Merge pull request 'release: v1.4.0 — Telegram launch diagnostic + dynamic SDK load' (#127 ) from development into master

Merge pull request 'feat(ui): diagnostic screen on /telegram/ instead of the landing bounce' (#126 ) from feature/telegram-launch-diagnostic into development
feat(ui): record the SDK load outcome in the launch diagnostic
2026-06-23 08:40:09 +00:00 · 2026-06-23 08:32:18 +00:00 · 2026-06-23 10:18:02 +02:00 · 2026-06-23 09:59:24 +02:00 · 2026-06-23 09:37:36 +02:00 · 2026-06-22 22:36:42 +00:00
140 changed files with 4395 additions and 3141 deletions
@@ -31,7 +31,7 @@ on:
 # unit/integration jobs inherit it. The deploy job overrides it per contour with
 # vars.TEST_DICT_VERSION (the seed for a fresh volume), see deploy/README.md.
 env:
-  DICT_VERSION: v1.2.1
+  DICT_VERSION: v1.3.0
 jobs:
  # changes detects which areas a PR/push touched, so the test jobs can skip when
@@ -301,8 +301,11 @@ jobs:
          # App version for the About screen: the git tag if present, else the short SHA
          # (the test checkout is shallow/untagged, so this is the SHA here — fine).
          export APP_VERSION="$(git -C "$GITHUB_WORKSPACE" describe --tags --always 2>/dev/null || echo dev)"
-          docker compose --ansi never build --progress plain
+          # The telegram-local profile brings the bot + its VPN sidecar; prod runs the
-          docker compose --ansi never up -d --remove-orphans
+          # bot on its own host instead (deploy/docker-compose.bot.yml), and the prod
          # main host omits both. Without the profile they would not start here.
          docker compose --ansi never --profile telegram-local build --progress plain
          docker compose --ansi never --profile telegram-local up -d --remove-orphans
          # The config-only services bind-mount the reseeded config dir. A plain `up -d`
          # leaves them on the previous bind mount (the dir was rm'd + recreated), so a
          # changed Caddyfile or Grafana dashboard is ignored — force-recreate them to
@@ -0,0 +1,266 @@
 # Manual production rollout. Runs ONLY from master, ONLY on workflow_dispatch with
 # confirm=deploy (development->master is merged + green first; this is the separate,
 # deliberate prod step). Visible sequential jobs from most to least significant:
 #   build -> deploy-main -> deploy-bot -> verify
 # The per-service rolling (postgres->backend->gateway->landing->validator->caddy),
 # health-gating and auto-rollback live in deploy/prod-deploy.sh on the main host and
 # show in the deploy-main log. Manual post-deploy rollback is prod-rollback.yaml.
 # See deploy/README.md (prod runbook).
 name: prod-deploy
 run-name: "prod deploy ${{ github.sha }}"
 on:
  workflow_dispatch:
    inputs:
      confirm:
        description: 'Type "deploy" to confirm a production rollout from master.'
        required: true
        default: ""
 permissions:
  contents: read
 env:
  NO_COLOR: "1"
  DOCKER_CLI_HINTS: "false"
  REGISTRY: docker.iliadenisov.ru/developer
 jobs:
  build:
    if: ${{ github.ref == 'refs/heads/master' && inputs.confirm == 'deploy' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    outputs:
      tag: ${{ steps.ver.outputs.tag }}
    env:
      PROD_REGISTRY_USER: ${{ vars.PROD_REGISTRY_USER }}
      PROD_REGISTRY_PASSWORD: ${{ secrets.PROD_REGISTRY_PASSWORD }}
      VITE_TELEGRAM_BOT_ID: ${{ vars.PROD_VITE_TELEGRAM_BOT_ID }}
      VITE_TELEGRAM_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
      VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.PROD_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
      VITE_GATEWAY_URL: ${{ vars.PROD_VITE_GATEWAY_URL }}
      POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }}
      GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Compute version tag
        id: ver
        run: echo "tag=$(git describe --tags --always)" >> "$GITHUB_OUTPUT"
      - name: Registry login
        run: echo "$PROD_REGISTRY_PASSWORD" | docker login "${REGISTRY%%/*}" -u "$PROD_REGISTRY_USER" --password-stdin
      - name: Build and push images
        working-directory: deploy
        run: |
          export TAG="${{ steps.ver.outputs.tag }}" APP_VERSION="${{ steps.ver.outputs.tag }}" SCRABBLE_CONFIG_DIR=.
          # The four main-stack images via compose (reuses the build args, incl. VERSION);
          # the bot separately, since it is profiled out of the prod compose.
          docker compose -f docker-compose.yml -f docker-compose.prod.yml build
          docker compose -f docker-compose.yml -f docker-compose.prod.yml push backend gateway landing validator
          docker build -f ../platform/telegram/Dockerfile --target bot --build-arg VERSION="$TAG" -t "$REGISTRY/scrabble-telegram-bot:$TAG" ..
          docker push "$REGISTRY/scrabble-telegram-bot:$TAG"
  deploy-main:
    needs: build
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      TAG: ${{ needs.build.outputs.tag }}
      PROD_REGISTRY_USER: ${{ vars.PROD_REGISTRY_USER }}
      PROD_REGISTRY_PASSWORD: ${{ secrets.PROD_REGISTRY_PASSWORD }}
      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
      POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }}
      GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
      GRAFANA_ADMIN_PASSWORD: ${{ secrets.PROD_GRAFANA_ADMIN_PASSWORD }}
      TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
      PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
      PROD_BOTLINK_GATEWAY_CERT: ${{ secrets.PROD_BOTLINK_GATEWAY_CERT }}
      PROD_BOTLINK_GATEWAY_KEY: ${{ secrets.PROD_BOTLINK_GATEWAY_KEY }}
      GM_BASICAUTH_USER: ${{ vars.PROD_GM_BASICAUTH_USER }}
      GRAFANA_ROOT_URL: ${{ vars.PROD_GRAFANA_ROOT_URL }}
      CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
      LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
      POSTGRES_DB: ${{ vars.PROD_POSTGRES_DB }}
      POSTGRES_USER: ${{ vars.PROD_POSTGRES_USER }}
      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
      - name: Determine previous tag and migration
        run: |
          ssh_main() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "$@"; }
          PREV_TAG="$(ssh_main 'cat /opt/scrabble/DEPLOYED_TAG 2>/dev/null || echo none')"
          MIGRATION=0
          if [ "$PREV_TAG" != none ]; then
            if ! git cat-file -e "$PREV_TAG^{commit}" 2>/dev/null; then
              MIGRATION=1
            elif git diff --name-only "$PREV_TAG..$TAG" -- backend/internal/postgres/migrations/ | grep -q .; then
              MIGRATION=1
            fi
          fi
          { echo "PREV_TAG=$PREV_TAG"; echo "MIGRATION=$MIGRATION"; } >> "$GITHUB_ENV"
          echo "prev=$PREV_TAG migration=$MIGRATION"
      - name: Render main env + certs
        run: |
          umask 077
          mkdir -p stage/certs-main
          cat > stage/env.sh <<EOF
          export REGISTRY='$REGISTRY'
          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
          export POSTGRES_DB='${POSTGRES_DB:-scrabble}'
          export POSTGRES_USER='${POSTGRES_USER:-scrabble}'
          export POSTGRES_PASSWORD='$POSTGRES_PASSWORD'
          export GM_BASICAUTH_USER='${GM_BASICAUTH_USER:-gm}'
          export GM_BASICAUTH_HASH='$GM_BASICAUTH_HASH'
          export GRAFANA_ADMIN_PASSWORD='$GRAFANA_ADMIN_PASSWORD'
          export GRAFANA_ROOT_URL='$GRAFANA_ROOT_URL'
          export CADDY_SITE_ADDRESS='$CADDY_SITE_ADDRESS'
          export LOG_LEVEL='${LOG_LEVEL:-info}'
          export DICT_VERSION='$DICT_VERSION'
          export APP_VERSION='$TAG'
          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
          export GATEWAY_ABUSE_BAN_ENABLED='true'
          EOF
          printf '%s\n' "$PROD_BOTLINK_CA"           > stage/certs-main/ca.crt
          printf '%s\n' "$PROD_BOTLINK_GATEWAY_CERT" > stage/certs-main/gateway.crt
          printf '%s\n' "$PROD_BOTLINK_GATEWAY_KEY"  > stage/certs-main/gateway.key
          chmod 644 stage/certs-main/*
      - name: Deploy the main host
        run: |
          ssh_main() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "$@"; }
          ssh_main 'mkdir -p /opt/scrabble/compose'
          tar -C deploy -czf - docker-compose.yml docker-compose.prod.yml prod-deploy.sh \
            | ssh_main 'tar -C /opt/scrabble/compose -xzf -'
          tar -C deploy -czf - caddy otelcol prometheus tempo grafana \
            | ssh_main 'tar -C /opt/scrabble -xzf -'
          tar -C stage -czf - certs-main \
            | ssh_main 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
          scp -i ~/.ssh/id_deploy -o BatchMode=yes stage/env.sh "deploy@$MAIN_HOST:/opt/scrabble/env.sh"
          echo "$PROD_REGISTRY_PASSWORD" | ssh_main "docker login ${REGISTRY%%/*} -u $PROD_REGISTRY_USER --password-stdin"
          ssh_main "TAG='$TAG' PREV_TAG='$PREV_TAG' MIGRATION='$MIGRATION' bash /opt/scrabble/compose/prod-deploy.sh"
  deploy-bot:
    needs: [build, deploy-main]
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      TAG: ${{ needs.build.outputs.tag }}
      PROD_REGISTRY_USER: ${{ vars.PROD_REGISTRY_USER }}
      PROD_REGISTRY_PASSWORD: ${{ secrets.PROD_REGISTRY_PASSWORD }}
      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
      TG_HOST: ${{ vars.PROD_TG_HOST }}
      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
      TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
      TELEGRAM_PROMO_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_PROMO_BOT_TOKEN }}
      PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
      PROD_BOTLINK_BOT_CERT: ${{ secrets.PROD_BOTLINK_BOT_CERT }}
      PROD_BOTLINK_BOT_KEY: ${{ secrets.PROD_BOTLINK_BOT_KEY }}
      LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
      TELEGRAM_GAME_CHANNEL_ID: ${{ vars.PROD_TELEGRAM_GAME_CHANNEL_ID }}
      TELEGRAM_CHAT_ID: ${{ vars.PROD_TELEGRAM_CHAT_ID }}
      TELEGRAM_BOT_USERNAME: ${{ vars.PROD_TELEGRAM_BOT_USERNAME }}
      TELEGRAM_BOT_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
      - name: Render bot env + certs
        run: |
          umask 077
          mkdir -p stage/certs-bot
          cat > stage/env.bot.sh <<EOF
          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
          export BOT_IMAGE='$REGISTRY/scrabble-telegram-bot:$TAG'
          export BOTLINK_GATEWAY_ADDR='$MAIN_HOST:9443'
          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
          export TELEGRAM_GAME_CHANNEL_ID='$TELEGRAM_GAME_CHANNEL_ID'
          export TELEGRAM_CHAT_ID='$TELEGRAM_CHAT_ID'
          export TELEGRAM_PROMO_BOT_TOKEN='$TELEGRAM_PROMO_BOT_TOKEN'
          export TELEGRAM_BOT_USERNAME='$TELEGRAM_BOT_USERNAME'
          export TELEGRAM_BOT_LINK='$TELEGRAM_BOT_LINK'
          export LOG_LEVEL='${LOG_LEVEL:-info}'
          EOF
          printf '%s\n' "$PROD_BOTLINK_CA"       > stage/certs-bot/ca.crt
          printf '%s\n' "$PROD_BOTLINK_BOT_CERT" > stage/certs-bot/bot.crt
          printf '%s\n' "$PROD_BOTLINK_BOT_KEY"  > stage/certs-bot/bot.key
          chmod 644 stage/certs-bot/*
      - name: Deploy the bot host
        run: |
          ssh_tg() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$TG_HOST" "$@"; }
          ssh_tg 'mkdir -p /opt/scrabble/compose'
          tar -C deploy -czf - docker-compose.bot.yml | ssh_tg 'tar -C /opt/scrabble/compose -xzf -'
          tar -C stage -czf - certs-bot \
            | ssh_tg 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
          scp -i ~/.ssh/id_deploy -o BatchMode=yes stage/env.bot.sh "deploy@$TG_HOST:/opt/scrabble/env.bot.sh"
          echo "$PROD_REGISTRY_PASSWORD" | ssh_tg "docker login ${REGISTRY%%/*} -u $PROD_REGISTRY_USER --password-stdin"
          ssh_tg 'set -a; . /opt/scrabble/env.bot.sh; set +a; cd /opt/scrabble/compose;
            docker compose -f docker-compose.bot.yml pull;
            docker compose -f docker-compose.bot.yml up -d'
          ssh_tg 'for i in $(seq 1 20); do
              s=$(docker inspect -f "{{.State.Status}}" scrabble-telegram-bot 2>/dev/null || echo missing)
              r=$(docker inspect -f "{{.State.Restarting}}" scrabble-telegram-bot 2>/dev/null || echo true)
              if [ "$s" = running ] && [ "$r" = false ]; then
                c1=$(docker inspect -f "{{.RestartCount}}" scrabble-telegram-bot); sleep 5
                c2=$(docker inspect -f "{{.RestartCount}}" scrabble-telegram-bot)
                [ "$c1" = "$c2" ] && { echo "bot healthy"; exit 0; }
              fi
              sleep 3
            done
            echo "bot not healthy:"; docker logs --tail 80 scrabble-telegram-bot; exit 1'
  verify:
    needs: [deploy-main, deploy-bot]
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
      CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
    steps:
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
      - name: Verify the public site
        run: |
          domain="${CADDY_SITE_ADDRESS%% *}"
          ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "for i in \$(seq 1 20); do
              if curl -fsS -k --resolve $domain:443:127.0.0.1 https://$domain/ -o /dev/null &&
                 curl -fsS -k --resolve $domain:443:127.0.0.1 https://$domain/app/ -o /dev/null &&
                 docker run --rm --network scrabble-internal alpine:3.20 wget -q -T 5 -O /dev/null http://backend:8080/readyz; then
                echo 'public site + /app/ + backend healthy'; exit 0
              fi
              sleep 5
            done
            echo 'public verify failed; recent caddy + gateway + backend logs:'
            docker logs --tail 40 scrabble-caddy; docker logs --tail 40 scrabble-gateway; docker logs --tail 40 scrabble-backend
            exit 1"
@@ -0,0 +1,223 @@
 # Manual production rollback. Runs ONLY from master, ONLY on workflow_dispatch with
 # confirm=rollback. Re-deploys an already-published image tag (no build): leave
 # target_version blank to roll back to the previously deployed version (read from the
 # main host), or set it to a specific release tag from the Releases page. The
 # re-deploy is the same rolling, health-gated path as prod-deploy (TAG=target,
 # MIGRATION=0 — rollback is image-only and never migrates the DB; image rollback is
 # DB-safe under the expand-contract rule). See deploy/README.md (prod runbook).
 name: prod-rollback
 run-name: "prod rollback ${{ inputs.target_version || 'previous' }}"
 on:
  workflow_dispatch:
    inputs:
      confirm:
        description: 'Type "rollback" to confirm a production rollback.'
        required: true
        default: ""
      target_version:
        description: "Release tag to roll back to (blank = the previous deployed version)."
        required: false
        default: ""
 permissions:
  contents: read
 env:
  NO_COLOR: "1"
  DOCKER_CLI_HINTS: "false"
  REGISTRY: docker.iliadenisov.ru/developer
 jobs:
  rollback-main:
    if: ${{ github.ref == 'refs/heads/master' && inputs.confirm == 'rollback' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    outputs:
      target: ${{ steps.resolve.outputs.target }}
    env:
      PROD_REGISTRY_USER: ${{ vars.PROD_REGISTRY_USER }}
      PROD_REGISTRY_PASSWORD: ${{ secrets.PROD_REGISTRY_PASSWORD }}
      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
      POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }}
      GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
      GRAFANA_ADMIN_PASSWORD: ${{ secrets.PROD_GRAFANA_ADMIN_PASSWORD }}
      TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
      PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
      PROD_BOTLINK_GATEWAY_CERT: ${{ secrets.PROD_BOTLINK_GATEWAY_CERT }}
      PROD_BOTLINK_GATEWAY_KEY: ${{ secrets.PROD_BOTLINK_GATEWAY_KEY }}
      GM_BASICAUTH_USER: ${{ vars.PROD_GM_BASICAUTH_USER }}
      GRAFANA_ROOT_URL: ${{ vars.PROD_GRAFANA_ROOT_URL }}
      CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
      LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
      POSTGRES_DB: ${{ vars.PROD_POSTGRES_DB }}
      POSTGRES_USER: ${{ vars.PROD_POSTGRES_USER }}
      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
      INPUT_TARGET: ${{ inputs.target_version }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
      - name: Resolve rollback target
        id: resolve
        run: |
          ssh_main() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "$@"; }
          CURRENT="$(ssh_main 'cat /opt/scrabble/DEPLOYED_TAG 2>/dev/null || echo none')"
          if [ -n "$INPUT_TARGET" ]; then
            TARGET="$INPUT_TARGET"
          else
            TARGET="$(ssh_main 'cat /opt/scrabble/PREVIOUS_TAG 2>/dev/null || echo none')"
          fi
          if [ -z "$TARGET" ] || [ "$TARGET" = none ]; then
            echo "no rollback target (no PREVIOUS_TAG on the host and no target_version input)"; exit 1
          fi
          if [ "$TARGET" = "$CURRENT" ]; then
            echo "target $TARGET is already the deployed version; nothing to do"; exit 1
          fi
          echo "rolling back: current=$CURRENT -> target=$TARGET"
          echo "target=$TARGET" >> "$GITHUB_OUTPUT"
          { echo "TARGET=$TARGET"; echo "CURRENT=$CURRENT"; } >> "$GITHUB_ENV"
      - name: Render main env + certs
        run: |
          umask 077
          mkdir -p stage/certs-main
          cat > stage/env.sh <<EOF
          export REGISTRY='$REGISTRY'
          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
          export POSTGRES_DB='${POSTGRES_DB:-scrabble}'
          export POSTGRES_USER='${POSTGRES_USER:-scrabble}'
          export POSTGRES_PASSWORD='$POSTGRES_PASSWORD'
          export GM_BASICAUTH_USER='${GM_BASICAUTH_USER:-gm}'
          export GM_BASICAUTH_HASH='$GM_BASICAUTH_HASH'
          export GRAFANA_ADMIN_PASSWORD='$GRAFANA_ADMIN_PASSWORD'
          export GRAFANA_ROOT_URL='$GRAFANA_ROOT_URL'
          export CADDY_SITE_ADDRESS='$CADDY_SITE_ADDRESS'
          export LOG_LEVEL='${LOG_LEVEL:-info}'
          export DICT_VERSION='$DICT_VERSION'
          export APP_VERSION='$TARGET'
          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
          export GATEWAY_ABUSE_BAN_ENABLED='true'
          EOF
          printf '%s\n' "$PROD_BOTLINK_CA"           > stage/certs-main/ca.crt
          printf '%s\n' "$PROD_BOTLINK_GATEWAY_CERT" > stage/certs-main/gateway.crt
          printf '%s\n' "$PROD_BOTLINK_GATEWAY_KEY"  > stage/certs-main/gateway.key
          chmod 644 stage/certs-main/*
      - name: Roll the main host back
        run: |
          ssh_main() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "$@"; }
          ssh_main 'mkdir -p /opt/scrabble/compose'
          tar -C deploy -czf - docker-compose.yml docker-compose.prod.yml prod-deploy.sh \
            | ssh_main 'tar -C /opt/scrabble/compose -xzf -'
          tar -C deploy -czf - caddy otelcol prometheus tempo grafana \
            | ssh_main 'tar -C /opt/scrabble -xzf -'
          tar -C stage -czf - certs-main \
            | ssh_main 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
          scp -i ~/.ssh/id_deploy -o BatchMode=yes stage/env.sh "deploy@$MAIN_HOST:/opt/scrabble/env.sh"
          echo "$PROD_REGISTRY_PASSWORD" | ssh_main "docker login ${REGISTRY%%/*} -u $PROD_REGISTRY_USER --password-stdin"
          # Image-only rollback: no migration window (TAG=target, MIGRATION=0). A failed
          # rollback's auto-revert returns to the current version (PREV_TAG=$CURRENT).
          ssh_main "TAG='$TARGET' PREV_TAG='$CURRENT' MIGRATION=0 bash /opt/scrabble/compose/prod-deploy.sh"
  rollback-bot:
    needs: rollback-main
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      TARGET: ${{ needs.rollback-main.outputs.target }}
      PROD_REGISTRY_USER: ${{ vars.PROD_REGISTRY_USER }}
      PROD_REGISTRY_PASSWORD: ${{ secrets.PROD_REGISTRY_PASSWORD }}
      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
      TG_HOST: ${{ vars.PROD_TG_HOST }}
      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
      TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
      TELEGRAM_PROMO_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_PROMO_BOT_TOKEN }}
      PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
      PROD_BOTLINK_BOT_CERT: ${{ secrets.PROD_BOTLINK_BOT_CERT }}
      PROD_BOTLINK_BOT_KEY: ${{ secrets.PROD_BOTLINK_BOT_KEY }}
      LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
      TELEGRAM_GAME_CHANNEL_ID: ${{ vars.PROD_TELEGRAM_GAME_CHANNEL_ID }}
      TELEGRAM_CHAT_ID: ${{ vars.PROD_TELEGRAM_CHAT_ID }}
      TELEGRAM_BOT_USERNAME: ${{ vars.PROD_TELEGRAM_BOT_USERNAME }}
      TELEGRAM_BOT_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
      - name: Render bot env + certs
        run: |
          umask 077
          mkdir -p stage/certs-bot
          cat > stage/env.bot.sh <<EOF
          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
          export BOT_IMAGE='$REGISTRY/scrabble-telegram-bot:$TARGET'
          export BOTLINK_GATEWAY_ADDR='$MAIN_HOST:9443'
          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
          export TELEGRAM_GAME_CHANNEL_ID='$TELEGRAM_GAME_CHANNEL_ID'
          export TELEGRAM_CHAT_ID='$TELEGRAM_CHAT_ID'
          export TELEGRAM_PROMO_BOT_TOKEN='$TELEGRAM_PROMO_BOT_TOKEN'
          export TELEGRAM_BOT_USERNAME='$TELEGRAM_BOT_USERNAME'
          export TELEGRAM_BOT_LINK='$TELEGRAM_BOT_LINK'
          export LOG_LEVEL='${LOG_LEVEL:-info}'
          EOF
          printf '%s\n' "$PROD_BOTLINK_CA"       > stage/certs-bot/ca.crt
          printf '%s\n' "$PROD_BOTLINK_BOT_CERT" > stage/certs-bot/bot.crt
          printf '%s\n' "$PROD_BOTLINK_BOT_KEY"  > stage/certs-bot/bot.key
          chmod 644 stage/certs-bot/*
      - name: Roll the bot host back
        run: |
          ssh_tg() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$TG_HOST" "$@"; }
          ssh_tg 'mkdir -p /opt/scrabble/compose'
          tar -C deploy -czf - docker-compose.bot.yml | ssh_tg 'tar -C /opt/scrabble/compose -xzf -'
          tar -C stage -czf - certs-bot \
            | ssh_tg 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
          scp -i ~/.ssh/id_deploy -o BatchMode=yes stage/env.bot.sh "deploy@$TG_HOST:/opt/scrabble/env.bot.sh"
          echo "$PROD_REGISTRY_PASSWORD" | ssh_tg "docker login ${REGISTRY%%/*} -u $PROD_REGISTRY_USER --password-stdin"
          ssh_tg 'set -a; . /opt/scrabble/env.bot.sh; set +a; cd /opt/scrabble/compose;
            docker compose -f docker-compose.bot.yml pull;
            docker compose -f docker-compose.bot.yml up -d'
  verify:
    needs: [rollback-main, rollback-bot]
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
      CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
    steps:
      - name: Set up SSH
        run: |
          mkdir -p ~/.ssh && chmod 700 ~/.ssh
          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
      - name: Verify the public site
        run: |
          domain="${CADDY_SITE_ADDRESS%% *}"
          ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "for i in \$(seq 1 20); do
              if curl -fsS -k --resolve $domain:443:127.0.0.1 https://$domain/ -o /dev/null &&
                 docker run --rm --network scrabble-internal alpine:3.20 wget -q -T 5 -O /dev/null http://backend:8080/readyz; then
                echo 'rolled-back site healthy'; exit 0
              fi
              sleep 5
            done
            echo 'verify failed'; docker logs --tail 40 scrabble-caddy; docker logs --tail 40 scrabble-backend; exit 1"
@@ -1,96 +1,97 @@
 # scrabble-game — project guide
-Multiplatform Scrabble game. Read this first every session. The owner drives the
+Multiplatform Scrabble game, **in production** at `https://erudit-game.ru`. Read this
-project **one stage per session** (tariff constraint), so the repository — not
+first every session. The repository — not conversation memory — is the source of
-conversation memory — is the source of continuity. Keep it that way.
+continuity; keep it that way.
 ## Sources of truth (read before changing behaviour)
- [`PLAN.md`](PLAN.md) — staged plan + **stage tracker** + per-stage *open
+- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — architecture, transport, security,
-  details to interview*.
+  the decision record. Always describes the current state.
- [`PRERELEASE.md`](PRERELEASE.md) — pre-release hardening tracker (phases R1–R7
+- [`docs/FUNCTIONAL.md`](docs/FUNCTIONAL.md) (+ [`_ru`](docs/FUNCTIONAL_ru.md) mirror)
-  before Stage 18); same per-phase *interview + bake-back* discipline as `PLAN.md`.
+  — per-domain user stories. English authoritative.
- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — architecture, transport,
+- [`docs/TESTING.md`](docs/TESTING.md) — test layers + the CI gate.
  security, the decision record. Always describes current state.
 - [`docs/FUNCTIONAL.md`](docs/FUNCTIONAL.md) (+ [`_ru`](docs/FUNCTIONAL_ru.md)
  mirror) — per-domain user stories. English authoritative.
 - [`docs/TESTING.md`](docs/TESTING.md) — test layers + the per-stage CI gate.
 - [`docs/UI_DESIGN.md`](docs/UI_DESIGN.md) — the `ui` visual/interaction design system.
 - [`deploy/README.md`](deploy/README.md) — the deploy contour + the production
  rollout / rollback runbook.
-## Mandatory per-stage workflow
+## How we work
-**Start of a stage**
+- Inspect the relevant code path and the docs above before changing behaviour.
-1. Read `PLAN.md` (the stage's scope + *open details*) and the relevant `docs/`.
+- **Interview the owner on every fork** — do not silently pick borderline decisions;
-2. Analyse what the stage actually requires against the current code.
+  offer options with brief pros/cons.
-3. **Interview the owner** on every open detail and any fork not already fixed
+- Smallest correct diff. Prefer compact code; reuse before adding; do not add deps,
-   in the plan — do not silently pick borderline decisions. Offer options with
+  seams or knobs until they are needed.
-   brief pros/cons.
+- **Update or add tests for every functional change**, at the layers
-4. Only then implement, strictly within the stage's scope.
+  `docs/TESTING.md` calls out.
-
+- **Bake docs in the same PR**: update `docs/ARCHITECTURE.md`, `docs/FUNCTIONAL.md`
-**End of a stage**
+  (+`_ru`), the affected service `README` and Go Doc comments alongside the change.
-1. Bake every new agreement back into `PLAN.md`, `docs/ARCHITECTURE.md`,
+- Document added packages, types, funcs, consts and vars with Go Doc comments.
   `docs/FUNCTIONAL.md` (+ `_ru`), the affected service `README`, and Go Doc
   comments — in the **same** PR. Correct earlier stages' docs/code if a new
   decision changes them.
 2. Update the stage tracker; add a line under *Refinements logged during
   implementation* for any plan deviation.
 3. Get CI green, then mark the stage done.
 (The `stage-implementation` skill encodes this same loop and can be invoked.)
 ## Conventions
 - All code, comments, identifiers, commits, docs, filenames in **English**.
- Chat with the owner follows the user-level `~/.claude/CLAUDE.md` (Russian,
+- Chat with the owner follows the user-level `~/.claude/CLAUDE.md` (Russian, the
-  the agreed persona and translation rules).
+  agreed persona and translation rules).
- Mirror every point edit of `docs/FUNCTIONAL.md` into `docs/FUNCTIONAL_ru.md`
+- Mirror every point edit of `docs/FUNCTIONAL.md` into `docs/FUNCTIONAL_ru.md` in the
-  in the same patch (translate only the touched paragraphs).
+  same patch (translate only the touched paragraphs).
 - Prefer compact code; do not add deps, seams or knobs until a stage needs them.
  Reuse before adding. Document added packages/types/funcs with Go Doc comments.
 - Update or add tests for every functional change.
-## Branching & CI
+## Branching, CI & production
- **Two long-lived branches** (Stage 16 onward): **`development`** is the
+- **Two long-lived branches**: **`development`** is the integration branch; **`master`**
-  integration branch; **`master`** is the production trunk. Cut `feature/*`
+  is the production trunk. Cut `feature/*` from `development` and PR back into it;
-  branches **from `development`** and PR them back into it. (Stages 0–15 used
+  promote `development → master` via PR when ready to release. Both branches require
-  `master` as the trunk with `feature/* → master`; the genesis Stage 0 commit is
+  one approval + the `CI / gate` check.
-  on `master` by necessity.)
+- A commit to a `feature/*` branch triggers nothing. The single workflow
- A commit to a `feature/*` branch triggers **nothing**. The single workflow
+  `.gitea/workflows/ci.yaml` runs the full suite (`unit` + `integration` + `ui`) on a
-  `.gitea/workflows/ci.yaml` runs the full suite (`unit` + `integration` + `ui`)
+  PR into `development` or `master`, and the gated **`deploy`** job auto-rolls the
-  on a PR into `development` or `master`, and the gated **`deploy`** job auto-rolls
+  **test contour** on a PR into — or a push to — `development`
-  the **test contour** on a PR into — or a push to — `development`
+  (`docker compose up -d --build` on the runner host + landing/SPA/backend probes). A
-  (`docker compose up -d --build` on the runner host + a `GET /` probe). A PR into
+  PR into `master` is test-only.
-  `master` is test-only.
+- **Production is live on two hosts** (main + the Telegram bot host) and deploys
- Merge `development → master` only when CI is green; the **prod** deploy is then a
+  **only manually** (`workflow_dispatch`), never automatically:
-  **manual** workflow (Stage 18), never automatic. Secrets/variables are prefixed
+  - **`.gitea/workflows/prod-deploy.yaml`** (`confirm=deploy`, from `master`) builds +
-  `TEST_` / `PROD_` per contour (Gitea 1.26 has no deployment environments).
+    pushes the images to the registry, then SSH-deploys both hosts — rolling per
- After any push, watch the run to green before declaring a stage done — use the
+    service in dependency order, health-gated, **auto-rollback to the previous tag**;
-  ready-made watcher, never an inline poll loop:
+    a schema migration adds a maintenance window + a consistent `pg_dump`. Four visible
-  `python3 ~/.claude/bin/gitea-ci-watch.py` (background). It reads `$GITEA_URL`
+    jobs: build → deploy-main → deploy-bot → verify.
-  / `$GITEA_TOKEN`; `gitea.iliadenisov.ru` is allow-listed in
+  - **`.gitea/workflows/prod-rollback.yaml`** (`confirm=rollback`) re-deploys a prior
-  `.claude/settings.json`. Remote: `origin git@gitea.iliadenisov.ru:developer/scrabble-game.git`.
+    release (blank `target_version` = the previous deployed version) — image-only,
    rolling, health-gated.
  - **Releases are git tags `vX.Y.Z` on `master`**; the deploy stamps `git describe
    --tags` into the image tag, every binary (`pkg/version` via `-ldflags` → the
    `service.version` telemetry attribute) and the SPA About screen. Tag the release
    before deploying.
  - Hosts are provisioned idempotently by **`deploy/ansible/`**. Per-contour
    secrets/variables use the `TEST_` / `PROD_` prefix (Gitea 1.26 has no deployment
    environments). Migrations must be **expand-contract** (backward-compatible) so
    image rollback stays DB-safe. Full runbook + variable list in `deploy/README.md`.
 - After any push, merge or deploy, **watch the run to green** before declaring done —
  use the ready-made watcher (run it in the background), never an inline poll loop:
  `python3 ~/.claude/bin/gitea-ci-watch.py`. It reads `$GITEA_URL` / `$GITEA_TOKEN`;
  `gitea.iliadenisov.ru` is allow-listed in `.claude/settings.json`. Remote:
  `origin git@gitea.iliadenisov.ru:developer/scrabble-game.git`.
 ## Stack
-Go 1.26.3, `go.work` monorepo, module paths `scrabble/<name>`. Dependencies are
+Go 1.26.3, `go.work` monorepo, module paths `scrabble/<name>`. Backend uses `gin` +
-added **when first used** (incremental): backend uses `gin` + `zap` +
+`zap` + `pgx`/`go-jet`/`goose`/OTel. Client↔gateway is Connect-RPC + FlatBuffers
-`pgx`/`go-jet`/`goose`/OTel (added in Stage 1). Client↔gateway is Connect-RPC +
+(h2c); gateway↔backend is REST/JSON + `X-User-ID` plus a gRPC server-stream for live
-FlatBuffers (h2c); gateway↔backend is REST/JSON + `X-User-ID` plus a gRPC
+events. UI is pure HTML5/CSS on plain Svelte + Vite, packaged to native with
-server-stream for live events. UI is pure HTML5/CSS on plain Svelte + Vite,
+Capacitor. No Redis.
 packaged to native with Capacitor. Likely no Redis.
 ## Reused engine: `../scrabble-solver` (module `scrabble-solver`, Go 1.26.3)
-Embedded **in-process as a library** — there is no per-game container. Public
+Embedded **in-process as a library** (`replace scrabble-solver => ../scrabble-solver`
-API to reuse (do not reimplement):
+in `go.work`; CI checks out the sibling from
 `https://gitea.iliadenisov.ru/.../scrabble-solver.git`). There is no per-game
 container. Public API to reuse (do not reimplement):
- `scrabble.NewSolver(rs, finder)` → `GenerateMoves(b, r, mode)` (ranked,
+- `scrabble.NewSolver(rs, finder)` → `GenerateMoves(b, r, mode)` (ranked, highest
-  highest score first), `ValidatePlay(b, dir, tiles)`, `ScorePlay(...)`;
+  score first), `ValidatePlay(b, dir, tiles)`, `ScorePlay(...)`; `scrabble.Apply(b, m)`;
-  `scrabble.Apply(b, m)`; types `Move/Word/Placement/Direction/Mode`
+  types `Move/Word/Placement/Direction/Mode`
  (`scrabble-solver/scrabble/{solver,move,apply}.go`).
- `rules.English() / RussianScrabble() / Erudit()`
+- `rules.English() / RussianScrabble() / Erudit()` (`scrabble-solver/rules/rules.go`).
  (`scrabble-solver/rules/rules.go`).
 - `board.New / Parse / Clone / Transpose`; `rack.New / Add / Remove / Clone`;
  `selfplay.NewBag / Draw / Len` (bag pattern).
 - Load committed dictionaries with `dawg.Load(path)` from
@@ -99,20 +100,17 @@ API to reuse (do not reimplement):
 Constraints:
 - Words/tiles are **alphabet-index bytes**, meaningful only with the matching
-  `rules.Ruleset` (`Alphabet.Decode`); blank flag carried separately. **Decode
+  `rules.Ruleset` (`Alphabet.Decode`); the blank flag is carried separately. **Decode
  to real characters before persisting history** (history must be
  dictionary-independent — see `docs/ARCHITECTURE.md` §9.1).
 - The solver's `internal/*` is NOT importable from this sibling module.
 - **GCG is test-only** in the solver (no public writer) — we ship our own.
- Wiring: add `replace scrabble-solver => ../scrabble-solver` to `go.work` in
+- The solver uses published `github.com/iliadenisov/{alphabet,dafsa}` (no local replace).
  **Stage 2** (when `internal/engine` first imports it), and make CI check out
  the solver sibling (`https://gitea.iliadenisov.ru/.../scrabble-solver.git`).
  It uses published `github.com/iliadenisov/{alphabet,dafsa}` (no local replace).
 ## Repository layout
 ```
-go.work                      # use the existing modules; grows per stage
+go.work                      # the go.work monorepo
 backend/                     # module scrabble/backend
  cmd/backend/               # main: telemetry -> db+migrate -> cache -> server
  cmd/jetgen/                # dev tool: regenerate go-jet code (throwaway container)
@@ -123,12 +121,14 @@ backend/                     # module scrabble/backend
  internal/session/          # opaque tokens, sessions store, cache, service
  internal/server/           # gin engine, /api/v1 groups, X-User-ID, probes
  internal/inttest/          # //go:build integration Postgres-backed tests
-docs/  .gitea/workflows/  PLAN.md  CLAUDE.md  README.md
+gateway/                     # module scrabble/gateway: Connect-RPC edge, embeds the SPA
-gateway/  ui/  pkg/              # added by their stages
+ui/                          # Svelte + Vite SPA + landing (Node project, not in go.work)
-platform/telegram/               # Telegram side-service, two binaries (Stage 9; split in phase TX): cmd/validator (HMAC, no VPN) + cmd/bot (Bot API; dials gateway over reverse mTLS bot-link)
+pkg/                         # shared: telemetry, version, wire/FlatBuffers, proto, mtls
-loadtest/                        # module scrabble/loadtest: the pre-release stress harness (R2)
+platform/telegram/           # Telegram side-service: cmd/validator (HMAC, no VPN) + cmd/bot (Bot API; dials gateway over reverse mTLS bot-link)
-backend/Dockerfile gateway/Dockerfile platform/telegram/Dockerfile loadtest/Dockerfile  # multi-stage distroless (Stage 16; loadtest R2); gateway/Dockerfile has the `landing` target (R3), platform/telegram/Dockerfile has `validator`+`bot` targets (TX)
+loadtest/                    # module scrabble/loadtest: the load/stress harness
-deploy/                          # docker-compose (per-service limits, R7) + caddy + landing + otelcol (OTLP + docker_stats per-container metrics) + prometheus/tempo/grafana + postgres_exporter
+docs/  .gitea/workflows/  CLAUDE.md  README.md
 backend/Dockerfile gateway/Dockerfile platform/telegram/Dockerfile loadtest/Dockerfile  # multi-stage distroless; gateway/Dockerfile has the `landing` target, platform/telegram/Dockerfile has `validator`+`bot` targets
 deploy/                      # docker-compose (+ prod overlay + bot host) + ansible provisioning + caddy + landing + otelcol (OTLP + docker_stats) + prometheus/tempo/grafana + node_exporter + postgres_exporter; prod-deploy.sh
 ```
 ## Build & test
@@ -138,20 +138,19 @@ go build ./backend/...          # per module ('./...' from the root won't span t
 go vet ./backend/...
 gofmt -l .                      # must print nothing
 go test -count=1 ./backend/...
-go build ./platform/telegram/... && go test ./platform/telegram/...  # Telegram validator + bot (Stage 9; split in TX)
+go build ./platform/telegram/... && go test ./platform/telegram/...  # Telegram validator + bot
 go run ./backend/cmd/backend    # /healthz, /readyz on :8080
-cd ui && pnpm install && pnpm check && pnpm test:unit && pnpm build  # the UI (Stage 7+)
+cd ui && pnpm install && pnpm check && pnpm test:unit && pnpm build  # the UI
 pnpm start                      # UI mock mode: lobby -> game, no backend
-docker build -f backend/Dockerfile -t scrabble-backend .   # images (Stage 16); gateway embeds the SPA
+docker build --build-arg DICT_VERSION=v1.3.0 -f backend/Dockerfile -t scrabble-backend .  # DICT_VERSION required (no default); gateway embeds the SPA
 docker build -f gateway/Dockerfile --target gateway -t scrabble-gateway .
-docker build -f gateway/Dockerfile --target landing -t scrabble-landing .  # static landing (R3)
+docker build -f gateway/Dockerfile --target landing -t scrabble-landing .  # static landing
 docker compose -f deploy/docker-compose.yml config         # validate the full contour
 ```
-The `ui` module is a Node project (pnpm), **not** in `go.work`; it is the `ui` job
+The `ui` module is a Node project (pnpm), **not** in `go.work`; it is the `ui` job of
-of the single `.gitea/workflows/ci.yaml` (Stage 16 folded the former go-unit /
+the single `.gitea/workflows/ci.yaml`. Committed edge codegen under `ui/src/gen/`
 integration / ui-test workflows into it). Committed edge codegen under `ui/src/gen/`
 (regenerate with `pnpm codegen`); pnpm build-script approval lives in
 `ui/pnpm-workspace.yaml` (`allowBuilds: esbuild: true`).
