test(offline): real-dictionary move-generator conformance in CI

Phase A (A4): prove the ported move generator (#188) against the FULL shipped
dictionaries, not just the tiny samples — the deep graphs and complete 26/33-letter
alphabets the samples cannot reach.

- backend/cmd/movegen: add a -dawg-dir mode that emits per-variant golden move-gen
  vectors from the real dawgs (a bounded first-move + a blank case + a deep 7-tile
  mid-game position). Regenerated in CI to /tmp, never committed (like the
  dictgen/validategen vectors), so no dictionary version is pinned into the repo.
- ui/src/lib/dict/generate.realparity.test.ts: env-gated (DICT_DAWG_DIR +
  DICT_MOVEGEN_DIR) parity against that golden — 9 positions across scrabble_en /
  scrabble_ru / erudit_ru match the Go solver exactly. Skips cleanly when unset.
- .gitea/workflows/ci.yaml: the conformance job now generates the movegen golden
  and points the gated vitest at it (DICT_MOVEGEN_DIR).

.gitea/workflows/ci.yaml

@@ -252,6 +252,7 @@ jobs:
         run: |
           go run ./backend/cmd/dictgen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out /tmp/dictgold
           go run ./backend/cmd/validategen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out /tmp/validgold
+          go run ./backend/cmd/movegen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out /tmp/movegold
 
       - name: Set up Node
         uses: actions/setup-node@v4
@@ -271,6 +272,7 @@ jobs:
           DICT_DAWG_DIR: ${{ github.workspace }}/dawg
           DICT_GOLD_DIR: /tmp/dictgold
           DICT_VALID_DIR: /tmp/validgold
+          DICT_MOVEGEN_DIR: /tmp/movegold
         run: pnpm exec vitest run src/lib/dict/
 
   # gate is the single branch-protection required check. It always runs and passes

backend/cmd/backend/main.go

@@ -12,7 +12,6 @@ import (
 	"fmt"
 	"log"
 	"os/signal"
-	"strings"
 	"syscall"
 	"time"
 
@@ -216,11 +215,9 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	// Operator alert emails on new feedback / word complaints, coalesced into one digest
 	// per interval. Inert unless a distinct admin sender and recipient are configured.
 	if cfg.SMTP.AdminFrom != "" && cfg.SMTP.AdminTo != "" {
-		consoleURL := ""
-		if cfg.PublicBaseURL != "" {
-			consoleURL = strings.TrimRight(cfg.PublicBaseURL, "/") + "/_gm"
-		}
-		alerts := adminalert.New(mailer, feedbackSvc, games, cfg.SMTP.AdminFrom, cfg.SMTP.AdminTo, consoleURL, logger)
+		// The alert digest carries no admin-console link on purpose — an admin URL must not
+		// travel in an email (a mail provider could cache or index it); see adminalert.New.
+		alerts := adminalert.New(mailer, feedbackSvc, games, cfg.SMTP.AdminFrom, cfg.SMTP.AdminTo, logger)
 		go alerts.Run(ctx, adminAlertInterval)
 		logger.Info("admin alert worker started", zap.Duration("interval", adminAlertInterval))
 	}

