perf(ui): cancel the in-flight move preview when tiles move; debug cache-bust

Placing or recalling a tile fires the network preview; on a slow link the requests
piled up and an out-of-order response could overwrite the newest with a stale score.
Cancel the previous in-flight evaluate on each change — evaluate is non-mutating, so
aborting is safe (only submit_play and the debounced draft save persist), so only the
latest request runs and the newest result wins; the game also aborts it on unmount.
The abort threads an AbortSignal through the Connect exec (an intentional cancel does
not retry). The debug reset now also bypasses the browser HTTP cache on the next
dictionary load, so a "clear" forces a genuinely cold test — clearing IndexedDB alone
left the immutable blob served straight from the HTTP cache.

.gitea/workflows/ci.yaml

@@ -26,12 +26,12 @@ on:
   push:
     branches: [development]
 
-# The dictionary release. One Gitea variable is the single source of truth: the
-# test suite validates against it here (inherited by the unit/integration jobs) and
-# both contours' deploy jobs seed a fresh volume with the same value. A release bump
-# is one edit (the variable). See deploy/README.md.
+# The dictionary release the test suite validates against — the current
+# scrabble-dictionary release. Centralised here so a release bump is one edit; the
+# unit/integration jobs inherit it. The deploy job overrides it per contour with
+# vars.TEST_DICT_VERSION (the seed for a fresh volume), see deploy/README.md.
 env:
-  DICT_VERSION: ${{ vars.DICT_VERSION }}
+  DICT_VERSION: v1.3.1
 
 jobs:
   # changes detects which areas a PR/push touched, so the test jobs can skip when
@@ -73,9 +73,6 @@ jobs:
             go=false; ui=false
             if echo "$files" | grep -qE '^(backend/|pkg/|gateway/|platform/|loadtest/|go\.work)'; then go=true; fi
             if echo "$files" | grep -qE '^ui/'; then ui=true; fi
-            # The render sidecar bundles ui/src/lib, so its dir rides the ui lane (the
-            # deploy's compose build picks it up either way).
-            if echo "$files" | grep -qE '^renderer/'; then ui=true; fi
             # A workflow or deploy change re-runs everything as a safety net.
             if echo "$files" | grep -qE '^(\.gitea/workflows/|deploy/)'; then go=true; ui=true; fi
           else
@@ -202,33 +199,13 @@ jobs:
       - name: Bundle-size budget
         run: node scripts/bundle-size.mjs
 
-      # The render sidecar executes the shared ui/src/lib/gameimage.ts on skia-canvas;
-      # its smoke test guards the bundling + skia seam (docs/TESTING.md).
-      - name: Render sidecar test
-        working-directory: renderer
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm test
-
       - name: Install Playwright browsers
         run: pnpm exec playwright install chromium webkit
         timeout-minutes: 5
 
-      # The offline e2e plays a real local vs_ai game, so it needs the per-variant dawgs; fetch the
-      # release the same way the Go jobs do and point the mock preview's copy step (scripts/
-      # e2e-dict.mjs, via E2E_DICT_DIR below) at it.
-      - name: Fetch dictionary DAWGs
-        run: |
-          mkdir -p "${GITHUB_WORKSPACE}/dawg"
-          curl -fsSL -o /tmp/dawg.tar.gz "https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/${DICT_VERSION}/scrabble-dawg-${DICT_VERSION}.tar.gz"
-          tar xzf /tmp/dawg.tar.gz -C "${GITHUB_WORKSPACE}/dawg"
-          ls -la "${GITHUB_WORKSPACE}/dawg"
-
       - name: E2E smoke (mock)
         run: pnpm run test:e2e
         timeout-minutes: 5
-        env:
-          E2E_DICT_DIR: ${{ github.workspace }}/dawg
 
   # conformance proves the client's local move preview (the ported dawg reader +
   # validator, ui/src/lib/dict) byte-for-byte against the authoritative Go engine:
@@ -264,7 +241,6 @@ jobs:
         run: |
           go run ./backend/cmd/dictgen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out /tmp/dictgold
           go run ./backend/cmd/validategen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out /tmp/validgold
-          go run ./backend/cmd/movegen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out "${GITHUB_WORKSPACE}/movegold"
 
       - name: Set up Node
         uses: actions/setup-node@v4
@@ -284,7 +260,6 @@ jobs:
           DICT_DAWG_DIR: ${{ github.workspace }}/dawg
           DICT_GOLD_DIR: /tmp/dictgold
           DICT_VALID_DIR: /tmp/validgold
-          DICT_MOVEGEN_DIR: ${{ github.workspace }}/movegold
         run: pnpm exec vitest run src/lib/dict/
 
   # gate is the single branch-protection required check. It always runs and passes
@@ -316,13 +291,9 @@ jobs:
     # Auto test-deploy on a PR into development and on the push that merges it.
     # A PR into master is test-only (this job is skipped); prod deploy is manual.
     # Gates on `gate` (so a real test failure blocks the deploy) but runs even when
-    # some test jobs were path-skipped. Skipped entirely when neither the Go nor the
-    # UI side changed (e.g. a docs-only change): the contour image is unchanged, so
-    # there is nothing to redeploy. `changes` still defaults both to true when the
-    # diff is uncomputable, and a workflow/deploy edit forces both true, so an
-    # ambiguous or infra change still deploys as a safety net.
-    needs: [changes, gate]
-    if: ${{ (needs.changes.outputs.go == 'true' || needs.changes.outputs.ui == 'true') && ((github.event_name == 'push' && github.ref == 'refs/heads/development') || (github.event_name == 'pull_request' && github.base_ref == 'development')) }}
+    # some test jobs were path-skipped.
+    needs: [gate]
+    if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/development') || (github.event_name == 'pull_request' && github.base_ref == 'development') }}
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -347,42 +318,11 @@ jobs:
           TELEGRAM_PROMO_BOT_TOKEN: ${{ secrets.TEST_TELEGRAM_PROMO_BOT_TOKEN }}
           # VK Mini App protected key (offline HMAC for the launch-param signature); empty
           # leaves the VK auth path (auth.vk) disabled until the operator sets the secret.
-          # One VK Mini App serves every contour -> unprefixed secret.
-          GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
-          # VK ID web login (browser VK-identity linking): the VK ID "Web" app's protected key
-          # for the server-side confidential code exchange — a SEPARATE VK app from the Mini
-          # App above. One VK ID "Web" app serves every contour -> unprefixed secret.
-          GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
-          # Planted honeytoken bearer: presenting it flags the caller (logs + a ban metric on
-          # test where the IP ban is off; a 24h IP ban on prod). Per-contour secret; empty = trap off.
-          GATEWAY_HONEYTOKEN: ${{ secrets.TEST_GATEWAY_HONEYTOKEN }}
-          # Signs the finished-game export download URLs (backend + compose interpolation).
-          EXPORT_SIGN_KEY: ${{ secrets.TEST_EXPORT_SIGN_KEY }}
-          # Transactional email via the shared Selectel relay: one account for every
-          # contour -> unprefixed host/port/tls/user/pass. Empty host leaves the backend
-          # on the log mailer (email disabled) but the contour still boots.
-          SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
-          SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
-          SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
-          SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
-          SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
-          SMTP_RELAY_FROM: ${{ vars.TEST_SMTP_RELAY_FROM }}
-          # Operator alerts: backend admin emails (new feedback / complaints) + Grafana
-          # infra alerts. Distinct senders + recipients; Grafana uses the relay's STARTTLS
-          # host:port. Empty leaves the alert worker off and Grafana SMTP disabled.
-          SMTP_RELAY_ADMIN_FROM: ${{ vars.TEST_SMTP_RELAY_ADMIN_FROM }}
-          ADMIN_EMAIL: ${{ vars.TEST_ADMIN_EMAIL }}
-          SMTP_RELAY_SERVICE_FROM: ${{ vars.TEST_SMTP_RELAY_SERVICE_FROM }}
-          SERVICE_EMAIL: ${{ vars.TEST_SERVICE_EMAIL }}
-          GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
-          GF_SMTP_ENABLED: ${{ vars.TEST_GF_SMTP_ENABLED }}
-          # Canonical public origin for links in the email (this contour's URL);
-          # required by the backend whenever SMTP_RELAY_HOST is set.
-          PUBLIC_BASE_URL: ${{ vars.TEST_PUBLIC_BASE_URL }}
+          GATEWAY_VK_APP_SECRET: ${{ secrets.TEST_GATEWAY_VK_APP_SECRET }}
           GM_BASICAUTH_USER: ${{ vars.TEST_GM_BASICAUTH_USER }}
+          GRAFANA_ROOT_URL: ${{ vars.TEST_GRAFANA_ROOT_URL }}
           CADDY_SITE_ADDRESS: ${{ vars.TEST_CADDY_SITE_ADDRESS }}
-          # TELEGRAM_MINIAPP_URL, GRAFANA_ROOT_URL and VITE_VK_ID_REDIRECT_URL are derived
-          # from PUBLIC_BASE_URL in the run step below, not stored as their own variables.
+          TELEGRAM_MINIAPP_URL: ${{ vars.TEST_TELEGRAM_MINIAPP_URL }}
           TELEGRAM_GAME_CHANNEL_ID: ${{ vars.TEST_TELEGRAM_GAME_CHANNEL_ID }}
           TELEGRAM_CHAT_ID: ${{ vars.TEST_TELEGRAM_CHAT_ID }}
           TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.TEST_TELEGRAM_SUPPORT_CHAT_ID }}
@@ -395,16 +335,11 @@ jobs:
           VITE_TELEGRAM_BOT_ID: ${{ vars.TEST_VITE_TELEGRAM_BOT_ID }}
           VITE_TELEGRAM_LINK: ${{ vars.TEST_VITE_TELEGRAM_LINK }}
           VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.TEST_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
-          # VK Mini App landing link + VK ID "Web" app id: one value each serves every
-          # contour -> unprefixed. VITE_VK_APP_ID also feeds the gateway (GATEWAY_VK_ID_APP_ID);
-          # the VK ID redirect URL is derived from PUBLIC_BASE_URL in the run step below.
-          VITE_VK_APP_LINK: ${{ vars.VITE_VK_APP_LINK }}
-          VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-          # VITE_GATEWAY_URL omitted: the SPA is served same-origin, so it stays the
-          # compose ":-" empty default. Other unset vars likewise fall to their defaults.
+          VITE_GATEWAY_URL: ${{ vars.TEST_VITE_GATEWAY_URL }}
+          # Unset vars render empty -> the compose ":-" defaults apply.
           POSTGRES_DB: ${{ vars.TEST_POSTGRES_DB }}
           POSTGRES_USER: ${{ vars.TEST_POSTGRES_USER }}
-          DICT_VERSION: ${{ vars.DICT_VERSION }}
+          DICT_VERSION: ${{ vars.TEST_DICT_VERSION }}
           LOG_LEVEL: ${{ vars.TEST_LOG_LEVEL }}
         run: |
           # Seed the config files to a stable host path. The runner checks out into
@@ -415,34 +350,8 @@ jobs:
           conf="$HOME/.scrabble-deploy"
           rm -rf "$conf"
           mkdir -p "$conf"
-          cp -r caddy otelcol prometheus tempo grafana blackbox "$conf"/
+          cp -r caddy otelcol prometheus tempo grafana "$conf"/
           export SCRABBLE_CONFIG_DIR="$conf"
-          # Maintenance page for the redeploy window, mirroring prod-deploy.sh so the SPA
-          # overlay is exercised on the test contour too (not only prod). Raised just before
-          # the recreate and lowered once caddy is back (below); the trap clears it if the
-          # step fails so the contour never sticks in maintenance (and the reseed above wipes a
-          # stale flag anyway). The caddy-routed probes run in the NEXT step, after it is lowered.
-          maint_flag="$conf/caddy/on"
-          trap 'rm -f "$maint_flag"' EXIT
-          # Derive the public URLs from the one canonical origin instead of storing each as
-          # its own variable (paths are structural SPA routes / the Caddy /_gm sub-path).
-          # Exported before build so the VK ID redirect is baked into the SPA.
-          base="${PUBLIC_BASE_URL%/}"
-          export TELEGRAM_MINIAPP_URL="$base/telegram/"
-          export GRAFANA_ROOT_URL="$base/_gm/grafana/"
-          export VITE_VK_ID_REDIRECT_URL="$base/app/"
-          # Grafana's SMTP from_address must be a BARE address (it rejects the "Name" <addr>
-          # form the backend go-mail accepts) and validates it even when SMTP is disabled — a
-          # bad value crash-loops Grafana. Split the display-format SERVICE From into a bare
-          # address + name for Grafana; the backend keeps the full form.
-          svc_from="${SMTP_RELAY_SERVICE_FROM:-}"
-          case "$svc_from" in
-            *"<"*">"*)
-              export GRAFANA_SMTP_FROM_ADDRESS="$(printf '%s' "$svc_from" | sed -E 's/.*<([^>]+)>.*/\1/')"
-              export GRAFANA_SMTP_FROM_NAME="$(printf '%s' "$svc_from" | sed -E 's/[[:space:]]*<[^>]*>.*$//; s/^"//; s/"$//')" ;;
-            *)
-              export GRAFANA_SMTP_FROM_ADDRESS="$svc_from" ;;
-          esac
           # Bot-link mTLS material for the test contour: a private CA + gateway/bot
           # leaves (CN=gateway, the service name the bot dials). Prod supplies these
           # from PROD_ secrets instead. Regenerated each deploy; both ends redeploy
@@ -455,23 +364,12 @@ jobs:
           # bot on its own host instead (deploy/docker-compose.bot.yml), and the prod
           # main host omits both. Without the profile they would not start here.
           docker compose --ansi never --profile telegram-local build --progress plain
-          # Raise the maintenance page, THEN bring caddy onto the reseeded config mount so it
-          # actually carries the flag: the running caddy sits on the stale pre-reseed mount (the
-          # dir was rm'd + recreated — see the force-recreate note below), so a flag written to
-          # the new dir is invisible until caddy is recreated. With the fresh caddy up, an open
-          # SPA sees the 503 marker + overlay for the whole recreate window, not a bare reconnect.
-          : > "$maint_flag"
-          docker compose --ansi never up -d --force-recreate --no-deps caddy
           docker compose --ansi never --profile telegram-local up -d --remove-orphans
           # The config-only services bind-mount the reseeded config dir. A plain `up -d`
           # leaves them on the previous bind mount (the dir was rm'd + recreated), so a
-          # changed Grafana dashboard is ignored — force-recreate them to pick up the fresh
-          # config. (Caddy was already recreated above so it would carry the maintenance flag.)
-          docker compose --ansi never up -d --force-recreate --no-deps otelcol prometheus tempo grafana
-          # Lower the maintenance page: services are back. An open SPA's poll now gets through
-          # (once the gateway finishes booting) and reloads into the fresh client; the caddy
-          # probes in the next step see 200. The EXIT trap is a backstop if we failed earlier.
-          rm -f "$maint_flag"
+          # changed Caddyfile or Grafana dashboard is ignored — force-recreate them to
+          # pick up the fresh config.
+          docker compose --ansi never up -d --force-recreate --no-deps caddy otelcol prometheus tempo grafana
 
       - name: Probe the landing, gateway and backend
         run: |

.gitea/workflows/prod-deploy.yaml

@@ -40,22 +40,11 @@ jobs:
       VITE_TELEGRAM_BOT_ID: ${{ vars.PROD_VITE_TELEGRAM_BOT_ID }}
       VITE_TELEGRAM_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
       VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.PROD_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
-      # VK Mini App link + VK ID "Web" app id: one value each serves every contour.
-      VITE_VK_APP_LINK: ${{ vars.VITE_VK_APP_LINK }}
-      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-      # VITE_GATEWAY_URL omitted: the SPA is served same-origin (compose ":-" default).
+      VITE_GATEWAY_URL: ${{ vars.PROD_VITE_GATEWAY_URL }}
       POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }}
       GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
-      # `docker compose build` interpolates the WHOLE compose file, so every :?-guarded
-      # runtime var must be present at build even though it is not a build-arg — incl. the
-      # backend's EXPORT_SIGN_KEY (added with the finished-game export after v1.7.0, which is
-      # why the first v1.8.0 build tripped on it). POSTGRES_PASSWORD/GM_BASICAUTH_HASH above
-      # are here for the same reason; DICT_VERSION + the derived Mini App URL cover the rest.
-      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
-      # PUBLIC_BASE_URL drives the derived VK ID redirect (baked into the SPA) and the
-      # Mini App URL; both are computed in the build step, not stored variables.
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
-      DICT_VERSION: ${{ vars.DICT_VERSION }}
+      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
+      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -69,15 +58,10 @@ jobs:
         working-directory: deploy
         run: |
           export TAG="${{ steps.ver.outputs.tag }}" APP_VERSION="${{ steps.ver.outputs.tag }}" SCRABBLE_CONFIG_DIR=.
-          # Derive the public URLs from the one canonical origin: the VK ID redirect is a
-          # build-arg baked into the SPA, and the Mini App URL satisfies the (profiled-out)
-          # bot service's compose ":?" guard during parse. See deploy/write-prod-env.sh.
-          base="${PUBLIC_BASE_URL%/}"
-          export VITE_VK_ID_REDIRECT_URL="$base/app/" TELEGRAM_MINIAPP_URL="$base/telegram/"
-          # The main-stack images via compose (reuses the build args, incl. VERSION);
+          # The four main-stack images via compose (reuses the build args, incl. VERSION);
           # the bot separately, since it is profiled out of the prod compose.
           docker compose -f docker-compose.yml -f docker-compose.prod.yml build
-          docker compose -f docker-compose.yml -f docker-compose.prod.yml push postgres backend gateway landing validator renderer
+          docker compose -f docker-compose.yml -f docker-compose.prod.yml push backend gateway landing validator
           docker build -f ../platform/telegram/Dockerfile --target bot --build-arg VERSION="$TAG" -t "$REGISTRY/scrabble-telegram-bot:$TAG" ..
           docker push "$REGISTRY/scrabble-telegram-bot:$TAG"
 
@@ -98,57 +82,18 @@ jobs:
       GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
       GRAFANA_ADMIN_PASSWORD: ${{ secrets.PROD_GRAFANA_ADMIN_PASSWORD }}
       TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
-      GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
-      # VK ID web login: the "Web" app id (the gateway reuses it as GATEWAY_VK_ID_APP_ID at
-      # runtime) + the app's protected key. Both shared across contours. The redirect URL is
-      # derived from PUBLIC_BASE_URL in deploy/write-prod-env.sh.
-      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-      GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
-      # Planted honeytoken bearer: presenting it earns a 24h IP ban + a high-severity alarm.
-      # Per-contour secret; empty = trap off. Rendered by deploy/write-prod-env.sh.
-      GATEWAY_HONEYTOKEN: ${{ secrets.PROD_GATEWAY_HONEYTOKEN }}
-      # Signs the finished-game export download URLs (backend BACKEND_EXPORT_SIGN_KEY).
-      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
-      # Transactional email via the shared Selectel relay (confirm-codes): one account for
-      # every contour -> unprefixed host/port/tls/user/pass.
-      SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
-      SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
-      SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
-      SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
-      SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
-      SMTP_RELAY_FROM: ${{ vars.PROD_SMTP_RELAY_FROM }}
-      # Operator alerts: backend admin emails + Grafana infra alerts (distinct senders +
-      # recipients; Grafana uses the relay's STARTTLS host:port).
-      SMTP_RELAY_ADMIN_FROM: ${{ vars.PROD_SMTP_RELAY_ADMIN_FROM }}
-      ADMIN_EMAIL: ${{ vars.PROD_ADMIN_EMAIL }}
-      SMTP_RELAY_SERVICE_FROM: ${{ vars.PROD_SMTP_RELAY_SERVICE_FROM }}
-      SERVICE_EMAIL: ${{ vars.PROD_SERVICE_EMAIL }}
-      GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
-      GF_SMTP_ENABLED: ${{ vars.PROD_GF_SMTP_ENABLED }}
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
+      GATEWAY_VK_APP_SECRET: ${{ secrets.PROD_GATEWAY_VK_APP_SECRET }}
       PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
       PROD_BOTLINK_GATEWAY_CERT: ${{ secrets.PROD_BOTLINK_GATEWAY_CERT }}
       PROD_BOTLINK_GATEWAY_KEY: ${{ secrets.PROD_BOTLINK_GATEWAY_KEY }}
       GM_BASICAUTH_USER: ${{ vars.PROD_GM_BASICAUTH_USER }}
+      GRAFANA_ROOT_URL: ${{ vars.PROD_GRAFANA_ROOT_URL }}
       CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      DICT_VERSION: ${{ vars.DICT_VERSION }}
+      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
       POSTGRES_DB: ${{ vars.PROD_POSTGRES_DB }}
       POSTGRES_USER: ${{ vars.PROD_POSTGRES_USER }}
-      # Point-in-time recovery (pgBackRest -> S3), prod main host only. Endpoint/bucket/
-      # region + the archive-mode switch are variables; the S3 keys + the repository cipher
-      # passphrase are secrets. All empty/off until the operator arms archiving; flipping
-      # PROD_PGBACKREST_ARCHIVE_MODE=on activates it (deploy/README.md, arming).
-      PGBACKREST_ARCHIVE_MODE: ${{ vars.PROD_PGBACKREST_ARCHIVE_MODE }}
-      PGBACKREST_S3_ENDPOINT: ${{ vars.PROD_PGBACKREST_S3_ENDPOINT }}
-      PGBACKREST_S3_PORT: ${{ vars.PROD_PGBACKREST_S3_PORT }}
-      PGBACKREST_S3_BUCKET: ${{ vars.PROD_PGBACKREST_S3_BUCKET }}
-      PGBACKREST_S3_REGION: ${{ vars.PROD_PGBACKREST_S3_REGION }}
-      PGBACKREST_S3_KEY: ${{ secrets.PROD_PGBACKREST_S3_KEY }}
-      PGBACKREST_S3_KEY_SECRET: ${{ secrets.PROD_PGBACKREST_S3_KEY_SECRET }}
-      PGBACKREST_CIPHER_PASS: ${{ secrets.PROD_PGBACKREST_CIPHER_PASS }}
-      # TELEGRAM_MINIAPP_URL and GRAFANA_ROOT_URL are derived from PUBLIC_BASE_URL in
-      # deploy/write-prod-env.sh, not stored variables.
+      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -176,8 +121,25 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-main
-          # Shared with prod-rollback so the two paths render an identical runtime env.
-          APP_VERSION="$TAG" bash deploy/write-prod-env.sh stage/env.sh
+          cat > stage/env.sh <<EOF
+          export REGISTRY='$REGISTRY'
+          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
+          export POSTGRES_DB='${POSTGRES_DB:-scrabble}'
+          export POSTGRES_USER='${POSTGRES_USER:-scrabble}'
+          export POSTGRES_PASSWORD='$POSTGRES_PASSWORD'
+          export GM_BASICAUTH_USER='${GM_BASICAUTH_USER:-gm}'
+          export GM_BASICAUTH_HASH='$GM_BASICAUTH_HASH'
+          export GRAFANA_ADMIN_PASSWORD='$GRAFANA_ADMIN_PASSWORD'
+          export GRAFANA_ROOT_URL='$GRAFANA_ROOT_URL'
+          export CADDY_SITE_ADDRESS='$CADDY_SITE_ADDRESS'
+          export LOG_LEVEL='${LOG_LEVEL:-info}'
+          export DICT_VERSION='$DICT_VERSION'
+          export APP_VERSION='$TAG'
+          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
+          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
+          export GATEWAY_VK_APP_SECRET='$GATEWAY_VK_APP_SECRET'
+          export GATEWAY_ABUSE_BAN_ENABLED='true'
+          EOF
           printf '%s\n' "$PROD_BOTLINK_CA"           > stage/certs-main/ca.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_CERT" > stage/certs-main/gateway.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_KEY"  > stage/certs-main/gateway.key
@@ -188,7 +150,7 @@ jobs:
           ssh_main 'mkdir -p /opt/scrabble/compose'
           tar -C deploy -czf - docker-compose.yml docker-compose.prod.yml prod-deploy.sh \
             | ssh_main 'tar -C /opt/scrabble/compose -xzf -'
-          tar -C deploy -czf - caddy otelcol prometheus tempo grafana blackbox \
+          tar -C deploy -czf - caddy otelcol prometheus tempo grafana \
             | ssh_main 'tar -C /opt/scrabble -xzf -'
           tar -C stage -czf - certs-main \
             | ssh_main 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
@@ -216,8 +178,7 @@ jobs:
       PROD_BOTLINK_BOT_CERT: ${{ secrets.PROD_BOTLINK_BOT_CERT }}
       PROD_BOTLINK_BOT_KEY: ${{ secrets.PROD_BOTLINK_BOT_KEY }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      # PUBLIC_BASE_URL drives the derived Mini App URL in deploy/write-prod-bot-env.sh.
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
+      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
       TELEGRAM_GAME_CHANNEL_ID: ${{ vars.PROD_TELEGRAM_GAME_CHANNEL_ID }}
       TELEGRAM_CHAT_ID: ${{ vars.PROD_TELEGRAM_CHAT_ID }}
       TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.PROD_TELEGRAM_SUPPORT_CHAT_ID }}
@@ -234,8 +195,20 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-bot
-          # Shared with prod-rollback so the two paths render an identical bot env.
-          BOT_IMAGE="$REGISTRY/scrabble-telegram-bot:$TAG" bash deploy/write-prod-bot-env.sh stage/env.bot.sh
+          cat > stage/env.bot.sh <<EOF
+          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
+          export BOT_IMAGE='$REGISTRY/scrabble-telegram-bot:$TAG'
+          export BOTLINK_GATEWAY_ADDR='$MAIN_HOST:9443'
+          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
+          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
+          export TELEGRAM_GAME_CHANNEL_ID='$TELEGRAM_GAME_CHANNEL_ID'
+          export TELEGRAM_CHAT_ID='$TELEGRAM_CHAT_ID'
+          export TELEGRAM_SUPPORT_CHAT_ID='$TELEGRAM_SUPPORT_CHAT_ID'
+          export TELEGRAM_PROMO_BOT_TOKEN='$TELEGRAM_PROMO_BOT_TOKEN'
+          export TELEGRAM_BOT_USERNAME='$TELEGRAM_BOT_USERNAME'
+          export TELEGRAM_BOT_LINK='$TELEGRAM_BOT_LINK'
+          export LOG_LEVEL='${LOG_LEVEL:-info}'
+          EOF
           printf '%s\n' "$PROD_BOTLINK_CA"       > stage/certs-bot/ca.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_CERT" > stage/certs-bot/bot.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_KEY"  > stage/certs-bot/bot.key

.gitea/workflows/prod-rollback.yaml

@@ -51,42 +51,13 @@ jobs:
       PROD_BOTLINK_GATEWAY_CERT: ${{ secrets.PROD_BOTLINK_GATEWAY_CERT }}
       PROD_BOTLINK_GATEWAY_KEY: ${{ secrets.PROD_BOTLINK_GATEWAY_KEY }}
       GM_BASICAUTH_USER: ${{ vars.PROD_GM_BASICAUTH_USER }}
+      GRAFANA_ROOT_URL: ${{ vars.PROD_GRAFANA_ROOT_URL }}
       CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      DICT_VERSION: ${{ vars.DICT_VERSION }}
+      DICT_VERSION: ${{ vars.PROD_DICT_VERSION }}
       POSTGRES_DB: ${{ vars.PROD_POSTGRES_DB }}
       POSTGRES_USER: ${{ vars.PROD_POSTGRES_USER }}
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
-      # Full runtime env — parity with prod-deploy's deploy-main so a rollback re-renders
-      # the SAME env.sh (email / VK login / Grafana alerts survive a rollback). TELEGRAM_MINIAPP_URL
-      # and GRAFANA_ROOT_URL are derived from PUBLIC_BASE_URL in deploy/write-prod-env.sh.
-      GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
-      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-      GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
-      GATEWAY_HONEYTOKEN: ${{ secrets.PROD_GATEWAY_HONEYTOKEN }}
-      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
-      SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
-      SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
-      SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
-      SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
-      SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
-      SMTP_RELAY_FROM: ${{ vars.PROD_SMTP_RELAY_FROM }}
-      SMTP_RELAY_ADMIN_FROM: ${{ vars.PROD_SMTP_RELAY_ADMIN_FROM }}
-      ADMIN_EMAIL: ${{ vars.PROD_ADMIN_EMAIL }}
-      SMTP_RELAY_SERVICE_FROM: ${{ vars.PROD_SMTP_RELAY_SERVICE_FROM }}
-      SERVICE_EMAIL: ${{ vars.PROD_SERVICE_EMAIL }}
-      GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
-      GF_SMTP_ENABLED: ${{ vars.PROD_GF_SMTP_ENABLED }}
-      # PITR archiving parity: a rollback must re-render the SAME env.sh, else it would
-      # silently disarm WAL archiving (PGBACKREST_ARCHIVE_MODE would fall back to off).
-      PGBACKREST_ARCHIVE_MODE: ${{ vars.PROD_PGBACKREST_ARCHIVE_MODE }}
-      PGBACKREST_S3_ENDPOINT: ${{ vars.PROD_PGBACKREST_S3_ENDPOINT }}
-      PGBACKREST_S3_PORT: ${{ vars.PROD_PGBACKREST_S3_PORT }}
-      PGBACKREST_S3_BUCKET: ${{ vars.PROD_PGBACKREST_S3_BUCKET }}
-      PGBACKREST_S3_REGION: ${{ vars.PROD_PGBACKREST_S3_REGION }}
-      PGBACKREST_S3_KEY: ${{ secrets.PROD_PGBACKREST_S3_KEY }}
-      PGBACKREST_S3_KEY_SECRET: ${{ secrets.PROD_PGBACKREST_S3_KEY_SECRET }}
-      PGBACKREST_CIPHER_PASS: ${{ secrets.PROD_PGBACKREST_CIPHER_PASS }}
+      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
       INPUT_TARGET: ${{ inputs.target_version }}
     steps:
       - uses: actions/checkout@v4
@@ -118,9 +89,24 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-main
-          # Same writer as prod-deploy's deploy-main -> the rollback re-renders the FULL
-          # runtime env (not a subset), so email / VK login / Grafana alerts survive it.
-          APP_VERSION="$TARGET" bash deploy/write-prod-env.sh stage/env.sh
+          cat > stage/env.sh <<EOF
+          export REGISTRY='$REGISTRY'
+          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
+          export POSTGRES_DB='${POSTGRES_DB:-scrabble}'
+          export POSTGRES_USER='${POSTGRES_USER:-scrabble}'
+          export POSTGRES_PASSWORD='$POSTGRES_PASSWORD'
+          export GM_BASICAUTH_USER='${GM_BASICAUTH_USER:-gm}'
+          export GM_BASICAUTH_HASH='$GM_BASICAUTH_HASH'
+          export GRAFANA_ADMIN_PASSWORD='$GRAFANA_ADMIN_PASSWORD'
+          export GRAFANA_ROOT_URL='$GRAFANA_ROOT_URL'
+          export CADDY_SITE_ADDRESS='$CADDY_SITE_ADDRESS'
+          export LOG_LEVEL='${LOG_LEVEL:-info}'
+          export DICT_VERSION='$DICT_VERSION'
+          export APP_VERSION='$TARGET'
+          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
+          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
+          export GATEWAY_ABUSE_BAN_ENABLED='true'
+          EOF
           printf '%s\n' "$PROD_BOTLINK_CA"           > stage/certs-main/ca.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_CERT" > stage/certs-main/gateway.crt
           printf '%s\n' "$PROD_BOTLINK_GATEWAY_KEY"  > stage/certs-main/gateway.key
@@ -161,11 +147,9 @@ jobs:
       PROD_BOTLINK_BOT_CERT: ${{ secrets.PROD_BOTLINK_BOT_CERT }}
       PROD_BOTLINK_BOT_KEY: ${{ secrets.PROD_BOTLINK_BOT_KEY }}
       LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      # PUBLIC_BASE_URL drives the derived Mini App URL; SUPPORT_CHAT_ID for parity with deploy.
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
+      TELEGRAM_MINIAPP_URL: ${{ vars.PROD_TELEGRAM_MINIAPP_URL }}
       TELEGRAM_GAME_CHANNEL_ID: ${{ vars.PROD_TELEGRAM_GAME_CHANNEL_ID }}
       TELEGRAM_CHAT_ID: ${{ vars.PROD_TELEGRAM_CHAT_ID }}
-      TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.PROD_TELEGRAM_SUPPORT_CHAT_ID }}
       TELEGRAM_BOT_USERNAME: ${{ vars.PROD_TELEGRAM_BOT_USERNAME }}
       TELEGRAM_BOT_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
     steps:
@@ -179,8 +163,19 @@ jobs:
         run: |
           umask 077
           mkdir -p stage/certs-bot
-          # Same writer as prod-deploy's deploy-bot (parity; includes TELEGRAM_SUPPORT_CHAT_ID).
-          BOT_IMAGE="$REGISTRY/scrabble-telegram-bot:$TARGET" bash deploy/write-prod-bot-env.sh stage/env.bot.sh
+          cat > stage/env.bot.sh <<EOF
+          export SCRABBLE_CONFIG_DIR='/opt/scrabble'
+          export BOT_IMAGE='$REGISTRY/scrabble-telegram-bot:$TARGET'
+          export BOTLINK_GATEWAY_ADDR='$MAIN_HOST:9443'
+          export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
+          export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
+          export TELEGRAM_GAME_CHANNEL_ID='$TELEGRAM_GAME_CHANNEL_ID'
+          export TELEGRAM_CHAT_ID='$TELEGRAM_CHAT_ID'
+          export TELEGRAM_PROMO_BOT_TOKEN='$TELEGRAM_PROMO_BOT_TOKEN'
+          export TELEGRAM_BOT_USERNAME='$TELEGRAM_BOT_USERNAME'
+          export TELEGRAM_BOT_LINK='$TELEGRAM_BOT_LINK'
+          export LOG_LEVEL='${LOG_LEVEL:-info}'
+          EOF
           printf '%s\n' "$PROD_BOTLINK_CA"       > stage/certs-bot/ca.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_CERT" > stage/certs-bot/bot.crt
           printf '%s\n' "$PROD_BOTLINK_BOT_KEY"  > stage/certs-bot/bot.key

