Merge pull request 'R6: refactor + docs reconciliation + de-staging' (#37 ) from feature/r6-refactor-destage into development

R6: mark phase done in PRERELEASE.md + log refinements
R6(c): centralize shared integration-test fixtures in helpers.go
2026-06-10 16:03:18 +00:00 · 2026-06-10 17:32:30 +02:00 · 2026-06-10 17:30:53 +02:00 · 2026-06-10 17:21:18 +02:00 · 2026-06-10 17:06:25 +02:00 · 2026-06-10 17:02:48 +02:00
320 changed files with 18066 additions and 2750 deletions
@@ -0,0 +1,349 @@
 name: CI
 # Single gated pipeline for the test contour. Gitea cannot express
 # cross-workflow `needs`, so the full test suite and the auto test-deploy live in
 # one workflow.
 #
 # Branch model (CLAUDE.md): feature branches are cut from `development`; a commit
 # to a feature branch triggers nothing. The pipeline runs on a PR into
 # `development` or `master` (the full test suite — the merge gate) and on a push
 # to `development` (after a merge). The deploy job runs only for `development`
 # (PR or merge), so a PR into `master` is test-only; the prod deploy is a manual
 # workflow.
 #
 # Path-conditional jobs: `unit`/`integration`/`ui` run only when their
 # code changed (the `changes` job decides). Because a skipped required check would
 # block a merge under branch protection, the always-running `gate` job aggregates
 # their results and is the ONLY required status check; it passes when every
 # upstream job either succeeded or was skipped.
 #
 # Console output is kept plain (NO_COLOR + `docker compose --ansi never` +
 # `--progress plain`) so the Gitea logs stay readable.
 on:
  pull_request:
    branches: [development, master]
  push:
    branches: [development]
 jobs:
  # changes detects which areas a PR/push touched, so the test jobs can skip when
  # irrelevant. It defaults to running everything when the diff cannot be computed.
  changes:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    outputs:
      go: ${{ steps.filter.outputs.go }}
      ui: ${{ steps.filter.outputs.ui }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Detect changed paths
        id: filter
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            git fetch -q origin "${{ github.base_ref }}" || true
            range="origin/${{ github.base_ref }}...HEAD"
          else
            before="${{ github.event.before }}"
            if [ -z "$before" ] || [ "$before" = "0000000000000000000000000000000000000000" ] || ! git cat-file -e "${before}^{commit}" 2>/dev/null; then
              range="HEAD~1...HEAD"
            else
              range="${before}...HEAD"
            fi
          fi
          echo "comparison range: $range"
          # Default to running everything; narrow only when the diff is computable.
          go=true; ui=true
          files="$(git diff --name-only "$range" 2>/dev/null || echo __DIFF_FAILED__)"
          if [ "$files" != "__DIFF_FAILED__" ]; then
            echo "changed files:"; echo "$files"
            go=false; ui=false
            if echo "$files" | grep -qE '^(backend/|pkg/|gateway/|platform/|loadtest/|go\.work)'; then go=true; fi
            if echo "$files" | grep -qE '^ui/'; then ui=true; fi
            # A workflow or deploy change re-runs everything as a safety net.
            if echo "$files" | grep -qE '^(\.gitea/workflows/|deploy/)'; then go=true; ui=true; fi
          else
            echo "diff failed; running all jobs"
          fi
          echo "selected: go=$go ui=$ui"
          echo "go=$go" >> "$GITHUB_OUTPUT"
          echo "ui=$ui" >> "$GITHUB_OUTPUT"
  unit:
    needs: changes
    if: ${{ needs.changes.outputs.go == 'true' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      # The engine consumes the published scrabble-solver module from this Gitea;
      # GOPRIVATE makes go fetch it directly (skipping the public proxy/checksum DB).
      GOPRIVATE: gitea.iliadenisov.ru/*
      DICT_VERSION: v1.0.0
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Fetch dictionary DAWGs
        run: |
          mkdir -p "${GITHUB_WORKSPACE}/dawg"
          curl -fsSL -o /tmp/dawg.tar.gz "https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/${DICT_VERSION}/scrabble-dawg-${DICT_VERSION}.tar.gz"
          tar xzf /tmp/dawg.tar.gz -C "${GITHUB_WORKSPACE}/dawg"
          ls -la "${GITHUB_WORKSPACE}/dawg"
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.work
          cache: true
      - name: gofmt
        run: |
          unformatted="$(gofmt -l .)"
          if [ -n "$unformatted" ]; then
            echo "gofmt needed on:"; echo "$unformatted"; exit 1
          fi
      - name: vet
        run: go vet ./backend/... ./pkg/... ./gateway/... ./platform/telegram/... ./loadtest/...
      - name: build
        run: go build ./backend/... ./pkg/... ./gateway/... ./platform/telegram/... ./loadtest/...
      - name: test
        env:
          BACKEND_DICT_DIR: ${{ github.workspace }}/dawg
        run: go test -count=1 ./backend/... ./pkg/... ./gateway/... ./platform/telegram/... ./loadtest/...
  integration:
    needs: changes
    if: ${{ needs.changes.outputs.go == 'true' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      # Ryuk (testcontainers' reaper) does not start cleanly on every runner; the
      # suite's TestMain terminates its own container, so disable it.
      TESTCONTAINERS_RYUK_DISABLED: "true"
      GOPRIVATE: gitea.iliadenisov.ru/*
      DICT_VERSION: v1.0.0
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Fetch dictionary DAWGs
        run: |
          mkdir -p "${GITHUB_WORKSPACE}/dawg"
          curl -fsSL -o /tmp/dawg.tar.gz "https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/${DICT_VERSION}/scrabble-dawg-${DICT_VERSION}.tar.gz"
          tar xzf /tmp/dawg.tar.gz -C "${GITHUB_WORKSPACE}/dawg"
          ls -la "${GITHUB_WORKSPACE}/dawg"
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.work
          cache: true
      - name: Integration tests
        # -count=1 disables the cache; -p=1 -parallel=1 keeps the container-backed
        # tests serial; the 15-minute timeout bounds a stuck container pull.
        env:
          BACKEND_DICT_DIR: ${{ github.workspace }}/dawg
        run: go test -tags=integration -count=1 -p=1 -parallel=1 -timeout=15m ./backend/...
  ui:
    needs: changes
    if: ${{ needs.changes.outputs.ui == 'true' }}
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ui
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Install pnpm
        run: npm install -g pnpm@11.0.9
      - name: Install deps
        run: pnpm install --frozen-lockfile
      - name: Type-check
        run: pnpm run check
      - name: Unit tests
        run: pnpm run test:unit
      - name: Build
        run: pnpm run build
      - name: Bundle-size budget
        run: node scripts/bundle-size.mjs
      - name: Install Playwright browsers
        run: pnpm exec playwright install chromium webkit
        timeout-minutes: 5
      - name: E2E smoke (mock)
        run: pnpm run test:e2e
        timeout-minutes: 5
  # gate is the single branch-protection required check. It always runs and passes
  # only when each upstream job succeeded or was skipped (a path-filtered no-op),
  # failing the merge if any actually failed or was cancelled.
  gate:
    needs: [unit, integration, ui]
    if: always()
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    steps:
      - name: Aggregate required checks
        run: |
          fail=
          for r in "unit:${{ needs.unit.result }}" "integration:${{ needs.integration.result }}" "ui:${{ needs.ui.result }}"; do
            name="${r%%:*}"; res="${r#*:}"
            echo "$name = $res"
            case "$res" in
              success|skipped) ;;
              *) echo "::error::$name=$res"; fail=1 ;;
            esac
          done
          [ -z "$fail" ] || { echo "one or more required jobs failed"; exit 1; }
          echo "all required jobs passed or were skipped"
  deploy:
    # Auto test-deploy on a PR into development and on the push that merges it.
    # A PR into master is test-only (this job is skipped); prod deploy is manual.
    # Gates on `gate` (so a real test failure blocks the deploy) but runs even when
    # some test jobs were path-skipped.
    needs: [gate]
    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/development') || (github.event_name == 'pull_request' && github.base_ref == 'development') }}
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      NO_COLOR: "1"
      DOCKER_CLI_HINTS: "false"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Build and (re)deploy the test contour
        working-directory: deploy
        env:
          # Sensitive values -> secrets; non-sensitive -> variables. The compose
          # interpolates these unprefixed names (see deploy/.env.example).
          POSTGRES_PASSWORD: ${{ secrets.TEST_POSTGRES_PASSWORD }}
          AWG_CONF: ${{ secrets.TEST_AWG_CONF }}
          GM_BASICAUTH_HASH: ${{ secrets.TEST_GM_BASICAUTH_HASH }}
          GRAFANA_ADMIN_PASSWORD: ${{ secrets.TEST_GRAFANA_ADMIN_PASSWORD }}
          TELEGRAM_BOT_TOKEN_EN: ${{ secrets.TEST_TELEGRAM_BOT_TOKEN_EN }}
          TELEGRAM_BOT_TOKEN_RU: ${{ secrets.TEST_TELEGRAM_BOT_TOKEN_RU }}
          GM_BASICAUTH_USER: ${{ vars.TEST_GM_BASICAUTH_USER }}
          GRAFANA_ROOT_URL: ${{ vars.TEST_GRAFANA_ROOT_URL }}
          CADDY_SITE_ADDRESS: ${{ vars.TEST_CADDY_SITE_ADDRESS }}
          TELEGRAM_MINIAPP_URL: ${{ vars.TEST_TELEGRAM_MINIAPP_URL }}
          TELEGRAM_GAME_CHANNEL_ID_EN: ${{ vars.TEST_TELEGRAM_GAME_CHANNEL_ID_EN }}
          TELEGRAM_GAME_CHANNEL_ID_RU: ${{ vars.TEST_TELEGRAM_GAME_CHANNEL_ID_RU }}
          # The test contour always uses Telegram's test environment — pinned here,
          # not an operator variable. The prod workflow leaves it false.
          TELEGRAM_TEST_ENV: "true"
          VITE_TELEGRAM_BOT_ID: ${{ vars.TEST_VITE_TELEGRAM_BOT_ID }}
          VITE_TELEGRAM_LINK: ${{ vars.TEST_VITE_TELEGRAM_LINK }}
          VITE_TELEGRAM_GAME_CHANNEL_NAME_EN: ${{ vars.TEST_VITE_TELEGRAM_GAME_CHANNEL_NAME_EN }}
          VITE_TELEGRAM_GAME_CHANNEL_NAME_RU: ${{ vars.TEST_VITE_TELEGRAM_GAME_CHANNEL_NAME_RU }}
          VITE_GATEWAY_URL: ${{ vars.TEST_VITE_GATEWAY_URL }}
          GATEWAY_DEFAULT_SUPPORTED_LANGUAGES: ${{ vars.TEST_GATEWAY_DEFAULT_SUPPORTED_LANGUAGES }}
          # Unset vars render empty -> the compose ":-" defaults apply.
          POSTGRES_DB: ${{ vars.TEST_POSTGRES_DB }}
          POSTGRES_USER: ${{ vars.TEST_POSTGRES_USER }}
          DICT_VERSION: ${{ vars.TEST_DICT_VERSION }}
          LOG_LEVEL: ${{ vars.TEST_LOG_LEVEL }}
        run: |
          # Seed the config files to a stable host path. The runner checks out into
          # an ephemeral act workspace that is removed after the job, which would
          # dangle the compose config bind mounts in the long-lived containers
          # (e.g. Grafana then logs "no such file or directory"). Bind from a stable
          # dir instead (mirrors ../galaxy-game's $HOME/.galaxy-dev/monitoring).
          conf="$HOME/.scrabble-deploy"
          rm -rf "$conf"
          mkdir -p "$conf"
          cp -r caddy otelcol prometheus tempo grafana "$conf"/
          export SCRABBLE_CONFIG_DIR="$conf"
          # App version for the About screen: the git tag if present, else the short SHA
          # (the test checkout is shallow/untagged, so this is the SHA here — fine).
          export APP_VERSION="$(git -C "$GITHUB_WORKSPACE" describe --tags --always 2>/dev/null || echo dev)"
          docker compose --ansi never build --progress plain
          docker compose --ansi never up -d --remove-orphans
          # The config-only services bind-mount the reseeded config dir. A plain `up -d`
          # leaves them on the previous bind mount (the dir was rm'd + recreated), so a
          # changed Caddyfile or Grafana dashboard is ignored — force-recreate them to
          # pick up the fresh config.
          docker compose --ansi never up -d --force-recreate --no-deps caddy otelcol prometheus tempo grafana
      - name: Probe the landing and the gateway through caddy
        run: |
          set -u
          # Two probes through the contour caddy: "/" is the static
          # landing container, "/app/" is the gateway-served SPA shell.
          for i in $(seq 1 20); do
            if docker run --rm --network edge alpine:3.20 wget -q -T 5 -O /dev/null http://scrabble/ &&
               docker run --rm --network edge alpine:3.20 wget -q -T 5 -O /dev/null http://scrabble/app/; then
              echo "healthy: GET http://scrabble/ (landing) + /app/ (gateway)"
              exit 0
            fi
            sleep 3
          done
          echo "probe failed; recent landing + gateway logs:"
          docker logs --tail 50 scrabble-landing || true
          docker logs --tail 50 scrabble-gateway || true
          exit 1
      - name: Probe the Telegram connector liveness
        run: |
          set -u
          # The gateway probe cannot see a crash-looping connector (it long-polls and
          # egresses through the VPN sidecar, with no public ingress). Inspect the
          # container directly: it must be running, not restarting, with a stable
          # restart count. A grace period lets the VPN handshake settle (the connector
          # may restart a few times first).
          sleep 20
          for i in $(seq 1 20); do
            status="$(docker inspect -f '{{.State.Status}}' scrabble-telegram 2>/dev/null || echo missing)"
            restarting="$(docker inspect -f '{{.State.Restarting}}' scrabble-telegram 2>/dev/null || echo true)"
            if [ "$status" = "running" ] && [ "$restarting" = "false" ]; then
              c1="$(docker inspect -f '{{.RestartCount}}' scrabble-telegram)"
              sleep 5
              c2="$(docker inspect -f '{{.RestartCount}}' scrabble-telegram)"
              if [ "$c1" = "$c2" ]; then
                echo "connector healthy: status=$status restarts=$c2"
                exit 0
              fi
              echo "connector still restarting ($c1 -> $c2); waiting"
            fi
            sleep 3
          done
          echo "connector not healthy; recent logs:"
          docker logs --tail 80 scrabble-telegram || true
          exit 1
      - name: Prune dangling images
        if: always()
        run: docker image prune -f
@@ -1,81 +0,0 @@
 name: Tests · Go
 # Fast unit tests for the Go side of the monorepo. Runs on every push and pull
 # request whose path filter matches a Go source directory. The module list
 # grows as new go.work modules (gateway, pkg/*, platform/*) are added by later
 # stages.
 on:
  push:
    paths:
      - 'backend/**'
      - 'gateway/**'
      - 'pkg/**'
      - 'platform/**'
      - 'go.work'
      - 'go.work.sum'
      - '.gitea/workflows/go-unit.yaml'
      - '!**/*.md'
  pull_request:
    paths:
      - 'backend/**'
      - 'gateway/**'
      - 'pkg/**'
      - 'platform/**'
      - 'go.work'
      - 'go.work.sum'
      - '.gitea/workflows/go-unit.yaml'
      - '!**/*.md'
 jobs:
  test:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      # The engine consumes the published scrabble-solver module from this Gitea;
      # GOPRIVATE makes go fetch it directly (skipping the public proxy/checksum DB).
      # DICT_VERSION selects the dictionary DAWG release the engine tests load.
      GOPRIVATE: gitea.iliadenisov.ru/*
      DICT_VERSION: v1.0.0
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Fetch dictionary DAWGs
        # The DAWGs moved to the scrabble-dictionary repo (the solver is now a
        # versioned module pinned in backend/go.mod, fetched via GOPRIVATE — no
        # sibling clone). They ship as a release artifact, one semver per set.
        run: |
          mkdir -p "${GITHUB_WORKSPACE}/dawg"
          curl -fsSL -o /tmp/dawg.tar.gz "https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/${DICT_VERSION}/scrabble-dawg-${DICT_VERSION}.tar.gz"
          tar xzf /tmp/dawg.tar.gz -C "${GITHUB_WORKSPACE}/dawg"
          ls -la "${GITHUB_WORKSPACE}/dawg"
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.work
          cache: true
      - name: gofmt
        run: |
          unformatted="$(gofmt -l .)"
          if [ -n "$unformatted" ]; then
            echo "gofmt needed on:"; echo "$unformatted"; exit 1
          fi
      - name: vet
        run: go vet ./backend/... ./pkg/... ./gateway/... ./platform/telegram/...
      - name: build
        run: go build ./backend/... ./pkg/... ./gateway/... ./platform/telegram/...
      - name: test
        # -count=1 disables the test cache so a green run never depends on a
        # previous runner's cached state. BACKEND_DICT_DIR points the engine
        # tests at the DAWGs fetched from the dictionary release.
        env:
          BACKEND_DICT_DIR: ${{ github.workspace }}/dawg
        run: go test -count=1 ./backend/... ./pkg/... ./gateway/... ./platform/telegram/...
@@ -1,71 +0,0 @@
 name: Tests · Integration
 # Postgres-backed integration tests for the Go backend, gated behind the
 # `integration` build tag. They spin a throwaway postgres:17-alpine container via
 # testcontainers-go, which reaches the host Docker daemon through the socket the
 # Gitea runner exposes. Slower than the unit job (go-unit.yaml); run serially
 # (-p=1) with Ryuk disabled — TestMain terminates its own container. The module
 # list grows as new go.work modules are added by later stages.
 on:
  push:
    paths:
      - 'backend/**'
      - 'pkg/**'
      - 'go.work'
      - 'go.work.sum'
      - '.gitea/workflows/integration.yaml'
      - '!**/*.md'
  pull_request:
    paths:
      - 'backend/**'
      - 'pkg/**'
      - 'go.work'
      - 'go.work.sum'
      - '.gitea/workflows/integration.yaml'
      - '!**/*.md'
 jobs:
  integration:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    env:
      # Ryuk (testcontainers' reaper) does not start cleanly on every runner;
      # the suite's TestMain terminates its own container, so disable it.
      TESTCONTAINERS_RYUK_DISABLED: "true"
      # The engine consumes the published scrabble-solver module from this Gitea
      # (GOPRIVATE -> direct fetch, skipping the public proxy/checksum DB);
      # DICT_VERSION selects the dictionary DAWG release the engine tests load.
      GOPRIVATE: gitea.iliadenisov.ru/*
      DICT_VERSION: v1.0.0
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Fetch dictionary DAWGs
        # The DAWGs moved to the scrabble-dictionary repo (the solver is now a
        # versioned module pinned in backend/go.mod, fetched via GOPRIVATE — no
        # sibling clone). They ship as a release artifact; the engine's untagged
        # tests (compiled here too) load them.
        run: |
          mkdir -p "${GITHUB_WORKSPACE}/dawg"
          curl -fsSL -o /tmp/dawg.tar.gz "https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/${DICT_VERSION}/scrabble-dawg-${DICT_VERSION}.tar.gz"
          tar xzf /tmp/dawg.tar.gz -C "${GITHUB_WORKSPACE}/dawg"
          ls -la "${GITHUB_WORKSPACE}/dawg"
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.work
          cache: true
      - name: Integration tests
        # -count=1 disables the test cache; -p=1 -parallel=1 keeps the
        # container-backed tests serial; the 15-minute timeout bounds a stuck
        # container pull. The engine package's (untagged) tests also compile and
        # run here, so BACKEND_DICT_DIR points them at the DAWGs from the release.
        env:
          BACKEND_DICT_DIR: ${{ github.workspace }}/dawg
        run: go test -tags=integration -count=1 -p=1 -parallel=1 -timeout=15m ./backend/...
@@ -1,67 +0,0 @@
 name: Tests · UI
 # Hermetic UI checks: type-check, Vitest unit tests, production build with a
 # bundle-size budget, and a Playwright smoke (Chromium + WebKit) against the in-memory
 # mock transport (no backend/gateway/Postgres). The committed src/gen/ codegen is built, not
 # regenerated (the same model as the Go committed jet/fbs output).
 on:
  push:
    paths:
      - 'ui/**'
      - '.gitea/workflows/ui-test.yaml'
  pull_request:
    paths:
      - 'ui/**'
      - '.gitea/workflows/ui-test.yaml'
 jobs:
  test:
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: ui
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Install pnpm
        run: npm install -g pnpm@11.0.9
      - name: Install deps
        run: pnpm install --frozen-lockfile
      - name: Type-check
        run: pnpm run check
      - name: Unit tests
        run: pnpm run test:unit
      - name: Build
        run: pnpm run build
      - name: Bundle-size budget
        run: node scripts/bundle-size.mjs
      # The Playwright system libraries are provisioned once on the runner host
      # (`sudo npx playwright@<version> install-deps chromium`), so the job needs no
      # apt and no sudo: it only downloads the browser binaries into the runner cache
      # (persisted by the host executor) and runs the suite. WebKit's Debian build
      # bundles most of its own libraries and runs headless without extra host deps; if
      # a runner ever lacks one, provision it once on the host with
      # `sudo npx playwright install-deps webkit`. The timeouts guard against a future
      # hang. Keep this in lockstep with @playwright/test in package.json — re-run
      # install-deps on the host after a major bump.
      - name: Install Playwright browsers
        run: pnpm exec playwright install chromium webkit
        timeout-minutes: 5
      - name: E2E smoke (mock)
        run: pnpm run test:e2e
        timeout-minutes: 5
@@ -16,3 +16,6 @@
 # Local, unstaged env overrides
 **/.env.local
 **/.env.*.local
 # Claude Code harness runtime artifacts
 .claude/scheduled_tasks.lock
@@ -8,6 +8,8 @@ conversation memory — is the source of continuity. Keep it that way.
 - [`PLAN.md`](PLAN.md) — staged plan + **stage tracker** + per-stage *open
  details to interview*.
 - [`PRERELEASE.md`](PRERELEASE.md) — pre-release hardening tracker (phases R1–R7
  before Stage 18); same per-phase *interview + bake-back* discipline as `PLAN.md`.
 - [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — architecture, transport,
  security, the decision record. Always describes current state.
 - [`docs/FUNCTIONAL.md`](docs/FUNCTIONAL.md) (+ [`_ru`](docs/FUNCTIONAL_ru.md)
@@ -49,9 +51,20 @@ conversation memory — is the source of continuity. Keep it that way.
 ## Branching & CI
- Trunk is **`master`** (owner preference). From Stage 1, work on `feature/*`
+- **Two long-lived branches** (Stage 16 onward): **`development`** is the
-  and merge via PR with a green CI gate. The genesis commit (Stage 0) lands on
+  integration branch; **`master`** is the production trunk. Cut `feature/*`
-  `master` by necessity (an empty branch has nothing to PR into).
+  branches **from `development`** and PR them back into it. (Stages 0–15 used
  `master` as the trunk with `feature/* → master`; the genesis Stage 0 commit is
  on `master` by necessity.)
 - A commit to a `feature/*` branch triggers **nothing**. The single workflow
  `.gitea/workflows/ci.yaml` runs the full suite (`unit` + `integration` + `ui`)
  on a PR into `development` or `master`, and the gated **`deploy`** job auto-rolls
  the **test contour** on a PR into — or a push to — `development`
  (`docker compose up -d --build` on the runner host + a `GET /` probe). A PR into
  `master` is test-only.
 - Merge `development → master` only when CI is green; the **prod** deploy is then a
  **manual** workflow (Stage 18), never automatic. Secrets/variables are prefixed
  `TEST_` / `PROD_` per contour (Gitea 1.26 has no deployment environments).
 - After any push, watch the run to green before declaring a stage done — use the
  ready-made watcher, never an inline poll loop:
  `python3 ~/.claude/bin/gitea-ci-watch.py` (background). It reads `$GITEA_URL`
@@ -113,6 +126,9 @@ backend/                     # module scrabble/backend
 docs/  .gitea/workflows/  PLAN.md  CLAUDE.md  README.md
 gateway/  ui/  pkg/              # added by their stages
 platform/telegram/               # Telegram connector side-service (Stage 9): bot + gRPC API
 loadtest/                        # module scrabble/loadtest: the pre-release stress harness (R2)
 backend/Dockerfile gateway/Dockerfile platform/telegram/Dockerfile loadtest/Dockerfile  # multi-stage distroless (Stage 16; loadtest R2); gateway/Dockerfile also has the `landing` target (R3)
 deploy/                          # docker-compose + caddy + landing + otelcol/prometheus/tempo/grafana (+ cAdvisor/postgres_exporter, R2)
 ```
 ## Build & test
@@ -127,9 +143,15 @@ go run ./backend/cmd/backend    # /healthz, /readyz on :8080
 cd ui && pnpm install && pnpm check && pnpm test:unit && pnpm build  # the UI (Stage 7+)
 pnpm start                      # UI mock mode: lobby -> game, no backend
 docker build -f backend/Dockerfile -t scrabble-backend .   # images (Stage 16); gateway embeds the SPA
 docker build -f gateway/Dockerfile --target gateway -t scrabble-gateway .
 docker build -f gateway/Dockerfile --target landing -t scrabble-landing .  # static landing (R3)
 docker compose -f deploy/docker-compose.yml config         # validate the full contour
 ```
-The `ui` module is a Node project (pnpm), **not** in `go.work`; its CI is
+The `ui` module is a Node project (pnpm), **not** in `go.work`; it is the `ui` job
-`.gitea/workflows/ui-test.yaml`. Committed edge codegen under `ui/src/gen/`
+of the single `.gitea/workflows/ci.yaml` (Stage 16 folded the former go-unit /
 integration / ui-test workflows into it). Committed edge codegen under `ui/src/gen/`
 (regenerate with `pnpm codegen`); pnpm build-script approval lives in
 `ui/pnpm-workspace.yaml` (`allowBuilds: esbuild: true`).
@@ -49,8 +49,9 @@ independent (see ARCHITECTURE §9.1).
 | 13 | Alphabet on the wire (UI alphabet-agnostic) | **done** |
 | 14 | Solver & dictionary split (publish solver + scrabble-dictionary repo/artifact) | **done** |
 | 15 | Dual Telegram bots & language-gated variants | **done** |
-| 16 | Deploy infra & test contour (Dockerfiles, gateway static UI, compose, observability) | todo |
+| 16 | Deploy infra & test contour (Dockerfiles, gateway static UI, compose, observability) | **done** |
-| 17 | Prod contour deploy (SSH export/import, manual after merge) | todo |
+| 17 | Test-contour verification & defect fixes | **done** |
 | 18 | Prod contour deploy (SSH export/import, manual after merge) | todo |
 Scaffolding is incremental: `go.work` lists only existing modules; each stage
 adds the modules it needs.
@@ -244,7 +245,7 @@ indices; the premiums.ts parity-test rework.
 ### Stage 14 — Solver & dictionary split (TODO-1 + TODO-2)
 Re-scoped from the original "CI & deploy": that was several sessions of work, so the
-deploy + observability + the two-bots idea were split into **Stages 15–17** below and this
+deploy + observability + the two-bots idea were split into **Stages 15–18** below and this
 stage took only the dependency/artifact split that everything else builds on. Scope: publish
 `scrabble-solver` as a versioned Gitea module and split the dictionary build into a new
 `scrabble-dictionary` repo delivering a **release artifact**, then make `scrabble-game` consume
@@ -279,7 +280,7 @@ back to `preferred_language`). Non-Telegram logins (web/email/guest) carry the g
 (`GATEWAY_DEFAULT_SUPPORTED_LANGUAGES`, all variants). Admin broadcasts (`SendToUser`/`SendToGameChannel`)
 pick the bot by an **operator-chosen** language in the console — unrelated to `ValidateInitData`.
-### Stage 16 — Deploy infra & test contour
+### Stage 16 — Deploy infra & test contour *(done)*
 Scope: the deploy machinery + the **test contour** (the bulk of the original Stage 14). Backend +
 gateway **Dockerfiles** (multi-stage distroless, mirroring the Stage 9 connector image); the gateway
 gains **static UI serving** — **embedded** via `go:embed` (a node build stage in the gateway image),
@@ -297,15 +298,126 @@ h2c wrap — `/` + `/telegram/` mounts; a committed `dist` placeholder so `go bu
 build); Postgres healthcheck/volume; whether the connector-scoped compose is retired for the root one;
 collector/Tempo/Prometheus retention.
-### Stage 17 — Prod contour deploy
+### Stage 17 — Test-contour verification & defect fixes *(done)*
 Scope: exercise the deployed **test contour** end-to-end and fix the defects it surfaces — the
 "does it actually work in the contour" pass before prod. Bring up the `development` deploy, then
 verify each piece against a real run: the gateway serves the SPA at `/` and `/telegram/`; the admin
 console and Grafana sit behind the single `/_gm` Basic-Auth; the Telegram **bots** start (test
 environment) and the Mini App launches/authenticates; a game can be created and played through (web
 + Mini App); the **observability** stack receives data (Prometheus targets up, the dashboards
 populate incl. `accounts_created_total`/`active_users`, traces reach Tempo); the out-of-app push
 works. Fix the defects found and harden where the run exposes gaps — notably a CI **connector
 liveness check** (the deploy probe only hits the gateway today, so a crash-looping connector is
 invisible — that is how the Stage 16 test-env miss went unnoticed) and **path-conditional CI** (skip
 the jobs whose code did not change, behind a single always-running gate job so branch-protection
 required checks stay satisfiable — a skipped required check otherwise blocks the merge).
 Open details (interview at start): the verification checklist + pass bar; which discovered defects
 are in-scope vs deferred; the changed-paths design + the aggregate gate job; the connector
 liveness-check grace period (the VPN sidecar handshake lets the connector restart a few times before
 it settles).
 #### Found caveats (all resolved in Stage 17 — see *Refinements → Stage 17*)
 The owner's collected caveats below were classified (fix-now / verify-then-fix / discuss),
 discussed where they were forks, and resolved in one session with tests where practical. The
 per-item outcomes are recorded under *Refinements logged during implementation → Stage 17*; the
 raw list is kept here as the record of what the first contour run surfaced.
 - /_gm/grafana/ требует повторного ввода пароля basic auth, хотя до этого я уже зашёл в /_gm/
  Такого быть не должно: графана живёт под /_gm/ и ей не нужен свой auth.
 - нужна ещё метрика "продолжительность хода" - сколько игроки тратят на каждый ход,
  скорее всего, понадобится новое поле last_move_ts если ещё нет, так же нужно будет завести
  метрику в графане как общую, так и и по конкретному пользователю (можно ли? дорого ли?),
  а так же с привязкой к номеру хода и без номера хода. Всё это понадобится для анализа
  способностей игроков, чтобы подогнать под них роботоа. А так же - выявлять читеров.
 - регистрация пользователя из телеграм (как и других коннекторов):
  пытаться очистить имя от посторонних символов, аналогично проверке при вводе имени в профиле.
  если после очистки ничего не осталось, поставить имя Player/Игрок-XXXXX (5 рандомных цифр),
  язык в зависимости от внешнего коннектора.
 - game - chat - nudge. Когда мой ход и я жму nudge, появляется сообщение "сейчас не ваш ход".
  Думаю, опечатка - "не" лишняя, проверь на всех языках.
 - если открыли игру через telegram, надо в настройках вообще полностью скрыть переключатель темы "авто/светлая/темная",
  т.к. тему задаёт сам телеграм (уточни, в какой проперти её можно забрать, и нужно ли, сейчас оно уже нормально работает
  на самих стилях)
 - возможно, к предыдущему пункту: запускаю мини апп на macos/telegram desktop. в самой macos у меня темная тема.
  когда я включаю тему "авто" в настройках mini app, а в самом телеграме - светлую, всё ломается, nav bar и tab bar
  рисуются темным фоном, список игр и меню - светлым, поле игры - тёмное, вокруг него светлоая рамка.
  Провернул тот же трюк на ios - всё чётко, в режиме "авто" он полностью держит ту настройку, которая в
  самом телеграме задана. Проверь, можно ли это починить для desktop-версии тг, скорее всего там
  системные настройки как-то в браузер протекают. Ну если не получится понять причину, тогда и черт с ним.
 - не знаю, ошибка это или by design - если у меня открыта игра сразу в desktop telegram и на ios,
  то когда я делаю ход, в другом окне не обновляется ничего - ни само игровое поле, ни лобби.
  интересно, как ходят уведомления через gateway - по последнему активному push-каналу, что ли?
  если так, стоит ли чинить, чтобы у пользователя все пуш-каналы поддерживались или это дорого?
  нужен твой анализ и совет.
 - надо подкрутить тайминг автоматического хода работа. идея такая: сейчас, насколько я помню, время хода
  выбирается от 2 до 90 минут с перекосом ближе к 2 минутам (поправь если что). я предлагаю этот интервал
  сделать динамическим в зависимости от хода. Например, средяя партия это 25-30 ходов, предположительно.
  На первом ходу интервал должен быть 1..5 минут, на последнем - 10..90 минут, всё так же с перекосом в меньшую сторону.
  А то я сейчас поиграл, роботы на первых ходах по 15 минут думают.
  Сможешь такую хитрую формулу составить? Цифры ориентировочные. Потом после набора реальной статистики подкрутим цифры.
  Заодно напомни, как работает формула "перекоса", можно ли её "заставить" косить почаще в меньшую сторону, как бы имитируя
  активного игрока. Этот пункт требует тщательного обсуждения, пожалуй.
 - при навигации между лобби и игрой есть задержка едва заметная на глаз, думаю, связанная с тем, что UI все данные по игре перезапрашивает
  каждый раз. Кроме этого, когда я в лобби возвращаюсь, глаз ловит перерисовку экрана, довольно быстро, но есть какое-то
  неприятное ощущение, что туда что-то подгружается. А мы можем внутри UI наполнять кэш этими данными и экраны не рисовать
  каждый раз, а просто подменять? не знаю, как это работает, если честно. Но вот информацию по игре, в которую пользователь
  проваливался 1 раз, совершенно точно можно положить в кэш и обновлять его когда с сервера приходит новый ход и т.п.
 - при запуске в telegram, надо бы цвет фона nav bar сделать фоном телеграма, а то он "выпадает" из общего дизайна.
 - а вот фон рекламной строчки под nav bar наоборот, сделать бы чуть светлее (в тёмной теме) или темнее (в светлой),
  чтобы был акцентирован, но не ярко. что-то там есть в стилях телеграма такое готовое?
  ну и для собственного дефолтного стиля тоже надо выбрать соответствующие.
 - Переключаюсь в ios в другое приложение, по возвращении ловлю "проблема соединения, повторяем".
  Вроде бы в телеграм-бандле есть обработчики всяких событий, в том числе background in/out, или как там оно зовётся.
  Посмотри, можно ли что-то с этим сделать? Если да, то именно в случаях когда приложение уходит в фон - не надо рисовать
  плашку с ошибкой, просто молча пытаться соединиться, то есть плашка появится когда приложение на в фоне на следующем retry.
 - при использовании подсказки в игре ато зум ведёт в лево-верх, а не туда, где была поставлена подсказка.
 - В русских партиях нужны русские имена для роботов, но можно вперемешку с латинскими именами, только чтобы латинских имён
  было не больше 20%.
 - Сделать анимацию переходов между экранами: наезд справа если из лобби куда-то переходим и наоборот, уезжание вправо и открытие лобби, когда нажимаем back в навигации.
 - Цвет и размер плашки с игроками над доской: давай сделаем не "кнопками" самих игроков, а просто поделим это пространство
  поровну между игроками, а активного игрока будем показывать за счёт "поднятия" его плашки, за счёт теней слева и справа, чтобы
  остальные игроки были как бы "утоплены" внутрь.
 - В игре клик/тач по плашке с именами игроков открывает/закрывает историю.
 - В истории ходов странное выравнивание колонки со словами, они буквально скачут влево-вправо.
 - В многословных партиях надо в истории показывать основное слово + дополнительное (если это ещё не сделано, надо проверить)
 - При открытии истории нижнюю границу таблицы ("тень") сразу прибивать к доске, а не растягивать вслед за таблицей.
 - Баг. Открыл игру через ru-телеграм бота, пытаюсь сделать "new -> русский" (это скрэбл с русским алфавитом), появляется красная плашка
  "что-то пошло не так". при этом "new -> эрудит" работает. Попробуй посмотреть в логах сейчас, может что-то есть. Или как-то иначе проанализируй, или давай вместе будем смотреть, если не получится.
 ### Stage 18 — Prod contour deploy
 Scope: the **production contour** on a remote host over SSH. Deploy by **container export/import**
 (`docker save` → `scp`/ssh → `docker load` → `docker compose up` on the remote), the SSH key + host IP
-in Gitea secrets; **strictly manual** (`workflow_dispatch`) after a feature branch is merged to
+in Gitea secrets; **strictly manual** (`workflow_dispatch`) after `development` is merged to `master`
-`master`. Two-contour config uses **`TEST_`/`PROD_` secret/variable prefixes** — Gitea 1.26 has no
+(the Stage 16 branch model: `feature/* → development → master`, merge gated green). Two-contour config
-deployment environments (verified: the `environments` API 404s), so a flat prefixed namespace is the
+uses **`TEST_`/`PROD_` secret/variable prefixes** — Gitea 1.26 has no deployment environments (verified:
-convention.
+the `environments` API 404s), so a flat prefixed namespace is the convention.
-Open details (re-interview): export/import vs a registry trade-off; prod domain/TLS at the remote
+Reuses the Stage 16 `deploy/docker-compose.yml` as-is, mapping the **`PROD_`** set onto the same
-caddy; prod VPN; rollback.
+unprefixed compose vars. **No host caddy on prod**, so the contour's own caddy terminates TLS — set
 `CADDY_SITE_ADDRESS` to the prod domain so caddy does its own ACME (the Caddyfile is already
 parameterised for this; the test contour leaves it `:80` behind the host caddy).
 Open details (re-interview): export/import vs a registry trade-off; prod domain/cert source (ACME vs a
 provided cert) at the contour caddy; prod VPN; rollback.
 ## Refinements logged during implementation
@@ -901,7 +1013,7 @@ caddy; prod VPN; rollback.
    CI & deploy (TODO-1, TODO-2, the collector + dashboards). The latter two were written
    into the plan now as the agreed baseline (each still re-interviews at its own start).
    (Stage 14 was itself later re-scoped to the solver/dictionary split alone; deploy +
-    observability + the dual-bot idea split into Stages 15–17.)
+    observability + the dual-bot idea split into Stages 15–18.)
  - **Shared telemetry** (interview): a new `pkg/telemetry` owns the OTel provider
    bootstrap (exporter selection, W3C propagators, shutdown, Go runtime metrics); the
    backend `internal/telemetry` is now a thin facade over it (keeping its gin middleware),
@@ -981,7 +1093,7 @@ caddy; prod VPN; rollback.
 - **Stage 14** (interview + implementation, re-scoped + discharges TODO-1/TODO-2):
  - **Re-scoped to the split** (interview): the original "CI & deploy" was several sessions of work,
    so it was cut to the **solver/dictionary split** (the dependency foundation) and the deploy +
-    observability + the dual-bot idea were written into the plan as new **Stages 15–17**. The deploy
+    observability + the dual-bot idea were written into the plan as new **Stages 15–18**. The deploy
    decisions taken at the interview are recorded there (embed the UI in the gateway via `go:embed`;
    full Collector+Prometheus+Tempo+Grafana stack; **two contours** — test = auto on feature-branch
    push on the local host, prod = manual SSH `docker save`/`load` after merge; `TEST_`/`PROD_` secret
@@ -1036,6 +1148,334 @@ caddy; prod VPN; rollback.
    per-language vars (the full deploy stack is Stage 16). No CI workflow change (the Go and UI workflows
    already span the touched modules).
 - **Stage 16** (interview + implementation):
  - **Branch model reshaped** (interview, supersedes the Stage 0 `feature/* → master`): a long-lived
    **`development`** integration branch + **`master`** as the prod trunk. Feature branches are cut from
    `development`; a feature-branch commit triggers nothing. A single consolidated
    `.gitea/workflows/ci.yaml` (Gitea has no cross-workflow `needs`) runs `unit`+`integration`+`ui` on a PR
    into `development`/`master` and a **gated `deploy`** job (`needs` the three) that auto-rolls the test
    contour **on a PR into — or a push to — `development`** (owner's "и PR, и push"). A PR into `master` is
    test-only; prod is the manual Stage 18. The former `go-unit`/`integration`/`ui-test` workflows were
    folded in (no path filters — full CI on every PR, per the owner). Console kept plain (`NO_COLOR`,
    `docker compose --ansi never`, `--progress plain`).
  - **Gateway serves the UI** (interview, the §13 single-origin): a new `gateway/internal/webui` embeds
    `dist` via `go:embed` (a committed placeholder index so `go build`/CI compile without a UI build) and
    serves the SPA at `/` and `/telegram/` (a path-stripping SPA handler, index.html fallback for the hash
    router), mounted in the edge mux **below** the h2c wrap; `/_gm` stays an explicit 404 when the local
    admin proxy is off so the catch-all does not leak the shell. The `gateway/Dockerfile` node stage builds
    the UI with the `VITE_*` build-args and copies it into the embed dir before `go build`.
  - **Images** (interview): multi-stage distroless `backend/Dockerfile` (a DAWG stage `curl`s the
    `scrabble-dawg` release pinned to `DICT_VERSION`, `GOPRIVATE` fetches the solver) and `gateway/Dockerfile`
    (node UI stage + Go stage), both trimming `go.work` like `platform/telegram/Dockerfile`. Built and
    verified locally.
  - **Contour = caddy-fronted** (interview, "caddy всё равно нужен для https"): a new `caddy` service owns
    a **single `/_gm` Basic-Auth** and routes `/_gm/grafana/*` → Grafana (anonymous-admin + sub-path, no
    own accounts) and the rest of `/_gm/*` → the backend console; everything else → the gateway. This
    **supersedes Stage 10's** gateway-fronts-`/_gm` model **in the deploy topology** (the gateway's own
    `/_gm` proxy stays for a local non-caddy run). TLS: the **host caddy** terminates it for the test
    contour and forwards to `scrabble:80`; the in-compose caddy is parameterised (`CADDY_SITE_ADDRESS`) to
    own ACME on prod (Stage 18) where there is no host caddy.
  - **Networks** (engineering): inter-service traffic on a private `internal` network (project-scoped DNS,
    no name collisions on the shared `edge`); only caddy joins the external `edge` (alias `scrabble`). The
    connector keeps its VPN sidecar (the only egress that needs the tunnel). The connector-scoped
    `platform/telegram/deploy/docker-compose.yml` was **retired** (the root `deploy/docker-compose.yml`
    supersedes it; the connector Dockerfile stays).
  - **Observability stack** (interview): OTel Collector (OTLP/gRPC → a Prometheus scrape endpoint +
    Tempo OTLP) + Prometheus (**15d**) + Tempo (**72h**) + Grafana (provisioned Prometheus+Tempo datasources
    + four dashboards: Service overview, Edge/UX, Game domain, Users; Traces via the Tempo datasource +
    Explore, no fixed panels). The collector's prometheus exporter uses `add_metric_suffixes:false` +
    `resource_to_telemetry_conversion` so the dashboards' PromQL matches the in-code metric names and carries
    `service_name`. The three services export `otlp` in the contour (default stays `none`, so CI needs no
    collector). Loki/logs were left out of scope (container stdout / zap JSON).
  - **User metrics** (interview): a backend `accounts_created_total{kind}` counter (telegram/email/guest;
    robots excluded — they are a provisioned pool, not users) via the Stage-12 `SetMetrics` no-op pattern,
    and a gateway **in-memory** `active_users{window=24h,7d}` observable gauge (distinct authenticated edge
    actors). The owner chose the in-memory gauge over a DB `last_seen_at` (overkill); its single-instance /
    reset-on-restart limits are documented (a live gauge, not billing).
  - **Owner actions before the contour is green** (surfaced, not blockers): set the **`TEST_`** Gitea
    secrets/variables (see `deploy/.env.example`) and add a host-caddy route `<test domain> → scrabble:80`
    on the runner host. CI bootstrap nuance: the first PR introducing `ci.yaml` may first deploy on the
    post-merge push to `development` (depending on whether Gitea runs head/base workflows for a PR), after
    which PR-time deploys work.
  - **Telegram test environment** (post-deploy fix): the connector now selects Telegram's test env with the
    library's native `tgbot.UseTestEnvironment()` (was a `token += "/test"` hack — functionally identical,
    verified, but the option is idiomatic and now has a `bot` test asserting the `/bot<token>/test/getMe`
    path). The test contour **pins `TELEGRAM_TEST_ENV=true` in `ci.yaml`** (the contour is the test
    environment) rather than via a `TEST_`-prefixed variable — removing a confusing double-`TEST` operator
    knob and the secret-vs-variable footgun; prod (Stage 18) leaves it `false`.
 - **Stage 17** (interview + implementation): the test-contour verification pass. The owner's
  collected caveats were classified (fix-now / verify-then-fix / discuss) and resolved in one session.
  - **Russian Scrabble fixed** (#6): the UI sent the variant id `russian` while the backend's canonical
    string (and `StateView`) is `russian_scrabble`, so `lobby.enqueue`/invite returned 400 (confirmed in
    the contour logs). The UI was aligned to `russian_scrabble` (the `Variant` type, `variants.ts`,
    `Lobby.svelte`, mock fixtures, premium/alphabet keys, tests); the backend label is unchanged
    (persisted games, GCG and the `variant` metric attribute keep it).
  - **Nudge message** (#3): `social.ErrNudgeOnOwnTurn` shared the `not_your_turn` result code with
    `game.ErrNotYourTurn`, so nudging on your own turn read "it is not your turn" — backwards. A distinct
    `nudge_own_turn` code + i18n message was added, and the UI disables the nudge control on your own turn.
  - **Connector name sanitization** (#2): `account.ProvisionTelegram` now cleans the platform name to the
    editable display-name format (`sanitizeDisplayName`) and falls back to `Player`/`Игрок-NNNNN` (by
    language) when nothing remains. A new `account.ProvisionRobot` lets system robot names bypass editor
    validation (e.g. "Peter J.").
  - **Robot names** (#5, interview): per-language composed pools — 32 full + 32 colloquial first names
    paired by index, plus a surname pool (gender-agreed for Russian) rendered in three forms (first only /
    first + surname initial / first + full surname), composed deterministically per pool slot (stable
    across restarts). `Pick(variant)` is variant-aware: a Russian game draws Russian names with ≤ ~20%
    Latin, an English game the Latin pool. Robot identities are keyed `robot-<lang>-<index>`.
  - **Robot timing** (#4, interview): the fixed `2 + 88·u^3.5` move delay became move-number-aware — the
    band interpolates from [3,10] min at the first move (raised from [1,5] in round 4, #14) to [10,90] min
    by ~28 moves, right-skewed by k=4, so early moves are quick and the endgame can be long. A daytime
    nudge pulls the reply toward the move's lower band.
  - **Multi-device push** (#7, interview): `emitMove` no longer skips the acting seat, so the mover's own
    other devices (and their lobby) refresh. `opponent_moved` stays in-app only (no out-of-app push to the
    actor), and the gateway already fans each event out to all of a user's live streams.
  - **Move-duration analytics** (#1, interview): a live `game_move_duration{variant,phase}` histogram
    (opening/middle/endgame) + a Grafana panel, plus offline per-user analytics in the admin console —
    min/avg/max columns in the user list and an inline-SVG chart of think-time by the player's move number,
    computed from the journal (`game_moves.created_at` deltas; no schema change). Per-user stays offline,
    not a Prometheus label, to avoid cardinality blow-up; the live histogram aggregates all seats (robots
    included), so the per-human admin view is authoritative.
  - **CI** (#9/#10, interview): `unit`/`integration`/`ui` are path-conditional behind a `changes` job; an
    always-running `gate` job aggregates them (success-or-skipped) and is the single branch-protection
    required check (`CI / gate`), so a skipped job never blocks a merge. The deploy job gained a
    Telegram-connector liveness probe (`docker inspect`: running, not restarting, stable restart count,
    with a VPN-handshake grace period) — closing the Stage 16 blind spot where a crash-looping connector
    was invisible to the gateway-only probe.
  - **UI theming / UX**: inside Telegram the colour scheme is forced from `WebApp.colorScheme` over the OS
    `prefers-color-scheme` (fixes the Telegram Desktop breakage, #12) and the theme switcher is hidden
    (#11); the nav bar takes Telegram's bg and the announcement banner a subtle `--ad-bg` accent (#14/#15);
    the reconnect banner is suppressed while backgrounded and the stream reconnects on return (#16); hint
    zoom scrolls to the placement (#17); the players plaque raises the active seat and sinks the others
    with a tap toggling history (#19/#20); history fixes the word-column jitter and pins its bottom shadow
    to the board (#21/#23); directional screen-slide transitions (#18a); a per-game in-memory cache renders
    instantly on re-entry and refreshes in the background (#13).
  - **Grafana repeated password (#8) — not a server defect**: verified live that caddy challenges `/_gm`
    and `/_gm/grafana` with one identical realm and Grafana serves anonymously, so the repeated prompt is a
    browser Basic-Auth scoping quirk (likely Safari/Desktop), not infra — left for the owner to re-verify,
    no server change. **Multi-word history (#22)** was already implemented (all formed words shown).
  - **Contour-verification follow-ups** (rounds 2–3, from live testing): the Grafana
    double-password was its **Live WebSocket** tripping caddy Basic-Auth — Grafana Live is
    disabled (`GF_LIVE_MAX_CONNECTIONS=0`) and the admin console links to Grafana; the
    move-duration panel was invisible because the deploy reseed (`rm -rf`) left the
    config-only services on a stale bind mount — the deploy now **force-recreates**
    caddy/otelcol/prometheus/tempo/grafana; the **per-user rate limit** was raised 120/40 →
    300/80 and the UI no longer reloads on the echo of its own move; the iOS/Telegram
    reconnect banner gained a resume **grace window** (visibilitychange + pageshow/pagehide
    + Telegram `activated`/`deactivated`); **Telegram Mini Apps polish** was adopted —
    chrome colours (`setHeaderColor`/`setBackgroundColor`/`setBottomBarColor`), native
    **BackButton**, **HapticFeedback**, **closing confirmation** in a game,
    **disableVerticalSwipes**; the players-plaque highlight was inverted so the active seat
    pops; the make-move popover became a direct **✅** with a tab-bar **↩️ Reset**; the hint
    button disables at zero hints; plus **board-only vertical scroll** (#9) and a
    **keyboard-overlay** check-word dialog (#10).
  - **Contour-verification follow-ups** (round 4, from live testing): the robot early-move band was raised
    [1,5] → [3,10] min so openings are less hasty (#14); the **profile** is edited inline (the Edit/Cancel
    toggle is gone, the form is always shown for durable accounts, hint balance stays read-only) and a
    single trailing "." is allowed in display names (#5/#6); a pending tile now recalls by **double-tap**
    or by **dragging it back onto the rack** (single-tap recall removed), and **holding a dragged tile over
    a cell ~1 s auto-zooms** there (#3/#10); **🔀 Shuffle is animated** — tiles hop along a low parabola to
    their new slots, duration scaled by distance, with a haptic shake (#9); a **lines-off board** Settings
    toggle (default off) renders a gapless checkerboard with rounded, right-shadowed tiles, reclaiming
    ~14px of width (#12). **Deferred (discussed):** board **pinch zoom** (#2) — it fights both the native
    scroll and the new one-finger drag-back, so it stays dropped in favour of double-tap + hover-hold zoom;
    **robot win% in the admin game detail** (#16) — needs the seed-derived play-to-win decision exposed
    across the game/robot package boundary, to be picked up when that seam is added.
