statistics
-Finished games are archived in a dictionary-independent form and exportable in
+Finished games are archived in a dictionary-independent form and exportable to
-**two formats behind one 📤 button** — the GCG file and a rendered **PNG image** of
+GCG; the export is offered **only once a game is finished**, and never for an
-the final position; the export is offered **only once a game is finished**, and
+honest-AI practice game (a live game's export would leak the move journal; an AI
-never for an honest-AI practice game (a live game's export would leak the move
+game is throwaway). The client shares the `.gcg` file where the platform supports
-journal; an AI game is throwaway). The format chooser is Telegram's **native popup**
+it, otherwise downloads it. Statistics (durable accounts only):
-on Telegram Android/desktop (safe there: that chain is all bridge calls, which need
-no user activation) and the app's own modal elsewhere — on Telegram iOS the delivery
-is the OS share sheet, which a native-popup callback cannot open, and VK has no
-native chooser.
-
-The **image** is rendered on the server (the internal render sidecar runs the same
-drawing module the web client tests; always the light theme): the final board with
-classic coordinate axes A..O / 1..15 on the left — premium squares as plain colour
-fills, no text labels — and a compact per-seat scoresheet on the right: each seat's
-name and final score in the header (🏆 by the winner), then one row per move
-carrying the main word's classic coordinate (an across play is row-first, `8G`; a
-down play column-first, `H8` — the GCG convention), the word and its points; extra
-words of a multi-word play ride a smaller second line, non-play moves show as
-localized notes (pass/exchange/resign/timeout), and a closing ± row shows the
-endgame rack settlement when there was one (the final scores are authoritative —
-running totals alone do not include it). The footer stamps the site host and the
-finish date in the device locale. The scoresheet typography is fixed; a long game
-stretches the board (never below its minimum) so the image carries no dead space.
-
-Delivery is **one signed, short-lived link for both formats on every platform**,
-handed to the best affordance each platform has (each branch verified on-device):
-Telegram Android/desktop use Telegram's download dialog (whose own preview shares
-onwards); **Telegram iOS opens the OS share sheet** with the fetched file; VK iOS
-takes both formats through VK's download into its native share flow, while on the
-**VK Android client** — whose downloader hangs — the image opens in VK's native
-photo viewer (saving from its controls) and the GCG copies to the clipboard (the
-desktop VK iframe, an ordinary browser, downloads both); a **mobile browser gets
-the OS share sheet** (nothing lands in Downloads first); a desktop browser
-downloads the file. The link needs no login to fetch (the platforms' downloaders
-carry none) and is valid for minutes. The single exception is a legacy Telegram
-client without the download dialog (pre-Bot API 8.0): there the GCG falls back to
-the old clipboard copy (with the confirming toast) and the image option is not
-offered. Statistics (durable accounts only):
 wins, losses, draws, max points in a game, and max points for a single move (the
 best play, which already includes every word it formed plus the all-tiles bonus). It
 also shows the player's **move count** (their plays — passes and exchanges do not

docs/FUNCTIONAL_ru.md

@@ -16,37 +16,15 @@ top-1 подсказку, безлимитную проверку слова с
 профиль только для чтения. Он также включает управление друзьями (в т.ч.
 одноразовые коды-приглашения) и блоками, дружеские приглашения в игру,
 редактирование профиля и привязку email, экран статистики и просмотр истории
-партии с экспортом в GCG / PNG-картинку. В настройках также выбирается стиль подписей бонус-клеток
+партии с экспортом GCG. В настройках также выбирается стиль подписей бонус-клеток
 (новичок / классика / без текста). Подсказка **выставляет предложенные фишки на
 доску** — игрок сам решает сделать ход, и подсказка не тратится, если ходов нет.
 Проверка слова принимает только алфавит варианта, запоминает ответы в рамках сессии
 и ограничивает частоту повторов.
 Публичная **посадочная страница** в корне сайта представляет игру, переключает язык и
-тему и ведёт в Telegram-канал игры и в VK Mini App; сама игра живёт по адресам
+тему и ведёт в соответствующий по-язычный Telegram-канал; сама игра живёт по адресам
-`/app/` (веб), `/telegram/` (Telegram Mini App) и `/vk/` (VK Mini App). Тема на странице эфемерна (берётся из
+`/app/` (веб) и `/telegram/` (Telegram Mini App). Тема на странице эфемерна (берётся из
-системной настройки, а не из сохранённой), выбор языка сохраняется. Страница всегда
+системной настройки, а не из сохранённой), выбор языка сохраняется.
-открывается на **русском** — язык браузера не определяется автоматически (роботы
-рендерят страницу с произвольным языком, и автоопределение сделало бы
-проиндексированный контент недетерминированным); сохранённый выбор 🌐 по-прежнему
-главнее. Страница несёт статическую русскую SEO-«шапку» (title/description, карточка
-Open Graph, которую используют превью ссылок в Telegram/VK, канонический адрес
-продакшен-домена, JSON-LD, набор favicon и `robots.txt`), а оболочка SPA помечена
-`noindex` — индексируется только посадочная страница.
-
-### Первый запуск: онбординг
-При первом открытии приложения игрока один раз проводят по интерфейсу лёгким
-**coachmark-оверлеем**: затемнённый слой показывает по одной подсказке-«облачку» за раз, каждое
-«хвостиком» указывает на реальный элемент управления, а **тап в любом месте** переходит к
-следующей; после последней подсказки оверлей убирается навсегда. Серий две. Серия **лобби**
-указывает на вкладки ⚙️ настроек, ✏️ статистики и 🎲 новой игры. Серия **игры**, на первой партии
-игрока, указывает на шапку со счётом (история ходов / чат / проверка слова), кнопки 🔄 пас-и-обмен,
-🛟 подсказок и 🔀 перемешивания, и на стойку с фишками. Серия считается просмотренной только
-**после последней подсказки**, поэтому выход на середине в следующий раз покажет её с начала;
-запоминается она по устройству. Триггер серии лобби — попадание в лобби, так что игрок, пришедший
-по deeplink сразу в Настройки → Друзья, всё равно получит проводку по лобби при первом возврате.
-Обе серии одинаково работают в portrait и landscape (облачка переустанавливаются туда, куда
-переезжают элементы), тексты подсказок локализованы (en/ru). Рекламный баннер скрывается, пока
-оверлей показан, и возвращается по закрытию.
 
 ### Личность и сессии
 Игрок приходит с платформы (сначала Telegram), через email-вход или как
@@ -59,23 +37,7 @@ Mini App** авторизует по подписанным `initData` плат
 языку Telegram-клиента. Если запуск не может достучаться до бэкенда (например, во время
 деплоя), Mini App тихо повторяет попытки, а затем показывает небольшой экран «не удалось
 загрузить» с кнопкой **Повторить**, вместо того чтобы сбрасывать на веб-вход, которому внутри
-Telegram не место. Запуск **VK Mini App** работает так же: авторизует по подписанным
+Telegram не место. Telegram держит **единого бота**: все игроки пользуются одним
-launch-параметрам VK (их проверяет gateway), и при первом контакте задаёт язык интерфейса
-нового аккаунта по `vk_language`, а отображаемое имя — по профилю VK (читается на клиенте,
-так как VK не кладёт имя в подписанный запуск). Пока тема в режиме «авто», приложение следует
-светлой/тёмной схеме VK-клиента, а раскладка обходит нижнюю home-bar VK на мобильных. Тот же экран
-тихого повтора «не удалось
-загрузить» действует и внутри VK.
-**Email**-вход (в вебе) отправляет на адрес брендированный шестизначный код подтверждения —
-локализованный (ru/en), без картинок; после ввода игрок входит. Новый адрес заводится при первом
-запросе, но становится постоянным аккаунтом только после подтверждения кода — так брошенная,
-неподтверждённая попытка вычищается, а адрес освобождается. Отправки ограничены по частоте (короткая
-пауза между кодами и небольшой часовой лимит на адрес), чтобы опечатка в адресе или нетерпеливый тап
-не завалили почтовый ящик. В письме также есть **ссылка одного нажатия**, которая подтверждает
-адрес — или сразу выполняет вход — в один тап; открытие её в другом браузере тут же отражается в
-приложении, а почтовый сканер, который просто загружает ссылку, до токена не дотянется —
-он едет в URL-фрагменте, который не уходит на сервер.
-Telegram держит **единого бота**: все игроки пользуются одним
 и тем же ботом, а весь его чат и внеприложенческие уведомления пишутся на **языке
 интерфейса** самого игрока (en/ru). Рядом с основным может работать отдельный опциональный
 **промо-бот** — его единственная задача отвечать на `/start` коротким сообщением и кнопкой,
@@ -100,6 +62,10 @@ Telegram держит **единого бота**: все игроки поль
 рабочим вместо красного баннера каждый раз.
 