CLAUDE.md

@@ -125,10 +125,9 @@ gateway/                     # module scrabble/gateway: Connect-RPC edge, embeds
 ui/                          # Svelte + Vite SPA + landing (Node project, not in go.work)
 pkg/                         # shared: telemetry, version, wire/FlatBuffers, proto, mtls
 platform/telegram/           # Telegram side-service: cmd/validator (HMAC, no VPN) + cmd/bot (Bot API; dials gateway over reverse mTLS bot-link)
-renderer/                    # image-render sidecar (Node + skia-canvas): runs ui/src/lib/gameimage.ts server-side for the finished-game PNG export
 loadtest/                    # module scrabble/loadtest: the load/stress harness
 docs/  .gitea/workflows/  CLAUDE.md  README.md
-backend/Dockerfile gateway/Dockerfile platform/telegram/Dockerfile loadtest/Dockerfile renderer/Dockerfile  # multi-stage distroless (renderer: node:22-slim + skia-canvas + fonts); gateway/Dockerfile has the `landing` target, platform/telegram/Dockerfile has `validator`+`bot` targets
+backend/Dockerfile gateway/Dockerfile platform/telegram/Dockerfile loadtest/Dockerfile  # multi-stage distroless; gateway/Dockerfile has the `landing` target, platform/telegram/Dockerfile has `validator`+`bot` targets
 deploy/                      # docker-compose (+ prod overlay + bot host) + ansible provisioning + caddy + landing + otelcol (OTLP + docker_stats) + prometheus/tempo/grafana + node_exporter + postgres_exporter; prod-deploy.sh
 ```
 
@@ -144,7 +143,6 @@ go run ./backend/cmd/backend    # /healthz, /readyz on :8080
 
 cd ui && pnpm install && pnpm check && pnpm test:unit && pnpm build  # the UI
 pnpm start                      # UI mock mode: lobby -> game, no backend
-cd renderer && pnpm install && pnpm test  # image-render sidecar (bundles ui/src/lib/gameimage.ts, skia smoke)
 
 docker build --build-arg DICT_VERSION=v1.3.0 -f backend/Dockerfile -t scrabble-backend .  # DICT_VERSION required (no default); gateway embeds the SPA
 docker build -f gateway/Dockerfile --target gateway -t scrabble-gateway .

PLAN.md

@@ -1,712 +0,0 @@
-# PLAN — monetization implementation
-
-Technical, step-by-step implementation of the monetization domain. Business mechanics and
-the rationale for every rule live in [`docs/PAYMENTS.md`](docs/PAYMENTS.md) (RU mirror
-[`docs/PAYMENTS_ru.md`](docs/PAYMENTS_ru.md)); the frozen owner agreements they both derive
-from (the `D1`–`D41` decisions log) live in
-[`docs/PAYMENTS_DECISIONS_ru.md`](docs/PAYMENTS_DECISIONS_ru.md) — the authority when a rule
-is disputed. This file is the *how*. Each stage is written to be self-sufficient: returning
-to it gives full context — goal, exact touch-points, tests, done-criteria, and current
-status — without re-deriving decisions.
-
-## How to use this file
-
-- **Stage granularity (E0–E9) is fixed.** Do not split or merge stages. Plan each stage
-  densely enough to execute whole.
-- **Never leak stage ids into the product.** Code, comments, commit messages, PR
-  titles/descriptions must read as finalized feature copy — never "E5", "stage 3", etc.
-  Stage ids exist only in this file.
-- **Deviations are allowed** when new unknowns surface, but the plan is then edited **whole
-  and in agreement** (not piecemeal), keeping it coherent, and `docs/PAYMENTS.md` updated in
-  step.
-- **Status marks:** each stage header carries `Status: TODO | WIP | DONE`. When a stage
-  lands, flip it to DONE and note the PR. The **Progress** table is the at-a-glance index.
-- **Per-change discipline** (repo `CLAUDE.md`): update tests at the layers `docs/TESTING.md`
-  calls out, bake doc updates into the same PR, run local full verification before pushing,
-  feature branch → PR into `development`.
-
-## Progress
-
-| Stage | Title | Release | Status |
-|-------|-------|---------|--------|
-| E0 | Payments data foundation | 1 | DONE |
-| E1 | Trusted platform signal | 1 | DONE |
-| E2 | Currency + benefit core | 1 | DONE |
-| E3 | Wallet UI | 1 | DONE |
-| E4 | Durability (PITR) | 2 | WIP |
-| E5 | Payment intake | 2 | TODO |
-| E6 | Ads | 2 | TODO |
-| E7 | Admin & reports | 2 | TODO |
-| E8 | Guest limits | — | TODO |
-| E9 | Tournament fee | future | TODO |
-
-**Release 1** = full mechanics with no real money, exercised via `admin_grant` (E0→E1→E2→E3).
-**Release 2** = money (E4→E5→E6→E7). E8 is standalone (game-behaviour change, can run in
-parallel). E9 is future.
-
----
-
-## Architecture baseline (applies to all stages)
-
-Read once; individual stages assume it.
-
-### Schema & isolation
-
-- The payments domain owns its **own Postgres schema `payments`** in the shared instance
-  (`scrabble` DB). All payments tables are `payments.*`. `backend` schema is untouched
-  except for the deprecation of two legacy columns (E2).
-- **DB role.** A dedicated **NOLOGIN** role holds ALL privileges on `payments.*` and
-  **nothing** on `backend` — grant-based confinement, asserted by a `SET ROLE` isolation
-  test. The application still connects on its single (superuser) pool, so these grants are a
-  stepping-stone to a real separate login/process, not the runtime wall. The **runtime wall
-  is code-level**: only the `internal/payments` package imports the payments jet code and
-  issues `payments.*` SQL (an **import-boundary test** enforces it); every other domain
-  reaches payments through the narrow Go interface.
-- **No cross-schema link at all.** There is **no** foreign key from `payments.*` to
-  `backend.accounts`: `account_id` is a plain `uuid`, kept referentially honest in code and
-  joined to the tombstoned account / `retained_identities` dossier by the stable id. This
-  keeps the spend transaction (ledger INSERT + balance UPDATE + benefit UPDATE) fully
-  **within `payments`** and the domain extractable into its own database later. Benefits move
-  **into** `payments` (they no longer live on `accounts` — see E2); game code reads them
-  through the payments **Go interface**, never via SQL.
-- **Money.** Monetary amounts are a single **`bigint` in the currency's minor units** (RUB
-  kopecks; Votes/Stars/chips are whole units, scale 1) carried in Go by the `payments.Money`
-  value type — the sole constructor/formatter/arithmetic, so **no `float64` ever touches an
-  amount** and a whole-unit currency structurally cannot hold a fraction. `chip_rate` is not a
-  table: a chip pack is a product, so its per-method rate **is** `product_price`.
-
-### Domain boundary
-
-- New package `backend/internal/payments/` — `payments.go` (types + `Service`),
-  `store.go` (`type Store struct{ db *sql.DB }`, go-jet against `internal/postgres/jet/
-  payments`), following the `ads` domain shape (`backend/internal/ads/{ads,service,store}.go`).
-- Wired in `backend/cmd/backend/main.go` `run()` (construct after `account`, before
-  `server.New`), handed into `server.Deps` (`server.go`), routes registered in
-  `registerRoutes` gated `if s.payments != nil`, admin section in `registerConsole` gated
-  `if s.payments != nil`.
-- Game/other domains depend on payments only through a **narrow interface** (e.g.
-  `AdFree(ctx, account, platform, present) bool`, `SpendHint(ctx, account, platform, present)
-  error`, `Balances(ctx, account, platform, present) …`), where `present` is the set of
-  identity sources the account currently holds (`vk`→vk, `telegram`→telegram, `email`→direct;
-  `robot` ignored), computed by the caller from `account.Identities` — payments carries no
-  cross-schema identity knowledge, so unlink/re-link availability (D14) falls out live. Keep
-  the surface small; this is the seam that lets payments become a separate process later
-  without touching callers.
-- **Read model.** Hot reads (`AdFree`/`HintsAvailable`/`Balances` and the gate) are served
-  from an in-process, account-keyed, write-through cache inside the payments package
-  (mirroring `account/suspension.go`), invalidated on every payments mutation
-  (spend/grant/fund/refund/merge); the payments DB is touched only on a cache miss, so the
-  steady-state hot path issues no query to the `payments` schema. The D39 materialized
-  `balances`/`benefits` tables stay the in-transaction write target the cache fronts.
-  Single-instance, matching the deployment (a multi-instance backend would need a shared
-  cache).
-
-### Migrations & codegen
-
-- Migrations: same goose dir `backend/internal/postgres/migrations/`, sequential
-  `0000N_*.sql`, `-- +goose Up/Down`, schema-qualified, **expand-contract mandatory**
-  (image rollback must stay DB-safe). First payments migration does `CREATE SCHEMA IF NOT
-  EXISTS payments`, creates the role, grants.
-- **jetgen** (`backend/cmd/jetgen/main.go`) is currently hardwired to `schema=backend`.
-  Extend it to also generate `schema=payments` into `internal/postgres/jet/payments/
-  {model,table}` (committed). Regenerate only after a payments migration; revert unrelated
-  `backend`-schema churn (jetgen may reorder untouched tables — commit only intended diffs).
-- Transactions: reuse the local `withTx(ctx, db, fn)` idiom. Balance/benefit mutations are
-  guarded single-row atomic UPDATEs (mirror `account.SpendHint`); the ledger INSERT +
-  materialized-cache UPDATE go in one `withTx`. Default Read-Committed is sufficient given
-  the guarded updates + unique idempotency keys; do not reach for Serializable without a
-  demonstrated need.
-
-### Transport
-
-- client ↔ gateway: Connect-RPC + FlatBuffers (h2c). gateway ↔ backend: REST/JSON +
-  `X-User-ID` via `gateway/internal/backendclient`. Any user-facing payments call needs the
-  full chain: backend REST handler (`u := s.user` group) → `backendclient` method →
-  Connect-RPC method + transcode (`gateway/internal/transcode/`) → FlatBuffers schema
-  (`pkg/fbs/…`, regen with `make -C pkg fbs` + `pnpm -C ui codegen`).
-- Provider webhooks (Robokassa/VK) do NOT use the Connect path — model on the existing
-  public HMAC-signed route `s.public.GET("/dl/:id/:kind", …)` (`handlers.go`): a public
-  route with signature verification, proxied by the gateway/Caddy `@gateway` matcher
-  (`deploy/caddy/Caddyfile` — a new edge route MUST be added there or it falls to the
-  landing catch-all).
-
-### Testing layers (`docs/TESTING.md`)
-
-- **unit** (Go `_test.go`, TS vitest): gate-by-context, no-ads stacking, priority draw,
-  rate math, idempotency keys, catalog snapshotting. UI logic must be extracted out of
-  `.svelte` into `ui/src/lib/*` to be unit-testable.
-- **integration** (`backend/internal/inttest/`, `//go:build integration`, Postgres-backed):
-  atomic chip↔benefit spend, callback idempotency, order-flow, TG outbox delivery, merge/
-  unlink of segments.
-- **UI** (Playwright mock e2e, Chromium+WebKit): Wallet screen, warnings, guest-hidden, GP
-  stub. Mock e2e bypasses codec — wire bugs need codec unit tests.
-- Local full verification before push: integration (`-tags=integration` + DAWG sibling +
-  Ryuk-off), UI check/test/build, codegen (`make -C pkg proto fbs`, `pnpm -C ui codegen`).
-
----
-
-## E0 — Payments data foundation
-
-**Status:** DONE · **Release 1** · depends on: none · mechanics: PAYMENTS §14, §7, §11.
-
-**Goal.** Stand up the `payments` schema, its confinement role, the jetgen target, the domain
-package skeleton and all core tables — nothing wired to real money yet. This is the substrate
-every later stage builds on.
-
-**Migration `00010_payments_foundation.sql` (`payments` schema).**
-
-- `CREATE SCHEMA payments`; an idempotent `DO $$` block creates a **NOLOGIN** `payments` role;
-  `GRANT USAGE` + `GRANT ALL ON ALL TABLES` (+ `ALTER DEFAULT PRIVILEGES … GRANT ALL`) confine it
-  to `payments.*` with nothing on `backend`. No `REFERENCES` grant (there is no cross-schema FK).
-- `payments.ledger` — append-only. `ledger_id` (uuid PK, app-generated v7), `account_id` (plain
-  `uuid`, **no FK**), `kind` (`fund|spend|admin_grant|refund`), `source`/`origin` (nullable,
-  `vk|telegram|direct`), `chips_delta` (signed int, 0 for a grant), `product_id` (nullable
-  FK→product), `order_id` (nullable FK→orders), `provider` + `provider_payment_id` (nullable),
-  `snapshot` (jsonb, written from E2), `created_at`. Immutability is a **`BEFORE UPDATE OR DELETE`
-  trigger** (a superuser bypasses a privilege REVOKE). Unique **partial** index on `(provider,
-  provider_payment_id) WHERE provider_payment_id IS NOT NULL` — the idempotency key.
-- `payments.balances` — `(account_id, source)` PK, `chips int CHECK (>=0)`, `updated_at`. Created
-  **lazily** on first fund (up to three rows/account, absent = zero).
-- `payments.benefits` — `(account_id, origin)` PK, `ads_paid_until timestamptz` null,
-  `ads_forever bool`, `hints int CHECK (>=0)`, `updated_at`. Created lazily.
-- `payments.catalog_atom` — `atom_type` PK (`chips|hints|noads_days|tournament`); the four atoms
-  are **seeded** here (the `tournament` atom is provisioned for E9).
-- `payments.product` (`product_id` PK, `title`, `active bool` soft-delete, timestamps);
-  `payments.product_item` (`(product_id, atom_type)` PK → `quantity`); `payments.product_price`
-  (`(product_id, COALESCE(method,''), currency)` unique → `amount bigint` minor units): a chip
-  pack carries a money price per `method` (`vk|telegram|direct`), a value carries one
-  `currency='CHIP', method=NULL` row. `currency ∈ {RUB, VOTE, XTR, CHIP}`; `amount CHECK (>=0)`.
-- `payments.config` — a single typed row (`only_row bool PK CHECK`): `rewarded_payout_chips`,
-  `cooldown_global_seconds` (300), `cooldown_vs_ai_seconds` (1800), `cooldown_hint_seconds` (60),
-  `order_ttl_seconds` (1800). No `chip_rate` table — the pack rate is `product_price`.
-- `payments.orders` — `order_id` (uuid PK), `account_id`, `platform`, `product_id` (FK),
-  `expected_amount bigint` + `currency`, `origin`, `status` (`pending|paid|expired`), `provider`,
-  `provider_payment_id` (nullable), timestamps. Index `(status, created_at)` for the pending sweep.
-- `payments.payment_events` — `event_id` (uuid PK), `account_id`, `order_id` (nullable FK), `type`
-  (`succeeded|failed|refunded`), `payload jsonb`, `created_at`, `dispatched_at` (nullable, partial
-  index for the dispatch queue).
-- Full `-- +goose Down` (DROP SCHEMA CASCADE + DROP OWNED BY + DROP ROLE); expand-contract, proven
-  reversible by an integration test.
-
-**Backend.**
-
-- `backend/internal/payments/{payments,service,store}.go` — the `Money` value type + `Currency`
-  (bigint minor units, exact, no float); `Store{db *sql.DB}` with a `Ping` health read via jet;
-  `Service` over the store. (`withTx` arrives with E2's first transaction.)
-- `cmd/jetgen` generates the `payments` schema into `internal/postgres/jet/payments/` (a second
-  `GenerateDB` call); committed. Constructed in `cmd/backend/main.go` and passed to `server.Deps`
-  (`Payments`) with a boot-time reachability check; its routes are registered from E2.
-
-**Legacy deprecation (expand phase only).** A `--` header note marks `accounts.hint_balance` and
-`accounts.paid_account` deprecated; they are **not** dropped (the DROP is the contract phase after
-E2 flips reads and after Release 2). Reads still use the old columns until E2.
-
-**Tests.**
-
-- integration (`inttest`): schema + role + seeds present; `SET ROLE payments` cannot read
-  `backend.accounts` (grant confinement); ledger rejects UPDATE/DELETE (trigger); idempotency
-  partial index holds (NULL-keyed rows repeat); balance/benefit/amount/enum CHECKs bite; migration
-  applies forward **and backward** on a throwaway PG.
-- unit: `Money` — exact round-trip, per-currency scale, no-float parse rejecting a fraction for a
-  whole-unit currency, arithmetic, formatting. Import-boundary test: only `internal/payments`
-  imports the payments jet code.
-
-**Done-criteria (met).** Migrations apply forward+backward on a throwaway PG 17; `go build
-./backend/...` + `go vet` + `gofmt -l .` clean; committed `jet/payments/`; all tests green; no
-behaviour change for users.
-
-**Notes.** jetgen regenerates the whole `backend` schema; its committed jet had drifted from the
-migrations (`robot_blocks`, `robot_friend_requests`, the `feedback_messages` `app_version` /
-`browser_tz` columns, and `UseSchema` gaps), so this change also **regenerates and commits
-`jet/backend`** to bring it back in sync (additive only — all suites stay green). The `payments`
-role creation is idempotent (`DO $$` / `IF NOT EXISTS`) for fresh volumes.
-
----
-
-## E1 — Trusted platform signal
-
-**Status:** DONE · **Release 1** · depends on: none (parallel to E0) · mechanics: PAYMENTS §8.
-
-**Goal.** Make the server know the execution platform from a trusted, unforgeable source,
-carried on the session. This is the foundation the gate (E2) stands on; without it the gate is
-meaningless. Signal plumbing only — no user-visible change.
-
-**Model.** `platform = {kind: vk|telegram|direct, subtype: ios|android|web}` is a property of
-the **session**, captured at creation. `kind` is always trusted — the gateway derives it from
-the validated establish path (VK launch / TG initData / a web-native session), never a client
-field. `subtype` is **cryptographically trusted only for VK** (it rides inside the signed
-`vk_platform` launch param); for telegram and direct it is client-reported best-effort, and the
-gate never relies on it (only the VK-iOS-frozen case is compliance-critical, and VK subtype is
-trusted). VK/TG re-mint a session on **every cold start**, so their platform is re-captured each
-launch; web/direct/email reuse the stored token, so their platform is captured once at creation
-(`direct` needs no signature).
-
-**Validation stays at the gateway.** Both wrapper verifiers already live there and the backend
-cannot import either (separate modules under `internal/`, and the VK app secret is gateway-only):
-VK launch params via the in-process `gateway/internal/vkauth.Verify` (HMAC-SHA256 over the signed
-`vk_*` params under `GATEWAY_VK_APP_SECRET`, extended here to expose the signed `vk_platform` →
-a trusted `Subtype()`), TG `initData` via the validator RPC. The gateway hands the derived
-platform to the backend at establish; the backend persists it and returns it on resolve.
-
-**Backend.**
-
-- `backend.sessions` gains nullable `platform_kind` + `platform_subtype` columns (migration
-  `00011`, CHECK-constrained, jet regenerated). A `session.Platform` value type + `session.Create`
-  captures it; `Session` carries it through the store and the warm cache.
-- `handleResolveSession` → `resolveResponse` (`dto.go`) returns the platform; the establish
-  handlers set `kind` from their own endpoint (`/sessions/telegram|vk|guest|email/*`) and
-  `subtype` from the request (VK: gateway-extracted from the signed params; TG/direct: the client
-  best-effort field, defaulting web). The account-merge session mint (`link.merge`) inherits the
-  caller's platform from the request context.
-- Middleware (`middleware.go`) parses the gateway-injected `X-Platform` into the request context
-  on the `s.user` group; `platform(c)` exposes it. Absent ⇒ untrusted (fail-closed).
-
-**Gateway.**
-
-- `backendclient.WithPlatform(ctx, "<kind>/<subtype>")` + `do`/`getRaw` inject `X-Platform` on
-  every authenticated backend call; `connectsrv.Execute` enriches the request context from the
-  resolved session's platform (carried through the gateway session cache + `ResolveSession`).
-  Never from a client request body.
-
-**Client (`ui/`).** `platformSubtype()` (`ui/src/lib/platform.ts`) supplies a best-effort device
-subtype on the `auth.telegram` / `auth.guest` / `auth.email.login` requests (new FBS `subtype`
-field): Telegram's `WebApp.platform` inside a Mini App, else the Capacitor/web channel. VK sends
-nothing (the gateway derives the trusted subtype from the signed launch params).
-
-**Tests.**
-
-- unit (Go): `vkauth` exposes the signed `vk_platform` and maps iPhone/iPad → ios (the frozen
-  case); the `X-Platform` middleware round-trips + reports untrusted when absent; the backend
-  client injects `X-Platform` from the context and omits it when untrusted.
-- integration: a session carries its platform through create + a cold-cache (DB) resolve for each
-  kind; an unattributed session is untrusted; the CHECK constraints bite; migration `00011`
-  applies forward **and backward** on a throwaway PG.
-- UI: subtype normalization (vitest) + the new `subtype` field on the wire (codec unit test).
-
-**Done-criteria (met).** A VK/TG session resolves to a trusted `{kind, subtype}`; a forged body
-cannot change `kind` (nor the VK subtype); `direct` sessions resolve to `direct`; the untrusted
-path is reachable and observable via `platform(c)`. No user-visible change; all layers green.
-
-**Notes/risks.** High blast-radius (auth/session table + broad gateway header threading): additive
-migration, no mixed-in refactors, `X-Platform` inert until E2 consumes it. **Sessions minted before
-E1 carry no platform → untrusted (view-only) until re-login**; VK/TG self-heal on the next
-cold-start re-mint, direct/email do not (accepted: Release 1 has no money, sessions cycle by
-Release 2). TG/direct subtype is not cryptographically trusted — E2 must keep the gate on `kind`
-+ the trusted VK subtype only.
-
----
-
-## E2 — Currency + benefit core
-
-**Status:** DONE · **Release 1** · depends on: E0, E1 · mechanics: PAYMENTS §2–§6, §11.
-
-**Goal.** The full internal money mechanic, exercisable end-to-end **without real money**
-via `admin_grant`: chip balances, spend→benefit atomically, the compliance gate by context,
-benefit application (no-ads stacking, hints per-origin), the legacy migration, and the
-`SpendHint` rewrite. This is the heart.
-
-**Payments service (Go).** Every read/gate method also takes `present` (the account's live
-identity sources, see *Domain boundary*) and is served from the read cache.
-
-- `Balances(ctx, account, platform, present)` → per-segment `{source, chips, spendable}` for
-  the context (VK→vk spendable, direct/tg hidden; TG→tg; direct→direct+vk+tg by priority;
-  VK-iOS→vk shown as a **frozen** number, none spendable; untrusted→view-only, none spendable).
-- `Spend(ctx, account, platform, present, productID)` → gate-checked purchase of a **value**
-  (CHIP price, `method=NULL`; never a chip pack) with chips: resolve spendable segments by
-  context, draw by priority direct→vk→tg, write a `spend` ledger row (+ a catalog **snapshot**
-  of atoms+price) + decrement balance + apply benefit (extend `ads_paid_until[origin]` from
-  `max(now,end)` / set `ads_forever` / add hints) **in one tx**, stamping `origin` = platform
-  context. Refuse if untrusted (fail-closed) or funds insufficient.
-- `Grant(ctx, account, origin, atoms)` → a **0-price sale of a value**: an `admin_grant`
-  ledger row (`chips_delta=0`, + snapshot), same benefit application; concrete values only,
-  never chips (no chips move — it neither requires nor touches a balance). Origin chosen by
-  the admin. In E2 this is the Go service method only, exercised by tests; the admin grant UI
-  + catalog editor are E7.
-- `AdFree(ctx, account, platform, present)` / `HintsAvailable(…)` / `SpendHint(…)` → apply
-  the one-directional origin rule: in context P, usable origins = {P} plus, when P is
-  web/native, {vk,tg} (relaxation outward); in VK only vk; in TG only tg. Hint consumption
-  draws by the same priority direct→vk→tg.
-- `Merge` / `Unlink` hooks: extend `accountmerge` to merge segments **and** benefits by origin
-  (same-origin add — chips sum, terms extend per origin; different origins coexist) in the
-  caller's tx (`MergeTx`), and make **both** segment *and* benefit availability follow
-  identity presence — unlink sleeps the balance *and* the benefit, re-link wakes them (D14),
-  resolved live from `present`. Warn-before-unlink surfaces the balance via the interface; the
-  warning UI itself is not E2.
-
-**Backend wiring & migration.**
-
-- Deprecate-and-flip `accounts.hint_balance` / `accounts.paid_account`: E0 added the tables;
-  here, move reads/writes to `payments.benefits`. `SpendHint` (`game/service.go` ~:1147) and
-  `ads.Eligible` (`ads/ads.go` :107) call the payments interface instead of the account
-  columns. Legacy values were never set in prod → zero them; the DROP is the contract phase
-  (guarded, after Release 2 — keep columns until then for rollback safety).
-- `vs_ai` hints stay free/unlimited (unchanged 30-min gate); only online-game hint spend
-  routes through the segmented, context-aware path.
-
-**API (user-facing, Connect chain).** Read-only wallet view + spend:
-`GET /api/v1/user/wallet` (balances+benefits for the context), `POST /api/v1/user/wallet/
-buy` (spend chips on a product). Add the backend handlers (`u := s.user`), `backendclient`
-methods, Connect methods + transcode + FBS. Admin grant is internal/admin (E7 UI).
-
-**Tests.**
-
-- unit (Go): gate-by-context matrix (every row of PAYMENTS §4, incl. VK-iOS frozen +
-  untrusted); priority draw; no-ads stacking (`+=` from max(now,end)) + forever override;
-  per-origin hint applicability + direct→vk→tg draw; merge/unlink segment+benefit math;
-  catalog snapshotting; read-cache invalidation on each mutation.
-- integration: atomic spend (ledger+balance+benefit in one tx; failure rolls all back);
-  admin_grant credits values not chips; legacy migration zeroes and flips reads; merge/
-  unlink over Postgres.
-- UI: none new (E3 builds the screen); wallet DTO covered by codec unit tests.
-
-**Done-criteria.** `admin_grant` applies no-ads/hints directly (a 0-price sale of a value —
-no chips involved); the player chip-spend path (`Spend`) is proven by unit/integration tests
-(balance seeded in-test, since a legitimate chip source arrives only with Release 2); the gate
-blocks cross-context spend and cross-origin application; the ads gate reads the new benefit;
-`SpendHint` uses segments; the hot read paths hit the read cache, not the `payments` schema;
-all layers green; **compliance regression** (a `direct` benefit never activates inside VK/TG)
-is a named test.
-
-**Notes/risks.** This is the high-blast-radius core (money semantics + a live path
-`SpendHint`/`ads.Eligible`). Minimize surface, keep the interface narrow, no mixed-in
-refactors. The legacy flip is expand-contract: reads move first, DROP much later.
-
----
-
-## E3 — Wallet UI
-
-**Status:** DONE · **Release 1** · depends on: E2 · mechanics: PAYMENTS §1, §7, §6, §13, §4.
-
-**Goal.** The user-facing "Кошелёк" (Wallet) section: balances + active benefits + the
-catalog storefront, honouring guest-hidden, GP-stub, and the web-spend warning.
-
-**Backend + wire (catalog read — new).** E2 shipped `wallet.get` / `wallet.buy` (segments +
-benefits + a chip spend) but no way to *list* the catalog; the storefront needs one, so E3 adds a
-read path following the E2 shape:
-
-- `payments.Service.Catalog(ctx, cxt)` + `store.loadCatalog` (`internal/payments/{catalog,
-  store_catalog}.go`) read every **active** product with atoms and prices and project them to the
-  context (`projectCatalog`, pure + unit-tested): a **value** (no `chips` atom) carries its CHIP
-  price and shows everywhere; a **chip pack** (`chips` atom) carries the money price for the
-  context method (`cxt.Kind`: vk→VOTE, telegram→XTR, direct→RUB) and shows only where that method
-  is priced. Read **uncached** (the catalog is small and rarely edited — unlike the per-account
-  balances/benefits the read cache fronts).
-- REST `GET /api/v1/user/wallet/catalog` (`handleWalletCatalog`, gated by `walletGate`) →
-  `catalogDTO`; gateway op `wallet.catalog` (`transcode.go` + `encodeCatalog`), `backendclient.
-  Catalog`; FBS `Catalog`/`CatalogProduct`/`CatalogAtom` (`pkg/fbs/scrabble.fbs`), client
-  `decodeCatalog`.
-
-**UI (`ui/`).**
-
-- New `'wallet'` tab in `ui/src/screens/SettingsHub.svelte` — `SettingsTab` union, tab button
-  **between Friends and About** (guest-hidden like Friends, offline-disabled like Profile/Friends),
-  body branch, `'wallet'` route in `ui/src/lib/routeparse.ts` + `ui/src/App.svelte`.
-- `Wallet.svelte` screen: context-available chip balances + active benefits (no-ads until date /
-  forever, hints count). **No history feed** (PAYMENTS §11 — noise). Storefront: values priced in
-  chips (buyable with `wallet.buy`), chip packs priced per method.
-- **Guest:** section hidden entirely (durable-only).
-- **GP build:** the chip-pack purchases are hidden behind a RuStore stub; spending earned chips on
-  values still works (PAYMENTS §13). Detected by a build-time flag `VITE_GP_BUILD`
-  (`ui/src/lib/distribution.ts`), forcible under the mock e2e with `?gp`.
-- **Web-spend warning:** before a value spend that would draw vk/tg chips in a direct context, an
-  own `Modal` (not `showPopup`) warns the benefit will be web/native-only. The context is inferred
-  client-side (`executionContext` — VK/Telegram/direct); the server enforces the real gate on
-  `wallet.buy` (fail-closed), so no wallet-DTO change was needed.
-- Logic extracted to `ui/src/lib/{wallet,distribution}.ts` (unit-testable); `.svelte` stays thin.
-
-**Pack purchase is display-only in E3.** Buying a chip pack needs the money order flow, which is
-**E5**; here a pack card shows its price with a disabled **"Soon"** action. E5 replaces that with the
-launch/order CTA. Value spends are wired now (E2 `wallet.buy`), though a Release-1 durable account
-has 0 chips until funding exists (E5/E6), so a real value spend returns insufficient-funds until then.
-
-**Tests.**
-
-- unit (Go): `projectCatalog` context matrix (value everywhere; pack per context method; misconfig
-  omitted). unit (vitest): money/price formatting, spendable-segment selection, warning trigger,
-  the GP flag; `decodeCatalog` codec round-trip (mock e2e bypasses the codec).
-- integration (`inttest`): `/wallet/catalog` returns active products with the context-correct price
-  over Postgres; soft-deleted excluded.
-- UI (Playwright mock, Chromium+WebKit): Wallet renders between Friends/About; guest hides it
-  (`?guest` seam); GP stub (`?gp`); warning modal on a vk-drawing web spend, no warning on a
-  direct-covered spend. Mock overlay stays instant under `MODE==='mock'` (or it intercepts taps).
-
-**Done-criteria (met).** Balances/benefits/storefront render per context; guest/GP/warning paths
-verified by unit + integration + mock e2e on both engines. **A *populated* contour review depends
-on later stages** (no products until the E7 catalog editor, no chip funding until E5/E6, no grant
-UI until E7): on the contour E3 shows the correct **empty** wallet/storefront states; the populated
-UI is proven by the mock e2e. (This replaces the earlier "demonstrable end-to-end via `admin_grant`"
-line — the grant UI is E7.)
-
-**Notes/risks.** No global `.btn`/`.ghost` in `ui/` — styled per-component with scoped CSS + tokens
-(mirror NewGame `.invite`). Product titles are single-language catalog data (E0 `product.title`),
-shown verbatim; currency/chip words are i18n, counts follow the app's label+number convention (no
-noun agreement). Svelte whitespace/`$state` naming gotchas apply.
-
----
-
-## E4 — Durability (PITR)
-
-**Status:** WIP — repo artifacts landed; **prod arming pending** (owner-coordinated, before
-E5). · **Release 2** · depends on: E0 (schema exists) · mechanics: PAYMENTS §14 (D4).
-
-**Goal.** Continuous WAL archiving with point-in-time recovery, armed **before the first
-real money** is accepted (E5 prod). Protects both money and game data.
-
-**Locked decisions (this stage).**
-
-- **Tool: pgBackRest.** **Destination: Selectel S3** object storage (encrypted AES-256-CBC,
-  path-style addressing), **prod main host only** — the test contour never archives. (D4 left
-  the tool + destination open; resolved here. Warm replica stays deferred, per D4.)
-- **Retention 30 days**, **daily full base backup** (a systemd timer) + continuous WAL
-  (`archive_command`, a 5-minute forced switch bounds the recovery point). Assessment
-  (owner-reviewed prod gate): measured prod WAL **~0.77 MB/day**, DB **~9.6 MB** → archive
-  **< 1 ₽/month** on Selectel S3, **negligible** perf impact. Recorded in `deploy/README.md`.
-- **Archiving ships gated OFF** (`PGBACKREST_ARCHIVE_MODE` on the DB, `pitr_enabled` for the
-  timer — both default off), so the merged/redeployed artifact is inert until armed and an
-  un-armed prod deploy **cannot** pile WAL onto the disk.
-
-**Work (landed in the artifacts PR into `development`).**
-
-- pgBackRest in the DB image (`deploy/postgres/Dockerfile`); postgres becomes a built + pushed
-  image (prod overlay `image:` + `prod-deploy.yaml` build/push list).
-- Repository config + `archive_mode` via `PGBACKREST_*` env on the prod-overlay postgres
-  service; secrets/vars rendered by `deploy/write-prod-env.sh` from the `PROD_PGBACKREST_*`
-  Gitea set; **parity added to `prod-rollback.yaml`** (a rollback must not disarm archiving).
-- Daily base-backup systemd timer (Ansible `main` role, gated by `pitr_enabled`).
-- Two Grafana alerts on the exporter's `pg_stat_archiver` metrics (failing / stalled),
-  absent/NaN-safe on the contour.
-- Belt-and-braces `pg_dump` fixed to dump the **whole DB** (`deploy/prod-deploy.sh` was
-  `-n backend`, silently excluding `payments`); manual-restore runbook updated.
-- Full PITR runbook + arming sequence + recorded assessment in `deploy/README.md`.
-
-**Prod arming (SEPARATE — owner-coordinated, before E5; NOT the artifacts PR).** Owner creates
-the Selectel S3 bucket + the `PROD_PGBACKREST_*` secrets/variables (incl. `ARCHIVE_MODE=on`);
-then promote `development → master` → `prod-deploy` (archive_mode on behind the maintenance
-window), `pgbackrest stanza-create` + first base backup + `check`, re-run Ansible with
-`-e pitr_enabled=true`, and run the restore drill on an isolated one-shot target. Exact steps:
-`deploy/README.md` (point-in-time recovery — arming).
-
-**Tests.** Restore drill on an isolated one-shot instance (base + WAL → target timestamp),
-recorded in `deploy/README.md`. No app-level tests. Local verification: `docker compose config`
-valid + the custom PG image builds (archiving inert on the contour).
-
-**Done-criteria.** Artifacts merged with archiving inert. **Fully done** at arming: WAL
-archiving live on prod PG; a timed restore verified; cost + perf assessment reviewed; runbook
-current in `deploy/README.md`.
-
-**Notes/risks.** The repository **cipher passphrase is unrecoverable if lost** — stored apart
-from the S3 keys. Enabling `archive_mode` restarts postgres (rides the prod-deploy maintenance
-window). Migrations stay expand-contract so image rollback remains DB-safe alongside PITR.
-
----
-
-## E5 — Payment intake
-
-**Status:** TODO · **Release 2** · depends on: E0, E1, E2, E4 · mechanics: PAYMENTS §9, §12.
-
-**Goal.** Accept real money on all three rails into the payments domain: order-flow,
-verified provider callbacks, idempotency, the TG bot SQLite outbox, the event dispatcher,
-receipts, and refunds.
-
-**Order-flow & intake (single writer).**
-
-- `POST /api/v1/user/wallet/order` → create `order(pending)` (account/platform/product/
-  expected amount/origin), return the provider-specific launch payload with `order_id`
-  threaded in (Robokassa `InvId` / TG `invoice_payload` / VK `item`). The storefront's chip-pack
-  card wires its purchase CTA to this here, **replacing the disabled "Soon" placeholder E3 left**
-  (`ui/src/screens/Wallet.svelte`).
-- Robokassa + VK **public webhooks**: new edge routes (add to `deploy/caddy/Caddyfile`
-  `@gateway` matcher — or they fall to the landing catch-all), signature/HMAC verified,
-  proxied into a payments intake handler. Match by `order_id`, verify amount, credit
-  (ledger `fund` + balance UPDATE in one tx), mark order `paid`, emit `payment_event`.
-  Idempotent by `(provider, provider_payment_id)`.
-- **Pending sweep:** background reaper expires pending orders after the configured timeout
-  (~30 min). Expiry is cosmetic — a later valid callback still credits (revive/honour).
-
-**TG bot outbox (`platform/telegram/`).**
-
-- The bot receives `successful_payment` (and `pre_checkout_query`) via Bot API. Add a
-  **SQLite** store on the bot's disk: on receipt, persist → ack the Telegram update → forward
-  to a backend payments-intake endpoint (internal, authenticated over the existing reverse
-  mTLS bot-link) → on backend ack, mark `forwarded`. Retries with backoff; re-drive
-  undelivered on restart. Backend intake dedups by `telegram_payment_charge_id`.
-- Provide the invoice creation path (Stars) from the Mini App via the bot as needed.
-
-**Events & notifications.**
-
-- `payment_events` dispatcher: `succeeded`/`failed`/`refunded` → live gRPC stream if the
-  user is connected, else `botlink` push / email relay (existing). "failed" = an active
-  provider decline (not an abandoned pending) surfaced to the user; "succeeded" hook
-  (email/bot message).
-
-**Receipts (§12).** Robokassa self-employed НПД receipt on payment (provider config); VK
-handles Votes tax itself; TG Stars — no receipt.
-
-**Refunds (§9).** ToS non-refundable; admin manual refund (ties to `accountdelete`); external
-`refunded` events honoured — best-effort benefit revoke (never negative; record loss + abuse
-flag if spent), ledger `refund` row. Ledger export-ready (reconciliation not built).
-
-**Tests.**
-
-- unit: signature/HMAC verifiers per rail; order-id matching; idempotency-key dedup.
-- integration: full order→callback→credit per rail; duplicate callback credits once; expired
-  order still honoured on late callback; TG outbox store→forward→ack→cleanup + restart
-  re-drive; refund revoke best-effort/never-negative.
-- UI: purchase flow reaches the provider launch (mock); success/failure surfaced.
-
-**Done-criteria.** A real (sandbox) payment on each rail credits chips exactly once; a
-replayed callback does not double-credit; the TG outbox survives a bot restart mid-flight;
-failed/succeeded events reach the user; refund path exercised. **PITR (E4) armed and the
-cost/perf assessment reviewed before this goes to prod.**
-
-**Notes/risks.** Manual `docker run -p` boot tests fail from the shell — verify the runnable
-artifact via the testcontainers integration suite. Distroless services run UID 65532;
-bind-mounted secrets must be 0644. Edge routes silently fall through if not added to the
-Caddyfile — add a CI probe. The prod rolling deploy skips caddy on config-only changes —
-force-recreate when the Caddyfile changes.
-
----
-
-## E6 — Ads
-
-**Status:** TODO · **Release 2** · depends on: E2 (chips), E5 (rewarded credits via intake) ·
-mechanics: PAYMENTS §10.
-
-**Goal.** VK video ads: the post-move interstitial (frequency-gated) and the rewarded video
-(credits chips via server verify), plus extending the existing banner suppression to
-per-origin.
-
-**Work.**
-
-- **Provider abstraction:** a small ads-network interface (VK impl now) so a future network
-  for other platforms slots in without rework. VK integration via `ui/src/lib/vk.ts`.
-- **Rewarded:** voluntary view → the network's **server verify callback** → payments intake
-  credits chips to the `vk` segment (client not believed, like a payment). On-launch
-  anti-fraud = provider verify only (no own daily cap; abstraction allows later).
-- **Interstitial** (post-move fullscreen), configurable server values (from `payments`
-  config): global per-user cooldown across all games (default 5 min); `vs_ai` 30 min; a hint
-  application triggers a post-move interstitial independently with its own 1-min cooldown;
-  offline banner-only; respect VK's own frequency caps. Cooldown state tracked server-side
-  (per user) or client-mirrored from a server value — pick and document at implementation.
-- **Banner suppression:** extend `ads.Eligible` (`backend/internal/ads/ads.go` :107) to gate
-  on the **origin benefit applicable in the current context** (E2 interface) instead of the
-  single legacy flag. No-ads suppresses banner + interstitial; rewarded never suppressed.
-
-**Tests.**
-
-- unit: cooldown logic (global 5m / vs_ai 30m / hint-trigger 1m independence); rewarded
-  credit path; banner eligibility per context.
-- integration: rewarded verify → credit exactly once (idempotent like a payment).
-- UI: interstitial shows/respects cooldown (mock); rewarded button; no-ads hides banner +
-  interstitial; rewarded still available under no-ads.
-
-**Done-criteria.** VK rewarded credits chips once per verified view; interstitial respects
-all cooldowns incl. the hint trigger; no-ads suppresses banner+interstitial but not
-rewarded; offline shows banner only.
-
-**Notes/risks.** Crypto-payout networks stay rejected. Rewarded-without-payout is pointless —
-only enable where the network pays (VK). Keep the interstitial frequency as server config so
-it tunes without a store release.
-
----
-
-## E7 — Admin & reports
-
-**Status:** TODO · **Release 2** · depends on: E2 (ledger/grant), E5 (payments/refunds) ·
-mechanics: PAYMENTS §11.
-
-**Goal.** The admin console financial surface: per-user report, admin grant UI, manual
-refund UI, ledger export.
-
-**Work (`/_gm`, `backend/internal/server/handlers_admin_console.go` + `adminconsole/`).**
-
-- **Per-user financial panel** on the existing user card (`consoleUserDetail` :343,
-  `UserDetailView`): segment balances, payments, spends, grants, refunds, full history —
-  read from the append-only ledger + materialized cache.
-- **Admin grant** action (mirror the existing `POST /_gm/users/:id/grant-hints`): grant
-  concrete values (no-ads days / hints), **origin picker**, **never chips**; writes an
-  `admin_grant` ledger row (E2 `Grant`).
-- **Manual refund** action: admin-initiated refund of a specific order (ties to the refund
-  path); records a `refund` ledger row; best-effort benefit revoke.
-- **Ledger export**: CSV/JSON export of the ledger for tax reporting + future Robokassa
-  reconciliation (export-ready schema; reconciliation itself not built).
-- Auth unchanged: gateway Basic-Auth in front of `/_gm` + backend same-origin CSRF on POSTs.
-
-**Tests.**
-
-- unit: report view assembly; grant refuses chips; export shape.
-- integration: grant/refund write correct ledger rows; report reflects balances+history.
-
-**Done-criteria.** An operator can see a user's full financial picture, grant concrete
-values (origin-picked, never chips), issue a manual refund, and export the ledger.
-
-**Notes/risks.** `/_gm` per-user detail already surfaces `PaidAccount`/`HintBalance` — replace
-those with the segmented view as the legacy columns retire.
-
----
-
-## E8 — Guest limits
-
-**Status:** TODO · **standalone** (game-behaviour change; can run in parallel) · depends on:
-none · mechanics: PAYMENTS §6.
-
-**Goal.** A registration funnel: cap what a guest can do, enforced **server-side** (today the
-gating is UI-only).
-
-**Finding (verified).** The friend/invitation paths do **not** check `is_guest` on the
-server — only the UI hides them: `social/friends.go:50` `SendFriendRequest`,
-`robotfriends.go:41` `RequestInGame`, `friendcodes.go:67` `RedeemFriendCode`,
-`lobby/invitations.go:208` `CreateInvitation`. A guest with a valid `X-User-ID` can call them
-in the UI's stead.
-
-**Work.**
-
-- **Server guest gate** on friend-request / redeem-code / invitation-create: refuse when the
-  caller `is_guest` (add an `ErrGuestForbidden`-style guard, as `feedback` already has).
-- **Active-game limits** for guests: at most **1 random-opponent game + 1 vs_ai** concurrently
-  (enforce on game/invitation creation in `lobby`/`game`; today no such limit exists).
-- Keep the existing UI gating; this adds the server as the source of truth.
-
-**Tests.**
-
-- integration: guest is refused friend/redeem/invitation server-side; guest blocked from a
-  2nd random / 2nd vs_ai; durable account unaffected.
-- UI: guest sees the funnel (existing hides + any new messaging).
-
-**Done-criteria.** Guests are server-limited to 1 random + 1 vs_ai and cannot friend/invite;
-durable accounts unchanged; regression that this does not break existing durable flows.
-
-**Notes/risks.** This changes existing game behaviour — its own tests, its own PR, no
-mixed-in payments changes. Decide whether a guest may finish an already-started game (limit
-on creation, not mid-game) at implementation and record it here.
-
----
-
-## E9 — Tournament fee (future)
-
-**Status:** TODO · **future** · depends on: E0 (atom provisioned), tournament feature ·
-mechanics: PAYMENTS §5, §7.
-
-**Goal.** Charge a chip entry fee for tournaments. The `tournament` atom + a catalog product
-are provisioned in E0/E7; the spend mechanic reuses E2 (`Spend`). The actual tournament
-feature and its coupling to entry are out of scope until the tournament feature exists.
-
-**Done-criteria.** Deferred — revisit when tournaments are built.
-
----
-
-## Verification & CI (all stages)
-
-- Per-stage tests at the layers above; **compliance-gate regression is mandatory** (a
-  `direct` benefit must never activate inside VK/TG) and runs from E2 onward.
-- Local full verification before every push: `go build/vet ./backend/... && gofmt -l .`,
-  integration (`-tags=integration` + DAWG sibling + Ryuk-off), `pnpm -C ui check/test:unit/
-  build`, Playwright mock e2e, codegen (`make -C pkg proto fbs`, `pnpm -C ui codegen`).
-- Contour: each PR into `development` auto-deploys the test contour; owner does visual sign-
-  off there (not local). Keep a multi-PR batch a linear stack (one shared contour,
-  last-deploy-wins).
-- Prod (Release 2): expand-contract migrations only (image rollback DB-safe); PITR armed +
-  the E4 cost/perf assessment reviewed **before** the first money; new edge routes added to
-  the Caddyfile with a CI probe; caddy force-recreated on config-only changes.
-- Release framing: **shipped docs/code/commits/PRs carry no stage ids** — finalize copy for
-  the release, not the plan.

assets/icons/README.md

@@ -1,41 +0,0 @@
-# Erudit — site icons + Open Graph card
-
-The favicon set and the `og:image` link-preview card for the public landing
-(`ui/landing.html`) and the SPA shell (`ui/index.html`). Same design language as the
-[VK loading-screen logo](../vk/README.md): the wooden Erudit «Э» tile (score `8`),
-with the wordmark on the app's dark board green (`ui/src/app.css` tokens).
-
-| Output (committed to `ui/public/`) | Purpose |
-|------|---------|
-| `favicon.svg` | Vector favicon, transparent; tile + «Э» only (the score is illegible below ~32 px). |
-| `favicon.ico` | 32×32 PNG-in-ICO fallback (also answers the browsers' blind `/favicon.ico` probe). |
-| `apple-touch-icon.png` | 180×180 opaque full-bleed tile; iOS masks its own corners. |
-| `og-image.png` | 1200×630 card: tile + «Эрудит / Скрэббл — игра в слова». Referenced absolutely as `https://erudit-game.ru/og-image.png`. |
-
-## How it works
-
-`build/extract.js` extracts the needed glyph outlines (tile glyphs + every wordmark
-character) from LiberationSans (Arial-metric, the game's font stack) with their
-advance widths into `build/glyphs.json` (committed). `build/generate.js` composes
-plain SVG from those outlines — no font is needed at generation time — writes
-`favicon.svg` and rasterises the PNG/ICO outputs by screenshotting the SVGs with the
-`ui` package's Playwright chromium (`@playwright/test`); the `.ico` container is
-assembled in-script (a single PNG entry). Raster bytes therefore depend on the
-installed chromium version; the SVG sources are deterministic.
-
-## Regenerate
-
-Requirements: Node ≥ 18, `ui` installed (`pnpm install`, provides Playwright).
-`extract.js` additionally needs `opentype.js` (`npm i opentype.js`); **`generate.js`
-needs no extra packages**.
-
-```sh
-cd assets/icons
-
-# 1. (optional) re-extract the glyphs — only if the font or the wordmark changes:
-#    default font: /usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf
-node build/extract.js [/path/to/font.ttf]      # -> build/glyphs.json
-
-# 2. regenerate everything in ui/public/:
-node build/generate.js
-```

assets/icons/build/extract.js

@@ -1,78 +0,0 @@
-'use strict';
-// Extract the glyph outlines the site icons and the og-image wordmark need from a
-// grotesque font (LiberationSans = Arial-metric, matching the game's system-ui/Arial
-// stack) and emit cubic-bezier contours per character, baseline at y=0, y-down,
-// plus the advance width so generate.js can lay out words without the font.
-// Same outline conversion as ../../vk/build/extract.js, generalised to a char set.
-const opentype = require('opentype.js');
-const fs = require('fs');
-
-const FONT = process.argv[2] || '/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf';
-const b = fs.readFileSync(FONT);
-const font = opentype.parse(b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength));
-const FS = 1000; // em scale
-
-// The tile glyphs («Э», «8») + every character of the og-image wordmark lines
-// («Эрудит», «Скрэббл — игра в слова»). The space carries only an advance.
-const CHARS = [...new Set('Э8рудитСкэббл—игра в слова')];
-
-function glyphData(ch) {
-  const g = font.charToGlyph(ch);
-  const p = g.getPath(0, 0, FS); // baseline at y=0, y-down
-  const contours = [];
-  let cur = null, prev = null;
-  for (const c of p.commands) {
-    if (c.type === 'M') {
-      if (cur) contours.push(cur);
-      cur = [{ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] }];
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'L') {
-      cur.push({ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'C') {
-      cur[cur.length - 1].o = [c.x1, c.y1];
-      cur.push({ v: [c.x, c.y], i: [c.x2, c.y2], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Q') {
-      const c1 = [prev.x + 2 / 3 * (c.x1 - prev.x), prev.y + 2 / 3 * (c.y1 - prev.y)];
-      const c2 = [c.x + 2 / 3 * (c.x1 - c.x), c.y + 2 / 3 * (c.y1 - c.y)];
-      cur[cur.length - 1].o = c1;
-      cur.push({ v: [c.x, c.y], i: c2, o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Z') {
-      if (cur && cur.length > 1) {
-        const last = cur[cur.length - 1], first = cur[0];
-        if (Math.hypot(last.v[0] - first.v[0], last.v[1] - first.v[1]) < 1e-3) {
-          first.i = last.i; // fold the duplicate closing point into the first
-          cur.pop();
-        }
-      }
-      if (cur) { contours.push(cur); cur = null; }
-    }
-  }
-  if (cur) contours.push(cur);
-
-  let minx = Infinity, miny = Infinity, maxx = -Infinity, maxy = -Infinity;
-  const out = contours.map(ct => {
-    const v = [], i = [], o = [];
-    ct.forEach(pt => {
-      v.push(pt.v);
-      i.push([pt.i[0] - pt.v[0], pt.i[1] - pt.v[1]]);
-      o.push([pt.o[0] - pt.v[0], pt.o[1] - pt.v[1]]);
-      minx = Math.min(minx, pt.v[0]); maxx = Math.max(maxx, pt.v[0]);
-      miny = Math.min(miny, pt.v[1]); maxy = Math.max(maxy, pt.v[1]);
-    });
-    return { i, o, v, c: true };
-  });
-  const bbox = out.length
-    ? { x: minx, y: miny, w: maxx - minx, h: maxy - miny }
-    : { x: 0, y: 0, w: 0, h: 0 }; // the space has no outline
-  return { adv: g.advanceWidth * (FS / font.unitsPerEm), bbox, contours: out };
-}
-
-const glyphs = {};
-for (const ch of CHARS) glyphs[ch] = glyphData(ch);
-
-const out = __dirname + '/glyphs.json';
-fs.writeFileSync(out, JSON.stringify({ em: FS, glyphs }));
-console.log('wrote', out, fs.statSync(out).size, 'bytes;', CHARS.length, 'glyphs:', CHARS.join(''));

assets/icons/build/generate.js

@@ -1,128 +0,0 @@
-'use strict';
-// Site icons + the Open Graph card for the public landing, drawn from the same
-// design as ../../vk (the wooden Erudit tile: face «Э», score «8») and the app's
-// board palette (ui/src/app.css). Everything is composed as SVG from the committed
-// glyph outlines (build/extract.js -> glyphs.json), so no font is needed at build
-// time; the PNG/ICO rasters are screenshots taken with the ui package's Playwright
-// chromium (@playwright/test re-exports the browser API). Outputs go straight to
-// ui/public/:
-//   favicon.svg          96 viewBox, transparent, tile + «Э» (the score is illegible small)
-//   favicon.ico          32x32 PNG-in-ICO render of the same
-//   apple-touch-icon.png 180x180 opaque full-bleed tile (iOS masks its own corners)
-//   og-image.png         1200x630 card: tile + wordmark on the board green
-const fs = require('fs');
-const path = require('path');
-
-const G = JSON.parse(fs.readFileSync(path.join(__dirname, 'glyphs.json'), 'utf8'));
-const UI = path.resolve(__dirname, '../../../ui');
-const OUT = path.join(UI, 'public');
-
-// ---- palette (vk loader tile + app.css board tokens) ------------------------
-const FACE = '#D9B978', BORDER = '#B49559', GLYPH = '#1A1A1A';
-const BOARD_DARK = '#2a3330', TEXT = '#e7ece8', TEXT_MUTED = '#cdd6cf';
-
-// ---- glyph outlines -> SVG path data ----------------------------------------
-const r2 = n => Math.round(n * 100) / 100;
-// pathD renders one glyph's contours scaled by sc and translated by (tx, ty).
-function pathD(g, sc, tx, ty) {
-  const pt = (v, d) => `${r2(v[0] * sc + tx + d[0] * sc)} ${r2(v[1] * sc + ty + d[1] * sc)}`;
-  const Z = [0, 0];
-  return g.contours.map(ct => {
-    const n = ct.v.length;
-    let d = `M${pt(ct.v[0], Z)}`;
-    for (let k = 1; k <= n; k++) {
-      const a = k - 1, b = k % n;
-      d += `C${pt(ct.v[a], ct.o[a])} ${pt(ct.v[b], ct.i[b])} ${pt(ct.v[b], Z)}`;
-    }
-    return d + 'Z';
-  }).join('');
-}
-// glyphAt centres a glyph's bbox at (cx, cy) with the given pixel cap height, the
-// same placement rule as the vk loader's glyph(). stroke fattens it slightly.
-function glyphAt(ch, capPx, cx, cy, stroke, colour) {
-  const g = G.glyphs[ch], sc = capPx / g.bbox.h;
-  const d = pathD(g, sc, cx - (g.bbox.x + g.bbox.w / 2) * sc, cy - (g.bbox.y + g.bbox.h / 2) * sc);
-  return `<path d="${d}" fill="${colour}" stroke="${colour}" stroke-width="${r2(stroke)}"/>`;
-}
-// textLine lays out a string on a baseline from the per-glyph advances; capPx sets
-// the capital height (measured on «Э»). Returns the combined path + the width.
-function textLine(str, capPx, x, y, colour) {
-  const sc = capPx / G.glyphs['Э'].bbox.h;
-  let d = '', w = 0;
-  for (const ch of str) {
-    const g = G.glyphs[ch];
-    if (g.contours.length) d += pathD(g, sc, x + w, y);
-    w += g.adv * sc;
-  }
-  return { svg: `<path d="${d}" fill="${colour}"/>`, width: w };
-}
-// tile draws the rounded wooden tile centred at (cx, cy): size px wide/high, with
-// the vk loader's corner (6/52) and rim proportions, «Э» and optionally the «8».
-function tile(cx, cy, size, withScore) {
-  const h = size / 2, rx = size * (6 / 52), rim = size * (1.8 / 52);
-  let s = `<rect x="${r2(cx - h + rim / 2)}" y="${r2(cy - h + rim / 2)}" width="${r2(size - rim)}" height="${r2(size - rim)}" rx="${r2(rx)}" fill="${FACE}" stroke="${BORDER}" stroke-width="${r2(rim)}"/>`;
-  s += glyphAt('Э', size * (32 / 52), cx, cy - size * (1 / 52), size * (1 / 52), GLYPH);
-  if (withScore) s += glyphAt('8', size * (8.5 / 52), cx + size * (19.5 / 52), cy + size * (18.5 / 52), size * (0.5 / 52), GLYPH);
-  return s;
-}
-const svg = (w, h, body) => `<svg xmlns="http://www.w3.org/2000/svg" width="${w}" height="${h}" viewBox="0 0 ${w} ${h}">${body}</svg>`;
-
-// ---- favicon.svg (the committed vector master) -------------------------------
-const favicon = svg(96, 96, tile(48, 48, 88, false)) + '\n';
-
-// ---- apple-touch-icon: opaque full bleed, iOS applies its own corner mask ----
-const appleTouch = svg(180, 180,
-  `<rect width="180" height="180" fill="${FACE}"/>` +
-  `<rect x="8" y="8" width="164" height="164" rx="18" fill="none" stroke="${BORDER}" stroke-width="4"/>` +
-  glyphAt('Э', 100, 90, 88, 3, GLYPH) +
-  glyphAt('8', 26, 146, 142, 1.5, GLYPH));
-
-// ---- og-image: tile + wordmark, centred as one group on the board green ------
-function ogImage() {
-  const W = 1200, H = 630, tileSize = 340, gap = 84;
-  const l1 = textLine('Эрудит', 112, 0, 0, TEXT);
-  const l2 = textLine('Скрэббл — игра в слова', 44, 0, 0, TEXT_MUTED);
-  const textW = Math.max(l1.width, l2.width);
-  const left = (W - (tileSize + gap + textW)) / 2;
-  const tx = left + tileSize + gap;
-  // Two baselines around the vertical centre; the tile centre sits between them.
-  const b1 = 295, b2 = 408;
-  const body =
-    `<rect width="${W}" height="${H}" fill="${BOARD_DARK}"/>` +
-    tile(left + tileSize / 2, H / 2, tileSize, true) +
-    textLine('Эрудит', 112, tx, b1, TEXT).svg +
-    textLine('Скрэббл — игра в слова', 44, tx, b2, TEXT_MUTED).svg;
-  console.log(`og-image: text ${Math.round(textW)}px wide, group left ${Math.round(left)}px`);
-  return svg(W, H, body);
-}
-
-// ---- rasterisation (Playwright chromium from ui/node_modules) ----------------
-async function shoot(page, markup, w, h, transparent) {
-  await page.setViewportSize({ width: w, height: h });
-  await page.setContent(`<body style="margin:0">${markup}</body>`);
-  return page.screenshot({ omitBackground: transparent });
-}
-// icoFromPNG wraps one PNG as a single-entry .ico (ICONDIR + ICONDIRENTRY + PNG).
-function icoFromPNG(png, sizePx) {
-  const h = Buffer.alloc(22);
-  h.writeUInt16LE(0, 0); h.writeUInt16LE(1, 2); h.writeUInt16LE(1, 4); // icon, 1 image
-  h.writeUInt8(sizePx, 6); h.writeUInt8(sizePx, 7);                    // 32x32
-  h.writeUInt16LE(1, 10); h.writeUInt16LE(32, 12);                     // planes, 32bpp
-  h.writeUInt32LE(png.length, 14); h.writeUInt32LE(22, 18);            // size, offset
-  return Buffer.concat([h, png]);
-}
-
-(async () => {
-  fs.writeFileSync(path.join(OUT, 'favicon.svg'), favicon);
-  const { chromium } = require(path.join(UI, 'node_modules', '@playwright/test'));
-  const browser = await chromium.launch();
-  const page = await browser.newPage();
-  const fav32 = await shoot(page, svg(32, 32, tile(16, 16, 29.33, false)), 32, 32, true);
-  fs.writeFileSync(path.join(OUT, 'favicon.ico'), icoFromPNG(fav32, 32));
-  fs.writeFileSync(path.join(OUT, 'apple-touch-icon.png'), await shoot(page, appleTouch, 180, 180, false));
-  fs.writeFileSync(path.join(OUT, 'og-image.png'), await shoot(page, ogImage(), 1200, 630, false));
-  await browser.close();
-  for (const f of ['favicon.svg', 'favicon.ico', 'apple-touch-icon.png', 'og-image.png']) {
-    console.log('wrote', path.join(OUT, f), fs.statSync(path.join(OUT, f)).size, 'bytes');
-  }
-})();

backend/README.md

@@ -100,10 +100,7 @@ state, lobby enqueue, chat). The social/account/history operations under
 `/api/v1/user`: `friends/*` (request/respond/cancel/unfriend,
 list/incoming, the one-time `code` issue/redeem), `blocks/*`, `invitations/*`
 (create/accept/decline/cancel/list), `PUT profile`, `email/{request,confirm}`,
-`stats`, `games/:id/gcg` (finished-only), and the payments `wallet` /
-`wallet/catalog` (`GET` — the context-visible chip segments + benefits, and the
-storefront catalog) / `wallet/buy` (`POST` — a chip spend on a value), served by
-`internal/payments` behind the store-compliance gate. The `internal/notify` hub feeds a
+`stats`, and `games/:id/gcg` (finished-only). The `internal/notify` hub feeds a
 second listener — `internal/pushgrpc`, a gRPC server (`BACKEND_GRPC_ADDR`) streaming
 live events (your-turn, opponent-moved, chat, nudge, match-found, notify) to the
 gateway. The gateway-only `POST /api/v1/internal/push-target` (a user's
@@ -217,13 +214,11 @@ internal/banview/    # gateway active-ban mirror: the console's Active IP bans p
 | `BACKEND_LOBBY_ROBOT_WAIT` | `10s` | Auto-match wait before a robot is substituted for a missing human. |
 | `BACKEND_LOBBY_REAPER_INTERVAL` | `1s` | How often the substitution reaper scans for over-waited players. |
 | `BACKEND_ROBOT_DRIVE_INTERVAL` | `30s` | How often the robot driver scans for due robot turns. |
-| `BACKEND_SMTP_HOST` | — | Confirm-code relay host. **Empty selects the development log mailer** (the code is logged, not sent). |
-| `BACKEND_SMTP_PORT` | `587` | Relay port. No client certificate is needed (the server cert is validated against the system roots). |
-| `BACKEND_SMTP_TLS` | — | Transport security: `ssl` (implicit TLS from connect) or `starttls`. Empty derives it from the port (implicit on `465`, STARTTLS otherwise); set it for a relay on a non-standard port (e.g. Selectel's `1127` = SSL, `1126` = STARTTLS). |
-| `BACKEND_SMTP_USERNAME` | — | SMTP AUTH user; empty relays without authentication. |
-| `BACKEND_SMTP_PASSWORD` | — | SMTP AUTH password. |
-| `BACKEND_SMTP_FROM` | `no-reply@localhost` | From address. A deployed contour must use the prod domain (the relay only accepts its verified sender domain). |
-| `BACKEND_PUBLIC_BASE_URL` | — | Canonical public origin (scheme + host) for links in the email. **Required when `BACKEND_SMTP_HOST` is set.** Never derived from a request Host header (anti-injection). |
+| `BACKEND_SMTP_HOST` | — | Email relay host. **Empty selects the development log mailer** (the confirm-code is logged, not sent). |
+| `BACKEND_SMTP_PORT` | `587` | Email relay port. |
+| `BACKEND_SMTP_USERNAME` | — | SMTP user; empty relays without authentication. |
+| `BACKEND_SMTP_PASSWORD` | — | SMTP password. |
+| `BACKEND_SMTP_FROM` | `no-reply@localhost` | Envelope/From address for confirm-codes. |
 | `BACKEND_CONNECTOR_ADDR` | — | the gateway bot-link relay gRPC address for admin-console operator broadcasts. Empty disables broadcasts. |
 | `BACKEND_GUEST_REAP_INTERVAL` | `1h` | How often the abandoned-guest reaper sweeps. |
 | `BACKEND_GUEST_RETENTION` | `720h` | Account age past which a guest with no game seat is deleted. |

backend/cmd/backend/main.go

@@ -20,7 +20,6 @@ import (
 
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/accountmerge"
-	"scrabble/backend/internal/adminalert"
 	"scrabble/backend/internal/ads"
 	"scrabble/backend/internal/banview"
 	"scrabble/backend/internal/config"
