Merge pull request 'feat(payments): VK Votes payment rail' (#224) from feature/payment-intake-vk into development

The landing at / lists every version's entry; /app/ dropped the player straight
into the web game. Link the iOS store note to the root instead.

.gitea/workflows/ci.yaml

@@ -366,6 +366,13 @@ jobs:
           SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
           SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
           SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
+          # Direct-rail (Robokassa) sandbox intake on the contour: the test shop's merchant login +
+          # Password1/Password2. IsTest is forced to 1 below so the contour can never take real money
+          # (independent of the shop's own mode). Empty login leaves the direct rail off.
+          ROBOKASSA_MERCHANT_LOGIN: ${{ secrets.TEST_BACKEND_ROBOKASSA_MERCHANT_LOGIN }}
+          ROBOKASSA_PASSWORD1: ${{ secrets.TEST_BACKEND_ROBOKASSA_PASSWORD1 }}
+          ROBOKASSA_PASSWORD2: ${{ secrets.TEST_BACKEND_ROBOKASSA_PASSWORD2 }}
+          ROBOKASSA_TEST: "1"
           SMTP_RELAY_FROM: ${{ vars.TEST_SMTP_RELAY_FROM }}
           # Operator alerts: backend admin emails (new feedback / complaints) + Grafana
           # infra alerts. Distinct senders + recipients; Grafana uses the relay's STARTTLS
@@ -497,6 +504,38 @@ jobs:
           docker logs --tail 50 scrabble-backend || true
           exit 1
 
+      - name: Probe the /offer/ public offer page is served
+        run: |
+          set -u
+          # /offer/ is a static page baked into the landing image (rendered from
+          # ui/legal/offer_ru.md). If the landing Caddyfile stops routing it, the request
+          # silently falls through to the landing shell (also 200) — so assert offer-specific
+          # content, never just the status.
+          out="$(docker run --rm --network edge alpine:3.20 wget -q -O - http://scrabble/offer/ 2>&1 || true)"
+          if echo "$out" | grep -q "290210610742"; then
+            echo "ok: /offer/ serves the public offer page"
+          else
+            echo "FAIL: /offer/ did not serve the offer page (fell through to the landing shell?)"
+            docker logs --tail 50 scrabble-landing || true
+            exit 1
+          fi
+
+      - name: Probe the /pay/ callback route reaches the gateway
+        run: |
+          set -u
+          # /pay/robokassa/result must reach the gateway, not fall to the landing catch-all. An
+          # unsigned probe is rejected downstream, so the gateway answers a 4xx/5xx (never a 200 or
+          # a 404 landing.html), which proves the edge route is wired.
+          out="$(docker run --rm --network edge alpine:3.20 wget -S -q -O /dev/null http://scrabble/pay/robokassa/result 2>&1 || true)"
+          echo "$out" | grep -E "HTTP/" || true
+          if echo "$out" | grep -qE "HTTP/1\.1 (4|5)[0-9][0-9]"; then
+            echo "ok: /pay/ reaches the gateway (non-landing response)"
+          else
+            echo "FAIL: /pay/robokassa/result did not reach the gateway (landing catch-all?)"
+            docker logs --tail 50 scrabble-gateway || true
+            exit 1
+          fi
+
       - name: Probe the /dict edge route reaches the gateway
         run: |
           set -u

PLAN.md

@@ -33,8 +33,8 @@ status — without re-deriving decisions.
 | E1 | Trusted platform signal | 1 | DONE |
 | E2 | Currency + benefit core | 1 | DONE |
 | E3 | Wallet UI | 1 | DONE |
-| E4 | Durability (PITR) | 2 | WIP |
+| E4 | Durability (PITR) | 2 | DONE |
-| E5 | Payment intake | 2 | TODO |
+| E5 | Payment intake | 2 | WIP |
 | E6 | Ads | 2 | TODO |
 | E7 | Admin & reports | 2 | TODO |
 | E8 | Guest limits | — | TODO |
@@ -446,8 +446,8 @@ noun agreement). Svelte whitespace/`$state` naming gotchas apply.
 
 ## E4 — Durability (PITR)
 
-**Status:** WIP — repo artifacts landed; **prod arming pending** (owner-coordinated, before
+**Status:** DONE — armed + restore-drilled on prod (v1.13.0, 2026-07-09). · **Release 2** ·
-E5). · **Release 2** · depends on: E0 (schema exists) · mechanics: PAYMENTS §14 (D4).
+depends on: E0 (schema exists) · mechanics: PAYMENTS §14 (D4).
 
 **Goal.** Continuous WAL archiving with point-in-time recovery, armed **before the first
 real money** is accepted (E5 prod). Protects both money and game data.
@@ -479,30 +479,52 @@ real money** is accepted (E5 prod). Protects both money and game data.
   `-n backend`, silently excluding `payments`); manual-restore runbook updated.
 - Full PITR runbook + arming sequence + recorded assessment in `deploy/README.md`.
 
-**Prod arming (SEPARATE — owner-coordinated, before E5; NOT the artifacts PR).** Owner creates
+**Prod arming (completed 2026-07-09 with the v1.13.0 release).** Owner created the Selectel S3
-the Selectel S3 bucket + the `PROD_PGBACKREST_*` secrets/variables (incl. `ARCHIVE_MODE=on`);
+bucket (`erudite`, ru-6) + the `PROD_PGBACKREST_*` secrets/variables (incl. `ARCHIVE_MODE=on`);
-then promote `development → master` → `prod-deploy` (archive_mode on behind the maintenance
+promoted `development → master` → `prod-deploy` (archive_mode on behind the maintenance window),
-window), `pgbackrest stanza-create` + first base backup + `check`, re-run Ansible with
+then `stanza-create` + first base backup (31.9 MB cluster → 3.7 MB in the repo) + `check`, the
-`-e pitr_enabled=true`, and run the restore drill on an isolated one-shot target. Exact steps:
+Ansible `-e pitr_enabled=true` timer, and a restore drill on an isolated one-shot target (data
-`deploy/README.md` (point-in-time recovery — arming).
+intact, then wiped). Exact steps: `deploy/README.md` (point-in-time recovery — arming).
 
 **Tests.** Restore drill on an isolated one-shot instance (base + WAL → target timestamp),
 recorded in `deploy/README.md`. No app-level tests. Local verification: `docker compose config`
 valid + the custom PG image builds (archiving inert on the contour).
 
-**Done-criteria.** Artifacts merged with archiving inert. **Fully done** at arming: WAL
+**Done-criteria (met).** WAL archiving live on prod PG (v1.13.0); a restore verified on an
-archiving live on prod PG; a timed restore verified; cost + perf assessment reviewed; runbook
+isolated one-shot target; cost + perf assessment reviewed; runbook current in
-current in `deploy/README.md`.
+`deploy/README.md`.
 
 **Notes/risks.** The repository **cipher passphrase is unrecoverable if lost** — stored apart
-from the S3 keys. Enabling `archive_mode` restarts postgres (rides the prod-deploy maintenance
+from the S3 keys. Manual/timer pgBackRest runs use `docker exec -u postgres … --pg1-user=scrabble`
-window). Migrations stay expand-contract so image rollback remains DB-safe alongside PITR.
+(docker exec is root; the DB superuser role is `scrabble`, not `postgres`) — the systemd timer
++ the runbook carry this. Enabling `archive_mode` restarts postgres (rode the prod-deploy
+maintenance window). Migrations stay expand-contract so image rollback remains DB-safe with PITR.
 
 ---
 
 ## E5 — Payment intake
 
-**Status:** TODO · **Release 2** · depends on: E0, E1, E2, E4 · mechanics: PAYMENTS §9, §12.
+**Status:** WIP · **Release 2** · depends on: E0, E1, E2, E4 · mechanics: PAYMENTS §9, §12.
+
+**Delivery & baked decisions.** Shipped as a linear PR stack (owner's choice), Robokassa first.
+Resolved: match the order by a Robokassa **`Shp_order`** custom parameter, not the numeric `InvId`
+(an order id is a uuid); idempotency key = the order id (`provider_payment_id = order_id`); the НПД
+receipt is formed **shop-side in the Robokassa cabinet**, so no `Receipt` parameter is sent; a
+chargeback **never drives the balance negative** (D27 stands, `balances_chips_chk` kept), so E5 is
+**schema-free** (no migration, no contour wipe). Delivered on `feature/payment-intake-robokassa`:
+the offer page (`/offer/`), the order/`fund` engine (idempotent, honours an expired order), the
+`internal/robokassa` adapter, the `POST /wallet/order` + internal Result-callback handlers (a D36
+confirmed-email gate on `direct`), the pending reaper, the `wallet.order` edge wire + the public
+`/pay/*` routes, the Wallet purchase CTA, the contour deploy env (IsTest forced), and the
+`payment_events` dispatcher — an in-app wallet-refresh push (KindNotification `"payment"`) with a
+self-closing provider-return page (the payment opens in a separate window) and a return-focus
+refetch fallback. The **VK Votes rail** is delivered too: the client opens
+`VKWebAppShowOrderBox({item: order_id})`; a two-phase signed server callback (`get_item` → the pack
+title + vote price; a chargeable `order_status_change` → the same `Fund` with source=`vk`, idempotent
+on VK's own order id) is verified at the gateway with the app protected key (`GATEWAY_VK_APP_SECRET`,
+already deployed) and proxied to the backend intake. Remaining: the TG-Stars rail and refunds; and
+hiding the ad banner on a no-ads purchase (a spend-path `NotifyBanner`, deferred with the owner's
+agreement).
 
 **Goal.** Accept real money on all three rails into the payments domain: order-flow,
 verified provider callbacks, idempotency, the TG bot SQLite outbox, the event dispatcher,

backend/cmd/backend/main.go

@@ -308,6 +308,7 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		Notifier:      hub,
 		ExportSignKey: cfg.ExportSignKey,
 		Renderer:      renderer,
+		Robokassa:     cfg.Robokassa,
 	})
 	pushSrv := pushgrpc.NewServer(cfg.GRPCAddr, hub, logger)
 
@@ -316,6 +317,13 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	logger.Info("servers starting",
 		zap.String("http_addr", cfg.HTTPAddr),
 		zap.String("grpc_addr", cfg.GRPCAddr))
+	// Sweep expired pending payment orders on a cadence (cosmetic hygiene; a late valid callback
+	// still credits). Runs until ctx is cancelled.
+	go runOrderReaper(ctx, paymentsSvc, logger)
+	// Deliver pending payment_events to connected clients as an in-app wallet-refresh push (the
+	// credit already landed in the ledger; a return-focus poll is the client-side fallback).
+	go runPaymentDispatcher(ctx, paymentsSvc, hub, logger)
+
 	errc := make(chan error, 2)
 	go func() { errc <- pushSrv.Run(ctx) }()
 	go func() { errc <- srv.Run(ctx) }()
@@ -325,6 +333,52 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	return err
 }
 
+// runOrderReaper periodically expires pending payment orders past their configured lifetime, until
+// ctx is cancelled. Expiry is cosmetic: a later valid provider callback still credits an expired
+// order.
+func runOrderReaper(ctx context.Context, p *payments.Service, log *zap.Logger) {
+	t := time.NewTicker(5 * time.Minute)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			if n, err := p.ExpireOrders(ctx); err != nil {
+				log.Warn("order reaper: sweep failed", zap.Error(err))
+			} else if n > 0 {
+				log.Info("order reaper: expired pending orders", zap.Int("count", n))
+			}
+		}
+	}
+}
+
+// runPaymentDispatcher delivers pending payment_events to connected clients as a wallet-refresh
+// signal (KindNotification / "payment"), marking each delivered, until ctx is cancelled. The credit
+// already committed to the ledger; this is only the in-app push so an open wallet updates in place.
+func runPaymentDispatcher(ctx context.Context, p *payments.Service, pub notify.Publisher, log *zap.Logger) {
+	t := time.NewTicker(3 * time.Second)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			evs, err := p.UndispatchedEvents(ctx, 50)
+			if err != nil {
+				log.Warn("payment dispatcher: read failed", zap.Error(err))
+				continue
+			}
+			for _, e := range evs {
+				pub.Publish(notify.Notification(e.AccountID, notify.NotifyPayment))
+				if err := p.MarkEventDispatched(ctx, e.EventID); err != nil {
+					log.Warn("payment dispatcher: mark failed", zap.String("event", e.EventID.String()), zap.Error(err))
+				}
+			}
+		}
+	}
+}
+
 // newMailer builds the confirm-code mailer: an SMTP relay when a host is
 // configured, otherwise the development log mailer (the code is logged, not sent).
 func newMailer(cfg account.SMTPConfig, logger *zap.Logger) account.Mailer {

backend/internal/account/account.go

@@ -393,6 +393,21 @@ func (s *Store) Identities(ctx context.Context, accountID uuid.UUID) ([]Identity
 	return out, nil
 }
 
+// HasConfirmedEmail reports whether the account owns a confirmed email identity — the direct-rail
+// recovery anchor a first purchase requires (D36).
+func (s *Store) HasConfirmedEmail(ctx context.Context, accountID uuid.UUID) (bool, error) {
+	ids, err := s.Identities(ctx, accountID)
+	if err != nil {
+		return false, err
+	}
+	for _, id := range ids {
+		if id.Kind == "email" && id.Confirmed {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
 // ListAccounts returns accounts for the admin user list, newest first, paginated
 // by limit and offset.
 func (s *Store) ListAccounts(ctx context.Context, limit, offset int) ([]Account, error) {

backend/internal/config/config.go

@@ -14,6 +14,7 @@ import (
 	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/postgres"
 	"scrabble/backend/internal/ratewatch"
+	"scrabble/backend/internal/robokassa"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/telemetry"
 )
@@ -64,6 +65,9 @@ type Config struct {
 	// RendererURL is the base URL of the internal image-render sidecar (e.g.
 	// http://renderer:8090). Empty disables the PNG export artifact.
 	RendererURL string
+	// Robokassa configures the direct-rail (RUB) payment provider. An empty MerchantLogin
+	// leaves the direct order and Result-callback endpoints unregistered.
+	Robokassa robokassa.Config
 }
 
 // Defaults applied when the corresponding environment variable is unset.
@@ -153,6 +157,13 @@ func Load() (Config, error) {
 		AdminTo:   os.Getenv("BACKEND_ADMIN_EMAIL"),
 	}
 
+	robo := robokassa.Config{
+		MerchantLogin: os.Getenv("BACKEND_ROBOKASSA_MERCHANT_LOGIN"),
+		Password1:     os.Getenv("BACKEND_ROBOKASSA_PASSWORD1"),
+		Password2:     os.Getenv("BACKEND_ROBOKASSA_PASSWORD2"),
+		IsTest:        os.Getenv("BACKEND_ROBOKASSA_TEST") == "1",
+	}
+
 	c := Config{
 		HTTPAddr:          envOr("BACKEND_HTTP_ADDR", defaultHTTPAddr),
 		GRPCAddr:          envOr("BACKEND_GRPC_ADDR", defaultGRPCAddr),
@@ -170,6 +181,7 @@ func Load() (Config, error) {
 		GuestRetention:    guestRetention,
 		ExportSignKey:     os.Getenv("BACKEND_EXPORT_SIGN_KEY"),
 		RendererURL:       os.Getenv("BACKEND_RENDERER_URL"),
+		Robokassa:         robo,
 	}
 	if err := c.validate(); err != nil {
 		return Config{}, err
@@ -222,6 +234,9 @@ func (c Config) validate() error {
 			return fmt.Errorf("config: BACKEND_PUBLIC_BASE_URL %q must be an absolute URL (scheme://host)", c.PublicBaseURL)
 		}
 	}
+	if c.Robokassa.MerchantLogin != "" && (c.Robokassa.Password1 == "" || c.Robokassa.Password2 == "") {
+		return fmt.Errorf("config: BACKEND_ROBOKASSA_PASSWORD1 and BACKEND_ROBOKASSA_PASSWORD2 must be set when BACKEND_ROBOKASSA_MERCHANT_LOGIN is")
+	}
 	return nil
 }
 