@@ -1,627 +0,0 @@
 # Pre-release plan — hardening before Stage 18
 Living tracker for the pre-release hardening pass that runs **before Stage 18** (the
 prod cutover). Same discipline as [`PLAN.md`](PLAN.md): one phase per session,
 **interview the owner on the open details** at the start of each phase, bake every
 decision back into `PLAN.md` / `docs/` / the affected `README`s / Go Doc comments in
 the **same** PR, get CI green, then mark the phase done. Phases run as
 `feature/* → development` PRs (the Stage 16 branch model); the owner approves+merges.
 **Why now:** the system is feature-complete through Stage 17 and the test contour is
 green, but there is **no prod data yet** — schema, wire labels and the dictionary
 layout can still change for free. These phases spend that one-time freedom and harden
 the edge before prod. Each phase maps back to the owner's raw pre-release TODO list
 (numbers in the tracker).
 ## Phase tracker
 | # | Phase | Raw TODOs | Status |
 |---|-------|-----------|--------|
 | R1 | Schema & naming reset | 1 + 10 | **done** |
 | R2 | Stress harness + contour observability + early run | 9a | **done** |
 | R3 | Edge hardening | 2 + 8 + 3 | **done** |
 | R4 | Push enrichment + kill the last poll | 4 + 5 | **done** |
 | R5 | Bundle slimming | 6 | **done** |
 | R6 | Refactor + docs reconciliation + de-staging | 7 | **done** |
 | R7 | Final stress run + tuning | 9b | **done** |
 | UI | Tab-bar navigation redesign (drop the hamburger) | owner ad-hoc | **done** |
 | MW | "Multiple words per turn" rule for Russian games (engine v1.1.0) | owner ad-hoc | **done** |
 | MW2 | Single-word rule connectivity fix: the word must run along its own line through an existing tile (perpendicular-only contact no longer connects); single-tile direction picks the best legal word (engine v1.1.1) | owner ad-hoc | **done** |
 | MW3 | Graceful replay degradation: a game whose journalled move became illegal under MW2 is closed as a draw (`end_reason='aborted'`) on open instead of erroring, with an impersonal organizer note in the history + GCG (migration `00002`) | owner ad-hoc | **done** |
 | OW | Open auto-match: enter the game at once and wait inside it (robot after 90–180 s) | owner ad-hoc | **done** |
 | DA | Dictionary admin: online release-archive upload → word-diff preview → install/activate; versioned dict volume; active version persisted in DB; resident label = release tag | owner ad-hoc | **done** |
 | AB | Manual account block (admin suspension): permanent/temporary with an editable en+ru reason picklist; a block forfeits the player's active games + cancels their open ones; a backend gate refuses a blocked account with **403 `account_blocked`**; the UI shows a terminal blocked screen and stops all push/poll; manual unblock; temporary blocks self-expire (migration `00003`) | owner ad-hoc | **done** |
 | AI | Honest AI opponent in quick game: an explicit 🤖 AI / 👤 random selector (AI default); the robot is seated and moves at once; 7-day inactivity loss (the per-turn timeout reused); chat/nudge disabled, no statistics; the opponent is shown as 🤖 everywhere | owner ad-hoc | **done** |
 | AD | Advertising banner ("ad network"): server-driven weighted campaigns (percent weight + validity window; the perpetual default fills the remainder up to 100%), bilingual messages shown by bot (`service_language`); eligibility = free account + empty hint wallet + no `no_banner` role (guests included); the resolved feed rides `profile.get` with a `notify` `banner` re-poll on eligibility change; `/_gm/banners` admin + global display timings; client smooth-weighted-round-robin rotation + fade-out/gap/fade-in UX. A single `app.load` bootstrap aggregator was considered and **deferred** (see ARCHITECTURE §10). | owner ad-hoc | **done** (PR1 backend+admin, PR2 UI rotation) |
 | GL | Simultaneous quick-game cap (10): grey "New Game" + a lobby notice at the cap; backend gate on quick enqueue + invitation creation (409 `game_limit_reached`), accepting invitations exempt; `at_game_limit` rides `games.list` | owner ad-hoc | **done** |
 | CR | In-game chat read receipts: per-message `unread_seats` bitmask (migration `00008`); a per-viewer unread **dot** in the lobby + game header (a nudge counts and clears when its recipient moves); reading = opening the move history (the 💬 fade-blinks twice) or the chat, acked (`chat.read`) only when unread; `chat_read_duration` + `chat_unread_messages` metrics + tracing + the **Scrabble — Messages** Grafana dashboard (follow-up PR); a message to a disguised robot opponent is born read; admin unread-only filter / read column / per-seat read card | owner ad-hoc | **done** |
 | BX | Asymmetric per-user block + in-game controls: a block now silently suppresses everything **from** the blocked user (chat, nudge, friend requests, invitations are kept but never delivered/surfaced, born-read) while they notice nothing, **without** deleting the friendship (unblock restores it); auto-match excludes a block-related pair (either direction); in-game opponent card gains a ✖️ **block** control (mirroring 🤝, red "Block?" confirm, mutual-hide, struck name + hidden chat composer when blocked); optimistic apply + `user_blocked`/`user_unblocked` event confirm + rollback; admin user card gains **blocks / blocked-by / friends** cross-linked lists. Blocking a disguised-robot opponent is recorded per-game in a separate **`robot_blocks`** table (migration `00011`), keyed on game+seat with the seen name — never the shared robot account — so the matchmaker keeps giving robots; it shows in the blocked list and re-marks the in-game card | owner ad-hoc | **done** |
 | FM | First-move tile draw (official rules): each seated player draws a tile, the one closest to "A" leads (a blank beats every letter), ties re-drawing until a single leader; **honest per-draw `crypto/rand` entropy**, not the bag seed, so the **record** (`game_setup_draws`, migration `00013`) — not a seed — is the only account of the outcome, kept for future **tournaments** (designed as a discrete per-tile "player N draws" step). Friend/AI draws at create; **auto-match draws at *open*** against a synthetic `uuid.Nil` opponent whose draw rows are back-filled on join, so the opener's seat is fixed up front and the existing open-game pre-move is preserved (no reseating, no play-gating). Admin `/_gm/games/:id` gains the recorded draw list + a simple **step-by-step board replay** (`ReplayTimeline`). | owner ad-hoc | **done** |
 | SB | Single Telegram bot + per-user variant preferences: the two per-language bots collapse into **one** (drop `accounts.service_language`, `supported_languages`, the `*_EN`/`*_RU` env vars and game-language push routing — the single bot renders in the recipient's `preferred_language`); New Game variant gating moves to a profile **`variant_preferences`** set (default Erudit only, Erudit-first, server-enforced on the caller's auto-match/vs-AI/invitation-create paths, an invited friend may accept any variant); env vars collapse to unsuffixed `TELEGRAM_BOT_TOKEN`/`TELEGRAM_GAME_CHANNEL_ID`/`VITE_TELEGRAM_LINK`/`VITE_TELEGRAM_GAME_CHANNEL_NAME` and `GATEWAY_DEFAULT_SUPPORTED_LANGUAGES` is removed; wire drops `service_language`/`supported_languages` (Session, ValidateInitDataResponse) + the push `language` routing field and adds `variant_preferences` to Profile/UpdateProfile. | owner ad-hoc | **done** |
 | DV | Dictionary version hygiene: CI + image/compose seed track the current release (`v1.2.1`); a **seed-drift guard** records the flat dir's seed in an authoritative `.seed_version` marker so a bumped build seed on a live volume is ignored (it can't relabel live bytes — which would mis-serve the dictionary + void games pinned to the prior label); `DICT_VERSION` is the fresh-volume seed only, a live contour migrates through the admin console | owner ad-hoc | **done** |
 | TX | Telegram egress off the main host: split the connector into a home **validator** (Mini App / Login-Widget HMAC, no VPN, no Bot API — so game login no longer depends on Telegram being reachable) and a remote **bot** (Bot API long-poll + `sendMessage`) that holds **no inbound port** and dials the gateway over a reverse **mTLS bot-link** (`pkg/proto/botlink/v1`); the gateway funnels out-of-app push (fire-and-forget, at-most-once) and the backend admin broadcasts (a relay that awaits the bot's ack) down the link. The bot is Telegram-rate-limited; **one bot now**, with seams (a bot registry + `owns_updates` + command ids) for N later; **no webhook** (rejected: one URL per token, adds inbound + a static address). The **unified test contour** runs the split (the bot keeps its VPN sidecar and dials the gateway by its internal name; certs from `deploy/gen-certs.sh`). The **prod** wiring — the bot on a separate host (no VPN), the gateway bot-link port published, `PROD_` certs with scheduled rotation, an SSH deploy of both hosts together — is the **deferred final stage** (Stage 18). | owner ad-hoc | **done** (code + test contour; prod wiring → Stage 18) |
 | AG | Anti-abuse IP ban + honeypot/honeytoken (prod-only): a fail2ban-style in-memory `ratelimit.Banlist` keyed by client IP, fed by sustained rate-limiter rejections (the IP-keyed public/email/admin classes — the user class stays the soft-flag's concern), a **honeypot** decoy path (the contour caddy tags `/.env`, `/.git`, `/wp-*`, … with `X-Scrabble-Honeypot` and routes them to the gateway), and a **honeytoken** (`GATEWAY_HONEYTOKEN`, a planted bearer). The `abuseGuard` edge middleware refuses a banned IP with **429** before any work — closing the R3 gap that the static SPA/landing was outside the token bucket. Off by default — it keys by the real client IP the shared-NAT test contour does not expose (detection still logs there); enabled in prod via `GATEWAY_ABUSE_BAN_ENABLED`. Operators see + lift bans on the console **Throttled** page; the gateway syncs its active set to the backend (`/api/v1/internal/bans/sync`, `internal/banview`) every 30 s and applies operator unbans. | owner ad-hoc | **done** (code + test contour; ban enabled in prod → Stage 18) |
 | CM | Channel-chat moderation + promo bot: a second standalone bot in the bot container answers `/start` with a localized message + a **URL** button into the **main** bot's Mini App (`?startapp`; a `web_app` button would sign initData with the promo token, which the main validator rejects). The **main** bot gates write access in a channel's linked discussion chat. The chat **allows sending by default** and the bot only restricts (Telegram intersects the chat default with the per-user permission, so a per-user grant cannot exceed a deny-by-default group): it **mutes** a member who is not registered or is admin-suspended or holding a new **`chat_muted`** role, and **un-mutes** an eligible one it had muted, for a member currently in the chat (a `getChatMember` guard, since bots cannot list members). Eligibility = `registered AND NOT suspended AND NOT chat_muted` (the game suspension dominates), resolved once in the backend and reached two ways: the bot's `ResolveChatEligibility` on a `chat_member` event over the existing mTLS bot-link, and a backend `chat_access_changed` event → gateway → `ChatGate` command (emitted on block/unblock, a `chat_muted` change, a first registration, or a temporary-block expiry via a sweeper; idempotent). No schema change — `chat_muted` reuses `account_roles`. | owner ad-hoc | **done** |
 | → | Stage 18 — prod contour deploy | — | see [`PLAN.md`](PLAN.md) |
 ## Key findings (these reshaped the raw list — read before starting a phase)
 - **R1 (TODO 1 + 10) is one cheap moment, now.** Squashing the 12 goose migrations is
  safe precisely because there is no prod data and the contour DB is wiped. Folding the
  new variant labels (`scrabble_ru`/`scrabble_en`/`erudit_ru`) into that single baseline
  makes the rename need **no data migration and no back-compat mapping**. Today's labels
  (`english`/`russian_scrabble`/`erudit`) are persisted in `games.variant`,
  `game_invitations.variant`, in `pkg/fbs` and the UI — ~100 files, but a mechanical sweep
  on a clean DB.
 - **R4 (TODO 4 + 5): the app is already push-first.** Game state refreshes on
  `your_turn`/`opponent_moved`, the lobby on `notify`, chat on `chat_message`. The **only**
  genuine periodic server poll is `lobby.poll` (matchmaking, 2.5 s,
  `ui/src/screens/NewGame.svelte`). What remains is killing that one poll **and** enriching
  push events to carry payloads so the UI stops re-fetching after each signal.
 - **R3 (TODO 2): identity forgery is already mitigated.** Identity is always derived from
  the session (`Authorization: Bearer` → `X-User-ID`); the client cannot inject identity,
  the backend re-validates resource ownership, Telegram initData is HMAC-checked. The real
  gaps are a missing **request-body size limit** (cheap DoS) and **invisible rate-limit
  rejections** (no log/metric/admin view — that is TODO 8). Static landing serving is **not**
  covered by the gateway token bucket (it only guards `Execute`).
 - **R6 (TODO 7) scale:** ~431 `Stage N` references across ~104 files (incl. the file name
  `backend/internal/inttest/stage6_test.go`). Code is the source of truth; `docs/` describe
  current state; `PLAN.md` keeps the decision history.
 ## Locked decisions (owner interview)
 - **Stress test (TODO 9):** **early + final** runs. Driver = **edge protocol** (Connect/FB
  through the gateway, moves generated by the solver) **plus a separate gateway-hammer**
  saturation test. Pacing = **realistic (under limits) + saturation (ramp to the knee)**.
  Resource metrics = **add cAdvisor + postgres_exporter to the contour** (today only
  Go-runtime metrics exist). The harness stays in the repo for repeats.
 - **Push (TODO 4 + 5):** **both** — kill `lobby.poll` (use the existing `match_found`, keep
  poll as the ws-down fallback) **and** enrich push events with payloads.
 - **Refactor (TODO 7):** **hygiene + structural changes by a reviewed list** —
  behaviour-preserving, test-gated, contentious items surfaced to the owner before applying.
 - **Landing (TODO 3):** **separate static container** behind the project caddy
  (`/` → landing, `/app/` + `/telegram/` → gateway); drop `landing.html` from the gateway
  `go:embed`.
 - **Rate-abuse (TODO 8):** metric + Grafana + admin view **plus a conservative auto-flag** —
  a *soft, reversible* "suspected high-rate" marker for operator review, tunable threshold,
  **no auto-ban**.
 - **Anti-abuse IP ban (AG, owner ad-hoc):** a honeypot was considered and rejected as a *DDoS*
  defence — it detects/deceives but does not shed volumetric load, cannot cover the real
  endpoints, and a tarpit backfires under flood; volumetric L3/L4 is an upstream/CDN concern,
  out of scope. The effective layer is a **temporary IP ban** (fail2ban-style) that the honeypot
  and honeytoken merely *feed*. This does **not** reverse the TODO-8 "no auto-ban": that decision
  governs the **account** soft-flag (still never a gate); the IP ban is a separate, IP-keyed,
  **prod-only** layer with an **operator unban** in the console. Decisions: banlist lives in the
  existing `ratelimit` package (smallest surface); the decoy path list is a **single source of
  truth in the caddy** (it tags requests with a header — the gateway keeps no second list);
  bans are in-memory + single-instance (like `ratewatch`), auto-expiring, **plus** an admin
  console view + manual unban over a bidirectional 30 s sync (operator control = owner's choice).
  An active-bans Grafana **gauge** was trimmed (the console view + the `gateway_abuse_banned_total`
  counter cover it) to keep the diff focused.
 - **Open auto-match (owner ad-hoc):** a quick game **enters a real game at once and waits inside
  it** (status `open`, the opponent seat empty); a second human searching the same variant+rule
  joins it, or a robot fills it after a **90 s + random 0–90 s** wait, pushing the in-app
  **opponent_joined** event. While open, the starter may move on their turn but resign, chat and
  nudge are disabled, and the lobby + opponent card read "searching for opponent". Matchmaking is
  now **DB-backed open games** — the in-memory pool, `lobby.poll` and `lobby.cancel` are gone. The
  schema is edited in the baseline (no prod data); `game_players.account_id` is nullable for the
  empty seat.
 - **Telegram egress off-host (TX, owner ad-hoc):** the driver is **removing VPN/Telegram
  traffic from the main host** (OPSEC / one fewer analysis vector), not only notification
  resilience. Login is local HMAC, so it stays up regardless of the bot — confirmed in the
  code and made structural by the split. **Unified topology in code** (validator + bot, the
  bot dialing the gateway) in **both** contours, differing only in deployment; the test bot
  keeps its VPN sidecar. Transport = a **reverse gRPC bidi stream, mTLS, bot-dials-gateway**
  (no inbound/static IP on the bot), reusing the push-stream pattern; **webhook rejected**
  (one URL per token, adds inbound + a static address). Delivery **at-most-once** (a dropped
  nudge beats a duplicate). **One bot now**, seams (registry + `owns_updates` + command ids)
  for N later. **Cert rotation** by a scheduled CI job from a long-lived CA. **Prod deploy by
  SSH** (pull excluded), the bot rolled **together** with the main app (the bot-link protocol
  kept back-compatible by one version as the non-atomic-two-host-deploy safety net). The bot
  is monitored **from the gateway** (connection + ack metrics). The bot-host token-at-rest is
  **accepted**.
 ## Phases
 Each phase: read this tracker + the relevant `docs/`, **interview the owner on the open
 details below**, implement within scope, then update the tracker + docs/code and get CI
 green before marking it done.
 ### R1 — Schema & naming reset *(TODO 1 + 10)* — first
 Squash `backend/internal/postgres/migrations/00001..00012` into one `00001_baseline.sql`
 (method: `pg_dump --schema-only` from a fully-migrated DB → wrap as the goose baseline →
 prove a fresh migrate yields a schema identical to the 12-migration chain via the
 integration suite → delete the old files; keep goose). Bake the new variant labels into the
 baseline. Propagate `scrabble_ru`/`scrabble_en`/`erudit_ru` through the backend
 (`engine.Variant`/`ParseVariant`, `registry.dictFiles`, the CHECK values), the wire
 (`pkg/fbs` `variant:string`, regenerate FB) and the UI (`lib/model.ts` union, `variants.ts`,
 fixtures, premium/alphabet keys, tests); i18n display keys stay display-only. Tidy
 `../scrabble-dictionary` to a single source→dawg build point and align the dawg artifact
 names to the new labels (crosses into `../scrabble-solver`'s committed fixtures — keep them
 byte-identical). After merge, **wipe the contour DB** (drop the volume) so it re-provisions
 on the next deploy.
 - Critical files: `backend/internal/postgres/migrations/`,
  `backend/internal/engine/{engine,registry}.go`, `pkg/fbs/scrabble.fbs`,
  `ui/src/lib/{model,variants}.ts`, `../scrabble-dictionary/{Makefile,cmd/builddict,…}`.
 - Open details to interview: the exact dawg filename scheme; whether the dict-repo tidy is
  one PR or split; how to script the contour DB wipe in the deploy.
 ### R2 — Stress harness + contour observability + early run *(TODO 9, part 1)*
 Build the reusable load harness as a new `loadtest` module in `go.work` (reuses `pkg/fbs`,
 `connect-go`, and `scrabble-solver` for legal-move generation): a seeder that inserts
 **1000 guest + 10000 durable** accounts with pre-created sessions (token hashes) directly in
 the DB and hands the plaintext tokens to the client; a driver that runs N virtual users,
 each in 3–5 concurrent 2–4-player games, exercising submit-play / pass / exchange / nudge /
 chat / check-word / draft-move / profile-save through the **edge protocol**, in
 **realistic** (under rate limits) and **saturation** (ramp) modes; plus a separate
 **gateway-hammer** that deliberately exceeds limits to verify the limiter holds and measure
 its cost. Add **cAdvisor + postgres_exporter** to `deploy/docker-compose.yml` and a Grafana
 resource dashboard. Run the **early pass** against the freshly-wiped contour; produce a
 **trip report** (logic/concurrency bugs + a resource baseline) that feeds R3 and R6.
 - Critical files: new `loadtest/`, `deploy/docker-compose.yml`, `deploy/observability/*`,
  `docs/TESTING.md`.
 - Open details: the scale ramp steps; the move-selection policy (a mid-ranked solver move
  for realistic game progress); run duration; the pass/fail bar.
 ### R3 — Edge hardening *(TODO 2 + 8 + 3)*
 Add a **request-body size cap** at the gateway h2c mux / `Execute` (e.g. ~1 MB). Add
 **rate-limit observability**: a `gateway_rate_limited_total{class}` counter + a structured
 log per rejection; an **aggregate** Grafana panel (request rate + rejection rate — spikes
 visible without per-user label cardinality, honouring the Stage 12/17 discipline); an
 **admin-console view** of recently throttled users/IPs (in-memory ring buffer, single-
 instance, reset-on-restart, like the `active_users` gauge). Add the **conservative
 auto-flag**: when a user is *sustained*-throttled past a tunable threshold, set a soft,
 reversible `account.flagged_high_rate_at` marker (baked into the R1 baseline) surfaced in the
 admin user list/detail — **no auto-ban**; the operator clears it. Split the **landing** into
 its own static container (`deploy/` + a Caddyfile route `/` → landing) and drop
 `landing.html` from the gateway `go:embed`.
 - Critical files: `gateway/internal/connectsrv/server.go`, `gateway/internal/ratelimit/`,
  `gateway/internal/connectsrv/metrics.go`, `backend/internal/adminconsole/`,
  `deploy/caddy/Caddyfile`, `deploy/docker-compose.yml`, `gateway/internal/webui/`.
 - Open details: the auto-flag threshold/window + whether the marker is persisted vs
  in-memory; the landing image base (caddy vs nginx).
 ### R4 — Push enrichment + kill the last poll *(TODO 4 + 5)*
 Replace `lobby.poll` with the existing `match_found` push (keep the poll as a ws-down
 fallback). Enrich `your_turn`/`opponent_moved`/`notify` to carry the state payload so the UI
 renders from the event without a follow-up `game.state` (removes the lobby↔game nav latency
 the owner noticed). Wire-contract change: `pkg/fbs` event payloads → backend `notify` emit →
 UI stream consumers (`ui/src/lib/app.svelte.ts`), with the per-game cache as the landing
 spot; regenerate FB.
 - Critical files: `pkg/fbs/scrabble.fbs`, `backend/internal/notify/events.go`,
  `ui/src/lib/{app.svelte,transport}.ts`, `ui/src/screens/NewGame.svelte`.
 - Open details: which events carry full vs delta payloads; the fallback-poll cadence when the
  stream is down.
 ### R5 — Bundle slimming *(TODO 6)* — done
 Analysed the bundle against the 100 KB-gzip budget; **no code slimming was warranted**, and the
 budget metric was retargeted to measure the app correctly. The build already minifies +
 tree-shakes; the dominant cost is the Connect/FlatBuffers transport runtime + generated bindings
 + the Svelte runtime (≈⅔ of `main`'s source is third-party/generated) — irreducible within scope.
 **Lazy-loading was rejected**: `bundle-size.mjs` sums every emitted chunk, so code-splitting yields
 no total-size win and adds request latency (+N gateway fetches on first navigation to a split
 screen). i18n lazy-load was skipped (the catalogs are a sliver of a Svelte-runtime-dominated shared
 chunk, and `en` must stay bundled as the `MessageKey` type source + fallback). Instead,
 `bundle-size.mjs` now measures **per HTML entry**, with three independent gates on the natural chunk
 boundaries — **app entry ≤ 100 KB, the Svelte+i18n shared chunk ≤ 30 KB, the landing's own chunk
 ≤ 5 KB** — since the app's real payload is its entry chunk plus the shared chunk (≈97 KB), while the
 landing (≈24 KB) is reported separately and kept minimal. Same CLI + exit-code contract, so the CI
 step is unchanged.
 - Critical files: `ui/scripts/bundle-size.mjs`; no app code changed.
 ### R6 — Refactor + docs reconciliation + de-staging *(TODO 7)* — done
 Behaviour-preserving only. Three separable, separately-committed passes: (a) mechanical
 **de-staging** — remove `Stage N`/`TODO-N` references from code, comments and service
 READMEs (rename `stage6_test.go`); (b) **docs↔code reconciliation** — reconcile
 `docs/ARCHITECTURE.md` / `docs/FUNCTIONAL.md`(+`_ru`) against the code-as-truth, fixing drift
 and Go Doc comments; (c) **structural changes by a reviewed list** — surface a list of
 proposed optimizations / test-suite consolidations to the owner, apply only the approved,
 behaviour-preserving, test-gated ones. The full suite + the final stress run (R7) are the
 regression gate. Incorporates the early-run (R2) bug fixes not already shipped.
 - Open details: the structural-changes list itself (owner-approved before applying); the test
  consolidation targets.
 ### R7 — Final stress run + tuning *(TODO 9, part 2)* — done
 Re-run the R2 harness against the final, refactored system on a clean contour; analyse
 resource consumption across **all** components (gateway, backend, Postgres, the
 metrics/observability stack, docker log volume) and agree the tuning (pool sizes, rate
 limits, cache TTLs, container limits, GOMAXPROCS, log levels). Apply the agreed tuning; record
 the methodology + results in the repo.
 → **Stage 18** (prod contour) then proceeds per [`PLAN.md`](PLAN.md).
 ## Sequencing rationale
 `R1` first (cheapest now; everything builds on the final schema/naming and the stress test
 must run against it). `R2` builds the harness and runs the **early** pass to surface bugs and
 a resource baseline that feed `R3` and `R6`. `R3`/`R4`/`R5` harden and improve the system.
 `R6` (de-stage + reconcile + structural) runs near the end so it sweeps settled code once and
 benefits from all accumulated bug knowledge. `R7` validates the final system and tunes it.
 Then Stage 18.
 ## Regression-safety discipline (cross-cutting)
 - Every phase is a `feature/* → development` PR; CI (`unit` + `integration` + `ui` behind the
  `CI / gate` check) must be green before the owner merges; watch the post-merge contour
  deploy with `gitea-ci-watch.py`.
 - `R6` structural changes are behaviour-preserving, test-gated, and split from the mechanical
  sweeps; contentious items are owner-approved first.
 - The two stress runs (`R2` early, `R7` final) are the system-level regression gate.
 ## Verification (per phase)
 - `go build ./<module>/...`, `go vet`, `gofmt -l .` clean, `go test -count=1 ./<module>/...`;
  UI: `pnpm check && pnpm test:unit && pnpm build`; the integration suite
  (`-tags integration`) for DB/schema changes; `docker compose config` for deploy changes;
  green CI on the PR + a healthy contour deploy.
 - `R1`: prove the squashed baseline yields a schema identical to the 12-migration chain
  (integration suite on a fresh DB) **before** deleting the old files.
 - `R2`/`R7`: the harness runs end-to-end against the contour; the trip report lists concrete
  defects + a resource profile from the Grafana cAdvisor/postgres_exporter panels.
 ## Refinements logged during implementation
 - **R1** (interview + implementation):
  - **Variant labels** `english`/`russian_scrabble`/`erudit` → **`scrabble_en`/`scrabble_ru`/`erudit_ru`**
    across the backend (`engine.Variant.String`/`ParseVariant`; the `games`/`game_invitations` `variant`
    CHECK in the baseline; GCG `#lexicon` and the `variant` metric attribute both flow from `String`),
    the wire (`pkg/fbs` `variant` is a `string` field — values change with **no FlatBuffers regen**) and
    the UI (`model.ts` union, `variants.ts` records, `codec`/`premiums`/mocks/tests, the admin
    `dictionary.gohtml`). **Kept:** the Go enum identifiers (`VariantEnglish`…, internal) and the i18n
    display keys (`new.english`/`new.russian`/`new.erudit`, display-only). `complaints.variant` stays
    free-text (no CHECK, as before).
  - **dawg filenames kept descriptive** (`en_sowpods`/`ru_scrabble`/`ru_erudit`) — only the registry's
    `Variant` key carries the rename, so `registry.go`, the published `scrabble-solver` fixtures and the
    dictionary release artifact are untouched (decouples the three repos).
  - **Migrations squashed** 12 → one hand-written `00001_baseline.sql`. Verified by a
    `pg_dump --schema-only` diff (the chain vs the baseline are **identical** but for the two intended
    variant-CHECK values) plus the green integration suite. **No data migration** (no production data).
  - **Done (cross-repo + contour):** the **`scrabble-dictionary` tidy** merged (PR #2) and was re-cut as
    the **byte-identical `v1.0.1`** release for clean provenance (the backend stays on `v1.0.0` — same
    bytes, no rewire; the backend pulls a version-pinned release artifact, not master). Post-merge the
    contour `backend` schema was wiped (`DROP SCHEMA backend CASCADE` + restart, not a volume drop) and
    re-migrated to the baseline — verified the new variant CHECK (`scrabble_en/scrabble_ru/erudit_ru`),
    `games`=0 and a clean boot.
 - **R2** (interview + implementation):
  - **Locked decisions:** game assembly via **invitations** (real path, no robots; not direct game-row
    inserts); **moderate** ramp **50 → 200 → 500** at 10 min/step; **diagnostic** pass bar (no SLO gate);
    run as a **one-shot container on `scrabble-internal`** in this PR.
  - **Harness** = new `scrabble/loadtest` module (`use ./loadtest` + a `replace scrabble/gateway` for the
    dot-free edge-proto import). It seeds 1000 guest + 10000 durable accounts + sessions **directly in
    Postgres** (token hash mirrors `backend/internal/session`), drives players over the **edge protocol**,
    generates **mid-ranked legal moves locally** with the embedded `scrabble-solver` by replaying
    `game.history` (the edge carries no board — mirrors `engine.ReplayBoard` via the public API), and a
    **gateway-hammer**. Compact CLI (`run` / `cleanup`), distroless Dockerfile (DAWGs baked), Go unit tests.
  - **Adding the module broke the other images' builds** — backend/gateway/telegram Dockerfiles reduce the
    workspace but still referenced `./loadtest` (not in their context); each now also
    `-dropuse=./loadtest` (backend/telegram additionally `-dropreplace` the gateway replace). Caught by the
    first deploy run; verified by building all four images.
  - **Harness payload fixes found by the smoke pass:** the draft DTO's `rack_order` is a string (was sent
    as `[]` → `bad_request`); the display-name validator forbids digits/colons, so the cleanup marker
    became a letters-only `Zzloadtest` so `profile.update` resends the seeded name. `chat_not_your_turn` /
    `nudge_own_turn` are **by-design** turn gates, correctly exercised.
  - **Observability:** added **cAdvisor + postgres_exporter** + the **Scrabble — Resources** dashboard +
    two Prometheus jobs. **Finding:** cAdvisor yields only the root cgroup on the contour host (separate
    XFS `/var/lib/docker` breaks its layer-ID resolution — the existing galaxy deploy has the same limit),
    so per-container CPU/RSS for the early pass was captured via `docker stats`. **R7:** adopt the otelcol
    `docker_stats` receiver (already the contrib image) for per-container metrics in Grafana.
  - **Early run (2026-06-09):** ramped clean to 500 players, no crash/deadlock, cleanup removed all 11000
    accounts. 1.2 M edge calls, 48 870 plays, 2 798 games finished; the per-user limiter held under the
    hammer (99.97 % rejected, p99 2 ms). **Top finding:** ~14 % `transport_error` on `game.state` at 500
    players, under CPU saturation (backend/gateway/Postgres each ~1 core) and amplified by the harness's
    single shared `http2.Transport`; the harness itself peaked at 86 % of a core on the same host, so the
    figures are pessimistic. Full trip report in [`../loadtest/REPORT-R2.md`](../loadtest/REPORT-R2.md);
    it feeds R3 (h2c `MaxConcurrentStreams`/timeouts, body-size cap), R6 and R7 (per-player transports,
    separate hardware, pool/limit sizing).
  - **CI:** `./loadtest/...` added to the path filter + vet/build/test; `go.work.sum` carries the new deps.
 - **R3** (interview + implementation):
  - **Locked decisions:** the flag column lands by **editing the R1 baseline** (+ a contour schema
    wipe after merge — no migration chain accrues before prod); auto-flag defaults **1000 rejected /
    10 min** (`BACKEND_HIGHRATE_FLAG_THRESHOLD`/`_WINDOW`, rolling window, set-once, operator clears,
    no auto-ban); landing image = **caddy:2-alpine**; throttle data flows **gateway → backend** (a
    30 s per-key summary POST to the new `/api/v1/internal/ratelimit/report`, the existing trusted
    direction) with the episode window + flag rule in the backend (`internal/ratewatch`); rejection
    logging = **Warn summary per key per window + Debug per rejection** — a deliberate deviation from
    the phase's "structured log per rejection" (the R2 hammer would have logged ~522k lines in
    minutes); all three R2-report tails included (explicit h2c sizing, the session-resolve failure
    cause at Warn, reviving the admin limiter).
  - **Body cap:** `GATEWAY_MAX_BODY_BYTES` (default 1 MiB) as both the Connect per-message read limit
    and an `http.MaxBytesReader` wrap of the public mux; an oversized Execute is `resource_exhausted`.
  - **Dead config found:** `AdminPerMinute`/`AdminBurst` were never wired — the gateway `/_gm` mount is
    now 429-guarded per IP ahead of its Basic-Auth. The caddy-fronted contour path stays unlimited
    (stock caddy has no limiter) — an accepted gap, recorded in `docs/ARCHITECTURE.md` §12.
  - **Landing split:** a `landing` target in `gateway/Dockerfile` (the UI build stage is shared;
    identical compose build args keep it one cached build); the gateway drops `landing.html` from the
    embed and 308-redirects `/` → `/app/`; the contour caddy routes `/app/`, `/telegram/` and the
    Connect path to the gateway and the catch-all to the landing container; the CI deploy probe now
    checks both `/` (landing) and `/app/` (gateway).
  - **Observability:** `gateway_rate_limited_total{class}` (user/public/email/admin, aggregate-only)
    + a rate-vs-rejections panel on the Edge/UX dashboard; the admin console gains the **Throttled**
    page (the in-memory episode window, reset-on-restart like `active_users`, plus the flagged-account
    queue) and the flag badge / clear action on the user list / card.
  - The jet regen also restored the previously missing `game_drafts`/`game_hidden` generated models
    (their tables were added after the last jetgen run; no behaviour change).
 - **R4** (interview + implementation):
  - **Locked decisions:** **delta-first**, not full snapshots — an event carries only the new move and
    the UI applies it to its per-game cache, keyed on `move_count` (idempotent + gap-safe: a gap or the
    actor's own move falls back to a `game.state` + `game.history` refetch). `match_found` /
    `game_started` carry the recipient's **initial `StateView`** (instant lobby→game); the fallback
    refetch stays the existing two calls (no merged endpoint); the matchmaking poll runs **only while
    the stream is down** (2.5 s); **all** UI-state-changing events carry their payload (incl. lobby `notify`).
  - **Enriched events** (`pkg/fbs` trailing fields — backward-compatible, no FB regen of *values*, only
    the schema): `opponent_moved` (+`move`/`game`/`bag_len`), `your_turn` (+`move_count`), `match_found`
    (+`state`), `game_over` (+`game`), `notify` (+`account`/`invitation`/`state`). The pre-R4
    `opponent_moved` scalars (`seat`/`action`/`score`/`total`) stay for wire back-compat, now redundant
    with `move`/`game` — slated for the R6 de-stage.
  - **Encoding placement:** the `notify` package keeps ownership of the FlatBuffers encoding (a new
    `encode.go` mirrors the gateway transcode but reads wire-agnostic `notify.*` input structs +
    `engine.MoveRecord`); the game/lobby/social services map their domain types to those structs, so the
    wire schema stays out of the domain. **Flagged for R6:** this partly duplicates the gateway encoders
    (different source types) — a candidate consolidation.
  - **Actor self-fetch killed too** (beyond literal "push"): the `submit_play`/`pass`/`exchange`/`resign`
    **response** (`MoveResult`) now returns the actor's refilled rack + bag size, so the mover renders the
    next turn from the response — `Game.svelte`'s `commit`/`pass`/`exchange`/`resign` drop their `await load()`.
  - **`match_found` enrichment** needs a per-seat initial state: `lobby.GameCreator` gained `InitialState`,
    and `game.Service.InitialState` builds the `notify.PlayerState` (rack re-encoded to wire indices, the
    variant alphabet embedded for a first-seen variant).
  - **UI:** a pure `lib/gamedelta.ts` reducer (`applyMoveDelta` / `applyGameOver` / `seedInitialState`,
    unit-tested) advances the cache; `app.svelte` seeds it on `match_found` / `game_started`; `Game.svelte`
    applies the delta (falling back to `load()` while composing, on a gap, or on its own move's new rack);
    `NewGame.svelte` polls only when `app.streamAlive` is false and guards its teardown so a push-delivered
    match is not cancelled.
  - **notify (friends/invitations) scope:** the backend carries the full account / invitation payload on the
    wire (per "all events → push"); the UI seeds the game cache from `game_started` but keeps its lightweight
    **authoritative** badge refresh (`refreshNotifications`, on the rare `notify` event + on foreground) rather
    than adding client-side friend/invitation caches — the per-move hot path is fully de-fetched, which was the
    goal. Deeper lobby-cache consumption is an easy follow-up.
  - **No schema change** (no migration); the contour needs no DB wipe. Tests: `notify` FB round-trips +
    `emitMove` delta + the `gamedelta` reducer; the e2e mock now emits the enriched delta.
 - **R5** (interview + implementation):
  - **No code slimming — by analysis.** A gzip measure + sourcemap attribution of the real `dist` showed
    the app bundle is already minified + tree-shaken and dominated by the Connect/FlatBuffers transport
    runtime + generated FB/PB bindings (≈⅔ of `main`'s source) and the Svelte runtime — all
    third-party/generated, irreducible within R5's scope. App-authored code carries no hand-trimmable fat.
  - **Lazy-load rejected** (screens *and* i18n): `bundle-size.mjs` sums every emitted chunk, so
    code-splitting moves bytes between chunks for **zero total-size win** while adding request latency (+N
    gateway fetches on first navigation to a split screen). i18n lazy-load additionally buys ≤3 KB (en-only
    users) at the cost of an async `t()`, and `en` must stay bundled (it is the `MessageKey` type source +
    fallback). **Chunk-collapsing rejected** too — keeping the near-static Svelte runtime in its own
    cacheable chunk is the recommended practice (an app deploy then re-busts only `main`, not the runtime),
    and HTTP/2 makes the extra preload request negligible.
  - **Metric retargeted to the app.** The two-entry build (`index.html` app + `landing.html`) makes Rollup
    hoist the code shared by both (Svelte runtime + i18n + `aboutContent`) into one preloaded chunk, so the
    app actually loads its entry chunk **+ the shared chunk** (≈74 + ≈23 = **≈97 KB**), never `landing.js`
    (≈1.6 KB). The old script summed all three chunks (98.8 KB), over-counting the app by `landing.js`.
    `bundle-size.mjs` now parses each built HTML for the JS it eagerly loads and gates three parts
    independently — **app entry ≤ 100 KB, shared (Svelte+i18n) ≤ 30 KB, landing-own ≤ 5 KB** — reporting the
    app total (≈97) and landing total (≈24.5). Same CLI + exit-code contract, so the CI step is unchanged.
  - **No app/source/build change** (`App.svelte`, `lib/i18n/`, `vite.config.ts` untouched); no schema
    change, no contour wipe. The stale "~82 KB" figure was corrected in `bundle-size.mjs` and `ui/README.md`.
 - **R6** (interview + implementation):
  - **Locked decisions:** apply **both** wire/code structural changes (**B** + **A**) and **only C1+C2** of
    the test consolidation (not C3/C5); strip the `*(Stage N)*` tags from **all current-state docs**
    (ARCHITECTURE / FUNCTIONAL+`_ru` / TESTING / UI_DESIGN), keeping PLAN.md / PRERELEASE.md / CLAUDE.md as
    history; **split `stage6_test.go`** by domain. The `h2cMaxConcurrentStreams` sizing stays an **R7**
    concern (tuning, not behaviour-preserving); the R2 early run forced no code fix, so nothing was carried in.
  - **(a) De-staging:** removed the `Stage N` / `TODO-N` / `(RN)` references across code, comments, service
    READMEs and the current-state docs, rewording narratives to present tense (no technical content lost).
    Renamed the only stage-named identifiers (`registerStage8`→`registerSocialOps`,
    `registerStage11`→`registerLinkOps`) and split `stage6_test.go` (`TestEmailLoginFlow`→`email_test.go`;
    `TestGuestAutoMatchLeavesNoStats`+`provisionGuest`→`account_test.go`). De-staged the `.fbs`/`.proto`
    comments and regenerated: only the `.proto`-derived Go docstrings (`*_grpc.pb.go`, `push.pb.go`) changed —
    flatc strips schema comments, so the FB Go/TS bindings were untouched.
  - **(b) Reconciliation:** the docs were accurate (each R-phase baked its own); the one drift was a stale
    "guest-reaping deferred (TODO-3)" note in `ARCHITECTURE.md` §3 — guest reaping is implemented, so the
    note was replaced with the current behaviour (FUNCTIONAL/TESTING already described it).
  - **(c) B — dead `opponent_moved` scalars:** removed `seat/action/score/total` from `OpponentMovedEvent`
    (`pkg/fbs/scrabble.fbs` + the `notify` emit + the round-trip test); regenerated FB Go + TS. No reader
    used them (the UI codec/mock take `move`/`game`/`bag_len`; the gateway forwards the payload verbatim).
    A pre-release wire-slot renumber — free with no prod data, no DB change.