backend/cmd/movegen/main.go

@@ -0,0 +1,374 @@
+// Command movegen emits golden conformance fixtures for the client-side move
+// generator port (ui/src/lib/dict). It is a dev tool, run by hand; its output is
+// committed so the TypeScript parity tests run without a Go toolchain.
+//
+// For each small sample dictionary (English and Russian — the latter reaches
+// alphabet index 32, exercising the 33-letter cross-set boundary) it writes:
+//
+//   - sample_<tag>.dawg           the serialized dictionary (the reader/cursor fixture)
+//   - sample_<tag>.words.json     the stored words + their alphabet indexes
+//   - sample_<tag>.gen.json       ranked move-generation results from the real solver,
+//     for a handful of positions, plus the ruleset the TS
+//     side rebuilds to score identically
+//
+// Positions are built with only the solver's public API: an empty board, and
+// two-ply positions reached by applying the solver's own top move (so no internal
+// encoding is needed). Regenerate with:
+//
+//	go run ./backend/cmd/movegen -out ui/src/lib/dict/testdata
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"flag"
+	"log"
+	"os"
+	"path/filepath"
+
+	"gitea.iliadenisov.ru/developer/scrabble-solver/board"
+	"gitea.iliadenisov.ru/developer/scrabble-solver/rack"
+	"gitea.iliadenisov.ru/developer/scrabble-solver/rules"
+	"gitea.iliadenisov.ru/developer/scrabble-solver/scrabble"
+	dawg "github.com/iliadenisov/dafsa"
+)
+
+// sampleWordsEN is the English sample dictionary, in strictly increasing
+// alphabet-index order (the builder requires it). Shared prefixes (car/care/cars),
+// shared suffixes (cats/dogs), internal-final nodes (do, an) and a one-letter word.
+var sampleWordsEN = []string{
+	"a", "an", "and", "ant",
+	"car", "care", "cared", "cares", "cars", "cat", "cats",
+	"do", "doe", "does", "dog", "dogs", "done", "dot",
+}
+
+// sampleWordsRU is the Russian sample dictionary, in strictly increasing index
+// order. It deliberately includes words starting with я (index 32) so the ported
+// cross-set handles alphabet indexes past JS's 31-bit shift boundary.
+var sampleWordsRU = []string{"ад", "ар", "оса", "я", "яд", "яр"}
+
+// sampleFixture is the JSON committed with the .dawg so the TypeScript cursor test
+// knows the exact word set (as alphabet indexes) to expect from enumeration.
+type sampleFixture struct {
+	Alphabet string   `json:"alphabet"`
+	NumAdded int      `json:"numAdded"`
+	Words    []string `json:"words"`
+	Indexes  [][]int  `json:"indexes"`
+}
+
+// genFixture is the move-generation golden set for one sample dictionary.
+type genFixture struct {
+	Ruleset genRuleset `json:"ruleset"`
+	Cases   []genCase  `json:"cases"`
+}
+
+// genRuleset is the scoring data the TS side rebuilds so evaluate() matches the Go
+// solver: letter values, premium multipliers per square, the centre, rack size and bonus.
+type genRuleset struct {
+	Size       int     `json:"size"`
+	Cols       int     `json:"cols"`
+	Center     int     `json:"center"`
+	RackSize   int     `json:"rackSize"`
+	Bingo      int     `json:"bingo"`
+	Values     []int   `json:"values"`
+	LetterMult [][]int `json:"letterMult"`
+	WordMult   [][]int `json:"wordMult"`
+}
+
+// genTile is one placed tile (a board tile or a move placement).
+type genTile struct {
+	Row    int  `json:"row"`
+	Col    int  `json:"col"`
+	Letter int  `json:"letter"`
+	Blank  bool `json:"blank"`
+}
+
+// genRack is a rack as a multiset of letter indexes plus a blank count.
+type genRack struct {
+	Letters []int `json:"letters"`
+	Blanks  int   `json:"blanks"`
+}
+
+// genMove is one ranked generated play: its orientation, placed tiles and total score.
+type genMove struct {
+	Dir   int       `json:"dir"`
+	Tiles []genTile `json:"tiles"`
+	Score int       `json:"score"`
+}
+
+// genCase is one generation position: the tiles already on the board (empty when
+// none), the rack, the mode/rule and the ranked moves the solver returns.
+type genCase struct {
+	Name             string    `json:"name"`
+	Placed           []genTile `json:"placed"`
+	Rack             genRack   `json:"rack"`
+	Mode             int       `json:"mode"`
+	IgnoreCrossWords bool      `json:"ignoreCrossWords"`
+	Moves            []genMove `json:"moves"`
+}
+
+func main() {
+	out := flag.String("out", "ui/src/lib/dict/testdata", "output directory for fixtures")
+	dawgDir := flag.String("dawg-dir", "", "when set, emit real-dictionary move-gen golden from the .dawg files in this dir (conformance mode) instead of the committed samples")
+	flag.Parse()
+
+	if err := os.MkdirAll(*out, 0o755); err != nil {