@@ -31,11 +30,9 @@ import (
 	"scrabble/backend/internal/link"
 	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/notify"
-	"scrabble/backend/internal/payments"
 	"scrabble/backend/internal/postgres"
 	"scrabble/backend/internal/pushgrpc"
 	"scrabble/backend/internal/ratewatch"
-	"scrabble/backend/internal/render"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/server"
 	"scrabble/backend/internal/session"
@@ -46,10 +43,6 @@ import (
 // telemetryShutdownTimeout bounds the OpenTelemetry flush during process exit.
 const telemetryShutdownTimeout = 5 * time.Second
 
-// adminAlertInterval is how often the operator-alert worker checks for new feedback /
-// complaints; a burst within one interval coalesces into a single digest email.
-const adminAlertInterval = 5 * time.Minute
-
 func main() {
 	cfg, err := config.Load()
 	if err != nil {
@@ -168,15 +161,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		zap.Duration("interval", cfg.GuestReapInterval),
 		zap.Duration("retention", cfg.GuestRetention))
 
-	// Purge the account-deletion legal dossier past its retention TTL: the
-	// retained-identities journal, and the feedback thread + dossier PII of long-deleted
-	// accounts (chat is kept). Checked daily; the TTL is a two-year policy constant.
-	retentionReaper := account.NewRetentionReaper(accounts, account.RetentionTTL, logger)
-	go retentionReaper.Run(ctx, 24*time.Hour)
-	logger.Info("retention reaper started",
-		zap.Duration("interval", 24*time.Hour),
-		zap.Duration("retention", account.RetentionTTL))
-
 	// Re-evaluate moderated-chat write access when a temporary block self-expires:
 	// no operator action fires then, so the sweeper emits the chat-access-changed
 	// event for lapsed blocks and the gateway re-pushes the chat-gate command.
@@ -189,14 +173,10 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	// Lobby & social domains. Their REST and stream surface lives in the gateway,
 	// so they are handed to the server (like the route groups) for the handlers.
 	mailer := newMailer(cfg.SMTP, logger)
-	emails := account.NewEmailService(accounts, mailer, cfg.PublicBaseURL)
-	// Throttle confirm-code sends per recipient: at most one per minute and five per
-	// rolling hour, guarding against email bombing and the relay's own quota.
-	emails.SetSendLimiter(account.NewSendLimiter(time.Minute, 5))
+	emails := account.NewEmailService(accounts, mailer)
 	// Account linking & merge: the orchestrator over the account, merge and
 	// session layers. Wired to the /api/v1/user/link REST surface below.
-	merger := accountmerge.NewMerger(db)
-	links := link.NewService(emails, accounts, merger, sessions)
+	links := link.NewService(emails, accounts, accountmerge.NewMerger(db), sessions)
 	socialSvc := social.NewService(social.NewStore(db), accounts, games)
 	socialSvc.SetNotifier(hub)
 	socialSvc.SetMetrics(tel.MeterProvider().Meter("scrabble/backend/social"))
@@ -214,16 +194,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	feedbackSvc := feedback.NewService(feedback.NewStore(db), accounts)
 	feedbackSvc.SetNotifier(hub)
 
-	// Operator alert emails on new feedback / word complaints, coalesced into one digest
-	// per interval. Inert unless a distinct admin sender and recipient are configured.
-	if cfg.SMTP.AdminFrom != "" && cfg.SMTP.AdminTo != "" {
-		// The alert digest carries no admin-console link on purpose — an admin URL must not
-		// travel in an email (a mail provider could cache or index it); see adminalert.New.
-		alerts := adminalert.New(mailer, feedbackSvc, games, cfg.SMTP.AdminFrom, cfg.SMTP.AdminTo, logger)
-		go alerts.Run(ctx, adminAlertInterval)
-		logger.Info("admin alert worker started", zap.Duration("interval", adminAlertInterval))
-	}
-
 	// Robot opponent: provision its durable account pool (a hard startup
 	// dependency, like the dictionaries) and start its move driver. The matchmaker
 	// substitutes a pooled robot for a missing human after the wait window.
@@ -262,28 +232,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	// block and the banner admin console section.
 	adsSvc := ads.NewService(ads.NewStore(db))
 
-	// In-game currency domain (data foundation): the payments schema behind a
-	// narrow interface. A boot-time reachability check fails fast if the schema
-	// did not migrate; the wallet routes are registered when that surface lands.
-	paymentsSvc := payments.NewService(payments.NewStore(db))
-	if err := paymentsSvc.Ping(ctx); err != nil {
-		return fmt.Errorf("payments schema unreachable: %w", err)
-	}
-	logger.Info("payments domain ready")
-
-	// Wire the payments surface into the domains that consume it: the online-game hint wallet
-	// and the account-merge wallet fold. Done after the reachability check so a broken payments
-	// schema fails boot before anything depends on it.
-	games.SetHintWallet(paymentsSvc)
-	merger.SetPayments(paymentsSvc)
-
-	// The image-render sidecar client for the PNG export artifact; nil (PNG
-	// download answers 404) when BACKEND_RENDERER_URL is unset.
-	var renderer *render.Client
-	if cfg.RendererURL != "" {
-		renderer = render.New(cfg.RendererURL)
-	}
-
 	srv := server.New(cfg.HTTPAddr, server.Deps{
 		Logger:        logger,
 		DB:            db,
@@ -304,10 +252,7 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		RateWatch:     rateWatch,
 		BanView:       banView,
 		Ads:           adsSvc,
-		Payments:      paymentsSvc,
 		Notifier:      hub,
-		ExportSignKey: cfg.ExportSignKey,
-		Renderer:      renderer,
 	})
 	pushSrv := pushgrpc.NewServer(cfg.GRPCAddr, hub, logger)
 

backend/cmd/jetgen/main.go

@@ -9,8 +9,7 @@
 //  1. start a postgres:17-alpine container via testcontainers-go
 //  2. open it with search_path=backend and apply the embedded goose migrations
 //  3. drop goose's bookkeeping table so jet does not generate a model for it
-//  4. run jet's PostgreSQL generator for the backend and payments schemas into
-//     internal/postgres/jet (one subdirectory per schema)
+//  4. run jet's PostgreSQL generator for schema=backend into internal/postgres/jet
 package main
 
 import (
@@ -37,7 +36,6 @@ const (
 	superuserPassword  = "scrabble"
 	superuserDatabase  = "scrabble_backend"
 	backendSchema      = "backend"
-	paymentsSchema     = "payments"
 	containerStartup   = 90 * time.Second
 	jetOutputDirSuffix = "internal/postgres/jet"
 )
@@ -107,16 +105,11 @@ func run(ctx context.Context) error {
 		return fmt.Errorf("drop goose_db_version: %w", err)
 	}
 
-	// Each schema generates into its own jet/<schema>/ subdirectory (the
-	// generator wipes only that subtree), so the two calls do not clobber each
-	// other. GenerateDB takes the schema explicitly, so the connection's
-	// search_path=backend does not affect the payments introspection.
-	for _, schema := range []string{backendSchema, paymentsSchema} {
-		if err := jetpostgres.GenerateDB(db, schema, outputDir); err != nil {
-			return fmt.Errorf("jet generate schema=%s: %w", schema, err)
-		}
-		log.Printf("jetgen: generated jet code into %s (schema=%s)", outputDir, schema)
+	if err := jetpostgres.GenerateDB(db, backendSchema, outputDir); err != nil {
+		return fmt.Errorf("jet generate: %w", err)
 	}
+
+	log.Printf("jetgen: generated jet code into %s (schema=%s)", outputDir, backendSchema)
 	return nil
 }
 

backend/cmd/movegen/main.go

@@ -1,417 +0,0 @@
-// Command movegen emits golden conformance fixtures for the client-side move
-// generator port (ui/src/lib/dict). It is a dev tool, run by hand; its output is
-// committed so the TypeScript parity tests run without a Go toolchain.
-//
-// For each small sample dictionary (English and Russian — the latter reaches
-// alphabet index 32, exercising the 33-letter cross-set boundary) it writes:
-//
-//   - sample_<tag>.dawg           the serialized dictionary (the reader/cursor fixture)
-//   - sample_<tag>.words.json     the stored words + their alphabet indexes
-//   - sample_<tag>.gen.json       ranked move-generation results from the real solver,
-//     for a handful of positions, plus the ruleset the TS
-//     side rebuilds to score identically
-//
-// Positions are built with only the solver's public API: an empty board, and
-// two-ply positions reached by applying the solver's own top move (so no internal
-// encoding is needed). Regenerate with:
-//
-//	go run ./backend/cmd/movegen -out ui/src/lib/dict/testdata
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"flag"
-	"log"
-	"os"
-	"path/filepath"
-	"strings"
-
-	"gitea.iliadenisov.ru/developer/scrabble-solver/board"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rack"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rules"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/scrabble"
-	dawg "github.com/iliadenisov/dafsa"
-)
-
-// sampleWordsEN is the English sample dictionary, in strictly increasing
-// alphabet-index order (the builder requires it). Shared prefixes (car/care/cars),
-// shared suffixes (cats/dogs), internal-final nodes (do, an) and a one-letter word.
-var sampleWordsEN = []string{
-	"a", "an", "and", "ant",
-	"car", "care", "cared", "cares", "cars", "cat", "cats",
-	"do", "doe", "does", "dog", "dogs", "done", "dot",
-}
-
-// sampleWordsRU is the Russian sample dictionary, in strictly increasing index
-// order. It deliberately includes words starting with я (index 32) so the ported
-// cross-set handles alphabet indexes past JS's 31-bit shift boundary.
-var sampleWordsRU = []string{"ад", "ар", "оса", "я", "яд", "яр"}
-
-// sampleFixture is the JSON committed with the .dawg so the TypeScript cursor test
-// knows the exact word set (as alphabet indexes) to expect from enumeration.
-type sampleFixture struct {
-	Alphabet string   `json:"alphabet"`
-	NumAdded int      `json:"numAdded"`
-	Words    []string `json:"words"`
-	Indexes  [][]int  `json:"indexes"`
-}
-
-// genFixture is the move-generation golden set for one sample dictionary.
-type genFixture struct {
-	Ruleset genRuleset `json:"ruleset"`
-	Cases   []genCase  `json:"cases"`
-}
-
-// genRuleset is the scoring data the TS side rebuilds so evaluate() matches the Go
-// solver: letter values, premium multipliers per square, the centre, rack size and bonus.
-type genRuleset struct {
-	Size       int     `json:"size"`
-	Cols       int     `json:"cols"`
-	Center     int     `json:"center"`
-	RackSize   int     `json:"rackSize"`
-	Bingo      int     `json:"bingo"`
-	Values     []int   `json:"values"`
-	LetterMult [][]int `json:"letterMult"`
-	WordMult   [][]int `json:"wordMult"`
-}
-
-// genTile is one placed tile (a board tile or a move placement).
-type genTile struct {
-	Row    int  `json:"row"`
-	Col    int  `json:"col"`
-	Letter int  `json:"letter"`
-	Blank  bool `json:"blank"`
-}
-
-// genRack is a rack as a multiset of letter indexes plus a blank count.
-type genRack struct {
-	Letters []int `json:"letters"`
-	Blanks  int   `json:"blanks"`
-}
-
-// genMove is one ranked generated play: its orientation, placed tiles and total score.
-type genMove struct {
-	Dir   int       `json:"dir"`
-	Tiles []genTile `json:"tiles"`
-	Score int       `json:"score"`
-}
-
-// genCase is one generation position: the tiles already on the board (empty when
-// none), the rack, the mode/rule and the ranked moves the solver returns.
-type genCase struct {
-	Name             string    `json:"name"`
-	Placed           []genTile `json:"placed"`
-	Rack             genRack   `json:"rack"`
-	Mode             int       `json:"mode"`
-	IgnoreCrossWords bool      `json:"ignoreCrossWords"`
-	Moves            []genMove `json:"moves"`
-}
-
-func main() {
-	out := flag.String("out", "ui/src/lib/dict/testdata", "output directory for fixtures")
-	dawgDir := flag.String("dawg-dir", "", "when set, emit real-dictionary move-gen golden from the .dawg files in this dir (conformance mode) instead of the committed samples")
-	flag.Parse()
-
-	if err := os.MkdirAll(*out, 0o755); err != nil {
-		log.Fatalf("movegen: mkdir %s: %v", *out, err)
-	}
-
-	if *dawgDir != "" {
-		buildReal(*dawgDir, *out)
-		return
-	}
-
-	emitRulesets()
-
-	buildSample(*out, "en", rules.English(), sampleWordsEN, []genCase{
-		emptyCase("empty-cared", englishRack("caredts", 0), scrabble.Both, false),
-		emptyCase("empty-dogs", englishRack("dogsent", 0), scrabble.Both, false),
-		emptyCase("empty-blank", englishRack("caret", 1), scrabble.Both, false),
-		emptyCase("empty-single-word", englishRack("caredts", 0), scrabble.Both, true),
-	})
-
-	buildSample(*out, "ru", rules.RussianScrabble(), sampleWordsRU, []genCase{
-		emptyCase("empty-yad", russianRack("ядрасо", 0), scrabble.Both, false),
-	})
-}
-
-// buildSample writes the dawg, the word fixture and the generation golden set for
-// one sample dictionary. Two-ply cases are appended: the solver's own top move from
-// the first non-empty result is applied, then generation runs again on the new rack.
-func buildSample(out, tag string, rs *rules.Ruleset, words []string, cases []genCase) {
-	idx := rs.Alphabet
-	b := dawg.New(idx)
-	indexes := make([][]int, 0, len(words))
-	for _, w := range words {
-		if err := b.Add(w); err != nil {
-			log.Fatalf("movegen[%s]: add %q: %v", tag, w, err)
-		}
-		enc, err := idx.Encode(w)
-		if err != nil {
-			log.Fatalf("movegen[%s]: encode %q: %v", tag, w, err)
-		}
-		ints := make([]int, len(enc))
-		for i, x := range enc {
-			ints[i] = int(x)
-		}
-		indexes = append(indexes, ints)
-	}
-	finder := b.Finish()
-
-	writeJSON(filepath.Join(out, "sample_"+tag+".words.json"), sampleFixture{
-		Alphabet: tag, NumAdded: finder.NumAdded(), Words: words, Indexes: indexes,
-	})
-	dawgPath := filepath.Join(out, "sample_"+tag+".dawg")
-	if _, err := finder.Save(dawgPath); err != nil {
-		log.Fatalf("movegen[%s]: save %s: %v", tag, dawgPath, err)
-	}
-
-	s := scrabble.NewSolver(rs, finder)
-	for i := range cases {
-		runCase(s, rs, &cases[i], nil)
-	}
-	// A two-ply position from the first standard case that produced a move.
-	if two := twoPly(s, rs, cases); two != nil {
-		cases = append(cases, *two)
-	}
-
-	writeJSON(filepath.Join(out, "sample_"+tag+".gen.json"), genFixture{
-		Ruleset: rulesetOf(rs), Cases: cases,
-	})
-	log.Printf("movegen[%s]: %d words, %d cases", tag, finder.NumAdded(), len(cases))
-}
-
-// realVariant maps a shipped dictionary file to the ruleset that scores it and the racks
-// the conformance positions use. smallRack/blankRack keep the first-move (empty board)
-// lists bounded on a dense dictionary; fullRack drives a deep 7-tile mid-game position,
-// kept small by the anchors around the already-placed word.
-type realVariant struct {
-	file, variant, smallRack, blankRack, fullRack string
-	rs                                            *rules.Ruleset
-}
-
-// buildReal emits move-generation golden from the real shipped dictionaries in dawgDir —
-// the full alphabets and deep graphs the tiny samples cannot reach — one
-// <variant>.movegen.json per variant. Like the dictgen/validategen vectors it is
-// regenerated in CI and never committed, so it pins no dictionary version into the repo.
-func buildReal(dawgDir, out string) {
-	reals := []realVariant{
-		{"en_sowpods", "scrabble_en", "aine", "ain", "aeinrst", rules.English()},
-		{"ru_scrabble", "scrabble_ru", "аеин", "аен", "аеиноср", rules.RussianScrabble()},
-		{"ru_erudit", "erudit_ru", "аеин", "аен", "аеиноср", rules.Erudit()},
-	}
-	for _, v := range reals {
-		data, err := os.ReadFile(filepath.Join(dawgDir, v.file+".dawg"))
-		if err != nil {
-			log.Fatalf("movegen[%s]: read dawg: %v", v.variant, err)
-		}
-		finder, err := dawg.Read(bytes.NewReader(data), 0)
-		if err != nil {
-			log.Fatalf("movegen[%s]: parse dawg: %v", v.variant, err)
-		}
-		s := scrabble.NewSolver(v.rs, finder)
-
-		cases := []genCase{
-			emptyCase("first-move", encRack(v.rs, v.smallRack, 0), scrabble.Both, false),
-			emptyCase("first-move-blank", encRack(v.rs, v.blankRack, 1), scrabble.Both, false),
-		}
-		for i := range cases {
-			runCase(s, v.rs, &cases[i], nil)
-		}
-		// A deep 7-tile mid-game: place the top first move, then generate again. The
-		// anchors around the placed word bound the list while still exercising a full rack,
-		// deep left/right extension and wide cross-sets over the real graph.
-		full := encRack(v.rs, v.fullRack, 0)
-		b := board.New(v.rs.Rows, v.rs.Cols)
-		if m1 := s.GenerateMovesOpts(b, toRack(v.rs.Size(), full), scrabble.Both, scrabble.PlayOptions{}); len(m1) > 0 {
-			mid := genCase{Name: "mid-game", Rack: full, Mode: int(scrabble.Both)}
-			runCase(s, v.rs, &mid, tilesOf(m1[0].Tiles))
-			cases = append(cases, mid)
-		}
-
-		writeJSON(filepath.Join(out, v.variant+".movegen.json"), genFixture{Ruleset: rulesetOf(v.rs), Cases: cases})
-		total := 0
-		for _, c := range cases {
-			total += len(c.Moves)
-		}
-		_ = finder.Close()
-		log.Printf("movegen[%s]: %d cases, %d golden moves", v.variant, len(cases), total)
-	}
-}
-
-// encRack encodes a rack given as the variant's letters (plus a blank count) into the
-// index-based genRack the fixtures carry.
-func encRack(rs *rules.Ruleset, letters string, blanks int) genRack {
-	enc, err := rs.Alphabet.Encode(letters)
-	if err != nil {
-		log.Fatalf("movegen: encode rack %q: %v", letters, err)
-	}
-	idx := make([]int, len(enc))
-	for i, b := range enc {
-		idx[i] = int(b)
-	}
-	return genRack{Letters: idx, Blanks: blanks}
-}
-
-// runCase fills a case's Moves by generating on a board holding the given placed
-// tiles (nil = empty board).
-func runCase(s *scrabble.Solver, rs *rules.Ruleset, c *genCase, placed []genTile) {
-	bd := board.New(rs.Rows, rs.Cols)
-	for _, t := range placed {
-		bd.Set(t.Row, t.Col, cellByte(t.Letter, t.Blank))
-	}
-	c.Placed = placed
-	rk := toRack(rs.Size(), c.Rack)
-	moves := s.GenerateMovesOpts(bd, rk, scrabble.Mode(c.Mode), scrabble.PlayOptions{IgnoreCrossWords: c.IgnoreCrossWords})
-	c.Moves = movesOf(moves)
-}
-
-// twoPly reaches a mid-game position by applying the top move of the first standard
-// case that generated one, then generates again with a fresh rack of the same tiles.
-func twoPly(s *scrabble.Solver, rs *rules.Ruleset, cases []genCase) *genCase {
-	for _, c := range cases {
-		if c.IgnoreCrossWords || len(c.Moves) == 0 {
-			continue
-		}
-		placed := c.Moves[0].Tiles
-		next := genCase{Name: "two-ply", Rack: c.Rack, Mode: int(scrabble.Both)}
-		runCase(s, rs, &next, placed)
-		return &next
-	}
-	return nil
-}
-
-// cellByte encodes a board cell the way internal/encoding.Cell does (bits 0-5 hold
-// letter+1, bit 7 marks a blank). Duplicated here because that package is internal
-// to the solver module and cannot be imported.
-func cellByte(letter int, blank bool) byte {
-	v := byte(letter+1) & 0x3f
-	if blank {
-		v |= 0x80
-	}
-	return v
-}
-
-func toRack(size int, r genRack) rack.Rack {
-	rk := rack.New(size)
-	for _, l := range r.Letters {
-		rk.Add(byte(l))
-	}
-	for i := 0; i < r.Blanks; i++ {
-		rk.AddBlank()
-	}
-	return rk
-}
-
-func rulesetOf(rs *rules.Ruleset) genRuleset {
-	lm := make([][]int, rs.Rows)
-	wm := make([][]int, rs.Rows)
-	for r := 0; r < rs.Rows; r++ {
-		lm[r] = make([]int, rs.Cols)
-		wm[r] = make([]int, rs.Cols)
-		for c := 0; c < rs.Cols; c++ {
-			p := rs.Premium(r, c)
-			lm[r][c] = p.LetterMult()
-			wm[r][c] = p.WordMult()
-		}
-	}
-	return genRuleset{
-		Size: rs.Size(), Cols: rs.Cols, Center: rs.Center, RackSize: rs.RackSize,
-		Bingo: rs.Bingo, Values: rs.Values, LetterMult: lm, WordMult: wm,
-	}
-}
-
-func movesOf(ms []scrabble.Move) []genMove {
-	out := make([]genMove, len(ms))
-	for i, m := range ms {
-		out[i] = genMove{Dir: int(m.Dir), Tiles: tilesOf(m.Tiles), Score: m.Score}
-	}
-	return out
-}
-
-func tilesOf(ps []scrabble.Placement) []genTile {
-	out := make([]genTile, len(ps))
-	for i, p := range ps {
-		out[i] = genTile{Row: p.Row, Col: p.Col, Letter: int(p.Letter), Blank: p.Blank}
-	}
-	return out
-}
-
-// emptyCase builds an empty-board case (Moves filled later by runCase).
-func emptyCase(name string, r genRack, mode scrabble.Mode, ignoreCross bool) genCase {
-	return genCase{Name: name, Rack: r, Mode: int(mode), IgnoreCrossWords: ignoreCross}
-}
-
-// englishRack builds a rack from lowercase a-z letters (index = letter-'a').
-func englishRack(letters string, blanks int) genRack {
-	idx := make([]int, 0, len(letters))
-	for _, ch := range letters {
-		idx = append(idx, int(ch-'a'))
-	}
-	return genRack{Letters: idx, Blanks: blanks}
-}
-
-// russianRack builds a rack from the Russian sample letters used above.
-func russianRack(letters string, blanks int) genRack {
-	m := map[rune]int{'а': 0, 'д': 4, 'о': 15, 'р': 17, 'с': 18, 'я': 32}
-	idx := make([]int, 0, len([]rune(letters)))
-	for _, ch := range letters {
-		i, ok := m[ch]
-		if !ok {
-			log.Fatalf("movegen: russianRack: no index for %q", string(ch))
-		}
-		idx = append(idx, i)
-	}
-	return genRack{Letters: idx, Blanks: blanks}
-}
-
-// emitRulesets writes the per-variant static ruleset data (tile values, bag counts, blanks,
-// bingo, rack size) the offline engine mirrors in ui/src/lib/localgame/ruleset.ts, so a TS
-// parity test can pin that hand-copied table to the Go rulesets (scrabble-solver/rules).
-func emitRulesets() {
-	type rsFix struct {
-		Size     int      `json:"size"`
-		RackSize int      `json:"rackSize"`
-		Bingo    int      `json:"bingo"`
-		Blanks   int      `json:"blanks"`
-		Values   []int    `json:"values"`
-		Counts   []int    `json:"counts"`
-		Letters  []string `json:"letters"`
-	}
-	out := map[string]rsFix{}
-	for _, v := range []struct {
-		name string
-		rs   *rules.Ruleset
-	}{
-		{"scrabble_en", rules.English()},
-		{"scrabble_ru", rules.RussianScrabble()},
-		{"erudit_ru", rules.Erudit()},
-	} {
-		letters := make([]string, v.rs.Size())
-		for i := range letters {
-			ch, err := v.rs.Alphabet.Character(byte(i))
-			if err != nil {
-				log.Fatalf("movegen: %s letter %d: %v", v.name, i, err)
-			}
-			letters[i] = strings.ToUpper(ch)
-		}
-		out[v.name] = rsFix{Size: v.rs.Size(), RackSize: v.rs.RackSize, Bingo: v.rs.Bingo, Blanks: v.rs.Blanks, Values: v.rs.Values, Counts: v.rs.Counts, Letters: letters}
-	}
-	dir := filepath.Join("ui", "src", "lib", "localgame", "testdata")
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		log.Fatalf("movegen: mkdir %s: %v", dir, err)
-	}
-	writeJSON(filepath.Join(dir, "rulesets.json"), out)
-	log.Printf("movegen: wrote %s (3 variants)", filepath.Join(dir, "rulesets.json"))
-}
-
-func writeJSON(path string, v any) {
-	data, err := json.MarshalIndent(v, "", "  ")
-	if err != nil {
-		log.Fatalf("movegen: marshal %s: %v", path, err)
-	}
-	if err := os.WriteFile(path, append(data, '\n'), 0o644); err != nil {
-		log.Fatalf("movegen: write %s: %v", path, err)
-	}
-}

backend/go.mod

@@ -13,7 +13,6 @@ require (
 	github.com/pressly/goose/v3 v3.27.1
 	github.com/testcontainers/testcontainers-go v0.42.0
 	github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0
-	github.com/wneessen/go-mail v0.7.3
 	go.opentelemetry.io/otel v1.43.0
 	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0
@@ -110,7 +109,7 @@ require (
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

backend/go.sum

@@ -279,8 +279,6 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
 github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
-github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
-github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
@@ -402,8 +400,6 @@ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
 golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=

backend/internal/account/account.go

@@ -121,44 +121,13 @@ func (s *Store) ProvisionByIdentity(ctx context.Context, kind, externalID string
 }
 
 // ProvisionEmail returns the account owning the email identity externalID, creating
-// it on first contact with browserTZ — the client's detected "±HH:MM" UTC offset —
-// seeded into its time zone, language seeded from the client's UI language, and its
-// display name seeded from the email's local part (so it is not left nameless). Like
-// ProvisionByIdentity it is race-safe and leaves an existing account untouched, so a
-// returning user's saved zone, language and name are never overwritten. The email account is
-// created here (the code-request step), not at the later login, so this is where its
-// zone and language are seeded. It is created flagged is_guest with an unconfirmed
-// email identity: an abandoned, never-confirmed login is then reaped like any guest,
-// freeing the reserved address, and confirming the code clears the guest flag.
-func (s *Store) ProvisionEmail(ctx context.Context, externalID, browserTZ, language string) (Account, error) {
-	return s.provision(ctx, KindEmail, externalID, provisionSeed{
-		displayName:       emailDisplayName(externalID),
-		timeZone:          seedZone(browserTZ),
-		preferredLanguage: supportedLanguage(language),
-		isGuest:           true,
-	})
-}
-
-// emailDisplayName derives a display name from an email address — the local part
-// before '@', trimmed and capped to the column width — so a new email account is not
-// left nameless. It is only the first-contact seed; the user can rename it later.
-func emailDisplayName(email string) string {
-	local, _, _ := strings.Cut(email, "@")
-	local = strings.TrimSpace(local)
-	if r := []rune(local); len(r) > maxDisplayName {
-		local = strings.TrimRight(string(r[:maxDisplayName]), " ")
-	}
-	return local
-}
-
-// supportedLanguage returns code normalised to a supported UI language ("en" or
-// "ru"), or "" when it maps to neither, so a new account keeps the 'en' default. It
-// accepts region-tagged codes ("ru-RU").
-func supportedLanguage(code string) string {
-	if lang, _, _ := strings.Cut(strings.ToLower(strings.TrimSpace(code)), "-"); lang == "en" || lang == "ru" {
-		return lang
-	}
-	return ""
+// it (unconfirmed) on first contact with browserTZ — the client's detected "±HH:MM"
+// UTC offset — seeded into its time zone. Like ProvisionByIdentity it is race-safe
+// and leaves an existing account untouched, so a returning user's saved zone is never
+// overwritten. The email account is created here (the code-request step), not at the
+// later login, so this is where its zone is seeded.
+func (s *Store) ProvisionEmail(ctx context.Context, externalID, browserTZ string) (Account, error) {
+	return s.provision(ctx, KindEmail, externalID, provisionSeed{timeZone: seedZone(browserTZ)})
 }
 
 // ProvisionRobot provisions (or finds) the durable account backing a robot pool
@@ -270,11 +239,6 @@ type provisionSeed struct {
 	preferredLanguage string
 	displayName       string
 	timeZone          string
-	// isGuest creates the account flagged is_guest. It is set for an email-login
-	// account, which stays a guest until the address is confirmed (so an abandoned,
-	// never-confirmed login is reaped and its address freed); confirming clears the
-	// flag. Platform identities (telegram/vk) are durable from creation.
-	isGuest bool
 }
 
 // seedZone returns browserTZ when it is a well-formed zone to persist at account
@@ -483,8 +447,8 @@ func (s *Store) create(ctx context.Context, kind, externalID string, seed provis
 			tz = "UTC"
 		}
 		insertAccount := table.Accounts.
-			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage, table.Accounts.TimeZone, table.Accounts.IsGuest).
-			VALUES(accountID, seed.displayName, lang, tz, seed.isGuest).
+			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage, table.Accounts.TimeZone).
+			VALUES(accountID, seed.displayName, lang, tz).
 			RETURNING(table.Accounts.AllColumns)
 
 		var row model.Accounts

backend/internal/account/email.go

@@ -5,7 +5,6 @@ import (
 	crand "crypto/rand"
 	"crypto/sha256"
 	"database/sql"
-	"encoding/base64"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -27,22 +26,6 @@ const (
 	emailCodeTTL = 15 * time.Minute
 	// emailCodeMaxAttempts caps wrong-code submissions before a code is dead.
 	emailCodeMaxAttempts = 5
-	// linkTokenBytes is the entropy of a confirm deeplink token: 256 bits.
-	linkTokenBytes = 32
-	// emailConfirmPath is the SPA route the one-tap confirm deeplink opens (the token
-	// is appended). The SPA is served under /app/ behind a hash router.
-	emailConfirmPath = "/app/#/confirm/"
-)
-
-// Confirmation purposes recorded on a pending confirm-code row. They select what
-// verifying the code or the deeplink token does: sign in (login), link/confirm the
-// address on the current account (link), or replace the account's confirmed email with
-// a new address (change). Account deletion adds a further purpose in a later stage.
-const (
-	purposeLogin  = "login"
-	purposeLink   = "link"
-	purposeChange = "change"
-	purposeDelete = "delete"
 )
 
 // Errors returned by the email confirm-code flow.
@@ -63,12 +46,6 @@ var (
 	ErrTooManyAttempts = errors.New("account: too many confirmation attempts")
 	// ErrCodeMismatch is returned when the submitted code does not match.
 	ErrCodeMismatch = errors.New("account: confirmation code does not match")
-	// ErrTooManyRequests is returned when confirm-code sends to an address are being
-	// requested too frequently (the resend cooldown or the rolling-hour cap).
-	ErrTooManyRequests = errors.New("account: too many code requests")
-	// ErrNoEmail is returned when an email-code step-up is requested for an account that
-	// holds no confirmed email (the caller must use the typed-phrase path instead).
-	ErrNoEmail = errors.New("account: no confirmed email")
 )
 
 // EmailService runs the email confirm-code flow: it issues a 6-digit code over a
@@ -80,80 +57,12 @@ var (
 type EmailService struct {
 	store  *Store
 	mailer Mailer
-	baseURL string
-	limiter *SendLimiter
 	now    func() time.Time
 }
 
-// NewEmailService constructs an EmailService over store, sending via mailer. baseURL
-// is the canonical public origin (scheme + host) used to build the one-tap confirm
-// deeplink and the email footer landing link; an empty baseURL omits the deeplink
-// (development / log mailer).
-func NewEmailService(store *Store, mailer Mailer, baseURL string) *EmailService {
-	return &EmailService{store: store, mailer: mailer, baseURL: baseURL, now: func() time.Time { return time.Now().UTC() }}
-}
-
-// SetSendLimiter installs a per-recipient send throttle. When unset (nil), sends are
-// not throttled — production wires a limiter; tests leave it off.
-func (s *EmailService) SetSendLimiter(l *SendLimiter) { s.limiter = l }
-
-// allowSend reports whether a confirm-code send to email is permitted now, recording
-// it when so. A nil limiter permits every send.
-func (s *EmailService) allowSend(email string) bool {
-	return s.limiter == nil || s.limiter.Allow(email)
-}
-
-// issueCode generates a fresh confirm-code and one-tap deeplink token for (accountID,
-// email), replaces any prior pending confirmation, and mails the branded code in
-// locale; purpose selects the email wording and what verifying does. omitLink drops the
-// one-tap deeplink from the email (account deletion, or a login requested from an installed
-// PWA). Only the SHA-256 hashes of the code and token are stored.
-func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email, purpose, locale string, omitLink bool) error {
-	code, codeHash, err := generateCode()
-	if err != nil {
-		return err
-	}
-	token, tokenHash, err := generateLinkToken()
-	if err != nil {
-		return err
-	}
-	if err := s.store.replacePendingConfirmation(ctx, accountID, email, codeHash, tokenHash, purpose, s.now().Add(emailCodeTTL)); err != nil {
-		return err
-	}
-	// Omit the one-tap deeplink when asked: for a login from an installed PWA (the link would
-	// open in a separate browser whose minted session cannot reach the PWA), or for account
-	// deletion (a prefetch or stray click must not delete an account — the delete code is entered
-	// in the app only, and ConfirmByToken refuses a delete token).
-	deeplink := s.confirmURL(token, locale)
-	if purpose == purposeDelete || omitLink {
-		deeplink = ""
-	}
-	msg, err := renderConfirmationEmail(purpose, code, deeplink, s.baseURL, locale)
-	if err != nil {
-		return err
-	}
-	msg.To = email
-	return s.mailer.Send(ctx, msg)
-}
-
-// confirmURL builds the absolute one-tap confirm deeplink for token in locale, or ""
-// when no public base URL is configured. The locale rides the fragment as ?lang so the
-// confirm screen (opened in a browser with no session) renders in the email's language.
-func (s *EmailService) confirmURL(token, locale string) string {
-	if s.baseURL == "" {
-		return ""
-	}
-	return strings.TrimRight(s.baseURL, "/") + emailConfirmPath + token + "?lang=" + normalizeLocale(locale)
-}
-
-// accountLocale returns the account's preferred UI language for localising email,
-// defaulting to "en" when the account cannot be loaded.
-func (s *EmailService) accountLocale(ctx context.Context, accountID uuid.UUID) string {
-	acc, err := s.store.GetByID(ctx, accountID)
-	if err != nil {
-		return "en"
-	}
-	return acc.PreferredLanguage
+// NewEmailService constructs an EmailService over store, sending via mailer.
+func NewEmailService(store *Store, mailer Mailer) *EmailService {
+	return &EmailService{store: store, mailer: mailer, now: func() time.Time { return time.Now().UTC() }}
 }
 
 // RequestCode issues a fresh confirm-code for email to accountID and mails it,
@@ -164,9 +73,6 @@ func (s *EmailService) RequestCode(ctx context.Context, accountID uuid.UUID, ema
 	if err != nil {
 		return err
 	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
 	owner, ok, err := s.store.confirmedEmailAccount(ctx, addr)
 	if err != nil {
 		return err
@@ -177,7 +83,16 @@ func (s *EmailService) RequestCode(ctx context.Context, accountID uuid.UUID, ema
 		}
 		return ErrEmailTaken
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID), false)
+	code, hash, err := generateCode()
+	if err != nil {
+		return err
+	}
+	if err := s.store.replacePendingConfirmation(ctx, accountID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return err
+	}
+	subject := "Your Scrabble confirmation code"
+	body := fmt.Sprintf("Your confirmation code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	return s.mailer.Send(ctx, addr, subject, body)
 }
 
 // ConfirmCode verifies code for accountID and email. On success it attaches a
@@ -208,38 +123,36 @@ func (s *EmailService) ConfirmCode(ctx context.Context, accountID uuid.UUID, ema
 	if err := s.store.confirmEmailIdentity(ctx, conf.id, accountID, addr, s.now()); err != nil {
 		return Account{}, err
 	}
-	// Binding the first confirmed email promotes a guest to a durable account, matching the
-	// link and deeplink flows (defence-in-depth: no confirmed-email path leaves is_guest set).
-	if err := s.store.ClearGuest(ctx, accountID); err != nil {
-		return Account{}, err
-	}
 	return s.store.GetByID(ctx, accountID)
 }
 
 // RequestLoginCode issues a login confirm-code to the account that owns email,
-// provisioning a fresh (unconfirmed) guest account when the email is new — it becomes
-// durable once the code is confirmed. It is the unauthenticated email-login entry
-// point and, unlike RequestCode, does not refuse an already-confirmed email — that is
-// the ordinary returning-user login. The code is mailed to the address, so only its
-// real owner can complete the login. On first contact browserTZ (the client's
-// detected "±HH:MM" UTC offset) seeds the new account's time zone and language its UI
-// language. When pwa is set (the request came from an installed PWA) the login email omits the
-// one-tap confirm link — it would open in a separate browser, out of the PWA's reach — so the
-// code is entered in the same window. It returns the target account id for the subsequent
-// LoginWithCode.
-func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ, language string, pwa bool) (uuid.UUID, error) {
+// provisioning a fresh (unconfirmed) durable account when the email is new. It is
+// the unauthenticated email-login entry point and, unlike RequestCode,
+// does not refuse an already-confirmed email — that is the ordinary returning-user
+// login. The code is mailed to the address, so only its real owner can complete
+// the login. On first contact browserTZ (the client's detected "±HH:MM" UTC offset)
+// seeds the new account's time zone. It returns the target account id for the
+// subsequent LoginWithCode.
+func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ string) (uuid.UUID, error) {
 	addr, err := normalizeEmail(email)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	if !s.allowSend(addr) {
-		return uuid.UUID{}, ErrTooManyRequests
-	}
-	acc, err := s.store.ProvisionEmail(ctx, addr, browserTZ, language)
+	acc, err := s.store.ProvisionEmail(ctx, addr, browserTZ)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	if err := s.issueCode(ctx, acc.ID, addr, purposeLogin, language, pwa); err != nil {
+	code, hash, err := generateCode()
+	if err != nil {
+		return uuid.UUID{}, err
+	}
+	if err := s.store.replacePendingConfirmation(ctx, acc.ID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return uuid.UUID{}, err
+	}
+	subject := "Your Scrabble login code"
+	body := fmt.Sprintf("Your login code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	if err := s.mailer.Send(ctx, addr, subject, body); err != nil {
 		return uuid.UUID{}, err
 	}
 	return acc.ID, nil
@@ -278,104 +191,9 @@ func (s *EmailService) LoginWithCode(ctx context.Context, email, code string) (A
 	if err := s.store.confirmEmailLogin(ctx, conf.id, acc.ID, addr, s.now()); err != nil {
 		return Account{}, err
 	}
-	if err := s.store.ClearGuest(ctx, acc.ID); err != nil {
-		return Account{}, err
-	}
 	return s.store.GetByID(ctx, acc.ID)
 }
 
-// LinkConfirmation is the outcome of confirming a one-tap deeplink token: what the
-// transport layer must finish. Purpose is the pending row's purpose. For a login,
-// Account is the account to sign in. For a link, Account is the account the email was
-// (or would be) attached to; NeedsMerge is set when another account (MergeOwner)
-// already owns the address, so the caller drives the interactive merge instead of a
-// plain link — the token is left unconsumed for that merge step.
-type LinkConfirmation struct {
-	Purpose    string
-	Account    uuid.UUID
-	NeedsMerge bool
-	MergeOwner uuid.UUID
-}
-
-// IsLogin reports whether the confirmation is a login (the caller mints a session)
-// rather than a link (attach the identity, or drive a merge).
-func (r LinkConfirmation) IsLogin() bool { return r.Purpose == purposeLogin }
-
-// ConfirmByToken verifies a one-tap deeplink token and performs its purpose. A login
-// confirms the email identity, clears the guest flag and returns the account to sign
-// in. A link attaches the confirmed email to the pending account when the address is
-// free, or reports NeedsMerge when another account already owns it (leaving the token
-// live so the caller's merge step can re-verify). It returns ErrNoPendingCode when the
-// token matches no live confirmation and ErrCodeExpired when it has lapsed. The token
-// is high-entropy, so there is no wrong-attempt counter.
-func (s *EmailService) ConfirmByToken(ctx context.Context, token string) (LinkConfirmation, error) {
-	pend, err := s.store.pendingByTokenHash(ctx, hashCode(token))
-	if err != nil {
-		return LinkConfirmation{}, err
-	}
-	if s.now().After(pend.expiresAt) {
-		return LinkConfirmation{}, ErrCodeExpired
-	}
-	switch pend.purpose {
-	case purposeLogin:
-		if err := s.store.confirmEmailLogin(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		if err := s.store.ClearGuest(ctx, pend.accountID); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeLogin, Account: pend.accountID}, nil
-	case purposeLink:
-		owner, ok, err := s.store.confirmedEmailAccount(ctx, pend.email)
-		if err != nil {
-			return LinkConfirmation{}, err
-		}
-		if ok {
-			if owner == pend.accountID {
-				if err := s.store.consumeConfirmation(ctx, pend.id, s.now()); err != nil {
-					return LinkConfirmation{}, err
-				}
-				return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID}, nil
-			}
-			return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID, NeedsMerge: true, MergeOwner: owner}, nil
-		}
-		if err := s.store.confirmEmailIdentity(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		// Binding the first email promotes a guest to a durable account, matching the
-		// code-based link flow (which clears the guest flag in the link service).
-		if err := s.store.ClearGuest(ctx, pend.accountID); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID}, nil
-	case purposeChange:
-		owner, ok, err := s.store.confirmedEmailAccount(ctx, pend.email)
-		if err != nil {
-			return LinkConfirmation{}, err
-		}
-		if ok && owner != pend.accountID {
-			// The new address is confirmed by a different account: refuse without
-			// disclosing it (anti-enumeration). Unlike a link, a change never merges.
-			return LinkConfirmation{}, ErrEmailTaken
-		}
-		if ok && owner == pend.accountID {
-			if err := s.store.consumeConfirmation(ctx, pend.id, s.now()); err != nil {
-				return LinkConfirmation{}, err
-			}
-			return LinkConfirmation{Purpose: purposeChange, Account: pend.accountID}, nil
-		}
-		if err := s.store.replaceEmailIdentity(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeChange, Account: pend.accountID}, nil
-	case purposeDelete:
-		// Deletion is confirmed in the app with the code, never via a one-tap link.
-		return LinkConfirmation{}, fmt.Errorf("account: deletion cannot be confirmed by link")
-	default:
-		return LinkConfirmation{}, fmt.Errorf("account: unsupported confirmation purpose %q", pend.purpose)
-	}
-}
-
 // emailConfirmation is a pending confirm-code row in domain form.
 type emailConfirmation struct {
 	id        uuid.UUID
@@ -404,30 +222,9 @@ func (s *Store) confirmedEmailAccount(ctx context.Context, email string) (uuid.U
 	return row.AccountID, true, nil
 }
 
-// confirmedEmailOf returns the account's confirmed email address and true, or ("", false)
-// when it holds none. It backs the deletion step-up, which mails a code to the account's
-// own address.
-func (s *Store) confirmedEmailOf(ctx context.Context, accountID uuid.UUID) (string, bool, error) {
-	stmt := postgres.SELECT(table.Identities.ExternalID).
-		FROM(table.Identities).
-		WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))).
-				AND(table.Identities.Confirmed.EQ(postgres.Bool(true))),
-		).LIMIT(1)
-	var row model.Identities
-	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return "", false, nil
-		}
-		return "", false, fmt.Errorf("account: confirmed email of %s: %w", accountID, err)
-	}
-	return row.ExternalID, true, nil
-}
-
 // replacePendingConfirmation clears any pending code for (accountID, email) and
 // inserts a fresh one, inside one transaction.
-func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.UUID, email, codeHash, linkTokenHash, purpose string, expiresAt time.Time) error {
+func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.UUID, email, codeHash string, expiresAt time.Time) error {
 	id, err := uuid.NewV7()
 	if err != nil {
 		return fmt.Errorf("account: new confirmation id: %w", err)
@@ -444,8 +241,7 @@ func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.U
 		ins := table.EmailConfirmations.INSERT(
 			table.EmailConfirmations.ConfirmationID, table.EmailConfirmations.AccountID,
 			table.EmailConfirmations.Email, table.EmailConfirmations.CodeHash, table.EmailConfirmations.ExpiresAt,
-			table.EmailConfirmations.LinkTokenHash, table.EmailConfirmations.Purpose,
-		).VALUES(id, accountID, email, codeHash, expiresAt, linkTokenHash, purpose)
+		).VALUES(id, accountID, email, codeHash, expiresAt)
 		if _, err := ins.ExecContext(ctx, tx); err != nil {
 			return fmt.Errorf("insert confirmation: %w", err)
 		}
@@ -478,54 +274,6 @@ func (s *Store) latestPendingConfirmation(ctx context.Context, accountID uuid.UU
 	}, nil
 }
 
-// pendingConfirmation is a pending confirm-code row loaded by its deeplink token, in
-// domain form.
-type pendingConfirmation struct {
-	id        uuid.UUID
-	accountID uuid.UUID
-	email     string
-	purpose   string
-	expiresAt time.Time
-}
-
-// pendingByTokenHash loads the unconsumed confirmation whose deeplink token hashes to
-// tokenHash, or ErrNoPendingCode. The high-entropy token needs no attempt counter, so
-// a partial-unique index guarantees at most one match.
-func (s *Store) pendingByTokenHash(ctx context.Context, tokenHash string) (pendingConfirmation, error) {
-	stmt := postgres.SELECT(table.EmailConfirmations.AllColumns).
-		FROM(table.EmailConfirmations).
-		WHERE(
-			table.EmailConfirmations.LinkTokenHash.EQ(postgres.String(tokenHash)).
-				AND(table.EmailConfirmations.ConsumedAt.IS_NULL()),
-		).LIMIT(1)
-	var row model.EmailConfirmations
-	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return pendingConfirmation{}, ErrNoPendingCode
-		}
-		return pendingConfirmation{}, fmt.Errorf("account: load confirmation by token: %w", err)
-	}
-	return pendingConfirmation{
-		id:        row.ConfirmationID,
-		accountID: row.AccountID,
-		email:     row.Email,
-		purpose:   row.Purpose,
-		expiresAt: row.ExpiresAt,
-	}, nil
-}
-
-// consumeConfirmation marks a confirmation consumed without writing an identity, used
-// for the idempotent already-linked deeplink path.
-func (s *Store) consumeConfirmation(ctx context.Context, id uuid.UUID, now time.Time) error {
-	upd := table.EmailConfirmations.UPDATE(table.EmailConfirmations.ConsumedAt).
-		SET(postgres.TimestampzT(now)).
-		WHERE(table.EmailConfirmations.ConfirmationID.EQ(postgres.UUID(id)))
-	if _, err := upd.ExecContext(ctx, s.db); err != nil {
-		return fmt.Errorf("account: consume confirmation: %w", err)
-	}
-	return nil
-}
-
 // bumpConfirmationAttempts increments a code's wrong-attempt counter by one.
 func (s *Store) bumpConfirmationAttempts(ctx context.Context, id uuid.UUID) error {
 	stmt := table.EmailConfirmations.
@@ -572,69 +320,6 @@ func (s *Store) confirmEmailIdentity(ctx context.Context, confirmationID, accoun
 	return nil
 }
 
-// replaceEmailIdentity consumes the confirmation, deletes the account's existing email
-// identity (freeing the old address) and inserts newEmail as its confirmed email, inside
-// one transaction. It backs the change-email flow. A unique-constraint violation — the
-// new address was confirmed elsewhere in the meantime — surfaces as ErrEmailTaken. When
-// the account holds no email identity yet the delete is a no-op, so this doubles as an
-// attach.
-func (s *Store) replaceEmailIdentity(ctx context.Context, confirmationID, accountID uuid.UUID, newEmail string, now time.Time) error {
-	identityID, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("account: new identity id: %w", err)
-	}
-	err = withTx(ctx, s.db, func(tx *sql.Tx) error {
-		upd := table.EmailConfirmations.
-			UPDATE(table.EmailConfirmations.ConsumedAt).
-			SET(postgres.TimestampzT(now)).
-			WHERE(table.EmailConfirmations.ConfirmationID.EQ(postgres.UUID(confirmationID)))
-		if _, err := upd.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("consume confirmation: %w", err)
-		}
-		// Journal the outgoing email before replacing it, so the legal dossier keeps the
-		// address the account used to hold (see retention.go).
-		var old model.Identities
-		sel := postgres.SELECT(
-			table.Identities.ExternalID, table.Identities.Confirmed, table.Identities.CreatedAt,
-		).FROM(table.Identities).WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))),
-		).LIMIT(1)
-		switch err := sel.QueryContext(ctx, tx, &old); {
-		case err == nil:
-			if err := retainIdentityTx(ctx, tx, accountID, KindEmail, old.ExternalID, old.Confirmed, old.CreatedAt, retainChange); err != nil {
-				return err
-			}
-		case errors.Is(err, qrm.ErrNoRows):
-			// No prior email (this doubles as an attach); nothing to retain.
-		default:
-			return fmt.Errorf("load outgoing email identity: %w", err)
-		}
-		del := table.Identities.DELETE().WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))),
-		)
-		if _, err := del.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("delete old email identity: %w", err)
-		}
-		ins := table.Identities.INSERT(
-			table.Identities.IdentityID, table.Identities.AccountID, table.Identities.Kind,
-			table.Identities.ExternalID, table.Identities.Confirmed,
-		).VALUES(identityID, accountID, KindEmail, newEmail, true)
-		if _, err := ins.ExecContext(ctx, tx); err != nil {
-			return err
-		}
-		return nil
-	})
-	if err != nil {
-		if isUniqueViolation(err) {
-			return ErrEmailTaken
-		}
-		return fmt.Errorf("account: replace email identity: %w", err)
-	}
-	return nil
-}
-
 // confirmEmailLogin consumes the login code and marks the existing email
 // identity confirmed, inside one transaction. The identity already exists (a
 // login provisioned it), so this updates rather than inserts and is idempotent
@@ -682,18 +367,6 @@ func generateCode() (code, hash string, err error) {
 	return code, hashCode(code), nil
 }
 
-// generateLinkToken returns a fresh opaque one-tap confirm deeplink token (URL-safe
-// base64, 256-bit) and its hex SHA-256 hash. Only the hash is stored; the token
-// travels only in the emailed link, mirroring the session-token model.
-func generateLinkToken() (token, hash string, err error) {
-	buf := make([]byte, linkTokenBytes)
-	if _, err := crand.Read(buf); err != nil {
-		return "", "", fmt.Errorf("account: generate link token: %w", err)
-	}
-	token = base64.RawURLEncoding.EncodeToString(buf)
-	return token, hashCode(token), nil
-}
-
 // hashCode returns the hex-encoded SHA-256 of a confirm-code.
 func hashCode(code string) string {
 	sum := sha256.Sum256([]byte(code))

backend/internal/account/emailtemplate.go

@@ -1,239 +0,0 @@
-package account
-
-import (
-	"fmt"
-	"html/template"
-	"strings"
-	tmpltext "text/template"
-	"time"
-)
-
-// emailBrandColor is the single accent used in the confirmation email — a calm
-// tile green, matching the "no riot of colours" brief.
-const emailBrandColor = "#2f7d4f"
-
-// confirmEmailView is the fully-localised data the confirmation email templates
-// render. Every string is resolved before rendering, so the templates carry no
-// localisation logic.
-type confirmEmailView struct {
-	Brand        string
-	Heading      string
-	Intro        string
-	Code         string
-	Expiry       string
-	CTALabel     string
-	DeeplinkURL  string
-	FooterIgnore string
-	LandingURL   string
-	LandingLabel string
-	Preheader    string
-	Locale       string
-	Accent       string
-}
-
-// emailCopy is the purpose- and locale-specific wording of a confirmation email.
-type emailCopy struct {
-	Subject      string
-	Preheader    string
-	Heading      string
-	Intro        string
-	CTALabel     string
-	FooterIgnore string
-}
-
-// confirmEmailCopy holds the wording per (purpose, locale). Unknown purposes fall
-// back to the neutral link wording and unknown locales fall back to English.
-var confirmEmailCopy = map[string]map[string]emailCopy{
-	purposeLogin: {
-		"en": {
-			Subject:      "Your Erudit sign-in code",
-			Preheader:    "Your sign-in code",
-			Heading:      "Sign in to Erudit",
-			Intro:        "Enter this code to sign in:",
-			CTALabel:     "Sign in with one tap",
-			FooterIgnore: "If you didn't request this email, you can safely ignore it.",
-		},
-		"ru": {
-			Subject:      "Код для входа в Эрудит",
-			Preheader:    "Ваш код для входа",
-			Heading:      "Вход в Эрудит",
-			Intro:        "Введите этот код, чтобы войти в игру:",
-			CTALabel:     "Войти одним нажатием",
-			FooterIgnore: "Если вы не запрашивали это письмо, просто проигнорируйте его.",
-		},
-	},
-	purposeLink: {
-		"en": {
-			Subject:      "Your Erudit confirmation code",
-			Preheader:    "Your confirmation code",
-			Heading:      "Confirm your e-mail",
-			Intro:        "Enter this code to confirm your address:",
-			CTALabel:     "Confirm with one tap",
-			FooterIgnore: "If you didn't request this email, you can safely ignore it.",
-		},
-		"ru": {
-			Subject:      "Код подтверждения Эрудит",
-			Preheader:    "Ваш код подтверждения",
-			Heading:      "Подтверждение e-mail",
-			Intro:        "Введите этот код, чтобы подтвердить адрес:",
-			CTALabel:     "Подтвердить одним нажатием",
-			FooterIgnore: "Если вы не запрашивали это письмо, просто проигнорируйте его.",
-		},
-	},
-	purposeChange: {
-		"en": {
-			Subject:      "Confirm your new Erudit e-mail",
-			Preheader:    "Confirm your new address",
-			Heading:      "Confirm your new e-mail",
-			Intro:        "Enter this code to switch your account to this address:",
-			CTALabel:     "Confirm with one tap",
-			FooterIgnore: "If you didn't request this change, you can safely ignore it — your address stays the same.",
-		},
-		"ru": {
-			Subject:      "Подтвердите новый e-mail в Эрудит",
-			Preheader:    "Подтвердите новый адрес",
-			Heading:      "Смена e-mail",
-			Intro:        "Введите этот код, чтобы привязать аккаунт к новому адресу:",
-			CTALabel:     "Подтвердить одним нажатием",
-			FooterIgnore: "Если вы не запрашивали смену, просто проигнорируйте письмо — адрес останется прежним.",
-		},
-	},
-	purposeDelete: {
-		"en": {
-			Subject:      "Confirm your Erudit account deletion",
-			Preheader:    "Confirm account deletion",
-			Heading:      "Delete your account",
-			Intro:        "Enter this code in the app to permanently delete your account:",
-			CTALabel:     "",
-			FooterIgnore: "If you didn't request this, ignore it — your account stays as it is.",
-		},
-		"ru": {
-			Subject:      "Подтвердите удаление аккаунта Эрудит",
-			Preheader:    "Подтверждение удаления аккаунта",
-			Heading:      "Удаление аккаунта",
-			Intro:        "Введите этот код в приложении, чтобы удалить аккаунт без восстановления:",
-			CTALabel:     "",
-			FooterIgnore: "Если вы не запрашивали удаление, проигнорируйте письмо — аккаунт останется.",
-		},
-	},
-}
-
-// emailBrand is the brand wordmark per locale.
-var emailBrand = map[string]string{"en": "Erudit", "ru": "Эрудит"}
-
-// emailExpiry formats the code-lifetime line per locale (abbreviated minutes to
-// avoid plural agreement).
-func emailExpiry(locale string, d time.Duration) string {
-	min := int(d / time.Minute)
-	if locale == "ru" {
-		return fmt.Sprintf("Код действует %d мин.", min)
-	}
-	return fmt.Sprintf("The code is valid for %d minutes.", min)
-}
-
-// normalizeLocale maps an account language to a supported email locale, defaulting
-// to English.
-func normalizeLocale(locale string) string {
-	if locale == "ru" {
-		return "ru"
-	}
-	return "en"
-}
-
-// renderConfirmationEmail builds the branded confirmation email for purpose in
-// locale: a large readable code plus a one-tap deeplink button, with an
-// ignore-notice footer and a landing link. Both a plain-text body and an HTML
-// alternative are produced. deeplinkURL is the absolute /confirm link and
-// landingURL the public landing origin.
-func renderConfirmationEmail(purpose, code, deeplinkURL, landingURL, locale string) (Message, error) {
-	loc := normalizeLocale(locale)
-	byLocale, ok := confirmEmailCopy[purpose]
-	if !ok {
-		byLocale = confirmEmailCopy[purposeLink]
-	}
-	cp := byLocale[loc]
-	view := confirmEmailView{
-		Brand:        emailBrand[loc],
-		Heading:      cp.Heading,
-		Intro:        cp.Intro,
-		Code:         code,
-		Expiry:       emailExpiry(loc, emailCodeTTL),
-		CTALabel:     cp.CTALabel,
-		DeeplinkURL:  deeplinkURL,
-		FooterIgnore: cp.FooterIgnore,
-		LandingURL:   landingURL,
-		LandingLabel: emailBrand[loc],
-		Preheader:    cp.Preheader,
-		Locale:       loc,
-		Accent:       emailBrandColor,
-	}
-	var html strings.Builder
-	if err := confirmEmailHTML.Execute(&html, view); err != nil {
-		return Message{}, fmt.Errorf("account: render confirmation email (html): %w", err)
-	}
-	var text strings.Builder
-	if err := confirmEmailText.Execute(&text, view); err != nil {
-		return Message{}, fmt.Errorf("account: render confirmation email (text): %w", err)
-	}
-	return Message{Subject: cp.Subject, Text: text.String(), HTML: html.String()}, nil
-}
-
-// confirmEmailHTML is a compact, image-free, mobile-friendly HTML email. Layout is
-// table-based for broad mail-client compatibility and all styling is inlined
-// because clients strip <style> blocks.
-var confirmEmailHTML = template.Must(template.New("confirmEmailHTML").Parse(`<!DOCTYPE html>
-<html lang="{{.Locale}}">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>{{.Brand}}</title>
-</head>
-<body style="margin:0;padding:0;background:#f4f5f7;">
-<span style="display:none;max-height:0;overflow:hidden;opacity:0;">{{.Preheader}}</span>
-<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f4f5f7;padding:24px 12px;">
-<tr><td align="center">
-<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:460px;background:#ffffff;border:1px solid #e5e7eb;border-radius:14px;overflow:hidden;font-family:-apple-system,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
-<tr><td style="padding:28px 32px 4px;">
-<div style="font-size:15px;font-weight:700;letter-spacing:.04em;color:{{.Accent}};">{{.Brand}}</div>
-</td></tr>
-<tr><td style="padding:8px 32px 0;">
-<h1 style="margin:0;font-size:20px;line-height:1.3;color:#111827;font-weight:600;">{{.Heading}}</h1>
-<p style="margin:12px 0 0;font-size:15px;line-height:1.5;color:#374151;">{{.Intro}}</p>
-</td></tr>
-<tr><td style="padding:18px 32px 0;">
-<div style="font-size:34px;font-weight:700;letter-spacing:8px;text-align:center;color:#111827;background:#f3f4f6;border-radius:10px;padding:18px 0;font-family:'SFMono-Regular',Consolas,Menlo,monospace;">{{.Code}}</div>
-<p style="margin:10px 0 0;font-size:13px;line-height:1.5;color:#6b7280;text-align:center;">{{.Expiry}}</p>
-</td></tr>
-{{if .DeeplinkURL}}<tr><td style="padding:22px 32px 0;" align="center">
-<a href="{{.DeeplinkURL}}" style="display:inline-block;background:{{.Accent}};color:#ffffff;text-decoration:none;font-size:15px;font-weight:600;padding:12px 26px;border-radius:9px;">{{.CTALabel}}</a>
-</td></tr>
-{{end}}<tr><td style="padding:26px 32px 28px;">
-<hr style="border:none;border-top:1px solid #eceef1;margin:0 0 16px;">
-<p style="margin:0;font-size:12px;line-height:1.6;color:#9ca3af;">{{.FooterIgnore}}</p>
-<p style="margin:10px 0 0;font-size:12px;color:#9ca3af;"><a href="{{.LandingURL}}" style="color:#6b7280;text-decoration:none;">{{.LandingLabel}}</a></p>
-</td></tr>
-</table>
-</td></tr>
-</table>
-</body>
-</html>
-`))
-
-// confirmEmailText is the plain-text alternative (and multipart fallback).
-var confirmEmailText = tmpltext.Must(tmpltext.New("confirmEmailText").Parse(`{{.Brand}}
-
-{{.Heading}}
-
-{{.Intro}}
-
-    {{.Code}}
-
-{{.Expiry}}
-
-{{if .DeeplinkURL}}{{.CTALabel}}:
-{{.DeeplinkURL}}
-
-{{end}}—
-{{.FooterIgnore}}
-{{.LandingLabel}} — {{.LandingURL}}
-`))

backend/internal/account/emailtemplate_test.go

@@ -1,54 +0,0 @@
-package account
-
-import (
-	"strings"
-	"testing"
-)
-
-// TestRenderConfirmationEmail checks that each (purpose, locale) renders a localised
-// subject, embeds the code and the one-tap deeplink in both bodies, and produces HTML.
-func TestRenderConfirmationEmail(t *testing.T) {
-	const deeplink = "https://erudit-game.ru/app/#/confirm/tok123"
-	cases := []struct {
-		name, purpose, locale, subjectSub string
-	}{
-		{"login ru", purposeLogin, "ru", "вход"},
-		{"login en", purposeLogin, "en", "sign-in"},
-		{"link ru", purposeLink, "ru", "подтвержд"},
-		{"link en", purposeLink, "en", "confirmation"},
-		{"change ru", purposeChange, "ru", "новый"},
-		{"change en", purposeChange, "en", "new"},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			msg, err := renderConfirmationEmail(c.purpose, "123456", deeplink, "https://erudit-game.ru", c.locale)
-			if err != nil {
-				t.Fatalf("render: %v", err)
-			}
-			if !strings.Contains(strings.ToLower(msg.Subject), c.subjectSub) {
-				t.Errorf("subject %q does not contain %q", msg.Subject, c.subjectSub)
-			}
-			if !strings.Contains(msg.Text, "123456") || !strings.Contains(msg.HTML, "123456") {
-				t.Error("code missing from a body")
-			}
-			if !strings.Contains(msg.Text, deeplink) || !strings.Contains(msg.HTML, "confirm/tok123") {
-				t.Error("deeplink missing from a body")
-			}
-			if !strings.Contains(msg.HTML, "<html") {
-				t.Error("HTML body is not HTML")
-			}
-		})
-	}
-}
-
-// TestRenderConfirmationEmailUnknownLocaleDefaultsEnglish falls back to English for an
-// unsupported locale rather than erroring or emitting an empty subject.
-func TestRenderConfirmationEmailUnknownLocaleDefaultsEnglish(t *testing.T) {
-	msg, err := renderConfirmationEmail(purposeLogin, "000000", "", "https://erudit-game.ru", "de")
-	if err != nil {
-		t.Fatalf("render: %v", err)
-	}
-	if !strings.Contains(strings.ToLower(msg.Subject), "sign-in") {
-		t.Errorf("unknown locale should default to English, got subject %q", msg.Subject)
-	}
-}

backend/internal/account/link.go

@@ -2,7 +2,6 @@ package account
 
 import (
 	"context"
-	"database/sql"
 	"errors"
 	"fmt"
 	"time"
@@ -17,68 +16,6 @@ import (
 // belongs to another account; the caller turns it into a merge.
 var ErrIdentityTaken = errors.New("account: identity already linked to another account")
 
-// ErrLastIdentity is returned when removing an identity would leave the account with
-// none, making it unreachable after logout. The admin email-erase refuses it.
-var ErrLastIdentity = errors.New("account: cannot remove the last identity")
-
-// RemoveIdentity deletes the account's identity of the given kind (and, for an email,
-// any pending confirmations for it), freeing it for reuse. It refuses when that is the
-// account's only identity (ErrLastIdentity) — which would leave the account
-// unreachable — and returns ErrNotFound when the account has no identity of that kind.