  - **(c) A — shared FB builders:** new `scrabble/pkg/wire` holds the single definition of the nested wire
    tables (GameView / MoveRecord / StateView / AccountRef / Invitation) shared by the backend `notify`
    encoder and the gateway `transcode`; both map their own source types to neutral `wire.*` structs and
    delegate. **Honest tradeoff:** the verbose `Start/Add/End` + reverse-prepend boilerplate is now written
    once, but the field *set* is still mapped per side, and the new package makes the change net **+~145 LOC**
    — a single-source / anti-drift win for the fiddly mechanics rather than a line-count cut. Behaviour-
    preserving: the two sides' field sets were verified identical and the round-trip tests pass unchanged.
  - **(c) C1+C2 — inttest fixtures:** moved the cross-file service/game fixtures (`newGameService` was used by
    10 files) into `backend/internal/inttest/helpers.go`; single-file helpers stay local. Pure relocation.
  - **No schema change → no contour DB wipe.** Regression gate: the full unit + integration + UI suites plus
    the R7 stress run.
 - **R7** (interview + implementation):
  - **Locked decisions:** run the harness **same-host** (one-shot container on `scrabble-internal`, capped
    `--cpus=3` so the contour keeps spare cores); **apply container limits + `GOMAXPROCS` now** (not just a
    prod recommendation); **replace cAdvisor with the otelcol `docker_stats` receiver** (it resolved only the
    root cgroup on this host); keep rate-limit / h2c knobs **compiled-in** (change values only if the data
    demands — it did not).
  - **Harness refinements (pre-run):** each virtual player builds its **own `edge.Client`** (its own h2c
    connection for its Subscribe stream + Execute calls) instead of all players sharing one `http2.Transport` —
    the R2 `transport_error` artifact; and `playTurn` now reports a **finished** game so the player drops it
    from rotation. Effect, measured: `game.state` `transport_error` 14 % (R2) → **2.49 %**; `game_finished` on
    chat ≈ 3 900 → **35**.
  - **Observability:** added the `docker_stats` receiver to `otelcol` (`api_version: "1.44"` — the daemon's
    minimum is 1.40; the receiver defaults to 1.25 and crash-looped until pinned), mounted the docker socket
    read-only with `group_add` (the contrib image runs as UID 10001), dropped the cAdvisor service + its
    Prometheus job, and retargeted the **Scrabble — Resources** dashboard to the docker_stats metric names
    (`container_cpu_utilization`/100 == cores). Cross-checked against `docker stats` within sampling error.
  - **Profile (final run, 500 players, limits in force):** the **gateway is the binding constraint** — with
    one connection per player it bursts into its 2-core cap (the residual 2.49 % `transport_error`); backend
    ~0.85 core and postgres ~1.4 cores had headroom; **tempo reached its 1 GiB cap**; the backend pool sat at
    its `MaxOpenConns=25` cap (28 backends); docker logs were unbounded (~14 MiB / 30 min on the backend at
    info). Full write-up in [`../loadtest/REPORT-R7.md`](../loadtest/REPORT-R7.md).
  - **Round-2 tuning (owner-agreed, all in `deploy/docker-compose.yml`, no code change):** gateway **2 → 3
    cores + `GOMAXPROCS=3`**; tempo memory **1 → 2 GiB**; backend `MAX_OPEN_CONNS` **25 → 40**; a json-file
    **log-rotation** default (10m × 3) applied contour-wide via a YAML anchor (level stays info).
    backend/postgres kept at 2 cores / 512 MiB (headroom is cheap on the shared host).
  - **Validation:** the same gradual ramp on the tuned contour cut `game.state` `transport_error` to **0.72 %**
    (gateway ~2 cores, now under the 3-core cap, no throttle; tempo ~1.27 GiB, under 2 GiB). A separate
    **burst** run (a single 100 → 500 jump) pegged the gateway at 3 cores (≈296 % sustained, 9.27 % error),
    confirming it is **connection-CPU-bound** — a true arrival spike is a **horizontal-scaling** lever, not
    more cores per node (recorded in the prod-sizing recommendation).
  - **No schema change → no contour DB wipe.** Bake-back: `loadtest/REPORT-R7.md` (new), `loadtest/README.md`,
    `docs/TESTING.md`, the telemetry/observability section of `docs/ARCHITECTURE.md`, the repo-layout line in `CLAUDE.md`.
 - **UI — Tab-bar navigation redesign** (owner ad-hoc, not on the raw TODO list): drop the hamburger
  `Menu.svelte` everywhere (it fought the Telegram-fullscreen layout, where it had to be re-centred).
  - **Locked decisions (interview):** the in-Settings sub-nav is a **bottom TabBar with the active tab
    highlighted** (icon-only); **Export GCG** moves to the left slot of the move-history header (free in a
    finished game, where 🏁 *leave* does not apply); the lobby **⚙️ badge counts incoming friend requests
    only** (invitations keep their own lobby section); unread chat is badged on **the score bar and the 💬**.
  - **What shipped:** a ⚙️ **Settings hub** (`screens/SettingsHub.svelte`) over the existing
    Settings/Profile/Friends/About bodies and an in-game **comms hub** (`game/CommsHub.svelte`) over
    chat + dictionary, both with in-place tabs and a fixed back target; the game's menu items relocate into
    the open move history (🏁 leave / 📤 export + 💬 comms header) and the player cards (🤝 add-friend); a
    shared **TapConfirm** (`components/TapConfirm.svelte`, `lib/tapconfirm.ts`) — tap → fading ✅ → tap —
    replaces the Skip/Hint press-and-hold popovers and drives the add-friend confirm. Fixed the move-history
    "jump" bug (the slid board is now inert and the stage can't scroll, so a swipe up genuinely closes it).
    `Menu.svelte` + `HoldConfirm.svelte` removed.
  - **No schema/wire change → no contour DB wipe.** Bake-back: `docs/UI_DESIGN.md`, `docs/FUNCTIONAL.md`
    (+`_ru`). Regression gate: UI `check` + unit (`tapconfirm`) + build + bundle budget + e2e (Chromium &
    WebKit), all green.
 - **UI — Merge Exchange/Pass; drop the dead Tournaments tab** (owner ad-hoc, not on the raw TODO
  list): the lobby's 🏆 *Tournaments* tab was an inert `lobby.soon` toast — removed (the lobby is back
  to three tabs, matching `docs/FUNCTIONAL.md`). In-game the separate 🥺 *Skip* (pass) tab folds into
  the 🔄 tab, now **Exchange/Pass**, whose dialog passes when no tile is selected and exchanges when
  tiles are.
  - **Decision — a pass is NOT an exchange of zero (verified against the rules + GCG):** the merge is
    **UI-only**. Pass and exchange stay distinct game actions end-to-end — wire (`GameActionRequest` vs
    `ExchangeRequest`), engine (`ActionPass` vs `ActionExchange`), and the GCG Poslfit dialect (a pass is
    a bare `-`, an exchange is `-TILES`). The engine forbids a zero-tile exchange (`ErrNothingToExchange`)
    and allows an exchange only with a full rack left in the bag (`ErrNotEnoughTilesToExchange`), while a
    pass is always legal — collapsing them would lose a real distinction. The dialog dispatches the
    existing `gateway.pass` / `gateway.exchange`.
  - **What shipped:** `Lobby.svelte` (tab removed); `Game.svelte` (one 🔄 Exchange/Pass tab no longer
    gated on an empty bag; the dialog disables tile selection while the bag is below a full rack
    (`bagLen >= RACK_SIZE`), its confirm button reading **Pass without exchanging** / **Exchange N**);
    i18n (`game.draw` → Exchange/Pass, new `game.passNoExchange`, dropped `game.skip` /
    `lobby.tournaments` / `lobby.soon`). No backend/wire/history/GCG change.
  - **No schema/wire change → no contour DB wipe.** Bake-back: `docs/UI_DESIGN.md`, `docs/FUNCTIONAL.md`
    (+`_ru`). Regression gate: UI `check` + unit + build + bundle budget + e2e (Chromium & WebKit).
 - **AI — Honest AI opponent in quick game** (owner ad-hoc, not on the raw TODO list): a second quick-game
  opponent the player *knowingly* chooses, distinct from the disguised robot of the random/open path
  (which is kept as-is). New Game's quick-game mode replaces the "auto-match" subtitle with a two-button
  selector **🤖 AI / 👤 Random player** (the `.seg`/`.opt` segmented style, AI the default); for AI the
  move-clock line reads "Loss after 7 days of inactivity" and the "searching" hint is hidden.
  - **Locked decisions (interview):** AI move is **event-driven** (the robot replies the instant the
    player's move commits; the 30 s driver is the fallback); AI games **do not touch `account_stats`**
    (practice, like guests); the **Stage 5 strength logic is reused unchanged** (`playToWin` 40 % from the
    seed + margin band); **no per-move timeout — a 7-day inactivity loss** instead; the 7-day line lives on
    the New Game screen (the in-game screen has no move-clock line); chat + nudge **disabled**, word-check
    kept, add-friend never drawn, opponent shown as **🤖** everywhere.
  - **The 7-day rule reuses the existing per-turn timeout:** an AI game is created with
    `turn_timeout_secs = AIInactivityTimeout` (7 days) and the existing timeout sweeper resigns the overdue
    seat — since the robot moves at once, only the human is ever on the clock, so the per-turn timeout *is*
    the abandon rule (no new column, no new sweeper).
  - **One game flag drives everything:** `games.vs_ai` (edited into the R1 baseline — pre-release, so a
    contour DB wipe after merge). It is set **only** on AI-started games, so a robot-filled random game keeps
    `vs_ai=false` and the disguised opponent is never revealed; the UI derives 🤖 / the gates **from the flag,
    never from the opponent account**. New backend path `Matchmaker.StartVsAI` (picks a pooled robot via the
    existing `Pick`, creates an **active** seated game via `game.Service.Create`, random seat order) — the AI
    request never enters the open pool, so the open-game reaper never touches it. The robot driver gains a
    `vs_ai` branch (no sleep, no proactive nudge, zero delay) and a focused `DriveGame`/`TriggerMove` fast
    path wired from the game service's after-create/after-commit hook (`SetAITrigger`, a func value so the
    game package never imports the robot package). Chat/nudge gated by a new `social` `VsAI` check
    (`ErrGameVsAI` → 409 `ai_game`); statistics skipped in `commit` when `vs_ai`.
  - **Wire:** `EnqueueRequest` += `vs_ai`, `GameView` += `vs_ai` (trailing FB fields, regenerated Go + TS),
    threaded through the backend DTO, the gateway transcode and the `pkg/wire` + `notify` builders.
  - **Tests:** `lobby` unit (StartVsAI seats a robot + flags the game; empty pool leaves no game); backend
    integration (`ai_game_test.go`: active+seated+vs_ai+7-day clock, robot moves immediately, stats skipped,
    7-day timeout resigns the human, chat/nudge rejected); UI codec round-trip (`vs_ai` on enqueue + game
    view); e2e (an AI game shows 🤖, no "searching", chat disabled, the dictionary still works) + the
    existing quick-match e2e updated to pick **Random player** (the default is now AI).
  - **Schema/wire change → a contour DB wipe** after merge (`DROP SCHEMA backend CASCADE` + restart, the
    R1/R3 pattern). Bake-back: `docs/ARCHITECTURE.md`, `docs/FUNCTIONAL.md` (+`_ru`), `docs/UI_DESIGN.md`,
    `backend/README.md`, Go Doc comments.
  - **Post-review refinements (owner, same PR):** (1) the **GCG export labels the robot seat "AI"** rather
    than its human-like pool name (`ExportGCG` overrides the name via `accounts.IsRobot`; the in-app 🤖 is
    unchanged); (2) honest-AI games **emit no `your_turn`** — the robot replies instantly, so the signal
    would arrive with the move and be pointless; `opponent_moved` still advances the UI; (3) the **admin
    console surfaces the AI flag** — a **🤖 column** in `/games` and an "AI game" line on the game card
    (`GameRow`/`GameDetailView` gain `VsAI`); (4) `games_started_total` / `games_abandoned_total` gain a
    **`vs_ai`** attribute and the Grafana *Game domain* dashboard splits started/abandoned into **human**
    and **AI** panels.
  - **Follow-up (separate PR — strategy deviation):** the robot now plays **≈20%** of opening/midgame moves
    *against* its per-game `playToWin` intent (toward the opposite margin band — a winning robot eases off, a
    losing one surges ahead), tapering linearly to **0 over the last 14 bag tiles** and **0 once the bag is
    empty**, so the endgame follows the chosen strategy strictly while earlier outcomes can swing the human's
    way. Deterministic from the seed (`mix(seed,"deviate",moveCount)`), applied to **both** robot paths via
    the shared `selectMove`; the per-game intent (and the admin card) is unchanged. Tests: `robot` unit
    (taper bounds + monotonicity, never-in-endgame, determinism, ~20% distribution). Bake-back:
    `docs/ARCHITECTURE.md` §7, `docs/FUNCTIONAL.md` (+`_ru`), `backend/README.md`, `PLAN.md` Stage 5.
 - **GL — Simultaneous quick-game cap** (owner ad-hoc, not on the raw TODO list): a player may hold at
  most **10** active quick games; at the cap the lobby greys **New Game** and shows a plain notice
  "Вы достигли лимита одновременных партий", both clearing automatically when an active game finishes.
  - **Locked decisions (interview):** what counts = active **+** open (searching) quick games, **including
    AI** (`vs_ai`); friend games (invitation-linked) **never** count. The backend gate refuses **all** new-game
    creation at the cap — `lobby/enqueue` **and** `invitations` — with **409 `game_limit_reached`**; **accepting**
    an invitation is never gated, so friend games are capped "from the other end". Delivery = a boolean
    **`at_game_limit`** on the existing `games.list` (no per-event payload: a turn change does not move the count,
    and the lobby already re-fetches `games.list` on entry + every game event); the first uncached lobby frame
    defaults the button **enabled** (the backend gate is the authority).
  - **What shipped:** `game.MaxActiveQuickGames` + `Store/Service.CountActiveQuickGames` (active/open seats, no
    `game_invitations` row; hidden games still count → a dedicated count, not a filter over the lobby list);
    `Server.atGameLimit`/`ensureUnderGameLimit` gating `handleEnqueue` + `handleCreateInvitation`;
    `gameListDTO.at_game_limit`; the FB `GameList` trailing `at_game_limit` (regenerated Go + TS) threaded through
    the gateway transcode + UI codec; `lib/model` + `lobbycache` snapshot + `Lobby.svelte` (disabled tab + a muted
    `.limit` notice); i18n `lobby.limitReached` (en authoritative + ru).
  - **Caveat (logged):** the gate is a pre-check, not transaction-atomic — concurrent creates from one account could
    momentarily exceed by 1–2 (harmless soft cap; the UI disables the button regardless). Strict atomicity was judged
    a disproportionate diff across the two create paths.
  - **No schema change → no contour DB wipe** (only a trailing FB field, no migration). Tests: backend integration
    (`game_limit_test.go`: count rule + HTTP gate 409 + accept bypass), server unit (error mapping), gateway
    transcode round-trip, UI codec + lobbycache unit, e2e (`gamelimit.spec.ts`). Bake-back: `docs/FUNCTIONAL.md`
    (+`_ru`), `docs/ARCHITECTURE.md` §8, `docs/UI_DESIGN.md`, `backend/README.md`.
 - **CM — Channel-chat moderation + promo bot** (owner ad-hoc, not on the raw TODO list):
  - **Locked decisions (interview):** the promo bot is a **goroutine in `cmd/bot`** (its own token, no
    bot-link); the moderated chat's default-no-send is configured by a **human** in the group settings (the
    bot only grants, never `setChatPermissions`); a non-eligible joiner is **left muted silently**; a
    temporary-suspension expiry is handled by a **backend sweeper** that emits the re-evaluate event; and a new
    **`chat_muted` role** is a chat-only mute with the **game suspension dominating**
    (`eligible = registered AND NOT suspended AND NOT chat_muted`).
  - **Bot API reality (verified against the docs):** a cross-bot Mini App launch must be a **URL button** to the
    main bot's `t.me/<bot>?startapp` link — a `web_app` button signs initData with the *sending* bot's token,
    which the main validator rejects — so the promo button reuses the UI's `VITE_TELEGRAM_LINK`. `chat_member`
    updates arrive **only** when the bot is a chat **admin** with the "Ban users" right (the client label for the
    Bot API `can_restrict_members`) and `chat_member` is in `allowed_updates`; bots cannot list members but can
    `getChatMember` a single user, which is the membership guard on the block/unblock path.
  - **Wire:** `pkg/proto/botlink/v1` gains a `ChatGateCommand` in the `Command` oneof and a unary
    `ResolveChatEligibility`; the backend gains `notify.KindChatAccessChanged` (no payload, infra-only — never an
    out-of-app message) and an internal `POST /api/v1/internal/chat-access` resolver; the gateway resolves the
    join (by external_id) and the event (by user_id) through it and pushes the chat-gate command fire-and-forget
    (at-most-once, recovered by the next moderation action or a re-join).
  - **No schema change → no contour DB wipe:** `chat_muted` is a new `account.KnownRoles` entry (the
    `account_roles` table is data-driven). The suspension-expiry sweeper is a new `account.SuspensionSweeper`
    (a 1-minute window, idempotent) started in `cmd/backend`, alongside the guest reaper.
  - **Deploy:** new `TEST_`/`PROD_` `TELEGRAM_PROMO_BOT_TOKEN` (secret), `TELEGRAM_BOT_USERNAME` and
    `TELEGRAM_CHAT_ID` (variables); the promo link reuses the existing `*_VITE_TELEGRAM_LINK` variable as
    `TELEGRAM_BOT_LINK`. The bot must be promoted to admin in the real discussion group, and the group default
    set to no-send, as part of the Stage 18 prod cutover (the test contour exercises the code path).
  - **Bake-back:** `docs/ARCHITECTURE.md`, `docs/FUNCTIONAL.md` (+`_ru`), `platform/telegram/README.md`,
    `backend/README.md`, Go Doc comments. Tests: backend resolver truth table + publish on block/unblock/role +
    the sweeper window (unit + integration); gateway hub `ResolveChatEligibility` + the chat-gate command; bot
    `chat_member` grant + `ApplyChatGate` getChatMember-guard; promo `/start` localization + URL button; config
    parsing.
  - **Post-contour-test fixes (same PR):** a live test drove three corrections. (1) **Strategy
    inversion (the key one)** — the original "group default no-send, bot grants the eligible" cannot
    work: Telegram intersects the chat default with each user's permission, so a per-user grant never
    exceeds a deny-by-default group (the bot set `can_send=true` yet the user still could not write).
    The group now **allows sending by default** and the bot only **restricts** — it mutes an ineligible
    member (unregistered / admin-suspended / `chat_muted`) and un-mutes an eligible one it had muted,
    acting only when the current state differs (idempotent; the bot's own change is skipped by matching
    the actor id to the bot). A present member in a default-allow group can appear as `restricted` with
    `is_member`, so the gate reads both. (2) **Join-before-register** — a user who joins before
    registering is covered by no `chat_member` event, so `ProvisionTelegram` now reports first contact
    and the Telegram auth handler emits `chat_access_changed` on it. (3) **Observability** — a startup
    self-check logs whether the bot is an admin-with-restrict in the chat (it caught a misconfigured
    `TELEGRAM_CHAT_ID` set to a channel id, not the discussion-group id); the per-event trace is at
    Debug, the actual mute/unmute and warnings at Info.
@@ -22,9 +22,8 @@ supports English Scrabble, Russian Scrabble and Эрудит.
  security, cross-service contracts.
 - [`docs/FUNCTIONAL.md`](docs/FUNCTIONAL.md) (+ [`_ru`](docs/FUNCTIONAL_ru.md)) —
  per-domain user stories.
- [`docs/TESTING.md`](docs/TESTING.md) — test layers and the per-stage CI gate.
+- [`docs/TESTING.md`](docs/TESTING.md) — test layers and the CI gate.
- [`PLAN.md`](PLAN.md) — the staged implementation plan and stage tracker.
+- [`CLAUDE.md`](CLAUDE.md) — project guide and development workflow.
 - [`CLAUDE.md`](CLAUDE.md) — project guide and the mandatory per-stage workflow.
 ## Build & test
@@ -90,7 +89,7 @@ observability stack (OTel Collector → Prometheus + Tempo → Grafana) + a fron
 services build from multi-stage distroless `*/Dockerfile`.
 ```sh
-docker build -f backend/Dockerfile -t scrabble-backend .   # pulls the DAWG release artifact
+docker build --build-arg DICT_VERSION=v1.3.0 -f backend/Dockerfile -t scrabble-backend .  # DICT_VERSION required; pulls that DAWG release artifact
 docker build -f gateway/Dockerfile -t scrabble-gateway .   # node stage builds + embeds the UI
 docker compose -f deploy/docker-compose.yml config         # validate (needs the TEST_/PROD_ env)
 ```
@@ -7,12 +7,14 @@
 # (GOPRIVATE), so the build stage needs git and network.
 #
 # Build from the repository root so go.work, go.work.sum, pkg/ and backend/ are all
-# in the Docker context:
+# in the Docker context. DICT_VERSION has no default — the caller supplies the
-#   docker build -f backend/Dockerfile -t scrabble-backend .
+# scrabble-dictionary release tag (compose/CI pass it; see deploy/README.md
 # "Bumping the dictionary version"):
 #   docker build --build-arg DICT_VERSION=v1.3.0 -f backend/Dockerfile -t scrabble-backend .
 # --- dictionary artifact -----------------------------------------------------
 FROM alpine:3.20 AS dawg
-ARG DICT_VERSION=v1.2.1
+ARG DICT_VERSION
 RUN apk add --no-cache curl tar
 RUN mkdir -p /dawg \
 && curl -fsSL -o /tmp/dawg.tar.gz \
@@ -33,14 +35,16 @@ COPY backend ./backend
 # Reduce the workspace to what the backend needs: backend + pkg. loadtest and the
 # gateway replace it requires are not in this context, so drop both.
 RUN go work edit -dropuse=./gateway -dropuse=./platform/telegram -dropuse=./loadtest -dropreplace=scrabble/gateway@v0.0.0
-RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/backend ./backend/cmd/backend
+# VERSION (the deploy passes the git tag) is stamped into the binary via the linker.
 ARG VERSION=dev
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-X scrabble/pkg/version.Version=${VERSION}" -o /out/backend ./backend/cmd/backend
 # --- runtime -----------------------------------------------------------------
 FROM gcr.io/distroless/static-debian12:nonroot
 # Re-declare the build arg in this stage so it labels the seed dictionary. One
 # DICT_VERSION drives both the artifact the dawg stage downloads and the version
 # label the binary pins, so the resident version equals the release tag.
-ARG DICT_VERSION=v1.2.1
+ARG DICT_VERSION
 COPY --from=build /out/backend /usr/local/bin/backend
 # Own the seed dictionary as the nonroot runtime user (UID 65532): a named volume
 # mounted at /opt/dawg inherits this ownership on first use, so the admin console
@@ -228,7 +228,7 @@ internal/banview/    # gateway active-ban mirror: the console's Active IP bans p
 ```sh
 docker run -d --name scrabble-pg -e POSTGRES_PASSWORD=dev -p 5432:5432 postgres:17-alpine
 # DAWGs: extract the dictionary release artifact (or point at a local scrabble-solver/dawg):
-mkdir -p /tmp/dawg && curl -fsSL https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/v1.2.1/scrabble-dawg-v1.2.1.tar.gz | tar xz -C /tmp/dawg
+mkdir -p /tmp/dawg && curl -fsSL https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/v1.3.0/scrabble-dawg-v1.3.0.tar.gz | tar xz -C /tmp/dawg
 BACKEND_POSTGRES_DSN='postgres://postgres:dev@localhost:5432/postgres?search_path=backend&sslmode=disable' \
  BACKEND_DICT_DIR=/tmp/dawg \
  GOPRIVATE='gitea.iliadenisov.ru/*' \
@@ -3,8 +3,8 @@
 // loads the dictionaries into the engine registry, warms the session cache,
 // constructs the game domain and starts its turn-timeout sweeper, constructs the
 // lobby and social domains, then serves the HTTP listener with the infrastructure
-// probes and the /api/v1 route-group skeleton. Domain HTTP endpoints are added
+// probes and the /api/v1 route group, behind which the domains expose their HTTP
-// with the gateway in a later stage described in PLAN.md.
+// endpoints to the gateway.
 package main
 import (
@@ -119,6 +119,16 @@ func (s *Store) ProvisionByIdentity(ctx context.Context, kind, externalID string
 	return s.provision(ctx, kind, externalID, provisionSeed{})
 }
 // ProvisionEmail returns the account owning the email identity externalID, creating
 // it (unconfirmed) on first contact with browserTZ — the client's detected "±HH:MM"
 // UTC offset — seeded into its time zone. Like ProvisionByIdentity it is race-safe
 // and leaves an existing account untouched, so a returning user's saved zone is never
 // overwritten. The email account is created here (the code-request step), not at the
 // later login, so this is where its zone is seeded.
 func (s *Store) ProvisionEmail(ctx context.Context, externalID, browserTZ string) (Account, error) {
 	return s.provision(ctx, KindEmail, externalID, provisionSeed{timeZone: seedZone(browserTZ)})
 }
 // ProvisionRobot provisions (or finds) the durable account backing a robot pool
 // member: a KindRobot identity carrying displayName, with chat blocked but friend
 // requests NOT blocked — a request to a robot is accepted as pending and, since the
@@ -160,7 +170,7 @@ func (s *Store) ProvisionRobot(ctx context.Context, externalID, displayName stri
 // is never overwritten. The created flag lets the auth handler re-evaluate moderated-
 // chat write access on first registration — the path of a user who joined the chat
 // before registering, whom no chat_member event covers.
-func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode, username, firstName string) (Account, bool, error) {
+func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode, username, firstName, browserTZ string) (Account, bool, error) {
 	// Pre-check whether the identity already exists so the caller can act on first
 	// contact. A race with a concurrent create only over- or under-reports created for
 	// that one call, which the idempotent chat-access re-evaluation tolerates.
@@ -169,7 +179,9 @@ func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode,
 	if err != nil && !created {
 		return Account{}, false, err
 	}
-	acc, err := s.provision(ctx, KindTelegram, externalID, telegramSeed(languageCode, username, firstName))
+	seed := telegramSeed(languageCode, username, firstName)
 	seed.timeZone = seedZone(browserTZ)
 	acc, err := s.provision(ctx, KindTelegram, externalID, seed)
 	return acc, created, err
 }
@@ -197,20 +209,33 @@ func (s *Store) provision(ctx context.Context, kind, externalID string, seed pro
 }
 // provisionSeed carries the optional create-time profile seed for a brand-new
-// account (Telegram first contact). Empty fields fall back to the accounts table
+// account (first contact). Empty fields fall back to the accounts table defaults,
-// defaults, so an unknown language keeps the 'en' default and an empty name keeps
+// so an unknown language keeps the 'en' default, an empty name keeps the ” default
-// the ” default.
+// and an empty time zone keeps the 'UTC' default.
 type provisionSeed struct {
 	preferredLanguage string
 	displayName       string
 	timeZone          string
 }
 // seedZone returns browserTZ when it is a well-formed zone to persist at account
 // creation (a "±HH:MM" offset or a loadable IANA name), else "" so the new account
 // falls back to the accounts table's 'UTC' default. The client reports the device's
 // detected offset deterministically; a bad value is dropped rather than guessed at.
 func seedZone(browserTZ string) string {
 	if validZone(browserTZ) {
 		return browserTZ
 	}
 	return ""
 }
 // telegramSeed derives the create-time seed from Telegram launch fields: a
 // supported preferred language from languageCode (an ISO-639 code, possibly
-// region-tagged like "ru-RU"), and a display name sanitized from firstName or,
+// region-tagged like "ru-RU"), and a display name. The name precedence is the real
-// failing that, username (sanitizeDisplayName strips disallowed characters to the
+// name (firstName, sanitized to the editable format) → the @username taken verbatim
-// editable format). When neither yields any letters, it falls back to a generated
+// (already a valid handle, only trimmed and length-capped, never character-stripped)
-// placeholder in the seeded language (placeholderDisplayName).
+// → a generated placeholder in the seeded language (placeholderDisplayName), reached
 // only when firstName has no usable letters and no username is set.
 func telegramSeed(languageCode, username, firstName string) provisionSeed {
 	var seed provisionSeed
 	if lang, _, _ := strings.Cut(strings.ToLower(strings.TrimSpace(languageCode)), "-"); lang == "en" || lang == "ru" {
@@ -218,7 +243,13 @@ func telegramSeed(languageCode, username, firstName string) provisionSeed {
 	}
 	name := sanitizeDisplayName(firstName)
 	if name == "" {
-		name = sanitizeDisplayName(username)
+		// The real name yielded nothing usable: fall back to the @username verbatim
 		// (Telegram guarantees a valid handle), only trimmed and capped to the column
 		// width — never character-stripped like the real name.
 		name = strings.TrimSpace(username)
 		if r := []rune(name); len(r) > maxDisplayName {
 			name = strings.TrimRight(string(r[:maxDisplayName]), " ")
 		}
 	}
 	if name == "" {
 		name = placeholderDisplayName(seed.preferredLanguage)
@@ -361,16 +392,22 @@ func (s *Store) create(ctx context.Context, kind, externalID string, seed provis
 	var created Account
 	err = withTx(ctx, s.db, func(tx *sql.Tx) error {
-		// Seed the new row's display name and language (Telegram first contact); an
+		// Seed the new row's display name, language and time zone (first contact); an
-		// empty seed reproduces the table defaults ('' and 'en') the other callers
+		// empty seed reproduces the table defaults ('', 'en' and 'UTC') the other callers
-		// relied on, so their behaviour is unchanged.
+		// relied on, so their behaviour is unchanged. time_zone is written explicitly (the
 		// detected offset, or 'UTC' equal to the column default) so a seeded zone lands at
 		// creation while an unseeded one stays UTC.
 		lang := seed.preferredLanguage
 		if lang == "" {
 			lang = "en"
 		}
 		tz := seed.timeZone
 		if tz == "" {
 			tz = "UTC"
 		}
 		insertAccount := table.Accounts.
-			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage).
+			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage, table.Accounts.TimeZone).
-			VALUES(accountID, seed.displayName, lang).
+			VALUES(accountID, seed.displayName, lang, tz).
 			RETURNING(table.Accounts.AllColumns)
 		var row model.Accounts
@@ -409,15 +446,21 @@ const guestDisplayName = "Guest"
 // ProvisionGuest creates a fresh ephemeral guest account: a durable row carrying
 // no identity, flagged is_guest, so it can hold a session and a game seat (both
 // foreign-key the accounts table) while being excluded from statistics, friends
-// and history. Guests are not reused — each bootstrap mints a new account.
+// and history. Guests are not reused — each bootstrap mints a new account. browserTZ
-func (s *Store) ProvisionGuest(ctx context.Context) (Account, error) {
+// (the client's detected "±HH:MM" UTC offset) seeds the guest's time zone, falling
 // back to the 'UTC' default when empty or malformed.
 func (s *Store) ProvisionGuest(ctx context.Context, browserTZ string) (Account, error) {
 	accountID, err := uuid.NewV7()
 	if err != nil {
 		return Account{}, fmt.Errorf("account: new guest id: %w", err)
 	}
 	tz := seedZone(browserTZ)
 	if tz == "" {
 		tz = "UTC"
 	}
 	stmt := table.Accounts.
-		INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.IsGuest).
+		INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.IsGuest, table.Accounts.TimeZone).
-		VALUES(accountID, guestDisplayName, true).
+		VALUES(accountID, guestDisplayName, true, tz).
 		RETURNING(table.Accounts.AllColumns)
 	var row model.Accounts
@@ -131,13 +131,15 @@ func (s *EmailService) ConfirmCode(ctx context.Context, accountID uuid.UUID, ema
 // the unauthenticated email-login entry point and, unlike RequestCode,
 // does not refuse an already-confirmed email — that is the ordinary returning-user
 // login. The code is mailed to the address, so only its real owner can complete
-// the login. It returns the target account id for the subsequent LoginWithCode.
+// the login. On first contact browserTZ (the client's detected "±HH:MM" UTC offset)
-func (s *EmailService) RequestLoginCode(ctx context.Context, email string) (uuid.UUID, error) {
+// seeds the new account's time zone. It returns the target account id for the
 // subsequent LoginWithCode.
 func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ string) (uuid.UUID, error) {
 	addr, err := normalizeEmail(email)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	acc, err := s.store.ProvisionByIdentity(ctx, KindEmail, addr)
+	acc, err := s.store.ProvisionEmail(ctx, addr, browserTZ)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
@@ -9,8 +9,9 @@ import (
 // TestTelegramSeed covers the pure mapping from Telegram launch fields to the
 // create-time account seed: supported-language detection (bare and region-tagged),
-// the first-name / username display-name precedence, and the sanitization that
+// the real-name → @username (verbatim) → placeholder display-name precedence, and
-// strips disallowed characters (emoji, digits, punctuation) to the editable format.
+// the sanitization of the real name (emoji, digits, punctuation stripped to the
 // editable format). The username, when used, is kept verbatim.
 func TestTelegramSeed(t *testing.T) {
 	cases := map[string]struct {
 		languageCode, username, firstName string
@@ -28,6 +29,7 @@ func TestTelegramSeed(t *testing.T) {
 		"punct to space":      {"en", "user", "John❤Doe", "en", "John Doe"},
 		"digits dropped":      {"ru", "user", "Маша123", "ru", "Маша"},
 		"garbage to username": {"en", "good", "123!@#", "en", "good"},
 		"username verbatim":   {"en", "co_ol99", "🎮🎮", "en", "co_ol99"},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
@@ -52,7 +54,7 @@ func TestTelegramSeedPlaceholder(t *testing.T) {
 		"en empty":                  {"en", "", "", `^Player-\d{5}$`},
 		"ru empty":                  {"ru", "", "", `^Игрок-\d{5}$`},
 		"default en":                {"fr", "", "", `^Player-\d{5}$`},
-		"both garbage": {"ru", "123", "!!!", `^Игрок-\d{5}$`},
+		"name garbage, no username": {"ru", "", "!!!", `^Игрок-\d{5}$`},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
@@ -7,8 +7,9 @@
 <li><b>From</b> <a href="/_gm/users/{{.AccountID}}">{{.SenderName}}</a> ({{.Source}})</li>
 <li><b>Channel</b> {{.Channel}}</li>
 <li><b>Interface language</b> {{.InterfaceLanguage}}</li>
 <li><b>App version</b> {{if .Version}}<code>{{.Version}}</code>{{else}}<span class="note">unknown</span>{{end}}</li>
 <li><b>IP</b> {{if .IP}}<code>{{.IP}}</code>{{else}}<span class="note">none</span>{{end}}</li>
-<li><b>Filed</b> {{.CreatedAt}}</li>
+<li><b>Filed</b> {{.CreatedAt}} UTC &middot; browser {{if .CreatedAtBrowser}}{{.CreatedAtBrowser}} ({{.BrowserTZ}}){{else}}<span class="note">N/A</span>{{end}} &middot; user {{if .CreatedAtUser}}{{.CreatedAtUser}} ({{.UserTZ}}){{else}}<span class="note">N/A</span>{{end}}</li>
 <li><b>State</b> {{if .Archived}}archived{{else if .Read}}read{{else}}<span class="warn">unread</span>{{end}}</li>
 {{if .Banned}}<li><b>Feedback</b> <span class="warn">sender is banned from feedback</span></li>{{end}}
 </ul>
@@ -554,5 +554,17 @@ type FeedbackDetailView struct {
 	ReplyBody         string
 	RepliedAt         string
 	CreatedAt         string
 	// Version is the client app build the report was sent from (empty for rows that predate it).
 	Version string
 	// The Filed time is shown in three zones so the operator can tell what is certainly known from
 	// what is merely defaulted. CreatedAt is the authoritative UTC time. CreatedAtBrowser is that
 	// instant in the client's UTC offset detected at submit (BrowserTZ its "±HH:MM" label), empty
 	// when the client reported none (an older build). CreatedAtUser is that instant in the sender's
 	// saved profile zone (UserTZ its label), empty when the account has no zone beyond the UTC
 	// default — the template then shows "N/A" so the missing datum is explicit.
 	CreatedAtBrowser string
 	BrowserTZ        string
 	CreatedAtUser    string
 	UserTZ           string
 	Banned           bool
 }
@@ -21,7 +21,7 @@ const (
 	// ActionResign abandons the game.
 	ActionResign
 	// ActionTimeout is the auto-resignation a missed turn becomes; recorded by
-	// the game domain in a later stage, never produced by the engine itself.
+	// the game domain, never produced by the engine itself.
 	ActionTimeout
 )
@@ -10,7 +10,7 @@
 // characters (see decode.go and docs/ARCHITECTURE.md §9.1), so archived games
 // replay independently of any dictionary. Second, the engine owns rules and
 // scoring only: turn scheduling, the 24-hour timeout, persistence and transport
-// belong to the game domain in a later stage.
+// belong to the game domain.
 package engine
 import (
@@ -31,7 +31,7 @@ type entry struct {
 // Registry holds the dictionaries resident in memory, addressed by variant and
 // dictionary version, and the solvers built over them. Several versions of a
 // variant may be resident at once; a game pins the version it started on. The
-// admin reload flow (a later stage) registers a new version through Load.
+// admin reload flow registers a new version through Load.
 // Registry is safe for concurrent use.
 type Registry struct {
 	mu      sync.RWMutex
@@ -72,7 +72,7 @@ func (svc *Service) SetNotifier(p notify.Publisher) {
 // validates the body (non-empty, within the rune limit) and the optional
 // attachment (size and extension allow-list). senderIP is the gateway-forwarded
 // client IP (validated); channel is the submitting platform.
-func (svc *Service) Submit(ctx context.Context, accountID uuid.UUID, body string, attachment []byte, attachmentName, channel, senderIP string) error {
+func (svc *Service) Submit(ctx context.Context, accountID uuid.UUID, body string, attachment []byte, attachmentName, channel, version, browserTZ, senderIP string) error {
 	acc, err := svc.accounts.GetByID(ctx, accountID)
 	if err != nil {
 		return err
@@ -112,9 +112,10 @@ func (svc *Service) Submit(ctx context.Context, accountID uuid.UUID, body string
 		attachmentName = "" // a name without bytes carries no attachment
 	}
 	ch := normalizeChannel(channel)
-	// Snapshot the sender's interface language at submit time (acc is already loaded
+	// Snapshot the sender's interface language, the client app version and the client's
-	// for the guest check) so the operator later sees the state as it was.
+	// detected UTC offset at submit time (acc is already loaded for the guest check) so the
-	_, err = svc.store.Insert(ctx, accountID, body, attachment, attachmentName, ch, acc.PreferredLanguage, parseIP(senderIP))
+	// operator later sees the state as it was.
 	_, err = svc.store.Insert(ctx, accountID, body, attachment, attachmentName, ch, acc.PreferredLanguage, version, browserTZ, parseIP(senderIP))
 	return err
 }
@@ -34,10 +34,10 @@ func NewStore(db *sql.DB) *Store {
 // Insert stores one feedback message from accountID and returns its id. attachment
 // is the raw file bytes (nil for none); attachmentName, ip and a non-default
-// channel are stored as given. lang (the sender's interface language) is a snapshot
+// channel are stored as given. lang (interface language), version (client app build) and
-// taken now, so the operator later sees the state at submit time. created_at defaults
+// browserTZ (the client's detected "±HH:MM" UTC offset) are snapshots taken now, so the operator
-// to now() in the database.
+// later sees the state at submit time. created_at defaults to now() in the database.
-func (s *Store) Insert(ctx context.Context, accountID uuid.UUID, body string, attachment []byte, attachmentName, channel, lang string, ip *string) (uuid.UUID, error) {
+func (s *Store) Insert(ctx context.Context, accountID uuid.UUID, body string, attachment []byte, attachmentName, channel, lang, version, browserTZ string, ip *string) (uuid.UUID, error) {
 	id, err := uuid.NewV7()
 	if err != nil {
 		return uuid.Nil, fmt.Errorf("feedback: new message id: %w", err)
@@ -48,9 +48,9 @@ func (s *Store) Insert(ctx context.Context, accountID uuid.UUID, body string, at
 	}
 	if _, err := s.db.ExecContext(ctx,
 		`INSERT INTO backend.feedback_messages
-		   (message_id, account_id, body, attachment, attachment_name, channel, lang, sender_ip)
+		   (message_id, account_id, body, attachment, attachment_name, channel, lang, app_version, browser_tz, sender_ip)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
-		id, accountID, body, att, nullStr(attachmentName), channel, nullStr(lang), ip); err != nil {
+		id, accountID, body, att, nullStr(attachmentName), channel, nullStr(lang), nullStr(version), nullStr(browserTZ), ip); err != nil {
 		return uuid.Nil, fmt.Errorf("feedback: insert: %w", err)
 	}
 	return id, nil
@@ -229,6 +229,14 @@ type AdminMessage struct {
 	Channel    string
 	// Lang is the sender's interface language, snapshotted at submit time.
 	Lang string
 	// Version is the client app build the report was sent from, snapshotted at submit time.
 	Version string
 	// BrowserTZ is the client's detected "±HH:MM" UTC offset at submit time, snapshotted so the
 	// filed time can be shown in the sender's browser-local zone even before they save a profile.
 	BrowserTZ string
 	// TimeZone is the sender account's stored zone ("±HH:MM" offset, IANA name, or ""), for
 	// rendering CreatedAt in the sender's own configured time alongside UTC.