 ### Аккаунты, привязка и слияние
+_Вход сейчас только через провайдера, поэтому UI привязки в профиле временно скрыт; он
+вернётся, когда появится анонимный `/app/`-гость (для апгрейда которого он и нужен). Описание
+ниже — на этот случай._
+
 Первый контакт с платформы заводит постоянный аккаунт. Из профиля игрок
 привязывает email (по confirm-коду) или свой Telegram (через веб-вход); гость,
 привязавший первую личность, становится постоянным аккаунтом. Факт «личность уже
@@ -111,25 +77,6 @@ Telegram держит **единого бота**: все игроки поль
 тогда сохраняется постоянный аккаунт, а игры гостя переходят в него. Слияние
 запрещено, только пока у аккаунтов есть общая незавершённая игра.
 
-В профиле перечислены **способы входа** аккаунта. В вебе игрок может добавить
-Telegram; добавление VK в вебе пока не предлагается, а внутри Mini App платформа-хозяин
-уже привязана. Привязанного провайдера можно **отвязать** — кроме последнего
-оставшегося способа входа: он не отвязывается, чтобы аккаунт оставался достижимым.
-**Email не отвязывают — его меняют**: игрок вводит новый адрес, подтверждает код,
-отправленный на него, и аккаунт атомарно переключается на новый адрес, освобождая
-старый. Новый адрес, уже принадлежащий другому аккаунту, отклоняется нейтральным
-«проверьте правильность e-mail или обратитесь в поддержку» — смена никогда не сливает
-аккаунты и не раскрывает чужой.
-
-Игрок может **удалить аккаунт**. Это удаление с юридическим удержанием, а не стирание:
-аккаунт деактивируется, живые поверхности обезличиваются (соперники видят «[Deleted]»),
-способы входа освобождаются под повторную регистрацию, сессии отзываются — но досье
-(какие креды были привязаны, последний вход, сообщения игрока) сохраняется для оператора и
-чистится через два года. Подтверждение удаления — код на почту (если у аккаунта есть
-e-mail) либо ввод фразы. Активные игры форфейтятся, чтобы не бросать соперников; одиночные
-игры против ИИ удаляются, а игры с людьми сохраняются под обезличенным именем, чат игрока
-остаётся. Если снова открыть приложение после удаления — создаётся новый аккаунт.
-
 ### Лобби и подбор
 При холодном запуске лобби встречает игрока короткой **заставкой загрузки** — фишки Scrabble
 складывают небольшой кроссворд из слов **ЭРУДИТ / ЗАГРУЗКА / ОЖИДАНИЕ** — и она исчезает, как
@@ -180,8 +127,7 @@ e-mail) либо ввод фразы. Активные игры форфейтя
 показывают. В авто-подборе выбор входит в ключ подбора, поэтому игрок сводится только с теми,
 кто выбрал то же правило. Игры с друзьями (2–4)
 формируются приглашением игроков из списка друзей (приглашение, как и код друга,
-можно отправить deep-link'ом в Telegram, который откроет его сразу — на VK, который не передаёт Mini App
+можно отправить deep-link'ом в Telegram, который откроет его сразу): инициатор
-никакой нагрузки, ссылка лишь открывает приложение, а скопированный код получатель вводит вручную): инициатор
 выбирает настройки, и партия стартует, когда приняли все приглашённые — любой отказ отменяет приглашение, а без
 ответа приглашение протухает через семь дней.
 
@@ -203,9 +149,7 @@ e-mail) либо ввод фразы. Активные игры форфейтя
 слово (по столбцу или по строке), принимается. Ход проверяется по словарю партии при
 сдаче и считается; безлимитный предпросмотр показывает слово (или слова), которое
 образует предполагаемый ход, и его очки — либо что ход недопустим, — и ход можно
-отправить только после подтверждения, что он допустим. Предпросмотр считается **на устройстве**
+отправить только после подтверждения, что он допустим. Инструмент проверки слова безлимитный и
-и отвечает мгновенно, как только словарь партии загружен — иначе при первом открытии показывается
-короткий прогрев, — и уходит на сервер, если локальный словарь недоступен. Инструмент проверки слова безлимитный и
 предлагает пожаловаться на любой результат; для найденного слова он также даёт ссылку на
 внешний справочный словарь (gramota.ru для русских игр, scrabblewordfinder.org для английских),
 чтобы его посмотреть. Подсказки управляются настройками
@@ -303,8 +247,7 @@ e-mail) либо ввод фразы. Активные игры форфейтя
 **лобби** и на **строке счёта** партии, **красную при непрочитанном сообщении и мягкую жёлтую,
 когда непрочитаны только nudge'и**. Открытие **истории ходов** считается прочтением чата, даже
 без захода в него: точка гаснет, а значок 💬 **дважды мигает**. Nudge также гаснет в момент, когда
-его получатель **делает ход**, и **все nudge'и партии гаснут по её завершении** (после конца
+его получатель **делает ход**.
-партии бейдж неактуален) — но непрочитанные сообщения чата остаются непрочитанными.
 
 ### Профиль и настройки
 Редактирование отображаемого имени (буквы, разделённые одиночным пробелом / «.» /
@@ -352,44 +295,11 @@ Telegram.
 канал для тех, кто пишет боту напрямую, а не через приложение.
 
 ### История и статистика
-Завершённые партии архивируются в независимом от словаря виде и экспортируются в
+Завершённые партии архивируются в независимом от словаря виде и экспортируются
-**двух форматах за одной кнопкой 📤** — файл GCG и отрисованная **PNG-картинка**
+в GCG; экспорт доступен **только после завершения партии** и никогда — для
-финальной позиции; экспорт доступен **только после завершения партии** и никогда —
+тренировочной партии с ИИ (экспорт идущей партии раскрыл бы журнал ходов, а партия
-для тренировочной партии с ИИ (экспорт идущей партии раскрыл бы журнал ходов, а
+с ИИ одноразовая). Клиент делится файлом `.gcg` там, где платформа это поддерживает,
-партия с ИИ одноразовая). Выбор формата — **нативный попап Telegram** на
+иначе скачивает его. Статистика (только у постоянных аккаунтов):
-Telegram Android/desktop (там это безопасно: цепочка целиком из bridge-вызовов,
-которым user activation не нужна) и собственный модал приложения в остальных
-случаях — на Telegram iOS доставка идёт через системную share-шторку, которую из
-коллбека нативного попапа не открыть, а у VK нативного чузера нет.
-
-**Картинка** рендерится на сервере (внутренний рендер-сайдкар исполняет тот же
-модуль отрисовки, что тестирует веб-клиент; всегда светлая тема): финальная
-доска с классическими осями координат A..O / 1..15 слева — бонус-клетки чистой
-цветовой заливкой, без текстовых подписей — и компактная таблица ходов по местам
-справа: в шапке имя и финальный счёт каждого места (🏆 у победителя), далее по
-строке на ход: классическая координата главного слова (горизонтальный ход —
-цифра первой, `8G`; вертикальный — буква первой, `H8` — конвенция GCG), слово и
-его очки; дополнительные слова мультисловного хода — второй мелкой строкой,
-не-игровые ходы — локализованными пометками (пас/обмен/сдался/таймаут), а
-замыкающая строка ± показывает концовочную поправку за рэк, когда она была
-(финальные счета авторитетны — суммы ходов её не содержат). В подвале — хост сайта
-и дата завершения в локали устройства. Типографика таблицы фиксирована; длинная
-партия растягивает доску (не ниже минимума), так что пустот на картинке нет.
-
-Доставка — **одна подписанная короткоживущая ссылка для обоих форматов на любой
-платформе**, отданная лучшему механизму, который у платформы реально есть (каждая
-ветка проверена на устройстве): Telegram Android/desktop — диалог загрузки Telegram
-(из его превью файл шерится дальше); **Telegram iOS — системная share-шторка** со
-скачанным файлом; VK iOS ведёт оба формата через загрузку VK в её нативный
-share-поток, а на **VK Android** — чей загрузчик виснет — картинка открывается в
-нативном просмотрщике фото VK (сохранение его кнопками), GCG копируется в буфер
-(десктопный iframe VK — обычный браузер — скачивает оба); **мобильный браузер
-получает системную share-шторку** (ничего не оседает в Загрузках); десктопный
-браузер скачивает файл. Ссылка не требует логина при
-скачивании (родные загрузчики платформ его не несут) и живёт минуты. Единственное
-исключение — устаревший клиент Telegram без диалога загрузки (до Bot API 8.0): там
-GCG откатывается на прежнее копирование в буфер (с подтверждающим тостом), а пункт
-«картинка» не предлагается. Статистика (только у постоянных аккаунтов):
 победы, поражения, ничьи, макс. очков за партию и макс. очков за один ход (лучший
 ход, уже включающий все образованные им слова и бонус за все фишки). Также
 показываются **число ходов** игрока (его выкладки — пасы и обмены не считаются) и