  - **Contour-verification follow-ups** (round 5, from live testing): **resign on the opponent's turn**
    now works — the engine gained `ResignSeat(seat)` and `game.Resign` bypasses the turn check to forfeit
    the actor's own seat (it no longer returned "not your turn"); **quick-match cancel** was a UI no-op
    (only stopped polling) — added the full path (REST `/lobby/cancel` → gateway → client) and clear the
    matchmaker's pending result on cancel, so a cancelled search is dequeued (no "already queued", no later
    robot-substituted game); **lobby win/loss** ranked by score, so a 0-0 resignation read as a win —
    `result.ts` now places the viewer below the winner (rank ≥ 2), matching the game detail; a **friend
    request to a robot** is accepted as pending and expires like a human ignore (robots no longer set
    `BlockFriendRequests`); the **nudge cooldown** error got its own `nudge_too_soon` code/message and the
    chat button disables for the hour, with the note reworded to "Waiting for your move!". UI polish:
    **even zoom** (interpolate the scroll toward a pre-clamped target as the real width grows/shrinks — no
    lurch-and-snap) that **recentres only on the first zoom-in**; a drag **drop-target highlight**; **pinch
    zoom** (two-finger, preventDefault only on two touches; a second finger aborts a drag); shuffle hop
    capped at **0.3 s** and off under reduce-motion; a **borderless** make-move icon, disabled on a known-
    illegal pending word; **variant display names** (english & russian_scrabble → Scrabble/Скрэббл, erudit
    → Erudite/Эрудит) shown on the create-game controls and the in-game title. **L2 done:** the admin game
    card now shows each robot seat's per-game play-to-win **intent** + the ~40% target and, on the robot's
    turn, its deterministic **next-move ETA**. *Open edge:* a bilingual New Game (both en+ru offered) would
    show two "Scrabble" buttons — left as the owner's chosen naming; disambiguate if it bites.
  - **Contour-verification follow-ups** (round 6, from live testing) — **shipped & deployed:** profile drops
    the hint-balance line; no mobile tap-flash on a board cell (`-webkit-tap-highlight-color`); variant
    display names keyed by the game's **alphabet**, not the UI language (english → "Scrabble",
    russian_scrabble → "Скрэббл", both unlocalized so they never collide; erudit localized), and the in-game
    title shows the variant name; **chat & nudge are mutually exclusive by turn** (message field on your
    turn, nudge on the opponent's, grey "awaiting reply" caption during the cooldown), with chat enforced
    server-side to your own turn (`ErrChatNotYourTurn`); the **nudge cooldown resets** once the player has
    moved or chatted since the last nudge (`game.LastMoveAt` + last chat vs last nudge; the UI mirrors it);
    the **About** screen got localized titles + a rules link + the random/friends sections, and the app
    **version comes from `git describe`** (Vite define `__APP_VERSION__` ← Docker build-arg in the deploy
    step, default "dev"); the **quick-game buttons** became lobby-style plaques — name + flag (🇺🇸/🇷🇺 + a
    bundled minimalist USSR-flag SVG) + a one-line rules summary (bag size, the ё rule, bonus differences
    from the engine rulesets) + the 24h move-limit beneath; two follow-up fixes (pin the nudge right when
    available; redraw the USSR emblem as a thin schematic hammer & sickle); **#3 drag-reorder of rack tiles**
    with a visual gap (the dragged tile lifts out, the rest slide to open a slot; `reorderIndices`
    unit-tested; only with no pending tiles); and the **persistence backend foundation** (#4/#5/#6): a
    `game_drafts` table (migration 00011) + raw-SQL store/service (`GetDraft`/`SaveDraft`) that, on every
    committed move, clears the actor's own draft and resets any opponent's board draft whose cell the play
    overlapped — 5 integration tests.
  - **Stage 17 round 6 — final pass (#4/#5/#6 + #16–20), shipped:**
    1. **Draft persistence — gateway slice + UI (#4/#5/#6, PR #20).** FB `DraftRequest{game_id, json}`
       (save) + `DraftView{json}` (get reuses `GameActionRequest`); the client serializes
       `{rack_order, board_tiles}` itself (no FB tile array), the gateway forwards it as `json.RawMessage`
       both ways (no double-encode), and `GET`/`PUT /games/:id/draft` (a server `draftDTO` ↔ `game.Draft`)
       is the only place that reads the shape. UI: debounced save of the rack order (#4) + board draft (#6)
       and restore on load (`lib/draft.ts`, reconciling against the committed board); **#5** — tiles may be
       arranged on the opponent's turn (placement relaxed; the preview and Make-move stay your-turn-only,
       so an off-turn draft is position-only). Off-turn tiles keep the **existing pending highlight** — no
       caption, no new style (owner's call). The backend draft endpoint is sub-ms.
    2. **Landing + `/app/` move (#16–20, this PR).** One Vite build with **two HTML entries** — the game
       SPA (`index.html`) and a new lightweight landing (`landing.html` → `Landing.svelte`, reusing the
       theme/i18n/`aboutContent` leaf modules, not the app store, so it stays small). The gateway serves the
       **landing at `/`** and the **game SPA at `/app/` and `/telegram/`** (`webui.Handler(stripPrefix,
       indexName)`); relative base keeps one build serving every mount with a shared `dist/assets/` (the
       planned per-target `base` conditional proved unnecessary). **Correction to the original note:** the
       Telegram **Mini App stays at `/telegram/`** — only the plain web app moved off `/` to `/app/`, so
       BotFather is untouched. The landing's "Play in Telegram" link is **per-language** via two new build
       vars `VITE_TELEGRAM_LINK_EN` / `VITE_TELEGRAM_LINK_RU` (test/prod bots differ → no hardcoding; the
       button hides when unset). Logo copied `.claude/telegram-logo.svg` → `ui/public/` (source stays
       untracked).
    - **Edge robustness (folded into the landing PR).** (a) **Static cache headers** — the embedded
      `http.FileServer` over `go:embed` has a zero modtime, so it emitted no validators → the client
      re-downloaded the whole bundle every launch; now hash-named `/assets/*` are `immutable` (a relaunch
      is a cache hit) and the HTML shells are `no-cache`. (b) **Live-stream 15 s abort** — the `Subscribe`
      heartbeat only fired after the first 15 s tick, so the stream sat silent and raced a ~15 s edge idle
      timeout (constant reconnects in the caddy log); now an **immediate heartbeat on open** + a **10 s**
      default interval. Both surfaced while diagnosing a reported "slow load in Telegram" that was actually
      the owner's **external network** (the server is sub-ms end-to-end) — not a regression.
  - **Landing follow-up (owner review pass):** reworked from the first cut — the per-language Telegram
    link var renamed `VITE_TELEGRAM_LINK_EN/_RU` → **`VITE_TELEGRAM_GAME_CHANNEL_NAME_EN/_RU`** (it carries
    a channel **username**, the landing builds `https://t.me/<name>`; the connector keeps the matching
    `..._CHANNEL_ID_..` to post). Switchers became icons — a 🌐 language dropdown (saved, synced to the app)
    and a ☼/☾ theme toggle that is **ephemeral** (follows the system scheme, never persisted, no "auto").
    The "Play in browser" CTA was dropped (no standalone-web onboarding yet).
  - **Game/Telegram review-pass polish:** the USSR flag emblem redrawn (canonical hammer & sickle,
    scaled down ×1.5 below the star, the star itself +25%); touch drag enlarges the drag ghost ×1.5
    (touch only — the finger hides the tile) and suppresses the iOS tap-highlight that lingered on a
    rack tile sliding into a dragged tile's slot; a placed tile can be **dragged to another board
    cell** (it lifts off its origin for the drag, and `touch-action:none` lets the drag win over the
    board pan when zoomed) and the manual-select ring clears when a tile is recalled; and **Telegram
    fullscreen** no longer hides our header under its native nav — the whole header drops below the
    content-safe-area top inset (title and the right-aligned menu both clear the nav), via
    `--tg-content-top` from the SDK + a `tg-fullscreen` class. (Telegram's Mini App SDK exposes no way
    to set the native nav-bar title, move its buttons, or add items to its "⋯" menu, so we keep our
    own header and simply push it clear.)
  - **Lobby sort + in-game friend state (review pass, PR C):** the **my-games** lobby now groups games
    into *your turn* / *opponent's turn* / *finished* (empty sections hidden) and orders them by last
    activity — your-turn oldest-first (the longest-waiting on top), the other two newest-first — in a
    compact, line-separated list (the owner's density pick over bordered cards). `gameDTO` / FB
    `GameView` gained `last_activity_unix` (the turn start while active, the finish time once
    finished). The in-game **"add to friends"** item is now **server-derived** (new `GET
    /user/friends/outgoing` + `friends.outgoing` op, returning the addressees already requested —
    pending **or** declined, which both read as "request sent") so it is correct across reloads, shows
    a disabled **"✓ in friends"** once accepted, and **live-updates** when the opponent answers:
    `RespondFriendRequest` now publishes `friend_added` (accept) / `friend_declined` (a new notify
    sub-kind, decline) to the **original requester**, whose open game re-derives its friend state.
    Owner decisions: a declined request stays "request sent" (non-revealing); an accepted opponent
    reads "✓ in friends"; rack-tile reorder while tiles are placed stays disabled by design.
  - **Admin "Messages" moderation section (#18, PR D):** a new `/_gm/messages` console page lists
    posted chat messages (**nudges excluded**) newest-first — time · **source** (guest / robot /
    oldest identity kind) · sender (→ user card) · IP · body · game (→ game card) — searchable by
    sender name / external-id glob masks and pinnable to one game (`?game=`) or sender (`?user=`),
    linked from the game and user cards. Server-rendered (`adminconsole` `MessagesView` +
    `messages.gohtml`, 50/page via the shared pager); the list query lives in `social` (raw SQL,
    `kind='message'`, the source via a SQL `CASE`), reusing the now-exported `account.LikePattern`
    glob helper. Owner decisions: messages only (no nudges), separate name/ext masks (matching the
    Users section), a top-level nav entry plus the card deep-links.
  - **Round-6 follow-up — UX polish + client-IP fix (this PR):**
    - **Client IP through the edge.** The compose caddy now sets `trusted_proxies static
      private_ranges`, so the real client IP survives the host-caddy hop (it was logging the
      docker-network caddy hop `172.18.0.x` for chat moderation, and bucketing the gateway's
      per-IP rate limiter on it). Correct + spoof-safe in **both** contours (prod has no host
      caddy → public clients untrusted → real peer used). `peerIP` unit-tested.
    - **Ad banner** gated **off** behind a compile-time `SHOW_AD_BANNER=false` in `Screen.svelte`
      — the `{#if}` branch, the `AdBanner` import and `banner.ts` are tree-shaken out of the prod
      bundle (code kept for post-release polish).
    - **Landing** Telegram entry is now just the **64px logo** (clickable, no button/caption).
    - **TG-fullscreen header** reworked again: title + menu are one **centred pair** (hamburger
      right of the title) pinned to the **bottom** of the TG nav band, lining up with Telegram's
      own controls.
    - **Edge-swipe back** (`Screen.svelte`): a left-edge rightward drag navigates to `back`
      (touch/pen only, armed only from ≤24px so it never fights the board's gestures; skipped
      inside Telegram, which has its own back).
    - **Chat + word-check are now their own routed screens** (`/game/:id/chat`,
      `/game/:id/check`, header back to the game, no tab-bar) so the soft keyboard simply resizes
      the **visible viewport** — mirrored into a `--vvh` CSS var the `Screen` height uses, since
      iOS doesn't shrink `dvh` for the keyboard — with the input pinned to the bottom: no modal
      relayout, no page jump (this superseded a first bottom-sheet-`Modal` attempt). New chat
      messages raise an **unread badge** on the in-game hamburger + the Chat menu row (per game,
      cleared on open), mirroring the lobby badge; the chat screen is routable for a future
      Telegram deep-link. The TG-fullscreen header was also finalised over a couple of review
      passes: title + menu as a centred pair inside Telegram's nav band (between `--tg-safe-top`
      and `--tg-content-top`), with a small padding bump so the native controls aren't flush.
    - **Tests backfilled** for the merged round-6 work: e2e for the in-game "✓ in friends" item
      and a board→board tile relocation; codec units for `last_activity_unix` + `OutgoingRequestList`.
    - **Hide finished games (#5, shipped):** a player can remove a finished game from their own
      *my games* list — **per-account, finished-only and irreversible** (the game stays for the
      other players; there is no un-hide). On a finished row a **swipe-left** (touch) or a tap on
      its **kebab ⋮** (the desktop affordance) reveals a **❌** that hides it; active rows carry an
      inert **›** chevron purely to keep the right-edge icons aligned. New table
      `game_hidden(account_id, game_id)` + migration `00012`; `ListGamesForAccount` filters the
      hidden set; `POST /api/v1/user/games/:id/hide` behind the `game.hide` edge op (reusing
      `GameActionRequest` → an `Ack`); the lobby drops the card optimistically and keeps the cache
      in sync. Covered by an integration test (active→`ErrGameActive`, outsider→`ErrNotAPlayer`,
      per-account visibility, idempotent), a gateway transcode test, and a mock e2e (kebab → ❌).
    - **Enriched out-of-app push (#4, shipped):** the "your turn" Telegram notification now names
      the opponent and recaps their last move — voiced as the opponent, `«{name}: my move —
      «WORD». Score 120:95»` for a scoring play, or a short "swapped / passed, your turn" — and a
      new **game-over** notification reports the result + final score when a game ends (any path:
      closing play, all-pass, resign, timeout). Scores are **recipient-first** (the reader's
      score leads), 2- to 4-player (`120:95:80`). `YourTurnEvent` gained `opponent_name`/
      `last_action`/`last_word`/`score_line` (appended, backward-compatible) and a new
      `GameOverEvent` carries `result`/`score_line`; both emit per-recipient from the game commit
      (`emitMove`), join the out-of-app whitelist, and render per language (en/ru) in the Telegram
      connector. The backend resolves the mover's display name (the score line and result are
      built per recipient). Covered by notify round-trip, emit, connector-render (en/ru) and
      routing tests.
    - **No-op drain of all bot updates (#1, investigated — no change):** confirmed the Telegram bot
      already long-polls and the library advances the offset for every delivered update (the default
      handler no-ops anything but `/start`), so the queue never piles up. Telegram withholds only
      `message_reaction` / `message_reaction_count` / `chat_member` by default, and — being
      unrequested — those never queue either. Owner chose to leave `allowed_updates` at the default
      (zero risk) rather than hand-maintain a full whitelist (a wrong/stale type would break
      `getUpdates` entirely); a specific type will be requested when a concrete handler needs it.
    - **Reconnect UX — "Connecting…" + soft-disable (#2, shipped):** connectivity failures became
      **state, not toasts**. A global `online` signal (`lib/connection.svelte.ts`) flips on a
      transport `unavailable` / `rate_limited` (and on the live stream's drop), driving a pure-CSS
      header **spinner + "Connecting…"** in place of the title and softly disabling the in-game
      server actions (commit / exchange / pass / hint; local board/rack/reset stay live). The
      transport (`exec`) **auto-retries with capped backoff** — every op on a rate-limit, **reads
      only** on `unavailable` (mutations are not blindly re-sent; their buttons are disabled while
      offline, so the player re-issues on reconnect — the idempotency caveat the owner accepted). A
      reachability **watcher** (`profile.get` probe) and any successful traffic clear the signal; the
      old red `error.unavailable` toast is gone (the indicator replaces it). A server-data screen
      still **opens with the spinner** and fills on reconnect (global indicator + read auto-retry),
      so navigation is never dead. Pure policy unit-tested (`retry.ts`); a mock-only `window.__conn`
      hook drives a Chromium+WebKit e2e (indicator appears offline, the action disables, both clear
      on reconnect). The visual soft-disable spans the server-action buttons across the app: the
      game bar (commit/exchange/pass/hint/resign), chat send + nudge, profile save / link / merge,
      friends (request/respond/unfriend/block/code), New Game (auto-match + invite) and the lobby
      hide ❌; purely local controls (board/rack/reset, menu, navigation, settings) stay live.
    - **Nudge defects (owner-reported, shipped):** two from a live contour game.
      **(A) Frequency** — the robot's proactive nudge fired hourly for 12 h+ (12 h idle threshold +
      the 1 h cooldown, uncapped). Replaced with a **lengthening, randomized schedule** in the
      robot strategy/driver: the first nudge ~60-90 min into the human's turn, each later gap
      growing toward 1-6 h (the gap is a uniform sample in `[60 min, ceil]`, `ceil` ramping from
      90 min to 6 h over 12 h of idle, measured from the previous nudge), so a long wait gets a
      handful of increasingly-spaced reminders. **(B) Language** — the out-of-app push routed by
      the recipient's **global `service_language`** (last-login-wins), so after re-logging through
      the RU bot an English game's nudges came from the RU bot. Now a game push (your_turn,
      game_over, nudge, match_found) carries the **game's own language** (`engine.Variant.Language`)
      on `push.Event`, and the gateway routes by it (falling back to `service_language` for
      non-game pushes); the New-Game variant-gating guarantees deliverability. Covered by the
      `proactiveNudgeGap` unit test, the retimed `TestRobotProactiveNudge`, `TestVariantLanguage`,
      emit (`your_turn`/`game_over` language) and a `TestNudgeRoutedByGameLanguage` integration test.
 ## Deferred TODOs (cross-stage)
 - ~~**TODO-1 — publish & version the solver.**~~ **Done in Stage 14.** `scrabble-solver` is
@@ -0,0 +1,382 @@
 # Pre-release plan — hardening before Stage 18
 Living tracker for the pre-release hardening pass that runs **before Stage 18** (the
 prod cutover). Same discipline as [`PLAN.md`](PLAN.md): one phase per session,
 **interview the owner on the open details** at the start of each phase, bake every
 decision back into `PLAN.md` / `docs/` / the affected `README`s / Go Doc comments in
 the **same** PR, get CI green, then mark the phase done. Phases run as
 `feature/* → development` PRs (the Stage 16 branch model); the owner approves+merges.
 **Why now:** the system is feature-complete through Stage 17 and the test contour is
 green, but there is **no prod data yet** — schema, wire labels and the dictionary
 layout can still change for free. These phases spend that one-time freedom and harden
 the edge before prod. Each phase maps back to the owner's raw pre-release TODO list
 (numbers in the tracker).
 ## Phase tracker
 | # | Phase | Raw TODOs | Status |
 |---|-------|-----------|--------|
 | R1 | Schema & naming reset | 1 + 10 | **done** |
 | R2 | Stress harness + contour observability + early run | 9a | **done** |
 | R3 | Edge hardening | 2 + 8 + 3 | **done** |
 | R4 | Push enrichment + kill the last poll | 4 + 5 | **done** |
 | R5 | Bundle slimming | 6 | **done** |
 | R6 | Refactor + docs reconciliation + de-staging | 7 | **done** |
 | R7 | Final stress run + tuning | 9b | todo |
 | → | Stage 18 — prod contour deploy | — | see [`PLAN.md`](PLAN.md) |
 ## Key findings (these reshaped the raw list — read before starting a phase)
 - **R1 (TODO 1 + 10) is one cheap moment, now.** Squashing the 12 goose migrations is
  safe precisely because there is no prod data and the contour DB is wiped. Folding the
  new variant labels (`scrabble_ru`/`scrabble_en`/`erudit_ru`) into that single baseline
  makes the rename need **no data migration and no back-compat mapping**. Today's labels
  (`english`/`russian_scrabble`/`erudit`) are persisted in `games.variant`,
  `game_invitations.variant`, in `pkg/fbs` and the UI — ~100 files, but a mechanical sweep
  on a clean DB.
 - **R4 (TODO 4 + 5): the app is already push-first.** Game state refreshes on
  `your_turn`/`opponent_moved`, the lobby on `notify`, chat on `chat_message`. The **only**
  genuine periodic server poll is `lobby.poll` (matchmaking, 2.5 s,
  `ui/src/screens/NewGame.svelte`). What remains is killing that one poll **and** enriching
  push events to carry payloads so the UI stops re-fetching after each signal.
 - **R3 (TODO 2): identity forgery is already mitigated.** Identity is always derived from
  the session (`Authorization: Bearer` → `X-User-ID`); the client cannot inject identity,
  the backend re-validates resource ownership, Telegram initData is HMAC-checked. The real
  gaps are a missing **request-body size limit** (cheap DoS) and **invisible rate-limit
  rejections** (no log/metric/admin view — that is TODO 8). Static landing serving is **not**
  covered by the gateway token bucket (it only guards `Execute`).
 - **R6 (TODO 7) scale:** ~431 `Stage N` references across ~104 files (incl. the file name
  `backend/internal/inttest/stage6_test.go`). Code is the source of truth; `docs/` describe
  current state; `PLAN.md` keeps the decision history.
 ## Locked decisions (owner interview)
 - **Stress test (TODO 9):** **early + final** runs. Driver = **edge protocol** (Connect/FB
  through the gateway, moves generated by the solver) **plus a separate gateway-hammer**
  saturation test. Pacing = **realistic (under limits) + saturation (ramp to the knee)**.
  Resource metrics = **add cAdvisor + postgres_exporter to the contour** (today only
  Go-runtime metrics exist). The harness stays in the repo for repeats.
 - **Push (TODO 4 + 5):** **both** — kill `lobby.poll` (use the existing `match_found`, keep
  poll as the ws-down fallback) **and** enrich push events with payloads.
 - **Refactor (TODO 7):** **hygiene + structural changes by a reviewed list** —
  behaviour-preserving, test-gated, contentious items surfaced to the owner before applying.
 - **Landing (TODO 3):** **separate static container** behind the project caddy
  (`/` → landing, `/app/` + `/telegram/` → gateway); drop `landing.html` from the gateway
  `go:embed`.
 - **Rate-abuse (TODO 8):** metric + Grafana + admin view **plus a conservative auto-flag** —
  a *soft, reversible* "suspected high-rate" marker for operator review, tunable threshold,
  **no auto-ban**.
 ## Phases
 Each phase: read this tracker + the relevant `docs/`, **interview the owner on the open
 details below**, implement within scope, then update the tracker + docs/code and get CI
 green before marking it done.
 ### R1 — Schema & naming reset *(TODO 1 + 10)* — first
 Squash `backend/internal/postgres/migrations/00001..00012` into one `00001_baseline.sql`
 (method: `pg_dump --schema-only` from a fully-migrated DB → wrap as the goose baseline →
 prove a fresh migrate yields a schema identical to the 12-migration chain via the
 integration suite → delete the old files; keep goose). Bake the new variant labels into the
 baseline. Propagate `scrabble_ru`/`scrabble_en`/`erudit_ru` through the backend
 (`engine.Variant`/`ParseVariant`, `registry.dictFiles`, the CHECK values), the wire
 (`pkg/fbs` `variant:string`, regenerate FB) and the UI (`lib/model.ts` union, `variants.ts`,
 fixtures, premium/alphabet keys, tests); i18n display keys stay display-only. Tidy
 `../scrabble-dictionary` to a single source→dawg build point and align the dawg artifact
 names to the new labels (crosses into `../scrabble-solver`'s committed fixtures — keep them
 byte-identical). After merge, **wipe the contour DB** (drop the volume) so it re-provisions
 on the next deploy.
 - Critical files: `backend/internal/postgres/migrations/`,
  `backend/internal/engine/{engine,registry}.go`, `pkg/fbs/scrabble.fbs`,
  `ui/src/lib/{model,variants}.ts`, `../scrabble-dictionary/{Makefile,cmd/builddict,…}`.
 - Open details to interview: the exact dawg filename scheme; whether the dict-repo tidy is
  one PR or split; how to script the contour DB wipe in the deploy.
 ### R2 — Stress harness + contour observability + early run *(TODO 9, part 1)*
 Build the reusable load harness as a new `loadtest` module in `go.work` (reuses `pkg/fbs`,
 `connect-go`, and `scrabble-solver` for legal-move generation): a seeder that inserts
 **1000 guest + 10000 durable** accounts with pre-created sessions (token hashes) directly in
 the DB and hands the plaintext tokens to the client; a driver that runs N virtual users,
 each in 3–5 concurrent 2–4-player games, exercising submit-play / pass / exchange / nudge /
 chat / check-word / draft-move / profile-save through the **edge protocol**, in
 **realistic** (under rate limits) and **saturation** (ramp) modes; plus a separate
 **gateway-hammer** that deliberately exceeds limits to verify the limiter holds and measure
 its cost. Add **cAdvisor + postgres_exporter** to `deploy/docker-compose.yml` and a Grafana
 resource dashboard. Run the **early pass** against the freshly-wiped contour; produce a
 **trip report** (logic/concurrency bugs + a resource baseline) that feeds R3 and R6.
 - Critical files: new `loadtest/`, `deploy/docker-compose.yml`, `deploy/observability/*`,
  `docs/TESTING.md`.
 - Open details: the scale ramp steps; the move-selection policy (a mid-ranked solver move
  for realistic game progress); run duration; the pass/fail bar.
 ### R3 — Edge hardening *(TODO 2 + 8 + 3)*
 Add a **request-body size cap** at the gateway h2c mux / `Execute` (e.g. ~1 MB). Add
 **rate-limit observability**: a `gateway_rate_limited_total{class}` counter + a structured
 log per rejection; an **aggregate** Grafana panel (request rate + rejection rate — spikes
 visible without per-user label cardinality, honouring the Stage 12/17 discipline); an
 **admin-console view** of recently throttled users/IPs (in-memory ring buffer, single-
 instance, reset-on-restart, like the `active_users` gauge). Add the **conservative
 auto-flag**: when a user is *sustained*-throttled past a tunable threshold, set a soft,
 reversible `account.flagged_high_rate_at` marker (baked into the R1 baseline) surfaced in the
 admin user list/detail — **no auto-ban**; the operator clears it. Split the **landing** into
 its own static container (`deploy/` + a Caddyfile route `/` → landing) and drop
 `landing.html` from the gateway `go:embed`.
 - Critical files: `gateway/internal/connectsrv/server.go`, `gateway/internal/ratelimit/`,
  `gateway/internal/connectsrv/metrics.go`, `backend/internal/adminconsole/`,
  `deploy/caddy/Caddyfile`, `deploy/docker-compose.yml`, `gateway/internal/webui/`.
 - Open details: the auto-flag threshold/window + whether the marker is persisted vs
  in-memory; the landing image base (caddy vs nginx).
 ### R4 — Push enrichment + kill the last poll *(TODO 4 + 5)*
 Replace `lobby.poll` with the existing `match_found` push (keep the poll as a ws-down
 fallback). Enrich `your_turn`/`opponent_moved`/`notify` to carry the state payload so the UI
 renders from the event without a follow-up `game.state` (removes the lobby↔game nav latency
 the owner noticed). Wire-contract change: `pkg/fbs` event payloads → backend `notify` emit →
 UI stream consumers (`ui/src/lib/app.svelte.ts`), with the per-game cache as the landing
 spot; regenerate FB.
 - Critical files: `pkg/fbs/scrabble.fbs`, `backend/internal/notify/events.go`,
  `ui/src/lib/{app.svelte,transport}.ts`, `ui/src/screens/NewGame.svelte`.
 - Open details: which events carry full vs delta payloads; the fallback-poll cadence when the
  stream is down.
 ### R5 — Bundle slimming *(TODO 6)* — done
 Analysed the bundle against the 100 KB-gzip budget; **no code slimming was warranted**, and the
 budget metric was retargeted to measure the app correctly. The build already minifies +
 tree-shakes; the dominant cost is the Connect/FlatBuffers transport runtime + generated bindings
 + the Svelte runtime (≈⅔ of `main`'s source is third-party/generated) — irreducible within scope.
 **Lazy-loading was rejected**: `bundle-size.mjs` sums every emitted chunk, so code-splitting yields
 no total-size win and adds request latency (+N gateway fetches on first navigation to a split
 screen). i18n lazy-load was skipped (the catalogs are a sliver of a Svelte-runtime-dominated shared
 chunk, and `en` must stay bundled as the `MessageKey` type source + fallback). Instead,
 `bundle-size.mjs` now measures **per HTML entry**, with three independent gates on the natural chunk
 boundaries — **app entry ≤ 100 KB, the Svelte+i18n shared chunk ≤ 30 KB, the landing's own chunk
 ≤ 5 KB** — since the app's real payload is its entry chunk plus the shared chunk (≈97 KB), while the
 landing (≈24 KB) is reported separately and kept minimal. Same CLI + exit-code contract, so the CI
 step is unchanged.
 - Critical files: `ui/scripts/bundle-size.mjs`; no app code changed.
 ### R6 — Refactor + docs reconciliation + de-staging *(TODO 7)* — done
 Behaviour-preserving only. Three separable, separately-committed passes: (a) mechanical
 **de-staging** — remove `Stage N`/`TODO-N` references from code, comments and service
 READMEs (rename `stage6_test.go`); (b) **docs↔code reconciliation** — reconcile
 `docs/ARCHITECTURE.md` / `docs/FUNCTIONAL.md`(+`_ru`) against the code-as-truth, fixing drift
 and Go Doc comments; (c) **structural changes by a reviewed list** — surface a list of
 proposed optimizations / test-suite consolidations to the owner, apply only the approved,
 behaviour-preserving, test-gated ones. The full suite + the final stress run (R7) are the
 regression gate. Incorporates the early-run (R2) bug fixes not already shipped.
 - Open details: the structural-changes list itself (owner-approved before applying); the test
  consolidation targets.
 ### R7 — Final stress run + tuning *(TODO 9, part 2)* — before Stage 18
 Re-run the R2 harness against the final, refactored system on a clean contour; analyse
 resource consumption across **all** components (gateway, backend, Postgres, the
 metrics/observability stack, docker log volume) and agree the tuning (pool sizes, rate
 limits, cache TTLs, container limits, GOMAXPROCS, log levels). Apply the agreed tuning; record
 the methodology + results in the repo.
 → **Stage 18** (prod contour) then proceeds per [`PLAN.md`](PLAN.md).
 ## Sequencing rationale
 `R1` first (cheapest now; everything builds on the final schema/naming and the stress test
 must run against it). `R2` builds the harness and runs the **early** pass to surface bugs and
 a resource baseline that feed `R3` and `R6`. `R3`/`R4`/`R5` harden and improve the system.
 `R6` (de-stage + reconcile + structural) runs near the end so it sweeps settled code once and
 benefits from all accumulated bug knowledge. `R7` validates the final system and tunes it.
 Then Stage 18.
 ## Regression-safety discipline (cross-cutting)
 - Every phase is a `feature/* → development` PR; CI (`unit` + `integration` + `ui` behind the
  `CI / gate` check) must be green before the owner merges; watch the post-merge contour
  deploy with `gitea-ci-watch.py`.
 - `R6` structural changes are behaviour-preserving, test-gated, and split from the mechanical
  sweeps; contentious items are owner-approved first.
 - The two stress runs (`R2` early, `R7` final) are the system-level regression gate.
 ## Verification (per phase)
 - `go build ./<module>/...`, `go vet`, `gofmt -l .` clean, `go test -count=1 ./<module>/...`;
  UI: `pnpm check && pnpm test:unit && pnpm build`; the integration suite
  (`-tags integration`) for DB/schema changes; `docker compose config` for deploy changes;
  green CI on the PR + a healthy contour deploy.
 - `R1`: prove the squashed baseline yields a schema identical to the 12-migration chain
  (integration suite on a fresh DB) **before** deleting the old files.
 - `R2`/`R7`: the harness runs end-to-end against the contour; the trip report lists concrete
  defects + a resource profile from the Grafana cAdvisor/postgres_exporter panels.
 ## Refinements logged during implementation
 - **R1** (interview + implementation):
  - **Variant labels** `english`/`russian_scrabble`/`erudit` → **`scrabble_en`/`scrabble_ru`/`erudit_ru`**
    across the backend (`engine.Variant.String`/`ParseVariant`; the `games`/`game_invitations` `variant`
    CHECK in the baseline; GCG `#lexicon` and the `variant` metric attribute both flow from `String`),
    the wire (`pkg/fbs` `variant` is a `string` field — values change with **no FlatBuffers regen**) and
    the UI (`model.ts` union, `variants.ts` records, `codec`/`premiums`/mocks/tests, the admin
    `dictionary.gohtml`). **Kept:** the Go enum identifiers (`VariantEnglish`…, internal) and the i18n
    display keys (`new.english`/`new.russian`/`new.erudit`, display-only). `complaints.variant` stays
    free-text (no CHECK, as before).
  - **dawg filenames kept descriptive** (`en_sowpods`/`ru_scrabble`/`ru_erudit`) — only the registry's
    `Variant` key carries the rename, so `registry.go`, the published `scrabble-solver` fixtures and the
    dictionary release artifact are untouched (decouples the three repos).
  - **Migrations squashed** 12 → one hand-written `00001_baseline.sql`. Verified by a
    `pg_dump --schema-only` diff (the chain vs the baseline are **identical** but for the two intended
    variant-CHECK values) plus the green integration suite. **No data migration** (no production data).
  - **Done (cross-repo + contour):** the **`scrabble-dictionary` tidy** merged (PR #2) and was re-cut as
    the **byte-identical `v1.0.1`** release for clean provenance (the backend stays on `v1.0.0` — same
    bytes, no rewire; the backend pulls a version-pinned release artifact, not master). Post-merge the
    contour `backend` schema was wiped (`DROP SCHEMA backend CASCADE` + restart, not a volume drop) and
    re-migrated to the baseline — verified the new variant CHECK (`scrabble_en/scrabble_ru/erudit_ru`),
    `games`=0 and a clean boot.
 - **R2** (interview + implementation):
  - **Locked decisions:** game assembly via **invitations** (real path, no robots; not direct game-row
    inserts); **moderate** ramp **50 → 200 → 500** at 10 min/step; **diagnostic** pass bar (no SLO gate);
    run as a **one-shot container on `scrabble-internal`** in this PR.
  - **Harness** = new `scrabble/loadtest` module (`use ./loadtest` + a `replace scrabble/gateway` for the
    dot-free edge-proto import). It seeds 1000 guest + 10000 durable accounts + sessions **directly in
    Postgres** (token hash mirrors `backend/internal/session`), drives players over the **edge protocol**,
    generates **mid-ranked legal moves locally** with the embedded `scrabble-solver` by replaying
    `game.history` (the edge carries no board — mirrors `engine.ReplayBoard` via the public API), and a
    **gateway-hammer**. Compact CLI (`run` / `cleanup`), distroless Dockerfile (DAWGs baked), Go unit tests.
  - **Adding the module broke the other images' builds** — backend/gateway/telegram Dockerfiles reduce the
    workspace but still referenced `./loadtest` (not in their context); each now also
    `-dropuse=./loadtest` (backend/telegram additionally `-dropreplace` the gateway replace). Caught by the
    first deploy run; verified by building all four images.
  - **Harness payload fixes found by the smoke pass:** the draft DTO's `rack_order` is a string (was sent
    as `[]` → `bad_request`); the display-name validator forbids digits/colons, so the cleanup marker
    became a letters-only `Zzloadtest` so `profile.update` resends the seeded name. `chat_not_your_turn` /
    `nudge_own_turn` are **by-design** turn gates, correctly exercised.
  - **Observability:** added **cAdvisor + postgres_exporter** + the **Scrabble — Resources** dashboard +
    two Prometheus jobs. **Finding:** cAdvisor yields only the root cgroup on the contour host (separate
    XFS `/var/lib/docker` breaks its layer-ID resolution — the existing galaxy deploy has the same limit),
    so per-container CPU/RSS for the early pass was captured via `docker stats`. **R7:** adopt the otelcol
    `docker_stats` receiver (already the contrib image) for per-container metrics in Grafana.
  - **Early run (2026-06-09):** ramped clean to 500 players, no crash/deadlock, cleanup removed all 11000
    accounts. 1.2 M edge calls, 48 870 plays, 2 798 games finished; the per-user limiter held under the
    hammer (99.97 % rejected, p99 2 ms). **Top finding:** ~14 % `transport_error` on `game.state` at 500
    players, under CPU saturation (backend/gateway/Postgres each ~1 core) and amplified by the harness's
    single shared `http2.Transport`; the harness itself peaked at 86 % of a core on the same host, so the
    figures are pessimistic. Full trip report in [`../loadtest/REPORT-R2.md`](../loadtest/REPORT-R2.md);
    it feeds R3 (h2c `MaxConcurrentStreams`/timeouts, body-size cap), R6 and R7 (per-player transports,
    separate hardware, pool/limit sizing).
  - **CI:** `./loadtest/...` added to the path filter + vet/build/test; `go.work.sum` carries the new deps.
 - **R3** (interview + implementation):
  - **Locked decisions:** the flag column lands by **editing the R1 baseline** (+ a contour schema
    wipe after merge — no migration chain accrues before prod); auto-flag defaults **1000 rejected /
    10 min** (`BACKEND_HIGHRATE_FLAG_THRESHOLD`/`_WINDOW`, rolling window, set-once, operator clears,
    no auto-ban); landing image = **caddy:2-alpine**; throttle data flows **gateway → backend** (a
    30 s per-key summary POST to the new `/api/v1/internal/ratelimit/report`, the existing trusted
    direction) with the episode window + flag rule in the backend (`internal/ratewatch`); rejection
    logging = **Warn summary per key per window + Debug per rejection** — a deliberate deviation from
    the phase's "structured log per rejection" (the R2 hammer would have logged ~522k lines in
    minutes); all three R2-report tails included (explicit h2c sizing, the session-resolve failure
    cause at Warn, reviving the admin limiter).
  - **Body cap:** `GATEWAY_MAX_BODY_BYTES` (default 1 MiB) as both the Connect per-message read limit
    and an `http.MaxBytesReader` wrap of the public mux; an oversized Execute is `resource_exhausted`.
  - **Dead config found:** `AdminPerMinute`/`AdminBurst` were never wired — the gateway `/_gm` mount is
    now 429-guarded per IP ahead of its Basic-Auth. The caddy-fronted contour path stays unlimited
    (stock caddy has no limiter) — an accepted gap, recorded in `docs/ARCHITECTURE.md` §12.
  - **Landing split:** a `landing` target in `gateway/Dockerfile` (the UI build stage is shared;
    identical compose build args keep it one cached build); the gateway drops `landing.html` from the
    embed and 308-redirects `/` → `/app/`; the contour caddy routes `/app/`, `/telegram/` and the
    Connect path to the gateway and the catch-all to the landing container; the CI deploy probe now
    checks both `/` (landing) and `/app/` (gateway).
  - **Observability:** `gateway_rate_limited_total{class}` (user/public/email/admin, aggregate-only)
    + a rate-vs-rejections panel on the Edge/UX dashboard; the admin console gains the **Throttled**
    page (the in-memory episode window, reset-on-restart like `active_users`, plus the flagged-account
    queue) and the flag badge / clear action on the user list / card.
  - The jet regen also restored the previously missing `game_drafts`/`game_hidden` generated models
    (their tables were added after the last jetgen run; no behaviour change).
 - **R4** (interview + implementation):
  - **Locked decisions:** **delta-first**, not full snapshots — an event carries only the new move and
    the UI applies it to its per-game cache, keyed on `move_count` (idempotent + gap-safe: a gap or the
    actor's own move falls back to a `game.state` + `game.history` refetch). `match_found` /
    `game_started` carry the recipient's **initial `StateView`** (instant lobby→game); the fallback
    refetch stays the existing two calls (no merged endpoint); the matchmaking poll runs **only while
    the stream is down** (2.5 s); **all** UI-state-changing events carry their payload (incl. lobby `notify`).
  - **Enriched events** (`pkg/fbs` trailing fields — backward-compatible, no FB regen of *values*, only
    the schema): `opponent_moved` (+`move`/`game`/`bag_len`), `your_turn` (+`move_count`), `match_found`
    (+`state`), `game_over` (+`game`), `notify` (+`account`/`invitation`/`state`). The pre-R4
    `opponent_moved` scalars (`seat`/`action`/`score`/`total`) stay for wire back-compat, now redundant
    with `move`/`game` — slated for the R6 de-stage.
  - **Encoding placement:** the `notify` package keeps ownership of the FlatBuffers encoding (a new
    `encode.go` mirrors the gateway transcode but reads wire-agnostic `notify.*` input structs +
    `engine.MoveRecord`); the game/lobby/social services map their domain types to those structs, so the
    wire schema stays out of the domain. **Flagged for R6:** this partly duplicates the gateway encoders
    (different source types) — a candidate consolidation.
  - **Actor self-fetch killed too** (beyond literal "push"): the `submit_play`/`pass`/`exchange`/`resign`
    **response** (`MoveResult`) now returns the actor's refilled rack + bag size, so the mover renders the
    next turn from the response — `Game.svelte`'s `commit`/`pass`/`exchange`/`resign` drop their `await load()`.
  - **`match_found` enrichment** needs a per-seat initial state: `lobby.GameCreator` gained `InitialState`,
    and `game.Service.InitialState` builds the `notify.PlayerState` (rack re-encoded to wire indices, the
    variant alphabet embedded for a first-seen variant).
  - **UI:** a pure `lib/gamedelta.ts` reducer (`applyMoveDelta` / `applyGameOver` / `seedInitialState`,
    unit-tested) advances the cache; `app.svelte` seeds it on `match_found` / `game_started`; `Game.svelte`
    applies the delta (falling back to `load()` while composing, on a gap, or on its own move's new rack);
    `NewGame.svelte` polls only when `app.streamAlive` is false and guards its teardown so a push-delivered
    match is not cancelled.
  - **notify (friends/invitations) scope:** the backend carries the full account / invitation payload on the
    wire (per "all events → push"); the UI seeds the game cache from `game_started` but keeps its lightweight
    **authoritative** badge refresh (`refreshNotifications`, on the rare `notify` event + on foreground) rather
    than adding client-side friend/invitation caches — the per-move hot path is fully de-fetched, which was the
    goal. Deeper lobby-cache consumption is an easy follow-up.
  - **No schema change** (no migration); the contour needs no DB wipe. Tests: `notify` FB round-trips +
    `emitMove` delta + the `gamedelta` reducer; the e2e mock now emits the enriched delta.
 - **R5** (interview + implementation):
  - **No code slimming — by analysis.** A gzip measure + sourcemap attribution of the real `dist` showed
    the app bundle is already minified + tree-shaken and dominated by the Connect/FlatBuffers transport
    runtime + generated FB/PB bindings (≈⅔ of `main`'s source) and the Svelte runtime — all
    third-party/generated, irreducible within R5's scope. App-authored code carries no hand-trimmable fat.
  - **Lazy-load rejected** (screens *and* i18n): `bundle-size.mjs` sums every emitted chunk, so
    code-splitting moves bytes between chunks for **zero total-size win** while adding request latency (+N
    gateway fetches on first navigation to a split screen). i18n lazy-load additionally buys ≤3 KB (en-only
    users) at the cost of an async `t()`, and `en` must stay bundled (it is the `MessageKey` type source +
    fallback). **Chunk-collapsing rejected** too — keeping the near-static Svelte runtime in its own
    cacheable chunk is the recommended practice (an app deploy then re-busts only `main`, not the runtime),
    and HTTP/2 makes the extra preload request negligible.
  - **Metric retargeted to the app.** The two-entry build (`index.html` app + `landing.html`) makes Rollup
    hoist the code shared by both (Svelte runtime + i18n + `aboutContent`) into one preloaded chunk, so the
    app actually loads its entry chunk **+ the shared chunk** (≈74 + ≈23 = **≈97 KB**), never `landing.js`
    (≈1.6 KB). The old script summed all three chunks (98.8 KB), over-counting the app by `landing.js`.
    `bundle-size.mjs` now parses each built HTML for the JS it eagerly loads and gates three parts
    independently — **app entry ≤ 100 KB, shared (Svelte+i18n) ≤ 30 KB, landing-own ≤ 5 KB** — reporting the
    app total (≈97) and landing total (≈24.5). Same CLI + exit-code contract, so the CI step is unchanged.
  - **No app/source/build change** (`App.svelte`, `lib/i18n/`, `vite.config.ts` untouched); no schema
    change, no contour wipe. The stale "~82 KB" figure was corrected in `bundle-size.mjs` and `ui/README.md`.
 - **R6** (interview + implementation):
  - **Locked decisions:** apply **both** wire/code structural changes (**B** + **A**) and **only C1+C2** of
    the test consolidation (not C3/C5); strip the `*(Stage N)*` tags from **all current-state docs**
    (ARCHITECTURE / FUNCTIONAL+`_ru` / TESTING / UI_DESIGN), keeping PLAN.md / PRERELEASE.md / CLAUDE.md as
    history; **split `stage6_test.go`** by domain. The `h2cMaxConcurrentStreams` sizing stays an **R7**
    concern (tuning, not behaviour-preserving); the R2 early run forced no code fix, so nothing was carried in.
  - **(a) De-staging:** removed the `Stage N` / `TODO-N` / `(RN)` references across code, comments, service
    READMEs and the current-state docs, rewording narratives to present tense (no technical content lost).
    Renamed the only stage-named identifiers (`registerStage8`→`registerSocialOps`,
    `registerStage11`→`registerLinkOps`) and split `stage6_test.go` (`TestEmailLoginFlow`→`email_test.go`;
    `TestGuestAutoMatchLeavesNoStats`+`provisionGuest`→`account_test.go`). De-staged the `.fbs`/`.proto`
    comments and regenerated: only the `.proto`-derived Go docstrings (`*_grpc.pb.go`, `push.pb.go`) changed —
    flatc strips schema comments, so the FB Go/TS bindings were untouched.
  - **(b) Reconciliation:** the docs were accurate (each R-phase baked its own); the one drift was a stale
    "guest-reaping deferred (TODO-3)" note in `ARCHITECTURE.md` §3 — guest reaping is implemented, so the
    note was replaced with the current behaviour (FUNCTIONAL/TESTING already described it).
  - **(c) B — dead `opponent_moved` scalars:** removed `seat/action/score/total` from `OpponentMovedEvent`
    (`pkg/fbs/scrabble.fbs` + the `notify` emit + the round-trip test); regenerated FB Go + TS. No reader
    used them (the UI codec/mock take `move`/`game`/`bag_len`; the gateway forwards the payload verbatim).
    A pre-release wire-slot renumber — free with no prod data, no DB change.
  - **(c) A — shared FB builders:** new `scrabble/pkg/wire` holds the single definition of the nested wire
    tables (GameView / MoveRecord / StateView / AccountRef / Invitation) shared by the backend `notify`
    encoder and the gateway `transcode`; both map their own source types to neutral `wire.*` structs and
    delegate. **Honest tradeoff:** the verbose `Start/Add/End` + reverse-prepend boilerplate is now written
    once, but the field *set* is still mapped per side, and the new package makes the change net **+~145 LOC**
    — a single-source / anti-drift win for the fiddly mechanics rather than a line-count cut. Behaviour-
    preserving: the two sides' field sets were verified identical and the round-trip tests pass unchanged.
  - **(c) C1+C2 — inttest fixtures:** moved the cross-file service/game fixtures (`newGameService` was used by
    10 files) into `backend/internal/inttest/helpers.go`; single-file helpers stay local. Pure relocation.
  - **No schema change → no contour DB wipe.** Regression gate: the full unit + integration + UI suites plus
    the R7 stress run.
@@ -8,14 +8,13 @@ supports English Scrabble, Russian Scrabble and Эрудит.
 - **`gateway`** — the only public ingress: anti-abuse, platform authentication
  (resolves the player and injects `X-User-ID`), routing to `backend`, and an
-  admin surface behind Basic Auth. *(added in a later stage)*
+  admin surface behind Basic Auth.
 - **`backend`** — internal-only service that owns every domain concern and
  embeds the [`scrabble-solver`](../scrabble-solver) engine library in-process.
 - **`ui`** — pure-HTML5 client (plain Svelte 5 + TypeScript + Vite) over Connect-RPC
  + FlatBuffers, embeddable in platform webviews and packageable to native via
  Capacitor. See [`ui/README.md`](ui/README.md).
 - **`platform/*`** — per-platform side-services (e.g. the Telegram bot).
  *(added in a later stage)*
 ## Documentation (sources of truth)
@@ -80,3 +79,24 @@ pnpm dev       # against a running gateway (Vite proxies the RPC path to :8081)
 `pnpm check` (type-check), `pnpm test:unit` (Vitest), `pnpm test:e2e` (Playwright
 smoke vs the mock), `pnpm build` (static bundle). Details — including the committed
 edge codegen (`pnpm codegen`) — are in [`ui/README.md`](ui/README.md).
 ## Deploy (`deploy/`)
 The full contour is [`deploy/docker-compose.yml`](deploy/docker-compose.yml):
 `backend` + `gateway` (with the UI embedded via `go:embed`, baked in by its node
 build stage) + Postgres + the Telegram connector (with a VPN sidecar) + an
 observability stack (OTel Collector → Prometheus + Tempo → Grafana) + a front
 **caddy** that owns a single `/_gm` Basic-Auth (admin console + Grafana). The Go
 services build from multi-stage distroless `*/Dockerfile`.
 ```sh
 docker build -f backend/Dockerfile -t scrabble-backend .   # pulls the DAWG release artifact
 docker build -f gateway/Dockerfile -t scrabble-gateway .   # node stage builds + embeds the UI
 docker compose -f deploy/docker-compose.yml config         # validate (needs the TEST_/PROD_ env)
 ```
 CI auto-deploys the **test contour** on a PR into — or push to — `development`
 (`.gitea/workflows/ci.yaml`); the **prod contour** is a manual deploy after
 `development → master`. Env reference: [`deploy/.env.example`](deploy/.env.example);
 the topology and the two-contour model are in
 [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) §13.
@@ -0,0 +1,43 @@
 # Multi-stage build for the backend service. Mirrors platform/telegram/Dockerfile:
 # a golang-alpine builder yields a static binary shipped on distroless nonroot.
 #
 # The dictionary DAWGs are baked in from the scrabble-dictionary release artifact
 # — the same set the Go CI downloads — and BACKEND_DICT_DIR points the
 # binary at them. The published solver module is fetched directly from Gitea
 # (GOPRIVATE), so the build stage needs git and network.
 #
 # Build from the repository root so go.work, go.work.sum, pkg/ and backend/ are all
 # in the Docker context:
 #   docker build -f backend/Dockerfile -t scrabble-backend .
 # --- dictionary artifact -----------------------------------------------------
 FROM alpine:3.20 AS dawg
 ARG DICT_VERSION=v1.0.0
 RUN apk add --no-cache curl tar
 RUN mkdir -p /dawg \
 && curl -fsSL -o /tmp/dawg.tar.gz \
      "https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/${DICT_VERSION}/scrabble-dawg-${DICT_VERSION}.tar.gz" \
 && tar xzf /tmp/dawg.tar.gz -C /dawg
 # --- build -------------------------------------------------------------------
 FROM golang:1.26.3-alpine AS build
 WORKDIR /src
 # git: the published solver module is fetched from Gitea directly (GOPRIVATE).
 RUN apk add --no-cache git
 ENV GOPRIVATE=gitea.iliadenisov.ru/*
 COPY go.work go.work.sum ./
 COPY pkg ./pkg
 COPY backend ./backend
 # Reduce the workspace to what the backend needs: backend + pkg. loadtest and the
 # gateway replace it requires are not in this context, so drop both.
 RUN go work edit -dropuse=./gateway -dropuse=./platform/telegram -dropuse=./loadtest -dropreplace=scrabble/gateway@v0.0.0
 RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/backend ./backend/cmd/backend
 # --- runtime -----------------------------------------------------------------
 FROM gcr.io/distroless/static-debian12:nonroot
 COPY --from=build /out/backend /usr/local/bin/backend
 COPY --from=dawg /dawg /opt/dawg
 ENV BACKEND_DICT_DIR=/opt/dawg
 ENTRYPOINT ["/usr/local/bin/backend"]
@@ -1,24 +1,24 @@
 # backend
 Internal-only domain service for the Scrabble platform (module `scrabble/backend`).
-It owns identity/sessions, accounts, and — in later stages — the lobby, game
+It owns identity/sessions, accounts, the lobby, game runtime, robot, chat, history
-runtime, robot, chat, history and administration. Its only network consumers are
+and administration. Its only network consumers are the `gateway` and the platform
-the `gateway` and the platform side-services; it is never exposed publicly.
+side-services; it is never exposed publicly.