 	TimeZone       string
 	SenderIP       string
 	HasAttachment  bool
 	AttachmentName string
@@ -343,7 +351,7 @@ func (s *Store) AdminGet(ctx context.Context, id uuid.UUID) (AdminMessage, error
 	var m AdminMessage
 	var repliedAt sql.NullTime
 	q := `SELECT m.message_id, m.account_id, a.display_name, ` + feedbackSource + ` AS source, m.body, m.channel,
-		COALESCE(m.lang, ''),
+		COALESCE(m.lang, ''), COALESCE(m.app_version, ''), COALESCE(m.browser_tz, ''), a.time_zone,
 		COALESCE(m.sender_ip, ''), (m.attachment IS NOT NULL), COALESCE(m.attachment_name, ''),
 		(m.read_at IS NOT NULL), (m.archived_at IS NOT NULL), (m.reply_body IS NOT NULL),
 		COALESCE(m.reply_body, ''), m.replied_at, m.created_at
@@ -352,7 +360,7 @@ func (s *Store) AdminGet(ctx context.Context, id uuid.UUID) (AdminMessage, error
 	WHERE m.message_id = $1`
 	err := s.db.QueryRowContext(ctx, q, id).Scan(
 		&m.ID, &m.AccountID, &m.SenderName, &m.Source, &m.Body, &m.Channel,
-		&m.Lang,
+		&m.Lang, &m.Version, &m.BrowserTZ, &m.TimeZone,
 		&m.SenderIP, &m.HasAttachment, &m.AttachmentName,
 		&m.Read, &m.Archived, &m.Replied, &m.ReplyBody, &repliedAt, &m.CreatedAt)
 	if errors.Is(err, sql.ErrNoRows) {
@@ -63,6 +63,7 @@ type gameCache struct {
 type cachedGame struct {
 	game       *engine.Game
 	seats      []Seat
 	variant    string
 	lastAccess time.Time
 }
@@ -71,24 +72,27 @@ func newGameCache(ttl time.Duration, now func() time.Time) *gameCache {
 	return &gameCache{entries: make(map[uuid.UUID]*cachedGame), ttl: ttl, now: now}
 }
-// get returns the live game for id and refreshes its idle timer, or (nil, false).
+// get returns the live game and its immutable seat list for id and refreshes its idle
-func (c *gameCache) get(id uuid.UUID) (*engine.Game, bool) {
+// timer, or (nil, nil, false). The seats let a read check membership (and label seats)
 // without re-loading the game from the store, since seats never change after a game starts.
 func (c *gameCache) get(id uuid.UUID) (*engine.Game, []Seat, bool) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	e, ok := c.entries[id]
 	if !ok {
-		return nil, false
+		return nil, nil, false
 	}
 	e.lastAccess = c.now()
-	return e.game, true
+	return e.game, e.seats, true
 }
-// put stores g as the live game for id. variant labels the entry so the active-
+// put stores g as the live game for id together with its seat list. variant labels the
-// games gauge can report counts by variant without inspecting engine internals.
+// entry so the active-games gauge can report counts by variant without inspecting engine
-func (c *gameCache) put(id uuid.UUID, g *engine.Game, variant string) {
+// internals; seats are the game's immutable seat standings for the membership fast path.
 func (c *gameCache) put(id uuid.UUID, g *engine.Game, variant string, seats []Seat) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	c.entries[id] = &cachedGame{game: g, variant: variant, lastAccess: c.now()}
+	c.entries[id] = &cachedGame{game: g, seats: seats, variant: variant, lastAccess: c.now()}
 }
 // remove drops id from the cache (used on a finished game and after a failed
@@ -16,5 +16,5 @@
 // word-check tool with complaint capture, per-player game state, history and GCG
 // export, and the per-game turn-timeout sweeper that auto-resigns an overdue
 // player (honouring their daily away window). The HTTP surface that fronts these
-// operations is added with the gateway in a later stage.
+// operations is exposed to the gateway.
 package game
@@ -94,8 +94,8 @@ func TestGameCacheEviction(t *testing.T) {
 	cur := time.Unix(1_700_000_000, 0)
 	cache := newGameCache(time.Hour, func() time.Time { return cur })
 	id := uuid.New()
-	cache.put(id, nil, "scrabble_en")
+	cache.put(id, nil, "scrabble_en", nil)
-	if _, ok := cache.get(id); !ok {
+	if _, _, ok := cache.get(id); !ok {
 		t.Fatal("game must be resident after put")
 	}
 	cur = cur.Add(30 * time.Minute)
@@ -104,7 +104,7 @@ func TestGameCacheEviction(t *testing.T) {
 	if n := cache.sweep(); n != 1 {
 		t.Errorf("sweep evicted %d, want 1", n)
 	}
-	if _, ok := cache.get(id); ok {
+	if _, _, ok := cache.get(id); ok {
 		t.Error("game must be evicted after idle TTL")
 	}
 	if cache.size() != 0 {
@@ -287,12 +287,12 @@ func (svc *Service) Create(ctx context.Context, params CreateParams) (Game, erro
 	if err := svc.store.CreateGame(ctx, ins, seats, seeding.draws); err != nil {
 		return Game{}, err
 	}
 	svc.cache.put(id, g, params.Variant.String())
 	svc.metrics.recordStarted(ctx, params.Variant, params.VsAI)
 	created, err := svc.store.GetGame(ctx, id)
 	if err != nil {
 		return Game{}, err
 	}
 	svc.cache.put(id, g, params.Variant.String(), created.Seats)
 	// Honest-AI game seated with a robot: if the robot moves first, reply at once
 	// (the periodic driver is the fallback). No-op for every human-only game.
 	svc.triggerAI(created)
@@ -890,26 +890,35 @@ func (svc *Service) timeoutGame(ctx context.Context, gameID uuid.UUID, now time.
 // EvaluatePlay previews a tentative play for a seated player against the current
 // board without committing it: whether it is legal and what it would score.
 func (svc *Service) EvaluatePlay(ctx context.Context, gameID, accountID uuid.UUID, tiles []engine.TileRecord) (EvalResult, error) {
 	unlock := svc.locks.lock(gameID)
 	defer unlock()
 	// Hot path: an active game stays cached — the engine game is mutated in place across
 	// moves and evicted only when it finishes — so on a hit the cached live game and its
 	// immutable seat list answer the membership check and the score with no DB read. This
 	// preview is fired on every tile placement, the hottest gameplay call at scale.
 	g, seats, ok := svc.cache.get(gameID)
 	if !ok {
 		// Cold path: load and validate from the store, then replay into the cache.
 		pre, err := svc.store.GetGame(ctx, gameID)
 		if err != nil {
 			return EvalResult{}, err
 		}
 	if _, ok := pre.seatOf(accountID); !ok {
 		return EvalResult{}, ErrNotAPlayer
 	}
 		if pre.Status == StatusFinished {
 			return EvalResult{}, ErrFinished
 		}
-
+		if g, err = svc.liveGame(ctx, pre); err != nil {
 	unlock := svc.locks.lock(gameID)
 	defer unlock()
 	g, err := svc.liveGame(ctx, pre)
 	if err != nil {
 			return EvalResult{}, err
 		}
 		seats = pre.Seats
 	}
 	if !seatedIn(seats, accountID) {
 		return EvalResult{}, ErrNotAPlayer
 	}
 	validateStart := time.Now()
 	rec, err := g.EvaluatePlay(tiles)
-	svc.metrics.recordValidate(ctx, pre.Variant, validateStart)
+	svc.metrics.recordValidate(ctx, g.Variant(), validateStart)
 	if err != nil {
 		if errors.Is(err, engine.ErrIllegalPlay) {
 			return EvalResult{Valid: false}, nil
@@ -1359,7 +1368,7 @@ func (svc *Service) ExportGCG(ctx context.Context, gameID uuid.UUID) (string, er
 // liveGame returns the live engine.Game for pre, rebuilding it from the journal
 // on a cache miss. Callers must hold the per-game lock.
 func (svc *Service) liveGame(ctx context.Context, pre Game) (*engine.Game, error) {
-	if g, ok := svc.cache.get(pre.ID); ok {
+	if g, _, ok := svc.cache.get(pre.ID); ok {
 		return g, nil
 	}
 	g, err := svc.replay(ctx, pre)
@@ -1374,7 +1383,7 @@ func (svc *Service) liveGame(ctx context.Context, pre Game) (*engine.Game, error
 		}
 	}
 	if !g.Over() {
-		svc.cache.put(pre.ID, g, pre.Variant.String())
+		svc.cache.put(pre.ID, g, pre.Variant.String(), pre.Seats)
 	}
 	return g, nil
 }
@@ -355,27 +355,33 @@ func (s *Store) ExpiredOpen(ctx context.Context, now time.Time) ([]OpenGame, err
 // GetGame loads the games row joined with its seats (ordered by seat), or
 // ErrNotFound.
 func (s *Store) GetGame(ctx context.Context, id uuid.UUID) (Game, error) {
-	gstmt := postgres.SELECT(table.Games.AllColumns).
+	// One round-trip: the game joined with its seats. A LEFT JOIN keeps a (would-be)
-		FROM(table.Games).
+	// seatless game returning the game with no seats, exactly as the prior two-query
 	// version did; ORDER BY seat preserves seat order. The games columns repeat per seat
 	// row — cheap at 2-4 seats, and one round-trip instead of two, which matters because
 	// GetGame is the universal "load the game" step on every game operation.
 	stmt := postgres.SELECT(table.Games.AllColumns, table.GamePlayers.AllColumns).
 		FROM(table.Games.LEFT_JOIN(table.GamePlayers, table.GamePlayers.GameID.EQ(table.Games.GameID))).
 		WHERE(table.Games.GameID.EQ(postgres.UUID(id))).
-		LIMIT(1)
+		ORDER_BY(table.GamePlayers.Seat.ASC())
-	var grow model.Games
+	var rows []struct {
-	if err := gstmt.QueryContext(ctx, s.db, &grow); err != nil {
+		model.Games
-		if errors.Is(err, qrm.ErrNoRows) {
+		model.GamePlayers
 			return Game{}, ErrNotFound
 	}
 	if err := stmt.QueryContext(ctx, s.db, &rows); err != nil {
 		return Game{}, fmt.Errorf("game: get %s: %w", id, err)
 	}
-
+	if len(rows) == 0 {
-	sstmt := postgres.SELECT(table.GamePlayers.AllColumns).
+		return Game{}, ErrNotFound
 		FROM(table.GamePlayers).
 		WHERE(table.GamePlayers.GameID.EQ(postgres.UUID(id))).
 		ORDER_BY(table.GamePlayers.Seat.ASC())
 	var srows []model.GamePlayers
 	if err := sstmt.QueryContext(ctx, s.db, &srows); err != nil {
 		return Game{}, fmt.Errorf("game: get seats %s: %w", id, err)
 	}
-	return projectGame(grow, srows)
+	seats := make([]model.GamePlayers, 0, len(rows))
 	for i := range rows {
 		// Skip the phantom all-NULL seat row a LEFT JOIN yields for a seatless game.
 		if rows[i].GamePlayers.GameID == id {
 			seats = append(seats, rows[i].GamePlayers)
 		}
 	}
 	return projectGame(rows[0].Games, seats)
 }
 // GetGameVariant reads just a game's variant — a cheap single-column lookup the edge uses
@@ -105,7 +105,7 @@ const MaxActiveQuickGames = 10
 const aiPlayerName = "AI"
 // CreateParams describes a new game. Seats lists the seated accounts in turn
-// order (seat 0 moves first); lobby/matchmaking assembles it in a later stage.
+// order (seat 0 moves first); lobby/matchmaking assembles it.
 type CreateParams struct {
 	Variant        engine.Variant
 	Seats          []uuid.UUID
@@ -184,6 +184,18 @@ func (g Game) seatOf(accountID uuid.UUID) (int, bool) {
 	return 0, false
 }
 // seatedIn reports whether accountID holds a seat in seats. It backs the read-side
 // membership check against the cached, immutable seat list, so a hot read can skip
 // loading the game from the store.
 func seatedIn(seats []Seat, accountID uuid.UUID) bool {
 	for _, s := range seats {
 		if s.AccountID == accountID {
 			return true
 		}
 	}
 	return false
 }
 // MoveResult is the outcome of a committed transition: the decoded move and the
 // post-move game, plus the actor's own refilled rack and the bag size after the draw
 // (Rack/BagLen), so the mover renders the next state from the response without a
@@ -110,15 +110,15 @@ func identityConfirmed(t *testing.T, kind, externalID string) bool {
 }
 // TestProvisionTelegramSeedsNewAccountOnly checks that Telegram first contact
-// seeds the new account's language and display name from the launch fields,
+// seeds the new account's language, display name and time zone from the launch
-// defaults the in-app-only flag on, and never overwrites an existing account on a
+// fields / detected offset, defaults the in-app-only flag on, and never overwrites
-// later login (language seeding).
+// an existing account on a later login (language and zone seeding).
 func TestProvisionTelegramSeedsNewAccountOnly(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	ext := "tg-" + uuid.NewString()
-	acc, created, err := store.ProvisionTelegram(ctx, ext, "ru-RU", "thehandle", "Иван")
+	acc, created, err := store.ProvisionTelegram(ctx, ext, "ru-RU", "thehandle", "Иван", "+03:00")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -131,12 +131,15 @@ func TestProvisionTelegramSeedsNewAccountOnly(t *testing.T) {
 	if acc.DisplayName != "Иван" {
 		t.Errorf("DisplayName = %q, want Иван", acc.DisplayName)
 	}
 	if acc.TimeZone != "+03:00" {
 		t.Errorf("TimeZone = %q, want the seeded +03:00", acc.TimeZone)
 	}
 	if !acc.NotificationsInAppOnly {
 		t.Error("NotificationsInAppOnly should default to true")
 	}
 	// A later login with different fields returns the same account, unchanged.
-	again, created, err := store.ProvisionTelegram(ctx, ext, "en", "other", "Other")
+	again, created, err := store.ProvisionTelegram(ctx, ext, "en", "other", "Other", "+09:00")
 	if err != nil {
 		t.Fatalf("re-provision telegram: %v", err)
 	}
@@ -146,8 +149,53 @@ func TestProvisionTelegramSeedsNewAccountOnly(t *testing.T) {
 	if again.ID != acc.ID {
 		t.Errorf("re-provision id = %s, want %s", again.ID, acc.ID)
 	}
-	if again.PreferredLanguage != "ru" || again.DisplayName != "Иван" {
+	if again.PreferredLanguage != "ru" || again.DisplayName != "Иван" || again.TimeZone != "+03:00" {
-		t.Errorf("existing account overwritten: lang=%q name=%q", again.PreferredLanguage, again.DisplayName)
+		t.Errorf("existing account overwritten: lang=%q name=%q tz=%q", again.PreferredLanguage, again.DisplayName, again.TimeZone)
 	}
 }
 // TestProvisionSeedsTimeZone checks the create-time time-zone seed across paths: a
 // valid detected offset is stored verbatim (even "+00:00", which is deliberately
 // distinct from the unset "UTC" default), a guest is seeded the same way, and a
 // missing or malformed offset falls back to the "UTC" column default rather than
 // being guessed at.
 func TestProvisionSeedsTimeZone(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	// A detected zero offset is written as "+00:00" — we record that the zone was
 	// detected (and equals UTC), distinct from the "UTC" default meaning "unknown".
 	utcDetected, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Zero", "+00:00")
 	if err != nil {
 		t.Fatalf("provision telegram +00:00: %v", err)
 	}
 	if utcDetected.TimeZone != "+00:00" {
 		t.Errorf("TimeZone = %q, want the seeded +00:00", utcDetected.TimeZone)
 	}
 	// A malformed offset is dropped: the account keeps the UTC default.
 	bad, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Bad", "not-a-zone")
 	if err != nil {
 		t.Fatalf("provision telegram bad tz: %v", err)
 	}
 	if bad.TimeZone != "UTC" {
 		t.Errorf("TimeZone = %q, want UTC fallback for a malformed offset", bad.TimeZone)
 	}
 	// A guest is seeded its detected offset; an empty one keeps the UTC default.
 	guest, err := store.ProvisionGuest(ctx, "-05:30")
 	if err != nil {
 		t.Fatalf("provision guest: %v", err)
 	}
 	if guest.TimeZone != "-05:30" {
 		t.Errorf("guest TimeZone = %q, want the seeded -05:30", guest.TimeZone)
 	}
 	plainGuest, err := store.ProvisionGuest(ctx, "")
 	if err != nil {
 		t.Fatalf("provision plain guest: %v", err)
 	}
 	if plainGuest.TimeZone != "UTC" {
 		t.Errorf("plain guest TimeZone = %q, want UTC default", plainGuest.TimeZone)
 	}
 }
@@ -156,7 +204,7 @@ func TestProvisionTelegramSeedsNewAccountOnly(t *testing.T) {
 // language CHECK.
 func TestProvisionTelegramUnknownLanguageDefaults(t *testing.T) {
 	ctx := context.Background()
-	acc, _, err := account.NewStore(testDB).ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "fr", "", "")
+	acc, _, err := account.NewStore(testDB).ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "fr", "", "", "")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -172,7 +220,7 @@ func TestProvisionTelegramUnknownLanguageDefaults(t *testing.T) {
 func TestHighRateFlagRoundTrip(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player")
+	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player", "")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -228,7 +276,7 @@ func TestIdentityExternalID(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	ext := "tg-" + uuid.NewString()
-	acc, _, err := store.ProvisionTelegram(ctx, ext, "en", "", "Tg User")
+	acc, _, err := store.ProvisionTelegram(ctx, ext, "en", "", "Tg User", "")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -253,7 +301,7 @@ func TestIdentityExternalID(t *testing.T) {
 func TestNotificationsInAppOnlyRoundTrip(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player")
+	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player", "")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -222,7 +222,7 @@ func TestConsoleGameDetailRobotSchedule(t *testing.T) {
 func TestConsoleThrottledViewAndFlagClear(t *testing.T) {
 	ctx := context.Background()
 	accounts := account.NewStore(testDB)
-	acc, _, err := accounts.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Throttled Player")
+	acc, _, err := accounts.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Throttled Player", "")
 	if err != nil {
 		t.Fatalf("provision: %v", err)
 	}
@@ -55,7 +55,7 @@ func TestChatAccessResolver(t *testing.T) {
 	srv := server.New(":0", server.Deps{Logger: zaptest.NewLogger(t), DB: testDB, Accounts: accounts})
 	ext := "tg-" + uuid.NewString()
-	acc, _, err := accounts.ProvisionTelegram(ctx, ext, "en", "", "Chatter")
+	acc, _, err := accounts.ProvisionTelegram(ctx, ext, "en", "", "Chatter", "")
 	if err != nil {
 		t.Fatalf("provision: %v", err)
 	}
@@ -62,7 +62,7 @@ func TestEmailConfirmFlow(t *testing.T) {
 }
 // TestEmailAlreadyTakenByAnotherAccount refuses to bind an email confirmed by a
-// different account (merge is a later stage).
+// different account (combining two accounts is the separate link/merge flow).
 func TestEmailAlreadyTakenByAnotherAccount(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
@@ -206,7 +206,7 @@ func TestEmailLoginFlow(t *testing.T) {
 	svc := account.NewEmailService(account.NewStore(testDB), mailer)
 	email := "login-" + uuid.NewString() + "@example.com"
-	accountID, err := svc.RequestLoginCode(ctx, email)
+	accountID, err := svc.RequestLoginCode(ctx, email, "+02:00")
 	if err != nil {
 		t.Fatalf("request login code: %v", err)
 	}
@@ -225,12 +225,15 @@ func TestEmailLoginFlow(t *testing.T) {
 	if acc.IsGuest {
 		t.Error("an email account must be durable, not a guest")
 	}
 	if acc.TimeZone != "+02:00" {
 		t.Errorf("TimeZone = %q, want the +02:00 seeded at the request step", acc.TimeZone)
 	}
 	if !identityConfirmed(t, account.KindEmail, email) {
 		t.Error("the email identity must be confirmed after login")
 	}
 	// A second login for the same email is the returning user: same account.
-	if _, err := svc.RequestLoginCode(ctx, email); err != nil {
+	if _, err := svc.RequestLoginCode(ctx, email, ""); err != nil {
 		t.Fatalf("second request: %v", err)
 	}
 	acc2, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody))
@@ -38,7 +38,7 @@ func latestFeedbackID(t *testing.T, svc *feedback.Service, acc uuid.UUID) uuid.U
 func TestFeedbackGuestRejected(t *testing.T) {
 	svc := newFeedbackService()
 	guest := provisionGuest(t)
-	if err := svc.Submit(context.Background(), guest, "hi", nil, "", "web", "1.2.3.4"); !errors.Is(err, feedback.ErrGuestForbidden) {
+	if err := svc.Submit(context.Background(), guest, "hi", nil, "", "web", "v1", "+05:00", "1.2.3.4"); !errors.Is(err, feedback.ErrGuestForbidden) {
 		t.Fatalf("guest submit err = %v, want ErrGuestForbidden", err)
 	}
 }
@@ -48,11 +48,11 @@ func TestFeedbackSubmitGateAndReplyLifecycle(t *testing.T) {
 	svc := newFeedbackService()
 	acc := provisionAccount(t)
-	if err := svc.Submit(ctx, acc, "  please fix the board  ", []byte("PNGDATA"), "shot.png", "ios", "9.9.9.9"); err != nil {
+	if err := svc.Submit(ctx, acc, "  please fix the board  ", []byte("PNGDATA"), "shot.png", "ios", "v1.2.0", "+03:00", "9.9.9.9"); err != nil {
 		t.Fatalf("submit: %v", err)
 	}
 	// Anti-spam gate: a second message is refused while the first is unreviewed.
-	if err := svc.Submit(ctx, acc, "again", nil, "", "web", ""); !errors.Is(err, feedback.ErrPendingReview) {
+	if err := svc.Submit(ctx, acc, "again", nil, "", "web", "", "", ""); !errors.Is(err, feedback.ErrPendingReview) {
 		t.Fatalf("second submit err = %v, want ErrPendingReview", err)
 	}
 	if st, err := svc.State(ctx, acc); err != nil {
@@ -69,7 +69,7 @@ func TestFeedbackSubmitGateAndReplyLifecycle(t *testing.T) {
 	if m.Body != "please fix the board" { // trimmed
 		t.Fatalf("body = %q, want trimmed", m.Body)
 	}
-	if !m.HasAttachment || m.AttachmentName != "shot.png" || m.Channel != "ios" || m.SenderIP != "9.9.9.9" {
+	if !m.HasAttachment || m.AttachmentName != "shot.png" || m.Channel != "ios" || m.SenderIP != "9.9.9.9" || m.Version != "v1.2.0" || m.BrowserTZ != "+03:00" {
 		t.Fatalf("admin message = %+v", m)
 	}
 	if name, data, ok, err := svc.Attachment(ctx, id); err != nil || !ok || name != "shot.png" || string(data) != "PNGDATA" {
@@ -116,7 +116,7 @@ func TestFeedbackReplyHiddenAfterNewMessage(t *testing.T) {
 	acc := provisionAccount(t)
 	// msg1, replied → the player can send again and currently sees the reply.
-	if err := svc.Submit(ctx, acc, "first", nil, "", "web", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "first", nil, "", "web", "", "", ""); err != nil {
 		t.Fatalf("submit msg1: %v", err)
 	}
 	if err := svc.Reply(ctx, latestFeedbackID(t, svc, acc), "the answer"); err != nil {
@@ -130,7 +130,7 @@ func TestFeedbackReplyHiddenAfterNewMessage(t *testing.T) {
 	// Sending a new message immediately drops the previous reply (it now belongs to an
 	// older message), even though it is well within the one-week window.
-	if err := svc.Submit(ctx, acc, "second", nil, "", "web", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "second", nil, "", "web", "", "", ""); err != nil {
 		t.Fatalf("submit msg2: %v", err)
 	}
 	st, err := svc.State(ctx, acc)
@@ -154,7 +154,7 @@ func TestFeedbackSnapshotsLanguage(t *testing.T) {
 		t.Fatalf("set language: %v", err)
 	}
 	// A message snapshots the sender's interface language at submit time.
-	if err := svc.Submit(ctx, acc, "from telegram", nil, "", "telegram", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "from telegram", nil, "", "telegram", "", "", ""); err != nil {
 		t.Fatalf("submit: %v", err)
 	}
 	id := latestFeedbackID(t, svc, acc)
@@ -184,7 +184,7 @@ func TestFeedbackBanRole(t *testing.T) {
 	if err := accounts.GrantRole(ctx, acc, account.RoleFeedbackBanned); err != nil {
 		t.Fatalf("grant role: %v", err)
 	}
-	if err := svc.Submit(ctx, acc, "hi", nil, "", "web", ""); !errors.Is(err, feedback.ErrBanned) {
+	if err := svc.Submit(ctx, acc, "hi", nil, "", "web", "", "", ""); !errors.Is(err, feedback.ErrBanned) {
 		t.Fatalf("banned submit err = %v, want ErrBanned", err)
 	}
 	if st, err := svc.State(ctx, acc); err != nil {
@@ -196,7 +196,7 @@ func TestFeedbackBanRole(t *testing.T) {
 	if err := accounts.RevokeRole(ctx, acc, account.RoleFeedbackBanned); err != nil {
 		t.Fatalf("revoke role: %v", err)
 	}
-	if err := svc.Submit(ctx, acc, "hi again", nil, "", "web", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "hi again", nil, "", "web", "", "", ""); err != nil {
 		t.Fatalf("submit after unban: %v", err)
 	}
 }
@@ -219,7 +219,7 @@ func TestFeedbackValidation(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			acc := provisionAccount(t) // fresh account so the pending gate never fires first
-			if err := svc.Submit(ctx, acc, tt.body, tt.attachment, tt.attachmentName, "web", ""); !errors.Is(err, tt.want) {
+			if err := svc.Submit(ctx, acc, tt.body, tt.attachment, tt.attachmentName, "web", "", "", ""); !errors.Is(err, tt.want) {
 				t.Fatalf("submit err = %v, want %v", err, tt.want)
 			}
 		})
@@ -231,7 +231,7 @@ func TestFeedbackAdminLifecycle(t *testing.T) {
 	svc := newFeedbackService()
 	acc := provisionAccount(t)
-	if err := svc.Submit(ctx, acc, "first report", nil, "", "web", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "first report", nil, "", "web", "", "", ""); err != nil {
 		t.Fatalf("submit: %v", err)
 	}
 	id := latestFeedbackID(t, svc, acc)
@@ -276,7 +276,7 @@ func TestFeedbackDeleteAllByAccount(t *testing.T) {
 	svc := newFeedbackService()
 	acc := provisionAccount(t)
-	if err := svc.Submit(ctx, acc, "one", nil, "", "web", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "one", nil, "", "web", "", "", ""); err != nil {
 		t.Fatalf("submit: %v", err)
 	}
 	if err := svc.DeleteAllByAccount(ctx, acc); err != nil {
@@ -286,7 +286,7 @@ func TestFeedbackDeleteAllByAccount(t *testing.T) {
 	if has, err := svc.ReplyUnread(ctx, acc); err != nil || has {
 		t.Fatalf("reply unread after delete-all = %v (err %v)", has, err)
 	}
-	if err := svc.Submit(ctx, acc, "fresh", nil, "", "web", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "fresh", nil, "", "web", "", "", ""); err != nil {
 		t.Fatalf("submit after delete-all: %v", err)
 	}
 }
@@ -543,6 +543,12 @@ func TestEvaluatePlayPreview(t *testing.T) {
 	if bad.Valid {
 		t.Error("disconnected play must be invalid")
 	}
 	// A non-seated account cannot preview: with the game warm in the live cache, the
 	// membership check runs against the cached seat list (the hot path that skips GetGame).
 	if _, err := svc.EvaluatePlay(ctx, g.ID, provisionAccount(t), hint.Tiles); !errors.Is(err, game.ErrNotAPlayer) {
 		t.Errorf("evaluate by a non-player = %v, want ErrNotAPlayer", err)
 	}
 }
 // TestConcurrentSubmitSerialized confirms the per-game lock lets only one of two
@@ -120,7 +120,7 @@ func provisionAccount(t *testing.T) uuid.UUID {
 // provisionGuest creates a fresh ephemeral guest account and returns its id.
 func provisionGuest(t *testing.T) uuid.UUID {
 	t.Helper()
-	acc, err := account.NewStore(testDB).ProvisionGuest(context.Background())
+	acc, err := account.NewStore(testDB).ProvisionGuest(context.Background(), "")
 	if err != nil {
 		t.Fatalf("provision guest: %v", err)
 	}
@@ -38,7 +38,7 @@ func TestSuspensionGate(t *testing.T) {
 		Accounts: accounts,
 	})
-	acc, _, err := accounts.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "", "Blocked")
+	acc, _, err := accounts.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "", "Blocked", "")
 	if err != nil {
 		t.Fatalf("provision: %v", err)
 	}
@@ -18,7 +18,7 @@ func TestUserListFilter(t *testing.T) {
 	st := account.NewStore(testDB)
 	uniq := uuid.NewString()
-	human, _, err := st.ProvisionTelegram(ctx, "tg-"+uniq, "en", "", "Zzqxhuman")
+	human, _, err := st.ProvisionTelegram(ctx, "tg-"+uniq, "en", "", "Zzqxhuman", "")
 	if err != nil {
 		t.Fatalf("provision human: %v", err)
 	}
@@ -26,7 +26,7 @@ func TestUserListFilter(t *testing.T) {
 	if err != nil {
 		t.Fatalf("provision robot: %v", err)
 	}
-	guest, err := st.ProvisionGuest(ctx)
+	guest, err := st.ProvisionGuest(ctx, "")
 	if err != nil {
 		t.Fatalf("provision guest: %v", err)
 	}
@@ -0,0 +1,64 @@
 -- Replace the default (house) ad campaign's single seed tip with the curated,
 -- language-agnostic Scrabble tip set (one bilingual row per tip; the client picks the
 -- column for the viewer's language). Data-only — the ad_messages schema is unchanged, so
 -- a backend image rollback stays DB-safe. The default campaign is the fixed house id seeded
 -- in 00001; ON DELETE CASCADE is irrelevant here (we only touch its messages).
 -- +goose Up
 DELETE FROM backend.ad_messages WHERE campaign_id = '00000000-0000-0000-0000-0000000000ad';
 INSERT INTO backend.ad_messages (message_id, campaign_id, "position", body_en, body_ru) VALUES
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 0, 'Keep a balanced rack — a slight edge of consonants over vowels.', 'Держи на руках баланс — с лёгким перевесом согласных над гласными.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 1, 'Your "leave" (the tiles you keep) sets up your next turn — value it.', '«Остаток» (что оставляешь на руках) готовит следующий ход — цени его.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 2, 'Shed duplicate tiles — repeats clog your options.', 'Сбрасывай дубли фишек — повторы забивают возможности.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 3, 'A slightly consonant-heavy rack builds full-rack plays more easily.', 'Лёгкий перевес согласных проще складывается в выкладку всех фишек.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 4, 'Play several tiles per turn to keep your rack cycling.', 'Выкладывай по нескольку фишек за ход, чтобы рука обновлялась.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 5, 'Don''t hoard hard-to-place duplicates or a lone high-value tile.', 'Не копи труднопристраиваемые дубли или одинокую дорогую фишку.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 6, 'Using all your rack tiles in one move scores a large bonus — chase it.', 'Выкладка всех фишек с рук за ход даёт крупный бонус — стремись к ней.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 7, 'Learn common prefixes and suffixes — they extend words to use every tile.', 'Учи частые приставки и суффиксы — они растягивают слово на все фишки.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 8, '"Fish": play few tiles to keep a near-complete rack when you''re ahead.', '«Рыбачь»: сыграй мало фишек, сохранив почти всю руку, когда ведёшь.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 9, 'Don''t hoard high-value tiles — play them in good time, not at the very end.', 'Не копи дорогие фишки — играй их вовремя, а не под самый конец.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 10, 'Don''t hold a high-value tile waiting for a rare partner — usually a loss.', 'Не держи дорогую фишку ради редкого партнёра — обычно это проигрыш.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 11, 'Land your priciest tile on a premium square for a big single score.', 'Сажай самую дорогую фишку на бонусную клетку ради крупных очков.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 12, 'High-value tiles shine in parallel plays through short words.', 'Дорогие фишки сильны в параллельных выкладках через короткие слова.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 13, 'Stuck with an unplayable high-value tile late? Exchange it.', 'Завис с неиграбельной дорогой фишкой под конец? Обменяй её.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 14, 'The blanks are the most valuable tiles in the bag — guard them.', 'Пустышки — самые ценные фишки в мешке; береги их.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 15, 'Save a blank for a full-rack play or a key premium square.', 'Береги пустышку для выкладки всех фишек или важной бонусной клетки.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 16, 'Don''t spend a blank cheaply — hold it for a much bigger gain.', 'Не трать пустышку по мелочи — придержи ради куда большей выгоды.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 17, 'Put high-value tiles on letter-bonus or word-bonus squares.', 'Клади дорогие фишки на бонус буквы или слова.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 18, 'Stack bonuses — a letter bonus under a word bonus multiplies both.', 'Совмещай бонусы — бонус буквы под бонусом слова умножает оба.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 19, 'Parallel plays can earn nearly half your points — look for them.', 'Параллельные выкладки могут давать почти половину очков — ищи их.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 20, 'A hook adds one tile to an existing word to make a new one.', '«Крючок» — одна фишка к готовому слову, образующая новое.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 21, 'Hooks work at the front or the back of a word.', 'Крючки работают спереди и сзади слова.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 22, 'Short words are the keys to tight parallel plays — memorize them.', 'Короткие слова — ключ к плотным параллелям; выучи их.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 23, 'Your opening word crosses the centre — keep it compact, don''t open up.', 'Первое слово идёт через центр — держи компактным, не раскрывайся.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 24, 'It''s not only your score — limit your opponent''s options too.', 'Это не только твои очки — ограничивай и возможности соперника.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 25, 'Denying a big reply often beats squeezing a few more points yourself.', 'Закрыть крупный ответ часто важнее, чем добрать пару своих очков.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 26, 'When ahead, keep the board tight and closed; avoid open lanes.', 'Ведёшь — держи доску плотной и закрытой, не открывай линии.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 27, 'When behind, open the board up to create high-scoring chances.', 'Отстаёшь — раскрывай доску ради шансов на крупный ход.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 28, 'Don''t leave a word-bonus square open right beside your word.', 'Не оставляй клетку бонуса слова открытой рядом со своим словом.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 29, 'Block a hot square even with a weak word to deny a big play.', 'Закрывай опасную клетку даже слабым словом, чтобы срубить крупный ход.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 30, 'Know words that take no hooks — use them to seal off lines.', 'Знай слова, не берущие крючков — ими запирай линии.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 31, 'Track the tiles played to judge what is still left in the bag.', 'Считай сыгранные фишки — так поймёшь, что осталось в мешке.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 32, 'Exchange when your rack is unbalanced or can only score low.', 'Меняй фишки, когда рука несбалансированна или тянет мало.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 33, 'A good exchange beats a bad play — a clean rack is worth a turn.', 'Хороший обмен лучше плохого хода — чистая рука стоит хода.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 34, 'Swap away a surplus of vowels or consonants to rebalance.', 'Сбрасывай в обмен избыток гласных или согласных, чтобы выровняться.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 35, 'Rare high-value tiles are gone once seen — note them as they appear.', 'Редкие дорогие фишки исчезают, едва мелькнув — отмечай их.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 36, 'Once the bag is empty, deduce your opponent''s remaining tiles.', 'Когда мешок пуст, вычисли оставшиеся фишки соперника.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 37, 'Shed high-value tiles before the bag empties — don''t get stuck with them.', 'Сбрось дорогие фишки до опустения мешка — не зависай с ними.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 38, 'Unplayed tiles count against you at the end — try to go out first.', 'Несыгранные фишки минусуют очки в конце — старайся выйти первым.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 39, 'Going out first adds your opponent''s leftover tiles to your score.', 'Кто вышел первым, добирает очки за оставшиеся фишки соперника.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 40, 'Sometimes leaving one tile in the bag buys you an extra turn.', 'Иногда оставить одну фишку в мешке — это лишний ход.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 41, 'In the endgame, block the exact squares your opponent needs.', 'В эндшпиле блокируй именно те клетки, что нужны сопернику.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 42, 'Shuffle your rack to spot new patterns.', 'Перемешивай фишки на руках — так замечаешь новые сочетания.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 43, 'Separate prefix, suffix and middle tiles to anagram faster.', 'Разнеси приставку, суффикс и середину — анаграммы решаются быстрее.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 44, 'Value board position and future turns over raw points this turn.', 'Цени позицию и будущие ходы выше сиюминутных очков.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 45, 'Early game build position; midgame maximize score; endgame defend.', 'В начале — позиция, в середине — очки, в конце — защита.'),
    (gen_random_uuid(), '00000000-0000-0000-0000-0000000000ad', 46, 'Learn the short-word lists first — they pay off in every game.', 'Сначала учи списки коротких слов — окупаются в каждой партии.');
 -- +goose Down
 -- Restore the original single house tip seeded by the baseline.
 DELETE FROM backend.ad_messages WHERE campaign_id = '00000000-0000-0000-0000-0000000000ad';
 INSERT INTO backend.ad_messages (message_id, campaign_id, "position", body_en, body_ru)
 VALUES ('00000000-0000-0000-0000-0000000000a1', '00000000-0000-0000-0000-0000000000ad', 0,
    'Tip: a play using all 7 tiles earns a +50 bonus.',
    'Совет: ход всеми 7 фишками приносит бонус +50 очков.');
@@ -0,0 +1,10 @@
 -- Capture the client app version (the build a report was sent from) with each feedback
 -- message, so the operator console can show which version a player was on. Nullable, so the
 -- rows that predate this keep working — additive and backward-compatible, so a backend image
 -- rollback stays DB-safe (older code simply ignores the column).
 -- +goose Up
 ALTER TABLE backend.feedback_messages ADD COLUMN app_version text;
 -- +goose Down
 ALTER TABLE backend.feedback_messages DROP COLUMN app_version;
@@ -0,0 +1,11 @@
 -- Capture the client's detected UTC offset ("±HH:MM") with each feedback message, so the
 -- operator console can show the filed time in the sender's browser-local zone even before that
 -- player has ever saved a profile (the account zone defaults to UTC until then). Nullable, so the
 -- rows that predate this keep working — additive and backward-compatible, so a backend image
 -- rollback stays DB-safe (older code simply ignores the column).
 -- +goose Up
 ALTER TABLE backend.feedback_messages ADD COLUMN browser_tz text;
 -- +goose Down
 ALTER TABLE backend.feedback_messages DROP COLUMN browser_tz;
@@ -1198,6 +1198,17 @@ func fmtTime(t time.Time) string {
 	return t.UTC().Format("2006-01-02 15:04")
 }
 // fmtTimeIn formats a timestamp in the given zone — a "±HH:MM" offset or an IANA name, resolved
 // by account.ResolveZone (falling back to UTC when empty or unknown) — or "" when zero. Used to
 // show a time in a user's local zone beside UTC; the offset form is what the profile editor and
 // the feedback browser-tz snapshot store, so it must not go through time.LoadLocation alone.
 func fmtTimeIn(t time.Time, tz string) string {
 	if t.IsZero() {
 		return ""
 	}
 	return t.In(account.ResolveZone(tz)).Format("2006-01-02 15:04")
 }
 // fmtTimePtr formats an optional timestamp for display, or "" when nil.
 func fmtTimePtr(t *time.Time) string {
 	if t == nil {
@@ -77,6 +77,17 @@ func (s *Server) consoleFeedbackDetail(c *gin.Context) {
 		s.consoleError(c, err)
 		return
 	}
 	// Filed time in three zones so the operator can tell what is certainly known from what is
 	// merely defaulted: always UTC; the client's offset detected at submit (when the build
 	// reported one); and the sender's saved profile zone (when set beyond the UTC default). An
 	// empty rendered time makes the template show "N/A" for that line.
 	browserCreated, userCreated := "", ""
 	if m.BrowserTZ != "" {
 		browserCreated = fmtTimeIn(m.CreatedAt, m.BrowserTZ)
 	}
 	if m.TimeZone != "" && m.TimeZone != "UTC" {
 		userCreated = fmtTimeIn(m.CreatedAt, m.TimeZone)
 	}
 	view := adminconsole.FeedbackDetailView{
 		ID: m.ID.String(), AccountID: m.AccountID.String(), SenderName: m.SenderName,
 		Source: m.Source, Channel: m.Channel, InterfaceLanguage: m.Lang,
@@ -84,6 +95,9 @@ func (s *Server) consoleFeedbackDetail(c *gin.Context) {
 		HasAttachment: m.HasAttachment, AttachmentName: m.AttachmentName, IsImage: feedback.IsImage(m.AttachmentName),
 		Read: m.Read, Archived: m.Archived, Replied: m.Replied, ReplyBody: m.ReplyBody,
 		RepliedAt: fmtTime(m.RepliedAt), CreatedAt: fmtTime(m.CreatedAt),
 		Version:          m.Version,
 		CreatedAtBrowser: browserCreated, BrowserTZ: m.BrowserTZ,
 		CreatedAtUser: userCreated, UserTZ: m.TimeZone,
 	}
 	if banned, err := s.accounts.HasRole(ctx, m.AccountID, account.RoleFeedbackBanned); err == nil {
 		view.Banned = banned
@@ -18,12 +18,14 @@ import (
 // telegramAuthRequest carries the identity the connector extracted from a
 // validated initData payload. Username, FirstName and LanguageCode seed a
-// brand-new account's display name and language (first contact only).