docs/TESTING.md

@@ -17,26 +17,10 @@ tests or touching CI.
 - **UI** — Vitest (unit) + Playwright
   (e2e), mirroring the chosen plain-Svelte + Vite toolchain. Vitest covers
   the FlatBuffers codecs (friend list, invitation, stats), the win-rate
-  derivation and the GCG share/copy/download choice, plus Playwright specs against the
+  derivation and the GCG share/download choice, plus Playwright specs against the
   mock for the friends screen (code issue/redeem, accept a request), the lobby
-  invitations section, the stats screen, profile editing, and the export chooser's
+  invitations section, the stats screen, profile editing, and the GCG export's
-  finished-only visibility + its signed-URL download flow (route-intercepted).
+  finished-only visibility.
-- **Render sidecar** — `renderer/` (Node + skia-canvas executing the shared
-  `ui/src/lib/gameimage.ts`) carries a `node --test` smoke: the committed fixture (a
-  real self-played 35-move game) must rasterize to a plausible PNG
-  (`pnpm -C renderer test`). The drawing module's pure parts (scoresheet, layout,
-  notation) stay unit-tested in `ui/` — the sidecar test guards only the
-  skia/bundling seam. Pixel goldens are deliberately avoided (fonts differ across
-  hosts).
-- **Local-eval conformance** — the client's on-device move preview (the ported
-  dawg reader + validator, `ui/src/lib/dict`) is checked byte-for-byte against the
-  authoritative Go engine. `backend/cmd/dictgen` and `backend/cmd/validategen` emit
-  golden vectors from the release dictionaries — every stored word plus a battery of
-  plays across both cross-word rules and all variants, each with the engine's
-  legality, score, words and inferred direction. The gated Vitest suites
-  (`ui/src/lib/dict/*.parity.test.ts`, skipped without their `DICT_*` env) replay
-  them and must agree exactly; the `conformance` CI job runs the whole loop, so a
-  drift in the port fails the merge.
 - **Engine** — correctness of scoring and move generation is owned
   by `scrabble-solver`'s own GCG-backed tests. `backend/internal/engine` adds, on
   top of the embedded solver: per-variant smoke tests (load all three committed
@@ -69,10 +53,7 @@ tests or touching CI.
   content and block-visibility rules, the nudge turn/rate-limit rules, the
   invitation flow (all-accept starts the game, decline cancels, lazy expiry,
   inviter-only cancel), and the email confirm-code flow (request/confirm, taken
-  email, expiry and attempt-cap, and the guest-until-confirmed login) with a fixture
+  email, expiry and attempt-cap) with a fixture mailer. It also covers the
-  mailer. The branded email template render (en/ru subject, code and body) and the
-  per-recipient send-rate limiter (cooldown + hourly cap) are pure account-package
-  unit tests, needing no database. It also covers the
   **befriend-an-opponent** gate (a request needs a shared game), the **permanent
   decline** and 30-day re-send rule, the **one-time friend code** (issue/redeem,
   self/single-use, decline-bypass), `ListInvitations`, the zero-value `GetStats`, and

docs/UI_DESIGN.md

@@ -49,32 +49,6 @@ fast load shows it for ~1.25 s. Each tile **drops in** with a brief scale + fade
 dismisses as soon as the lobby is ready. The pure layout and timing live in `lib/splash.ts`
 (unit-tested); `Splash.svelte` is the renderer.
 
-## First-run onboarding coachmarks (`components/Coachmark.svelte`, `lib/coachmark.ts`)
-
-A one-time **coachmark overlay** introduces the interface to a new player. Like the splash it is an
-**App-level overlay**; it runs two independent series chosen by the route — **lobby** (⚙️ settings →
-✏️ stats → 🎲 new game) and **game** (scoreboard header → 🔄 pass/exchange → 🛟 hints → 🔀 shuffle →
-rack). It draws **one bubble at a time** over a light scrim (`rgba(0,0,0,0.32)`); the whole layer
-captures pointer events, so a **tap anywhere advances** and the UI underneath stays inert. After the
-last hint the series is recorded done (`session.ts` `onboarding` key) and the overlay removes itself;
-a series is marked only after its **last** hint, so an interrupted player replays it from the start.
-The lobby series gates on `app.splashDone`, the game series on its first target laying out; both defer
-while a modal (`welcomeRedeem` / `staleInvite`) is open.
-
-Each target carries a **`data-coach` attribute**, so the **same positioning engine anchors it in both
-orientations** wherever the layout moves it (the tab bar to the landscape left panel, etc.). The
-bubble points at the live `getBoundingClientRect()` of its target, **re-measuring each frame until the
-geometry settles** (the route-change slide, the hidden-banner reflow, async fonts) and on resize /
-rotation; a target absent in the current state is skipped. The bubble matches the in-game counter text
-size (`0.85rem`, larger in landscape), wraps by word and never fills the width; its **tail** sits on
-the edge facing the target, centred on it (clamped near a corner). The pure geometry (step lists,
-`nextVisibleStep`, `placeBubble`) lives in `lib/coachmark.ts` (unit-tested); `Coachmark.svelte` is the
-renderer. While the overlay is up the **advertising banner is hidden** (`app.coachActive`) so its
-scroll does not run behind the scrim. The hidden DebugPanel offers a **Reset visited** control that
-clears the flags so the walk-through replays on the next launch. In the **mock build** the overlay
-does not auto-show (so it cannot block the Playwright smoke); `?coach` forces it on for the dedicated
-e2e and the screenshots.
-
 ## Navigation
 
 - **Back**: a thin, compact `<` drawn from two rotated CSS borders (`Header.svelte`
@@ -100,10 +74,7 @@ e2e and the screenshots.
   square with an accent underline). A red count **badge** rides the icon's corner — on the
   lobby ⚙️ tab and the hub's 🤝 Friends tab for pending incoming friend requests (invitations
   keep their own lobby section), and on the Hint tab for the remaining count. No text
-  selection on nav / tab-bar / buttons (`user-select: none`), and no tap-highlight flash on any
+  selection on nav / tab-bar / buttons (`user-select: none`).
-  tappable element (`-webkit-tap-highlight-color: transparent` on `#app`) — Android in-app WebViews
-  otherwise draw a momentary selection-like box on a clickable node on tap (seen on the header title
-  and the back chevron).
 - **Screen transitions** (`App.svelte`): navigation slides directionally — a
   screen entered from the lobby flies in from the right; returning to the lobby reveals it
   from the left (back). Transitions are local (so they do not play on first load) and
@@ -142,22 +113,6 @@ e2e and the screenshots.
   by a background suspend reconnects silently on return — the connection banner is
   suppressed while hidden and for a short grace after resume (visibilitychange +
   pageshow/pagehide + Telegram `activated`/`deactivated`).
-- **VK integration** (`lib/vk.ts`): inside the VK Mini App the **auto** theme follows the VK
-  client's light/dark (`VKWebAppUpdateConfig`), as the VK webview's `prefers-color-scheme` does not
-  track it; explicit light/dark prefs still win. The device safe-area comes from CSS
-  `env(safe-area-inset-*)` (the meta already sets `viewport-fit=cover`) **max'd** with the VK bridge
-  insets (`VKWebAppUpdateInsets`, needed on Android, where the VK webview exposes no `env()` inset),
-  so the layout clears the VK home bar. Share and copy route through the bridge (`VKWebAppShare` /
-  `VKWebAppCopyText`) because `navigator.share` / `clipboard` are absent in the desktop VK iframe.
-  Haptics fire the same set as Telegram via VK Bridge taptic (`VKWebAppTapticImpactOccurred` /
-  `…NotificationOccurred` / `…SelectionChanged`), through the shared `lib/haptics.ts` dispatcher; and
-  VK's **horizontal swipe-back** is disabled at launch (`VKWebAppSetSwipeSettings`) so it does not
-  fight the app's own edge-swipe-back and tile drag — parity with Telegram's disabled vertical
-  swipes, the app owning navigation through its back chevron. VK's **status bar** (and, on Android,
-  the action / navigation bars) is painted to the app theme via `VKWebAppSetViewSettings` on launch
-  and every theme change — parity with the Telegram chrome painting (`syncVKChrome` mirrors
-  `syncTelegramChrome`); the status-bar appearance follows the `--bg` token's luminance
-  (`appearanceForBg`).
 
 ## Tiles & board
 
@@ -182,10 +137,7 @@ e2e and the screenshots.
   the first time. A **swipe down on the zoom-out board** opens the history, but only when the
   board is scrolled to its top so it never fights the stage's own vertical scroll (the conflict
   that once retired this gesture) — and it is suppressed on the zoomed board, where the
-  one-finger drag pans (and on desktop / the landscape iframe, where a mouse cannot drag-scroll the
+  one-finger drag pans. History also opens on a **tap of the score bar** and closes on a tap or
-  viewport natively, a **drag-to-pan** handler moves the zoomed board instead — active only while
-  zoomed, off pending tiles, past a small threshold, swallowing the trailing click). History also
-  opens on a **tap of the score bar** and closes on a tap or
   an **upward swipe** of the then-inert board (below). A **hint** auto-zooms centred on the
   hint's placement, not
   the top-left.
@@ -214,7 +166,8 @@ e2e and the screenshots.
   **Drop game** (or 📤 **Export GCG** on a finished game) at the left and the comms 💬
   (badged with unread chat) at the right, icon-only. A **single-word-rule** game (a Russian
   game with "multiple words per turn" off) centres a **"One word per turn"** label between
-  those two icons; standard games show no label. Each **opponent**'s card also gains two
+  those two icons, and the status bar shows a small **1️⃣** in the score-preview slot that
+  yields to the live word/score preview while tiles are pending; standard games show neither. Each **opponent**'s card also gains two
   edge-pinned controls (non-guests): a 🤝 **add-friend** on the right (hidden once a friend,
   disabled once requested) and a ✖️ **block** on the left. Each confirms via the fading-✅ tap,
   swapping the card's score for "Add friend?" — or **"Block?" in the danger colour** — while
@@ -290,8 +243,7 @@ the surroundings in the light theme and a touch lighter in the dark theme, mappe
 linkified). It is **server-driven**: the campaigns and display timings ride the `profile.get`
 response (`app.profile.banner`, present only for an eligible viewer — see ARCHITECTURE §10), so
 `Header` renders the strip only when that block is present, and a `notify` `banner` event re-fetches
-the profile to show or hide it in place. It is also hidden while a first-run onboarding overlay is up
+the profile to show or hide it in place.
-(`app.coachActive`), reappearing by this same condition once the overlay closes.
 