-As of Stage 1 the backend provides the foundation: configuration, the HTTP
+The backend provides the foundation: configuration, the HTTP listener with the
-listener with the `/api/v1` route-group skeleton and probes, the Postgres pool
+`/api/v1` route-group skeleton and probes, the Postgres pool with embedded goose
-with embedded goose migrations, OpenTelemetry wiring, an in-memory session cache,
+migrations, OpenTelemetry wiring, an in-memory session cache, and the durable
-and the durable accounts / identities / sessions data model. The session and
+accounts / identities / sessions data model. The session and account REST
-account REST endpoints are added with the `gateway` (Stage 6); Stage 1 ships the
+endpoints live in the `gateway`; the backend ships the store/service layer they
-store/service layer they will call.
+call.
-Stage 2 adds `internal/engine`, the in-process bridge to the `scrabble-solver`
+`internal/engine` is the in-process bridge to the `scrabble-solver`
 library: a versioned dictionary registry, a deterministic tile bag, and a pure
 rules `Game` (legal plays, passes, exchanges, resignations and end-condition
 detection) that emits dictionary-independent move records. It is a library only;
-the game domain wires it into the process in Stage 3.
+the game domain wires it into the process.
-Stage 3 adds `internal/game`, the game domain over the engine. Active games are
+`internal/game` is the game domain over the engine. Active games are
 event-sourced: a `games` row plus an append-only decoded move journal, with the
 live `engine.Game` kept warm in a cache and rebuilt by replay on a miss. It
 provides create, the play/pass/exchange/resign transitions, an unlimited
@@ -26,10 +26,9 @@ score/legality preview, the hint (per-game allowance plus a profile wallet), the
 word-check tool with complaint capture, per-player game state, history and GCG
 export, per-account statistics on finish, and a background turn-timeout sweeper
 that auto-resigns overdue turns (honouring each player's daily away window). Like
-Stages 1–2 it is a service/store layer; the HTTP surface lands with the
+the engine it is a service/store layer; the HTTP surface lives in the `gateway`.
 `gateway` (Stage 6).
-Stage 4 adds the lobby and social fabric. `internal/lobby` holds an in-memory
+The lobby and social fabric. `internal/lobby` holds an in-memory
 matchmaking pool (FIFO per variant, pairs two humans into an auto-match) and
 friend-game invitations (invite → accept, starting a 2–4 player game once every
 invitee accepts). `internal/social` owns the friend graph (request/accept),
@@ -41,53 +40,54 @@ development log mailer). The engine now also handles **multi-player drop-out**:
 a 3–4 player game a resignation or timeout drops that seat and the rest play on
 (the tile disposition is a per-game setting), the game ending when one active seat
 remains. As before this is a service/store layer — chat and nudges are persisted
-but their live delivery, and all REST endpoints, arrive with the `gateway`
+but their live delivery, and all REST endpoints, live in the `gateway`; the
-(Stage 6); the services are exposed via `Server` accessors for those handlers.
+services are exposed via `Server` accessors for those handlers.
-Stage 5 adds the robot opponent (`internal/robot`). A pool of durable accounts —
+The robot opponent (`internal/robot`). A pool of durable accounts —
 each a `kind='robot'` identity, provisioned at startup with chat and friend
-requests blocked — backs a human-like name pool. A background driver plays the
+requests blocked — backs human-like, per-language composed names. A background driver plays the
 robot's moves through the public game API as an ordinary seated player (so only
 `internal/engine` imports the solver): it decides once per game whether to play to
-win (≈ 40%), targets a small score margin, and times its moves with a right-skewed
+win (≈ 40%), targets a small score margin, and times its moves with a move-number-aware
-delay, a night-sleep window anchored to the opponent's timezone, and nudge
+right-skewed delay (quick openings, long endgames), a night-sleep window anchored to the opponent's timezone, and nudge
 behaviour — all derived deterministically from the game seed, so it keeps no extra
-state. The matchmaker now substitutes a pooled robot after a 10-second wait and
+state. The matchmaker now substitutes a pooled robot (matching the game's language) after a 10-second wait and
-exposes `Poll` so a waiting player can collect the started game (the live
+exposes `Poll` so a waiting player can collect the started game — it is the **stream-down
-match-found notification arrives with the `gateway`).
+fallback**: while the client is streaming, the live match-found push (enriched with the recipient's
 initial game state) drives it instead.
-Stage 6 opens the backend to the edge. The route groups gain their first
+The backend opens to the edge. The route groups gain their first
 handlers (`internal/server/handlers_*.go`): gateway-only session endpoints under
 `/api/v1/internal` (Telegram/guest/email login → mint, resolve, revoke) and a
 slice of authenticated `/api/v1/user` operations (profile, submit play, game
-state, lobby enqueue/poll, chat). Stage 8 fills in the social/account/history
+state, lobby enqueue/poll, chat). The social/account/history operations under
-operations under `/api/v1/user`: `friends/*` (request/respond/cancel/unfriend,
+`/api/v1/user`: `friends/*` (request/respond/cancel/unfriend,
 list/incoming, the one-time `code` issue/redeem), `blocks/*`, `invitations/*`
 (create/accept/decline/cancel/list), `PUT profile`, `email/{request,confirm}`,
-`stats`, and `games/:id/gcg` (finished-only). A new `internal/notify` hub feeds a
+`stats`, and `games/:id/gcg` (finished-only). The `internal/notify` hub feeds a
 second listener — `internal/pushgrpc`, a gRPC server (`BACKEND_GRPC_ADDR`) streaming
 live events (your-turn, opponent-moved, chat, nudge, match-found, notify) to the
-gateway. Stage 9 adds the gateway-only `POST /api/v1/internal/push-target` (a user's
+gateway. The gateway-only `POST /api/v1/internal/push-target` (a user's
-Telegram `external_id`, language and `notifications_in_app_only` flag) that the gateway
+Telegram `external_id`, language and `notifications_in_app_only` flag) lets the gateway
-uses to route out-of-app push to the Telegram connector, extends the Telegram login to
+route out-of-app push to the Telegram connector; the Telegram login
-seed a new account's language and display name from the launch fields, and adds
+seeds a new account's language and display name from the launch fields, and the
-migration `00007` (`accounts.notifications_in_app_only`, default true).
+`accounts.notifications_in_app_only` flag (default true).
-Migration `00005` adds `accounts.is_guest`: an ephemeral guest is a durable row
+`accounts.is_guest` marks an ephemeral guest — a durable row
-with no identity, excluded from statistics. **Stage 10** adds the server-rendered
+with no identity, excluded from statistics. The server-rendered
 **admin console** at `/_gm` (`internal/adminconsole` + `internal/server/handlers_admin_console.go`;
 the gateway fronts it with Basic-Auth and a same-origin guard protects its POSTs), the
-**complaint resolution** lifecycle (migration `00008` adds `disposition`/`resolution_note`/
+**complaint resolution** lifecycle (the `complaints` `disposition`/`resolution_note`/
-`resolved_at`/`applied_in_version` + the `status` CHECK) feeding a dictionary-change
+`resolved_at`/`applied_in_version` columns + the `status` CHECK) feeding a dictionary-change
 pipeline, dictionary **hot-reload** from `BACKEND_DICT_DIR/<version>/`
 (`engine.OpenWithVersions` / `Registry.LoadAvailable`), and operator **broadcasts** via a
 backend Telegram-connector client (`internal/connector`, `BACKEND_CONNECTOR_ADDR`) — each
-broadcast picks the delivering bot by an operator-chosen language. **Stage 15** adds
+broadcast picks the delivering bot by an operator-chosen language. `accounts.service_language`
-migration `00010` (`accounts.service_language`): the language tag of the bot a Telegram
+holds the language tag of the bot a Telegram
 user last signed in through, written on every login and returned by
 `/internal/push-target` (falling back to `preferred_language`) so out-of-app push routes
 to the right bot. The shared wire contracts live in the sibling [`../pkg`](../pkg) module.
-Stage 11 adds **account linking & merge** (`/api/v1/user/link/*`). `internal/link`
+**Account linking & merge** (`/api/v1/user/link/*`). `internal/link`
 orchestrates it: an email confirm-code or a gateway-validated Telegram identity is
 attached to the current account, and when the identity already has its own account
 the two are merged in one transaction (`internal/accountmerge`) — stats and the hint
@@ -96,8 +96,16 @@ friends/blocks de-duplicated, the secondary kept as a `merged_into` tombstone (s
 shared finished game's foreign keys hold); a shared **active** game blocks the merge.
 The current account is primary, except a guest initiator whose linked identity has a
 durable owner — then the durable account wins and a fresh session is minted for it.
-Migration `00009` adds `paid_account`/`merged_into`/`merged_at`. This supersedes the
+The `accounts.paid_account`/`merged_into`/`merged_at` columns back this. This supersedes the
-Stage 8 `email.bind.*` edge surface (the `RequestCode`/`ConfirmCode` primitives stay).
+former `email.bind.*` edge surface (the `RequestCode`/`ConfirmCode` primitives stay).
 Rate-limit observability: the gateway posts its periodic rejection
 summaries to `POST /api/v1/internal/ratelimit/report`; `internal/ratewatch` keeps a
 bounded in-memory episode window for the console's **Throttled** page and applies the
 conservative auto-flag — an account sustaining `BACKEND_HIGHRATE_FLAG_THRESHOLD`
 rejected calls within `BACKEND_HIGHRATE_FLAG_WINDOW` gets the soft, reversible
 `accounts.flagged_high_rate_at` marker (set-once; a badge in the user list and a
 **Clear** action on the user card; never an automatic ban).
 ## Package layout
@@ -110,8 +118,8 @@ internal/postgres/   # pgx-over-database/sql pool (otelsql), goose migrations
  migrations/        #   embedded *.sql (goose), schema `backend`
  jet/               #   generated go-jet models + table builders (committed)
 internal/account/    # durable accounts + platform/email identities (store) + email/identity link primitives
-internal/accountmerge/ # single-transaction merge of a secondary account into a primary (Stage 11)
+internal/accountmerge/ # single-transaction merge of a secondary account into a primary
-internal/link/       # link/merge orchestrator over account + accountmerge + session (Stage 11)
+internal/link/       # link/merge orchestrator over account + accountmerge + session
 internal/session/    # opaque tokens, sessions store, write-through cache, service (incl. RevokeAllForAccount)
 internal/server/     # gin engine, route groups, X-User-ID middleware, probes
 internal/engine/     # in-process scrabble-solver bridge: registry, bag, Game, replay
@@ -121,6 +129,7 @@ internal/lobby/      # in-memory matchmaking pool (+ robot substitution) + frien
 internal/robot/      # human-like robot opponent: account pool, seed-derived strategy, move driver
 internal/adminconsole/ # server-rendered admin console (Go templates + embedded CSS, view models), served at /_gm
 internal/connector/  # backend gRPC client to the Telegram connector (operator broadcasts)
 internal/ratewatch/  # gateway rate-limit reports: episode window for the console + the high-rate auto-flag
 ```
 ## Configuration (environment)
@@ -153,6 +162,8 @@ internal/connector/  # backend gRPC client to the Telegram connector (operator b
 | `BACKEND_CONNECTOR_ADDR` | — | Telegram connector gRPC address for admin-console operator broadcasts. Empty disables broadcasts. |
 | `BACKEND_GUEST_REAP_INTERVAL` | `1h` | How often the abandoned-guest reaper sweeps. |
 | `BACKEND_GUEST_RETENTION` | `720h` | Account age past which a guest with no game seat is deleted. |
 | `BACKEND_HIGHRATE_FLAG_THRESHOLD` | `1000` | Gateway-reported rejected calls within the window past which an account is soft-flagged. |
 | `BACKEND_HIGHRATE_FLAG_WINDOW` | `10m` | The rolling window those rejections accumulate over. |
 ## Run
@@ -176,7 +187,10 @@ warmed.
 ## Migrations & generated code
 Migrations are plain goose SQL under `internal/postgres/migrations` (sequential
-`NNNNN_name.sql`), embedded and applied at startup. After changing the schema,
+`NNNNN_name.sql`), embedded and applied at startup. The incremental history was
 squashed into a single `00001_baseline.sql` before the first production deploy
 (there was no production data); new schema changes append as `00002_*` onward.
 After changing the schema,
 regenerate the committed go-jet code (needs Docker):
 ```sh
@@ -194,9 +208,8 @@ local solver co-development you may add a temporary replace — see `go.work`).
 (`en_sowpods.dawg`, `ru_scrabble.dawg`, `ru_erudit.dawg`) ship as a **release artifact**
 from the [`scrabble-dictionary`](https://gitea.iliadenisov.ru/developer/scrabble-dictionary)
 repo (one semver per set); the engine loads them by `(variant, dict_version)` from
-`BACKEND_DICT_DIR`. Since Stage 3 the backend loads them at startup as a hard dependency
+`BACKEND_DICT_DIR`. The backend loads them at startup as a hard dependency
-(a missing dictionary aborts the boot). See [`../PLAN.md`](../PLAN.md) Stage 14
+(a missing dictionary aborts the boot).
 (TODO-1/TODO-2).
 ## Tests
@@ -28,6 +28,7 @@ import (
 	"scrabble/backend/internal/notify"
 	"scrabble/backend/internal/postgres"
 	"scrabble/backend/internal/pushgrpc"
 	"scrabble/backend/internal/ratewatch"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/server"
 	"scrabble/backend/internal/session"
@@ -107,7 +108,7 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		zap.String("dir", cfg.Game.DictDir),
 		zap.String("version", cfg.Game.DictVersion))
-	// Stage 10 admin console: an optional backend client to the Telegram connector
+	// Admin console: an optional backend client to the Telegram connector
 	// side-service for operator broadcasts. Unset (BACKEND_CONNECTOR_ADDR empty)
 	// leaves broadcasts disabled — the console shows a "not configured" notice.
 	var conn *connector.Client
@@ -132,6 +133,7 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	hub := notify.NewHub(0)
 	accounts := account.NewStore(db)
 	accounts.SetMetrics(tel.MeterProvider().Meter("scrabble/backend/account"))
 	games := game.NewService(game.NewStore(db), accounts, registry, cfg.Game, logger)
 	games.SetNotifier(hub)
 	games.SetMetrics(tel.MeterProvider().Meter("scrabble/backend/game"))
@@ -139,7 +141,7 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	logger.Info("game turn-timeout sweeper started",
 		zap.Duration("interval", cfg.Game.TimeoutSweepInterval))
-	// Stage 12 TODO-3: reap abandoned guest accounts (no game seat, account age past
+	// Reap abandoned guest accounts (no game seat, account age past
 	// the retention window). Dependent rows fall away via ON DELETE CASCADE.
 	guestReaper := account.NewGuestReaper(accounts, cfg.GuestRetention, logger)
 	go guestReaper.Run(ctx, cfg.GuestReapInterval)
@@ -147,19 +149,18 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		zap.Duration("interval", cfg.GuestReapInterval),
 		zap.Duration("retention", cfg.GuestRetention))
-	// Stage 4 lobby & social domains. Their REST and stream surface is added with
+	// Lobby & social domains. Their REST and stream surface lives in the gateway,
-	// the gateway in Stage 6, so they are handed to the server (like the route
+	// so they are handed to the server (like the route groups) for the handlers.
 	// groups) for the handlers to come.
 	mailer := newMailer(cfg.SMTP, logger)
 	emails := account.NewEmailService(accounts, mailer)
-	// Stage 11 account linking & merge: the orchestrator over the account, merge and
+	// Account linking & merge: the orchestrator over the account, merge and
 	// session layers. Wired to the /api/v1/user/link REST surface below.
 	links := link.NewService(emails, accounts, accountmerge.NewMerger(db), sessions)
 	socialSvc := social.NewService(social.NewStore(db), accounts, games)
 	socialSvc.SetNotifier(hub)
 	socialSvc.SetMetrics(tel.MeterProvider().Meter("scrabble/backend/social"))
-	// Stage 5 robot opponent: provision its durable account pool (a hard startup
+	// Robot opponent: provision its durable account pool (a hard startup
 	// dependency, like the dictionaries) and start its move driver. The matchmaker
 	// substitutes a pooled robot for a missing human after the wait window.
 	robots := robot.NewService(games, accounts, socialSvc, tel.MeterProvider().Meter("scrabble/backend/robot"), logger)
@@ -176,6 +177,13 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	invitations.SetNotifier(hub)
 	logger.Info("lobby and social domains ready", zap.Duration("robot_wait", cfg.Lobby.RobotWait))
 	// Rate-limit observability: ingest the gateway's rejection reports for the
 	// admin throttled view and the conservative high-rate auto-flag.
 	rateWatch := ratewatch.New(cfg.RateWatch, accounts, logger)
 	logger.Info("rate watch ready",
 		zap.Int("flag_threshold", cfg.RateWatch.FlagThreshold),
 		zap.Duration("flag_window", cfg.RateWatch.FlagWindow))
 	srv := server.New(cfg.HTTPAddr, server.Deps{
 		Logger:        logger,
 		DB:            db,
@@ -192,6 +200,7 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		Registry:      registry,
 		DictDir:       cfg.Game.DictDir,
 		Connector:     conn,
 		RateWatch:     rateWatch,
 	})
 	pushSrv := pushgrpc.NewServer(cfg.GRPCAddr, hub, logger)
@@ -12,7 +12,6 @@ import (
 	"fmt"
 	"strings"
 	"time"
 	"unicode/utf8"
 	"github.com/go-jet/jet/v2/postgres"
 	"github.com/go-jet/jet/v2/qrm"
@@ -25,8 +24,8 @@ import (
 // Identity kinds recognised by the backend. Email is modelled as an identity
 // alongside platform identities; its confirmed flag is driven by the email
-// confirm-code flow in a later stage. Robot is a synthetic kind: each pooled
+// confirm-code flow. Robot is a synthetic kind: each pooled
-// robot opponent is a durable account bound to one robot identity (Stage 5).
+// robot opponent is a durable account bound to one robot identity.
 const (
 	KindTelegram = "telegram"
 	KindEmail    = "email"
@@ -67,18 +66,23 @@ type Account struct {
 	IsGuest bool
 	// NotificationsInAppOnly confines notifications to the in-app live stream when
 	// true (the default): the platform side-service skips out-of-app push for the
-	// account (Stage 9).
+	// account.
 	NotificationsInAppOnly bool
 	// PaidAccount marks a lifetime one-time-payment account. It is a service field
 	// (no purchase flow yet); an account linking & merge ORs it so a paid status is
-	// never lost when accounts are consolidated (Stage 11).
+	// never lost when accounts are consolidated.
 	PaidAccount bool
 	// MergedInto is the primary account a retired (merged) secondary points at, or
 	// uuid.Nil for a live account. A tombstone keeps the row so the no-cascade
-	// foreign keys of a shared finished game stay valid (Stage 11).
+	// foreign keys of a shared finished game stay valid.
 	MergedInto uuid.UUID
-	CreatedAt  time.Time
+	// FlaggedHighRateAt is the soft, reversible "suspected high-rate" marker: the
-	UpdatedAt  time.Time
+	// zero time for an unflagged account, otherwise when the gateway-reported
 	// rate-limiter rejections first crossed the sustained threshold. An
 	// operator clears it in the admin console; it never gates any request.
 	FlaggedHighRateAt time.Time
 	CreatedAt         time.Time
 	UpdatedAt         time.Time
 }
 // Identity is one of an account's platform/email identities, surfaced on the
@@ -93,12 +97,14 @@ type Identity struct {
 // Store is the Postgres-backed query surface for accounts and identities.
 type Store struct {
-	db *sql.DB
+	db      *sql.DB
 	metrics *accountMetrics
 }
-// NewStore constructs a Store wrapping db.
+// NewStore constructs a Store wrapping db. Metrics default to a no-op meter until
 // SetMetrics installs the real one during startup wiring.
 func NewStore(db *sql.DB) *Store {
-	return &Store{db: db}
+	return &Store{db: db, metrics: defaultAccountMetrics()}
 }
 // ProvisionByIdentity returns the account bound to (kind, externalID), creating
@@ -110,10 +116,43 @@ func (s *Store) ProvisionByIdentity(ctx context.Context, kind, externalID string
 	return s.provision(ctx, kind, externalID, provisionSeed{})
 }
 // ProvisionRobot provisions (or finds) the durable account backing a robot pool
 // member: a KindRobot identity carrying displayName, with chat blocked but friend
 // requests NOT blocked — a request to a robot is accepted as pending and, since the
 // robot never responds, simply expires (friendRequestTTL), exactly mirroring a human
 // who ignores the request. Robot names are system-generated, not player-edited, so they
 // bypass the editable display-name validation and may carry forms the editor rejects (an
 // abbreviated surname like "Peter J."). It is idempotent: repeated calls converge the
 // display name and both block flags.
 func (s *Store) ProvisionRobot(ctx context.Context, externalID, displayName string) (Account, error) {
 	acc, err := s.provision(ctx, KindRobot, externalID, provisionSeed{displayName: displayName})
 	if err != nil {
 		return Account{}, err
 	}
 	if acc.DisplayName == displayName && acc.BlockChat && !acc.BlockFriendRequests {
 		return acc, nil
 	}
 	stmt := table.Accounts.UPDATE(
 		table.Accounts.DisplayName, table.Accounts.BlockChat,
 		table.Accounts.BlockFriendRequests, table.Accounts.UpdatedAt,
 	).SET(
 		postgres.String(displayName), postgres.Bool(true),
 		postgres.Bool(false), postgres.TimestampzT(time.Now().UTC()),
 	).WHERE(table.Accounts.AccountID.EQ(postgres.UUID(acc.ID))).
 		RETURNING(table.Accounts.AllColumns)
 	var row model.Accounts
 	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
 		return Account{}, fmt.Errorf("account: provision robot %q: %w", externalID, err)
 	}
 	return modelToAccount(row), nil
 }
 // ProvisionTelegram provisions (or finds) the account bound to a Telegram
 // identity. On first contact only, it seeds the new account's preferred language
 // from the Telegram client languageCode (when it maps to a supported language) and
-// its display name from firstName (falling back to username); an already-existing
+// its display name sanitized from firstName (falling back to username, then to a
 // generated placeholder when neither yields any letters); an already-existing
 // account is returned unchanged, so a later profile edit is never overwritten.
 func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode, username, firstName string) (Account, error) {
 	return s.provision(ctx, KindTelegram, externalID, telegramSeed(languageCode, username, firstName))
@@ -153,19 +192,21 @@ type provisionSeed struct {
 // telegramSeed derives the create-time seed from Telegram launch fields: a
 // supported preferred language from languageCode (an ISO-639 code, possibly
-// region-tagged like "ru-RU"), and a display name from firstName or, failing that,
+// region-tagged like "ru-RU"), and a display name sanitized from firstName or,
-// username (capped to maxDisplayName runes).
+// failing that, username (sanitizeDisplayName strips disallowed characters to the
 // editable format). When neither yields any letters, it falls back to a generated
 // placeholder in the seeded language (placeholderDisplayName).
 func telegramSeed(languageCode, username, firstName string) provisionSeed {
 	var seed provisionSeed
 	if lang, _, _ := strings.Cut(strings.ToLower(strings.TrimSpace(languageCode)), "-"); lang == "en" || lang == "ru" {
 		seed.preferredLanguage = lang
 	}
-	name := strings.TrimSpace(firstName)
+	name := sanitizeDisplayName(firstName)
 	if name == "" {
-		name = strings.TrimSpace(username)
+		name = sanitizeDisplayName(username)
 	}
-	if utf8.RuneCountInString(name) > maxDisplayName {
+	if name == "" {
-		name = string([]rune(name)[:maxDisplayName])
+		name = placeholderDisplayName(seed.preferredLanguage)
 	}
 	seed.displayName = name
 	return seed
@@ -331,6 +372,11 @@ func (s *Store) create(ctx context.Context, kind, externalID string, seed provis
 	if err != nil {
 		return Account{}, fmt.Errorf("account: create for identity (%s, %s): %w", kind, externalID, err)
 	}
 	// Count genuinely new durable accounts; robots are a fixed provisioned pool,
 	// not users, so they are excluded.
 	if kind != KindRobot {
 		s.metrics.recordCreated(ctx, kind)
 	}
 	return created, nil
 }
@@ -355,6 +401,7 @@ func (s *Store) ProvisionGuest(ctx context.Context) (Account, error) {
 	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
 		return Account{}, fmt.Errorf("account: provision guest: %w", err)
 	}
 	s.metrics.recordCreated(ctx, kindGuest)
 	return modelToAccount(row), nil
 }
@@ -380,6 +427,43 @@ func (s *Store) SpendHint(ctx context.Context, id uuid.UUID) (bool, error) {
 	return n > 0, nil
 }
 // FlagHighRate stamps the soft "suspected high-rate" marker with at, only when
 // the account is not already flagged — the first sustained episode wins, and a
 // re-flag after an operator clear starts a fresh timestamp. An infra marker, not
 // a profile edit, so updated_at is untouched; it never gates any request.
 // It reports whether the flag was newly set.
 func (s *Store) FlagHighRate(ctx context.Context, id uuid.UUID, at time.Time) (bool, error) {
 	stmt := table.Accounts.
 		UPDATE(table.Accounts.FlaggedHighRateAt).
 		SET(postgres.TimestampzT(at.UTC())).
 		WHERE(
 			table.Accounts.AccountID.EQ(postgres.UUID(id)).
 				AND(table.Accounts.FlaggedHighRateAt.IS_NULL()),
 		)
 	res, err := stmt.ExecContext(ctx, s.db)
 	if err != nil {
 		return false, fmt.Errorf("account: flag high rate %s: %w", id, err)
 	}
 	n, err := res.RowsAffected()
 	if err != nil {
 		return false, fmt.Errorf("account: flag high rate rows %s: %w", id, err)
 	}
 	return n > 0, nil
 }
 // ClearHighRateFlag removes the high-rate marker — the operator's reversible
 // action in the admin console. Clearing an unflagged account is a no-op.
 func (s *Store) ClearHighRateFlag(ctx context.Context, id uuid.UUID) error {
 	stmt := table.Accounts.
 		UPDATE(table.Accounts.FlaggedHighRateAt).
 		SET(postgres.NULL).
 		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(id)))
 	if _, err := stmt.ExecContext(ctx, s.db); err != nil {
 		return fmt.Errorf("account: clear high-rate flag %s: %w", id, err)
 	}
 	return nil
 }
 // SetServiceLanguage records the service language (en/ru) of the bot a Telegram
 // user authenticated through. It is called on every Telegram login — new and
 // existing accounts — so it tracks the bot the user last came through (last-login-
@@ -410,6 +494,10 @@ func modelToAccount(row model.Accounts) Account {
 	if row.ServiceLanguage != nil {
 		serviceLanguage = *row.ServiceLanguage
 	}
 	var flaggedHighRateAt time.Time
 	if row.FlaggedHighRateAt != nil {
 		flaggedHighRateAt = *row.FlaggedHighRateAt
 	}
 	return Account{
 		ID:                     row.AccountID,
 		DisplayName:            row.DisplayName,
@@ -425,6 +513,7 @@ func modelToAccount(row model.Accounts) Account {
 		NotificationsInAppOnly: row.NotificationsInAppOnly,
 		PaidAccount:            row.PaidAccount,
 		MergedInto:             mergedInto,
 		FlaggedHighRateAt:      flaggedHighRateAt,
 		CreatedAt:              row.CreatedAt,
 		UpdatedAt:              row.UpdatedAt,
 	}
@@ -33,7 +33,7 @@ var (
 	// ErrInvalidEmail is returned for an unparseable email address.
 	ErrInvalidEmail = errors.New("account: invalid email address")
 	// ErrEmailTaken is returned when the email is already confirmed by another
-	// account; binding it would be a merge, which Stage 11 owns.
+	// account; binding it would be a merge, which the link/merge flow owns.
 	ErrEmailTaken = errors.New("account: email already confirmed by another account")
 	// ErrAlreadyConfirmed is returned when the email is already confirmed by the
 	// requesting account.
@@ -52,8 +52,8 @@ var (
 // Mailer and verifies it, binding a confirmed email identity to the requesting
 // account. Only the SHA-256 hash of a code is stored (never the plaintext),
 // matching the session model. Binding an email already confirmed by a different
-// account is refused (ErrEmailTaken) — merging two accounts is Stage 11 — and
+// account is refused (ErrEmailTaken) — merging two accounts is the link/merge flow —
-// using an email as a login is Stage 6, which reuses this mechanism.
+// and using an email as a login reuses this mechanism.
 type EmailService struct {
 	store  *Store
 	mailer Mailer
@@ -128,7 +128,7 @@ func (s *EmailService) ConfirmCode(ctx context.Context, accountID uuid.UUID, ema
 // RequestLoginCode issues a login confirm-code to the account that owns email,
 // provisioning a fresh (unconfirmed) durable account when the email is new. It is
-// the unauthenticated email-login entry point (Stage 6) and, unlike RequestCode,
+// the unauthenticated email-login entry point and, unlike RequestCode,
 // does not refuse an already-confirmed email — that is the ordinary returning-user
 // login. The code is mailed to the address, so only its real owner can complete
 // the login. It returns the target account id for the subsequent LoginWithCode.
@@ -13,14 +13,14 @@ import (
 )
 // ErrIdentityTaken is returned when a platform identity being linked already
-// belongs to another account; the caller turns it into a merge (Stage 11).
+// belongs to another account; the caller turns it into a merge.
 var ErrIdentityTaken = errors.New("account: identity already linked to another account")
 // RequestLinkCode issues and mails a confirm-code for email to accountID,
 // replacing any prior pending code. Unlike RequestCode it never refuses up front
 // (taken or already-confirmed): possession of the address is the authorization for
 // a later link or merge, and the merge is only revealed once the code is verified,
-// so a probe cannot learn whether an address is registered (Stage 11).
+// so a probe cannot learn whether an address is registered.
 func (s *EmailService) RequestLinkCode(ctx context.Context, accountID uuid.UUID, email string) error {
 	addr, err := normalizeEmail(email)
 	if err != nil {
@@ -94,7 +94,7 @@ func (s *EmailService) verifyPendingCode(ctx context.Context, accountID uuid.UUI
 // AccountIDByIdentity returns the account owning (kind, externalID) and true, or
 // (uuid.Nil, false) when the identity is free. It backs the platform-identity link
-// flow (Stage 11).
+// flow.
 func (s *Store) AccountIDByIdentity(ctx context.Context, kind, externalID string) (uuid.UUID, bool, error) {
 	acc, err := s.findByIdentity(ctx, kind, externalID)
 	if errors.Is(err, ErrNotFound) {
@@ -109,7 +109,7 @@ func (s *Store) AccountIDByIdentity(ctx context.Context, kind, externalID string
 // AttachIdentity links a new (kind, externalID) identity to an existing account.
 // A unique-constraint violation means the identity was taken meanwhile, surfaced
 // as ErrIdentityTaken. It is used to attach a platform identity (e.g. Telegram)
-// to the current account during linking (Stage 11).
+// to the current account during linking.
 func (s *Store) AttachIdentity(ctx context.Context, accountID uuid.UUID, kind, externalID string, confirmed bool) error {
 	id, err := uuid.NewV7()
 	if err != nil {
@@ -129,7 +129,7 @@ func (s *Store) AttachIdentity(ctx context.Context, accountID uuid.UUID, kind, e
 }
 // ClearGuest removes the is_guest flag from accountID, promoting an ephemeral guest
-// to a durable account once it gains its first identity (Stage 11). It is a no-op
+// to a durable account once it gains its first identity. It is a no-op
 // for an already-durable account.
 func (s *Store) ClearGuest(ctx context.Context, accountID uuid.UUID) error {
 	upd := table.Accounts.UPDATE(table.Accounts.IsGuest, table.Accounts.UpdatedAt).
@@ -0,0 +1,53 @@
 package account
 import (
 	"context"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/metric"
 	"go.opentelemetry.io/otel/metric/noop"
 )
 // meterName scopes the account domain's OpenTelemetry instruments.
 const meterName = "scrabble/backend/account"
 // kindGuest labels guest accounts in accounts_created_total. Guests carry no
 // identity, so they have no identity Kind; this is the metric label for them.
 const kindGuest = "guest"
 // accountMetrics holds the account domain's operational instruments. It defaults
 // to no-ops (see defaultAccountMetrics); SetMetrics installs the real meter during
 // startup wiring.
 type accountMetrics struct {
 	created metric.Int64Counter
 }
 // defaultAccountMetrics returns instruments backed by a no-op meter.
 func defaultAccountMetrics() *accountMetrics {
 	return newAccountMetrics(noop.NewMeterProvider().Meter(meterName))
 }
 // newAccountMetrics builds the instruments on meter, falling back to a no-op
 // counter on the (rare) construction error.
 func newAccountMetrics(meter metric.Meter) *accountMetrics {
 	c, err := meter.Int64Counter("accounts_created_total",
 		metric.WithDescription("New accounts created, labelled by kind (telegram/email/guest); robots are not counted."))
 	if err != nil {
 		c, _ = noop.NewMeterProvider().Meter(meterName).Int64Counter("accounts_created_total")
 	}
 	return &accountMetrics{created: c}
 }
 // SetMetrics installs the meter the account store records to. It must be called
 // during startup wiring; the default is a no-op meter.
 func (s *Store) SetMetrics(meter metric.Meter) {
 	if meter == nil {
 		return
 	}
 	s.metrics = newAccountMetrics(meter)
 }
 // recordCreated counts one newly created account of the given kind.
 func (m *accountMetrics) recordCreated(ctx context.Context, kind string) {
 	m.created.Add(ctx, 1, metric.WithAttributes(attribute.String("kind", kind)))
 }
@@ -4,9 +4,11 @@ import (
 	"context"
 	"errors"
 	"fmt"
 	"math/rand/v2"
 	"regexp"
 	"strings"
 	"time"
 	"unicode"
 	"unicode/utf8"
 	"github.com/go-jet/jet/v2/postgres"
@@ -21,14 +23,20 @@ import (
 // is unbounded; auto-provisioned platform names bypass this editor validation).
 const maxDisplayName = 32
 // maxDisplayNameSpecials caps the total special characters (the "." / "_" separators —
 // every name rune that is neither a letter nor a space) an editable display name may
 // carry, so a still-well-formed name cannot be made of mostly punctuation.
 const maxDisplayNameSpecials = 5
 // maxAwayWindow bounds the daily away window's duration (midnight-wrap aware).
 const maxAwayWindow = 12 * time.Hour
-// displayNameRe enforces the editable display-name format (Stage 8): Unicode letters
+// displayNameRe enforces the editable display-name format: Unicode letters
 // joined by single space / "." / "_" separators, where a "." or "_" may be followed
-// by a single space. No leading or trailing separator and no two adjacent separators,
+// by a single space. No leading separator and no two adjacent separators (except
-// except "<dot|underscore> <space>". So "Name_P. Last" is valid, "Name P._Last" is not.
+// "<dot|underscore> <space>"); a single trailing "." is allowed, so
-var displayNameRe = regexp.MustCompile(`^\p{L}+(?:(?:[._] ?| )\p{L}+)*$`)
+// "Name_P. Last" and "Anna B." are valid, "Name P._Last" is not.
 var displayNameRe = regexp.MustCompile(`^\p{L}+(?:(?:[._] ?| )\p{L}+)*\.?$`)
 // ErrInvalidProfile is returned when a profile update carries an unacceptable
 // field (an unknown language, an invalid timezone, or an over-long display name).
@@ -107,9 +115,51 @@ func ValidateDisplayName(raw string) (string, error) {
 	if !displayNameRe.MatchString(name) {
 		return "", fmt.Errorf("%w: display name has an invalid character or layout", ErrInvalidProfile)
 	}
 	specials := 0
 	for _, r := range name {
 		if r != ' ' && !unicode.IsLetter(r) {
 			specials++
 		}
 	}
 	if specials > maxDisplayNameSpecials {
 		return "", fmt.Errorf("%w: display name has more than %d special characters", ErrInvalidProfile, maxDisplayNameSpecials)
 	}
 	return name, nil
 }
 // sanitizeDisplayName best-effort cleans a platform-supplied name (e.g. a Telegram
 // first name) to the editable display-name format: it keeps the maximal runs of
 // Unicode letters and joins them with a single space, dropping every other rune
 // (emoji, digits, punctuation), then caps the result to maxDisplayName runes. The
 // result therefore always satisfies ValidateDisplayName, or is empty when the input
 // carries no letters — in which case the caller substitutes placeholderDisplayName.
 // Mirroring the profile editor's rule means a connector-provisioned name is editable
 // later without first failing validation.
 func sanitizeDisplayName(raw string) string {
 	fields := strings.FieldsFunc(raw, func(r rune) bool { return !unicode.IsLetter(r) })
 	if len(fields) == 0 {
 		return ""
 	}
 	name := strings.Join(fields, " ")
 	if utf8.RuneCountInString(name) > maxDisplayName {
 		name = strings.TrimRight(string([]rune(name)[:maxDisplayName]), " ")
 	}
 	return name
 }
 // placeholderDisplayName builds a fallback display name for a platform account whose
 // supplied name had no usable letters: "Player-NNNNN" for lang "en" (the default) or
 // "Игрок-NNNNN" for "ru", with five random digits. The generated name intentionally
 // carries digits and a hyphen, so it lies outside the editable format and the player
 // is expected to rename it; provisioned names bypass that editor validation.
 func placeholderDisplayName(lang string) string {
 	prefix := "Player"
 	if lang == "ru" {
 		prefix = "Игрок"
 	}
 	return fmt.Sprintf("%s-%05d", prefix, rand.IntN(100000))
 }
 // validateAwayWindow checks that the daily away window's duration, wrapping across
 // midnight, does not exceed maxAwayWindow. A zero-length window (start == end) means
 // "no away time" and is allowed.
@@ -12,7 +12,7 @@ import (
 // TestUpdateProfileValidation checks that bad fields are rejected before any
 // database access, so a nil-backed Store is enough to exercise the guards. It also
-// confirms UpdateProfile wires the Stage 8 validators (name format, away window,
+// confirms UpdateProfile wires the validators (name format, away window,
 // offset/IANA timezone), not just their unit tests in validate_test.go.
 func TestUpdateProfileValidation(t *testing.T) {
 	s := &Store{}
@@ -1,6 +1,7 @@
 package account
 import (
 	"regexp"
 	"strings"
 	"testing"
 	"unicode/utf8"
@@ -8,21 +9,25 @@ import (
 // TestTelegramSeed covers the pure mapping from Telegram launch fields to the
 // create-time account seed: supported-language detection (bare and region-tagged),
-// the first-name / username display-name precedence, and trimming.
+// the first-name / username display-name precedence, and the sanitization that
 // strips disallowed characters (emoji, digits, punctuation) to the editable format.
 func TestTelegramSeed(t *testing.T) {
 	cases := map[string]struct {
 		languageCode, username, firstName string
 		wantLang, wantName                string
 	}{
-		"ru bare":           {"ru", "user", "Иван", "ru", "Иван"},
+		"ru bare":             {"ru", "user", "Иван", "ru", "Иван"},
-		"en region-tagged":  {"en-US", "user", "John", "en", "John"},
+		"en region-tagged":    {"en-US", "user", "John", "en", "John"},
-		"ru region-tagged":  {"ru-RU", "", "Пётр", "ru", "Пётр"},
+		"ru region-tagged":    {"ru-RU", "", "Пётр", "ru", "Пётр"},
-		"unknown language":  {"fr", "frodo", "Frodo", "", "Frodo"},
+		"unknown language":    {"fr", "frodo", "Frodo", "", "Frodo"},
-		"empty language":    {"", "neo", "Neo", "", "Neo"},
+		"empty language":      {"", "neo", "Neo", "", "Neo"},
-		"first name wins":   {"en", "handle", "Real Name", "en", "Real Name"},
+		"first name wins":     {"en", "handle", "Real Name", "en", "Real Name"},
-		"username fallback": {"en", "handle", "", "en", "handle"},
+		"username fallback":   {"en", "handle", "", "en", "handle"},
-		"both empty":        {"en", "", "", "en", ""},
+		"trimmed":             {" RU ", "  ", "  Anna  ", "ru", "Anna"},
-		"trimmed":           {" RU ", "  ", "  Anna  ", "ru", "Anna"},
+		"emoji stripped":      {"en", "user", "🎮Kaya🎮", "en", "Kaya"},
 		"punct to space":      {"en", "user", "John❤Doe", "en", "John Doe"},
 		"digits dropped":      {"ru", "user", "Маша123", "ru", "Маша"},
 		"garbage to username": {"en", "good", "123!@#", "en", "good"},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
@@ -37,6 +42,28 @@ func TestTelegramSeed(t *testing.T) {
 	}
 }
 // TestTelegramSeedPlaceholder checks that a name with no usable letters falls back to
 // a generated placeholder in the seeded language ("Player-NNNNN" / "Игрок-NNNNN").
 func TestTelegramSeedPlaceholder(t *testing.T) {
 	cases := map[string]struct {
 		languageCode, username, firstName string
 		wantRe                            string
 	}{
 		"en empty":     {"en", "", "", `^Player-\d{5}$`},
 		"ru empty":     {"ru", "", "", `^Игрок-\d{5}$`},
 		"default en":   {"fr", "", "", `^Player-\d{5}$`},
 		"both garbage": {"ru", "123", "!!!", `^Игрок-\d{5}$`},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
 			got := telegramSeed(tc.languageCode, tc.username, tc.firstName).displayName
 			if !regexp.MustCompile(tc.wantRe).MatchString(got) {
 				t.Errorf("displayName = %q, want match %s", got, tc.wantRe)
 			}
 		})
 	}
 }
 // TestTelegramSeedTruncatesLongName checks an over-long Telegram name is capped to
 // maxDisplayName runes (counted in runes, not bytes).
 func TestTelegramSeedTruncatesLongName(t *testing.T) {
@@ -7,7 +7,7 @@ import (
 )
 // offsetZoneRe matches a fixed UTC offset like "+03:00" or "-05:30" — the form the
-// Stage 8 profile editor stores (an offset dropdown rather than an IANA name).
+// profile editor stores (an offset dropdown rather than an IANA name).
 var offsetZoneRe = regexp.MustCompile(`^([+-])(\d{2}):(\d{2})$`)
 // parseOffsetZone parses a "±HH:MM" offset into a fixed-offset location, reporting
@@ -0,0 +1,149 @@
 package account
 import (
 	"context"
 	"database/sql"
 	"fmt"
 	"strings"
 	"time"
 	"github.com/google/uuid"
 )
 // UserListItem is the admin user-list projection: a small subset of the account plus
 // whether it is a robot (derived from its identities), so the console can label the kind
 // without a per-row identity query.
 type UserListItem struct {
 	ID                uuid.UUID
 	DisplayName       string
 	PreferredLanguage string
 	IsGuest           bool
 	IsRobot           bool
 	// FlaggedHighRateAt is the soft high-rate marker (zero when unflagged), shown
 	// as a badge in the console list.
 	FlaggedHighRateAt time.Time
 	CreatedAt         time.Time
 }
 // UserFilter narrows the admin user list: Robots selects robot accounts (otherwise the
 // non-robot "people"); NameMask and ExternalIDMask are glob masks ('*' = any run, '?' =
 // one char) matched case-insensitively against the display name / any identity's external
 // id. An empty mask means no filter on that field.
 type UserFilter struct {
 	Robots         bool
 	NameMask       string
 	ExternalIDMask string
 }
 // robotExists is the correlated subquery testing whether account a is a robot.
 const robotExists = `EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.kind = 'robot')`
 // IsRobot reports whether the account is a robot pool member (it carries a robot
 // identity). The admin console uses it to label a game's robot seats.
 func (s *Store) IsRobot(ctx context.Context, accountID uuid.UUID) (bool, error) {
 	var ok bool
 	err := s.db.QueryRowContext(ctx,
 		`SELECT EXISTS (SELECT 1 FROM backend.identities WHERE account_id = $1 AND kind = 'robot')`,
 		accountID).Scan(&ok)
 	if err != nil {
 		return false, fmt.Errorf("account: is-robot %s: %w", accountID, err)
 	}
 	return ok, nil
 }
 // userListWhere builds the shared WHERE clause and its positional args (from $1).
 func userListWhere(f UserFilter) (string, []any) {
 	args := []any{f.Robots}
 	where := robotExists + ` = $1`
 	if name := LikePattern(f.NameMask); name != "" {
 		args = append(args, name)
 		where += fmt.Sprintf(` AND a.display_name ILIKE $%d ESCAPE '\'`, len(args))
 	}
 	if ext := LikePattern(f.ExternalIDMask); ext != "" {
 		args = append(args, ext)
 		where += fmt.Sprintf(` AND EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.external_id ILIKE $%d ESCAPE '\')`, len(args))
 	}
 	return where, args
 }
 // ListUsers returns the filtered admin user list, newest first, paginated.
 func (s *Store) ListUsers(ctx context.Context, f UserFilter, limit, offset int) ([]UserListItem, error) {
 	where, args := userListWhere(f)
 	q := `SELECT a.account_id, a.display_name, a.preferred_language, a.is_guest, a.flagged_high_rate_at, a.created_at, ` + robotExists + ` AS is_robot
 FROM backend.accounts a WHERE ` + where +
 		fmt.Sprintf(` ORDER BY a.created_at DESC LIMIT $%d OFFSET $%d`, len(args)+1, len(args)+2)
 	args = append(args, limit, offset)
 	rows, err := s.db.QueryContext(ctx, q, args...)
 	if err != nil {
 		return nil, fmt.Errorf("account: list users: %w", err)
 	}
 	defer rows.Close()
 	var out []UserListItem
 	for rows.Next() {
 		var it UserListItem
 		var flagged sql.NullTime
 		if err := rows.Scan(&it.ID, &it.DisplayName, &it.PreferredLanguage, &it.IsGuest, &flagged, &it.CreatedAt, &it.IsRobot); err != nil {
 			return nil, fmt.Errorf("account: scan user: %w", err)
 		}
 		if flagged.Valid {
 			it.FlaggedHighRateAt = flagged.Time
 		}
 		out = append(out, it)
 	}
 	return out, rows.Err()
 }
 // FlaggedAccount is one row of the console's high-rate review queue.
 type FlaggedAccount struct {
 	ID                uuid.UUID
 	DisplayName       string
 	FlaggedHighRateAt time.Time
 }
 // flaggedListCap bounds the console's flagged-account list; the operator clears
 // flags as they are reviewed, so the queue stays short in practice.
 const flaggedListCap = 200
 // ListFlaggedHighRate returns the accounts carrying the high-rate flag, most
 // recently flagged first.
 func (s *Store) ListFlaggedHighRate(ctx context.Context) ([]FlaggedAccount, error) {
 	rows, err := s.db.QueryContext(ctx,
 		`SELECT account_id, display_name, flagged_high_rate_at
 FROM backend.accounts WHERE flagged_high_rate_at IS NOT NULL
 ORDER BY flagged_high_rate_at DESC LIMIT $1`, flaggedListCap)
 	if err != nil {
 		return nil, fmt.Errorf("account: list flagged: %w", err)
 	}
 	defer rows.Close()
 	var out []FlaggedAccount
 	for rows.Next() {
 		var fa FlaggedAccount
 		if err := rows.Scan(&fa.ID, &fa.DisplayName, &fa.FlaggedHighRateAt); err != nil {
 			return nil, fmt.Errorf("account: scan flagged: %w", err)
 		}
 		out = append(out, fa)
 	}
 	return out, rows.Err()
 }
 // CountUsers counts the filtered admin user list, for pagination.
 func (s *Store) CountUsers(ctx context.Context, f UserFilter) (int, error) {
 	where, args := userListWhere(f)
 	var n int
 	if err := s.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM backend.accounts a WHERE `+where, args...).Scan(&n); err != nil {
 		return 0, fmt.Errorf("account: count users: %w", err)
 	}
 	return n, nil
 }
 // LikePattern converts a glob mask ('*' any run, '?' one char) to an ILIKE pattern,
 // escaping the SQL wildcards already in the input first. An empty/blank mask returns "".
 func LikePattern(mask string) string {
 	mask = strings.TrimSpace(mask)
 	if mask == "" {
 		return ""
 	}
 	escaped := strings.NewReplacer(`\`, `\\`, `%`, `\%`, `_`, `\_`).Replace(mask)
 	escaped = strings.ReplaceAll(escaped, "*", "%")
 	return strings.ReplaceAll(escaped, "?", "_")
 }
@@ -12,19 +12,24 @@ func TestValidateDisplayName(t *testing.T) {
 		want string
 		ok   bool
 	}{
-		"plain":              {"Kaya", "Kaya", true},
+		"plain":               {"Kaya", "Kaya", true},
-		"cyrillic":           {"Кая", "Кая", true},
+		"cyrillic":            {"Кая", "Кая", true},
-		"dot underscore mix": {"Name_P. Last", "Name_P. Last", true},
+		"dot underscore mix":  {"Name_P. Last", "Name_P. Last", true},
-		"single dot":         {"Mr.Smith", "Mr.Smith", true},
+		"single dot":          {"Mr.Smith", "Mr.Smith", true},
-		"dot then space":     {"Mr. Smith", "Mr. Smith", true},
+		"dot then space":      {"Mr. Smith", "Mr. Smith", true},
-		"trim surrounding":   {"  Kaya  ", "Kaya", true},
+		"trim surrounding":    {"  Kaya  ", "Kaya", true},
-		"adjacent specials":  {"Name P._Last", "", false},
+		"adjacent specials":   {"Name P._Last", "", false},
-		"two spaces":         {"Name  Last", "", false},
+		"two spaces":          {"Name  Last", "", false},
-		"leading special":    {"_Name", "", false},
+		"leading special":     {"_Name", "", false},
-		"trailing special":   {"Name.", "", false},
+		"trailing underscore": {"Name_", "", false},
-		"digit rejected":     {"Name2", "", false},
+		"trailing dot ok":     {"Anna B.", "Anna B.", true},
-		"blank":              {"   ", "", false},
+		"double trailing dot": {"Name..", "", false},
-		"too long":           {strings.Repeat("a", 33), "", false},
+		"digit rejected":      {"Name2", "", false},
 		"blank":               {"   ", "", false},
 		"too long":            {strings.Repeat("a", 33), "", false},
 		"five specials ok":    {"a.a.a.a.a.a", "a.a.a.a.a.a", true},           // 5 dots
 		"six specials":        {"a.a.a.a.a.a.a", "", false},                   // 6 dots
 		"initials spaces ok":  {"J. R. R. Tolkien", "J. R. R. Tolkien", true}, // 3 dots; spaces don't count
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
@@ -2,7 +2,7 @@
 // transaction: it sums statistics and the hint wallet, ORs the paid flag, repoints
 // the secondary's identities, transfers its games/chat/complaints/invitations,
 // de-duplicates friends and blocks, and leaves the secondary as an audit tombstone
-// (accounts.merged_into). It is the data core of Stage 11 account linking & merge
+// (accounts.merged_into). It is the data core of account linking & merge
 // (ARCHITECTURE.md §4); session revocation and any session switch are orchestrated
 // one layer up (the link service), since the in-memory session cache lives there.
 package accountmerge
@@ -74,6 +74,7 @@ h1 { font-size: 1.4rem; margin: 0 0 0.4rem; }
 .subnav a.active { color: var(--ink); }
 .form { display: flex; flex-wrap: wrap; gap: 0.6rem; align-items: end; margin-top: 0.4rem; }
 .form .export { margin-left: auto; align-self: center; color: var(--accent); white-space: nowrap; }
 .form.col { flex-direction: column; align-items: stretch; max-width: 540px; }
 .form label { display: flex; flex-direction: column; gap: 0.2rem; font-size: 0.85rem; color: var(--ink-dim); }
 .form input, .form select, .form textarea {
@@ -101,3 +102,17 @@ code { background: var(--bg); padding: 0.05rem 0.3rem; border-radius: 4px; }
 .actions { display: flex; flex-wrap: wrap; gap: 0.6rem; margin: 0.8rem 0; }
 .actions form { margin: 0; }
 .pill { padding: 0.05rem 0.4rem; border: 1px solid var(--line); border-radius: 999px; font-size: 0.8rem; }
 /* Move-timing chart: a server-rendered, script-free inline SVG line chart. */
 .chart { width: 100%; height: auto; max-width: 680px; margin-top: 0.4rem; }
 .chart .axis { stroke: var(--line); stroke-width: 1; }
 .chart .grid { stroke: var(--line); stroke-width: 1; stroke-dasharray: 2 3; opacity: 0.6; }
 .chart .lbl { fill: var(--ink-dim); font-size: 11px; }
 .chart .ln { fill: none; stroke-width: 1.5; }
 .chart .ln-min { stroke: var(--ok); }
 .chart .ln-avg { stroke: var(--accent); }
 .chart .ln-max { stroke: var(--danger); }
 .lg { font-weight: 600; }
 .lg-min { color: var(--ok); }
 .lg-avg { color: var(--accent); }
 .lg-max { color: var(--danger); }
@@ -0,0 +1,108 @@
 package adminconsole
 import (
 	"fmt"
 	"html/template"
 	"strings"
 	"time"
 )
 // ChartPoint is one move-number sample of the move-duration chart: the min, mean and
 // max think time (seconds) the account took on its Ordinal-th move across its games.
 type ChartPoint struct {
 	Ordinal int
 	Min     float64
 	Max     float64
 	Avg     float64
 }
 // FormatDuration renders a think-time in seconds as a compact human string
 // ("45s", "3m", "1h5m"), for the user-list columns and the chart's Y labels.
 func FormatDuration(secs float64) string {
 	d := time.Duration(secs * float64(time.Second))
 	switch {
 	case d < time.Minute:
 		return fmt.Sprintf("%ds", int(d.Seconds()+0.5))
 	case d < time.Hour:
 		return fmt.Sprintf("%dm", int(d.Minutes()+0.5))
 	default:
 		h := int(d.Hours())
 		if m := int(d.Minutes()) - h*60; m > 0 {
 			return fmt.Sprintf("%dh%dm", h, m)
 		}
 		return fmt.Sprintf("%dh", h)
 	}
 }
 // MoveDurationChart renders the per-move-number think-time chart as a self-contained,
 // script-free inline SVG with three series (min, mean, max). The coordinates and
 // labels are all derived from numeric data, so the result is safe template.HTML.