backend/internal/inttest/payments_intake_test.go

@@ -0,0 +1,233 @@
+//go:build integration
+
+package inttest
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"scrabble/backend/internal/payments"
+)
+
+// orderStatus reads an order's status.
+func orderStatus(t *testing.T, orderID uuid.UUID) string {
+	t.Helper()
+	var status string
+	if err := testDB.QueryRowContext(context.Background(),
+		`SELECT status FROM payments.orders WHERE order_id=$1`, orderID).Scan(&status); err != nil {
+		t.Fatalf("read order status: %v", err)
+	}
+	return status
+}
+
+// TestPaymentsOrderFundCreditsOnce verifies the intake path over Postgres: creating an order then
+// funding it credits the funded segment exactly once, and a replayed callback (the same order)
+// credits nothing more — the ledger idempotency index holds.
+func TestPaymentsOrderFundCreditsOnce(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	acc := uuid.New()
+	prod := seedPackProduct(t, 100, methodPrice{method: "direct", currency: "RUB", amount: 14900}) // 149.00 RUB funds 100 chips
+
+	res, err := svc.CreateOrder(ctx, acc, payments.NewContext("direct", "web"), []payments.Source{payments.SourceDirect}, prod, "robokassa")
+	if err != nil {
+		t.Fatalf("create order: %v", err)
+	}
+	if res.Amount.Minor() != 14900 || res.Amount.Currency() != payments.CurrencyRUB {
+		t.Fatalf("order amount = %s, want 149.00 RUB", res.Amount)
+	}
+	if orderStatus(t, res.OrderID) != "pending" {
+		t.Errorf("new order status = %s, want pending", orderStatus(t, res.OrderID))
+	}
+
+	paid, _ := payments.MoneyFromMinor(14900, payments.CurrencyRUB)
+	out, err := svc.Fund(ctx, res.OrderID, "robokassa", res.OrderID.String(), paid)
+	if err != nil {
+		t.Fatalf("fund: %v", err)
+	}
+	if out.AlreadyCredited || out.Chips != 100 || out.Source != payments.SourceDirect {
+		t.Fatalf("fund outcome = %+v, want 100 chips to direct, not already-credited", out)
+	}
+	if got := readBalance(t, acc, "direct"); got != 100 {
+		t.Errorf("balance after fund = %d, want 100", got)
+	}
+	if ledgerRows(t, acc, "fund") != 1 {
+		t.Errorf("fund ledger rows = %d, want 1", ledgerRows(t, acc, "fund"))
+	}
+	if orderStatus(t, res.OrderID) != "paid" {
+		t.Errorf("order status after fund = %s, want paid", orderStatus(t, res.OrderID))
+	}
+
+	// A replayed callback for the same order is rejected by the unique index: no second credit.
+	out2, err := svc.Fund(ctx, res.OrderID, "robokassa", res.OrderID.String(), paid)
+	if err != nil {
+		t.Fatalf("duplicate fund: %v", err)
+	}
+	if !out2.AlreadyCredited {
+		t.Error("duplicate callback not flagged AlreadyCredited")
+	}
+	if got := readBalance(t, acc, "direct"); got != 100 {
+		t.Errorf("balance after duplicate = %d, want 100 (credited once)", got)
+	}
+	if ledgerRows(t, acc, "fund") != 1 {
+		t.Error("duplicate callback wrote a second fund ledger row")
+	}
+}
+
+// TestPaymentsVKOrderFundCredits exercises the VK Votes rail over Postgres: a VK order prices the
+// pack in votes; the get_item lookup returns its title and vote price; a chargeable
+// order_status_change credits the vk segment exactly once (idempotent on VK's own order id).
+func TestPaymentsVKOrderFundCredits(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	acc := uuid.New()
+	prod := seedPackProduct(t, 200, methodPrice{method: "vk", currency: "VOTE", amount: 30})
+
+	res, err := svc.CreateOrder(ctx, acc, payments.NewContext("vk", "web"), []payments.Source{payments.SourceVK}, prod, "vk")
+	if err != nil {
+		t.Fatalf("create vk order: %v", err)
+	}
+	if res.Amount.Currency() != payments.CurrencyVote || res.Amount.Minor() != 30 {
+		t.Fatalf("vk order amount = %s, want 30 VOTE", res.Amount)
+	}
+
+	// get_item phase: title + vote price.
+	title, amount, err := svc.OrderItem(ctx, res.OrderID)
+	if err != nil {
+		t.Fatalf("order item: %v", err)
+	}
+	if title == "" || amount.Minor() != 30 || amount.Currency() != payments.CurrencyVote {
+		t.Errorf("order item = %q / %s, want a title + 30 VOTE", title, amount)
+	}
+
+	// order_status_change phase: VK's own order id is the idempotency key.
+	paid, _ := payments.MoneyFromMinor(30, payments.CurrencyVote)
+	out, err := svc.Fund(ctx, res.OrderID, "vk", "vk-order-777", paid)
+	if err != nil {
+		t.Fatalf("vk fund: %v", err)
+	}
+	if out.AlreadyCredited || out.Chips != 200 || out.Source != payments.SourceVK {
+		t.Fatalf("vk fund outcome = %+v, want 200 chips credited to vk", out)
+	}
+	if got := readBalance(t, acc, "vk"); got != 200 {
+		t.Errorf("vk balance after fund = %d, want 200", got)
+	}
+
+	// A duplicate VK callback (same VK order id) credits nothing more.
+	out2, err := svc.Fund(ctx, res.OrderID, "vk", "vk-order-777", paid)
+	if err != nil {
+		t.Fatalf("duplicate vk fund: %v", err)
+	}
+	if !out2.AlreadyCredited {
+		t.Error("duplicate VK callback not flagged AlreadyCredited")
+	}
+	if got := readBalance(t, acc, "vk"); got != 200 {
+		t.Errorf("vk balance after duplicate = %d, want 200 (credited once)", got)
+	}
+}
+
+// TestPaymentsFundAmountMismatch verifies a callback whose paid amount does not match the order is
+// refused and credits nothing (§9: verify the amount after matching by order id).
+func TestPaymentsFundAmountMismatch(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	acc := uuid.New()
+	prod := seedPackProduct(t, 100, methodPrice{method: "direct", currency: "RUB", amount: 14900})
+
+	res, err := svc.CreateOrder(ctx, acc, payments.NewContext("direct", "web"), []payments.Source{payments.SourceDirect}, prod, "robokassa")
+	if err != nil {
+		t.Fatalf("create order: %v", err)
+	}
+	underpaid, _ := payments.MoneyFromMinor(100, payments.CurrencyRUB)
+	if _, err := svc.Fund(ctx, res.OrderID, "robokassa", res.OrderID.String(), underpaid); !errors.Is(err, payments.ErrAmountMismatch) {
+		t.Fatalf("fund = %v, want ErrAmountMismatch", err)
+	}
+	if got := readBalance(t, acc, "direct"); got != 0 {
+		t.Errorf("balance = %d, want 0 (nothing credited on mismatch)", got)
+	}
+	if ledgerRows(t, acc, "fund") != 0 {
+		t.Error("fund ledger row written on an amount mismatch")
+	}
+}
+
+// TestPaymentsEventDispatchDrain verifies the payment_events dispatcher queue: a recorded event is
+// returned as undispatched until marked, then drops out (so the dispatcher delivers it once).
+func TestPaymentsEventDispatchDrain(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	acc := uuid.New()
+	if err := svc.RecordPaymentEvent(ctx, acc, nil, "succeeded", []byte(`{"chips":10,"source":"direct"}`)); err != nil {
+		t.Fatalf("record event: %v", err)
+	}
+
+	// testDB is shared, so filter the queue to our account.
+	find := func() *payments.PaymentEvent {
+		evs, err := svc.UndispatchedEvents(ctx, 100)
+		if err != nil {
+			t.Fatalf("undispatched: %v", err)
+		}
+		for i := range evs {
+			if evs[i].AccountID == acc {
+				return &evs[i]
+			}
+		}
+		return nil
+	}
+
+	mine := find()
+	if mine == nil {
+		t.Fatal("recorded event not in the undispatched queue")
+	}
+	if mine.Type != "succeeded" {
+		t.Errorf("event type = %s, want succeeded", mine.Type)
+	}
+	if err := svc.MarkEventDispatched(ctx, mine.EventID); err != nil {
+		t.Fatalf("mark dispatched: %v", err)
+	}
+	if find() != nil {
+		t.Error("event still undispatched after MarkEventDispatched")
+	}
+}
+
+// TestPaymentsExpiredOrderStillCredits verifies an expired pending order is still honoured by a
+// later valid callback (§9/D23: expiry is cosmetic, the money is real).
+func TestPaymentsExpiredOrderStillCredits(t *testing.T) {
+	ctx := context.Background()
+	svc := newPaymentsService()
+	acc := uuid.New()
+	prod := seedPackProduct(t, 100, methodPrice{method: "direct", currency: "RUB", amount: 14900})
+
+	res, err := svc.CreateOrder(ctx, acc, payments.NewContext("direct", "web"), []payments.Source{payments.SourceDirect}, prod, "robokassa")
+	if err != nil {
+		t.Fatalf("create order: %v", err)
+	}
+	// Age the order well past the configured TTL, then sweep it to expired.
+	if _, err := testDB.ExecContext(ctx,
+		`UPDATE payments.orders SET created_at = now() - interval '1 day' WHERE order_id=$1`, res.OrderID); err != nil {
+		t.Fatalf("age order: %v", err)
+	}
+	if n, err := svc.ExpireOrders(ctx); err != nil || n < 1 {
+		t.Fatalf("expire orders = %d (err %v), want at least 1", n, err)
+	}
+	if orderStatus(t, res.OrderID) != "expired" {
+		t.Fatalf("order status = %s, want expired before the late callback", orderStatus(t, res.OrderID))
+	}
+
+	paid, _ := payments.MoneyFromMinor(14900, payments.CurrencyRUB)
+	out, err := svc.Fund(ctx, res.OrderID, "robokassa", res.OrderID.String(), paid)
+	if err != nil {
+		t.Fatalf("fund after expiry: %v", err)
+	}
+	if out.AlreadyCredited || out.Chips != 100 {
+		t.Fatalf("fund outcome = %+v, want a fresh 100-chip credit", out)
+	}
+	if got := readBalance(t, acc, "direct"); got != 100 {
+		t.Errorf("balance = %d, want 100 (expired order honoured)", got)
+	}
+	if orderStatus(t, res.OrderID) != "paid" {
+		t.Errorf("order status = %s, want paid after the honoured callback", orderStatus(t, res.OrderID))
+	}
+}

backend/internal/notify/notify.go

@@ -73,6 +73,10 @@ const (
 	// (e.g. an email was confirmed via the one-tap deeplink opened in another browser),
 	// so it re-fetches profile.get. It carries no payload. In-app only.
 	NotifyProfile = "profile"
+	// NotifyPayment tells the client that the viewer's wallet changed from a payment-intake event
+	// (a credit or a refund), so it re-fetches the wallet in place. It carries no payload. In-app
+	// only; the payment_events dispatcher emits it after the crediting transaction commits.
+	NotifyPayment = "payment"
 	// NotifyUserBlocked confirms to the blocker that a per-user block took effect,
 	// carrying the blocked account, so every one of the blocker's sessions updates the
 	// in-game block/add-friend controls and the struck name in place. It is delivered

backend/internal/payments/payments.go

@@ -147,12 +147,13 @@ func (m Money) Cmp(o Money) (int, error) {
 	}
 }
 
-// String renders the amount as "<value> <currency>", with the currency's
+// Major renders the amount as a decimal string without the currency, with the currency's
-// fractional digits and no floating point (e.g. "149.50 RUB", "250 XTR").
+// fractional digits and no floating point (e.g. "149.50", "250") — the form a provider's amount
-func (m Money) String() string {
+// field (Robokassa OutSum) takes.
+func (m Money) Major() string {
 	scale := m.currency.minorPerUnit()
 	if scale == 1 {
-		return fmt.Sprintf("%d %s", m.minor, m.currency)
+		return fmt.Sprintf("%d", m.minor)
 	}
 	neg := m.minor < 0
 	abs := m.minor
@@ -167,5 +168,10 @@ func (m Money) String() string {
 	if neg {
 		sign = "-"
 	}
-	return fmt.Sprintf("%s%d.%0*d %s", sign, abs/scale, width, abs%scale, m.currency)
+	return fmt.Sprintf("%s%d.%0*d", sign, abs/scale, width, abs%scale)
+}
+
+// String renders the amount as "<value> <currency>" (e.g. "149.50 RUB", "250 XTR").
+func (m Money) String() string {
+	return m.Major() + " " + string(m.currency)
 }

backend/internal/payments/service_intake.go

@@ -0,0 +1,109 @@
+package payments
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/google/uuid"
+)
+
+// OrderResult is what CreateOrder returns to the transport: the created order id and the details a
+// provider launch payload needs — the amount to charge and a human title for the payment.
+type OrderResult struct {
+	OrderID uuid.UUID
+	Amount  Money
+	Title   string
+}
+
+// CreateOrder opens a pending order to fund a chip pack in the execution context's payment method,
+// tagged with the provider that will settle it. It gate-checks the context (trusted, not the
+// VK-iOS spend freeze) and that the method's funding segment is attached, prices the pack in the
+// method's currency, then writes the order. The caller enforces any account-level precondition
+// (e.g. the direct email anchor, D36) before calling — payments holds no cross-schema identity
+// knowledge.
+func (s *Service) CreateOrder(ctx context.Context, accountID uuid.UUID, cxt Context, present []Source, productID uuid.UUID, provider string) (OrderResult, error) {
+	if !cxt.Trusted() || cxt.vkFrozen() {
+		return OrderResult{}, ErrUntrusted
+	}
+	method := cxt.Kind
+	if !has(present, method) {
+		return OrderResult{}, ErrUntrusted // the funding segment is not attached to the account
+	}
+	pack, err := s.store.loadPackForOrder(ctx, productID, method)
+	if err != nil {
+		return OrderResult{}, err
+	}
+	orderID, err := uuid.NewV7()
+	if err != nil {
+		return OrderResult{}, fmt.Errorf("payments: order id: %w", err)
+	}
+	o := newOrder{
+		orderID:   orderID,
+		accountID: accountID,
+		platform:  string(method),
+		productID: productID,
+		amount:    pack.price,
+		origin:    method,
+		provider:  provider,
+	}
+	if err := s.store.createOrder(ctx, o, s.clock()); err != nil {
+		return OrderResult{}, err
+	}
+	return OrderResult{OrderID: orderID, Amount: pack.price, Title: pack.title}, nil
+}
+
+// OrderItem returns a pending order's human title and the amount it charges, in the order's own
+// currency — the details a provider's item-lookup phase needs (VK's get_item). It reads the order
+// and the pack title, honouring the pack even if it was later deactivated (mirrors Fund).
+func (s *Service) OrderItem(ctx context.Context, orderID uuid.UUID) (title string, amount Money, err error) {
+	ord, err := s.store.orderByID(ctx, orderID)
+	if err != nil {
+		return "", Money{}, err
+	}
+	_, title, err = s.store.packForCredit(ctx, ord.productID)
+	if err != nil {
+		return "", Money{}, err
+	}
+	amount, err = MoneyFromMinor(ord.expectedAmount, Currency(ord.currency))
+	if err != nil {
+		return "", Money{}, err
+	}
+	return title, amount, nil
+}
+
+// Fund credits a paid order into its funded segment exactly once, from a verified provider callback
+// — the single writer for every rail. It matches the order, verifies the paid amount, appends the
+// fund ledger row (idempotent on (provider, provider_payment_id)), credits the balance and marks
+// the order paid. A duplicate callback returns AlreadyCredited without a second credit; a valid
+// callback is honoured even on an expired order (§9/D23).
+func (s *Service) Fund(ctx context.Context, orderID uuid.UUID, provider, providerPaymentID string, paid Money) (FundOutcome, error) {
+	return s.store.fund(ctx, orderID, provider, providerPaymentID, paid, s.clock())
+}
+
+// ExpireOrders marks pending orders older than the configured lifetime as expired, returning how
+// many were swept. It backs the periodic pending reaper; expiry is cosmetic (a late valid callback
+// still credits — see Fund).
+func (s *Service) ExpireOrders(ctx context.Context) (int, error) {
+	ttl, err := s.store.orderTTL(ctx)
+	if err != nil {
+		return 0, err
+	}
+	return s.store.expirePending(ctx, ttl, s.clock())
+}
+
+// RecordPaymentEvent appends a payment lifecycle event (succeeded/failed/refunded) for the
+// dispatcher to deliver to the user (live stream, botlink or email).
+func (s *Service) RecordPaymentEvent(ctx context.Context, accountID uuid.UUID, orderID *uuid.UUID, eventType string, payload []byte) error {
+	return s.store.insertPaymentEvent(ctx, accountID, orderID, eventType, payload, s.clock())
+}
+
+// UndispatchedEvents returns up to limit payment events awaiting delivery. The dispatcher drains
+// them and marks each delivered via MarkEventDispatched.
+func (s *Service) UndispatchedEvents(ctx context.Context, limit int) ([]PaymentEvent, error) {
+	return s.store.undispatchedEvents(ctx, limit)
+}
+
+// MarkEventDispatched stamps a payment event as delivered so it is not re-sent.
+func (s *Service) MarkEventDispatched(ctx context.Context, eventID uuid.UUID) error {
+	return s.store.markEventDispatched(ctx, eventID, s.clock())
+}

backend/internal/payments/service_intake_test.go

@@ -0,0 +1,42 @@
+package payments
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// gateOnlyService builds a Service with a fixed clock and no store, usable only for the CreateOrder
+// gate rejections that return before any store access.
+func gateOnlyService() *Service {
+	return &Service{clock: func() time.Time { return time.Unix(0, 0).UTC() }}
+}
+
+// TestCreateOrderGateRejections checks that CreateOrder fails closed — before touching the store —
+// on an untrusted platform, the VK-iOS spend freeze, and a method whose funding segment the account
+// does not hold.
+func TestCreateOrderGateRejections(t *testing.T) {
+	ctx := context.Background()
+	acc, prod := uuid.New(), uuid.New()
+	present := []Source{SourceDirect, SourceVK}
+
+	cases := []struct {
+		name string
+		cxt  Context
+	}{
+		{"untrusted context", Context{}},
+		{"vk-ios spend freeze", Context{Kind: SourceVK, Subtype: SubtypeIOS}},
+		{"method segment not attached", Context{Kind: SourceTelegram}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := gateOnlyService().CreateOrder(ctx, acc, tc.cxt, present, prod, "robokassa")
+			if !errors.Is(err, ErrUntrusted) {
+				t.Fatalf("CreateOrder(%s) = %v, want ErrUntrusted", tc.name, err)
+			}
+		})
+	}
+}