 The rotation runs in a **persistent module engine** (`lib/bannerEngine`): the scheduler and timer
 live outside the components, so navigating between screens (which remounts the view) **continues the
@@ -403,41 +355,13 @@ enabled on the first, uncached load) and flip in place when an event refreshes t
   lobby with a calm modal pointing at the bot (`@<username>`), not a red error on the
   Friends tab. Flex text inputs carry `min-width:0` so they shrink instead of overflowing in
   Safari.
-- **History / export**: the in-game slide-down history lays each move out in a per-seat grid
+- **History / GCG**: the in-game slide-down history lays each move out in a per-seat grid
-  (the word(s) and the move score, no running total); the 📤 in the history header appears
+  (the word(s) and the move score, no running total); *Export GCG* (the 📤 in the history
-  only once the game is finished — never in an honest-AI game (throwaway practice) — and
+  header) shares or downloads the `.gcg` file and appears only once the game is finished — and
-  opens the **format chooser**: Telegram's native popup on TG Android/desktop — safe
+  never in an honest-AI game (throwaway practice). Confirming a resign reveals the full board:
-  there, since that chain is all bridge calls needing no user activation (a popup callback
+  it closes the history drawer (portrait) and zooms the board out.
-  must never lead into `navigator.share`/clipboard, the on-device finding) — and the app's
-  own modal elsewhere (TG iOS delivers via the OS share sheet, which needs the modal
-  click's activation; VK has no native chooser; the accent button leads with the image,
-  both options need the connection). Both formats mint the same signed relative link
-  (`game.export_url`), resolved against the app's own origin, then delivered per platform
-  (each branch owner-verified on-device): TG Android/desktop `downloadFile` (its preview
-  shares onwards); TG iOS the OS share sheet with the fetched file; VK iOS
-  `VKWebAppDownloadFile` for both formats (VK's native share flow); VK Android — whose
-  DownloadFile hangs — the PNG in VK's native image viewer (`VKWebAppShowImages`, its save
-  works) and the GCG to the clipboard; the VK desktop iframe plain anchor downloads; a
-  mobile browser the OS share sheet (the proven fetch-then-share pattern); a desktop
-  browser an anchor download. A legacy Telegram
-  client without `downloadFile` keeps the old GCG clipboard copy, hides the image option
-  and stays on the app modal. Confirming a resign reveals the full board: it closes the
-  history drawer (portrait) and zooms the board out.
-- **Export image** (`lib/gameimage.ts` — the shared drawing module the render sidecar
-  executes; the browser app no longer draws it): always the light palette (pinned constants
-  mirroring `app.css`), the final board with classic axes A..O / 1..15, premium squares as
-  plain colour fills (no text labels), tiles in the in-game style (bevel, letter top-left,
-  value bottom-right, ✻ for an Erudit blank), no last-move highlight. The right column is
-  the scoresheet: per-seat name over the final score (🏆 by the winner), one
-  fixed-typography row per move — muted classic coordinate (across = row-first `8G`, down =
-  column-first `H8`), the main word, points right-aligned; extra words of a multi-word play
-  on a smaller second line; italic localized notes for pass/exchange/resign/timeout; a
-  closing muted ± row for the endgame rack settlement when present. Footer:
-  `hostname · finish date` in the **device** locale. The scoresheet's height drives the
-  board side (never below its minimum): a long game stretches the board, never the
-  typography, so the image has no dead space.
 - **Finished game**: the board keeps no last-word highlight and no zoom; the history header
-  offers *Export game* (not *Drop game*; an AI game offers neither) and the comms hub hides the 🔎 *Dictionary* tab — and a **finished AI game has no comms at all** (no chat, dictionary closed), so its 💬 entry is dropped from the header too; and
+  offers *Export GCG* (not *Drop game*; an AI game offers neither) and the comms hub hides the 🔎 *Dictionary* tab — and a **finished AI game has no comms at all** (no chat, dictionary closed), so its 💬 entry is dropped from the header too; and
   the footer (rack + tab bar) is **drawn but inert** (greyed, non-interactive) rather than
   hidden, so the layout does not jump. Chat send / nudge are the ⬆️ / 🛎️ icons. The input
   row is turn-driven: on your turn the message field shows until your one allowed message is
@@ -452,20 +376,6 @@ enabled on the first, uncached load) and flip in place when an event refreshes t
   raises a badge on the lobby ⚙️ tab (combined with the friend-request count) and a "1" on the
   Info tab.
 
-## Dictionary warm-up overlay (`components/DictWarmup.svelte`)
-
-Opening a game whose local move-preview dictionary is not yet cached shows a brief,
-non-dismissable warm-up overlay while it downloads (a returning player's cached
-dictionary loads from IndexedDB in a few ms, so the flash-guard suppresses it then).
-A darker-than-onboarding scrim covers
-the board; centred on it, a large emoji cycles through a fixed playful sequence — one
-per 500 ms tick (300 ms still, then a 200 ms clockwise spin with the current glyph
-fading out and the next fading in), looping — under a constant "Loading…" caption.
-Reduce-motion drops the spin to a plain cross-fade. A ~120 ms flash-guard suppresses
-the overlay for a disk-cached dictionary that loads in a few ms; a cold (network) load
-shows it until the dictionary is ready or a 5 s cap elapses, after which the preview
-falls back to the network. See docs/ARCHITECTURE.md §5 (the local eval).
-
 ## Caveat
 
 Emoji are rendered by the platform's system emoji font, so their exact look varies across

gateway/Dockerfile

@@ -23,14 +23,18 @@ RUN corepack enable && corepack prepare pnpm@11.0.9 --activate
 # VITE_APP_VERSION carries `git describe` for the About screen (defaults to "dev").
 ARG VITE_TELEGRAM_BOT_ID=
 ARG VITE_TELEGRAM_LINK=
-ARG VITE_TELEGRAM_GAME_CHANNEL_NAME=
+ARG VITE_TELEGRAM_LINK_EN=
-ARG VITE_VK_APP_LINK=
+ARG VITE_TELEGRAM_LINK_RU=
+ARG VITE_TELEGRAM_GAME_CHANNEL_NAME_EN=
+ARG VITE_TELEGRAM_GAME_CHANNEL_NAME_RU=
 ARG VITE_GATEWAY_URL=
 ARG VITE_APP_VERSION=
 ENV VITE_TELEGRAM_BOT_ID=$VITE_TELEGRAM_BOT_ID \
     VITE_TELEGRAM_LINK=$VITE_TELEGRAM_LINK \
-    VITE_TELEGRAM_GAME_CHANNEL_NAME=$VITE_TELEGRAM_GAME_CHANNEL_NAME \
+    VITE_TELEGRAM_LINK_EN=$VITE_TELEGRAM_LINK_EN \
-    VITE_VK_APP_LINK=$VITE_VK_APP_LINK \
+    VITE_TELEGRAM_LINK_RU=$VITE_TELEGRAM_LINK_RU \
+    VITE_TELEGRAM_GAME_CHANNEL_NAME_EN=$VITE_TELEGRAM_GAME_CHANNEL_NAME_EN \
+    VITE_TELEGRAM_GAME_CHANNEL_NAME_RU=$VITE_TELEGRAM_GAME_CHANNEL_NAME_RU \
     VITE_GATEWAY_URL=$VITE_GATEWAY_URL \
     VITE_APP_VERSION=$VITE_APP_VERSION
 