 // An empty series renders nothing.
 func MoveDurationChart(points []ChartPoint) template.HTML {
 	if len(points) == 0 {
 		return ""
 	}
 	const (
 		w, h = 640, 240
 		padL = 46
 		padR = 12
 		padT = 10
 		padB = 28
 	)
 	maxOrd := points[len(points)-1].Ordinal
 	if maxOrd < 1 {
 		maxOrd = 1
 	}
 	var maxY float64
 	for _, p := range points {
 		maxY = max(maxY, p.Max)
 	}
 	if maxY <= 0 {
 		maxY = 1
 	}
 	xOf := func(ord int) float64 {
 		if maxOrd == 1 {
 			return padL
 		}
 		return padL + (float64(ord-1)/float64(maxOrd-1))*(w-padL-padR)
 	}
 	yOf := func(v float64) float64 { return padT + (1-v/maxY)*(h-padT-padB) }
 	line := func(get func(ChartPoint) float64) string {
 		pts := make([]string, len(points))
 		for i, p := range points {
 			pts[i] = fmt.Sprintf("%.1f,%.1f", xOf(p.Ordinal), yOf(get(p)))
 		}
 		return strings.Join(pts, " ")
 	}
 	var b strings.Builder
 	fmt.Fprintf(&b, `<svg viewBox="0 0 %d %d" class="chart" role="img" aria-label="Move duration by move number">`, w, h)
 	fmt.Fprintf(&b, `<line x1="%d" y1="%d" x2="%d" y2="%.1f" class="axis"/>`, padL, padT, padL, float64(h-padB))
 	fmt.Fprintf(&b, `<line x1="%d" y1="%.1f" x2="%d" y2="%.1f" class="axis"/>`, padL, float64(h-padB), w-padR, float64(h-padB))
 	for _, frac := range []float64{0, 0.5, 1} {
 		v := maxY * frac
 		y := yOf(v)
 		fmt.Fprintf(&b, `<line x1="%d" y1="%.1f" x2="%d" y2="%.1f" class="grid"/>`, padL, y, w-padR, y)
 		fmt.Fprintf(&b, `<text x="%d" y="%.1f" class="lbl" text-anchor="end">%s</text>`, padL-5, y+3, FormatDuration(v))
 	}
 	for _, ord := range xTicks(maxOrd) {
 		fmt.Fprintf(&b, `<text x="%.1f" y="%d" class="lbl" text-anchor="middle">%d</text>`, xOf(ord), h-padB+15, ord)
 	}
 	fmt.Fprintf(&b, `<polyline points="%s" class="ln ln-max"/>`, line(func(p ChartPoint) float64 { return p.Max }))
 	fmt.Fprintf(&b, `<polyline points="%s" class="ln ln-avg"/>`, line(func(p ChartPoint) float64 { return p.Avg }))
 	fmt.Fprintf(&b, `<polyline points="%s" class="ln ln-min"/>`, line(func(p ChartPoint) float64 { return p.Min }))
 	b.WriteString(`</svg>`)
 	return template.HTML(b.String())
 }
 // xTicks returns up to three distinct ordinal labels for the chart's X axis.
 func xTicks(maxOrd int) []int {
 	if maxOrd <= 2 {
 		out := make([]int, 0, maxOrd)
 		for i := 1; i <= maxOrd; i++ {
 			out = append(out, i)
 		}
 		return out
 	}
 	return []int{1, (maxOrd + 1) / 2, maxOrd}
 }
@@ -0,0 +1,51 @@
 package adminconsole
 import (
 	"strings"
 	"testing"
 )
 func TestFormatDuration(t *testing.T) {
 	cases := map[float64]string{
 		0: "0s", 30: "30s", 59: "59s", 60: "1m", 150: "3m", 3600: "1h", 3660: "1h1m", 7800: "2h10m",
 	}
 	for secs, want := range cases {
 		if got := FormatDuration(secs); got != want {
 			t.Errorf("FormatDuration(%v) = %q, want %q", secs, got, want)
 		}
 	}
 }
 func TestMoveDurationChartEmpty(t *testing.T) {
 	if got := MoveDurationChart(nil); got != "" {
 		t.Errorf("empty chart = %q, want empty", got)
 	}
 }
 func TestMoveDurationChart(t *testing.T) {
 	pts := []ChartPoint{{Ordinal: 1, Min: 5, Max: 20, Avg: 10}, {Ordinal: 2, Min: 8, Max: 40, Avg: 18}, {Ordinal: 3, Min: 12, Max: 90, Avg: 30}}
 	svg := string(MoveDurationChart(pts))
 	for _, want := range []string{"<svg", "ln-min", "ln-avg", "ln-max", "</svg>"} {
 		if !strings.Contains(svg, want) {
 			t.Errorf("chart missing %q\n%s", want, svg)
 		}
 	}
 	if n := strings.Count(svg, "<polyline"); n != 3 {
 		t.Errorf("polylines = %d, want 3", n)
 	}
 }
 func TestXTicks(t *testing.T) {
 	cases := map[int][]int{1: {1}, 2: {1, 2}, 3: {1, 2, 3}, 10: {1, 5, 10}}
 	for maxOrd, want := range cases {
 		got := xTicks(maxOrd)
 		if len(got) != len(want) {
 			t.Fatalf("xTicks(%d) = %v, want %v", maxOrd, got, want)
 		}
 		for i := range want {
 			if got[i] != want[i] {
 				t.Errorf("xTicks(%d) = %v, want %v", maxOrd, got, want)
 			}
 		}
 	}
 }
@@ -20,14 +20,21 @@ func TestRendererRendersEveryPage(t *testing.T) {
 		data any
 		want string
 	}{
-		{"dashboard", DashboardView{Accounts: 3, Variants: []VariantVersions{{Variant: "english", Latest: "v1", Versions: []string{"v1"}}}}, "Dashboard"},
+		{"dashboard", DashboardView{Accounts: 3, Variants: []VariantVersions{{Variant: "scrabble_en", Latest: "v1", Versions: []string{"v1"}}}}, "Dashboard"},
-		{"users", UsersView{Items: []UserRow{{ID: "a1", DisplayName: "Kaya"}}, Pager: NewPager(1, 50, 1)}, "Kaya"},
+		{"users", UsersView{Items: []UserRow{{ID: "a1", DisplayName: "Kaya", FlaggedHighRate: true}}, Pager: NewPager(1, 50, 1)}, "high-rate"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", HasStats: true, Stats: StatsRow{Wins: 2}, TelegramID: "123", ConnectorEnabled: true}, "Send Telegram message"},
-		{"games", GamesView{Items: []GameRow{{ID: "g1", Variant: "english", Status: "active"}}, Status: "active", Pager: NewPager(1, 50, 1)}, "g1"},
+		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", FlaggedHighRateAt: "2026-06-10 12:00"}, "Clear high-rate flag"},
-		{"game_detail", GameDetailView{ID: "g1", Variant: "english", Seats: []SeatRow{{Seat: 0, DisplayName: "Kaya"}}}, "Seats"},
+		{"throttled", ThrottledView{
 			Episodes:      []ThrottleEpisodeRow{{Class: "user", Key: "a1", UserID: "a1", Rejected: 1234, FirstSeen: "2026-06-10 12:00", LastSeen: "2026-06-10 12:05"}},
 			Flagged:       []FlaggedAccountRow{{ID: "a1", DisplayName: "Kaya", FlaggedAt: "2026-06-10 12:05"}},
 			FlagThreshold: 1000, FlagWindow: "10m0s",
 		}, "Recent episodes"},
 		{"games", GamesView{Items: []GameRow{{ID: "g1", Variant: "scrabble_en", Status: "active"}}, Status: "active", Pager: NewPager(1, 50, 1)}, "g1"},
 		{"game_detail", GameDetailView{ID: "g1", Variant: "scrabble_en", Seats: []SeatRow{{Seat: 0, DisplayName: "Kaya"}}}, "Seats"},
 		{"complaints", ComplaintsView{Items: []ComplaintRow{{ID: "c1", Word: "qi", Status: "open"}}, Status: "open", Pager: NewPager(1, 50, 1)}, "qi"},
-		{"complaint_detail", ComplaintDetailView{ID: "c1", Word: "qi", Variant: "english"}, "Resolve"},
+		{"messages", MessagesView{Items: []MessageRow{{ID: "m1", SenderID: "a1", SenderName: "Kaya", Source: "telegram", Body: "good luck", GameID: "g1"}}, Pager: NewPager(1, 50, 1)}, "good luck"},
-		{"dictionary", DictionaryView{Variants: []VariantVersions{{Variant: "english", Latest: "v1", Versions: []string{"v1"}}}, Changes: []DictChangeRow{{Variant: "english", Word: "qi", Action: "add"}}}, "Hot-reload"},
+		{"complaint_detail", ComplaintDetailView{ID: "c1", Word: "qi", Variant: "scrabble_en"}, "Resolve"},
 		{"dictionary", DictionaryView{Variants: []VariantVersions{{Variant: "scrabble_en", Latest: "v1", Versions: []string{"v1"}}}, Changes: []DictChangeRow{{Variant: "scrabble_en", Word: "qi", Action: "add"}}}, "Hot-reload"},
 		{"broadcast", BroadcastView{ConnectorEnabled: true}, "Post to the game channel"},
 		{"message", MessageView{Heading: "Done", Body: "ok", Back: "/_gm/"}, "Done"},
 	}
@@ -16,8 +16,11 @@
    <a href="/_gm/users"{{if eq .ActiveNav "users"}} class="active"{{end}}>Users</a>
    <a href="/_gm/games"{{if eq .ActiveNav "games"}} class="active"{{end}}>Games</a>
    <a href="/_gm/complaints"{{if eq .ActiveNav "complaints"}} class="active"{{end}}>Complaints</a>
    <a href="/_gm/messages"{{if eq .ActiveNav "messages"}} class="active"{{end}}>Messages</a>
    <a href="/_gm/throttled"{{if eq .ActiveNav "throttled"}} class="active"{{end}}>Throttled</a>
    <a href="/_gm/dictionary"{{if eq .ActiveNav "dictionary"}} class="active"{{end}}>Dictionary</a>
    <a href="/_gm/broadcast"{{if eq .ActiveNav "broadcast"}} class="active"{{end}}>Broadcast</a>
    <a href="/_gm/grafana/">Grafana ↗</a>
  </nav>
 </header>
 <main class="content">
@@ -30,9 +30,9 @@
 <form class="form" method="post" action="/_gm/dictionary/changes/apply">
 <label>Mark applied for variant
 <select name="variant">
-<option value="english">english</option>
+<option value="scrabble_en">scrabble_en</option>
-<option value="russian_scrabble">russian_scrabble</option>
+<option value="scrabble_ru">scrabble_ru</option>
-<option value="erudit">erudit</option>
+<option value="erudit_ru">erudit_ru</option>
 </select>
 </label>
 <label>In version <input type="text" name="version" placeholder="v2" required></label>
@@ -1,7 +1,7 @@
 {{define "content" -}}
 {{with .Data}}
 <h1>Game {{.ID}}</h1>
-<nav class="subnav"><a href="/_gm/games">&laquo; games</a></nav>
+<nav class="subnav"><a href="/_gm/games">&laquo; games</a> · <a href="/_gm/messages?game={{.ID}}">messages</a></nav>
 <section class="panel"><h2>Summary</h2>
 <ul class="kv">
 <li><b>Variant</b> {{.Variant}}</li>
@@ -17,13 +17,14 @@
 </section>
 <section class="panel"><h2>Seats</h2>
 <table class="list">
-<thead><tr><th class="num">Seat</th><th>Player</th><th class="num">Score</th><th class="num">Hints</th><th>Winner</th></tr></thead>
+<thead><tr><th>Seat</th><th>Player</th><th>Score</th><th>Hints used</th><th>Winner</th><th>Robot</th></tr></thead>
 <tbody>
 {{range .Seats}}
-<tr><td class="num">{{.Seat}}</td><td><a href="/_gm/users/{{.AccountID}}">{{.DisplayName}}</a></td><td class="num">{{.Score}}</td><td class="num">{{.HintsUsed}}</td><td>{{if .Winner}}<span class="ok">winner</span>{{end}}</td></tr>
+<tr><td>{{.Seat}}</td><td><a href="/_gm/users/{{.AccountID}}">{{.DisplayName}}</a></td><td>{{.Score}}</td><td>{{.HintsUsed}}</td><td>{{if .Winner}}<span class="ok">winner</span>{{end}}</td><td>{{if .IsRobot}}🤖 {{.RobotIntent}}{{if .NextMove}}<br><small>next move {{.NextMove}}</small>{{end}}{{end}}</td></tr>
 {{end}}
 </tbody>
 </table>
 {{if .HasRobot}}<p><small>Play-to-win is decided once per game from the bag seed; robots play to win in ~{{.RobotTargetPct}}% of games.</small></p>{{end}}
 </section>
 {{end}}
 {{- end}}
@@ -0,0 +1,38 @@
 {{define "content" -}}
 <h1>Messages</h1>
 {{with .Data}}
 <form class="form" method="get" action="/_gm/messages">
 {{if .GameID}}<input type="hidden" name="game" value="{{.GameID}}">{{end}}
 {{if .UserID}}<input type="hidden" name="user" value="{{.UserID}}">{{end}}
 <input name="name" value="{{.NameMask}}" placeholder="sender name mask (* ?)">
 <input name="ext" value="{{.ExtMask}}" placeholder="sender external id mask (* ?)">
 <button type="submit">Filter</button>
 <a class="export" href="/_gm/messages.csv?{{.FilterQuery}}">Export CSV ↓</a>
 </form>
 {{if or .GameID .UserID}}
 <p class="note">Filtered{{if .GameID}} to game <a href="/_gm/games/{{.GameID}}">{{.GameID}}</a>{{end}}{{if .UserID}} from <a href="/_gm/users/{{.UserID}}">sender</a>{{end}} · <a href="/_gm/messages">clear</a></p>
 {{end}}
 <table class="list">
 <thead><tr><th>Time</th><th>Source</th><th>Sender</th><th>IP</th><th>Message</th><th>Game</th></tr></thead>
 <tbody>
 {{range .Items}}
 <tr>
 <td>{{.CreatedAt}}</td>
 <td>{{.Source}}</td>
 <td><a href="/_gm/users/{{.SenderID}}">{{.SenderName}}</a></td>
 <td>{{.IP}}</td>
 <td>{{.Body}}</td>
 <td><a href="/_gm/games/{{.GameID}}">game</a></td>
 </tr>
 {{else}}
 <tr><td colspan="6"><span class="note">no messages</span></td></tr>
 {{end}}
 </tbody>
 </table>
 <nav class="pager">
 {{if .Pager.HasPrev}}<a href="/_gm/messages?{{.FilterQuery}}&amp;page={{.Pager.PrevPage}}">&laquo; prev</a>{{end}}
 <span>page {{.Pager.Page}} · {{.Pager.Total}} total</span>
 {{if .Pager.HasNext}}<a href="/_gm/messages?{{.FilterQuery}}&amp;page={{.Pager.NextPage}}">next &raquo;</a>{{end}}
 </nav>
 {{end}}
 {{- end}}
@@ -0,0 +1,39 @@
 {{define "content" -}}
 <h1>Throttled</h1>
 {{with .Data}}
 <p class="note">Rate-limiter rejections reported periodically by the gateway. The episode
 list is in-memory and resets on a backend restart. An account sustaining
 {{.FlagThreshold}}+ rejected calls within {{.FlagWindow}} is soft-flagged for review
 below — never banned automatically; clear the flag on the user card.</p>
 <section class="panel"><h2>Recent episodes</h2>
 <table class="list">
 <thead><tr><th>Class</th><th>Key</th><th class="num">Rejected</th><th>First seen</th><th>Last seen</th></tr></thead>
 <tbody>
 {{range .Episodes}}
 <tr>
 <td>{{.Class}}</td>
 <td>{{if .UserID}}<a href="/_gm/users/{{.UserID}}">{{.Key}}</a>{{else}}<code>{{.Key}}</code>{{end}}</td>
 <td class="num">{{.Rejected}}</td>
 <td>{{.FirstSeen}}</td>
 <td>{{.LastSeen}}</td>
 </tr>
 {{else}}
 <tr><td colspan="5"><span class="note">nothing throttled recently</span></td></tr>
 {{end}}
 </tbody>
 </table>
 </section>
 <section class="panel"><h2>Flagged accounts</h2>
 <table class="list">
 <thead><tr><th>Account</th><th>Display name</th><th>Flagged</th></tr></thead>
 <tbody>
 {{range .Flagged}}
 <tr><td><a href="/_gm/users/{{.ID}}">{{.ID}}</a></td><td>{{.DisplayName}}</td><td>{{.FlaggedAt}}</td></tr>
 {{else}}
 <tr><td colspan="3"><span class="note">no flagged accounts</span></td></tr>
 {{end}}
 </tbody>
 </table>
 </section>
 {{end}}
 {{- end}}
@@ -1,7 +1,7 @@
 {{define "content" -}}
 {{with .Data}}
 <h1>{{.DisplayName}}</h1>
-<nav class="subnav"><a href="/_gm/users">&laquo; users</a></nav>
+<nav class="subnav"><a href="/_gm/users">&laquo; users</a> · <a href="/_gm/messages?user={{.ID}}">messages</a></nav>
 <div class="cards">
 <section class="panel"><h2>Account</h2>
 <ul class="kv">
@@ -13,8 +13,14 @@
 <li><b>Paid</b> {{if .PaidAccount}}yes{{else}}no{{end}}</li>
 <li><b>Hint wallet</b> {{.HintBalance}}</li>
 {{if .MergedInto}}<li><b>Merged into</b> {{.MergedInto}}</li>{{end}}
 {{if .FlaggedHighRateAt}}<li><b>High-rate flag</b> <span class="warn">{{.FlaggedHighRateAt}}</span></li>{{end}}
 <li><b>Created</b> {{.CreatedAt}}</li>
 </ul>
 {{if .FlaggedHighRateAt}}
 <form class="form" method="post" action="/_gm/users/{{.ID}}/clear-high-rate-flag">
 <button type="submit">Clear high-rate flag</button>
 </form>
 {{end}}
 </section>
 <section class="panel"><h2>Statistics</h2>
 {{if .HasStats}}
@@ -28,6 +34,12 @@
 {{else}}<p class="note">no statistics</p>{{end}}
 </section>
 </div>
 {{if .MoveChart}}
 <section class="panel"><h2>Move timing</h2>
 <p class="note">Think time per move number across all games — <span class="lg lg-min">min</span> · <span class="lg lg-avg">mean</span> · <span class="lg lg-max">max</span>.</p>
 {{.MoveChart}}
 </section>
 {{end}}
 <section class="panel"><h2>Identities</h2>
 <table class="list">
 <thead><tr><th>Kind</th><th>External ID</th><th>Confirmed</th><th>Created</th></tr></thead>
@@ -1,26 +1,37 @@
 {{define "content" -}}
 <h1>Users</h1>
 {{with .Data}}
 <nav class="subnav">
 <a href="/_gm/users"{{if not .Robots}} class="active"{{end}}>People</a> ·
 <a href="/_gm/users?kind=robots"{{if .Robots}} class="active"{{end}}>Robots</a>
 </nav>
 <form class="form" method="get" action="/_gm/users">
 {{if .Robots}}<input type="hidden" name="kind" value="robots">{{end}}
 <input name="name" value="{{.NameMask}}" placeholder="display name mask (* ?)">
 <input name="ext" value="{{.ExternalIDMask}}" placeholder="external id mask (* ?)">
 <button type="submit">Filter</button>
 </form>
 <table class="list">
-<thead><tr><th>Account</th><th>Display name</th><th>Kind</th><th>Lang</th><th>Created</th></tr></thead>
+<thead><tr><th>Account</th><th>Display name</th><th>Kind</th><th>Lang</th><th>Created</th><th title="per-move think time across all games">Move min</th><th>avg</th><th>max</th></tr></thead>
 <tbody>
 {{range .Items}}
 <tr>
 <td><a href="/_gm/users/{{.ID}}">{{.ID}}</a></td>
-<td>{{.DisplayName}}{{if .Guest}} <span class="pill">guest</span>{{end}}</td>
+<td>{{.DisplayName}}{{if .Guest}} <span class="pill">guest</span>{{end}}{{if .FlaggedHighRate}} <span class="pill">high-rate</span>{{end}}</td>
 <td>{{.Kind}}</td>
 <td>{{.Language}}</td>
 <td>{{.CreatedAt}}</td>
 {{if .HasMoveStats}}<td>{{.MoveMin}}</td><td>{{.MoveAvg}}</td><td>{{.MoveMax}}</td>{{else}}<td colspan="3"><span class="note">—</span></td>{{end}}
 </tr>
 {{else}}
-<tr><td colspan="5"><span class="note">no users</span></td></tr>
+<tr><td colspan="8"><span class="note">no users</span></td></tr>
 {{end}}
 </tbody>
 </table>
 <nav class="pager">
-{{if .Pager.HasPrev}}<a href="/_gm/users?page={{.Pager.PrevPage}}">&laquo; prev</a>{{end}}
+{{if .Pager.HasPrev}}<a href="/_gm/users?{{.FilterQuery}}&amp;page={{.Pager.PrevPage}}">&laquo; prev</a>{{end}}
 <span>page {{.Pager.Page}} · {{.Pager.Total}} total</span>
-{{if .Pager.HasNext}}<a href="/_gm/users?page={{.Pager.NextPage}}">next &raquo;</a>{{end}}
+{{if .Pager.HasNext}}<a href="/_gm/users?{{.FilterQuery}}&amp;page={{.Pager.NextPage}}">next &raquo;</a>{{end}}
 </nav>
 {{end}}
 {{- end}}
@@ -1,5 +1,7 @@
 package adminconsole
 import "html/template"
 // The *View types are the display models the gin handlers fill and the templates
 // render. Time values are pre-formatted to strings by the handlers so the
 // templates stay logic-free.
@@ -48,16 +50,55 @@ type DashboardView struct {
 type UsersView struct {
 	Items []UserRow
 	Pager Pager
 	// Robots is the active people/robots toggle; NameMask/ExternalIDMask are the current
 	// glob filters; FilterQuery is those encoded for pager/toggle links.
 	Robots         bool
 	NameMask       string
 	ExternalIDMask string
 	FilterQuery    string
 }
-// UserRow is one account row in the list.
+// UserRow is one account row in the list. MoveMin/Avg/Max are the account's
 // pre-formatted move-duration summary (empty when it has no timed move);
 // FlaggedHighRate marks the soft high-rate badge.
 type UserRow struct {
-	ID          string
+	ID              string
-	DisplayName string
+	DisplayName     string
-	Kind        string
+	Kind            string
-	Language    string
+	Language        string
-	Guest       bool
+	Guest           bool
-	CreatedAt   string
+	FlaggedHighRate bool
 	CreatedAt       string
 	HasMoveStats    bool
 	MoveMin         string
 	MoveAvg         string
 	MoveMax         string
 }
 // MessagesView is the paginated chat-message moderation list. NameMask/ExtMask are the
 // current sender glob filters; GameID/UserID pin the list to one game / sender (set from a
 // game or user card); FilterQuery is the active filters encoded for the pager links.
 type MessagesView struct {
 	Items       []MessageRow
 	Pager       Pager
 	NameMask    string
 	ExtMask     string
 	GameID      string
 	UserID      string
 	FilterQuery string
 }
 // MessageRow is one chat message in the moderation list: its sender (linked to the user
 // card), source, IP, body, game (linked to the game card) and time.
 type MessageRow struct {
 	ID         string
 	SenderID   string
 	SenderName string
 	Source     string
 	IP         string
 	Body       string
 	GameID     string
 	CreatedAt  string
 }
 // UserDetailView is one account with its stats, identities and recent games.
@@ -70,16 +111,22 @@ type UserDetailView struct {
 	NotificationsInAppOnly bool
 	PaidAccount            bool
 	// MergedInto is the primary account id when this account has been retired by a
-	// merge (Stage 11), or empty for a live account.
+	// merge, or empty for a live account.
-	MergedInto       string
+	MergedInto string
-	HintBalance      int
+	// FlaggedHighRateAt is the pre-formatted soft high-rate marker timestamp,
-	CreatedAt        string
+	// empty for an unflagged account; the card shows it with the Clear action.
-	HasStats         bool
+	FlaggedHighRateAt string
-	Stats            StatsRow
+	HintBalance       int
-	Identities       []IdentityRow
+	CreatedAt         string
-	Games            []GameRow
+	HasStats          bool
-	TelegramID       string
+	Stats             StatsRow
-	ConnectorEnabled bool
+	Identities        []IdentityRow
 	Games             []GameRow
 	TelegramID        string
 	ConnectorEnabled  bool
 	// MoveChart is the pre-rendered inline SVG of the account's per-move-number think
 	// time (min/mean/max), empty when the account has no timed move.
 	MoveChart template.HTML
 }
 // StatsRow is an account's lifetime statistics.
@@ -129,9 +176,15 @@ type GameDetailView struct {
 	UpdatedAt   string
 	FinishedAt  string
 	Seats       []SeatRow
 	// HasRobot is true when any seat is a robot, gating the robot-target caption;
 	// RobotTargetPct is the configured global play-to-win rate, in percent.
 	HasRobot       bool
 	RobotTargetPct int
 }
-// SeatRow is one seat of a game.
+// SeatRow is one seat of a game. For a robot seat (IsRobot) RobotIntent is the game's
 // deterministic play-to-win decision ("play to win"/"play to lose"), and NextMove is the
 // scheduled next-move ETA shown only while it is that robot's turn in an active game.
 type SeatRow struct {
 	Seat        int
 	DisplayName string
@@ -139,6 +192,9 @@ type SeatRow struct {
 	Score       int
 	HintsUsed   int
 	Winner      bool
 	IsRobot     bool
 	RobotIntent string
 	NextMove    string
 }
 // ComplaintsView is the paginated complaint review queue.
@@ -196,6 +252,35 @@ type BroadcastView struct {
 	ConnectorEnabled bool
 }
 // ThrottledView is the rate-limit observability page: the recent gateway-reported
 // throttle episodes (in-memory, reset on restart) and the accounts currently
 // carrying the high-rate flag. FlagThreshold and FlagWindow caption the active
 // auto-flag tuning.
 type ThrottledView struct {
 	Episodes      []ThrottleEpisodeRow
 	Flagged       []FlaggedAccountRow
 	FlagThreshold int
 	FlagWindow    string
 }
 // ThrottleEpisodeRow is one recently throttled limiter key. UserID links to the
 // user card and is set only for the user class (the other classes key by IP).
 type ThrottleEpisodeRow struct {
 	Class     string
 	Key       string
 	UserID    string
 	Rejected  int
 	FirstSeen string
 	LastSeen  string
 }
 // FlaggedAccountRow is one account carrying the high-rate flag.
 type FlaggedAccountRow struct {
 	ID          string
 	DisplayName string
 	FlaggedAt   string
 }
 // MessageView is the result page shown after a POST action.
 type MessageView struct {
 	Heading string
@@ -12,6 +12,7 @@ import (
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/postgres"
 	"scrabble/backend/internal/ratewatch"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/telemetry"
 )
@@ -35,6 +36,9 @@ type Config struct {
 	Lobby lobby.Config
 	// Robot configures the robot opponent driver (scan cadence).
 	Robot robot.Config
 	// RateWatch tunes the conservative high-rate auto-flag applied to the
 	// gateway's rate-limiter rejection reports.
 	RateWatch ratewatch.Config
 	// SMTP configures the email relay used for confirm-codes. An empty Host
 	// selects the development log mailer (the code is logged, not sent).
 	SMTP account.SMTPConfig
@@ -105,6 +109,14 @@ func Load() (Config, error) {
 		return Config{}, err
 	}
 	rw := ratewatch.DefaultConfig()
 	if rw.FlagThreshold, err = envInt("BACKEND_HIGHRATE_FLAG_THRESHOLD", rw.FlagThreshold); err != nil {
 		return Config{}, err
 	}
 	if rw.FlagWindow, err = envDuration("BACKEND_HIGHRATE_FLAG_WINDOW", rw.FlagWindow); err != nil {
 		return Config{}, err
 	}
 	guestReapInterval, err := envDuration("BACKEND_GUEST_REAP_INTERVAL", defaultGuestReapInterval)
 	if err != nil {
 		return Config{}, err
@@ -131,6 +143,7 @@ func Load() (Config, error) {
 		Game:              gm,
 		Lobby:             lb,
 		Robot:             rb,
 		RateWatch:         rw,
 		SMTP:              smtp,
 		ConnectorAddr:     os.Getenv("BACKEND_CONNECTOR_ADDR"),
 		GuestReapInterval: guestReapInterval,
@@ -170,6 +183,9 @@ func (c Config) validate() error {
 	if err := c.Robot.Validate(); err != nil {
 		return fmt.Errorf("config: %w", err)
 	}
 	if err := c.RateWatch.Validate(); err != nil {
 		return fmt.Errorf("config: %w", err)
 	}
 	if c.GuestReapInterval <= 0 {
 		return fmt.Errorf("config: BACKEND_GUEST_REAP_INTERVAL must be positive")
 	}
@@ -7,7 +7,7 @@ import (
 // AlphabetEntry is one letter of a variant's alphabet: its alphabet-index byte, the
 // concrete character and its tile point value. It is the dictionary-independent display
-// table the edge sends to the client (Stage 13), produced from the variant's solver
+// table the edge sends to the client, produced from the variant's solver
 // ruleset (its alphabet and value table) and so pinned by the solver version, not by any
 // dictionary.
 type AlphabetEntry struct {
@@ -8,11 +8,11 @@ import (
 // TestAlphabetTableEnglish pins the English table against the solver ruleset: 26 letters,
 // contiguous indices, the concrete lower-case characters the solver emits and the standard
-// tile values. This is the real parity check the UI no longer carries (Stage 13).
+// tile values. This is the real parity check the UI no longer carries.
 func TestAlphabetTableEnglish(t *testing.T) {
 	tab, err := AlphabetTable(VariantEnglish)
 	if err != nil {
-		t.Fatalf("AlphabetTable(english): %v", err)
+		t.Fatalf("AlphabetTable(scrabble_en): %v", err)
 	}
 	if len(tab) != 26 {
 		t.Fatalf("size = %d, want 26", len(tab))
@@ -40,23 +40,23 @@ func TestAlphabetTableEnglish(t *testing.T) {
 func TestAlphabetTableRussianVariants(t *testing.T) {
 	ru, err := AlphabetTable(VariantRussianScrabble)
 	if err != nil {
-		t.Fatalf("AlphabetTable(russian_scrabble): %v", err)
+		t.Fatalf("AlphabetTable(scrabble_ru): %v", err)
 	}
 	er, err := AlphabetTable(VariantErudit)
 	if err != nil {
-		t.Fatalf("AlphabetTable(erudit): %v", err)
+		t.Fatalf("AlphabetTable(erudit_ru): %v", err)
 	}
 	if len(ru) != 33 || len(er) != 33 {
 		t.Fatalf("sizes = %d/%d, want 33/33", len(ru), len(er))
 	}
 	if ru[0].Letter != "а" || ru[0].Value != 1 {
-		t.Errorf("russian entry 0 = %q/%d, want а/1", ru[0].Letter, ru[0].Value)
+		t.Errorf("scrabble_ru entry 0 = %q/%d, want а/1", ru[0].Letter, ru[0].Value)
 	}
 	if ru[6].Letter != "ё" || ru[6].Value != 3 {
-		t.Errorf("russian ё (entry 6) = %q/%d, want ё/3", ru[6].Letter, ru[6].Value)
+		t.Errorf("scrabble_ru ё (entry 6) = %q/%d, want ё/3", ru[6].Letter, ru[6].Value)
 	}
 	if er[6].Letter != "ё" || er[6].Value != 0 {
-		t.Errorf("erudit ё (entry 6) = %q/%d, want ё/0", er[6].Letter, er[6].Value)
+		t.Errorf("erudit_ru ё (entry 6) = %q/%d, want ё/0", er[6].Letter, er[6].Value)
 	}
 	if ru[32].Letter != "я" || er[32].Letter != "я" {
 		t.Errorf("last letter = %q/%q, want я/я", ru[32].Letter, er[32].Letter)
@@ -168,10 +168,10 @@ func TestRegistryLookup(t *testing.T) {
 		word    string
 		want    bool
 	}{
-		{"english hit", VariantEnglish, "cat", true},
+		{"scrabble_en hit", VariantEnglish, "cat", true},
-		{"english miss", VariantEnglish, "zzzz", false},
+		{"scrabble_en miss", VariantEnglish, "zzzz", false},
-		{"russian hit", VariantRussianScrabble, "кот", true},
+		{"scrabble_ru hit", VariantRussianScrabble, "кот", true},
-		{"erudit hit", VariantErudit, "кот", true},
+		{"erudit_ru hit", VariantErudit, "кот", true},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
@@ -38,15 +38,25 @@ const (
 func (v Variant) String() string {
 	switch v {
 	case VariantEnglish:
-		return "english"
+		return "scrabble_en"
 	case VariantRussianScrabble:
-		return "russian_scrabble"
+		return "scrabble_ru"
 	case VariantErudit:
-		return "erudit"
+		return "erudit_ru"
 	}
 	return "unknown"
 }
 // Language returns the variant's interface/bot language tag: "en" for English Scrabble, "ru" for
 // the Russian variants (Russian Scrabble and Erudite). It routes a game's out-of-app push to the
 // matching per-language Telegram bot — by the game, not the recipient's last-login bot.
 func (v Variant) Language() string {
 	if v == VariantEnglish {
 		return "en"
 	}
 	return "ru"
 }
 // ruleset returns the scrabble-solver ruleset backing the variant and true, or
 // (nil, false) for an unrecognised variant.
 func (v Variant) ruleset() (*rules.Ruleset, bool) {
@@ -248,17 +248,29 @@ func (g *Game) Exchange(tiles []byte) (MoveRecord, error) {
 // winning regardless of score. A missed-turn timeout reuses Resign in the game
 // domain, so it inherits this win/loss.
 func (g *Game) Resign() (MoveRecord, error) {
 	return g.ResignSeat(g.toMove)
 }
 // ResignSeat resigns a specific seat regardless of whose turn it is, so a player
 // may forfeit on the opponent's turn. The resigning seat always loses (winner()
 // skips resigned seats). The turn cursor only advances when the seat that resigned
 // was the one to move; resigning an off-turn seat leaves the current player's turn
 // intact. It returns ErrGameOver on a finished game or for an out-of-range or
 // already-resigned seat.
 func (g *Game) ResignSeat(seat int) (MoveRecord, error) {
 	if g.over {
 		return MoveRecord{}, ErrGameOver
 	}
-	player := g.toMove
+	if seat < 0 || seat >= len(g.hands) || g.resigned[seat] {
-	g.resigned[player] = true
+		return MoveRecord{}, ErrGameOver
-	g.disposeHand(player)
+	}
-	rec := MoveRecord{Player: player, Action: ActionResign, Total: g.scores[player]}
+	g.resigned[seat] = true
 	g.disposeHand(seat)
 	rec := MoveRecord{Player: seat, Action: ActionResign, Total: g.scores[seat]}
 	g.log = append(g.log, rec)
 	if g.activeCount() <= 1 {
 		g.finish(EndResign)
-	} else {
+	} else if seat == g.toMove {
 		g.advance()
 	}
 	return rec, nil
@@ -60,7 +60,7 @@ func TestRegistryValidatesKnownWords(t *testing.T) {
 func TestRegistryUnknownLookups(t *testing.T) {
 	reg, err := Open(testDictDir(), testVersion, VariantEnglish)
 	if err != nil {
-		t.Fatalf("open english-only registry: %v", err)
+		t.Fatalf("open scrabble_en-only registry: %v", err)
 	}
 	defer reg.Close()
@@ -45,13 +45,13 @@ func TestLoadAvailableLoadsPresentSkipsAbsent(t *testing.T) {
 		t.Fatalf("load available: %v", err)
 	}
 	if len(loaded) != 1 || loaded[0] != VariantEnglish {
-		t.Fatalf("loaded = %v, want [english]", loaded)
+		t.Fatalf("loaded = %v, want [scrabble_en]", loaded)
 	}
 	if _, err := reg.Solver(VariantEnglish, "v2"); err != nil {
-		t.Errorf("english v2 solver: %v", err)
+		t.Errorf("scrabble_en v2 solver: %v", err)
 	}
 	if _, err := reg.Solver(VariantRussianScrabble, "v2"); !errors.Is(err, ErrUnknownVariant) {
-		t.Errorf("russian v2 should be absent: got %v", err)
+		t.Errorf("scrabble_ru v2 should be absent: got %v", err)
 	}
 }
@@ -77,17 +77,17 @@ func TestOpenWithVersionsScansSubdirs(t *testing.T) {
 		}
 	}
 	if got := reg.Versions(VariantEnglish); len(got) != 2 {
-		t.Errorf("english versions = %v, want two", got)
+		t.Errorf("scrabble_en versions = %v, want two", got)
 	}
 	latest, _, err := reg.Latest(VariantEnglish)
 	if err != nil {
-		t.Fatalf("latest english: %v", err)
+		t.Fatalf("latest scrabble_en: %v", err)
 	}
 	if latest != "v2" {
-		t.Errorf("latest english = %q, want v2", latest)
+		t.Errorf("latest scrabble_en = %q, want v2", latest)
 	}
 	if got := reg.Versions(VariantRussianScrabble); len(got) != 1 {
-		t.Errorf("russian versions = %v, want one (no v2 file)", got)
+		t.Errorf("scrabble_ru versions = %v, want one (no v2 file)", got)
 	}
 }
@@ -69,6 +69,39 @@ func TestResignTrailingPlayerLoses(t *testing.T) {
 	}
 }
 // TestResignSeatOffTurn covers a forfeit on the opponent's turn: after player 0
 // moves it is player 1's turn, yet player 0 resigns its own seat — the resigner
 // loses, the opponent wins, and the game ends.
 func TestResignSeatOffTurn(t *testing.T) {
 	g := openingGame(t)
 	hint, ok := g.HintView()
 	if !ok {
 		t.Fatal("opening game has no hint")
 	}
 	if _, err := g.SubmitPlay(hint.Dir, hint.Tiles); err != nil { // player 0 moves
 		t.Fatalf("player 0 play: %v", err)
 	}
 	if g.ToMove() != 1 {
 		t.Fatalf("after player 0's move, toMove = %d, want 1", g.ToMove())
 	}
 	// Player 0 resigns although it is player 1's turn.
 	rec, err := g.ResignSeat(0)
 	if err != nil {
 		t.Fatalf("player 0 off-turn resign: %v", err)
 	}
 	if rec.Player != 0 || rec.Action != ActionResign {
 		t.Errorf("resign record = seat %d action %v, want seat 0 resign", rec.Player, rec.Action)
 	}
 	if !g.Over() || g.Reason() != EndResign {
 		t.Fatalf("game over=%v reason=%v, want over with resign", g.Over(), g.Reason())
 	}
 	if res := g.Result(); res.Winner != 1 {
 		t.Errorf("winner = %d, want 1 (the non-resigner)", res.Winner)
 	}
 }
 // TestResignOnFinishedGame rejects a second transition.
 func TestResignOnFinishedGame(t *testing.T) {
 	g := newEnglishGame(t, 1)
@@ -0,0 +1,19 @@
 package engine
 import "testing"
 // TestVariantLanguage checks the variant -> bot-language mapping that routes a game's out-of-app
 // push by the game itself (English -> en, the Russian variants -> ru), rather than the recipient's
 // last-login bot.
 func TestVariantLanguage(t *testing.T) {
 	cases := map[Variant]string{
 		VariantEnglish:         "en",
 		VariantRussianScrabble: "ru",
 		VariantErudit:          "ru",
 	}
 	for v, want := range cases {
 		if got := v.Language(); got != want {
 			t.Errorf("%s.Language() = %q, want %q", v, got, want)
 		}
 	}
 }
@@ -0,0 +1,116 @@
 package game
 import (
 	"context"
 	"fmt"
 	"strings"
 	"github.com/google/uuid"
 )
 // A move's "duration" is the think time from the previous move's commit (the moment
 // the turn started) to this move's commit. Only play/pass/exchange moves count;
 // timeouts and resignations are not think time. The very first move of a game has no
 // previous move, so its baseline is the game's creation time. The figures are derived
 // from the move journal (game_moves.created_at), so no schema change is needed.
 //
 // timedMovesCTE is the shared subquery yielding (account, game, ordinal, seconds) for
 // every timed move; the two reports aggregate it differently.
 const timedMovesCTE = `
  SELECT gp.account_id AS aid,
         m.game_id AS gid,
         ROW_NUMBER() OVER (PARTITION BY m.game_id ORDER BY m.seq) AS ord,
         EXTRACT(EPOCH FROM (m.created_at - COALESCE(prev.created_at, g.created_at))) AS secs
  FROM backend.game_moves m
  JOIN backend.games g ON g.game_id = m.game_id
  LEFT JOIN backend.game_moves prev ON prev.game_id = m.game_id AND prev.seq = m.seq - 1
  JOIN backend.game_players gp ON gp.game_id = m.game_id AND gp.seat = m.seat
  WHERE m.action IN ('play', 'pass', 'exchange')`
 // MoveDurationStat is the min, max and mean per-move think time (in seconds) for an
 // account across all its games, with the number of timed moves counted.
 type MoveDurationStat struct {
 	MinSecs float64
 	MaxSecs float64
 	AvgSecs float64
 	Moves   int
 }
 // MoveDurationStats returns the move-duration summary for each of accountIDs that has
 // at least one timed move; accounts with none are absent from the map. It powers the
 // admin user-list columns. The scan over the journal is acceptable for the low-traffic
 // console; per-human analysis is the authoritative use (the live metric aggregates all
 // seats including robots).
 func (s *Store) MoveDurationStats(ctx context.Context, accountIDs []uuid.UUID) (map[uuid.UUID]MoveDurationStat, error) {
 	if len(accountIDs) == 0 {
 		return map[uuid.UUID]MoveDurationStat{}, nil
 	}
 	q := `WITH d AS (` + timedMovesCTE + `)
 SELECT aid, MIN(secs), MAX(secs), AVG(secs), COUNT(*) FROM d WHERE aid = ANY($1::uuid[]) GROUP BY aid`
 	rows, err := s.db.QueryContext(ctx, q, uuidArrayLiteral(accountIDs))
 	if err != nil {
 		return nil, fmt.Errorf("game: move-duration stats: %w", err)
 	}
 	defer rows.Close()
 	out := make(map[uuid.UUID]MoveDurationStat, len(accountIDs))
 	for rows.Next() {
 		var id uuid.UUID
 		var st MoveDurationStat
 		if err := rows.Scan(&id, &st.MinSecs, &st.MaxSecs, &st.AvgSecs, &st.Moves); err != nil {
 			return nil, fmt.Errorf("game: scan move-duration stat: %w", err)
 		}
 		out[id] = st
 	}
 	return out, rows.Err()
 }
 // OrdinalDuration is the min/max/mean think time (seconds) at an account's k-th move
 // (Ordinal) across all its games.
 type OrdinalDuration struct {
 	Ordinal int
 	MinSecs float64
 	MaxSecs float64
 	AvgSecs float64
 }
 // MoveDurationByOrdinal returns the account's per-move-number think-time summary,
 // ordered by move number, for the admin user-detail chart. The ordinal counts the
 // account's own moves within each game (its 1st, 2nd, … move).
 func (s *Store) MoveDurationByOrdinal(ctx context.Context, accountID uuid.UUID) ([]OrdinalDuration, error) {
 	q := `WITH d AS (` + timedMovesCTE + ` AND gp.account_id = $1)
 SELECT ord, MIN(secs), MAX(secs), AVG(secs) FROM d GROUP BY ord ORDER BY ord`
 	rows, err := s.db.QueryContext(ctx, q, accountID)
 	if err != nil {
 		return nil, fmt.Errorf("game: move-duration by ordinal: %w", err)
 	}
 	defer rows.Close()
 	var out []OrdinalDuration
 	for rows.Next() {
 		var od OrdinalDuration
 		if err := rows.Scan(&od.Ordinal, &od.MinSecs, &od.MaxSecs, &od.AvgSecs); err != nil {
 			return nil, fmt.Errorf("game: scan ordinal duration: %w", err)
 		}
 		out = append(out, od)
 	}
 	return out, rows.Err()
 }
 // uuidArrayLiteral renders ids as a Postgres array literal ("{u1,u2,…}") for an
 // ANY($1::uuid[]) parameter. UUIDs are fixed-format, so the literal is injection-safe.
 func uuidArrayLiteral(ids []uuid.UUID) string {
 	ss := make([]string, len(ids))
 	for i, id := range ids {
 		ss[i] = id.String()
 	}
 	return "{" + strings.Join(ss, ",") + "}"
 }
 // MoveDurationStats exposes the store report to the admin console handlers.
 func (svc *Service) MoveDurationStats(ctx context.Context, accountIDs []uuid.UUID) (map[uuid.UUID]MoveDurationStat, error) {
 	return svc.store.MoveDurationStats(ctx, accountIDs)
 }
 // MoveDurationByOrdinal exposes the per-move-number report to the admin console.
 func (svc *Service) MoveDurationByOrdinal(ctx context.Context, accountID uuid.UUID) ([]OrdinalDuration, error) {
 	return svc.store.MoveDurationByOrdinal(ctx, accountID)
 }
@@ -0,0 +1,163 @@
 package game
 import (
 	"context"
 	"database/sql"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"slices"
 	"github.com/google/uuid"
 	"scrabble/backend/internal/engine"
 )
 // DraftTile is one tile a player has laid on the board but not yet submitted.
 type DraftTile struct {
 	Row    int    `json:"row"`
 	Col    int    `json:"col"`
 	Letter string `json:"letter"`
 	Blank  bool   `json:"blank"`
 }
 // Draft is a player's persisted client-side composition for a game: the
 // preferred rack tile order and the board tiles laid but not yet submitted. The server
 // keeps it so a reload or a second device resumes the same arrangement.
 type Draft struct {
 	RackOrder  string
 	BoardTiles []DraftTile
 }
 // GetDraft returns the player's draft for a game, or a zero Draft when none is stored.
 func (svc *Service) GetDraft(ctx context.Context, gameID, accountID uuid.UUID) (Draft, error) {
 	return svc.store.getDraft(ctx, gameID, accountID)
 }
 // SaveDraft upserts the player's draft; the account must be seated in the game.
 func (svc *Service) SaveDraft(ctx context.Context, gameID, accountID uuid.UUID, d Draft) error {
 	seats, _, _, err := svc.Participants(ctx, gameID)
 	if err != nil {
 		return err
 	}
 	if !slices.Contains(seats, accountID) {
 		return ErrNotAPlayer
 	}
 	return svc.store.saveDraft(ctx, gameID, accountID, d)
 }
 // getDraft reads one draft row, returning a zero Draft when absent.
 func (s *Store) getDraft(ctx context.Context, gameID, accountID uuid.UUID) (Draft, error) {
 	var rackOrder string
 	var boardJSON []byte
 	err := s.db.QueryRowContext(ctx,
 		`SELECT rack_order, board_tiles FROM backend.game_drafts WHERE game_id = $1 AND account_id = $2`,
 		gameID, accountID).Scan(&rackOrder, &boardJSON)
 	if errors.Is(err, sql.ErrNoRows) {
 		return Draft{}, nil
 	}
 	if err != nil {
 		return Draft{}, fmt.Errorf("game: get draft %s: %w", gameID, err)
 	}
 	d := Draft{RackOrder: rackOrder}
 	if len(boardJSON) > 0 {
 		if err := json.Unmarshal(boardJSON, &d.BoardTiles); err != nil {
 			return Draft{}, fmt.Errorf("game: decode draft tiles: %w", err)
 		}
 	}
 	return d, nil
 }
 // saveDraft upserts the player's draft.
 func (s *Store) saveDraft(ctx context.Context, gameID, accountID uuid.UUID, d Draft) error {
 	tiles := d.BoardTiles
 	if tiles == nil {
 		tiles = []DraftTile{}
 	}
 	boardJSON, err := json.Marshal(tiles)
 	if err != nil {
 		return fmt.Errorf("game: encode draft tiles: %w", err)
 	}
 	if _, err := s.db.ExecContext(ctx,
 		`INSERT INTO backend.game_drafts (game_id, account_id, rack_order, board_tiles, updated_at)
 		 VALUES ($1, $2, $3, $4, now())
 		 ON CONFLICT (game_id, account_id)
 		 DO UPDATE SET rack_order = $3, board_tiles = $4, updated_at = now()`,
 		gameID, accountID, d.RackOrder, boardJSON); err != nil {
 		return fmt.Errorf("game: save draft: %w", err)
 	}
 	return nil
 }
 // clearDraft drops a player's draft row (their composition is consumed or discarded).
 func (s *Store) clearDraft(ctx context.Context, gameID, accountID uuid.UUID) error {
 	if _, err := s.db.ExecContext(ctx,
 		`DELETE FROM backend.game_drafts WHERE game_id = $1 AND account_id = $2`,
 		gameID, accountID); err != nil {
 		return fmt.Errorf("game: clear draft: %w", err)
 	}
 	return nil
 }
 // resetConflictingBoardDrafts clears the board_tiles of every OTHER player's draft that has
 // a tile on one of the just-committed cells, since that draft can no longer be placed; the
 // rack order is kept.
 func (s *Store) resetConflictingBoardDrafts(ctx context.Context, gameID, actorID uuid.UUID, cells []DraftTile) error {
 	if len(cells) == 0 {
 		return nil
 	}
 	occupied := make(map[[2]int]bool, len(cells))
 	for _, c := range cells {
 		occupied[[2]int{c.Row, c.Col}] = true
 	}
 	rows, err := s.db.QueryContext(ctx,
 		`SELECT account_id, board_tiles FROM backend.game_drafts
 		 WHERE game_id = $1 AND account_id <> $2 AND board_tiles <> '[]'::jsonb`,
 		gameID, actorID)
 	if err != nil {
 		return fmt.Errorf("game: scan drafts for conflict: %w", err)
 	}
 	var toClear []uuid.UUID
 	func() {
 		defer func() { _ = rows.Close() }()
 		for rows.Next() {
 			var acc uuid.UUID
 			var boardJSON []byte
 			if err = rows.Scan(&acc, &boardJSON); err != nil {
 				return
 			}
 			var tiles []DraftTile
 			if json.Unmarshal(boardJSON, &tiles) != nil {
 				continue // skip a malformed draft
 			}
 			for _, t := range tiles {
 				if occupied[[2]int{t.Row, t.Col}] {
 					toClear = append(toClear, acc)
 					break
 				}
 			}
 		}
 		err = rows.Err()
 	}()
 	if err != nil {
 		return fmt.Errorf("game: read drafts for conflict: %w", err)
 	}
 	for _, acc := range toClear {
 		if _, err := s.db.ExecContext(ctx,
 			`UPDATE backend.game_drafts SET board_tiles = '[]'::jsonb, updated_at = now()
 			 WHERE game_id = $1 AND account_id = $2`,
 			gameID, acc); err != nil {
 			return fmt.Errorf("game: clear conflicting draft: %w", err)
 		}
 	}
 	return nil
 }
 // draftTilesFrom projects a play's committed tiles into draft cells, for the conflict scan.
 func draftTilesFrom(rec engine.MoveRecord) []DraftTile {
 	out := make([]DraftTile, 0, len(rec.Tiles))
 	for _, t := range rec.Tiles {
 		out = append(out, DraftTile{Row: t.Row, Col: t.Col, Letter: t.Letter, Blank: t.Blank})
 	}
 	return out
 }
@@ -0,0 +1,112 @@
 package game
 import (
 	"context"
 	"slices"
 	"testing"
 	"time"
 	"github.com/google/uuid"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/notify"
 	fb "scrabble/pkg/fbs/scrabblefb"
 )
 // recordingPublisher captures every published intent for assertions.
 type recordingPublisher struct{ intents []notify.Intent }
 func (p *recordingPublisher) Publish(in ...notify.Intent) { p.intents = append(p.intents, in...) }
 // TestEmitMoveNotifiesActor checks a committed move sends opponent_moved to every
 // seat — including the actor's own account, so the mover's other devices refresh —
 // and your_turn only to the next mover.
 func TestEmitMoveNotifiesActor(t *testing.T) {
 	actor, opp := uuid.New(), uuid.New()
 	pub := &recordingPublisher{}
 	svc := &Service{pub: pub}
 	g := Game{
 		ID:            uuid.New(),
 		Status:        StatusActive,
 		ToMove:        1,
 		TurnStartedAt: time.Now(),
 		TurnTimeout:   time.Hour,
 		Seats:         []Seat{{Seat: 0, AccountID: actor, Score: 19}, {Seat: 1, AccountID: opp, Score: 13}},
 	}
 	svc.emitMove(context.Background(), g, engine.MoveRecord{Player: 0, Action: engine.ActionPlay, Words: []string{"HELLO"}, Score: 10, Total: 19}, 80)
 	kinds := map[uuid.UUID][]string{}
 	var yourTurn notify.Intent
 	for _, in := range pub.intents {
 		kinds[in.UserID] = append(kinds[in.UserID], in.Kind)
 		if in.UserID == opp && in.Kind == notify.KindYourTurn {
 			yourTurn = in
 		}
 	}
 	if !slices.Contains(kinds[actor], notify.KindOpponentMoved) {
 		t.Errorf("actor should get opponent_moved, got %v", kinds[actor])
 	}
 	if !slices.Contains(kinds[opp], notify.KindOpponentMoved) {
 		t.Errorf("opponent should get opponent_moved, got %v", kinds[opp])
 	}
 	if !slices.Contains(kinds[opp], notify.KindYourTurn) {
 		t.Errorf("next mover should get your_turn, got %v", kinds[opp])
 	}
 	if slices.Contains(kinds[actor], notify.KindYourTurn) {
 		t.Errorf("actor is not next to move, should not get your_turn")
 	}
 	// The your_turn push is enriched: the last move's action and word, and a recipient-first
 	// score line (the next mover, seat 1, first). The opponent name needs the account store and
 	// is left empty by this store-less unit (covered at the render layer).
 	yt := fb.GetRootAsYourTurnEvent(yourTurn.Payload, 0)
 	if got := string(yt.LastAction()); got != "play" {
 		t.Errorf("your_turn last_action = %q, want play", got)
 	}
 	if got := string(yt.LastWord()); got != "HELLO" {
 		t.Errorf("your_turn last_word = %q, want HELLO", got)
 	}
 	if got := string(yt.ScoreLine()); got != "13:19" { // seat 1 (recipient) first, then seat 0
 		t.Errorf("your_turn score_line = %q, want 13:19", got)
 	}
 	// Routed out-of-app by the game's language (the default Variant is English).
 	if yourTurn.Language != "en" {
 		t.Errorf("your_turn language = %q, want en", yourTurn.Language)
 	}
 }
 // TestEmitMoveAnnouncesGameOver checks the closing move sends a game_over push to every seat,
 // each with its own outcome and a recipient-first final score.
 func TestEmitMoveAnnouncesGameOver(t *testing.T) {
 	winner, loser := uuid.New(), uuid.New()
 	pub := &recordingPublisher{}
 	svc := &Service{pub: pub}
 	g := Game{
 		ID:        uuid.New(),
 		Status:    StatusFinished,
 		Players:   2,
 		EndReason: "out_of_tiles",
 		Seats:     []Seat{{Seat: 0, AccountID: winner, Score: 120, IsWinner: true}, {Seat: 1, AccountID: loser, Score: 95}},
 	}
 	svc.emitMove(context.Background(), g, engine.MoveRecord{Player: 0, Action: engine.ActionPlay, Total: 120}, 0)
 	over := map[uuid.UUID]notify.Intent{}
 	for _, in := range pub.intents {
 		if in.Kind == notify.KindGameOver {
 			over[in.UserID] = in
 		}
 	}
 	if len(over) != 2 {
 		t.Fatalf("game_over should reach both seats, got %d", len(over))
 	}
 	w := fb.GetRootAsGameOverEvent(over[winner].Payload, 0)
 	if string(w.Result()) != "won" || string(w.ScoreLine()) != "120:95" {
 		t.Errorf("winner game_over = %q / %q, want won / 120:95", w.Result(), w.ScoreLine())
 	}
 	l := fb.GetRootAsGameOverEvent(over[loser].Payload, 0)
 	if string(l.Result()) != "lost" || string(l.ScoreLine()) != "95:120" {
 		t.Errorf("loser game_over = %q / %q, want lost / 95:120", l.Result(), l.ScoreLine())
 	}
 	if over[winner].Language != "en" || over[loser].Language != "en" {
 		t.Errorf("game_over languages = %q/%q, want en/en", over[winner].Language, over[loser].Language)
 	}
 }
@@ -0,0 +1,79 @@
 package game
 import (
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/notify"
 )
 // The mappers below project the game domain into the wire-agnostic notify.* input
 // structs the enriched live events carry. They keep the wire schema out of the
 // game package: notify owns the FlatBuffers encoding, this file only resolves the
 // values (seat display names, last-activity sort key) into its input shapes.