-// It backs the profile Unlink control and the admin "erase email" action.
-func (s *Store) RemoveIdentity(ctx context.Context, accountID uuid.UUID, kind string) error {
-	ids, err := s.Identities(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	var toRetain []Identity
-	others := 0
-	for _, id := range ids {
-		if id.Kind == kind {
-			toRetain = append(toRetain, id)
-		} else {
-			others++
-		}
-	}
-	if len(toRetain) == 0 {
-		return ErrNotFound
-	}
-	if others == 0 {
-		return ErrLastIdentity
-	}
-	return withTx(ctx, s.db, func(tx *sql.Tx) error {
-		// Journal the detached credential before removing it, so the legal dossier
-		// survives while the identity frees for reuse (see retention.go).
-		for _, id := range toRetain {
-			if err := retainIdentityTx(ctx, tx, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, retainUnlink); err != nil {
-				return err
-			}
-		}
-		delID := table.Identities.DELETE().WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(kind))),
-		)
-		if _, err := delID.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("account: delete %s identity %s: %w", kind, accountID, err)
-		}
-		if kind == KindEmail {
-			delConf := table.EmailConfirmations.DELETE().WHERE(
-				table.EmailConfirmations.AccountID.EQ(postgres.UUID(accountID)),
-			)
-			if _, err := delConf.ExecContext(ctx, tx); err != nil {
-				return fmt.Errorf("account: delete email confirmations %s: %w", accountID, err)
-			}
-		}
-		return nil
-	})
-}
-
-// RemoveEmailIdentity erases the account's email identity. It backs the admin console's
-// "erase email" action; the user-facing profile never unlinks email (it is changed).
-func (s *Store) RemoveEmailIdentity(ctx context.Context, accountID uuid.UUID) error {
-	return s.RemoveIdentity(ctx, accountID, KindEmail)
-}
-
 // RequestLinkCode issues and mails a confirm-code for email to accountID,
 // replacing any prior pending code. Unlike RequestCode it never refuses up front
 // (taken or already-confirmed): possession of the address is the authorization for
@@ -89,10 +26,16 @@ func (s *EmailService) RequestLinkCode(ctx context.Context, accountID uuid.UUID,
 	if err != nil {
 		return err
 	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
+	code, hash, err := generateCode()
+	if err != nil {
+		return err
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID), false)
+	if err := s.store.replacePendingConfirmation(ctx, accountID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return err
+	}
+	subject := "Your Scrabble confirmation code"
+	body := fmt.Sprintf("Your confirmation code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	return s.mailer.Send(ctx, addr, subject, body)
 }
 
 // ConfirmLink verifies code for (accountID, email) and reports the address's
@@ -127,100 +70,6 @@ func (s *EmailService) ConfirmLink(ctx context.Context, accountID uuid.UUID, ema
 	return accountID, true, nil
 }
 
-// RequestChangeCode issues and mails a confirm-code to newEmail for an authenticated
-// email change on accountID, replacing any prior pending code. Like RequestLinkCode it
-// never refuses up front on "taken" (anti-enumeration): possession of newEmail is the
-// authorization, and a conflict with another account is revealed only at confirm — as a
-// non-disclosing refusal, never a merge.
-func (s *EmailService) RequestChangeCode(ctx context.Context, accountID uuid.UUID, newEmail string) error {
-	addr, err := normalizeEmail(newEmail)
-	if err != nil {
-		return err
-	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
-	return s.issueCode(ctx, accountID, addr, purposeChange, s.accountLocale(ctx, accountID), false)
-}
-
-// ConfirmChange verifies code for (accountID, newEmail) and atomically replaces the
-// account's confirmed email with newEmail, freeing the old address. When newEmail is
-// already confirmed by another account it refuses with ErrEmailTaken (surfaced to the
-// user as a non-disclosing "check the address or contact support"), never merging; when
-// the account already owns newEmail it is an idempotent no-op. It returns the usual
-// confirm-code errors (ErrNoPendingCode, ErrCodeExpired, ErrTooManyAttempts,
-// ErrCodeMismatch) and the updated account on success.
-func (s *EmailService) ConfirmChange(ctx context.Context, accountID uuid.UUID, newEmail, code string) (Account, error) {
-	addr, err := normalizeEmail(newEmail)
-	if err != nil {
-		return Account{}, err
-	}
-	conf, err := s.verifyPendingCode(ctx, accountID, addr, code)
-	if err != nil {
-		return Account{}, err
-	}
-	owner, ok, err := s.store.confirmedEmailAccount(ctx, addr)
-	if err != nil {
-		return Account{}, err
-	}
-	if ok && owner != accountID {
-		return Account{}, ErrEmailTaken
-	}
-	if ok && owner == accountID {
-		if err := s.store.consumeConfirmation(ctx, conf.id, s.now()); err != nil {
-			return Account{}, err
-		}
-		return s.store.GetByID(ctx, accountID)
-	}
-	if err := s.store.replaceEmailIdentity(ctx, conf.id, accountID, addr, s.now()); err != nil {
-		return Account{}, err
-	}
-	return s.store.GetByID(ctx, accountID)
-}
-
-// HasEmail reports whether accountID owns a confirmed email. The account-deletion step-up
-// mails a confirm-code when it does, and falls back to a typed phrase otherwise.
-func (s *EmailService) HasEmail(ctx context.Context, accountID uuid.UUID) (bool, error) {
-	_, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	return ok, err
-}
-
-// RequestDeleteCode mails an account-deletion confirm-code to the account's own confirmed
-// email (no deeplink — deletion is confirmed in the app). It returns ErrNoEmail when the
-// account holds no email, ErrTooManyRequests when throttled.
-func (s *EmailService) RequestDeleteCode(ctx context.Context, accountID uuid.UUID) error {
-	addr, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	if !ok {
-		return ErrNoEmail
-	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
-	return s.issueCode(ctx, accountID, addr, purposeDelete, s.accountLocale(ctx, accountID), false)
-}
-
-// VerifyDeleteCode verifies the account-deletion code against the account's own email and
-// consumes it on success. It returns ErrNoEmail (no email), the usual confirm-code errors
-// (ErrNoPendingCode, ErrCodeExpired, ErrTooManyAttempts, ErrCodeMismatch), or nil when the
-// code is valid — the caller then performs the deletion.
-func (s *EmailService) VerifyDeleteCode(ctx context.Context, accountID uuid.UUID, code string) error {
-	addr, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	if !ok {
-		return ErrNoEmail
-	}
-	conf, err := s.verifyPendingCode(ctx, accountID, addr, code)
-	if err != nil {
-		return err
-	}
-	return s.store.consumeConfirmation(ctx, conf.id, s.now())
-}
-
 // verifyPendingCode loads and checks the pending confirm-code for (accountID,
 // addr), counting a wrong attempt. It returns the confirmation on success.
 func (s *EmailService) verifyPendingCode(ctx context.Context, accountID uuid.UUID, addr, code string) (emailConfirmation, error) {

backend/internal/account/mailer.go

@@ -3,99 +3,33 @@ package account
 import (
 	"context"
 	"fmt"
-	"strconv"
-	"strings"
-	"time"
+	"net"
+	"net/smtp"
 
-	"github.com/wneessen/go-mail"
 	"go.uber.org/zap"
 )
 
-// Message is a transactional email to send through a Mailer. Text is the
-// required plain-text body and doubles as the multipart/alternative fallback;
-// HTML, when non-empty, is the preferred body a capable client renders instead.
-type Message struct {
-	// To is the recipient address, or several comma-separated (all get the one message).
-	To string
-	// From, when non-empty, overrides the configured sender for this message — the admin
-	// alert path uses a distinct From from the user-facing confirm-code sender.
-	From    string
-	Subject string
-	Text    string
-	HTML    string
-}
-
 // Mailer delivers a transactional email. It is the seam behind which the email
 // confirm-code flow sends codes, so the relay is swappable and unit tests use a
-// fixture (see docs/TESTING.md: no real network in tests). The context bounds the
-// delivery and is honoured by the SMTP implementation.
+// fixture (see docs/TESTING.md: no real network in tests). The context is offered
+// for cancellation; the standard-library SMTP implementation sends synchronously
+// and ignores it.
 type Mailer interface {
-	Send(ctx context.Context, msg Message) error
-}
-
-// splitAddrs splits a comma-separated recipient list into trimmed, non-empty addresses.
-func splitAddrs(list string) []string {
-	parts := strings.Split(list, ",")
-	out := make([]string, 0, len(parts))
-	for _, p := range parts {
-		if a := strings.TrimSpace(p); a != "" {
-			out = append(out, a)
-		}
-	}
-	return out
+	Send(ctx context.Context, to, subject, body string) error
 }
 
 // SMTPConfig configures the SMTP relay. An empty Host selects the LogMailer
 // instead, so a deployment without a relay still runs (the code lands in the log).
-// TLS is always used and no client certificate is required — only the server
-// certificate is validated against the system roots.
 type SMTPConfig struct {
 	Host     string
 	Port     string
 	Username string
 	Password string
 	From     string
-	// TLS selects the transport security: "ssl" for implicit TLS from connect, or
-	// "starttls" to upgrade a plaintext connection. Empty derives the mode from the
-	// port (implicit TLS on 465, STARTTLS otherwise); set it explicitly for a relay on
-	// a non-standard port (e.g. Selectel's 1127 = SSL, 1126 = STARTTLS).
-	TLS string
-	// AdminFrom / AdminTo drive the operator alert emails (new feedback / word complaints),
-	// distinct from the user-facing confirm-code sender. AdminTo may be several
-	// comma-separated addresses. Both empty disables the alert worker.
-	AdminFrom string
-	AdminTo   string
 }
 
-const (
-	// SMTP transport-security modes for SMTPConfig.TLS.
-	smtpTLSImplicit = "ssl"
-	smtpTLSSTARTTLS = "starttls"
-	// smtpDialTimeout bounds a single relay connect-and-send. The confirm-code send
-	// is synchronous on the request path, so an unreachable relay must fail fast
-	// rather than hold the request open.
-	smtpDialTimeout = 15 * time.Second
-)
-
-// tlsMode resolves the transport-security mode for the relay: the explicitly
-// configured SMTPConfig.TLS, or — when unset — implicit TLS on the conventional SSL
-// port 465 and STARTTLS on any other port.
-func (cfg SMTPConfig) tlsMode(port int) string {
-	switch strings.ToLower(strings.TrimSpace(cfg.TLS)) {
-	case smtpTLSImplicit, "tls":
-		return smtpTLSImplicit
-	case smtpTLSSTARTTLS:
-		return smtpTLSSTARTTLS
-	}
-	if port == 465 {
-		return smtpTLSImplicit
-	}
-	return smtpTLSSTARTTLS
-}
-
-// SMTPMailer sends mail through an SMTP relay using go-mail. When a username is
-// set it authenticates, auto-discovering the strongest mechanism the relay
-// advertises; otherwise it relays unauthenticated.
+// SMTPMailer sends mail through an SMTP relay using the standard library. When a
+// username is set it authenticates with PLAIN; otherwise it relays unauthenticated.
 type SMTPMailer struct {
 	cfg SMTPConfig
 }
@@ -105,55 +39,29 @@ func NewSMTPMailer(cfg SMTPConfig) SMTPMailer {
 	return SMTPMailer{cfg: cfg}
 }
 
-// Send delivers a UTF-8 message to msg.To via the configured relay. When msg.HTML
-// is set the message is multipart/alternative (plain text plus HTML); otherwise
-// it is plain text only.
-func (m SMTPMailer) Send(ctx context.Context, msg Message) error {
-	port, err := strconv.Atoi(m.cfg.Port)
-	if err != nil {
-		return fmt.Errorf("account: invalid SMTP port %q: %w", m.cfg.Port, err)
-	}
-	opts := []mail.Option{mail.WithPort(port), mail.WithTimeout(smtpDialTimeout)}
-	if m.cfg.tlsMode(port) == smtpTLSImplicit {
-		opts = append(opts, mail.WithSSL())
-	} else {
-		opts = append(opts, mail.WithTLSPortPolicy(mail.TLSMandatory))
-	}
+// Send delivers a plain-text UTF-8 message to to via the configured relay.
+func (m SMTPMailer) Send(_ context.Context, to, subject, body string) error {
+	addr := net.JoinHostPort(m.cfg.Host, m.cfg.Port)
+	var auth smtp.Auth
 	if m.cfg.Username != "" {
-		opts = append(opts,
-			mail.WithSMTPAuth(mail.SMTPAuthAutoDiscover),
-			mail.WithUsername(m.cfg.Username),
-			mail.WithPassword(m.cfg.Password),
-		)
+		auth = smtp.PlainAuth("", m.cfg.Username, m.cfg.Password, m.cfg.Host)
 	}
-	client, err := mail.NewClient(m.cfg.Host, opts...)
-	if err != nil {
-		return fmt.Errorf("account: build mail client: %w", err)
-	}
-	out := mail.NewMsg()
-	from := m.cfg.From
-	if msg.From != "" {
-		from = msg.From
-	}
-	if err := out.From(from); err != nil {
-		return fmt.Errorf("account: set From %q: %w", from, err)
-	}
-	// To may carry several comma-separated recipients; go-mail wants them as separate
-	// arguments (a single joined string parses as one malformed address).
-	if err := out.To(splitAddrs(msg.To)...); err != nil {
-		return fmt.Errorf("account: set To %q: %w", msg.To, err)
-	}
-	out.Subject(msg.Subject)
-	out.SetBodyString(mail.TypeTextPlain, msg.Text)
-	if msg.HTML != "" {
-		out.AddAlternativeString(mail.TypeTextHTML, msg.HTML)
-	}
-	if err := client.DialAndSendWithContext(ctx, out); err != nil {
-		return fmt.Errorf("account: send mail to %s: %w", msg.To, err)
+	if err := smtp.SendMail(addr, auth, m.cfg.From, []string{to}, message(m.cfg.From, to, subject, body)); err != nil {
+		return fmt.Errorf("account: send mail to %s: %w", to, err)
 	}
 	return nil
 }
 
+// message renders a minimal RFC 5322 plain-text email.
+func message(from, to, subject, body string) []byte {
+	return []byte("From: " + from + "\r\n" +
+		"To: " + to + "\r\n" +
+		"Subject: " + subject + "\r\n" +
+		"MIME-Version: 1.0\r\n" +
+		"Content-Type: text/plain; charset=UTF-8\r\n" +
+		"\r\n" + body + "\r\n")
+}
+
 // LogMailer logs the message instead of sending it. It is the default when no
 // SMTP relay is configured and is intended for development only: it logs the body,
 // which carries the confirm-code, so it must not be used in production.
@@ -166,12 +74,11 @@ func NewLogMailer(log *zap.Logger) LogMailer {
 	return LogMailer{log: log}
 }
 
-// Send logs the message at info level and reports success. It logs the plain-text
-// body only (which carries the confirm-code); the HTML alternative is omitted.
-func (m LogMailer) Send(_ context.Context, msg Message) error {
+// Send logs the message at info level and reports success.
+func (m LogMailer) Send(_ context.Context, to, subject, body string) error {
 	if m.log != nil {
 		m.log.Info("email not sent (log mailer)",
-			zap.String("to", msg.To), zap.String("subject", msg.Subject), zap.String("body", msg.Text))
+			zap.String("to", to), zap.String("subject", subject), zap.String("body", body))
 	}
 	return nil
 }

backend/internal/account/mailer_test.go

@@ -1,51 +0,0 @@
-package account
-
-import (
-	"slices"
-	"testing"
-)
-
-// TestSplitAddrs covers the comma-separated recipient parsing used for the admin alert
-// To (several operator mailboxes in one message), including trimming and empty entries.
-func TestSplitAddrs(t *testing.T) {
-	cases := []struct {
-		in   string
-		want []string
-	}{
-		{"a@x.ru", []string{"a@x.ru"}},
-		{"a@x.ru, b@y.ru", []string{"a@x.ru", "b@y.ru"}},
-		{" a@x.ru ,, b@y.ru ,", []string{"a@x.ru", "b@y.ru"}},
-		{"", nil},
-	}
-	for _, c := range cases {
-		if got := splitAddrs(c.in); !slices.Equal(got, c.want) {
-			t.Errorf("splitAddrs(%q) = %v, want %v", c.in, got, c.want)
-		}
-	}
-}
-
-// TestSMTPTLSMode covers the explicit TLS mode and the port-based fallback, including
-// the non-standard Selectel ports (1127 = SSL, 1126 = STARTTLS) that the 465 heuristic
-// alone cannot classify.
-func TestSMTPTLSMode(t *testing.T) {
-	cases := []struct {
-		name string
-		tls  string
-		port int
-		want string
-	}{
-		{"explicit ssl on a custom port (Selectel 1127)", "ssl", 1127, smtpTLSImplicit},
-		{"explicit starttls on a custom port (Selectel 1126)", "starttls", 1126, smtpTLSSTARTTLS},
-		{"tls is an alias for ssl", "TLS", 2525, smtpTLSImplicit},
-		{"empty derives implicit TLS on 465", "", 465, smtpTLSImplicit},
-		{"empty derives STARTTLS on 587", "", 587, smtpTLSSTARTTLS},
-		{"an unknown value falls back to the port heuristic", "bogus", 465, smtpTLSImplicit},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			if got := (SMTPConfig{TLS: c.tls}).tlsMode(c.port); got != c.want {
-				t.Errorf("tlsMode(TLS=%q, port=%d) = %q, want %q", c.tls, c.port, got, c.want)
-			}
-		})
-	}
-}

backend/internal/account/ratelimit.go

@@ -1,66 +0,0 @@
-package account
-
-import (
-	"sync"
-	"time"
-)
-
-// SendLimiter throttles confirm-code sends per recipient address: it enforces a
-// minimum cooldown between two sends and a cap over a rolling hour. It guards against
-// email bombing and protects the relay's own quota. State is in-memory (per process,
-// reset on restart) and keyed by the normalised recipient address, which is adequate
-// for the single-instance backend. Safe for concurrent use.
-type SendLimiter struct {
-	mu       sync.Mutex
-	cooldown time.Duration
-	perHour  int
-	now      func() time.Time
-	sends    map[string][]time.Time
-}
-
-// NewSendLimiter returns a SendLimiter allowing at most one send per cooldown and at
-// most perHour sends over any rolling hour, to the same recipient.
-func NewSendLimiter(cooldown time.Duration, perHour int) *SendLimiter {
-	return &SendLimiter{
-		cooldown: cooldown,
-		perHour:  perHour,
-		now:      func() time.Time { return time.Now() },
-		sends:    make(map[string][]time.Time),
-	}
-}
-
-// Allow reports whether a send to key is permitted now, recording the send when it is.
-// It is denied when the last send was within the cooldown or the rolling-hour cap is
-// already reached.
-func (l *SendLimiter) Allow(key string) bool {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	now := l.now()
-	cutoff := now.Add(-time.Hour)
-	kept := l.sends[key][:0]
-	for _, t := range l.sends[key] {
-		if t.After(cutoff) {
-			kept = append(kept, t)
-		}
-	}
-	if n := len(kept); n > 0 && now.Sub(kept[n-1]) < l.cooldown {
-		l.set(key, kept)
-		return false
-	}
-	if len(kept) >= l.perHour {
-		l.set(key, kept)
-		return false
-	}
-	l.set(key, append(kept, now))
-	return true
-}
-
-// set stores the retained send times for key, dropping the entry entirely once empty
-// so the map stays bounded to recipients active within the last hour.
-func (l *SendLimiter) set(key string, times []time.Time) {
-	if len(times) == 0 {
-		delete(l.sends, key)
-		return
-	}
-	l.sends[key] = times
-}

backend/internal/account/ratelimit_test.go

@@ -1,43 +0,0 @@
-package account
-
-import (
-	"testing"
-	"time"
-)
-
-// TestSendLimiter checks the per-recipient cooldown and the rolling-hour cap, and
-// that recipients are throttled independently.
-func TestSendLimiter(t *testing.T) {
-	base := time.Now()
-	now := base
-	l := NewSendLimiter(time.Minute, 3)
-	l.now = func() time.Time { return now }
-
-	if !l.Allow("a") {
-		t.Fatal("send 1 should be allowed")
-	}
-	if l.Allow("a") {
-		t.Fatal("immediate resend must be blocked by the cooldown")
-	}
-	if !l.Allow("b") {
-		t.Fatal("a different recipient is independent")
-	}
-
-	now = base.Add(time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("send 2 after the cooldown should be allowed")
-	}
-	now = base.Add(2 * time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("send 3 should be allowed")
-	}
-	now = base.Add(3 * time.Minute)
-	if l.Allow("a") {
-		t.Fatal("send 4 within the hour must be blocked by the cap")
-	}
-
-	now = base.Add(time.Hour + time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("after the rolling hour the cap resets")
-	}
-}

backend/internal/account/retention.go

@@ -1,224 +0,0 @@
-package account
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/go-jet/jet/v2/postgres"
-	"github.com/go-jet/jet/v2/qrm"
-	"github.com/google/uuid"
-	"go.uber.org/zap"
-
-	"scrabble/backend/internal/postgres/jet/backend/model"
-	"scrabble/backend/internal/postgres/jet/backend/table"
-)
-
-// RetentionTTL bounds how long the account-deletion legal dossier is kept before the
-// reaper purges it: two years from the detach/deletion event (owner policy, 2026-07-03).
-const RetentionTTL = 2 * 365 * 24 * time.Hour
-
-// Reasons recorded on a retained_identities row: what detached the credential from its
-// account (unlink / email change / account deletion here; an account merge that drops a
-// same-kind colliding identity writes reason "merge" from the accountmerge package). The
-// row is written just before the live identities row is removed, preserving the legal
-// dossier (which email/vk/tg was linked, and when) even as the identity frees for reuse.
-// See docs/ARCHITECTURE.md §9.1.
-const (
-	retainUnlink = "unlink"
-	retainChange = "change"
-	retainDelete = "delete"
-)
-
-// retainIdentityTx appends a retention-journal row for one identity being detached, inside
-// tx. linkedAt is the identity's original creation time; detached_at defaults to now(). It
-// must run in the same transaction as the identity removal, so the dossier and the live
-// state can never diverge.
-func retainIdentityTx(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, kind, externalID string, confirmed bool, linkedAt time.Time, reason string) error {
-	id, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("account: new retained id: %w", err)
-	}
-	ins := table.RetainedIdentities.INSERT(
-		table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
-		table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
-		table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
-		table.RetainedIdentities.Reason,
-	).VALUES(id, accountID, kind, externalID, confirmed, linkedAt, reason)
-	if _, err := ins.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("account: retain identity (%s, %s): %w", kind, externalID, err)
-	}
-	return nil
-}
-
-// StampLastLogin records the account's last cold-load time and client IP, but only when
-// the stored value is missing or older than an hour — so it costs at most one write per
-// account per hour (its caller, the profile fetch, runs once per cold app-load). It is a
-// best-effort audit signal that feeds the account-deletion dossier.
-func (s *Store) StampLastLogin(ctx context.Context, accountID uuid.UUID, ip string) error {
-	now := time.Now().UTC()
-	upd := table.Accounts.UPDATE(table.Accounts.LastLoginAt, table.Accounts.LastLoginIP).
-		SET(postgres.TimestampzT(now), postgres.String(ip)).
-		WHERE(
-			table.Accounts.AccountID.EQ(postgres.UUID(accountID)).
-				AND(
-					table.Accounts.LastLoginAt.IS_NULL().
-						OR(table.Accounts.LastLoginAt.LT(postgres.TimestampzT(now.Add(-time.Hour)))),
-				),
-		)
-	if _, err := upd.ExecContext(ctx, s.db); err != nil {
-		return fmt.Errorf("account: stamp last login %s: %w", accountID, err)
-	}
-	return nil
-}
-
-// ReapExpiredRetention purges retention data whose event is older than cutoff: every
-// retained_identities row by its detached_at (covering unlink/change on live accounts as
-// well as deleted ones), plus — for accounts tombstoned before cutoff — the retained
-// feedback thread and the dossier PII (deleted_display_name, last_login_ip). Chat is kept
-// (a shared game artifact), and the tombstone account row itself stays (its no-cascade
-// foreign keys). It returns how many journal rows and feedback messages were removed.
-func (s *Store) ReapExpiredRetention(ctx context.Context, cutoff time.Time) (identities, feedback int64, err error) {
-	cut := postgres.TimestampzT(cutoff)
-	delJournal := table.RetainedIdentities.DELETE().
-		WHERE(table.RetainedIdentities.DetachedAt.LT(cut))
-	res, err := delJournal.ExecContext(ctx, s.db)
-	if err != nil {
-		return 0, 0, fmt.Errorf("account: reap retained identities: %w", err)
-	}
-	identities, _ = res.RowsAffected()
-
-	expired := postgres.SELECT(table.Accounts.AccountID).
-		FROM(table.Accounts).
-		WHERE(table.Accounts.DeletedAt.IS_NOT_NULL().AND(table.Accounts.DeletedAt.LT(cut)))
-	delFeedback := table.FeedbackMessages.DELETE().
-		WHERE(table.FeedbackMessages.AccountID.IN(expired))
-	fbRes, err := delFeedback.ExecContext(ctx, s.db)
-	if err != nil {
-		return identities, 0, fmt.Errorf("account: reap deleted feedback: %w", err)
-	}
-	feedback, _ = fbRes.RowsAffected()
-
-	clearPII := table.Accounts.UPDATE(table.Accounts.DeletedDisplayName, table.Accounts.LastLoginIP).
-		SET(postgres.NULL, postgres.NULL).
-		WHERE(
-			table.Accounts.DeletedAt.IS_NOT_NULL().
-				AND(table.Accounts.DeletedAt.LT(cut)).
-				AND(table.Accounts.DeletedDisplayName.IS_NOT_NULL().
-					OR(table.Accounts.LastLoginIP.IS_NOT_NULL())),
-		)
-	if _, err := clearPII.ExecContext(ctx, s.db); err != nil {
-		return identities, feedback, fmt.Errorf("account: clear expired dossier PII: %w", err)
-	}
-	return identities, feedback, nil
-}
-
-// RetainedIdentity is one row of the retention journal, for the admin dossier.
-type RetainedIdentity struct {
-	Kind       string
-	ExternalID string
-	Reason     string
-	Confirmed  bool
-	LinkedAt   time.Time
-	DetachedAt time.Time
-}
-
-// RetainedIdentities returns the account's retention-journal rows (the legal dossier of
-// detached credentials), newest detach first, for the admin console.
-func (s *Store) RetainedIdentities(ctx context.Context, accountID uuid.UUID) ([]RetainedIdentity, error) {
-	var rows []model.RetainedIdentities
-	err := postgres.SELECT(table.RetainedIdentities.AllColumns).
-		FROM(table.RetainedIdentities).
-		WHERE(table.RetainedIdentities.AccountID.EQ(postgres.UUID(accountID))).
-		ORDER_BY(table.RetainedIdentities.DetachedAt.DESC()).
-		QueryContext(ctx, s.db, &rows)
-	if err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return nil, fmt.Errorf("account: retained identities %s: %w", accountID, err)
-	}
-	out := make([]RetainedIdentity, 0, len(rows))
-	for _, r := range rows {
-		out = append(out, RetainedIdentity{
-			Kind: r.Kind, ExternalID: r.ExternalID, Reason: r.Reason,
-			Confirmed: r.Confirmed, LinkedAt: r.LinkedAt, DetachedAt: r.DetachedAt,
-		})
-	}
-	return out, nil
-}
-
-// DeletionInfo is a tombstoned account's dossier header, for the admin console.
-type DeletionInfo struct {
-	DeletedAt          *time.Time
-	DeletedDisplayName string
-	LastLoginAt        *time.Time
-	LastLoginIP        string
-}
-
-// DeletionInfo reads the account's deletion tombstone + last-login dossier fields.
-func (s *Store) DeletionInfo(ctx context.Context, accountID uuid.UUID) (DeletionInfo, error) {
-	var row model.Accounts
-	err := postgres.SELECT(
-		table.Accounts.DeletedAt, table.Accounts.DeletedDisplayName,
-		table.Accounts.LastLoginAt, table.Accounts.LastLoginIP,
-	).FROM(table.Accounts).
-		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(accountID))).
-		QueryContext(ctx, s.db, &row)
-	if err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return DeletionInfo{}, ErrNotFound
-		}
-		return DeletionInfo{}, fmt.Errorf("account: deletion info %s: %w", accountID, err)
-	}
-	info := DeletionInfo{DeletedAt: row.DeletedAt, LastLoginAt: row.LastLoginAt}
-	if row.DeletedDisplayName != nil {
-		info.DeletedDisplayName = *row.DeletedDisplayName
-	}
-	if row.LastLoginIP != nil {
-		info.LastLoginIP = *row.LastLoginIP
-	}
-	return info, nil
-}
-
-// RetentionReaper periodically purges expired account-deletion retention data via
-// Store.ReapExpiredRetention, mirroring GuestReaper: one background goroutine started once
-// from main.
-type RetentionReaper struct {
-	store *Store
-	ttl   time.Duration
-	clock func() time.Time
-	log   *zap.Logger
-}
-
-// NewRetentionReaper constructs a reaper purging retention data older than ttl. log may be
-// nil.
-func NewRetentionReaper(store *Store, ttl time.Duration, log *zap.Logger) *RetentionReaper {
-	if log == nil {
-		log = zap.NewNop()
-	}
-	return &RetentionReaper{
-		store: store,
-		ttl:   ttl,
-		clock: func() time.Time { return time.Now().UTC() },
-		log:   log,
-	}
-}
-
-// Run purges expired retention data on each tick until ctx is cancelled.
-func (r *RetentionReaper) Run(ctx context.Context, interval time.Duration) {
-	ticker := time.NewTicker(interval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			idn, fb, err := r.store.ReapExpiredRetention(ctx, r.clock().Add(-r.ttl))
-			if err != nil {
-				r.log.Warn("retention reap failed", zap.Error(err))
-			} else if idn > 0 || fb > 0 {
-				r.log.Info("reaped expired retention", zap.Int64("identities", idn), zap.Int64("feedback", fb))
-			}
-		}
-	}
-}

backend/internal/account/userlist.go

@@ -19,9 +19,6 @@ type UserListItem struct {
 	PreferredLanguage string
 	IsGuest           bool
 	IsRobot           bool
-	// IsDeleted marks a tombstoned account (deleted_at set), shown as a badge — a search
-	// spans both lists, so a result can be either live or deleted.
-	IsDeleted bool
 	// FlaggedHighRateAt is the soft high-rate marker (zero when unflagged), shown
 	// as a badge in the console list.
 	FlaggedHighRateAt time.Time
@@ -29,17 +26,13 @@ type UserListItem struct {
 }
 
 // UserFilter narrows the admin user list: Robots selects robot accounts (otherwise the
-// non-robot "people"); Deleted selects tombstoned accounts (every other scope hides them);
-// NameMask and ExternalIDMask are glob masks ('*' = any run, '?' = one char) matched
-// case-insensitively against the display name / any identity's external id; EmailExact is a
-// strict (exact) match against an account's email identity. An empty value means no filter
-// on that field.
+// non-robot "people"); NameMask and ExternalIDMask are glob masks ('*' = any run, '?' =
+// one char) matched case-insensitively against the display name / any identity's external
+// id. An empty mask means no filter on that field.
 type UserFilter struct {
 	Robots         bool
-	Deleted        bool
 	NameMask       string
 	ExternalIDMask string
-	EmailExact     string
 }
 
 // robotExists is the correlated subquery testing whether account a is a robot.
@@ -58,42 +51,17 @@ func (s *Store) IsRobot(ctx context.Context, accountID uuid.UUID) (bool, error)
 	return ok, nil
 }
 
-// userListWhere builds the shared WHERE clause and its positional args (from $1). On the
-// Robots tab it lists/searches robots only. Otherwise a search (any of the name /
-// external-id / email filters) spans live and deleted people alike — never robots — so the
-// operator finds a match from one query regardless of the People / Deleted tab; the search
-// also looks in the retention journal, so a deleted account is still found by the email /
-// external id it held (those rows moved from identities to retained_identities on deletion)
-// and by its retained real name. With no search, the People / Deleted tab scope applies.
+// userListWhere builds the shared WHERE clause and its positional args (from $1).
 func userListWhere(f UserFilter) (string, []any) {
-	name := LikePattern(f.NameMask)
-	ext := LikePattern(f.ExternalIDMask)
-	email := strings.ToLower(strings.TrimSpace(f.EmailExact))
-	searching := name != "" || ext != "" || email != ""
-
-	var args []any
-	var where string
-	switch {
-	case f.Robots:
-		where = robotExists + ` = true`
-	case searching:
-		where = robotExists + ` = false`
-	case f.Deleted:
-		where = robotExists + ` = false AND a.deleted_at IS NOT NULL`
-	default:
-		where = robotExists + ` = false AND a.deleted_at IS NULL`
-	}
-	if name != "" {
+	args := []any{f.Robots}
+	where := robotExists + ` = $1`
+	if name := LikePattern(f.NameMask); name != "" {
 		args = append(args, name)
-		where += fmt.Sprintf(` AND (a.display_name ILIKE $%d ESCAPE '\' OR a.deleted_display_name ILIKE $%d ESCAPE '\')`, len(args), len(args))
+		where += fmt.Sprintf(` AND a.display_name ILIKE $%d ESCAPE '\'`, len(args))
 	}
-	if ext != "" {
+	if ext := LikePattern(f.ExternalIDMask); ext != "" {
 		args = append(args, ext)
-		where += fmt.Sprintf(` AND (EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.external_id ILIKE $%d ESCAPE '\') OR EXISTS (SELECT 1 FROM backend.retained_identities r WHERE r.account_id = a.account_id AND r.external_id ILIKE $%d ESCAPE '\'))`, len(args), len(args))
-	}
-	if email != "" {
-		args = append(args, email)
-		where += fmt.Sprintf(` AND (EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.kind = 'email' AND i.external_id = $%d) OR EXISTS (SELECT 1 FROM backend.retained_identities r WHERE r.account_id = a.account_id AND r.kind = 'email' AND r.external_id = $%d))`, len(args), len(args))
+		where += fmt.Sprintf(` AND EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.external_id ILIKE $%d ESCAPE '\')`, len(args))
 	}
 	return where, args
 }
@@ -101,7 +69,7 @@ func userListWhere(f UserFilter) (string, []any) {
 // ListUsers returns the filtered admin user list, newest first, paginated.
 func (s *Store) ListUsers(ctx context.Context, f UserFilter, limit, offset int) ([]UserListItem, error) {
 	where, args := userListWhere(f)
-	q := `SELECT a.account_id, a.display_name, a.preferred_language, a.is_guest, a.flagged_high_rate_at, a.created_at, ` + robotExists + ` AS is_robot, (a.deleted_at IS NOT NULL) AS is_deleted
+	q := `SELECT a.account_id, a.display_name, a.preferred_language, a.is_guest, a.flagged_high_rate_at, a.created_at, ` + robotExists + ` AS is_robot
 FROM backend.accounts a WHERE ` + where +
 		fmt.Sprintf(` ORDER BY a.created_at DESC LIMIT $%d OFFSET $%d`, len(args)+1, len(args)+2)
 	args = append(args, limit, offset)
@@ -114,7 +82,7 @@ FROM backend.accounts a WHERE ` + where +
 	for rows.Next() {
 		var it UserListItem
 		var flagged sql.NullTime
-		if err := rows.Scan(&it.ID, &it.DisplayName, &it.PreferredLanguage, &it.IsGuest, &flagged, &it.CreatedAt, &it.IsRobot, &it.IsDeleted); err != nil {
+		if err := rows.Scan(&it.ID, &it.DisplayName, &it.PreferredLanguage, &it.IsGuest, &flagged, &it.CreatedAt, &it.IsRobot); err != nil {
 			return nil, fmt.Errorf("account: scan user: %w", err)
 		}
 		if flagged.Valid {

backend/internal/accountdelete/delete.go

@@ -1,223 +0,0 @@
-// Package accountdelete deactivates an account as legal retention, not erasure: it keeps
-// the account row as a tombstone (its chat/complaint foreign keys have no cascade, so a
-// hard delete is impossible) while journalling and freeing the account's credentials,
-// anonymising the live surfaces, and dropping the account's own social/ephemeral rows.
-// The retained_identities journal plus the tombstone (deleted_at, deleted_display_name,
-// last_login_at/ip) form the admin/legal dossier; messages are deliberately kept. Session
-// revocation and active-game forfeit are orchestrated one layer up (they need the session
-// cache and the game service). See docs/ARCHITECTURE.md §9.1 and the retention TTL reaper.
-package accountdelete
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/go-jet/jet/v2/postgres"
-	"github.com/go-jet/jet/v2/qrm"
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/postgres/jet/backend/model"
-	"scrabble/backend/internal/postgres/jet/backend/table"
-)
-
-// AnonymizedName is the label a deleted account shows to opponents. Display names are
-// stored strings resolved identically for every viewer (no per-viewer localisation in this
-// codebase), so a single canonical label is used. The brackets are deliberate: the
-// editable-name rule (account.displayNameRe) forbids them, so a live player can never set a
-// name that impersonates a deleted account.
-const AnonymizedName = "[Deleted]"
-
-// retainDelete is the retained_identities reason written when a credential is journalled
-// because its account is being deleted.
-const retainDelete = "delete"
-
-// Deleter performs the SQL-atomic part of account deletion over a Postgres handle.
-type Deleter struct {
-	db  *sql.DB
-	now func() time.Time
-}
-
-// NewDeleter constructs a Deleter over db.
-func NewDeleter(db *sql.DB) *Deleter {
-	return &Deleter{db: db, now: func() time.Time { return time.Now().UTC() }}
-}
-
-// AnonymizeAndTombstone retires accountID atomically: it journals every live identity into
-// retained_identities (reason=delete) then removes them so the credentials free for reuse,
-// snapshots the real display name into deleted_display_name and scrubs the live one to
-// AnonymizedName, sets deleted_at, anonymises the account's game-seat snapshots, and drops
-// its friendships, blocks, invitations, friend codes, drafts and pending codes. Chat,
-// feedback and complaints are kept (the surviving tombstone keeps their no-cascade foreign
-// keys valid). It is idempotent-safe on an already-tombstoned account (re-journalling
-// nothing, since the identities are already gone).
-func (d *Deleter) AnonymizeAndTombstone(ctx context.Context, accountID uuid.UUID) error {
-	now := d.now()
-	return withTx(ctx, d.db, func(tx *sql.Tx) error {
-		if err := journalAndDropIdentities(ctx, tx, accountID, now); err != nil {
-			return err
-		}
-		if err := tombstone(ctx, tx, accountID, now); err != nil {
-			return err
-		}
-		if _, err := table.GamePlayers.UPDATE(table.GamePlayers.DisplayName).
-			SET(postgres.String(AnonymizedName)).
-			WHERE(table.GamePlayers.AccountID.EQ(postgres.UUID(accountID))).
-			ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountdelete: anonymise seats: %w", err)
-		}
-		return dropSocialAndEphemerals(ctx, tx, accountID)
-	})
-}
-
-// dropAllRobotGamesSQL deletes every game in which the account plays and no other seat is a
-// human — a robot seat is one whose account holds a 'robot' identity, so this covers both
-// honest vs-AI games and disguised auto-match substitutes. The game rows are deleted; their
-// moves/chat/players/complaints fall away through ON DELETE CASCADE.
-const dropAllRobotGamesSQL = `
-DELETE FROM games g
-WHERE EXISTS (
-    SELECT 1 FROM game_players p WHERE p.game_id = g.game_id AND p.account_id = $1
-) AND NOT EXISTS (
-    SELECT 1 FROM game_players o
-    WHERE o.game_id = g.game_id AND o.account_id <> $1
-      AND NOT EXISTS (
-          SELECT 1 FROM identities i WHERE i.account_id = o.account_id AND i.kind = 'robot'
-      )
-)`
-
-// DropAllRobotGames deletes the account's games that have no human opponent (solo vs-AI or
-// auto-match-robot games), returning how many were removed. Games with any human seat are
-// kept — their seat is anonymised by AnonymizeAndTombstone instead. Run it after the
-// account's active games are resigned, so no live game is removed under the robot driver.
-func (d *Deleter) DropAllRobotGames(ctx context.Context, accountID uuid.UUID) (int64, error) {
-	res, err := d.db.ExecContext(ctx, dropAllRobotGamesSQL, accountID)
-	if err != nil {
-		return 0, fmt.Errorf("accountdelete: drop all-robot games: %w", err)
-	}
-	n, err := res.RowsAffected()
-	if err != nil {
-		return 0, fmt.Errorf("accountdelete: dropped games count: %w", err)
-	}
-	return n, nil
-}
-
-// journalAndDropIdentities copies the account's live identities into the retention journal
-// (reason=delete) and then removes them, freeing each (kind, external_id) for reuse.
-func journalAndDropIdentities(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, now time.Time) error {
-	var ids []model.Identities
-	err := postgres.SELECT(table.Identities.AllColumns).
-		FROM(table.Identities).
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(accountID))).
-		QueryContext(ctx, tx, &ids)
-	if err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return fmt.Errorf("accountdelete: load identities: %w", err)
-	}
-	for _, id := range ids {
-		rid, err := uuid.NewV7()
-		if err != nil {
-			return fmt.Errorf("accountdelete: new retained id: %w", err)
-		}
-		ins := table.RetainedIdentities.INSERT(
-			table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
-			table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
-			table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
-			table.RetainedIdentities.DetachedAt, table.RetainedIdentities.Reason,
-		).VALUES(rid, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, now, retainDelete)
-		if _, err := ins.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountdelete: retain identity %s: %w", id.Kind, err)
-		}
-	}
-	if _, err := table.Identities.DELETE().
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(accountID))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete identities: %w", err)
-	}
-	return nil
-}
-
-// tombstone marks the account deleted, snapshotting the real display name into
-// deleted_display_name (evaluated from the old row) before scrubbing the live one.
-func tombstone(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, now time.Time) error {
-	upd := table.Accounts.UPDATE(
-		table.Accounts.DeletedAt, table.Accounts.DeletedDisplayName,
-		table.Accounts.DisplayName, table.Accounts.UpdatedAt,
-	).SET(
-		postgres.TimestampzT(now), table.Accounts.DisplayName,
-		postgres.String(AnonymizedName), postgres.TimestampzT(now),
-	).WHERE(table.Accounts.AccountID.EQ(postgres.UUID(accountID)))
-	if _, err := upd.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: tombstone account: %w", err)
-	}
-	return nil
-}
-
-// dropSocialAndEphemerals removes the account's own friendships, blocks, invitations
-// (as inviter and as invitee), friend codes, drafts and pending confirm-codes. These are
-// the deleting user's private data with no dossier value; chat and feedback are kept.
-func dropSocialAndEphemerals(ctx context.Context, tx *sql.Tx, accountID uuid.UUID) error {
-	id := postgres.UUID(accountID)
-	// Friendships and blocks are two-account edges keyed on either endpoint.
-	if _, err := table.Friendships.DELETE().
-		WHERE(table.Friendships.RequesterID.EQ(id).OR(table.Friendships.AddresseeID.EQ(id))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete friendships: %w", err)
-	}
-	if _, err := table.Blocks.DELETE().
-		WHERE(table.Blocks.BlockerID.EQ(id).OR(table.Blocks.BlockedID.EQ(id))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete blocks: %w", err)
-	}
-	// Invitations: drop the account's invitee rows, then its own invitations' invitees and
-	// the invitations themselves (children first, to respect the foreign key).
-	if _, err := table.GameInvitationInvitees.DELETE().
-		WHERE(table.GameInvitationInvitees.AccountID.EQ(id)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete invitee rows: %w", err)
-	}
-	ownInvitations := postgres.SELECT(table.GameInvitations.InvitationID).
-		FROM(table.GameInvitations).
-		WHERE(table.GameInvitations.InviterID.EQ(id))
-	if _, err := table.GameInvitationInvitees.DELETE().
-		WHERE(table.GameInvitationInvitees.InvitationID.IN(ownInvitations)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete own invitation invitees: %w", err)
-	}
-	if _, err := table.GameInvitations.DELETE().
-		WHERE(table.GameInvitations.InviterID.EQ(id)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete invitations: %w", err)
-	}
-	// Ephemerals: friend codes, move drafts, pending confirm-codes.
-	if _, err := table.FriendCodes.DELETE().
-		WHERE(table.FriendCodes.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete friend codes: %w", err)
-	}
-	if _, err := table.GameDrafts.DELETE().
-		WHERE(table.GameDrafts.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete drafts: %w", err)
-	}
-	if _, err := table.EmailConfirmations.DELETE().
-		WHERE(table.EmailConfirmations.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete confirmations: %w", err)
-	}
-	return nil
-}
-
-// withTx runs fn inside a transaction, committing on success and rolling back on error.
-func withTx(ctx context.Context, db *sql.DB, fn func(tx *sql.Tx) error) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("accountdelete: begin tx: %w", err)
-	}
-	if err := fn(tx); err != nil {
-		_ = tx.Rollback()
-		return err
-	}
-	if err := tx.Commit(); err != nil {
-		return fmt.Errorf("accountdelete: commit tx: %w", err)
-	}
-	return nil
-}

backend/internal/accountmerge/merge.go

@@ -27,11 +27,6 @@ import (
 // without taking a dependency on the game package.
 const statusActive = "active"
 
-// retainReasonMerge is the retained_identities.reason for a credential dropped by a merge
-// collision (both accounts held the same kind). It mirrors the account package's retain
-// reasons, kept local to avoid importing that package's unexported constants.
-const retainReasonMerge = "merge"
-
 // Friendship statuses, highest precedence first, mirroring internal/social.
 const (
 	friendAccepted = "accepted"
@@ -51,24 +46,8 @@ var ErrSameAccount = errors.New("accountmerge: primary and secondary are the sam
 type Merger struct {
 	db  *sql.DB
 	now func() time.Time
-	// payments, when set, merges the two accounts' chip segments and benefits by origin inside
-	// the merge transaction (SetPayments). Nil leaves payments untouched (tests that do not
-	// exercise the wallet).
-	payments PaymentsMerger
 }
 
-// PaymentsMerger is the payments surface the account merge enlists: fold the secondary's
-// segments and benefits into the primary within the merge transaction, then invalidate the
-// affected read caches after the commit. *payments.Service satisfies it.
-type PaymentsMerger interface {
-	MergeTx(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID) error
-	Invalidate(ids ...uuid.UUID)
-}
-
-// SetPayments installs the payments merge hook. It must be called during startup wiring; the
-// default (nil) merges no wallet state.
-func (m *Merger) SetPayments(p PaymentsMerger) { m.payments = p }
-
 // NewMerger constructs a Merger over db.
 func NewMerger(db *sql.DB) *Merger {
 	return &Merger{db: db, now: func() time.Time { return time.Now().UTC() }}
@@ -83,7 +62,7 @@ func (m *Merger) Merge(ctx context.Context, primary, secondary uuid.UUID) error
 		return ErrSameAccount
 	}
 	now := m.now()
-	if err := withTx(ctx, m.db, func(tx *sql.Tx) error {
+	return withTx(ctx, m.db, func(tx *sql.Tx) error {
 		if err := guardActiveSharedGame(ctx, tx, primary, secondary); err != nil {
 			return err
 		}
@@ -96,9 +75,6 @@ func (m *Merger) Merge(ctx context.Context, primary, secondary uuid.UUID) error
 		if err := mergeAccountFields(ctx, tx, primary, secondary, now); err != nil {
 			return err
 		}
-		if err := dedupeIdentities(ctx, tx, primary, secondary); err != nil {
-			return err
-		}
 		if err := reassignColumn(ctx, tx, table.Identities, table.Identities.AccountID, primary, secondary); err != nil {
 			return fmt.Errorf("accountmerge: identities: %w", err)
 		}
@@ -123,21 +99,8 @@ func (m *Merger) Merge(ctx context.Context, primary, secondary uuid.UUID) error
 		if err := deleteEphemerals(ctx, tx, secondary); err != nil {
 			return err
 		}
-		if m.payments != nil {
-			if err := m.payments.MergeTx(ctx, tx, primary, secondary); err != nil {
-				return fmt.Errorf("accountmerge: payments: %w", err)
-			}
-		}
 		return tombstone(ctx, tx, primary, secondary, now)
-	}); err != nil {
-		return err
-	}
-	// The payments read cache is invalidated only after the merge commits, so a read racing the
-	// transaction cannot re-cache pre-merge state (both accounts' rows are moved or dropped).
-	if m.payments != nil {
-		m.payments.Invalidate(primary, secondary)
-	}
-	return nil
+	})
 }
 
 // guardActiveSharedGame returns ErrActiveGameConflict when primary and secondary
@@ -277,16 +240,25 @@ func mergeBestMoves(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUI
 	return nil
 }
 
-// mergeAccountFields bumps the primary account's updated_at to reflect the merge. The former
-// hint-wallet and paid-flag merge moved to the payments domain, where segments and benefits
-// merge by origin (see the payments MergeTx step and docs/PAYMENTS.md §6); the legacy
-// accounts.hint_balance / paid_account columns are deprecated and no longer read or written.
-func mergeAccountFields(ctx context.Context, tx *sql.Tx, primary, _ uuid.UUID, now time.Time) error {
-	upd := table.Accounts.UPDATE(table.Accounts.UpdatedAt).
-		SET(postgres.TimestampzT(now)).
-		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(primary)))
+// mergeAccountFields adds secondary's hint wallet to primary and ORs the paid flag;
+// all other profile fields stay the primary's.
+func mergeAccountFields(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID, now time.Time) error {
+	var sec model.Accounts
+	if err := postgres.SELECT(table.Accounts.AllColumns).
+		FROM(table.Accounts).
+		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(secondary))).
+		QueryContext(ctx, tx, &sec); err != nil {
+		return fmt.Errorf("accountmerge: load secondary account: %w", err)
+	}
+	upd := table.Accounts.UPDATE(
+		table.Accounts.HintBalance, table.Accounts.PaidAccount, table.Accounts.UpdatedAt,
+	).SET(
+		table.Accounts.HintBalance.ADD(postgres.Int(int64(sec.HintBalance))),
+		table.Accounts.PaidAccount.OR(postgres.Bool(sec.PaidAccount)),
+		postgres.TimestampzT(now),
+	).WHERE(table.Accounts.AccountID.EQ(postgres.UUID(primary)))
 	if _, err := upd.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountmerge: touch primary account: %w", err)
+		return fmt.Errorf("accountmerge: update primary account: %w", err)
 	}
 	return nil
 }
@@ -328,77 +300,6 @@ func reassignColumn(ctx context.Context, tx *sql.Tx, tbl postgres.Table, col pos
 	return err
 }
 
-// dedupeIdentities resolves a same-kind identity collision before the blanket identity
-// reassign: when both accounts already hold an identity of the same kind (e.g. each has a
-// confirmed email — reachable when two email-bearing accounts merge), the primary keeps
-// its own and the secondary's is journaled to retained_identities (reason=merge) and
-// removed. Without this the blanket reassign would leave the survivor with two identities
-// of one kind (there is no per-account-kind unique on identities), which the profile and
-// the retention dossier both treat as singular. Non-colliding identities are untouched and
-// move with the blanket reassign.
-func dedupeIdentities(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID) error {
-	var prows []model.Identities
-	if err := postgres.SELECT(table.Identities.Kind).
-		FROM(table.Identities).
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(primary))).
-		QueryContext(ctx, tx, &prows); err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return fmt.Errorf("accountmerge: primary identity kinds: %w", err)
-	}
-	occupied := make(map[string]struct{}, len(prows))
-	for _, r := range prows {
-		occupied[r.Kind] = struct{}{}
-	}
-	if len(occupied) == 0 {
-		return nil
-	}
-	var srows []model.Identities
-	if err := postgres.SELECT(
-		table.Identities.Kind, table.Identities.ExternalID,
-		table.Identities.Confirmed, table.Identities.CreatedAt,
-	).FROM(table.Identities).
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(secondary))).
-		QueryContext(ctx, tx, &srows); err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return fmt.Errorf("accountmerge: secondary identities: %w", err)
-	}
-	for _, s := range srows {
-		if _, dup := occupied[s.Kind]; !dup {
-			continue
-		}
-		if err := retainMergedIdentity(ctx, tx, secondary, s); err != nil {
-			return err
-		}
-		del := table.Identities.DELETE().WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(secondary)).
-				AND(table.Identities.Kind.EQ(postgres.String(s.Kind))).
-				AND(table.Identities.ExternalID.EQ(postgres.String(s.ExternalID))),
-		)
-		if _, err := del.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountmerge: drop colliding %s identity: %w", s.Kind, err)
-		}
-	}
-	return nil
-}
-
-// retainMergedIdentity appends a retained_identities row for a secondary identity dropped
-// by a merge collision (reason=merge), preserving it in the legal dossier. It mirrors
-// account.retainIdentityTx, which is unexported; detached_at falls to the column default.
-func retainMergedIdentity(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, id model.Identities) error {
-	rid, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("accountmerge: new retained id: %w", err)
-	}
-	ins := table.RetainedIdentities.INSERT(
-		table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
-		table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
-		table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
-		table.RetainedIdentities.Reason,
-	).VALUES(rid, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, retainReasonMerge)
-	if _, err := ins.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountmerge: retain merged %s identity: %w", id.Kind, err)
-	}
-	return nil
-}
-
 // friendRank ranks a friendship status for dedupe precedence (higher wins).
 func friendRank(status string) int {
 	switch status {

backend/internal/adminalert/notify.go

@@ -1,115 +0,0 @@
-// Package adminalert emails the operator when new player feedback or word complaints
-// arrive, coalescing a burst into a single digest per interval so a flood is one email,
-// not N. It is inert unless an admin sender and recipient are configured. The sender is
-// distinct from the user-facing confirm-code From, and the recipient may be several
-// comma-separated addresses (the mailer splits them).
-package adminalert
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"time"
-
-	"go.uber.org/zap"
-
-	"scrabble/backend/internal/account"
-)
-
-// FeedbackCounter counts feedback created since a time (satisfied by feedback.Service).
-type FeedbackCounter interface {
-	CountSince(ctx context.Context, since time.Time) (int, error)
-}
-
-// ComplaintCounter counts word complaints filed since a time (satisfied by game.Service).
-type ComplaintCounter interface {
-	CountComplaintsSince(ctx context.Context, since time.Time) (int, error)
-}
-
-// Notifier polls for new feedback and complaints and emails the operator a digest.
-type Notifier struct {
-	mailer     account.Mailer
-	feedback   FeedbackCounter
-	complaints ComplaintCounter
-	from       string
-	to         string
-	clock      func() time.Time
-	log        *zap.Logger
-	last       time.Time
-}
-
-// New constructs a Notifier. from and to are the alert sender and recipient(s); log may be
-// nil. The watermark starts at "now", so only items arriving after start-up are reported. The
-// digest deliberately carries no admin-console link — an admin URL must never travel in an
-// email, where a mail provider could cache or index it.
-func New(mailer account.Mailer, fb FeedbackCounter, cp ComplaintCounter, from, to string, log *zap.Logger) *Notifier {
-	if log == nil {
-		log = zap.NewNop()
-	}
-	return &Notifier{
-		mailer: mailer, feedback: fb, complaints: cp, from: from, to: to,
-		clock: func() time.Time { return time.Now().UTC() }, log: log, last: time.Now().UTC(),
-	}
-}
-
-// Run polls on each tick until ctx is cancelled.
-func (n *Notifier) Run(ctx context.Context, interval time.Duration) {
-	ticker := time.NewTicker(interval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			n.tick(ctx)
-		}
-	}
-}
-
-// tick counts what arrived since the last watermark and, if anything did, emails one
-// digest. The watermark only advances after a successful send (or a quiet tick), so a
-// transient send failure is retried on the next tick — the counts simply grow.
-func (n *Notifier) tick(ctx context.Context) {
-	now := n.clock()
-	fb, err := n.feedback.CountSince(ctx, n.last)
-	if err != nil {
-		n.log.Warn("admin alert: count feedback failed", zap.Error(err))
-		return
-	}
-	cp, err := n.complaints.CountComplaintsSince(ctx, n.last)
-	if err != nil {
-		n.log.Warn("admin alert: count complaints failed", zap.Error(err))
-		return
-	}
-	if fb == 0 && cp == 0 {
-		n.last = now
-		return
-	}
-	if err := n.mailer.Send(ctx, n.digest(fb, cp)); err != nil {
-		n.log.Warn("admin alert: send failed", zap.Error(err))
-		return
-	}
-	n.log.Info("admin alert sent", zap.Int("feedback", fb), zap.Int("complaints", cp))
-	n.last = now
-}
-
-// digest builds the operator alert email for fb new feedback and cp new complaints.
-func (n *Notifier) digest(fb, cp int) account.Message {
-	var parts []string
-	if fb > 0 {
-		parts = append(parts, fmt.Sprintf("%d new feedback message(s)", fb))
-	}
-	if cp > 0 {
-		parts = append(parts, fmt.Sprintf("%d new word complaint(s)", cp))
-	}
-	summary := strings.Join(parts, ", ")
-	// No admin-console link in the body: an admin URL must never travel in an email (a mail
-	// provider could cache or index it). The operator opens the console directly.
-	text := summary + "."
-	return account.Message{
-		From:    n.from,
-		To:      n.to,
-		Subject: "Erudit — " + summary,
-		Text:    text,
-	}
-}

backend/internal/adminalert/notify_test.go

@@ -1,57 +0,0 @@
-package adminalert
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	"scrabble/backend/internal/account"
-)
-
-// The fakes ignore the watermark and return a fixed count, which is all the digest logic
-// needs.
-type fbCounter struct{ n int }
-
-func (f fbCounter) CountSince(context.Context, time.Time) (int, error) { return f.n, nil }
-
-type cpCounter struct{ n int }
-
-func (c cpCounter) CountComplaintsSince(context.Context, time.Time) (int, error) { return c.n, nil }
-
-type recordingMailer struct{ sent []account.Message }
-
-func (m *recordingMailer) Send(_ context.Context, msg account.Message) error {
-	m.sent = append(m.sent, msg)
-	return nil
-}
-
-func TestNotifierSkipsWhenNothingNew(t *testing.T) {
-	mailer := &recordingMailer{}
-	n := New(mailer, fbCounter{0}, cpCounter{0}, "alerts@erudit-game.ru", "op@x.ru", nil)
-	n.tick(context.Background())
-	if len(mailer.sent) != 0 {
-		t.Fatalf("sent %d emails, want 0 when nothing is new", len(mailer.sent))
-	}
-}
-
-func TestNotifierDigestsNewItems(t *testing.T) {
-	mailer := &recordingMailer{}
-	n := New(mailer, fbCounter{2}, cpCounter{1}, "alerts@erudit-game.ru", "op@x.ru, two@x.ru", nil)
-	n.tick(context.Background())
-	if len(mailer.sent) != 1 {
-		t.Fatalf("sent %d emails, want 1 digest", len(mailer.sent))
-	}
-	msg := mailer.sent[0]
-	if msg.From != "alerts@erudit-game.ru" || msg.To != "op@x.ru, two@x.ru" {
-		t.Errorf("digest addressing = From %q To %q", msg.From, msg.To)
-	}
-	if !strings.Contains(msg.Subject, "2 new feedback") || !strings.Contains(msg.Subject, "1 new word complaint") {
-		t.Errorf("digest subject = %q, want the feedback + complaint counts", msg.Subject)
-	}
-	// The digest must never carry an admin-console link — an admin URL in an email is a leak
-	// (mail providers cache/index it).
-	if strings.Contains(msg.Text, "/_gm") || strings.Contains(strings.ToLower(msg.Text), "admin console") {
-		t.Errorf("digest body = %q, must not carry an admin-console link", msg.Text)
-	}
-}

backend/internal/adminconsole/assets/console.css

@@ -193,24 +193,3 @@ code { background: var(--bg); padding: 0.05rem 0.3rem; border-radius: 4px; }
 .replay-log { margin: 0.4rem 0 0; padding-left: 1.4rem; max-height: 14rem; overflow: auto; font-size: 0.85rem; }
 .replay-log li { color: var(--ink-dim); padding: 0.1rem 0; }
 .replay-log li.cur { color: var(--ink); font-weight: 600; }
-
-/* Banner colour override editor + live preview (banner_detail). The override
-   fieldsets group the enable toggle with the native colour swatches; the preview
-   renders a sample strip on both themes from those inputs (see the inline script). */
-.ovr { border: 1px solid var(--line); border-radius: 6px; padding: 0.3rem 0.8rem 0.7rem; margin: 0.2rem 0; }
-.ovr legend { padding: 0 0.3rem; font-size: 0.85rem; color: var(--ink); }
-.ovr legend label { flex-direction: row; align-items: center; gap: 0.4rem; color: var(--ink); }
-.ovr .note { margin: 0.2rem 0 0.4rem; }
-.ovr .swatches { display: flex; flex-wrap: wrap; gap: 1rem; }
-.ovr .swatches label { flex-direction: column; gap: 0.25rem; align-items: flex-start; }
-.ovr input[type=color] { width: 3rem; height: 1.8rem; padding: 0; border: 1px solid var(--line); border-radius: 4px; background: var(--bg); cursor: pointer; }
-.ovr input[type=color]:disabled { opacity: 0.4; cursor: default; }
-.ovr .hex { font-size: 0.72rem; color: var(--ink-dim); font-variant-numeric: tabular-nums; }
-.banner-preview { display: flex; flex-wrap: wrap; gap: 0.8rem; margin: 0.7rem 0 0.2rem; }
-.banner-preview .bp { flex: 1 1 18rem; }
-.banner-preview .bp-label { display: block; font-size: 0.75rem; color: var(--ink-dim); margin-bottom: 0.25rem; }
-.ad-frame { padding: 0.7rem; border-radius: 6px; border: 1px solid var(--line); }
-.ad-frame.light { background: #f4f6f9; }
-.ad-frame.dark { background: #0f1420; }
-.ad-sample { padding: 0.35rem 0.7rem; font-size: 0.85rem; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
-.ad-sample .ad-link { text-decoration: underline; }

backend/internal/adminconsole/templates/pages/banner_detail.gohtml

@@ -11,72 +11,10 @@
 <label>Starts (UTC) <input type="datetime-local" name="starts_at" value="{{.StartsAt}}"></label>
 <label>Ends (UTC) <input type="datetime-local" name="ends_at" value="{{.EndsAt}}"></label>
 <label><input type="checkbox" name="enabled"{{if .Enabled}} checked{{end}}> Enabled</label>
-<fieldset class="ovr">
-<legend><label><input type="checkbox" name="urgent"{{if .Urgent}} checked{{end}}> Urgent</label></legend>
-<p class="note">Shows to <em>everyone</em>, always — bypassing paid accounts, hint wallets and the no-banner role. While any urgent campaign is live it is the only thing the strip shows (other campaigns and the default are suppressed). For system alerts.</p>
-</fieldset>
-<fieldset class="ovr" data-ovr-group>
-<legend><label><input type="checkbox" name="override_all_on" data-ovr="all"{{if .OverrideAllOn}} checked{{end}}> Colour override — all themes</label></legend>
-<div class="swatches">
-<label>Background <input type="color" name="override_bg" value="{{.AllBg}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
-<label>Text <input type="color" name="override_fg" value="{{.AllFg}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
-<label>Link <input type="color" name="override_link" value="{{.AllLink}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