gateway/README.md

@@ -7,7 +7,7 @@ thin opaque session, rate-limits, injects `X-User-ID` when forwarding to the
 backend over REST/JSON, and bridges the backend's gRPC push stream to each
 client's in-app live channel. It **embeds the static UI build** (`go:embed`, baked
 in by the gateway image's node stage) and serves a **landing page** at `/` and the game
-**SPA** at `/app/` (web), `/telegram/` (the Telegram Mini App) and `/vk/` (the VK Mini App) — the single-origin model.
+**SPA** at `/app/` (web) and `/telegram/` (the Mini App) — the single-origin model.
 Hash-named `/assets/*` are served `immutable`; the HTML shells are `no-cache`. It can also serve the
 backend's admin console at `/_gm` behind HTTP Basic-Auth for a local non-caddy run;
 in the deployed contour the front caddy owns `/_gm` (see
@@ -29,7 +29,7 @@ internal/push/          # live-event fan-out hub (per-user client streams)
 internal/transcode/     # FlatBuffers<->REST bridge + message_type registry
 internal/connectsrv/    # the Connect Gateway service over h2c (+ the in-memory active_users gauge)
 internal/admin/         # Basic-Auth reverse proxy mounting the backend admin console at /_gm (verbatim)
-internal/webui/         # embedded UI build (go:embed dist): landing at /, SPA at /app/ + /telegram/ + /vk/
+internal/webui/         # embedded UI build (go:embed dist): landing at /, SPA at /app/ + /telegram/
 ```
 
 The FlatBuffers payloads and the backend push proto are the shared wire
@@ -54,14 +54,7 @@ them down the same link and awaits the bot's ack (ARCHITECTURE.md §10/§12). Wh
 `GATEWAY_VALIDATOR_ADDR` is unset Telegram auth is disabled; when `GATEWAY_BOTLINK_ADDR`
 is unset the bot channel (out-of-app push + admin relay) is disabled.
 
-`auth.vk` validates a VK Mini App launch **in-process** (`internal/vkauth`): it verifies the
+The message-type catalog: `auth.telegram`, `auth.guest`,
-signed `vk_*` launch parameters against the VK app's protected key (`GATEWAY_VK_APP_SECRET`) —
-HMAC-SHA256 over the sorted params, base64url — a pure offline check with no side-service or VK API
-round-trip, then forwards the trusted `vk_user_id` (and the client-read display name, which VK omits
-from the signed params) to the backend. When `GATEWAY_VK_APP_SECRET` is unset VK auth is disabled
-(`auth.vk` is unregistered).
-
-The message-type catalog: `auth.telegram`, `auth.vk`, `auth.guest`,
 `auth.email.request`, `auth.email.login`, `profile.get`, `game.submit_play`,
 `game.state`, `lobby.enqueue`, `lobby.poll`, `chat.post`, `chat.read` and the play-loop ops;
 live events
@@ -88,7 +81,6 @@ validator (`ValidateLoginWidget`) and forward the trusted `external_id`. These
 | `GATEWAY_BACKEND_TIMEOUT` | `5s` | per backend REST call |
 | `GATEWAY_ADMIN_USER` / `GATEWAY_ADMIN_PASSWORD` | unset | enable + guard the admin console at `/_gm` |
 | `GATEWAY_VALIDATOR_ADDR` | unset | Telegram validator gRPC address (enables initData / Login Widget validation) |
-| `GATEWAY_VK_APP_SECRET` | unset | VK app protected key; enables in-process VK Mini App launch-signature verification (`auth.vk`) |
 | `GATEWAY_BOTLINK_ADDR` | unset | reverse mTLS bot-link listener the remote bot dials (enables out-of-app push + admin relay) |
 | `GATEWAY_BOTLINK_RELAY_ADDR` | unset | plaintext internal listener serving the backend admin `SendToUser`/`SendToGameChannel` relay |
 | `GATEWAY_BOTLINK_TLS_CERT` / `_KEY` / `_CA` | unset | gateway server cert, its key, and the CA that signs accepted bot client certs (required when `GATEWAY_BOTLINK_ADDR` is set) |

gateway/cmd/gateway/main.go

@@ -190,11 +190,10 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		logger.Info("admin console disabled (set GATEWAY_ADMIN_USER and GATEWAY_ADMIN_PASSWORD)")
 	}
 
-	registry := transcode.NewRegistry(backend, validator, transcode.WithVKAuth(cfg.VKAppSecret))
+	registry := transcode.NewRegistry(backend, validator)
 	edge := connectsrv.NewServer(connectsrv.Deps{
 		Registry:     registry,
 		Sessions:     sessions,
-		Backend:      backend,
 		Limiter:      limiter,
 		Tracker:      tracker,
 		Banlist:      banlist,

gateway/internal/backendclient/api.go

@@ -37,11 +37,6 @@ type ProfileResp struct {
 	// Banner is the advertising-banner block, present only for a viewer eligible to
 	// see the banner. The gateway forwards it verbatim into the Profile payload.
 	Banner *BannerResp `json:"banner,omitempty"`
-	// Email is the confirmed email ("" when none); TelegramLinked/VkLinked report an
-	// attached platform identity — they drive the profile's link/unlink/change controls.
-	Email          string `json:"email"`
-	TelegramLinked bool   `json:"telegram_linked"`
-	VkLinked       bool   `json:"vk_linked"`
 }
 
 // BannerResp is the advertising-banner block of an eligible viewer's profile: the
@@ -206,23 +201,6 @@ func (c *Client) TelegramAuth(ctx context.Context, externalID, languageCode, use
 	return out, err
 }
 
-// VKAuth provisions/finds the VK account and mints a session, seeding a brand-new
-// account's preferred language from languageCode (the vk_language hint), its display
-// name from displayName (read client-side via VKWebAppGetUserInfo, since VK omits the
-// name from the signed launch params) and its time zone from browserTz (the client's
-// detected "±HH:MM" UTC offset). All seeds apply on first contact only.
-func (c *Client) VKAuth(ctx context.Context, externalID, languageCode, displayName, browserTz string) (SessionResp, error) {
-	var out SessionResp
-	err := c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/vk", "", "",
-		map[string]string{
-			"external_id":   externalID,
-			"language_code": languageCode,
-			"display_name":  displayName,
-			"browser_tz":    browserTz,
-		}, &out)
-	return out, err
-}
-
 // PushTargetResp is a recipient's out-of-app push routing data: their Telegram
 // external_id (empty when they have no Telegram identity), preferred language, and
 // whether they confined notifications to the in-app stream.
@@ -281,9 +259,9 @@ func (c *Client) GuestAuth(ctx context.Context, browserTz string) (SessionResp,
 // EmailRequest asks the backend to mail a login code, provisioning the account on
 // first contact; browserTz (the client's detected "±HH:MM" UTC offset) seeds the new
 // account's time zone, since the email account is created here, not at login.
-func (c *Client) EmailRequest(ctx context.Context, email, browserTz, language string) error {
+func (c *Client) EmailRequest(ctx context.Context, email, browserTz string) error {
 	return c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/email/request", "", "",
-		map[string]string{"email": email, "browser_tz": browserTz, "language": language}, nil)
+		map[string]string{"email": email, "browser_tz": browserTz}, nil)
 }
 
 // EmailLogin verifies a login code and mints a session.
@@ -294,23 +272,6 @@ func (c *Client) EmailLogin(ctx context.Context, email, code string) (SessionRes
 	return out, err
 }
 
-// ConfirmLinkResp is the backend's outcome of a one-tap deeplink confirmation: for a
-// login Session carries the minted credential; for a link Status is "confirmed" or
-// "merge_required".
-type ConfirmLinkResp struct {
-	Purpose string       `json:"purpose"`
-	Status  string       `json:"status"`
-	Session *SessionResp `json:"session,omitempty"`
-}
-
-// EmailConfirmLink verifies a one-tap deeplink token; the token is the authorization.
-func (c *Client) EmailConfirmLink(ctx context.Context, token string) (ConfirmLinkResp, error) {
-	var out ConfirmLinkResp
-	err := c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/email/confirm-link", "", "",
-		map[string]string{"token": token}, &out)
-	return out, err
-}
-
 // ResolveSession maps a token to its account id and guest flag (gateway
 // session-cache miss). The guest flag lets the edge gate guest-forbidden ops.
 func (c *Client) ResolveSession(ctx context.Context, token string) (string, bool, error) {
@@ -505,13 +466,6 @@ func (c *Client) Evaluate(ctx context.Context, userID, gameID string, tiles []Pl
 	return out, err
 }
 
-// DictBytes fetches the raw serialized dictionary for a (variant, version) pair,
-// backing the client-side local move preview. It returns the blob and the
-// backend's Cache-Control header, forwarded so the immutable blob is cached hard.
-func (c *Client) DictBytes(ctx context.Context, userID, variant, version string) ([]byte, string, error) {