 // gameSummary projects a game.Game into the notify.GameSummary embedded in enriched
 // events. names is the seat-indexed display-name slice from seatNames; LastActivityUnix
 // mirrors the gateway view (the current turn's start while active, the finish time once
 // finished).
 func gameSummary(g Game, names []string) notify.GameSummary {
 	seats := make([]notify.SeatStanding, 0, len(g.Seats))
 	for _, s := range g.Seats {
 		name := ""
 		if s.Seat >= 0 && s.Seat < len(names) {
 			name = names[s.Seat]
 		}
 		seats = append(seats, notify.SeatStanding{
 			Seat:        s.Seat,
 			AccountID:   s.AccountID.String(),
 			DisplayName: name,
 			Score:       s.Score,
 			HintsUsed:   s.HintsUsed,
 			IsWinner:    s.IsWinner,
 		})
 	}
 	last := g.TurnStartedAt
 	if g.FinishedAt != nil {
 		last = *g.FinishedAt
 	}
 	return notify.GameSummary{
 		ID:               g.ID.String(),
 		Variant:          g.Variant.String(),
 		DictVersion:      g.DictVersion,
 		Status:           g.Status,
 		Players:          g.Players,
 		ToMove:           g.ToMove,
 		TurnTimeoutSecs:  int(g.TurnTimeout.Seconds()),
 		MoveCount:        g.MoveCount,
 		EndReason:        g.EndReason,
 		Seats:            seats,
 		LastActivityUnix: last.Unix(),
 	}
 }
 // playerState projects a StateView into the notify.PlayerState carried by the
 // match_found / game_started events. The rack is re-encoded to wire alphabet indices;
 // the variant alphabet display table is embedded when includeAlphabet is set (an
 // initial view whose recipient may not have cached the variant yet).
 func playerState(v StateView, names []string, includeAlphabet bool) (notify.PlayerState, error) {
 	rack, err := engine.EncodeRack(v.Game.Variant, v.Rack)
 	if err != nil {
 		return notify.PlayerState{}, err
 	}
 	ps := notify.PlayerState{
 		Game:           gameSummary(v.Game, names),
 		Seat:           v.Seat,
 		Rack:           rack,
 		BagLen:         v.BagLen,
 		HintsRemaining: v.HintsRemaining,
 	}
 	if includeAlphabet {
 		tab, err := engine.AlphabetTable(v.Game.Variant)
 		if err != nil {
 			return notify.PlayerState{}, err
 		}
 		ps.Alphabet = make([]notify.AlphabetLetter, len(tab))
 		for i, e := range tab {
 			ps.Alphabet[i] = notify.AlphabetLetter{Index: int(e.Index), Letter: e.Letter, Value: e.Value}
 		}
 	}
 	return ps, nil
 }
@@ -40,7 +40,7 @@ func TestWriteGCG(t *testing.T) {
 		"#character-encoding UTF-8",
 		"#player1 p1 Alice",
 		"#player2 p2 Bob",
-		"#lexicon english/v1",
+		"#lexicon scrabble_en/v1",
 		"#title game 00000000-0000-7000-8000-000000000001",
 		">p1: CATSER? 8H CAT +10 10",
 		">p2: AS?E I8 .s +2 2",
@@ -94,7 +94,7 @@ func TestGameCacheEviction(t *testing.T) {
 	cur := time.Unix(1_700_000_000, 0)
 	cache := newGameCache(time.Hour, func() time.Time { return cur })
 	id := uuid.New()
-	cache.put(id, nil, "english")
+	cache.put(id, nil, "scrabble_en")
 	if _, ok := cache.get(id); !ok {
 		t.Fatal("game must be resident after put")
 	}
@@ -16,12 +16,13 @@ import (
 const meterName = "scrabble/backend/game"
 // gameMetrics holds the game domain's operational instruments. Every game-scoped
-// measurement carries a "variant" attribute (english/russian/erudit). The
+// measurement carries a "variant" attribute (scrabble_en/scrabble_ru/erudit_ru). The
 // instruments default to no-ops (see defaultGameMetrics), so recording is always
 // safe; SetMetrics installs the real meter during startup wiring.
 type gameMetrics struct {
 	replay    metric.Float64Histogram
 	validate  metric.Float64Histogram
 	moveDur   metric.Float64Histogram
 	started   metric.Int64Counter
 	abandoned metric.Int64Counter
 }
@@ -39,6 +40,7 @@ func newGameMetrics(meter metric.Meter) *gameMetrics {
 	return &gameMetrics{
 		replay:    histogram(meter, "game_replay_duration", "Seconds to rebuild a live game from its journal on a cache miss."),
 		validate:  histogram(meter, "game_move_validate_duration", "Seconds to validate and score a tentative play (EvaluatePlay)."),
 		moveDur:   histogram(meter, "game_move_duration", "Seconds a seat spent on a committed move (play/pass/exchange), by variant and phase. Aggregates all seats including robots; per-human analysis lives in the admin console."),
 		started:   counter(meter, "games_started_total", "Games created and started."),
 		abandoned: counter(meter, "games_abandoned_total", "Player seats dropped by the turn-timeout sweeper."),
 	}
@@ -75,6 +77,30 @@ func (m *gameMetrics) recordValidate(ctx context.Context, v engine.Variant, star
 	m.validate.Record(ctx, time.Since(start).Seconds(), variantAttr(v))
 }
 // recordMoveDuration records how long a seat spent on a committed move, attributed by
 // variant and the game phase derived from moveCount. A non-positive duration (a clock
 // skew or a move with no recorded turn start) is dropped.
 func (m *gameMetrics) recordMoveDuration(ctx context.Context, v engine.Variant, moveCount int, d time.Duration) {
 	if d <= 0 {
 		return
 	}
 	m.moveDur.Record(ctx, d.Seconds(),
 		metric.WithAttributes(attribute.String("variant", v.String()), attribute.String("phase", phaseOf(moveCount))))
 }
 // phaseOf buckets a move ordinal into the game phase used as a metric attribute. The
 // thresholds reflect a typical ~28-move game (docs/ARCHITECTURE.md §7).
 func phaseOf(moveCount int) string {
 	switch {
 	case moveCount <= 8:
 		return "opening"
 	case moveCount <= 20:
 		return "middle"
 	default:
 		return "endgame"
 	}
 }
 // recordStarted counts one started game of variant.
 func (m *gameMetrics) recordStarted(ctx context.Context, v engine.Variant) {
 	m.started.Add(ctx, 1, variantAttr(v))
@@ -26,6 +26,8 @@ func TestGameMetrics(t *testing.T) {
 	m.recordAbandoned(ctx, engine.VariantErudit)
 	m.recordReplay(ctx, engine.VariantEnglish, time.Now().Add(-time.Millisecond))
 	m.recordValidate(ctx, engine.VariantRussianScrabble, time.Now().Add(-time.Millisecond))
 	m.recordMoveDuration(ctx, engine.VariantEnglish, 3, 5*time.Second)
 	m.recordMoveDuration(ctx, engine.VariantEnglish, 3, 0) // non-positive: dropped
 	var rm metricdata.ResourceMetrics
 	if err := reader.Collect(ctx, &rm); err != nil {
@@ -33,11 +35,11 @@ func TestGameMetrics(t *testing.T) {
 	}
 	started := counterByAttr(t, rm, "games_started_total", "variant")
-	if started["english"] != 2 || started["russian_scrabble"] != 1 {
+	if started["scrabble_en"] != 2 || started["scrabble_ru"] != 1 {
-		t.Errorf("games_started_total = %v, want english:2 russian_scrabble:1", started)
+		t.Errorf("games_started_total = %v, want scrabble_en:2 scrabble_ru:1", started)
 	}
-	if abandoned := counterByAttr(t, rm, "games_abandoned_total", "variant"); abandoned["erudit"] != 1 {
+	if abandoned := counterByAttr(t, rm, "games_abandoned_total", "variant"); abandoned["erudit_ru"] != 1 {
-		t.Errorf("games_abandoned_total = %v, want erudit:1", abandoned)
+		t.Errorf("games_abandoned_total = %v, want erudit_ru:1", abandoned)
 	}
 	if c := histogramCount(t, rm, "game_replay_duration"); c != 1 {
 		t.Errorf("game_replay_duration observations = %d, want 1", c)
@@ -45,6 +47,19 @@ func TestGameMetrics(t *testing.T) {
 	if c := histogramCount(t, rm, "game_move_validate_duration"); c != 1 {
 		t.Errorf("game_move_validate_duration observations = %d, want 1", c)
 	}
 	if c := histogramCount(t, rm, "game_move_duration"); c != 1 {
 		t.Errorf("game_move_duration observations = %d, want 1 (zero-duration dropped)", c)
 	}
 }
 // TestPhaseOf checks the move-ordinal to phase bucketing.
 func TestPhaseOf(t *testing.T) {
 	cases := map[int]string{1: "opening", 8: "opening", 9: "middle", 20: "middle", 21: "endgame", 50: "endgame"}
 	for mc, want := range cases {
 		if got := phaseOf(mc); got != want {
 			t.Errorf("phaseOf(%d) = %q, want %q", mc, got, want)
 		}
 	}
 }
 // counterByAttr sums the int64 counter named name, grouped by the value of the
@@ -7,6 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -171,20 +172,79 @@ func (svc *Service) Exchange(ctx context.Context, gameID, accountID uuid.UUID, t
 }
 // Resign ends the game on the player's turn; the remaining player wins.
 // Resign forfeits the game for the acting account. Unlike a play/exchange/pass it is
 // allowed on the opponent's turn (a resignation is not a turn-scoped move), so it does
 // not go through transition's turn check: it resigns the actor's own seat, whoever is to
 // move. The resigning seat always loses (docs/ARCHITECTURE.md §7).
 func (svc *Service) Resign(ctx context.Context, gameID, accountID uuid.UUID) (MoveResult, error) {
-	return svc.transition(ctx, gameID, accountID, func(g *engine.Game) (engine.MoveRecord, []string, error) {
+	pre, err := svc.store.GetGame(ctx, gameID)
-		rec, err := g.Resign()
+	if err != nil {
-		return rec, nil, err
+		return MoveResult{}, err
-	})
+	}
 	seat, ok := pre.seatOf(accountID)
 	if !ok {
 		return MoveResult{}, ErrNotAPlayer
 	}
 	if pre.Status != StatusActive {
 		return MoveResult{}, ErrFinished
 	}
 	unlock := svc.locks.lock(gameID)
 	defer unlock()
 	g, err := svc.liveGame(ctx, pre)
 	if err != nil {
 		return MoveResult{}, err
 	}
 	if g.Over() {
 		return MoveResult{}, ErrFinished
 	}
 	rackBefore := g.Hand(seat)
 	rec, err := g.ResignSeat(seat)
 	if err != nil {
 		return MoveResult{}, err
 	}
 	post, err := svc.commit(ctx, gameID, g, rec, rec.Action.String(), rackBefore, nil, pre.Seats)
 	if err != nil {
 		return MoveResult{}, err
 	}
 	svc.afterCommitDrafts(ctx, gameID, accountID, rec)
 	// A resignation carries no think time (it can happen on the opponent's turn), so it
 	// is intentionally excluded from the move-duration metric.
 	return MoveResult{Move: rec, Game: post}, nil
 }
 // GameVariant returns just a game's variant. The edge layer uses it to map wire alphabet
 // indices to concrete letters before delegating to the letter-based play, exchange and
-// word-check methods (Stage 13), keeping a single domain path shared with the robot.
+// word-check methods, keeping a single domain path shared with the robot.
 func (svc *Service) GameVariant(ctx context.Context, gameID uuid.UUID) (engine.Variant, error) {
 	return svc.store.GetGameVariant(ctx, gameID)
 }
 // GameLanguage returns the game's language tag ("en"/"ru"), derived from its variant, so a
 // game push routes out-of-app to the game's own bot rather than the recipient's last-login bot.
 func (svc *Service) GameLanguage(ctx context.Context, gameID uuid.UUID) (string, error) {
 	v, err := svc.GameVariant(ctx, gameID)
 	if err != nil {
 		return "", err
 	}
 	return v.Language(), nil
 }
 // RobotSchedule returns a game's bag seed and turn-start time, for the admin console's
 // robot-schedule panel (the deterministic play-to-win intent and next-move ETA).
 func (svc *Service) RobotSchedule(ctx context.Context, gameID uuid.UUID) (seed int64, turnStartedAt time.Time, err error) {
 	return svc.store.RobotSchedule(ctx, gameID)
 }
 // LastMoveAt returns the time of an account's most recent move in a game (and whether it
 // has moved). The social service uses it to reset the nudge cooldown once a player has
 // taken a turn.
 func (svc *Service) LastMoveAt(ctx context.Context, gameID, accountID uuid.UUID) (time.Time, bool, error) {
 	return svc.store.LastMoveAt(ctx, gameID, accountID)
 }
 // transition validates the actor and turn, applies op under the per-game lock and
 // commits the result.
 func (svc *Service) transition(ctx context.Context, gameID, accountID uuid.UUID, op engineOp) (MoveResult, error) {
@@ -226,7 +286,26 @@ func (svc *Service) transition(ctx context.Context, gameID, accountID uuid.UUID,
 	if err != nil {
 		return MoveResult{}, err
 	}
-	return MoveResult{Move: rec, Game: post}, nil
+	svc.afterCommitDrafts(ctx, gameID, accountID, rec)
 	// Record the seat's think time (turn start to commit) for the move-duration
 	// metric; the timeout path commits separately and is excluded by design.
 	svc.metrics.recordMoveDuration(ctx, pre.Variant, post.MoveCount, svc.clock().Sub(pre.TurnStartedAt))
 	return MoveResult{Move: rec, Game: post, Rack: g.Hand(seat), BagLen: g.BagLen()}, nil
 }
 // afterCommitDrafts maintains the drafts after a committed move: the actor's own
 // composition is consumed, so clear it; a play's tiles may overlap an opponent's board
 // draft, which is then reset. Best-effort — the move is already committed, so a draft
 // cleanup failure is logged rather than failing the move.
 func (svc *Service) afterCommitDrafts(ctx context.Context, gameID, accountID uuid.UUID, rec engine.MoveRecord) {
 	if err := svc.store.clearDraft(ctx, gameID, accountID); err != nil {
 		svc.log.Warn("clear actor draft", zap.Error(err))
 	}
 	if rec.Action == engine.ActionPlay {
 		if err := svc.store.resetConflictingBoardDrafts(ctx, gameID, accountID, draftTilesFrom(rec)); err != nil {
 			svc.log.Warn("reset conflicting board drafts", zap.Error(err))
 		}
 	}
 }
 // commit persists a just-applied transition: the journal row, the post-move turn
@@ -282,30 +361,113 @@ func (svc *Service) commit(ctx context.Context, gameID uuid.UUID, g *engine.Game
 	if err != nil {
 		return Game{}, err
 	}
-	svc.emitMove(post, rec)
+	svc.emitMove(ctx, post, rec, g.BagLen())
 	return post, nil
 }
 // emitMove publishes the live events for a just-committed move: opponent_moved to
-// every seat other than the actor, and your_turn to the next mover while the game
+// every seat — including the actor's own account, so the mover's other devices (and
-// is still active. Delivery is best-effort (notify.Publisher never blocks).
+// their lobby) refresh too — and your_turn to the next mover while the game is still
-func (svc *Service) emitMove(post Game, rec engine.MoveRecord) {
+// active. opponent_moved is in-app only (the gateway never turns it into an
-	intents := make([]notify.Intent, 0, len(post.Seats)+1)
+// out-of-app push), so the actor is not notified out of band about their own move.
 // Delivery is best-effort (notify.Publisher never blocks) and the gateway fans each
 // event out to all of the recipient's live streams.
 func (svc *Service) emitMove(ctx context.Context, post Game, rec engine.MoveRecord, bagLen int) {
 	// Resolve the seat names once and reuse them for every recipient's enriched summary.
 	names := svc.seatNames(ctx, post)
 	summary := gameSummary(post, names)
 	intents := make([]notify.Intent, 0, 2*len(post.Seats))
 	for _, s := range post.Seats {
-		if s.Seat == rec.Player {
+		intents = append(intents, notify.OpponentMoved(s.AccountID, post.ID, rec, summary, bagLen))
 			continue
 		}
 		intents = append(intents, notify.OpponentMoved(s.AccountID, post.ID, rec.Player, rec.Action.String(), rec.Score, rec.Total))
 	}
-	if post.Status == StatusActive {
+	// Game pushes are routed out-of-app by the game's own language, not the recipient's
 	// last-login bot.
 	lang := post.Variant.Language()
 	switch post.Status {
 	case StatusActive:
 		if next, ok := seatAccount(post.Seats, post.ToMove); ok {
 			deadline := post.TurnStartedAt.Add(post.TurnTimeout)
-			intents = append(intents, notify.YourTurn(next, post.ID, deadline))
+			action := rec.Action.String()
 			word := ""
 			if action == "play" && len(rec.Words) > 0 {
 				word = rec.Words[0]
 			}
 			opponent := svc.displayName(ctx, post.Seats, rec.Player)
 			yourTurn := notify.YourTurn(next, post.ID, deadline, opponent, action, word, scoreLine(post, post.ToMove), post.MoveCount)
 			yourTurn.Language = lang
 			intents = append(intents, yourTurn)
 		}
 	case StatusFinished:
 		// The game just ended (any path: a closing play, all-pass, resign or timeout). Tell every
 		// seat, each with their own perspective + recipient-first score, so an offline player gets
 		// an out-of-app "game over" push (online players take it from the in-app refresh).
 		for _, s := range post.Seats {
 			over := notify.GameOver(s.AccountID, post.ID, seatResult(post.Seats, s.Seat), scoreLine(post, s.Seat), summary)
 			over.Language = lang
 			intents = append(intents, over)
 		}
 	}
 	svc.pub.Publish(intents...)
 }
 // displayName resolves the display name of the account at the given seat, or "" when the seat
 // is absent or the lookup fails (the enriched push then falls back to its plain text).
 func (svc *Service) displayName(ctx context.Context, seats []Seat, seat int) string {
 	if svc.accounts == nil {
 		return ""
 	}
 	id, ok := seatAccount(seats, seat)
 	if !ok {
 		return ""
 	}
 	acc, err := svc.accounts.GetByID(ctx, id)
 	if err != nil {
 		return ""
 	}
 	return acc.DisplayName
 }
 // scoreLine formats the running scores with recipientSeat's score first, then the remaining
 // seats in seat order, colon-joined (e.g. "120:95:80") — the recipient-first form used in the
 // out-of-app notifications.
 func scoreLine(g Game, recipientSeat int) string {
 	n := len(g.Seats)
 	bySeat := make([]int, n)
 	for _, s := range g.Seats {
 		if s.Seat >= 0 && s.Seat < n {
 			bySeat[s.Seat] = s.Score
 		}
 	}
 	parts := make([]string, 0, n)
 	if recipientSeat >= 0 && recipientSeat < n {
 		parts = append(parts, strconv.Itoa(bySeat[recipientSeat]))
 	}
 	for seat := 0; seat < n; seat++ {
 		if seat != recipientSeat {
 			parts = append(parts, strconv.Itoa(bySeat[seat]))
 		}
 	}
 	return strings.Join(parts, ":")
 }
 // seatResult reports the finished-game outcome from recipientSeat's perspective: "draw" when no
 // seat is flagged the winner, "won" when recipientSeat is, otherwise "lost".
 func seatResult(seats []Seat, recipientSeat int) string {
 	winner := false
 	for _, s := range seats {
 		if s.IsWinner {
 			winner = true
 			if s.Seat == recipientSeat {
 				return "won"
 			}
 		}
 	}
 	if !winner {
 		return "draw"
 	}
 	return "lost"
 }
 // seatAccount returns the account seated at the given seat index, or false when
 // no seat matches (the slice is not assumed to be ordered by seat).
 func seatAccount(seats []Seat, seat int) (uuid.UUID, bool) {
@@ -625,6 +787,20 @@ func (svc *Service) GameState(ctx context.Context, gameID, accountID uuid.UUID)
 	}, nil
 }
 // InitialState returns accountID's full initial view of game gameID as the notify
 // PlayerState carried by the match_found / game_started events, so a client can
 // render a freshly started game from the event without a follow-up fetch. The variant
 // alphabet table is always embedded (the recipient may be seeing the variant for the
 // first time). It satisfies lobby.GameCreator.
 func (svc *Service) InitialState(ctx context.Context, gameID, accountID uuid.UUID) (notify.PlayerState, error) {
 	v, err := svc.GameState(ctx, gameID, accountID)
 	if err != nil {
 		return notify.PlayerState{}, err
 	}
 	names := svc.seatNames(ctx, v.Game)
 	return playerState(v, names, true)
 }
 // Participants returns the seated account IDs in seat order, the seat index whose
 // turn it is, and the game status. It is a snapshot read (no engine, no lock) that
 // lets the social package gate per-game chat and nudges without importing the
@@ -658,6 +834,30 @@ func (svc *Service) ListForAccount(ctx context.Context, accountID uuid.UUID) ([]
 	return svc.store.ListGamesForAccount(ctx, accountID)
 }
 // HideGame hides a finished game from accountID's own lobby (it stays visible to the other
 // players); it is irreversible by design. Only a player of a finished game may hide it
 // (ErrNotAPlayer / ErrGameActive otherwise); hiding an already-hidden game is a no-op.
 func (svc *Service) HideGame(ctx context.Context, accountID, gameID uuid.UUID) error {
 	g, err := svc.store.GetGame(ctx, gameID)
 	if err != nil {
 		return err
 	}
 	seated := false
 	for _, s := range g.Seats {
 		if s.AccountID == accountID {
 			seated = true
 			break
 		}
 	}
 	if !seated {
 		return ErrNotAPlayer
 	}
 	if g.Status != StatusFinished {
 		return ErrGameActive
 	}
 	return svc.store.HideGame(ctx, accountID, gameID)
 }
 // GameByID returns a game with its seats for the admin console detail view.
 func (svc *Service) GameByID(ctx context.Context, id uuid.UUID) (Game, error) {
 	return svc.store.GetGame(ctx, id)
@@ -825,6 +1025,9 @@ func (svc *Service) nonGuestSeats(ctx context.Context, seats []Seat) ([]Seat, er
 // seatNames resolves each seat's display name for GCG export.
 func (svc *Service) seatNames(ctx context.Context, g Game) []string {
 	names := make([]string, g.Players)
 	if svc.accounts == nil {
 		return names
 	}
 	for _, s := range g.Seats {
 		if acc, err := svc.accounts.GetByID(ctx, s.AccountID); err == nil {
 			names[s.Seat] = acc.DisplayName
@@ -136,7 +136,7 @@ func (s *Store) GetGame(ctx context.Context, id uuid.UUID) (Game, error) {
 }
 // GetGameVariant reads just a game's variant — a cheap single-column lookup the edge uses
-// to map wire alphabet indices to concrete letters (Stage 13) without loading the whole
+// to map wire alphabet indices to concrete letters without loading the whole
 // game and its seats.
 func (s *Store) GetGameVariant(ctx context.Context, id uuid.UUID) (engine.Variant, error) {
 	stmt := postgres.SELECT(table.Games.Variant).
@@ -186,6 +186,23 @@ func (s *Store) ListGamesForAccount(ctx context.Context, accountID uuid.UUID) ([
 	if len(grows) == 0 {
 		return nil, nil
 	}
 	// Drop games the account has hidden from its own lobby.
 	hidden, err := s.hiddenGameIDs(ctx, accountID)
 	if err != nil {
 		return nil, err
 	}
 	if len(hidden) > 0 {
 		kept := grows[:0]
 		for _, g := range grows {
 			if !hidden[g.GameID] {
 				kept = append(kept, g)
 			}
 		}
 		grows = kept
 		if len(grows) == 0 {
 			return nil, nil
 		}
 	}
 	ids := make([]postgres.Expression, len(grows))
 	for i, g := range grows {
@@ -215,6 +232,36 @@ func (s *Store) ListGamesForAccount(ctx context.Context, accountID uuid.UUID) ([
 	return out, nil
 }
 // HideGame hides a game from the account's own lobby list (idempotent). The caller validates the
 // game is finished and the account is a player.
 func (s *Store) HideGame(ctx context.Context, accountID, gameID uuid.UUID) error {
 	_, err := s.db.ExecContext(ctx,
 		`INSERT INTO backend.game_hidden (account_id, game_id) VALUES ($1, $2) ON CONFLICT DO NOTHING`,
 		accountID, gameID)
 	if err != nil {
 		return fmt.Errorf("game: hide game: %w", err)
 	}
 	return nil
 }
 // hiddenGameIDs returns the set of games the account has hidden from its lobby.
 func (s *Store) hiddenGameIDs(ctx context.Context, accountID uuid.UUID) (map[uuid.UUID]bool, error) {
 	rows, err := s.db.QueryContext(ctx, `SELECT game_id FROM backend.game_hidden WHERE account_id = $1`, accountID)
 	if err != nil {
 		return nil, fmt.Errorf("game: hidden ids: %w", err)
 	}
 	defer rows.Close()
 	out := map[uuid.UUID]bool{}
 	for rows.Next() {
 		var id uuid.UUID
 		if err := rows.Scan(&id); err != nil {
 			return nil, fmt.Errorf("game: scan hidden id: %w", err)
 		}
 		out[id] = true
 	}
 	return out, rows.Err()
 }
 // ListGames returns games for the admin games list, most-recently-updated first,
 // paginated. status filters by lifecycle ("active"/"finished") when non-empty.
 // The seats are not loaded — the list shows summaries; the detail view uses
@@ -651,6 +698,43 @@ func (s *Store) GameSeed(ctx context.Context, id uuid.UUID) (int64, error) {
 	return row.Seed, nil
 }
 // LastMoveAt returns the time of the account's most recent move in the game and true, or
 // the zero time and false when it has not moved. The social service uses it to reset the
 // nudge cooldown once the player has taken a turn.
 func (s *Store) LastMoveAt(ctx context.Context, gameID, accountID uuid.UUID) (time.Time, bool, error) {
 	var at sql.NullTime
 	err := s.db.QueryRowContext(ctx,
 		`SELECT MAX(m.created_at) FROM backend.game_moves m
 		 JOIN backend.game_players p ON p.game_id = m.game_id AND p.seat = m.seat
 		 WHERE m.game_id = $1 AND p.account_id = $2`,
 		gameID, accountID).Scan(&at)
 	if err != nil {
 		return time.Time{}, false, fmt.Errorf("game: last move at %s: %w", gameID, err)
 	}
 	if !at.Valid {
 		return time.Time{}, false, nil
 	}
 	return at.Time, true, nil
 }
 // RobotSchedule returns a game's bag seed and current turn-start time. The admin console
 // combines them with the robot strategy to show a robot seat's play-to-win intent and its
 // next-move ETA. Both are server-only state, never part of the public game view.
 func (s *Store) RobotSchedule(ctx context.Context, id uuid.UUID) (seed int64, turnStartedAt time.Time, err error) {
 	stmt := postgres.SELECT(table.Games.Seed, table.Games.TurnStartedAt).
 		FROM(table.Games).
 		WHERE(table.Games.GameID.EQ(postgres.UUID(id))).
 		LIMIT(1)
 	var row model.Games
 	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
 		if errors.Is(err, qrm.ErrNoRows) {
 			return 0, time.Time{}, ErrNotFound
 		}
 		return 0, time.Time{}, fmt.Errorf("game: get schedule %s: %w", id, err)
 	}
 	return row.Seed, row.TurnStartedAt, nil
 }
 // projectGame builds a Game from a games row and its ordered seat rows.
 func projectGame(g model.Games, seats []model.GamePlayers) (Game, error) {
 	variant, err := engine.ParseVariant(g.Variant)
@@ -15,8 +15,8 @@ const (
 	StatusFinished = "finished"
 )
-// Complaint lifecycle values. A complaint is filed StatusComplaintOpen (Stage 3)
+// Complaint lifecycle values. A complaint is filed StatusComplaintOpen
-// and closed StatusComplaintResolved by the admin review queue (Stage 10) with a
+// and closed StatusComplaintResolved by the admin review queue with a
 // Disposition. The CHECK constraints live in migration 00008.
 const (
 	StatusComplaintOpen     = "open"
@@ -124,10 +124,14 @@ func (g Game) seatOf(accountID uuid.UUID) (int, bool) {
 }
 // MoveResult is the outcome of a committed transition: the decoded move and the
-// post-move game.
+// post-move game, plus the actor's own refilled rack and the bag size after the draw
 // (Rack/BagLen), so the mover renders the next state from the response without a
 // follow-up game.state.
 type MoveResult struct {
-	Move engine.MoveRecord
+	Move   engine.MoveRecord
-	Game Game
+	Game   Game
 	Rack   []string
 	BagLen int
 }
 // HintResult is a revealed hint and the requesting player's remaining hint
@@ -6,10 +6,13 @@ import (
 	"context"
 	"errors"
 	"testing"
 	"time"
 	"github.com/google/uuid"
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 )
 // TestAccountProvisionByIdentity covers find-or-create semantics, distinct
@@ -77,7 +80,7 @@ func TestAccountProvisionByIdentity(t *testing.T) {
 }
 // TestGetStatsZeroForFreshAccount checks that an account with no finished games
-// reads back the zero statistics rather than an error (the Stage 8 stats screen).
+// reads back the zero statistics rather than an error (the stats screen).
 func TestGetStatsZeroForFreshAccount(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
@@ -108,7 +111,7 @@ func identityConfirmed(t *testing.T, kind, externalID string) bool {
 // TestProvisionTelegramSeedsNewAccountOnly checks that Telegram first contact
 // seeds the new account's language and display name from the launch fields,
 // defaults the in-app-only flag on, and never overwrites an existing account on a
-// later login (Stage 9 language seeding).
+// later login (language seeding).
 func TestProvisionTelegramSeedsNewAccountOnly(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
@@ -195,6 +198,62 @@ func TestServiceLanguageRoundTrip(t *testing.T) {
 	}
 }
 // TestHighRateFlagRoundTrip covers the soft high-rate marker: a fresh account
 // is unflagged, FlagHighRate stamps it exactly once (a second sustained episode
 // never moves the timestamp), ClearHighRateFlag reverses it, and a re-flag after
 // the operator clear takes a fresh timestamp.
 func TestHighRateFlagRoundTrip(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	acc, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
 	if !acc.FlaggedHighRateAt.IsZero() {
 		t.Fatalf("fresh FlaggedHighRateAt = %v, want zero", acc.FlaggedHighRateAt)
 	}
 	first := time.Date(2026, 6, 1, 12, 0, 0, 0, time.UTC)
 	set, err := store.FlagHighRate(ctx, acc.ID, first)
 	if err != nil {
 		t.Fatalf("flag: %v", err)
 	}
 	if !set {
 		t.Fatal("first FlagHighRate reported not set")
 	}
 	if set, err = store.FlagHighRate(ctx, acc.ID, first.Add(time.Hour)); err != nil {
 		t.Fatalf("re-flag: %v", err)
 	} else if set {
 		t.Fatal("second FlagHighRate must not overwrite the marker")
 	}
 	got, err := store.GetByID(ctx, acc.ID)
 	if err != nil {
 		t.Fatalf("get by id: %v", err)
 	}
 	if !got.FlaggedHighRateAt.Equal(first) {
 		t.Errorf("FlaggedHighRateAt = %v, want %v", got.FlaggedHighRateAt, first)
 	}
 	if err := store.ClearHighRateFlag(ctx, acc.ID); err != nil {
 		t.Fatalf("clear: %v", err)
 	}
 	if got, err = store.GetByID(ctx, acc.ID); err != nil {
 		t.Fatalf("get by id: %v", err)
 	} else if !got.FlaggedHighRateAt.IsZero() {
 		t.Errorf("cleared FlaggedHighRateAt = %v, want zero", got.FlaggedHighRateAt)
 	}
 	second := first.Add(24 * time.Hour)
 	if set, err = store.FlagHighRate(ctx, acc.ID, second); err != nil || !set {
 		t.Fatalf("re-flag after clear = (%v, %v), want (true, nil)", set, err)
 	}
 	if got, err = store.GetByID(ctx, acc.ID); err != nil {
 		t.Fatalf("get by id: %v", err)
 	} else if !got.FlaggedHighRateAt.Equal(second) {
 		t.Errorf("re-flagged FlaggedHighRateAt = %v, want %v", got.FlaggedHighRateAt, second)
 	}
 }
 // TestIdentityExternalID covers the reverse identity lookup the push-target route
 // uses: it returns the external_id for the matching kind and ErrNotFound otherwise,
 // including for a guest that carries no identity.
@@ -222,7 +281,7 @@ func TestIdentityExternalID(t *testing.T) {
 	}
 }
-// TestNotificationsInAppOnlyRoundTrip checks the Stage 9 profile flag persists
+// TestNotificationsInAppOnlyRoundTrip checks the profile flag persists
 // through UpdateProfile and reads back through GetByID.
 func TestNotificationsInAppOnlyRoundTrip(t *testing.T) {
 	ctx := context.Background()
@@ -254,3 +313,59 @@ func TestNotificationsInAppOnlyRoundTrip(t *testing.T) {
 		t.Error("GetByID still reports in-app-only after clearing")
 	}
 }
 // TestGuestAutoMatchLeavesNoStats drives a guest through a full auto-match game
 // against a robot to a natural end and checks the guest holds a seat (the
 // game_players foreign key is satisfied) yet accrues no statistics, while the
 // durable robot opponent does.
 func TestGuestAutoMatchLeavesNoStats(t *testing.T) {
 	ctx := context.Background()
 	svc := newGameService()
 	robots := newRobotService(t, svc)
 	if err := robots.EnsurePool(ctx); err != nil {
 		t.Fatalf("ensure pool: %v", err)
 	}
 	robotID, err := robots.Pick(engine.VariantEnglish)
 	if err != nil {
 		t.Fatalf("pick: %v", err)
 	}
 	guest := provisionGuest(t)
 	seed := openingSeed(t)
 	g, err := svc.Create(ctx, game.CreateParams{
 		Variant: engine.VariantEnglish, Seats: []uuid.UUID{guest, robotID},
 		TurnTimeout: 24 * time.Hour, Seed: seed,
 	})
 	if err != nil {
 		t.Fatalf("create: %v", err)
 	}
 	const robotSeat = 1 // seats = [guest, robot]
 	finished := false
 	for i := 0; i < 400 && !finished; i++ {
 		_, toMove, status, err := svc.Participants(ctx, g.ID)
 		if err != nil {
 			t.Fatalf("participants: %v", err)
 		}
 		if status != game.StatusActive {
 			finished = true
 			break
 		}
 		if toMove == robotSeat {
 			setTurnStarted(t, g.ID, daytime.Add(-2*time.Hour))
 			robots.Drive(ctx, daytime)
 			continue
 		}
 		playHuman(t, ctx, svc, g.ID, guest)
 	}
 	if !finished {
 		t.Fatal("guest game did not finish within the move budget")
 	}
 	if _, _, _, _, _, ok := readStats(t, guest); ok {
 		t.Error("a guest must not accrue a statistics row")
 	}
 	if _, _, _, _, _, ok := readStats(t, robotID); !ok {
 		t.Error("the durable robot opponent should have a statistics row")
 	}
 }
@@ -16,6 +16,7 @@ import (
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/ratewatch"
 	"scrabble/backend/internal/server"
 )
@@ -167,6 +168,111 @@ func TestConsoleServesAndGuardsCSRF(t *testing.T) {
 	}
 }
 // TestConsoleGameDetailRobotSchedule checks the admin game card surfaces a robot seat's
 // play-to-win intent and, while it is the robot's turn, its next-move ETA.
 func TestConsoleGameDetailRobotSchedule(t *testing.T) {
 	ctx := context.Background()
 	svc := newGameService()
 	robotAcc, err := account.NewStore(testDB).ProvisionRobot(ctx, "robot-admin-"+uuid.NewString(), "Robo Tester")
 	if err != nil {
 		t.Fatalf("provision robot: %v", err)
 	}
 	human := provisionAccount(t)
 	// Seat the robot first so it is to move (seat 0), exposing the next-move ETA.
 	g, err := svc.Create(ctx, game.CreateParams{
 		Variant: engine.VariantEnglish, Seats: []uuid.UUID{robotAcc.ID, human}, TurnTimeout: 24 * time.Hour, Seed: 7,
 	})
 	if err != nil {
 		t.Fatalf("create: %v", err)
 	}
 	srv := server.New(":0", server.Deps{
 		Logger: zap.NewNop(), Accounts: account.NewStore(testDB), Games: svc, Registry: testRegistry, DictDir: dictDir(),
 	})
 	code, body := consoleDo(srv.Handler(), http.MethodGet, "http://admin.test/_gm/games/"+g.ID.String(), "", "")
 	if code != http.StatusOK {
 		t.Fatalf("game detail = %d, want 200", code)
 	}
 	if !strings.Contains(body, "🤖") {
 		t.Error("robot seat is not marked in the game detail")
 	}
 	if !strings.Contains(body, "play to win") && !strings.Contains(body, "play to lose") {
 		t.Error("robot play-to-win intent missing")
 	}
 	if !strings.Contains(body, "next move") {
 		t.Error("robot is to move but the next-move ETA is missing")
 	}
 	if !strings.Contains(body, "~40%") {
 		t.Error("robot play-to-win target caption missing")
 	}
 }
 // TestConsoleThrottledViewAndFlagClear drives the rate-limit surface end to
 // end against real stores: a gateway report past the threshold auto-flags the
 // account, the throttled view shows the episode and the flagged account, the
 // user card carries the marker, and the operator clear (a same-origin POST)
 // reverses it.
 func TestConsoleThrottledViewAndFlagClear(t *testing.T) {
 	ctx := context.Background()
 	accounts := account.NewStore(testDB)
 	acc, err := accounts.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Throttled Player")
 	if err != nil {
 		t.Fatalf("provision: %v", err)
 	}
 	watch := ratewatch.New(ratewatch.Config{FlagThreshold: 100, FlagWindow: 10 * time.Minute}, accounts, zap.NewNop())
 	srv := server.New(":0", server.Deps{
 		Logger:    zap.NewNop(),
 		Accounts:  accounts,
 		Games:     newGameService(),
 		Registry:  testRegistry,
 		DictDir:   dictDir(),
 		RateWatch: watch,
 	})
 	h := srv.Handler()
 	report := `{"window_seconds":30,"entries":[` +
 		`{"class":"user","key":"` + acc.ID.String() + `","rejected":150},` +
 		`{"class":"public","key":"10.1.2.3","rejected":7}]}`
 	req := httptest.NewRequest(http.MethodPost, "http://admin.test/api/v1/internal/ratelimit/report", strings.NewReader(report))
 	req.Header.Set("Content-Type", "application/json")
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	if rec.Code != http.StatusNoContent {
 		t.Fatalf("report = %d, want 204", rec.Code)
 	}
 	got, err := accounts.GetByID(ctx, acc.ID)
 	if err != nil {
 		t.Fatalf("get by id: %v", err)
 	}
 	if got.FlaggedHighRateAt.IsZero() {
 		t.Fatal("account not auto-flagged past the threshold")
 	}
 	base := "http://admin.test/_gm"
 	code, body := consoleDo(h, http.MethodGet, base+"/throttled", "", "")
 	if code != http.StatusOK || !strings.Contains(body, acc.ID.String()) ||
 		!strings.Contains(body, "10.1.2.3") || !strings.Contains(body, "Throttled Player") {
 		t.Fatalf("throttled view = %d, episode/flag shown = %v/%v",
 			code, strings.Contains(body, "10.1.2.3"), strings.Contains(body, "Throttled Player"))
 	}
 	if code, body = consoleDo(h, http.MethodGet, base+"/users/"+acc.ID.String(), "", ""); code != http.StatusOK || !strings.Contains(body, "Clear high-rate flag") {
 		t.Fatalf("user card = %d, has clear action = %v", code, strings.Contains(body, "Clear high-rate flag"))
 	}
 	// The clear POST is CSRF-guarded like every console action.
 	if code, _ = consoleDo(h, http.MethodPost, base+"/users/"+acc.ID.String()+"/clear-high-rate-flag", "", ""); code != http.StatusForbidden {
 		t.Fatalf("clear without origin = %d, want 403", code)
 	}
 	if code, body = consoleDo(h, http.MethodPost, base+"/users/"+acc.ID.String()+"/clear-high-rate-flag", "x=1", "http://admin.test"); code != http.StatusOK || !strings.Contains(body, "Cleared") {
 		t.Fatalf("clear with origin = %d, has Cleared = %v", code, strings.Contains(body, "Cleared"))
 	}
 	if got, err = accounts.GetByID(ctx, acc.ID); err != nil || !got.FlaggedHighRateAt.IsZero() {
 		t.Fatalf("flag survived the clear: %v (err %v)", got.FlaggedHighRateAt, err)
 	}
 }
 // consoleDo issues a request to h, optionally with an Origin header, and returns
 // the status and body. Form bodies are sent as application/x-www-form-urlencoded.
 func consoleDo(h http.Handler, method, target, body, origin string) (int, string) {
@@ -0,0 +1,81 @@
 //go:build integration
 package inttest
 import (
 	"context"
 	"testing"
 	"time"
 	"github.com/google/uuid"
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/game"
 )
 // TestMoveDurationAnalytics seeds a game with crafted move timestamps and checks the
 // admin-console move-duration reports compute the think time (gap to the previous
 // move, the first move measured from game creation) correctly, per account and per
 // the account's move ordinal.
 func TestMoveDurationAnalytics(t *testing.T) {
 	ctx := context.Background()
 	accounts := account.NewStore(testDB)
 	a, err := accounts.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
 	if err != nil {
 		t.Fatalf("provision A: %v", err)
 	}
 	b, err := accounts.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
 	if err != nil {
 		t.Fatalf("provision B: %v", err)
 	}
 	gid := uuid.New()
 	t0 := time.Date(2026, 1, 1, 12, 0, 0, 0, time.UTC)
 	if _, err := testDB.ExecContext(ctx,
 		`INSERT INTO backend.games (game_id, variant, dict_version, seed, players, turn_timeout_secs, created_at)
 		 VALUES ($1,'scrabble_en','v1',1,2,86400,$2)`, gid, t0); err != nil {
 		t.Fatalf("insert game: %v", err)
 	}
 	if _, err := testDB.ExecContext(ctx,
 		`INSERT INTO backend.game_players (game_id, seat, account_id) VALUES ($1,0,$2),($1,1,$3)`, gid, a.ID, b.ID); err != nil {
 		t.Fatalf("insert seats: %v", err)
 	}
 	// seq, seat, commit time as seconds from t0. Durations: A:60,50  B:120,200.
 	moves := []struct{ seq, seat, at int }{{0, 0, 60}, {1, 1, 180}, {2, 0, 230}, {3, 1, 430}}
 	for _, m := range moves {
 		if _, err := testDB.ExecContext(ctx,
 			`INSERT INTO backend.game_moves (game_id, seq, seat, action, created_at) VALUES ($1,$2,$3,'play',$4)`,
 			gid, m.seq, m.seat, t0.Add(time.Duration(m.at)*time.Second)); err != nil {
 			t.Fatalf("insert move %d: %v", m.seq, err)
 		}
 	}
 	store := game.NewStore(testDB)
 	stats, err := store.MoveDurationStats(ctx, []uuid.UUID{a.ID, b.ID})
 	if err != nil {
 		t.Fatalf("stats: %v", err)
 	}
 	if sa := stats[a.ID]; sa.Moves != 2 || sa.MinSecs != 50 || sa.MaxSecs != 60 || sa.AvgSecs != 55 {
 		t.Errorf("A stats = %+v, want min50 max60 avg55 moves2", sa)
 	}
 	if sb := stats[b.ID]; sb.Moves != 2 || sb.MinSecs != 120 || sb.MaxSecs != 200 || sb.AvgSecs != 160 {
 		t.Errorf("B stats = %+v, want min120 max200 avg160 moves2", sb)
 	}
 	byOrd, err := store.MoveDurationByOrdinal(ctx, a.ID)
 	if err != nil {
 		t.Fatalf("by ordinal: %v", err)
 	}
 	want := []game.OrdinalDuration{
 		{Ordinal: 1, MinSecs: 60, MaxSecs: 60, AvgSecs: 60},
 		{Ordinal: 2, MinSecs: 50, MaxSecs: 50, AvgSecs: 50},
 	}
 	if len(byOrd) != len(want) {
 		t.Fatalf("by ordinal = %+v, want %+v", byOrd, want)
 	}
 	for i, w := range want {
 		if byOrd[i] != w {
 			t.Errorf("ordinal[%d] = %+v, want %+v", i, byOrd[i], w)
 		}
 	}
 }
@@ -0,0 +1,79 @@
 //go:build integration
 package inttest
 import (
 	"context"
 	"testing"
 	"scrabble/backend/internal/game"
 )
 // TestDraftPersistAndConflictReset covers draft persistence: a round-trip of the
 // rack order + board tiles, the actor's own draft cleared on their move, and an opponent's
 // board draft reset when a committed play overlaps one of its cells (the rack order kept).