-</div>
-</fieldset>
-<fieldset class="ovr" data-ovr-group>
-<legend><label><input type="checkbox" name="override_dark_on" data-ovr="dark"{{if .OverrideDarkOn}} checked{{end}}> Colour override — dark theme only</label></legend>
-<div class="swatches">
-<label>Background <input type="color" name="override_bg_dark" value="{{.DarkBg}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
-<label>Text <input type="color" name="override_fg_dark" value="{{.DarkFg}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
-<label>Link <input type="color" name="override_link_dark" value="{{.DarkLink}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
-</div>
-</fieldset>
 {{end}}
 <div><button type="submit">Save</button></div>
 </form>
 {{if not .IsDefault}}
-<div class="banner-preview">
-<div class="bp"><span class="bp-label">Light theme</span><div class="ad-frame light"><div class="ad-sample" id="prev-light"><span>Sample banner text — <span class="ad-link">a link</span></span></div></div></div>
-<div class="bp"><span class="bp-label">Dark theme</span><div class="ad-frame dark"><div class="ad-sample" id="prev-dark"><span>Sample banner text — <span class="ad-link">a link</span></span></div></div></div>
-</div>
-<p class="note">Live preview of the strip on both themes. An empty override falls back to the neutral theme colours; the top/bottom border is derived from the background.</p>
-<script>
-(function(){
-  // Neutral fallbacks — mirror ui/src/app.css (--ad-bg / --text-muted / --accent).
-  var TOK={light:{bg:'#e3e7ee',fg:'#6b7280',link:'#2f6df6'},dark:{bg:'#272f3c',fg:'#9aa3b2',link:'#5b8cff'}};
-  function byName(n){return document.querySelector('[name="'+n+'"]');}
-  var allOn=byName('override_all_on'), darkOn=byName('override_dark_on');
-  if(!allOn||!darkOn){return;}
-  var f={ab:byName('override_bg'),af:byName('override_fg'),al:byName('override_link'),db:byName('override_bg_dark'),df:byName('override_fg_dark'),dl:byName('override_link_dark')};
-  var lightEl=document.getElementById('prev-light'), darkEl=document.getElementById('prev-dark');
-  function hexToRgb(h){h=h.replace('#','');return [parseInt(h.slice(0,2),16),parseInt(h.slice(2,4),16),parseInt(h.slice(4,6),16)];}
-  function pad(x){x=Math.max(0,Math.min(255,Math.round(x))).toString(16);return x.length<2?'0'+x:x;}
-  function rgbToHex(r){return '#'+pad(r[0])+pad(r[1])+pad(r[2]);}
-  function mix(a,b,t){return [a[0]+(b[0]-a[0])*t,a[1]+(b[1]-a[1])*t,a[2]+(b[2]-a[2])*t];}
-  function lum(r){return (0.2126*r[0]+0.7152*r[1]+0.0722*r[2])/255;}
-  // Derived border: nudge the background 14% toward black on a light bg, toward white on a dark bg.
-  function border(bg){var r=hexToRgb(bg);return rgbToHex(mix(r, lum(r)>0.5?[0,0,0]:[255,255,255], 0.14));}
-  function paint(el,c){
-    el.style.background=c.bg; el.style.color=c.fg;
-    el.style.borderTop='1px solid '+border(c.bg); el.style.borderBottom='1px solid '+border(c.bg);
-    var a=el.querySelector('.ad-link'); if(a){a.style.color=c.link;}
-  }
-  function resolve(){
-    var light=allOn.checked?{bg:f.ab.value,fg:f.af.value,link:f.al.value}:TOK.light;
-    var dark=darkOn.checked?{bg:f.db.value,fg:f.df.value,link:f.dl.value}
-            :(allOn.checked?{bg:f.ab.value,fg:f.af.value,link:f.al.value}:TOK.dark);
-    paint(lightEl,light); paint(darkEl,dark);
-    document.querySelectorAll('.ovr .swatches label').forEach(function(lab){
-      var inp=lab.querySelector('input[type=color]'), hx=lab.querySelector('.hex');
-      if(inp&&hx){hx.textContent=inp.value;}
-    });
-  }
-  function toggleGroup(chk){chk.closest('fieldset').querySelectorAll('[data-ovr-color]').forEach(function(inp){inp.disabled=!chk.checked;});}
-  [allOn,darkOn].forEach(function(chk){chk.addEventListener('change',function(){toggleGroup(chk);resolve();});});
-  Object.keys(f).forEach(function(k){f[k].addEventListener('input',resolve);});
-  resolve();
-})();
-</script>
 <form class="form" method="post" action="/_gm/banners/{{.ID}}/delete" onsubmit="return confirm('Delete this campaign and its messages?')">
 <button type="submit" class="danger">Delete campaign</button>
 </form>

backend/internal/adminconsole/templates/pages/user_detail.gohtml

@@ -101,29 +101,6 @@
 {{else}}<tr><td colspan="4"><span class="note">no identities (guest)</span></td></tr>{{end}}
 </tbody>
 </table>
-{{if .HasEmail}}
-<form class="form" method="post" action="/_gm/users/{{.ID}}/remove-email" onsubmit="return confirm('Erase the email identity from this account? The address will be freed.')">
-<button type="submit">Erase email</button>
-</form>
-{{end}}
-</section>
-<section class="panel"><h2>Deletion &amp; retention</h2>
-{{if .LastLoginAt}}<p class="note">Last login: {{.LastLoginAt}}{{if .LastLoginIP}} — <code>{{.LastLoginIP}}</code>{{end}}</p>{{end}}
-{{if .Deleted}}<p><span class="warn">Deleted</span> at {{.DeletedAt}}{{if .DeletedName}} — was <code>{{.DeletedName}}</code>{{end}}</p>{{end}}
-{{if .Retained}}
-<h3>Retention journal (legal dossier of detached credentials)</h3>
-<table class="list">
-<thead><tr><th>Kind</th><th>Credential</th><th>Reason</th><th>Detached</th></tr></thead>
-<tbody>
-{{range .Retained}}<tr><td>{{.Kind}}</td><td><code>{{.ExternalID}}</code></td><td>{{.Reason}}</td><td>{{.DetachedAt}}</td></tr>{{end}}
-</tbody>
-</table>
-{{end}}
-{{if not .Deleted}}
-<form class="form" method="post" action="/_gm/users/{{.ID}}/delete" onsubmit="return confirm('Delete this account? Its credentials are journalled and freed, its data anonymised, and its sessions revoked. This cannot be undone.')">
-<button type="submit">Delete user</button>
-</form>
-{{end}}
 </section>
 <section class="panel"><h2>Friends</h2>
 <table class="list">

backend/internal/adminconsole/templates/pages/users.gohtml

@@ -2,15 +2,13 @@
 <h1>Users</h1>
 {{with .Data}}
 <nav class="subnav">
-<a href="/_gm/users"{{if and (not .Robots) (not .Deleted)}} class="active"{{end}}>People</a> ·
-<a href="/_gm/users?kind=deleted"{{if .Deleted}} class="active"{{end}}>Deleted</a> ·
+<a href="/_gm/users"{{if not .Robots}} class="active"{{end}}>People</a> ·
 <a href="/_gm/users?kind=robots"{{if .Robots}} class="active"{{end}}>Robots</a>
 </nav>
 <form class="form" method="get" action="/_gm/users">
-{{if .Robots}}<input type="hidden" name="kind" value="robots">{{end}}{{if .Deleted}}<input type="hidden" name="kind" value="deleted">{{end}}
+{{if .Robots}}<input type="hidden" name="kind" value="robots">{{end}}
 <input name="name" value="{{.NameMask}}" placeholder="display name mask (* ?)">
 <input name="ext" value="{{.ExternalIDMask}}" placeholder="external id mask (* ?)">
-<input name="email" value="{{.EmailExact}}" placeholder="email (exact)" type="search">
 <button type="submit">Filter</button>
 </form>
 <table class="list">
@@ -19,7 +17,7 @@
 {{range .Items}}
 <tr>
 <td><a href="/_gm/users/{{.ID}}">{{.ID}}</a></td>
-<td>{{.DisplayName}}{{if .Deleted}} <span class="pill">deleted</span>{{end}}{{if .Guest}} <span class="pill">guest</span>{{end}}{{if .FlaggedHighRate}} <span class="pill">high-rate</span>{{end}}</td>
+<td>{{.DisplayName}}{{if .Guest}} <span class="pill">guest</span>{{end}}{{if .FlaggedHighRate}} <span class="pill">high-rate</span>{{end}}</td>
 <td>{{.Kind}}</td>
 <td>{{.Language}}</td>
 <td>{{.CreatedAt}}</td>

backend/internal/adminconsole/views.go

@@ -60,10 +60,8 @@ type UsersView struct {
 	// be emitted verbatim — interpolated as a plain string it would have its "=" and "&"
 	// percent-encoded again by the contextual escaper.
 	Robots         bool
-	Deleted        bool
 	NameMask       string
 	ExternalIDMask string
-	EmailExact     string
 	FilterQuery    template.URL
 }
 
@@ -76,7 +74,6 @@ type UserRow struct {
 	Kind            string
 	Language        string
 	Guest           bool
-	Deleted         bool
 	FlaggedHighRate bool
 	CreatedAt       string
 	HasMoveStats    bool
@@ -153,15 +150,6 @@ type UserDetailView struct {
 	// MergedInto is the primary account id when this account has been retired by a
 	// merge, or empty for a live account.
 	MergedInto string
-	// The account-deletion dossier. Deleted marks a tombstoned account; DeletedAt and
-	// DeletedName are its deletion time and retained real name; LastLoginAt/IP are the
-	// last cold-load stamp (shown for any account); Retained is the credential journal.
-	Deleted     bool
-	DeletedAt   string
-	DeletedName string
-	LastLoginAt string
-	LastLoginIP string
-	Retained    []RetainedRow
 	// FlaggedHighRateAt is the pre-formatted soft high-rate marker timestamp,
 	// empty for an unflagged account; the card shows it with the Clear action.
 	FlaggedHighRateAt string
@@ -173,8 +161,6 @@ type UserDetailView struct {
 	HasStats     bool
 	Stats        StatsRow
 	Identities   []IdentityRow
-	// HasEmail gates the "Erase email" action; set when the account carries an email identity.
-	HasEmail bool
 	Games        []GameRow
 	// TelegramID and VKID are the account's platform external ids (empty when absent).
 	// TelegramID gates the "Send Telegram message" operator action; VKID surfaces the VK
@@ -248,17 +234,6 @@ type IdentityRow struct {
 	CreatedAt  string
 }
 
-// RetainedRow is one credential in the account-deletion retention journal (the legal
-// dossier of detached credentials): what was detached, when, and why.
-type RetainedRow struct {
-	Kind       string
-	ExternalID string
-	Reason     string
-	Confirmed  bool
-	LinkedAt   string
-	DetachedAt string
-}
-
 // GameRow is one game row in a list.
 type GameRow struct {
 	ID        string
@@ -498,12 +473,6 @@ type BannerCampaignRow struct {
 
 // BannerDetailView is the campaign detail/edit page. StartsAt/EndsAt are the
 // "YYYY-MM-DDTHH:MM" (UTC) values for the datetime-local inputs, empty when open.
-//
-// The colour-override and urgent fields drive the non-default campaign's editor:
-// OverrideAllOn/OverrideDarkOn report whether each colour set is active, and the
-// six *Bg/*Fg/*Link values seed the native colour inputs — the stored override
-// when a set is on, otherwise the neutral theme token so the picker starts from a
-// sensible colour and the live preview shows the real fallback.
 type BannerDetailView struct {
 	ID        string
 	Name      string
@@ -512,15 +481,6 @@ type BannerDetailView struct {
 	Enabled   bool
 	StartsAt  string
 	EndsAt    string
-	Urgent         bool
-	OverrideAllOn  bool
-	AllBg          string
-	AllFg          string
-	AllLink        string
-	OverrideDarkOn bool
-	DarkBg         string
-	DarkFg         string
-	DarkLink       string
 	Messages  []BannerMessageRow
 }
 

backend/internal/ads/ads.go

@@ -30,15 +30,6 @@ var ErrDefaultImmutable = errors.New("ads: the default campaign cannot be modifi
 // window or message body).
 var ErrValidation = errors.New("ads: validation")
 
-// ColorSet is an optional per-campaign colour override for the banner strip:
-// background, foreground (text) and link, each a "#rrggbb" hex string. The three
-// are set together or the whole set is absent (a nil *ColorSet).
-type ColorSet struct {
-	Bg   string
-	Fg   string
-	Link string
-}
-
 // Campaign is one advertising placement order with its messages.
 type Campaign struct {
 	ID        uuid.UUID // uuid.Nil on create
@@ -49,16 +40,6 @@ type Campaign struct {
 	StartsAt  *time.Time // nil = open-ended start; always nil for the default
 	EndsAt    *time.Time // nil = open-ended end; always nil for the default
 	Messages  []Message
-	// OverrideAll paints the strip on every theme; OverrideDark, when set, further
-	// overrides the dark theme (the client resolves dark ← dark ?? all ?? token,
-	// light ← all ?? token). Both are nil for the default campaign and for a
-	// campaign that keeps the neutral theme tokens. Non-default only.
-	OverrideAll  *ColorSet
-	OverrideDark *ColorSet
-	// Urgent forces the banner on every viewer (bypassing eligibility) and, while
-	// any urgent campaign is active, suppresses every non-urgent campaign and the
-	// default remainder. Non-default only; always false for the default campaign.
-	Urgent    bool
 	CreatedAt time.Time
 	UpdatedAt time.Time
 }
@@ -89,32 +70,29 @@ type Timings struct {
 
 // ActiveCampaign is one campaign in the resolved rotation feed sent to a client:
 // its GCD-reduced show weight and its messages, already resolved to the viewer's
-// language and in display (round-robin) order, plus the optional colour overrides
-// the client applies to the strip (nil = the neutral theme tokens). Urgency is not
-// carried here: it is resolved server-side into the set's membership and the
-// eligibility bypass, so the client only ever renders what it is sent.
+// language and in display (round-robin) order.
 type ActiveCampaign struct {
 	Weight   int
 	Messages []string
-	OverrideAll  *ColorSet
-	OverrideDark *ColorSet
+}
+
+// Eligible reports whether an account should be shown the advertising banner: a
+// free account (not paid) with an empty hint wallet and without the no_banner
+// role. The no_banner role suppresses the banner unconditionally; buying a paid
+// account or any hints also removes it.
+func Eligible(paidAccount bool, hintBalance int, hasNoBanner bool) bool {
+	return !paidAccount && hintBalance <= 0 && !hasNoBanner
 }
 
 // computeActiveSet builds the resolved rotation feed from the enabled campaigns
-// at time now, in language lang, and reports whether the feed is an urgent one.
-// Campaigns outside their validity window, and campaigns with no messages, are
-// dropped.
-//
-// While any active campaign is urgent, the feed is the urgent campaigns alone —
-// every non-urgent timed campaign and the default remainder are suppressed for
-// the duration (and the caller shows the feed to every viewer, bypassing
-// eligibility). Otherwise the default campaign's effective weight is the
-// remainder up to 100% — max(0, 100 - sum of active timed weights) — so it fills
-// unsold inventory and is dropped entirely when timed campaigns already reach
-// 100%. Weights are then reduced by their GCD so the fair rotation cycle stays
-// short. The input is expected to be the enabled campaigns (ActiveCampaigns);
-// disabled ones must already be excluded.
-func computeActiveSet(campaigns []Campaign, now time.Time, lang string) ([]ActiveCampaign, bool) {
+// at time now, in language lang. Campaigns outside their validity window, and
+// campaigns with no messages, are dropped. The default campaign's effective
+// weight is the remainder up to 100% — max(0, 100 - sum of active timed
+// weights) — so it fills unsold inventory and is dropped entirely when timed
+// campaigns already reach 100%. Weights are then reduced by their GCD so the
+// fair rotation cycle stays short. The input is expected to be the enabled
+// campaigns (ActiveCampaigns); disabled ones must already be excluded.
+func computeActiveSet(campaigns []Campaign, now time.Time, lang string) []ActiveCampaign {
 	var timed []Campaign
 	var def *Campaign
 	for i := range campaigns {
@@ -130,54 +108,20 @@ func computeActiveSet(campaigns []Campaign, now time.Time, lang string) ([]Activ
 			timed = append(timed, c)
 		}
 	}
-	if urgent := filterUrgent(timed); len(urgent) > 0 {
-		out := make([]ActiveCampaign, 0, len(urgent))
-		for _, c := range urgent {
-			out = append(out, activeFrom(c, lang))
-		}
-		reduceByGCD(out)
-		return out, true
-	}
 	sumTimed := 0
 	for _, c := range timed {
 		sumTimed += c.Weight
 	}
 	out := make([]ActiveCampaign, 0, len(timed)+1)
 	for _, c := range timed {
-		out = append(out, activeFrom(c, lang))
+		out = append(out, ActiveCampaign{Weight: c.Weight, Messages: resolveBodies(c.Messages, lang)})
 	}
 	if def != nil {
 		if dw := 100 - sumTimed; dw > 0 {
-			a := activeFrom(*def, lang)
-			a.Weight = dw // the default's stored weight is nominal; it fills the remainder
-			out = append(out, a)
+			out = append(out, ActiveCampaign{Weight: dw, Messages: resolveBodies(def.Messages, lang)})
 		}
 	}
 	reduceByGCD(out)
-	return out, false
-}
-
-// activeFrom projects a campaign to its rotation-feed entry: its show weight, its
-// language-resolved messages and its colour overrides (carried through by
-// reference, they are read-only).
-func activeFrom(c Campaign, lang string) ActiveCampaign {
-	return ActiveCampaign{
-		Weight:       c.Weight,
-		Messages:     resolveBodies(c.Messages, lang),
-		OverrideAll:  c.OverrideAll,
-		OverrideDark: c.OverrideDark,
-	}
-}
-
-// filterUrgent returns the urgent campaigns among cs, preserving order. It is the
-// preempt selector: a non-empty result makes the whole feed urgent.
-func filterUrgent(cs []Campaign) []Campaign {
-	var out []Campaign
-	for _, c := range cs {
-		if c.Urgent {
-			out = append(out, c)
-		}
-	}
 	return out
 }
 

backend/internal/ads/ads_test.go

@@ -6,6 +6,30 @@ import (
 	"time"
 )
 
+func TestEligible(t *testing.T) {
+	tests := []struct {
+		name        string
+		paidAccount bool
+		hintBalance int
+		hasNoBanner bool
+		want        bool
+	}{
+		{name: "free, empty wallet, no role", want: true},
+		{name: "paid", paidAccount: true, want: false},
+		{name: "has hints", hintBalance: 3, want: false},
+		{name: "no_banner role", hasNoBanner: true, want: false},
+		{name: "paid and has hints", paidAccount: true, hintBalance: 5, want: false},
+		{name: "no_banner overrides everything", hasNoBanner: true, want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := Eligible(tt.paidAccount, tt.hintBalance, tt.hasNoBanner); got != tt.want {
+				t.Errorf("Eligible(%v,%d,%v) = %v, want %v", tt.paidAccount, tt.hintBalance, tt.hasNoBanner, got, tt.want)
+			}
+		})
+	}
+}
+
 func TestComputeActiveSet(t *testing.T) {
 	now := time.Date(2026, 6, 15, 12, 0, 0, 0, time.UTC)
 	past := now.Add(-24 * time.Hour)
@@ -22,19 +46,12 @@ func TestComputeActiveSet(t *testing.T) {
 	timed := func(name string, weight int, starts, ends *time.Time, msgs []Message) Campaign {
 		return Campaign{Name: name, Weight: weight, Enabled: true, StartsAt: starts, EndsAt: ends, Messages: msgs}
 	}
-	urgent := func(name string, weight int, msgs []Message) Campaign {
-		c := timed(name, weight, nil, nil, msgs)
-		c.Urgent = true
-		return c
-	}
-	red := &ColorSet{Bg: "#aa0000", Fg: "#ffffff", Link: "#ffdd00"}
 
 	tests := []struct {
 		name      string
 		campaigns []Campaign
 		lang      string
 		want      []ActiveCampaign
-		wantUrgent bool
 	}{
 		{
 			name:      "default only reduces to weight 1",
@@ -135,71 +152,22 @@ func TestComputeActiveSet(t *testing.T) {
 			lang: "en",
 			want: []ActiveCampaign{{Weight: 1, Messages: []string{"one-en", "two-en"}}},
 		},
-		{
-			name: "urgent preempts default and normal timed",
-			campaigns: []Campaign{
-				def(msg("house")),
-				timed("promo", 40, nil, nil, msg("promo")),
-				urgent("alert", 50, msg("alert")),
-			},
-			lang: "en",
-			// only the urgent campaign survives; a lone weight reduces to 1.
-			want:       []ActiveCampaign{{Weight: 1, Messages: []string{"alert-en"}}},
-			wantUrgent: true,
-		},
-		{
-			name: "multiple urgent share the feed by gcd",
-			campaigns: []Campaign{
-				def(msg("house")),
-				urgent("a", 60, msg("a")),
-				urgent("b", 40, msg("b")),
-			},
-			lang: "en",
-			// default and any non-urgent dropped; gcd(60,40)=20 -> 3 and 2.
-			want: []ActiveCampaign{
-				{Weight: 3, Messages: []string{"a-en"}},
-				{Weight: 2, Messages: []string{"b-en"}},
-			},
-			wantUrgent: true,
-		},
-		{
-			name: "out-of-window urgent does not preempt",
-			campaigns: []Campaign{
-				def(msg("house")),
-				func() Campaign { c := urgent("future", 50, msg("future")); c.StartsAt = &future; return c }(),
-			},
-			lang: "en",
-			// the urgent campaign is not yet live, so the normal default feed stands.
-			want: []ActiveCampaign{{Weight: 1, Messages: []string{"house-en"}}},
-		},
-		{
-			name: "colour overrides ride the active campaign",
-			campaigns: []Campaign{
-				def(msg("house")),
-				func() Campaign { c := timed("promo", 100, nil, nil, msg("promo")); c.OverrideAll = red; return c }(),
-			},
-			lang: "en",
-			want: []ActiveCampaign{{Weight: 1, Messages: []string{"promo-en"}, OverrideAll: red}},
-		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, gotUrgent := computeActiveSet(tt.campaigns, now, tt.lang)
+			got := computeActiveSet(tt.campaigns, now, tt.lang)
 			if !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("computeActiveSet() =\n  %#v\nwant\n  %#v", got, tt.want)
 			}
-			if gotUrgent != tt.wantUrgent {
-				t.Errorf("computeActiveSet() urgent = %v, want %v", gotUrgent, tt.wantUrgent)
-			}
 		})
 	}
 }
 
 func TestComputeActiveSetEmpty(t *testing.T) {
 	// No campaigns at all yields an empty (non-nil-or-nil) feed without panicking.
-	if got, urgent := computeActiveSet(nil, time.Now(), "en"); len(got) != 0 || urgent {
-		t.Errorf("computeActiveSet(nil) = %#v urgent=%v, want empty non-urgent", got, urgent)
+	if got := computeActiveSet(nil, time.Now(), "en"); len(got) != 0 {
+		t.Errorf("computeActiveSet(nil) = %#v, want empty", got)
 	}
 }
 

backend/internal/ads/service.go

@@ -3,7 +3,6 @@ package ads
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"time"
 
@@ -41,20 +40,17 @@ func NewService(store *Store) *Service { return &Service{store: store} }
 // ActiveSet returns the resolved rotation feed for a viewer in language lang
 // (en/ru) together with the global display timings: the currently-active
 // campaigns, each with its GCD-reduced show weight and its messages resolved to
-// lang, ready for the client's weighted round-robin. The bool result reports
-// whether the feed is urgent — an urgent feed is shown to every viewer
-// regardless of eligibility (the caller skips the eligibility gate for it).
-func (s *Service) ActiveSet(ctx context.Context, lang string) ([]ActiveCampaign, Timings, bool, error) {
+// lang, ready for the client's weighted round-robin.
+func (s *Service) ActiveSet(ctx context.Context, lang string) ([]ActiveCampaign, Timings, error) {
 	campaigns, err := s.store.ActiveCampaigns(ctx)
 	if err != nil {
-		return nil, Timings{}, false, err
+		return nil, Timings{}, err
 	}
 	timings, err := s.store.Settings(ctx)
 	if err != nil {
-		return nil, Timings{}, false, err
+		return nil, Timings{}, err
 	}
-	set, urgent := computeActiveSet(campaigns, time.Now().UTC(), lang)
-	return set, timings, urgent, nil
+	return computeActiveSet(campaigns, time.Now().UTC(), lang), timings, nil
 }
 
 // ListCampaigns returns every campaign with its messages, for the admin console.
@@ -80,13 +76,8 @@ func (s *Service) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, er
 	if err := validWindow(c.StartsAt, c.EndsAt); err != nil {
 		return uuid.Nil, err
 	}
-	all, dark, err := validOverrides(c.OverrideAll, c.OverrideDark)
-	if err != nil {
-		return uuid.Nil, err
-	}
 	return s.store.CreateCampaign(ctx, Campaign{
 		Name: name, Weight: c.Weight, Enabled: c.Enabled, StartsAt: c.StartsAt, EndsAt: c.EndsAt,
-		OverrideAll: all, OverrideDark: dark, Urgent: c.Urgent,
 	})
 }
 
@@ -108,7 +99,6 @@ func (s *Service) UpdateCampaign(ctx context.Context, c Campaign) error {
 		upd.Enabled = true
 		upd.StartsAt = nil
 		upd.EndsAt = nil
-		// The default (house) campaign stays plain: no colour overrides, never urgent.
 	} else {
 		if err := validWeight(c.Weight); err != nil {
 			return err
@@ -116,17 +106,10 @@ func (s *Service) UpdateCampaign(ctx context.Context, c Campaign) error {
 		if err := validWindow(c.StartsAt, c.EndsAt); err != nil {
 			return err
 		}
-		all, dark, err := validOverrides(c.OverrideAll, c.OverrideDark)
-		if err != nil {
-			return err
-		}
 		upd.Weight = c.Weight
 		upd.Enabled = c.Enabled
 		upd.StartsAt = c.StartsAt
 		upd.EndsAt = c.EndsAt
-		upd.OverrideAll = all
-		upd.OverrideDark = dark
-		upd.Urgent = c.Urgent
 	}
 	return s.store.UpdateCampaign(ctx, upd)
 }
@@ -271,46 +254,6 @@ func validWindow(starts, ends *time.Time) error {
 	return nil
 }
 
-// hexColor matches a "#rrggbb" colour — the format the console's native colour
-// input emits and the wire carries.
-var hexColor = regexp.MustCompile(`^#[0-9a-fA-F]{6}$`)
-
-// validOverrides validates the two optional colour sets together and returns
-// their normalised copies (nil when a set is absent), so a caller can store them
-// directly.
-func validOverrides(all, dark *ColorSet) (*ColorSet, *ColorSet, error) {
-	va, err := validColorSet(all)
-	if err != nil {
-		return nil, nil, err
-	}
-	vd, err := validColorSet(dark)
-	if err != nil {
-		return nil, nil, err
-	}
-	return va, vd, nil
-}
-
-// validColorSet validates one optional colour override: a nil set passes (no
-// override); otherwise all three colours must be present and "#rrggbb". It
-// returns a trimmed, lower-cased copy.
-func validColorSet(cs *ColorSet) (*ColorSet, error) {
-	if cs == nil {
-		return nil, nil
-	}
-	bg := strings.TrimSpace(cs.Bg)
-	fg := strings.TrimSpace(cs.Fg)
-	link := strings.TrimSpace(cs.Link)
-	if bg == "" || fg == "" || link == "" {
-		return nil, fmt.Errorf("%w: a colour override needs all of background, text and link", ErrValidation)
-	}
-	for _, h := range []string{bg, fg, link} {
-		if !hexColor.MatchString(h) {
-			return nil, fmt.Errorf("%w: colours must be #rrggbb hex", ErrValidation)
-		}
-	}
-	return &ColorSet{Bg: strings.ToLower(bg), Fg: strings.ToLower(fg), Link: strings.ToLower(link)}, nil
-}
-
 // validBodies trims and bounds both mandatory language bodies of a message.
 func validBodies(bodyEn, bodyRu string) (string, string, error) {
 	en := strings.TrimSpace(bodyEn)

backend/internal/ads/store.go

@@ -90,23 +90,15 @@ func (s *Store) Campaign(ctx context.Context, id uuid.UUID) (Campaign, error) {
 func (s *Store) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, error) {
 	id := uuid.New()
 	now := time.Now().UTC()
-	abg, afg, alink := colorCols(c.OverrideAll)
-	dbg, dfg, dlink := colorCols(c.OverrideDark)
 	stmt := table.AdCampaigns.INSERT(
 		table.AdCampaigns.CampaignID, table.AdCampaigns.Name, table.AdCampaigns.Weight,
 		table.AdCampaigns.IsDefault, table.AdCampaigns.Enabled,
 		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt,
-		table.AdCampaigns.OverrideBg, table.AdCampaigns.OverrideFg, table.AdCampaigns.OverrideLink,
-		table.AdCampaigns.OverrideBgDark, table.AdCampaigns.OverrideFgDark, table.AdCampaigns.OverrideLinkDark,
-		table.AdCampaigns.Urgent,
 		table.AdCampaigns.CreatedAt, table.AdCampaigns.UpdatedAt,
 	).VALUES(
 		postgres.UUID(id), postgres.String(c.Name), postgres.Int(int64(c.Weight)),
 		postgres.Bool(false), postgres.Bool(c.Enabled),
 		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt),
-		abg, afg, alink,
-		dbg, dfg, dlink,
-		postgres.Bool(c.Urgent),
 		postgres.TimestampzT(now), postgres.TimestampzT(now),
 	)
 	if _, err := stmt.ExecContext(ctx, s.db); err != nil {
@@ -119,20 +111,12 @@ func (s *Store) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, erro
 // window. The default flag is never touched here. Returns ErrNotFound when no
 // campaign matches.
 func (s *Store) UpdateCampaign(ctx context.Context, c Campaign) error {
-	abg, afg, alink := colorCols(c.OverrideAll)
-	dbg, dfg, dlink := colorCols(c.OverrideDark)
 	stmt := table.AdCampaigns.UPDATE(
 		table.AdCampaigns.Name, table.AdCampaigns.Weight, table.AdCampaigns.Enabled,
-		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt,
-		table.AdCampaigns.OverrideBg, table.AdCampaigns.OverrideFg, table.AdCampaigns.OverrideLink,
-		table.AdCampaigns.OverrideBgDark, table.AdCampaigns.OverrideFgDark, table.AdCampaigns.OverrideLinkDark,
-		table.AdCampaigns.Urgent, table.AdCampaigns.UpdatedAt,
+		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt, table.AdCampaigns.UpdatedAt,
 	).SET(
 		postgres.String(c.Name), postgres.Int(int64(c.Weight)), postgres.Bool(c.Enabled),
-		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt),
-		abg, afg, alink,
-		dbg, dfg, dlink,
-		postgres.Bool(c.Urgent), postgres.TimestampzT(time.Now().UTC()),
+		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt), postgres.TimestampzT(time.Now().UTC()),
 	).WHERE(table.AdCampaigns.CampaignID.EQ(postgres.UUID(c.ID)))
 	return execOne(ctx, s.db, stmt, "update campaign")
 }
@@ -280,33 +264,11 @@ func modelToCampaign(r model.AdCampaigns) Campaign {
 		Enabled:   r.Enabled,
 		StartsAt:  r.StartsAt,
 		EndsAt:    r.EndsAt,
-		OverrideAll:  colorSetFrom(r.OverrideBg, r.OverrideFg, r.OverrideLink),
-		OverrideDark: colorSetFrom(r.OverrideBgDark, r.OverrideFgDark, r.OverrideLinkDark),
-		Urgent:       r.Urgent,
 		CreatedAt: r.CreatedAt,
 		UpdatedAt: r.UpdatedAt,
 	}
 }
 
-// colorSetFrom rebuilds an optional ColorSet from three nullable colour columns.
-// The all-or-nothing CHECK keeps the trio consistent, so a nil in any one means
-// the set is absent.
-func colorSetFrom(bg, fg, link *string) *ColorSet {
-	if bg == nil || fg == nil || link == nil {
-		return nil
-	}
-	return &ColorSet{Bg: *bg, Fg: *fg, Link: *link}
-}
-
-// colorCols renders a *ColorSet as its three column value-expressions in
-// bg, fg, link order — NULL for each when the set is absent.
-func colorCols(cs *ColorSet) (bg, fg, link postgres.Expression) {
-	if cs == nil {
-		return postgres.NULL, postgres.NULL, postgres.NULL
-	}
-	return postgres.String(cs.Bg), postgres.String(cs.Fg), postgres.String(cs.Link)
-}
-
 func modelToMessage(r model.AdMessages) Message {
 	return Message{
 		ID:         r.MessageID,

backend/internal/config/config.go

@@ -4,7 +4,6 @@ package config
 
 import (
 	"fmt"
-	"net/url"
 	"os"
 	"strconv"
 	"time"
@@ -43,12 +42,6 @@ type Config struct {
 	// SMTP configures the email relay used for confirm-codes. An empty Host
 	// selects the development log mailer (the code is logged, not sent).
 	SMTP account.SMTPConfig
-	// PublicBaseURL is the canonical public origin (scheme + host, e.g.
-	// https://erudit-game.ru) used to build absolute links in outgoing email — the
-	// confirm deeplink and the footer landing link. It is deliberately not derived
-	// from a request Host header, which would let an attacker inject a phishing link
-	// into the email. Required whenever an SMTP relay is configured.
-	PublicBaseURL string
 	// ConnectorAddr is the gRPC address of the Telegram platform connector
 	// side-service, used by the admin console to send operator broadcasts. Empty
 	// disables broadcasts (the admin broadcast actions report "not configured").
@@ -58,12 +51,6 @@ type Config struct {
 	// GuestRetention is the account age past which an unused guest (no game seat)
 	// is eligible for deletion by the reaper.
 	GuestRetention time.Duration
-	// ExportSignKey signs the finished-game export download URLs. Empty leaves
-	// the export-URL endpoints disabled (503 on mint, 404 on download).
-	ExportSignKey string
-	// RendererURL is the base URL of the internal image-render sidecar (e.g.
-	// http://renderer:8090). Empty disables the PNG export artifact.
-	RendererURL string
 }
 
 // Defaults applied when the corresponding environment variable is unset.
@@ -148,9 +135,6 @@ func Load() (Config, error) {
 		Username: os.Getenv("BACKEND_SMTP_USERNAME"),
 		Password: os.Getenv("BACKEND_SMTP_PASSWORD"),
 		From:     envOr("BACKEND_SMTP_FROM", "no-reply@localhost"),
-		TLS:       os.Getenv("BACKEND_SMTP_TLS"),
-		AdminFrom: os.Getenv("BACKEND_SMTP_ADMIN_FROM"),
-		AdminTo:   os.Getenv("BACKEND_ADMIN_EMAIL"),
 	}
 
 	c := Config{
@@ -164,12 +148,9 @@ func Load() (Config, error) {
 		Robot:             rb,
 		RateWatch:         rw,
 		SMTP:              smtp,
-		PublicBaseURL:     os.Getenv("BACKEND_PUBLIC_BASE_URL"),
 		ConnectorAddr:     os.Getenv("BACKEND_CONNECTOR_ADDR"),
 		GuestReapInterval: guestReapInterval,
 		GuestRetention:    guestRetention,
-		ExportSignKey:     os.Getenv("BACKEND_EXPORT_SIGN_KEY"),
-		RendererURL:       os.Getenv("BACKEND_RENDERER_URL"),
 	}
 	if err := c.validate(); err != nil {
 		return Config{}, err
@@ -214,14 +195,6 @@ func (c Config) validate() error {
 	if c.GuestRetention <= 0 {
 		return fmt.Errorf("config: BACKEND_GUEST_RETENTION must be positive")
 	}
-	if c.SMTP.Host != "" {
-		if c.PublicBaseURL == "" {
-			return fmt.Errorf("config: BACKEND_PUBLIC_BASE_URL must be set when BACKEND_SMTP_HOST is configured")
-		}
-		if u, err := url.Parse(c.PublicBaseURL); err != nil || u.Scheme == "" || u.Host == "" {
-			return fmt.Errorf("config: BACKEND_PUBLIC_BASE_URL %q must be an absolute URL (scheme://host)", c.PublicBaseURL)
-		}
-	}
 	return nil
 }
 

backend/internal/engine/endfixture_test.go

@@ -1,123 +0,0 @@
-package engine
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rules"
-)
-
-// The offline engine (ui/src/lib/localgame) reproduces the end-of-game rack settlement and the
-// winner rule so a local game finishes with the same scores as the server. These golden fixtures
-// pin the ported pure functions (applyEndAdjustment / winner / rackValue) to the real Go engine.
-// Being in-package, this emitter constructs Game values directly and drives the unexported
-// end-game math on chosen positions.
-
-type endCaseIn struct {
-	Name     string  `json:"name"`
-	Variant  string  `json:"variant"`
-	Reason   string  `json:"reason"`
-	Hands    [][]int `json:"hands"`
-	Scores   []int   `json:"scores"`
-	Resigned []bool  `json:"resigned"`
-	ToMove   int     `json:"toMove"`
-}
-
-type endCaseOut struct {
-	endCaseIn
-	ScoresAfter []int `json:"scoresAfter"`
-	Winner      int   `json:"winner"`
-}
-
-func rulesetFor(variant string) *rules.Ruleset {
-	switch variant {
-	case "scrabble_ru":
-		return rules.RussianScrabble()
-	case "erudit_ru":
-		return rules.Erudit()
-	default:
-		return rules.English()
-	}
-}
-
-func reasonFor(s string) EndReason {
-	switch s {
-	case "out_of_tiles":
-		return EndOutOfTiles
-	case "scoreless":
-		return EndScoreless
-	case "resign":
-		return EndResign
-	case "aborted":
-		return EndAborted
-	}
-	return EndNotOver
-}
-
-func handsBytes(hands [][]int) [][]byte {
-	out := make([][]byte, len(hands))
-	for i, h := range hands {
-		b := make([]byte, len(h))
-		for j, x := range h {
-			b[j] = byte(x)
-		}
-		out[i] = b
-	}
-	return out
-}
-
-// TestEmitEndgameFixtures regenerates ui/src/lib/localgame/testdata/endgame.json. Gated by
-// EMIT_ENGINE_FIXTURES. Regenerate with:
-//
-//	EMIT_ENGINE_FIXTURES=1 go test ./backend/internal/engine -run TestEmitEndgameFixtures
-func TestEmitEndgameFixtures(t *testing.T) {
-	if os.Getenv("EMIT_ENGINE_FIXTURES") == "" {
-		t.Skip("set EMIT_ENGINE_FIXTURES=1 to regenerate ui/src/lib/localgame/testdata/endgame.json")
-	}
-
-	cases := []endCaseIn{
-		{"out-basic", "scrabble_en", "out_of_tiles", [][]int{{}, {0, 1, 2}}, []int{50, 40}, []bool{false, false}, 0},
-		{"out-blank", "scrabble_en", "out_of_tiles", [][]int{{}, {255, 0}}, []int{30, 30}, []bool{false, false}, 0},
-		{"out-erudit-yo", "erudit_ru", "out_of_tiles", [][]int{{}, {6, 32}}, []int{10, 10}, []bool{false, false}, 0},
-		{"out-tie", "scrabble_en", "out_of_tiles", [][]int{{}, {}}, []int{30, 30}, []bool{false, false}, 0},
-		{"out-3p", "scrabble_ru", "out_of_tiles", [][]int{{}, {0, 1}, {2}}, []int{10, 10, 10}, []bool{false, false, false}, 0},
-		{"scoreless", "scrabble_en", "scoreless", [][]int{{0, 1}, {2, 3}}, []int{20, 20}, []bool{false, false}, 0},
-		{"resign-2p", "scrabble_en", "resign", [][]int{{}, {0}}, []int{100, 10}, []bool{true, false}, 1},
-		{"resign-3p", "scrabble_en", "resign", [][]int{{}, {}, {}}, []int{50, 60, 40}, []bool{false, true, false}, 0},
-		{"aborted", "scrabble_en", "aborted", [][]int{{0}, {1}}, []int{40, 30}, []bool{false, false}, 0},
-	}
-
-	out := make([]endCaseOut, 0, len(cases))
-	for _, c := range cases {
-		rs := rulesetFor(c.Variant)
-		scores := append([]int(nil), c.Scores...)
-		g := &Game{
-			rules:    rs,
-			hands:    handsBytes(c.Hands),
-			scores:   scores,
-			resigned: c.Resigned,
-			toMove:   c.ToMove,
-		}
-		reason := reasonFor(c.Reason)
-		g.over = true
-		g.reason = reason
-		g.applyEndAdjustment(reason)
-		out = append(out, endCaseOut{endCaseIn: c, ScoresAfter: g.scores, Winner: g.winner()})
-	}
-
-	dir := filepath.Join("..", "..", "..", "ui", "src", "lib", "localgame", "testdata")
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		t.Fatalf("mkdir %s: %v", dir, err)
-	}
-	data, err := json.MarshalIndent(map[string]any{"cases": out}, "", "  ")
-	if err != nil {
-		t.Fatalf("marshal: %v", err)
-	}
-	path := filepath.Join(dir, "endgame.json")
-	if err := os.WriteFile(path, append(data, '\n'), 0o644); err != nil {
-		t.Fatalf("write %s: %v", path, err)
-	}
-	t.Logf("wrote %s (%d cases)", path, len(out))
-}

backend/internal/feedback/service.go

@@ -195,11 +195,6 @@ func (svc *Service) CountUnread(ctx context.Context) (int, error) {
 	return svc.store.CountUnread(ctx)
 }
 
-// CountSince counts feedback created after since, for the operator alert worker.
-func (svc *Service) CountSince(ctx context.Context, since time.Time) (int, error) {
-	return svc.store.CountSince(ctx, since)
-}
-
 // Attachment returns a message's file name and bytes, reporting false when absent.
 func (svc *Service) Attachment(ctx context.Context, id uuid.UUID) (string, []byte, bool, error) {
 	return svc.store.Attachment(ctx, id)

backend/internal/feedback/store.go

@@ -386,15 +386,3 @@ func (s *Store) CountUnread(ctx context.Context) (int, error) {
 	}
 	return n, nil
 }
-
-// CountSince counts feedback messages created strictly after since — the operator alert
-// worker's "new since the last check" signal.
-func (s *Store) CountSince(ctx context.Context, since time.Time) (int, error) {
-	var n int
-	if err := s.db.QueryRowContext(ctx,
-		`SELECT COUNT(*) FROM backend.feedback_messages WHERE created_at > $1`, since,
-	).Scan(&n); err != nil {
-		return 0, fmt.Errorf("feedback: count since: %w", err)
-	}
-	return n, nil
-}

backend/internal/game/helpers_test.go

@@ -69,29 +69,6 @@ func TestHintsRemaining(t *testing.T) {
 	}
 }
 
-func TestHintUnlockLeftSeconds(t *testing.T) {
-	now := time.Now()
-	// A gated vs_ai game on the caller's turn, the robot having moved 10 min ago (turn started then).
-	gated := Game{VsAI: true, ToMove: 0, MoveCount: 2, TurnStartedAt: now.Add(-10 * time.Minute)}
-	cases := []struct {
-		name string
-		g    Game
-		seat int
-		want int
-	}{
-		{"non-vs_ai is open", Game{VsAI: false, ToMove: 0, MoveCount: 2, TurnStartedAt: now.Add(-10 * time.Minute)}, 0, 0},
-		{"not the caller's turn is open", gated, 1, 0},
-		{"human first move (no robot move) is open", Game{VsAI: true, ToMove: 0, MoveCount: 0, TurnStartedAt: now}, 0, 0},
-		{"robot moved 10 min ago leaves 20 min", gated, 0, 20 * 60},
-		{"robot moved past the window is open", Game{VsAI: true, ToMove: 0, MoveCount: 2, TurnStartedAt: now.Add(-40 * time.Minute)}, 0, 0},
-	}
-	for _, c := range cases {
-		if got := hintUnlockLeftSeconds(c.g, c.seat, now); got != c.want {
-			t.Errorf("%s: hintUnlockLeftSeconds = %d, want %d", c.name, got, c.want)
-		}
-	}
-}
-
 func TestAllowedTimeout(t *testing.T) {
 	if !allowedTimeout(24 * time.Hour) {
 		t.Error("24h must be allowed")

backend/internal/game/service.go

@@ -18,8 +18,6 @@ import (
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/notify"
-	"scrabble/backend/internal/payments"
-	"scrabble/backend/internal/session"
 )
 
 // Service is the game domain: it drives the engine over a single match, persists
@@ -52,11 +50,6 @@ type Service struct {
 	// its asynchronous TriggerMove); nil disables the fast path (the scan still covers
 	// these games). Kept as a func so the game package never imports the robot package.
 	aiTrigger func(gameID uuid.UUID)
-	// hintWallet is the payments surface the online-game hint path spends against (the
-	// segmented, context-aware hint balance). It is set by SetHintWallet during wiring; when
-	// nil, only the free per-game allowance is served (no purchased hints). vs_ai hints are
-	// wallet-free and never touch it.
-	hintWallet HintWallet
 	// clearNudges, when set, marks the actor's pending nudges in a game read once they
 	// have committed a move (a nudge answered by moving stops counting as unread). It is
 	// best-effort and kept as a func so the game package never imports the social package.
@@ -112,39 +105,6 @@ func (svc *Service) SetAITrigger(trigger func(gameID uuid.UUID)) {
 	svc.aiTrigger = trigger
 }
 
-// HintWallet is the payments surface the online-game hint path uses: the context-aware hint
-// balance (HintsAvailable) and a one-hint spend (SpendHint), both keyed by the trusted execution
-// context and the account's present identity sources. *payments.Service satisfies it.
-type HintWallet interface {
-	HintsAvailable(ctx context.Context, accountID uuid.UUID, cxt payments.Context, present []payments.Source) (int, error)
-	SpendHint(ctx context.Context, accountID uuid.UUID, cxt payments.Context, present []payments.Source) (bool, error)
-}
-
-// SetHintWallet installs the payments hint wallet the online-game hint path spends against. It
-// must be called during startup wiring; the default (nil) serves only the free per-game allowance.
-func (svc *Service) SetHintWallet(w HintWallet) {
-	svc.hintWallet = w
-}
-
-// walletContext resolves the payments gate inputs for an account on the current request: the
-// trusted execution context (from the session platform carried on ctx; absent ⇒ untrusted) and
-// the account's present identity sources (which chip/benefit segments are awake, §6).
-func (svc *Service) walletContext(ctx context.Context, accountID uuid.UUID) (payments.Context, []payments.Source, error) {
-	var cxt payments.Context
-	if p, ok := session.PlatformFromContext(ctx); ok {
-		cxt = payments.NewContext(p.Kind, p.Subtype)
-	}
-	ids, err := svc.accounts.Identities(ctx, accountID)
-	if err != nil {
-		return payments.Context{}, nil, err
-	}
-	kinds := make([]string, len(ids))
-	for i, id := range ids {
-		kinds[i] = id.Kind
-	}
-	return cxt, payments.PresentSources(kinds), nil
-}
-
 // SetNudgeClearer installs the hook that marks a mover's pending nudges read after
 // their move commits. It must be called during startup wiring; the default (nil)
 // leaves nudges to be cleared only when the recipient opens the move history or chat.
@@ -1048,12 +1008,6 @@ func (svc *Service) CountComplaints(ctx context.Context, status string) (int, er
 	return svc.store.CountComplaints(ctx, status)
 }
 
-// CountComplaintsSince counts word complaints filed after since, for the operator alert
-// worker.
-func (svc *Service) CountComplaintsSince(ctx context.Context, since time.Time) (int, error) {
-	return svc.store.CountComplaintsSince(ctx, since)
-}
-
 // ResolveComplaint closes a complaint with an operator disposition (reject /
 // accept_add / accept_remove) and an optional note. An accepted complaint then
 // appears in DictionaryChanges until a rebuilt dictionary is loaded and the
@@ -1098,31 +1052,10 @@ func (svc *Service) MarkChangesApplied(ctx context.Context, variant engine.Varia
 	return svc.store.MarkChangesApplied(ctx, variant.String(), version)
 }
 
-// hintIdleWindow is how long a vs_ai player must be stuck on a turn (since the robot's last move)
-// before the idle hint unlocks. Mirrors the offline client (lib/hints HINT_GATE_MS = 30 min).
-const hintIdleWindow = 30 * time.Minute
-
-// hintUnlockLeftSeconds is the seconds until g's vs_ai idle hint unlocks for seat, measured from now:
-// the robot's last move (the current turn's start, on the human's turn) plus the window, floored at
-// 0 and ceiled to whole seconds. It is 0 for a non-vs_ai game, when it is not seat's turn, or on the
-// human's first move (MoveCount 0, no robot move yet) — the gate is an anti-frustration aid, not a
-// first-move tax. The client anchors a monotonic countdown to it, so a client clock cannot skew it.
-func hintUnlockLeftSeconds(g Game, seat int, now time.Time) int {
-	if !g.VsAI || g.ToMove != seat || g.MoveCount < 1 {
-		return 0
-	}
-	left := g.TurnStartedAt.Add(hintIdleWindow).Sub(now)
-	if left <= 0 {
-		return 0
-	}
-	return int((left + time.Second - 1) / time.Second) // ceil to whole seconds (no math import)
-}
-
-// Hint reveals the top-scoring legal play for the requesting player on their turn. For a human game
-// it spends one hint from the per-game allowance then the profile wallet (ErrHintsDisabled /
-// ErrNoHintsLeft / ErrNoHintAvailable). For a vs_ai game the hint is unlimited and wallet-free but
-// idle-gated from the server clock (ErrHintLocked until the window elapses) and counts toward no
-// hint statistic.
+// Hint reveals the top-scoring legal play for the requesting player on their
+// turn, spending one hint from their per-game allowance and then their profile
+// wallet. It returns ErrHintsDisabled, ErrNoHintsLeft or ErrNoHintAvailable as
+// appropriate.
 func (svc *Service) Hint(ctx context.Context, gameID, accountID uuid.UUID) (HintResult, error) {
 	pre, err := svc.store.GetGame(ctx, gameID)
 	if err != nil {
@@ -1141,40 +1074,13 @@ func (svc *Service) Hint(ctx context.Context, gameID, accountID uuid.UUID) (Hint
 	if !pre.HintsAllowed {
 		return HintResult{}, ErrHintsDisabled
 	}
-	if pre.VsAI {
-		// vs_ai: unlimited and wallet-free, but idle-gated from the server clock — and counted toward
-		// no hint statistic. Enforce the gate (the client normally pre-gates from the view's
-		// HintUnlockLeftSeconds; this is the authoritative backstop), then serve the top move without
-		// touching the allowance, the wallet or hints_used.
-		if hintUnlockLeftSeconds(pre, seat, svc.clock()) > 0 {
-			return HintResult{}, ErrHintLocked
-		}
-		unlock := svc.locks.lock(gameID)
-		defer unlock()
-		g, err := svc.liveGame(ctx, pre)
+	acc, err := svc.accounts.GetByID(ctx, accountID)
 	if err != nil {
 		return HintResult{}, err
 	}
-		move, ok := g.HintView()
-		if !ok {
-			return HintResult{}, ErrNoHintAvailable
-		}
-		return HintResult{Move: move}, nil
-	}
-	cxt, present, err := svc.walletContext(ctx, accountID)
-	if err != nil {
-		return HintResult{}, err
-	}
-	wallet := 0
-	if svc.hintWallet != nil {
-		wallet, err = svc.hintWallet.HintsAvailable(ctx, accountID, cxt, present)
-		if err != nil {
-			return HintResult{}, err
-		}
-	}
 	used := pre.Seats[seat].HintsUsed
 	fromAllowance := used < pre.HintsPerPlayer
-	if !fromAllowance && wallet <= 0 {
+	if !fromAllowance && acc.HintBalance <= 0 {
 		return HintResult{}, ErrNoHintsLeft
 	}
 
@@ -1189,9 +1095,9 @@ func (svc *Service) Hint(ctx context.Context, gameID, accountID uuid.UUID) (Hint
 		return HintResult{}, ErrNoHintAvailable
 	}
 
-	walletAfter := wallet
+	walletAfter := acc.HintBalance
 	if !fromAllowance {
-		spent, err := svc.hintWallet.SpendHint(ctx, accountID, cxt, present)
+		spent, err := svc.accounts.SpendHint(ctx, accountID)
 		if err != nil {
 			return HintResult{}, err
 		}
@@ -1296,8 +1202,6 @@ func (svc *Service) GameState(ctx context.Context, gameID, accountID uuid.UUID)
 		BagLen:         g.BagLen(),
 		HintsRemaining: hintsRemaining(pre.HintsPerPlayer, pre.Seats[seat].HintsUsed, acc.HintBalance),
 		WalletBalance:  acc.HintBalance,
-		// vs_ai idle-hint gate (seconds left; 0 for a human game / first move / not your turn).
-		HintUnlockLeftSeconds: hintUnlockLeftSeconds(pre, seat, svc.clock()),
 	}, nil
 }
 
@@ -1459,53 +1363,30 @@ func (svc *Service) SetupDraws(ctx context.Context, gameID uuid.UUID) ([]SetupDr
 	return svc.store.SetupDraws(ctx, gameID)
 }
 
-// ExportView returns a finished game with its journal and per-seat display names —
-// the material every export artifact (the GCG text, the PNG render payload) is built
-// from. It is allowed only on a finished game: exporting an in-progress game would
-// leak the full move journal mid-play, so an active game yields ErrGameActive. In an
-// honest-AI game the robot seat is labelled "AI", not its pool name.
-func (svc *Service) ExportView(ctx context.Context, gameID uuid.UUID) (Game, []HistoryMove, []string, error) {
+// ExportGCG renders a game as GCG text from the journal alone (no dictionary). It
+// is allowed only on a finished game: exporting an in-progress game would leak the
+// full move journal mid-play, so an active game yields ErrGameActive.
+func (svc *Service) ExportGCG(ctx context.Context, gameID uuid.UUID) (string, error) {
 	g, err := svc.store.GetGame(ctx, gameID)
 	if err != nil {
-		return Game{}, nil, nil, err
+		return "", err
 	}
 	if g.Status != StatusFinished {
-		return Game{}, nil, nil, ErrGameActive
+		return "", ErrGameActive
 	}
 	moves, err := svc.store.GetJournal(ctx, gameID)
 	if err != nil {
-		return Game{}, nil, nil, err
+		return "", err
 	}
 	names := svc.seatNames(ctx, g)
 	if g.VsAI {
+		// Label the robot seat "AI" in an honest-AI game's export, not its pool name.
 		for _, s := range g.Seats {
 			if robot, err := svc.accounts.IsRobot(ctx, s.AccountID); err == nil && robot {
 				names[s.Seat] = aiPlayerName
 			}
 		}
 	}
-	return g, moves, names, nil
-}
-
-// EnsureExportable reports whether a game may be exported (it exists and is
-// finished) without loading the journal — the export-URL mint check.
-func (svc *Service) EnsureExportable(ctx context.Context, gameID uuid.UUID) error {
-	g, err := svc.store.GetGame(ctx, gameID)
-	if err != nil {
-		return err
-	}
-	if g.Status != StatusFinished {
-		return ErrGameActive
-	}
-	return nil
-}
-
-// ExportGCG renders a game as GCG text from the journal alone (no dictionary).
-func (svc *Service) ExportGCG(ctx context.Context, gameID uuid.UUID) (string, error) {
-	g, moves, names, err := svc.ExportView(ctx, gameID)
-	if err != nil {
-		return "", err
-	}
 	return writeGCG(g, names, moves), nil
 }
 

backend/internal/game/store.go

@@ -1040,19 +1040,6 @@ func (s *Store) CountComplaints(ctx context.Context, status string) (int, error)
 	return int(dest.Count), nil
 }
 
-// CountComplaintsSince counts word complaints filed strictly after since — the operator
-// alert worker's "new since the last check" signal.
-func (s *Store) CountComplaintsSince(ctx context.Context, since time.Time) (int, error) {
-	stmt := postgres.SELECT(postgres.COUNT(table.Complaints.ComplaintID).AS("count")).
-		FROM(table.Complaints).
-		WHERE(table.Complaints.CreatedAt.GT(postgres.TimestampzT(since)))
-	var dest struct{ Count int64 }
-	if err := stmt.QueryContext(ctx, s.db, &dest); err != nil {
-		return 0, fmt.Errorf("game: count complaints since: %w", err)
-	}
-	return int(dest.Count), nil
-}
-
 // ActiveGames returns the turn clocks of every in-progress game; the sweeper
 // filters them against the per-move deadline and the player's away window.
 func (s *Store) ActiveGames(ctx context.Context) ([]activeGame, error) {

backend/internal/game/types.go

@@ -65,10 +65,6 @@ var (
 	ErrNoHintsLeft = errors.New("game: no hints remaining")
 	// ErrNoHintAvailable is returned when the player has no legal play to reveal.
 	ErrNoHintAvailable = errors.New("game: no legal move to suggest")
-	// ErrHintLocked is returned when a vs_ai game's idle hint is still gated (the player has not yet
-	// been stuck the idle window since the robot's last move). The client normally pre-gates from
-	// StateView.HintUnlockLeftSeconds, so this is the authoritative server-clock backstop.
-	ErrHintLocked = errors.New("game: hint is not available yet")
 	// ErrGameLimitReached is returned when an account already holds MaxActiveQuickGames
 	// simultaneous quick games and tries to create another game (quick or by invitation).
 	ErrGameLimitReached = errors.New("game: simultaneous game limit reached")
@@ -244,11 +240,6 @@ type StateView struct {
 	// WalletBalance is the player's global hint-wallet balance alone (HintsRemaining folds
 	// it in with the per-game allowance), so the client keeps the wallet live across games.
 	WalletBalance int
-	// HintUnlockLeftSeconds is, for a vs_ai game on the requesting player's turn, the seconds left
-	// until the idle hint unlocks (the robot's last move plus the idle window, from the server clock);
-	// 0 for the human's first move, when it is not their turn, or a non-vs_ai game. The vs_ai hint is
-	// unlimited and wallet-free; this idle gate replaces the allowance/wallet for it.
-	HintUnlockLeftSeconds int
 }
 
 // HistoryMove is one decoded journal row, independent of any dictionary.

backend/internal/inttest/adminemail_test.go

@@ -1,83 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-)
-
-// TestRemoveEmailIdentity erases an account's email identity but refuses when the
-// email is the account's only identity (which would leave it unreachable).
-func TestRemoveEmailIdentity(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-
-	// Email is the only identity → refuse.
-	solo, err := store.ProvisionEmail(ctx, "solo-"+uuid.NewString()+"@example.com", "", "en")
-	if err != nil {
-		t.Fatalf("provision email: %v", err)
-	}
-	if err := store.RemoveEmailIdentity(ctx, solo.ID); !errors.Is(err, account.ErrLastIdentity) {
-		t.Fatalf("remove last identity = %v, want ErrLastIdentity", err)
-	}
-
-	// Telegram + email → erase the email, keep Telegram.
-	tg, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision telegram: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, tg.ID, account.KindEmail, "dual-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	if err := store.RemoveEmailIdentity(ctx, tg.ID); err != nil {
-		t.Fatalf("remove email: %v", err)
-	}
-	ids, err := store.Identities(ctx, tg.ID)
-	if err != nil {
-		t.Fatalf("identities: %v", err)
-	}
-	if len(ids) != 1 || ids[0].Kind != account.KindTelegram {
-		t.Errorf("identities after erase = %+v, want only telegram", ids)
-	}
-}
-
-// TestListUsersEmailExact matches accounts strictly (exactly) by their email identity.
-func TestListUsersEmailExact(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	email := "find-" + uuid.NewString() + "@example.com"
-	acc, err := store.ProvisionEmail(ctx, email, "", "en")
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-
-	items, err := store.ListUsers(ctx, account.UserFilter{EmailExact: email}, 50, 0)
-	if err != nil {
-		t.Fatalf("list: %v", err)
-	}
-	found := false
-	for _, it := range items {
-		if it.ID == acc.ID {
-			found = true
-		}
-	}
-	if !found {
-		t.Error("the exact email filter did not find the account")
-	}
-
-	other, err := store.ListUsers(ctx, account.UserFilter{EmailExact: "nope-" + uuid.NewString() + "@example.com"}, 50, 0)
-	if err != nil {
-		t.Fatalf("list (no match): %v", err)
-	}
-	for _, it := range other {
-		if it.ID == acc.ID {
-			t.Error("a non-matching email filter must not return the account")
-		}
-	}
-}

backend/internal/inttest/banner_console_test.go

@@ -15,15 +15,13 @@ import (
 
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/ads"
-	"scrabble/backend/internal/payments"
 	"scrabble/backend/internal/server"
 )
 
 // bannerServer assembles a console-capable server with the ads domain wired.
-func bannerServer(t *testing.T) (*server.Server, *ads.Service, *payments.Service) {
+func bannerServer(t *testing.T) (*server.Server, *ads.Service) {
 	t.Helper()
 	adsSvc := ads.NewService(ads.NewStore(testDB))
-	paySvc := newPaymentsService()
 	srv := server.New(":0", server.Deps{
 		Logger:   zap.NewNop(),
 		Accounts: account.NewStore(testDB),
@@ -31,9 +29,8 @@ func bannerServer(t *testing.T) (*server.Server, *ads.Service, *payments.Service
 		Registry: testRegistry,
 		DictDir:  dictDir(),
 		Ads:      adsSvc,
-		Payments: paySvc,
 	})
-	return srv, adsSvc, paySvc
+	return srv, adsSvc
 }
 
 // findCampaign returns the id of the campaign with the given name, or fails.
@@ -74,7 +71,7 @@ func defaultCampaign(t *testing.T, svc *ads.Service) ads.Campaign {
 // reorder/delete.
 func TestBannerConsoleCRUD(t *testing.T) {
 	ctx := context.Background()
-	srv, adsSvc, _ := bannerServer(t)
+	srv, adsSvc := bannerServer(t)
 	h := srv.Handler()
 	base := "http://admin.test/_gm"
 	const origin = "http://admin.test"
@@ -154,7 +151,7 @@ func TestBannerConsoleCRUD(t *testing.T) {
 // unrelated campaign's URL must be refused.
 func TestBannerMessageOwnership(t *testing.T) {
 	ctx := context.Background()
-	srv, adsSvc, _ := bannerServer(t)
+	srv, adsSvc := bannerServer(t)
 	h := srv.Handler()
 	base := "http://admin.test/_gm"
 	const origin = "http://admin.test"
@@ -197,7 +194,6 @@ type profileBanner struct {
 		Campaigns []struct {
 			Weight   int      `json:"weight"`
 			Messages []string `json:"messages"`
-			OverrideBg string   `json:"override_bg"`
 		} `json:"campaigns"`
 		Timings struct {
 			HoldMs int `json:"hold_ms"`
@@ -210,11 +206,10 @@ type profileBanner struct {
 // wallet each suppress it.
 func TestBannerProfileEligibility(t *testing.T) {
 	ctx := context.Background()
-	srv, _, pay := bannerServer(t)
+	srv, _ := bannerServer(t)
 	accounts := account.NewStore(testDB)
 	id := provisionAccount(t)
 
-	// getBanner fetches the profile banner with no platform header (an untrusted context).
 	getBanner := func() profileBanner {
 		t.Helper()
 		rec := userGet(t, srv, "/api/v1/user/profile", id)
@@ -227,27 +222,10 @@ func TestBannerProfileEligibility(t *testing.T) {
 		}
 		return p
 	}
-	// getBannerTG fetches the profile banner in a trusted Telegram context — the account's
-	// telegram identity makes telegram the applicable origin for its benefits.
-	getBannerTG := func() profileBanner {
-		t.Helper()
-		rec := httptest.NewRecorder()
-		req := httptest.NewRequest(http.MethodGet, "/api/v1/user/profile", nil)
-		req.Header.Set("X-User-ID", id.String())
-		req.Header.Set("X-Platform", "telegram/android")
-		srv.Handler().ServeHTTP(rec, req)
-		if rec.Code != http.StatusOK {
-			t.Fatalf("profile = %d, want 200", rec.Code)
-		}
-		var p profileBanner
-		if err := json.Unmarshal(rec.Body.Bytes(), &p); err != nil {
-			t.Fatalf("decode profile: %v", err)
-		}
-		return p
-	}
 
-	// A free account with no role and no benefit is eligible.
-	if p := getBanner(); p.Banner == nil || len(p.Banner.Campaigns) == 0 || p.Banner.Timings.HoldMs <= 0 {
+	// A free account with an empty hint wallet and no role is eligible.
+	p := getBanner()
+	if p.Banner == nil || len(p.Banner.Campaigns) == 0 || p.Banner.Timings.HoldMs <= 0 {
 		t.Fatalf("eligible account: banner=%v", p.Banner)
 	}
 
@@ -262,31 +240,19 @@ func TestBannerProfileEligibility(t *testing.T) {
 		t.Fatalf("revoke role: %v", err)
 	}
 
-	// A hint wallet no longer suppresses the banner — hints and no-ads are distinct benefits now.
-	if err := pay.Grant(ctx, id, payments.SourceTelegram, 5, 0, false); err != nil {
+	// A non-empty hint wallet suppresses it.
+	if _, err := accounts.GrantHints(ctx, id, 5); err != nil {
 		t.Fatalf("grant hints: %v", err)
 	}
-	if p := getBannerTG(); p.Banner == nil {
-		t.Fatal("a hint wallet must NOT suppress the banner")
-	}
-
-	// An active no-ads benefit applicable in the context suppresses the banner.
-	if err := pay.Grant(ctx, id, payments.SourceTelegram, 0, 30, false); err != nil {
-		t.Fatalf("grant no-ads: %v", err)
-	}
-	if p := getBannerTG(); p.Banner != nil {
-		t.Fatal("an active no-ads benefit must suppress the banner")
-	}
-	// Fail-closed: without a trusted platform the same benefit does not apply, so the banner shows.
-	if p := getBanner(); p.Banner == nil {
-		t.Fatal("an untrusted context must not apply the no-ads benefit (banner should show)")
+	if p := getBanner(); p.Banner != nil {
+		t.Fatal("a non-empty hint wallet still shows the banner")
 	}
 }
 
 // TestBannerSurvivesProfileUpdate guards that a profile update (e.g. a language switch) returns the
 // banner block too, so the client's profile keeps the banner instead of losing it until reload.
 func TestBannerSurvivesProfileUpdate(t *testing.T) {
-	srv, _, _ := bannerServer(t)
+	srv, _ := bannerServer(t)
 	id := provisionAccount(t)
 
 	body := `{"display_name":"Tester","preferred_language":"ru","time_zone":"UTC","away_start":"00:00",` +
@@ -308,142 +274,3 @@ func TestBannerSurvivesProfileUpdate(t *testing.T) {
 		t.Fatalf("profile update dropped the banner block: %v", p.Banner)
 	}
 }
-
-// TestBannerConsoleColorsAndUrgent drives the colour-override + urgent editor over
-// HTTP against real Postgres: an incomplete or malformed colour set is refused, a
-// full two-set override + urgent round-trips through the store (exercising the new
-// columns and CHECK constraints), clearing the sets removes the override, and the
-// default campaign stays plain (colours + urgent are ignored for it).
-func TestBannerConsoleColorsAndUrgent(t *testing.T) {
-	ctx := context.Background()
-	srv, adsSvc, _ := bannerServer(t)
-	h := srv.Handler()
-	base := "http://admin.test/_gm"
-	const origin = "http://admin.test"
-
-	name := "Brand-" + uuid.NewString()[:8]
-	if code, body := consoleDo(h, http.MethodPost, base+"/banners", "name="+name+"&weight=20&enabled=on", origin); code != http.StatusOK || !strings.Contains(body, "Created") {
-		t.Fatalf("create = %d, has Created=%v", code, strings.Contains(body, "Created"))
-	}
-	id := findCampaign(t, adsSvc, name)
-	t.Cleanup(func() { _ = adsSvc.DeleteCampaign(ctx, id) })
-	detail := base + "/banners/" + id.String()
-
-	// A partial colour set (a missing colour) is refused by validation.
-	partial := "name=" + name + "&weight=20&enabled=on&override_all_on=on&override_bg=%23aa0000&override_fg=&override_link=%23ffdd00"
-	if code, b := consoleDo(h, http.MethodPost, detail, partial, origin); code != http.StatusOK || !strings.Contains(b, "Not saved") {
-		t.Fatalf("partial colour = %d, has 'Not saved'=%v", code, strings.Contains(b, "Not saved"))
-	}
-	// A malformed hex is refused.
-	badHex := "name=" + name + "&weight=20&enabled=on&override_all_on=on&override_bg=red&override_fg=%23ffffff&override_link=%23ffdd00"
-	if code, b := consoleDo(h, http.MethodPost, detail, badHex, origin); code != http.StatusOK || !strings.Contains(b, "Not saved") {
-		t.Fatalf("bad hex = %d, has 'Not saved'=%v", code, strings.Contains(b, "Not saved"))
-	}
-	// Both colour sets + urgent persist and round-trip through the store.
-	full := "name=" + name + "&weight=20&enabled=on&urgent=on" +