+// brand-new account's display name and language; BrowserTZ (the client's detected
 // "±HH:MM" UTC offset) seeds its time zone (first contact only).
 type telegramAuthRequest struct {
 	ExternalID   string `json:"external_id"`
 	Username     string `json:"username"`
 	FirstName    string `json:"first_name"`
 	LanguageCode string `json:"language_code"`
 	BrowserTZ    string `json:"browser_tz"`
 }
 // handleTelegramAuth provisions (or finds) the account bound to a Telegram
@@ -35,7 +37,7 @@ func (s *Server) handleTelegramAuth(c *gin.Context) {
 		abortBadRequest(c, "external_id is required")
 		return
 	}
-	acc, created, err := s.accounts.ProvisionTelegram(c.Request.Context(), req.ExternalID, req.LanguageCode, req.Username, req.FirstName)
+	acc, created, err := s.accounts.ProvisionTelegram(c.Request.Context(), req.ExternalID, req.LanguageCode, req.Username, req.FirstName, req.BrowserTZ)
 	if err != nil {
 		s.abortErr(c, err)
 		return
@@ -97,9 +99,21 @@ func (s *Server) handlePushTarget(c *gin.Context) {
 	})
 }
-// handleGuestAuth provisions a fresh ephemeral guest account and mints a session.
+// guestAuthRequest carries the guest bootstrap's optional time-zone seed: BrowserTZ
 // (the client's detected "±HH:MM" UTC offset) is written to the new guest account's
 // time zone, so robot timing is anchored to the player's zone from the first game.
 type guestAuthRequest struct {
 	BrowserTZ string `json:"browser_tz"`
 }
 // handleGuestAuth provisions a fresh ephemeral guest account and mints a session,
 // seeding its time zone from the optional detected browser offset.
 func (s *Server) handleGuestAuth(c *gin.Context) {
-	acc, err := s.accounts.ProvisionGuest(c.Request.Context())
+	// The body is optional: an absent or malformed one simply yields no time-zone seed
 	// (the account keeps the UTC default), so a bind error must not fail the bootstrap.
 	var req guestAuthRequest
 	_ = c.ShouldBindJSON(&req)
 	acc, err := s.accounts.ProvisionGuest(c.Request.Context(), req.BrowserTZ)
 	if err != nil {
 		s.abortErr(c, err)
 		return
@@ -107,9 +121,12 @@ func (s *Server) handleGuestAuth(c *gin.Context) {
 	s.mintSession(c, acc)
 }
-// emailRequest is an email-login code request.
+// emailRequest is an email-login code request. BrowserTZ (the client's detected
 // "±HH:MM" UTC offset) seeds the time zone of an account provisioned here on first
 // contact (the email account is created at the request step, not at login).
 type emailRequest struct {
 	Email     string `json:"email"`
 	BrowserTZ string `json:"browser_tz"`
 }
 // handleEmailRequest issues a login confirm-code to the email. It always reports
@@ -121,7 +138,7 @@ func (s *Server) handleEmailRequest(c *gin.Context) {
 		abortBadRequest(c, "email is required")
 		return
 	}
-	if _, err := s.emails.RequestLoginCode(c.Request.Context(), req.Email); err != nil {
+	if _, err := s.emails.RequestLoginCode(c.Request.Context(), req.Email, req.BrowserTZ); err != nil {
 		s.abortErr(c, err)
 		return
 	}
@@ -16,6 +16,12 @@ type feedbackSubmitRequest struct {
 	Attachment     string `json:"attachment"`
 	AttachmentName string `json:"attachment_name"`
 	Channel        string `json:"channel"`
 	// Version is the client's app version (pkg/version / the SPA build), snapshotted so the
 	// operator sees which build a report came from.
 	Version string `json:"version"`
 	// BrowserTZ is the client's detected UTC offset ("±HH:MM") at submit, so the operator can
 	// see the filed time in the sender's local zone even before they save a profile.
 	BrowserTZ string `json:"browser_tz"`
 }
 // feedbackReplyDTO is the operator's reply shown back to the player.
@@ -61,7 +67,7 @@ func (s *Server) handleFeedbackSubmit(c *gin.Context) {
 		}
 		attachment = data
 	}
-	if err := s.feedback.Submit(c.Request.Context(), uid, req.Body, attachment, req.AttachmentName, req.Channel, clientIP(c)); err != nil {
+	if err := s.feedback.Submit(c.Request.Context(), uid, req.Body, attachment, req.AttachmentName, req.Channel, req.Version, req.BrowserTZ, clientIP(c)); err != nil {
 		s.abortErr(c, err)
 		return
 	}
@@ -1,10 +1,10 @@
 // Package server wires the backend's HTTP listener: the gin engine, its route
 // groups, the per-request telemetry middleware and the start/stop lifecycle.
 //
-// The /api/v1 route groups (public, user, internal, admin) are created here so
+// The /api/v1 route groups (public, user, internal, admin) attach their endpoints
-// later stages attach their endpoints to a stable structure; the /user group
+// to a stable structure; the /user group requires the X-User-ID identity header.
-// requires the X-User-ID identity header. The probes /healthz (liveness) and
+// The probes /healthz (liveness) and /readyz (database + session-cache readiness)
-// /readyz (database + session-cache readiness) are unauthenticated.
+// are unauthenticated.
 package server
 import (
@@ -245,7 +245,7 @@ func (s *Server) Invitations() *lobby.InvitationService { return s.invitations }
 func (s *Server) Emails() *account.EmailService { return s.emails }
 // Handler returns the underlying HTTP handler. It lets tests drive the server
-// without binding a socket and lets later stages compose the backend behind
+// without binding a socket and lets callers compose the backend behind
 // another listener.
 func (s *Server) Handler() http.Handler { return s.http.Handler }
@@ -8,8 +8,7 @@ import (
 )
 // Service mints, resolves, and revokes sessions over the store and the
-// write-through cache. The gateway is its only caller (from a later stage); the
+// write-through cache. The gateway is its only caller.
 // HTTP surface is wired then.
 type Service struct {
 	store *Store
 	cache *Cache
@@ -3,8 +3,8 @@
 // in as a message kind. It owns the friendships, blocks and chat_messages tables,
 // reads the account-level block toggles through account.Store, and gates chat and
 // nudge on game state through a GameReader so it never imports the engine. The
-// live delivery of chat and nudges (push / in-app stream) belongs to the gateway
+// live delivery of chat and nudges (push / in-app stream) belongs to the gateway;
-// in a later stage; this package only persists and reads them.
+// this package only persists and reads them.
 package social
 import (
@@ -16,7 +16,7 @@ POSTGRES_PASSWORD=change-me            # required
 # the active version lives in the DB. On a live volume a changed value is ignored (the
 # recorded .seed_version marker wins — the seed-drift guard); change a running
 # contour's dictionary through /_gm/dictionary (ARCHITECTURE.md §5).
-DICT_VERSION=v1.2.1
+DICT_VERSION=v1.3.0
 # --- Logging ----------------------------------------------------------------
 LOG_LEVEL=info
@@ -17,11 +17,12 @@ operational reference for **every environment variable**.
 | `backend` | built (`backend/Dockerfile`) | Domain service; bakes in the DAWG dictionaries; runs migrations at boot. |
 | `postgres` | `postgres:17-alpine` | Database (named volume, `pg_isready` healthcheck). |
 | `validator` | built (`platform/telegram/Dockerfile`, target `validator`) | Telegram HMAC validator (no VPN, no Bot API); internal gRPC at `validator:9091`. Game login depends only on this. |
-| `vpn` + `bot` | sidecar + built (`platform/telegram/Dockerfile`, target `bot`) | Telegram bot; egresses through the AmneziaWG sidecar; holds no inbound port — dials the gateway bot-link (mTLS) at `gateway:9443`. |
+| `vpn` + `bot` | sidecar + built (`platform/telegram/Dockerfile`, target `bot`) | Telegram bot, gated to the **`telegram-local`** profile; egresses through the AmneziaWG sidecar and dials the gateway bot-link (mTLS) at `gateway:9443`. The test contour activates the profile; the prod **main** host omits it and runs the bot standalone on its **own host** (`docker-compose.bot.yml`, no VPN — native Bot API egress). |
 | `otelcol` | `otel/opentelemetry-collector-contrib` | OTLP/gRPC `:4317` → Prometheus scrape (`:9464`) + Tempo. |
-| `prometheus` | `prom/prometheus` | Metrics, 15d retention. |
+| `prometheus` | `prom/prometheus` | Metrics, 15d retention (7d in prod). |
 | `tempo` | `grafana/tempo` | Traces, 72h retention. |
 | `grafana` | `grafana/grafana` | Dashboards (provisioned), anonymous-admin behind caddy's `/_gm/grafana`. |
 | `node_exporter` | `quay.io/prometheus/node-exporter` | Host CPU/memory/disk metrics (Prometheus job `node`); the OOM signal on the tight prod main host (2 vCPU / 1.9 GiB). |
 Networking: inter-service traffic is on the private `internal` network
 (project-scoped DNS); only `caddy` joins the shared external `edge` network so the
@@ -59,7 +60,6 @@ compose binds from this directory.
 | Variable | Gitea kind | Purpose |
 | --- | --- | --- |
 | `POSTGRES_PASSWORD` | secret | Postgres password (also embedded in `BACKEND_POSTGRES_DSN`). |
 | `AWG_CONF` | secret | AmneziaWG config for the VPN sidecar (the bot's only Telegram egress in the test contour). **Must not contain a `DNS=` line** — it hijacks the shared netns's resolv.conf and breaks the bot resolving `otelcol` / `gateway`. Without it, Docker's resolver handles `otelcol`, `gateway` and `api.telegram.org`. |
 | `GM_BASICAUTH_HASH` | secret | bcrypt hash gating `/_gm` (admin console + Grafana). Generate with `docker run --rm caddy:2-alpine caddy hash-password --plaintext '<pw>'`. |
 | `TELEGRAM_MINIAPP_URL` | variable | The Mini App URL the bot hands out in deep links / buttons. |
@@ -67,13 +67,20 @@ compose binds from this directory.
 secret) and the bot (Bot API). It defaults to empty in compose, but both **fail at
 boot** when it is empty.
 **Conditionally — `AWG_CONF`** (secret): the AmneziaWG config for the VPN sidecar, needed
 only when the `telegram-local` profile runs (the test contour and local runs with the
 bot). It is **not** `:?`-guarded — compose interpolates profiled-out services too, so the
 prod main host (no VPN) must not require it. It **must not contain a `DNS=` line** — that
 hijacks the shared netns's resolv.conf and breaks the bot resolving `otelcol` / `gateway`;
 without it Docker's resolver handles `otelcol`, `gateway` and `api.telegram.org`.
 ## Optional variables (with defaults)
 | Variable | Gitea kind | Default | Purpose |
 | --- | --- | --- | --- |
 | `POSTGRES_DB` | variable | `scrabble` | Database name. |
 | `POSTGRES_USER` | variable | `scrabble` | Database user. |
-| `DICT_VERSION` | variable | `v1.2.1` | `scrabble-dictionary` release tag baked into the backend image as the **seed for a fresh volume** (build-arg). A live contour changes dictionary through the admin console, not this; on a seeded volume a changed value is ignored (the recorded `.seed_version` marker wins — the seed-drift guard, ARCHITECTURE.md §5). Set per contour as `TEST_`/`PROD_DICT_VERSION`. |
+| `DICT_VERSION` | variable | `v1.3.0` | `scrabble-dictionary` release tag baked into the backend image as the **seed for a fresh volume** (build-arg). A live contour changes dictionary through the admin console, not this; on a seeded volume a changed value is ignored (the recorded `.seed_version` marker wins — the seed-drift guard, ARCHITECTURE.md §5). Set per contour as `TEST_`/`PROD_DICT_VERSION`. |
 | `LOG_LEVEL` | variable | `info` | Shared log level for backend / gateway / validator / bot (`debug\|info\|warn\|error`). |
 | `CADDY_SITE_ADDRESS` | variable | `:80` | Caddy site address. Test: `:80` (host caddy terminates TLS). Prod: a domain, so caddy does its own ACME. |
 | `GM_BASICAUTH_USER` | variable | `gm` | Username for the `/_gm` Basic-Auth. |
@@ -110,6 +117,89 @@ collector's / gateway's internal IP is fine (connected route), but its `AWG_CONF
 which resolves `otelcol`, `gateway` and `api.telegram.org`. `GATEWAY_ADMIN_*` is
 intentionally **unset** — caddy owns `/_gm` in the contour.
 ## Bumping the dictionary version
 The dictionary ships as a versioned **release artifact** (`scrabble-dawg-vX.Y.Z.tar.gz`) from
 [`scrabble-dictionary`](https://gitea.iliadenisov.ru/developer/scrabble-dictionary). The tag is
 a build-time input with **no default** in the images, so it is set in exactly two places to
 move the whole stack — change both to a new release:
 1. **CI tests** — `.gitea/workflows/ci.yaml` `env.DICT_VERSION` (the unit/integration jobs
   download that dawg).
 2. **Deploy seed** — the Gitea repo variables `TEST_DICT_VERSION` / `PROD_DICT_VERSION` (the tag
   the deploy bakes into a **fresh** volume's image; the deploy job feeds it to `compose` as
   `DICT_VERSION`).
 For local builds set `DICT_VERSION` in `deploy/.env` (template: `.env.example`); a bare
 `docker build` needs `--build-arg DICT_VERSION=vX.Y.Z`. The Dockerfiles and `compose` carry no
 default — a missing value fails loudly instead of baking a stale tag.
 Bumping the seed is a **no-op on a live volume** (the `.seed_version` marker wins — the
 seed-drift guard). A running contour/prod moves to a new release **through the admin console**
 `/_gm/dictionary` (upload the tarball, preview the per-variant diff, confirm); in-flight games
 keep their pinned version, new games use the new one (ARCHITECTURE.md §5).
 ## Production rollout
 Prod runs on **two hosts** (main = full stack + ACME on the domain; tg = the bot only,
 native Bot API, no VPN), one-time provisioned by **[`ansible/`](ansible/)** (docker, a
 non-sudo `deploy` user holding the CI key, key-only sshd, default-deny ufw, fail2ban).
 Re-run `ansible/` after a host resize — it is idempotent.
 **To roll out:** merge `development → master` (CI green), then run the **`prod-deploy`**
 workflow manually (Gitea → Actions → prod-deploy → run from `master`, input
 `confirm=deploy`). It builds + pushes the images to the registry, ships the
 compose/config/certs/env over SSH, deploys the main host with `prod-deploy.sh` (rolling,
 health-gated, **auto-rollback to the previous tag**; caddy is force-recreated on its roll so
 a bind-mounted `Caddyfile` change applies — its image is pinned and admin is off, so neither a
 new tag nor a hot reload would pick it up), then the bot host, then probes the
 public site. After `master` is green this workflow is the **only** thing that touches
 prod — nothing auto-deploys there. It runs four visible jobs: **build → deploy-main →
 deploy-bot → verify** (the per-service rolling shows in the deploy-main log).
 **Versioning.** Each release is a git tag `vX.Y.Z` on `master`; the deploy stamps
 `git describe --tags` into every image tag, every binary (`-ldflags` → `pkg/version` →
 the `service.version` telemetry attribute) and the SPA About screen. Tag the release
 before running the deploy:
 ```sh
 git tag -a v1.0.0 -m v1.0.0 && git push origin v1.0.0
 ```
 **Manual rollback** (any time after a successful deploy). Run the **`prod-rollback`**
 workflow (Gitea → Actions → prod-rollback, `confirm=rollback`). Leave `target_version`
 blank to roll back to the previously deployed version (read from the host's
 `PREVIOUS_TAG`), or set it to a release tag from the **Releases** page. It re-deploys
 that already-published image rolling + health-gated — no rebuild, no DB migration
 (image rollback is DB-safe under the expand-contract rule). The registry keeps every
 release tag, so any prior release is reachable.
 **Migrations** must be **expand-contract** (backward-compatible; goose is forward-only):
 the automatic rollback is image-only and never restores the DB. A deploy that changes
 `backend/internal/postgres/migrations/` opens a maintenance window — the backend (sole
 writer) is stopped for a consistent `pg_dump` into `/opt/scrabble/dumps` before the new
 backend migrates. **Manual DB restore** (only if a migration was destructive):
 `docker exec -i scrabble-postgres psql -U scrabble -d scrabble -c 'DROP SCHEMA backend CASCADE'`,
 then pipe the dump into the same `psql`, and redeploy the matching old tag.
 **bot-link cert rotation:** regenerate (`deploy/gen-certs.sh /tmp/c --force`), reset the
 five `PROD_BOTLINK_*` secrets from `/tmp/c`, and re-run the workflow — both hosts redeploy
 together with the fresh CA.
 **Sizing / monitoring:** the main host launches undersized (2 vCPU / 1.9 GiB); the prod
 overlay trims limits + `GOMAXPROCS=2` + 7d Prometheus retention, and `node_exporter` feeds
 host memory to Grafana (`/_gm/grafana/`). Watch host memory and resize at Selectel when
 players arrive.
 **`PROD_` Gitea set** (mirrors `TEST_`, mapped onto the unprefixed names above) — secrets:
 `PROD_{POSTGRES_PASSWORD, GM_BASICAUTH_HASH, GRAFANA_ADMIN_PASSWORD, TELEGRAM_BOT_TOKEN,
 TELEGRAM_PROMO_BOT_TOKEN, REGISTRY_PASSWORD, SSH_KEY, SSH_KNOWN_HOSTS, BOTLINK_CA,
 BOTLINK_GATEWAY_CERT, BOTLINK_GATEWAY_KEY, BOTLINK_BOT_CERT, BOTLINK_BOT_KEY}`; variables:
 `PROD_{REGISTRY_USER, MAIN_HOST, TG_HOST, CADDY_SITE_ADDRESS, GM_BASICAUTH_USER,
 GRAFANA_ROOT_URL, LOG_LEVEL, DICT_VERSION, TELEGRAM_MINIAPP_URL, TELEGRAM_GAME_CHANNEL_ID,
 TELEGRAM_CHAT_ID, TELEGRAM_BOT_USERNAME, VITE_TELEGRAM_BOT_ID, VITE_TELEGRAM_LINK,
 VITE_TELEGRAM_GAME_CHANNEL_NAME}`.
 ## Host-side setup (outside this repo)
 - **`edge` network** must exist on the host (`docker network create edge`).
@@ -0,0 +1,49 @@
 # Prod host provisioning
 Idempotent Ansible that prepares the two production hosts. It installs Docker, a
 non-sudo `deploy` service account, SSH hardening, a default-deny firewall,
 fail2ban, unattended security upgrades and time sync. It does **not** deploy the
 application — that is `.gitea/workflows/prod-deploy.yaml`'s job, running as the
 `deploy` account this playbook creates.
 Hosts are referenced by `~/.ssh/config` aliases (`scrabble-main-ops`,
 `scrabble-tg-ops`), so no IPs or key paths live in the repo.
 ## Prerequisites (controller)
 - `ansible` with the bundled collections (`community.general`, `community.docker`,
  `ansible.posix`).
 - The two hosts reachable as root via the ssh-config aliases, host keys already
  accepted into `known_hosts` (`host_key_checking = True`).
 ## One-time: the CI deploy key
 The CI prod-deploy workflow logs into the hosts as `deploy` using a dedicated
 key. Generate it once on the controller, authorize its public half via the
 playbook, and store its private half **only** in the Gitea `PROD_SSH_KEY` secret:
 ```sh
 ssh-keygen -t ed25519 -N '' -C scrabble-ci-deploy \
  -f ~/.ssh/scrabble_ci_deploy_ed25519
 # private half -> Gitea secret PROD_SSH_KEY (set via API); never commit it
 ```
 ## Run
 ```sh
 cd deploy/ansible
 ansible-playbook site.yml
 ```
 The playbook reads the public key from `~/.ssh/scrabble_ci_deploy_ed25519.pub` by
 default; override with `-e deploy_ci_pubkey_path=/path/to/key.pub`. Re-running is
 safe (idempotent) and survives a host resize.
 ## What each host gets
 - **both** (`common`): docker-ce + compose plugin, `daemon.json` (live-restore,
  10m×3 log rotation), `deploy` user (docker group, no sudo), key-only sshd,
  `ufw` default-deny incoming + allow SSH, fail2ban sshd jail, unattended
  upgrades, chrony, `/opt/scrabble/{config,certs,dumps,images}`.
 - **main**: `ufw` opens 80/443/9443; the external `edge` docker network.
 - **tg**: verifies direct `api.telegram.org` egress (the no-VPN assumption).
@@ -0,0 +1,11 @@
 [defaults]
 inventory = inventory.ini
 roles_path = roles
 interpreter_python = /usr/bin/python3
 host_key_checking = True
 stdout_callback = yaml
 deprecation_warnings = False
 retry_files_enabled = False
 [ssh_connection]
 pipelining = True
@@ -0,0 +1,21 @@
 ---
 # Service account the CI prod-deploy workflow uses to drive docker on the hosts.
 # Membership in the docker group is root-equivalent (docker socket access), which
 # is all the deploy workflow needs; the account is deliberately not given sudo.
 deploy_user: deploy
 # Public half of the dedicated CI deploy SSH key, read from the controller at run
 # time. The private half is generated on the controller during provisioning and
 # stored ONLY in the Gitea PROD_SSH_KEY secret; it is never committed. Override the
 # path with -e deploy_ci_pubkey_path=/path/to/key.pub if the key lives elsewhere.
 deploy_ci_pubkey_path: "{{ lookup('env', 'HOME') }}/.ssh/scrabble_ci_deploy_ed25519.pub"
 deploy_ci_pubkey: "{{ lookup('file', deploy_ci_pubkey_path) }}"
 # Base directory the deploy workflow rsyncs compose files, config, certs and dumps
 # into. Owned by deploy_user so the workflow needs no elevation.
 scrabble_base_dir: /opt/scrabble
 # Docker daemon json-file log rotation, mirroring the compose x-logging anchor so
 # the host's own containers (and any ad-hoc runs) rotate identically.
 docker_log_max_size: "10m"
 docker_log_max_file: "3"
@@ -0,0 +1,19 @@
 # Production inventory for Stage 18.
 #
 # Hosts resolve through the operator's ~/.ssh/config aliases, so HostName (public
 # IP), User and IdentityFile live there — no IPs or key paths are committed here.
 #   scrabble-main-ops -> main stack host (public IP, domain erudit-game.ru)
 #   scrabble-tg-ops   -> Telegram bot host (direct Bot API egress, no VPN)
 [main]
 scrabble-main-ops
 [tg]
 scrabble-tg-ops
 [prod:children]
 main
 tg
 [prod:vars]
 ansible_user=root
@@ -0,0 +1,15 @@
 ---
 - name: restart docker
  ansible.builtin.service:
    name: docker
    state: restarted
 - name: reload sshd
  ansible.builtin.service:
    name: ssh
    state: reloaded
 - name: restart fail2ban
  ansible.builtin.service:
    name: fail2ban
    state: restarted
@@ -0,0 +1,167 @@
 ---
 # Common baseline applied to both prod hosts: Docker engine, a non-sudo deploy
 # service account, SSH hardening, a default-deny firewall, fail2ban, unattended
 # security upgrades and time sync. Every task is idempotent.
 - name: Install base packages
  ansible.builtin.apt:
    name:
      - ca-certificates
      - curl
      - gnupg
      - ufw
      - fail2ban
      - unattended-upgrades
      - chrony
    state: present
    update_cache: true
    cache_valid_time: 3600
 # --- Docker engine (official repo; trixie is published upstream) ---------------
 - name: Create apt keyring directory
  ansible.builtin.file:
    path: /etc/apt/keyrings
    state: directory
    mode: "0755"
 - name: Install Docker apt GPG key
  ansible.builtin.get_url:
    url: https://download.docker.com/linux/debian/gpg
    dest: /etc/apt/keyrings/docker.asc
    mode: "0644"
 - name: Add Docker apt repository
  ansible.builtin.apt_repository:
    repo: >-
      deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc]
      https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable
    filename: docker
    state: present
 - name: Install Docker engine and the compose plugin
  ansible.builtin.apt:
    name:
      - docker-ce
      - docker-ce-cli
      - containerd.io
      - docker-buildx-plugin
      - docker-compose-plugin
    state: present
    update_cache: true
 - name: Configure the Docker daemon (live-restore + log rotation)
  ansible.builtin.template:
    src: daemon.json.j2
    dest: /etc/docker/daemon.json
    mode: "0644"
  notify: restart docker
 - name: Enable and start Docker
  ansible.builtin.service:
    name: docker
    enabled: true
    state: started
 # --- Deploy service account ----------------------------------------------------
 - name: Create the deploy service account
  ansible.builtin.user:
    name: "{{ deploy_user }}"
    groups: docker
    append: true
    shell: /bin/bash
    create_home: true
 - name: Ensure the deploy .ssh directory
  ansible.builtin.file:
    path: "/home/{{ deploy_user }}/.ssh"
    state: directory
    owner: "{{ deploy_user }}"
    group: "{{ deploy_user }}"
    mode: "0700"
 - name: Authorize the CI deploy SSH key (exclusive)
  ansible.builtin.copy:
    dest: "/home/{{ deploy_user }}/.ssh/authorized_keys"
    content: "{{ deploy_ci_pubkey }}\n"
    owner: "{{ deploy_user }}"
    group: "{{ deploy_user }}"
    mode: "0600"
 # --- SSH hardening -------------------------------------------------------------
 - name: Harden sshd (key-only auth)
  ansible.builtin.template:
    src: sshd-hardening.conf.j2
    dest: /etc/ssh/sshd_config.d/10-scrabble-hardening.conf
    mode: "0644"
    validate: sshd -t -f %s
  notify: reload sshd
 # --- Firewall (default deny incoming) ------------------------------------------
 # SSH is allowed before the policy flips so enabling ufw never locks us out.
 - name: Allow SSH through the firewall
  community.general.ufw:
    rule: allow
    name: OpenSSH
 - name: Default-deny incoming, allow outgoing
  community.general.ufw:
    direction: "{{ item.direction }}"
    policy: "{{ item.policy }}"
  loop:
    - { direction: incoming, policy: deny }
    - { direction: outgoing, policy: allow }
 - name: Enable the firewall
  community.general.ufw:
    state: enabled
 # --- fail2ban ------------------------------------------------------------------
 - name: Configure the fail2ban sshd jail
  ansible.builtin.template:
    src: jail.local.j2
    dest: /etc/fail2ban/jail.local
    mode: "0644"
  notify: restart fail2ban
 - name: Enable and start fail2ban
  ansible.builtin.service:
    name: fail2ban
    enabled: true
    state: started
 # --- Unattended security upgrades + time sync ----------------------------------
 - name: Enable unattended upgrades
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    mode: "0644"
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
 - name: Enable and start chrony
  ansible.builtin.service:
    name: chrony
    enabled: true
    state: started
 # --- Deploy directories --------------------------------------------------------
 - name: Create the scrabble base directories
  ansible.builtin.file:
    path: "{{ scrabble_base_dir }}/{{ item }}"
    state: directory
    owner: "{{ deploy_user }}"
    group: "{{ deploy_user }}"
    mode: "0750"
  loop:
    - ""
    - config
    - certs
    - dumps
    - images
@@ -0,0 +1,8 @@
 {
  "live-restore": true,
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "{{ docker_log_max_size }}",
    "max-file": "{{ docker_log_max_file }}"
  }
 }
@@ -0,0 +1,9 @@
 # Managed by Ansible (deploy/ansible).
 [DEFAULT]
 bantime = 1h
 findtime = 10m
 maxretry = 5
 backend = systemd
 [sshd]
 enabled = true
@@ -0,0 +1,6 @@
 # Managed by Ansible (deploy/ansible). Key-only authentication.
 # root stays reachable by key (prohibit-password) for provisioning re-runs.
 PasswordAuthentication no
 PermitRootLogin prohibit-password
 PubkeyAuthentication yes
 KbdInteractiveAuthentication no
@@ -0,0 +1,18 @@
 ---
 # Main stack host: public web + bot-link ports and the external 'edge' network
 # the compose stack attaches caddy to.
 - name: Open public web and bot-link ports
  community.general.ufw:
    rule: allow
    port: "{{ item }}"
    proto: tcp
  loop:
    - "80"    # HTTP (ACME challenge + redirect to HTTPS)
    - "443"   # HTTPS (caddy edge)
    - "9443"  # bot-link mTLS (remote bot dials in; mutual TLS gates access)
 - name: Ensure the external 'edge' docker network exists
  community.docker.docker_network:
    name: edge
    state: present
@@ -0,0 +1,19 @@
 ---
 # Telegram bot host: holds no inbound port beyond SSH (the bot dials out to the
 # Bot API and into the main host's bot-link). We only verify direct Bot API
 # egress here, since the "no VPN" decision depends on it.
 - name: Verify direct Telegram Bot API egress (no VPN on this host)
  ansible.builtin.uri:
    url: https://api.telegram.org/
    method: GET
    status_code: [200, 301, 302, 401, 404]   # any HTTP reply proves reachability
    timeout: 10
  register: tg_egress
  failed_when: false
 - name: Report Telegram reachability
  ansible.builtin.debug:
    msg: >-
      api.telegram.org reachable:
      {{ (tg_egress.status | default(0) | int) > 0 }} (status {{ tg_egress.status | default('none') }})
@@ -0,0 +1,31 @@
 ---
 # Production host provisioning. Idempotent: safe to re-run after a host resize.
 # Prepares hosts only (docker, hardening, service account, firewall); the
 # application is deployed separately by .gitea/workflows/prod-deploy.yaml.
 - name: Common baseline (both hosts)
  hosts: prod
  become: true
  pre_tasks:
    - name: Require a well-formed CI deploy public key
      ansible.builtin.assert:
        that:
          - deploy_ci_pubkey | length > 0
          - deploy_ci_pubkey is search('^(ssh|ecdsa)-')
        fail_msg: >-
          deploy_ci_pubkey is empty or malformed. Generate the key first
          (see deploy/ansible/README.md) or override deploy_ci_pubkey_path.
  roles:
    - common
 - name: Main stack host
  hosts: main
  become: true
  roles:
    - main
 - name: Telegram bot host
  hosts: tg
  become: true
  roles:
    - tg
@@ -21,6 +21,18 @@
 }
 {$CADDY_SITE_ADDRESS::80} {
 	# HTTP/3 is advertised by default whenever this caddy terminates TLS (prod:
 	# CADDY_SITE_ADDRESS is the domain). But UDP/443 is never reachable — the prod
 	# compose maps only "443:443" (TCP) and ufw opens 443/tcp — so a client that cached
 	# the `Alt-Svc: h3` advert (sticky for ma=2592000s) stalls on the dead QUIC path
 	# before falling back to h2, which surfaced as the Telegram Mini App intermittently
 	# hanging on load. `Alt-Svc: clear` actively drops any cached alternative and pins
 	# clients to h2/h1; it is applied site-wide so every route is covered. In the test
 	# contour this caddy serves plain :80 (no h3 to advertise) and the host caddy
 	# re-stamps its own Alt-Svc, so the live test fix lives in the host caddy — here it
 	# is the prod fix. Background + alternatives (incl. serving h3 for real): docs/EDGE_HTTP3.md.
 	header Alt-Svc clear
 	# Operator surfaces under /_gm: a single shared Basic-Auth, then route.
 	@gm path /_gm /_gm/*
 	handle @gm {
@@ -0,0 +1,53 @@
 # Production Telegram bot host descriptor (standalone — NOT an overlay). Run only on
 # the bot host:
 #   docker compose -f docker-compose.bot.yml up -d
 #
 # The bot egresses to the Bot API directly (no VPN sidecar) and dials the main host's
 # published bot-link :9443 over mTLS. It exports no telemetry — otelcol lives on the
 # main host and is unreachable from here — so observe it via `docker logs` on this host.
 # Values come from the prod-deploy workflow (PROD_ secrets/variables); BOT_IMAGE is the
 # pushed registry tag and BOTLINK_GATEWAY_ADDR is the main host's <ip>:9443.
 name: scrabble-bot
 services:
  bot:
    container_name: scrabble-telegram-bot
    image: ${BOT_IMAGE:?set BOT_IMAGE to the registry tag}
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    environment:
      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:?set TELEGRAM_BOT_TOKEN}
      TELEGRAM_GAME_CHANNEL_ID: ${TELEGRAM_GAME_CHANNEL_ID:-}
      TELEGRAM_CHAT_ID: ${TELEGRAM_CHAT_ID:-}
      TELEGRAM_PROMO_BOT_TOKEN: ${TELEGRAM_PROMO_BOT_TOKEN:-}
      TELEGRAM_BOT_USERNAME: ${TELEGRAM_BOT_USERNAME:-}
      TELEGRAM_BOT_LINK: ${TELEGRAM_BOT_LINK:-}
      TELEGRAM_MINIAPP_URL: ${TELEGRAM_MINIAPP_URL:?set TELEGRAM_MINIAPP_URL}
      # Real Bot API in prod (the test contour pins TELEGRAM_TEST_ENV=true instead).
      TELEGRAM_TEST_ENV: "false"
      TELEGRAM_API_BASE_URL: ${TELEGRAM_API_BASE_URL:-}
      TELEGRAM_OWNS_UPDATES: "true"
      # Dials the main host's published bot-link. ServerName stays `gateway` (the cert
      # SAN), so TLS validation is independent of the dial address.
      TELEGRAM_GATEWAY_ADDR: ${BOTLINK_GATEWAY_ADDR:?set BOTLINK_GATEWAY_ADDR (main:9443)}
      TELEGRAM_BOTLINK_SERVER_NAME: gateway
      TELEGRAM_BOTLINK_TLS_CERT: /certs/bot.crt
      TELEGRAM_BOTLINK_TLS_KEY: /certs/bot.key
      TELEGRAM_BOTLINK_TLS_CA: /certs/ca.crt
      TELEGRAM_LOG_LEVEL: ${LOG_LEVEL:-info}
      TELEGRAM_SERVICE_NAME: scrabble-telegram-bot
      # No telemetry export: otelcol is on the main host, unreachable from here.
      TELEGRAM_OTEL_TRACES_EXPORTER: none
      TELEGRAM_OTEL_METRICS_EXPORTER: none
      GOMAXPROCS: "1"
    volumes:
      - ${SCRABBLE_CONFIG_DIR:-.}/certs:/certs:ro
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 256M
@@ -0,0 +1,98 @@
 # Production main-host overlay, applied on top of docker-compose.yml on the main host:
 #   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
 #
 # It (1) publishes caddy 80/443 — there is no host caddy in prod, so the contour caddy
 # owns the edge and does its own ACME on CADDY_SITE_ADDRESS — and the gateway bot-link
 # :9443 the remote bot dials in over mTLS; and (2) retunes the baseline limits down for the
 # 2 vCPU / 1.9 GiB host (GOMAXPROCS=2, smaller memory caps, shorter Prometheus
 # retention). The contour launches deliberately undersized at zero players; the added
 # node_exporter + Grafana watch host memory so it can be resized at Selectel when
 # traffic arrives.
 #
 # The bot + its VPN sidecar are absent here (the telegram-local profile is not
 # activated); the prod bot runs on its own host from docker-compose.bot.yml.
 services:
  caddy:
    ports:
      - "80:80"
      - "443:443"
    deploy:
      resources:
        limits:
          memory: 96M
  gateway:
    # Prod pulls the pushed image by tag instead of building locally; the base
    # build: section stays dormant because the deploy always pulls first.
    image: ${REGISTRY:?set REGISTRY}/scrabble-gateway:${TAG:?set TAG}
    ports:
      - "9443:9443"
    environment:
      # 2 vCPU host: align the Go scheduler with the cgroup quota (the baseline's 3-core gateway needs 3 cores).
      GOMAXPROCS: "2"
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 384M
  backend:
    image: ${REGISTRY:?set REGISTRY}/scrabble-backend:${TAG:?set TAG}
    deploy:
      resources:
        limits:
          memory: 384M
  postgres:
    deploy:
      resources:
        limits:
          memory: 384M
  validator:
    image: ${REGISTRY:?set REGISTRY}/scrabble-telegram-validator:${TAG:?set TAG}
    deploy:
      resources:
        limits:
          memory: 96M
  landing:
    image: ${REGISTRY:?set REGISTRY}/scrabble-landing:${TAG:?set TAG}
    deploy:
      resources:
        limits:
          memory: 64M
  otelcol:
    deploy:
      resources:
        limits:
          memory: 256M
  prometheus:
    command:
      - --config.file=/etc/prometheus/prometheus.yml
      - --storage.tsdb.retention.time=7d
    deploy:
      resources:
        limits:
          memory: 256M
  tempo:
    deploy:
      resources:
        limits:
          memory: 384M
  grafana:
    deploy:
      resources:
        limits:
          memory: 256M
  postgres_exporter:
    deploy:
      resources:
        limits:
          memory: 64M
@@ -25,9 +25,9 @@
 #     backend admin relay reaches the gateway at `gateway:9092` (plaintext).
 name: scrabble
-# Bound every container's json-file logs. R7 measured the backend emitting a
+# Bound every container's json-file logs. The backend emits a per-request latency
-# per-request latency line at info (~14 MiB / 30 min under the 500-player stress
+# line at info (~14 MiB / 30 min under the 500-player peak); without rotation the
-# peak); without rotation the volume grows unbounded. 10 MiB x 3 files caps each
+# volume grows unbounded. 10 MiB x 3 files caps each
 # container at 30 MiB. Applied to every service via the *default-logging alias.
 x-logging: &default-logging
  driver: json-file
@@ -52,8 +52,8 @@ services:
      retries: 30
    volumes:
      - postgres-data:/var/lib/postgresql/data
-    # R7 starting limits: 512M leaves headroom over the default 128 MB shared_buffers +
+    # 512M leaves headroom over the default 128 MB shared_buffers + per-connection
-    # per-connection memory (R2 peaked at 28 backends / 69 MiB RSS); tighten after the run.
+    # memory (the load harness peaked at 28 backends / 69 MiB RSS).
    deploy:
      resources:
        limits:
@@ -68,9 +68,13 @@ services:
      context: ..
      dockerfile: backend/Dockerfile
      args:
-        # Seed dictionary for a FRESH volume; the per-contour value comes from the
+        # Seed dictionary for a FRESH volume; required (no default) so the release tag is
-        # deploy env (Gitea TEST_/PROD_DICT_VERSION). See the volume note below.
+        # set in exactly one place per context — the deploy env (Gitea TEST_/PROD_DICT_VERSION)
-        DICT_VERSION: ${DICT_VERSION:-v1.2.1}
+        # or .env for local builds. See the volume note below + deploy/README.md "Bumping the
        # dictionary version".
        DICT_VERSION: ${DICT_VERSION:?set DICT_VERSION — the scrabble-dictionary release tag, e.g. in deploy/.env}
        # Build version stamped into the binary (git tag; see pkg/version).
        VERSION: ${APP_VERSION:-dev}
    restart: unless-stopped
    logging: *default-logging
    depends_on:
@@ -79,8 +83,8 @@ services:
    environment:
      # search_path=backend matches the migrations (00001 creates the schema).
      BACKEND_POSTGRES_DSN: postgres://${POSTGRES_USER:-scrabble}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-scrabble}?sslmode=disable&search_path=backend
-      # R7 tuned: the pool sat at its 25-conn cap (28 backends total) at 500 players;
+      # The pool caps at 25 conns (~28 backends) around 500 players; 40 gives headroom
-      # 40 gives headroom for bursts. Postgres (2 cores / 512 MiB) handles it.
+      # for bursts. Postgres (2 cores / 512 MiB) handles it.