+		log.Fatalf("movegen: mkdir %s: %v", *out, err)
+	}
+
+	if *dawgDir != "" {
+		buildReal(*dawgDir, *out)
+		return
+	}
+
+	buildSample(*out, "en", rules.English(), sampleWordsEN, []genCase{
+		emptyCase("empty-cared", englishRack("caredts", 0), scrabble.Both, false),
+		emptyCase("empty-dogs", englishRack("dogsent", 0), scrabble.Both, false),
+		emptyCase("empty-blank", englishRack("caret", 1), scrabble.Both, false),
+		emptyCase("empty-single-word", englishRack("caredts", 0), scrabble.Both, true),
+	})
+
+	buildSample(*out, "ru", rules.RussianScrabble(), sampleWordsRU, []genCase{
+		emptyCase("empty-yad", russianRack("ядрасо", 0), scrabble.Both, false),
+	})
+}
+
+// buildSample writes the dawg, the word fixture and the generation golden set for
+// one sample dictionary. Two-ply cases are appended: the solver's own top move from
+// the first non-empty result is applied, then generation runs again on the new rack.
+func buildSample(out, tag string, rs *rules.Ruleset, words []string, cases []genCase) {
+	idx := rs.Alphabet
+	b := dawg.New(idx)
+	indexes := make([][]int, 0, len(words))
+	for _, w := range words {
+		if err := b.Add(w); err != nil {
+			log.Fatalf("movegen[%s]: add %q: %v", tag, w, err)
+		}
+		enc, err := idx.Encode(w)
+		if err != nil {
+			log.Fatalf("movegen[%s]: encode %q: %v", tag, w, err)
+		}
+		ints := make([]int, len(enc))
+		for i, x := range enc {
+			ints[i] = int(x)
+		}
+		indexes = append(indexes, ints)
+	}
+	finder := b.Finish()
+
+	writeJSON(filepath.Join(out, "sample_"+tag+".words.json"), sampleFixture{
+		Alphabet: tag, NumAdded: finder.NumAdded(), Words: words, Indexes: indexes,
+	})
+	dawgPath := filepath.Join(out, "sample_"+tag+".dawg")
+	if _, err := finder.Save(dawgPath); err != nil {
+		log.Fatalf("movegen[%s]: save %s: %v", tag, dawgPath, err)
+	}
+
+	s := scrabble.NewSolver(rs, finder)
+	for i := range cases {
+		runCase(s, rs, &cases[i], nil)
+	}
+	// A two-ply position from the first standard case that produced a move.
+	if two := twoPly(s, rs, cases); two != nil {
+		cases = append(cases, *two)
+	}
+
+	writeJSON(filepath.Join(out, "sample_"+tag+".gen.json"), genFixture{
+		Ruleset: rulesetOf(rs), Cases: cases,
+	})
+	log.Printf("movegen[%s]: %d words, %d cases", tag, finder.NumAdded(), len(cases))
+}
+
+// realVariant maps a shipped dictionary file to the ruleset that scores it and the racks
+// the conformance positions use. smallRack/blankRack keep the first-move (empty board)
+// lists bounded on a dense dictionary; fullRack drives a deep 7-tile mid-game position,
+// kept small by the anchors around the already-placed word.
+type realVariant struct {
+	file, variant, smallRack, blankRack, fullRack string
+	rs                                            *rules.Ruleset
+}
+
+// buildReal emits move-generation golden from the real shipped dictionaries in dawgDir —
+// the full alphabets and deep graphs the tiny samples cannot reach — one
+// <variant>.movegen.json per variant. Like the dictgen/validategen vectors it is
+// regenerated in CI and never committed, so it pins no dictionary version into the repo.
+func buildReal(dawgDir, out string) {
+	reals := []realVariant{
+		{"en_sowpods", "scrabble_en", "aine", "ain", "aeinrst", rules.English()},
+		{"ru_scrabble", "scrabble_ru", "аеин", "аен", "аеиноср", rules.RussianScrabble()},
+		{"ru_erudit", "erudit_ru", "аеин", "аен", "аеиноср", rules.Erudit()},
+	}
+	for _, v := range reals {
+		data, err := os.ReadFile(filepath.Join(dawgDir, v.file+".dawg"))
+		if err != nil {
+			log.Fatalf("movegen[%s]: read dawg: %v", v.variant, err)
+		}
+		finder, err := dawg.Read(bytes.NewReader(data), 0)
+		if err != nil {
+			log.Fatalf("movegen[%s]: parse dawg: %v", v.variant, err)
+		}
+		s := scrabble.NewSolver(v.rs, finder)
+
+		cases := []genCase{
+			emptyCase("first-move", encRack(v.rs, v.smallRack, 0), scrabble.Both, false),
+			emptyCase("first-move-blank", encRack(v.rs, v.blankRack, 1), scrabble.Both, false),
+		}
+		for i := range cases {
+			runCase(s, v.rs, &cases[i], nil)
+		}
+		// A deep 7-tile mid-game: place the top first move, then generate again. The
+		// anchors around the placed word bound the list while still exercising a full rack,
+		// deep left/right extension and wide cross-sets over the real graph.
+		full := encRack(v.rs, v.fullRack, 0)
+		b := board.New(v.rs.Rows, v.rs.Cols)
+		if m1 := s.GenerateMovesOpts(b, toRack(v.rs.Size(), full), scrabble.Both, scrabble.PlayOptions{}); len(m1) > 0 {
+			mid := genCase{Name: "mid-game", Rack: full, Mode: int(scrabble.Both)}
+			runCase(s, v.rs, &mid, tilesOf(m1[0].Tiles))