-	return c.getRaw(ctx, "/api/v1/user/dict/"+url.PathEscape(variant)+"/"+url.PathEscape(version), userID, "Cache-Control")
-}
-
 // CheckWord looks a word up in the game's pinned dictionary. The word is carried as
 // repeated ?idx= alphabet indices; the backend echoes the decoded concrete word.
 func (c *Client) CheckWord(ctx context.Context, userID, gameID string, word []int) (WordCheckResp, error) {

gateway/internal/backendclient/api_social.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"net/http"
 	"net/url"
-	"strings"
 )
 
 // The response structs and client methods mirror the backend's social,
@@ -335,51 +334,6 @@ func (c *Client) LinkTelegramMerge(ctx context.Context, userID, externalID strin
 	return out, err
 }
 
-// ChangeEmailRequest asks the backend to mail a confirm-code to a new address for an
-// authenticated email change.
-func (c *Client) ChangeEmailRequest(ctx context.Context, userID, email string) error {
-	return c.do(ctx, http.MethodPost, "/api/v1/user/link/email/change/request", userID, "",
-		map[string]string{"email": email}, nil)
-}
-
-// ChangeEmailConfirm verifies the code and atomically switches the account's email,
-// returning the refreshed profile in the result.
-func (c *Client) ChangeEmailConfirm(ctx context.Context, userID, email, code string) (LinkResultResp, error) {
-	var out LinkResultResp
-	err := c.do(ctx, http.MethodPost, "/api/v1/user/link/email/change/confirm", userID, "",
-		map[string]string{"email": email, "code": code}, &out)
-	return out, err
-}
-
-// DeleteRequestResp reports which account-deletion step-up the account uses.
-type DeleteRequestResp struct {
-	Method string `json:"method"`
-}
-
-// DeleteRequest starts account deletion: the backend mails a delete code (email accounts)
-// or reports the typed-phrase path.
-func (c *Client) DeleteRequest(ctx context.Context, userID string) (DeleteRequestResp, error) {
-	var out DeleteRequestResp
-	err := c.do(ctx, http.MethodPost, "/api/v1/user/delete/request", userID, "", nil, &out)
-	return out, err
-}
-
-// DeleteConfirm verifies the step-up (a mailed code or the typed phrase) and deletes the
-// account.
-func (c *Client) DeleteConfirm(ctx context.Context, userID, code, phrase string) error {
-	return c.do(ctx, http.MethodPost, "/api/v1/user/delete/confirm", userID, "",
-		map[string]string{"code": code, "phrase": phrase}, nil)
-}
-
-// LinkUnlink detaches a platform identity (kind = "telegram" | "vk") from the caller
-// and returns the refreshed profile in the result.
-func (c *Client) LinkUnlink(ctx context.Context, userID, kind string) (LinkResultResp, error) {
-	var out LinkResultResp
-	err := c.do(ctx, http.MethodPost, "/api/v1/user/link/unlink", userID, "",
-		map[string]string{"kind": kind}, &out)
-	return out, err
-}
-
 // Stats returns the caller's lifetime statistics.
 func (c *Client) Stats(ctx context.Context, userID string) (StatsResp, error) {
 	var out StatsResp
@@ -393,28 +347,3 @@ func (c *Client) ExportGCG(ctx context.Context, userID, gameID string) (GcgResp,
 	err := c.do(ctx, http.MethodGet, c.gamePath(gameID, "/gcg"), userID, "", nil, &out)
 	return out, err
 }
-
-// ExportURLResp is the minted signed download link for an export artifact.
-type ExportURLResp struct {
-	Path     string `json:"path"`
-	Filename string `json:"filename"`
-}
-
-// ExportURL mints a signed download URL for a finished game's artifact (kind
-// "png" or "gcg"). dateLocale and the localized non-play labels ride the URL so
-// the server render matches the player's presentation.
-func (c *Client) ExportURL(ctx context.Context, userID, gameID, kind, dateLocale, timeZone string, labels []string) (ExportURLResp, error) {
-	q := url.Values{"kind": {kind}}
-	if dateLocale != "" {
-		q.Set("dl", dateLocale)
-	}
-	if timeZone != "" {
-		q.Set("tz", timeZone)
-	}
-	if len(labels) > 0 {
-		q.Set("t", strings.Join(labels, ","))
-	}
-	var out ExportURLResp
-	err := c.do(ctx, http.MethodGet, c.gamePath(gameID, "/export-url")+"?"+q.Encode(), userID, "", nil, &out)
-	return out, err
-}

gateway/internal/backendclient/client.go

@@ -39,18 +39,10 @@ const backendMaxIdleConns = 512
 type Client struct {
 	baseURL string
 	http    *http.Client
-	// dl serves the export downloads: the backend may wait on the render sidecar
+	conn    *grpc.ClientConn
-	// for several seconds, so these calls get their own, longer deadline than the
+	push    pushv1.PushClient
-	// ordinary REST budget.
-	dl   *http.Client
-	conn *grpc.ClientConn
-	push pushv1.PushClient
 }
 
-// exportDownloadTimeout bounds one export-download fetch end to end (the backend's
-// own sidecar budget is 15s).
-const exportDownloadTimeout = 30 * time.Second
-
 // New dials the backend push gRPC endpoint and prepares the REST client. The
 // backend lives on a trusted network segment, so the gRPC connection uses
 // insecure (plaintext) transport credentials (ARCHITECTURE.md §12).
@@ -70,39 +62,11 @@ func New(httpURL, grpcAddr string, timeout time.Duration) (*Client, error) {
 	return &Client{
 		baseURL: strings.TrimRight(httpURL, "/"),
 		http:    &http.Client{Timeout: timeout, Transport: transport},
-		dl:      &http.Client{Timeout: exportDownloadTimeout, Transport: transport},
 		conn:    conn,
 		push:    pushv1.NewPushClient(conn),
 	}, nil
 }
 
-// ExportDownload fetches a signed finished-game export artifact from the backend's
-// public group, forwarding the caller's public Host for the image footer. It returns
-// the bytes with the backend's Content-Type and Content-Disposition. rest is the
-// public path suffix after /dl (e.g. "/<game>/<kind>?e=…&s=…").
-func (c *Client) ExportDownload(ctx context.Context, rest, publicHost string) ([]byte, string, string, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+"/api/v1/public/dl"+rest, nil)
-	if err != nil {
-		return nil, "", "", fmt.Errorf("backendclient: new request: %w", err)
-	}
-	if publicHost != "" {
-		req.Header.Set("X-Public-Host", publicHost)
-	}
-	resp, err := c.dl.Do(req)
-	if err != nil {
-		return nil, "", "", fmt.Errorf("backendclient: GET export: %w", err)
-	}
-	defer func() { _ = resp.Body.Close() }()
-	data, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, "", "", fmt.Errorf("backendclient: read export: %w", err)
-	}
-	if resp.StatusCode >= http.StatusMultipleChoices {
-		return nil, "", "", parseAPIError(resp.StatusCode, data)
-	}
-	return data, resp.Header.Get("Content-Type"), resp.Header.Get("Content-Disposition"), nil
-}
-
 // Close releases the gRPC connection.
 func (c *Client) Close() error { return c.conn.Close() }
 
@@ -161,34 +125,6 @@ func (c *Client) do(ctx context.Context, method, path, userID, clientIP string,
 	return nil
 }
 
-// getRaw performs one REST GET, returning the raw (un-decoded) response body and
-// the value of respHeader (e.g. Cache-Control). userID, when non-empty, is
-// forwarded as X-User-ID. A non-2xx response is returned as an *APIError. Unlike
-// do it does not JSON-decode, so it carries a binary payload such as a dictionary
-// blob.
-func (c *Client) getRaw(ctx context.Context, path, userID, respHeader string) ([]byte, string, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+path, nil)
-	if err != nil {
-		return nil, "", fmt.Errorf("backendclient: new request: %w", err)
-	}
-	if userID != "" {
-		req.Header.Set("X-User-ID", userID)
-	}
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return nil, "", fmt.Errorf("backendclient: GET %s: %w", path, err)
-	}
-	defer func() { _ = resp.Body.Close() }()
-	data, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, "", fmt.Errorf("backendclient: read response: %w", err)
-	}
-	if resp.StatusCode >= http.StatusMultipleChoices {
-		return nil, "", parseAPIError(resp.StatusCode, data)
-	}
-	return data, resp.Header.Get(respHeader), nil
-}
-
 // parseAPIError extracts the backend's {error:{code,message}} envelope.
 func parseAPIError(status int, data []byte) *APIError {
 	var env struct {

gateway/internal/config/config.go

@@ -32,10 +32,6 @@ type Config struct {
 	// plaintext, internal). The gateway calls it to validate Mini App initData and
 	// Login Widget data. Empty disables the telegram auth path.
 	ValidatorAddr string
-	// VKAppSecret is the VK Mini App protected ("secure") key. The gateway verifies the
-	// VK launch-parameter signature in-process under it (a pure offline HMAC, no VK API
-	// round-trip). Empty disables the VK auth path (auth.vk is then unregistered).
-	VKAppSecret string