backend/internal/payments/store_intake.go

@@ -0,0 +1,381 @@
+package payments
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/go-jet/jet/v2/postgres"
+	"github.com/go-jet/jet/v2/qrm"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgconn"
+
+	"scrabble/backend/internal/postgres/jet/payments/model"
+	"scrabble/backend/internal/postgres/jet/payments/table"
+)
+
+// Intake errors surfaced by the order-flow and external-credit (fund) path.
+var (
+	// ErrNotAPack means the product is not a fundable chip pack in the requested method: it
+	// carries no chips atom, or no price for that payment method.
+	ErrNotAPack = errors.New("payments: product is not a chip pack for this method")
+	// ErrOrderNotFound means no order matches the id (an unknown or forged callback reference).
+	ErrOrderNotFound = errors.New("payments: order not found")
+	// ErrAmountMismatch means the callback's paid amount or currency does not match the order's
+	// expected amount — the credit is refused (§9: verify amount after matching by order id).
+	ErrAmountMismatch = errors.New("payments: paid amount does not match the order")
+)
+
+// errAlreadyCredited is the internal sentinel that unwinds the fund transaction when the ledger's
+// (provider, provider_payment_id) unique index rejects a duplicate callback. It is not surfaced:
+// a replayed callback is a success that credits nothing.
+var errAlreadyCredited = errors.New("payments: already credited")
+
+// packInfo is a chip pack resolved for an order: the product, the chips it funds and its price in
+// the requested payment method's currency.
+type packInfo struct {
+	productID uuid.UUID
+	title     string
+	chips     int
+	price     Money
+}
+
+// packChips returns the quantity of the chips atom a product carries, or 0 if it has none (which
+// marks it as a value, not a fundable pack).
+func (s *Store) packChips(ctx context.Context, productID uuid.UUID) (int, error) {
+	var item model.ProductItem
+	err := postgres.SELECT(table.ProductItem.AllColumns).
+		FROM(table.ProductItem).
+		WHERE(table.ProductItem.ProductID.EQ(postgres.UUID(productID)).
+			AND(table.ProductItem.AtomType.EQ(postgres.String(atomChips)))).
+		LIMIT(1).
+		QueryContext(ctx, s.db, &item)
+	if errors.Is(err, qrm.ErrNoRows) {
+		return 0, nil
+	}
+	if err != nil {
+		return 0, fmt.Errorf("payments: load pack chips %s: %w", productID, err)
+	}
+	return int(item.Quantity), nil
+}
+
+// loadPackForOrder resolves an active chip pack for a new order in the given payment method: an
+// active product carrying a chips atom and a price row for the method (its currency and amount are
+// the order's expected amount). It rejects a missing/deactivated product (ErrProductNotFound) and
+// a product that is not a pack for the method (ErrNotAPack).
+func (s *Store) loadPackForOrder(ctx context.Context, productID uuid.UUID, method Source) (packInfo, error) {
+	var p model.Product
+	err := postgres.SELECT(table.Product.AllColumns).
+		FROM(table.Product).
+		WHERE(table.Product.ProductID.EQ(postgres.UUID(productID))).
+		LIMIT(1).
+		QueryContext(ctx, s.db, &p)
+	if errors.Is(err, qrm.ErrNoRows) || (err == nil && !p.Active) {
+		return packInfo{}, ErrProductNotFound
+	}
+	if err != nil {
+		return packInfo{}, fmt.Errorf("payments: load product %s: %w", productID, err)
+	}
+
+	chips, err := s.packChips(ctx, productID)
+	if err != nil {
+		return packInfo{}, err
+	}
+	if chips <= 0 {
+		return packInfo{}, ErrNotAPack
+	}
+
+	var price model.ProductPrice
+	err = postgres.SELECT(table.ProductPrice.AllColumns).
+		FROM(table.ProductPrice).
+		WHERE(table.ProductPrice.ProductID.EQ(postgres.UUID(productID)).
+			AND(table.ProductPrice.Method.EQ(postgres.String(string(method))))).
+		LIMIT(1).
+		QueryContext(ctx, s.db, &price)
+	if errors.Is(err, qrm.ErrNoRows) {
+		return packInfo{}, ErrNotAPack
+	}
+	if err != nil {
+		return packInfo{}, fmt.Errorf("payments: load pack price %s: %w", productID, err)
+	}
+	money, err := MoneyFromMinor(price.Amount, Currency(price.Currency))
+	if err != nil {
+		return packInfo{}, err
+	}
+	return packInfo{productID: productID, title: p.Title, chips: chips, price: money}, nil
+}
+
+// packForCredit resolves the chips and title of an ordered pack at credit time, ignoring the
+// product's active flag: the money is real, so an order is honoured even if the pack was
+// deactivated after it was placed (§9/D23).
+func (s *Store) packForCredit(ctx context.Context, productID uuid.UUID) (chips int, title string, err error) {
+	var p model.Product
+	e := postgres.SELECT(table.Product.Title).
+		FROM(table.Product).
+		WHERE(table.Product.ProductID.EQ(postgres.UUID(productID))).
+		LIMIT(1).
+		QueryContext(ctx, s.db, &p)
+	if errors.Is(e, qrm.ErrNoRows) {
+		return 0, "", ErrProductNotFound
+	}
+	if e != nil {
+		return 0, "", fmt.Errorf("payments: load product %s: %w", productID, e)
+	}
+	chips, err = s.packChips(ctx, productID)
+	if err != nil {
+		return 0, "", err
+	}
+	if chips <= 0 {
+		return 0, "", ErrNotAPack
+	}
+	return chips, p.Title, nil
+}
+
+// newOrder is the intent a CreateOrder writes: a pending order for a pack, priced in the method's
+// currency, tagged with the provider that will settle it.
+type newOrder struct {
+	orderID   uuid.UUID
+	accountID uuid.UUID
+	platform  string
+	productID uuid.UUID
+	amount    Money
+	origin    Source
+	provider  string
+}
+
+// createOrder inserts a pending order.
+func (s *Store) createOrder(ctx context.Context, o newOrder, now time.Time) error {
+	stmt := table.Orders.INSERT(
+		table.Orders.OrderID, table.Orders.AccountID, table.Orders.Platform,
+		table.Orders.ProductID, table.Orders.ExpectedAmount, table.Orders.Currency,
+		table.Orders.Origin, table.Orders.Status, table.Orders.Provider,
+		table.Orders.CreatedAt, table.Orders.UpdatedAt,
+	).VALUES(
+		o.orderID, o.accountID, o.platform,
+		o.productID, o.amount.Minor(), string(o.amount.Currency()),
+		string(o.origin), "pending", o.provider,
+		now, now,
+	)
+	if _, err := stmt.ExecContext(ctx, s.db); err != nil {
+		return fmt.Errorf("payments: create order: %w", err)
+	}
+	return nil
+}
+
+// orderRow is a stored order read back for the intake path.
+type orderRow struct {
+	orderID        uuid.UUID
+	accountID      uuid.UUID
+	productID      uuid.UUID
+	expectedAmount int64
+	currency       string
+	origin         string
+	status         string
+}
+
+// orderByID reads an order, or ErrOrderNotFound.
+func (s *Store) orderByID(ctx context.Context, orderID uuid.UUID) (orderRow, error) {
+	var o model.Orders
+	err := postgres.SELECT(table.Orders.AllColumns).
+		FROM(table.Orders).
+		WHERE(table.Orders.OrderID.EQ(postgres.UUID(orderID))).
+		LIMIT(1).
+		QueryContext(ctx, s.db, &o)
+	if errors.Is(err, qrm.ErrNoRows) {
+		return orderRow{}, ErrOrderNotFound
+	}
+	if err != nil {
+		return orderRow{}, fmt.Errorf("payments: load order %s: %w", orderID, err)
+	}
+	return orderRow{
+		orderID:        o.OrderID,
+		accountID:      o.AccountID,
+		productID:      o.ProductID,
+		expectedAmount: o.ExpectedAmount,
+		currency:       o.Currency,
+		origin:         o.Origin,
+		status:         o.Status,
+	}, nil
+}
+
+// FundOutcome reports the result of an intake credit: whose balance, which segment and how many
+// chips were credited, and whether the callback was a duplicate that credited nothing.
+type FundOutcome struct {
+	AccountID       uuid.UUID
+	Source          Source
+	Chips           int
+	AlreadyCredited bool
+}
+
+// fund credits a paid order exactly once: it matches the order, verifies the amount, then in one
+// transaction appends a fund ledger row (idempotent on the (provider, provider_payment_id) unique
+// index), credits the funded segment's balance and marks the order paid. A duplicate callback is
+// rejected by the unique index and returns AlreadyCredited with no error and no second credit. A
+// valid callback is honoured even on an expired order (§9/D23). The read cache is invalidated after
+// the commit, since the credit runs outside any request the payments package owns.
+func (s *Store) fund(ctx context.Context, orderID uuid.UUID, provider, providerPaymentID string, paid Money, now time.Time) (FundOutcome, error) {
+	ord, err := s.orderByID(ctx, orderID)
+	if err != nil {
+		return FundOutcome{}, err
+	}
+	if paid.Currency() != Currency(ord.currency) || paid.Minor() != ord.expectedAmount {
+		return FundOutcome{}, ErrAmountMismatch
+	}
+	chips, title, err := s.packForCredit(ctx, ord.productID)
+	if err != nil {
+		return FundOutcome{}, err
+	}
+	snapshot, err := marshalFundSnapshot(ord.productID, title, chips, paid)
+	if err != nil {
+		return FundOutcome{}, err
+	}
+
+	src := Source(ord.origin)
+	outcome := FundOutcome{AccountID: ord.accountID, Source: src, Chips: chips}
+	pv, pp := provider, providerPaymentID
+	productID := ord.productID
+	err = withTx(ctx, s.db, func(tx *sql.Tx) error {
+		if e := insertLedgerTx(ctx, tx, ord.accountID, "fund", &src, &src, chips, &productID, &orderID, &pv, &pp, snapshot, now); e != nil {
+			if isUniqueViolation(e) {
+				outcome.AlreadyCredited = true
+				return errAlreadyCredited
+			}
+			return e
+		}
+		if _, e := tx.ExecContext(ctx,
+			`INSERT INTO payments.balances (account_id, source, chips, updated_at)
+			 VALUES ($1, $2, $3, now())
+			 ON CONFLICT (account_id, source) DO UPDATE
+			   SET chips = payments.balances.chips + EXCLUDED.chips, updated_at = now()`,
+			ord.accountID, string(src), chips); e != nil {
+			return fmt.Errorf("payments: credit balance %s: %w", src, e)
+		}
+		if _, e := tx.ExecContext(ctx,
+			`UPDATE payments.orders SET status = 'paid', provider = $2, provider_payment_id = $3, updated_at = now()
+			 WHERE order_id = $1`,
+			orderID, provider, providerPaymentID); e != nil {
+			return fmt.Errorf("payments: mark order paid: %w", e)
+		}
+		return nil
+	})
+	if err != nil {
+		if errors.Is(err, errAlreadyCredited) {
+			return outcome, nil
+		}
+		return FundOutcome{}, err
+	}
+	s.cache.invalidate(ord.accountID)
+	return outcome, nil
+}
+
+// insertPaymentEvent appends an undispatched lifecycle event (succeeded/failed/refunded) for the
+// dispatcher to deliver. orderID and payload (a jsonb detail blob) are optional.
+func (s *Store) insertPaymentEvent(ctx context.Context, accountID uuid.UUID, orderID *uuid.UUID, eventType string, payload []byte, now time.Time) error {
+	id, err := uuid.NewV7()
+	if err != nil {
+		return fmt.Errorf("payments: event id: %w", err)
+	}
+	var pl any = postgres.NULL
+	if payload != nil {
+		pl = string(payload)
+	}
+	stmt := table.PaymentEvents.INSERT(
+		table.PaymentEvents.EventID, table.PaymentEvents.AccountID, table.PaymentEvents.OrderID,
+		table.PaymentEvents.Type, table.PaymentEvents.Payload, table.PaymentEvents.CreatedAt,
+	).VALUES(id, accountID, uuidOrNull(orderID), eventType, pl, now)
+	if _, err := stmt.ExecContext(ctx, s.db); err != nil {
+		return fmt.Errorf("payments: insert %s event: %w", eventType, err)
+	}
+	return nil
+}
+
+// PaymentEvent is an undispatched lifecycle event the dispatcher delivers to an account.
+type PaymentEvent struct {
+	EventID   uuid.UUID
+	AccountID uuid.UUID
+	Type      string
+}
+
+// undispatchedEvents reads up to limit payment events not yet delivered, oldest first.
+func (s *Store) undispatchedEvents(ctx context.Context, limit int) ([]PaymentEvent, error) {
+	rows, err := s.db.QueryContext(ctx,
+		`SELECT event_id, account_id, type FROM payments.payment_events
+		 WHERE dispatched_at IS NULL ORDER BY created_at LIMIT $1`, limit)
+	if err != nil {
+		return nil, fmt.Errorf("payments: read undispatched events: %w", err)
+	}
+	defer rows.Close()
+	var out []PaymentEvent
+	for rows.Next() {
+		var e PaymentEvent
+		if err := rows.Scan(&e.EventID, &e.AccountID, &e.Type); err != nil {
+			return nil, fmt.Errorf("payments: scan event: %w", err)
+		}
+		out = append(out, e)
+	}
+	return out, rows.Err()
+}
+
+// markEventDispatched stamps an event as delivered so it is not re-sent.
+func (s *Store) markEventDispatched(ctx context.Context, eventID uuid.UUID, now time.Time) error {
+	if _, err := s.db.ExecContext(ctx,
+		`UPDATE payments.payment_events SET dispatched_at = $2 WHERE event_id = $1`, eventID, now); err != nil {
+		return fmt.Errorf("payments: mark event dispatched: %w", err)
+	}
+	return nil
+}
+
+// orderTTL reads the configured pending-order lifetime in whole seconds.
+func (s *Store) orderTTL(ctx context.Context) (int, error) {
+	var cfg model.Config
+	if err := postgres.SELECT(table.Config.OrderTTLSeconds).
+		FROM(table.Config).
+		LIMIT(1).
+		QueryContext(ctx, s.db, &cfg); err != nil {
+		return 0, fmt.Errorf("payments: read order ttl: %w", err)
+	}
+	return int(cfg.OrderTTLSeconds), nil
+}
+
+// expirePending marks every pending order older than ttlSeconds as expired, returning how many.
+// Expiry is cosmetic DB hygiene: a later valid callback still credits an expired order (§9/D23).
+func (s *Store) expirePending(ctx context.Context, ttlSeconds int, now time.Time) (int, error) {
+	cutoff := now.Add(-time.Duration(ttlSeconds) * time.Second)
+	res, err := table.Orders.
+		UPDATE(table.Orders.Status, table.Orders.UpdatedAt).
+		SET(postgres.String("expired"), postgres.TimestampzT(now)).
+		WHERE(table.Orders.Status.EQ(postgres.String("pending")).
+			AND(table.Orders.CreatedAt.LT(postgres.TimestampzT(cutoff)))).
+		ExecContext(ctx, s.db)
+	if err != nil {
+		return 0, fmt.Errorf("payments: expire pending orders: %w", err)
+	}
+	n, _ := res.RowsAffected()
+	return int(n), nil
+}
+
+// marshalFundSnapshot records what a fund credited (the pack, chips and paid amount) on the ledger
+// row, so history stays independent of later catalog edits (§7/D34).
+func marshalFundSnapshot(productID uuid.UUID, title string, chips int, paid Money) ([]byte, error) {
+	b, err := json.Marshal(struct {
+		ProductID string `json:"product_id"`
+		Title     string `json:"title,omitempty"`
+		Chips     int    `json:"chips"`
+		Amount    int64  `json:"amount_minor"`
+		Currency  string `json:"currency"`
+	}{productID.String(), title, chips, paid.Minor(), string(paid.Currency())})
+	if err != nil {
+		return nil, fmt.Errorf("payments: marshal fund snapshot: %w", err)
+	}
+	return b, nil
+}
+
+// isUniqueViolation reports whether err is a PostgreSQL unique-constraint violation (SQLSTATE
+// 23505) — here, a duplicate provider callback hitting the ledger idempotency index.
+func isUniqueViolation(err error) bool {
+	var pgErr *pgconn.PgError
+	return errors.As(err, &pgErr) && pgErr.Code == "23505"
+}

backend/internal/payments/store_wallet.go

@@ -230,8 +230,11 @@ func applyBenefitTx(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, origin
 	return nil
 }
 
-// insertLedgerTx appends one append-only ledger row inside tx.
+// insertLedgerTx appends one append-only ledger row inside tx. orderID, provider and
-func insertLedgerTx(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, kind string, source, origin *Source, chipsDelta int, productID *uuid.UUID, snapshot []byte, now time.Time) error {
+// providerPaymentID are set only on an intake credit (fund/refund) and are nil for a
+// spend/admin_grant; a non-nil (provider, providerPaymentID) pair is guarded by the partial
+// unique index, so a duplicate provider callback fails here (the idempotency key).
+func insertLedgerTx(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, kind string, source, origin *Source, chipsDelta int, productID, orderID *uuid.UUID, provider, providerPaymentID *string, snapshot []byte, now time.Time) error {
 	id, err := uuid.NewV7()
 	if err != nil {
 		return fmt.Errorf("payments: ledger id: %w", err)
@@ -246,11 +249,13 @@ func insertLedgerTx(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, kind s
 	stmt := table.Ledger.INSERT(
 		table.Ledger.LedgerID, table.Ledger.AccountID, table.Ledger.Kind,
 		table.Ledger.Source, table.Ledger.Origin, table.Ledger.ChipsDelta,
-		table.Ledger.ProductID, table.Ledger.Snapshot, table.Ledger.CreatedAt,
+		table.Ledger.ProductID, table.Ledger.OrderID, table.Ledger.Provider,
+		table.Ledger.ProviderPaymentID, table.Ledger.Snapshot, table.Ledger.CreatedAt,
 	).VALUES(
 		id, accountID, kind,
 		sourceOrNull(source), sourceOrNull(origin), int32(chipsDelta),
-		uuidOrNull(productID), snap, now,
+		uuidOrNull(productID), uuidOrNull(orderID), stringOrNull(provider),
+		stringOrNull(providerPaymentID), snap, now,
 	)
 	if _, err := stmt.ExecContext(ctx, tx); err != nil {
 		return fmt.Errorf("payments: insert %s ledger: %w", kind, err)
@@ -278,7 +283,7 @@ func (s *Store) spend(ctx context.Context, accountID uuid.UUID, draws []sourceAm
 				return ErrInsufficientChips
 			}
 			src := dr.source
-			if err := insertLedgerTx(ctx, tx, accountID, "spend", &src, &origin, -dr.amount, &productID, snapshot, now); err != nil {
+			if err := insertLedgerTx(ctx, tx, accountID, "spend", &src, &origin, -dr.amount, &productID, nil, nil, nil, snapshot, now); err != nil {
 				return err
 			}
 		}
@@ -295,7 +300,7 @@ func (s *Store) spend(ctx context.Context, accountID uuid.UUID, draws []sourceAm
 // the chosen origin, in one transaction — a zero-price sale of a value.
 func (s *Store) grant(ctx context.Context, accountID uuid.UUID, origin Source, d benefitDelta, snapshot []byte, now time.Time) error {
 	err := withTx(ctx, s.db, func(tx *sql.Tx) error {
-		if err := insertLedgerTx(ctx, tx, accountID, "admin_grant", nil, &origin, 0, nil, snapshot, now); err != nil {
+		if err := insertLedgerTx(ctx, tx, accountID, "admin_grant", nil, &origin, 0, nil, nil, nil, nil, snapshot, now); err != nil {
 			return err
 		}
 		return applyBenefitTx(ctx, tx, accountID, origin, d, now)
@@ -419,3 +424,11 @@ func uuidOrNull(id *uuid.UUID) postgres.Expression {
 	}
 	return postgres.UUID(*id)
 }
+
+// stringOrNull renders an optional string as a SQL string or NULL.
+func stringOrNull(s *string) postgres.Expression {
+	if s == nil {
+		return postgres.NULL
+	}
+	return postgres.String(*s)
+}