+			cases = append(cases, mid)
+		}
+
+		writeJSON(filepath.Join(out, v.variant+".movegen.json"), genFixture{Ruleset: rulesetOf(v.rs), Cases: cases})
+		total := 0
+		for _, c := range cases {
+			total += len(c.Moves)
+		}
+		_ = finder.Close()
+		log.Printf("movegen[%s]: %d cases, %d golden moves", v.variant, len(cases), total)
+	}
+}
+
+// encRack encodes a rack given as the variant's letters (plus a blank count) into the
+// index-based genRack the fixtures carry.
+func encRack(rs *rules.Ruleset, letters string, blanks int) genRack {
+	enc, err := rs.Alphabet.Encode(letters)
+	if err != nil {
+		log.Fatalf("movegen: encode rack %q: %v", letters, err)
+	}
+	idx := make([]int, len(enc))
+	for i, b := range enc {
+		idx[i] = int(b)
+	}
+	return genRack{Letters: idx, Blanks: blanks}
+}
+
+// runCase fills a case's Moves by generating on a board holding the given placed
+// tiles (nil = empty board).
+func runCase(s *scrabble.Solver, rs *rules.Ruleset, c *genCase, placed []genTile) {
+	bd := board.New(rs.Rows, rs.Cols)
+	for _, t := range placed {
+		bd.Set(t.Row, t.Col, cellByte(t.Letter, t.Blank))
+	}
+	c.Placed = placed
+	rk := toRack(rs.Size(), c.Rack)
+	moves := s.GenerateMovesOpts(bd, rk, scrabble.Mode(c.Mode), scrabble.PlayOptions{IgnoreCrossWords: c.IgnoreCrossWords})
+	c.Moves = movesOf(moves)
+}
+
+// twoPly reaches a mid-game position by applying the top move of the first standard
+// case that generated one, then generates again with a fresh rack of the same tiles.
+func twoPly(s *scrabble.Solver, rs *rules.Ruleset, cases []genCase) *genCase {
+	for _, c := range cases {
+		if c.IgnoreCrossWords || len(c.Moves) == 0 {
+			continue
+		}
+		placed := c.Moves[0].Tiles
+		next := genCase{Name: "two-ply", Rack: c.Rack, Mode: int(scrabble.Both)}
+		runCase(s, rs, &next, placed)
+		return &next
+	}
+	return nil
+}
+
+// cellByte encodes a board cell the way internal/encoding.Cell does (bits 0-5 hold
+// letter+1, bit 7 marks a blank). Duplicated here because that package is internal
+// to the solver module and cannot be imported.
+func cellByte(letter int, blank bool) byte {
+	v := byte(letter+1) & 0x3f
+	if blank {
+		v |= 0x80
+	}
+	return v
+}
+
+func toRack(size int, r genRack) rack.Rack {
+	rk := rack.New(size)
+	for _, l := range r.Letters {
+		rk.Add(byte(l))
+	}
+	for i := 0; i < r.Blanks; i++ {
+		rk.AddBlank()
+	}
+	return rk
+}
+
+func rulesetOf(rs *rules.Ruleset) genRuleset {
+	lm := make([][]int, rs.Rows)
+	wm := make([][]int, rs.Rows)
+	for r := 0; r < rs.Rows; r++ {
+		lm[r] = make([]int, rs.Cols)
+		wm[r] = make([]int, rs.Cols)
+		for c := 0; c < rs.Cols; c++ {
+			p := rs.Premium(r, c)
+			lm[r][c] = p.LetterMult()
+			wm[r][c] = p.WordMult()
+		}
+	}
+	return genRuleset{
+		Size: rs.Size(), Cols: rs.Cols, Center: rs.Center, RackSize: rs.RackSize,
+		Bingo: rs.Bingo, Values: rs.Values, LetterMult: lm, WordMult: wm,
+	}
+}
+
+func movesOf(ms []scrabble.Move) []genMove {
+	out := make([]genMove, len(ms))
+	for i, m := range ms {
+		out[i] = genMove{Dir: int(m.Dir), Tiles: tilesOf(m.Tiles), Score: m.Score}
+	}
+	return out
+}
+
+func tilesOf(ps []scrabble.Placement) []genTile {
+	out := make([]genTile, len(ps))
+	for i, p := range ps {
+		out[i] = genTile{Row: p.Row, Col: p.Col, Letter: int(p.Letter), Blank: p.Blank}
+	}
+	return out
+}
+
+// emptyCase builds an empty-board case (Moves filled later by runCase).
+func emptyCase(name string, r genRack, mode scrabble.Mode, ignoreCross bool) genCase {
+	return genCase{Name: name, Rack: r, Mode: int(mode), IgnoreCrossWords: ignoreCross}
+}
+
+// englishRack builds a rack from lowercase a-z letters (index = letter-'a').
+func englishRack(letters string, blanks int) genRack {
+	idx := make([]int, 0, len(letters))
+	for _, ch := range letters {
+		idx = append(idx, int(ch-'a'))
+	}
+	return genRack{Letters: idx, Blanks: blanks}
+}
+
+// russianRack builds a rack from the Russian sample letters used above.
+func russianRack(letters string, blanks int) genRack {
+	m := map[rune]int{'а': 0, 'д': 4, 'о': 15, 'р': 17, 'с': 18, 'я': 32}
+	idx := make([]int, 0, len([]rune(letters)))
+	for _, ch := range letters {
+		i, ok := m[ch]
+		if !ok {
+			log.Fatalf("movegen: russianRack: no index for %q", string(ch))
+		}
+		idx = append(idx, i)
+	}
+	return genRack{Letters: idx, Blanks: blanks}
+}
+
+func writeJSON(path string, v any) {
+	data, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		log.Fatalf("movegen: marshal %s: %v", path, err)
+	}
+	if err := os.WriteFile(path, append(data, '\n'), 0o644); err != nil {
+		log.Fatalf("movegen: write %s: %v", path, err)
+	}
+}