      BACKEND_POSTGRES_MAX_OPEN_CONNS: "40"
      BACKEND_HTTP_ADDR: ":8080"
      BACKEND_GRPC_ADDR: ":9090"
@@ -109,8 +113,8 @@ services:
      - dawg-data:/opt/dawg
    # No container healthcheck: the distroless image has no shell/wget. Readiness
    # is covered by the CI post-deploy probe (GET / through caddy).
-    # R7 starting limits (generous over the R2 ~1-core / <=100 MiB peak); tightened to
+    # Generous over the ~1-core / <=100 MiB measured peak; the prod overlay trims these
-    # the agreed prod values after the final stress run. deploy.resources.limits is
+    # to the launch-host values. deploy.resources.limits is
    # honoured by `docker compose up` (Compose v2), not only by swarm.
    deploy:
      resources:
@@ -132,6 +136,8 @@ services:
        VITE_TELEGRAM_GAME_CHANNEL_NAME: ${VITE_TELEGRAM_GAME_CHANNEL_NAME:-}
        VITE_GATEWAY_URL: ${VITE_GATEWAY_URL:-}
        VITE_APP_VERSION: ${APP_VERSION:-dev}
        # Go binary version (the SPA's VITE_APP_VERSION is the same git tag).
        VERSION: ${APP_VERSION:-dev}
    restart: unless-stopped
    logging: *default-logging
    depends_on: [backend]
@@ -171,7 +177,7 @@ services:
    # deploy/gen-certs.sh for the test contour; supplied from PROD_ secrets in prod.
    volumes:
      - ${SCRABBLE_CONFIG_DIR:-.}/certs:/certs:ro
-    # R7 tuned: the gateway holds one h2c connection per player, so at 500 players it
+    # The gateway holds one h2c connection per player, so at 500 players it
    # bursts into a 2-core cap (~2.49% transport_error on game.state); 3 cores absorbs
    # the bursts. Per-connection overhead is the realistic prod cost — size for it.
    deploy:
@@ -218,6 +224,8 @@ services:
      context: ..
      dockerfile: platform/telegram/Dockerfile
      target: validator
      args:
        VERSION: ${APP_VERSION:-dev}
    restart: unless-stopped
    logging: *default-logging
    environment:
@@ -240,14 +248,22 @@ services:
    networks: [internal]
  # --- Telegram bot (egress via the VPN sidecar in test; dials the gateway) ---
  # vpn + bot are gated to the `telegram-local` profile: the test contour runs them
  # locally (CI passes --profile telegram-local), the prod main host omits them, and
  # the prod bot runs on its own host from deploy/docker-compose.bot.yml.
  vpn:
    container_name: scrabble-telegram-vpn
    image: docker.iliadenisov.ru/developer/amneziawg-sidecar:latest
    profiles: ["telegram-local"]
    restart: unless-stopped
    logging: *default-logging
    privileged: true
    environment:
-      AWG_CONF: ${AWG_CONF:?set AWG_CONF}
+      # Required by the vpn sidecar, which is gated to the telegram-local profile.
      # Compose can't scope a `:?` guard to a profile (interpolation runs for
      # profiled-out services too) and the prod main host has no VPN, so this is a soft
      # default; the test contour always supplies TEST_AWG_CONF and the sidecar validates it.
      AWG_CONF: ${AWG_CONF:-}
    networks:
      internal:
        aliases: [telegram]
@@ -255,10 +271,13 @@ services:
  bot:
    container_name: scrabble-telegram-bot
    image: scrabble-telegram-bot:latest
    profiles: ["telegram-local"]
    build:
      context: ..
      dockerfile: platform/telegram/Dockerfile
      target: bot
      args:
        VERSION: ${APP_VERSION:-dev}
    restart: unless-stopped
    logging: *default-logging
    depends_on: [vpn]
@@ -385,8 +404,8 @@ services:
    volumes:
      - ${SCRABBLE_CONFIG_DIR:-.}/tempo/tempo.yaml:/etc/tempo/tempo.yaml:ro
      - tempo-data:/var/tempo
-    # R7 tuned: tempo reached the 1 GiB cap during the final run (446 MiB in R2);
+    # Tempo reached the 1 GiB cap under sustained load (446 MiB in earlier runs);
-    # raised to 2 GiB for headroom against OOM under sustained tracing load.
+    # raised to 2 GiB for headroom against OOM.
    deploy:
      resources:
        limits:
@@ -444,6 +463,26 @@ services:
          memory: 128M
    networks: [internal]
  # node_exporter exports host CPU/memory/disk metrics. The prod main host runs a tight
  # 1.9 GiB budget, so host memory pressure — not just per-container docker_stats — is
  # what warns before an OOM. Prometheus scrapes it at :9100 (see prometheus.yml).
  node_exporter:
    container_name: scrabble-node-exporter
    image: quay.io/prometheus/node-exporter:v1.8.2
    restart: unless-stopped
    logging: *default-logging
    command:
      - --path.rootfs=/host
      - --collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host)($|/)
    pid: host
    volumes:
      - /:/host:ro,rslave
    deploy:
      resources:
        limits:
          memory: 64M
    networks: [internal]
 networks:
  internal:
    name: scrabble-internal
@@ -36,7 +36,21 @@
      "type": "stat",
      "title": "Database size",
      "gridPos": { "h": 5, "w": 6, "x": 18, "y": 0 },
-      "fieldConfig": { "defaults": { "unit": "bytes" }, "overrides": [] },
+      "fieldConfig": {
        "defaults": {
          "unit": "bytes",
          "color": { "mode": "thresholds" },
          "thresholds": {
            "mode": "absolute",
            "steps": [
              { "color": "green", "value": null },
              { "color": "yellow", "value": 8589934592 },
              { "color": "red", "value": 17179869184 }
            ]
          }
        },
        "overrides": []
      },
      "datasource": { "type": "prometheus", "uid": "prometheus" },
      "targets": [{ "refId": "A", "expr": "max(pg_database_size_bytes{datname=\"scrabble\"})" }]
    },
@@ -0,0 +1,149 @@
 #!/usr/bin/env bash
 # Production main-host deploy driver. Runs ON the main host, invoked over SSH by
 # .gitea/workflows/prod-deploy.yaml as the deploy user (which must already be
 # `docker login`ed to the registry). It pulls the images at the new tag and rolls
 # the stack ONE service at a time in dependency order (least -> most dependent),
 # health-checking after each; any failure rolls the whole stack back to the
 # previously deployed tag.
 #
 # A schema migration adds a maintenance window: the backend (the only writer) is
 # stopped so a consistent pg_dump is taken before the new backend migrates forward.
 # Image rollback alone is safe under the expand-contract migration rule, so the
 # automatic rollback never touches the database; the dump is kept for a MANUAL
 # restore if a migration turned out to be destructive (see deploy/prod/README.md).
 #
 # Required env (exported by the workflow over SSH):
 #   REGISTRY   registry namespace, e.g. docker.iliadenisov.ru/developer
 #   TAG        new image tag (the deployed git SHA)
 #   PREV_TAG   previously deployed tag, or "none" on the first deploy
 #   MIGRATION  "1" when the deploy carries a schema migration, else "0"
 # Optional: COMPOSE_DIR ENV_FILE DUMP_DIR STATE_FILE POSTGRES_USER POSTGRES_DB
 set -uo pipefail
 # Runtime compose vars (POSTGRES_*, GM_*, GRAFANA_*, CADDY_*, TELEGRAM_*, REGISTRY,
 # SCRABBLE_CONFIG_DIR, ...) come from a shell-sourceable env file the workflow writes
 # with single-quoted values. Exporting them into the process environment lets compose
 # interpolate ${...} without re-parsing the value — a plain --env-file would mangle the
 # literal '$' in the bcrypt GM_BASICAUTH_HASH.
 ENV_FILE="${ENV_FILE:-/opt/scrabble/env.sh}"
 # shellcheck disable=SC1090
 [ -f "$ENV_FILE" ] && . "$ENV_FILE"
 REGISTRY="${REGISTRY:?REGISTRY required (env.sh)}"
 TAG="${TAG:?TAG required}"
 PREV_TAG="${PREV_TAG:-none}"
 MIGRATION="${MIGRATION:-0}"
 COMPOSE_DIR="${COMPOSE_DIR:-/opt/scrabble/compose}"
 DUMP_DIR="${DUMP_DIR:-/opt/scrabble/dumps}"
 STATE_FILE="${STATE_FILE:-/opt/scrabble/DEPLOYED_TAG}"
 # The prior deployed tag, preserved on every successful deploy so prod-rollback can
 # target "the previous version" with no operator input.
 PREV_STATE_FILE="${PREV_STATE_FILE:-/opt/scrabble/PREVIOUS_TAG}"
 PG_USER="${POSTGRES_USER:-scrabble}"
 PG_DB="${POSTGRES_DB:-scrabble}"
 cd "$COMPOSE_DIR" || { echo "compose dir $COMPOSE_DIR missing"; exit 1; }
 export REGISTRY
 # otelcol joins the host docker group to read the socket; the GID varies per host.
 DOCKER_GID="$(getent group docker | cut -d: -f3)"
 export DOCKER_GID
 dc() { docker compose -f docker-compose.yml -f docker-compose.prod.yml "$@"; }
 use_tag() { export TAG="$1"; }
 # --- health probes (one-off containers on the contour networks, like CI) --------
 _probe() { docker run --rm --network "$1" alpine:3.20 wget -q -T 5 -O /dev/null "$2"; }
 health_backend() { for _ in $(seq 1 20); do _probe scrabble-internal http://backend:8080/readyz && return 0; sleep 3; done; return 1; }
 health_landing() { for _ in $(seq 1 20); do _probe scrabble-internal http://landing:80/ && return 0; sleep 3; done; return 1; }
 health_postgres() { for _ in $(seq 1 30); do [ "$(docker inspect -f '{{.State.Health.Status}}' scrabble-postgres 2>/dev/null)" = healthy ] && return 0; sleep 2; done; return 1; }
 health_running() { # health_running <container>: running, not restarting, stable restart count
  local n="$1" s r c1 c2
  for _ in $(seq 1 20); do
    s="$(docker inspect -f '{{.State.Status}}' "$n" 2>/dev/null || echo missing)"
    r="$(docker inspect -f '{{.State.Restarting}}' "$n" 2>/dev/null || echo true)"
    if [ "$s" = running ] && [ "$r" = false ]; then
      c1="$(docker inspect -f '{{.RestartCount}}' "$n")"; sleep 5
      c2="$(docker inspect -f '{{.RestartCount}}' "$n")"
      [ "$c1" = "$c2" ] && return 0
    fi
    sleep 3
  done
  return 1
 }
 roll() { # roll <service> <health-cmd...>
  local svc="$1"; shift
  echo ">>> rolling $svc -> $TAG"
  # caddy's image is pinned (caddy:2-alpine, no $TAG) and its Caddyfile is bind-mounted, so a
  # config-only change leaves the compose definition unchanged: `up -d` treats the container as
  # current and does not recreate it, and admin is off so there is no hot reload — the new
  # Caddyfile would never load. Force a recreate for caddy so config changes always apply; every
  # other service already recreates on its new $TAG image.
  local recreate=(); [ "$svc" = caddy ] && recreate=(--force-recreate)
  dc up -d --no-build --no-deps "${recreate[@]}" "$svc" || return 1
  "$@" || { echo "!!! $svc failed health check"; return 1; }
  echo "<<< $svc healthy"
 }
 rollback() {
  echo "########## ROLLBACK -> $PREV_TAG ##########"
  if [ "$PREV_TAG" = none ]; then
    echo "no previous tag (first deploy): cannot roll back; leaving the stack up for inspection."
    return
  fi
  use_tag "$PREV_TAG"
  dc up -d --no-build --remove-orphans
  echo "rolled back to $PREV_TAG."
  [ "$MIGRATION" = 1 ] && echo "NOTE: the DB is forward-migrated; a pre-deploy dump is in $DUMP_DIR — restore manually ONLY if the migration was destructive (see deploy/README.md, prod runbook)."
 }
 commit_tag() {
  # Record the just-deployed tag as current, preserving the prior one as previous.
  [ -f "$STATE_FILE" ] && cp "$STATE_FILE" "$PREV_STATE_FILE"
  echo "$TAG" > "$STATE_FILE"
 }
 mkdir -p "$DUMP_DIR"
 echo "=== prod deploy: tag=$TAG prev=$PREV_TAG migration=$MIGRATION ==="
 use_tag "$TAG"
 dc pull
 # First deploy: nothing to roll from; bring the whole stack up and gate on health.
 if [ -z "$(docker ps -aq -f name=scrabble-backend)" ]; then
  echo "first deploy: bringing the whole stack up"
  dc up -d --no-build --remove-orphans || { echo "compose up failed"; exit 1; }
  health_backend || { echo "backend not ready"; exit 1; }
  health_landing || { echo "landing not ready"; exit 1; }
  commit_tag
  echo "first deploy healthy ($TAG)."
  exit 0
 fi
 # Migration deploy: freeze writes and snapshot a consistent dump before migrating.
 if [ "$MIGRATION" = 1 ]; then
  echo "migration deploy: opening maintenance window (stopping the backend = the only writer)"
  dc stop backend
  dump="$DUMP_DIR/pre-$TAG-$(date +%Y%m%d-%H%M%S).sql"
  if ! docker exec scrabble-postgres pg_dump -U "$PG_USER" -d "$PG_DB" -n backend > "$dump"; then
    echo "pg_dump failed; restarting the old backend and aborting"
    dc start backend
    exit 1
  fi
  echo "consistent dump: $dump"
 fi
 # Roll one service at a time, least -> most dependent; any failure rolls everything back.
 roll postgres  health_postgres                              || { rollback; exit 1; }
 roll backend   health_backend                               || { rollback; exit 1; }
 roll gateway   health_running scrabble-gateway              || { rollback; exit 1; }
 roll landing   health_landing                               || { rollback; exit 1; }
 roll validator health_running scrabble-telegram-validator   || { rollback; exit 1; }
 roll caddy     health_running scrabble-caddy                || { rollback; exit 1; }
 # Observability + node_exporter: bring up the remainder and pick up any config changes.
 dc up -d --no-build --remove-orphans || { rollback; exit 1; }
 # Final internal sanity before committing the new tag.
 health_backend || { rollback; exit 1; }
 commit_tag
 echo "=== deploy healthy ($TAG) ==="
@@ -18,3 +18,8 @@ scrape_configs:
  - job_name: postgres_exporter
    static_configs:
      - targets: ["postgres_exporter:9187"]
  # Host-level metrics (memory/CPU/disk). Matters most on the prod main host's tight
  # 1.9 GiB budget, where total host memory is the OOM-proximity signal.
  - job_name: node
    static_configs:
      - targets: ["node_exporter:9100"]
@@ -2,10 +2,8 @@
 Source of truth for the platform architecture, transport, security model and
 cross-service contracts. User-visible behaviour per domain lives in
-[`FUNCTIONAL.md`](FUNCTIONAL.md); the staged build order lives in
+[`FUNCTIONAL.md`](FUNCTIONAL.md). This document always describes the **current**
-[`../PLAN.md`](../PLAN.md). This document always describes the **current**
+design, not the history of how it was reached.
 design, not the history of how it was reached. Sections describing
 not-yet-implemented components are marked *(planned)*.
 ## 1. Overview
@@ -128,7 +126,11 @@ dropped). Horizontal scaling is explicit future work.
  and GCG are unaffected** (they stay decoded concrete characters, §9.1).
 - **gateway ↔ backend (sync)**: plain HTTP REST/JSON. The gateway injects
  `X-User-ID` for authenticated requests; `backend` never re-derives identity
-  from the body.
+  from the body. Because every sync call targets the one backend host, the
  gateway's REST client widens its keep-alive pool well past the stdlib default
  of 2 idle connections per host; otherwise the per-request connection churn
  exhausts ephemeral ports and burns gateway CPU under load (see
  [`../loadtest/REPORT.md`](../loadtest/REPORT.md)).
 - **backend → gateway (live)**: a single gRPC server-stream carries live events
  (your-turn, opponent-moved, chat, nudge). The gateway bridges them to the
  client's in-app stream while the app is open. Out-of-app delivery uses
@@ -156,7 +158,12 @@ arrive from a platform rather than completing a mandatory registration).
  rendered in the recipient's **interface language** (`preferred_language`, en/ru), not in
  any bot-scoped language, and the friend-invite **share link** (and its caption) point at
  that one bot. First Telegram contact seeds the new account's `preferred_language` from the
-  launch `language_code` (§4); the interface language is otherwise edited in Settings.
+  launch `language_code` (§4), but the **interface language follows the device** — the system
  guess, or an explicit Settings choice saved locally — and the bot never dictates the UI.
  `preferred_language` is then **reconciled to the active interface locale on every session
  adopt** (not only on a Settings change; a no-op for guests and when already equal), so the
  server-rendered language surfaces — this push and the ad banner — always match the UI rather
  than stranding a user who never opened Settings on the creation-time seed.
 - **Variant preferences (New Game gating).** Which variants a player may be matched into is a
  per-user **profile** setting — `variant_preferences`, a set of `engine.Variant` labels
  (`scrabble_en`, `scrabble_ru`, `erudit_ru`) edited on the Settings/Profile screen. New
@@ -638,7 +645,7 @@ in either direction (the enqueue excludes the caller's `BlockedWith` set);
  **floats games with any unread entry to the top** of the your-turn and opponent-turn
  sections (the finished section keeps its activity order). On each clear the publish-to-read
  latency is recorded; the read time itself is not retained.
- **Profile**: `preferred_language` (en/ru, edited in Settings), display name, email
+- **Profile**: `preferred_language` (en/ru; tracks the interface language — §4), display name, email
  (confirm-code binding, see §4), **timezone**, the daily **away window**, the
  **variant preferences** (`variant_preferences`, the matchable-variant set that gates New
  Game — §3, defaulting to Erudit only, at least one enforced) and the
@@ -647,7 +654,11 @@ in either direction (the enqueue excludes the caller's `BlockedWith` set);
  separators (no leading/trailing/adjacent separators, ≤ 32 runes); the timezone is a
  fixed `±HH:MM` **UTC offset** (or a legacy IANA name) resolved by `account.ResolveZone`
  for the sweeper and the robot's sleep (a fixed offset trades DST for a simple
-  picker); the away window is at most **12 h** (midnight-wrap aware). Linked platform
+  picker), and is **seeded at account creation** from the client's detected offset — sent
  on the Telegram / guest / email first-contact request — so the robot's sleep and the
  away-window sweeper are anchored to the player's real zone from the first game rather
  than the `UTC` default (an undetected or malformed offset keeps the default); the away
  window is at most **12 h** (midnight-wrap aware). Linked platform
  accounts and merge are covered in §4.
 ## 9. Persistence
@@ -1029,8 +1040,9 @@ a dedicated redeem sub-limit or a longer code is the hardening step if abuse app
 Single public origin, path-routed. The Vite build has two entries: a lightweight
 **landing page** and the game **SPA**. The gateway **embeds** the SPA build
 (`go:embed`, baked in by a node stage in `gateway/Dockerfile`) and serves it at
-`/app/` (web) and `/telegram/` (the Telegram Mini App; outside Telegram that path
+`/app/` (web) and `/telegram/` (the Telegram Mini App; on that path without sign-in data
-redirects to the root — the client-side guard); a stray hit on the gateway's `/`
+— no `initData` — the client renders a compact, shareable launch-diagnostic screen instead
 of redirecting away); a stray hit on the gateway's `/`
 308-redirects to `/app/`. The **landing** ships in its own static container: the
 `landing` target of `gateway/Dockerfile` (caddy:2-alpine + the same Vite build,
 `deploy/landing/Caddyfile`) serves it at `/`, so stray public traffic is absorbed by
@@ -1052,8 +1064,10 @@ plaintext relay (`GATEWAY_BOTLINK_RELAY_ADDR`) the backend admin console calls.
 The full contour (`deploy/docker-compose.yml`) runs one `gateway`, one `backend`,
 one Postgres, the static `landing`, the Telegram `validator` and `bot` (+ the bot's VPN
-sidecar) and the **observability stack** —
+sidecar — the `bot`+`vpn` pair is gated to a `telegram-local` compose profile so the prod
-OTel Collector (OTLP/gRPC ingest → Prometheus metrics + Tempo traces) and Grafana
+main host can omit them) and the **observability stack** —
 OTel Collector (OTLP/gRPC ingest → Prometheus metrics + Tempo traces), a `node_exporter`
 for host CPU/memory (the prod main host's OOM signal), and Grafana
 with provisioned datasources and dashboards. All services export OTLP to the
 collector; the bot shares the VPN sidecar's netns, so its `AWG_CONF` must not
 carry a `DNS=` directive (that would hijack resolv.conf and stop it resolving
@@ -1077,16 +1091,39 @@ Two contours, two secret/variable prefixes (`TEST_` / `PROD_`):
  generated by `deploy/gen-certs.sh` before `compose up`; the bot keeps its VPN sidecar
  for Telegram egress and dials the gateway by its internal name, so the bot-link stays
  on the internal network.
- **Prod**: a manual SSH deploy after `development → master`. There is no
+- **Prod**: a **manual** rollout — `.gitea/workflows/prod-deploy.yaml`, `workflow_dispatch`
-  host caddy, so the contour ships its own caddy terminating TLS — set
+  only (from `master`, `confirm=deploy`), run after `development → master` is merged green.
-  `CADDY_SITE_ADDRESS` to the domain and the caddy does its own ACME. The **bot runs
+  It builds and pushes the images to the registry (`docker.iliadenisov.ru`), then deploys
-  on a separate host** with native Telegram access (no VPN), deployed by SSH alongside
+  over SSH onto **two hosts** provisioned by `deploy/ansible/` (docker, a non-sudo `deploy`
-  the main app (rolled together so the bot-link protocol versions never skew); the
+  service account holding a dedicated CI key, key-only sshd, default-deny ufw, fail2ban):
-  gateway **publishes** the bot-link port and the certificates come from `PROD_`
+  the **main host** runs the full stack (`docker-compose.yml` + `docker-compose.prod.yml`),
-  secrets — a long-lived CA with leaves rotated by a scheduled job. The bot dials the
+  the **bot host** runs only the bot (`docker-compose.bot.yml`, no VPN — native Bot API
-  gateway's public bot-link endpoint and holds no inbound port; login is unaffected if
+  egress, telemetry off). There is no host caddy, so the contour caddy terminates TLS —
-  that host or the link is down. *(This prod wiring is the deferred final stage; the
+  `CADDY_SITE_ADDRESS` is the domain and caddy does its own ACME. Caddy advertises HTTP/3 by default, but UDP/443 is not exposed (the
-  code and the unified test contour land first — see `PRERELEASE.md`.)*
+  compose maps only TCP and ufw opens 443/tcp), so the edge emits `Alt-Svc: clear` to keep
  clients on h2/h1 rather than stall on a dead QUIC path — see [`EDGE_HTTP3.md`](EDGE_HTTP3.md).
  The gateway **publishes**
  the bot-link `:9443`; the remote bot dials it over mTLS (certs from `PROD_BOTLINK_*`,
  ServerName `gateway`, so TLS validation is independent of the public dial address), holds
  no inbound port, and login is unaffected if that host or the link is down.
  `deploy/prod-deploy.sh` rolls the main stack **one service at a time in dependency order**
  (postgres → backend → gateway → landing → validator → caddy), health-checking after each;
  any failure **rolls the whole stack back to the previous image tag**. A **schema migration**
  adds a maintenance window: the backend (the sole writer) is stopped for a consistent
  `pg_dump` before the new backend migrates forward — image rollback stays DB-safe under the
  expand-contract migration rule, and the dump is kept for a manual restore. The workflow runs
  four visible jobs (build → deploy-main → deploy-bot → verify). Releases are git tags
  `vX.Y.Z`; the version is stamped into the image tag, every binary (`-ldflags` → `pkg/version`
  → the `service.version` telemetry attribute) and the SPA About screen. A separate manual
  **`prod-rollback`** workflow re-deploys any prior release tag (blank input = the previous
  deployed version, tracked on the host) over the same rolling, health-gated path — image-only,
  no DB migration. The main host is
  intentionally **launch-sized** (2 vCPU / 1.9 GiB): the prod overlay trims the baseline limits
  (`GOMAXPROCS=2`, smaller caps, 7d Prometheus retention) and a **node_exporter** feeds
  host-memory metrics to Grafana so it can be resized reactively as players arrive.
  `GATEWAY_ABUSE_BAN_ENABLED=true` in prod (the per-IP ban is meaningful only with real
  client IPs). The `vpn`+`bot` pair is gated to a `telegram-local` compose profile the test
  contour activates; the prod main host omits it.
 ## 14. CI & branches
@@ -1125,9 +1162,11 @@ Two contours, two secret/variable prefixes (`TEST_` / `PROD_`):
 Players reach the operators through a **Feedback** screen (Settings → Info, registered accounts
 only). A message (≤1024 runes) plus an optional single attachment is stored in
-`feedback_messages`; the sender's IP (gateway-forwarded, as for chat) and the submitting
+`feedback_messages`; the sender's IP (gateway-forwarded, as for chat), the submitting
-**channel** (telegram/ios/android/web, client-reported and validated) are recorded. The domain
+**channel** (telegram/ios/android/web, client-reported and validated), the **client app version**
-is `internal/feedback` (store + service), modelled on the admin chat-moderation surface.
+(`__APP_VERSION__`, the build a report was sent from), the client's **detected UTC offset** at
 submit (`browser_tz`, `±HH:MM`) and a snapshot of the sender's interface language are recorded. The domain is `internal/feedback` (store + service), modelled on the admin
 chat-moderation surface.
 **Anti-spam.** A player with an unreviewed message (`read_at IS NULL`) cannot submit another; the
 gate is server-side. Because the operator must act before the next message, this is itself the
@@ -1135,8 +1174,11 @@ rate limit — there is no separate per-user feedback limiter.
 **Operator review** happens in the server-rendered console (`/_gm/feedback`): an
 unread / read / archived queue with per-user search (the `/users` glob masks), a detail card
-(user content rendered as auto-escaped `html/template` text), and the read / reply / archive /
+(user content rendered as auto-escaped `html/template` text; it shows the channel, interface
-delete / delete-all actions — each marks the message read; merely opening the detail does not.
+language and app version, and the filed time in three zones — UTC, the browser offset detected at
 submit, and the sender's saved profile zone, each `N/A` when not known), and the read /
 reply / archive / delete / delete-all actions — each marks the message read; merely opening the
 detail does not.
 The attachment is served from `/_gm/feedback/:id/attachment` with `X-Content-Type-Options:
 nosniff`: images inline (loaded only via `<img>`, which never executes — a renamed non-image is
 inert), everything else as an `application/octet-stream` download. The UI gates the attachment by
@@ -0,0 +1,111 @@
 # Edge HTTP/3 (`Alt-Svc`) policy
 ## TL;DR
 The edge **advertises HTTP/3 but does not actually serve it** (UDP/443 is not exposed),
 so we suppress the advert with `Alt-Svc: clear`. Advertising QUIC on `:443/udp` while
 that port is unreachable makes clients — notably the Telegram Mini App webview — stall
 on a dead QUIC connection before falling back to h2, which shows up as the app "hanging
 on load".
 ## Symptom
 Opening the Mini App intermittently hangs on load: from a barely-noticeable pause to
 several seconds, sometimes a blank window that never finishes downloading `index.html`.
 Intermittent, worse after the first successful visit, reproduced on both the test
 contour and prod.
 ## Root cause
 Caddy enables HTTP/3 by default on any TLS listener and emits
 `Alt-Svc: h3=":443"; ma=2592000` — telling every client "reach me over QUIC/UDP 443"
 and to cache that for 30 days. But UDP/443 is **never reachable end to end**:
 - **Test contour**: the host caddy publishes only `:443/tcp` (`docker port caddy` shows
  no `udp`); QUIC packets from the internet are dropped.
 - **Prod**: `deploy/docker-compose.prod.yml` maps `"443:443"` (Docker = **TCP only**)
  and `deploy/ansible/roles/main/tasks/main.yml` opens 443 `proto: tcp`. UDP/443 is
  dropped at both the publish and the firewall.
 Caddy *does* bind `udp/443` inside the container and h3 works container-to-container
 (verified `http=3 code=200`), so the listener is healthy — it is simply not exposed.
 A client that cached the advert tries QUIC first on later opens, gets no response, and
 waits for the QUIC attempt to time out before falling back to TCP/h2. That wait is the
 stall. The very first visit (no cached `Alt-Svc`) uses h2 and is fast.
 The h2/TCP serving path itself is healthy: 30 fresh-TLS requests through the full path
 (host caddy -> contour caddy -> gateway) measured TTFB ~9.5 ms, total ~9.8 ms, no tail;
 `index.html` is ~1 KB.
 ## Fix in place (option A — suppress the advert)
 Emit `Alt-Svc: clear`, which actively drops any cached alternative (better than merely
 deleting the header, which leaves the sticky 30-day cache in place):
 - **Prod / repo**: `deploy/caddy/Caddyfile` — a site-level `header Alt-Svc clear` (this
  caddy terminates TLS in prod).
 - **Test contour**: the host caddy terminates TLS, so the fix lives there (homelab
  config, outside this repo): `header Alt-Svc clear` on the `scrabble.*` site. The
  in-compose caddy serves plain `:80` in test and never advertises h3, so the repo
  directive is a harmless no-op there (the host caddy re-stamps the header).
 `header Alt-Svc clear` overrides Caddy's auto-advert (verified) and is site-scoped.
 ### Verify
 The runner/prod host shell cannot reach the Docker bridge IPs directly, so probe from a
 container on the relevant network, using `--resolve` to hit the TLS-terminating caddy by
 its bridge IP (this also bypasses the public-IP NAT hairpin):
 ```sh
 # <edge-ip> = the TLS-terminating caddy's IP on its network (docker inspect ... )
 docker run --rm --network edge curlimages/curl:latest -sS -D - -o /dev/null \
  --resolve <host>:443:<edge-ip> https://<host>/telegram/ | grep -iE '^HTTP|^alt-svc'
 # expect: HTTP/2 200, and NO `alt-svc: h3=...` (the header is absent or `alt-svc: clear`)
 ```
 ## If it recurs — alternatives to try
 So we do not re-derive the diagnosis from scratch:
 1. **Re-confirm the advert is actually suppressed** with the verify command above. A
   redeploy or a Caddy upgrade could regress it, or a client may still hold a cached
   `h3` entry that has not yet been replaced by a `clear` (it needs one successful h2
   response to receive the `clear`).
 2. **Option B — serve HTTP/3 for real** instead of suppressing it. Worth it only if we
   actually want QUIC (the benefit is marginal for a ~1 KB shell plus hash-immutable
   cached assets, and it adds UDP/QUIC attack surface):
   - Publish UDP: add `"443:443/udp"` next to the TCP map in
     `deploy/docker-compose.prod.yml` (and publish udp/443 on the test host caddy too).
   - Open the firewall: add a `443 proto: udp` rule in
     `deploy/ansible/roles/main/tasks/main.yml`.
   - Drop the `header Alt-Svc clear` so Caddy advertises h3 again.
   - Verify with an h3 client from inside the network:
     `docker run --rm --network edge ymuski/curl-http3 curl --http3-only ...` should
     return `http=3 code=200`.
 3. **Look past the edge** if the advert is suppressed and stalls persist. The h2 path is
   fast server-side, so a remaining stall is most likely the client network / RTT / the
   provider, not our stack. Re-run the timing loop (below) to confirm the server is
   still <~10 ms TTFB before chasing the client side.
 ## How this was diagnosed (method, to repeat)
 - The runner/prod host shell cannot reach the Docker bridge subnets, so all probing runs
  from a throwaway container on the target network (`docker run --network <net>
  curlimages/curl`), using `--resolve <host>:443:<edge-ip>` to bypass the public-IP NAT
  hairpin and exercise the real TLS path.
 - Compare a fresh-connection timing loop (worst case, full TLS each time) against a
  keepalive batch to separate handshake cost from serving cost:
  ```sh
  docker run --rm --network edge curlimages/curl:latest sh -c '
    for i in $(seq 1 30); do
      curl -sS -o /dev/null --resolve <host>:443:<edge-ip> \
        -w "http=%{http_version} code=%{http_code} tls=%{time_appconnect} ttfb=%{time_starttransfer} total=%{time_total}\n" \
        https://<host>/telegram/
    done'
  ```
 - `docker port <caddy>` shows whether `udp/443` is actually published; the response
  `Alt-Svc` header shows what the edge advertises. The two disagreeing is the bug.
@@ -31,7 +31,10 @@ ephemeral guest. The gateway validates the credential once and mints a thin
 session token; the backend resolves it to an internal `user_id`. A **Telegram Mini
 App** launch authenticates from the platform's signed `initData`, themes the UI to
 the Telegram colours, and — on first contact — seeds the new account's interface
-language from the Telegram client. Telegram runs a **single bot**: every player uses
+language from the Telegram client. If a launch cannot reach the backend (for example during a
 deployment), the Mini App retries quietly and then shows a small "couldn't load" screen with a
 **Retry** button, rather than dropping to the web sign-in, which has no place inside Telegram.
 Telegram runs a **single bot**: every player uses
 the same bot, and all of its chat and out-of-app notifications are written in the
 player's own **interface language** (en/ru). A separate optional **promo bot** can run alongside the
 main one — its only job is to answer `/start` with a short message and a button that opens the
@@ -56,6 +59,10 @@ reconnect), and pending reads resume on their own — the interface stays usable
 flashing a red banner each time.
 ### Accounts, linking & merge
 _Sign-in is currently provider-only, so the in-profile linking UI is temporarily hidden; it
 returns once the anonymous `/app/` guest (whose upgrade path this is) ships. The flow below
 describes it for when it does._
 First platform contact auto-provisions a durable account. From the profile a player
 links an email (via a confirm code) or their Telegram (via the web sign-in); a guest
 who links their first identity becomes a durable account. The "already taken" status
@@ -206,6 +213,9 @@ block **overrides but does not delete** an existing friendship (so you may block
 they keep seeing you as one); active games are never interrupted — you can finish them, with
 the blocked opponent's chat composer hidden (only the log remains). Blocking from a game card
 mirrors the block in **Settings → Friends**; **unblock** and **unfriend** live there only.
 On Settings → Friends each friend is a one-line row whose right-hand kebab (⋮) slides open
 **block 🚫** and **remove ✖️** icon actions, and each action is gated by a confirmation
 that names the friend (*Block this player?* / *Remove from friends?*).
 Blocking an **auto-match opponent who is secretly a robot** behaves the same in that game
 (struck name, hidden composer) and lists the blocked opponent under the name you saw, but is
 recorded only against that game — the disguise holds, the shared robot is never globally
@@ -234,7 +244,8 @@ also clears the moment its recipient **takes their move**.
 Edit the display name (letters joined by a single space / "." / "_" separator, with an
 optional trailing "." or a trailing run of up to five digits, up to 32 characters and at most
 5 special characters — the "." / "_" punctuation, spaces and digits aside), the timezone
-(chosen as a UTC offset), the
+(chosen as a UTC offset, and pre-filled from your device's detected offset when the account
 is first created — so robot games are timed correctly before you ever open this form), the
 daily away window (on a 10-minute grid, at most 12 hours, wrapping midnight) and the
 block toggles. The profile form is edited inline (no separate edit mode). Linking
 an email or Telegram and merging accounts are covered under "Accounts, linking &
@@ -339,7 +350,9 @@ over-grant cannot be reversed there.
 The console works a **feedback** queue too (`/_gm/feedback`): the messages players sent, filtered
 **unread / read / archived** with per-user search, each shown with its sender, source, channel
 (with the bot language — en/ru — for a Telegram message), the sender's interface
-language, IP and any attachment. The operator can mark a message read, **reply** to the player (delivered
+language, the **app version** it was sent from, IP, the filed time (in three zones — UTC, the
 browser zone detected at submit, and the sender's saved zone, each shown `N/A` when not known) and
 any attachment. The operator can mark a message read, **reply** to the player (delivered
 in-app), archive it, delete it, or delete every message from that player — and, alongside a delete,
 **bar the player from feedback** (a `feedback_banned` role, distinct from a full account block: it
 stops only feedback submission). Roles are listed and granted/revoked on the user card. Opening a
@@ -32,7 +32,10 @@ top-1 подсказку, безлимитную проверку слова с
 session-токен; backend сопоставляет его с внутренним `user_id`. Запуск **Telegram
 Mini App** авторизует по подписанным `initData` платформы, перекрашивает интерфейс
 в цвета Telegram и — при первом контакте — задаёт язык интерфейса нового аккаунта по
-языку Telegram-клиента. Telegram держит **единого бота**: все игроки пользуются одним
+языку Telegram-клиента. Если запуск не может достучаться до бэкенда (например, во время
 деплоя), Mini App тихо повторяет попытки, а затем показывает небольшой экран «не удалось
 загрузить» с кнопкой **Повторить**, вместо того чтобы сбрасывать на веб-вход, которому внутри
 Telegram не место. Telegram держит **единого бота**: все игроки пользуются одним
 и тем же ботом, а весь его чат и внеприложенческие уведомления пишутся на **языке
 интерфейса** самого игрока (en/ru). Рядом с основным может работать отдельный опциональный
 **промо-бот** — его единственная задача отвечать на `/start` коротким сообщением и кнопкой,
@@ -57,6 +60,10 @@ Mini App** авторизует по подписанным `initData` плат
 рабочим вместо красного баннера каждый раз.
 ### Аккаунты, привязка и слияние
 _Вход сейчас только через провайдера, поэтому UI привязки в профиле временно скрыт; он
 вернётся, когда появится анонимный `/app/`-гость (для апгрейда которого он и нужен). Описание
 ниже — на этот случай._
 Первый контакт с платформы заводит постоянный аккаунт. Из профиля игрок
 привязывает email (по confirm-коду) или свой Telegram (через веб-вход); гость,
 привязавший первую личность, становится постоянным аккаунтом. Факт «личность уже
@@ -211,6 +218,9 @@ Mini App** авторизует по подписанным `initData` плат
 заблокированного соперника «подвал» чата скрыт (остаётся только лог). Блокировка с карточки в
 партии повторяет блокировку в **Настройках → Друзья**; **разблокировка** и **удаление из друзей**
 есть только там.
 В **Настройках → Друзья** каждый друг — однострочник, чей правый кебаб (⋮) выдвигает
 иконки-действия **заблокировать 🚫** и **удалить ✖️**, и каждое действие подтверждается
 диалогом с именем друга (*Заблокировать?* / *Удалить из друзей?*).
 Блокировка **авто-матч соперника, который втайне робот**, в этой партии ведёт себя так же
 (зачёркнутое имя, скрытый «подвал») и в списке заблокированных показывается под тем именем,
 которое ты видел, но записывается только для этой партии — маскировка сохраняется, общий
@@ -241,8 +251,9 @@ Mini App** авторизует по подписанным `initData` плат
 Редактирование отображаемого имени (буквы, разделённые одиночным пробелом / «.» /
 «_», с необязательной завершающей «.» или хвостом до пяти цифр, до 32 символов и не
 более 5 спецсимволов — пунктуации «.» / «_», пробелы и цифры не в счёт), таймзоны (выбор смещения от
-UTC), суточного окна отсутствия (away; сетка по 10 минут, не более 12 часов, с
+UTC; при создании аккаунта она подставляется из определённого смещения устройства — чтобы
-переходом через полночь) и переключателей блокировок. Форма профиля редактируется
+игры с роботом таймились правильно ещё до открытия этой формы), суточного окна отсутствия
 (away; сетка по 10 минут, не более 12 часов, с переходом через полночь) и переключателей блокировок. Форма профиля редактируется
 сразу (без отдельного режима редактирования). Привязка email и Telegram, а также
 слияние аккаунтов вынесены в раздел «Аккаунты, привязка и слияние».
@@ -349,7 +360,8 @@ high-rate флага. С карточки пользователя операт
 Консоль ведёт и очередь **обратной связи** (`/_gm/feedback`): присланные игроками сообщения с фильтром
 **непрочитанные / прочитанные / архив** и поиском по пользователю, каждое — с отправителем, источником,
 каналом (и языком бота — en/ru — для сообщения из Telegram), языком интерфейса отправителя,
-IP и вложением. Оператор может пометить сообщение прочитанным, **ответить** игроку (доставка
+**версией приложения**, с которой отправлено, IP, временем подачи (в трёх зонах — UTC, зоне браузера
 на момент отправки и сохранённой зоне отправителя, каждая — «N/A», если неизвестна) и вложением. Оператор может пометить сообщение прочитанным, **ответить** игроку (доставка
 в приложение), отправить в архив, удалить или удалить все сообщения этого игрока — и вместе с удалением
 **запретить игроку обратную связь** (роль `feedback_banned`, отличная от полной блокировки аккаунта:
 останавливает только отправку обратной связи). Роли перечислены и выдаются/снимаются на карточке
@@ -121,7 +121,7 @@ tests or touching CI.
  Postgres-backed `inttest` drives the **guest reaper** end to end (an abandoned guest is
  reaped; a too-young guest, a seated guest and a durable account are kept).
 - **Load test & resource baseline** — a reusable `loadtest/` module
-  (`scrabble/loadtest`) is the pre-release stress harness. It **seeds** a large account
+  (`scrabble/loadtest`) is the stress/load harness. It **seeds** a large account
  population with pre-created sessions directly in Postgres (token hashes matching
  `backend/internal/session`), **drives** virtual players through the edge protocol —
  real games assembled via invitations, **mid-ranked** legal moves generated locally by
@@ -133,9 +133,9 @@ tests or touching CI.
  engine tests do). It is **not** part of the per-PR suite's behavioural assertions: it
  runs ad hoc as a one-shot container against the contour, producing a trip report (bugs
  + a per-container resource profile) read off the **otelcol `docker_stats` +
-  postgres_exporter** Grafana dashboard on the contour. Two passes are recorded — the
+  postgres_exporter** Grafana dashboard on the contour. The findings — including the
-  early [`REPORT-R2.md`](../loadtest/REPORT-R2.md) and the final, tuned
+  `game.evaluate` hot-path model and the gateway→backend connection-pool fix — are written
-  [`REPORT-R7.md`](../loadtest/REPORT-R7.md). See [`../loadtest/README.md`](../loadtest/README.md).
+  up in [`REPORT.md`](../loadtest/REPORT.md). See [`../loadtest/README.md`](../loadtest/README.md).