backend/internal/robokassa/robokassa.go

@@ -0,0 +1,104 @@
+// Package robokassa builds and verifies Robokassa direct-rail (RUB) payments: it forms the signed
+// hosted-payment URL a client is sent to, and verifies the Result-URL server callback that credits
+// an order. It is pure provider glue — no database, no payments-domain coupling — so the payments
+// domain stays provider-agnostic and this layer is unit-testable in isolation.
+//
+// The order is threaded through Robokassa's custom-parameter channel as Shp_order=<order id> (echoed
+// back in the callback and bound into the signature), not the numeric InvId, because an order id is
+// a uuid; InvId is sent as 0. Idempotency is therefore keyed on the order id at the credit site.
+// Signatures use SHA-256 (configured to match the shop's technical settings); the shop's test mode
+// is carried by IsTest.
+package robokassa
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"net/url"
+	"sort"
+	"strings"
+
+	"github.com/google/uuid"
+)
+
+// payEndpoint is Robokassa's hosted payment page; the signed query sends the client there.
+const payEndpoint = "https://auth.robokassa.ru/Merchant/Index.aspx"
+
+// Config is a Robokassa shop's credentials. Password1 signs the outgoing payment request;
+// Password2 signs (and so verifies) the incoming Result callback. IsTest adds IsTest=1 so the shop's
+// test mode simulates payments without money movement.
+type Config struct {
+	MerchantLogin string
+	Password1     string
+	Password2     string
+	IsTest        bool
+}
+
+// PaymentURL builds the signed hosted-payment URL for an order: amount is the OutSum decimal string
+// (roubles, e.g. "149.00"), description is the human payment purpose. The order id rides as
+// Shp_order and is bound into the SHA-256 signature; InvId is 0 (unused).
+func (c Config) PaymentURL(orderID uuid.UUID, amount, description string) string {
+	q := url.Values{}
+	q.Set("Shp_order", orderID.String())
+	// Signature base: MerchantLogin:OutSum:InvId:Password1[:Shp_key=value...sorted].
+	base := c.MerchantLogin + ":" + amount + ":0:" + c.Password1 + shpSuffix(q)
+
+	q.Set("MerchantLogin", c.MerchantLogin)
+	q.Set("OutSum", amount)
+	q.Set("InvId", "0")
+	q.Set("Description", description)
+	q.Set("SignatureValue", sign(base))
+	if c.IsTest {
+		q.Set("IsTest", "1")
+	}
+	return payEndpoint + "?" + q.Encode()
+}
+
+// VerifyResult verifies a Result-URL callback and extracts the order it credits. It recomputes the
+// SHA-256 signature OutSum:InvId:Password2[:Shp_...sorted] over the callback's own fields and
+// compares it (case-insensitively) with SignatureValue. On success it returns the order id (from
+// Shp_order) and the raw OutSum string the caller re-checks against the order amount; on any
+// missing field, a signature mismatch or an unparseable order id it returns ok=false.
+func (c Config) VerifyResult(v url.Values) (orderID uuid.UUID, outSum string, ok bool) {
+	outSum = v.Get("OutSum")
+	sig := v.Get("SignatureValue")
+	order := v.Get("Shp_order")
+	if outSum == "" || sig == "" || order == "" {
+		return uuid.Nil, "", false
+	}
+	// Robokassa signs with the InvId it returns in the callback; recompute with that same value.
+	base := outSum + ":" + v.Get("InvId") + ":" + c.Password2 + shpSuffix(v)
+	if !strings.EqualFold(sign(base), sig) {
+		return uuid.Nil, "", false
+	}
+	id, err := uuid.Parse(order)
+	if err != nil {
+		return uuid.Nil, "", false
+	}
+	return id, outSum, true
+}
+
+// shpSuffix renders the Shp_ custom parameters of v as Robokassa binds them into a signature:
+// every Shp_-prefixed key, sorted alphabetically, appended as ":key=value".
+func shpSuffix(v url.Values) string {
+	var keys []string
+	for k := range v {
+		if strings.HasPrefix(k, "Shp_") {
+			keys = append(keys, k)
+		}
+	}
+	sort.Strings(keys)
+	var b strings.Builder
+	for _, k := range keys {
+		b.WriteString(":")
+		b.WriteString(k)
+		b.WriteString("=")
+		b.WriteString(v.Get(k))
+	}
+	return b.String()
+}
+
+// sign returns the lowercase hex SHA-256 of s, the hash Robokassa compares against SignatureValue.
+func sign(s string) string {
+	sum := sha256.Sum256([]byte(s))
+	return hex.EncodeToString(sum[:])
+}

backend/internal/robokassa/robokassa_test.go

@@ -0,0 +1,85 @@
+package robokassa
+
+import (
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+)
+
+func testCfg() Config {
+	return Config{MerchantLogin: "shop", Password1: "p1", Password2: "p2", IsTest: true}
+}
+
+// resultSig computes the Pass2 Result signature Robokassa would send for a callback carrying only
+// Shp_order — the fixture the verifier must accept.
+func resultSig(pass2, outSum, invID string, orderID uuid.UUID) string {
+	return sign(outSum + ":" + invID + ":" + pass2 + ":Shp_order=" + orderID.String())
+}
+
+func TestPaymentURL(t *testing.T) {
+	cfg := testCfg()
+	id := uuid.New()
+	u, err := url.Parse(cfg.PaymentURL(id, "149.00", "10 chips"))
+	if err != nil {
+		t.Fatalf("parse payment url: %v", err)
+	}
+	q := u.Query()
+	if got := q.Get("OutSum"); got != "149.00" {
+		t.Errorf("OutSum = %q, want 149.00", got)
+	}
+	if got := q.Get("InvId"); got != "0" {
+		t.Errorf("InvId = %q, want 0 (unused)", got)
+	}
+	if got := q.Get("Shp_order"); got != id.String() {
+		t.Errorf("Shp_order = %q, want the order id", got)
+	}
+	if got := q.Get("IsTest"); got != "1" {
+		t.Errorf("IsTest = %q, want 1 (test shop)", got)
+	}
+	want := sign("shop:149.00:0:p1:Shp_order=" + id.String())
+	if got := q.Get("SignatureValue"); got != want {
+		t.Errorf("SignatureValue = %q, want %q", got, want)
+	}
+}
+
+func TestVerifyResult(t *testing.T) {
+	cfg := testCfg()
+	id := uuid.New()
+
+	valid := func() url.Values {
+		v := url.Values{}
+		v.Set("OutSum", "149.00")
+		v.Set("InvId", "0")
+		v.Set("Shp_order", id.String())
+		// Robokassa sends the hash uppercase; the verifier must be case-insensitive.
+		v.Set("SignatureValue", strings.ToUpper(resultSig("p2", "149.00", "0", id)))
+		return v
+	}
+
+	gotID, gotSum, ok := cfg.VerifyResult(valid())
+	if !ok || gotID != id || gotSum != "149.00" {
+		t.Fatalf("VerifyResult(valid) = %v/%q/%v, want %v/149.00/true", gotID, gotSum, ok, id)
+	}
+
+	// A tampered amount breaks the signature.
+	tampered := valid()
+	tampered.Set("OutSum", "1.00")
+	if _, _, ok := cfg.VerifyResult(tampered); ok {
+		t.Error("VerifyResult accepted a tampered amount")
+	}
+
+	// The wrong Password2 (a forged callback) does not verify.
+	wrongPass := Config{MerchantLogin: "shop", Password1: "p1", Password2: "other"}
+	if _, _, ok := wrongPass.VerifyResult(valid()); ok {
+		t.Error("VerifyResult accepted a signature under the wrong password")
+	}
+
+	// A missing Shp_order is rejected (no order to credit).
+	noOrder := valid()
+	noOrder.Del("Shp_order")
+	if _, _, ok := cfg.VerifyResult(noOrder); ok {
+		t.Error("VerifyResult accepted a callback with no order")
+	}
+}

backend/internal/server/handlers.go

@@ -73,6 +73,17 @@ func (s *Server) registerRoutes() {
 		u.GET("/wallet/catalog", s.handleWalletCatalog)
 		u.POST("/wallet/buy", s.handleWalletBuy)
 	}
+	if s.payments != nil {
+		// The money order endpoint dispatches by rail (direct → Robokassa, vk → VK); an
+		// unsupported or unconfigured rail returns 501 from the handler. The provider callbacks are
+		// gateway-only (the single writer): the VK payment callback (both phases handled here), and
+		// the Robokassa Result callback when a merchant is configured.
+		u.POST("/wallet/order", s.handleWalletOrder)
+		s.internal.POST("/payments/vk/callback", s.handleVKCallback)
+		if s.robokassa.MerchantLogin != "" {
+			s.internal.POST("/payments/robokassa/result", s.handleRobokassaResult)
+		}
+	}
 	if s.links != nil {
 		// Account linking & merge. The request step always mails a code;
 		// a required merge is revealed only after the code is verified, and the
@@ -266,6 +277,8 @@ func statusForError(err error) (int, string) {
 		return http.StatusNotFound, "product_not_found"
 	case errors.Is(err, payments.ErrNotAValue):
 		return http.StatusBadRequest, "not_a_value"
+	case errors.Is(err, payments.ErrNotAPack):
+		return http.StatusBadRequest, "not_a_pack"
 	case errors.Is(err, account.ErrInvalidEmail):
 		return http.StatusBadRequest, "invalid_email"
 	case errors.Is(err, account.ErrCodeMismatch), errors.Is(err, account.ErrCodeExpired),

backend/internal/server/handlers_intake.go

@@ -0,0 +1,227 @@
+package server
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/url"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+
+	"scrabble/backend/internal/payments"
+)
+
+// Ledger/order provider tags per rail.
+const (
+	providerRobokassa = "robokassa" // the direct (RUB) rail
+	providerVK        = "vk"        // the VK Votes rail
+)
+
+// walletOrderRequest is the POST body of a chip-pack purchase: the pack to fund.
+type walletOrderRequest struct {
+	ProductID string `json:"product_id"`
+}
+
+// walletOrderResponse returns the created order id and the provider launch URL the client opens.
+type walletOrderResponse struct {
+	OrderID     string `json:"order_id"`
+	RedirectURL string `json:"redirect_url"`
+}
+
+// handleWalletOrder opens a pending order to fund a chip pack and returns the Robokassa
+// hosted-payment URL for the client to open. It is direct-rail only for now (VK/TG land later);
+// it enforces the wallet gate and D36 (a direct purchase requires a confirmed email anchor). No
+// chips are credited here — only later, by the verified Result callback.
+func (s *Server) handleWalletOrder(c *gin.Context) {
+	uid, ok := userID(c)
+	if !ok {
+		return
+	}
+	var req walletOrderRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.AbortWithStatusJSON(http.StatusBadRequest, errorResponse{Error: errorBody{Code: "invalid_request", Message: "invalid request body"}})
+		return
+	}
+	productID, err := uuid.Parse(req.ProductID)
+	if err != nil {
+		c.AbortWithStatusJSON(http.StatusBadRequest, errorResponse{Error: errorBody{Code: "invalid_request", Message: "invalid product id"}})
+		return
+	}
+	ctx := c.Request.Context()
+	cxt, present, err := s.walletGate(ctx, uid)
+	if err != nil {
+		s.abortErr(c, err)
+		return
+	}
+	switch cxt.Kind {
+	case payments.SourceDirect:
+		if s.robokassa.MerchantLogin == "" {
+			c.AbortWithStatusJSON(http.StatusNotImplemented, errorResponse{Error: errorBody{Code: "rail_unavailable", Message: "this payment method is not available"}})
+			return
+		}
+		// D36: a direct purchase requires a confirmed email anchor.
+		hasEmail, err := s.accounts.HasConfirmedEmail(ctx, uid)
+		if err != nil {
+			s.abortErr(c, err)
+			return
+		}
+		if !hasEmail {
+			c.AbortWithStatusJSON(http.StatusForbidden, errorResponse{Error: errorBody{Code: "email_required", Message: "confirm your email before making a purchase"}})
+			return
+		}
+		res, err := s.payments.CreateOrder(ctx, uid, cxt, present, productID, providerRobokassa)
+		if err != nil {
+			s.abortErr(c, err)
+			return
+		}
+		c.JSON(http.StatusOK, walletOrderResponse{
+			OrderID:     res.OrderID.String(),
+			RedirectURL: s.robokassa.PaymentURL(res.OrderID, res.Amount.Major(), res.Title),
+		})
+	case payments.SourceVK:
+		res, err := s.payments.CreateOrder(ctx, uid, cxt, present, productID, providerVK)
+		if err != nil {
+			s.abortErr(c, err)
+			return
+		}
+		// The client passes the order id to VKWebAppShowOrderBox as the item; there is no redirect.
+		c.JSON(http.StatusOK, walletOrderResponse{OrderID: res.OrderID.String()})
+	default:
+		c.AbortWithStatusJSON(http.StatusNotImplemented, errorResponse{Error: errorBody{Code: "rail_unavailable", Message: "this payment method is not available yet"}})
+	}
+}
+
+// handleRobokassaResult is the verified Robokassa Result callback, reached only through the gateway
+// (which forwards the provider's form parameters as a JSON object on the internal, gateway-only
+// route). It verifies the Password2 signature, credits the matched order exactly once (idempotent,
+// and honoured even if the order expired), records a succeeded event, and answers Robokassa's
+// expected "OK<InvId>". A duplicate callback credits nothing but still answers OK.
+func (s *Server) handleRobokassaResult(c *gin.Context) {
+	var params map[string]string
+	if err := c.ShouldBindJSON(&params); err != nil {
+		c.String(http.StatusBadRequest, "bad request")
+		return
+	}
+	v := url.Values{}
+	for k, val := range params {
+		v.Set(k, val)
+	}
+	orderID, outSum, ok := s.robokassa.VerifyResult(v)
+	if !ok {
+		s.log.Warn("robokassa result: bad signature")
+		c.String(http.StatusBadRequest, "bad sign")
+		return
+	}
+	paid, err := payments.ParseMoney(outSum, payments.CurrencyRUB)
+	if err != nil {
+		c.String(http.StatusBadRequest, "bad amount")
+		return
+	}
+	ctx := c.Request.Context()
+	outcome, err := s.payments.Fund(ctx, orderID, providerRobokassa, orderID.String(), paid)
+	if err != nil {
+		if errors.Is(err, payments.ErrOrderNotFound) || errors.Is(err, payments.ErrAmountMismatch) ||
+			errors.Is(err, payments.ErrNotAPack) || errors.Is(err, payments.ErrProductNotFound) {
+			s.log.Warn("robokassa result rejected", zap.String("order", orderID.String()), zap.Error(err))
+			c.String(http.StatusBadRequest, "rejected")
+			return
+		}
+		s.log.Error("robokassa fund failed", zap.String("order", orderID.String()), zap.Error(err))
+		c.String(http.StatusInternalServerError, "error")
+		return
+	}
+	if !outcome.AlreadyCredited {
+		payload, _ := json.Marshal(map[string]any{"chips": outcome.Chips, "source": string(outcome.Source)})
+		if err := s.payments.RecordPaymentEvent(ctx, outcome.AccountID, &orderID, "succeeded", payload); err != nil {
+			s.log.Error("record payment event failed", zap.String("order", orderID.String()), zap.Error(err))
+		}
+	}
+	// The gateway echoes response verbatim to Robokassa, which requires the body "OK<InvId>".
+	c.JSON(http.StatusOK, gin.H{"response": "OK" + v.Get("InvId")})
+}
+
+// vkErrorResponse builds VK's error envelope for a payment callback.
+func vkErrorResponse(code int, msg string, critical bool) gin.H {
+	return gin.H{"error": gin.H{"error_code": code, "error_msg": msg, "critical": critical}}
+}
+
+// handleVKCallback is the VK Mini Apps payment callback, reached only through the gateway (which
+// verifies the VK signature and forwards the provider's parameters as a JSON object on the internal
+// route). It answers VK's two phases: get_item returns the ordered pack's title and vote price; a
+// chargeable order_status_change credits the matched order exactly once (idempotent on VK's order
+// id) and records a succeeded event. Both phases use VK's response envelope; the _test variants are
+// the sandbox notifications and are handled identically.
+func (s *Server) handleVKCallback(c *gin.Context) {
+	var params map[string]string
+	if err := c.ShouldBindJSON(&params); err != nil {
+		c.JSON(http.StatusOK, vkErrorResponse(1, "bad request", true))
+		return
+	}
+	ctx := c.Request.Context()
+	switch params["notification_type"] {
+	case "get_item", "get_item_test":
+		orderID, err := uuid.Parse(params["item"])
+		if err != nil {
+			c.JSON(http.StatusOK, vkErrorResponse(20, "item not available", true))
+			return
+		}
+		title, amount, err := s.payments.OrderItem(ctx, orderID)
+		if err != nil {
+			s.log.Warn("vk get_item lookup failed", zap.String("order", orderID.String()), zap.Error(err))
+			c.JSON(http.StatusOK, vkErrorResponse(20, "item not available", true))
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"response": gin.H{
+			"item_id": orderID.String(),
+			"title":   title,
+			"price":   amount.Minor(),
+		}})
+	case "order_status_change", "order_status_change_test":
+		if params["status"] != "chargeable" {
+			c.JSON(http.StatusOK, vkErrorResponse(100, "unsupported status", false))
+			return
+		}
+		orderID, err := uuid.Parse(params["item"])
+		if err != nil {
+			c.JSON(http.StatusOK, vkErrorResponse(20, "item not available", true))
+			return
+		}
+		price, err := strconv.ParseInt(params["item_price"], 10, 64)
+		if err != nil {
+			c.JSON(http.StatusOK, vkErrorResponse(100, "bad price", false))
+			return
+		}
+		paid, err := payments.MoneyFromMinor(price, payments.CurrencyVote)
+		if err != nil {
+			c.JSON(http.StatusOK, vkErrorResponse(100, "bad price", false))
+			return
+		}
+		vkOrderID := params["order_id"]
+		outcome, err := s.payments.Fund(ctx, orderID, providerVK, vkOrderID, paid)
+		if err != nil {
+			if errors.Is(err, payments.ErrOrderNotFound) || errors.Is(err, payments.ErrAmountMismatch) ||
+				errors.Is(err, payments.ErrNotAPack) || errors.Is(err, payments.ErrProductNotFound) {
+				s.log.Warn("vk order rejected", zap.String("order", orderID.String()), zap.Error(err))
+				c.JSON(http.StatusOK, vkErrorResponse(100, "cannot process the order", false))
+				return
+			}
+			s.log.Error("vk fund failed", zap.String("order", orderID.String()), zap.Error(err))
+			c.JSON(http.StatusOK, vkErrorResponse(100, "internal error", false))
+			return
+		}
+		if !outcome.AlreadyCredited {
+			payload, _ := json.Marshal(map[string]any{"chips": outcome.Chips, "source": string(outcome.Source)})
+			if err := s.payments.RecordPaymentEvent(ctx, outcome.AccountID, &orderID, "succeeded", payload); err != nil {
+				s.log.Error("record vk payment event failed", zap.String("order", orderID.String()), zap.Error(err))
+			}
+		}
+		// Echo VK's own order id; app_order_id is optional and our order id is a uuid, so omit it.
+		appOrderID, _ := strconv.ParseInt(vkOrderID, 10, 64)
+		c.JSON(http.StatusOK, gin.H{"response": gin.H{"order_id": appOrderID}})
+	default:
+		c.JSON(http.StatusOK, vkErrorResponse(100, "unknown notification", false))
+	}
+}

backend/internal/server/server.go

@@ -31,6 +31,7 @@ import (
 	"scrabble/backend/internal/payments"
 	"scrabble/backend/internal/ratewatch"
 	"scrabble/backend/internal/render"
+	"scrabble/backend/internal/robokassa"
 	"scrabble/backend/internal/session"
 	"scrabble/backend/internal/social"
 	"scrabble/backend/internal/telemetry"
@@ -109,6 +110,9 @@ type Deps struct {
 	// Renderer is the image-render sidecar client for the PNG export artifact. A
 	// nil Renderer makes the PNG download answer 404 (the GCG artifact still works).
 	Renderer *render.Client
+	// Robokassa configures the direct-rail (RUB) provider; an empty MerchantLogin leaves the
+	// order and Result-callback endpoints unregistered.
+	Robokassa robokassa.Config
 }
 
 // Server owns the gin engine, the underlying HTTP server and the readiness
@@ -136,6 +140,7 @@ type Server struct {
 	banview     *banview.View
 	ads         *ads.Service
 	payments    *payments.Service
+	robokassa   robokassa.Config
 	notifier    notify.Publisher
 	console     *adminconsole.Renderer
 	exportKey   []byte
@@ -189,6 +194,7 @@ func New(addr string, deps Deps) *Server {
 		banview:       deps.BanView,
 		ads:           deps.Ads,
 		payments:      deps.Payments,
+		robokassa:     deps.Robokassa,
 		notifier:      notifier,
 		renderer:      deps.Renderer,
 		http:          &http.Server{Addr: addr, Handler: engine},

deploy/README.md

@@ -236,6 +236,7 @@ The main host archives Postgres continuously with **pgBackRest** to **Selectel S
 (encrypted at rest, path-style addressing) so the database can be restored to any moment —
 protecting the money ledger and the game state against corruption or host loss. It is the
 primary recovery path; the migration-window `pg_dump` above is the secondary net.
+**Live on the prod main host since v1.13.0** (armed + restore-drilled 2026-07-09).
 