backend/internal/account/email.go

@@ -105,9 +105,10 @@ func (s *EmailService) allowSend(email string) bool {
 
 // issueCode generates a fresh confirm-code and one-tap deeplink token for (accountID,
 // email), replaces any prior pending confirmation, and mails the branded code in
-// locale; purpose selects the email wording and what verifying does. Only the SHA-256
-// hashes of the code and token are stored.
-func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email, purpose, locale string) error {
+// locale; purpose selects the email wording and what verifying does. omitLink drops the
+// one-tap deeplink from the email (account deletion, or a login requested from an installed
+// PWA). Only the SHA-256 hashes of the code and token are stored.
+func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email, purpose, locale string, omitLink bool) error {
 	code, codeHash, err := generateCode()
 	if err != nil {
 		return err
@@ -119,11 +120,12 @@ func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email
 	if err := s.store.replacePendingConfirmation(ctx, accountID, email, codeHash, tokenHash, purpose, s.now().Add(emailCodeTTL)); err != nil {
 		return err
 	}
-	// Account deletion is never a one-tap link (a prefetch or a stray click must not delete
-	// an account): the delete code is entered in the app only, so the email omits the
-	// deeplink and ConfirmByToken refuses a delete token.
+	// Omit the one-tap deeplink when asked: for a login from an installed PWA (the link would
+	// open in a separate browser whose minted session cannot reach the PWA), or for account
+	// deletion (a prefetch or stray click must not delete an account — the delete code is entered
+	// in the app only, and ConfirmByToken refuses a delete token).
 	deeplink := s.confirmURL(token, locale)
-	if purpose == purposeDelete {
+	if purpose == purposeDelete || omitLink {
 		deeplink = ""
 	}
 	msg, err := renderConfirmationEmail(purpose, code, deeplink, s.baseURL, locale)
@@ -175,7 +177,7 @@ func (s *EmailService) RequestCode(ctx context.Context, accountID uuid.UUID, ema
 		}
 		return ErrEmailTaken
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID))
+	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID), false)
 }
 
 // ConfirmCode verifies code for accountID and email. On success it attaches a
@@ -221,8 +223,11 @@ func (s *EmailService) ConfirmCode(ctx context.Context, accountID uuid.UUID, ema
 // the ordinary returning-user login. The code is mailed to the address, so only its
 // real owner can complete the login. On first contact browserTZ (the client's
 // detected "±HH:MM" UTC offset) seeds the new account's time zone and language its UI
-// language. It returns the target account id for the subsequent LoginWithCode.
-func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ, language string) (uuid.UUID, error) {
+// language. When pwa is set (the request came from an installed PWA) the login email omits the
+// one-tap confirm link — it would open in a separate browser, out of the PWA's reach — so the
+// code is entered in the same window. It returns the target account id for the subsequent
+// LoginWithCode.
+func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ, language string, pwa bool) (uuid.UUID, error) {
 	addr, err := normalizeEmail(email)
 	if err != nil {
 		return uuid.UUID{}, err
@@ -234,7 +239,7 @@ func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ, l
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	if err := s.issueCode(ctx, acc.ID, addr, purposeLogin, language); err != nil {
+	if err := s.issueCode(ctx, acc.ID, addr, purposeLogin, language, pwa); err != nil {
 		return uuid.UUID{}, err
 	}
 	return acc.ID, nil

backend/internal/account/link.go

@@ -92,7 +92,7 @@ func (s *EmailService) RequestLinkCode(ctx context.Context, accountID uuid.UUID,
 	if !s.allowSend(addr) {
 		return ErrTooManyRequests
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID))
+	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID), false)
 }
 
 // ConfirmLink verifies code for (accountID, email) and reports the address's
@@ -140,7 +140,7 @@ func (s *EmailService) RequestChangeCode(ctx context.Context, accountID uuid.UUI
 	if !s.allowSend(addr) {
 		return ErrTooManyRequests
 	}
-	return s.issueCode(ctx, accountID, addr, purposeChange, s.accountLocale(ctx, accountID))
+	return s.issueCode(ctx, accountID, addr, purposeChange, s.accountLocale(ctx, accountID), false)
 }
 
 // ConfirmChange verifies code for (accountID, newEmail) and atomically replaces the
@@ -199,7 +199,7 @@ func (s *EmailService) RequestDeleteCode(ctx context.Context, accountID uuid.UUI
 	if !s.allowSend(addr) {
 		return ErrTooManyRequests
 	}
-	return s.issueCode(ctx, accountID, addr, purposeDelete, s.accountLocale(ctx, accountID))
+	return s.issueCode(ctx, accountID, addr, purposeDelete, s.accountLocale(ctx, accountID), false)
 }
 