 - **User feedback** — `internal/feedback` unit tests cover the attachment allow-list /
  content-type and the channel normaliser; the UI covers `detectChannel`, the attachment gate and
  the feedback wire round-trip (`channel` / `feedback` / `codec` tests) plus a Playwright e2e
@@ -154,13 +154,12 @@ tests or touching CI.
 - No network or real platform calls in unit tests; validate platform
  credentials behind an interface seam and test with fixtures.
-## Per-stage CI gate
+## CI gate
-Every completed stage is exercised on `gitea.iliadenisov.ru` before it is marked
+Every change is exercised on `gitea.iliadenisov.ru` before it is merged:
 done in [`../PLAN.md`](../PLAN.md):
-1. Commit the stage on its `feature/*` branch.
+1. Commit the change on its `feature/*` branch.
 2. Push to `origin`.
 3. Watch the run to completion — never hand-roll a poll loop:
   `python3 ~/.claude/bin/gitea-ci-watch.py` (launch in the background).
-4. Only after every workflow that fired is green may the stage be marked done.
+4. Only after every workflow that fired is green may the change be merged.
@@ -8,7 +8,13 @@ emoji glyphs. Tokens are CSS custom properties (`ui/src/app.css`), light/dark vi
 `prefers-color-scheme` or an explicit Settings choice, and **Telegram-themed**:
 on a Telegram Mini App launch — the app is served under `/telegram/` and detects the
 launch by `Telegram.WebApp.initData` — the SDK's `themeParams` override the tokens at
-runtime; opened outside Telegram, the `/telegram/` path redirects to the site root.
+runtime; on that path without sign-in data (no `initData` — outside Telegram, or a Mini App
 launch that delivered none, as seen on some Android clients) the app renders a compact,
 shareable launch-diagnostic screen (`screens/TelegramLaunchError.svelte`) rather than
 redirecting to the site root. `telegram-web-app.js` is loaded **dynamically with a timeout**,
 only on a Telegram entry — not a render-blocking `<script>` in the shared `index.html` shell —
 so a network that blocks `telegram.org` cannot hang the page; `/app/` (web) and the native build
 never load it.
 ## Layout shell (`components/Screen.svelte`)
@@ -109,7 +115,10 @@ dismisses as soon as the lobby is ready. The pure layout and timing live in `lib
 ## Tiles & board
 - **Tiles**: the letter sits in the **top-left** corner (offset a touch more than the
-  value), the point value bottom-right; blanks show no value.
+  value), the point value bottom-right; blanks show no value. In **Erudit** the blank is the
  "звёздочка" (star) chip: an unplaced blank shows the star (`✻`, U+273B) centred on the rack
  tile, and a placed blank carries it in the value corner; the Scrabble variants leave the
  blank unmarked (`usesStarBlank` in `lib/variants.ts`).
 - **Board zoom** (`Board.svelte`): a two-state zoom (full 15×15 ↔ ~9 cells) by **growing
  the board's width** inside a fixed-size viewport (a real layout change → native scroll
  that works consistently across browsers; no `transform`, which broke scrolling
@@ -70,7 +70,9 @@ RUN rm gateway/internal/webui/dist/landing.html
 # Reduce the workspace to what the gateway needs: gateway + pkg (loadtest is not in
 # this context; its scrabble/gateway replace targets ./gateway, which is present here).
 RUN go work edit -dropuse=./backend -dropuse=./platform/telegram -dropuse=./loadtest
-RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/gateway ./gateway/cmd/gateway
+# VERSION (the deploy passes the git tag) is stamped into the binary via the linker.
 ARG VERSION=dev
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-X scrabble/pkg/version.Version=${VERSION}" -o /out/gateway ./gateway/cmd/gateway
 # --- runtime -----------------------------------------------------------------
 FROM gcr.io/distroless/static-debian12:nonroot AS gateway
@@ -184,8 +184,10 @@ type ChatResp struct {
 }
 // TelegramAuth provisions/finds the Telegram account and mints a session, seeding a
-// brand-new account's display name and language from the validated launch fields.
+// brand-new account's display name and language from the validated launch fields and
-func (c *Client) TelegramAuth(ctx context.Context, externalID, languageCode, username, firstName string) (SessionResp, error) {
+// its time zone from browserTz (the client's detected "±HH:MM" UTC offset; first
 // contact only).
 func (c *Client) TelegramAuth(ctx context.Context, externalID, languageCode, username, firstName, browserTz string) (SessionResp, error) {
 	var out SessionResp
 	err := c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/telegram", "", "",
 		map[string]string{
@@ -193,6 +195,7 @@ func (c *Client) TelegramAuth(ctx context.Context, externalID, languageCode, use
 			"language_code": languageCode,
 			"username":      username,
 			"first_name":    firstName,
 			"browser_tz":    browserTz,
 		}, &out)
 	return out, err
 }
@@ -243,17 +246,21 @@ func (c *Client) ChatAccessByUser(ctx context.Context, userID string) (ChatAcces
 	return out, err
 }
-// GuestAuth provisions a guest account and mints a session.
+// GuestAuth provisions a guest account and mints a session, seeding its time zone
-func (c *Client) GuestAuth(ctx context.Context) (SessionResp, error) {
+// from browserTz (the client's detected "±HH:MM" UTC offset).
 func (c *Client) GuestAuth(ctx context.Context, browserTz string) (SessionResp, error) {
 	var out SessionResp
-	err := c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/guest", "", "", struct{}{}, &out)
+	err := c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/guest", "", "",
 		map[string]string{"browser_tz": browserTz}, &out)
 	return out, err
 }
-// EmailRequest asks the backend to mail a login code.
+// EmailRequest asks the backend to mail a login code, provisioning the account on
-func (c *Client) EmailRequest(ctx context.Context, email string) error {
+// first contact; browserTz (the client's detected "±HH:MM" UTC offset) seeds the new
 // account's time zone, since the email account is created here, not at login.
 func (c *Client) EmailRequest(ctx context.Context, email, browserTz string) error {
 	return c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/email/request", "", "",
-		map[string]string{"email": email}, nil)
+		map[string]string{"email": email, "browser_tz": browserTz}, nil)
 }
 // EmailLogin verifies a login code and mints a session.
@@ -27,12 +27,14 @@ type FeedbackUnreadResp struct {
 // FeedbackSubmit posts a feedback message. The attachment bytes are base64-encoded
 // into the JSON body for the internal hop; clientIP rides X-Forwarded-For.
-func (c *Client) FeedbackSubmit(ctx context.Context, userID, body string, attachment []byte, attachmentName, channel, clientIP string) error {
+func (c *Client) FeedbackSubmit(ctx context.Context, userID, body string, attachment []byte, attachmentName, channel, version, browserTz, clientIP string) error {
 	payload := map[string]string{
 		"body":            body,
 		"attachment":      "",
 		"attachment_name": attachmentName,
 		"channel":         channel,
 		"version":         version,
 		"browser_tz":      browserTz,
 	}
 	if len(attachment) > 0 {
 		payload["attachment"] = base64.StdEncoding.EncodeToString(attachment)
@@ -22,6 +22,19 @@ import (
 	pushv1 "scrabble/pkg/proto/push/v1"
 )
 // backendMaxIdleConns sizes the REST keep-alive pool to the single backend host. The
 // default transport caps idle connections per host at 2 (http.DefaultMaxIdleConnsPerHost),
 // which — since every synchronous client call proxies to that one host — forces a fresh
 // TCP connection (and a lingering TIME_WAIT socket) for almost every request under load.
 // That connection churn burns gateway CPU and exhausts ephemeral ports at scale, all
 // while the backend itself sits near-idle. Pooling the connections lets them be reused.
 //
 // The stress harness measured the effect at 500 concurrent players: the churn collapsed
 // from ~26 500 TIME_WAIT sockets to ~0 and peak gateway CPU from ~1.75 to ~0.26 cores,
 // with the pool settling at ~225 live connections. 512 keeps ~2x headroom over that
 // observed peak so a burst never re-caps the pool. See loadtest/REPORT.md.
 const backendMaxIdleConns = 512
 // Client calls the backend's REST API and opens its push gRPC stream.
 type Client struct {
 	baseURL string
@@ -41,9 +54,14 @@ func New(httpURL, grpcAddr string, timeout time.Duration) (*Client, error) {
 	if err != nil {
 		return nil, fmt.Errorf("backendclient: dial push %s: %w", grpcAddr, err)
 	}
 	// Clone the default transport (keeping its proxy, dialer and timeouts) and widen the
 	// idle pool so REST calls to the backend reuse connections instead of churning them.
 	transport := http.DefaultTransport.(*http.Transport).Clone()
 	transport.MaxIdleConns = backendMaxIdleConns
 	transport.MaxIdleConnsPerHost = backendMaxIdleConns
 	return &Client{
 		baseURL: strings.TrimRight(httpURL, "/"),
-		http:    &http.Client{Timeout: timeout},
+		http:    &http.Client{Timeout: timeout, Transport: transport},
 		conn:    conn,
 		push:    pushv1.NewPushClient(conn),
 	}, nil
@@ -0,0 +1,31 @@
 package backendclient
 import (
 	"net/http"
 	"testing"
 	"time"
 )
 // TestBackendTransportPoolsConnections guards the fix for the gateway->backend
 // connection churn. Every synchronous client call proxies to the single backend host,
 // so the REST client must widen the idle-connection pool past the default per-host cap
 // of 2 (http.DefaultMaxIdleConnsPerHost) — otherwise almost every request under load
 // opens a fresh TCP connection that then lingers in TIME_WAIT, burning gateway CPU and
 // exhausting ephemeral ports. Reverting to the default transport (`&http.Client{...}`
 // with no Transport) would silently reintroduce that, so assert the pool is widened.
 func TestBackendTransportPoolsConnections(t *testing.T) {
 	c, err := New("http://backend.invalid", "localhost:9090", time.Second)
 	if err != nil {
 		t.Fatalf("New: %v", err)
 	}
 	defer func() { _ = c.Close() }()
 	tr, ok := c.http.Transport.(*http.Transport)
 	if !ok {
 		t.Fatalf("REST transport = %T, want a *http.Transport with a widened idle pool", c.http.Transport)
 	}
 	if tr.MaxIdleConnsPerHost <= http.DefaultMaxIdleConnsPerHost {
 		t.Errorf("MaxIdleConnsPerHost = %d, want > default %d (else per-call connection churn)",
 			tr.MaxIdleConnsPerHost, http.DefaultMaxIdleConnsPerHost)
 	}
 }
@@ -158,7 +158,7 @@ func authTelegramHandler(backend *backendclient.Client, tg TelegramValidator) Ha
 		if err != nil {
 			return nil, err
 		}
-		sess, err := backend.TelegramAuth(ctx, user.ExternalID, user.LanguageCode, user.Username, user.FirstName)
+		sess, err := backend.TelegramAuth(ctx, user.ExternalID, user.LanguageCode, user.Username, user.FirstName, string(in.BrowserTz()))
 		if err != nil {
 			return nil, err
 		}
@@ -167,8 +167,15 @@ func authTelegramHandler(backend *backendclient.Client, tg TelegramValidator) Ha
 }
 func authGuestHandler(backend *backendclient.Client) Handler {
-	return func(ctx context.Context, _ Request) ([]byte, error) {
+	return func(ctx context.Context, req Request) ([]byte, error) {
-		sess, err := backend.GuestAuth(ctx)
+		// The guest bootstrap historically carried no payload; the detected zone is
 		// optional, so an absent or empty one simply yields no time-zone seed (rather
 		// than panicking in GetRootAs* on a zero-length buffer).
 		var browserTz string
 		if len(req.Payload) > 0 {
 			browserTz = string(fb.GetRootAsGuestLoginRequest(req.Payload, 0).BrowserTz())
 		}
 		sess, err := backend.GuestAuth(ctx, browserTz)
 		if err != nil {
 			return nil, err
 		}
@@ -179,7 +186,7 @@ func authGuestHandler(backend *backendclient.Client) Handler {
 func authEmailRequestHandler(backend *backendclient.Client) Handler {
 	return func(ctx context.Context, req Request) ([]byte, error) {
 		in := fb.GetRootAsEmailRequestRequest(req.Payload, 0)
-		if err := backend.EmailRequest(ctx, string(in.Email())); err != nil {
+		if err := backend.EmailRequest(ctx, string(in.Email()), string(in.BrowserTz())); err != nil {
 			return nil, err
 		}
 		return encodeAck(true), nil
@@ -499,7 +506,7 @@ func hideGameHandler(backend *backendclient.Client) Handler {
 func feedbackSubmitHandler(backend *backendclient.Client) Handler {
 	return func(ctx context.Context, req Request) ([]byte, error) {
 		in := fb.GetRootAsFeedbackSubmitRequest(req.Payload, 0)
-		if err := backend.FeedbackSubmit(ctx, req.UserID, string(in.Body()), in.AttachmentBytes(), string(in.AttachmentName()), string(in.Channel()), req.ClientIP); err != nil {
+		if err := backend.FeedbackSubmit(ctx, req.UserID, string(in.Body()), in.AttachmentBytes(), string(in.AttachmentName()), string(in.Channel()), string(in.Version()), string(in.BrowserTz()), req.ClientIP); err != nil {
 			return nil, err
 		}
 		return encodeAck(true), nil
@@ -12,7 +12,8 @@
 # --- dictionary artifact -----------------------------------------------------
 FROM alpine:3.20 AS dawg
-ARG DICT_VERSION=v1.2.1
+# Required, no default: the build caller supplies the scrabble-dictionary release tag.
 ARG DICT_VERSION
 RUN apk add --no-cache curl tar
 RUN mkdir -p /dawg \
 && curl -fsSL -o /tmp/dawg.tar.gz \
@@ -1,6 +1,6 @@
 # loadtest — stress harness
-Reusable load harness for the pre-release stress pass. It
+Reusable load/stress harness. It
 seeds a large account population with pre-created sessions, drives virtual players
 through the **gateway edge protocol** in realistic games, hammers the rate limiter,
 and prints a trip-report summary. It stays in the repo for repeats.
@@ -15,10 +15,12 @@ and prints a trip-report summary. It stays in the repo for repeats.
 2. **Drive** (edge protocol over h2c): assembles real 2–4 player games via the
   invitation flow (`invitation.create` → `invitation.accept`, no robots), then runs
   each player's turn loop — poll `game.state`, replay `game.history`, generate a legal
-   **mid-ranked** move with the embedded `scrabble-solver`, and `game.submit_play`
+   **mid-ranked** move with the embedded `scrabble-solver`, **compose it tile by tile with
-   (or pass/exchange). A fraction of turns exercise nudge / chat / check-word / draft /
+   the debounced `game.evaluate` preview a real client fires** (the hottest gameplay call),
-   profile-update / stats. Each player also holds a live `Subscribe` stream. The
+   persist a `draft.save`, and `game.submit_play` (or pass/exchange). A fraction of turns
-   moderate ramp is **50 → 200 → 500** concurrent players, ~12 min per step.
+   exercise nudge / chat / check-word / draft / profile-update / stats. Each player also
   holds a live `Subscribe` stream. The moderate ramp is **50 → 200 → 500** concurrent
   players, ~12 min per step. `--eval=false` drops the evaluate model for an A/B baseline.
 3. **Hammer**: drives `games.list` from one account far above the per-user rate limit
   to verify the limiter holds (`rate_limited` results) and measure its cost.
 4. **Report**: per-operation latency percentiles, throughput, result-code breakdown,
@@ -33,8 +35,8 @@ The harness reaches Postgres and the gateway directly, so run it as a one-shot
 container on the contour's docker network (this bypasses the host→gateway hairpin):
 ```sh
-# from the repo root
+# from the repo root (DICT_VERSION has no default — pass the scrabble-dictionary release tag)
-docker build -f loadtest/Dockerfile -t scrabble-loadtest .
+docker build --build-arg DICT_VERSION=v1.3.0 -f loadtest/Dockerfile -t scrabble-loadtest .
 docker run --rm --cpus=3 --name scrabble-loadtest --network scrabble-internal \
  -e POSTGRES_PASSWORD="$TEST_POSTGRES_PASSWORD" \
@@ -72,6 +74,8 @@ Key `run` flags (env in parentheses):
 | `--games-per-player` | `0` (random 3–5) | target concurrent games per player |
 | `--tick` | `800ms` | per-player op cadence (keeps a player under the per-user limit) |
 | `--secondary-prob` | `0.08` | chance per tick of a non-move op |
 | `--eval` | `true` | model the per-tile `game.evaluate` preview (the gameplay hot path); `false` reproduces the pre-evaluate harness |
 | `--eval-recon` | `1` | extra full-composition evaluate re-previews per play (reconsideration), beyond one per placed tile |
 | `--hammer-workers` / `--hammer-dur` | `20` / `15s` | gateway-hammer (0 workers disables) |
 | `--reset` / `--cleanup` | `false` | delete harness rows before / after the run |
@@ -93,16 +97,16 @@ runs unconditionally. Use an **absolute** path (here via `$PWD`): `go test ./loa
 runs each package from its own directory, so a relative `BACKEND_DICT_DIR` would not
 resolve.
-## Trip reports
+## Trip report
-The two stress passes are written up in the repo: the early pass in
+The stress findings — the final run, the `game.evaluate` hot-path model, the
-[`REPORT-R2.md`](REPORT-R2.md) and the final, tuned pass in
+gateway→backend connection-pool fix, and the revised sizing — are written up in
-[`REPORT-R7.md`](REPORT-R7.md).
+[`REPORT.md`](REPORT.md).
 ## Caveat
 The harness shares the host CPU with the contour, so its own `scrabble-loadtest`
 container series is read alongside the system under test; capping it with `--cpus`
-keeps the contour's quota. Per-player transports (R7) removed the shared-transport
+keeps the contour's quota. Per-player transports removed the shared-transport
-artifact that inflated R2's `transport_error`, so the figures reflect the system. A
+artifact that previously inflated `transport_error`, so the figures reflect the system. A
 fully isolated ceiling on separate hardware remains future work.
@@ -1,162 +0,0 @@
 # R2 — early stress-run trip report
 The early stress pass for `PRERELEASE.md` R2. It exercises the system through the
 **edge protocol** with the `scrabble/loadtest` harness, to surface logic/concurrency
 bugs and capture a resource baseline that feeds R3 (edge hardening), R6 (refactor) and
 R7 (final tuning). Pass bar: **diagnostic** — the run "passes" by completing without the
 harness crashing; findings are recorded below, not gated.
 ## Method
 - **Driver:** the `scrabble/loadtest` module, run as a one-shot container on the
  `scrabble-internal` docker network (reaching `postgres:5432` and `gateway:8081`
  directly, bypassing the host→gateway hairpin).
 - **Seed:** 10 000 durable + 1 000 guest accounts with pre-created sessions written
  directly to Postgres (token hash matches `backend/internal/session`), so the driver
  authenticates without the per-IP-limited auth ops.
 - **Games:** assembled through the real **invitation** flow (`invitation.create` →
  `invitation.accept`), 2–4 players each, no robots; variants spread over
  scrabble_en / scrabble_ru / erudit_ru.
 - **Play:** each virtual player holds a live `Subscribe` stream and, per tick, polls
  `game.state`, replays `game.history` and submits a **mid-ranked** legal move generated
  locally by the embedded `scrabble-solver` (the edge carries no board), or
  passes/exchanges; a fraction exercise nudge / chat / check-word / draft / profile /
  stats. A separate **gateway-hammer** floods `games.list` from one account.
 - **Scale:** moderate ramp **50 → 200 → 500** concurrent players, 10 min/step (the
  agreed moderate profile; harness and contour share this host's CPU).
 - **Resource capture:** `docker stats` (docker API) sampled every 28 s for per-container
  CPU/memory; Prometheus for edge latency/throughput, `postgres_exporter` internals and
  per-service Go runtime metrics.
 ## Run configuration
 ```
 loadtest run --durable 10000 --guest 1000 --steps 50,200,500 --step-dur 10m \
             --tick 800ms --hammer-workers 20 --hammer-dur 15s --cleanup
 ```
 Date: 2026-06-09. Contour: the R1-baseline schema, freshly deployed with the R2
 exporters. Seeded population removed by `--cleanup` afterwards.
 ## Findings
 ### Validated (fixed within R2)
 - **Harness draft payload.** `draft.save` first returned `bad_request`: the backend
  draft DTO's `rack_order` is a string (the harness sent `[]`). Fixed → `ok`.
 - **Harness profile marker.** `profile.update` first returned `invalid_profile`: the
  editable-display-name validator (`backend/internal/account/profile.go`) forbids digits
  and colons, but the seed marker was `lt:…`. Switched the marker to a distinctive
  letters-only string → `ok`. Cleanup still matches it.
 ### By-design behaviour (correctly exercised, not bugs)
 - **`chat_not_your_turn`** — chat is gated to the sender's turn
  (`backend/internal/social/chat.go`); off-turn posts are correctly rejected.
 - **`nudge_own_turn`** — you nudge the player whose turn it is, so a nudge on your own
  turn is correctly rejected. The harness nudges/chats at random ticks, so a share of
  these codes is expected.
 ### Observability gap (key R7 input)
 - **cAdvisor yields only the root cgroup on the contour host.** Its docker factory
  registers, but per-container init fails — `failed to identify the read-write layer ID
  … /rootfs/var/lib/docker/image/overlayfs/…: no such file or directory` — because this
  host's `/var/lib/docker` is a **separate XFS mount** not visible under cAdvisor's
  `/rootfs` bind (the existing galaxy deployment on the same host has the same
  limitation). So the **Scrabble — Resources** dashboard's per-container panels are empty
  here, and per-container CPU/RSS for this run was captured via `docker stats` instead.
  Postgres internals (`postgres_exporter`) and per-service Go runtime metrics
  (`go_*` by `service_name`) work. **Recommendation for R7:** adopt the otelcol
  **`docker_stats`** receiver (already the contrib image) — it reads per-container stats
  via the docker API with no cgroup dependency — and/or run the final pass on hardware
  where cAdvisor resolves containers. (Decision to confirm with the owner.)
 ### Run results
 The ramp ran clean to 500 players with no harness crash, no deadlock and
 `stream errors: 0`; cleanup removed all 11 000 seeded accounts (and their ~941 games).
 - **Ramp:** step 1 = 50 players / 90 games, step 2 = 200 / 282, step 3 = 500 / 569.
 - **Volume (30 min):** 1.20 M total edge calls, 659 req/s average. Real gameplay at
  scale: **48 870 committed plays**, 52 772 `your_turn` + 159 631 `opponent_moved`
  events, **2 798 games finished**.
 - **Latency under load (peak, step 3):** `game.state` p50 ≈ 100 ms, p90/p99 in the
  200–500 ms buckets, max 849 ms; `game.submit_play` similar (p99 ≤ 500 ms, max 490 ms).
  Lobby ops stayed fast (invitation/games.list p99 ≤ 10 ms).
 - **Rate limiter holds.** The gateway-hammer sent 522 667 `games.list` from one account;
  **522 486 (99.97 %) were `rate_limited`**, only 135 `ok` (the burst). Rejections are
  cheap — p99 = 2 ms — and the gateway sustained ~16 k req/s of rejections during the
  flood. The per-user limiter behaves as designed (R3 input: the cost is negligible).
 **Top finding — `transport_error` under saturation.** At 500 players ~14 % of
 `game.state` calls (72 429 / 519 067) and a few % of the other ops returned a Connect
 `transport_error` (not a domain code). It correlates with the CPU saturation below: the
 backend/gateway are pinned near one core each while the host also runs the 86 %-core
 harness, so the edge sheds load (resets/timeouts) at the knee. It is **amplified by a
 harness artifact** — all 500 virtual players multiplex over a *single* shared
 `http2.Transport`, so 500 persistent `Subscribe` streams plus Execute calls press on one
 HTTP/2 connection's concurrent-stream limit; real clients each use their own connection.
 **Actions:** R7 harness — give each player (or a pool) its own transport, and run on
 hardware not shared with the contour; R3 — confirm the gateway's h2c
 `MaxConcurrentStreams` and edge timeouts are sized for many persistent streams.
 **Minor findings:**
 - `unauthenticated` on a tiny share (188 / 519 067 `game.state`, ~0.04 %) — transient
  session-resolve failures under load; worth a glance in R3 but not material.
 - one `internal` on `game.pass` (1 / 4 788).
 - `game_finished` dominates `chat.nudge`/`chat.post` (≈ 3 900 each): the harness keeps
  secondary ops on games that already ended. Harness refinement — drop finished games
  from the rotation (R7).
 - `nudge_own_turn` / `chat_not_your_turn` / `nudge_too_soon` are the expected turn/rate
  gates, correctly exercised.
 ## Resource baseline
 Per-container peak during step 3 (500 players), from `docker stats`:
 | container | peak CPU | memory |
 |-----------|---------:|-------:|
 | scrabble-backend | **99 %** (~1 core) | 91 MiB |
 | scrabble-gateway | **93 %** | 76 MiB |
 | scrabble-postgres | **90 %** | 69 MiB |
 | scrabble-loadtest (harness) | **86 %** | 42 MiB |
 | scrabble-otelcol | 10 % | 110 MiB |
 | scrabble-tempo | 9 % | 446 MiB |
 | prometheus / postgres-exporter | ~0 % | 46 / 16 MiB |
 - **The contour is CPU-bound at 500 concurrent players:** backend, gateway and Postgres
  each saturate ~1 core (single-instance MVP config), so the system draws ~3 cores at
  this scale; memory is modest (≤ 100 MiB per Go service). This is the sizing input for
  R7 (pool sizes, GOMAXPROCS, container limits) and the prod cutover.
 - **Caveat:** the harness itself peaked at **86 % of a core** on the *same host*, so the
  step-3 latency and `transport_error` figures are pessimistic — the contour competed
  with the generator for CPU. A clean ceiling needs separate hardware (R7).
 - **Postgres:** peak 28 backend connections, ~5 581 commits/s at the peak, **100 % cache
  hit ratio** (no disk reads) — the DB was comfortable; CPU, not I/O, is its limit here.
 - **Goroutines:** backend 638, gateway **1 698** (it holds the 500 `Subscribe` streams +
  per-request goroutines), telegram 49 — all stable, no leak across the ramp.
 ## Recommendations feeding later phases
 - **R3 (edge hardening):** the per-user limiter holds (99.97 % rejected, p99 2 ms) — add
  the per-IP body-size cap on top. Investigate the **~14 % `transport_error` on
  `game.state` at 500 players**: confirm the gateway h2c `MaxConcurrentStreams` and edge
  read/write timeouts are sized for many persistent `Subscribe` streams, and glance at the
  ~0.04 % transient `unauthenticated` resolves under load.
 - **R6 (refactor):** no logic bug forced a code change beyond the two harness-payload
  fixes; the run surfaced no deadlock or goroutine leak across the ramp.
 - **R7 (final tuning + stress):** (1) fix the per-container observability gap — adopt the
  otelcol `docker_stats` receiver so Grafana shows per-container CPU/RSS on the contour;
  (2) refine the harness — per-player/pooled transports and dropping finished games from
  the rotation — and run on hardware **not** shared with the contour; (3) size pools /
  GOMAXPROCS / container limits from the CPU-bound peak (~1 core each for backend, gateway,
  Postgres at 500 players).
 ## Re-running
 See [`README.md`](README.md). Briefly, from the repo root:
 ```sh
 docker build -f loadtest/Dockerfile -t scrabble-loadtest .
 docker run --rm --name scrabble-loadtest --network scrabble-internal \
  -e POSTGRES_PASSWORD=… scrabble-loadtest run    # add --reset on a re-run
 ```
 The harness stays in the repo for the R7 repeat.
@@ -1,212 +0,0 @@
 # R7 — final stress-run trip report
 The final pre-release stress pass for [`PRERELEASE.md`](../PRERELEASE.md) R7. It re-runs
 the R2 harness (`scrabble/loadtest`) against the **final, refactored system** on a
 freshly redeployed contour, to confirm the system holds at scale and to settle the
 resource sizing (container limits, `GOMAXPROCS`, pools, rate limits, log levels) before
 the Stage 18 prod cutover. Pass bar: **diagnostic + a tuning decision** — the run
 "passes" by completing cleanly; the per-container resource profile drives the tuning
 recorded below. Companion to the early pass, [`REPORT-R2.md`](REPORT-R2.md).
 ## What changed since the R2 pass
 - **Harness — per-player transports.** Each virtual player now owns its `edge.Client`
  (its own `http2.Transport` / h2c connection carrying both its `Subscribe` stream and
  its `Execute` calls), instead of all players multiplexing over one shared transport.
  R2 traced the ~14 % `transport_error` on `game.state` at 500 players to that single
  shared connection's stream limit; per-player connections mirror real clients and
  remove the artifact, so this pass measures the system, not the harness.
 - **Harness — drop finished games.** `playTurn` reports a finished game and the player
  drops it from its rotation, so secondary ops stop hitting `game_finished` on ended
  games (the other R2 harness finding).
 - **Observability — otelcol `docker_stats`.** cAdvisor (which resolves only the root
  cgroup on this host — separate-XFS `/var/lib/docker`) is replaced by the otelcol
  `docker_stats` receiver, reading per-container CPU/memory/network from the Docker API.
  Per-container panels now populate on the contour host. (`api_version` pinned to 1.44;
  the daemon's minimum is 1.40.)
 - **Contour — container limits + `GOMAXPROCS`.** `deploy.resources.limits` now bound
  every service; the Go services pin `GOMAXPROCS` to their CPU limit so the runtime
  matches the cgroup quota. Starting values were generous over the R2 peak; this pass
  validates them and settles the agreed sizing (below).
 ## Method
 Unchanged from R2 except for the per-player transports and the dropped-finished-games
 refinement above:
 - **Driver:** the `scrabble/loadtest` module, run as a one-shot container on the
  `scrabble-internal` docker network (reaching `postgres:5432` / `gateway:8081`
  directly), capped at `--cpus 3` so the contour keeps the host's spare cores.
 - **Seed:** 10 000 durable + 1 000 guest accounts with pre-created sessions written
  straight to Postgres (token hash matches `backend/internal/session`).
 - **Games:** assembled through the real **invitation** flow, 2–4 players each, no
  robots; variants over scrabble_en / scrabble_ru / erudit_ru.
 - **Play:** each player holds a live `Subscribe` stream and, per tick, polls
  `game.state`, replays `game.history` and submits a **mid-ranked** legal move generated
  locally by the embedded `scrabble-solver`, or passes / exchanges; a fraction exercise
  nudge / chat / check-word / draft / profile / stats. A separate **gateway-hammer**
  floods `games.list` from one account.
 - **Scale:** the same moderate ramp **50 → 200 → 500** concurrent players, 10 min/step.
 - **Resource capture:** `docker stats` (docker API) sampled every ~20 s for per-container
  CPU/memory; the otelcol **`docker_stats`** receiver → Prometheus → the Grafana
  **Scrabble — Resources** dashboard for the same per-container series; `postgres_exporter`
  internals and per-service Go runtime metrics.
 ## Run configuration
 ```
 docker run --rm --cpus=3 --name scrabble-loadtest --network scrabble-internal \
  -e POSTGRES_PASSWORD=… scrabble-loadtest \
  run --durable 10000 --guest 1000 --steps 50,200,500 --step-dur 10m \
      --tick 800ms --hammer-workers 20 --hammer-dur 15s --reset --cleanup
 ```
 Date: 2026-06-10. Contour: the R1-baseline schema, freshly redeployed with the R7
 container limits / `GOMAXPROCS` (backend/gateway/postgres capped at 2 cores + 512 MiB,
 `GOMAXPROCS=2`) and the `docker_stats` observability. Seeded population removed by
 `--cleanup` afterwards.
 ## Findings
 The ramp ran clean to 500 players — no harness crash, no deadlock, `stream errors: 0` —
 and cleanup removed all 11 000 seeded accounts.
 - **Volume (1827 s):** 821 680 edge calls (449.7 req/s incl. the hammer). Real gameplay
  at scale: **50 916 committed plays**, 4 817 passes, 2 931 games finished; 165 755
  `opponent_moved` + 54 864 `your_turn` events.
 - **The per-player transport fix worked.** `game.state` returned `transport_error` on
  **3 173 / 127 403 = 2.49 %** of calls — down from R2's ~14 % on the same step. Other
  ops were lower still (`game.history` 0.43 %, `game.submit_play` 0.28 %). The residual
  is the gateway bursting into its 2-core cap (see the profile below), not the harness.
 - **Dropping finished games worked.** `game_finished` on `chat.nudge` / `chat.post` fell
  to **35 / 36** (R2: ≈ 3 900 each) — secondary ops no longer hammer ended games.
 - **The limiter holds.** The gateway-hammer sent 565 152 `games.list`; **564 979
  (99.97 %) were `rate_limited`** (154 ok burst, 19 deadline), p99 = 2 ms, ~309 req/s of
  rejections sustained — unchanged from R2.
 - **Latency (peak):** `game.state` p50 ≈ 100 ms, p99 in the 2000 ms bucket (max 2549 ms);
  `game.submit_play` p50 100 / p99 1000 ms bucket. Lobby ops stayed fast
  (invitation / games.list p99 ≤ 10 ms). The p99 tail correlates with the gateway
  burst-throttling, not the backend (which stayed at ~0.85 core).
 ## Resource profile
 Per-container peak during step 3 (500 players), with the R7 starting limits in force
 (backend/gateway/postgres capped at 2 cores / 512 MiB). Two CPU columns: `docker stats`
 samples a ~1 s window (catches bursts); the otelcol `docker_stats` receiver averages over
 its 30 s collection interval (smooths them) — they agree within sampling error, which
 validates the new observability path.
 | container | CPU burst (1 s) | CPU sustained (30 s) | CPU cap | mem peak | mem cap |
 |-----------|----------------:|---------------------:|--------:|---------:|--------:|
 | scrabble-gateway | **217 %** (at cap) | ~145 % | 200 % | 167 MiB | 512 MiB |
 | scrabble-postgres | 138 % | ~153 % | 200 % | 117 MiB | 512 MiB |
 | scrabble-backend | 85 % | ~89 % | 200 % | 116 MiB | 512 MiB |
 | scrabble-tempo | 33 % | — | (none) | **1024 MiB** (at cap) | 1024 MiB |
 | scrabble-otelcol | 11 % | — | (none) | 131 MiB | 512 MiB |
 | scrabble-loadtest (harness) | 157 % | — | 300 % | 369 MiB | — |
 - **The gateway is the binding constraint.** With one h2c connection per player it draws
  ~1.45 cores sustained and **bursts to its 2-core cap** at 500 players, throttling
  briefly — the source of the 2.49 % `transport_error`. R2 saw only ~0.93 core because
  all 500 players shared one connection; the +~0.5 core is the realistic per-connection
  overhead (500 separate HTTP/2 connections). This is a sizing fact, not a regression.
 - **backend is over-provisioned** (~0.85 core vs a 2-core cap); **postgres** (~1.4 cores)
  has headroom; both stayed ≤ 120 MiB.
 - **tempo reached its 1 GiB memory cap** (R2: 446 MiB) — an OOM risk under sustained
  tracing.
 - **Postgres backends peaked at 28**, with the backend pool at its `MaxOpenConns=25` cap.
  Cache hit stayed ~100 % (no disk reads); CPU, not I/O, is the limit.
 - **docker log volume (30 min):** backend 14.2 MiB, gateway 4.6 MiB, postgres 0.04 MiB —
  the backend's per-request latency line at info dominates, and json-file logs had no
  rotation.
 ## Tuning applied
 Agreed from the profile (all in `deploy/docker-compose.yml`; no code change — the pool
 is already env-driven):
 | knob | from | to | why |
 |------|------|----|-----|
 | gateway CPU + `GOMAXPROCS` | 2 cores / 2 | **3 cores / 3** | it bursts into the 2-core cap at 500 players (the 2.49 % `transport_error`); 3 absorbs the bursts |
 | tempo memory | 1 GiB | **2 GiB** | it reached the 1 GiB cap (OOM risk) |
 | backend `MAX_OPEN_CONNS` | 25 | **40** | the pool sat at its 25-conn cap at peak; headroom trims the p99 tail |
 | docker logs | unbounded | **json-file 10m × 3** | bound the ~14 MiB / 30 min backend log; level stays `info` |
 Left as-is: backend / postgres at 2 cores / 512 MiB (peak ~0.85 / ~1.4 cores — headroom
 is cheap on the shared host); the per-user rate limiter and `h2cMaxConcurrentStreams=250`
 (per-connection now, ~1 stream each — ample) and cache TTLs (no pressure observed).
 ### Validation re-run
 Re-running the **same gradual ramp** (50 → 200 → 500) on the tuned contour confirms the
 fix:
 - **`game.state` `transport_error` fell to 0.72 %** (853 / 119 051), down from 2.49 % at
  2 cores. The latency tail also improved — p99 in the 1000 ms bucket, max 1220 ms (was
  the 2000 ms bucket, max 2549 ms).
 - The **gateway peaked at ~2 cores** (≈196 % on the 30 s gauge) — now comfortably **under
  the 3-core cap**, so it no longer throttles. backend ~1 core, postgres ~1.3 cores.
 - **tempo peaked at ~1.27 GiB** — under the new 2 GiB cap (it would have OOM-ed at 1 GiB).
 - Drop-finished still holds (`game_finished` on chat 41/42); the limiter still rejects
  99.97 % of the hammer at p99 2 ms; `stream errors: 0`.
 A separate **burst stress** (a single 100 → 500 jump — 400 players connecting at once)
 **pegged the gateway at 3 cores** (≈296 % sustained) and pushed `game.state`
 `transport_error` to 9.27 %. The gateway is **connection-CPU-bound and bursty**: average
 load is ~1 core, but a mass-simultaneous connection storm saturates whatever single-node
 cap it is given. Real arrivals are gradual (the canonical run), where 3 cores has
 headroom; the lever for a true arrival spike is **horizontal scaling**, not more cores per
 node — carried into the prod recommendation below.
 ## Prod-sizing recommendation (Stage 18)
 The contour is **CPU-bound and gateway-led** at 500 concurrent players. Carry these to the
 prod contour env (the same compose, `PROD_*` values):
 - **gateway: ≥ 3 cores** per ~500 concurrent players, `GOMAXPROCS` pinned to the limit —
  it scales with the **connection count**, not just the request rate; beyond one node's
  worth, scale the gateway **horizontally** rather than vertically.
 - **backend: ~1–2 cores**, pool 40 — comfortable; the work is light per request.
 - **postgres: ~2 cores / ≥ 512 MiB** — ~1.4 cores at 500 players, 100 % cache hit.
 - **tempo: ≥ 2 GiB**; the Go services run under ~170 MiB (256 MiB would suffice, 512 is
  safe); pin `GOMAXPROCS` to each CPU limit; keep json-file rotation.
 - Memory is not the constraint anywhere; CPU is.
 ### VPS / VDS sizing (single-host contour)
 The whole contour (the app + the observability stack) runs on one host via
 `docker-compose`. The tiers below are grounded in the R7 profile (**≈5.5 cores / ≈2.5 GiB
 RAM peak at 500 concurrent players**; ≈0.5 GiB idle) and the **measured** on-disk
 footprint: prod images ≈2.4 GB; the Tempo volume **3.1 GB at 72 h** retention; Prometheus
 ≈1–2 GB at 15 d; the game DB 23 MiB and growing with history. CPU and disk grow; RAM has
 the most slack.
 | tier | CPU | RAM | disk | handles |
 |------|-----|-----|------|---------|
 | **Minimum** | 2 cores | 2 GiB | 20 GiB | ~up to ~150 concurrent; lower the compose limits (gateway 1.5 / backend·postgres 1 / tempo 1 GiB) to fit the box |
 | **Average** (reasonable load) | 4 cores | 4 GiB | 40 GiB | ~300–400 concurrent comfortably; the tested 500 with occasional gateway burst-throttling |
 | **Maximum** (worry-free) | 8 cores | 8 GiB | 80 GiB | 500+ concurrent with full gateway burst headroom (its 3-core cap) + room to grow; the compose limits fit as-is |
 - The per-service limits in `docker-compose.yml` are tuned for the **Average/Maximum**
  target (the gateway alone caps at 3 cores). On the **Minimum** tier, scale them down to
  match the host or the caps over-subscribe it.
 - **Disk is dominated by observability retention + DB growth.** Tempo (72 h traces) and
  Prometheus (15 d metrics) are the main levers — shorten the windows (or move Tempo to
  object storage) to cut disk; Postgres grows with game history, so budget for months of
  it; container logs are already capped (json-file 10m × 3 ≈ 30 MiB each).
 - **RAM** rarely binds: the contour peaks ≈2.5 GiB at 500 players and the sum of all
  configured limits is ≈5.6 GiB, so 8 GiB never strains.
 - Beyond one host's worth of players, scale the **gateway horizontally** (it is
  connection-CPU-bound) rather than ordering an ever-bigger box.
 ## Re-running
 See [`README.md`](README.md). Briefly, from the repo root:
 ```sh
 docker build -f loadtest/Dockerfile -t scrabble-loadtest .
 docker run --rm --cpus=3 --name scrabble-loadtest --network scrabble-internal \
  -e POSTGRES_PASSWORD=… scrabble-loadtest run --reset --cleanup
 ```
 The harness stays in the repo for future repeats.