-		"&override_all_on=on&override_bg=%23aa0000&override_fg=%23ffffff&override_link=%23ffdd00" +
-		"&override_dark_on=on&override_bg_dark=%23330000&override_fg_dark=%23eeeeee&override_link_dark=%23ffcc00"
-	if code, b := consoleDo(h, http.MethodPost, detail, full, origin); code != http.StatusOK || !strings.Contains(b, "Saved") {
-		t.Fatalf("full save = %d, has Saved=%v", code, strings.Contains(b, "Saved"))
-	}
-	cm, err := adsSvc.Campaign(ctx, id)
-	if err != nil {
-		t.Fatalf("read campaign: %v", err)
-	}
-	if cm.OverrideAll == nil || cm.OverrideAll.Bg != "#aa0000" || cm.OverrideAll.Fg != "#ffffff" || cm.OverrideAll.Link != "#ffdd00" {
-		t.Fatalf("override all = %+v", cm.OverrideAll)
-	}
-	if cm.OverrideDark == nil || cm.OverrideDark.Bg != "#330000" || cm.OverrideDark.Fg != "#eeeeee" || cm.OverrideDark.Link != "#ffcc00" {
-		t.Fatalf("override dark = %+v", cm.OverrideDark)
-	}
-	if !cm.Urgent {
-		t.Fatal("urgent not persisted")
-	}
-	// Clearing the sets (both checkboxes off, urgent off) removes the override.
-	if code, _ := consoleDo(h, http.MethodPost, detail, "name="+name+"&weight=20&enabled=on", origin); code != http.StatusOK {
-		t.Fatalf("clear = %d", code)
-	}
-	if cm, _ := adsSvc.Campaign(ctx, id); cm.OverrideAll != nil || cm.OverrideDark != nil || cm.Urgent {
-		t.Fatalf("override not cleared: all=%v dark=%v urgent=%v", cm.OverrideAll, cm.OverrideDark, cm.Urgent)
-	}
-
-	// The default campaign stays plain: submitted colours + urgent are ignored for it.
-	def := defaultCampaign(t, adsSvc)
-	defForm := "name=Default+%28house%29&urgent=on&override_all_on=on&override_bg=%23aa0000&override_fg=%23ffffff&override_link=%23ffdd00"
-	if code, _ := consoleDo(h, http.MethodPost, base+"/banners/"+def.ID.String(), defForm, origin); code != http.StatusOK {
-		t.Fatalf("update default = %d", code)
-	}
-	if again := defaultCampaign(t, adsSvc); again.OverrideAll != nil || again.OverrideDark != nil || again.Urgent {
-		t.Fatalf("default not plain: all=%v dark=%v urgent=%v", again.OverrideAll, again.OverrideDark, again.Urgent)
-	}
-}
-
-// TestBannerUrgentBypassesEligibility checks the urgent flag at the profile level:
-// an urgent campaign preempts the feed (only it shows, with its colours) and reaches
-// every viewer — including the no_banner role and a non-empty hint wallet that
-// otherwise suppress the banner.
-func TestBannerUrgentBypassesEligibility(t *testing.T) {
-	ctx := context.Background()
-	srv, adsSvc, _ := bannerServer(t)
-	accounts := account.NewStore(testDB)
-	id := provisionAccount(t)
-
-	urgentID, err := adsSvc.CreateCampaign(ctx, ads.Campaign{
-		Name: "Alert-" + uuid.NewString()[:8], Weight: 10, Enabled: true, Urgent: true,
-		OverrideAll: &ads.ColorSet{Bg: "#aa0000", Fg: "#ffffff", Link: "#ffdd00"},
-	})
-	if err != nil {
-		t.Fatalf("create urgent: %v", err)
-	}
-	t.Cleanup(func() { _ = adsSvc.DeleteCampaign(ctx, urgentID) })
-	if _, err := adsSvc.AddMessage(ctx, urgentID, "System maintenance tonight", "Ночью тех.работы"); err != nil {
-		t.Fatalf("add urgent message: %v", err)
-	}
-
-	get := func() profileBanner {
-		t.Helper()
-		rec := userGet(t, srv, "/api/v1/user/profile", id)
-		if rec.Code != http.StatusOK {
-			t.Fatalf("profile = %d", rec.Code)
-		}
-		var p profileBanner
-		if err := json.Unmarshal(rec.Body.Bytes(), &p); err != nil {
-			t.Fatalf("decode: %v", err)
-		}
-		return p
-	}
-	assertUrgentOnly := func(what string, p profileBanner) {
-		t.Helper()
-		if p.Banner == nil {
-			t.Fatalf("%s: no banner", what)
-		}
-		if len(p.Banner.Campaigns) != 1 {
-			t.Fatalf("%s: %d campaigns, want only the urgent one (default preempted)", what, len(p.Banner.Campaigns))
-		}
-		c := p.Banner.Campaigns[0]
-		if len(c.Messages) != 1 || c.Messages[0] != "System maintenance tonight" {
-			t.Fatalf("%s: messages = %v, want only the urgent one", what, c.Messages)
-		}
-		if c.OverrideBg != "#aa0000" {
-			t.Fatalf("%s: override_bg = %q, want #aa0000", what, c.OverrideBg)
-		}
-	}
-
-	// A normal viewer sees only the urgent campaign (the default is preempted).
-	assertUrgentOnly("eligible", get())
-
-	// The no_banner role no longer suppresses it — urgent reaches everyone.
-	if err := accounts.GrantRole(ctx, id, account.RoleNoBanner); err != nil {
-		t.Fatalf("grant role: %v", err)
-	}
-	assertUrgentOnly("no_banner", get())
-	if err := accounts.RevokeRole(ctx, id, account.RoleNoBanner); err != nil {
-		t.Fatalf("revoke role: %v", err)
-	}
-
-	// A non-empty hint wallet no longer suppresses it either.
-	if _, err := accounts.GrantHints(ctx, id, 5); err != nil {
-		t.Fatalf("grant hints: %v", err)
-	}
-	assertUrgentOnly("hints", get())
-}

backend/internal/inttest/delete_test.go

@@ -1,322 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-	"scrabble/backend/internal/accountdelete"
-	"scrabble/backend/internal/engine"
-	"scrabble/backend/internal/game"
-)
-
-// deletedFields reads a tombstoned account's retained real name and its deleted_at.
-func deletedFields(t *testing.T, accountID uuid.UUID) (name string, deletedAt sql.NullTime) {
-	t.Helper()
-	var dn sql.NullString
-	err := testDB.QueryRowContext(context.Background(),
-		"SELECT deleted_display_name, deleted_at FROM accounts WHERE account_id = $1", accountID).
-		Scan(&dn, &deletedAt)
-	if err != nil {
-		t.Fatalf("read deleted fields %s: %v", accountID, err)
-	}
-	return dn.String, deletedAt
-}
-
-// TestAnonymizeAndTombstone: deletion journals + frees the credentials, tombstones the
-// account, scrubs the live name while retaining the real one, and frees the creds for a
-// new account to reuse.
-func TestAnonymizeAndTombstone(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "handle", "Иван", "+03:00")
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	email := "del-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, email, true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	before, err := store.GetByID(ctx, acc.ID)
-	if err != nil {
-		t.Fatalf("load before: %v", err)
-	}
-
-	if err := deleter.AnonymizeAndTombstone(ctx, acc.ID); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-
-	// The live identities are gone.
-	if ids, err := store.Identities(ctx, acc.ID); err != nil || len(ids) != 0 {
-		t.Fatalf("identities after delete = %+v (err %v), want none", ids, err)
-	}
-	// Both credentials are journalled with reason=delete.
-	got := retainedRows(t, acc.ID)
-	if len(got) != 2 {
-		t.Fatalf("retained rows = %+v, want 2", got)
-	}
-	for _, r := range got {
-		if r.reason != "delete" {
-			t.Errorf("retained reason = %q, want delete", r.reason)
-		}
-	}
-	// The live name is scrubbed; the real one is retained; deleted_at is set.
-	after, err := store.GetByID(ctx, acc.ID)
-	if err != nil {
-		t.Fatalf("load after: %v", err)
-	}
-	if after.DisplayName != accountdelete.AnonymizedName {
-		t.Errorf("live display name = %q, want %q", after.DisplayName, accountdelete.AnonymizedName)
-	}
-	name, deletedAt := deletedFields(t, acc.ID)
-	if name != before.DisplayName {
-		t.Errorf("retained name = %q, want %q", name, before.DisplayName)
-	}
-	if !deletedAt.Valid || time.Since(deletedAt.Time) > time.Minute {
-		t.Errorf("deleted_at = %+v, want a recent timestamp", deletedAt)
-	}
-	// The credentials are free: a new account can claim the same email.
-	other, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Other", "")
-	if err != nil {
-		t.Fatalf("provision other: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, other.ID, account.KindEmail, email, true); err != nil {
-		t.Fatalf("email should be free after deletion, got: %v", err)
-	}
-}
-
-// TestDeletionDossierReaders: after deletion the admin readers expose the credential
-// journal and the tombstone dossier.
-func TestDeletionDossierReaders(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "handle", "Иван", "+03:00")
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, "dos-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	if err := deleter.AnonymizeAndTombstone(ctx, acc.ID); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-
-	rets, err := store.RetainedIdentities(ctx, acc.ID)
-	if err != nil || len(rets) != 2 {
-		t.Fatalf("RetainedIdentities = (%+v, %v), want 2 rows", rets, err)
-	}
-	for _, r := range rets {
-		if r.Reason != "delete" {
-			t.Errorf("retained reason = %q, want delete", r.Reason)
-		}
-	}
-	info, err := store.DeletionInfo(ctx, acc.ID)
-	if err != nil {
-		t.Fatalf("DeletionInfo: %v", err)
-	}
-	if info.DeletedAt == nil {
-		t.Error("DeletionInfo.DeletedAt should be set")
-	}
-	if info.DeletedDisplayName != "Иван" {
-		t.Errorf("DeletionInfo.DeletedDisplayName = %q, want Иван", info.DeletedDisplayName)
-	}
-}
-
-// listHasID reports whether the user list contains accountID.
-func listHasID(items []account.UserListItem, id uuid.UUID) bool {
-	for _, it := range items {
-		if it.ID == id {
-			return true
-		}
-	}
-	return false
-}
-
-// TestUserListDeletedFilter: a tombstoned account is hidden from the default People list and
-// shown only under the Deleted scope.
-func TestUserListDeletedFilter(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	live, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Live", "")
-	if err != nil {
-		t.Fatalf("provision live: %v", err)
-	}
-	goneTg := "tg-" + uuid.NewString()
-	gone, _, err := store.ProvisionTelegram(ctx, goneTg, "en", "", "Gone", "")
-	if err != nil {
-		t.Fatalf("provision gone: %v", err)
-	}
-	goneEmail := "gone-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, gone.ID, account.KindEmail, goneEmail, true); err != nil {
-		t.Fatalf("attach gone email: %v", err)
-	}
-	if err := deleter.AnonymizeAndTombstone(ctx, gone.ID); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-
-	people, err := store.ListUsers(ctx, account.UserFilter{}, 5000, 0)
-	if err != nil {
-		t.Fatalf("list people: %v", err)
-	}
-	if listHasID(people, gone.ID) {
-		t.Error("a deleted account must not appear in the default People list")
-	}
-	if !listHasID(people, live.ID) {
-		t.Error("a live account must appear in the default People list")
-	}
-	deleted, err := store.ListUsers(ctx, account.UserFilter{Deleted: true}, 5000, 0)
-	if err != nil {
-		t.Fatalf("list deleted: %v", err)
-	}
-	if !listHasID(deleted, gone.ID) {
-		t.Error("a deleted account must appear in the Deleted list")
-	}
-	if listHasID(deleted, live.ID) {
-		t.Error("a live account must not appear in the Deleted list")
-	}
-
-	// A search spans both lists and reaches the retention journal: a deleted account is
-	// still found by the email and external id it held (both moved to retained_identities
-	// on deletion, out of the live identities table).
-	byEmail, err := store.ListUsers(ctx, account.UserFilter{EmailExact: goneEmail}, 5000, 0)
-	if err != nil {
-		t.Fatalf("search by email: %v", err)
-	}
-	if !listHasID(byEmail, gone.ID) {
-		t.Error("a deleted account must be found by the email it held (retention journal)")
-	}
-	byExt, err := store.ListUsers(ctx, account.UserFilter{ExternalIDMask: goneTg}, 5000, 0)
-	if err != nil {
-		t.Fatalf("search by external id: %v", err)
-	}
-	if !listHasID(byExt, gone.ID) {
-		t.Error("a deleted account must be found by the external id it held (retention journal)")
-	}
-}
-
-// TestConfirmCodeClearsGuest: confirming an email on a guest via ConfirmCode promotes it to
-// a durable account (defence-in-depth — no confirmed-email path leaves is_guest set).
-func TestConfirmCodeClearsGuest(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	guest, err := store.ProvisionGuest(ctx, "")
-	if err != nil {
-		t.Fatalf("provision guest: %v", err)
-	}
-	email := "cc-" + uuid.NewString() + "@example.com"
-	if err := svc.RequestCode(ctx, guest.ID, email); err != nil {
-		t.Fatalf("request code: %v", err)
-	}
-	if _, err := svc.ConfirmCode(ctx, guest.ID, email, sixDigit.FindString(mailer.lastBody)); err != nil {
-		t.Fatalf("confirm code: %v", err)
-	}
-	after, err := store.GetByID(ctx, guest.ID)
-	if err != nil {
-		t.Fatalf("load: %v", err)
-	}
-	if after.IsGuest {
-		t.Error("confirming an email must clear the guest flag")
-	}
-}
-
-// TestDropAllRobotGames drops the deletee's solo vs-AI game but keeps a game with a human
-// opponent.
-func TestDropAllRobotGames(t *testing.T) {
-	ctx := context.Background()
-	gsvc := newGameService()
-	robots := newRobotService(t, gsvc)
-	if err := robots.EnsurePool(ctx); err != nil {
-		t.Fatalf("ensure pool: %v", err)
-	}
-	mm := newMatchmaker(t, robots, time.Minute, 0)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	user := provisionAccount(t)
-	other := provisionAccount(t)
-
-	aiRes, err := mm.StartVsAI(ctx, user, engine.VariantEnglish, true)
-	if err != nil {
-		t.Fatalf("start vs AI: %v", err)
-	}
-	humanGame, err := gsvc.Create(ctx, game.CreateParams{
-		Variant: engine.VariantEnglish, Seats: []uuid.UUID{user, other}, TurnTimeout: time.Hour, Seed: 1,
-	})
-	if err != nil {
-		t.Fatalf("create human game: %v", err)
-	}
-
-	n, err := deleter.DropAllRobotGames(ctx, user)
-	if err != nil {
-		t.Fatalf("drop: %v", err)
-	}
-	if n != 1 {
-		t.Fatalf("dropped %d games, want 1 (the vs-AI game)", n)
-	}
-	if _, err := gsvc.GameByID(ctx, aiRes.Game.ID); err == nil {
-		t.Error("the vs-AI game should be dropped")
-	}
-	if _, err := gsvc.GameByID(ctx, humanGame.ID); err != nil {
-		t.Errorf("the human game should be kept, got: %v", err)
-	}
-}
-
-// TestDeleteStepUpEmail: an email account's delete code verifies (wrong code rejected, no
-// deeplink in the mail); a platform-only account has no email and cannot request a code.
-func TestDeleteStepUpEmail(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, "del-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	if has, err := svc.HasEmail(ctx, acc.ID); err != nil || !has {
-		t.Fatalf("HasEmail = (%v, %v), want true", has, err)
-	}
-	if err := svc.RequestDeleteCode(ctx, acc.ID); err != nil {
-		t.Fatalf("request delete code: %v", err)
-	}
-	if strings.Contains(mailer.lastBody, "/confirm/") {
-		t.Error("a delete email must not carry a one-tap deeplink")
-	}
-	code := sixDigit.FindString(mailer.lastBody)
-	if err := svc.VerifyDeleteCode(ctx, acc.ID, "000000"); err == nil {
-		t.Error("a wrong delete code must be rejected")
-	}
-	if err := svc.VerifyDeleteCode(ctx, acc.ID, code); err != nil {
-		t.Fatalf("verify correct delete code: %v", err)
-	}
-
-	noEmail, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision no-email: %v", err)
-	}
-	if has, _ := svc.HasEmail(ctx, noEmail.ID); has {
-		t.Error("HasEmail must be false for a platform-only account")
-	}
-	if err := svc.RequestDeleteCode(ctx, noEmail.ID); !errors.Is(err, account.ErrNoEmail) {
-		t.Errorf("request delete for no-email account = %v, want ErrNoEmail", err)
-	}
-}

backend/internal/inttest/email_test.go

@@ -19,8 +19,8 @@ import (
 // recover the confirm-code from the body.
 type capturingMailer struct{ lastBody string }
 
-func (m *capturingMailer) Send(_ context.Context, msg account.Message) error {
-	m.lastBody = msg.Text
+func (m *capturingMailer) Send(_ context.Context, _, _, body string) error {
+	m.lastBody = body
 	return nil
 }
 
@@ -32,7 +32,7 @@ func TestEmailConfirmFlow(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)
 
 	acc := provisionAccount(t)
 	email := "user-" + uuid.NewString() + "@example.com"
@@ -67,7 +67,7 @@ func TestEmailAlreadyTakenByAnotherAccount(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)
 
 	owner := provisionAccount(t)
 	email := "taken-" + uuid.NewString() + "@example.com"
@@ -89,7 +89,7 @@ func TestEmailCodeExpires(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)
 
 	acc := provisionAccount(t)
 	email := "expire-" + uuid.NewString() + "@example.com"
@@ -111,7 +111,7 @@ func TestEmailTooManyAttempts(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)
 
 	acc := provisionAccount(t)
 	email := "lock-" + uuid.NewString() + "@example.com"
@@ -203,10 +203,10 @@ func TestUpdateProfileOffsetTimezone(t *testing.T) {
 func TestEmailLoginFlow(t *testing.T) {
 	ctx := context.Background()
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(account.NewStore(testDB), mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(account.NewStore(testDB), mailer)
 	email := "login-" + uuid.NewString() + "@example.com"
 
-	accountID, err := svc.RequestLoginCode(ctx, email, "+02:00", "en", false)
+	accountID, err := svc.RequestLoginCode(ctx, email, "+02:00")
 	if err != nil {
 		t.Fatalf("request login code: %v", err)
 	}
@@ -233,7 +233,7 @@ func TestEmailLoginFlow(t *testing.T) {
 	}
 
 	// A second login for the same email is the returning user: same account.
-	if _, err := svc.RequestLoginCode(ctx, email, "", "ru", false); err != nil {
+	if _, err := svc.RequestLoginCode(ctx, email, ""); err != nil {
 		t.Fatalf("second request: %v", err)
 	}
 	acc2, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody))
@@ -244,210 +244,3 @@ func TestEmailLoginFlow(t *testing.T) {
 		t.Errorf("returning login account = %s, want %s", acc2.ID, accountID)
 	}
 }
-
-// TestEmailLoginProvisionsGuestUntilConfirmed covers the squat fix: an email-login
-// account is a guest (reapable, so an abandoned never-confirmed login frees its
-// address) until the code is confirmed, which promotes it to a durable account.
-func TestEmailLoginProvisionsGuestUntilConfirmed(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	email := "squat-" + uuid.NewString() + "@example.com"
-
-	id, err := svc.RequestLoginCode(ctx, email, "", "en", false)
-	if err != nil {
-		t.Fatalf("request login code: %v", err)
-	}
-	before, err := store.GetByID(ctx, id)
-	if err != nil {
-		t.Fatalf("get before confirm: %v", err)
-	}
-	if !before.IsGuest {
-		t.Error("an unconfirmed email-login account must be a guest so it is reapable")
-	}
-
-	if _, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody)); err != nil {
-		t.Fatalf("login: %v", err)
-	}
-	after, err := store.GetByID(ctx, id)
-	if err != nil {
-		t.Fatalf("get after confirm: %v", err)
-	}
-	if after.IsGuest {
-		t.Error("confirming the login must clear the guest flag (promote to durable)")
-	}
-}
-
-// TestEmailLoginPWAOmitsLink: a login requested from an installed PWA (pwa=true) mails only the
-// code — no one-tap confirm link, which would otherwise open in a separate browser out of the
-// PWA's reach. A non-PWA request keeps the link.
-func TestEmailLoginPWAOmitsLink(t *testing.T) {
-	ctx := context.Background()
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(account.NewStore(testDB), mailer, "https://erudit-game.ru")
-
-	pwaEmail := "pwa-login-" + uuid.NewString() + "@example.com"
-	if _, err := svc.RequestLoginCode(ctx, pwaEmail, "", "en", true); err != nil {
-		t.Fatalf("pwa request login: %v", err)
-	}
-	if sixDigit.FindString(mailer.lastBody) == "" {
-		t.Errorf("pwa login mail must still carry the code, body %q", mailer.lastBody)
-	}
-	if confirmToken.MatchString(mailer.lastBody) {
-		t.Errorf("pwa login mail must omit the one-tap confirm link, body %q", mailer.lastBody)
-	}
-
-	webEmail := "web-login-" + uuid.NewString() + "@example.com"
-	if _, err := svc.RequestLoginCode(ctx, webEmail, "", "en", false); err != nil {
-		t.Fatalf("web request login: %v", err)
-	}
-	if !confirmToken.MatchString(mailer.lastBody) {
-		t.Errorf("non-pwa login mail must keep the one-tap confirm link, body %q", mailer.lastBody)
-	}
-}
-
-// confirmToken extracts the one-tap deeplink token from the /app/#/confirm/<token> link
-// the branded email carries.
-var confirmToken = regexp.MustCompile(`/confirm/([A-Za-z0-9_-]+)`)
-
-func tokenFromMail(t *testing.T, body string) string {
-	t.Helper()
-	m := confirmToken.FindStringSubmatch(body)
-	if m == nil {
-		t.Fatalf("no confirm token in mail body %q", body)
-	}
-	return m[1]
-}
-
-// TestConfirmByTokenLogin: the one-tap deeplink token completes an email login,
-// clearing the guest flag.
-func TestConfirmByTokenLogin(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	email := "tok-login-" + uuid.NewString() + "@example.com"
-
-	id, err := svc.RequestLoginCode(ctx, email, "", "en", false)
-	if err != nil {
-		t.Fatalf("request login: %v", err)
-	}
-	res, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody))
-	if err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	if !res.IsLogin() || res.Account != id {
-		t.Fatalf("login result = %+v, want login for %s", res, id)
-	}
-	if !identityConfirmed(t, account.KindEmail, email) {
-		t.Error("email identity must be confirmed after the token login")
-	}
-	if acc, _ := store.GetByID(ctx, id); acc.IsGuest {
-		t.Error("the token login must clear the guest flag")
-	}
-}
-
-// TestConfirmByTokenLink: the token attaches a free email to the requesting account.
-func TestConfirmByTokenLink(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	acc := provisionAccount(t)
-	email := "tok-link-" + uuid.NewString() + "@example.com"
-
-	if err := svc.RequestLinkCode(ctx, acc, email); err != nil {
-		t.Fatalf("request link: %v", err)
-	}
-	res, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody))
-	if err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	if res.IsLogin() || res.NeedsMerge || res.Account != acc {
-		t.Fatalf("link result = %+v, want a plain link for %s", res, acc)
-	}
-	if !identityConfirmed(t, account.KindEmail, email) {
-		t.Error("email identity must be confirmed after the token link")
-	}
-}
-
-// TestConfirmByTokenLinkMerge: a token for an address owned by another account signals
-// a merge (leaving the token unconsumed for the interactive step).
-func TestConfirmByTokenLinkMerge(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	email := "tok-merge-" + uuid.NewString() + "@example.com"
-
-	owner := provisionAccount(t)
-	if err := svc.RequestCode(ctx, owner, email); err != nil {
-		t.Fatalf("owner request: %v", err)
-	}
-	if _, err := svc.ConfirmCode(ctx, owner, email, sixDigit.FindString(mailer.lastBody)); err != nil {
-		t.Fatalf("owner confirm: %v", err)
-	}
-
-	other := provisionAccount(t)
-	if err := svc.RequestLinkCode(ctx, other, email); err != nil {
-		t.Fatalf("link request: %v", err)
-	}
-	res, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody))
-	if err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	if !res.NeedsMerge || res.MergeOwner != owner {
-		t.Fatalf("merge result = %+v, want NeedsMerge with owner=%s", res, owner)
-	}
-}
-
-// TestEmailAccountSeedsDisplayName seeds a new email account's display name from the
-// email's local part, so an email login is not left nameless.
-func TestEmailAccountSeedsDisplayName(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	svc := account.NewEmailService(store, &capturingMailer{}, "https://erudit-game.ru")
-	local := "kaya-" + uuid.NewString()[:8]
-
-	id, err := svc.RequestLoginCode(ctx, local+"@example.com", "", "en", false)
-	if err != nil {
-		t.Fatalf("request login: %v", err)
-	}
-	acc, err := store.GetByID(ctx, id)
-	if err != nil {
-		t.Fatalf("get: %v", err)
-	}
-	if acc.DisplayName != local {
-		t.Errorf("display name = %q, want the email local part %q", acc.DisplayName, local)
-	}
-}
-
-// TestConfirmByTokenLinkClearsGuest: binding an email to a guest via the deeplink
-// promotes the guest to a durable account (the deeplink path must match the
-// code-based link flow, which clears the guest flag).
-func TestConfirmByTokenLinkClearsGuest(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	guest, err := store.ProvisionGuest(ctx, "")
-	if err != nil {
-		t.Fatalf("provision guest: %v", err)
-	}
-	email := "guest-link-" + uuid.NewString() + "@example.com"
-
-	if err := svc.RequestLinkCode(ctx, guest.ID, email); err != nil {
-		t.Fatalf("request link: %v", err)
-	}
-	if _, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody)); err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	acc, err := store.GetByID(ctx, guest.ID)
-	if err != nil {
-		t.Fatalf("get: %v", err)
-	}
-	if acc.IsGuest {
-		t.Error("linking an email via the deeplink must promote the guest to durable")
-	}
-}

backend/internal/inttest/game_test.go

@@ -14,8 +14,6 @@ import (
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
-	"scrabble/backend/internal/payments"
-	"scrabble/backend/internal/session"
 )
 
 // TestListForAccount checks the lobby "my games" query: it returns exactly the
@@ -403,13 +401,8 @@ func gameStatus(t *testing.T, svc *game.Service, id uuid.UUID) (status, endReaso
 // TestHintPolicy exercises the per-game allowance, the profile wallet and the
 // disabled switch.
 func TestHintPolicy(t *testing.T) {
-	// A trusted platform context so the online hint wallet (payments) is reachable; a provisioned
-	// account carries a telegram identity, so the telegram origin is the applicable one here.
-	ctx := session.WithPlatform(context.Background(),
-		session.Platform{Kind: session.PlatformKindTelegram, Subtype: session.SubtypeAndroid})
+	ctx := context.Background()
 	svc := newGameService()
-	pay := newPaymentsService()
-	svc.SetHintWallet(pay) // share the handle so a grant invalidates the wallet the game reads
 	seats := []uuid.UUID{provisionAccount(t), provisionAccount(t)}
 	seed := openingSeed(t)
 	g, err := svc.Create(ctx, game.CreateParams{
@@ -435,11 +428,7 @@ func TestHintPolicy(t *testing.T) {
 	if _, err := svc.Hint(ctx, g.ID, seats[0]); !errors.Is(err, game.ErrNoHintsLeft) {
 		t.Fatalf("second hint = %v, want ErrNoHintsLeft", err)
 	}
-	// Grant 2 hints on the telegram origin through the service so its read cache is invalidated
-	// (a raw insert would leave the cache warmed at zero by the allowance hint above).
-	if err := pay.Grant(ctx, seats[0], payments.SourceTelegram, 2, 0, false); err != nil {
-		t.Fatalf("grant hints: %v", err)
-	}
+	setHintBalance(t, seats[0], 2)
 	res, err := svc.Hint(ctx, g.ID, seats[0]) // spends the wallet
 	if err != nil {
 		t.Fatalf("wallet hint: %v", err)
@@ -614,6 +603,14 @@ func setAway(t *testing.T, id uuid.UUID, tz, start, end string) {
 	}
 }
 
+func setHintBalance(t *testing.T, id uuid.UUID, n int) {
+	t.Helper()
+	if _, err := testDB.ExecContext(context.Background(),
+		`UPDATE backend.accounts SET hint_balance = $1 WHERE account_id = $2`, n, id); err != nil {
+		t.Fatalf("set hint balance: %v", err)
+	}
+}
+
 func equalStrings(a, b []string) bool {
 	if len(a) != len(b) {
 		return false

backend/internal/inttest/helpers.go

@@ -17,7 +17,6 @@ import (
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/lobby"
-	"scrabble/backend/internal/payments"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/social"
 )
@@ -43,42 +42,9 @@ func newGameService() *game.Service {
 		zap.NewNop(),
 	)
 	svc.SetFirstMoveEntropy(seatZeroFirstMove)
-	svc.SetHintWallet(newPaymentsService())
 	return svc
 }
 
-// newPaymentsService builds a payments service over the shared pool (its own in-process read
-// cache), for wiring the game hint wallet and the account-merge fold in the integration suite.
-func newPaymentsService() *payments.Service {
-	return payments.NewService(payments.NewStore(testDB))
-}
-
-// seedBenefit writes a payments benefit row for an account+origin directly (bypassing the
-// service), used to stand up wallet state a test then spends or merges. A non-zero hints count
-// and/or the forever flag are set; a caller wanting a no-ads term sets it via seedBenefitUntil.
-func seedBenefit(t *testing.T, id uuid.UUID, origin string, hints int, forever bool) {
-	t.Helper()
-	if _, err := testDB.ExecContext(context.Background(),
-		`INSERT INTO payments.benefits (account_id, origin, hints, ads_forever) VALUES ($1,$2,$3,$4)
-		 ON CONFLICT (account_id, origin) DO UPDATE SET hints = EXCLUDED.hints, ads_forever = EXCLUDED.ads_forever`,
-		id, origin, hints, forever); err != nil {
-		t.Fatalf("seed benefit: %v", err)
-	}
-}
-
-// readBenefit reads an account's benefit row for an origin: the hint count and the forever flag
-// (both zero/false when the row is absent).
-func readBenefit(t *testing.T, id uuid.UUID, origin string) (hints int, forever bool) {
-	t.Helper()
-	err := testDB.QueryRowContext(context.Background(),
-		`SELECT hints, ads_forever FROM payments.benefits WHERE account_id=$1 AND origin=$2`, id, origin).
-		Scan(&hints, &forever)
-	if err != nil && !errors.Is(err, sql.ErrNoRows) {
-		t.Fatalf("read benefit: %v", err)
-	}
-	return hints, forever
-}
-
 // seatZeroFirstMove is a first-move-draw entropy factory that always elects the first
 // listed account as the leader, keeping the integration suite's turn order stable
 // despite the real draw's randomness: the first contender draws a blank — the best

backend/internal/inttest/link_change_test.go

@@ -1,174 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-)
-
-// emailOf returns the external id of the account's email identity, or "" when it has none.
-func emailOf(t *testing.T, store *account.Store, id uuid.UUID) string {
-	t.Helper()
-	ids, err := store.Identities(context.Background(), id)
-	if err != nil {
-		t.Fatalf("identities %s: %v", id, err)
-	}
-	for _, i := range ids {
-		if i.Kind == account.KindEmail {
-			return i.ExternalID
-		}
-	}
-	return ""
-}
-
-// TestUnlinkProviderKeepsOthers detaches one provider from a multi-identity account and
-// refuses to remove the last remaining identity.
-func TestUnlinkProviderKeepsOthers(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision telegram: %v", err)
-	}
-	email := "unlink-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, email, true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-
-	// Removing a kind the account does not hold reports not-found.
-	if err := store.RemoveIdentity(ctx, acc.ID, account.KindVK); !errors.Is(err, account.ErrNotFound) {
-		t.Fatalf("remove absent vk = %v, want ErrNotFound", err)
-	}
-
-	// Detach Telegram: the email identity remains.
-	if err := store.RemoveIdentity(ctx, acc.ID, account.KindTelegram); err != nil {
-		t.Fatalf("remove telegram: %v", err)
-	}
-	ids, err := store.Identities(ctx, acc.ID)
-	if err != nil {
-		t.Fatalf("identities: %v", err)
-	}
-	if len(ids) != 1 || ids[0].Kind != account.KindEmail {
-		t.Fatalf("identities after unlink = %+v, want only email", ids)
-	}
-
-	// The email is now the last identity, so unlinking it is refused.
-	if err := store.RemoveIdentity(ctx, acc.ID, account.KindEmail); !errors.Is(err, account.ErrLastIdentity) {
-		t.Fatalf("remove last email = %v, want ErrLastIdentity", err)
-	}
-}
-
-// TestChangeEmailReplaces switches an account's confirmed email to a free address,
-// freeing the old one.
-func TestChangeEmailReplaces(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	oldAddr := "old-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, oldAddr, true); err != nil {
-		t.Fatalf("attach old email: %v", err)
-	}
-	newAddr := "new-" + uuid.NewString() + "@example.com"
-
-	if err := svc.RequestChangeCode(ctx, acc.ID, newAddr); err != nil {
-		t.Fatalf("request change: %v", err)
-	}
-	code := sixDigit.FindString(mailer.lastBody)
-	if _, err := svc.ConfirmChange(ctx, acc.ID, newAddr, code); err != nil {
-		t.Fatalf("confirm change: %v", err)
-	}
-	if got := emailOf(t, store, acc.ID); got != newAddr {
-		t.Fatalf("email after change = %q, want %q", got, newAddr)
-	}
-	if !identityConfirmed(t, account.KindEmail, newAddr) {
-		t.Error("the new email identity must be confirmed")
-	}
-	// The old address is freed: another account can now claim it.
-	other, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision other: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, other.ID, account.KindEmail, oldAddr, true); err != nil {
-		t.Fatalf("old address should be free after change, got: %v", err)
-	}
-}
-
-// TestChangeEmailRefusesTaken refuses (without merging) a new address already confirmed by
-// another account, leaving the caller's email untouched.
-func TestChangeEmailRefusesTaken(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision caller: %v", err)
-	}
-	mine := "mine-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, mine, true); err != nil {
-		t.Fatalf("attach caller email: %v", err)
-	}
-	other, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision other: %v", err)
-	}
-	taken := "taken-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, other.ID, account.KindEmail, taken, true); err != nil {
-		t.Fatalf("attach other email: %v", err)
-	}
-
-	if err := svc.RequestChangeCode(ctx, acc.ID, taken); err != nil {
-		t.Fatalf("request change: %v", err)
-	}
-	code := sixDigit.FindString(mailer.lastBody)
-	if _, err := svc.ConfirmChange(ctx, acc.ID, taken, code); !errors.Is(err, account.ErrEmailTaken) {
-		t.Fatalf("confirm change to taken = %v, want ErrEmailTaken", err)
-	}
-	if got := emailOf(t, store, acc.ID); got != mine {
-		t.Errorf("caller email after refused change = %q, want unchanged %q", got, mine)
-	}
-}
-
-// TestChangeEmailViaDeeplink switches the email through the one-tap confirm token.
-func TestChangeEmailViaDeeplink(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, "old-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach old email: %v", err)
-	}
-	newAddr := "dl-" + uuid.NewString() + "@example.com"
-	if err := svc.RequestChangeCode(ctx, acc.ID, newAddr); err != nil {
-		t.Fatalf("request change: %v", err)
-	}
-	res, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody))
-	if err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	if res.IsLogin() || res.NeedsMerge || res.Account != acc.ID {
-		t.Fatalf("deeplink change result = %+v, want a plain change for %s", res, acc.ID)
-	}
-	if got := emailOf(t, store, acc.ID); got != newAddr {
-		t.Fatalf("email after deeplink change = %q, want %q", got, newAddr)
-	}
-}

backend/internal/inttest/merge_test.go

@@ -58,6 +58,14 @@ func bestMoveCount(t *testing.T, id uuid.UUID) int {
 	return n
 }
 
+func setWallet(t *testing.T, id uuid.UUID, hints int, paid bool) {
+	t.Helper()
+	if _, err := testDB.ExecContext(context.Background(),
+		`UPDATE backend.accounts SET hint_balance=$2, paid_account=$3 WHERE account_id=$1`, id, hints, paid); err != nil {
+		t.Fatalf("set wallet: %v", err)
+	}
+}
+
 func bindEmailIdentity(t *testing.T, acc uuid.UUID, email string) {
 	t.Helper()
 	if _, err := testDB.ExecContext(context.Background(),
@@ -111,7 +119,7 @@ func seatGame(t *testing.T, seats []uuid.UUID, timeout time.Duration) uuid.UUID
 
 func newLinkService(mailer account.Mailer) *link.Service {
 	store := account.NewStore(testDB)
-	emails := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	emails := account.NewEmailService(store, mailer)
 	sessions := session.NewService(session.NewStore(testDB), session.NewCache())
 	return link.NewService(emails, store, accountmerge.NewMerger(testDB), sessions)
 }
@@ -123,7 +131,6 @@ func TestAccountMergeCore(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	merger := accountmerge.NewMerger(testDB)
-	merger.SetPayments(newPaymentsService())
 
 	primary := provisionAccount(t)
 	secondary := provisionAccount(t)
@@ -133,8 +140,8 @@ func TestAccountMergeCore(t *testing.T) {
 	setStats(t, secondary, 3, 1, 2, 400, 80)
 	setStatsCounts(t, primary, 100, 5)
 	setStatsCounts(t, secondary, 50, 8)
-	seedBenefit(t, primary, "telegram", 2, false)
-	seedBenefit(t, secondary, "telegram", 5, true) // hints sum, forever OR-s on merge
+	setWallet(t, primary, 2, false)
+	setWallet(t, secondary, 5, true)
 	// Best moves: secondary's scrabble_en (80) beats primary's (50) and is kept; secondary's
 	// scrabble_ru (30) is new to primary and carried over.
 	setBestMove(t, primary, "scrabble_en", 50)
@@ -158,13 +165,15 @@ func TestAccountMergeCore(t *testing.T) {
 		t.Error("secondary stats row should be deleted after merge")
 	}
 
-	// The payments wallet merged by origin: hints sum (2+5) and the forever flag OR-s; the
-	// deprecated accounts.hint_balance / paid_account columns are no longer touched by a merge.
-	if hints, forever := readBenefit(t, primary, "telegram"); hints != 7 || !forever {
-		t.Errorf("merged telegram benefit = hints %d forever %v, want 7/true", hints, forever)
+	acc, err := store.GetByID(ctx, primary)
+	if err != nil {
+		t.Fatalf("get primary: %v", err)
 	}
-	if hints, _ := readBenefit(t, secondary, "telegram"); hints != 0 {
-		t.Errorf("secondary benefit should be cleared after merge, got hints %d", hints)
+	if acc.HintBalance != 7 {
+		t.Errorf("hint balance = %d, want 7", acc.HintBalance)
+	}
+	if !acc.PaidAccount {
+		t.Error("paid_account should be true (ORed from secondary)")
 	}
 
 	if owner, ok, _ := store.AccountIDByIdentity(ctx, account.KindEmail, email); !ok || owner != primary {
@@ -242,44 +251,6 @@ func TestAccountMergeFinishedSharedGameKept(t *testing.T) {
 	}
 }
 
-// TestAccountMergeDedupesEmail keeps the primary's email when both accounts have one and
-// journals the secondary's to the dossier (reason=merge), so the survivor never ends up
-// with two email identities.
-func TestAccountMergeDedupesEmail(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	merger := accountmerge.NewMerger(testDB)
-
-	primary := provisionAccount(t)
-	secondary := provisionAccount(t)
-	primaryEmail := "keep-" + uuid.NewString() + "@example.com"
-	secondaryEmail := "absorb-" + uuid.NewString() + "@example.com"
-	bindEmailIdentity(t, primary, primaryEmail)
-	bindEmailIdentity(t, secondary, secondaryEmail)
-
-	if err := merger.Merge(ctx, primary, secondary); err != nil {
-		t.Fatalf("merge: %v", err)
-	}
-
-	// The primary keeps its own email; the secondary's is gone from the live identities.
-	if owner, ok, _ := store.AccountIDByIdentity(ctx, account.KindEmail, primaryEmail); !ok || owner != primary {
-		t.Errorf("primary email owner = %s ok=%v, want primary %s", owner, ok, primary)
-	}
-	if _, ok, _ := store.AccountIDByIdentity(ctx, account.KindEmail, secondaryEmail); ok {
-		t.Error("the secondary's email must be removed (no duplicate email on the survivor)")
-	}
-	// The absorbed email stays in the legal dossier, tagged reason=merge.
-	var reason string
-	if err := testDB.QueryRowContext(ctx,
-		`SELECT reason FROM backend.retained_identities WHERE account_id=$1 AND kind='email' AND external_id=$2`,
-		secondary, secondaryEmail).Scan(&reason); err != nil {
-		t.Fatalf("retained email row: %v", err)
-	}
-	if reason != "merge" {
-		t.Errorf("retained reason = %q, want merge", reason)
-	}
-}
-
 // TestAccountLinkFreeEmail binds a free email and promotes a guest to durable.
 func TestAccountLinkFreeEmail(t *testing.T) {
 	ctx := context.Background()
@@ -384,64 +355,3 @@ func TestAccountLinkGuestInversion(t *testing.T) {
 		t.Errorf("email owner = %s, want durable", owner)
 	}
 }
-
-// TestAccountLinkFreeVK binds a free VK identity (gateway-validated, no code) and
-// promotes a guest to durable — the ConfirmVK counterpart of the free-email case.
-func TestAccountLinkFreeVK(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	links := newLinkService(&capturingMailer{})
-
-	guest := provisionGuest(t)
-	vkID := "vk-" + uuid.NewString()
-	res, err := links.ConfirmVK(ctx, guest, vkID)
-	if err != nil {
-		t.Fatalf("confirm vk: %v", err)
-	}
-	if !res.Linked || res.MergeRequired {
-		t.Fatalf("confirm = %+v, want linked", res)
-	}
-	if acc, _ := store.GetByID(ctx, guest); acc.IsGuest {
-		t.Error("guest flag should clear once VK is linked")
-	}
-	if owner, ok, _ := store.AccountIDByIdentity(ctx, account.KindVK, vkID); !ok || owner != guest {
-		t.Errorf("vk owner = %s, want the promoted guest %s", owner, guest)
-	}
-}
-
-// TestAccountLinkVKMergeIntoCaller merges the account owning a VK identity into the
-// current durable account: ConfirmVK previews the merge, MergeVK folds it, the caller
-// stays primary and keeps its session, and the VK identity repoints to the caller.
-func TestAccountLinkVKMergeIntoCaller(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	links := newLinkService(&capturingMailer{})
-
-	caller := provisionAccount(t)
-	other := provisionAccount(t)
-	vkID := "vk-" + uuid.NewString()
-	if err := store.AttachIdentity(ctx, other, account.KindVK, vkID, true); err != nil {
-		t.Fatalf("seed vk on other: %v", err)
-	}
-
-	confirm, err := links.ConfirmVK(ctx, caller, vkID)
-	if err != nil {
-		t.Fatalf("confirm vk: %v", err)
-	}
-	if !confirm.MergeRequired || confirm.SecondaryID != other {
-		t.Fatalf("confirm = %+v, want merge_required to other %s", confirm, other)
-	}
-	merge, err := links.MergeVK(ctx, caller, vkID)
-	if err != nil {
-		t.Fatalf("merge vk: %v", err)
-	}
-	if merge.PrimaryID != caller || merge.SwitchedToken != "" {
-		t.Fatalf("merge = %+v, want primary caller and no session switch", merge)
-	}
-	if mergedInto(t, other) != caller {
-		t.Error("other should be tombstoned into caller")
-	}
-	if owner, _, _ := store.AccountIDByIdentity(ctx, account.KindVK, vkID); owner != caller {
-		t.Errorf("vk owner = %s, want caller after merge", owner)
-	}
-}

backend/internal/inttest/payments_catalog_test.go

@@ -1,113 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"testing"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/payments"
-)
-
-// methodPrice is one per-method money price for a seeded chip pack.
-type methodPrice struct {
-	method   string
-	currency string
-	amount   int64
-}
-
-// seedPackProduct creates an active chip pack: a product carrying the chips atom and a money price
-// per method. It returns the product id.
-func seedPackProduct(t *testing.T, chips int, prices ...methodPrice) uuid.UUID {
-	t.Helper()
-	ctx := context.Background()
-	prod := uuid.New()
-	if _, err := testDB.ExecContext(ctx,
-		`INSERT INTO payments.product (product_id, title, active) VALUES ($1,'test pack',true)`, prod); err != nil {
-		t.Fatalf("seed pack product: %v", err)
-	}
-	if _, err := testDB.ExecContext(ctx,
-		`INSERT INTO payments.product_item (product_id, atom_type, quantity) VALUES ($1,'chips',$2)`, prod, chips); err != nil {
-		t.Fatalf("seed chips item: %v", err)
-	}
-	for _, p := range prices {
-		if _, err := testDB.ExecContext(ctx,
-			`INSERT INTO payments.product_price (product_id, method, currency, amount) VALUES ($1,$2,$3,$4)`,
-			prod, p.method, p.currency, p.amount); err != nil {
-			t.Fatalf("seed pack price %s: %v", p.method, err)
-		}
-	}
-	return prod
-}
-
-// findCatalogProduct returns the projected storefront product for id in the context (the catalog
-// is global, so tests assert by id rather than count — testDB is shared).
-func findCatalogProduct(t *testing.T, svc *payments.Service, cxt payments.Context, id uuid.UUID) (payments.CatalogProduct, bool) {
-	t.Helper()
-	view, err := svc.Catalog(context.Background(), cxt)
-	if err != nil {
-		t.Fatalf("catalog: %v", err)
-	}
-	for _, p := range view.Products {
-		if p.ProductID == id.String() {
-			return p, true
-		}
-	}
-	return payments.CatalogProduct{}, false
-}
-
-// TestPaymentsCatalogByContext verifies the storefront projects a value at its chip price in every
-// context and a chip pack at the context method's money price, over Postgres.
-func TestPaymentsCatalogByContext(t *testing.T) {
-	svc := newPaymentsService()
-	value := seedValueProduct(t, 500, 250, 0)
-	pack := seedPackProduct(t, 100,
-		methodPrice{"vk", "VOTE", 20},
-		methodPrice{"telegram", "XTR", 25},
-		methodPrice{"direct", "RUB", 14900},
-	)
-
-	for _, kind := range []string{"vk", "telegram", "direct"} {
-		v, ok := findCatalogProduct(t, svc, payments.NewContext(kind, "web"), value)
-		if !ok {
-			t.Fatalf("value missing in %s context", kind)
-		}
-		if v.Kind != "value" || v.Chips != 500 || v.MoneyCurrency != "" {
-			t.Errorf("value in %s = %+v, want kind=value chips=500 no money", kind, v)
-		}
-	}
-
-	cases := []struct {
-		kind     string
-		amount   int64
-		currency string
-	}{
-		{"vk", 20, "VOTE"},
-		{"telegram", 25, "XTR"},
-		{"direct", 14900, "RUB"},
-	}
-	for _, tc := range cases {
-		p, ok := findCatalogProduct(t, svc, payments.NewContext(tc.kind, "web"), pack)
-		if !ok {
-			t.Fatalf("pack missing in %s context", tc.kind)
-		}
-		if p.Kind != "pack" || p.Chips != 0 || p.MoneyAmount != tc.amount || p.MoneyCurrency != tc.currency {
-			t.Errorf("pack in %s = %+v, want kind=pack amount=%d currency=%s", tc.kind, p, tc.amount, tc.currency)
-		}
-	}
-}
-
-// TestPaymentsCatalogExcludesDeactivated verifies a soft-deleted product drops out of the storefront.
-func TestPaymentsCatalogExcludesDeactivated(t *testing.T) {
-	svc := newPaymentsService()
-	prod := seedValueProduct(t, 100, 10, 0)
-	if _, err := testDB.ExecContext(context.Background(),
-		`UPDATE payments.product SET active=false WHERE product_id=$1`, prod); err != nil {
-		t.Fatalf("deactivate: %v", err)
-	}
-	if _, ok := findCatalogProduct(t, svc, payments.NewContext("direct", "web"), prod); ok {
-		t.Error("deactivated product must not appear in the storefront")
-	}
-}

backend/internal/inttest/payments_test.go

@@ -1,263 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/jackc/pgx/v5/pgconn"
-	"github.com/pressly/goose/v3"
-	testcontainers "github.com/testcontainers/testcontainers-go"
-	tcpostgres "github.com/testcontainers/testcontainers-go/modules/postgres"
-	"github.com/testcontainers/testcontainers-go/wait"
-
-	"scrabble/backend/internal/postgres"
-	"scrabble/backend/internal/postgres/migrations"
-)
-
-// isPgCode reports whether err is a PostgreSQL server error with the given
-// SQLSTATE code.
-func isPgCode(err error, code string) bool {
-	var pgErr *pgconn.PgError
-	return errors.As(err, &pgErr) && pgErr.Code == code
-}
-
-// TestPaymentsSchemaAndSeeds checks the payments schema, its role and the fixed
-// seed rows are present after migration.
-func TestPaymentsSchemaAndSeeds(t *testing.T) {
-	ctx := context.Background()
-
-	var atoms int
-	if err := testDB.QueryRowContext(ctx, "SELECT count(*) FROM payments.catalog_atom").Scan(&atoms); err != nil {
-		t.Fatalf("count catalog_atom: %v", err)
-	}
-	if atoms != 4 {
-		t.Errorf("catalog_atom rows = %d, want 4 (chips/hints/noads_days/tournament)", atoms)
-	}
-
-	var cfg int
-	if err := testDB.QueryRowContext(ctx, "SELECT count(*) FROM payments.config").Scan(&cfg); err != nil {
-		t.Fatalf("count config: %v", err)
-	}
-	if cfg != 1 {
-		t.Errorf("config rows = %d, want the single seeded row", cfg)
-	}
-
-	var roleExists bool
-	if err := testDB.QueryRowContext(ctx, "SELECT EXISTS(SELECT 1 FROM pg_roles WHERE rolname = 'payments')").Scan(&roleExists); err != nil {
-		t.Fatalf("check payments role: %v", err)
-	}
-	if !roleExists {
-		t.Error("payments role missing")
-	}
-}
-
-// TestPaymentsRoleConfinement proves the payments role is confined to its own
-// schema: it can read payments.* but is denied on backend.*. The application
-// itself connects as a superuser (which bypasses this), so this asserts the
-// grants are correct as the stepping-stone to a real separate login; the runtime
-// wall for the superuser pool is the import-boundary test in the payments package.
-func TestPaymentsRoleConfinement(t *testing.T) {
-	ctx := context.Background()
-	tx, err := testDB.BeginTx(ctx, nil)
-	if err != nil {
-		t.Fatalf("begin tx: %v", err)
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	if _, err := tx.ExecContext(ctx, "SET LOCAL ROLE payments"); err != nil {
-		t.Fatalf("SET LOCAL ROLE payments: %v", err)
-	}
-
-	// The payments role can read its own schema.
-	var n int
-	if err := tx.QueryRowContext(ctx, "SELECT count(*) FROM payments.config").Scan(&n); err != nil {
-		t.Errorf("payments role denied on payments.config (grants wrong): %v", err)
-	}
-
-	// The payments role must NOT reach the backend schema.
-	err = tx.QueryRowContext(ctx, "SELECT count(*) FROM backend.accounts").Scan(&n)
-	if err == nil {
-		t.Fatal("payments role could read backend.accounts — cross-schema isolation broken")
-	}
-	if !isPgCode(err, "42501") {
-		t.Errorf("reading backend.accounts as payments: got %v, want permission-denied (42501)", err)
-	}
-}
-
-// TestPaymentsLedgerAppendOnly verifies the append-only trigger rejects any
-// UPDATE or DELETE on the ledger (a superuser is bound by the trigger, unlike a
-// mere privilege REVOKE).
-func TestPaymentsLedgerAppendOnly(t *testing.T) {
-	ctx := context.Background()
-	id := uuid.New()
-	if _, err := testDB.ExecContext(ctx,
-		`INSERT INTO payments.ledger (ledger_id, account_id, kind, chips_delta) VALUES ($1, $2, 'admin_grant', 0)`,
-		id, uuid.New()); err != nil {
-		t.Fatalf("insert ledger row: %v", err)
-	}
-
-	if _, err := testDB.ExecContext(ctx, `UPDATE payments.ledger SET chips_delta = 1 WHERE ledger_id = $1`, id); err == nil {
-		t.Error("UPDATE on payments.ledger succeeded — append-only violated")
-	} else if !isPgCode(err, "P0001") {
-		t.Errorf("UPDATE ledger: got %v, want the append-only exception (P0001)", err)
-	}
-
-	if _, err := testDB.ExecContext(ctx, `DELETE FROM payments.ledger WHERE ledger_id = $1`, id); err == nil {
-		t.Error("DELETE on payments.ledger succeeded — append-only violated")
-	} else if !isPgCode(err, "P0001") {
-		t.Errorf("DELETE ledger: got %v, want the append-only exception (P0001)", err)
-	}
-}
-
-// TestPaymentsCheckConstraints verifies the domain CHECKs bite: non-negative
-// balances/hints/amount and the enum-like columns.
-func TestPaymentsCheckConstraints(t *testing.T) {
-	ctx := context.Background()
-
-	prod := uuid.New()
-	if _, err := testDB.ExecContext(ctx, `INSERT INTO payments.product (product_id, title) VALUES ($1, 'test')`, prod); err != nil {
-		t.Fatalf("insert product: %v", err)
-	}
-
-	cases := []struct {
-		name string
-		sql  string
-		args []any
-	}{
-		{"balances chips negative", `INSERT INTO payments.balances (account_id, source, chips) VALUES ($1, 'vk', -1)`, []any{uuid.New()}},
-		{"balances bad source", `INSERT INTO payments.balances (account_id, source, chips) VALUES ($1, 'nope', 0)`, []any{uuid.New()}},
-		{"benefits hints negative", `INSERT INTO payments.benefits (account_id, origin, hints) VALUES ($1, 'vk', -1)`, []any{uuid.New()}},
-		{"ledger bad kind", `INSERT INTO payments.ledger (ledger_id, account_id, kind) VALUES ($1, $2, 'bogus')`, []any{uuid.New(), uuid.New()}},
-		{"product_price amount negative", `INSERT INTO payments.product_price (product_id, method, currency, amount) VALUES ($1, 'direct', 'RUB', -1)`, []any{prod}},
-		{"product_price bad currency", `INSERT INTO payments.product_price (product_id, method, currency, amount) VALUES ($1, 'direct', 'EUR', 100)`, []any{prod}},
-	}
-	for _, c := range cases {
-		if _, err := testDB.ExecContext(ctx, c.sql, c.args...); err == nil {
-			t.Errorf("%s: insert succeeded, want a CHECK violation", c.name)
-		} else if !isPgCode(err, "23514") {
-			t.Errorf("%s: got %v, want check_violation (23514)", c.name, err)
-		}
-	}
-}
-
-// TestPaymentsLedgerIdempotencyIndex verifies the partial unique index makes a
-// (provider, provider_payment_id) pair collide once but leaves NULL-keyed rows
-// unconstrained.
-func TestPaymentsLedgerIdempotencyIndex(t *testing.T) {
-	ctx := context.Background()
-	insert := func(ppid *string) error {
-		_, err := testDB.ExecContext(ctx,
-			`INSERT INTO payments.ledger (ledger_id, account_id, kind, provider, provider_payment_id) VALUES ($1, $2, 'fund', 'robokassa', $3)`,
-			uuid.New(), uuid.New(), ppid)
-		return err
-	}
-
-	ppid := "inv-" + uuid.NewString()
-	if err := insert(&ppid); err != nil {
-		t.Fatalf("first insert: %v", err)
-	}
-	if err := insert(&ppid); err == nil {
-		t.Error("duplicate (provider, provider_payment_id) inserted — idempotency index missing")
-	} else if !isPgCode(err, "23505") {
-		t.Errorf("duplicate insert: got %v, want unique_violation (23505)", err)
-	}
-
-	// A NULL provider_payment_id is outside the partial index — repeats allowed.
-	if err := insert(nil); err != nil {
-		t.Fatalf("first null-ppid insert: %v", err)
-	}
-	if err := insert(nil); err != nil {
-		t.Errorf("second null-ppid insert should be allowed by the partial index: %v", err)
-	}
-}
-
-// TestPaymentsMigrationReversible proves the migration is expand-contract: it
-// applies, rolls fully back (schema, role, trigger and all), and re-applies
-// cleanly — so a backend image rollback stays DB-safe. It uses its own container
-// so the Down does not disturb the shared suite database.
-func TestPaymentsMigrationReversible(t *testing.T) {
-	ctx := context.Background()
-
-	container, err := tcpostgres.Run(ctx, pgImage,
-		tcpostgres.WithDatabase(pgDatabase),
-		tcpostgres.WithUsername(pgUser),
-		tcpostgres.WithPassword(pgPassword),
-		testcontainers.WithWaitStrategy(
-			wait.ForLog("database system is ready to accept connections").
-				WithOccurrence(2).
-				WithStartupTimeout(containerStartup),
-		),
-	)
-	if err != nil {
-		t.Fatalf("start container: %v", err)
-	}
-	defer func() { _ = container.Terminate(context.Background()) }()
-
-	baseDSN, err := container.ConnectionString(ctx, "sslmode=disable")
-	if err != nil {
-		t.Fatalf("connection string: %v", err)
-	}
-	dsn, err := withSearchPath(baseDSN, pgSchema)
-	if err != nil {
-		t.Fatalf("search path: %v", err)
-	}
-	cfg := postgres.DefaultConfig()
-	cfg.DSN = dsn
-	db, err := postgres.Open(ctx, cfg)
-	if err != nil {
-		t.Fatalf("open pool: %v", err)
-	}
-	defer func() { _ = db.Close() }()
-
-	// Up: apply every migration, including the payments foundation.
-	if err := postgres.ApplyMigrations(ctx, db); err != nil {
-		t.Fatalf("apply up: %v", err)
-	}
-	if !schemaExists(ctx, t, db, "payments") {
-		t.Fatal("payments schema absent after up")
-	}
-
-	// Down the payments migration and assert a clean teardown.
-	goose.SetBaseFS(migrations.Migrations())
-	defer goose.SetBaseFS(nil)
-	if err := goose.SetDialect("postgres"); err != nil {
-		t.Fatalf("set dialect: %v", err)
-	}
-	if err := goose.DownToContext(ctx, db, ".", 9); err != nil {
-		t.Fatalf("down to 9: %v", err)
-	}
-	if schemaExists(ctx, t, db, "payments") {
-		t.Error("payments schema survived the down migration")
-	}
-	var roleExists bool
-	if err := db.QueryRowContext(ctx, "SELECT EXISTS(SELECT 1 FROM pg_roles WHERE rolname = 'payments')").Scan(&roleExists); err != nil {
-		t.Fatalf("check role after down: %v", err)
-	}
-	if roleExists {
-		t.Error("payments role survived the down migration")
-	}
-
-	// Re-apply and assert it comes back cleanly.
-	if err := goose.UpContext(ctx, db, "."); err != nil {
-		t.Fatalf("re-apply up: %v", err)
-	}
-	if !schemaExists(ctx, t, db, "payments") {
-		t.Fatal("payments schema absent after re-apply")
-	}
-}
-
-// schemaExists reports whether a schema of the given name is present.
-func schemaExists(ctx context.Context, t *testing.T, db *sql.DB, name string) bool {
-	t.Helper()
-	var exists bool
-	if err := db.QueryRowContext(ctx,
-		"SELECT EXISTS(SELECT 1 FROM information_schema.schemata WHERE schema_name = $1)", name).Scan(&exists); err != nil {
-		t.Fatalf("check schema %s: %v", name, err)
-	}
-	return exists
-}

backend/internal/inttest/payments_wallet_test.go

@@ -1,279 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/payments"
-)
-
-// seedBalance writes a chip balance for an account+source directly (payments has no FK to
-// accounts, so a bare uuid is a valid account id here).
-func seedBalance(t *testing.T, id uuid.UUID, source string, chips int) {
-	t.Helper()
-	if _, err := testDB.ExecContext(context.Background(),
-		`INSERT INTO payments.balances (account_id, source, chips) VALUES ($1,$2,$3)
-		 ON CONFLICT (account_id, source) DO UPDATE SET chips = EXCLUDED.chips`,
-		id, source, chips); err != nil {
-		t.Fatalf("seed balance: %v", err)
-	}
-}
-
-// readBalance reads an account's chip balance for a source (0 when the row is absent).
-func readBalance(t *testing.T, id uuid.UUID, source string) int {
-	t.Helper()
-	var chips int
-	err := testDB.QueryRowContext(context.Background(),
-		`SELECT chips FROM payments.balances WHERE account_id=$1 AND source=$2`, id, source).Scan(&chips)
-	if err != nil && !errors.Is(err, sql.ErrNoRows) {
-		t.Fatalf("read balance: %v", err)
-	}
-	return chips
-}
-
-// benefitUntil reads an account's no-ads term end for an origin (nil when none).
-func benefitUntil(t *testing.T, id uuid.UUID, origin string) *time.Time {
-	t.Helper()
-	var until *time.Time
-	err := testDB.QueryRowContext(context.Background(),
-		`SELECT ads_paid_until FROM payments.benefits WHERE account_id=$1 AND origin=$2`, id, origin).Scan(&until)
-	if err != nil && !errors.Is(err, sql.ErrNoRows) {
-		t.Fatalf("read benefit until: %v", err)
-	}
-	return until
-}
-
-// ledgerRows counts an account's ledger rows of a given kind.
-func ledgerRows(t *testing.T, id uuid.UUID, kind string) int {
-	t.Helper()
-	var n int
-	if err := testDB.QueryRowContext(context.Background(),
-		`SELECT count(*) FROM payments.ledger WHERE account_id=$1 AND kind=$2`, id, kind).Scan(&n); err != nil {
-		t.Fatalf("ledger count: %v", err)
-	}
-	return n
-}
-
-// seedValueProduct creates an active chip-priced value: a product with a CHIP price (method
-// NULL) and the given hint / no-ads-day atoms. It returns the product id.
-func seedValueProduct(t *testing.T, priceChips, hints, noAdsDays int) uuid.UUID {
-	t.Helper()
-	ctx := context.Background()
-	prod := uuid.New()
-	if _, err := testDB.ExecContext(ctx,
-		`INSERT INTO payments.product (product_id, title, active) VALUES ($1,'test value',true)`, prod); err != nil {
-		t.Fatalf("seed product: %v", err)
-	}
-	if _, err := testDB.ExecContext(ctx,
-		`INSERT INTO payments.product_price (product_id, method, currency, amount) VALUES ($1, NULL, 'CHIP', $2)`,
-		prod, priceChips); err != nil {
-		t.Fatalf("seed price: %v", err)
-	}
-	if hints > 0 {
-		if _, err := testDB.ExecContext(ctx,
-			`INSERT INTO payments.product_item (product_id, atom_type, quantity) VALUES ($1,'hints',$2)`, prod, hints); err != nil {
-			t.Fatalf("seed hints item: %v", err)
-		}
-	}
-	if noAdsDays > 0 {
-		if _, err := testDB.ExecContext(ctx,
-			`INSERT INTO payments.product_item (product_id, atom_type, quantity) VALUES ($1,'noads_days',$2)`, prod, noAdsDays); err != nil {
-			t.Fatalf("seed noads item: %v", err)
-		}
-	}
-	return prod
-}
-
-// TestPaymentsSpendAppliesAtomically verifies a chip spend writes the ledger row, decrements the
-// balance and applies the benefit together over Postgres.
-func TestPaymentsSpendAppliesAtomically(t *testing.T) {
-	ctx := context.Background()
-	svc := newPaymentsService()
-	acc := uuid.New()
-	seedBalance(t, acc, "direct", 100)
-	prod := seedValueProduct(t, 60, 3, 30)
-
-	if err := svc.Spend(ctx, acc, payments.NewContext("direct", "web"), []payments.Source{payments.SourceDirect}, prod); err != nil {
-		t.Fatalf("spend: %v", err)
-	}
-	if got := readBalance(t, acc, "direct"); got != 40 {
-		t.Errorf("balance after spend = %d, want 40", got)
-	}
-	if hints, _ := readBenefit(t, acc, "direct"); hints != 3 {
-		t.Errorf("hints after spend = %d, want 3", hints)
-	}
-	if benefitUntil(t, acc, "direct") == nil {
-		t.Error("no-ads term not applied by the spend")
-	}
-	if n := ledgerRows(t, acc, "spend"); n != 1 {
-		t.Errorf("spend ledger rows = %d, want 1", n)
-	}
-}
-
-// TestPaymentsSpendInsufficientNoWrite verifies an under-funded spend is refused and writes
-// nothing (the balance, benefit and ledger are untouched).
-func TestPaymentsSpendInsufficientNoWrite(t *testing.T) {
-	ctx := context.Background()
-	svc := newPaymentsService()
-	acc := uuid.New()
-	seedBalance(t, acc, "direct", 10)
-	prod := seedValueProduct(t, 60, 3, 0)
-
-	if err := svc.Spend(ctx, acc, payments.NewContext("direct", "web"), []payments.Source{payments.SourceDirect}, prod); !errors.Is(err, payments.ErrInsufficientChips) {
-		t.Fatalf("spend = %v, want ErrInsufficientChips", err)
-	}
-	if got := readBalance(t, acc, "direct"); got != 10 {
-		t.Errorf("balance changed to %d, want 10 (no write)", got)
-	}
-	if h, _ := readBenefit(t, acc, "direct"); h != 0 {
-		t.Errorf("benefit applied on a refused spend: hints %d", h)
-	}
-	if ledgerRows(t, acc, "spend") != 0 {
-		t.Error("spend ledger row written on a refused spend")
-	}
-}
-
-// TestPaymentsSpendGuardRollsBack forces the in-transaction guard to bite: with a stale read
-// cache the draw plan looks affordable, but the guarded decrement matches no row and the whole
-// transaction rolls back — no ledger row, no benefit, balance unchanged.
-func TestPaymentsSpendGuardRollsBack(t *testing.T) {
-	ctx := context.Background()
-	svc := newPaymentsService()
-	acc := uuid.New()
-	seedBalance(t, acc, "direct", 100)
-	present := []payments.Source{payments.SourceDirect}
-	cxt := payments.NewContext("direct", "web")
-	if _, err := svc.Wallet(ctx, acc, cxt, present); err != nil { // warm the cache at 100
-		t.Fatalf("warm: %v", err)
-	}
-	// Drain the real balance behind the cache's back (no invalidation), so the plan over-commits.
-	if _, err := testDB.ExecContext(ctx, `UPDATE payments.balances SET chips = 10 WHERE account_id=$1 AND source='direct'`, acc); err != nil {
-		t.Fatalf("drain: %v", err)
-	}
-	prod := seedValueProduct(t, 60, 3, 0)
-
-	if err := svc.Spend(ctx, acc, cxt, present, prod); !errors.Is(err, payments.ErrInsufficientChips) {
-		t.Fatalf("spend = %v, want ErrInsufficientChips", err)
-	}
-	if got := readBalance(t, acc, "direct"); got != 10 {
-		t.Errorf("balance = %d, want 10 (rolled back)", got)
-	}
-	if ledgerRows(t, acc, "spend") != 0 {
-		t.Error("spend ledger row written despite the rollback")
-	}
-	if h, _ := readBenefit(t, acc, "direct"); h != 0 {
-		t.Error("benefit applied despite the rollback")
-	}
-}
-
-// TestPaymentsGrantCreditsValuesNotChips verifies admin_grant applies a benefit at price 0
-// without ever crediting chips (D16).
-func TestPaymentsGrantCreditsValuesNotChips(t *testing.T) {
-	ctx := context.Background()
-	svc := newPaymentsService()
-	acc := uuid.New()
-
-	if err := svc.Grant(ctx, acc, payments.SourceDirect, 5, 0, true); err != nil {
-		t.Fatalf("grant: %v", err)
-	}
-	if hints, forever := readBenefit(t, acc, "direct"); hints != 5 || !forever {
-		t.Errorf("granted benefit = hints %d forever %v, want 5/true", hints, forever)
-	}
-	if readBalance(t, acc, "direct") != 0 {
-		t.Error("a grant must not credit chips")
-	}