 // VerifyDeleteCode verifies the account-deletion code against the account's own email and

backend/internal/adminalert/notify.go

@@ -33,21 +33,21 @@ type Notifier struct {
 	complaints ComplaintCounter
 	from       string
 	to         string
-	consoleURL string
 	clock      func() time.Time
 	log        *zap.Logger
 	last       time.Time
 }
 
-// New constructs a Notifier. from and to are the alert sender and recipient(s); consoleURL,
-// when non-empty, is the admin-console link included in the email. log may be nil. The
-// watermark starts at "now", so only items arriving after start-up are reported.
-func New(mailer account.Mailer, fb FeedbackCounter, cp ComplaintCounter, from, to, consoleURL string, log *zap.Logger) *Notifier {
+// New constructs a Notifier. from and to are the alert sender and recipient(s); log may be
+// nil. The watermark starts at "now", so only items arriving after start-up are reported. The
+// digest deliberately carries no admin-console link — an admin URL must never travel in an
+// email, where a mail provider could cache or index it.
+func New(mailer account.Mailer, fb FeedbackCounter, cp ComplaintCounter, from, to string, log *zap.Logger) *Notifier {
 	if log == nil {
 		log = zap.NewNop()
 	}
 	return &Notifier{
-		mailer: mailer, feedback: fb, complaints: cp, from: from, to: to, consoleURL: consoleURL,
+		mailer: mailer, feedback: fb, complaints: cp, from: from, to: to,
 		clock: func() time.Time { return time.Now().UTC() }, log: log, last: time.Now().UTC(),
 	}
 }
@@ -103,10 +103,9 @@ func (n *Notifier) digest(fb, cp int) account.Message {
 		parts = append(parts, fmt.Sprintf("%d new word complaint(s)", cp))
 	}
 	summary := strings.Join(parts, ", ")
+	// No admin-console link in the body: an admin URL must never travel in an email (a mail
+	// provider could cache or index it). The operator opens the console directly.
 	text := summary + "."
-	if n.consoleURL != "" {
-		text += "\n\nOpen the admin console: " + n.consoleURL
-	}
 	return account.Message{
 		From:    n.from,
 		To:      n.to,

backend/internal/adminalert/notify_test.go

@@ -28,7 +28,7 @@ func (m *recordingMailer) Send(_ context.Context, msg account.Message) error {
 
 func TestNotifierSkipsWhenNothingNew(t *testing.T) {
 	mailer := &recordingMailer{}
-	n := New(mailer, fbCounter{0}, cpCounter{0}, "alerts@erudit-game.ru", "op@x.ru", "", nil)
+	n := New(mailer, fbCounter{0}, cpCounter{0}, "alerts@erudit-game.ru", "op@x.ru", nil)
 	n.tick(context.Background())
 	if len(mailer.sent) != 0 {
 		t.Fatalf("sent %d emails, want 0 when nothing is new", len(mailer.sent))
@@ -37,7 +37,7 @@ func TestNotifierSkipsWhenNothingNew(t *testing.T) {
 
 func TestNotifierDigestsNewItems(t *testing.T) {
 	mailer := &recordingMailer{}
-	n := New(mailer, fbCounter{2}, cpCounter{1}, "alerts@erudit-game.ru", "op@x.ru, two@x.ru", "https://erudit-game.ru/_gm", nil)
+	n := New(mailer, fbCounter{2}, cpCounter{1}, "alerts@erudit-game.ru", "op@x.ru, two@x.ru", nil)
 	n.tick(context.Background())
 	if len(mailer.sent) != 1 {
 		t.Fatalf("sent %d emails, want 1 digest", len(mailer.sent))
@@ -49,7 +49,9 @@ func TestNotifierDigestsNewItems(t *testing.T) {
 	if !strings.Contains(msg.Subject, "2 new feedback") || !strings.Contains(msg.Subject, "1 new word complaint") {
 		t.Errorf("digest subject = %q, want the feedback + complaint counts", msg.Subject)
 	}
-	if !strings.Contains(msg.Text, "/_gm") {
-		t.Errorf("digest body = %q, want the console link", msg.Text)
+	// The digest must never carry an admin-console link — an admin URL in an email is a leak
+	// (mail providers cache/index it).
+	if strings.Contains(msg.Text, "/_gm") || strings.Contains(strings.ToLower(msg.Text), "admin console") {
+		t.Errorf("digest body = %q, must not carry an admin-console link", msg.Text)
 	}
 }