 **Shape.** A daily full **base backup** (a systemd timer on the main host, `04:00`) plus
 **continuous WAL** archived by Postgres `archive_command` (a segment is forced at least every
@@ -258,8 +259,9 @@ absent/NaN-safe, so they stay quiet until archiving is armed.
 `pg_stat_wal`: WAL is generated at **~0.77 MB/day** and the database is **~9.6 MB**. At
 30-day retention on Selectel S3 (~2 ₽/GB·month) the archive is **under ~0.3 GB → well under
 1 ₽/month** (compression halves it again); request volume is trivial. Performance impact is
-**negligible**: archive-push moves tiny compressed segments, and the daily full base backup
+**negligible**: archive-push moves tiny compressed segments, and the daily full base backup is
-is a ~10 MB, sub-second job on the 2 vCPU host. Revisit both if traffic grows ~100× (watch
+small (the whole cluster is ~32 MB → ~3.7 MB compressed in the repo) and checkpoint-bound
+(~1.5 min wall, minimal CPU/I-O) on the 2 vCPU host. Revisit if traffic grows ~100× (watch
 `node_exporter` during a base backup).
 
 **Arming (owner-coordinated, once, before real payments).** Ships disarmed; to turn it on:
@@ -276,14 +278,22 @@ is a ~10 MB, sub-second job on the 2 vCPU host. Revisit both if traffic grows ~1
 2. Promote `development → master`, tag, and run **prod-deploy**. The roll recreates postgres
    with `archive_mode=on` behind the maintenance page. (Archive pushes fail harmlessly for the
    minute until step 3 creates the repository — the WAL is retained, not lost.)
-3. On the main host, create the repository, take the first base backup, and verify:
+3. On the main host, create the repository, verify archiving, take the first base backup. Run
+   pgBackRest **as the `postgres` OS user** (`-u postgres` — lock-dir/PGDATA consistency with
+   `archive-push`) and connect to the DB **as the superuser role** (`--pg1-user=scrabble`, the
+   `POSTGRES_USER`, not `postgres`); it inherits the container's `PGBACKREST_*` env:
    ```sh
-   docker exec scrabble-postgres pgbackrest --stanza=scrabble stanza-create
+   docker exec -u postgres scrabble-postgres pgbackrest --stanza=scrabble --pg1-user=scrabble stanza-create
-   docker exec scrabble-postgres pgbackrest --stanza=scrabble --type=full backup
+   docker exec -u postgres scrabble-postgres pgbackrest --stanza=scrabble --pg1-user=scrabble check
-   docker exec scrabble-postgres pgbackrest --stanza=scrabble check
+   docker exec -u postgres scrabble-postgres pgbackrest --stanza=scrabble --pg1-user=scrabble --type=full backup
+   docker exec -u postgres scrabble-postgres pgbackrest --stanza=scrabble info   # (info takes no --pg1-user)
    ```
-4. Enable the daily timer: `ansible-playbook site.yml -e pitr_enabled=true` (installs + starts
+   The few `archive-push` failures logged between `archive_mode=on` and `stanza-create` are the
-   `pgbackrest-backup.timer` on the main host).
+   expected transient (WAL retained, not lost); clear the counter afterwards with
+   `docker exec -u postgres scrabble-postgres psql -U scrabble -d scrabble -c "SELECT pg_stat_reset_shared('archiver');"`
+   so it does not trip the failing-archive alert.
+4. Enable the daily timer: `ansible-playbook site.yml --limit main -e pitr_enabled=true`
+   (installs + starts `pgbackrest-backup.timer` on the main host).
 5. Confirm in Grafana that the two archiving alerts are green (`last_archive_age` now tracks a
    real number, `failed_count` flat).
 
@@ -292,17 +302,26 @@ an **isolated, one-shot** target (a throwaway VM or a container with no ingress)
 the matching Postgres major, an empty `PGDATA`, and the same `PGBACKREST_*` environment:
 
 ```sh
-pgbackrest --stanza=scrabble --type=time "--target=YYYY-MM-DD HH:MM:SS+00" --delta restore
+# Throwaway container from the DB image (carries pgBackRest), the live PGBACKREST_* env, an
-# start Postgres; it replays WAL to the target; then verify a known row / the ledger tail
+# empty PGDATA and no app network; restore, recover, verify, then wipe (-v drops the data).
+IMG=$(docker inspect -f '{{.Config.Image}}' scrabble-postgres)
+docker exec scrabble-postgres env | grep '^PGBACKREST_' > /tmp/drill.env; echo POSTGRES_PASSWORD=drill >> /tmp/drill.env
+docker run -d --name pitr-drill --env-file /tmp/drill.env --entrypoint sleep "$IMG" infinity
+docker exec pitr-drill sh -c 'rm -rf /var/lib/postgresql/data/*; chown -R postgres:postgres /var/lib/postgresql/data; chmod 700 /var/lib/postgresql/data'
+# --type=immediate = to the base backup's consistency point; --type=time "--target=<ts>" for PITR
+docker exec -u postgres pitr-drill pgbackrest --stanza=scrabble --pg1-path=/var/lib/postgresql/data --type=immediate restore
+docker exec -u postgres pitr-drill pg_ctl -D /var/lib/postgresql/data -w start
+docker exec -u postgres pitr-drill psql -U scrabble -d scrabble -c "SELECT count(*) FROM backend.accounts;"  # verify data intact
+docker rm -fv pitr-drill; rm -f /tmp/drill.env   # wipe the restored real data
 ```
 
 The target holds **real money + personal data** while it exists — keep it network-isolated and
 **destroy it (wipe `PGDATA` + the instance) afterwards**. Record each drill (date, target
 timestamp, outcome) here:
 
-| Date | Target timestamp | Result |
+| Date | Target | Result |
 | --- | --- | --- |
-| _pending first arming_ | — | — |
+| 2026-07-09 | latest (`--type=immediate`) | PASS — v1.13.0 arming: 31.9 MB cluster restored from the encrypted S3 repo (3.7 MB compressed), recovered to consistency, `backend.accounts` intact; drill instance wiped. |
 
 **bot-link cert rotation:** regenerate (`deploy/gen-certs.sh /tmp/c --force`), reset the
 five `PROD_BOTLINK_*` secrets from `/tmp/c`, and re-run the workflow — both hosts redeploy

deploy/ansible/roles/main/templates/pgbackrest-backup.service.j2

@@ -10,6 +10,8 @@ Requires=docker.service
 
 [Service]
 Type=oneshot
-# docker exec runs as the image's postgres user and inherits the container's PGBACKREST_*
+# docker exec defaults to root, so run as the postgres OS user (-u postgres) for lock-dir and
-# environment (the S3 repository + cipher), so no repository config is needed on the host.
+# PGDATA consistency with archive-push, and connect to the database as the superuser role via
-ExecStart=/usr/bin/docker exec scrabble-postgres pgbackrest --stanza=scrabble --type=full backup
+# --pg1-user: that role is the POSTGRES_USER (scrabble), not "postgres". It inherits the
+# container's PGBACKREST_* environment (the S3 repository + cipher), so no host-side config.
+ExecStart=/usr/bin/docker exec -u postgres scrabble-postgres pgbackrest --stanza=scrabble --pg1-user=scrabble --type=full backup

deploy/caddy/Caddyfile

@@ -86,7 +86,7 @@
 	# The game SPA and the Connect edge are served by the gateway. Strip any
 	# client-supplied X-Scrabble-Honeypot here so the gateway only ever honours the
 	# tag the honeypot block sets below (a client cannot self-tag a real request).
-	@gateway path /app /app/* /telegram /telegram/* /vk /vk/* /dict/* /dl/* /metrics/* /telemetry/* /scrabble.edge.v1.Gateway/*
+	@gateway path /app /app/* /telegram /telegram/* /vk /vk/* /dict/* /dl/* /pay/* /metrics/* /telemetry/* /scrabble.edge.v1.Gateway/*
 	handle @gateway {
 		reverse_proxy gateway:8081 {
 			header_up -X-Scrabble-Honeypot

deploy/docker-compose.yml

@@ -161,6 +161,13 @@ services:
       # recipient(s) (comma-separated allowed). Both empty disables the alert worker.
       BACKEND_SMTP_ADMIN_FROM: ${SMTP_RELAY_ADMIN_FROM:-}
       BACKEND_ADMIN_EMAIL: ${ADMIN_EMAIL:-}
+      # Direct-rail (Robokassa) payment intake: the merchant login + Password1/Password2 and the
+      # test-mode flag (deploy env: TEST_/PROD_BACKEND_ROBOKASSA_*). An empty login leaves the
+      # direct order and Result-callback endpoints unregistered (the rail is off).
+      BACKEND_ROBOKASSA_MERCHANT_LOGIN: ${ROBOKASSA_MERCHANT_LOGIN:-}
+      BACKEND_ROBOKASSA_PASSWORD1: ${ROBOKASSA_PASSWORD1:-}
+      BACKEND_ROBOKASSA_PASSWORD2: ${ROBOKASSA_PASSWORD2:-}
+      BACKEND_ROBOKASSA_TEST: ${ROBOKASSA_TEST:-}
     # The dictionary lives on a named volume seeded from the image on first boot
     # (the image's /opt/dawg is owned by the nonroot UID, which the fresh volume
     # inherits). The admin console writes new version subdirectories here, and the

deploy/landing/Caddyfile

@@ -18,10 +18,25 @@
 	@shell not path /assets/*
 	header @shell Cache-Control "no-cache"
 
+	# The static public offer page, rendered from ui/legal/offer_ru.md at build
+	# time into dist/offer/index.html (vite emit-offer plugin). Served with its own
+	# index so /offer/ resolves to /srv/offer/index.html rather than falling to the
+	# landing shell below (whose index is landing.html). A bare /offer redirects in.
+	handle /offer {
+		redir * /offer/ permanent
+	}
+	handle /offer/* {
+		file_server {
+			index index.html
+		}
+	}
+
 	# An unknown path falls back to the landing shell (the gateway's old "/"
 	# behaviour); "/" itself resolves through the index below.
-	try_files {path} /landing.html
+	handle {
-	file_server {
+		try_files {path} /landing.html
-		index landing.html
+		file_server {
+			index landing.html
+		}
 	}
 }

docs/ARCHITECTURE.md

@@ -1328,7 +1328,8 @@ in-compose **caddy** is the contour's edge: it owns a single `/_gm` Basic-Auth a
 routes `/_gm/grafana/*` to **Grafana** (anonymous-admin, so the one shared login gates
 it with no per-user Grafana accounts) and the rest of `/_gm/*` to the backend-rendered
 **admin console**; `/app/`, `/telegram/`, `/vk/` and the Connect path go to the gateway; the
-catch-all — notably the landing at `/` — goes to the landing container. The
+catch-all — notably the landing at `/`, plus the static public offer at `/offer/`
+(rendered from `ui/legal/offer_ru.md` at build time) — goes to the landing container. The
 **Telegram validator** runs as a separate container with **no public ingress**,
 answering only internal gRPC (HMAC, no Telegram egress). The **Telegram bot** holds
 no inbound port either: it dials the gateway's **bot-link** (mTLS) and egresses to

gateway/cmd/gateway/main.go

@@ -208,6 +208,7 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		Tracker:      tracker,
 		Banlist:      banlist,
 		Honeytoken:   cfg.Abuse.Honeytoken,
+		VKAppSecret:  cfg.VKAppSecret,
 		Hub:          hub,
 		RateLimit:    cfg.RateLimit,
 		Heartbeat:    cfg.PushHeartbeatInterval,

gateway/internal/backendclient/api.go

@@ -396,6 +396,48 @@ func (c *Client) WalletBuy(ctx context.Context, userID, productID string) (Walle
 	return out, err
 }
 
+// walletOrderBody is the POST body of an order: the chip pack to fund.
+type walletOrderBody struct {
+	ProductID string `json:"product_id"`
+}
+
+// WalletOrderResp is a created order: its id and the provider launch URL the client opens.
+type WalletOrderResp struct {
+	OrderID     string `json:"order_id"`
+	RedirectURL string `json:"redirect_url"`
+}
+
+// WalletOrder opens a pending order to fund a chip pack and returns the provider launch URL.
+func (c *Client) WalletOrder(ctx context.Context, userID, productID string) (WalletOrderResp, error) {
+	var out WalletOrderResp
+	err := c.do(ctx, http.MethodPost, "/api/v1/user/wallet/order", userID, "", walletOrderBody{ProductID: productID}, &out)
+	return out, err
+}
+
+// robokassaResultResp is the backend intake's reply: the body to echo back to Robokassa.
+type robokassaResultResp struct {
+	Response string `json:"response"`
+}
+
+// RobokassaResult forwards a Robokassa Result callback's parameters to the backend intake (the
+// single writer, which verifies the signature and credits) and returns the body to echo to
+// Robokassa ("OK<InvId>"). params carries the provider's raw form fields.
+func (c *Client) RobokassaResult(ctx context.Context, params map[string]string) (string, error) {
+	var out robokassaResultResp
+	err := c.do(ctx, http.MethodPost, "/api/v1/internal/payments/robokassa/result", "", "", params, &out)
+	return out.Response, err
+}
+
+// VKCallback forwards a gateway-verified VK payment callback's parameters to the backend intake and
+// returns the backend's raw VK response envelope (`{"response":…}` or `{"error":…}`) for the gateway
+// to relay to VK verbatim. The backend answers 200 in every case (VK's protocol), so a transport
+// error here is a genuine proxy failure.
+func (c *Client) VKCallback(ctx context.Context, params map[string]string) (json.RawMessage, error) {
+	var out json.RawMessage
+	err := c.do(ctx, http.MethodPost, "/api/v1/internal/payments/vk/callback", "", "", params, &out)
+	return out, err
+}
+
 // CatalogAtomResp is one atom line of a storefront product: the value type it grants and quantity.
 type CatalogAtomResp struct {
 	AtomType string `json:"atom_type"`

gateway/internal/connectsrv/server.go

@@ -31,6 +31,7 @@ import (
 	"scrabble/gateway/internal/ratelimit"
 	"scrabble/gateway/internal/session"
 	"scrabble/gateway/internal/transcode"
+	"scrabble/gateway/internal/vkpay"
 	"scrabble/gateway/internal/webui"
 	edgev1 "scrabble/gateway/proto/edge/v1"
 	"scrabble/gateway/proto/edge/v1/edgev1connect"
@@ -70,18 +71,19 @@ const (
 
 // Server implements edgev1connect.GatewayHandler.
 type Server struct {
-	registry   *transcode.Registry
+	registry    *transcode.Registry
-	sessions   *session.Cache
+	sessions    *session.Cache
-	backend    *backendclient.Client
+	backend     *backendclient.Client
-	limiter    *ratelimit.Limiter
+	limiter     *ratelimit.Limiter
-	tracker    *ratelimit.Tracker
+	tracker     *ratelimit.Tracker
-	banlist    *ratelimit.Banlist
+	banlist     *ratelimit.Banlist
-	honeytoken string
+	honeytoken  string
-	hub        *push.Hub
+	vkAppSecret string
-	heartbeat  time.Duration
+	hub         *push.Hub
-	log        *zap.Logger
+	heartbeat   time.Duration
-	adminProxy http.Handler
+	log         *zap.Logger
-	metrics    *serverMetrics
+	adminProxy  http.Handler
+	metrics     *serverMetrics
 
 	maxBodyBytes int
 
@@ -110,12 +112,15 @@ type Deps struct {
 	// Honeytoken, when non-empty, is the planted bearer value whose presentation
 	// bans the caller and raises a high-severity alarm.
 	Honeytoken string
-	Hub        *push.Hub
+	// VKAppSecret is the VK Mini App protected key; it verifies the VK payment callback signature
-	RateLimit  config.RateLimitConfig
+	// (the same key the launch-signature auth uses). Empty leaves the VK callback rejecting.
-	Heartbeat  time.Duration
+	VKAppSecret string
-	Logger     *zap.Logger
+	Hub         *push.Hub
-	AdminProxy http.Handler
+	RateLimit   config.RateLimitConfig
-	Meter      metric.Meter
+	Heartbeat   time.Duration
+	Logger      *zap.Logger
+	AdminProxy  http.Handler
+	Meter       metric.Meter
 	// MaxBodyBytes caps one inbound request body and one Connect message read;
 	// zero or negative selects config.DefaultMaxBodyBytes.
 	MaxBodyBytes int
@@ -151,6 +156,7 @@ func NewServer(d Deps) *Server {
 		registry:     d.Registry,
 		sessions:     d.Sessions,
 		backend:      d.Backend,
+		vkAppSecret:  d.VKAppSecret,
 		limiter:      limiter,
 		tracker:      tracker,
 		banlist:      banlist,
@@ -196,6 +202,12 @@ func (s *Server) HTTPHandler() http.Handler {
 	// through this session-gated route (not public); see dictBytesHandler.
 	mux.Handle("/dict/", s.dictBytesHandler())
 	mux.Handle("/dl/", s.exportDownloadHandler())
+	// Direct-rail (Robokassa) return + callback routes: the server Result callback (the single
+	// crediting signal, proxied to the backend intake) and the browser Success/Fail redirects.
+	mux.Handle("/pay/robokassa/result", s.robokassaResultHandler())
+	mux.Handle("/pay/vk/callback", s.vkCallbackHandler())
+	mux.Handle("/pay/robokassa/success", s.robokassaReturnHandler("Оплата принята."))
+	mux.Handle("/pay/robokassa/fail", s.robokassaReturnHandler("Оплата не завершена."))
 	// The client posts its local-move-preview adoption telemetry here (session-gated).
 	mux.Handle("/metrics/local-eval", s.localEvalMetricsHandler())
 	// The index.html boot guard beacons here when it turns a client away on the unsupported-engine
@@ -482,6 +494,102 @@ func (s *Server) exportDownloadHandler() http.Handler {
 	})
 }
 