-	if ledgerRows(t, acc, "admin_grant") != 1 {
-		t.Error("admin_grant ledger row missing")
-	}
-	if ledgerRows(t, acc, "spend") != 0 || ledgerRows(t, acc, "fund") != 0 {
-		t.Error("a grant wrote a non-grant ledger row")
-	}
-}
-
-// TestPaymentsSpendHintByContext verifies a hint is drawn from an applicable origin, and that a
-// direct-origin hint is not usable inside a VK context (the compliance wall for hints).
-func TestPaymentsSpendHintByContext(t *testing.T) {
-	ctx := context.Background()
-	svc := newPaymentsService()
-	acc := uuid.New()
-	seedBenefit(t, acc, "direct", 2, false)
-	present := []payments.Source{payments.SourceDirect, payments.SourceVK}
-
-	if spent, err := svc.SpendHint(ctx, acc, payments.NewContext("direct", "web"), present); err != nil || !spent {
-		t.Fatalf("web spend hint = %v (err %v), want true", spent, err)
-	}
-	if h, _ := readBenefit(t, acc, "direct"); h != 1 {
-		t.Errorf("hints after spend = %d, want 1", h)
-	}
-	// Inside VK the applicable origins are {vk} only, so the direct-origin hint is untouched.
-	if spent, _ := svc.SpendHint(ctx, acc, payments.NewContext("vk", "android"), present); spent {
-		t.Error("direct-origin hint spent inside VK — compliance wall breached")
-	}
-	if h, _ := readBenefit(t, acc, "direct"); h != 1 {
-		t.Errorf("direct hints changed inside VK = %d, want 1 (untouched)", h)
-	}
-}
-
-// TestPaymentsComplianceGateOverPostgres is the named compliance regression at the integration
-// layer: a direct-origin no-ads benefit applies on the web but never inside a store wrapper.
-func TestPaymentsComplianceGateOverPostgres(t *testing.T) {
-	ctx := context.Background()
-	svc := newPaymentsService()
-	acc := uuid.New()
-	if err := svc.Grant(ctx, acc, payments.SourceDirect, 0, 30, false); err != nil {
-		t.Fatalf("grant: %v", err)
-	}
-	present := []payments.Source{payments.SourceDirect, payments.SourceVK}
-
-	if adFree, _ := svc.AdFree(ctx, acc, payments.NewContext("direct", "web"), present); !adFree {
-		t.Error("direct no-ads should apply on web")
-	}
-	if adFree, _ := svc.AdFree(ctx, acc, payments.NewContext("vk", "android"), present); adFree {
-		t.Error("direct no-ads must NOT apply inside VK (compliance wall)")
-	}
-	if adFree, _ := svc.AdFree(ctx, acc, payments.NewContext("telegram", "web"), present); adFree {
-		t.Error("direct no-ads must NOT apply inside Telegram (compliance wall)")
-	}
-}
-
-// TestPaymentsMergeFoldsSegmentsAndBenefits verifies the merge folds chip segments (sum) and
-// benefits (hints sum, forever OR) by origin, and clears the secondary's rows, over Postgres.
-func TestPaymentsMergeFoldsSegmentsAndBenefits(t *testing.T) {
-	ctx := context.Background()
-	svc := newPaymentsService()
-	primary, secondary := uuid.New(), uuid.New()
-	seedBalance(t, primary, "vk", 10)
-	seedBalance(t, secondary, "vk", 25)
-	seedBenefit(t, primary, "vk", 1, false)
-	seedBenefit(t, secondary, "vk", 4, true)
-
-	tx, err := testDB.BeginTx(ctx, nil)
-	if err != nil {
-		t.Fatalf("begin: %v", err)
-	}
-	if err := svc.MergeTx(ctx, tx, primary, secondary); err != nil {
-		_ = tx.Rollback()
-		t.Fatalf("merge: %v", err)
-	}
-	if err := tx.Commit(); err != nil {
-		t.Fatalf("commit: %v", err)
-	}
-	svc.Invalidate(primary, secondary)
-
-	if got := readBalance(t, primary, "vk"); got != 35 {
-		t.Errorf("merged chips = %d, want 35", got)
-	}
-	if h, forever := readBenefit(t, primary, "vk"); h != 5 || !forever {
-		t.Errorf("merged benefit = hints %d forever %v, want 5/true", h, forever)
-	}
-	if readBalance(t, secondary, "vk") != 0 {
-		t.Error("secondary balance not cleared after merge")
-	}
-}

backend/internal/inttest/retention_test.go

@@ -1,192 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-	"scrabble/backend/internal/accountdelete"
-)
-
-// lastLoginIP reads an account's stamped last-login IP ("" when unset).
-func lastLoginIP(t *testing.T, accountID uuid.UUID) string {
-	t.Helper()
-	var ip sql.NullString
-	err := testDB.QueryRowContext(context.Background(),
-		"SELECT last_login_ip FROM accounts WHERE account_id = $1", accountID).Scan(&ip)
-	if err != nil {
-		t.Fatalf("read last_login_ip %s: %v", accountID, err)
-	}
-	return ip.String
-}
-
-// retainedRow is one row of the retention journal, read directly for assertions.
-type retainedRow struct {
-	kind, externalID, reason string
-}
-
-// retainedRows reads the retention journal for an account, oldest detach first.
-func retainedRows(t *testing.T, accountID uuid.UUID) []retainedRow {
-	t.Helper()
-	rows, err := testDB.QueryContext(context.Background(),
-		"SELECT kind, external_id, reason FROM retained_identities WHERE account_id = $1 ORDER BY detached_at",
-		accountID)
-	if err != nil {
-		t.Fatalf("query retained_identities %s: %v", accountID, err)
-	}
-	defer rows.Close()
-	var out []retainedRow
-	for rows.Next() {
-		var r retainedRow
-		if err := rows.Scan(&r.kind, &r.externalID, &r.reason); err != nil {
-			t.Fatalf("scan retained row: %v", err)
-		}
-		out = append(out, r)
-	}
-	return out
-}
-
-// TestUnlinkJournalsRetainedIdentity: detaching a provider records it in the retention
-// journal (reason=unlink) before the live identity is removed.
-func TestUnlinkJournalsRetainedIdentity(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-
-	tgExt := "tg-" + uuid.NewString()
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, tgExt)
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	email := "keep-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, email, true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-
-	if err := store.RemoveIdentity(ctx, acc.ID, account.KindTelegram); err != nil {
-		t.Fatalf("unlink telegram: %v", err)
-	}
-	got := retainedRows(t, acc.ID)
-	if len(got) != 1 || got[0].kind != account.KindTelegram || got[0].externalID != tgExt || got[0].reason != "unlink" {
-		t.Fatalf("retained rows = %+v, want one unlink telegram %q", got, tgExt)
-	}
-}
-
-// TestChangeEmailJournalsOldAddress: an email change records the outgoing address in the
-// retention journal (reason=change).
-func TestChangeEmailJournalsOldAddress(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	oldAddr := "old-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, oldAddr, true); err != nil {
-		t.Fatalf("attach old email: %v", err)
-	}
-	newAddr := "new-" + uuid.NewString() + "@example.com"
-	if err := svc.RequestChangeCode(ctx, acc.ID, newAddr); err != nil {
-		t.Fatalf("request change: %v", err)
-	}
-	if _, err := svc.ConfirmChange(ctx, acc.ID, newAddr, sixDigit.FindString(mailer.lastBody)); err != nil {
-		t.Fatalf("confirm change: %v", err)
-	}
-	got := retainedRows(t, acc.ID)
-	if len(got) != 1 || got[0].kind != account.KindEmail || got[0].externalID != oldAddr || got[0].reason != "change" {
-		t.Fatalf("retained rows = %+v, want one change email %q", got, oldAddr)
-	}
-}
-
-// TestStampLastLoginThrottles: the first cold-load stamp writes the IP; a second within
-// the hour is a no-op (throttled), so it costs at most one write per account per hour.
-func TestStampLastLoginThrottles(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.StampLastLogin(ctx, acc.ID, "1.2.3.4"); err != nil {
-		t.Fatalf("first stamp: %v", err)
-	}
-	if got := lastLoginIP(t, acc.ID); got != "1.2.3.4" {
-		t.Fatalf("first stamp ip = %q, want 1.2.3.4", got)
-	}
-	if err := store.StampLastLogin(ctx, acc.ID, "9.9.9.9"); err != nil {
-		t.Fatalf("second stamp: %v", err)
-	}
-	if got := lastLoginIP(t, acc.ID); got != "1.2.3.4" {
-		t.Fatalf("throttled ip = %q, want unchanged 1.2.3.4", got)
-	}
-}
-
-// TestReapExpiredRetention: the reaper keeps journal rows newer than the cutoff and purges
-// older ones, and drops a long-deleted account's feedback thread + dossier PII.
-func TestReapExpiredRetention(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	// An unlinked provider leaves a journal row detached "now".
-	tgExt := "tg-" + uuid.NewString()
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, tgExt)
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, "keep-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	if err := store.RemoveIdentity(ctx, acc.ID, account.KindTelegram); err != nil {
-		t.Fatalf("unlink: %v", err)
-	}
-	// A cutoff before the detach keeps the row.
-	if _, _, err := store.ReapExpiredRetention(ctx, time.Now().Add(-time.Hour)); err != nil {
-		t.Fatalf("reap (early cutoff): %v", err)
-	}
-	if got := retainedRows(t, acc.ID); len(got) != 1 {
-		t.Fatalf("journal after early-cutoff reap = %+v, want kept", got)
-	}
-	// A cutoff after the detach purges it.
-	if _, _, err := store.ReapExpiredRetention(ctx, time.Now().Add(time.Hour)); err != nil {
-		t.Fatalf("reap (late cutoff): %v", err)
-	}
-	if got := retainedRows(t, acc.ID); len(got) != 0 {
-		t.Fatalf("journal after late-cutoff reap = %+v, want purged", got)
-	}
-
-	// A deleted account past the cutoff loses its feedback thread and dossier PII.
-	del, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "", "Иван", "")
-	if err != nil {
-		t.Fatalf("provision deletee: %v", err)
-	}
-	if _, err := testDB.ExecContext(ctx,
-		"INSERT INTO feedback_messages (message_id, account_id, body, channel) VALUES ($1, $2, 'hi', 'web')",
-		uuid.New(), del.ID); err != nil {
-		t.Fatalf("insert feedback: %v", err)
-	}
-	if err := deleter.AnonymizeAndTombstone(ctx, del.ID); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-	if _, fb, err := store.ReapExpiredRetention(ctx, time.Now().Add(time.Hour)); err != nil || fb == 0 {
-		t.Fatalf("reap deleted = (fb %d, err %v), want fb>=1", fb, err)
-	}
-	if name, _ := deletedFields(t, del.ID); name != "" {
-		t.Errorf("deleted_display_name after reap = %q, want cleared", name)
-	}
-	var fbCount int
-	if err := testDB.QueryRowContext(ctx, "SELECT count(*) FROM feedback_messages WHERE account_id = $1", del.ID).Scan(&fbCount); err != nil {
-		t.Fatalf("count feedback: %v", err)
-	}
-	if fbCount != 0 {
-		t.Errorf("feedback rows after reap = %d, want 0", fbCount)
-	}
-}

backend/internal/inttest/session_platform_test.go

@@ -1,178 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"database/sql"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/pressly/goose/v3"
-	testcontainers "github.com/testcontainers/testcontainers-go"
-	tcpostgres "github.com/testcontainers/testcontainers-go/modules/postgres"
-	"github.com/testcontainers/testcontainers-go/wait"
-
-	"scrabble/backend/internal/account"
-	"scrabble/backend/internal/postgres"
-	"scrabble/backend/internal/postgres/migrations"
-	"scrabble/backend/internal/session"
-)
-
-// TestSessionPlatformCaptureAndUntrusted proves a session round-trips its captured
-// platform through create and a cold-cache (DB-backed) resolve for each kind, and
-// that an unattributed session records no platform — the untrusted, view-only case.
-func TestSessionPlatformCaptureAndUntrusted(t *testing.T) {
-	ctx := context.Background()
-	accounts := account.NewStore(testDB)
-	store := session.NewStore(testDB)
-	svc := session.NewService(store, session.NewCache())
-
-	for _, tc := range []struct {
-		name     string
-		platform session.Platform
-	}{
-		{"vk-ios", session.Platform{Kind: session.PlatformKindVK, Subtype: session.SubtypeIOS}},
-		{"telegram-android", session.Platform{Kind: session.PlatformKindTelegram, Subtype: session.SubtypeAndroid}},
-		{"direct-web", session.Platform{Kind: session.PlatformKindDirect, Subtype: session.SubtypeWeb}},
-		{"untrusted", session.Platform{}},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			acc, err := accounts.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-			if err != nil {
-				t.Fatalf("provision: %v", err)
-			}
-			token, sess, err := svc.Create(ctx, acc.ID, tc.platform)
-			if err != nil {
-				t.Fatalf("create: %v", err)
-			}
-			if sess.Platform != tc.platform {
-				t.Errorf("created platform = %+v, want %+v", sess.Platform, tc.platform)
-			}
-			// Resolve through a cold cache so the value comes back via the DB columns.
-			cold := session.NewService(store, session.NewCache())
-			if err := cold.Warm(ctx); err != nil {
-				t.Fatalf("warm: %v", err)
-			}
-			got, err := cold.Resolve(ctx, token)
-			if err != nil {
-				t.Fatalf("resolve: %v", err)
-			}
-			if got.Platform != tc.platform {
-				t.Errorf("resolved platform = %+v, want %+v", got.Platform, tc.platform)
-			}
-			if got.Platform.Trusted() != tc.platform.Trusted() {
-				t.Errorf("resolved Trusted() = %v, want %v", got.Platform.Trusted(), tc.platform.Trusted())
-			}
-		})
-	}
-}
-
-// TestSessionPlatformCheckConstraints proves the CHECK constraints reject an
-// out-of-range kind or subtype, so a corrupt value cannot be persisted.
-func TestSessionPlatformCheckConstraints(t *testing.T) {
-	ctx := context.Background()
-	acc, err := account.NewStore(testDB).ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	const pgCheckViolation = "23514"
-	for _, tc := range []struct {
-		name    string
-		kind    string
-		subtype string
-	}{
-		{"bad-kind", "facebook", "web"},
-		{"bad-subtype", "vk", "windows"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			_, err := testDB.ExecContext(ctx,
-				`INSERT INTO backend.sessions (session_id, account_id, token_hash, platform_kind, platform_subtype)
-				 VALUES ($1, $2, $3, $4, $5)`,
-				uuid.New(), acc.ID, uuid.NewString(), tc.kind, tc.subtype)
-			if !isPgCode(err, pgCheckViolation) {
-				t.Errorf("insert %s: err = %v, want check_violation", tc.name, err)
-			}
-		})
-	}
-}
-
-// TestSessionPlatformMigrationReversible proves migration 00011 is expand-contract:
-// it applies, rolls back (dropping the platform columns), and re-applies cleanly —
-// so a backend image rollback stays DB-safe. It uses its own container so the Down
-// does not disturb the shared suite database.
-func TestSessionPlatformMigrationReversible(t *testing.T) {
-	ctx := context.Background()
-
-	container, err := tcpostgres.Run(ctx, pgImage,
-		tcpostgres.WithDatabase(pgDatabase),
-		tcpostgres.WithUsername(pgUser),
-		tcpostgres.WithPassword(pgPassword),
-		testcontainers.WithWaitStrategy(
-			wait.ForLog("database system is ready to accept connections").
-				WithOccurrence(2).
-				WithStartupTimeout(containerStartup),
-		),
-	)
-	if err != nil {
-		t.Fatalf("start container: %v", err)
-	}
-	defer func() { _ = container.Terminate(context.Background()) }()
-
-	baseDSN, err := container.ConnectionString(ctx, "sslmode=disable")
-	if err != nil {
-		t.Fatalf("connection string: %v", err)
-	}
-	dsn, err := withSearchPath(baseDSN, pgSchema)
-	if err != nil {
-		t.Fatalf("search path: %v", err)
-	}
-	cfg := postgres.DefaultConfig()
-	cfg.DSN = dsn
-	db, err := postgres.Open(ctx, cfg)
-	if err != nil {
-		t.Fatalf("open pool: %v", err)
-	}
-	defer func() { _ = db.Close() }()
-
-	if err := postgres.ApplyMigrations(ctx, db); err != nil {
-		t.Fatalf("apply up: %v", err)
-	}
-	if !sessionsPlatformColumnsExist(ctx, t, db) {
-		t.Fatal("platform columns absent after up")
-	}
-
-	goose.SetBaseFS(migrations.Migrations())
-	defer goose.SetBaseFS(nil)
-	if err := goose.SetDialect("postgres"); err != nil {
-		t.Fatalf("set dialect: %v", err)
-	}
-	// Down past 00011 (to 00010) and assert the columns are gone.
-	if err := goose.DownToContext(ctx, db, ".", 10); err != nil {
-		t.Fatalf("down to 10: %v", err)
-	}
-	if sessionsPlatformColumnsExist(ctx, t, db) {
-		t.Error("platform columns survived the down migration")
-	}
-	// Re-apply and assert they return.
-	if err := goose.UpContext(ctx, db, "."); err != nil {
-		t.Fatalf("re-apply up: %v", err)
-	}
-	if !sessionsPlatformColumnsExist(ctx, t, db) {
-		t.Fatal("platform columns absent after re-apply")
-	}
-}
-
-// sessionsPlatformColumnsExist reports whether both platform columns are present on
-// backend.sessions.
-func sessionsPlatformColumnsExist(ctx context.Context, t *testing.T, db *sql.DB) bool {
-	t.Helper()
-	var n int
-	if err := db.QueryRowContext(ctx,
-		`SELECT count(*) FROM information_schema.columns
-		 WHERE table_schema = 'backend' AND table_name = 'sessions'
-		   AND column_name IN ('platform_kind', 'platform_subtype')`).Scan(&n); err != nil {
-		t.Fatalf("count platform columns: %v", err)
-	}
-	return n == 2
-}

backend/internal/inttest/session_test.go

@@ -26,8 +26,7 @@ func TestSessionLifecycle(t *testing.T) {
 	store := session.NewStore(testDB)
 	svc := session.NewService(store, session.NewCache())
 
-	platform := session.Platform{Kind: session.PlatformKindVK, Subtype: session.SubtypeIOS}
-	token, sess, err := svc.Create(ctx, acc.ID, platform)
+	token, sess, err := svc.Create(ctx, acc.ID)
 	if err != nil {
 		t.Fatalf("create session: %v", err)
 	}
@@ -37,9 +36,6 @@ func TestSessionLifecycle(t *testing.T) {
 	if token == sess.TokenHash {
 		t.Error("plaintext token must not equal the stored hash")
 	}
-	if sess.Platform != platform {
-		t.Errorf("session platform = %+v, want %+v", sess.Platform, platform)
-	}
 
 	// Resolve via the warm write-through cache.
 	got, err := svc.Resolve(ctx, token)
@@ -67,8 +63,8 @@ func TestSessionLifecycle(t *testing.T) {
 	if _, ok := cold.Get(session.HashToken(token)); !ok {
 		t.Error("Warm must load the active session into the cache")
 	}
-	if got2, err := svc2.Resolve(ctx, token); err != nil || got2.ID != sess.ID || got2.Platform != platform {
-		t.Errorf("resolve after warm = (%s, %+v, %v), want %s / %+v", got2.ID, got2.Platform, err, sess.ID, platform)
+	if got2, err := svc2.Resolve(ctx, token); err != nil || got2.ID != sess.ID {
+		t.Errorf("resolve after warm = (%s, %v), want %s", got2.ID, err, sess.ID)
 	}
 
 	// Revoke, then the token no longer resolves; revoke again is a no-op.

backend/internal/link/service.go

@@ -133,53 +133,6 @@ func (s *Service) attachTelegram(ctx context.Context, callerID uuid.UUID, extern
 	return s.accounts.ClearGuest(ctx, callerID)
 }
 
-// ConfirmVK attaches a gateway-validated VK identity to the caller (Linked) or
-// reports that it belongs to another account (MergeRequired). The gateway has already
-// completed the VK ID code exchange, so externalID is the trusted vk user id.
-func (s *Service) ConfirmVK(ctx context.Context, callerID uuid.UUID, externalID string) (ConfirmResult, error) {
-	owner, ok, err := s.accounts.AccountIDByIdentity(ctx, account.KindVK, externalID)
-	if err != nil {
-		return ConfirmResult{}, err
-	}
-	if !ok {
-		if err := s.attachVK(ctx, callerID, externalID); err != nil {
-			return ConfirmResult{}, err
-		}
-		return ConfirmResult{Linked: true}, nil
-	}
-	if owner == callerID {
-		return ConfirmResult{Linked: true}, nil
-	}
-	return ConfirmResult{MergeRequired: true, SecondaryID: owner}, nil
-}
-
-// MergeVK merges the account owning a gateway-validated VK identity into the caller's
-// (subject to the guest-primary rule).
-func (s *Service) MergeVK(ctx context.Context, callerID uuid.UUID, externalID string) (MergeResult, error) {
-	owner, ok, err := s.accounts.AccountIDByIdentity(ctx, account.KindVK, externalID)
-	if err != nil {
-		return MergeResult{}, err
-	}
-	if !ok {
-		if err := s.attachVK(ctx, callerID, externalID); err != nil {
-			return MergeResult{}, err
-		}
-		return MergeResult{PrimaryID: callerID}, nil
-	}
-	if owner == callerID {
-		return MergeResult{PrimaryID: callerID}, nil
-	}
-	return s.merge(ctx, callerID, owner)
-}
-
-// attachVK links the identity to the caller and promotes a guest.
-func (s *Service) attachVK(ctx context.Context, callerID uuid.UUID, externalID string) error {
-	if err := s.accounts.AttachIdentity(ctx, callerID, account.KindVK, externalID, true); err != nil {
-		return err
-	}
-	return s.accounts.ClearGuest(ctx, callerID)
-}
-
 // merge decides the primary (the caller, unless it is a guest and the other is
 // durable), runs the data merge, retires the secondary's sessions and mints a new
 // session when the active account switches.
@@ -200,11 +153,7 @@ func (s *Service) merge(ctx context.Context, callerID, otherID uuid.UUID) (Merge
 	}
 	res := MergeResult{PrimaryID: primary}
 	if primary != callerID {
-		// The switched-to session inherits the caller's current trusted platform
-		// (the context the merge was initiated from); absent when the caller's
-		// session itself is untrusted.
-		platform, _ := session.PlatformFromContext(ctx)
-		token, _, err := s.sessions.Create(ctx, primary, platform)
+		token, _, err := s.sessions.Create(ctx, primary)
 		if err != nil {
 			return MergeResult{}, err
 		}

backend/internal/notify/events.go

@@ -155,13 +155,6 @@ func Notification(userID uuid.UUID, kind string) Intent {
 	return Intent{UserID: userID, Kind: KindNotification, Payload: b.FinishedBytes(), EventID: eventID()}
 }
 
-// ProfileChanged is a payload-free "re-fetch your profile" signal to userID, emitted
-// when the viewer's own account changed out of band — an email confirmed through the
-// one-tap deeplink opened in another browser.
-func ProfileChanged(userID uuid.UUID) Intent {
-	return Notification(userID, NotifyProfile)
-}
-
 // NotificationAccount builds a lobby notification of one of the friend_* kinds carrying the
 // account it concerns (the requester, the new friend or the decliner), so the client updates its
 // requests/friends lists and the in-game "add friend" state without a refetch.

backend/internal/notify/notify.go

@@ -69,10 +69,6 @@ const (
 	// it re-fetches profile.get to show or hide the banner. It carries no payload (the
 	// banner set rides the profile response). In-app only.
 	NotifyBanner = "banner"
-	// NotifyProfile tells the client that the viewer's own profile changed out of band
-	// (e.g. an email was confirmed via the one-tap deeplink opened in another browser),
-	// so it re-fetches profile.get. It carries no payload. In-app only.
-	NotifyProfile = "profile"
 	// NotifyUserBlocked confirms to the blocker that a per-user block took effect,
 	// carrying the blocked account, so every one of the blocker's sessions updates the
 	// in-game block/add-friend controls and the struck name in place. It is delivered

backend/internal/payments/boundary_test.go

@@ -1,57 +0,0 @@
-package payments
-
-import (
-	"go/parser"
-	"go/token"
-	"io/fs"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-)
-
-// TestPaymentsSchemaImportBoundary enforces that only this package reaches the
-// payments jet code. The payments schema is isolated behind this domain; the
-// application connects to Postgres as a superuser that bypasses the schema
-// grants, so the runtime wall that keeps every other package out of payments.*
-// is this import boundary, not the DB privileges. If another package imported
-// the generated payments tables it could issue SQL against the schema directly,
-// breaking the single-writer guarantee and the domain's extractability.
-func TestPaymentsSchemaImportBoundary(t *testing.T) {
-	const jetPkg = "scrabble/backend/internal/postgres/jet/payments"
-
-	_, thisFile, _, ok := runtime.Caller(0)
-	if !ok {
-		t.Fatal("cannot resolve the test file path")
-	}
-	// thisFile = .../backend/internal/payments/boundary_test.go
-	backendRoot := filepath.Clean(filepath.Join(filepath.Dir(thisFile), "..", ".."))
-	allowedPrefix := filepath.Join(backendRoot, "internal", "payments") + string(filepath.Separator)
-
-	fset := token.NewFileSet()
-	walkErr := filepath.WalkDir(backendRoot, func(path string, d fs.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		if d.IsDir() || !strings.HasSuffix(path, ".go") {
-			return nil
-		}
-		file, perr := parser.ParseFile(fset, path, nil, parser.ImportsOnly)
-		if perr != nil {
-			return perr
-		}
-		for _, imp := range file.Imports {
-			p := strings.Trim(imp.Path.Value, `"`)
-			if p != jetPkg && !strings.HasPrefix(p, jetPkg+"/") {
-				continue
-			}
-			if !strings.HasPrefix(path, allowedPrefix) {
-				t.Errorf("%s imports %s — only internal/payments may reach the payments jet code", path, p)
-			}
-		}
-		return nil
-	})
-	if walkErr != nil {
-		t.Fatalf("walk backend tree: %v", walkErr)
-	}
-}

backend/internal/payments/cache.go

@@ -1,72 +0,0 @@
-package payments
-
-import (
-	"sync"
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// benefitState is an account's benefit row for one origin: the no-ads term end (nil = none),
-// the perpetual forever flag, and the hint count. It is the context-independent stored form;
-// the read paths aggregate it over the origins applicable in a context.
-type benefitState struct {
-	adsPaidUntil *time.Time
-	adsForever   bool
-	hints        int
-}
-
-// walletState is an account's full payments state: chip balances by source and benefits by
-// origin. It is the raw, context-independent data every read path filters per execution
-// context — the value the cache holds and the store recomputes from the materialized tables.
-type walletState struct {
-	chips    map[Source]int
-	benefits map[Source]benefitState
-}
-
-// chipsOf returns the chip balance for a source, zero when the segment has no row (an absent
-// segment reads as zero, §2).
-func (w walletState) chipsOf(s Source) int { return w.chips[s] }
-
-// benefitOf returns the benefit for an origin, the zero benefit when the origin has no row.
-func (w walletState) benefitOf(o Source) benefitState { return w.benefits[o] }
-
-// walletCache is the payments read model: each account's chip/benefit state, keyed by account
-// id, read on every ad-eligibility / hint / wallet / gate request and invalidated on every
-// payments mutation (spend, grant, fund, refund, merge). It is a write-through cache in front
-// of the materialized balances/benefits tables — the same pattern the account-suspension gate
-// uses (backend/internal/account/suspension.go) — so the steady-state hot path issues no query
-// to the payments schema. It is single-instance, matching the deployment (one shared Store); a
-// multi-instance backend would need a shared cache.
-type walletCache struct {
-	mu sync.RWMutex
-	m  map[uuid.UUID]walletState
-}
-
-// newWalletCache constructs an empty cache.
-func newWalletCache() *walletCache {
-	return &walletCache{m: make(map[uuid.UUID]walletState)}
-}
-
-// get returns the cached state for an account and whether it was present.
-func (c *walletCache) get(id uuid.UUID) (walletState, bool) {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	s, ok := c.m[id]
-	return s, ok
-}
-
-// put stores an account's state.
-func (c *walletCache) put(id uuid.UUID, s walletState) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.m[id] = s
-}
-
-// invalidate drops an account's entry so the next read reloads it from the materialized tables.
-// Called after every mutation once its transaction has committed.
-func (c *walletCache) invalidate(id uuid.UUID) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	delete(c.m, id)
-}

backend/internal/payments/catalog.go

@@ -1,82 +0,0 @@
-package payments
-
-// AtomQty is one atom line of a catalog product in the read model: the base value type it grants
-// (chips / hints / no-ads days / tournament) and how many of it the product carries.
-type AtomQty struct {
-	AtomType string
-	Quantity int
-}
-
-// CatalogProduct is one storefront product projected for the execution context. A value is
-// bought with chips, so it carries Chips (its uniform chip price) and no money price. A chip pack
-// funds chips with money, so it carries MoneyAmount (minor units) and MoneyCurrency for the
-// context's payment method and no chip price. Atoms lists what the product grants.
-type CatalogProduct struct {
-	Kind          string // "value" (bought with chips) or "pack" (funds chips with money)
-	ProductID     string
-	Title         string
-	Chips         int    // a value's uniform chip price; 0 for a pack
-	MoneyAmount   int64  // a pack's price in the context currency's minor units; 0 for a value
-	MoneyCurrency string // a pack's currency for the context method; empty for a value
-	Atoms         []AtomQty
-}
-
-// CatalogView is the storefront read model for one execution context: the products a player sees
-// and can buy there — every chip-priced value plus the chip packs priced in the context's method.
-type CatalogView struct {
-	Products []CatalogProduct
-}
-
-// atomChips is the atom type that marks a product as a chip pack (it funds chips) rather than a
-// value (bought with chips). A value never carries it.
-const atomChips = "chips"
-
-// projectCatalog turns the raw active catalog into the storefront for the context. A value (no
-// chips atom) is shown everywhere at its CHIP price. A chip pack is shown only when it carries a
-// price for the context's payment method (cxt.Kind: vk / telegram / direct), priced in that
-// method's currency. A value missing its CHIP price and a pack missing a price for the context
-// method are omitted (misconfigured or unavailable there). An untrusted context (empty Kind) has
-// no method, so only values show; buying is gated server-side regardless.
-func projectCatalog(entries []catalogEntry, cxt Context) CatalogView {
-	var out CatalogView
-	for _, e := range entries {
-		isPack := false
-		atoms := make([]AtomQty, 0, len(e.atoms))
-		for _, a := range e.atoms {
-			atoms = append(atoms, AtomQty{AtomType: a.atomType, Quantity: a.quantity})
-			if a.atomType == atomChips {
-				isPack = true
-			}
-		}
-		p := CatalogProduct{ProductID: e.id.String(), Title: e.title, Atoms: atoms}
-		if isPack {
-			pr, ok := findPrice(e.prices, string(cxt.Kind))
-			if !ok {
-				continue // no price for this context's method — not purchasable here
-			}
-			p.Kind = "pack"
-			p.MoneyAmount = pr.amount
-			p.MoneyCurrency = string(pr.currency)
-		} else {
-			pr, ok := findPrice(e.prices, "")
-			if !ok {
-				continue // a value must carry a CHIP price
-			}
-			p.Kind = "value"
-			p.Chips = int(pr.amount)
-		}
-		out.Products = append(out.Products, p)
-	}
-	return out
-}
-
-// findPrice returns the price row for the given payment method — the empty string selects a
-// value's CHIP price row (stored with a NULL method).
-func findPrice(prices []priceRow, method string) (priceRow, bool) {
-	for _, pr := range prices {
-		if pr.method == method {
-			return pr, true
-		}
-	}
-	return priceRow{}, false
-}

backend/internal/payments/catalog_test.go

@@ -1,136 +0,0 @@
-package payments
-
-import (
-	"testing"
-
-	"github.com/google/uuid"
-)
-
-// catalog fixtures: a chip-priced value (hints), a multi-method chip pack, a VK-only chip pack, a
-// value with no CHIP price (misconfigured), and a pack whose only method is telegram.
-func fixtureCatalog() []catalogEntry {
-	value := catalogEntry{
-		id:    uuid.MustParse("00000000-0000-0000-0000-000000000001"),
-		title: "250 hints",
-		atoms: []atomQty{{atomType: "hints", quantity: 250}},
-		prices: []priceRow{
-			{method: "", currency: CurrencyChip, amount: 500},
-		},
-	}
-	pack := catalogEntry{
-		id:    uuid.MustParse("00000000-0000-0000-0000-000000000002"),
-		title: "100 chips",
-		atoms: []atomQty{{atomType: "chips", quantity: 100}},
-		prices: []priceRow{
-			{method: "vk", currency: CurrencyVote, amount: 20},
-			{method: "telegram", currency: CurrencyStar, amount: 25},
-			{method: "direct", currency: CurrencyRUB, amount: 14900},
-		},
-	}
-	vkOnlyPack := catalogEntry{
-		id:    uuid.MustParse("00000000-0000-0000-0000-000000000003"),
-		title: "VK-only chips",
-		atoms: []atomQty{{atomType: "chips", quantity: 50}},
-		prices: []priceRow{
-			{method: "vk", currency: CurrencyVote, amount: 10},
-		},
-	}
-	brokenValue := catalogEntry{
-		id:    uuid.MustParse("00000000-0000-0000-0000-000000000004"),
-		title: "no chip price",
-		atoms: []atomQty{{atomType: "noads_days", quantity: 30}},
-		// no CHIP price row — misconfigured, must be omitted
-	}
-	return []catalogEntry{value, pack, vkOnlyPack, brokenValue}
-}
-
-// byID indexes a projected storefront by product id for assertions.
-func byID(v CatalogView) map[string]CatalogProduct {
-	m := make(map[string]CatalogProduct, len(v.Products))
-	for _, p := range v.Products {
-		m[p.ProductID] = p
-	}
-	return m
-}
-
-func TestProjectCatalog_ContextMatrix(t *testing.T) {
-	const (
-		valueID  = "00000000-0000-0000-0000-000000000001"
-		packID   = "00000000-0000-0000-0000-000000000002"
-		vkPackID = "00000000-0000-0000-0000-000000000003"
-		brokenID = "00000000-0000-0000-0000-000000000004"
-	)
-	entries := fixtureCatalog()
-
-	tests := []struct {
-		name        string
-		cxt         Context
-		wantPackAmt int64
-		wantPackCur Currency
-		wantVKPack  bool // the vk-only pack visible?
-	}{
-		{"vk", Context{Kind: SourceVK}, 20, CurrencyVote, true},
-		{"vk-ios frozen still lists vk price", Context{Kind: SourceVK, Subtype: SubtypeIOS}, 20, CurrencyVote, true},
-		{"telegram", Context{Kind: SourceTelegram}, 25, CurrencyStar, false},
-		{"direct", Context{Kind: SourceDirect}, 14900, CurrencyRUB, false},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := byID(projectCatalog(entries, tc.cxt))
-
-			// The value shows everywhere at its uniform chip price, never a money price.
-			v, ok := got[valueID]
-			if !ok {
-				t.Fatalf("value missing from %s storefront", tc.name)
-			}
-			if v.Kind != "value" || v.Chips != 500 || v.MoneyCurrency != "" || v.MoneyAmount != 0 {
-				t.Errorf("value = %+v, want kind=value chips=500 no money", v)
-			}
-			if len(v.Atoms) != 1 || v.Atoms[0].AtomType != "hints" || v.Atoms[0].Quantity != 250 {
-				t.Errorf("value atoms = %+v, want [hints:250]", v.Atoms)
-			}
-
-			// The multi-method pack shows the context method's price, in that currency, no chips.
-			p, ok := got[packID]
-			if !ok {
-				t.Fatalf("pack missing from %s storefront", tc.name)
-			}
-			if p.Kind != "pack" || p.Chips != 0 || p.MoneyAmount != tc.wantPackAmt || p.MoneyCurrency != string(tc.wantPackCur) {
-				t.Errorf("pack = %+v, want kind=pack amount=%d currency=%s", p, tc.wantPackAmt, tc.wantPackCur)
-			}
-
-			// The vk-only pack shows only where a vk price exists.
-			if _, ok := got[vkPackID]; ok != tc.wantVKPack {
-				t.Errorf("vk-only pack present=%v, want %v (%s)", ok, tc.wantVKPack, tc.name)
-			}
-
-			// The misconfigured value (no CHIP price) is never shown.
-			if _, ok := got[brokenID]; ok {
-				t.Errorf("misconfigured value must be omitted (%s)", tc.name)
-			}
-		})
-	}
-}
-
-// An untrusted context (empty Kind) has no payment method, so it shows values only — no packs.
-func TestProjectCatalog_UntrustedShowsValuesOnly(t *testing.T) {
-	got := byID(projectCatalog(fixtureCatalog(), Context{}))
-	if _, ok := got["00000000-0000-0000-0000-000000000001"]; !ok {
-		t.Error("untrusted context should still list the chip-priced value")
-	}
-	for _, id := range []string{
-		"00000000-0000-0000-0000-000000000002",
-		"00000000-0000-0000-0000-000000000003",
-	} {
-		if _, ok := got[id]; ok {
-			t.Errorf("untrusted context must not list pack %s", id)
-		}
-	}
-}
-
-// An empty catalog projects to an empty storefront (no products seeded yet — the Release-1 state).
-func TestProjectCatalog_Empty(t *testing.T) {
-	if got := projectCatalog(nil, Context{Kind: SourceDirect}); len(got.Products) != 0 {
-		t.Errorf("empty catalog projected %d products, want 0", len(got.Products))
-	}
-}

backend/internal/payments/gate.go

@@ -1,202 +0,0 @@
-package payments
-
-import (
-	"slices"
-	"time"
-)
-
-// Source is the platform axis a chip balance is segmented by (where it was funded) and a
-// benefit is stamped with (where it was bought — its origin). The two roles share this value
-// set but mean different things (see docs/PAYMENTS.md §3); Source names the axis for both.
-type Source string
-
-const (
-	// SourceVK is the VK platform: Votes purchases and VK rewarded ads fund here.
-	SourceVK Source = "vk"
-	// SourceTelegram is the Telegram platform: Stars purchases fund here.
-	SourceTelegram Source = "telegram"
-	// SourceDirect is the open web / native context: Robokassa purchases fund here.
-	SourceDirect Source = "direct"
-)
-
-// Valid reports whether s is one of the three known platform sources.
-func (s Source) Valid() bool {
-	switch s {
-	case SourceVK, SourceTelegram, SourceDirect:
-		return true
-	default:
-		return false
-	}
-}
-
-// SubtypeIOS is the one device subtype the gate keys on: VK on iOS is frozen for spending
-// (Apple forbids spending virtual currency on digital goods outside IAP). It is trusted only
-// for VK, where it rides inside the signed launch parameters.
-const SubtypeIOS = "ios"
-
-// SourceForIdentityKind maps a backend identity kind to the payments source whose segment that
-// identity makes available: a vk/telegram identity to its own source, a durable email identity
-// to the direct source (the web/native recovery anchor). A robot identity — or any unknown
-// kind — maps to no source (second return false). Callers use it to build the present set the
-// payments interface takes, since payments cannot read the account schema.
-func SourceForIdentityKind(kind string) (Source, bool) {
-	switch kind {
-	case "vk":
-		return SourceVK, true
-	case "telegram":
-		return SourceTelegram, true
-	case "email":
-		return SourceDirect, true
-	default:
-		return "", false
-	}
-}
-
-// PresentSources maps an account's identity kinds to the payments sources they make available
-// (§6), de-duplicated: vk→vk, telegram→telegram, email→direct; a robot or unknown kind maps to
-// nothing. Callers pass the kinds from account.Identities so the gate — which holds no
-// cross-schema identity knowledge — can resolve which segments are awake.
-func PresentSources(kinds []string) []Source {
-	var out []Source
-	for _, k := range kinds {
-		if s, ok := SourceForIdentityKind(k); ok && !has(out, s) {
-			out = append(out, s)
-		}
-	}
-	return out
-}
-
-// Context is the trusted execution context the store-compliance gate keys on: the platform
-// Kind (the source the wrapper enforces) plus, for VK, the trusted Subtype (only the VK-iOS
-// freeze depends on it). The zero Context (empty Kind) is an untrusted platform — the gate is
-// fail-closed there: no spend, no purchase, no foreign-origin benefit, view only.
-type Context struct {
-	Kind    Source
-	Subtype string
-}
-
-// NewContext builds a Context from the session platform's kind and subtype strings (as carried
-// on the trusted X-Platform signal). An unrecognised or empty kind yields an untrusted Context.
-func NewContext(kind, subtype string) Context {
-	k := Source(kind)
-	if !k.Valid() {
-		return Context{}
-	}
-	return Context{Kind: k, Subtype: subtype}
-}
-
-// Trusted reports whether the platform is trusted (a known kind). An untrusted context denies
-// every spend/purchase and the application of any foreign origin.
-func (c Context) Trusted() bool { return c.Kind.Valid() }
-
-// vkFrozen reports whether this is the VK-iOS spend freeze: VK context on the trusted iOS
-// subtype. A previously bought benefit still applies there, but no spend or purchase is possible.
-func (c Context) vkFrozen() bool { return c.Kind == SourceVK && c.Subtype == SubtypeIOS }
-
-// spendPriority is the fixed draw order when several segments are spendable in one context
-// (D7): the "home" direct segment first, the store-funded segments after.
-var spendPriority = []Source{SourceDirect, SourceVK, SourceTelegram}
-
-// has reports whether present contains s.
-func has(present []Source, s Source) bool {
-	return slices.Contains(present, s)
-}
-
-// spendableSources returns the chip segments that may be SPENT in the context, in draw-priority
-// order, restricted to the sources the account actually has (present). It is empty when the
-// platform is untrusted (fail-closed) or VK-iOS (frozen): inside VK/TG only the same-named
-// segment is spendable; on web/native all attached segments are, drained direct→vk→tg.
-func spendableSources(c Context, present []Source) []Source {
-	if !c.Trusted() || c.vkFrozen() {
-		return nil
-	}
-	switch c.Kind {
-	case SourceVK, SourceTelegram:
-		if has(present, c.Kind) {
-			return []Source{c.Kind}
-		}
-		return nil
-	default: // direct (web/native)
-		var out []Source
-		for _, s := range spendPriority {
-			if has(present, s) {
-				out = append(out, s)
-			}
-		}
-		return out
-	}
-}
-
-// applicableOrigins returns the benefit origins that APPLY in the context, in draw-priority
-// order, restricted to present sources. It differs from spendableSources in one way: VK-iOS is
-// NOT excluded — a benefit bought earlier still applies while spending is frozen. Inside VK/TG
-// only the same-named origin applies (a foreign, e.g. direct, origin never activates inside a
-// store — the compliance wall); on web/native direct+vk+tg all apply, drained direct→vk→tg.
-func applicableOrigins(c Context, present []Source) []Source {
-	if !c.Trusted() {
-		return nil
-	}
-	switch c.Kind {
-	case SourceVK, SourceTelegram:
-		if has(present, c.Kind) {
-			return []Source{c.Kind}
-		}
-		return nil
-	default: // direct (web/native)
-		var out []Source
-		for _, s := range spendPriority {
-			if has(present, s) {
-				out = append(out, s)
-			}
-		}
-		return out
-	}
-}
-
-// visibleSources returns the segments the wallet shows in the context, regardless of whether
-// they are spendable: inside a store only the same-named segment (the others are invisible
-// there); on web/native or an untrusted context all three (untrusted shows them view-only).
-func visibleSources(c Context) []Source {
-	switch c.Kind {
-	case SourceVK, SourceTelegram:
-		return []Source{c.Kind}
-	default:
-		return spendPriority
-	}
-}
-
-// Segment is one chip balance the wallet shows: the source, its chip count, and whether it can
-// be spent in the current context (false for a frozen VK-iOS balance or an untrusted platform).
-type Segment struct {
-	Source    Source
-	Chips     int
-	Spendable bool
-}
-
-// BenefitView is the benefit state applicable in the current context: whether ads are off (and
-// until when, or forever) and how many hints are available. It aggregates over the origins
-// applicable in the context (§5).
-type BenefitView struct {
-	AdsForever   bool
-	AdsPaidUntil *time.Time
-	Hints        int
-}
-
-// WalletView is the read model returned to the wallet: the visible segments plus the
-// context-applicable benefits.
-type WalletView struct {
-	Segments []Segment
-	Benefits BenefitView
-}
-
-// benefitDelta is the benefit change a spend or grant applies to one origin: hints added, a
-// no-ads term in whole days (stacked from max(now, current end)), and the perpetual forever
-// flag (which overrides terms).
-type benefitDelta struct {
-	hintsAdd  int
-	noAdsDays int
-	forever   bool
-}
-
-// zero reports whether the delta changes nothing.
-func (d benefitDelta) zero() bool { return d.hintsAdd == 0 && d.noAdsDays == 0 && !d.forever }

backend/internal/payments/gate_test.go

@@ -1,132 +0,0 @@
-package payments
-
-import (
-	"slices"
-	"testing"
-)
-
-// allPresent is an account attached to every source (the maximal present set).
-var allPresent = []Source{SourceDirect, SourceVK, SourceTelegram}
-
-func TestSpendableSources(t *testing.T) {
-	tests := []struct {
-		name    string
-		ctx     Context
-		present []Source
-		want    []Source
-	}{
-		{"vk android, vk present", Context{Kind: SourceVK, Subtype: "android"}, allPresent, []Source{SourceVK}},
-		{"vk ios frozen", Context{Kind: SourceVK, Subtype: SubtypeIOS}, allPresent, nil},
-		{"vk android, vk absent", Context{Kind: SourceVK, Subtype: "android"}, []Source{SourceDirect}, nil},
-		{"telegram", Context{Kind: SourceTelegram, Subtype: "web"}, allPresent, []Source{SourceTelegram}},
-		{"telegram, tg absent", Context{Kind: SourceTelegram}, []Source{SourceVK}, nil},
-		{"direct all present, priority", Context{Kind: SourceDirect, Subtype: "web"}, allPresent, []Source{SourceDirect, SourceVK, SourceTelegram}},
-		{"direct, only vk+tg attached", Context{Kind: SourceDirect}, []Source{SourceTelegram, SourceVK}, []Source{SourceVK, SourceTelegram}},
-		{"direct, nothing attached", Context{Kind: SourceDirect}, nil, nil},
-		{"untrusted fail-closed", Context{}, allPresent, nil},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := spendableSources(tc.ctx, tc.present); !slices.Equal(got, tc.want) {
-				t.Errorf("spendableSources(%+v, %v) = %v, want %v", tc.ctx, tc.present, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestApplicableOrigins(t *testing.T) {
-	tests := []struct {
-		name    string
-		ctx     Context
-		present []Source
-		want    []Source
-	}{
-		// A benefit still APPLIES on VK-iOS while spending is frozen.
-		{"vk ios still applies", Context{Kind: SourceVK, Subtype: SubtypeIOS}, allPresent, []Source{SourceVK}},
-		{"vk android", Context{Kind: SourceVK, Subtype: "android"}, allPresent, []Source{SourceVK}},
-		{"telegram", Context{Kind: SourceTelegram}, allPresent, []Source{SourceTelegram}},
-		{"direct all, priority", Context{Kind: SourceDirect}, allPresent, []Source{SourceDirect, SourceVK, SourceTelegram}},
-		{"untrusted fail-closed", Context{}, allPresent, nil},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := applicableOrigins(tc.ctx, tc.present); !slices.Equal(got, tc.want) {
-				t.Errorf("applicableOrigins(%+v, %v) = %v, want %v", tc.ctx, tc.present, got, tc.want)
-			}
-		})
-	}
-}
-
-// TestComplianceWall is the named unit-level compliance regression: a direct origin (externally
-// paid, outside any store cash desk) must NEVER be applicable inside a VK or TG wrapper, and no
-// segment is ever spendable there beyond the same-named one. The dangerous direction stays shut.
-func TestComplianceWall(t *testing.T) {
-	for _, kind := range []Source{SourceVK, SourceTelegram} {
-		for _, sub := range []string{"android", "ios", "web"} {
-			ctx := Context{Kind: kind, Subtype: sub}
-			if slices.Contains(applicableOrigins(ctx, allPresent), SourceDirect) {
-				t.Errorf("direct origin applies inside %s/%s — compliance wall breached", kind, sub)
-			}
-			for _, s := range spendableSources(ctx, allPresent) {
-				if s != kind {
-					t.Errorf("foreign segment %s spendable inside %s/%s", s, kind, sub)
-				}
-			}
-			// The opposite store's origin must not leak in either (vk⊥tg).
-			other := SourceVK
-			if kind == SourceVK {
-				other = SourceTelegram
-			}
-			if slices.Contains(applicableOrigins(ctx, allPresent), other) {
-				t.Errorf("%s origin applies inside %s — cross-store leak", other, kind)
-			}
-		}
-	}
-}
-
-func TestVisibleSources(t *testing.T) {
-	if got := visibleSources(Context{Kind: SourceVK, Subtype: SubtypeIOS}); !slices.Equal(got, []Source{SourceVK}) {
-		t.Errorf("VK visible = %v, want [vk] (direct/tg hidden in a store)", got)
-	}
-	if got := visibleSources(Context{Kind: SourceDirect}); !slices.Equal(got, allPresent) {
-		t.Errorf("direct visible = %v, want all three", got)
-	}
-	if got := visibleSources(Context{}); !slices.Equal(got, allPresent) {
-		t.Errorf("untrusted visible = %v, want all three (view-only)", got)
-	}
-}
-
-func TestSourceForIdentityKind(t *testing.T) {
-	tests := []struct {
-		kind string
-		want Source
-		ok   bool
-	}{
-		{"vk", SourceVK, true},
-		{"telegram", SourceTelegram, true},
-		{"email", SourceDirect, true},
-		{"robot", "", false},
-		{"unknown", "", false},
-	}
-	for _, tc := range tests {
-		got, ok := SourceForIdentityKind(tc.kind)
-		if got != tc.want || ok != tc.ok {
-			t.Errorf("SourceForIdentityKind(%q) = %q,%v want %q,%v", tc.kind, got, ok, tc.want, tc.ok)
-		}
-	}
-}
-
-func TestNewContextTrusted(t *testing.T) {
-	if c := NewContext("vk", "ios"); !c.Trusted() || !c.vkFrozen() {
-		t.Errorf("vk/ios: trusted=%v frozen=%v, want true/true", c.Trusted(), c.vkFrozen())
-	}
-	if c := NewContext("bogus", "web"); c.Trusted() {
-		t.Errorf("bogus kind should be untrusted")
-	}
-	if c := NewContext("", ""); c.Trusted() {
-		t.Errorf("empty kind should be untrusted")
-	}
-	if c := NewContext("direct", "web"); c.vkFrozen() {
-		t.Errorf("direct is never frozen")
-	}
-}

backend/internal/payments/money_test.go

@@ -1,136 +0,0 @@
-package payments
-
-import "testing"
-
-func TestMoneyFromMinor(t *testing.T) {
-	m, err := MoneyFromMinor(14950, CurrencyRUB)
-	if err != nil {
-		t.Fatalf("MoneyFromMinor: %v", err)
-	}
-	if m.Minor() != 14950 || m.Currency() != CurrencyRUB {
-		t.Fatalf("got minor=%d currency=%s", m.Minor(), m.Currency())
-	}
-	if _, err := MoneyFromMinor(1, Currency("EUR")); err == nil {
-		t.Fatal("expected an error for an unknown currency")
-	}
-}
-
-func TestMoneyFromMajor(t *testing.T) {
-	cases := []struct {
-		major int64
-		cur   Currency
-		minor int64
-	}{
-		{149, CurrencyRUB, 14900}, // roubles scale to kopecks
-		{250, CurrencyStar, 250},  // Stars are whole units
-		{7, CurrencyVote, 7},
-		{50, CurrencyChip, 50},
-	}
-	for _, c := range cases {
-		m, err := MoneyFromMajor(c.major, c.cur)
-		if err != nil {
-			t.Fatalf("MoneyFromMajor(%d,%s): %v", c.major, c.cur, err)
-		}
-		if m.Minor() != c.minor {
-			t.Errorf("MoneyFromMajor(%d,%s): minor=%d, want %d", c.major, c.cur, m.Minor(), c.minor)
-		}
-	}
-	if _, err := MoneyFromMajor(1<<62, CurrencyRUB); err == nil {
-		t.Fatal("expected an overflow error")
-	}
-}
-
-func TestParseMoneyExact(t *testing.T) {
-	cases := []struct {
-		text  string
-		cur   Currency
-		minor int64
-	}{
-		{"149.50", CurrencyRUB, 14950},
-		{"149", CurrencyRUB, 14900},
-		{"0.01", CurrencyRUB, 1},
-		{"0.10", CurrencyRUB, 10}, // 0.1 is inexact as a float; big.Rat keeps it exact
-		{"-5.00", CurrencyRUB, -500},
-		{"250", CurrencyStar, 250},
-		{"7", CurrencyVote, 7},
-		{"50", CurrencyChip, 50},
-	}
-	for _, c := range cases {
-		m, err := ParseMoney(c.text, c.cur)
-		if err != nil {
-			t.Fatalf("ParseMoney(%q,%s): %v", c.text, c.cur, err)
-		}
-		if m.Minor() != c.minor {
-			t.Errorf("ParseMoney(%q,%s): minor=%d, want %d", c.text, c.cur, m.Minor(), c.minor)
-		}
-	}
-}
-
-func TestParseMoneyRejectsFraction(t *testing.T) {
-	// A whole-unit currency (Vote/Star/chip) must never accept a fraction, and
-	// the rouble must never accept finer than a kopeck — the no-float gate.
-	bad := []struct {
-		text string
-		cur  Currency
-	}{
-		{"250.5", CurrencyStar},
-		{"1.5", CurrencyChip},
-		{"7.01", CurrencyVote},
-		{"1.999", CurrencyRUB},
-		{"0.001", CurrencyRUB},
-		{"abc", CurrencyRUB},
-		{"12.34", Currency("EUR")}, // unknown currency
-	}
-	for _, c := range bad {
-		if m, err := ParseMoney(c.text, c.cur); err == nil {
-			t.Errorf("ParseMoney(%q,%s) = %d, want an error", c.text, c.cur, m.Minor())
-		}
-	}
-}
-
-func TestMoneyAddCmp(t *testing.T) {
-	a, _ := MoneyFromMinor(14900, CurrencyRUB)
-	b, _ := MoneyFromMinor(50, CurrencyRUB)
-	sum, err := a.Add(b)
-	if err != nil || sum.Minor() != 14950 {
-		t.Fatalf("Add: minor=%d err=%v", sum.Minor(), err)
-	}
-	if c, err := a.Cmp(b); err != nil || c != 1 {
-		t.Fatalf("Cmp a>b: got %d err=%v", c, err)
-	}
-	if c, err := b.Cmp(a); err != nil || c != -1 {
-		t.Fatalf("Cmp b<a: got %d err=%v", c, err)
-	}
-	if c, err := a.Cmp(a); err != nil || c != 0 {
-		t.Fatalf("Cmp a==a: got %d err=%v", c, err)
-	}
-	// Cross-currency arithmetic is refused, not silently coerced.
-	star, _ := MoneyFromMinor(1, CurrencyStar)
-	if _, err := a.Add(star); err == nil {
-		t.Error("Add across currencies: expected an error")
-	}
-	if _, err := a.Cmp(star); err == nil {
-		t.Error("Cmp across currencies: expected an error")
-	}
-}
-
-func TestMoneyString(t *testing.T) {
-	cases := []struct {
-		minor int64
-		cur   Currency
-		want  string
-	}{
-		{14900, CurrencyRUB, "149.00 RUB"},
-		{14950, CurrencyRUB, "149.50 RUB"},
-		{1, CurrencyRUB, "0.01 RUB"},
-		{-500, CurrencyRUB, "-5.00 RUB"},
-		{250, CurrencyStar, "250 XTR"},
-		{5, CurrencyChip, "5 CHIP"},
-	}
-	for _, c := range cases {
-		m, _ := MoneyFromMinor(c.minor, c.cur)
-		if got := m.String(); got != c.want {
-			t.Errorf("Money{%d,%s}.String() = %q, want %q", c.minor, c.cur, got, c.want)
-		}
-	}
-}

backend/internal/payments/payments.go

@@ -1,171 +0,0 @@
-// Package payments is the in-game currency, wallet, benefit and catalog domain.
-//
-// It owns its own Postgres schema (payments) and is the only backend package
-// that issues SQL against it — an import-boundary test forbids any other package
-// from importing the payments jet code, which keeps the domain extractable into
-// its own database or process later. There is no cross-schema foreign key to the
-// account schema: an account id is a plain uuid here, kept referentially honest
-// in code.
-//
-// Money is carried exclusively by [Money] — an exact integer amount in a
-// currency's minor units — so no floating-point value ever reaches a monetary
-// amount, and a whole-unit currency (Vote, Star, chip) can never hold a
-// fraction. This file is the data-foundation layer: the currency value type; the
-// wallet mechanics build on the schema and this package later.
-package payments
-
-import (
-	"fmt"
-	"math/big"
-)
-
-// Currency identifies the unit a monetary amount is denominated in.
-type Currency string
-
-const (
-	// CurrencyRUB is the Russian rouble; its minor unit is the kopeck (1/100).
-	CurrencyRUB Currency = "RUB"
-	// CurrencyVote is the VK Vote — a whole unit with no sub-unit.
-	CurrencyVote Currency = "VOTE"
-	// CurrencyStar is the Telegram Star (XTR) — a whole unit with no sub-unit.
-	CurrencyStar Currency = "XTR"
-	// CurrencyChip is the in-game chip, the unit a value's price is quoted in —
-	// a whole unit with no sub-unit.
-	CurrencyChip Currency = "CHIP"
-)
-
-// minorPerUnit reports how many minor units make one major unit of the currency.
-// Every currency except the rouble is a whole-unit currency (scale 1), so an
-// amount in it structurally cannot carry a fraction.
-func (c Currency) minorPerUnit() int64 {
-	if c == CurrencyRUB {
-		return 100
-	}
-	return 1
-}
-
-// Valid reports whether the currency is one of the known units.
-func (c Currency) Valid() bool {
-	switch c {
-	case CurrencyRUB, CurrencyVote, CurrencyStar, CurrencyChip:
-		return true
-	default:
-		return false
-	}
-}
-
-// Money is an exact monetary amount: a signed integer count of a currency's
-// minor units (rouble kopecks; Vote/Star/chip whole units). It is the sole
-// carrier of money in the payments domain — construction, arithmetic and
-// formatting all go through it, so no float ever reaches an amount and a
-// whole-unit currency can never hold a fraction. The zero value has an empty,
-// invalid currency; build a value with [MoneyFromMinor], [MoneyFromMajor] or
-// [ParseMoney].
-type Money struct {
-	minor    int64
-	currency Currency
-}
-
-// MoneyFromMinor builds a Money from a raw count of the currency's minor units
-// (kopecks for the rouble, whole units otherwise). It errors on an unknown
-// currency.
-func MoneyFromMinor(minor int64, c Currency) (Money, error) {
-	if !c.Valid() {
-		return Money{}, fmt.Errorf("payments: unknown currency %q", c)
-	}
-	return Money{minor: minor, currency: c}, nil
-}
-
-// MoneyFromMajor builds a Money from a whole number of major units (roubles,
-// Votes, Stars, chips). It errors on an unknown currency or on overflow.
-func MoneyFromMajor(major int64, c Currency) (Money, error) {
-	if !c.Valid() {
-		return Money{}, fmt.Errorf("payments: unknown currency %q", c)
-	}
-	scaled := new(big.Int).Mul(big.NewInt(major), big.NewInt(c.minorPerUnit()))
-	if !scaled.IsInt64() {
-		return Money{}, fmt.Errorf("payments: %d %s overflows", major, c)
-	}
-	return Money{minor: scaled.Int64(), currency: c}, nil
-}
-
-// ParseMoney parses a decimal amount (e.g. "149.50", "250") in the currency,
-// exactly and without floating point (via math/big). It rejects a value with
-// finer precision than the currency allows — in particular, any fractional part
-// for a whole-unit currency — which is the gate that keeps a fraction out of an
-// integer currency.
-func ParseMoney(text string, c Currency) (Money, error) {
-	if !c.Valid() {
-		return Money{}, fmt.Errorf("payments: unknown currency %q", c)
-	}
-	r, ok := new(big.Rat).SetString(text)
-	if !ok {
-		return Money{}, fmt.Errorf("payments: %q is not a valid amount", text)
-	}
-	scaled := new(big.Rat).Mul(r, new(big.Rat).SetInt64(c.minorPerUnit()))
-	if !scaled.IsInt() {
-		return Money{}, fmt.Errorf("payments: %q has finer precision than %s allows", text, c)
-	}
-	num := scaled.Num() // the denominator is 1 once scaled to an integer
-	if !num.IsInt64() {
-		return Money{}, fmt.Errorf("payments: %q overflows %s", text, c)
-	}
-	return Money{minor: num.Int64(), currency: c}, nil
-}
-
-// Minor returns the amount as a count of the currency's minor units — the value
-// persisted to an amount column.
-func (m Money) Minor() int64 { return m.minor }
-
-// Currency returns the amount's currency.
-func (m Money) Currency() Currency { return m.currency }
-
-// IsZero reports whether the amount is zero.
-func (m Money) IsZero() bool { return m.minor == 0 }
-
-// Add returns the sum of the two amounts. It errors when the currencies differ.
-func (m Money) Add(o Money) (Money, error) {
-	if m.currency != o.currency {
-		return Money{}, fmt.Errorf("payments: cannot add %s to %s", o.currency, m.currency)
-	}
-	return Money{minor: m.minor + o.minor, currency: m.currency}, nil
-}
-
-// Cmp compares the two amounts, returning -1, 0 or +1. It errors when the
-// currencies differ.
-func (m Money) Cmp(o Money) (int, error) {
-	if m.currency != o.currency {
-		return 0, fmt.Errorf("payments: cannot compare %s to %s", o.currency, m.currency)
-	}
-	switch {
-	case m.minor < o.minor:
-		return -1, nil
-	case m.minor > o.minor:
-		return 1, nil
-	default:
-		return 0, nil
-	}
-}
-
-// String renders the amount as "<value> <currency>", with the currency's
-// fractional digits and no floating point (e.g. "149.50 RUB", "250 XTR").
-func (m Money) String() string {
-	scale := m.currency.minorPerUnit()
-	if scale == 1 {
-		return fmt.Sprintf("%d %s", m.minor, m.currency)
-	}
-	neg := m.minor < 0
-	abs := m.minor
-	if neg {
-		abs = -abs
-	}
-	width := 0
-	for s := scale; s > 1; s /= 10 {
-		width++
-	}
-	sign := ""
-	if neg {
-		sign = "-"
-	}
-	return fmt.Sprintf("%s%d.%0*d %s", sign, abs/scale, width, abs%scale, m.currency)
-}

backend/internal/payments/service.go

@@ -1,246 +0,0 @@
-package payments
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"fmt"
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// Service is the payments domain's application layer — the narrow surface other domains depend
-// on, keeping the schema reachable through one seam. Every read/gate method takes the trusted
-// execution Context and the account's present identity sources (which segments are awake, §6);
-// payments holds no cross-schema identity knowledge, so the caller supplies present. Reads are
-// served from the store's in-process cache, so the steady-state hot path issues no query to the
-// payments schema.
-type Service struct {
-	store *Store
-	clock func() time.Time
-}
-
-// NewService constructs a Service over store with a wall-clock time source.
-func NewService(store *Store) *Service {
-	return &Service{store: store, clock: func() time.Time { return time.Now().UTC() }}
-}
-
-// Ping reports whether the payments schema is reachable.
-func (s *Service) Ping(ctx context.Context) error { return s.store.Ping(ctx) }
-
-// Wallet returns the read model for the account in the execution context: the segments visible
-// there (each with its chip count and whether it is spendable) plus the context-applicable
-// benefits. In a store context only the same-named segment is shown; on web/native or an
-// untrusted platform all attached segments are shown, spendable only when the gate allows.
-func (s *Service) Wallet(ctx context.Context, accountID uuid.UUID, cxt Context, present []Source) (WalletView, error) {
-	st, err := s.store.state(ctx, accountID)
-	if err != nil {
-		return WalletView{}, err
-	}
-	now := s.clock()
-	view := WalletView{Benefits: benefitView(st, cxt, present, now)}
-	spendable := spendableSources(cxt, present)
-	for _, src := range visibleSources(cxt) {
-		if !has(present, src) {
-			continue // only the account's own (attached) segments are shown
-		}
-		view.Segments = append(view.Segments, Segment{
-			Source:    src,
-			Chips:     st.chipsOf(src),
-			Spendable: has(spendable, src),
-		})
-	}
-	return view, nil
-}
-
-// Catalog returns the storefront for the execution context: every chip-priced value (shown in
-// every context) plus the chip packs priced in the context's payment method. It is read straight
-// from the catalog tables — small and rarely edited, so uncached. An untrusted context has no
-// method and so shows values only; buying is gate-checked on Spend regardless (fail-closed).
-func (s *Service) Catalog(ctx context.Context, cxt Context) (CatalogView, error) {
-	entries, err := s.store.loadCatalog(ctx)
-	if err != nil {
-		return CatalogView{}, err
-	}
-	return projectCatalog(entries, cxt), nil
-}
-
-// AdFree reports whether ads are suppressed for the account in the context: some origin
-// applicable there has an active no-ads term or the forever flag. Fail-closed on an untrusted
-// platform (no origin applies).
-func (s *Service) AdFree(ctx context.Context, accountID uuid.UUID, cxt Context, present []Source) (bool, error) {
-	st, err := s.store.state(ctx, accountID)
-	if err != nil {
-		return false, err
-	}
-	now := s.clock()
-	for _, o := range applicableOrigins(cxt, present) {
-		b := st.benefitOf(o)
-		if b.adsForever || (b.adsPaidUntil != nil && b.adsPaidUntil.After(now)) {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-// HintsAvailable returns how many hints the account can use in the context — the sum over the
-// applicable origins. Zero on an untrusted platform.
-func (s *Service) HintsAvailable(ctx context.Context, accountID uuid.UUID, cxt Context, present []Source) (int, error) {
-	st, err := s.store.state(ctx, accountID)
-	if err != nil {
-		return 0, err
-	}
-	total := 0
-	for _, o := range applicableOrigins(cxt, present) {
-		total += st.benefitOf(o).hints
-	}
-	return total, nil
-}
-