backend/internal/adminconsole/assets/console.css

@@ -193,3 +193,24 @@ code { background: var(--bg); padding: 0.05rem 0.3rem; border-radius: 4px; }
 .replay-log { margin: 0.4rem 0 0; padding-left: 1.4rem; max-height: 14rem; overflow: auto; font-size: 0.85rem; }
 .replay-log li { color: var(--ink-dim); padding: 0.1rem 0; }
 .replay-log li.cur { color: var(--ink); font-weight: 600; }
+
+/* Banner colour override editor + live preview (banner_detail). The override
+   fieldsets group the enable toggle with the native colour swatches; the preview
+   renders a sample strip on both themes from those inputs (see the inline script). */
+.ovr { border: 1px solid var(--line); border-radius: 6px; padding: 0.3rem 0.8rem 0.7rem; margin: 0.2rem 0; }
+.ovr legend { padding: 0 0.3rem; font-size: 0.85rem; color: var(--ink); }
+.ovr legend label { flex-direction: row; align-items: center; gap: 0.4rem; color: var(--ink); }
+.ovr .note { margin: 0.2rem 0 0.4rem; }
+.ovr .swatches { display: flex; flex-wrap: wrap; gap: 1rem; }
+.ovr .swatches label { flex-direction: column; gap: 0.25rem; align-items: flex-start; }
+.ovr input[type=color] { width: 3rem; height: 1.8rem; padding: 0; border: 1px solid var(--line); border-radius: 4px; background: var(--bg); cursor: pointer; }
+.ovr input[type=color]:disabled { opacity: 0.4; cursor: default; }
+.ovr .hex { font-size: 0.72rem; color: var(--ink-dim); font-variant-numeric: tabular-nums; }
+.banner-preview { display: flex; flex-wrap: wrap; gap: 0.8rem; margin: 0.7rem 0 0.2rem; }
+.banner-preview .bp { flex: 1 1 18rem; }
+.banner-preview .bp-label { display: block; font-size: 0.75rem; color: var(--ink-dim); margin-bottom: 0.25rem; }
+.ad-frame { padding: 0.7rem; border-radius: 6px; border: 1px solid var(--line); }
+.ad-frame.light { background: #f4f6f9; }
+.ad-frame.dark { background: #0f1420; }
+.ad-sample { padding: 0.35rem 0.7rem; font-size: 0.85rem; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.ad-sample .ad-link { text-decoration: underline; }