 	// BotLink configures the reverse mTLS channel to the remote Telegram bot. An
 	// empty BotLink.Addr disables the bot channel (out-of-app push and admin relay).
 	BotLink BotLinkConfig
@@ -173,7 +169,6 @@ func Load() (Config, error) {
 		AdminUser:       os.Getenv("GATEWAY_ADMIN_USER"),
 		AdminPassword:   os.Getenv("GATEWAY_ADMIN_PASSWORD"),
 		ValidatorAddr:   os.Getenv("GATEWAY_VALIDATOR_ADDR"),
-		VKAppSecret:     os.Getenv("GATEWAY_VK_APP_SECRET"),
 		SessionCacheMax: defaultSessionCacheMax,
 		RateLimit:       DefaultRateLimit(),
 		Abuse:           DefaultAbuse(),

gateway/internal/connectsrv/metrics.go

@@ -28,10 +28,6 @@ type serverMetrics struct {
 	rateLimited metric.Int64Counter
 	banned      metric.Int64Counter
 	active      *activeUsers
-	// Client-reported local move-preview adoption (see localEvalMetricsHandler).
-	localColdStart metric.Int64Counter
-	localDictLoad  metric.Int64Counter
-	localPreview   metric.Int64Counter
 }
 
 // newServerMetrics builds the instruments on meter (nil selects a no-op meter),
@@ -58,12 +54,7 @@ func newServerMetrics(meter metric.Meter) *serverMetrics {
 	if err != nil {
 		b, _ = noop.NewMeterProvider().Meter(meterName).Int64Counter("gateway_abuse_banned_total")
 	}
-	m := &serverMetrics{
+	m := &serverMetrics{edge: h, rateLimited: c, banned: b, active: newActiveUsers()}
-		edge: h, rateLimited: c, banned: b, active: newActiveUsers(),
-		localColdStart: counterOf(meter, "local_eval_cold_start_total", "App cold starts reported by clients — the denominator for local-move-preview adoption."),
-		localDictLoad:  counterOf(meter, "local_eval_dict_load_total", "Client dictionary loads for the local move preview, by result (fetched, cache_hit or miss)."),
-		localPreview:   counterOf(meter, "local_eval_preview_total", "Client move previews, by path (local on-device, or network fallback)."),
-	}
 
 	gauge, err := meter.Int64ObservableGauge("active_users",
 		metric.WithDescription("Distinct accounts that performed an authenticated action within the window (in-memory, single gateway instance)."))
@@ -107,40 +98,3 @@ func (m *serverMetrics) recordRateLimited(ctx context.Context, class string) {
 func (m *serverMetrics) recordBan(ctx context.Context, reason string) {
 	m.banned.Add(ctx, 1, metric.WithAttributes(attribute.String("reason", reason)))
 }
-
-// localEvalReport is the client-reported local move-preview telemetry batch — deltas since
-// the client's previous report. It backs the adoption dashboard: app cold starts vs cached
-// dictionaries vs on-device previews.
-type localEvalReport struct {
-	ColdStart      int `json:"cold_start"`
-	DictFetched    int `json:"dict_fetched"`
-	DictCacheHit   int `json:"dict_cache_hit"`
-	DictMiss       int `json:"dict_miss"`
-	PreviewLocal   int `json:"preview_local"`
-	PreviewNetwork int `json:"preview_network"`
-}
-
-// recordLocalEval folds one client report into the edge's local-eval counters.
-func (m *serverMetrics) recordLocalEval(ctx context.Context, r localEvalReport) {
-	add := func(c metric.Int64Counter, n int, opts ...metric.AddOption) {
-		if n > 0 {
-			c.Add(ctx, int64(n), opts...)
-		}
-	}
-	add(m.localColdStart, r.ColdStart)
-	add(m.localDictLoad, r.DictFetched, metric.WithAttributes(attribute.String("result", "fetched")))
-	add(m.localDictLoad, r.DictCacheHit, metric.WithAttributes(attribute.String("result", "cache_hit")))
-	add(m.localDictLoad, r.DictMiss, metric.WithAttributes(attribute.String("result", "miss")))
-	add(m.localPreview, r.PreviewLocal, metric.WithAttributes(attribute.String("path", "local")))
-	add(m.localPreview, r.PreviewNetwork, metric.WithAttributes(attribute.String("path", "network")))
-}
-
-// counterOf builds an Int64Counter on meter, falling back to a no-op on the rare
-// construction error so metrics never fail startup.
-func counterOf(meter metric.Meter, name, desc string) metric.Int64Counter {
-	c, err := meter.Int64Counter(name, metric.WithDescription(desc))
-	if err != nil {
-		c, _ = noop.NewMeterProvider().Meter(meterName).Int64Counter(name)
-	}
-	return c
-}

gateway/internal/connectsrv/server.go

@@ -7,12 +7,9 @@
 package connectsrv
 
 import (
-	"bytes"
 	"context"
 	"crypto/subtle"
-	"encoding/json"
 	"errors"
-	"io"
 	"net"
 	"net/http"
 	"strings"
@@ -71,7 +68,6 @@ const (
 type Server struct {
 	registry   *transcode.Registry
 	sessions   *session.Cache
-	backend    *backendclient.Client
 	limiter    *ratelimit.Limiter
 	tracker    *ratelimit.Tracker
 	banlist    *ratelimit.Banlist
@@ -95,10 +91,7 @@ type Server struct {
 type Deps struct {
 	Registry *transcode.Registry
 	Sessions *session.Cache
-	// Backend is the REST client backing the session-gated /dict blob route; a nil
+	Limiter  *ratelimit.Limiter
-	// value disables that route (it 404s).
-	Backend *backendclient.Client
-	Limiter *ratelimit.Limiter
 	// Tracker accumulates limiter rejections for the periodic report; nil
 	// selects a private tracker (rejections are then only counted, never
 	// reported).
@@ -149,7 +142,6 @@ func NewServer(d Deps) *Server {
 	return &Server{
 		registry:     d.Registry,
 		sessions:     d.Sessions,
-		backend:      d.Backend,
 		limiter:      limiter,
 		tracker:      tracker,
 		banlist:      banlist,
@@ -191,21 +183,14 @@ func (s *Server) HTTPHandler() http.Handler {
 		// does not serve the app shell at the operator path.
 		mux.Handle("/_gm/", http.NotFoundHandler())
 	}
-	// The client-side local move preview pulls each game's pinned dictionary blob
+	// The embedded UI: the game SPA under /app/ (web) and /telegram/ (the Telegram
-	// through this session-gated route (not public); see dictBytesHandler.
+	// Mini App) — the single-origin model (docs/ARCHITECTURE.md §13). Both sit below
-	mux.Handle("/dict/", s.dictBytesHandler())
+	// the h2c wrap so the Connect edge (a more specific prefix) keeps priority, and
-	mux.Handle("/dl/", s.exportDownloadHandler())
+	// each mount falls back to the app shell (index.html) for the hash router. The
-	// The client posts its local-move-preview adoption telemetry here (session-gated).
+	// public landing lives in its own static container behind the contour caddy,
-	mux.Handle("/metrics/local-eval", s.localEvalMetricsHandler())
+	// so the catch-all redirects a stray root hit to the app shell — which
-	// The embedded UI: the game SPA under /app/ (web), /telegram/ (the Telegram Mini
+	// keeps a local no-caddy run usable.
-	// App) and /vk/ (the VK Mini App) — the single-origin model (docs/ARCHITECTURE.md
-	// §13). All sit below the h2c wrap so the Connect edge (a more specific prefix) keeps
-	// priority, and each mount falls back to the app shell (index.html) for the hash
-	// router. The public landing lives in its own static container behind the contour
-	// caddy, so the catch-all redirects a stray root hit to the app shell — which keeps a
-	// local no-caddy run usable.
 	mux.Handle("/telegram/", webui.Handler("/telegram/", "index.html"))
-	mux.Handle("/vk/", webui.Handler("/vk/", "index.html"))
 	mux.Handle("/app/", webui.Handler("/app/", "index.html"))
 	mux.Handle("/", http.RedirectHandler("/app/", http.StatusPermanentRedirect))
 	// abuseGuard is the outermost wrap (right under h2c) so a banned IP or a
@@ -411,177 +396,6 @@ func (s *Server) limitAdmin(next http.Handler) http.Handler {
 	})
 }
 
-// dictBytesHandler serves the raw dictionary blob for a (variant, version) pair to
-// a signed-in client (the local move preview), proxying the backend's authed
-// endpoint. It is session-gated — not public — bounds the download with the
-// user-class limiter, and forwards the backend's immutable Cache-Control so the
-// browser caches the blob hard. Only GET is allowed; the path is
-// /dict/{variant}/{version}.
-// exportDownloadHandler serves the signed finished-game export downloads (/dl/*).
-// It is the gateway's only unauthenticated data route: the platforms' native
-// download calls (Telegram downloadFile, VKWebAppDownloadFile, a plain anchor)
-// carry no session, so the URL's HMAC — verified by the backend — is the whole
-// grant. The gateway only rate-limits by IP and forwards, passing the public Host
-// along for the image footer.
-func (s *Server) exportDownloadHandler() http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if s.backend == nil {
-			http.NotFound(w, r)
-			return
-		}
-		if r.Method != http.MethodGet {
-			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-			return
-		}