-// SpendHint consumes one hint from the first applicable origin that has one (priority
-// direct→vk→tg), returning whether a hint was spent. It spends nothing when no origin is
-// applicable (untrusted platform or no attached segment).
-func (s *Service) SpendHint(ctx context.Context, accountID uuid.UUID, cxt Context, present []Source) (bool, error) {
-	origins := applicableOrigins(cxt, present)
-	if len(origins) == 0 {
-		return false, nil
-	}
-	return s.store.consumeHint(ctx, accountID, origins, s.clock())
-}
-
-// Spend buys a chip-priced value: it gate-checks the context, draws the price across the
-// spendable segments by priority direct→vk→tg, and applies the benefit — atomically. The
-// benefit's origin is the purchase context. It fails closed on an untrusted or frozen platform
-// (ErrUntrusted) and on insufficient chips (ErrInsufficientChips).
-func (s *Service) Spend(ctx context.Context, accountID uuid.UUID, cxt Context, present []Source, productID uuid.UUID) error {
-	spendable := spendableSources(cxt, present)
-	if len(spendable) == 0 {
-		return ErrUntrusted // untrusted, frozen, or no attached segment — no spend
-	}
-	prod, err := s.store.loadProduct(ctx, productID)
-	if err != nil {
-		return err
-	}
-	st, err := s.store.state(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	draws, ok := planDraws(st, spendable, prod.priceChips)
-	if !ok {
-		return ErrInsufficientChips
-	}
-	snapshot, err := marshalSnapshot(prod)
-	if err != nil {
-		return err
-	}
-	return s.store.spend(ctx, accountID, draws, cxt.Kind, productID, prod.delta, snapshot, s.clock())
-}
-
-// Grant applies a benefit to an origin as a zero-price sale — an admin_grant ledger row and the
-// benefit (hints, a no-ads term in whole days, or the forever flag). It never grants chips (no
-// balance is touched — D16), so its signature has no chip amount. The origin is the admin's
-// compliance choice.
-func (s *Service) Grant(ctx context.Context, accountID uuid.UUID, origin Source, hints, noAdsDays int, forever bool) error {
-	if !origin.Valid() {
-		return fmt.Errorf("payments: invalid grant origin %q", origin)
-	}
-	d := benefitDelta{hintsAdd: hints, noAdsDays: noAdsDays, forever: forever}
-	if d.zero() {
-		return fmt.Errorf("payments: empty grant")
-	}
-	snapshot, err := marshalGrant(d)
-	if err != nil {
-		return err
-	}
-	return s.store.grant(ctx, accountID, origin, d, snapshot, s.clock())
-}
-
-// MergeTx merges the secondary account's segments and benefits into the primary inside the
-// caller's transaction (the account-merge flow). The caller invalidates the affected caches
-// after committing (Invalidate).
-func (s *Service) MergeTx(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID) error {
-	return s.store.MergeTx(ctx, tx, primary, secondary, s.clock())
-}
-
-// Invalidate drops the cached state of the listed accounts (called after a merge commit).
-func (s *Service) Invalidate(ids ...uuid.UUID) { s.store.Invalidate(ids...) }
-
-// benefitView aggregates the benefits applicable in the context into the wallet view: ads-off
-// forever if any applicable origin is perpetual, else the latest active term end, plus the total
-// available hints.
-func benefitView(st walletState, cxt Context, present []Source, now time.Time) BenefitView {
-	var v BenefitView
-	for _, o := range applicableOrigins(cxt, present) {
-		b := st.benefitOf(o)
-		if b.adsForever {
-			v.AdsForever = true
-		}
-		if b.adsPaidUntil != nil && b.adsPaidUntil.After(now) {
-			if v.AdsPaidUntil == nil || b.adsPaidUntil.After(*v.AdsPaidUntil) {
-				v.AdsPaidUntil = b.adsPaidUntil
-			}
-		}
-		v.Hints += b.hints
-	}
-	return v
-}
-
-// planDraws greedily allocates price across the spendable segments in priority order, draining
-// each before moving on. It returns the per-segment draws and whether the segments together held
-// enough.
-func planDraws(st walletState, spendable []Source, price int) ([]sourceAmount, bool) {
-	remaining := price
-	var draws []sourceAmount
-	for _, src := range spendable {
-		if remaining <= 0 {
-			break
-		}
-		avail := st.chipsOf(src)
-		if avail <= 0 {
-			continue
-		}
-		take := min(avail, remaining)
-		draws = append(draws, sourceAmount{source: src, amount: take})
-		remaining -= take
-	}
-	if remaining > 0 {
-		return nil, false
-	}
-	return draws, true
-}
-
-// purchaseSnapshot is the catalog snapshot stored on a spend/grant ledger row, so history and
-// receipts stay independent of later catalog edits (§7/D34).
-type purchaseSnapshot struct {
-	ProductID  string         `json:"product_id,omitempty"`
-	Title      string         `json:"title,omitempty"`
-	Atoms      map[string]int `json:"atoms,omitempty"`
-	PriceChips int            `json:"price_chips"`
-	Forever    bool           `json:"forever,omitempty"`
-}
-
-// marshalSnapshot builds the snapshot for a chip spend.
-func marshalSnapshot(p catalogProduct) ([]byte, error) {
-	b, err := json.Marshal(purchaseSnapshot{ProductID: p.id.String(), Title: p.title, Atoms: p.atoms, PriceChips: p.priceChips})
-	if err != nil {
-		return nil, fmt.Errorf("payments: marshal snapshot: %w", err)
-	}
-	return b, nil
-}
-
-// marshalGrant builds the snapshot for an admin grant (price 0).
-func marshalGrant(d benefitDelta) ([]byte, error) {
-	atoms := map[string]int{}
-	if d.hintsAdd > 0 {
-		atoms["hints"] = d.hintsAdd
-	}
-	if d.noAdsDays > 0 {
-		atoms["noads_days"] = d.noAdsDays
-	}
-	b, err := json.Marshal(purchaseSnapshot{Atoms: atoms, PriceChips: 0, Forever: d.forever})
-	if err != nil {
-		return nil, fmt.Errorf("payments: marshal grant snapshot: %w", err)
-	}
-	return b, nil
-}

backend/internal/payments/store.go

@@ -1,40 +0,0 @@
-package payments
-
-import (
-	"context"
-	"database/sql"
-	"fmt"
-
-	"github.com/go-jet/jet/v2/postgres"
-
-	"scrabble/backend/internal/postgres/jet/payments/model"
-	"scrabble/backend/internal/postgres/jet/payments/table"
-)
-
-// Store is the Postgres-backed query surface for the payments schema. It is the
-// only place in the backend that issues SQL against payments.* (an
-// import-boundary test enforces it), so the domain stays extractable into its
-// own database. It fronts the materialized balances/benefits tables with an
-// in-process write-through cache (see cache.go) so hot reads issue no query on
-// the steady-state path.
-type Store struct {
-	db    *sql.DB
-	cache *walletCache
-}
-
-// NewStore constructs a Store wrapping db, with an empty read cache.
-func NewStore(db *sql.DB) *Store { return &Store{db: db, cache: newWalletCache()} }
-
-// Ping verifies the payments schema is reachable by reading the singleton config
-// row. It is the data-foundation health check; the wallet query surface arrives
-// with the currency mechanics.
-func (s *Store) Ping(ctx context.Context) error {
-	var row model.Config
-	if err := postgres.SELECT(table.Config.AllColumns).
-		FROM(table.Config).
-		LIMIT(1).
-		QueryContext(ctx, s.db, &row); err != nil {
-		return fmt.Errorf("payments: ping: %w", err)
-	}
-	return nil
-}

backend/internal/payments/store_catalog.go

@@ -1,89 +0,0 @@
-package payments
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/go-jet/jet/v2/postgres"
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/postgres/jet/payments/model"
-	"scrabble/backend/internal/postgres/jet/payments/table"
-)
-
-// atomQty is one atom line of a product as loaded from the catalog: the atom type and quantity.
-type atomQty struct {
-	atomType string
-	quantity int
-}
-
-// priceRow is one price of a product as loaded from the catalog: the payment method (empty for a
-// value's CHIP price, stored with a NULL method) and the amount in that currency's minor units.
-type priceRow struct {
-	method   string
-	currency Currency
-	amount   int64
-}
-
-// catalogEntry is a raw active product loaded for the storefront: its atom composition and every
-// price row. [projectCatalog] turns it into the context-visible [CatalogProduct].
-type catalogEntry struct {
-	id     uuid.UUID
-	title  string
-	atoms  []atomQty
-	prices []priceRow
-}
-
-// loadCatalog reads every active product with its atoms and prices, ordered by creation, straight
-// from the catalog tables. The catalog is small and rarely edited (admin console only), so it is
-// read uncached — unlike the per-account balances/benefits the read cache fronts.
-func (s *Store) loadCatalog(ctx context.Context) ([]catalogEntry, error) {
-	var prods []model.Product
-	if err := postgres.SELECT(table.Product.AllColumns).
-		FROM(table.Product).
-		WHERE(table.Product.Active.IS_TRUE()).
-		ORDER_BY(table.Product.CreatedAt.ASC()).
-		QueryContext(ctx, s.db, &prods); err != nil {
-		return nil, fmt.Errorf("payments: load catalog products: %w", err)
-	}
-	if len(prods) == 0 {
-		return nil, nil
-	}
-	entries := make([]catalogEntry, len(prods))
-	index := make(map[uuid.UUID]int, len(prods))
-	for i, p := range prods {
-		entries[i] = catalogEntry{id: p.ProductID, title: p.Title}
-		index[p.ProductID] = i
-	}
-
-	var items []model.ProductItem
-	if err := postgres.SELECT(table.ProductItem.AllColumns).
-		FROM(table.ProductItem).
-		QueryContext(ctx, s.db, &items); err != nil {
-		return nil, fmt.Errorf("payments: load catalog items: %w", err)
-	}
-	for _, it := range items {
-		if i, ok := index[it.ProductID]; ok {
-			entries[i].atoms = append(entries[i].atoms, atomQty{atomType: it.AtomType, quantity: int(it.Quantity)})
-		}
-	}
-
-	var prices []model.ProductPrice
-	if err := postgres.SELECT(table.ProductPrice.AllColumns).
-		FROM(table.ProductPrice).
-		QueryContext(ctx, s.db, &prices); err != nil {
-		return nil, fmt.Errorf("payments: load catalog prices: %w", err)
-	}
-	for _, pr := range prices {
-		i, ok := index[pr.ProductID]
-		if !ok {
-			continue // a price for a deactivated product — not in the storefront
-		}
-		method := ""
-		if pr.Method != nil {
-			method = *pr.Method
-		}
-		entries[i].prices = append(entries[i].prices, priceRow{method: method, currency: Currency(pr.Currency), amount: pr.Amount})
-	}
-	return entries, nil
-}

backend/internal/payments/store_wallet.go

@@ -1,421 +0,0 @@
-package payments
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/go-jet/jet/v2/postgres"
-	"github.com/go-jet/jet/v2/qrm"
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/postgres/jet/payments/model"
-	"scrabble/backend/internal/postgres/jet/payments/table"
-)
-
-// Domain errors surfaced by the payments store and service.
-var (
-	// ErrInsufficientChips means the spendable segments held fewer chips than the price.
-	ErrInsufficientChips = errors.New("payments: insufficient chips")
-	// ErrUntrusted means the platform context is untrusted, so the gate is fail-closed.
-	ErrUntrusted = errors.New("payments: untrusted platform")
-	// ErrProductNotFound means the product is absent or deactivated.
-	ErrProductNotFound = errors.New("payments: product not found")
-	// ErrNotAValue means the product has no chip price (it is a chip pack or unpriced), so it
-	// cannot be bought with chips.
-	ErrNotAValue = errors.New("payments: product is not a chip-priced value")
-)
-
-// withTx runs fn inside a transaction on db, rolling back on error or panic.
-func withTx(ctx context.Context, db *sql.DB, fn func(*sql.Tx) error) (err error) {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("payments: begin tx: %w", err)
-	}
-	defer func() {
-		if p := recover(); p != nil {
-			_ = tx.Rollback()
-			panic(p)
-		}
-	}()
-	if err := fn(tx); err != nil {
-		_ = tx.Rollback()
-		return err
-	}
-	if err := tx.Commit(); err != nil {
-		return fmt.Errorf("payments: commit tx: %w", err)
-	}
-	return nil
-}
-
-// sourceAmount is one chip draw from a single segment during a spend.
-type sourceAmount struct {
-	source Source
-	amount int
-}
-
-// catalogProduct is a product resolved for a chip spend: its chip price, the benefit its atoms
-// fold into, and the raw atom composition for the purchase snapshot.
-type catalogProduct struct {
-	id         uuid.UUID
-	title      string
-	priceChips int
-	delta      benefitDelta
-	atoms      map[string]int
-}
-
-// loadState reads an account's balances and benefits straight from the materialized tables.
-func (s *Store) loadState(ctx context.Context, accountID uuid.UUID) (walletState, error) {
-	st := walletState{chips: map[Source]int{}, benefits: map[Source]benefitState{}}
-	var brows []model.Balances
-	if err := postgres.SELECT(table.Balances.AllColumns).
-		FROM(table.Balances).
-		WHERE(table.Balances.AccountID.EQ(postgres.UUID(accountID))).
-		QueryContext(ctx, s.db, &brows); err != nil {
-		return walletState{}, fmt.Errorf("payments: load balances %s: %w", accountID, err)
-	}
-	for _, r := range brows {
-		st.chips[Source(r.Source)] = int(r.Chips)
-	}
-	var frows []model.Benefits
-	if err := postgres.SELECT(table.Benefits.AllColumns).
-		FROM(table.Benefits).
-		WHERE(table.Benefits.AccountID.EQ(postgres.UUID(accountID))).
-		QueryContext(ctx, s.db, &frows); err != nil {
-		return walletState{}, fmt.Errorf("payments: load benefits %s: %w", accountID, err)
-	}
-	for _, r := range frows {
-		st.benefits[Source(r.Origin)] = benefitState{adsPaidUntil: r.AdsPaidUntil, adsForever: r.AdsForever, hints: int(r.Hints)}
-	}
-	return st, nil
-}
-
-// state returns an account's payments state, served from the read cache when warm, otherwise
-// loaded from the materialized tables and cached. The returned maps are read-only.
-func (s *Store) state(ctx context.Context, accountID uuid.UUID) (walletState, error) {
-	if st, ok := s.cache.get(accountID); ok {
-		return st, nil
-	}
-	st, err := s.loadState(ctx, accountID)
-	if err != nil {
-		return walletState{}, err
-	}
-	s.cache.put(accountID, st)
-	return st, nil
-}
-
-// Invalidate drops the cached state of every listed account so the next read reloads it. It is
-// called after a committed mutation whose transaction the payments package does not own — the
-// account-merge flow (after its own commit) and, later, external fund/refund intake.
-func (s *Store) Invalidate(ids ...uuid.UUID) {
-	for _, id := range ids {
-		s.cache.invalidate(id)
-	}
-}
-
-// loadProduct resolves a chip-priced value: an active product with a CHIP price row
-// (method NULL) whose atoms are benefits (hints / no-ads days). It rejects a missing or
-// deactivated product (ErrProductNotFound), a product with no chip price (ErrNotAValue), and a
-// product carrying the chips atom (a chip pack is funded, never bought with chips — ErrNotAValue).
-func (s *Store) loadProduct(ctx context.Context, productID uuid.UUID) (catalogProduct, error) {
-	var p model.Product
-	err := postgres.SELECT(table.Product.AllColumns).
-		FROM(table.Product).
-		WHERE(table.Product.ProductID.EQ(postgres.UUID(productID))).
-		LIMIT(1).
-		QueryContext(ctx, s.db, &p)
-	if errors.Is(err, qrm.ErrNoRows) || (err == nil && !p.Active) {
-		return catalogProduct{}, ErrProductNotFound
-	}
-	if err != nil {
-		return catalogProduct{}, fmt.Errorf("payments: load product %s: %w", productID, err)
-	}
-
-	var price model.ProductPrice
-	err = postgres.SELECT(table.ProductPrice.AllColumns).
-		FROM(table.ProductPrice).
-		WHERE(table.ProductPrice.ProductID.EQ(postgres.UUID(productID)).
-			AND(table.ProductPrice.Method.IS_NULL()).
-			AND(table.ProductPrice.Currency.EQ(postgres.String(string(CurrencyChip))))).
-		LIMIT(1).
-		QueryContext(ctx, s.db, &price)
-	if errors.Is(err, qrm.ErrNoRows) {
-		return catalogProduct{}, ErrNotAValue
-	}
-	if err != nil {
-		return catalogProduct{}, fmt.Errorf("payments: load price %s: %w", productID, err)
-	}
-
-	var items []model.ProductItem
-	if err := postgres.SELECT(table.ProductItem.AllColumns).
-		FROM(table.ProductItem).
-		WHERE(table.ProductItem.ProductID.EQ(postgres.UUID(productID))).
-		QueryContext(ctx, s.db, &items); err != nil {
-		return catalogProduct{}, fmt.Errorf("payments: load items %s: %w", productID, err)
-	}
-
-	cp := catalogProduct{id: productID, title: p.Title, priceChips: int(price.Amount), atoms: map[string]int{}}
-	for _, it := range items {
-		cp.atoms[it.AtomType] = int(it.Quantity)
-		switch it.AtomType {
-		case "hints":
-			cp.delta.hintsAdd += int(it.Quantity)
-		case "noads_days":
-			cp.delta.noAdsDays += int(it.Quantity)
-		case "chips":
-			return catalogProduct{}, ErrNotAValue // a value never grants chips
-		}
-	}
-	return cp, nil
-}
-
-// stackNoAds returns the new no-ads term end after adding addDays whole days from
-// max(now, current end) — terms add up, the remainder is never lost (§5/D33). A non-positive
-// addDays leaves the term unchanged; a nil current means no term yet.
-func stackNoAds(current *time.Time, addDays int, now time.Time) *time.Time {
-	if addDays <= 0 {
-		return current
-	}
-	base := now
-	if current != nil && current.After(now) {
-		base = *current
-	}
-	end := base.Add(time.Duration(addDays) * 24 * time.Hour)
-	return &end
-}
-
-// combineNoAds folds secondary's remaining no-ads term onto primary's during a merge: the
-// remaining duration of each is preserved (§6/D15 "terms extend per origin").
-func combineNoAds(primary, secondary *time.Time, now time.Time) *time.Time {
-	if secondary == nil || !secondary.After(now) {
-		return primary
-	}
-	base := now
-	if primary != nil && primary.After(now) {
-		base = *primary
-	}
-	end := base.Add(secondary.Sub(now))
-	return &end
-}
-
-// applyBenefitTx applies a benefit delta to one origin inside tx, stacking the no-ads term,
-// OR-ing the forever flag and adding hints. It ensures the (account, origin) row exists, locks
-// it, then writes the recomputed values — so concurrent applies serialise on the row lock.
-func applyBenefitTx(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, origin Source, d benefitDelta, now time.Time) error {
-	if d.zero() {
-		return nil
-	}
-	if _, err := tx.ExecContext(ctx,
-		`INSERT INTO payments.benefits (account_id, origin) VALUES ($1, $2) ON CONFLICT DO NOTHING`,
-		accountID, string(origin)); err != nil {
-		return fmt.Errorf("payments: ensure benefit row %s: %w", origin, err)
-	}
-	var untilCur *time.Time
-	var foreverCur bool
-	var hintsCur int32
-	if err := tx.QueryRowContext(ctx,
-		`SELECT ads_paid_until, ads_forever, hints FROM payments.benefits
-		 WHERE account_id = $1 AND origin = $2 FOR UPDATE`, accountID, string(origin)).
-		Scan(&untilCur, &foreverCur, &hintsCur); err != nil {
-		return fmt.Errorf("payments: lock benefit %s: %w", origin, err)
-	}
-	if _, err := tx.ExecContext(ctx,
-		`UPDATE payments.benefits SET ads_paid_until = $3, ads_forever = $4, hints = $5, updated_at = now()
-		 WHERE account_id = $1 AND origin = $2`,
-		accountID, string(origin), stackNoAds(untilCur, d.noAdsDays, now), foreverCur || d.forever, int(hintsCur)+d.hintsAdd); err != nil {
-		return fmt.Errorf("payments: apply benefit %s: %w", origin, err)
-	}
-	return nil
-}
-
-// insertLedgerTx appends one append-only ledger row inside tx.
-func insertLedgerTx(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, kind string, source, origin *Source, chipsDelta int, productID *uuid.UUID, snapshot []byte, now time.Time) error {
-	id, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("payments: ledger id: %w", err)
-	}
-	// The snapshot is a bare value, not a postgres.String literal: a jsonb column infers its
-	// type from an untyped parameter (the game-moves payload idiom), whereas a text-typed
-	// literal is rejected against jsonb.
-	var snap any = postgres.NULL
-	if snapshot != nil {
-		snap = string(snapshot)
-	}
-	stmt := table.Ledger.INSERT(
-		table.Ledger.LedgerID, table.Ledger.AccountID, table.Ledger.Kind,
-		table.Ledger.Source, table.Ledger.Origin, table.Ledger.ChipsDelta,
-		table.Ledger.ProductID, table.Ledger.Snapshot, table.Ledger.CreatedAt,
-	).VALUES(
-		id, accountID, kind,
-		sourceOrNull(source), sourceOrNull(origin), int32(chipsDelta),
-		uuidOrNull(productID), snap, now,
-	)
-	if _, err := stmt.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("payments: insert %s ledger: %w", kind, err)
-	}
-	return nil
-}
-
-// spend draws the chips across the given segments, appends a spend ledger row per draw (carrying
-// the purchase snapshot), and applies the benefit — all in one transaction. It fails closed on
-// an insufficient balance (a guarded decrement), rolling everything back.
-func (s *Store) spend(ctx context.Context, accountID uuid.UUID, draws []sourceAmount, origin Source, productID uuid.UUID, d benefitDelta, snapshot []byte, now time.Time) error {
-	err := withTx(ctx, s.db, func(tx *sql.Tx) error {
-		for _, dr := range draws {
-			res, err := table.Balances.
-				UPDATE(table.Balances.Chips, table.Balances.UpdatedAt).
-				SET(table.Balances.Chips.SUB(postgres.Int(int64(dr.amount))), postgres.TimestampzT(now)).
-				WHERE(table.Balances.AccountID.EQ(postgres.UUID(accountID)).
-					AND(table.Balances.Source.EQ(postgres.String(string(dr.source)))).
-					AND(table.Balances.Chips.GT_EQ(postgres.Int(int64(dr.amount))))).
-				ExecContext(ctx, tx)
-			if err != nil {
-				return fmt.Errorf("payments: decrement %s: %w", dr.source, err)
-			}
-			if n, _ := res.RowsAffected(); n == 0 {
-				return ErrInsufficientChips
-			}
-			src := dr.source
-			if err := insertLedgerTx(ctx, tx, accountID, "spend", &src, &origin, -dr.amount, &productID, snapshot, now); err != nil {
-				return err
-			}
-		}
-		return applyBenefitTx(ctx, tx, accountID, origin, d, now)
-	})
-	if err != nil {
-		return err
-	}
-	s.cache.invalidate(accountID)
-	return nil
-}
-
-// grant records an admin_grant ledger row (price 0, no chips) and applies the granted benefit to
-// the chosen origin, in one transaction — a zero-price sale of a value.
-func (s *Store) grant(ctx context.Context, accountID uuid.UUID, origin Source, d benefitDelta, snapshot []byte, now time.Time) error {
-	err := withTx(ctx, s.db, func(tx *sql.Tx) error {
-		if err := insertLedgerTx(ctx, tx, accountID, "admin_grant", nil, &origin, 0, nil, snapshot, now); err != nil {
-			return err
-		}
-		return applyBenefitTx(ctx, tx, accountID, origin, d, now)
-	})
-	if err != nil {
-		return err
-	}
-	s.cache.invalidate(accountID)
-	return nil
-}
-
-// consumeHint decrements one hint from the first applicable origin (in the given priority order)
-// that has one, with a guarded update. It returns whether a hint was spent.
-func (s *Store) consumeHint(ctx context.Context, accountID uuid.UUID, origins []Source, now time.Time) (bool, error) {
-	for _, o := range origins {
-		res, err := table.Benefits.
-			UPDATE(table.Benefits.Hints, table.Benefits.UpdatedAt).
-			SET(table.Benefits.Hints.SUB(postgres.Int(1)), postgres.TimestampzT(now)).
-			WHERE(table.Benefits.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Benefits.Origin.EQ(postgres.String(string(o)))).
-				AND(table.Benefits.Hints.GT(postgres.Int(0)))).
-			ExecContext(ctx, s.db)
-		if err != nil {
-			return false, fmt.Errorf("payments: consume hint %s: %w", o, err)
-		}
-		if n, _ := res.RowsAffected(); n > 0 {
-			s.cache.invalidate(accountID)
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-// MergeTx folds the secondary account's segments and benefits into the primary, by source and by
-// origin, inside the caller's transaction (the account-merge flow): chips sum, no-ads terms
-// extend per origin, forever OR-s, hints add. The secondary's payments rows are removed. The
-// caller invalidates the primary's cache after its own commit (Invalidate). It does not touch
-// the account schema — the JET import boundary stays intact, only the shared connection is used.
-func (s *Store) MergeTx(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID, now time.Time) error {
-	if _, err := tx.ExecContext(ctx,
-		`INSERT INTO payments.balances (account_id, source, chips, updated_at)
-		 SELECT $1, source, chips, now() FROM payments.balances WHERE account_id = $2
-		 ON CONFLICT (account_id, source) DO UPDATE
-		   SET chips = payments.balances.chips + EXCLUDED.chips, updated_at = now()`,
-		primary, secondary); err != nil {
-		return fmt.Errorf("payments: merge balances: %w", err)
-	}
-	if _, err := tx.ExecContext(ctx, `DELETE FROM payments.balances WHERE account_id = $1`, secondary); err != nil {
-		return fmt.Errorf("payments: clear secondary balances: %w", err)
-	}
-
-	rows, err := tx.QueryContext(ctx,
-		`SELECT origin, ads_paid_until, ads_forever, hints FROM payments.benefits WHERE account_id = $1`, secondary)
-	if err != nil {
-		return fmt.Errorf("payments: read secondary benefits: %w", err)
-	}
-	type secBenefit struct {
-		origin  Source
-		until   *time.Time
-		forever bool
-		hints   int
-	}
-	var secs []secBenefit
-	for rows.Next() {
-		var b secBenefit
-		var o string
-		var h int32
-		if err := rows.Scan(&o, &b.until, &b.forever, &h); err != nil {
-			rows.Close()
-			return fmt.Errorf("payments: scan secondary benefit: %w", err)
-		}
-		b.origin, b.hints = Source(o), int(h)
-		secs = append(secs, b)
-	}
-	if err := rows.Err(); err != nil {
-		rows.Close()
-		return fmt.Errorf("payments: iterate secondary benefits: %w", err)
-	}
-	rows.Close()
-
-	for _, b := range secs {
-		if _, err := tx.ExecContext(ctx,
-			`INSERT INTO payments.benefits (account_id, origin) VALUES ($1, $2) ON CONFLICT DO NOTHING`,
-			primary, string(b.origin)); err != nil {
-			return fmt.Errorf("payments: ensure primary benefit %s: %w", b.origin, err)
-		}
-		var untilCur *time.Time
-		var foreverCur bool
-		var hintsCur int32
-		if err := tx.QueryRowContext(ctx,
-			`SELECT ads_paid_until, ads_forever, hints FROM payments.benefits
-			 WHERE account_id = $1 AND origin = $2 FOR UPDATE`, primary, string(b.origin)).
-			Scan(&untilCur, &foreverCur, &hintsCur); err != nil {
-			return fmt.Errorf("payments: lock primary benefit %s: %w", b.origin, err)
-		}
-		if _, err := tx.ExecContext(ctx,
-			`UPDATE payments.benefits SET ads_paid_until = $3, ads_forever = $4, hints = $5, updated_at = now()
-			 WHERE account_id = $1 AND origin = $2`,
-			primary, string(b.origin), combineNoAds(untilCur, b.until, now), foreverCur || b.forever, int(hintsCur)+b.hints); err != nil {
-			return fmt.Errorf("payments: merge benefit %s: %w", b.origin, err)
-		}
-	}
-	if _, err := tx.ExecContext(ctx, `DELETE FROM payments.benefits WHERE account_id = $1`, secondary); err != nil {
-		return fmt.Errorf("payments: clear secondary benefits: %w", err)
-	}
-	return nil
-}
-
-// sourceOrNull renders an optional source as a SQL string or NULL.
-func sourceOrNull(s *Source) postgres.Expression {
-	if s == nil {
-		return postgres.NULL
-	}
-	return postgres.String(string(*s))
-}
-
-// uuidOrNull renders an optional id as a SQL uuid or NULL.
-func uuidOrNull(id *uuid.UUID) postgres.Expression {
-	if id == nil {
-		return postgres.NULL
-	}
-	return postgres.UUID(*id)
-}

backend/internal/payments/wallet_test.go

@@ -1,182 +0,0 @@
-package payments
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// base is a fixed clock instant for the deterministic tests.
-var base = time.Date(2026, 7, 8, 12, 0, 0, 0, time.UTC)
-
-// seededService builds a Service whose read cache already holds st for id, so the read methods
-// resolve without a database (the store's db is nil). The clock is pinned to base.
-func seededService(id uuid.UUID, st walletState) *Service {
-	store := NewStore(nil)
-	store.cache.put(id, st)
-	return &Service{store: store, clock: func() time.Time { return base }}
-}
-
-func TestStackNoAds(t *testing.T) {
-	future := base.Add(48 * time.Hour)
-	past := base.Add(-time.Hour)
-	tests := []struct {
-		name    string
-		current *time.Time
-		addDays int
-		want    *time.Time
-	}{
-		{"fresh term", nil, 3, new(base.Add(72 * time.Hour))},
-		{"stack onto future", new(future), 2, new(future.Add(48 * time.Hour))},
-		{"lapsed term restarts from now", new(past), 1, new(base.Add(24 * time.Hour))},
-		{"zero days unchanged", new(future), 0, new(future)},
-		{"zero days, nil stays nil", nil, 0, nil},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := stackNoAds(tc.current, tc.addDays, base)
-			if (got == nil) != (tc.want == nil) || (got != nil && !got.Equal(*tc.want)) {
-				t.Errorf("stackNoAds = %v, want %v", got, tc.want)
-			}
-		})
-	}
-}
-
-func TestCombineNoAds(t *testing.T) {
-	pFuture := base.Add(24 * time.Hour)
-	sFuture := base.Add(72 * time.Hour) // 3 days remaining
-	// primary future + secondary future: primary end + secondary's remaining (72h).
-	if got := combineNoAds(new(pFuture), new(sFuture), base); !got.Equal(pFuture.Add(72 * time.Hour)) {
-		t.Errorf("combine both future = %v, want %v", got, pFuture.Add(72*time.Hour))
-	}
-	// primary nil + secondary future: now + secondary's remaining.
-	if got := combineNoAds(nil, new(sFuture), base); !got.Equal(base.Add(72 * time.Hour)) {
-		t.Errorf("combine nil primary = %v, want %v", got, base.Add(72*time.Hour))
-	}
-	// secondary lapsed: primary unchanged.
-	if got := combineNoAds(new(pFuture), new(base.Add(-time.Hour)), base); !got.Equal(pFuture) {
-		t.Errorf("combine lapsed secondary = %v, want %v", got, pFuture)
-	}
-	// secondary nil: primary unchanged.
-	if got := combineNoAds(new(pFuture), nil, base); !got.Equal(pFuture) {
-		t.Errorf("combine nil secondary = %v, want %v", got, pFuture)
-	}
-}
-
-func TestPlanDraws(t *testing.T) {
-	st := walletState{chips: map[Source]int{SourceDirect: 30, SourceVK: 50, SourceTelegram: 5}}
-	// price met entirely by the first (direct) segment.
-	if draws, ok := planDraws(st, []Source{SourceDirect, SourceVK}, 20); !ok || len(draws) != 1 || draws[0] != (sourceAmount{SourceDirect, 20}) {
-		t.Errorf("single-segment draw = %v ok=%v", draws, ok)
-	}
-	// price spills from direct into vk by priority.
-	draws, ok := planDraws(st, []Source{SourceDirect, SourceVK, SourceTelegram}, 60)
-	want := []sourceAmount{{SourceDirect, 30}, {SourceVK, 30}}
-	if !ok || len(draws) != 2 || draws[0] != want[0] || draws[1] != want[1] {
-		t.Errorf("priority spill draw = %v ok=%v, want %v", draws, ok, want)
-	}
-	// insufficient total.
-	if _, ok := planDraws(st, []Source{SourceDirect, SourceVK, SourceTelegram}, 200); ok {
-		t.Error("expected insufficient")
-	}
-}
-
-func TestWalletSegments(t *testing.T) {
-	id := uuid.New()
-	st := walletState{chips: map[Source]int{SourceDirect: 100, SourceVK: 50}}
-	svc := seededService(id, st)
-	present := []Source{SourceDirect, SourceVK}
-
-	// Web/native: both attached segments shown, both spendable.
-	got, err := svc.Wallet(context.Background(), id, NewContext("direct", "web"), present)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(got.Segments) != 2 || !got.Segments[0].Spendable || got.Segments[0].Source != SourceDirect {
-		t.Errorf("direct wallet segments = %+v", got.Segments)
-	}
-	// VK Android: only vk shown, spendable.
-	got, _ = svc.Wallet(context.Background(), id, NewContext("vk", "android"), present)
-	if len(got.Segments) != 1 || got.Segments[0].Source != SourceVK || !got.Segments[0].Spendable {
-		t.Errorf("vk-android wallet = %+v", got.Segments)
-	}
-	// VK iOS: only vk shown, frozen (not spendable) but the balance is visible.
-	got, _ = svc.Wallet(context.Background(), id, NewContext("vk", "ios"), present)
-	if len(got.Segments) != 1 || got.Segments[0].Chips != 50 || got.Segments[0].Spendable {
-		t.Errorf("vk-ios wallet = %+v (want vk 50 frozen)", got.Segments)
-	}
-}
-
-func TestAdFreeByContext(t *testing.T) {
-	id := uuid.New()
-	future := base.Add(48 * time.Hour)
-	ctx := context.Background()
-
-	// A vk-origin no-ads term applies inside VK and out on web, but a direct-origin term never
-	// applies inside VK (the compliance wall).
-	svc := seededService(id, walletState{benefits: map[Source]benefitState{
-		SourceVK:     {adsPaidUntil: new(future)},
-		SourceDirect: {adsPaidUntil: new(future)},
-	}})
-	present := []Source{SourceDirect, SourceVK}
-
-	cases := []struct {
-		name string
-		cxt  Context
-		want bool
-	}{
-		{"vk term inside vk", NewContext("vk", "android"), true},
-		{"vk term inside vk-ios (applies while frozen)", NewContext("vk", "ios"), true},
-		{"terms on web", NewContext("direct", "web"), true},
-		{"untrusted fail-closed", NewContext("", ""), false},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := svc.AdFree(ctx, id, tc.cxt, present)
-			if err != nil || got != tc.want {
-				t.Errorf("AdFree = %v (err %v), want %v", got, err, tc.want)
-			}
-		})
-	}
-
-	// Compliance: ONLY a direct-origin term, checked inside VK, must not suppress ads.
-	svc2 := seededService(id, walletState{benefits: map[Source]benefitState{SourceDirect: {adsPaidUntil: new(future)}}})
-	if got, _ := svc2.AdFree(ctx, id, NewContext("vk", "android"), present); got {
-		t.Error("direct-origin no-ads must NOT apply inside VK (compliance wall)")
-	}
-}
-
-func TestHintsAvailableByContext(t *testing.T) {
-	id := uuid.New()
-	svc := seededService(id, walletState{benefits: map[Source]benefitState{
-		SourceDirect: {hints: 3},
-		SourceVK:     {hints: 2},
-	}})
-	present := []Source{SourceDirect, SourceVK}
-	ctx := context.Background()
-
-	// Web: both applicable origins summed.
-	if n, _ := svc.HintsAvailable(ctx, id, NewContext("direct", "web"), present); n != 5 {
-		t.Errorf("web hints = %d, want 5", n)
-	}
-	// VK: only vk-origin hints.
-	if n, _ := svc.HintsAvailable(ctx, id, NewContext("vk", "android"), present); n != 2 {
-		t.Errorf("vk hints = %d, want 2", n)
-	}
-	// Untrusted: none.
-	if n, _ := svc.HintsAvailable(ctx, id, NewContext("", ""), present); n != 0 {
-		t.Errorf("untrusted hints = %d, want 0", n)
-	}
-}
-
-func TestSpendHintUntrustedNoOp(t *testing.T) {
-	id := uuid.New()
-	svc := seededService(id, walletState{benefits: map[Source]benefitState{SourceDirect: {hints: 3}}})
-	// Untrusted context: no applicable origin, so nothing is spent and the DB (nil) is never hit.
-	spent, err := svc.SpendHint(context.Background(), id, NewContext("", ""), []Source{SourceDirect})
-	if err != nil || spent {
-		t.Errorf("untrusted SpendHint = %v (err %v), want false", spent, err)
-	}
-}

backend/internal/postgres/jet/backend/model/accounts.go

@@ -32,8 +32,4 @@ type Accounts struct {
 	MergedAt               *time.Time
 	FlaggedHighRateAt      *time.Time
 	VariantPreferences     pq.StringArray
-	LastLoginAt            *time.Time
-	LastLoginIP            *string
-	DeletedAt              *time.Time
-	DeletedDisplayName     *string
 }

backend/internal/postgres/jet/backend/model/ad_campaigns.go

@@ -22,11 +22,4 @@ type AdCampaigns struct {
 	EndsAt     *time.Time
 	CreatedAt  time.Time
 	UpdatedAt  time.Time
-	OverrideBg       *string
-	OverrideFg       *string
-	OverrideLink     *string
-	OverrideBgDark   *string
-	OverrideFgDark   *string
-	OverrideLinkDark *string
-	Urgent           bool
 }

backend/internal/postgres/jet/backend/model/email_confirmations.go

@@ -21,6 +21,4 @@ type EmailConfirmations struct {
 	Attempts       int16
 	ConsumedAt     *time.Time
 	CreatedAt      time.Time
-	Purpose        string
-	LinkTokenHash  *string
 }

backend/internal/postgres/jet/backend/model/feedback_messages.go

@@ -27,6 +27,4 @@ type FeedbackMessages struct {
 	ReplyReadAt    *time.Time
 	CreatedAt      time.Time
 	Lang           *string
-	AppVersion     *string
-	BrowserTz      *string
 }

backend/internal/postgres/jet/backend/model/retained_identities.go

@@ -1,24 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package model
-
-import (
-	"github.com/google/uuid"
-	"time"
-)
-
-type RetainedIdentities struct {
-	RetainedID uuid.UUID `sql:"primary_key"`
-	AccountID  uuid.UUID
-	Kind       string
-	ExternalID string
-	Confirmed  bool
-	LinkedAt   time.Time
-	DetachedAt time.Time
-	Reason     string
-}

backend/internal/postgres/jet/backend/model/robot_blocks.go

@@ -1,23 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package model
-
-import (
-	"github.com/google/uuid"
-	"time"
-)
-
-type RobotBlocks struct {
-	ID          uuid.UUID `sql:"primary_key"`
-	BlockerID   uuid.UUID
-	GameID      uuid.UUID
-	Seat        int16
-	RobotID     uuid.UUID
-	DisplayName string
-	CreatedAt   time.Time
-}

backend/internal/postgres/jet/backend/model/robot_friend_requests.go

@@ -1,23 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package model
-
-import (
-	"github.com/google/uuid"
-	"time"
-)
-
-type RobotFriendRequests struct {
-	ID          uuid.UUID `sql:"primary_key"`
-	RequesterID uuid.UUID
-	GameID      uuid.UUID
-	Seat        int16
-	RobotID     uuid.UUID
-	DisplayName string
-	CreatedAt   time.Time
-}

backend/internal/postgres/jet/backend/model/sessions.go

@@ -20,6 +20,4 @@ type Sessions struct {
 	CreatedAt  time.Time
 	LastSeenAt *time.Time
 	RevokedAt  *time.Time
-	PlatformKind    *string
-	PlatformSubtype *string
 }

backend/internal/postgres/jet/backend/table/accounts.go

@@ -35,10 +35,6 @@ type accountsTable struct {
 	MergedAt               postgres.ColumnTimestampz
 	FlaggedHighRateAt      postgres.ColumnTimestampz
 	VariantPreferences     postgres.ColumnStringArray
-	LastLoginAt            postgres.ColumnTimestampz
-	LastLoginIP            postgres.ColumnString
-	DeletedAt              postgres.ColumnTimestampz
-	DeletedDisplayName     postgres.ColumnString
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -98,12 +94,8 @@ func newAccountsTableImpl(schemaName, tableName, alias string) accountsTable {
 		MergedAtColumn               = postgres.TimestampzColumn("merged_at")
 		FlaggedHighRateAtColumn      = postgres.TimestampzColumn("flagged_high_rate_at")
 		VariantPreferencesColumn     = postgres.StringArrayColumn("variant_preferences")
-		LastLoginAtColumn            = postgres.TimestampzColumn("last_login_at")
-		LastLoginIPColumn            = postgres.StringColumn("last_login_ip")
-		DeletedAtColumn              = postgres.TimestampzColumn("deleted_at")
-		DeletedDisplayNameColumn     = postgres.StringColumn("deleted_display_name")
-		allColumns                   = postgres.ColumnList{AccountIDColumn, DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, FlaggedHighRateAtColumn, VariantPreferencesColumn, LastLoginAtColumn, LastLoginIPColumn, DeletedAtColumn, DeletedDisplayNameColumn}
-		mutableColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, FlaggedHighRateAtColumn, VariantPreferencesColumn, LastLoginAtColumn, LastLoginIPColumn, DeletedAtColumn, DeletedDisplayNameColumn}
+		allColumns                   = postgres.ColumnList{AccountIDColumn, DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, FlaggedHighRateAtColumn, VariantPreferencesColumn}
+		mutableColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn, FlaggedHighRateAtColumn, VariantPreferencesColumn}
 		defaultColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, VariantPreferencesColumn}
 	)
 
@@ -129,10 +121,6 @@ func newAccountsTableImpl(schemaName, tableName, alias string) accountsTable {
 		MergedAt:               MergedAtColumn,
 		FlaggedHighRateAt:      FlaggedHighRateAtColumn,
 		VariantPreferences:     VariantPreferencesColumn,
-		LastLoginAt:            LastLoginAtColumn,
-		LastLoginIP:            LastLoginIPColumn,
-		DeletedAt:              DeletedAtColumn,
-		DeletedDisplayName:     DeletedDisplayNameColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/jet/backend/table/ad_campaigns.go

@@ -26,13 +26,6 @@ type adCampaignsTable struct {
 	EndsAt     postgres.ColumnTimestampz
 	CreatedAt  postgres.ColumnTimestampz
 	UpdatedAt  postgres.ColumnTimestampz
-	OverrideBg       postgres.ColumnString
-	OverrideFg       postgres.ColumnString
-	OverrideLink     postgres.ColumnString
-	OverrideBgDark   postgres.ColumnString
-	OverrideFgDark   postgres.ColumnString
-	OverrideLinkDark postgres.ColumnString
-	Urgent           postgres.ColumnBool
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -83,16 +76,9 @@ func newAdCampaignsTableImpl(schemaName, tableName, alias string) adCampaignsTab
 		EndsAtColumn     = postgres.TimestampzColumn("ends_at")
 		CreatedAtColumn  = postgres.TimestampzColumn("created_at")
 		UpdatedAtColumn  = postgres.TimestampzColumn("updated_at")
-		OverrideBgColumn       = postgres.StringColumn("override_bg")
-		OverrideFgColumn       = postgres.StringColumn("override_fg")
-		OverrideLinkColumn     = postgres.StringColumn("override_link")
-		OverrideBgDarkColumn   = postgres.StringColumn("override_bg_dark")
-		OverrideFgDarkColumn   = postgres.StringColumn("override_fg_dark")
-		OverrideLinkDarkColumn = postgres.StringColumn("override_link_dark")
-		UrgentColumn           = postgres.BoolColumn("urgent")
-		allColumns             = postgres.ColumnList{CampaignIDColumn, NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn, OverrideBgColumn, OverrideFgColumn, OverrideLinkColumn, OverrideBgDarkColumn, OverrideFgDarkColumn, OverrideLinkDarkColumn, UrgentColumn}
-		mutableColumns         = postgres.ColumnList{NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn, OverrideBgColumn, OverrideFgColumn, OverrideLinkColumn, OverrideBgDarkColumn, OverrideFgDarkColumn, OverrideLinkDarkColumn, UrgentColumn}
-		defaultColumns         = postgres.ColumnList{IsDefaultColumn, EnabledColumn, CreatedAtColumn, UpdatedAtColumn, UrgentColumn}
+		allColumns       = postgres.ColumnList{CampaignIDColumn, NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn}
+		mutableColumns   = postgres.ColumnList{NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn}
+		defaultColumns   = postgres.ColumnList{IsDefaultColumn, EnabledColumn, CreatedAtColumn, UpdatedAtColumn}
 	)
 
 	return adCampaignsTable{
@@ -108,13 +94,6 @@ func newAdCampaignsTableImpl(schemaName, tableName, alias string) adCampaignsTab
 		EndsAt:     EndsAtColumn,
 		CreatedAt:  CreatedAtColumn,
 		UpdatedAt:  UpdatedAtColumn,
-		OverrideBg:       OverrideBgColumn,
-		OverrideFg:       OverrideFgColumn,
-		OverrideLink:     OverrideLinkColumn,
-		OverrideBgDark:   OverrideBgDarkColumn,
-		OverrideFgDark:   OverrideFgDarkColumn,
-		OverrideLinkDark: OverrideLinkDarkColumn,
-		Urgent:           UrgentColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/jet/backend/table/email_confirmations.go

@@ -25,8 +25,6 @@ type emailConfirmationsTable struct {
 	Attempts       postgres.ColumnInteger
 	ConsumedAt     postgres.ColumnTimestampz
 	CreatedAt      postgres.ColumnTimestampz
-	Purpose        postgres.ColumnString
-	LinkTokenHash  postgres.ColumnString
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -76,11 +74,9 @@ func newEmailConfirmationsTableImpl(schemaName, tableName, alias string) emailCo
 		AttemptsColumn       = postgres.IntegerColumn("attempts")
 		ConsumedAtColumn     = postgres.TimestampzColumn("consumed_at")
 		CreatedAtColumn      = postgres.TimestampzColumn("created_at")
-		PurposeColumn        = postgres.StringColumn("purpose")
-		LinkTokenHashColumn  = postgres.StringColumn("link_token_hash")
-		allColumns           = postgres.ColumnList{ConfirmationIDColumn, AccountIDColumn, EmailColumn, CodeHashColumn, ExpiresAtColumn, AttemptsColumn, ConsumedAtColumn, CreatedAtColumn, PurposeColumn, LinkTokenHashColumn}
-		mutableColumns       = postgres.ColumnList{AccountIDColumn, EmailColumn, CodeHashColumn, ExpiresAtColumn, AttemptsColumn, ConsumedAtColumn, CreatedAtColumn, PurposeColumn, LinkTokenHashColumn}
-		defaultColumns       = postgres.ColumnList{AttemptsColumn, CreatedAtColumn, PurposeColumn}
+		allColumns           = postgres.ColumnList{ConfirmationIDColumn, AccountIDColumn, EmailColumn, CodeHashColumn, ExpiresAtColumn, AttemptsColumn, ConsumedAtColumn, CreatedAtColumn}
+		mutableColumns       = postgres.ColumnList{AccountIDColumn, EmailColumn, CodeHashColumn, ExpiresAtColumn, AttemptsColumn, ConsumedAtColumn, CreatedAtColumn}
+		defaultColumns       = postgres.ColumnList{AttemptsColumn, CreatedAtColumn}
 	)
 
 	return emailConfirmationsTable{
@@ -95,8 +91,6 @@ func newEmailConfirmationsTableImpl(schemaName, tableName, alias string) emailCo
 		Attempts:       AttemptsColumn,
 		ConsumedAt:     ConsumedAtColumn,
 		CreatedAt:      CreatedAtColumn,
-		Purpose:        PurposeColumn,
-		LinkTokenHash:  LinkTokenHashColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/jet/backend/table/feedback_messages.go

@@ -31,8 +31,6 @@ type feedbackMessagesTable struct {
 	ReplyReadAt    postgres.ColumnTimestampz
 	CreatedAt      postgres.ColumnTimestampz
 	Lang           postgres.ColumnString
-	AppVersion     postgres.ColumnString
-	BrowserTz      postgres.ColumnString
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -88,10 +86,8 @@ func newFeedbackMessagesTableImpl(schemaName, tableName, alias string) feedbackM
 		ReplyReadAtColumn    = postgres.TimestampzColumn("reply_read_at")
 		CreatedAtColumn      = postgres.TimestampzColumn("created_at")
 		LangColumn           = postgres.StringColumn("lang")
-		AppVersionColumn     = postgres.StringColumn("app_version")
-		BrowserTzColumn      = postgres.StringColumn("browser_tz")
-		allColumns           = postgres.ColumnList{MessageIDColumn, AccountIDColumn, BodyColumn, AttachmentColumn, AttachmentNameColumn, SenderIPColumn, ChannelColumn, ReadAtColumn, ArchivedAtColumn, ReplyBodyColumn, RepliedAtColumn, ReplyReadAtColumn, CreatedAtColumn, LangColumn, AppVersionColumn, BrowserTzColumn}
-		mutableColumns       = postgres.ColumnList{AccountIDColumn, BodyColumn, AttachmentColumn, AttachmentNameColumn, SenderIPColumn, ChannelColumn, ReadAtColumn, ArchivedAtColumn, ReplyBodyColumn, RepliedAtColumn, ReplyReadAtColumn, CreatedAtColumn, LangColumn, AppVersionColumn, BrowserTzColumn}
+		allColumns           = postgres.ColumnList{MessageIDColumn, AccountIDColumn, BodyColumn, AttachmentColumn, AttachmentNameColumn, SenderIPColumn, ChannelColumn, ReadAtColumn, ArchivedAtColumn, ReplyBodyColumn, RepliedAtColumn, ReplyReadAtColumn, CreatedAtColumn, LangColumn}
+		mutableColumns       = postgres.ColumnList{AccountIDColumn, BodyColumn, AttachmentColumn, AttachmentNameColumn, SenderIPColumn, ChannelColumn, ReadAtColumn, ArchivedAtColumn, ReplyBodyColumn, RepliedAtColumn, ReplyReadAtColumn, CreatedAtColumn, LangColumn}
 		defaultColumns       = postgres.ColumnList{CreatedAtColumn}
 	)
 
@@ -113,8 +109,6 @@ func newFeedbackMessagesTableImpl(schemaName, tableName, alias string) feedbackM
 		ReplyReadAt:    ReplyReadAtColumn,
 		CreatedAt:      CreatedAtColumn,
 		Lang:           LangColumn,
-		AppVersion:     AppVersionColumn,
-		BrowserTz:      BrowserTzColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/jet/backend/table/retained_identities.go

@@ -1,99 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package table
-
-import (
-	"github.com/go-jet/jet/v2/postgres"
-)
-
-var RetainedIdentities = newRetainedIdentitiesTable("backend", "retained_identities", "")
-
-type retainedIdentitiesTable struct {
-	postgres.Table
-
-	// Columns
-	RetainedID postgres.ColumnString
-	AccountID  postgres.ColumnString
-	Kind       postgres.ColumnString
-	ExternalID postgres.ColumnString
-	Confirmed  postgres.ColumnBool
-	LinkedAt   postgres.ColumnTimestampz
-	DetachedAt postgres.ColumnTimestampz
-	Reason     postgres.ColumnString
-
-	AllColumns     postgres.ColumnList
-	MutableColumns postgres.ColumnList
-	DefaultColumns postgres.ColumnList
-}
-
-type RetainedIdentitiesTable struct {
-	retainedIdentitiesTable
-
-	EXCLUDED retainedIdentitiesTable
-}
-
-// AS creates new RetainedIdentitiesTable with assigned alias
-func (a RetainedIdentitiesTable) AS(alias string) *RetainedIdentitiesTable {
-	return newRetainedIdentitiesTable(a.SchemaName(), a.TableName(), alias)
-}
-
-// Schema creates new RetainedIdentitiesTable with assigned schema name
-func (a RetainedIdentitiesTable) FromSchema(schemaName string) *RetainedIdentitiesTable {
-	return newRetainedIdentitiesTable(schemaName, a.TableName(), a.Alias())
-}
-
-// WithPrefix creates new RetainedIdentitiesTable with assigned table prefix
-func (a RetainedIdentitiesTable) WithPrefix(prefix string) *RetainedIdentitiesTable {
-	return newRetainedIdentitiesTable(a.SchemaName(), prefix+a.TableName(), a.TableName())
-}
-
-// WithSuffix creates new RetainedIdentitiesTable with assigned table suffix
-func (a RetainedIdentitiesTable) WithSuffix(suffix string) *RetainedIdentitiesTable {
-	return newRetainedIdentitiesTable(a.SchemaName(), a.TableName()+suffix, a.TableName())
-}
-
-func newRetainedIdentitiesTable(schemaName, tableName, alias string) *RetainedIdentitiesTable {
-	return &RetainedIdentitiesTable{
-		retainedIdentitiesTable: newRetainedIdentitiesTableImpl(schemaName, tableName, alias),
-		EXCLUDED:                newRetainedIdentitiesTableImpl("", "excluded", ""),
-	}
-}
-
-func newRetainedIdentitiesTableImpl(schemaName, tableName, alias string) retainedIdentitiesTable {
-	var (
-		RetainedIDColumn = postgres.StringColumn("retained_id")
-		AccountIDColumn  = postgres.StringColumn("account_id")
-		KindColumn       = postgres.StringColumn("kind")
-		ExternalIDColumn = postgres.StringColumn("external_id")
-		ConfirmedColumn  = postgres.BoolColumn("confirmed")
-		LinkedAtColumn   = postgres.TimestampzColumn("linked_at")
-		DetachedAtColumn = postgres.TimestampzColumn("detached_at")
-		ReasonColumn     = postgres.StringColumn("reason")
-		allColumns       = postgres.ColumnList{RetainedIDColumn, AccountIDColumn, KindColumn, ExternalIDColumn, ConfirmedColumn, LinkedAtColumn, DetachedAtColumn, ReasonColumn}
-		mutableColumns   = postgres.ColumnList{AccountIDColumn, KindColumn, ExternalIDColumn, ConfirmedColumn, LinkedAtColumn, DetachedAtColumn, ReasonColumn}
-		defaultColumns   = postgres.ColumnList{ConfirmedColumn, DetachedAtColumn}
-	)
-
-	return retainedIdentitiesTable{
-		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
-
-		//Columns
-		RetainedID: RetainedIDColumn,
-		AccountID:  AccountIDColumn,
-		Kind:       KindColumn,
-		ExternalID: ExternalIDColumn,
-		Confirmed:  ConfirmedColumn,
-		LinkedAt:   LinkedAtColumn,
-		DetachedAt: DetachedAtColumn,
-		Reason:     ReasonColumn,
-
-		AllColumns:     allColumns,
-		MutableColumns: mutableColumns,
-		DefaultColumns: defaultColumns,
-	}
-}

backend/internal/postgres/jet/backend/table/robot_blocks.go

@@ -1,96 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package table
-
-import (
-	"github.com/go-jet/jet/v2/postgres"
-)
-
-var RobotBlocks = newRobotBlocksTable("backend", "robot_blocks", "")
-
-type robotBlocksTable struct {
-	postgres.Table
-
-	// Columns
-	ID          postgres.ColumnString
-	BlockerID   postgres.ColumnString
-	GameID      postgres.ColumnString
-	Seat        postgres.ColumnInteger
-	RobotID     postgres.ColumnString
-	DisplayName postgres.ColumnString
-	CreatedAt   postgres.ColumnTimestampz
-
-	AllColumns     postgres.ColumnList
-	MutableColumns postgres.ColumnList
-	DefaultColumns postgres.ColumnList
-}
-
-type RobotBlocksTable struct {
-	robotBlocksTable
-
-	EXCLUDED robotBlocksTable
-}
-
-// AS creates new RobotBlocksTable with assigned alias
-func (a RobotBlocksTable) AS(alias string) *RobotBlocksTable {
-	return newRobotBlocksTable(a.SchemaName(), a.TableName(), alias)
-}
-
-// Schema creates new RobotBlocksTable with assigned schema name
-func (a RobotBlocksTable) FromSchema(schemaName string) *RobotBlocksTable {
-	return newRobotBlocksTable(schemaName, a.TableName(), a.Alias())
-}
-
-// WithPrefix creates new RobotBlocksTable with assigned table prefix
-func (a RobotBlocksTable) WithPrefix(prefix string) *RobotBlocksTable {
-	return newRobotBlocksTable(a.SchemaName(), prefix+a.TableName(), a.TableName())
-}
-
-// WithSuffix creates new RobotBlocksTable with assigned table suffix
-func (a RobotBlocksTable) WithSuffix(suffix string) *RobotBlocksTable {
-	return newRobotBlocksTable(a.SchemaName(), a.TableName()+suffix, a.TableName())
-}
-
-func newRobotBlocksTable(schemaName, tableName, alias string) *RobotBlocksTable {
-	return &RobotBlocksTable{
-		robotBlocksTable: newRobotBlocksTableImpl(schemaName, tableName, alias),
-		EXCLUDED:         newRobotBlocksTableImpl("", "excluded", ""),
-	}
-}
-
-func newRobotBlocksTableImpl(schemaName, tableName, alias string) robotBlocksTable {
-	var (
-		IDColumn          = postgres.StringColumn("id")
-		BlockerIDColumn   = postgres.StringColumn("blocker_id")
-		GameIDColumn      = postgres.StringColumn("game_id")
-		SeatColumn        = postgres.IntegerColumn("seat")
-		RobotIDColumn     = postgres.StringColumn("robot_id")
-		DisplayNameColumn = postgres.StringColumn("display_name")
-		CreatedAtColumn   = postgres.TimestampzColumn("created_at")
-		allColumns        = postgres.ColumnList{IDColumn, BlockerIDColumn, GameIDColumn, SeatColumn, RobotIDColumn, DisplayNameColumn, CreatedAtColumn}
-		mutableColumns    = postgres.ColumnList{BlockerIDColumn, GameIDColumn, SeatColumn, RobotIDColumn, DisplayNameColumn, CreatedAtColumn}
-		defaultColumns    = postgres.ColumnList{CreatedAtColumn}
-	)
-
-	return robotBlocksTable{
-		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
-
-		//Columns
-		ID:          IDColumn,
-		BlockerID:   BlockerIDColumn,
-		GameID:      GameIDColumn,
-		Seat:        SeatColumn,
-		RobotID:     RobotIDColumn,
-		DisplayName: DisplayNameColumn,
-		CreatedAt:   CreatedAtColumn,
-
-		AllColumns:     allColumns,
-		MutableColumns: mutableColumns,
-		DefaultColumns: defaultColumns,
-	}
-}

backend/internal/postgres/jet/backend/table/robot_friend_requests.go

@@ -1,96 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package table
-
-import (
-	"github.com/go-jet/jet/v2/postgres"
-)
-
-var RobotFriendRequests = newRobotFriendRequestsTable("backend", "robot_friend_requests", "")
-
-type robotFriendRequestsTable struct {
-	postgres.Table
-
-	// Columns
-	ID          postgres.ColumnString
-	RequesterID postgres.ColumnString
-	GameID      postgres.ColumnString
-	Seat        postgres.ColumnInteger
-	RobotID     postgres.ColumnString
-	DisplayName postgres.ColumnString
-	CreatedAt   postgres.ColumnTimestampz
-
-	AllColumns     postgres.ColumnList
-	MutableColumns postgres.ColumnList
-	DefaultColumns postgres.ColumnList
-}
-
-type RobotFriendRequestsTable struct {
-	robotFriendRequestsTable
-
-	EXCLUDED robotFriendRequestsTable
-}
-
-// AS creates new RobotFriendRequestsTable with assigned alias
-func (a RobotFriendRequestsTable) AS(alias string) *RobotFriendRequestsTable {
-	return newRobotFriendRequestsTable(a.SchemaName(), a.TableName(), alias)
-}
-
-// Schema creates new RobotFriendRequestsTable with assigned schema name
-func (a RobotFriendRequestsTable) FromSchema(schemaName string) *RobotFriendRequestsTable {
-	return newRobotFriendRequestsTable(schemaName, a.TableName(), a.Alias())
-}
-
-// WithPrefix creates new RobotFriendRequestsTable with assigned table prefix
-func (a RobotFriendRequestsTable) WithPrefix(prefix string) *RobotFriendRequestsTable {
-	return newRobotFriendRequestsTable(a.SchemaName(), prefix+a.TableName(), a.TableName())
-}
-
-// WithSuffix creates new RobotFriendRequestsTable with assigned table suffix
-func (a RobotFriendRequestsTable) WithSuffix(suffix string) *RobotFriendRequestsTable {
-	return newRobotFriendRequestsTable(a.SchemaName(), a.TableName()+suffix, a.TableName())
-}
-
-func newRobotFriendRequestsTable(schemaName, tableName, alias string) *RobotFriendRequestsTable {
-	return &RobotFriendRequestsTable{
-		robotFriendRequestsTable: newRobotFriendRequestsTableImpl(schemaName, tableName, alias),
-		EXCLUDED:                 newRobotFriendRequestsTableImpl("", "excluded", ""),
-	}
-}
-
-func newRobotFriendRequestsTableImpl(schemaName, tableName, alias string) robotFriendRequestsTable {
-	var (
-		IDColumn          = postgres.StringColumn("id")
-		RequesterIDColumn = postgres.StringColumn("requester_id")
-		GameIDColumn      = postgres.StringColumn("game_id")
-		SeatColumn        = postgres.IntegerColumn("seat")
-		RobotIDColumn     = postgres.StringColumn("robot_id")
-		DisplayNameColumn = postgres.StringColumn("display_name")
-		CreatedAtColumn   = postgres.TimestampzColumn("created_at")
-		allColumns        = postgres.ColumnList{IDColumn, RequesterIDColumn, GameIDColumn, SeatColumn, RobotIDColumn, DisplayNameColumn, CreatedAtColumn}
-		mutableColumns    = postgres.ColumnList{RequesterIDColumn, GameIDColumn, SeatColumn, RobotIDColumn, DisplayNameColumn, CreatedAtColumn}
-		defaultColumns    = postgres.ColumnList{CreatedAtColumn}
-	)
-
-	return robotFriendRequestsTable{
-		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
-
-		//Columns
-		ID:          IDColumn,
-		RequesterID: RequesterIDColumn,
-		GameID:      GameIDColumn,
-		Seat:        SeatColumn,
-		RobotID:     RobotIDColumn,
-		DisplayName: DisplayNameColumn,
-		CreatedAt:   CreatedAtColumn,
-
-		AllColumns:     allColumns,
-		MutableColumns: mutableColumns,
-		DefaultColumns: defaultColumns,
-	}
-}

backend/internal/postgres/jet/backend/table/sessions.go

@@ -24,8 +24,6 @@ type sessionsTable struct {
 	CreatedAt  postgres.ColumnTimestampz
 	LastSeenAt postgres.ColumnTimestampz
 	RevokedAt  postgres.ColumnTimestampz
-	PlatformKind    postgres.ColumnString
-	PlatformSubtype postgres.ColumnString
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -74,10 +72,8 @@ func newSessionsTableImpl(schemaName, tableName, alias string) sessionsTable {
 		CreatedAtColumn  = postgres.TimestampzColumn("created_at")
 		LastSeenAtColumn = postgres.TimestampzColumn("last_seen_at")
 		RevokedAtColumn  = postgres.TimestampzColumn("revoked_at")
-		PlatformKindColumn    = postgres.StringColumn("platform_kind")
-		PlatformSubtypeColumn = postgres.StringColumn("platform_subtype")
-		allColumns            = postgres.ColumnList{SessionIDColumn, AccountIDColumn, TokenHashColumn, StatusColumn, CreatedAtColumn, LastSeenAtColumn, RevokedAtColumn, PlatformKindColumn, PlatformSubtypeColumn}
-		mutableColumns        = postgres.ColumnList{AccountIDColumn, TokenHashColumn, StatusColumn, CreatedAtColumn, LastSeenAtColumn, RevokedAtColumn, PlatformKindColumn, PlatformSubtypeColumn}
+		allColumns       = postgres.ColumnList{SessionIDColumn, AccountIDColumn, TokenHashColumn, StatusColumn, CreatedAtColumn, LastSeenAtColumn, RevokedAtColumn}
+		mutableColumns   = postgres.ColumnList{AccountIDColumn, TokenHashColumn, StatusColumn, CreatedAtColumn, LastSeenAtColumn, RevokedAtColumn}
 		defaultColumns   = postgres.ColumnList{StatusColumn, CreatedAtColumn}
 	)
 
@@ -92,8 +88,6 @@ func newSessionsTableImpl(schemaName, tableName, alias string) sessionsTable {
 		CreatedAt:  CreatedAtColumn,
 		LastSeenAt: LastSeenAtColumn,
 		RevokedAt:  RevokedAtColumn,
-		PlatformKind:    PlatformKindColumn,
-		PlatformSubtype: PlatformSubtypeColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/jet/backend/table/table_use_schema.go

@@ -10,7 +10,6 @@ package table
 // UseSchema sets a new schema name for all generated table SQL builder types. It is recommended to invoke
 // this method only once at the beginning of the program.
 func UseSchema(schema string) {
-	AccountBestMove = AccountBestMove.FromSchema(schema)
 	AccountRoles = AccountRoles.FromSchema(schema)
 	AccountStats = AccountStats.FromSchema(schema)
 	AccountSuspensions = AccountSuspensions.FromSchema(schema)
@@ -35,9 +34,6 @@ func UseSchema(schema string) {
 	GameSetupDraws = GameSetupDraws.FromSchema(schema)
 	Games = Games.FromSchema(schema)
 	Identities = Identities.FromSchema(schema)
-	RetainedIdentities = RetainedIdentities.FromSchema(schema)
-	RobotBlocks = RobotBlocks.FromSchema(schema)
-	RobotFriendRequests = RobotFriendRequests.FromSchema(schema)
 	Sessions = Sessions.FromSchema(schema)
 	SuspensionReasons = SuspensionReasons.FromSchema(schema)
 }

backend/internal/postgres/jet/payments/model/balances.go

@@ -1,20 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package model
-
-import (
-	"github.com/google/uuid"
-	"time"
-)
-
-type Balances struct {
-	AccountID uuid.UUID `sql:"primary_key"`
-	Source    string    `sql:"primary_key"`
-	Chips     int32
-	UpdatedAt time.Time
-}

backend/internal/postgres/jet/payments/model/benefits.go

@@ -1,22 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package model
-
-import (
-	"github.com/google/uuid"
-	"time"
-)
-
-type Benefits struct {
-	AccountID    uuid.UUID `sql:"primary_key"`
-	Origin       string    `sql:"primary_key"`
-	AdsPaidUntil *time.Time
-	AdsForever   bool
-	Hints        int32
-	UpdatedAt    time.Time
-}

backend/internal/postgres/jet/payments/model/catalog_atom.go

@@ -1,12 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package model
-
-type CatalogAtom struct {
-	AtomType string `sql:"primary_key"`
-}

backend/internal/postgres/jet/payments/model/config.go

@@ -1,17 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package model
-
-type Config struct {
-	OnlyRow               bool `sql:"primary_key"`
-	RewardedPayoutChips   int32
-	CooldownGlobalSeconds int32
-	CooldownVsAiSeconds   int32
-	CooldownHintSeconds   int32
-	OrderTTLSeconds       int32
-}

backend/internal/postgres/jet/payments/model/ledger.go

@@ -1,28 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package model
-
-import (
-	"github.com/google/uuid"
-	"time"
-)
-
-type Ledger struct {
-	LedgerID          uuid.UUID `sql:"primary_key"`
-	AccountID         uuid.UUID
-	Kind              string
-	Source            *string
-	Origin            *string
-	ChipsDelta        int32
-	ProductID         *uuid.UUID
-	OrderID           *uuid.UUID
-	Provider          *string
-	ProviderPaymentID *string
-	Snapshot          *string
-	CreatedAt         time.Time
-}

backend/internal/postgres/jet/payments/model/orders.go

@@ -1,28 +0,0 @@
-//
-// Code generated by go-jet DO NOT EDIT.
-//
-// WARNING: Changes to this file may cause incorrect behavior
-// and will be lost if the code is regenerated
-//
-
-package model
-
-import (
-	"github.com/google/uuid"
-	"time"
-)
-
-type Orders struct {
-	OrderID           uuid.UUID `sql:"primary_key"`
-	AccountID         uuid.UUID
-	Platform          string
-	ProductID         uuid.UUID
-	ExpectedAmount    int64
-	Currency          string
-	Origin            string
-	Status            string
-	Provider          *string
-	ProviderPaymentID *string
-	CreatedAt         time.Time
-	UpdatedAt         time.Time
-}