@@ -0,0 +1,194 @@
 # loadtest — stress trip report
 The pre-release stress write-up for [`PRERELEASE.md`](../PRERELEASE.md). It drives the
 `scrabble/loadtest` harness against a freshly redeployed test contour to confirm the
 system holds at scale and to settle resource sizing before the prod cutover. The harness
 stays in the repo for repeats; see [`README.md`](README.md) for how to run it.
 This report supersedes the earlier per-phase notes. The harness has been through three
 passes: an early diagnostic, a tuning pass that sized container limits / `GOMAXPROCS`, and
 this final pass — which **added the per-tile `game.evaluate` preview to the model** (the
 hottest real gameplay call, previously unmodelled) and, with it, surfaced and fixed the
 **gateway→backend connection-pool bottleneck** described below. The numbers here are from
 that final pass.
 ## What it models
 The harness seeds a large account population with pre-created sessions directly in
 Postgres, then drives virtual players through the **gateway edge protocol** (h2c) in real
 games assembled via the invitation flow. Each player owns its own `edge.Client` (its own
 h2c connection, like a real client), holds a live `Subscribe` stream, and per tick polls
 `game.state`, replays `game.history`, generates a legal **mid-ranked** move with the
 embedded `scrabble-solver`, and submits it (or passes/exchanges). A fraction of ticks
 exercise nudge / chat / check-word / draft / profile / stats. A separate **gateway-hammer**
 floods `games.list` to verify the rate limiter.
 ### The evaluate hot path (this pass)
 A real client previews every tentative play as the user arranges tiles: the UI fires a
 debounced `game.evaluate` (legality + score) on each placement change while it is the
 player's turn. Over a single composed word that is **several evaluate calls per turn** —
 far more than the one `submit_play` — so `game.evaluate` is the single hottest gameplay
 request at scale. The earlier passes did not model it at all (they submitted directly),
 which understated the real load.
 This pass models it: when a player composes a play of *K* newly-placed tiles, it fires one
 `evaluate` per landed tile (a growing prefix of the tiles), plus a small number of
 full-composition re-previews for reconsideration, spaced by a human-paced gap (the client's
 250 ms debounce), then one `draft.save`, then `submit_play`. `--eval=false` reproduces the
 pre-evaluate harness for an A/B baseline; `--eval-recon` tunes the reconsideration count.
 `game.check_word` is a *different*, manual "look this word up" panel (throttled, on demand)
 — not the per-tile call — and is exercised separately as a secondary op.
 ## Final run (eval-on, after the connection-pool fix)
 Contour: backend / postgres capped at 2 cores / 512 MiB (`GOMAXPROCS=2`), gateway at
 3 cores / 512 MiB (`GOMAXPROCS=3`), per the tuned `deploy/docker-compose.yml`. Gradual ramp
 **50 → 200 → 500** concurrent players, 4 min/step, `--tick 800ms`, gateway-hammer on. The
 harness ran as a one-shot container on `scrabble-internal`, capped at `--cpus 3`. The DB was
 wiped before the run (`DROP SCHEMA backend CASCADE`); the seeded population was removed by
 `--cleanup` afterwards.
 Per-operation results at the 500-player peak (740 s, gameplay rows; the hammer row is the
 limiter probe):
 | operation | count | req/s | p50 | p99 | max | notes |
 |-----------|------:|------:|----:|----:|----:|-------|
 | game.evaluate | 85 721 | 115.9 | 1 ms | 200 ms | 193 ms | **the hot path** — all ok |
 | game.state | 115 926 | 156.7 | 100 ms | 200 ms | 260 ms | transport_error 86 (0.07 %) |
 | game.history | 22 258 | 30.1 | 5 ms | 100 ms | 195 ms | all ok |
 | draft.save | 23 031 | 31.1 | 2 ms | 200 ms | 194 ms | all ok |
 | game.submit_play | 21 704 | 29.3 | 1 ms | 200 ms | 274 ms | ok 3 902; not_your_turn / illegal_play are concurrent-play races (see caveat) |
 | hammer:games.list | 522 756 | 706.7 | 1 ms | 2 ms | 53 ms | **99.97 % rate_limited** — limiter holds |
 - **Volume:** 802 200 total edge calls (1 084 req/s incl. the hammer; ~377 req/s of real
  gameplay). `stream errors: 0`. Live events: 11 199 `opponent_moved`, 4 153 `your_turn`.
 - **`game.evaluate` is the dominant gameplay write-path call** at ~116 req/s — second only
  to the `game.state` poll — and it is cheap: p50 1 ms, effectively zero errors. The backend
  serves it straight from the in-memory live-game cache; on a warm hit it skips the database
  entirely (see *Postgres read path* below, which halved its p99 to 100 ms).
 - **Latency stayed healthy** under the heavier evaluate load: every gameplay op p99 ≤ 200 ms.
 - **The limiter holds** unchanged: 99.97 % of the hammer rejected at p99 2 ms.
 ### Peak CPU (500 players)
 | container | CPU peak | cap |
 |-----------|---------:|----:|
 | scrabble-postgres | **165 %** (~1.65 cores) | 200 % |
 | scrabble-backend | 77 % (~0.77 core) | 200 % |
 | scrabble-gateway | **26 %** (~0.26 core) | 300 % |
 | scrabble-loadtest (harness) | 42 % | 300 % |
 Memory stayed modest everywhere (Go services ≤ ~90 MiB). **Postgres is now the busiest
 service** — it has headroom (1.65 of 2 cores) but is the scaling axis. The gateway, after
 the fix below, is near-idle.
 ## The headline finding: gateway→backend connection churn
 The gateway proxies every synchronous client call to the single backend host over REST.
 Its backend HTTP client used the default transport, whose **`MaxIdleConnsPerHost` is 2**
 (`http.DefaultMaxIdleConnsPerHost`). So the gateway kept only **2** keep-alive connections
 to the backend and opened — then closed — a fresh TCP connection for almost every other
 call. Measured at the gateway's network namespace:
 | | gateway→backend sockets |
 |---|---|
 | before (eval-on, 500 players) | **TIME_WAIT ≈ 26 500**, ESTABLISHED 2 |
 | after (eval-on, 500 players) | TIME_WAIT ≈ 0 (steady state), **ESTABLISHED ≈ 225 (reused)** |
 26 500 TIME_WAIT sockets is the connection **churn**: ~440 new connections per second,
 each a full TCP handshake + teardown, the socket then lingering 60 s. That count sits right
 under the ~28 000 ephemeral-port ceiling — the latent cliff that produced the residual
 `transport_error` the earlier passes chased on the *client* side (h2c streams) but never
 eliminated, because the real cause was here, on the *backend* side.
 The fix is one custom `http.Transport` with a wide idle pool
 (`gateway/internal/backendclient/client.go`, `backendMaxIdleConns`). Before / after, same
 eval-on workload at 500 players:
 | metric | before fix | after fix |
 |--------|-----------:|----------:|
 | gateway→backend TIME_WAIT | ~26 500 | **~0** |
 | gateway CPU peak | **175 %** (~1.75 cores) | **26 %** (~0.26 core) |
 | game.state p99 | 500 ms | 200 ms |
 **The churn was burning ~1.5 gateway cores of pure connection setup/teardown.** Removing it
 cut peak gateway CPU ~7× and erased the port-exhaustion cliff. The backend and postgres CPU
 are unchanged — they do the real work; only the gateway's wasted overhead disappeared. The
 pool settles at ~225 live connections at 500 players; the constant is set to 512 for ~2×
 headroom.
 ## Sizing — why the old "≈150 concurrent / 2-core" figure was a bug, not a floor
 The earlier tuning pass concluded the gateway was the binding constraint — "size it for
 ≥ 3 cores per 500 players, scale it horizontally" — and the single-host "minimum" tier
 topped out near ~150 concurrent. **That was sizing around the connection-churn bug.** The
 gateway drew ~1.75–3 cores not from proxying work but from churning backend connections;
 the backend behind it sat near-idle the whole time.
 With the churn fixed, at **500 concurrent players** the app draws roughly:
 - **gateway ≈ 0.26 core** (was ~3) — no longer the constraint,
 - **backend ≈ 0.77 core**,
 - **postgres ≈ 1.65 cores** — now the busiest, with headroom,
 ≈ **2.7 app cores total** (down from the ~5.5-core contour peak the tuning pass recorded,
 *and* under a heavier, more realistic workload that now includes `game.evaluate`). Postgres,
 not the gateway, is the scaling axis.
 Revised single-host guidance (app + co-resident observability stack on one box):
 | tier | CPU | RAM | handles |
 |------|-----|-----|---------|
 | **Minimum** | 2 cores | 2 GiB | comfortably the low hundreds of concurrent — the gateway no longer eats cores; postgres + the observability stack set the limit |
 | **Average** | 4 cores | 4 GiB | 500 concurrent with headroom |
 | **Maximum** | 8 cores | 8 GiB | 500+ with full burst headroom and room to grow |
 The gateway's compose limit can drop well below its old 3 cores; it is now connection-pool
 bound, not connection-CPU bound. Memory was never the constraint. Disk is still dominated
 by observability retention (Tempo, Prometheus) + DB growth — unchanged from before.
 ## Postgres read path (warm-cache optimization)
 Following this pass, `game.evaluate` no longer reads the database on the hot path. An
 active game is already resident in the in-memory live-game cache (mutated in place across
 moves, evicted only on finish), so the preview answers its seat-membership check from the
 cached immutable seat list and scores against the cached engine game — **no `GetGame` on a
 warm hit**. `GetGame` itself was also folded from two round-trips (game, then seats) into a
 single `LEFT JOIN`. Measured at 500 players, **`game.evaluate` p99 halved (200 → 100 ms)**
 and the per-operation query count dropped.
 It did **not** cut postgres CPU, and the measurement says why: postgres is **write-bound**,
 not read-bound. `pg_stat_user_tables` puts the cost in the per-move `CommitMove`
 transaction (a `game_moves` insert plus `games` / `game_players` updates), the debounced
 `game_drafts` upserts (~60 k in one run), and the journal replays — not the cheap, indexed,
 fully-cached `GetGame` lookups this change removed (one re-run even committed 28 % more
 plays, whose extra writes masked the saved reads). Postgres also runs with headroom
 (~1.5 of 2 cores), and the gateway fix freed ~3 cores on the box, so the lever if postgres
 ever caps is **more cores** (it is CPU-bound, not I/O), not riskier write-path surgery. So
 this change is a latency / query-volume win, deliberately not a DB-CPU one.
 ## Caveat — harness fidelity
 The harness's `not_your_turn` and `illegal_play` on `submit_play` are concurrent-play
 artifacts, not system errors: it generates a move from a locally replayed board, and a
 fast opponent (or a transport hiccup) can move between the state fetch and the submit,
 leaving the move out of turn or illegal on the now-changed board. A real client previews
 with `evaluate` and only submits a legal, in-turn play. These rejections are cheap domain
 outcomes (HTTP-ok with a stable code) and do not change the request *load*, which is what
 the run measures. The harness also shares the host CPU with the contour (capped with
 `--cpus`); a fully isolated ceiling on separate hardware remains future work.
 ## Re-running
 From the repo root:
 ```sh
 docker build -f loadtest/Dockerfile -t scrabble-loadtest .
 docker run --rm --cpus=3 --name scrabble-loadtest --network scrabble-internal \
  -e POSTGRES_PASSWORD="$TEST_POSTGRES_PASSWORD" scrabble-loadtest run --reset --cleanup
 ```
 `--eval=false` reproduces the pre-evaluate baseline for comparison. The authoritative hard
 reset of the contour DB remains `DROP SCHEMA backend CASCADE` + a backend restart.
@@ -73,6 +73,8 @@ func cmdRun(ctx context.Context, log *slog.Logger, args []string) error {
 	gpp := fs.Int("games-per-player", 0, "target concurrent games per player (0 => random 3..5)")
 	tick := fs.Duration("tick", 800*time.Millisecond, "per-player operation cadence")
 	secProb := fs.Float64("secondary-prob", 0.08, "chance per tick of a non-move operation")
 	eval := fs.Bool("eval", true, "model the per-tile evaluate preview (the realistic gameplay hot path); --eval=false reproduces the pre-evaluate harness for an A/B baseline")
 	evalRecon := fs.Int("eval-recon", 1, "extra full-composition evaluate re-previews per play (reconsideration), beyond one per placed tile")
 	hammerWorkers := fs.Int("hammer-workers", 20, "gateway-hammer concurrent callers (0 disables)")
 	hammerDur := fs.Duration("hammer-dur", 15*time.Second, "gateway-hammer duration")
 	reset := fs.Bool("reset", false, "delete prior harness rows before seeding")
@@ -117,6 +119,7 @@ func cmdRun(ctx context.Context, log *slog.Logger, args []string) error {
 	cfg := scenario.RealisticConfig{
 		Steps: steps, StepDur: *stepDur, GamesPerPlayer: *gpp,
 		Tick: *tick, SecondaryProb: *secProb,
 		Eval: *eval, EvalRecon: *evalRecon,
 	}
 	if err := drv.RunRealistic(ctx, pool, cfg); err != nil && !errors.Is(err, context.Canceled) {
 		return err
@@ -126,7 +129,7 @@ func cmdRun(ctx context.Context, log *slog.Logger, args []string) error {
 		drv.Hammer(ctx, pool.Durables[0], scenario.HammerConfig{Workers: *hammerWorkers, Duration: *hammerDur})
 	}
-	fmt.Println("\n==== R2 load-test report ====")
+	fmt.Println("\n==== load-test report ====")
 	fmt.Println(rec.Summary())
 	if *doCleanup {
@@ -24,6 +24,7 @@ const (
 	msgSubmitPlay = "game.submit_play"
 	msgPass       = "game.pass"
 	msgExchange   = "game.exchange"
 	msgEvaluate   = "game.evaluate"
 	msgState      = "game.state"
 	msgHistory    = "game.history"
 	msgGamesList  = "games.list"
@@ -63,6 +63,33 @@ func submitPlay(gameID string, tiles []PlayTile) []byte {
 	return b.FinishedBytes()
 }
 // evalReq builds an EvalRequest payload (game id plus the tentative newly-placed tiles).
 // It mirrors submitPlay's shape — the backend infers the play's orientation the same way —
 // so a preview previews exactly what submitting those tiles would score.
 func evalReq(gameID string, tiles []PlayTile) []byte {
 	b := flatbuffers.NewBuilder(256)
 	gid := b.CreateString(gameID)
 	offs := make([]flatbuffers.UOffsetT, len(tiles))
 	for i, t := range tiles {
 		fb.PlayTileStart(b)
 		fb.PlayTileAddRow(b, int32(t.Row))
 		fb.PlayTileAddCol(b, int32(t.Col))
 		fb.PlayTileAddLetter(b, t.Letter)
 		fb.PlayTileAddBlank(b, t.Blank)
 		offs[i] = fb.PlayTileEnd(b)
 	}
 	fb.EvalRequestStartTilesVector(b, len(offs))
 	for i := len(offs) - 1; i >= 0; i-- {
 		b.PrependUOffsetT(offs[i])
 	}
 	tilesVec := b.EndVector(len(offs))
 	fb.EvalRequestStart(b)
 	fb.EvalRequestAddGameId(b, gid)
 	fb.EvalRequestAddTiles(b, tilesVec)
 	b.Finish(fb.EvalRequestEnd(b))
 	return b.FinishedBytes()
 }
 // exchange builds an ExchangeRequest payload swapping the listed rack tiles (alphabet
 // indices; 255 a blank).
 func exchange(gameID string, tiles []byte) []byte {
@@ -53,6 +53,15 @@ func (c *Client) Exchange(ctx context.Context, token, gameID string, tiles []byt
 	return decodeMoveResultGame(r.Payload), r.Code, nil
 }
 // Evaluate previews a tentative play's legality and score without committing it. It is
 // the per-tile composition call a real client fires (debounced) on every change while
 // arranging a word, so it is the hottest gameplay request at scale. The harness records
 // only the result code and latency; an illegal preview is a successful "ok" call.
 func (c *Client) Evaluate(ctx context.Context, token, gameID string, tiles []PlayTile) (string, error) {
 	r, err := c.execute(ctx, token, msgEvaluate, evalReq(gameID, tiles))
 	return r.Code, err
 }
 // Nudge prods the opponent whose turn it is.
 func (c *Client) Nudge(ctx context.Context, token, gameID string) (string, error) {
 	r, err := c.execute(ctx, token, msgNudge, gameAction(gameID))
@@ -42,19 +42,35 @@ type RealisticConfig struct {
 	GamesPerPlayer int           // target concurrent games per player; 0 => random 3..5
 	Tick           time.Duration // per-player operation cadence (keeps a player under the per-user limit)
 	SecondaryProb  float64       // chance per tick of a non-move operation
 	Eval           bool          // model the per-tile evaluate preview (the gameplay hot path); false reproduces the pre-evaluate harness
 	EvalRecon      int           // extra full-composition evaluate re-previews per play, beyond one per placed tile
 }
 // DefaultRealistic returns the moderate ramp: 50 -> 200
-// -> 500 concurrent players, ~12 minutes per step, ~1 op/s per player.
+// -> 500 concurrent players, ~12 minutes per step, ~1 op/s per player, with the
 // per-tile evaluate preview modelled (the realistic hot path).
 func DefaultRealistic() RealisticConfig {
 	return RealisticConfig{
 		Steps:         []int{50, 200, 500},
 		StepDur:       12 * time.Minute,
 		Tick:          800 * time.Millisecond,
 		SecondaryProb: 0.08,
 		Eval:          true,
 		EvalRecon:     1,
 	}
 }
 // evalGapBase and evalGapSpan bound the modelled pause between successive tile
 // placements: the client's 250 ms debounce coalesces faster drags into a single
 // evaluate, so a thoughtful player's previews are spaced by a gap drawn from
 // [base, base+span] — wide enough that a normal composition stays under the per-user
 // rate limit, the way a real one does (the limiter's cost is measured by the hammer,
 // not by self-inflicted rejections here).
 const (
 	evalGapBase = 250 * time.Millisecond
 	evalGapSpan = 500 * time.Millisecond
 )
 // RunRealistic runs the staged ramp. Each step activates more players (drawn from the
 // seeded pool), assembles a cohort of games for them and starts their turn loops; the
 // loops run until the whole ramp ends. Players from earlier steps keep playing, so
@@ -128,7 +144,7 @@ func (d *Driver) playerLoop(ctx context.Context, p seed.Account, games []*Game,
 				d.secondaryOp(ctx, c, p, g, rng)
 				continue
 			}
-			if d.playTurn(ctx, c, p, g, rng) {
+			if d.playTurn(ctx, c, p, g, cfg, rng) {
 				active = slices.DeleteFunc(active, func(x *Game) bool { return x == g })
 				gi = 0
 				if len(active) == 0 {
@@ -161,10 +177,10 @@ func (d *Driver) subscribeLoop(ctx context.Context, c *edge.Client, p seed.Accou
 }
 // playTurn plays one turn in g over the player's client when it is the player's
-// move: fetch state, replay history, pick a legal move and submit it (or exchange /
+// move: fetch state, replay history, pick a legal move, compose it (the per-tile
-// pass). It reports whether the game has finished, so the caller can drop it from the
+// evaluate previews a real client fires) and submit it (or exchange / pass). It reports
-// rotation.
+// whether the game has finished, so the caller can drop it from the rotation.
-func (d *Driver) playTurn(ctx context.Context, c *edge.Client, p seed.Account, g *Game, rng *rand.Rand) (finished bool) {
+func (d *Driver) playTurn(ctx context.Context, c *edge.Client, p seed.Account, g *Game, cfg RealisticConfig, rng *rand.Rand) (finished bool) {
 	seat := g.seatOf(p.ID.String())
 	if seat < 0 {
 		return false
@@ -196,6 +212,7 @@ func (d *Driver) playTurn(ctx context.Context, c *edge.Client, p seed.Account, g
 	}
 	switch action.Kind {
 	case "play":
 		d.composePlay(ctx, c, p, g, action.Tiles, cfg, rng)
 		t0 = time.Now()
 		_, code, _ := c.SubmitPlay(ctx, p.Token, g.ID, action.Tiles)
 		d.rec.Record("game.submit_play", code, time.Since(t0))
@@ -211,6 +228,59 @@ func (d *Driver) playTurn(ctx context.Context, c *edge.Client, p seed.Account, g
 	return false
 }
 // composePlay models a player arranging the chosen play tile by tile before committing:
 // the debounced evaluate preview the real client fires on each placement (a growing prefix
 // of the tiles), a few full-composition re-previews for reconsideration (recall a tile, try
 // another spot), and the single draft persistence the client debounces out. evaluate is the
 // hottest gameplay request at scale, so omitting it (the pre-evaluate harness) understated
 // the load; cfg.Eval false reproduces that baseline for an A/B comparison. Every step
 // honours ctx, so end-of-run cancellation never blocks on a sleep or an in-flight preview.
 func (d *Driver) composePlay(ctx context.Context, c *edge.Client, p seed.Account, g *Game, tiles []edge.PlayTile, cfg RealisticConfig, rng *rand.Rand) {
 	if !cfg.Eval || len(tiles) == 0 {
 		return
 	}
 	// One evaluate per landed tile: the growing prefix mirrors the client re-previewing
 	// after each placement (an early prefix is often illegal, which is still a successful
 	// "ok" round trip — exactly the backend work a real composition triggers).
 	for n := 1; n <= len(tiles); n++ {
 		if !jitterSleep(ctx, rng, evalGapBase, evalGapSpan) {
 			return
 		}
 		t0 := time.Now()
 		code, _ := c.Evaluate(ctx, p.Token, g.ID, tiles[:n])
 		d.rec.Record("game.evaluate", code, time.Since(t0))
 	}
 	for r := 0; r < cfg.EvalRecon; r++ {
 		if !jitterSleep(ctx, rng, evalGapBase, evalGapSpan) {
 			return
 		}
 		t0 := time.Now()
 		code, _ := c.Evaluate(ctx, p.Token, g.ID, tiles)
 		d.rec.Record("game.evaluate", code, time.Since(t0))
 	}
 	// The client persists the in-progress composition (debounced to one upsert). Its opaque
 	// JSON content does not affect the call's cost, so a minimal valid shape stands in.
 	t0 := time.Now()
 	code, _ := c.DraftSave(ctx, p.Token, g.ID, `{"rack_order":"","board_tiles":[]}`)
 	d.rec.Record("draft.save", code, time.Since(t0))
 }
 // jitterSleep pauses for a randomised gap in [base, base+span], modelling the human pause
 // between tile placements that the client's debounce coalesces into one evaluate. It
 // returns false if ctx is cancelled during the wait, so a composition unwinds promptly at
 // end of run.
 func jitterSleep(ctx context.Context, rng *rand.Rand, base, span time.Duration) bool {
 	d := base + time.Duration(rng.Int63n(int64(span)+1))
 	t := time.NewTimer(d)
 	defer t.Stop()
 	select {
 	case <-ctx.Done():
 		return false
 	case <-t.C:
 		return true
 	}
 }
 // secondaryOp exercises one of the non-move edge operations the plan calls out, so
 // the run touches nudge / chat / check-word / draft / profile / stats too, over the
 // player's own client.
@@ -99,24 +99,33 @@ table MoveRecord {
 // --- auth (unauthenticated) ---
 // TelegramLoginRequest carries the platform launch data; the gateway validates
-// its HMAC before forwarding the extracted identity to the backend.
+// its HMAC before forwarding the extracted identity to the backend. browser_tz is
 // the client's detected UTC offset ("±HH:MM"), seeded into a brand-new account's
 // time zone so the robot's sleep window and the turn-timeout away window are
 // anchored to the player's real zone from first contact (first contact only).
 table TelegramLoginRequest {
  init_data:string;
  browser_tz:string;
 }
 // GuestLoginRequest bootstraps an ephemeral guest session. locale is an optional
-// preferred-language hint.
+// preferred-language hint; browser_tz is the detected UTC offset seeded into the
 // guest account's time zone (see TelegramLoginRequest.browser_tz).
 table GuestLoginRequest {
  locale:string;
  browser_tz:string;
 }
-// EmailRequestRequest asks the backend to send a login confirm-code to email.
+// EmailRequestRequest asks the backend to send a login confirm-code to email. It
 // also provisions the account on first contact, so browser_tz (the detected UTC
 // offset) is seeded into its time zone here, not at the later login step.
 table EmailRequestRequest {
  email:string;
  browser_tz:string;
 }
-// EmailLoginRequest logs in (or provisions) the account owning email, verifying
+// EmailLoginRequest logs in to the account owning email (provisioned at the
-// the confirm-code.
+// request step), verifying the confirm-code.
 table EmailLoginRequest {
  email:string;
  code:string;
@@ -383,6 +392,8 @@ table FeedbackSubmitRequest {
  attachment:[ubyte];
  attachment_name:string;
  channel:string;
  version:string;
  browser_tz:string;
 }
 // FeedbackReply is the operator's answer shown back to the player.
@@ -49,12 +49,23 @@ func (rcv *EmailRequestRequest) Email() []byte {
 	return nil
 }
 func (rcv *EmailRequestRequest) BrowserTz() []byte {
 	o := flatbuffers.UOffsetT(rcv._tab.Offset(6))
 	if o != 0 {
 		return rcv._tab.ByteVector(o + rcv._tab.Pos)
 	}
 	return nil
 }
 func EmailRequestRequestStart(builder *flatbuffers.Builder) {
-	builder.StartObject(1)
+	builder.StartObject(2)
 }
 func EmailRequestRequestAddEmail(builder *flatbuffers.Builder, email flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(email), 0)
 }
 func EmailRequestRequestAddBrowserTz(builder *flatbuffers.Builder, browserTz flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(1, flatbuffers.UOffsetT(browserTz), 0)
 }
 func EmailRequestRequestEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }
@@ -99,8 +99,24 @@ func (rcv *FeedbackSubmitRequest) Channel() []byte {
 	return nil
 }
 func (rcv *FeedbackSubmitRequest) Version() []byte {
 	o := flatbuffers.UOffsetT(rcv._tab.Offset(12))
 	if o != 0 {
 		return rcv._tab.ByteVector(o + rcv._tab.Pos)
 	}
 	return nil
 }
 func (rcv *FeedbackSubmitRequest) BrowserTz() []byte {
 	o := flatbuffers.UOffsetT(rcv._tab.Offset(14))
 	if o != 0 {
 		return rcv._tab.ByteVector(o + rcv._tab.Pos)
 	}
 	return nil
 }
 func FeedbackSubmitRequestStart(builder *flatbuffers.Builder) {
-	builder.StartObject(4)
+	builder.StartObject(6)
 }
 func FeedbackSubmitRequestAddBody(builder *flatbuffers.Builder, body flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(body), 0)
@@ -117,6 +133,12 @@ func FeedbackSubmitRequestAddAttachmentName(builder *flatbuffers.Builder, attach
 func FeedbackSubmitRequestAddChannel(builder *flatbuffers.Builder, channel flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(3, flatbuffers.UOffsetT(channel), 0)
 }
 func FeedbackSubmitRequestAddVersion(builder *flatbuffers.Builder, version flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(4, flatbuffers.UOffsetT(version), 0)
 }
 func FeedbackSubmitRequestAddBrowserTz(builder *flatbuffers.Builder, browserTz flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(5, flatbuffers.UOffsetT(browserTz), 0)
 }
 func FeedbackSubmitRequestEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }
@@ -49,12 +49,23 @@ func (rcv *GuestLoginRequest) Locale() []byte {
 	return nil
 }
 func (rcv *GuestLoginRequest) BrowserTz() []byte {
 	o := flatbuffers.UOffsetT(rcv._tab.Offset(6))
 	if o != 0 {
 		return rcv._tab.ByteVector(o + rcv._tab.Pos)
 	}
 	return nil
 }
 func GuestLoginRequestStart(builder *flatbuffers.Builder) {
-	builder.StartObject(1)
+	builder.StartObject(2)
 }
 func GuestLoginRequestAddLocale(builder *flatbuffers.Builder, locale flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(locale), 0)
 }
 func GuestLoginRequestAddBrowserTz(builder *flatbuffers.Builder, browserTz flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(1, flatbuffers.UOffsetT(browserTz), 0)
 }
 func GuestLoginRequestEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }
@@ -49,12 +49,23 @@ func (rcv *TelegramLoginRequest) InitData() []byte {
 	return nil
 }
 func (rcv *TelegramLoginRequest) BrowserTz() []byte {
 	o := flatbuffers.UOffsetT(rcv._tab.Offset(6))
 	if o != 0 {
 		return rcv._tab.ByteVector(o + rcv._tab.Pos)
 	}
 	return nil
 }
 func TelegramLoginRequestStart(builder *flatbuffers.Builder) {
-	builder.StartObject(1)
+	builder.StartObject(2)
 }
 func TelegramLoginRequestAddInitData(builder *flatbuffers.Builder, initData flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(initData), 0)
 }
 func TelegramLoginRequestAddBrowserTz(builder *flatbuffers.Builder, browserTz flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(1, flatbuffers.UOffsetT(browserTz), 0)
 }
 func TelegramLoginRequestEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }
@@ -29,6 +29,8 @@ import (
 	"go.opentelemetry.io/otel/sdk/resource"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
 	"go.opentelemetry.io/otel/trace"
 	"scrabble/pkg/version"
 )
 // Exporter selectors supported per signal.
@@ -95,9 +97,7 @@ func New(ctx context.Context, cfg Config) (*Runtime, error) {
 		return nil, err
 	}
-	res, err := resource.New(ctx, resource.WithAttributes(
+	res, err := serviceResource(ctx, cfg)
 		attribute.String("service.name", cfg.ServiceName),
 	))
 	if err != nil {
 		return nil, fmt.Errorf("telemetry: build resource: %w", err)
 	}
@@ -122,6 +122,16 @@ func New(ctx context.Context, cfg Config) (*Runtime, error) {
 	return &Runtime{tracerProvider: tracerProvider, meterProvider: meterProvider}, nil
 }
 // serviceResource builds the OpenTelemetry resource describing this service: its
 // service.name and the service.version stamped into the binary at build time
 // (pkg/version, set from the git tag by the deploy).
 func serviceResource(ctx context.Context, cfg Config) (*resource.Resource, error) {
 	return resource.New(ctx, resource.WithAttributes(
 		attribute.String("service.name", cfg.ServiceName),
 		attribute.String("service.version", version.Version),
 	))
 }
 // TracerProvider returns the runtime tracer provider, or the global one when r is
 // not initialised.
 func (r *Runtime) TracerProvider() trace.TracerProvider {
@@ -4,6 +4,8 @@ import (
 	"context"
 	"testing"
 	"time"
 	"scrabble/pkg/version"
 )
 // TestConfigValidate covers the supported and rejected exporter selections.
@@ -82,3 +84,22 @@ func TestNilRuntime(t *testing.T) {
 		t.Errorf("nil runtime Shutdown: %v", err)
 	}
 }
 // TestServiceResource checks the resource carries service.name and the embedded
 // service.version (pkg/version, stamped at build time).
 func TestServiceResource(t *testing.T) {
 	res, err := serviceResource(context.Background(), DefaultConfig("svc"))
 	if err != nil {
 		t.Fatalf("serviceResource: %v", err)
 	}
 	attrs := map[string]string{}
 	for _, kv := range res.Attributes() {
 		attrs[string(kv.Key)] = kv.Value.AsString()
 	}
 	if attrs["service.name"] != "svc" {
 		t.Errorf("service.name = %q, want svc", attrs["service.name"])
 	}
 	if attrs["service.version"] != version.Version {
 		t.Errorf("service.version = %q, want %q", attrs["service.version"], version.Version)
 	}
 }
@@ -0,0 +1,10 @@
 // Package version exposes the build version stamped into every Scrabble service
 // binary. The default is "dev"; release builds override it through the linker
 // (`go build -ldflags "-X scrabble/pkg/version.Version=<value>"`), wired from the
 // VERSION build-arg in each service Dockerfile, which the deploy sets to the git
 // tag (`git describe --tags`). It surfaces as the OpenTelemetry service.version
 // resource attribute (see pkg/telemetry) and the SPA About screen.
 package version
 // Version is the build version, "dev" unless overridden at link time.
 var Version = "dev"
@@ -19,8 +19,10 @@ COPY platform/telegram ./platform/telegram
 # Reduce the workspace to what the platform needs: only pkg + platform/telegram.
 RUN go work edit -dropuse=./backend -dropuse=./gateway -dropuse=./loadtest -dropreplace=scrabble/gateway@v0.0.0 -dropreplace=scrabble-solver
-RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/validator ./platform/telegram/cmd/validator
+# VERSION (the deploy passes the git tag) is stamped into both binaries via the linker.
-RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/bot ./platform/telegram/cmd/bot
+ARG VERSION=dev
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-X scrabble/pkg/version.Version=${VERSION}" -o /out/validator ./platform/telegram/cmd/validator
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-X scrabble/pkg/version.Version=${VERSION}" -o /out/bot ./platform/telegram/cmd/bot
 # --- validator (home) --------------------------------------------------------
 FROM gcr.io/distroless/static-debian12:nonroot AS validator
@@ -38,10 +38,17 @@ Telegram identity to an account from a browser. Both map a rejection to gRPC
  operator-chosen for broadcasts) with a Mini App launch button and sends it. It replies
  with an `Ack` per command (`delivered` mirrors the former connector semantics —
  false when the kind is not rendered out-of-app or the user never started the bot).
- **Bot chat.** `/start <payload>` (and the chat menu button) reply with a Mini App
+- **Bot chat.** `/start <payload>` (and the chat menu button) reply with a localized
-  launch button; a deep-link payload routes the launch to a game / invitation / friend
+  welcome and a Mini App launch button; a deep-link payload routes the launch to a game /
-  code. This is **self-contained** — the bot never calls back into the game, so `/start`
+  invitation / friend code. The welcome is **Russian or English** by the sender's reported
-  onboarding works even when the game is down.
+  Telegram language (`Message.from.language_code`, which the Bot API carries on the message
  itself — no separate user-update event — English fallback) and links the game channel and
  discussion chat by their public `@username`, **resolved once at startup** from
  `TELEGRAM_GAME_CHANNEL_ID` / `TELEGRAM_CHAT_ID` via `getChat` (a chat that is unset,
  private, or unreadable degrades that link to a generic noun — "the channel" / "our
  chat" — rather than a dangling "@"). This is otherwise **self-contained**
  — the bot never calls back into the game, so `/start` onboarding works even when the game
  is down.
 - **Moderated-chat gating.** When `TELEGRAM_CHAT_ID` names a channel's linked discussion
  group, the bot gates who may write there. The group **allows sending by default** (a
  human setting) and the bot only **restricts** — Telegram intersects the chat default with
@@ -152,7 +159,7 @@ targets, `validator` and `bot`. In the test contour (`deploy/docker-compose.yml`
 for Telegram egress and dials the gateway bot-link by its internal name. The bot-link
 mTLS material is generated by `deploy/gen-certs.sh`. In prod the bot runs on a separate
 host with native Telegram access and dials the gateway's published bot-link port with
-`PROD_` certificates (the deferred final stage — see `PRERELEASE.md`).
+`PROD_` certificates in production.
 A real end-to-end Telegram smoke needs a BotFather bot, its token, a public HTTPS Mini
 App origin, and the bot container; the unit tests cover the wire format, templates,
@@ -72,6 +72,7 @@ func run(ctx context.Context, cfg config.BotConfig, logger *zap.Logger) error {
 		MiniAppURL:        cfg.MiniAppURL,
 		SendRatePerSecond: cfg.SendRatePerSecond,
 		ChatID:            cfg.ChatID,
 		GameChannelID:     cfg.GameChannelID,
 	}, logger)
 	if err != nil {
 		return err
@@ -33,8 +33,12 @@ type Config struct {
 	SendRatePerSecond int
 	// ChatID is the moderated discussion chat the bot gates write access in; 0
 	// disables chat gating (and the chat_member long-poll subscription). Gating needs
-	// the bot to be an administrator there with the restrict-members right.
+	// the bot to be an administrator there with the restrict-members right. Its public
 	// @username is also resolved at startup for the /start welcome's discussion link.
 	ChatID int64
 	// GameChannelID is the game channel whose public @username the /start welcome links
 	// to (resolved from this id via getChat at startup); 0 omits that follow link.
 	GameChannelID int64
 }
 // EligibilityResolver answers whether the Telegram user identified by externalID
@@ -54,6 +58,13 @@ type Bot struct {
 	limiter *rate.Limiter
 	// chatID is the moderated discussion chat (0 disables gating).
 	chatID int64
 	// channelID is the game channel (0 omits its welcome follow link).
 	channelID int64
 	// channelUsername and chatUsername are the public @usernames (without the leading
 	// @) of the game channel and the discussion chat, resolved once at startup
 	// (resolveWelcomeHandles) for the /start welcome's follow links; "" when unresolved.
 	channelUsername string
 	chatUsername    string
 	// botID is the bot's own Telegram user id (resolved at startup); it skips the
 	// chat_member updates the bot's own restrict actions generate — the grant loop guard.
 	botID int64
@@ -69,7 +80,7 @@ func New(cfg Config, log *zap.Logger) (*Bot, error) {
 	if log == nil {
 		log = zap.NewNop()
 	}
-	t := &Bot{miniAppURL: cfg.MiniAppURL, log: log, chatID: cfg.ChatID}
+	t := &Bot{miniAppURL: cfg.MiniAppURL, log: log, chatID: cfg.ChatID, channelID: cfg.GameChannelID}
 	if cfg.SendRatePerSecond > 0 {
 		t.limiter = rate.NewLimiter(rate.Limit(cfg.SendRatePerSecond), cfg.SendRatePerSecond)
 	}
@@ -123,9 +134,43 @@ func (t *Bot) Run(ctx context.Context) {
 	if t.chatID != 0 {
 		t.logChatAdminStatus(ctx)
 	}
 	t.resolveWelcomeHandles(ctx)
 	t.api.Start(ctx)
 }
 // resolveWelcomeHandles resolves, once at startup, the public @usernames of the game
 // channel and the discussion chat from their configured ids (getChat), caching them for
 // the /start welcome's follow links. It runs before the update loop, so the handles are
 // set before any /start is handled; a chat that is unset, private (no public username)
 // or unreadable simply leaves its handle empty and the welcome omits that follow link.
 func (t *Bot) resolveWelcomeHandles(ctx context.Context) {
 	t.channelUsername = t.resolveUsername(ctx, t.channelID, "game channel")
 	t.chatUsername = t.resolveUsername(ctx, t.chatID, "discussion chat")
 }
 // resolveUsername returns the public @username (without the leading @) of the chat with
 // the given id, or "" when id is 0, the chat has no public username, or getChat fails —
 // logging the reason, since a missing handle silently drops a welcome follow link.
 func (t *Bot) resolveUsername(ctx context.Context, id int64, label string) string {
 	if id == 0 {
 		return ""
 	}
 	chat, err := t.api.GetChat(ctx, &tgbot.GetChatParams{ChatID: id})
 	if err != nil {
 		t.log.Warn("welcome: getChat failed; follow link omitted",
 			zap.String("chat", label), zap.Int64("id", id), zap.Error(err))
 		return ""
 	}
 	if chat.Username == "" {
 		t.log.Warn("welcome: chat has no public @username; follow link omitted",
 			zap.String("chat", label), zap.Int64("id", id))
 		return ""
 	}
 	t.log.Info("welcome: resolved follow link",
 		zap.String("chat", label), zap.String("username", chat.Username))
 	return chat.Username
 }
 // logChatAdminStatus checks, at startup, whether the bot can actually gate the
 // moderated chat — it must be an administrator there with the restrict-members
 // ("Ban users") right, or Telegram delivers no chat_member updates and restricts
@@ -191,11 +236,26 @@ func (t *Bot) handleStart(ctx context.Context, api *tgbot.Bot, update *models.Up
 	if update.Message == nil {
 		return
 	}
 	// Reply only in a private chat: the Mini App launch button is an inline web_app
 	// button, which Telegram permits only in private chats — replying to a group message
 	// (the bot is an admin in the moderated chat and now receives its messages) fails with
 	// BUTTON_TYPE_INVALID. In the group the bot only manages permissions, it never chats.
 	if update.Message.Chat.Type != models.ChatTypePrivate {
 		return
 	}
 	// The sender's Telegram language rides on the message itself (Message.from.language_code
 	// in the Bot API — there is no separate user-update event); fall back to English when it
 	// is absent.
 	lang := ""
 	if update.Message.From != nil {
 		lang = update.Message.From.LanguageCode
 	}
 	text, button := startText(lang, t.channelUsername, t.chatUsername)
 	startParam := startPayload(update.Message.Text)
 	if _, err := api.SendMessage(ctx, &tgbot.SendMessageParams{
 		ChatID:      update.Message.Chat.ID,
-		Text:        "Tap to open Scrabble.",
+		Text:        text,
-		ReplyMarkup: t.launchMarkup("Open Scrabble", startParam),
+		ReplyMarkup: t.launchMarkup(button, startParam),
 	}); err != nil {
 		t.log.Warn("reply to start failed", zap.Error(err))
 	}
--- a/Show More
+++ b/Show More