 func TestDraftPersistAndConflictReset(t *testing.T) {
 	ctx := context.Background()
 	svc, gameID, seats, hint := newDraftGame(t)
 	// Round-trip seat 0's rack order + a board draft.
 	d0 := game.Draft{RackOrder: "QANIWE?", BoardTiles: []game.DraftTile{{Row: 1, Col: 1, Letter: "Q"}}}
 	if err := svc.SaveDraft(ctx, gameID, seats[0], d0); err != nil {
 		t.Fatalf("save draft 0: %v", err)
 	}
 	if got, err := svc.GetDraft(ctx, gameID, seats[0]); err != nil ||
 		got.RackOrder != "QANIWE?" || len(got.BoardTiles) != 1 || got.BoardTiles[0].Letter != "Q" {
 		t.Fatalf("get draft 0 = %+v (err %v)", got, err)
 	}
 	// Seat 1 drafts a board tile on a cell the opening play will commit.
 	overlap := hint.Tiles[0]
 	if err := svc.SaveDraft(ctx, gameID, seats[1], game.Draft{
 		RackOrder:  "ABCDEFG",
 		BoardTiles: []game.DraftTile{{Row: overlap.Row, Col: overlap.Col, Letter: "X"}},
 	}); err != nil {
 		t.Fatalf("save draft 1: %v", err)
 	}
 	if _, err := svc.SubmitPlay(ctx, gameID, seats[0], hint.Dir, hint.Tiles); err != nil {
 		t.Fatalf("seat0 play: %v", err)
 	}
 	// Seat 0's own draft is cleared by their move.
 	if d, _ := svc.GetDraft(ctx, gameID, seats[0]); d.RackOrder != "" || len(d.BoardTiles) != 0 {
 		t.Errorf("actor draft not cleared: %+v", d)
 	}
 	// Seat 1's board draft overlapped the play and is reset; the rack order is kept.
 	if d, _ := svc.GetDraft(ctx, gameID, seats[1]); len(d.BoardTiles) != 0 || d.RackOrder != "ABCDEFG" {
 		t.Errorf("conflicting draft not reset (or rack order lost): %+v", d)
 	}
 }
 // TestDraftSurvivesNonConflictingMove checks an opponent's board draft is kept when a
 // committed play does not touch any of its cells.
 func TestDraftSurvivesNonConflictingMove(t *testing.T) {
 	ctx := context.Background()
 	svc, gameID, seats, hint := newDraftGame(t)
 	// Seat 1 drafts a far corner tile the central opening play cannot reach.
 	if err := svc.SaveDraft(ctx, gameID, seats[1], game.Draft{
 		BoardTiles: []game.DraftTile{{Row: 0, Col: 0, Letter: "Z"}},
 	}); err != nil {
 		t.Fatalf("save draft 1: %v", err)
 	}
 	if _, err := svc.SubmitPlay(ctx, gameID, seats[0], hint.Dir, hint.Tiles); err != nil {
 		t.Fatalf("seat0 play: %v", err)
 	}
 	if d, _ := svc.GetDraft(ctx, gameID, seats[1]); len(d.BoardTiles) != 1 || d.BoardTiles[0].Letter != "Z" {
 		t.Errorf("non-conflicting draft should survive: %+v", d)
 	}
 }
 // TestSaveDraftRejectsOutsider checks only a seated player may save a draft.
 func TestSaveDraftRejectsOutsider(t *testing.T) {
 	ctx := context.Background()
 	svc, gameID, _, _ := newDraftGame(t)
 	if err := svc.SaveDraft(ctx, gameID, provisionAccount(t), game.Draft{RackOrder: "X"}); err == nil {
 		t.Fatal("outsider SaveDraft should fail")
 	}
 }
@@ -159,7 +159,7 @@ func TestUpdateProfilePersists(t *testing.T) {
 	}
 }
-// TestUpdateProfileOffsetTimezone checks the Stage 8 UTC-offset timezone: it is
+// TestUpdateProfileOffsetTimezone checks the UTC-offset timezone: it is
 // accepted, persisted verbatim, and resolved to the right fixed offset.
 func TestUpdateProfileOffsetTimezone(t *testing.T) {
 	ctx := context.Background()
@@ -181,3 +181,49 @@ func TestUpdateProfileOffsetTimezone(t *testing.T) {
 		t.Fatalf("ResolveZone offset = %d, want 10800", off)
 	}
 }
 // TestEmailLoginFlow covers the email-as-login path: a code is mailed to
 // a new address, verifying it provisions and returns the owning account, and a
 // second login for the same address resolves to that same account (a returning
 // user), with the identity confirmed.
 func TestEmailLoginFlow(t *testing.T) {
 	ctx := context.Background()
 	mailer := &capturingMailer{}
 	svc := account.NewEmailService(account.NewStore(testDB), mailer)
 	email := "login-" + uuid.NewString() + "@example.com"
 	accountID, err := svc.RequestLoginCode(ctx, email)
 	if err != nil {
 		t.Fatalf("request login code: %v", err)
 	}
 	code := sixDigit.FindString(mailer.lastBody)
 	if code == "" {
 		t.Fatalf("no code in mail body %q", mailer.lastBody)
 	}
 	acc, err := svc.LoginWithCode(ctx, email, code)
 	if err != nil {
 		t.Fatalf("login with code: %v", err)
 	}
 	if acc.ID != accountID {
 		t.Errorf("login account = %s, want %s", acc.ID, accountID)
 	}
 	if acc.IsGuest {
 		t.Error("an email account must be durable, not a guest")
 	}
 	if !identityConfirmed(t, account.KindEmail, email) {
 		t.Error("the email identity must be confirmed after login")
 	}
 	// A second login for the same email is the returning user: same account.
 	if _, err := svc.RequestLoginCode(ctx, email); err != nil {
 		t.Fatalf("second request: %v", err)
 	}
 	acc2, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody))
 	if err != nil {
 		t.Fatalf("second login: %v", err)
 	}
 	if acc2.ID != accountID {
 		t.Errorf("returning login account = %s, want %s", acc2.ID, accountID)
 	}
 }
@@ -4,88 +4,17 @@ package inttest
 import (
 	"context"
 	"database/sql"
 	"errors"
 	"sync"
 	"testing"
 	"time"
 	"github.com/google/uuid"
 	"go.uber.org/zap"
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 )
 // newGameService builds a game service over the shared pool and registry.
 func newGameService() *game.Service {
 	return game.NewService(
 		game.NewStore(testDB),
 		account.NewStore(testDB),
 		testRegistry,
 		game.Config{
 			DictDir:              dictDir(),
 			DictVersion:          testDictVersion,
 			TimeoutSweepInterval: time.Minute,
 			CacheTTL:             time.Hour,
 		},
 		zap.NewNop(),
 	)
 }
 // provisionAccount creates a fresh durable account and returns its id.
 func provisionAccount(t *testing.T) uuid.UUID {
 	t.Helper()
 	acc, err := account.NewStore(testDB).ProvisionByIdentity(context.Background(), account.KindTelegram, "tg-"+uuid.NewString())
 	if err != nil {
 		t.Fatalf("provision account: %v", err)
 	}
 	return acc.ID
 }
 // openingSeed returns a seed whose fresh two-player English opening rack has a
 // legal move, so a greedy mirror can drive a game.
 func openingSeed(t *testing.T) int64 {
 	t.Helper()
 	for seed := int64(1); seed <= 200; seed++ {
 		g, err := engine.New(testRegistry, engine.Options{Variant: engine.VariantEnglish, Version: testDictVersion, Players: 2, Seed: seed})
 		if err != nil {
 			t.Fatalf("engine new: %v", err)
 		}
 		if _, ok := g.HintView(); ok {
 			return seed
 		}
 	}
 	t.Fatal("no opening seed found")
 	return 0
 }
 // newMirror builds a parallel engine game with the same seed, used to compute
 // legal moves to feed the service under test.
 func newMirror(t *testing.T, seed int64, players int) *engine.Game {
 	t.Helper()
 	g, err := engine.New(testRegistry, engine.Options{Variant: engine.VariantEnglish, Version: testDictVersion, Players: players, Seed: seed})
 	if err != nil {
 		t.Fatalf("mirror new: %v", err)
 	}
 	return g
 }
 // readStats reads an account's statistics row.
 func readStats(t *testing.T, id uuid.UUID) (wins, losses, draws, maxGame, maxWord int, found bool) {
 	t.Helper()
 	row := testDB.QueryRowContext(context.Background(),
 		`SELECT wins, losses, draws, max_game_points, max_word_points FROM backend.account_stats WHERE account_id = $1`, id)
 	if err := row.Scan(&wins, &losses, &draws, &maxGame, &maxWord); err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			return 0, 0, 0, 0, 0, false
 		}
 		t.Fatalf("read stats: %v", err)
 	}
 	return wins, losses, draws, maxGame, maxWord, true
 }
 // TestListForAccount checks the lobby "my games" query: it returns exactly the
 // games the account is seated in (each with its seats), and nothing for an outsider.
 func TestListForAccount(t *testing.T) {
@@ -299,6 +228,42 @@ func TestResignWinnerAndStats(t *testing.T) {
 	}
 }
 // TestResignOnOpponentTurn checks a player can forfeit on the
 // opponent's turn. Seat 0 plays (so it is seat 1's turn), then seat 0 resigns its own
 // seat while it is not its turn — no ErrNotYourTurn, the game ends, and seat 0 loses
 // despite leading on score.
 func TestResignOnOpponentTurn(t *testing.T) {
 	ctx := context.Background()
 	svc := newGameService()
 	seats := []uuid.UUID{provisionAccount(t), provisionAccount(t)}
 	seed := openingSeed(t)
 	g, err := svc.Create(ctx, game.CreateParams{
 		Variant: engine.VariantEnglish, Seats: seats, TurnTimeout: 24 * time.Hour, Seed: seed,
 	})
 	if err != nil {
 		t.Fatalf("create: %v", err)
 	}
 	hint, ok := newMirror(t, seed, 2).HintView()
 	if !ok {
 		t.Fatal("no opening move")
 	}
 	if _, err := svc.SubmitPlay(ctx, g.ID, seats[0], hint.Dir, hint.Tiles); err != nil { // p0 scores, now p1's turn
 		t.Fatalf("p0 play: %v", err)
 	}
 	res, err := svc.Resign(ctx, g.ID, seats[0]) // p0 resigns OFF turn
 	if err != nil {
 		t.Fatalf("off-turn resign = %v, want nil", err)
 	}
 	if res.Game.Status != game.StatusFinished || res.Game.EndReason != "resign" {
 		t.Fatalf("after off-turn resign: %+v", res.Game)
 	}
 	if res.Game.Seats[0].IsWinner || !res.Game.Seats[1].IsWinner {
 		t.Errorf("winner flags wrong (resigner must lose): %+v", res.Game.Seats)
 	}
 }
 // TestTimeoutSweep auto-resigns an overdue game and records it as a timeout.
 func TestTimeoutSweep(t *testing.T) {
 	ctx := context.Background()
@@ -428,7 +393,7 @@ func TestHintPolicy(t *testing.T) {
 	}
 }
-// TestGameVariant covers the edge's lightweight variant lookup (Stage 13): it returns the
+// TestGameVariant covers the edge's lightweight variant lookup: it returns the
 // created game's variant and ErrNotFound for an unknown id.
 func TestGameVariant(t *testing.T) {
 	ctx := context.Background()
@@ -441,7 +406,7 @@ func TestGameVariant(t *testing.T) {
 		t.Fatalf("create: %v", err)
 	}
 	if v, err := svc.GameVariant(ctx, g.ID); err != nil || v != engine.VariantEnglish {
-		t.Fatalf("GameVariant = %v, %v; want english, nil", v, err)
+		t.Fatalf("GameVariant = %v, %v; want scrabble_en, nil", v, err)
 	}
 	if _, err := svc.GameVariant(ctx, uuid.New()); !errors.Is(err, game.ErrNotFound) {
 		t.Errorf("GameVariant(unknown) = %v, want ErrNotFound", err)
@@ -583,7 +548,7 @@ func equalStrings(a, b []string) bool {
 	return true
 }
-// TestExportGCGRefusesActiveGame checks the Stage 8 finished-only gate: a GCG export
+// TestExportGCGRefusesActiveGame checks the finished-only gate: a GCG export
 // is allowed only once the game is over, so an active game leaks nothing mid-play.
 func TestExportGCGRefusesActiveGame(t *testing.T) {
 	ctx := context.Background()
@@ -0,0 +1,167 @@
 //go:build integration
 package inttest
 import (
 	"context"
 	"database/sql"
 	"errors"
 	"testing"
 	"time"
 	"github.com/google/uuid"
 	"go.opentelemetry.io/otel/metric/noop"
 	"go.uber.org/zap"
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/social"
 )
 // Shared fixtures for the Postgres-backed integration suite: the service
 // constructors over the shared pool/registry, account provisioning, game
 // assembly, and the stats reader. Helpers used by a single test file stay in
 // that file; everything reused across files lives here.
 // newGameService builds a game service over the shared pool and registry.
 func newGameService() *game.Service {
 	return game.NewService(
 		game.NewStore(testDB),
 		account.NewStore(testDB),
 		testRegistry,
 		game.Config{
 			DictDir:              dictDir(),
 			DictVersion:          testDictVersion,
 			TimeoutSweepInterval: time.Minute,
 			CacheTTL:             time.Hour,
 		},
 		zap.NewNop(),
 	)
 }
 // newSocialService builds a social service over the shared pool, reading game
 // state through a real game service.
 func newSocialService() *social.Service {
 	return social.NewService(social.NewStore(testDB), account.NewStore(testDB), newGameService())
 }
 // newRobotService builds a robot service over games (shared so its moves and the
 // test's human moves use the same live-game cache and per-game locks), a fresh
 // social service for nudges, and a no-op meter.
 func newRobotService(t *testing.T, games *game.Service) *robot.Service {
 	t.Helper()
 	return robot.NewService(games, account.NewStore(testDB), newSocialService(), noop.NewMeterProvider().Meter("robot-test"), zap.NewNop())
 }
 // newMatchmaker builds a matchmaker starting real games and substituting from
 // robots after wait.
 func newMatchmaker(t *testing.T, robots lobby.RobotProvider, wait time.Duration) *lobby.Matchmaker {
 	t.Helper()
 	return lobby.NewMatchmaker(newGameService(), robots, wait, zap.NewNop())
 }
 // provisionAccount creates a fresh durable account and returns its id.
 func provisionAccount(t *testing.T) uuid.UUID {
 	t.Helper()
 	acc, err := account.NewStore(testDB).ProvisionByIdentity(context.Background(), account.KindTelegram, "tg-"+uuid.NewString())
 	if err != nil {
 		t.Fatalf("provision account: %v", err)
 	}
 	return acc.ID
 }
 // provisionGuest creates a fresh ephemeral guest account and returns its id.
 func provisionGuest(t *testing.T) uuid.UUID {
 	t.Helper()
 	acc, err := account.NewStore(testDB).ProvisionGuest(context.Background())
 	if err != nil {
 		t.Fatalf("provision guest: %v", err)
 	}
 	if !acc.IsGuest {
 		t.Fatalf("provisioned account %s is not flagged guest", acc.ID)
 	}
 	return acc.ID
 }
 // openingSeed returns a seed whose fresh two-player English opening rack has a
 // legal move, so a greedy mirror can drive a game.
 func openingSeed(t *testing.T) int64 {
 	t.Helper()
 	for seed := int64(1); seed <= 200; seed++ {
 		g, err := engine.New(testRegistry, engine.Options{Variant: engine.VariantEnglish, Version: testDictVersion, Players: 2, Seed: seed})
 		if err != nil {
 			t.Fatalf("engine new: %v", err)
 		}
 		if _, ok := g.HintView(); ok {
 			return seed
 		}
 	}
 	t.Fatal("no opening seed found")
 	return 0
 }
 // newMirror builds a parallel engine game with the same seed, used to compute
 // legal moves to feed the service under test.
 func newMirror(t *testing.T, seed int64, players int) *engine.Game {
 	t.Helper()
 	g, err := engine.New(testRegistry, engine.Options{Variant: engine.VariantEnglish, Version: testDictVersion, Players: players, Seed: seed})
 	if err != nil {
 		t.Fatalf("mirror new: %v", err)
 	}
 	return g
 }
 // newGameWithSeats creates a started game seating n fresh accounts and returns the
 // game id and the seated account ids in seat order.
 func newGameWithSeats(t *testing.T, n int) (uuid.UUID, []uuid.UUID) {
 	t.Helper()
 	seats := make([]uuid.UUID, n)
 	for i := range seats {
 		seats[i] = provisionAccount(t)
 	}
 	g, err := newGameService().Create(context.Background(), game.CreateParams{
 		Variant: engine.VariantEnglish, Seats: seats, TurnTimeout: 24 * time.Hour, Seed: openingSeed(t),
 	})
 	if err != nil {
 		t.Fatalf("create game: %v", err)
 	}
 	return g.ID, seats
 }
 // newDraftGame creates a started two-player English game on an opening seed and returns the
 // service, game id, seats, and the opening play (from a mirror) used to drive a real commit.
 func newDraftGame(t *testing.T) (*game.Service, uuid.UUID, []uuid.UUID, engine.MoveRecord) {
 	t.Helper()
 	ctx := context.Background()
 	svc := newGameService()
 	seats := []uuid.UUID{provisionAccount(t), provisionAccount(t)}
 	seed := openingSeed(t)
 	g, err := svc.Create(ctx, game.CreateParams{
 		Variant: engine.VariantEnglish, Seats: seats, TurnTimeout: 24 * time.Hour, Seed: seed,
 	})
 	if err != nil {
 		t.Fatalf("create: %v", err)
 	}
 	hint, ok := newMirror(t, seed, 2).HintView()
 	if !ok || len(hint.Tiles) == 0 {
 		t.Fatal("no opening move")
 	}
 	return svc, g.ID, seats, hint
 }
 // readStats reads an account's statistics row.
 func readStats(t *testing.T, id uuid.UUID) (wins, losses, draws, maxGame, maxWord int, found bool) {
 	t.Helper()
 	row := testDB.QueryRowContext(context.Background(),
 		`SELECT wins, losses, draws, max_game_points, max_word_points FROM backend.account_stats WHERE account_id = $1`, id)
 	if err := row.Scan(&wins, &losses, &draws, &maxGame, &maxWord); err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
 			return 0, 0, 0, 0, 0, false
 		}
 		t.Fatalf("read stats: %v", err)
 	}
 	return wins, losses, draws, maxGame, maxWord, true
 }
@@ -0,0 +1,67 @@
 //go:build integration
 package inttest
 import (
 	"context"
 	"errors"
 	"testing"
 	"github.com/google/uuid"
 	"scrabble/backend/internal/game"
 )
 // TestHideFinishedGame covers per-account game hiding: an active game cannot be
 // hidden, a finished game is removed from the hider's own list while staying visible to the
 // other player, an outsider cannot hide it, and the action is idempotent.
 func TestHideFinishedGame(t *testing.T) {
 	ctx := context.Background()
 	svc, gameID, seats, _ := newDraftGame(t)
 	// Hiding while the game is still active is refused.
 	if err := svc.HideGame(ctx, seats[0], gameID); !errors.Is(err, game.ErrGameActive) {
 		t.Fatalf("hide active = %v, want ErrGameActive", err)
 	}
 	// Finish the game by seat 0 resigning.
 	if _, err := svc.Resign(ctx, gameID, seats[0]); err != nil {
 		t.Fatalf("resign: %v", err)
 	}
 	// A non-player cannot hide it.
 	if err := svc.HideGame(ctx, provisionAccount(t), gameID); !errors.Is(err, game.ErrNotAPlayer) {
 		t.Fatalf("hide by outsider = %v, want ErrNotAPlayer", err)
 	}
 	// Seat 0 hides the finished game; hiding again is a no-op success.
 	if err := svc.HideGame(ctx, seats[0], gameID); err != nil {
 		t.Fatalf("hide: %v", err)
 	}
 	if err := svc.HideGame(ctx, seats[0], gameID); err != nil {
 		t.Fatalf("hide twice: %v", err)
 	}
 	// It is gone from seat 0's list but still in seat 1's (hiding is per-account).
 	if containsGame(t, svc, seats[0], gameID) {
 		t.Error("hidden game still listed for the hider")
 	}
 	if !containsGame(t, svc, seats[1], gameID) {
 		t.Error("hidden game should remain listed for the other player")
 	}
 }
 // containsGame reports whether the account's lobby list includes gameID.
 func containsGame(t *testing.T, svc *game.Service, accountID, gameID uuid.UUID) bool {
 	t.Helper()
 	games, err := svc.ListForAccount(context.Background(), accountID)
 	if err != nil {
 		t.Fatalf("list for account: %v", err)
 	}
 	for _, g := range games {
 		if g.ID == gameID {
 			return true
 		}
 	}
 	return false
 }
@@ -8,31 +8,12 @@ import (
 	"time"
 	"github.com/google/uuid"
 	"go.opentelemetry.io/otel/metric/noop"
 	"go.uber.org/zap"
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/robot"
 )
 // newRobotService builds a robot service over games (shared so its moves and the
 // test's human moves use the same live-game cache and per-game locks), a fresh
 // social service for nudges, and a no-op meter.
 func newRobotService(t *testing.T, games *game.Service) *robot.Service {
 	t.Helper()
 	return robot.NewService(games, account.NewStore(testDB), newSocialService(), noop.NewMeterProvider().Meter("robot-test"), zap.NewNop())
 }
 // newMatchmaker builds a matchmaker starting real games and substituting from
 // robots after wait.
 func newMatchmaker(t *testing.T, robots lobby.RobotProvider, wait time.Duration) *lobby.Matchmaker {
 	t.Helper()
 	return lobby.NewMatchmaker(newGameService(), robots, wait, zap.NewNop())
 }
 // setTurnStarted rewrites a game's turn clock so a robot turn can be made due (or
 // idle) at a chosen instant, independent of wall time.
 func setTurnStarted(t *testing.T, id uuid.UUID, at time.Time) {
@@ -82,19 +63,25 @@ func TestRobotPoolProvisionsRobotAccounts(t *testing.T) {
 	if err := r.EnsurePool(ctx); err != nil {
 		t.Fatalf("ensure pool (idempotent): %v", err)
 	}
-	id, err := r.Pick()
+	id, err := r.Pick(engine.VariantEnglish)
 	if err != nil {
 		t.Fatalf("pick: %v", err)
 	}
 	if !isRobotAccount(t, id) {
 		t.Errorf("picked account %s is not a robot identity", id)
 	}
 	if ru, err := r.Pick(engine.VariantRussianScrabble); err != nil || !isRobotAccount(t, ru) {
 		t.Errorf("scrabble_ru pick = (%s, %v), want a robot account", ru, err)
 	}
 	acc, err := account.NewStore(testDB).GetByID(ctx, id)
 	if err != nil {
 		t.Fatalf("get robot account: %v", err)
 	}
-	if acc.DisplayName == "" || !acc.BlockChat || !acc.BlockFriendRequests {
+	// A robot blocks chat but NOT friend requests: a request to a robot stays pending and
-		t.Errorf("robot profile not set: name=%q chat=%v friends=%v", acc.DisplayName, acc.BlockChat, acc.BlockFriendRequests)
+	// expires, mirroring a human who ignores it.
 	if acc.DisplayName == "" || !acc.BlockChat || acc.BlockFriendRequests {
 		t.Errorf("robot profile wrong: name=%q chat-blocked=%v friends-blocked=%v (want chat blocked, friends open)",
 			acc.DisplayName, acc.BlockChat, acc.BlockFriendRequests)
 	}
 }
@@ -109,7 +96,7 @@ func TestRobotPlaysAutoMatchToEnd(t *testing.T) {
 	if err := robots.EnsurePool(ctx); err != nil {
 		t.Fatalf("ensure pool: %v", err)
 	}
-	robotID, err := robots.Pick()
+	robotID, err := robots.Pick(engine.VariantEnglish)
 	if err != nil {
 		t.Fatalf("pick: %v", err)
 	}
@@ -201,8 +188,8 @@ func TestMatchmakerSubstitutesRobotEndToEnd(t *testing.T) {
 	}
 }
-// TestRobotProactiveNudge checks the robot nudges the human after the idle
+// TestRobotProactiveNudge checks the robot's lengthening proactive-nudge schedule on the
-// threshold on the human's turn.
+// human's turn: nothing before the ~60-90 min first gap, exactly one once it has elapsed.
 func TestRobotProactiveNudge(t *testing.T) {
 	ctx := context.Background()
 	svc := newGameService()
@@ -210,7 +197,7 @@ func TestRobotProactiveNudge(t *testing.T) {
 	if err := robots.EnsurePool(ctx); err != nil {
 		t.Fatalf("ensure pool: %v", err)
 	}
-	robotID, err := robots.Pick()
+	robotID, err := robots.Pick(engine.VariantEnglish)
 	if err != nil {
 		t.Fatalf("pick: %v", err)
 	}
@@ -226,14 +213,18 @@ func TestRobotProactiveNudge(t *testing.T) {
 		t.Fatalf("create: %v", err)
 	}
-	// Midnight start, driven 13 hours later (>12h idle) at a daytime hour awake for
+	// A daytime turn start (the robot is awake for every ±3h drift between 07:30 and 12:00). No
-	// every drift.
+	// nudge before the 60-min floor of the first gap; exactly one once past its 90-min ceiling.
-	start := time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)
+	start := time.Date(2024, 1, 1, 10, 0, 0, 0, time.UTC)
 	setTurnStarted(t, g.ID, start)
 	robots.Drive(ctx, start.Add(13*time.Hour))
 	robots.Drive(ctx, start.Add(30*time.Minute))
 	if n := countNudges(t, g.ID, robotID); n != 0 {
 		t.Errorf("robot nudges = %d at 30m idle, want 0 (before the first gap)", n)
 	}
 	robots.Drive(ctx, start.Add(2*time.Hour))
 	if n := countNudges(t, g.ID, robotID); n != 1 {
-		t.Errorf("robot nudges = %d, want 1 after 13h idle on the human's turn", n)
+		t.Errorf("robot nudges = %d at 2h idle, want 1 (after the first gap)", n)
 	}
 }
@@ -6,6 +6,7 @@ import (
 	"context"
 	"errors"
 	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -14,30 +15,66 @@ import (
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/notify"
 	"scrabble/backend/internal/social"
 	fb "scrabble/pkg/fbs/scrabblefb"
 )
-// newSocialService builds a social service over the shared pool, reading game
+// capturePublisher records every published intent for assertions on live events.
-// state through a real game service.
+type capturePublisher struct {
-func newSocialService() *social.Service {
+	mu      sync.Mutex
-	return social.NewService(social.NewStore(testDB), account.NewStore(testDB), newGameService())
+	intents []notify.Intent
 }
-// newGameWithSeats creates a started game seating n fresh accounts and returns the
+func (c *capturePublisher) Publish(in ...notify.Intent) {
-// game id and the seated account ids in seat order.
+	c.mu.Lock()
-func newGameWithSeats(t *testing.T, n int) (uuid.UUID, []uuid.UUID) {
+	defer c.mu.Unlock()
-	t.Helper()
+	c.intents = append(c.intents, in...)
-	seats := make([]uuid.UUID, n)
+}
-	for i := range seats {
+
-		seats[i] = provisionAccount(t)
+// notified reports whether a Notification with the given sub-kind was published to user.
 func (c *capturePublisher) notified(user uuid.UUID, sub string) bool {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	for _, in := range c.intents {
 		if in.UserID == user && in.Kind == notify.KindNotification &&
 			string(fb.GetRootAsNotificationEvent(in.Payload, 0).Kind()) == sub {
 			return true
 		}
 	}
-	g, err := newGameService().Create(context.Background(), game.CreateParams{
+	return false
-		Variant: engine.VariantEnglish, Seats: seats, TurnTimeout: 24 * time.Hour, Seed: openingSeed(t),
+}
-	})
+
 // TestFriendRequestToRobotStaysPending checks a friend request to a robot is accepted as
 // pending rather than blocked: robots no longer block friend requests, so the request
 // just sits unanswered and later expires — mirroring a human who ignores it.
 func TestFriendRequestToRobotStaysPending(t *testing.T) {
 	ctx := context.Background()
 	svc := newSocialService()
 	accs := account.NewStore(testDB)
 	human := provisionAccount(t)
 	robot, err := accs.ProvisionRobot(ctx, "robot-friend-"+uuid.NewString(), "Robbie")
 	if err != nil {
 		t.Fatalf("provision robot: %v", err)
 	}
 	if robot.BlockFriendRequests {
 		t.Fatal("robot must not block friend requests")
 	}
 	// A request is only allowed between players who share a game.
 	if _, err := newGameService().Create(ctx, game.CreateParams{
 		Variant: engine.VariantEnglish, Seats: []uuid.UUID{human, robot.ID},
 		TurnTimeout: 24 * time.Hour, Seed: openingSeed(t),
 	}); err != nil {
 		t.Fatalf("create game: %v", err)
 	}
-	return g.ID, seats
+
 	if err := svc.SendFriendRequest(ctx, human, robot.ID); err != nil {
 		t.Fatalf("request to robot = %v, want nil (accepted as pending)", err)
 	}
 	if got, _ := svc.ListIncomingRequests(ctx, robot.ID); len(got) != 1 || got[0] != human {
 		t.Fatalf("robot incoming = %v, want [human]", got)
 	}
 }
 func TestFriendRequestLifecycle(t *testing.T) {
@@ -282,6 +319,20 @@ func TestChatRejectsBadContent(t *testing.T) {
 	}
 }
 // TestChatOnlyOnYourTurn checks chat is allowed only on the sender's own turn:
 // the player to move can post, the waiting player gets ErrChatNotYourTurn.
 func TestChatOnlyOnYourTurn(t *testing.T) {
 	ctx := context.Background()
 	svc := newSocialService()
 	gameID, seats := newGameWithSeats(t, 2) // seat 0 is to move at the opening
 	if _, err := svc.PostMessage(ctx, gameID, seats[1], "hi", ""); !errors.Is(err, social.ErrChatNotYourTurn) {
 		t.Fatalf("off-turn chat = %v, want ErrChatNotYourTurn", err)
 	}
 	if _, err := svc.PostMessage(ctx, gameID, seats[0], "hi", ""); err != nil {
 		t.Fatalf("on-turn chat = %v, want nil", err)
 	}
 }
 func TestNudgeRulesAndRateLimit(t *testing.T) {
 	ctx := context.Background()
 	svc := newSocialService()
@@ -307,3 +358,200 @@ func TestNudgeRulesAndRateLimit(t *testing.T) {
 		t.Fatalf("nudge after window: %v", err)
 	}
 }
 // TestNudgeCooldownResetsOnAction checks the nudge cooldown clears once the player has
 // acted (moved or chatted) since their last nudge, even within the hour.
 func TestNudgeCooldownResetsOnAction(t *testing.T) {
 	ctx := context.Background()
 	svc := newSocialService()
 	gsvc := newGameService()
 	gameID, seats := newGameWithSeats(t, 2) // seat 0 to move
 	if _, err := svc.Nudge(ctx, gameID, seats[1]); err != nil { // the waiting player nudges
 		t.Fatalf("nudge: %v", err)
 	}
 	if _, err := svc.Nudge(ctx, gameID, seats[1]); !errors.Is(err, social.ErrNudgeTooSoon) {
 		t.Fatalf("rapid nudge = %v, want ErrNudgeTooSoon", err)
 	}
 	// Seat 1 takes a turn: seat 0 passes (-> seat 1's turn), seat 1 chats then passes.
 	if _, err := gsvc.Pass(ctx, gameID, seats[0]); err != nil {
 		t.Fatalf("seat0 pass: %v", err)
 	}
 	if _, err := svc.PostMessage(ctx, gameID, seats[1], "thinking", ""); err != nil {
 		t.Fatalf("seat1 chat: %v", err)
 	}
 	if _, err := gsvc.Pass(ctx, gameID, seats[1]); err != nil {
 		t.Fatalf("seat1 pass: %v", err)
 	}
 	// Back on the opponent's turn, the cooldown is reset by the action since the nudge.
 	if _, err := svc.Nudge(ctx, gameID, seats[1]); err != nil {
 		t.Fatalf("nudge after acting = %v, want allowed (cooldown reset)", err)
 	}
 }
 // TestListOutgoingRequests checks the requester-side list that backs the in-game "add to
 // friends" item: a pending request shows for the requester only; an accepted one
 // clears (it is a friendship now); a declined one stays (cannot be re-sent, so it reads as
 // still "sent"); a lazily expired pending one drops (it may be re-sent).
 func TestListOutgoingRequests(t *testing.T) {
 	ctx := context.Background()
 	svc := newSocialService()
 	// Pending: outgoing for the requester, not the addressee.
 	_, s1 := newGameWithSeats(t, 2)
 	a, b := s1[0], s1[1]
 	if err := svc.SendFriendRequest(ctx, a, b); err != nil {
 		t.Fatalf("send: %v", err)
 	}
 	if got, _ := svc.ListOutgoingRequests(ctx, a); len(got) != 1 || got[0] != b {
 		t.Fatalf("outgoing pending = %v, want [b]", got)
 	}
 	if got, _ := svc.ListOutgoingRequests(ctx, b); len(got) != 0 {
 		t.Fatalf("addressee outgoing = %v, want none", got)
 	}
 	// Accepted: a friendship, no longer an outgoing request.
 	if err := svc.RespondFriendRequest(ctx, b, a, true); err != nil {
 		t.Fatalf("accept: %v", err)
 	}
 	if got, _ := svc.ListOutgoingRequests(ctx, a); len(got) != 0 {
 		t.Fatalf("outgoing after accept = %v, want none", got)
 	}
 	// Declined: stays outgoing (reads as sent; cannot re-send).
 	_, s2 := newGameWithSeats(t, 2)
 	c, d := s2[0], s2[1]
 	if err := svc.SendFriendRequest(ctx, c, d); err != nil {
 		t.Fatalf("send2: %v", err)
 	}
 	if err := svc.RespondFriendRequest(ctx, d, c, false); err != nil {
 		t.Fatalf("decline: %v", err)
 	}
 	if got, _ := svc.ListOutgoingRequests(ctx, c); len(got) != 1 || got[0] != d {
 		t.Fatalf("outgoing after decline = %v, want [d]", got)
 	}
 	// Lazily expired pending: omitted (may be re-sent).
 	_, s3 := newGameWithSeats(t, 2)
 	e, f := s3[0], s3[1]
 	if err := svc.SendFriendRequest(ctx, e, f); err != nil {
 		t.Fatalf("send3: %v", err)
 	}
 	if _, err := testDB.ExecContext(ctx,
 		`UPDATE backend.friendships SET created_at = now() - interval '31 days' WHERE requester_id = $1 AND addressee_id = $2`, e, f); err != nil {
 		t.Fatalf("backdate: %v", err)
 	}
 	if got, _ := svc.ListOutgoingRequests(ctx, e); len(got) != 0 {
 		t.Fatalf("expired outgoing = %v, want none", got)
 	}
 }
 // TestRespondPublishesToRequester checks that answering a request notifies the original
 // requester over the live channel: accept -> friend_added, decline ->
 // friend_declined, so a game screen watching that opponent re-derives its friend state.
 func TestRespondPublishesToRequester(t *testing.T) {
 	ctx := context.Background()
 	svc := newSocialService()
 	pub := &capturePublisher{}
 	svc.SetNotifier(pub)
 	_, s1 := newGameWithSeats(t, 2)
 	a, b := s1[0], s1[1]
 	if err := svc.SendFriendRequest(ctx, a, b); err != nil {
 		t.Fatalf("send: %v", err)
 	}
 	if err := svc.RespondFriendRequest(ctx, b, a, true); err != nil {
 		t.Fatalf("accept: %v", err)
 	}
 	if !pub.notified(a, notify.NotifyFriendAdded) {
 		t.Errorf("accept did not notify requester with %q", notify.NotifyFriendAdded)
 	}
 	_, s2 := newGameWithSeats(t, 2)
 	c, d := s2[0], s2[1]
 	if err := svc.SendFriendRequest(ctx, c, d); err != nil {
 		t.Fatalf("send2: %v", err)
 	}
 	if err := svc.RespondFriendRequest(ctx, d, c, false); err != nil {
 		t.Fatalf("decline: %v", err)
 	}
 	if !pub.notified(c, notify.NotifyFriendDeclined) {
 		t.Errorf("decline did not notify requester with %q", notify.NotifyFriendDeclined)
 	}
 }
 // TestNudgeRoutedByGameLanguage checks a nudge's out-of-app push carries the game's language, so
 // it is delivered by the game's bot rather than the recipient's last-login bot.
 func TestNudgeRoutedByGameLanguage(t *testing.T) {
 	ctx := context.Background()
 	svc := newSocialService()
 	pub := &capturePublisher{}
 	svc.SetNotifier(pub)
 	gameID, seats := newGameWithSeats(t, 2) // an English game; seat 0 is to move
 	if _, err := svc.Nudge(ctx, gameID, seats[1]); err != nil {
 		t.Fatalf("nudge: %v", err)
 	}
 	found := false
 	for _, in := range pub.intents {
 		if in.Kind == notify.KindNudge {
 			found = true
 			if in.Language != "en" {
 				t.Errorf("nudge language = %q, want en (the game's language)", in.Language)
 			}
 		}
 	}
 	if !found {
 		t.Fatal("no nudge intent published")
 	}
 }
 // TestAdminListMessages checks the admin moderation list: real messages only
 // (nudges excluded), the game / sender pins, the sender glob masks, and the source label.
 func TestAdminListMessages(t *testing.T) {
 	ctx := context.Background()
 	svc := newSocialService()
 	gameID, seats := newGameWithSeats(t, 2) // seat 0 is to move
 	if _, err := svc.PostMessage(ctx, gameID, seats[0], "good luck", "203.0.113.9"); err != nil {
 		t.Fatalf("post: %v", err)
 	}
 	if _, err := svc.Nudge(ctx, gameID, seats[1]); err != nil { // the waiting player nudges
 		t.Fatalf("nudge: %v", err)
 	}
 	// Pinned to the game: the message is listed; the nudge (kind=nudge) is excluded.
 	msgs, err := svc.AdminListMessages(ctx, social.AdminMessageFilter{GameID: gameID}, 50, 0)
 	if err != nil {
 		t.Fatalf("admin list: %v", err)
 	}
 	if len(msgs) != 1 {
 		t.Fatalf("game messages = %d, want 1 (nudge excluded)", len(msgs))
 	}
 	if m := msgs[0]; m.Body != "good luck" || m.SenderID != seats[0] || m.SenderIP != "203.0.113.9" {
 		t.Fatalf("message = %+v, want body=good luck sender=seat0 ip=203.0.113.9", m)
 	}
 	if msgs[0].Source != "telegram" { // provisionAccount provisions a telegram identity
 		t.Errorf("source = %q, want telegram", msgs[0].Source)
 	}
 	if n, _ := svc.AdminCountMessages(ctx, social.AdminMessageFilter{GameID: gameID}); n != 1 {
 		t.Errorf("count = %d, want 1", n)
 	}
 	// Sender pin: seat 0 has the message; seat 1 has only a nudge.
 	if got, _ := svc.AdminListMessages(ctx, social.AdminMessageFilter{SenderID: seats[0]}, 50, 0); len(got) == 0 {
 		t.Error("sender=seat0 returned nothing")
 	}
 	if got, _ := svc.AdminListMessages(ctx, social.AdminMessageFilter{GameID: gameID, SenderID: seats[1]}, 50, 0); len(got) != 0 {
 		t.Errorf("sender=seat1 has only a nudge, got %d messages", len(got))
 	}
 	// Sender glob masks: the telegram external id matches "tg-*"; bogus masks exclude.
 	if got, _ := svc.AdminListMessages(ctx, social.AdminMessageFilter{GameID: gameID, ExtMask: "tg-*"}, 50, 0); len(got) != 1 {
 		t.Errorf("ext mask tg-* = %d, want 1", len(got))
 	}
 	if got, _ := svc.AdminListMessages(ctx, social.AdminMessageFilter{GameID: gameID, ExtMask: "zzz-*"}, 50, 0); len(got) != 0 {
 		t.Errorf("ext mask zzz-* = %d, want 0", len(got))
 	}
 	if got, _ := svc.AdminListMessages(ctx, social.AdminMessageFilter{GameID: gameID, NameMask: "zzz-no-such-*"}, 50, 0); len(got) != 0 {
 		t.Errorf("name mask miss = %d, want 0", len(got))
 	}
 }
@@ -1,130 +0,0 @@
 //go:build integration
 package inttest
 import (
 	"context"
 	"testing"
 	"time"
 	"github.com/google/uuid"
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 )
 // provisionGuest creates a fresh ephemeral guest account and returns its id.
 func provisionGuest(t *testing.T) uuid.UUID {
 	t.Helper()
 	acc, err := account.NewStore(testDB).ProvisionGuest(context.Background())
 	if err != nil {
 		t.Fatalf("provision guest: %v", err)
 	}
 	if !acc.IsGuest {
 		t.Fatalf("provisioned account %s is not flagged guest", acc.ID)
 	}
 	return acc.ID
 }
 // TestGuestAutoMatchLeavesNoStats drives a guest through a full auto-match game
 // against a robot to a natural end and checks the guest holds a seat (the
 // game_players foreign key is satisfied) yet accrues no statistics, while the
 // durable robot opponent does.
 func TestGuestAutoMatchLeavesNoStats(t *testing.T) {
 	ctx := context.Background()
 	svc := newGameService()
 	robots := newRobotService(t, svc)
 	if err := robots.EnsurePool(ctx); err != nil {
 		t.Fatalf("ensure pool: %v", err)
 	}
 	robotID, err := robots.Pick()
 	if err != nil {
 		t.Fatalf("pick: %v", err)
 	}
 	guest := provisionGuest(t)
 	seed := openingSeed(t)
 	g, err := svc.Create(ctx, game.CreateParams{
 		Variant: engine.VariantEnglish, Seats: []uuid.UUID{guest, robotID},
 		TurnTimeout: 24 * time.Hour, Seed: seed,
 	})
 	if err != nil {
 		t.Fatalf("create: %v", err)
 	}
 	const robotSeat = 1 // seats = [guest, robot]
 	finished := false
 	for i := 0; i < 400 && !finished; i++ {
 		_, toMove, status, err := svc.Participants(ctx, g.ID)
 		if err != nil {
 			t.Fatalf("participants: %v", err)
 		}
 		if status != game.StatusActive {
 			finished = true
 			break
 		}
 		if toMove == robotSeat {
 			setTurnStarted(t, g.ID, daytime.Add(-2*time.Hour))
 			robots.Drive(ctx, daytime)
 			continue
 		}
 		playHuman(t, ctx, svc, g.ID, guest)
 	}
 	if !finished {
 		t.Fatal("guest game did not finish within the move budget")
 	}
 	if _, _, _, _, _, ok := readStats(t, guest); ok {
 		t.Error("a guest must not accrue a statistics row")
 	}
 	if _, _, _, _, _, ok := readStats(t, robotID); !ok {
 		t.Error("the durable robot opponent should have a statistics row")
 	}
 }
 // TestEmailLoginFlow covers the Stage 6 email-as-login path: a code is mailed to
 // a new address, verifying it provisions and returns the owning account, and a
 // second login for the same address resolves to that same account (a returning
 // user), with the identity confirmed.
 func TestEmailLoginFlow(t *testing.T) {
 	ctx := context.Background()
 	mailer := &capturingMailer{}
 	svc := account.NewEmailService(account.NewStore(testDB), mailer)
 	email := "login-" + uuid.NewString() + "@example.com"
 	accountID, err := svc.RequestLoginCode(ctx, email)
 	if err != nil {
 		t.Fatalf("request login code: %v", err)
 	}
 	code := sixDigit.FindString(mailer.lastBody)
 	if code == "" {
 		t.Fatalf("no code in mail body %q", mailer.lastBody)
 	}
 	acc, err := svc.LoginWithCode(ctx, email, code)
 	if err != nil {
 		t.Fatalf("login with code: %v", err)
 	}
 	if acc.ID != accountID {
 		t.Errorf("login account = %s, want %s", acc.ID, accountID)
 	}
 	if acc.IsGuest {
 		t.Error("an email account must be durable, not a guest")
 	}
 	if !identityConfirmed(t, account.KindEmail, email) {
 		t.Error("the email identity must be confirmed after login")
 	}
 	// A second login for the same email is the returning user: same account.
 	if _, err := svc.RequestLoginCode(ctx, email); err != nil {
 		t.Fatalf("second request: %v", err)
 	}
 	acc2, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody))
 	if err != nil {
 		t.Fatalf("second login: %v", err)
 	}
 	if acc2.ID != accountID {
 		t.Errorf("returning login account = %s, want %s", acc2.ID, accountID)
 	}
 }
@@ -0,0 +1,86 @@
 //go:build integration
 package inttest
 import (
 	"context"
 	"testing"
 	"github.com/google/uuid"
 	"scrabble/backend/internal/account"
 )
 // TestUserListFilter checks the admin user-list filter: the people/robots split (by a
 // robot identity) and the case-insensitive glob masks on display name and external id.
 func TestUserListFilter(t *testing.T) {
 	ctx := context.Background()
 	st := account.NewStore(testDB)
 	uniq := uuid.NewString()
 	human, err := st.ProvisionTelegram(ctx, "tg-"+uniq, "en", "", "Zzqxhuman")
 	if err != nil {
 		t.Fatalf("provision human: %v", err)
 	}
 	robot, err := st.ProvisionRobot(ctx, "robot-uxz-"+uniq, "Zzqxbot")
 	if err != nil {
 		t.Fatalf("provision robot: %v", err)
 	}
 	guest, err := st.ProvisionGuest(ctx)
 	if err != nil {
 		t.Fatalf("provision guest: %v", err)
 	}
 	collect := func(f account.UserFilter) map[uuid.UUID]account.UserListItem {
 		items, err := st.ListUsers(ctx, f, 5000, 0)
 		if err != nil {
 			t.Fatalf("list users %+v: %v", f, err)
 		}
 		m := make(map[uuid.UUID]account.UserListItem, len(items))
 		for _, it := range items {
 			m[it.ID] = it
 		}
 		return m
 	}
 	people := collect(account.UserFilter{})
 	if _, ok := people[human.ID]; !ok {
 		t.Error("human missing from people")
 	}
 	if _, ok := people[guest.ID]; !ok {
 		t.Error("guest missing from people")
 	}
 	if _, ok := people[robot.ID]; ok {
 		t.Error("robot must not appear in people")
 	}
 	if it := people[human.ID]; it.IsRobot || it.IsGuest {
 		t.Errorf("human flags wrong: robot=%v guest=%v (want both false)", it.IsRobot, it.IsGuest)
 	}
 	robots := collect(account.UserFilter{Robots: true})
 	if it, ok := robots[robot.ID]; !ok || !it.IsRobot {
 		t.Errorf("robot missing from robots or IsRobot=false (ok=%v)", ok)
 	}
 	if _, ok := robots[human.ID]; ok {
 		t.Error("human must not appear in robots")
 	}
 	// Name mask (people).
 	if _, ok := collect(account.UserFilter{NameMask: "Zzqx*"})[human.ID]; !ok {
 		t.Error("name mask Zzqx* should match the human")
 	}
 	if _, ok := collect(account.UserFilter{NameMask: "nomatch*"})[human.ID]; ok {
 		t.Error("name mask nomatch* should not match the human")
 	}
 	// External-id mask (robots).
 	if _, ok := collect(account.UserFilter{Robots: true, ExternalIDMask: "robot-uxz-*"})[robot.ID]; !ok {
 		t.Error("external-id mask robot-uxz-* should match the robot")
 	}
 	if _, ok := collect(account.UserFilter{Robots: true, ExternalIDMask: "robot-zzz-*"})[robot.ID]; ok {
 		t.Error("external-id mask robot-zzz-* should not match the robot")
 	}
 	// CountUsers agrees that robots exist.
 	if n, err := st.CountUsers(ctx, account.UserFilter{Robots: true, ExternalIDMask: "robot-uxz-*"}); err != nil || n != 1 {
 		t.Errorf("count robots robot-uxz-* = (%d, %v), want 1", n, err)
 	}
 }
@@ -1,4 +1,4 @@
-// Package link orchestrates account linking & merge (Stage 11, ARCHITECTURE.md §4).
+// Package link orchestrates account linking & merge (ARCHITECTURE.md §4).
 // It sits above the account, accountmerge and session layers: it verifies the
 // caller's control of an identity (an email confirm-code or a gateway-validated
 // platform identity), binds a free identity to the current account, and — when the
@@ -105,18 +105,72 @@ func (svc *InvitationService) SetNotifier(p notify.Publisher) {
 	}
 }
-// notify publishes a re-poll Notification of the given sub-kind to each user.
+// emitInvitation publishes the invitation notification to each invitee, carrying the invitation
-func (svc *InvitationService) notify(kind string, userIDs ...uuid.UUID) {
+// itself so the client adds it to its lobby list without a refetch.
-	if len(userIDs) == 0 {
+func (svc *InvitationService) emitInvitation(ctx context.Context, inv Invitation, inviteeIDs []uuid.UUID) {
 	if len(inviteeIDs) == 0 {
 		return
 	}
-	intents := make([]notify.Intent, 0, len(userIDs))
+	summary := svc.invitationSummary(ctx, inv)
-	for _, id := range userIDs {
+	intents := make([]notify.Intent, 0, len(inviteeIDs))
-		intents = append(intents, notify.Notification(id, kind))
+	for _, id := range inviteeIDs {
 		intents = append(intents, notify.NotificationInvitation(id, summary))
 	}
 	svc.pub.Publish(intents...)
 }
 // emitGameStarted publishes the game_started notification to each seated player, carrying their
 // initial view of the started game so the client seeds its game cache without a refetch. A
 // seat whose state cannot be read is skipped (it still sees the game on the next lobby load).
 func (svc *InvitationService) emitGameStarted(ctx context.Context, g game.Game, seats []uuid.UUID) {
 	intents := make([]notify.Intent, 0, len(seats))
 	for _, id := range seats {
 		state, err := svc.games.InitialState(ctx, g.ID, id)
 		if err != nil {
 			continue
 		}
 		intents = append(intents, notify.NotificationGameStarted(id, state))
 	}
 	svc.pub.Publish(intents...)
 }
 // invitationSummary projects an Invitation into the notify.InvitationSummary the event carries,
 // resolving the inviter's and invitees' display names from the account store.
 func (svc *InvitationService) invitationSummary(ctx context.Context, inv Invitation) notify.InvitationSummary {
 	name := func(id uuid.UUID) string {
 		if acc, err := svc.accounts.GetByID(ctx, id); err == nil {
 			return acc.DisplayName
 		}
 		return ""
 	}
 	invitees := make([]notify.InvitationInvitee, 0, len(inv.Invitees))
 	for _, iv := range inv.Invitees {
 		invitees = append(invitees, notify.InvitationInvitee{
 			AccountID:   iv.AccountID.String(),
 			DisplayName: name(iv.AccountID),
 			Seat:        iv.Seat,
 			Response:    iv.Response,
 		})
 	}
 	gameID := ""
 	if inv.GameID != nil {
 		gameID = inv.GameID.String()
 	}
 	return notify.InvitationSummary{
 		ID:              inv.ID.String(),
 		Inviter:         notify.AccountRef{AccountID: inv.InviterID.String(), DisplayName: name(inv.InviterID)},
 		Invitees:        invitees,
 		Variant:         inv.Settings.Variant.String(),
 		TurnTimeoutSecs: int(inv.Settings.TurnTimeout / time.Second),
 		HintsAllowed:    inv.Settings.HintsAllowed,
 		HintsPerPlayer:  inv.Settings.HintsPerPlayer,
 		DropoutTiles:    inv.Settings.DropoutTiles.String(),
 		Status:          inv.Status,
 		GameID:          gameID,
 		ExpiresAtUnix:   inv.ExpiresAt.Unix(),
 	}
 }
 // CreateInvitation records a pending invitation from inviterID to inviteeIDs (in
 // seat order, 1..N) with the given settings. The total seat count must be 2-4,
 // invitees distinct and not the inviter, every invitee an existing account with no
@@ -176,7 +230,7 @@ func (svc *InvitationService) CreateInvitation(ctx context.Context, inviterID uu
 	if err != nil {
 		return Invitation{}, err
 	}
-	svc.notify(notify.NotifyInvitation, inviteeIDs...)