+// robokassaResultHandler proxies the Robokassa Result callback to the backend intake (the single
+// writer). It rate-limits per IP, forwards the provider's form parameters, and echoes the backend's
+// "OK<InvId>" to Robokassa on success; any error tells Robokassa the notification was not accepted,
+// so it retries. The gateway does not verify the signature — the backend holds the secret.
+func (s *Server) robokassaResultHandler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if s.backend == nil {
+			http.NotFound(w, r)
+			return
+		}
+		ip := peerIP(r.RemoteAddr, r.Header)
+		if !s.limiter.Allow("public:"+ip, s.publicPolicy) {
+			s.noteRateLimited(r.Context(), classPublic, ip, "robokassa-result")
+			http.Error(w, "rate limited", http.StatusTooManyRequests)
+			return
+		}
+		if err := r.ParseForm(); err != nil {
+			http.Error(w, "bad request", http.StatusBadRequest)
+			return
+		}
+		params := make(map[string]string, len(r.Form))
+		for k := range r.Form {
+			params[k] = r.Form.Get(k)
+		}
+		resp, err := s.backend.RobokassaResult(r.Context(), params)
+		if err != nil {
+			s.log.Warn("robokassa result proxy failed", zap.Error(err))
+			http.Error(w, "not accepted", http.StatusBadGateway)
+			return
+		}
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		_, _ = w.Write([]byte(resp))
+	})
+}
+
+// vkCallbackHandler proxies a VK Mini Apps payment callback to the backend intake. It rate-limits
+// per IP, verifies the VK signature with the app's protected key (the backend holds no VK secret),
+// forwards the provider's parameters, and relays the backend's VK response envelope. A missing or
+// bad signature is rejected before reaching the backend.
+func (s *Server) vkCallbackHandler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if s.backend == nil {
+			http.NotFound(w, r)
+			return
+		}
+		ip := peerIP(r.RemoteAddr, r.Header)
+		if !s.limiter.Allow("public:"+ip, s.publicPolicy) {
+			s.noteRateLimited(r.Context(), classPublic, ip, "vk-callback")
+			http.Error(w, "rate limited", http.StatusTooManyRequests)
+			return
+		}
+		if err := r.ParseForm(); err != nil {
+			http.Error(w, "bad request", http.StatusBadRequest)
+			return
+		}
+		params := make(map[string]string, len(r.Form))
+		for k := range r.Form {
+			params[k] = r.Form.Get(k)
+		}
+		if !vkpay.Verify(params, s.vkAppSecret) {
+			s.log.Warn("vk callback: bad signature")
+			http.Error(w, "bad signature", http.StatusForbidden)
+			return
+		}
+		resp, err := s.backend.VKCallback(r.Context(), params)
+		if err != nil {
+			s.log.Warn("vk callback proxy failed", zap.Error(err))
+			http.Error(w, "bad gateway", http.StatusBadGateway)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		_, _ = w.Write(resp)
+	})
+}
+
+// robokassaReturnHandler serves a minimal self-closing page for Robokassa's Success/Fail browser
+// return. The payment opens in a separate window, so on return this closes that window and drops the
+// customer back into the live app (never a cold app start); a link is the fallback if the window
+// cannot self-close. The credit rides the server Result callback, never this redirect — the wallet
+// updates in place from the payment push, with a return-focus refetch as the fallback.
+func (s *Server) robokassaReturnHandler(message string) http.Handler {
+	page := []byte(`<!doctype html>
+<html lang="ru"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Оплата</title></head>
+<body style="font-family: system-ui, sans-serif; text-align: center; padding: 48px 20px; color: #1a1c20">
+<p style="font-size: 1.1rem">` + message + `</p>
+<p style="color: #5b6472">Можно закрыть это окно и вернуться в приложение.</p>
+<p><a href="/app/">Открыть приложение</a></p>
+<script>setTimeout(function () { try { window.close(); } catch (e) {} }, 1200);</script>
+</body></html>`)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.Header().Set("Cache-Control", "no-store")
+		_, _ = w.Write(page)
+	})
+}
+
 func (s *Server) dictBytesHandler() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if s.backend == nil {

gateway/internal/transcode/encode.go

@@ -37,6 +37,19 @@ func encodeAck(ok bool) []byte {
 	return b.FinishedBytes()
 }
 
+// encodeWalletOrder builds a WalletOrderResponse payload: the created order id and the provider
+// launch URL the client opens.
+func encodeWalletOrder(o backendclient.WalletOrderResp) []byte {
+	b := flatbuffers.NewBuilder(128)
+	oid := b.CreateString(o.OrderID)
+	url := b.CreateString(o.RedirectURL)
+	fb.WalletOrderResponseStart(b)
+	fb.WalletOrderResponseAddOrderId(b, oid)
+	fb.WalletOrderResponseAddRedirectUrl(b, url)
+	b.Finish(fb.WalletOrderResponseEnd(b))
+	return b.FinishedBytes()
+}
+
 // encodeDeleteRequestResult builds an AccountDeleteRequestResult payload reporting which
 // deletion step-up the account uses ("email" | "phrase").
 func encodeDeleteRequestResult(method string) []byte {

gateway/internal/transcode/transcode.go

@@ -55,6 +55,7 @@ const (
 	MsgWalletGet            = "wallet.get"
 	MsgWalletCatalog        = "wallet.catalog"
 	MsgWalletBuy            = "wallet.buy"
+	MsgWalletOrder          = "wallet.order"
 )
 
 // Request is one decoded Execute call.
@@ -111,6 +112,7 @@ func NewRegistry(backend *backendclient.Client, tg TelegramValidator, opts ...Op
 	r.ops[MsgWalletGet] = Op{Handler: walletHandler(backend), Auth: true}
 	r.ops[MsgWalletCatalog] = Op{Handler: walletCatalogHandler(backend), Auth: true}
 	r.ops[MsgWalletBuy] = Op{Handler: walletBuyHandler(backend), Auth: true}
+	r.ops[MsgWalletOrder] = Op{Handler: walletOrderHandler(backend), Auth: true}
 	r.ops[MsgBlockStatus] = Op{Handler: blockStatusHandler(backend), Auth: true}
 	r.ops[MsgGameSubmitPlay] = Op{Handler: submitPlayHandler(backend), Auth: true}
 	r.ops[MsgGameState] = Op{Handler: gameStateHandler(backend), Auth: true}
@@ -331,6 +333,17 @@ func walletBuyHandler(backend *backendclient.Client) Handler {
 	}
 }
 
+func walletOrderHandler(backend *backendclient.Client) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		in := fb.GetRootAsWalletOrderRequest(req.Payload, 0)
+		o, err := backend.WalletOrder(ctx, req.UserID, string(in.ProductId()))
+		if err != nil {
+			return nil, err
+		}
+		return encodeWalletOrder(o), nil
+	}
+}
+
 func blockStatusHandler(backend *backendclient.Client) Handler {
 	return func(ctx context.Context, req Request) ([]byte, error) {
 		bs, err := backend.BlockStatus(ctx, req.UserID)

gateway/internal/vkpay/vkpay.go

@@ -0,0 +1,40 @@
+// Package vkpay verifies VK Mini Apps payment ("голоса") callback signatures. VK signs each
+// payment notification (get_item / order_status_change) and expects the receiving server to verify
+// it with the app's secret before acting. The signature is MD5 — mandated by VK's payment protocol,
+// not a security choice on our part — so this package uses crypto/md5 deliberately.
+package vkpay
+
+import (
+	"crypto/md5"
+	"encoding/hex"
+	"sort"
+	"strings"
+)
+
+// Verify reports whether params carry a valid VK payment signature under secret. VK computes the
+// signature as the MD5 of the sig-excluded parameters, sorted alphabetically by name and
+// concatenated as key=value with no separators, with the app secret appended. The comparison is
+// case-insensitive over the hex digest.
+func Verify(params map[string]string, secret string) bool {
+	got := params["sig"]
+	if got == "" || secret == "" {
+		return false
+	}
+	keys := make([]string, 0, len(params))
+	for k := range params {
+		if k == "sig" {
+			continue
+		}
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	var b strings.Builder
+	for _, k := range keys {
+		b.WriteString(k)
+		b.WriteString("=")
+		b.WriteString(params[k])
+	}
+	b.WriteString(secret)
+	sum := md5.Sum([]byte(b.String()))
+	return strings.EqualFold(hex.EncodeToString(sum[:]), got)
+}

gateway/internal/vkpay/vkpay_test.go

@@ -0,0 +1,74 @@
+package vkpay
+
+import (
+	"crypto/md5"
+	"encoding/hex"
+	"maps"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// vkSig computes a valid VK signature the way VK does, for the fixtures (sig excluded, sorted
+// key=value concatenation, secret appended, MD5 hex).
+func vkSig(params map[string]string, secret string) string {
+	keys := make([]string, 0, len(params))
+	for k := range params {
+		if k == "sig" {
+			continue
+		}
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	var b strings.Builder
+	for _, k := range keys {
+		b.WriteString(k + "=" + params[k])
+	}
+	b.WriteString(secret)
+	sum := md5.Sum([]byte(b.String()))
+	return hex.EncodeToString(sum[:])
+}
+
+func clone(m map[string]string) map[string]string {
+	out := make(map[string]string, len(m))
+	maps.Copy(out, m)
+	return out
+}
+
+func TestVerify(t *testing.T) {
+	const secret = "app_secret"
+	base := map[string]string{
+		"notification_type": "order_status_change",
+		"app_id":            "123",
+		"user_id":           "456",
+		"receiver_id":       "456",
+		"order_id":          "789",
+		"date":              "1700000000",
+		"status":            "chargeable",
+		"item":              "019f47a0-6f9e-7000-8000-000000000000",
+		"item_price":        "10",
+	}
+	valid := clone(base)
+	// VK sends the digest uppercase; the verifier must accept it case-insensitively.
+	valid["sig"] = strings.ToUpper(vkSig(base, secret))
+
+	if !Verify(valid, secret) {
+		t.Fatal("valid VK signature rejected")
+	}
+
+	tampered := clone(valid)
+	tampered["item_price"] = "1"
+	if Verify(tampered, secret) {
+		t.Error("accepted a tampered amount")
+	}
+
+	if Verify(valid, "wrong-secret") {
+		t.Error("accepted under the wrong secret")
+	}
+
+	noSig := clone(valid)
+	delete(noSig, "sig")
+	if Verify(noSig, secret) {
+		t.Error("accepted a callback with no signature")
+	}
+}

pkg/fbs/scrabble.fbs

@@ -873,6 +873,18 @@ table WalletBuyRequest {
   product_id:string;
 }
 
+// WalletOrderRequest opens a money order to fund a chip pack: the pack to buy.
+table WalletOrderRequest {
+  product_id:string;
+}
+
+// WalletOrderResponse returns the created order id and the provider launch URL the client opens
+// (the Robokassa hosted-payment page); chips are credited later, by the verified server callback.
+table WalletOrderResponse {
+  order_id:string;
+  redirect_url:string;
+}
+
 // CatalogAtom is one atom line of a storefront product: the base value type it grants
 // ("chips"/"hints"/"noads_days"/"tournament") and how many of it the product carries.
 table CatalogAtom {

pkg/fbs/scrabblefb/WalletOrderRequest.go

@@ -0,0 +1,60 @@
+// Code generated by the FlatBuffers compiler. DO NOT EDIT.
+
+package scrabblefb
+
+import (
+	flatbuffers "github.com/google/flatbuffers/go"
+)
+
+type WalletOrderRequest struct {
+	_tab flatbuffers.Table
+}
+
+func GetRootAsWalletOrderRequest(buf []byte, offset flatbuffers.UOffsetT) *WalletOrderRequest {
+	n := flatbuffers.GetUOffsetT(buf[offset:])
+	x := &WalletOrderRequest{}
+	x.Init(buf, n+offset)
+	return x
+}
+
+func FinishWalletOrderRequestBuffer(builder *flatbuffers.Builder, offset flatbuffers.UOffsetT) {
+	builder.Finish(offset)
+}
+
+func GetSizePrefixedRootAsWalletOrderRequest(buf []byte, offset flatbuffers.UOffsetT) *WalletOrderRequest {
+	n := flatbuffers.GetUOffsetT(buf[offset+flatbuffers.SizeUint32:])
+	x := &WalletOrderRequest{}
+	x.Init(buf, n+offset+flatbuffers.SizeUint32)
+	return x
+}
+
+func FinishSizePrefixedWalletOrderRequestBuffer(builder *flatbuffers.Builder, offset flatbuffers.UOffsetT) {
+	builder.FinishSizePrefixed(offset)
+}
+
+func (rcv *WalletOrderRequest) Init(buf []byte, i flatbuffers.UOffsetT) {
+	rcv._tab.Bytes = buf
+	rcv._tab.Pos = i
+}
+
+func (rcv *WalletOrderRequest) Table() flatbuffers.Table {
+	return rcv._tab
+}
+
+func (rcv *WalletOrderRequest) ProductId() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(4))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func WalletOrderRequestStart(builder *flatbuffers.Builder) {
+	builder.StartObject(1)
+}
+func WalletOrderRequestAddProductId(builder *flatbuffers.Builder, productId flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(productId), 0)
+}
+func WalletOrderRequestEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
+	return builder.EndObject()
+}

pkg/fbs/scrabblefb/WalletOrderResponse.go

@@ -0,0 +1,71 @@
+// Code generated by the FlatBuffers compiler. DO NOT EDIT.
+
+package scrabblefb
+
+import (
+	flatbuffers "github.com/google/flatbuffers/go"
+)
+
+type WalletOrderResponse struct {
+	_tab flatbuffers.Table
+}
+
+func GetRootAsWalletOrderResponse(buf []byte, offset flatbuffers.UOffsetT) *WalletOrderResponse {
+	n := flatbuffers.GetUOffsetT(buf[offset:])
+	x := &WalletOrderResponse{}
+	x.Init(buf, n+offset)
+	return x
+}
+
+func FinishWalletOrderResponseBuffer(builder *flatbuffers.Builder, offset flatbuffers.UOffsetT) {
+	builder.Finish(offset)
+}
+
+func GetSizePrefixedRootAsWalletOrderResponse(buf []byte, offset flatbuffers.UOffsetT) *WalletOrderResponse {
+	n := flatbuffers.GetUOffsetT(buf[offset+flatbuffers.SizeUint32:])
+	x := &WalletOrderResponse{}
+	x.Init(buf, n+offset+flatbuffers.SizeUint32)
+	return x
+}
+
+func FinishSizePrefixedWalletOrderResponseBuffer(builder *flatbuffers.Builder, offset flatbuffers.UOffsetT) {
+	builder.FinishSizePrefixed(offset)
+}
+
+func (rcv *WalletOrderResponse) Init(buf []byte, i flatbuffers.UOffsetT) {
+	rcv._tab.Bytes = buf
+	rcv._tab.Pos = i
+}
+
+func (rcv *WalletOrderResponse) Table() flatbuffers.Table {
+	return rcv._tab
+}
+
+func (rcv *WalletOrderResponse) OrderId() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(4))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *WalletOrderResponse) RedirectUrl() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(6))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func WalletOrderResponseStart(builder *flatbuffers.Builder) {
+	builder.StartObject(2)
+}
+func WalletOrderResponseAddOrderId(builder *flatbuffers.Builder, orderId flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(orderId), 0)
+}
+func WalletOrderResponseAddRedirectUrl(builder *flatbuffers.Builder, redirectUrl flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(1, flatbuffers.UOffsetT(redirectUrl), 0)
+}
+func WalletOrderResponseEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
+	return builder.EndObject()
+}

ui/e2e/landing.spec.ts

@@ -58,3 +58,14 @@ test('the landing shows a web-version entry linking /app/, with a caption', asyn
   expect(await web.getAttribute('href')).toContain('/app/');
   await expect(page.getByText('Веб-версия')).toBeVisible();
 });
+
+// The footer carries a public-offer link to the static /offer/ page (rendered from
+// ui/legal/offer_ru.md at build; the legal document a purchase accepts).
+test('the landing footer links to the public offer at /offer/', async ({ page }) => {
+  await page.goto('/landing.html');
+  await expect(page.getByText(/Играй в «Эрудита»/)).toBeVisible(); // Russian by default
+
+  const offer = page.getByRole('link', { name: 'Публичная оферта' });
+  await expect(offer).toBeVisible();
+  expect(await offer.getAttribute('href')).toBe('/offer/');
+});

ui/e2e/wallet.spec.ts

@@ -37,8 +37,27 @@ test('wallet: balances, benefits and the storefront render for a durable account
   await expect(page.getByTestId('product')).toHaveCount(3);
   const pack = page.locator('[data-kind="pack"]');
   await expect(pack).toContainText('₽');
-  // The pack purchase (money intake) is not wired yet, so its action is the disabled 'Soon'.
+  // The pack purchase is wired to money intake: an enabled Buy action, with the public-offer link.
-  await expect(pack.getByRole('button', { name: 'Soon' })).toBeDisabled();
+  await expect(pack.getByTestId('buy-pack')).toBeEnabled();
+  await expect(page.getByTestId('offer')).toContainText('Public offer');
+});
+
+test('wallet: buying a chip pack opens the provider payment page', async ({ page }) => {
+  await loginLobby(page);
+  await openWallet(page);
+
+  // The purchase opens the provider's hosted-payment page in a new tab (window.open); capture it.
+  await page.evaluate(() => {
+    (window as { __opened?: string }).__opened = '';
+    window.open = ((u: string) => {
+      (window as { __opened?: string }).__opened = u;
+      return null;
+    }) as typeof window.open;
+  });
+  await page.locator('[data-kind="pack"]').getByTestId('buy-pack').click();
+  await expect
+    .poll(() => page.evaluate(() => (window as { __opened?: string }).__opened))
+    .toContain('robokassa');
 });
 