-		ip := peerIP(r.RemoteAddr, r.Header)
-		if !s.limiter.Allow("public:"+ip, s.publicPolicy) {
-			s.noteRateLimited(r.Context(), classPublic, ip, "export-dl")
-			http.Error(w, "rate limited", http.StatusTooManyRequests)
-			return
-		}
-		rest := strings.TrimPrefix(r.URL.Path, "/dl")
-		if rest == "" || rest == "/" {
-			http.NotFound(w, r)
-			return
-		}
-		if r.URL.RawQuery != "" {
-			rest += "?" + r.URL.RawQuery
-		}
-		data, contentType, disposition, err := s.backend.ExportDownload(r.Context(), rest, r.Host)
-		if err != nil {
-			var apiErr *backendclient.APIError
-			if errors.As(err, &apiErr) && apiErr.Status < http.StatusInternalServerError {
-				http.NotFound(w, r) // invalid, expired or unknown link
-				return
-			}
-			s.log.Warn("export download failed", zap.Error(err))
-			http.Error(w, "bad gateway", http.StatusBadGateway)
-			return
-		}
-		if contentType != "" {
-			w.Header().Set("Content-Type", contentType)
-		}
-		if disposition != "" {
-			w.Header().Set("Content-Disposition", disposition)
-		}
-		w.Header().Set("X-Content-Type-Options", "nosniff")
-		w.Header().Set("Cache-Control", "private, max-age=0")
-		// ServeContent (not a bare Write): the platforms' native downloaders are picky —
-		// Android's system DownloadManager (the VKWebAppDownloadFile executor) hangs on a
-		// chunked body of unknown length and may probe with Range. ServeContent emits
-		// Content-Length, honours Range/If-* and answers 206s from the buffered artifact.
-		http.ServeContent(w, r, "", time.Time{}, bytes.NewReader(data))
-	})
-}
-
-func (s *Server) dictBytesHandler() http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if s.backend == nil {
-			http.NotFound(w, r)
-			return
-		}
-		if r.Method != http.MethodGet {
-			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-			return
-		}
-		ip := peerIP(r.RemoteAddr, r.Header)
-		if !s.limiter.Allow("user:"+ip, s.userPolicy) {
-			s.noteRateLimited(r.Context(), classUser, ip, "dict")
-			http.Error(w, "rate limited", http.StatusTooManyRequests)
-			return
-		}
-		uid, _, err := s.resolve(r.Context(), r.Header, ip)
-		if err != nil {
-			http.Error(w, "unauthorized", http.StatusUnauthorized)
-			return
-		}
-		variant, version, ok := parseDictPath(r.URL.Path)
-		if !ok {
-			http.NotFound(w, r)
-			return
-		}
-		data, cacheControl, err := s.backend.DictBytes(r.Context(), uid, variant, version)
-		if err != nil {
-			var apiErr *backendclient.APIError
-			if errors.As(err, &apiErr) && apiErr.Status < http.StatusInternalServerError {
-				http.NotFound(w, r) // unknown variant or version
-				return
-			}
-			s.log.Warn("dict fetch failed", zap.Error(err))
-			http.Error(w, "bad gateway", http.StatusBadGateway)
-			return
-		}
-		if cacheControl != "" {
-			w.Header().Set("Cache-Control", cacheControl)
-		}
-		w.Header().Set("Content-Type", "application/octet-stream")
-		_, _ = w.Write(data)
-	})
-}
-
-// parseDictPath splits /dict/{variant}/{version}; both segments must be present
-// and non-empty, and the version must not contain a further slash.
-func parseDictPath(p string) (variant, version string, ok bool) {
-	rest, found := strings.CutPrefix(p, "/dict/")
-	if !found {
-		return "", "", false
-	}
-	i := strings.IndexByte(rest, '/')
-	if i <= 0 || i == len(rest)-1 {
-		return "", "", false
-	}
-	variant, version = rest[:i], rest[i+1:]
-	if strings.Contains(version, "/") {
-		return "", "", false
-	}
-	return variant, version, true
-}
-
-// localEvalMetricsHandler ingests a client's local move-preview telemetry batch into the
-// edge's adoption counters (docs/ARCHITECTURE.md §11). Session-gated so only real clients
-// report; the values are aggregate (no per-user attributes) and clamped against a spoofed
-// inflation. Only POST; the body is a small JSON of per-metric deltas.
-func (s *Server) localEvalMetricsHandler() http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodPost {
-			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-			return
-		}
-		ip := peerIP(r.RemoteAddr, r.Header)
-		if _, _, err := s.resolve(r.Context(), r.Header, ip); err != nil {
-			http.Error(w, "unauthorized", http.StatusUnauthorized)
-			return
-		}
-		var rep localEvalReport
-		if err := json.NewDecoder(io.LimitReader(r.Body, 512)).Decode(&rep); err != nil {
-			http.Error(w, "bad request", http.StatusBadRequest)
-			return
-		}
-		clampReport(&rep)
-		s.metrics.recordLocalEval(r.Context(), rep)
-		w.WriteHeader(http.StatusNoContent)
-	})
-}
-
-// clampReport bounds each counter of a client report against a spoofed inflation — one batch
-// reflects at most a few minutes of a single client's activity.
-func clampReport(r *localEvalReport) {
-	const maxPerField = 1000
-	clamp := func(n *int) {
-		if *n < 0 {
-			*n = 0
-		} else if *n > maxPerField {
-			*n = maxPerField
-		}
-	}
-	clamp(&r.ColdStart)
-	clamp(&r.DictFetched)
-	clamp(&r.DictCacheHit)
-	clamp(&r.DictMiss)
-	clamp(&r.PreviewLocal)
-	clamp(&r.PreviewNetwork)
-}
-
 // resolve extracts and resolves the Authorization bearer token to an account id
 // and its guest flag, returning a Connect Unauthenticated error when it is missing
 // or unknown.

gateway/internal/transcode/encode.go

@@ -37,46 +37,6 @@ func encodeAck(ok bool) []byte {
 	return b.FinishedBytes()
 }
 
-// encodeDeleteRequestResult builds an AccountDeleteRequestResult payload reporting which
-// deletion step-up the account uses ("email" | "phrase").
-func encodeDeleteRequestResult(method string) []byte {
-	b := flatbuffers.NewBuilder(32)
-	m := b.CreateString(method)
-	fb.AccountDeleteRequestResultStart(b)
-	fb.AccountDeleteRequestResultAddMethod(b, m)
-	b.Finish(fb.AccountDeleteRequestResultEnd(b))
-	return b.FinishedBytes()
-}
-
-// encodeConfirmLinkResult builds an EmailConfirmLinkResult payload, embedding the
-// minted Session for a login. All strings and the nested Session table are built
-// before the result table is opened.
-func encodeConfirmLinkResult(r backendclient.ConfirmLinkResp) []byte {
-	b := flatbuffers.NewBuilder(160)
-	purpose := b.CreateString(r.Purpose)
-	status := b.CreateString(r.Status)
-	var session flatbuffers.UOffsetT
-	if r.Session != nil {
-		token := b.CreateString(r.Session.Token)
-		uid := b.CreateString(r.Session.UserID)
-		name := b.CreateString(r.Session.DisplayName)
-		fb.SessionStart(b)
-		fb.SessionAddToken(b, token)
-		fb.SessionAddUserId(b, uid)
-		fb.SessionAddIsGuest(b, r.Session.IsGuest)
-		fb.SessionAddDisplayName(b, name)
-		session = fb.SessionEnd(b)
-	}
-	fb.EmailConfirmLinkResultStart(b)
-	fb.EmailConfirmLinkResultAddPurpose(b, purpose)
-	fb.EmailConfirmLinkResultAddStatus(b, status)
-	if r.Session != nil {
-		fb.EmailConfirmLinkResultAddSession(b, session)
-	}
-	b.Finish(fb.EmailConfirmLinkResultEnd(b))
-	return b.FinishedBytes()
-}
-
 // encodeProfile builds a Profile payload, including the advertising-banner block
 // when the backend marked the viewer eligible.
 func encodeProfile(p backendclient.ProfileResp) []byte {
@@ -87,7 +47,6 @@ func encodeProfile(p backendclient.ProfileResp) []byte {
 	tz := b.CreateString(p.TimeZone)
 	awayStart := b.CreateString(p.AwayStart)
 	awayEnd := b.CreateString(p.AwayEnd)
-	email := b.CreateString(p.Email)
 	// Build the banner table (and its children) before opening Profile: FlatBuffers
 	// forbids a nested table while another is under construction.
 	var banner flatbuffers.UOffsetT
@@ -108,9 +67,6 @@ func encodeProfile(p backendclient.ProfileResp) []byte {
 	fb.ProfileAddAwayEnd(b, awayEnd)
 	fb.ProfileAddNotificationsInAppOnly(b, p.NotificationsInAppOnly)
 	fb.ProfileAddVariantPreferences(b, prefs)
-	fb.ProfileAddEmail(b, email)
-	fb.ProfileAddTelegramLinked(b, p.TelegramLinked)
-	fb.ProfileAddVkLinked(b, p.VkLinked)
 	if p.Banner != nil {
 		fb.ProfileAddBanner(b, banner)
 	}

gateway/internal/transcode/encode_social.go

@@ -251,18 +251,6 @@ func encodeInvitationList(r backendclient.InvitationListResp) []byte {
 	return b.FinishedBytes()
 }
 
-// encodeExportURL builds an ExportUrl payload.
-func encodeExportURL(r backendclient.ExportURLResp) []byte {
-	b := flatbuffers.NewBuilder(256)
-	path := b.CreateString(r.Path)
-	fn := b.CreateString(r.Filename)
-	fb.ExportUrlStart(b)
-	fb.ExportUrlAddPath(b, path)
-	fb.ExportUrlAddFilename(b, fn)
-	b.Finish(fb.ExportUrlEnd(b))
-	return b.FinishedBytes()
-}
-
 // encodeGcg builds a GcgExport payload.
 func encodeGcg(r backendclient.GcgResp) []byte {
 	b := flatbuffers.NewBuilder(1024)