+	svc.emitInvitation(ctx, inv, inviteeIDs)
 	return inv, nil
 }
@@ -224,7 +278,7 @@ func (svc *InvitationService) startGame(ctx context.Context, invitationID uuid.U
 	if _, err := svc.store.markStarted(ctx, invitationID, g.ID, svc.now()); err != nil {
 		return err
 	}
-	svc.notify(notify.NotifyGameStarted, seats...)
+	svc.emitGameStarted(ctx, g, seats)
 	return nil
 }
@@ -12,20 +12,26 @@ import (
 	"github.com/google/uuid"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/notify"
 )
 // GameCreator is the slice of the game domain the lobby needs: starting a seated
-// game. game.Service satisfies it.
+// game and reading a player's initial view of it. game.Service satisfies it.
 type GameCreator interface {
 	Create(ctx context.Context, params game.CreateParams) (game.Game, error)
 	// InitialState returns a seated player's full initial view of a started game, used
 	// to enrich the match_found / game_started events so the client renders the new game
 	// without a follow-up fetch.
 	InitialState(ctx context.Context, gameID, accountID uuid.UUID) (notify.PlayerState, error)
 }
 // RobotProvider supplies a robot account to substitute for a missing human in
 // auto-match. robot.Service satisfies it; it returns an error when no robot is
 // available so the matchmaker can defer substitution.
 type RobotProvider interface {
-	Pick() (uuid.UUID, error)
+	Pick(variant engine.Variant) (uuid.UUID, error)
 }
 // Blocker reports whether two accounts have a block between them (either
@@ -75,10 +75,21 @@ func (m *Matchmaker) SetNotifier(p notify.Publisher) {
 // emitMatchFound pushes match_found to every seat of a freshly started game.
 // Emitting to a robot seat is harmless (no client subscription exists for it).
-func (m *Matchmaker) emitMatchFound(g game.Game) {
+func (m *Matchmaker) emitMatchFound(ctx context.Context, g game.Game) {
 	lang := g.Variant.Language() // route the push by the game's language, not the recipient's bot
 	intents := make([]notify.Intent, 0, len(g.Seats))
 	for _, s := range g.Seats {
-		intents = append(intents, notify.MatchFound(s.AccountID, g.ID))
+		state, err := m.games.InitialState(ctx, g.ID, s.AccountID)
 		if err != nil {
 			// A waiter still discovers the game through Poll (the ws-down fallback), so skip the
 			// enriched push for this seat rather than failing the match.
 			m.log.Warn("match_found initial state",
 				zap.String("game", g.ID.String()), zap.String("account", s.AccountID.String()), zap.Error(err))
 			continue
 		}
 		mf := notify.MatchFound(s.AccountID, g.ID, state)
 		mf.Language = lang
 		intents = append(intents, mf)
 	}
 	m.pub.Publish(intents...)
 }
@@ -125,7 +136,7 @@ func (m *Matchmaker) Enqueue(ctx context.Context, accountID uuid.UUID, variant e
 	m.mu.Lock()
 	m.results[opponent] = g
 	m.mu.Unlock()
-	m.emitMatchFound(g)
+	m.emitMatchFound(ctx, g)
 	return EnqueueResult{Matched: true, Game: g}, nil
 }
@@ -142,11 +153,14 @@ func (m *Matchmaker) Poll(_ context.Context, accountID uuid.UUID) (EnqueueResult
 	return EnqueueResult{}, nil
 }
-// Cancel removes accountID from whatever pool it waits in, reporting whether it
+// Cancel removes accountID from whatever pool it waits in and drops any pending
-// was queued.
+// matched result, reporting whether it was queued. Clearing the result closes the
 // race where the reaper substituted a robot just before the player cancelled: the
 // stale game must not later surface through Poll as a game the player did not want.
 func (m *Matchmaker) Cancel(_ context.Context, accountID uuid.UUID) bool {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	delete(m.results, accountID)
 	variant, ok := m.queued[accountID]
 	if !ok {
 		return false
@@ -197,12 +211,12 @@ func (m *Matchmaker) Reap(ctx context.Context, now time.Time) {
 	}
 	var subs []sub
 	for _, acc := range due {
-		robotID, err := m.robots.Pick()
+		variant := m.queued[acc]
 		robotID, err := m.robots.Pick(variant)
 		if err != nil {
 			m.log.Warn("robot substitution deferred", zap.Error(err))
 			continue
 		}
 		variant := m.queued[acc]
 		m.removeLocked(acc, variant)
 		seats := []uuid.UUID{acc, robotID}
 		if m.rng.Intn(2) == 0 {
@@ -221,7 +235,7 @@ func (m *Matchmaker) Reap(ctx context.Context, now time.Time) {
 		m.mu.Lock()
 		m.results[s.human] = g
 		m.mu.Unlock()
-		m.emitMatchFound(g)
+		m.emitMatchFound(ctx, g)
 	}
 }
@@ -11,6 +11,7 @@ import (
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/notify"
 )
 // fakeCreator records the games a matchmaker asks it to start.
@@ -27,14 +28,22 @@ func (f *fakeCreator) Create(_ context.Context, p game.CreateParams) (game.Game,
 	return game.Game{ID: uuid.New(), Players: len(p.Seats)}, nil
 }
-// fakeRobots is a RobotProvider returning a fixed robot id, or an error to model
+// InitialState satisfies GameCreator; the matchmaker reads it to enrich match_found. The pairing
-// an empty pool.
+// tests assert on matching behaviour, not the payload, so an empty state is enough.
-type fakeRobots struct {
+func (f *fakeCreator) InitialState(_ context.Context, _, _ uuid.UUID) (notify.PlayerState, error) {
-	id  uuid.UUID
+	return notify.PlayerState{}, nil
 	err error
 }
-func (f *fakeRobots) Pick() (uuid.UUID, error) {
+// fakeRobots is a RobotProvider returning a fixed robot id, or an error to model
 // an empty pool. It records the variant of the last substitution request.
 type fakeRobots struct {
 	id          uuid.UUID
 	err         error
 	lastVariant engine.Variant
 }
 func (f *fakeRobots) Pick(variant engine.Variant) (uuid.UUID, error) {
 	f.lastVariant = variant
 	if f.err != nil {
 		return uuid.Nil, f.err
 	}
@@ -238,6 +247,27 @@ func TestMatchmakerReaperSkipsCancelled(t *testing.T) {
 	}
 }
 // TestMatchmakerCancelClearsPendingResult covers the race where the reaper substitutes a
 // robot just before the player cancels: Cancel must drop the pending result so the
 // abandoned game never surfaces through Poll.
 func TestMatchmakerCancelClearsPendingResult(t *testing.T) {
 	creator := &fakeCreator{}
 	mm := newTestMatchmaker(creator, uuid.New())
 	base := time.Now()
 	mm.clock = func() time.Time { return base }
 	ctx := context.Background()
 	a := uuid.New()
 	if _, err := mm.Enqueue(ctx, a, engine.VariantEnglish); err != nil {
 		t.Fatalf("enqueue: %v", err)
 	}
 	mm.Reap(ctx, base.Add(testWaitDelay+time.Second)) // substitution stores a pending result
 	mm.Cancel(ctx, a)                                 // ... then the player cancels
 	if got, _ := mm.Poll(ctx, a); got.Matched {
 		t.Error("cancel must drop the pending substituted game; Poll still matched")
 	}
 }
 func TestMatchmakerReaperDefersWithoutRobot(t *testing.T) {
 	creator := &fakeCreator{}
 	mm := NewMatchmaker(creator, &fakeRobots{err: errors.New("empty pool")}, testWaitDelay, zap.NewNop())
@@ -0,0 +1,117 @@
 package notify
 import (
 	flatbuffers "github.com/google/flatbuffers/go"
 	"scrabble/backend/internal/engine"
 	"scrabble/pkg/wire"
 )
 // The builders below encode the nested wire tables embedded in enriched event
 // payloads. They map the domain's already-resolved values (notify.* payload structs
 // and the decoded engine.MoveRecord) to the neutral scrabble/pkg/wire structs and
 // delegate the FlatBuffers construction to package wire — the single definition of the
 // nested-table layout shared with the gateway transcoder. Each returns the offset of
 // the table it built; callers must build every nested table before opening the parent.
 // toWireGame maps a GameSummary to the shared wire.GameView.
 func toWireGame(g GameSummary) wire.GameView {
 	seats := make([]wire.SeatView, len(g.Seats))
 	for i, s := range g.Seats {
 		seats[i] = wire.SeatView{
 			Seat:        s.Seat,
 			AccountID:   s.AccountID,
 			Score:       s.Score,
 			HintsUsed:   s.HintsUsed,
 			IsWinner:    s.IsWinner,
 			DisplayName: s.DisplayName,
 		}
 	}
 	return wire.GameView{
 		ID:               g.ID,
 		Variant:          g.Variant,
 		DictVersion:      g.DictVersion,
 		Status:           g.Status,
 		Players:          g.Players,
 		ToMove:           g.ToMove,
 		TurnTimeoutSecs:  g.TurnTimeoutSecs,
 		MoveCount:        g.MoveCount,
 		EndReason:        g.EndReason,
 		Seats:            seats,
 		LastActivityUnix: g.LastActivityUnix,
 	}
 }
 // buildGameView builds a GameView table from a GameSummary and returns its offset.
 func buildGameView(b *flatbuffers.Builder, g GameSummary) flatbuffers.UOffsetT {
 	return wire.BuildGameView(b, toWireGame(g))
 }
 // buildMoveRecord builds a MoveRecord table from a decoded engine move and returns its
 // offset (Count is the engine count: the number of tiles swapped on an exchange, zero
 // otherwise).
 func buildMoveRecord(b *flatbuffers.Builder, m engine.MoveRecord) flatbuffers.UOffsetT {
 	tiles := make([]wire.TileRecord, len(m.Tiles))
 	for i, t := range m.Tiles {
 		tiles[i] = wire.TileRecord{Row: t.Row, Col: t.Col, Letter: t.Letter, Blank: t.Blank}
 	}
 	return wire.BuildMoveRecord(b, wire.MoveRecord{
 		Player:  m.Player,
 		Action:  m.Action.String(),
 		Dir:     m.Dir.String(),
 		MainRow: m.MainRow,
 		MainCol: m.MainCol,
 		Tiles:   tiles,
 		Words:   m.Words,
 		Count:   m.Count,
 		Score:   m.Score,
 		Total:   m.Total,
 	})
 }
 // buildStateView builds a StateView table from a PlayerState and returns its offset.
 func buildStateView(b *flatbuffers.Builder, s PlayerState) flatbuffers.UOffsetT {
 	alphabet := make([]wire.AlphabetEntry, len(s.Alphabet))
 	for i, e := range s.Alphabet {
 		alphabet[i] = wire.AlphabetEntry{Index: e.Index, Letter: e.Letter, Value: e.Value}
 	}
 	return wire.BuildStateView(b, wire.StateView{
 		Game:           toWireGame(s.Game),
 		Seat:           s.Seat,
 		Rack:           s.Rack,
 		BagLen:         s.BagLen,
 		HintsRemaining: s.HintsRemaining,
 		Alphabet:       alphabet,
 	})
 }
 // buildAccountRef builds an AccountRef table and returns its offset.
 func buildAccountRef(b *flatbuffers.Builder, a AccountRef) flatbuffers.UOffsetT {
 	return wire.BuildAccountRef(b, wire.AccountRef{AccountID: a.AccountID, DisplayName: a.DisplayName})
 }
 // buildInvitation builds an Invitation table from an InvitationSummary and returns its offset.
 func buildInvitation(b *flatbuffers.Builder, inv InvitationSummary) flatbuffers.UOffsetT {
 	invitees := make([]wire.InvitationInvitee, len(inv.Invitees))
 	for i, iv := range inv.Invitees {
 		invitees[i] = wire.InvitationInvitee{
 			AccountID:   iv.AccountID,
 			DisplayName: iv.DisplayName,
 			Seat:        iv.Seat,
 			Response:    iv.Response,
 		}
 	}
 	return wire.BuildInvitation(b, wire.Invitation{
 		ID:              inv.ID,
 		Inviter:         wire.AccountRef{AccountID: inv.Inviter.AccountID, DisplayName: inv.Inviter.DisplayName},
 		Invitees:        invitees,
 		Variant:         inv.Variant,
 		TurnTimeoutSecs: inv.TurnTimeoutSecs,
 		HintsAllowed:    inv.HintsAllowed,
 		HintsPerPlayer:  inv.HintsPerPlayer,
 		DropoutTiles:    inv.DropoutTiles,
 		Status:          inv.Status,
 		GameID:          inv.GameID,
 		ExpiresAtUnix:   inv.ExpiresAtUnix,
 	})
 }
@@ -6,6 +6,7 @@ import (
 	flatbuffers "github.com/google/flatbuffers/go"
 	"github.com/google/uuid"
 	"scrabble/backend/internal/engine"
 	fb "scrabble/pkg/fbs/scrabblefb"
 )
@@ -13,30 +14,65 @@ import (
 // the payload with the shared scrabblefb schema. Keeping the encoding here lets
 // the game/social/lobby services emit events without importing the wire schema.
-// YourTurn announces to userID that it is their turn in game gameID, with the
+// YourTurn announces to userID that it is their turn in game gameID, with the turn's nominal
-// turn's nominal deadline.
+// deadline. opponentName, lastAction, lastWord and scoreLine enrich the out-of-app push:
-func YourTurn(userID, gameID uuid.UUID, deadline time.Time) Intent {
+// the player who just moved, their move kind, the main word of a scoring play (empty
-	b := flatbuffers.NewBuilder(64)
+// otherwise) and the recipient-first running score line. Empty strings render the plain "your
 // turn" text. moveCount is the post-move count, which the client compares against its cached
 // game to detect a missed in-app move and fall back to a refetch.
 func YourTurn(userID, gameID uuid.UUID, deadline time.Time, opponentName, lastAction, lastWord, scoreLine string, moveCount int) Intent {
 	b := flatbuffers.NewBuilder(128)
 	gid := b.CreateString(gameID.String())
 	name := b.CreateString(opponentName)
 	action := b.CreateString(lastAction)
 	word := b.CreateString(lastWord)
 	score := b.CreateString(scoreLine)
 	fb.YourTurnEventStart(b)
 	fb.YourTurnEventAddGameId(b, gid)
 	fb.YourTurnEventAddDeadlineUnix(b, deadline.Unix())
 	fb.YourTurnEventAddOpponentName(b, name)
 	fb.YourTurnEventAddLastAction(b, action)
 	fb.YourTurnEventAddLastWord(b, word)
 	fb.YourTurnEventAddScoreLine(b, score)
 	fb.YourTurnEventAddMoveCount(b, int32(moveCount))
 	b.Finish(fb.YourTurnEventEnd(b))
 	return Intent{UserID: userID, Kind: KindYourTurn, Payload: b.FinishedBytes(), EventID: eventID()}
 }
-// OpponentMoved tells userID that seat just committed a move in game gameID,
+// GameOver announces to userID that game gameID finished. result is the outcome from userID's
-// summarising it (the client refetches the full state).
+// own perspective ("won"/"lost"/"draw") and scoreLine is the recipient-first final score; both
-func OpponentMoved(userID, gameID uuid.UUID, seat int, action string, score, total int) Intent {
+// feed the out-of-app "game over" push. game is the final post-game summary (the
-	b := flatbuffers.NewBuilder(64)
+// adjusted scores after rack penalties and the winner flag), so an in-app client settles the
 // finished game from the event without a refetch.
 func GameOver(userID, gameID uuid.UUID, result, scoreLine string, game GameSummary) Intent {
 	b := flatbuffers.NewBuilder(512)
 	gid := b.CreateString(gameID.String())
-	act := b.CreateString(action)
+	res := b.CreateString(result)
 	score := b.CreateString(scoreLine)
 	gameOff := buildGameView(b, game)
 	fb.GameOverEventStart(b)
 	fb.GameOverEventAddGameId(b, gid)
 	fb.GameOverEventAddResult(b, res)
 	fb.GameOverEventAddScoreLine(b, score)
 	fb.GameOverEventAddGame(b, gameOff)
 	b.Finish(fb.GameOverEventEnd(b))
 	return Intent{UserID: userID, Kind: KindGameOver, Payload: b.FinishedBytes(), EventID: eventID()}
 }
 // OpponentMoved tells userID that move was just committed in game gameID, carrying it as a delta
 // the client applies to its cached game without a refetch: move is the decoded play/pass/
 // exchange, game is the post-move summary (per-seat scores, to_move, move_count, status) and
 // bagLen is the bag size after the draw.
 func OpponentMoved(userID, gameID uuid.UUID, move engine.MoveRecord, game GameSummary, bagLen int) Intent {
 	b := flatbuffers.NewBuilder(512)
 	gid := b.CreateString(gameID.String())
 	moveOff := buildMoveRecord(b, move)
 	gameOff := buildGameView(b, game)
 	fb.OpponentMovedEventStart(b)
 	fb.OpponentMovedEventAddGameId(b, gid)
-	fb.OpponentMovedEventAddSeat(b, int32(seat))
+	fb.OpponentMovedEventAddMove(b, moveOff)
-	fb.OpponentMovedEventAddAction(b, act)
+	fb.OpponentMovedEventAddGame(b, gameOff)
-	fb.OpponentMovedEventAddScore(b, int32(score))
+	fb.OpponentMovedEventAddBagLen(b, int32(bagLen))
 	fb.OpponentMovedEventAddTotal(b, int32(total))
 	b.Finish(fb.OpponentMovedEventEnd(b))
 	return Intent{UserID: userID, Kind: KindOpponentMoved, Payload: b.FinishedBytes(), EventID: eventID()}
 }
@@ -72,21 +108,24 @@ func Nudge(userID, gameID, fromUserID uuid.UUID) Intent {
 	return Intent{UserID: userID, Kind: KindNudge, Payload: b.FinishedBytes(), EventID: eventID()}
 }
-// MatchFound tells userID that game gameID, which they are seated in, has
+// MatchFound tells userID that game gameID, which they are seated in, has started (an auto-match
-// started (an auto-match pairing or a robot substitution).
+// pairing or a robot substitution). state is the recipient's full initial view of the new game,
-func MatchFound(userID, gameID uuid.UUID) Intent {
+// so the client navigates straight in from the event with no follow-up fetch.
-	b := flatbuffers.NewBuilder(64)
+func MatchFound(userID, gameID uuid.UUID, state PlayerState) Intent {
 	b := flatbuffers.NewBuilder(512)
 	gid := b.CreateString(gameID.String())
 	stateOff := buildStateView(b, state)
 	fb.MatchFoundEventStart(b)
 	fb.MatchFoundEventAddGameId(b, gid)
 	fb.MatchFoundEventAddState(b, stateOff)
 	b.Finish(fb.MatchFoundEventEnd(b))
 	return Intent{UserID: userID, Kind: KindMatchFound, Payload: b.FinishedBytes(), EventID: eventID()}
 }
-// Notification is a lightweight "re-poll" signal to userID that a friend request or
+// Notification is a lightweight "re-poll" signal to userID that something in their lobby
-// invitation changed. kind is a sub-discriminator (NotifyFriendRequest,
+// changed. kind is a sub-discriminator (NotifyFriendRequest, NotifyFriendAdded,
-// NotifyFriendAdded, NotifyInvitation, NotifyGameStarted) the client may use to
+// NotifyFriendDeclined, NotifyInvitation, NotifyGameStarted). It carries no payload; prefer the
-// scope its refresh.
+// enriched constructors below, which let the client update its lobby without a refetch.
 func Notification(userID uuid.UUID, kind string) Intent {
 	b := flatbuffers.NewBuilder(32)
 	k := b.CreateString(kind)
@@ -96,6 +135,47 @@ func Notification(userID uuid.UUID, kind string) Intent {
 	return Intent{UserID: userID, Kind: KindNotification, Payload: b.FinishedBytes(), EventID: eventID()}
 }
 // NotificationAccount builds a lobby notification of one of the friend_* kinds carrying the
 // account it concerns (the requester, the new friend or the decliner), so the client updates its
 // requests/friends lists and the in-game "add friend" state without a refetch.
 func NotificationAccount(userID uuid.UUID, kind string, acc AccountRef) Intent {
 	b := flatbuffers.NewBuilder(128)
 	k := b.CreateString(kind)
 	accOff := buildAccountRef(b, acc)
 	fb.NotificationEventStart(b)
 	fb.NotificationEventAddKind(b, k)
 	fb.NotificationEventAddAccount(b, accOff)
 	b.Finish(fb.NotificationEventEnd(b))
 	return Intent{UserID: userID, Kind: KindNotification, Payload: b.FinishedBytes(), EventID: eventID()}
 }
 // NotificationGameStarted builds the NotifyGameStarted notification carrying the recipient's
 // initial view of the just-started invited game, so the client seeds its game cache and the
 // lobby list without a refetch.
 func NotificationGameStarted(userID uuid.UUID, state PlayerState) Intent {
 	b := flatbuffers.NewBuilder(512)
 	k := b.CreateString(NotifyGameStarted)
 	stateOff := buildStateView(b, state)
 	fb.NotificationEventStart(b)
 	fb.NotificationEventAddKind(b, k)
 	fb.NotificationEventAddState(b, stateOff)
 	b.Finish(fb.NotificationEventEnd(b))
 	return Intent{UserID: userID, Kind: KindNotification, Payload: b.FinishedBytes(), EventID: eventID()}
 }
 // NotificationInvitation builds the NotifyInvitation notification carrying the new invitation,
 // so the client adds it to its lobby invitations list without a refetch.
 func NotificationInvitation(userID uuid.UUID, inv InvitationSummary) Intent {
 	b := flatbuffers.NewBuilder(512)
 	k := b.CreateString(NotifyInvitation)
 	invOff := buildInvitation(b, inv)
 	fb.NotificationEventStart(b)
 	fb.NotificationEventAddKind(b, k)
 	fb.NotificationEventAddInvitation(b, invOff)
 	b.Finish(fb.NotificationEventEnd(b))
 	return Intent{UserID: userID, Kind: KindNotification, Payload: b.FinishedBytes(), EventID: eventID()}
 }
 // eventID returns a best-effort correlation id for one emitted event.
 func eventID() string {
 	if id, err := uuid.NewV7(); err == nil {
@@ -27,6 +27,9 @@ const (
 	// KindNotification is a lightweight "re-poll your lobby counters" signal
 	// (incoming friend requests, invitations) that drives the lobby badge.
 	KindNotification = "notify"
 	// KindGameOver announces a finished game to each seated player, driving the
 	// out-of-app "game over" push.
 	KindGameOver = "game_over"
 )
 // Notification sub-kinds carried in a KindNotification event payload; the client
@@ -34,8 +37,11 @@ const (
 const (
 	NotifyFriendRequest = "friend_request"
 	NotifyFriendAdded   = "friend_added"
-	NotifyInvitation    = "invitation"
+	// NotifyFriendDeclined tells the original requester their request was declined, so a
-	NotifyGameStarted   = "game_started"
+	// game screen watching that opponent re-derives its "add to friends" state.
 	NotifyFriendDeclined = "friend_declined"
 	NotifyInvitation     = "invitation"
 	NotifyGameStarted    = "game_started"
 )
 // Intent is one live event destined for a single user. Payload is the
@@ -46,6 +52,11 @@ type Intent struct {
 	Kind    string
 	Payload []byte
 	EventID string
 	// Language routes an out-of-app push to a specific per-language bot: for a
 	// game event it is the game's language ("en"/"ru"), so the notification comes from the
 	// game's bot rather than the recipient's last-login bot. Empty falls back to the
 	// recipient's service language at the gateway.
 	Language string
 }
 // Publisher accepts live-event intents. Implementations must be safe for
@@ -6,6 +6,7 @@ import (
 	"github.com/google/uuid"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/notify"
 	fb "scrabble/pkg/fbs/scrabblefb"
 )
@@ -61,7 +62,7 @@ func TestNopPublisherDiscards(t *testing.T) {
 func TestYourTurnPayloadRoundTrips(t *testing.T) {
 	uid, gid := uuid.New(), uuid.New()
-	in := notify.YourTurn(uid, gid, time.Unix(1717000000, 0))
+	in := notify.YourTurn(uid, gid, time.Unix(1717000000, 0), "Ann", "play", "STOOL", "120:95", 7)
 	if in.UserID != uid || in.Kind != notify.KindYourTurn || in.EventID == "" {
 		t.Fatalf("intent metadata wrong: %+v", in)
 	}
@@ -72,18 +73,124 @@ func TestYourTurnPayloadRoundTrips(t *testing.T) {
 	if got := ev.DeadlineUnix(); got != 1717000000 {
 		t.Fatalf("deadline = %d, want 1717000000", got)
 	}
 	if got := ev.MoveCount(); got != 7 {
 		t.Fatalf("move_count = %d, want 7", got)
 	}
 	if string(ev.OpponentName()) != "Ann" || string(ev.LastAction()) != "play" ||
 		string(ev.LastWord()) != "STOOL" || string(ev.ScoreLine()) != "120:95" {
 		t.Fatalf("enriched fields wrong: name=%q action=%q word=%q score=%q",
 			ev.OpponentName(), ev.LastAction(), ev.LastWord(), ev.ScoreLine())
 	}
 }
 func TestGameOverPayloadRoundTrips(t *testing.T) {
 	uid, gid := uuid.New(), uuid.New()
 	summary := notify.GameSummary{ID: gid.String(), Status: "finished", MoveCount: 18, Seats: []notify.SeatStanding{{Seat: 0, Score: 120, IsWinner: true}}}
 	in := notify.GameOver(uid, gid, "won", "120:95:80", summary)
 	if in.UserID != uid || in.Kind != notify.KindGameOver || in.EventID == "" {
 		t.Fatalf("intent metadata wrong: %+v", in)
 	}
 	ev := fb.GetRootAsGameOverEvent(in.Payload, 0)
 	if string(ev.GameId()) != gid.String() || string(ev.Result()) != "won" || string(ev.ScoreLine()) != "120:95:80" {
 		t.Fatalf("game_over fields wrong: game=%q result=%q score=%q", ev.GameId(), ev.Result(), ev.ScoreLine())
 	}
 	g := ev.Game(nil)
 	if g == nil || string(g.Id()) != gid.String() || g.MoveCount() != 18 || g.SeatsLength() != 1 {
 		t.Fatalf("final game summary wrong: %+v", g)
 	}
 }
 func TestOpponentMovedPayloadRoundTrips(t *testing.T) {
 	uid, gid := uuid.New(), uuid.New()
-	in := notify.OpponentMoved(uid, gid, 1, "play", 24, 130)
+	move := engine.MoveRecord{Player: 1, Action: engine.ActionPlay, Words: []string{"STOOL"}, Score: 24, Total: 130}
 	summary := notify.GameSummary{ID: gid.String(), MoveCount: 9, ToMove: 0, Seats: []notify.SeatStanding{{Seat: 1, Score: 130}}}
 	in := notify.OpponentMoved(uid, gid, move, summary, 42)
 	if in.Kind != notify.KindOpponentMoved {
 		t.Fatalf("kind = %q", in.Kind)
 	}
 	ev := fb.GetRootAsOpponentMovedEvent(in.Payload, 0)
-	if string(ev.GameId()) != gid.String() || ev.Seat() != 1 || string(ev.Action()) != "play" || ev.Score() != 24 || ev.Total() != 130 {
+	if string(ev.GameId()) != gid.String() {
-		t.Fatalf("decoded wrong: game=%q seat=%d action=%q score=%d total=%d",
+		t.Fatalf("game id = %q", ev.GameId())
-			ev.GameId(), ev.Seat(), ev.Action(), ev.Score(), ev.Total())
+	}
 	// The delta: the move, the post-move summary and the bag size.
 	if ev.BagLen() != 42 {
 		t.Fatalf("bag_len = %d, want 42", ev.BagLen())
 	}
 	m := ev.Move(nil)
 	if m == nil || m.Player() != 1 || string(m.Action()) != "play" || m.Total() != 130 {
 		t.Fatalf("move wrong: %+v", m)
 	}
 	if g := ev.Game(nil); g == nil || g.MoveCount() != 9 || g.ToMove() != 0 {
 		t.Fatalf("game summary wrong: %+v", ev.Game(nil))
 	}
 }
 func TestMatchFoundCarriesInitialState(t *testing.T) {
 	uid, gid := uuid.New(), uuid.New()
 	state := notify.PlayerState{
 		Game:   notify.GameSummary{ID: gid.String(), Variant: "scrabble_en", Seats: []notify.SeatStanding{{Seat: 0, DisplayName: "Ann"}}},
 		Seat:   0,
 		Rack:   []int{0, 1, 2, 255},
 		BagLen: 86,
 	}
 	in := notify.MatchFound(uid, gid, state)
 	if in.UserID != uid || in.Kind != notify.KindMatchFound {
 		t.Fatalf("intent metadata wrong: %+v", in)
 	}
 	ev := fb.GetRootAsMatchFoundEvent(in.Payload, 0)
 	if string(ev.GameId()) != gid.String() {
 		t.Fatalf("game id = %q", ev.GameId())
 	}
 	st := ev.State(nil)
 	if st == nil || st.Seat() != 0 || st.BagLen() != 86 || st.RackLength() != 4 || st.Rack(3) != 255 {
 		t.Fatalf("initial state wrong: %+v", st)
 	}
 	if g := st.Game(nil); g == nil || string(g.Variant()) != "scrabble_en" {
 		t.Fatalf("state game wrong: %+v", st.Game(nil))
 	}
 }
 func TestNotificationInvitationCarriesInvitation(t *testing.T) {
 	uid := uuid.New()
 	inv := notify.InvitationSummary{
 		ID:              "inv-1",
 		Inviter:         notify.AccountRef{AccountID: "a-1", DisplayName: "Ann"},
 		Invitees:        []notify.InvitationInvitee{{AccountID: "b-1", DisplayName: "Bob", Seat: 1, Response: "pending"}},
 		Variant:         "erudit_ru",
 		TurnTimeoutSecs: 86400,
 		Status:          "pending",
 	}
 	in := notify.NotificationInvitation(uid, inv)
 	if in.Kind != notify.KindNotification {
 		t.Fatalf("kind = %q", in.Kind)
 	}
 	ev := fb.GetRootAsNotificationEvent(in.Payload, 0)
 	if string(ev.Kind()) != notify.NotifyInvitation {
 		t.Fatalf("sub-kind = %q, want %q", ev.Kind(), notify.NotifyInvitation)
 	}
 	got := ev.Invitation(nil)
 	if got == nil || string(got.Id()) != "inv-1" || string(got.Variant()) != "erudit_ru" || got.InviteesLength() != 1 {
 		t.Fatalf("invitation wrong: %+v", got)
 	}
 	var iv fb.InvitationInvitee
 	if !got.Invitees(&iv, 0) || string(iv.DisplayName()) != "Bob" || iv.Seat() != 1 {
 		t.Fatalf("invitee wrong")
 	}
 	if inviter := got.Inviter(nil); inviter == nil || string(inviter.DisplayName()) != "Ann" {
 		t.Fatalf("inviter wrong")
 	}
 }
 func TestNotificationAccountCarriesAccount(t *testing.T) {
 	uid := uuid.New()
 	in := notify.NotificationAccount(uid, notify.NotifyFriendRequest, notify.AccountRef{AccountID: "a-1", DisplayName: "Ann"})
 	ev := fb.GetRootAsNotificationEvent(in.Payload, 0)
 	if string(ev.Kind()) != notify.NotifyFriendRequest {
 		t.Fatalf("sub-kind = %q", ev.Kind())
 	}
 	acc := ev.Account(nil)
 	if acc == nil || string(acc.AccountId()) != "a-1" || string(acc.DisplayName()) != "Ann" {
 		t.Fatalf("account wrong: %+v", acc)
 	}
 }
@@ -0,0 +1,89 @@
 package notify
 // The structs below are the wire-agnostic inputs the domain services hand to the
 // enriched event constructors. Keeping them here — rather than importing the wire
 // schema into game/lobby/social — preserves the package boundary: notify owns the
 // FlatBuffers encoding, while the domain only fills in already-resolved values (seat
 // display names, alphabet-index racks). Each mirrors the matching scrabblefb table.
 // SeatStanding is one seat's public standing inside a GameSummary (mirrors
 // scrabblefb.SeatView).
 type SeatStanding struct {
 	Seat        int
 	AccountID   string
 	DisplayName string
 	Score       int
 	HintsUsed   int
 	IsWinner    bool
 }
 // GameSummary is the shared, non-private game state embedded in enriched events
 // (mirrors scrabblefb.GameView). LastActivityUnix is the lobby sort key: the current
 // turn's start for an active game, the finish time once finished.
 type GameSummary struct {
 	ID               string
 	Variant          string
 	DictVersion      string
 	Status           string
 	Players          int
 	ToMove           int
 	TurnTimeoutSecs  int
 	MoveCount        int
 	EndReason        string
 	Seats            []SeatStanding
 	LastActivityUnix int64
 }
 // AlphabetLetter is one variant alphabet entry (a display-only row) embedded in an
 // initial PlayerState so a client seeing a variant for the first time can render its
 // rack (mirrors scrabblefb.AlphabetEntry).
 type AlphabetLetter struct {
 	Index  int
 	Letter string
 	Value  int
 }
 // PlayerState is a player's full initial view of a game — the shared summary plus
 // their private rack and budgets (mirrors scrabblefb.StateView). Rack carries wire
 // alphabet indices (a blank is the sentinel index 255). Alphabet is set only when the
 // recipient may not have cached the variant yet (match_found / game_started).
 type PlayerState struct {
 	Game           GameSummary
 	Seat           int
 	Rack           []int
 	BagLen         int
 	HintsRemaining int
 	Alphabet       []AlphabetLetter
 }
 // AccountRef is a referenced account with its display name resolved (mirrors
 // scrabblefb.AccountRef).
 type AccountRef struct {
 	AccountID   string
 	DisplayName string
 }
 // InvitationInvitee is one invited player's seat and response inside an
 // InvitationSummary (mirrors scrabblefb.InvitationInvitee).
 type InvitationInvitee struct {
 	AccountID   string
 	DisplayName string
 	Seat        int
 	Response    string
 }
 // InvitationSummary is a friend-game invitation carried by the NotifyInvitation event so
 // the client adds it to its lobby list without a refetch (mirrors scrabblefb.Invitation).
 type InvitationSummary struct {
 	ID              string
 	Inviter         AccountRef
 	Invitees        []InvitationInvitee
 	Variant         string
 	TurnTimeoutSecs int
 	HintsAllowed    bool
 	HintsPerPlayer  int
 	DropoutTiles    string
 	Status          string
 	GameID          string
 	ExpiresAtUnix   int64
 }
@@ -30,4 +30,5 @@ type Accounts struct {
 	MergedInto             *uuid.UUID
 	MergedAt               *time.Time
 	ServiceLanguage        *string
 	FlaggedHighRateAt      *time.Time
 }
@@ -0,0 +1,21 @@
 //
 // Code generated by go-jet DO NOT EDIT.
 //
 // WARNING: Changes to this file may cause incorrect behavior
 // and will be lost if the code is regenerated
 //
 package model
 import (
 	"github.com/google/uuid"
 	"time"
 )
 type GameDrafts struct {
 	GameID     uuid.UUID `sql:"primary_key"`
 	AccountID  uuid.UUID `sql:"primary_key"`
 	RackOrder  string
 	BoardTiles string
 	UpdatedAt  time.Time
 }
@@ -0,0 +1,19 @@
 //
 // Code generated by go-jet DO NOT EDIT.
 //
 // WARNING: Changes to this file may cause incorrect behavior
 // and will be lost if the code is regenerated
 //
 package model
 import (
 	"github.com/google/uuid"
 	"time"
 )
 type GameHidden struct {
 	AccountID uuid.UUID `sql:"primary_key"`
 	GameID    uuid.UUID `sql:"primary_key"`
 	CreatedAt time.Time
 }
@@ -34,6 +34,7 @@ type accountsTable struct {
 	MergedInto             postgres.ColumnString
 	MergedAt               postgres.ColumnTimestampz
 	ServiceLanguage        postgres.ColumnString
 	FlaggedHighRateAt      postgres.ColumnTimestampz
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -92,8 +93,9 @@ func newAccountsTableImpl(schemaName, tableName, alias string) accountsTable {
 		MergedIntoColumn             = postgres.StringColumn("merged_into")
 		MergedAtColumn               = postgres.TimestampzColumn("merged_at")
 		ServiceLanguageColumn        = postgres.StringColumn("service_language")
-		allColumns                   = postgres.ColumnList{AccountIDColumn, DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, ServiceLanguageColumn}
+		FlaggedHighRateAtColumn      = postgres.TimestampzColumn("flagged_high_rate_at")
-		mutableColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, ServiceLanguageColumn}
+		allColumns                   = postgres.ColumnList{AccountIDColumn, DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, ServiceLanguageColumn, FlaggedHighRateAtColumn}
 		mutableColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, ServiceLanguageColumn, FlaggedHighRateAtColumn}
 		defaultColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn}
 	)
@@ -118,6 +120,7 @@ func newAccountsTableImpl(schemaName, tableName, alias string) accountsTable {
 		MergedInto:             MergedIntoColumn,
 		MergedAt:               MergedAtColumn,
 		ServiceLanguage:        ServiceLanguageColumn,
 		FlaggedHighRateAt:      FlaggedHighRateAtColumn,
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,
@@ -0,0 +1,90 @@
 //
 // Code generated by go-jet DO NOT EDIT.
 //
 // WARNING: Changes to this file may cause incorrect behavior
 // and will be lost if the code is regenerated
 //
 package table
 import (
 	"github.com/go-jet/jet/v2/postgres"
 )
 var GameDrafts = newGameDraftsTable("backend", "game_drafts", "")
 type gameDraftsTable struct {
 	postgres.Table
 	// Columns
 	GameID     postgres.ColumnString
 	AccountID  postgres.ColumnString
 	RackOrder  postgres.ColumnString
 	BoardTiles postgres.ColumnString
 	UpdatedAt  postgres.ColumnTimestampz
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
 	DefaultColumns postgres.ColumnList
 }
 type GameDraftsTable struct {
 	gameDraftsTable
 	EXCLUDED gameDraftsTable
 }
 // AS creates new GameDraftsTable with assigned alias
 func (a GameDraftsTable) AS(alias string) *GameDraftsTable {
 	return newGameDraftsTable(a.SchemaName(), a.TableName(), alias)
 }
 // Schema creates new GameDraftsTable with assigned schema name
 func (a GameDraftsTable) FromSchema(schemaName string) *GameDraftsTable {
 	return newGameDraftsTable(schemaName, a.TableName(), a.Alias())
 }
 // WithPrefix creates new GameDraftsTable with assigned table prefix
 func (a GameDraftsTable) WithPrefix(prefix string) *GameDraftsTable {
 	return newGameDraftsTable(a.SchemaName(), prefix+a.TableName(), a.TableName())
 }
 // WithSuffix creates new GameDraftsTable with assigned table suffix
 func (a GameDraftsTable) WithSuffix(suffix string) *GameDraftsTable {
 	return newGameDraftsTable(a.SchemaName(), a.TableName()+suffix, a.TableName())
 }
 func newGameDraftsTable(schemaName, tableName, alias string) *GameDraftsTable {
 	return &GameDraftsTable{
 		gameDraftsTable: newGameDraftsTableImpl(schemaName, tableName, alias),
 		EXCLUDED:        newGameDraftsTableImpl("", "excluded", ""),
 	}
 }
 func newGameDraftsTableImpl(schemaName, tableName, alias string) gameDraftsTable {
 	var (
 		GameIDColumn     = postgres.StringColumn("game_id")
 		AccountIDColumn  = postgres.StringColumn("account_id")
 		RackOrderColumn  = postgres.StringColumn("rack_order")
 		BoardTilesColumn = postgres.StringColumn("board_tiles")
 		UpdatedAtColumn  = postgres.TimestampzColumn("updated_at")
 		allColumns       = postgres.ColumnList{GameIDColumn, AccountIDColumn, RackOrderColumn, BoardTilesColumn, UpdatedAtColumn}
 		mutableColumns   = postgres.ColumnList{RackOrderColumn, BoardTilesColumn, UpdatedAtColumn}
 		defaultColumns   = postgres.ColumnList{RackOrderColumn, BoardTilesColumn, UpdatedAtColumn}
 	)
 	return gameDraftsTable{
 		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
 		//Columns
 		GameID:     GameIDColumn,
 		AccountID:  AccountIDColumn,
 		RackOrder:  RackOrderColumn,
 		BoardTiles: BoardTilesColumn,
 		UpdatedAt:  UpdatedAtColumn,
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,
 		DefaultColumns: defaultColumns,
 	}
 }
@@ -0,0 +1,84 @@
 //
 // Code generated by go-jet DO NOT EDIT.
 //
 // WARNING: Changes to this file may cause incorrect behavior
 // and will be lost if the code is regenerated
 //
 package table
 import (
 	"github.com/go-jet/jet/v2/postgres"
 )
 var GameHidden = newGameHiddenTable("backend", "game_hidden", "")
 type gameHiddenTable struct {
 	postgres.Table
 	// Columns
 	AccountID postgres.ColumnString
 	GameID    postgres.ColumnString
 	CreatedAt postgres.ColumnTimestampz
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
 	DefaultColumns postgres.ColumnList
 }
 type GameHiddenTable struct {
 	gameHiddenTable
 	EXCLUDED gameHiddenTable
 }
 // AS creates new GameHiddenTable with assigned alias
 func (a GameHiddenTable) AS(alias string) *GameHiddenTable {
 	return newGameHiddenTable(a.SchemaName(), a.TableName(), alias)
 }
 // Schema creates new GameHiddenTable with assigned schema name
 func (a GameHiddenTable) FromSchema(schemaName string) *GameHiddenTable {
 	return newGameHiddenTable(schemaName, a.TableName(), a.Alias())
 }
 // WithPrefix creates new GameHiddenTable with assigned table prefix
 func (a GameHiddenTable) WithPrefix(prefix string) *GameHiddenTable {
 	return newGameHiddenTable(a.SchemaName(), prefix+a.TableName(), a.TableName())
 }
 // WithSuffix creates new GameHiddenTable with assigned table suffix
 func (a GameHiddenTable) WithSuffix(suffix string) *GameHiddenTable {
 	return newGameHiddenTable(a.SchemaName(), a.TableName()+suffix, a.TableName())
 }
 func newGameHiddenTable(schemaName, tableName, alias string) *GameHiddenTable {
 	return &GameHiddenTable{
 		gameHiddenTable: newGameHiddenTableImpl(schemaName, tableName, alias),
 		EXCLUDED:        newGameHiddenTableImpl("", "excluded", ""),
 	}
 }
 func newGameHiddenTableImpl(schemaName, tableName, alias string) gameHiddenTable {
 	var (
 		AccountIDColumn = postgres.StringColumn("account_id")
 		GameIDColumn    = postgres.StringColumn("game_id")
 		CreatedAtColumn = postgres.TimestampzColumn("created_at")
 		allColumns      = postgres.ColumnList{AccountIDColumn, GameIDColumn, CreatedAtColumn}
 		mutableColumns  = postgres.ColumnList{CreatedAtColumn}
 		defaultColumns  = postgres.ColumnList{CreatedAtColumn}
 	)
 	return gameHiddenTable{
 		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
 		//Columns
 		AccountID: AccountIDColumn,
 		GameID:    GameIDColumn,
 		CreatedAt: CreatedAtColumn,
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,
 		DefaultColumns: defaultColumns,
 	}
 }
@@ -18,6 +18,8 @@ func UseSchema(schema string) {
 	EmailConfirmations = EmailConfirmations.FromSchema(schema)
 	FriendCodes = FriendCodes.FromSchema(schema)
 	Friendships = Friendships.FromSchema(schema)
 	GameDrafts = GameDrafts.FromSchema(schema)
 	GameHidden = GameHidden.FromSchema(schema)
 	GameInvitationInvitees = GameInvitationInvitees.FromSchema(schema)
 	GameInvitations = GameInvitations.FromSchema(schema)
 	GameMoves = GameMoves.FromSchema(schema)
@@ -37,7 +37,7 @@ var gooseMu sync.Mutex
 // ApplyMigrations runs every pending Up migration embedded in the backend
 // binary against db. The schema is created upfront so goose's bookkeeping table
 // (`goose_db_version`, scoped to the DSN search_path) has somewhere to land
-// before the first migration runs; migration 00001_init.sql re-asserts the
+// before the first migration runs; the baseline migration re-asserts the
 // schema with IF NOT EXISTS, so the double-create is idempotent.
 //
 // The apply is retried on transient connection errors. Both steps are
@@ -0,0 +1,327 @@
 -- +goose Up
 -- Baseline schema for the Scrabble backend service, consolidating the incremental
 -- migration history into a single starting point (there is no production data yet,
 -- so the squash carries no data migration). Every backend object lives in the
 -- `backend` schema; it is created here so a fresh database can apply this migration,
 -- and search_path is pinned for the rest of the file so unqualified CREATE
 -- statements land in `backend`. Production also pins search_path via
 -- BACKEND_POSTGRES_DSN.
 CREATE SCHEMA IF NOT EXISTS backend;
 SET search_path = backend, pg_catalog;
 -- Durable internal accounts. A guest is a durable row with is_guest set and no
 -- identity, excluded from profile/friends/stats/history. The away window (one
 -- interval per day, in the account's time_zone) is honoured by the turn-timeout
 -- sweeper and the robot's sleep; hint_balance is the purchasable-hint wallet.
 -- service_language records the language tag of the bot a Telegram user last
 -- authenticated through (out-of-app push routing), distinct from preferred_language
 -- (the interface language). merged_into/merged_at turn a merged-away secondary into
 -- an audit tombstone; paid_account is a forward-looking one-time-payment marker.
 CREATE TABLE accounts (
    account_id                uuid        PRIMARY KEY,
    display_name              text        NOT NULL DEFAULT '',
    preferred_language        text        NOT NULL DEFAULT 'en',
    time_zone                 text        NOT NULL DEFAULT 'UTC',
    block_chat                boolean     NOT NULL DEFAULT false,
    block_friend_requests     boolean     NOT NULL DEFAULT false,
    created_at                timestamptz NOT NULL DEFAULT now(),
    updated_at                timestamptz NOT NULL DEFAULT now(),
    away_start                time        NOT NULL DEFAULT '00:00',
    away_end                  time        NOT NULL DEFAULT '07:00',
    hint_balance              integer     NOT NULL DEFAULT 0,
    is_guest                  boolean     NOT NULL DEFAULT false,
    notifications_in_app_only boolean     NOT NULL DEFAULT true,
    paid_account              boolean     NOT NULL DEFAULT false,
    merged_into               uuid        REFERENCES accounts (account_id) ON DELETE SET NULL,
    merged_at                 timestamptz,
    service_language          text        CHECK (service_language IN ('en', 'ru')),
    -- Soft, reversible "suspected high-rate" marker: set once when the gateway
    -- reports sustained rate-limiter rejections past the threshold; an operator
    -- clears it in the admin console. Never an automatic ban.
    flagged_high_rate_at      timestamptz,
    CONSTRAINT accounts_preferred_language_chk CHECK (preferred_language IN ('en', 'ru')),
    CONSTRAINT accounts_hint_balance_chk CHECK (hint_balance >= 0)
 );
 -- Platform and email identities attached to an account. external_id is the platform
 -- user id (kind='telegram'), the email address (kind='email') or the robot name
 -- (kind='robot'); confirmed flips true once an email confirm-code is verified.
 CREATE TABLE identities (
    identity_id uuid        PRIMARY KEY,
    account_id  uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    kind        text        NOT NULL,
    external_id text        NOT NULL,
    confirmed   boolean     NOT NULL DEFAULT false,
    created_at  timestamptz NOT NULL DEFAULT now(),
    CONSTRAINT identities_kind_chk CHECK (kind IN ('telegram', 'email', 'robot')),
    CONSTRAINT identities_kind_external_id_key UNIQUE (kind, external_id)
 );
 CREATE INDEX identities_account_idx ON identities (account_id);
 -- Opaque server sessions. token_hash is the hex-encoded SHA-256 of the bearer token;
 -- the plaintext token is never stored. Sessions are revoke-only (no TTL): status
 -- moves active -> revoked and revoked_at is stamped.
 CREATE TABLE sessions (
    session_id   uuid        PRIMARY KEY,
    account_id   uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    token_hash   text        NOT NULL,
    status       text        NOT NULL DEFAULT 'active',
    created_at   timestamptz NOT NULL DEFAULT now(),
    last_seen_at timestamptz,
    revoked_at   timestamptz,
    CONSTRAINT sessions_status_chk CHECK (status IN ('active', 'revoked')),
    CONSTRAINT sessions_token_hash_key UNIQUE (token_hash)
 );
 CREATE INDEX sessions_account_idx ON sessions (account_id);
 -- One match. The live position is event-sourced: this row carries the pinned
 -- dictionary, the bag seed and the denormalised turn cursor the sweeper needs, while
 -- game_moves is the append-only journal the in-memory engine.Game is replayed from
 -- (docs/ARCHITECTURE.md §9). turn_timeout_secs is the per-game move clock; its allowed
 -- values are enforced in Go. variant uses engine.Variant's stable labels.
 CREATE TABLE games (
    game_id           uuid        PRIMARY KEY,
    variant           text        NOT NULL,
    dict_version      text        NOT NULL,
    seed              bigint      NOT NULL,
    status            text        NOT NULL DEFAULT 'active',
    players           smallint    NOT NULL,
    to_move           smallint    NOT NULL DEFAULT 0,
    turn_started_at   timestamptz NOT NULL DEFAULT now(),
    turn_timeout_secs integer     NOT NULL,
    hints_allowed     boolean     NOT NULL DEFAULT true,
    hints_per_player  smallint    NOT NULL DEFAULT 1,
    move_count        integer     NOT NULL DEFAULT 0,
    end_reason        text,
    created_at        timestamptz NOT NULL DEFAULT now(),
    updated_at        timestamptz NOT NULL DEFAULT now(),
    finished_at       timestamptz,
    dropout_tiles     text        NOT NULL DEFAULT 'remove',
    CONSTRAINT games_variant_chk CHECK (variant IN ('scrabble_en', 'scrabble_ru', 'erudit_ru')),
    CONSTRAINT games_status_chk CHECK (status IN ('active', 'finished')),
    CONSTRAINT games_players_chk CHECK (players BETWEEN 2 AND 4),
    CONSTRAINT games_to_move_chk CHECK (to_move >= 0 AND to_move < players),
    CONSTRAINT games_turn_timeout_chk CHECK (turn_timeout_secs > 0),
    CONSTRAINT games_hints_per_player_chk CHECK (hints_per_player >= 0),
    CONSTRAINT games_end_reason_chk CHECK (
        end_reason IS NULL OR end_reason IN ('out_of_tiles', 'scoreless', 'resign', 'timeout')
    ),
    CONSTRAINT games_dropout_tiles_chk CHECK (dropout_tiles IN ('remove', 'return'))
 );
 -- The sweeper scans active games oldest-turn-first; a partial index keeps it off the
 -- finished archive.
 CREATE INDEX games_active_idx ON games (turn_started_at) WHERE status = 'active';
 -- Seats in turn order (seat 0 moves first), one row per player. account_id is a
 -- durable account. score is the running/final score, is_winner is stamped on finish
 -- (false for every seat on a draw), hints_used counts the per-game allowance consumed
 -- before the profile wallet.