 test('wallet: the tab sits between Friends and About', async ({ page }) => {

ui/legal/offer_ru.md

@@ -0,0 +1,145 @@
+# Публичная оферта
+
+Публичная оферта о заключении договора купли-продажи.
+
+## 1. Общие положения
+
+В настоящей Публичной оферте содержатся условия заключения Договора купли-продажи (далее по тексту — «Договор купли-продажи» и/или «Договор»). Настоящей офертой признается предложение, адресованное одному или нескольким конкретным лицам, которое достаточно определенно и выражает намерение лица, сделавшего предложение, считать себя заключившим Договор с адресатом, которым будет принято предложение.
+
+Совершение указанных в настоящей Оферте действий является подтверждением согласия обеих Сторон заключить Договор купли-продажи на условиях, в порядке и объеме, изложенных в настоящей Оферте.
+
+Нижеизложенный текст Публичной оферты является официальным публичным предложением Продавца, адресованный заинтересованному кругу лиц заключить Договор купли-продажи в соответствии с положениями пункта 2 статьи 437 Гражданского кодекса РФ.
+
+Договор купли-продажи считается заключенным и приобретает силу с момента совершения Сторонами действий, предусмотренных в настоящей Оферте, и, означающих безоговорочное, а также полное принятие всех условий настоящей Оферты без каких-либо изъятий или ограничений на условиях присоединения.
+
+### Термины и определения
+
+**Договор** — текст настоящей Оферты с Приложениями, являющимися неотъемлемой частью настоящей Оферты, акцептованный Покупателем путем совершения конклюдентных действий, предусмотренных настоящей Офертой.
+
+**Конклюдентные действия** — это поведение, которое выражает согласие с предложением контрагента заключить, изменить или расторгнуть договор. Действия состоят в полном или частичном выполнении условий, которые предложил контрагент.
+
+**Сайт Продавца в сети «Интернет»** — совокупность программ для электронных вычислительных машин и иной информации, содержащейся в информационной системе, доступ к которой обеспечивается посредством сети «Интернет» по доменному имени и сетевому адресу: `erudit-game.ru`.
+
+**Стороны Договора (Стороны)** — Продавец и Покупатель.
+
+**Товар** — товаром по договору купли-продажи могут быть любые вещи с соблюдением правил, предусмотренных статьей 129 Гражданского кодекса РФ.
+
+## 2. Предмет Договора
+
+**2.1.** По настоящему Договору Продавец обязуется передать вещь (Товар) в собственность Покупателя, а Покупатель обязуется принять Товар и уплатить за него определенную денежную сумму.
+
+**2.2.** Наименование, количество, а также ассортимент Товара, его стоимость, порядок доставки и иные условия определяются на основании сведений Продавца при оформлении заявки Покупателем, либо устанавливаются на сайте Продавца в сети «Интернет» `erudit-game.ru`.
+
+**2.3.** Акцепт настоящей Оферты выражается в совершении конклюдентных действий, в частности:
+
+- действиях, связанных с регистрацией учетной записи на Сайте Продавца в сети «Интернет» при наличии необходимости регистрации учетной записи;
+- путем составления и заполнения заявки на оформление заказа Товара;
+- путем сообщения требуемых для заключения Договора сведений по телефону, электронной почте, указанными на сайте Продавца в сети «Интернет», в том числе, при обратном звонке Продавца по заявке Покупателя;
+- оплаты Товара Покупателем.
+
+Данный перечень не является исчерпывающим, могут быть и другие действия, которые ясно выражают намерение лица принять предложение контрагента.
+
+## 3. Права и обязанности Сторон
+
+### 3.1. Права и обязанности Продавца
+
+**3.1.1.** Продавец вправе требовать оплаты Товаров и их доставки в порядке и на условиях, предусмотренных Договором;
+
+**3.1.2.** Отказать в заключении Договора на основании настоящей Оферты Покупателю в случае его недобросовестного поведения, в частности, в случае:
+
+- более 2 (Двух) отказов от Товаров надлежащего качества в течение года;
+- предоставления заведомо недостоверной персональной информации;
+- возврата испорченного Покупателем Товара или Товара, бывшего в употреблении;
+- иных случаях недобросовестного поведения, свидетельствующих о заключении Покупателем Договора с целью злоупотребления правами, и отсутствия обычной экономической цели Договора — приобретения Товара.
+
+**3.1.3.** Продавец обязуется передать Покупателю Товар надлежащего качества и в надлежащей упаковке;
+
+**3.1.4.** Передать Товар свободным от прав третьих лиц;
+
+**3.1.5.** Организовать доставку Товаров Покупателю;
+
+**3.1.6.** Предоставить Покупателю всю необходимую информацию в соответствии с требованиями действующего законодательства РФ и настоящей Оферты;
+
+### 3.2. Права и обязанности Покупателя
+
+**3.2.1.** Покупатель вправе требовать передачи Товара в порядке и на условиях, предусмотренных Договором.
+
+**3.2.2.** Требовать предоставления всей необходимой информации в соответствии с требованиями действующего законодательства РФ и настоящей Оферты;
+
+**3.2.3.** Отказаться от Товара по основаниям, предусмотренным Договором и действующим законодательством Российской Федерации.
+
+**3.2.4.** Покупатель обязуется предоставить Продавцу достоверную информацию, необходимую для надлежащего исполнения Договора;
+
+**3.2.5.** Принять и оплатить Товар в соответствии с условиями Договора;
+
+**3.2.6.** Покупатель гарантирует, что все условия Договора ему понятны; Покупатель принимает условия без оговорок, а также в полном объеме.
+
+## 4. Цена и порядок расчетов
+
+**4.1.** Стоимость, а также порядок оплаты Товара определяется на основании сведений Продавца при оформлении заявки Покупателем, либо устанавливаются на сайте Продавца в сети «Интернет»: `erudit-game.ru`.
+
+**4.2.** Все расчеты по Договору производятся в безналичном порядке.
+
+## 5. Обмен и возврат Товара
+
+**5.1.** Покупатель вправе осуществить возврат (обмен) Продавцу Товара, приобретенный дистанционным способом, за исключением перечня товаров, не подлежащих обмену и возврату согласно действующему законодательству Российской Федерации. Условия, сроки и порядок возврата Товара надлежащего и ненадлежащего качества установлены в соответствии с Гражданским кодексом РФ, Закона РФ от 07.02.1992 N 2300-1 «О защите прав потребителей», Правил, утвержденных Постановлением Правительства РФ от 31.12.2020 N 2463.
+
+**5.2.** Требование Покупателя об обмене либо о возврате Товара рассматривается индивидуально при условии неиспользования приобретенного товара и наличии уважительных причин (технический сбой, ошибка в описании товара).
+
+## 6. Конфиденциальность и безопасность
+
+**6.1.** При реализации настоящего Договора Стороны обеспечивают конфиденциальность и безопасность персональных данных в соответствии с актуальной редакцией ФЗ от 27.07.2006 г. № 152-ФЗ «О персональных данных» и ФЗ от 27.07.2006 г. № 149-ФЗ «Об информации, информационных технологиях и о защите информации».
+
+**6.2.** Стороны обязуются сохранять конфиденциальность информации, полученной в ходе исполнения настоящего Договора, и принять все возможные меры, чтобы предохранить полученную информацию от разглашения.
+
+**6.3.** Под конфиденциальной информацией понимается любая информация, передаваемая Продавцом и Покупателем в процессе реализации Договора и подлежащая защите, исключения указаны ниже.
+
+**6.4.** Такая информация может содержаться в предоставляемых Продавцом локальных нормативных актах, договорах, письмах, отчетах, аналитических материалах, результатах исследований, схемах, графиках, спецификациях и других документах, оформленных как на бумажных, так и на электронных носителях.
+
+## 7. Форс-мажор
+
+**7.1.** Стороны освобождаются от ответственности за неисполнение или ненадлежащее исполнение обязательств по Договору, если надлежащее исполнение оказалось невозможным вследствие непреодолимой силы, то есть чрезвычайных и непредотвратимых при данных условиях обстоятельств, под которыми понимаются: запретные действия властей, эпидемии, блокада, эмбарго, землетрясения, наводнения, пожары или другие стихийные бедствия.
+
+**7.2.** В случае наступления этих обстоятельств Сторона обязана в течение 30 (Тридцати) рабочих дней уведомить об этом другую Сторону.
+
+**7.3.** Документ, выданный уполномоченным государственным органом, является достаточным подтверждением наличия и продолжительности действия непреодолимой силы.
+
+**7.4.** Если обстоятельства непреодолимой силы продолжают действовать более 60 (Шестидесяти) рабочих дней, то каждая Сторона вправе отказаться от настоящего Договора в одностороннем порядке.
+
+## 8. Ответственность Сторон
+
+**8.1.** В случае неисполнения и/или ненадлежащего исполнения своих обязательств по Договору, Стороны несут ответственность в соответствии с условиями настоящей Оферты.
+
+**8.2.** Сторона, не исполнившая или ненадлежащим образом исполнившая обязательства по Договору, обязана возместить другой Стороне причиненные такими нарушениями убытки.
+
+## 9. Срок действия настоящей Оферты
+
+**9.1.** Оферта вступает в силу с момента размещения на Сайте Продавца и действует до момента её отзыва Продавцом.
+
+**9.2.** Продавец оставляет за собой право внести изменения в условия Оферты и/или отозвать Оферту в любой момент по своему усмотрению. Сведения об изменении или отзыве Оферты доводятся до Покупателя по выбору Продавца посредством размещения на сайте Продавца в сети «Интернет», в Личном кабинете Покупателя, либо путем направления соответствующего уведомления на электронный или почтовый адрес, указанный Покупателем при заключении Договора или в ходе его исполнения.
+
+**9.3.** Договор вступает в силу с момента Акцепта условий настоящей Оферты Покупателем и действует до полного исполнения Сторонами обязательств по Договору.
+
+**9.4.** Изменения, внесенные Продавцом в Договор и опубликованные на сайте в форме актуализированной Оферты, считаются принятыми Покупателем в полном объеме.
+
+## 10. Дополнительные условия
+
+**10.1.** Договор, его заключение и исполнение регулируется действующим законодательством Российской Федерации. Все вопросы, не урегулированные настоящей Офертой или урегулированные не полностью, регулируются в соответствии с материальным правом Российской Федерации.
+
+**10.2.** В случае возникновения спора, который может возникнуть между Сторонами в ходе исполнения ими своих обязательств по Договору, заключенному на условиях настоящей Оферты, Стороны обязаны урегулировать спор мирным путем до начала судебного разбирательства.
+
+Судебное разбирательство осуществляется в соответствии с законодательством Российской Федерации.
+
+Споры или разногласия, по которым Стороны не достигли договоренности, подлежат разрешению в соответствии с законодательством РФ. Досудебный порядок урегулирования спора является обязательным.
+
+**10.3.** В качестве языка Договора, заключаемого на условиях настоящей Оферты, а также языка, используемого при любом взаимодействии Сторон (включая ведение переписки, предоставление требований / уведомлений / разъяснений, предоставление документов и т. д.), Стороны определили русский язык.
+
+**10.4.** Все документы, подлежащие предоставлению в соответствии с условиями настоящей Оферты, должны быть составлены на русском языке либо иметь перевод на русский язык, удостоверенный в установленном порядке.
+
+**10.5.** Бездействие одной из Сторон в случае нарушения условий настоящей Оферты не лишает права заинтересованной Стороны осуществлять защиту своих интересов позднее, а также не означает отказа от своих прав в случае совершения одной из Сторон подобных либо сходных нарушений в будущем.
+
+**10.6.** Если на Сайте Продавца в сети «Интернет» есть ссылки на другие веб-сайты и материалы третьих лиц, такие ссылки размещены исключительно в целях информирования, и Продавец не имеет контроля в отношении содержания таких сайтов или материалов. Продавец не несет ответственность за любые убытки или ущерб, которые могут возникнуть в результате использования таких ссылок.
+
+## 11. Реквизиты Продавца
+
+Денисов Илья Аркадьевич, ИНН 290210610742.

ui/package.json

@@ -28,6 +28,7 @@
     "@sveltejs/vite-plugin-svelte": "^5.0.0",
     "@types/node": "^22.10.0",
     "core-js-bundle": "^3.49.0",
+    "marked": "^18.0.5",
     "svelte": "^5.15.0",
     "svelte-check": "^4.1.0",
     "typescript": "^5.7.0",

ui/pnpm-lock.yaml

@@ -39,6 +39,9 @@ importers:
       core-js-bundle:
         specifier: ^3.49.0
         version: 3.49.0
+      marked:
+        specifier: ^18.0.5
+        version: 18.0.5
       svelte:
         specifier: ^5.15.0
         version: 5.56.0
@@ -1628,6 +1631,11 @@ packages:
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
+  marked@18.0.5:
+    resolution: {integrity: sha512-S6GcvALHg6K4ohtu4E7x0a1AqhAjp6cV8KhLSyN9qVapnzJkusVBxZRcIU9AeYsbe6P1hKDusSbEOzGyyuce6w==}
+    engines: {node: '>= 20'}
+    hasBin: true
+
   math-intrinsics@1.1.0:
     resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
     engines: {node: '>= 0.4'}
@@ -3877,6 +3885,8 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  marked@18.0.5: {}
+
   math-intrinsics@1.1.0: {}
 
   minimatch@10.2.5:

ui/src/Landing.svelte

@@ -123,7 +123,10 @@
     </div>
   </section>
 
-  <footer class="ft">{t('about.version', { v: __APP_VERSION__ })}</footer>
+  <footer class="ft">
+    <a class="offer" href="/offer/">{t('landing.offer')}</a>
+    <span>{t('about.version', { v: __APP_VERSION__ })}</span>
+  </footer>
 </main>
 
 <style>
@@ -275,8 +278,18 @@
   }
   .ft {
     margin-top: auto;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 6px;
     text-align: center;
     color: var(--text-muted);
     font-size: 0.8rem;
   }
+  .ft .offer {
+    color: inherit;
+  }
+  .ft .offer:hover {
+    color: var(--accent);
+  }
 </style>

ui/src/gen/fbs/scrabblefb.ts

@@ -86,6 +86,8 @@ export { UpdateProfileRequest } from './scrabblefb/update-profile-request.js';
 export { VKLoginRequest } from './scrabblefb/vklogin-request.js';
 export { Wallet } from './scrabblefb/wallet.js';
 export { WalletBuyRequest } from './scrabblefb/wallet-buy-request.js';
+export { WalletOrderRequest } from './scrabblefb/wallet-order-request.js';
+export { WalletOrderResponse } from './scrabblefb/wallet-order-response.js';
 export { WalletSegment } from './scrabblefb/wallet-segment.js';
 export { WordCheckResult } from './scrabblefb/word-check-result.js';
 export { YourTurnEvent } from './scrabblefb/your-turn-event.js';

ui/src/gen/fbs/scrabblefb/wallet-order-request.ts

@@ -0,0 +1,48 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+import * as flatbuffers from 'flatbuffers';
+
+export class WalletOrderRequest {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):WalletOrderRequest {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsWalletOrderRequest(bb:flatbuffers.ByteBuffer, obj?:WalletOrderRequest):WalletOrderRequest {
+  return (obj || new WalletOrderRequest()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsWalletOrderRequest(bb:flatbuffers.ByteBuffer, obj?:WalletOrderRequest):WalletOrderRequest {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new WalletOrderRequest()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+productId():string|null
+productId(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+productId(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+static startWalletOrderRequest(builder:flatbuffers.Builder) {
+  builder.startObject(1);
+}
+
+static addProductId(builder:flatbuffers.Builder, productIdOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(0, productIdOffset, 0);
+}
+
+static endWalletOrderRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static createWalletOrderRequest(builder:flatbuffers.Builder, productIdOffset:flatbuffers.Offset):flatbuffers.Offset {
+  WalletOrderRequest.startWalletOrderRequest(builder);
+  WalletOrderRequest.addProductId(builder, productIdOffset);
+  return WalletOrderRequest.endWalletOrderRequest(builder);
+}
+}

ui/src/gen/fbs/scrabblefb/wallet-order-response.ts

@@ -0,0 +1,60 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+import * as flatbuffers from 'flatbuffers';
+
+export class WalletOrderResponse {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):WalletOrderResponse {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsWalletOrderResponse(bb:flatbuffers.ByteBuffer, obj?:WalletOrderResponse):WalletOrderResponse {
+  return (obj || new WalletOrderResponse()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsWalletOrderResponse(bb:flatbuffers.ByteBuffer, obj?:WalletOrderResponse):WalletOrderResponse {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new WalletOrderResponse()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+orderId():string|null
+orderId(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+orderId(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+redirectUrl():string|null
+redirectUrl(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+redirectUrl(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+static startWalletOrderResponse(builder:flatbuffers.Builder) {
+  builder.startObject(2);
+}
+
+static addOrderId(builder:flatbuffers.Builder, orderIdOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(0, orderIdOffset, 0);
+}
+
+static addRedirectUrl(builder:flatbuffers.Builder, redirectUrlOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(1, redirectUrlOffset, 0);
+}
+
+static endWalletOrderResponse(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static createWalletOrderResponse(builder:flatbuffers.Builder, orderIdOffset:flatbuffers.Offset, redirectUrlOffset:flatbuffers.Offset):flatbuffers.Offset {
+  WalletOrderResponse.startWalletOrderResponse(builder);
+  WalletOrderResponse.addOrderId(builder, orderIdOffset);
+  WalletOrderResponse.addRedirectUrl(builder, redirectUrlOffset);
+  return WalletOrderResponse.endWalletOrderResponse(builder);
+}
+}

ui/src/lib/app.svelte.ts

@@ -137,6 +137,9 @@ export const app = $state<{
   /** Whether an operator feedback reply awaits the player, for the lobby ⚙️ badge (combined
    *  with friend requests) and the Settings → Info badge. */
   feedbackReplyUnread: boolean;
+  /** A monotone counter bumped when a payment-intake push signals the wallet changed; an open
+   *  Wallet screen watches it and re-fetches in place. */
+  walletRefresh: number;
   /** Whether to show the "outdated invite link" notice: set when a Telegram deep-link friend
    *  code is already used/expired, so the visitor lands in the lobby with a gentle pointer to
    *  the bot instead of a scary error on the Friends screen. */
@@ -175,6 +178,7 @@ export const app = $state<{
   chatUnread: {},
   messageUnread: {},
   feedbackReplyUnread: false,
+  walletRefresh: 0,
   staleInvite: false,
   welcomeRedeem: false,
   resync: 0,
@@ -439,6 +443,12 @@ function openStream(): void {
         if (e.sub === 'profile') {
           void refreshProfile();
         }
+        // A payment-intake event credited (or refunded) the viewer's wallet: bump the signal an
+        // open Wallet screen watches, so it re-fetches in place (the return-focus poll is the
+        // fallback when the live stream is down).
+        if (e.sub === 'payment') {
+          app.walletRefresh++;
+        }
         void refreshNotifications();
       }
     },

ui/src/lib/client.ts

@@ -35,6 +35,7 @@ import type {
   Variant,
   WordCheckResult,
   Wallet,
+  WalletOrder,
   Catalog,
 } from './model';
 
@@ -147,6 +148,9 @@ export interface GatewayClient {
   /** walletBuy spends chips on a chip-priced value and returns the updated wallet. Gate-checked
    *  server-side: an untrusted/frozen context or an insufficient balance is refused. */
   walletBuy(productId: string): Promise<Wallet>;
+  /** walletOrder opens a money order to fund a chip pack and returns the provider launch URL the
+   *  client opens; chips are credited later, by the verified server callback. Direct rail only. */
+  walletOrder(productId: string): Promise<WalletOrder>;
 
   // --- friends ---
   friendsList(): Promise<AccountRef[]>;

ui/src/lib/codec.test.ts

@@ -17,6 +17,8 @@ import {
   decodeWallet,
   decodeCatalog,
   encodeWalletBuy,
+  encodeWalletOrder,
+  decodeWalletOrder,
   decodeSession,
   decodeFeedbackState,
   decodeFeedbackUnread,
@@ -73,6 +75,25 @@ describe('codec', () => {
     expect(w.hints).toBe(5);
   });
 
+  it('round-trips the wallet order request and response', () => {
+    // order request: pack id survives the wire
+    const req = fb.WalletOrderRequest.getRootAsWalletOrderRequest(new ByteBuffer(encodeWalletOrder('pack-7')));
+    expect(req.productId()).toBe('pack-7');
+
+    // order response: the created id and the provider launch URL decode back
+    const b = new Builder(64);
+    const oid = b.createString('order-123');
+    const url = b.createString('https://pay.example/abc');
+    fb.WalletOrderResponse.startWalletOrderResponse(b);
+    fb.WalletOrderResponse.addOrderId(b, oid);
+    fb.WalletOrderResponse.addRedirectUrl(b, url);
+    b.finish(fb.WalletOrderResponse.endWalletOrderResponse(b));
+
+    const order = decodeWalletOrder(b.asUint8Array());
+    expect(order.orderId).toBe('order-123');
+    expect(order.redirectUrl).toBe('https://pay.example/abc');
+  });
+
   it('round-trips the catalog view (value + pack)', () => {
     const b = new Builder(256);
 

ui/src/lib/codec.ts

@@ -39,6 +39,7 @@ import type {
   MoveResult,
   Profile,
   Wallet,
+  WalletOrder,
   WalletSegment,
   Catalog,
   CatalogProduct,
@@ -373,6 +374,15 @@ export function encodeWalletBuy(productId: string): Uint8Array {
   return finish(b, fb.WalletBuyRequest.endWalletBuyRequest(b));
 }
 