 CREATE TABLE game_players (
    game_id    uuid     NOT NULL REFERENCES games (game_id) ON DELETE CASCADE,
    seat       smallint NOT NULL,
    account_id uuid     NOT NULL REFERENCES accounts (account_id),
    score      integer  NOT NULL DEFAULT 0,
    hints_used smallint NOT NULL DEFAULT 0,
    is_winner  boolean  NOT NULL DEFAULT false,
    PRIMARY KEY (game_id, seat),
    CONSTRAINT game_players_account_key UNIQUE (game_id, account_id)
 );
 CREATE INDEX game_players_account_idx ON game_players (account_id);
 -- The append-only, dictionary-independent move journal (docs/ARCHITECTURE.md §9.1).
 -- seq orders the moves from 0. payload holds the decoded values needed to both replay
 -- the game through the engine and emit GCG without a dictionary. score / running_total
 -- / exchanged_count are lifted out for cheap history rendering.
 CREATE TABLE game_moves (
    game_id         uuid        NOT NULL REFERENCES games (game_id) ON DELETE CASCADE,
    seq             integer     NOT NULL,
    seat            smallint    NOT NULL,
    action          text        NOT NULL,
    score           integer     NOT NULL DEFAULT 0,
    running_total   integer     NOT NULL DEFAULT 0,
    exchanged_count smallint    NOT NULL DEFAULT 0,
    payload         text        NOT NULL DEFAULT '{}',
    created_at      timestamptz NOT NULL DEFAULT now(),
    PRIMARY KEY (game_id, seq),
    CONSTRAINT game_moves_action_chk CHECK (action IN ('play', 'pass', 'exchange', 'resign', 'timeout'))
 );
 -- Word-check complaints captured in the context of a game's pinned dictionary. The
 -- admin review queue resolves them with a disposition that also feeds the offline
 -- dictionary-rebuild pipeline: an accepted complaint records whether the word is to be
 -- added or removed, and is marked applied once a rebuilt version is hot-reloaded.
 CREATE TABLE complaints (
    complaint_id       uuid        PRIMARY KEY,
    complainant_id     uuid        NOT NULL REFERENCES accounts (account_id),
    game_id            uuid        NOT NULL REFERENCES games (game_id) ON DELETE CASCADE,
    variant            text        NOT NULL,
    dict_version       text        NOT NULL,
    word               text        NOT NULL,
    was_valid          boolean     NOT NULL,
    note               text        NOT NULL DEFAULT '',
    status             text        NOT NULL DEFAULT 'open',
    created_at         timestamptz NOT NULL DEFAULT now(),
    disposition        text        NOT NULL DEFAULT '',
    resolution_note    text        NOT NULL DEFAULT '',
    resolved_at        timestamptz,
    applied_in_version text        NOT NULL DEFAULT '',
    CONSTRAINT complaints_status_chk CHECK (status IN ('open', 'resolved')),
    CONSTRAINT complaints_disposition_chk
        CHECK (disposition IN ('', 'reject', 'accept_add', 'accept_remove'))
 );
 CREATE INDEX complaints_status_idx ON complaints (status);
 -- Per-account lifetime statistics, recomputed incrementally on each game finish.
 -- Guests have no durable stats. A draw increments draws only. max_word_points is the
 -- best single move score (folding in every word the move formed and the all-tiles bonus).
 CREATE TABLE account_stats (
    account_id      uuid        PRIMARY KEY REFERENCES accounts (account_id) ON DELETE CASCADE,
    wins            integer     NOT NULL DEFAULT 0,
    losses          integer     NOT NULL DEFAULT 0,
    draws           integer     NOT NULL DEFAULT 0,
    max_game_points integer     NOT NULL DEFAULT 0,
    max_word_points integer     NOT NULL DEFAULT 0,
    updated_at      timestamptz NOT NULL DEFAULT now()
 );
 -- The friend graph. A row is created by the requester as 'pending' and flipped to
 -- 'accepted' by the addressee; an explicit 'declined' is remembered (anti-spam),
 -- while cancelling or unfriending deletes the row. Friendship is symmetric.
 CREATE TABLE friendships (
    requester_id uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    addressee_id uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    status       text        NOT NULL DEFAULT 'pending',
    created_at   timestamptz NOT NULL DEFAULT now(),
    responded_at timestamptz,
    PRIMARY KEY (requester_id, addressee_id),
    CONSTRAINT friendships_status_chk CHECK (status IN ('pending', 'accepted', 'declined')),
    CONSTRAINT friendships_distinct_chk CHECK (requester_id <> addressee_id)
 );
 CREATE INDEX friendships_addressee_idx ON friendships (addressee_id);
 -- Per-user blocks. The effect is applied mutually by the social checks (a block in
 -- either direction suppresses chat visibility and prevents requests/invitations).
 CREATE TABLE blocks (
    blocker_id uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    blocked_id uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    created_at timestamptz NOT NULL DEFAULT now(),
    PRIMARY KEY (blocker_id, blocked_id),
    CONSTRAINT blocks_distinct_chk CHECK (blocker_id <> blocked_id)
 );
 CREATE INDEX blocks_blocked_idx ON blocks (blocked_id);
 -- Per-game chat. A nudge ("it's your move") is a kind='nudge' row with an empty body,
 -- so one journal carries both chatter and nudges. body is capped at 60 runes (enforced
 -- again in Go, where the content filter also rejects links/emails/phone numbers).
 -- sender_ip holds the gateway-forwarded client IP as a validated string. Chat is part
 -- of the game archive and cascades away only with its game.
 CREATE TABLE chat_messages (
    message_id uuid        PRIMARY KEY,
    game_id    uuid        NOT NULL REFERENCES games (game_id) ON DELETE CASCADE,
    sender_id  uuid        NOT NULL REFERENCES accounts (account_id),
    kind       text        NOT NULL DEFAULT 'message',
    body       text        NOT NULL DEFAULT '',
    sender_ip  text,
    created_at timestamptz NOT NULL DEFAULT now(),
    CONSTRAINT chat_messages_kind_chk CHECK (kind IN ('message', 'nudge')),
    CONSTRAINT chat_messages_body_len_chk CHECK (char_length(body) <= 60),
    CONSTRAINT chat_messages_nudge_empty_chk CHECK (kind <> 'nudge' OR body = '')
 );
 CREATE INDEX chat_messages_game_idx ON chat_messages (game_id, created_at);
 -- Backs the once-per-hour nudge rate-limit lookup (latest nudge by a sender).
 CREATE INDEX chat_messages_nudge_idx ON chat_messages (game_id, sender_id, created_at)
    WHERE kind = 'nudge';
 -- Pending email confirm-codes. code_hash is the hex-encoded SHA-256 of the 6-digit code
 -- (the plaintext is never stored); expires_at bounds the TTL and attempts caps brute
 -- force. A row is consumed (consumed_at stamped) on success.
 CREATE TABLE email_confirmations (
    confirmation_id uuid        PRIMARY KEY,
    account_id      uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    email           text        NOT NULL,
    code_hash       text        NOT NULL,
    expires_at      timestamptz NOT NULL,
    attempts        smallint    NOT NULL DEFAULT 0,
    consumed_at     timestamptz,
    created_at      timestamptz NOT NULL DEFAULT now(),
    CONSTRAINT email_confirmations_attempts_chk CHECK (attempts >= 0)
 );
 CREATE INDEX email_confirmations_account_idx ON email_confirmations (account_id);
 -- A friend-game invitation. The inviter (seat 0) proposes the game settings to 1..3
 -- invitees; the game starts only when every invitee has accepted, and any decline
 -- cancels the whole invitation. Lazily expired after expires_at (no background sweep).
 -- game_id is set when the game is started.
 CREATE TABLE game_invitations (
    invitation_id     uuid        PRIMARY KEY,
    inviter_id        uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    variant           text        NOT NULL,
    turn_timeout_secs integer     NOT NULL,
    hints_allowed     boolean     NOT NULL DEFAULT true,
    hints_per_player  smallint    NOT NULL DEFAULT 1,
    dropout_tiles     text        NOT NULL DEFAULT 'remove',
    status            text        NOT NULL DEFAULT 'pending',
    game_id           uuid        REFERENCES games (game_id) ON DELETE SET NULL,
    expires_at        timestamptz NOT NULL,
    created_at        timestamptz NOT NULL DEFAULT now(),
    updated_at        timestamptz NOT NULL DEFAULT now(),
    CONSTRAINT game_invitations_variant_chk CHECK (variant IN ('scrabble_en', 'scrabble_ru', 'erudit_ru')),
    CONSTRAINT game_invitations_dropout_tiles_chk CHECK (dropout_tiles IN ('remove', 'return')),
    CONSTRAINT game_invitations_status_chk CHECK (status IN ('pending', 'declined', 'cancelled', 'expired', 'started')),
    CONSTRAINT game_invitations_turn_timeout_chk CHECK (turn_timeout_secs > 0),
    CONSTRAINT game_invitations_hints_per_player_chk CHECK (hints_per_player >= 0)
 );
 CREATE INDEX game_invitations_inviter_idx ON game_invitations (inviter_id);
 -- One row per invitee (the inviter is implicit seat 0). seat is the invitee's seat in
 -- the started game (1..3, in invitation order). response tracks each invitee's decision.
 CREATE TABLE game_invitation_invitees (
    invitation_id uuid        NOT NULL REFERENCES game_invitations (invitation_id) ON DELETE CASCADE,
    account_id    uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    seat          smallint    NOT NULL,
    response      text        NOT NULL DEFAULT 'pending',
    responded_at  timestamptz,
    PRIMARY KEY (invitation_id, account_id),
    CONSTRAINT game_invitation_invitees_response_chk CHECK (response IN ('pending', 'accepted', 'declined')),
    CONSTRAINT game_invitation_invitees_seat_chk CHECK (seat BETWEEN 1 AND 3)
 );
 CREATE INDEX game_invitation_invitees_account_idx ON game_invitation_invitees (account_id);
 -- One-time friend codes. The player who wants to be added issues a 6-digit code;
 -- whoever enters it becomes their friend. Only the SHA-256 hash is stored; expires_at
 -- bounds the 12h TTL and consumed_at marks single use. At most one live code per issuer.
 CREATE TABLE friend_codes (
    code_id     uuid        PRIMARY KEY,
    account_id  uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    code_hash   text        NOT NULL,
    expires_at  timestamptz NOT NULL,
    consumed_at timestamptz,
    created_at  timestamptz NOT NULL DEFAULT now()
 );
 CREATE INDEX friend_codes_account_idx ON friend_codes (account_id);
 CREATE INDEX friend_codes_code_hash_idx ON friend_codes (code_hash);
 -- Per-(game, account) draft the server persists across reloads and devices: the
 -- player's preferred rack tile order and the tiles laid on the board but not yet
 -- submitted. board_tiles is reset when an opponent's committed move overlaps a cell.
 CREATE TABLE game_drafts (
    game_id     uuid        NOT NULL REFERENCES games (game_id) ON DELETE CASCADE,
    account_id  uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    rack_order  text        NOT NULL DEFAULT '',
    board_tiles jsonb       NOT NULL DEFAULT '[]',
    updated_at  timestamptz NOT NULL DEFAULT now(),
    PRIMARY KEY (game_id, account_id)
 );
 -- Per-account hidden games. A row hides game_id from account_id's own "my games" list,
 -- leaving it visible to the other players. Only finished games are hidden, and the
 -- action is irreversible by design (there is no un-hide).
 CREATE TABLE game_hidden (
    account_id uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    game_id    uuid        NOT NULL REFERENCES games (game_id) ON DELETE CASCADE,
    created_at timestamptz NOT NULL DEFAULT now(),
    PRIMARY KEY (account_id, game_id)
 );
 -- +goose Down
 DROP SCHEMA IF EXISTS backend CASCADE;
@@ -1,60 +0,0 @@
 -- +goose Up
 -- Initial schema for the Scrabble backend service: durable accounts, their
 -- platform/email identities, and opaque server sessions.
 --
 -- Every backend table lives in the `backend` schema. The schema is created here
 -- so a fresh database can apply this migration, and search_path is pinned for
 -- the rest of the migration so the CREATE statements land in `backend` without
 -- qualifying every object. Production also pins search_path via
 -- BACKEND_POSTGRES_DSN.
 CREATE SCHEMA IF NOT EXISTS backend;
 SET search_path = backend, pg_catalog;
 -- Durable internal accounts. Guests are session-only and never reach this table.
 CREATE TABLE accounts (
    account_id            uuid        PRIMARY KEY,
    display_name          text        NOT NULL DEFAULT '',
    preferred_language    text        NOT NULL DEFAULT 'en',
    time_zone             text        NOT NULL DEFAULT 'UTC',
    block_chat            boolean     NOT NULL DEFAULT false,
    block_friend_requests boolean     NOT NULL DEFAULT false,
    created_at            timestamptz NOT NULL DEFAULT now(),
    updated_at            timestamptz NOT NULL DEFAULT now(),
    CONSTRAINT accounts_preferred_language_chk CHECK (preferred_language IN ('en', 'ru'))
 );
 -- Platform and email identities attached to an account. external_id is the
 -- platform user id (kind='telegram') or the email address (kind='email');
 -- confirmed flips true once an email confirm-code is verified (later stages).
 CREATE TABLE identities (
    identity_id uuid        PRIMARY KEY,
    account_id  uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    kind        text        NOT NULL,
    external_id text        NOT NULL,
    confirmed   boolean     NOT NULL DEFAULT false,
    created_at  timestamptz NOT NULL DEFAULT now(),
    CONSTRAINT identities_kind_chk CHECK (kind IN ('telegram', 'email')),
    CONSTRAINT identities_kind_external_id_key UNIQUE (kind, external_id)
 );
 CREATE INDEX identities_account_idx ON identities (account_id);
 -- Opaque server sessions. token_hash is the hex-encoded SHA-256 of the bearer
 -- token; the plaintext token is never stored. Sessions are revoke-only (no
 -- TTL): status moves active -> revoked and revoked_at is stamped.
 CREATE TABLE sessions (
    session_id   uuid        PRIMARY KEY,
    account_id   uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    token_hash   text        NOT NULL,
    status       text        NOT NULL DEFAULT 'active',
    created_at   timestamptz NOT NULL DEFAULT now(),
    last_seen_at timestamptz,
    revoked_at   timestamptz,
    CONSTRAINT sessions_status_chk CHECK (status IN ('active', 'revoked')),
    CONSTRAINT sessions_token_hash_key UNIQUE (token_hash)
 );
 CREATE INDEX sessions_account_idx ON sessions (account_id);
 -- +goose Down
 DROP TABLE sessions;
 DROP TABLE identities;
 DROP TABLE accounts;
@@ -1,133 +0,0 @@
 -- +goose Up
 -- Stage 3 game domain: the per-game lifecycle, the dictionary-independent move
 -- journal, word-check complaints and per-account statistics, plus two account
 -- columns the game domain needs.
 SET search_path = backend, pg_catalog;
 -- Extend accounts with the per-user away window (one interval per day, in the
 -- account's local time_zone) honoured by the turn-timeout sweeper -- and, in a
 -- later stage, by the robot's sleep -- and a hint wallet (purchasable hints; the
 -- purchase flow lands later, so the balance defaults to empty). Profile editing
 -- of the away window arrives with the profile surface (Stage 4).
 ALTER TABLE accounts
    ADD COLUMN away_start   time    NOT NULL DEFAULT '00:00',
    ADD COLUMN away_end     time    NOT NULL DEFAULT '07:00',
    ADD COLUMN hint_balance integer NOT NULL DEFAULT 0,
    ADD CONSTRAINT accounts_hint_balance_chk CHECK (hint_balance >= 0);
 -- One match. The live position is event-sourced: this row carries the pinned
 -- dictionary, the bag seed and the denormalised turn cursor the sweeper needs,
 -- while game_moves is the append-only journal the in-memory engine.Game is
 -- replayed from (docs/ARCHITECTURE.md §9). turn_timeout_secs is the per-game move
 -- clock; its allowed values are enforced in Go. variant uses engine.Variant's
 -- stable labels.
 CREATE TABLE games (
    game_id           uuid        PRIMARY KEY,
    variant           text        NOT NULL,
    dict_version      text        NOT NULL,
    seed              bigint      NOT NULL,
    status            text        NOT NULL DEFAULT 'active',
    players           smallint    NOT NULL,
    to_move           smallint    NOT NULL DEFAULT 0,
    turn_started_at   timestamptz NOT NULL DEFAULT now(),
    turn_timeout_secs integer     NOT NULL,
    hints_allowed     boolean     NOT NULL DEFAULT true,
    hints_per_player  smallint    NOT NULL DEFAULT 1,
    move_count        integer     NOT NULL DEFAULT 0,
    end_reason        text,
    created_at        timestamptz NOT NULL DEFAULT now(),
    updated_at        timestamptz NOT NULL DEFAULT now(),
    finished_at       timestamptz,
    CONSTRAINT games_variant_chk CHECK (variant IN ('english', 'russian_scrabble', 'erudit')),
    CONSTRAINT games_status_chk CHECK (status IN ('active', 'finished')),
    CONSTRAINT games_players_chk CHECK (players BETWEEN 2 AND 4),
    CONSTRAINT games_to_move_chk CHECK (to_move >= 0 AND to_move < players),
    CONSTRAINT games_turn_timeout_chk CHECK (turn_timeout_secs > 0),
    CONSTRAINT games_hints_per_player_chk CHECK (hints_per_player >= 0),
    CONSTRAINT games_end_reason_chk CHECK (
        end_reason IS NULL OR end_reason IN ('out_of_tiles', 'scoreless', 'resign', 'timeout')
    )
 );
 -- The sweeper scans active games oldest-turn-first; a partial index keeps it
 -- off the finished archive.
 CREATE INDEX games_active_idx ON games (turn_started_at) WHERE status = 'active';
 -- Seats in turn order (seat 0 moves first), one row per player. account_id is a
 -- durable account (guests and robots are revisited when they arrive). score is
 -- the running/final score, is_winner is stamped on finish (false for every seat
 -- on a draw), hints_used counts the per-game allowance consumed before the
 -- profile wallet.
 CREATE TABLE game_players (
    game_id    uuid     NOT NULL REFERENCES games (game_id) ON DELETE CASCADE,
    seat       smallint NOT NULL,
    account_id uuid     NOT NULL REFERENCES accounts (account_id),
    score      integer  NOT NULL DEFAULT 0,
    hints_used smallint NOT NULL DEFAULT 0,
    is_winner  boolean  NOT NULL DEFAULT false,
    PRIMARY KEY (game_id, seat),
    CONSTRAINT game_players_account_key UNIQUE (game_id, account_id)
 );
 CREATE INDEX game_players_account_idx ON game_players (account_id);
 -- The append-only, dictionary-independent move journal (docs/ARCHITECTURE.md
 -- §9.1). seq orders the moves from 0. payload holds the decoded values needed to
 -- both replay the game through the engine and emit GCG without a dictionary: the
 -- acting rack, and for a play its direction, placed tiles and formed words; for
 -- an exchange the swapped tiles. score / running_total / exchanged_count are
 -- lifted out for cheap history rendering.
 CREATE TABLE game_moves (
    game_id         uuid        NOT NULL REFERENCES games (game_id) ON DELETE CASCADE,
    seq             integer     NOT NULL,
    seat            smallint    NOT NULL,
    action          text        NOT NULL,
    score           integer     NOT NULL DEFAULT 0,
    running_total   integer     NOT NULL DEFAULT 0,
    exchanged_count smallint    NOT NULL DEFAULT 0,
    payload         text        NOT NULL DEFAULT '{}',
    created_at      timestamptz NOT NULL DEFAULT now(),
    PRIMARY KEY (game_id, seq),
    CONSTRAINT game_moves_action_chk CHECK (action IN ('play', 'pass', 'exchange', 'resign', 'timeout'))
 );
 -- Word-check complaints captured in the context of a game's pinned dictionary.
 -- The admin review queue and the resolution lifecycle land in Stage 9, which
 -- owns the status state machine; Stage 3 only ever writes 'open'.
 CREATE TABLE complaints (
    complaint_id   uuid        PRIMARY KEY,
    complainant_id uuid        NOT NULL REFERENCES accounts (account_id),
    game_id        uuid        NOT NULL REFERENCES games (game_id) ON DELETE CASCADE,
    variant        text        NOT NULL,
    dict_version   text        NOT NULL,
    word           text        NOT NULL,
    was_valid      boolean     NOT NULL,
    note           text        NOT NULL DEFAULT '',
    status         text        NOT NULL DEFAULT 'open',
    created_at     timestamptz NOT NULL DEFAULT now()
 );
 CREATE INDEX complaints_status_idx ON complaints (status);
 -- Per-account lifetime statistics, recomputed incrementally on each game finish.
 -- Guests have no durable account and never appear here. A draw increments draws
 -- only (neither wins nor losses). max_word_points is the best single move score
 -- (which already folds in every word the move formed and the all-tiles bonus).
 CREATE TABLE account_stats (
    account_id      uuid        PRIMARY KEY REFERENCES accounts (account_id) ON DELETE CASCADE,
    wins            integer     NOT NULL DEFAULT 0,
    losses          integer     NOT NULL DEFAULT 0,
    draws           integer     NOT NULL DEFAULT 0,
    max_game_points integer     NOT NULL DEFAULT 0,
    max_word_points integer     NOT NULL DEFAULT 0,
    updated_at      timestamptz NOT NULL DEFAULT now()
 );
 -- +goose Down
 DROP TABLE account_stats;
 DROP TABLE complaints;
 DROP TABLE game_moves;
 DROP TABLE game_players;
 DROP TABLE games;
 ALTER TABLE accounts
    DROP CONSTRAINT accounts_hint_balance_chk,
    DROP COLUMN hint_balance,
    DROP COLUMN away_end,
    DROP COLUMN away_start;
@@ -1,136 +0,0 @@
 -- +goose Up
 -- Stage 4 lobby & social: the friend graph, per-user blocks, per-game chat (with
 -- nudge folded in as a message kind), email confirm-codes, and friend-game
 -- invitations -- plus the per-game drop-out tile disposition the multi-player
 -- engine needs. Matchmaking is an in-memory pool and persists nothing.
 SET search_path = backend, pg_catalog;
 -- The disposition of a dropped-out player's tiles in a game with three or more
 -- seats (docs/ARCHITECTURE.md §6), chosen at creation: 'remove' burns them
 -- (default), 'return' puts them back in the bag. Moot for a two-player game,
 -- which ends on the first drop-out. engine.DropoutTiles owns the stable labels.
 ALTER TABLE games
    ADD COLUMN dropout_tiles text NOT NULL DEFAULT 'remove',
    ADD CONSTRAINT games_dropout_tiles_chk CHECK (dropout_tiles IN ('remove', 'return'));
 -- The friend graph. A row is created by the requester as 'pending' and flipped to
 -- 'accepted' by the addressee; declining, cancelling or unfriending deletes the
 -- row. Friendship is symmetric: a player's friends are the accepted rows in
 -- either direction. A pair has at most one row (guarded in Go against either
 -- direction existing).
 CREATE TABLE friendships (
    requester_id uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    addressee_id uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    status       text        NOT NULL DEFAULT 'pending',
    created_at   timestamptz NOT NULL DEFAULT now(),
    responded_at timestamptz,
    PRIMARY KEY (requester_id, addressee_id),
    CONSTRAINT friendships_status_chk CHECK (status IN ('pending', 'accepted')),
    CONSTRAINT friendships_distinct_chk CHECK (requester_id <> addressee_id)
 );
 CREATE INDEX friendships_addressee_idx ON friendships (addressee_id);
 -- Per-user blocks. blocker_id has blocked blocked_id; the effect is applied
 -- mutually by the social checks (a block in either direction suppresses chat
 -- visibility and prevents requests/invitations between the pair).
 CREATE TABLE blocks (
    blocker_id uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    blocked_id uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    created_at timestamptz NOT NULL DEFAULT now(),
    PRIMARY KEY (blocker_id, blocked_id),
    CONSTRAINT blocks_distinct_chk CHECK (blocker_id <> blocked_id)
 );
 CREATE INDEX blocks_blocked_idx ON blocks (blocked_id);
 -- Per-game chat. A nudge ("it's your move") is a kind='nudge' row with an empty
 -- body, so one journal carries both chatter and nudges. body is capped at 60
 -- runes (enforced again in Go on input, where the content filter also rejects
 -- links/emails/phone numbers). sender_ip holds the gateway-forwarded client IP as
 -- a validated string (text, not inet, to avoid go-jet literal friction; the
 -- gateway populates it in Stage 6). Chat is part of the game archive and is never
 -- purged; it cascades away only with its game.
 CREATE TABLE chat_messages (
    message_id uuid        PRIMARY KEY,
    game_id    uuid        NOT NULL REFERENCES games (game_id) ON DELETE CASCADE,
    sender_id  uuid        NOT NULL REFERENCES accounts (account_id),
    kind       text        NOT NULL DEFAULT 'message',
    body       text        NOT NULL DEFAULT '',
    sender_ip  text,
    created_at timestamptz NOT NULL DEFAULT now(),
    CONSTRAINT chat_messages_kind_chk CHECK (kind IN ('message', 'nudge')),
    CONSTRAINT chat_messages_body_len_chk CHECK (char_length(body) <= 60),
    CONSTRAINT chat_messages_nudge_empty_chk CHECK (kind <> 'nudge' OR body = '')
 );
 CREATE INDEX chat_messages_game_idx ON chat_messages (game_id, created_at);
 -- Backs the once-per-hour nudge rate-limit lookup (latest nudge by a sender).
 CREATE INDEX chat_messages_nudge_idx ON chat_messages (game_id, sender_id, created_at)
    WHERE kind = 'nudge';
 -- Pending email confirm-codes. code_hash is the hex-encoded SHA-256 of the
 -- 6-digit code (the plaintext is never stored, matching the session model);
 -- expires_at bounds the TTL and attempts caps brute force. A row is consumed
 -- (consumed_at stamped) on success. A re-request deletes the prior pending row
 -- for the same (account, lowercased email) and inserts a fresh one.
 CREATE TABLE email_confirmations (
    confirmation_id uuid        PRIMARY KEY,
    account_id      uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    email           text        NOT NULL,
    code_hash       text        NOT NULL,
    expires_at      timestamptz NOT NULL,
    attempts        smallint    NOT NULL DEFAULT 0,
    consumed_at     timestamptz,
    created_at      timestamptz NOT NULL DEFAULT now(),
    CONSTRAINT email_confirmations_attempts_chk CHECK (attempts >= 0)
 );
 CREATE INDEX email_confirmations_account_idx ON email_confirmations (account_id);
 -- A friend-game invitation. The inviter (seat 0) proposes the game settings to
 -- 1..3 invitees; the game starts only when every invitee has accepted, and any
 -- decline cancels the whole invitation. Lazily expired after expires_at (no
 -- background sweep). game_id is set when the game is started.
 CREATE TABLE game_invitations (
    invitation_id     uuid        PRIMARY KEY,
    inviter_id        uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    variant           text        NOT NULL,
    turn_timeout_secs integer     NOT NULL,
    hints_allowed     boolean     NOT NULL DEFAULT true,
    hints_per_player  smallint    NOT NULL DEFAULT 1,
    dropout_tiles     text        NOT NULL DEFAULT 'remove',
    status            text        NOT NULL DEFAULT 'pending',
    game_id           uuid        REFERENCES games (game_id) ON DELETE SET NULL,
    expires_at        timestamptz NOT NULL,
    created_at        timestamptz NOT NULL DEFAULT now(),
    updated_at        timestamptz NOT NULL DEFAULT now(),
    CONSTRAINT game_invitations_variant_chk CHECK (variant IN ('english', 'russian_scrabble', 'erudit')),
    CONSTRAINT game_invitations_dropout_tiles_chk CHECK (dropout_tiles IN ('remove', 'return')),
    CONSTRAINT game_invitations_status_chk CHECK (status IN ('pending', 'declined', 'cancelled', 'expired', 'started')),
    CONSTRAINT game_invitations_turn_timeout_chk CHECK (turn_timeout_secs > 0),
    CONSTRAINT game_invitations_hints_per_player_chk CHECK (hints_per_player >= 0)
 );
 CREATE INDEX game_invitations_inviter_idx ON game_invitations (inviter_id);
 -- One row per invitee (the inviter is implicit seat 0). seat is the invitee's
 -- seat in the started game (1..3, in invitation order). response tracks each
 -- invitee's pending/accepted/declined decision.
 CREATE TABLE game_invitation_invitees (
    invitation_id uuid        NOT NULL REFERENCES game_invitations (invitation_id) ON DELETE CASCADE,
    account_id    uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    seat          smallint    NOT NULL,
    response      text        NOT NULL DEFAULT 'pending',
    responded_at  timestamptz,
    PRIMARY KEY (invitation_id, account_id),
    CONSTRAINT game_invitation_invitees_response_chk CHECK (response IN ('pending', 'accepted', 'declined')),
    CONSTRAINT game_invitation_invitees_seat_chk CHECK (seat BETWEEN 1 AND 3)
 );
 CREATE INDEX game_invitation_invitees_account_idx ON game_invitation_invitees (account_id);
 -- +goose Down
 DROP TABLE game_invitation_invitees;
 DROP TABLE game_invitations;
 DROP TABLE email_confirmations;
 DROP TABLE chat_messages;
 DROP TABLE blocks;
 DROP TABLE friendships;
 ALTER TABLE games
    DROP CONSTRAINT games_dropout_tiles_chk,
    DROP COLUMN dropout_tiles;
@@ -1,15 +0,0 @@
 -- +goose Up
 -- Stage 5 robot opponent: admit a 'robot' identity kind so the robot pool can be
 -- provisioned as durable accounts (one identity row per named robot). This widens
 -- the identities kind CHECK only; no table or column changes, so the generated
 -- jet code is unaffected.
 SET search_path = backend, pg_catalog;
 ALTER TABLE identities DROP CONSTRAINT identities_kind_chk;
 ALTER TABLE identities ADD CONSTRAINT identities_kind_chk CHECK (kind IN ('telegram', 'email', 'robot'));
 -- +goose Down
 SET search_path = backend, pg_catalog;
 ALTER TABLE identities DROP CONSTRAINT identities_kind_chk;
 ALTER TABLE identities ADD CONSTRAINT identities_kind_chk CHECK (kind IN ('telegram', 'email'));
@@ -1,14 +0,0 @@
 -- +goose Up
 -- Stage 6 gateway edge: mark ephemeral guest accounts. A guest is a durable
 -- account row -- the sessions and game_players foreign keys both require one --
 -- that carries no identity and no profile, friends, stats or history; is_guest
 -- gates that exclusion (statistics recompute skips guest seats). This adds a
 -- column, so the generated jet code is regenerated (cmd/jetgen).
 SET search_path = backend, pg_catalog;
 ALTER TABLE accounts ADD COLUMN is_guest boolean NOT NULL DEFAULT false;
 -- +goose Down
 SET search_path = backend, pg_catalog;
 ALTER TABLE accounts DROP COLUMN is_guest;
@@ -1,45 +0,0 @@
 -- +goose Up
 -- Stage 8 social UI: two changes to the friend graph.
 --
 -- 1. A declined friend request is now remembered permanently (status 'declined')
 --    instead of deleting the row, so a recipient's explicit "no" blocks the same
 --    requester from re-sending (anti-spam). An ignored request still lazily
 --    expires (30 days, computed from created_at in Go) and can then be re-sent; a
 --    one-time friend code from the same person bypasses a prior decline. This
 --    widens friendships_status_chk; the Stage 4 "declining deletes the row" rule
 --    is superseded (cancelling by the requester still deletes).
 --
 -- 2. friend_codes backs the code-redeem add-a-friend path: the player who wants to
 --    be added issues a one-time 6-digit numeric code; whoever enters it becomes
 --    their friend immediately. Only the hex-encoded SHA-256 of the code is stored
 --    (the plaintext is never persisted, matching the session and email-code
 --    models); expires_at bounds the 12h TTL and consumed_at marks single use. At
 --    most one live code exists per issuer (issuing a new one clears the prior
 --    unconsumed code, enforced in Go). This adds a table, so the generated jet code
 --    is regenerated (cmd/jetgen).
 SET search_path = backend, pg_catalog;
 ALTER TABLE friendships
    DROP CONSTRAINT friendships_status_chk,
    ADD CONSTRAINT friendships_status_chk CHECK (status IN ('pending', 'accepted', 'declined'));
 CREATE TABLE friend_codes (
    code_id     uuid        PRIMARY KEY,
    account_id  uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
    code_hash   text        NOT NULL,
    expires_at  timestamptz NOT NULL,
    consumed_at timestamptz,
    created_at  timestamptz NOT NULL DEFAULT now()
 );
 -- Backs "clear the issuer's prior live code" on issue.
 CREATE INDEX friend_codes_account_idx ON friend_codes (account_id);
 -- Backs the redeem lookup by code hash.
 CREATE INDEX friend_codes_code_hash_idx ON friend_codes (code_hash);
 -- +goose Down
 SET search_path = backend, pg_catalog;
 DROP TABLE friend_codes;
 ALTER TABLE friendships
    DROP CONSTRAINT friendships_status_chk,
    ADD CONSTRAINT friendships_status_chk CHECK (status IN ('pending', 'accepted'));
@@ -1,17 +0,0 @@
 -- +goose Up
 -- Stage 9 Telegram integration: a per-account toggle that confines notifications
 -- to the in-app live stream. When notifications_in_app_only is true (the default),
 -- the platform side-service (Telegram) sends no out-of-app push; turning it off
 -- opts into out-of-app push, which the gateway delivers only while the account has
 -- no live in-app stream, so the in-app and platform channels never duplicate. Adds
 -- a column, so the generated jet code is regenerated (cmd/jetgen).
 SET search_path = backend, pg_catalog;
 ALTER TABLE accounts
    ADD COLUMN notifications_in_app_only boolean NOT NULL DEFAULT true;
 -- +goose Down
 SET search_path = backend, pg_catalog;
 ALTER TABLE accounts
    DROP COLUMN notifications_in_app_only;
@@ -1,30 +0,0 @@
 -- +goose Up
 -- Stage 10 admin & dictionary ops: the word-check complaint resolution lifecycle.
 -- Stage 3 created complaints with a free-form status (only ever 'open'); the admin
 -- review queue (this stage) resolves them with a disposition that also feeds the
 -- offline dictionary-rebuild pipeline: an accepted complaint records whether the
 -- word should be added or removed, and is marked applied once a rebuilt dictionary
 -- version is hot-reloaded. No operator identity is recorded (the gateway gates the
 -- console behind Basic-Auth; the backend keeps no admin principal). Adds columns, so
 -- the generated jet code is regenerated (cmd/jetgen).
 SET search_path = backend, pg_catalog;
 ALTER TABLE complaints
    ADD COLUMN disposition        text        NOT NULL DEFAULT '',
    ADD COLUMN resolution_note    text        NOT NULL DEFAULT '',
    ADD COLUMN resolved_at        timestamptz,
    ADD COLUMN applied_in_version text        NOT NULL DEFAULT '',
    ADD CONSTRAINT complaints_status_chk CHECK (status IN ('open', 'resolved')),
    ADD CONSTRAINT complaints_disposition_chk
        CHECK (disposition IN ('', 'reject', 'accept_add', 'accept_remove'));
 -- +goose Down
 SET search_path = backend, pg_catalog;
 ALTER TABLE complaints
    DROP CONSTRAINT complaints_disposition_chk,
    DROP CONSTRAINT complaints_status_chk,
    DROP COLUMN applied_in_version,
    DROP COLUMN resolved_at,
    DROP COLUMN resolution_note,
    DROP COLUMN disposition;
@@ -1,24 +0,0 @@
 -- +goose Up
 -- Stage 11 account linking & merge: retire a secondary account into a primary one.
 -- merged_into/merged_at turn the secondary into an audit tombstone (its identities
 -- are repointed and its non-shared rows transferred to the primary, but the row is
 -- kept so the no-cascade game_players/chat/complaints foreign keys of any shared
 -- finished game stay valid). merged_into self-references accounts and is SET NULL on
 -- delete so a future guest reaper (PLAN.md TODO-3) can still remove a primary.
 -- paid_account is a forward-looking lifetime one-time-payment marker (no purchase
 -- flow yet); the merge ORs it so a paid status is never lost. Adds columns, so the
 -- generated jet code is regenerated (cmd/jetgen).
 SET search_path = backend, pg_catalog;
 ALTER TABLE accounts
    ADD COLUMN paid_account boolean     NOT NULL DEFAULT false,
    ADD COLUMN merged_into  uuid        REFERENCES accounts (account_id) ON DELETE SET NULL,
    ADD COLUMN merged_at    timestamptz;
 -- +goose Down
 SET search_path = backend, pg_catalog;
 ALTER TABLE accounts
    DROP COLUMN merged_at,
    DROP COLUMN merged_into,
    DROP COLUMN paid_account;
@@ -1,21 +0,0 @@
 -- +goose Up
 -- Stage 15 dual Telegram bots: service_language records the language tag of the bot
 -- a Telegram user last authenticated through (their last ValidateInitData). It is
 -- updated on every Telegram login — new and existing accounts — and routes the
 -- user's out-of-app push back through the right bot. It is distinct from
 -- preferred_language (the interface language) and from a game's variant language.
 -- Nullable: an account that has never signed in through a tagged bot (legacy,
 -- email-only or guest) has no value, and push routing falls back to
 -- preferred_language. Adds a column, so the generated jet code is regenerated
 -- (cmd/jetgen).
 SET search_path = backend, pg_catalog;
 ALTER TABLE accounts
    ADD COLUMN service_language text
        CHECK (service_language IN ('en', 'ru'));
 -- +goose Down
 SET search_path = backend, pg_catalog;
 ALTER TABLE accounts
    DROP COLUMN service_language;
@@ -54,10 +54,11 @@ func (s *Service) Subscribe(req *pushv1.SubscribeRequest, stream grpc.ServerStre
 				return nil
 			}
 			ev := &pushv1.Event{
-				UserId:  in.UserID.String(),
+				UserId:   in.UserID.String(),
-				Kind:    in.Kind,
+				Kind:     in.Kind,
-				Payload: in.Payload,
+				Payload:  in.Payload,
-				EventId: in.EventID,
+				EventId:  in.EventID,
 				Language: in.Language,
 			}
 			if err := stream.Send(ev); err != nil {
 				return err
@@ -0,0 +1,235 @@
 // Package ratewatch ingests the gateway's periodic rate-limiter rejection
 // reports. It keeps an in-memory window of recent throttle episodes for
 // the admin console's view and applies the conservative high-rate auto-flag:
 // when one account's rejections within the rolling window cross the threshold,
 // the account store stamps the soft, reversible flagged_high_rate_at marker
 // (set-once; an operator clears it; never an automatic ban). Like the gateway's
 // active_users gauge it is single-instance and resets on restart by design —
 // the durable part is the account flag, not the episode window.
 package ratewatch
 import (
 	"context"
 	"fmt"
 	"sort"
 	"sync"
 	"time"
 	"github.com/google/uuid"
 	"go.uber.org/zap"
 )
 // ClassUser is the limiter class whose keys are account ids — the only class
 // the auto-flag applies to (the others are keyed by client IP).
 const ClassUser = "user"
 const (
 	// maxSeries bounds the distinct (class, key) series kept for the console
 	// view, so a key-spraying client cannot grow the map: past the bound the
 	// least-recently-throttled series is evicted.
 	maxSeries = 200
 	// minRetention keeps an episode visible in the console for at least an hour
 	// after its last rejection (longer when the flag window is longer).
 	minRetention = time.Hour
 )
 // Config tunes the conservative high-rate auto-flag.
 type Config struct {
 	// FlagThreshold is the rejected-call count within FlagWindow past which a
 	// user account is flagged.
 	FlagThreshold int
 	// FlagWindow is the rolling window the rejections accumulate over.
 	FlagWindow time.Duration
 }
 // DefaultConfig returns the agreed conservative defaults — 1000 rejected calls
 // within a rolling 10 minutes (~1.7/s sustained, far above the client's
 // capped-backoff retry noise yet a fraction of an abusive loop).
 func DefaultConfig() Config {
 	return Config{FlagThreshold: 1000, FlagWindow: 10 * time.Minute}
 }
 // Validate reports whether the configuration values are acceptable.
 func (c Config) Validate() error {
 	if c.FlagThreshold <= 0 {
 		return fmt.Errorf("ratewatch: flag threshold must be positive")
 	}
 	if c.FlagWindow <= 0 {
 		return fmt.Errorf("ratewatch: flag window must be positive")
 	}
 	return nil
 }
 // Flagger stamps the account-level high-rate marker; account.Store satisfies it.
 type Flagger interface {
 	FlagHighRate(ctx context.Context, id uuid.UUID, at time.Time) (bool, error)
 }
 // Entry is one reported aggregate: the rejections of one limiter key within one
 // gateway report window (the wire mirror of the gateway's rejection summary).
 type Entry struct {
 	Class    string
 	Key      string
 	Rejected int
 }
 // Episode is one key's recent-throttle aggregate for the admin view.
 type Episode struct {
 	Class     string
 	Key       string
 	Rejected  int
 	FirstSeen time.Time
 	LastSeen  time.Time
 }
 // Watch accumulates reports and applies the auto-flag rule.
 type Watch struct {
 	cfg     Config
 	flagger Flagger
 	log     *zap.Logger
 	now     func() time.Time
 	mu     sync.Mutex
 	series map[seriesKey]*series
 }
 type seriesKey struct{ class, key string }
 type series struct {
 	points []point // ascending by time
 }
 type point struct {
 	at time.Time
 	n  int
 }
 // New constructs a Watch over flagger with cfg. A nil logger is replaced by a
 // no-op one; a nil flagger disables the auto-flag (the view still works).
 func New(cfg Config, flagger Flagger, log *zap.Logger) *Watch {
 	if log == nil {
 		log = zap.NewNop()
 	}
 	return &Watch{
 		cfg:     cfg,
 		flagger: flagger,
 		log:     log,
 		now:     time.Now,
 		series:  make(map[seriesKey]*series),
 	}
 }
 // Ingest records one gateway report. Entries with an empty class or key or a
 // non-positive count are skipped. When a user-class series crosses the flag
 // threshold within the flag window, the account is flagged (the store keeps it
 // set-once, so a sustained episode costs one no-op UPDATE per report).
 func (w *Watch) Ingest(ctx context.Context, entries []Entry) {
 	if len(entries) == 0 {
 		return
 	}
 	now := w.now()
 	var flag []uuid.UUID
 	w.mu.Lock()
 	for _, e := range entries {
 		if e.Class == "" || e.Key == "" || e.Rejected <= 0 {
 			continue
 		}
 		k := seriesKey{class: e.Class, key: e.Key}
 		s := w.series[k]
 		if s == nil {
 			s = &series{}
 			w.series[k] = s
 		}
 		s.points = append(s.points, point{at: now, n: e.Rejected})
 		if e.Class == ClassUser && s.sumSince(now.Add(-w.cfg.FlagWindow)) >= w.cfg.FlagThreshold {
 			if id, err := uuid.Parse(e.Key); err == nil {
 				flag = append(flag, id)
 			}
 		}
 	}
 	w.pruneLocked(now)
 	w.mu.Unlock()
 	if w.flagger == nil {
 		return
 	}
 	for _, id := range flag {
 		set, err := w.flagger.FlagHighRate(ctx, id, now)
 		switch {
 		case err != nil:
 			w.log.Warn("high-rate flag failed", zap.String("account_id", id.String()), zap.Error(err))
 		case set:
 			w.log.Info("account flagged high-rate",
 				zap.String("account_id", id.String()),
 				zap.Int("threshold", w.cfg.FlagThreshold),
 				zap.Duration("window", w.cfg.FlagWindow))
 		}
 	}
 }
 // Config returns the active auto-flag tuning (the admin console captions it).
 func (w *Watch) Config() Config { return w.cfg }
 // Recent returns the retained throttle episodes, most recently throttled first.
 func (w *Watch) Recent() []Episode {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 	out := make([]Episode, 0, len(w.series))
 	for k, s := range w.series {
 		if len(s.points) == 0 {
 			continue
 		}
 		ep := Episode{
 			Class:     k.class,
 			Key:       k.key,
 			FirstSeen: s.points[0].at,
 			LastSeen:  s.points[len(s.points)-1].at,
 		}
 		for _, p := range s.points {
 			ep.Rejected += p.n
 		}
 		out = append(out, ep)
 	}
 	sort.Slice(out, func(i, j int) bool { return out[i].LastSeen.After(out[j].LastSeen) })
 	return out
 }
 // sumSince totals the points at or after cutoff.
 func (s *series) sumSince(cutoff time.Time) int {
 	sum := 0
 	for i := len(s.points) - 1; i >= 0; i-- {
 		if s.points[i].at.Before(cutoff) {
 			break
 		}
 		sum += s.points[i].n
 	}
 	return sum
 }
 // pruneLocked drops points past retention, empty series, and — past maxSeries —
 // the least-recently-throttled series. The caller holds w.mu.
 func (w *Watch) pruneLocked(now time.Time) {
 	cutoff := now.Add(-max(minRetention, w.cfg.FlagWindow))
 	for k, s := range w.series {
 		i := 0
 		for i < len(s.points) && s.points[i].at.Before(cutoff) {
 			i++
 		}
 		s.points = s.points[i:]
 		if len(s.points) == 0 {
 			delete(w.series, k)
 		}
 	}
 	for len(w.series) > maxSeries {
 		var oldest seriesKey
 		var oldestAt time.Time
 		first := true
 		for k, s := range w.series {
 			last := s.points[len(s.points)-1].at
 			if first || last.Before(oldestAt) {
 				oldest, oldestAt, first = k, last, false
 			}
 		}
 		delete(w.series, oldest)
 	}
 }
@@ -0,0 +1,140 @@
 package ratewatch
 import (
 	"context"
 	"fmt"
 	"testing"
 	"time"
 	"github.com/google/uuid"
 )
 // fakeFlagger records flag calls and reports them as newly set.
 type fakeFlagger struct {
 	calls []uuid.UUID
 }
 func (f *fakeFlagger) FlagHighRate(_ context.Context, id uuid.UUID, _ time.Time) (bool, error) {
 	f.calls = append(f.calls, id)
 	return true, nil
 }
 // watchAt returns a Watch with a controllable clock.
 func watchAt(cfg Config, flagger Flagger, at *time.Time) *Watch {
 	w := New(cfg, flagger, nil)
 	w.now = func() time.Time { return *at }
 	return w
 }
 // TestIngestAggregatesAndRecent verifies episodes accumulate per (class, key),
 // invalid entries are skipped, and Recent orders by last rejection.
 func TestIngestAggregatesAndRecent(t *testing.T) {
 	now := time.Date(2026, 6, 10, 12, 0, 0, 0, time.UTC)
 	w := watchAt(DefaultConfig(), nil, &now)
 	ctx := context.Background()
 	w.Ingest(ctx, []Entry{
 		{Class: "public", Key: "10.0.0.1", Rejected: 3},
 		{Class: "user", Key: "u-1", Rejected: 5},
 		{Class: "", Key: "x", Rejected: 1},
 		{Class: "user", Key: "", Rejected: 1},
 		{Class: "user", Key: "u-1", Rejected: 0},
 	})
 	now = now.Add(30 * time.Second)
 	w.Ingest(ctx, []Entry{{Class: "public", Key: "10.0.0.1", Rejected: 4}})
 	got := w.Recent()
 	if len(got) != 2 {
 		t.Fatalf("Recent returned %d episodes, want 2", len(got))
 	}
 	if got[0].Class != "public" || got[0].Key != "10.0.0.1" || got[0].Rejected != 7 {
 		t.Errorf("first episode = %+v, want public/10.0.0.1 rejected=7", got[0])
 	}
 	if !got[0].LastSeen.After(got[0].FirstSeen) {
 		t.Errorf("episode span = [%v, %v], want a positive span", got[0].FirstSeen, got[0].LastSeen)
 	}
 	if got[1].Class != "user" || got[1].Rejected != 5 {
 		t.Errorf("second episode = %+v, want user rejected=5", got[1])
 	}
 }
 // TestAutoFlagThreshold verifies the flag fires only for a user-class series
 // crossing the threshold within the window, with a parseable account id.
 func TestAutoFlagThreshold(t *testing.T) {
 	now := time.Date(2026, 6, 10, 12, 0, 0, 0, time.UTC)
 	flagged := &fakeFlagger{}
 	id := uuid.New()
 	w := watchAt(Config{FlagThreshold: 100, FlagWindow: 10 * time.Minute}, flagged, &now)
 	ctx := context.Background()
 	w.Ingest(ctx, []Entry{
 		{Class: "user", Key: id.String(), Rejected: 99},
 		{Class: "public", Key: "10.0.0.1", Rejected: 1000},
 		{Class: "user", Key: "not-a-uuid", Rejected: 1000},
 	})
 	if len(flagged.calls) != 0 {
 		t.Fatalf("flagged %v below the threshold", flagged.calls)
 	}
 	now = now.Add(30 * time.Second)
 	w.Ingest(ctx, []Entry{{Class: "user", Key: id.String(), Rejected: 1}})
 	if len(flagged.calls) != 1 || flagged.calls[0] != id {
 		t.Fatalf("flag calls = %v, want exactly [%s]", flagged.calls, id)
 	}
 }
 // TestAutoFlagWindowExpiry verifies rejections age out of the rolling window.
 func TestAutoFlagWindowExpiry(t *testing.T) {
 	now := time.Date(2026, 6, 10, 12, 0, 0, 0, time.UTC)
 	flagged := &fakeFlagger{}
 	id := uuid.New()
 	w := watchAt(Config{FlagThreshold: 100, FlagWindow: 10 * time.Minute}, flagged, &now)
 	ctx := context.Background()
 	w.Ingest(ctx, []Entry{{Class: "user", Key: id.String(), Rejected: 60}})
 	now = now.Add(11 * time.Minute)
 	w.Ingest(ctx, []Entry{{Class: "user", Key: id.String(), Rejected: 60}})
 	if len(flagged.calls) != 0 {
 		t.Fatalf("flagged %v across an expired window", flagged.calls)
 	}
 	now = now.Add(time.Minute)
 	w.Ingest(ctx, []Entry{{Class: "user", Key: id.String(), Rejected: 50}})
 	if len(flagged.calls) != 1 {
 		t.Fatalf("flag calls = %v, want one in-window crossing", flagged.calls)
 	}
 }
 // TestSeriesBound verifies the episode map stays bounded by evicting the
 // least-recently-throttled series.
 func TestSeriesBound(t *testing.T) {
 	now := time.Date(2026, 6, 10, 12, 0, 0, 0, time.UTC)
 	w := watchAt(DefaultConfig(), nil, &now)
 	ctx := context.Background()
 	for i := range maxSeries + 10 {
 		now = now.Add(time.Second)
 		w.Ingest(ctx, []Entry{{Class: "public", Key: fmt.Sprintf("10.0.%d.%d", i/256, i%256), Rejected: 1}})
 	}
 	got := w.Recent()
 	if len(got) != maxSeries {
 		t.Fatalf("retained %d series, want %d", len(got), maxSeries)
 	}
 	for _, ep := range got {
 		if ep.Key == "10.0.0.0" {
 			t.Fatal("the least-recently-throttled series survived the bound")
 		}
 	}
 }
 // TestConfigValidate covers the tuning guards.
 func TestConfigValidate(t *testing.T) {
 	if err := DefaultConfig().Validate(); err != nil {
 		t.Errorf("default config invalid: %v", err)
 	}
 	if err := (Config{FlagThreshold: 0, FlagWindow: time.Minute}).Validate(); err == nil {
 		t.Error("zero threshold passed validation")
 	}
 	if err := (Config{FlagThreshold: 1, FlagWindow: 0}).Validate(); err == nil {
 		t.Error("zero window passed validation")
 	}
 }
--- a/Show More
+++ b/Show More