+// encodeWalletOrder wraps the pack id for a money order (POST /user/wallet/order).
+export function encodeWalletOrder(productId: string): Uint8Array {
+  const b = new Builder(64);
+  const pid = b.createString(productId);
+  fb.WalletOrderRequest.startWalletOrderRequest(b);
+  fb.WalletOrderRequest.addProductId(b, pid);
+  return finish(b, fb.WalletOrderRequest.endWalletOrderRequest(b));
+}
+
 // decodeWallet reads the wallet payload: the context-visible chip segments and the
 // context-applicable benefits.
 export function decodeWallet(buf: Uint8Array): Wallet {
@@ -391,6 +401,12 @@ export function decodeWallet(buf: Uint8Array): Wallet {
   };
 }
 
+// decodeWalletOrder reads the created order: its id and the provider launch URL the client opens.
+export function decodeWalletOrder(buf: Uint8Array): WalletOrder {
+  const o = fb.WalletOrderResponse.getRootAsWalletOrderResponse(new ByteBuffer(buf));
+  return { orderId: s(o.orderId()), redirectUrl: s(o.redirectUrl()) };
+}
+
 // decodeCatalog reads the storefront payload: the context-visible products, each a chip-priced
 // value or a chip pack priced in the context's payment method, with its atom composition.
 export function decodeCatalog(buf: Uint8Array): Catalog {

ui/src/lib/i18n/en.ts

@@ -242,7 +242,11 @@ export const en = {
   'wallet.store': 'Store',
   'wallet.empty': 'The store is empty for now',
   'wallet.buy': 'Buy',
-  'wallet.soon': 'Soon',
+  'wallet.offer': 'Public offer',
+  'wallet.platformNoBuy': 'Purchases are not available on this platform',
+  'wallet.iosBlockedPre': 'Purchases on iOS are prohibited by Apple policy. Try the ',
+  'wallet.iosBlockedLink': 'other version',
+  'wallet.iosBlockedPost': ' of the game.',
   'wallet.gpStub': 'To buy chips, install the RuStore build.',
   'wallet.cur.RUB': '₽',
   'wallet.cur.VOTE': 'votes',
@@ -275,6 +279,7 @@ export const en = {
   'landing.captionTelegram': 'Telegram',
   'landing.captionVK': 'VK',
   'landing.captionWeb': 'Web',
+  'landing.offer': 'Public offer',
 
   'install.title': 'Install the app',
   'install.subtitle': 'Put the app icon on your desktop (home screen) to open the game in one tap.',

ui/src/lib/i18n/ru.ts

@@ -242,7 +242,11 @@ export const ru: Record<MessageKey, string> = {
   'wallet.store': 'Магазин',
   'wallet.empty': 'Магазин пока пуст',
   'wallet.buy': 'Купить',
-  'wallet.soon': 'Скоро',
+  'wallet.offer': 'Публичная оферта',
+  'wallet.platformNoBuy': 'На данной платформе покупки невозможны',
+  'wallet.iosBlockedPre': 'Покупки на iOS запрещены политикой Apple. Попробуйте воспользоваться ',
+  'wallet.iosBlockedLink': 'другой версией',
+  'wallet.iosBlockedPost': ' игры.',
   'wallet.gpStub': 'Чтобы покупать фишки, установите версию из RuStore.',
   'wallet.cur.RUB': '₽',
   'wallet.cur.VOTE': 'голосов',
@@ -275,6 +279,7 @@ export const ru: Record<MessageKey, string> = {
   'landing.captionTelegram': 'Telegram',
   'landing.captionVK': 'VK',
   'landing.captionWeb': 'Веб-версия',
+  'landing.offer': 'Публичная оферта',
 
   'install.title': 'Установить приложение',
   'install.subtitle': 'Поместите иконку приложения на рабочий стол (домашний экран), чтобы открывать игру одним нажатием.',

ui/src/lib/mock/client.ts

@@ -41,6 +41,7 @@ import type {
   Variant,
   WordCheckResult,
   Wallet,
+  WalletOrder,
   Catalog,
 } from '../model';
 import { valueForLetter } from '../alphabet';
@@ -225,6 +226,14 @@ export class MockGateway implements GatewayClient {
     }
     return this.cloneWallet();
   }
+
+  async walletOrder(productId: string): Promise<WalletOrder> {
+    const p = this.mockCatalog.products.find((x) => x.productId === productId);
+    if (!p || p.kind !== 'pack') throw new GatewayError('not_a_pack');
+    // No real provider in mock: return a stub launch URL so the e2e can assert the purchase reaches
+    // the provider hand-off without leaving the app.
+    return { orderId: 'mock-order-' + productId, redirectUrl: 'https://mock.local/robokassa?order=' + productId };
+  }
   private cloneWallet(): Wallet {
     return {
       segments: this.mockWallet.segments.map((s) => ({ ...s })),

ui/src/lib/model.ts

@@ -172,6 +172,14 @@ export interface Wallet {
 
 /** One atom line of a storefront product: the base value type it grants ("chips"/"hints"/
  *  "noads_days"/"tournament") and how many of it the product carries. */
+// WalletOrder is a created money order to fund a chip pack: its id and the provider launch URL the
+// client opens (the Robokassa hosted-payment page). Chips arrive later, by the verified server
+// callback.
+export interface WalletOrder {
+  orderId: string;
+  redirectUrl: string;
+}
+
 export interface CatalogAtom {
   atomType: string;
   quantity: number;

ui/src/lib/offer.test.ts

@@ -0,0 +1,23 @@
+import { describe, it, expect } from 'vitest';
+import { renderOfferHtml } from './offer';
+
+describe('renderOfferHtml', () => {
+  it('wraps rendered markdown in a standalone Russian HTML document', () => {
+    const html = renderOfferHtml('# Публичная оферта\n\nо заключении договора купли-продажи');
+    expect(html).toContain('<!doctype html>');
+    expect(html).toContain('lang="ru"');
+    expect(html).toContain('<title>Публичная оферта — Эрудит</title>');
+    // The markdown heading is rendered, not left as literal source.
+    expect(html).toContain('<h1>Публичная оферта</h1>');
+    expect(html).not.toContain('# Публичная оферта');
+    // A back link to the landing root is always present.
+    expect(html).toContain('href="/"');
+  });
+
+  it('renders headings, bold clause numbers and lists', () => {
+    const html = renderOfferHtml('## 2. Предмет\n\n**2.1.** Текст пункта.\n\n- первый\n- второй');
+    expect(html).toContain('<h2>2. Предмет</h2>');
+    expect(html).toContain('<strong>2.1.</strong>');
+    expect(html).toContain('<li>первый</li>');
+  });
+});

ui/src/lib/offer.ts

@@ -0,0 +1,93 @@
+import { marked } from 'marked';
+
+/**
+ * renderOfferHtml renders the public-offer markdown source into a standalone,
+ * self-contained HTML document served statically at `/offer/`. The build emits
+ * the result as `dist/offer/index.html` (see the `emit-offer` plugin in
+ * `vite.config.ts`), which the landing container serves.
+ *
+ * The input `markdown` is trusted repository content (the owner-edited
+ * `ui/legal/offer_ru.md`), not user input, so the rendered HTML is deliberately
+ * not sanitised. The page carries its own minimal light/dark styling so it needs
+ * neither the app bundle nor `app.css`.
+ */
+export function renderOfferHtml(markdown: string): string {
+  const body = marked.parse(markdown, { async: false }) as string;
+  return `<!doctype html>
+<html lang="ru">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Публичная оферта — Эрудит</title>
+    <link rel="canonical" href="https://erudit-game.ru/offer/" />
+    <meta name="theme-color" media="(prefers-color-scheme: light)" content="#f3f4f6" />
+    <meta name="theme-color" media="(prefers-color-scheme: dark)" content="#0f1115" />
+    <style>
+      :root {
+        color-scheme: light dark;
+        --bg: #ffffff;
+        --text: #1a1c20;
+        --accent: #2563eb;
+        --rule: #e5e7eb;
+      }
+      @media (prefers-color-scheme: dark) {
+        :root {
+          --bg: #0f1115;
+          --text: #e7e9ee;
+          --accent: #6ea8fe;
+          --rule: #242832;
+        }
+      }
+      * {
+        box-sizing: border-box;
+      }
+      body {
+        margin: 0;
+        background: var(--bg);
+        color: var(--text);
+        font: 16px/1.6 system-ui, -apple-system, 'Segoe UI', Roboto, sans-serif;
+      }
+      main {
+        max-width: 760px;
+        margin: 0 auto;
+        padding: 24px 20px 64px;
+      }
+      a {
+        color: var(--accent);
+      }
+      .back {
+        display: inline-block;
+        margin-bottom: 20px;
+        text-decoration: none;
+      }
+      h1 {
+        font-size: 1.6rem;
+        text-align: center;
+      }
+      h2 {
+        font-size: 1.2rem;
+        margin-top: 2em;
+        padding-top: 1em;
+        border-top: 1px solid var(--rule);
+      }
+      h3 {
+        font-size: 1.05rem;
+        margin-top: 1.5em;
+      }
+      ul {
+        padding-left: 1.25em;
+      }
+      li {
+        margin: 0.25em 0;
+      }
+    </style>
+  </head>
+  <body>
+    <main>
+      <a class="back" href="/">← На главную</a>
+      ${body}
+    </main>
+  </body>
+</html>
+`;
+}

ui/src/lib/transport.ts

@@ -237,6 +237,9 @@ export function createTransport(baseUrl: string): GatewayClient {
     async walletBuy(productId: string) {
       return codec.decodeWallet(await exec('wallet.buy', codec.encodeWalletBuy(productId)));
     },
+    async walletOrder(productId: string) {
+      return codec.decodeWalletOrder(await exec('wallet.order', codec.encodeWalletOrder(productId)));
+    },
 
     async friendsList() {
       return codec.decodeFriendList(await exec('friends.list', codec.empty()));

ui/src/lib/vk.ts

@@ -182,6 +182,21 @@ export async function vkShowImages(url: string): Promise<boolean> {
   }
 }
 
+/**
+ * vkShowOrderBox opens VK's payment box for a "голоса" item purchase; item is the order id the
+ * backend created (VK echoes it to our payment callback, which credits). Resolves true when the
+ * payment completes, false on cancel/failure or outside VK. The chips are credited by the server
+ * callback, so the wallet refreshes from the payment push regardless of this result.
+ */
+export async function vkShowOrderBox(item: string): Promise<boolean> {
+  try {
+    await (await bridge()).send('VKWebAppShowOrderBox', { type: 'item', item });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * vkDownloadFile downloads url as filename through the VK client (VKWebAppDownloadFile) —
  * the mobile in-app file delivery, where the webview ignores <a download>. Resolves false

ui/src/screens/Wallet.svelte

@@ -1,11 +1,14 @@
 <script lang="ts">
   import { onMount } from 'svelte';
   import Modal from '../components/Modal.svelte';
-  import { handleError } from '../lib/app.svelte';
+  import { app, handleError, showToast } from '../lib/app.svelte';
   import { gateway } from '../lib/gateway';
+  import { normalizeSubtype } from '../lib/platform';
   import { t, i18n, type MessageKey } from '../lib/i18n/index.svelte';
   import { executionContext, formatAmount, needsWebSpendWarning, type SpendContext } from '../lib/wallet';
   import { isGooglePlayBuild } from '../lib/distribution';
+  import { onExternalLinkClick, openExternalUrl } from '../lib/links';
+  import { vkPlatform, vkShowOrderBox } from '../lib/vk';
   import type { Wallet, Catalog, CatalogProduct } from '../lib/model';
 
   // The Wallet section: the context-visible chip balances, the active benefits, and the storefront.
@@ -23,6 +26,10 @@
 
   const context: SpendContext = executionContext();
   const gpBuild = isGooglePlayBuild();
+  // Money purchases are not permitted inside the VK iOS app (Apple ToS); the pack CTA is shown
+  // muted and taps explain why, rather than hiding the storefront. VK's device family is not on the
+  // client platformSubtype (server-derived) — read it from the signed vk_platform launch param.
+  const purchaseBlocked = context === 'vk' && normalizeSubtype(vkPlatform()) === 'ios';
 
   const values = $derived(catalog?.products.filter((p) => p.kind === 'value') ?? []);
   const packs = $derived(catalog?.products.filter((p) => p.kind === 'pack') ?? []);
@@ -38,7 +45,26 @@
       loading = false;
     }
   }
-  onMount(load);
+  onMount(() => {
+    void load();
+    // Fallback to the payment push: re-fetch when the tab regains focus, i.e. the user returned
+    // from the provider's payment window.
+    const onVisible = () => {
+      if (!document.hidden) void load();
+    };
+    document.addEventListener('visibilitychange', onVisible);
+    return () => document.removeEventListener('visibilitychange', onVisible);
+  });
+
+  // Main path: a payment-intake push bumps app.walletRefresh; re-fetch in place when it changes
+  // (a credit landed while the screen is open).
+  let seenRefresh = app.walletRefresh;
+  $effect(() => {
+    if (app.walletRefresh !== seenRefresh) {
+      seenRefresh = app.walletRefresh;
+      void load();
+    }
+  });
 
   function sourceLabel(source: string): string {
     return t(`wallet.source.${source}` as MessageKey);
@@ -78,6 +104,27 @@
       busy = false;
     }
   }
+
+  // onOrder funds a chip pack with money: it opens a pending order and sends the player to the
+  // provider's hosted-payment page. The chips are credited later, by the verified server callback;
+  // paying accepts the public offer (linked below the packs).
+  async function onOrder(p: CatalogProduct) {
+    if (busy) return;
+    busy = true;
+    try {
+      const order = await gateway.walletOrder(p.productId);
+      if (context === 'vk') {
+        // VK settles the payment in-app via the bridge; the chips arrive on the server callback.
+        await vkShowOrderBox(order.orderId);
+      } else {
+        openExternalUrl(order.redirectUrl);
+      }
+    } catch (e) {
+      handleError(e);
+    } finally {
+      busy = false;
+    }
+  }
 </script>
 
 <div class="wallet" data-testid="wallet">
@@ -105,6 +152,10 @@
 
   <section>
     <h3>{t('wallet.store')}</h3>
+    {#if purchaseBlocked}
+      <!-- prettier-ignore -->
+      <p class="ios-note" data-testid="ios-note">{t('wallet.iosBlockedPre')}<a href="https://erudit-game.ru/" target="_blank" rel="noopener noreferrer" onclick={onExternalLinkClick}>{t('wallet.iosBlockedLink')}</a>{t('wallet.iosBlockedPost')}</p>
+    {/if}
     {#each values as p (p.productId)}
       <div class="row product" data-testid="product" data-kind="value" data-pid={p.productId}>
         <span class="name">{p.title}</span>
@@ -120,9 +171,23 @@
         <div class="row product" data-testid="product" data-kind="pack" data-pid={p.productId}>
           <span class="name">{p.title}</span>
           <span class="price">{formatAmount(p.moneyAmount, p.moneyCurrency)}&nbsp;{currencyLabel(p.moneyCurrency)}</span>
-          <button class="buy" disabled>{t('wallet.soon')}</button>
+          <button
+            class="buy"
+            class:blocked={purchaseBlocked}
+            data-testid="buy-pack"
+            disabled={busy}
+            onclick={() => {
+              if (purchaseBlocked) showToast(t('wallet.platformNoBuy'));
+              else void onOrder(p);
+            }}>{t('wallet.buy')}</button
+          >
         </div>
       {/each}
+      {#if packs.length > 0}
+        <p class="offer" data-testid="offer">
+          <a href="/offer/" target="_blank" rel="noopener noreferrer">{t('wallet.offer')}</a>
+        </p>
+      {/if}
     {/if}
 
     {#if !loading && values.length === 0 && (gpBuild || packs.length === 0)}
@@ -197,6 +262,20 @@
     opacity: 0.5;
     cursor: default;
   }
+  .buy.blocked {
+    opacity: 0.5;
+  }
+  .ios-note {
+    margin: 0 0 4px;
+    padding: 8px 12px;
+    color: var(--text-muted);
+    font-size: 0.85rem;
+    border: 1px dashed var(--border);
+    border-radius: var(--radius-sm);
+  }
+  .ios-note a {
+    color: var(--accent);
+  }
   .empty,
   .stub {
     margin: 0;
@@ -207,6 +286,14 @@
     border: 1px dashed var(--border);
     border-radius: var(--radius-sm);
   }
+  .offer {
+    margin: 2px 0 0;
+    text-align: center;
+    font-size: 0.85rem;
+  }
+  .offer a {
+    color: var(--text-muted);
+  }
   .warn-body {
     margin: 0 0 14px;
   }

ui/tsconfig.node.json

@@ -8,5 +8,5 @@
     "skipLibCheck": true,
     "types": ["node"]
   },
-  "include": ["vite.config.ts"]
+  "include": ["vite.config.ts", "src/lib/offer.ts"]
 }

ui/vite.config.ts

@@ -3,6 +3,7 @@ import { resolve } from 'node:path';
 import { defineConfig, type Plugin } from 'vite';
 import { svelte } from '@sveltejs/vite-plugin-svelte';
 import { VitePWA } from 'vite-plugin-pwa';
+import { renderOfferHtml } from './src/lib/offer';
 
 /**
  * injectBootVersion stamps the app version into index.html's boot-capability guard, replacing its
@@ -38,6 +39,22 @@ function emitPolyfills(): Plugin {
   };
 }
 
+/**
+ * emitOffer renders the public offer markdown (legal/offer_ru.md) to a standalone
+ * static page and emits it as dist/offer/index.html, which the landing container
+ * serves at /offer/ (deploy/landing/Caddyfile). The markdown is the owner-editable
+ * source of truth, so the page is regenerated from it on every build.
+ */
+function emitOffer(): Plugin {
+  return {
+    name: 'emit-offer',
+    generateBundle() {
+      const md = readFileSync(resolve(import.meta.dirname, 'legal/offer_ru.md'), 'utf8');
+      this.emitFile({ type: 'asset', fileName: 'offer/index.html', source: renderOfferHtml(md) });
+    },
+  };
+}
+
 // The edge Connect service is scrabble.edge.v1.Gateway; the gateway serves it over
 // h2c on :8081 by default. In dev we proxy the RPC path so the browser (which can
 // not speak h2c directly) talks to the dev server on the same origin. In `mock`
@@ -60,6 +77,7 @@ export default defineConfig(({ mode }) => ({
   plugins: [
     svelte(),
     emitPolyfills(),
+    emitOffer(),
     injectBootVersion(),
     // App-shell precache for the offline mode: a custom (injectManifest) service worker precaches
     // index.html + the hashed assets so the installed web PWA cold-launches with no network. It