backend/internal/adminconsole/templates/pages/banner_detail.gohtml

@@ -11,10 +11,72 @@
 <label>Starts (UTC) <input type="datetime-local" name="starts_at" value="{{.StartsAt}}"></label>
 <label>Ends (UTC) <input type="datetime-local" name="ends_at" value="{{.EndsAt}}"></label>
 <label><input type="checkbox" name="enabled"{{if .Enabled}} checked{{end}}> Enabled</label>
+<fieldset class="ovr">
+<legend><label><input type="checkbox" name="urgent"{{if .Urgent}} checked{{end}}> Urgent</label></legend>
+<p class="note">Shows to <em>everyone</em>, always — bypassing paid accounts, hint wallets and the no-banner role. While any urgent campaign is live it is the only thing the strip shows (other campaigns and the default are suppressed). For system alerts.</p>
+</fieldset>
+<fieldset class="ovr" data-ovr-group>
+<legend><label><input type="checkbox" name="override_all_on" data-ovr="all"{{if .OverrideAllOn}} checked{{end}}> Colour override — all themes</label></legend>
+<div class="swatches">
+<label>Background <input type="color" name="override_bg" value="{{.AllBg}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
+<label>Text <input type="color" name="override_fg" value="{{.AllFg}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
+<label>Link <input type="color" name="override_link" value="{{.AllLink}}" data-ovr-color{{if not .OverrideAllOn}} disabled{{end}}><span class="hex"></span></label>
+</div>
+</fieldset>
+<fieldset class="ovr" data-ovr-group>
+<legend><label><input type="checkbox" name="override_dark_on" data-ovr="dark"{{if .OverrideDarkOn}} checked{{end}}> Colour override — dark theme only</label></legend>
+<div class="swatches">
+<label>Background <input type="color" name="override_bg_dark" value="{{.DarkBg}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
+<label>Text <input type="color" name="override_fg_dark" value="{{.DarkFg}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
+<label>Link <input type="color" name="override_link_dark" value="{{.DarkLink}}" data-ovr-color{{if not .OverrideDarkOn}} disabled{{end}}><span class="hex"></span></label>
+</div>
+</fieldset>
 {{end}}
 <div><button type="submit">Save</button></div>
 </form>
 {{if not .IsDefault}}
+<div class="banner-preview">
+<div class="bp"><span class="bp-label">Light theme</span><div class="ad-frame light"><div class="ad-sample" id="prev-light"><span>Sample banner text — <span class="ad-link">a link</span></span></div></div></div>
+<div class="bp"><span class="bp-label">Dark theme</span><div class="ad-frame dark"><div class="ad-sample" id="prev-dark"><span>Sample banner text — <span class="ad-link">a link</span></span></div></div></div>
+</div>
+<p class="note">Live preview of the strip on both themes. An empty override falls back to the neutral theme colours; the top/bottom border is derived from the background.</p>
+<script>
+(function(){
+  // Neutral fallbacks — mirror ui/src/app.css (--ad-bg / --text-muted / --accent).
+  var TOK={light:{bg:'#e3e7ee',fg:'#6b7280',link:'#2f6df6'},dark:{bg:'#272f3c',fg:'#9aa3b2',link:'#5b8cff'}};
+  function byName(n){return document.querySelector('[name="'+n+'"]');}
+  var allOn=byName('override_all_on'), darkOn=byName('override_dark_on');
+  if(!allOn||!darkOn){return;}
+  var f={ab:byName('override_bg'),af:byName('override_fg'),al:byName('override_link'),db:byName('override_bg_dark'),df:byName('override_fg_dark'),dl:byName('override_link_dark')};
+  var lightEl=document.getElementById('prev-light'), darkEl=document.getElementById('prev-dark');
+  function hexToRgb(h){h=h.replace('#','');return [parseInt(h.slice(0,2),16),parseInt(h.slice(2,4),16),parseInt(h.slice(4,6),16)];}
+  function pad(x){x=Math.max(0,Math.min(255,Math.round(x))).toString(16);return x.length<2?'0'+x:x;}
+  function rgbToHex(r){return '#'+pad(r[0])+pad(r[1])+pad(r[2]);}
+  function mix(a,b,t){return [a[0]+(b[0]-a[0])*t,a[1]+(b[1]-a[1])*t,a[2]+(b[2]-a[2])*t];}
+  function lum(r){return (0.2126*r[0]+0.7152*r[1]+0.0722*r[2])/255;}
+  // Derived border: nudge the background 14% toward black on a light bg, toward white on a dark bg.
+  function border(bg){var r=hexToRgb(bg);return rgbToHex(mix(r, lum(r)>0.5?[0,0,0]:[255,255,255], 0.14));}
+  function paint(el,c){
+    el.style.background=c.bg; el.style.color=c.fg;
+    el.style.borderTop='1px solid '+border(c.bg); el.style.borderBottom='1px solid '+border(c.bg);
+    var a=el.querySelector('.ad-link'); if(a){a.style.color=c.link;}
+  }
+  function resolve(){
+    var light=allOn.checked?{bg:f.ab.value,fg:f.af.value,link:f.al.value}:TOK.light;
+    var dark=darkOn.checked?{bg:f.db.value,fg:f.df.value,link:f.dl.value}
+            :(allOn.checked?{bg:f.ab.value,fg:f.af.value,link:f.al.value}:TOK.dark);
+    paint(lightEl,light); paint(darkEl,dark);
+    document.querySelectorAll('.ovr .swatches label').forEach(function(lab){
+      var inp=lab.querySelector('input[type=color]'), hx=lab.querySelector('.hex');
+      if(inp&&hx){hx.textContent=inp.value;}
+    });
+  }
+  function toggleGroup(chk){chk.closest('fieldset').querySelectorAll('[data-ovr-color]').forEach(function(inp){inp.disabled=!chk.checked;});}
+  [allOn,darkOn].forEach(function(chk){chk.addEventListener('change',function(){toggleGroup(chk);resolve();});});
+  Object.keys(f).forEach(function(k){f[k].addEventListener('input',resolve);});
+  resolve();
+})();
+</script>
 <form class="form" method="post" action="/_gm/banners/{{.ID}}/delete" onsubmit="return confirm('Delete this campaign and its messages?')">
 <button type="submit" class="danger">Delete campaign</button>
 </form>

backend/internal/adminconsole/views.go

@@ -498,15 +498,30 @@ type BannerCampaignRow struct {
 
 // BannerDetailView is the campaign detail/edit page. StartsAt/EndsAt are the
 // "YYYY-MM-DDTHH:MM" (UTC) values for the datetime-local inputs, empty when open.
+//
+// The colour-override and urgent fields drive the non-default campaign's editor:
+// OverrideAllOn/OverrideDarkOn report whether each colour set is active, and the
+// six *Bg/*Fg/*Link values seed the native colour inputs — the stored override
+// when a set is on, otherwise the neutral theme token so the picker starts from a
+// sensible colour and the live preview shows the real fallback.
 type BannerDetailView struct {
-	ID        string
-	Name      string
-	Weight    int
-	IsDefault bool
-	Enabled   bool
-	StartsAt  string
-	EndsAt    string
-	Messages  []BannerMessageRow
+	ID             string
+	Name           string
+	Weight         int
+	IsDefault      bool
+	Enabled        bool
+	StartsAt       string
+	EndsAt         string
+	Urgent         bool
+	OverrideAllOn  bool
+	AllBg          string
+	AllFg          string
+	AllLink        string
+	OverrideDarkOn bool
+	DarkBg         string
+	DarkFg         string
+	DarkLink       string
+	Messages       []BannerMessageRow
 }
 
 // BannerMessageRow is one bilingual message of a campaign. First/Last drive the

backend/internal/ads/ads.go

@@ -30,6 +30,15 @@ var ErrDefaultImmutable = errors.New("ads: the default campaign cannot be modifi
 // window or message body).
 var ErrValidation = errors.New("ads: validation")
 
+// ColorSet is an optional per-campaign colour override for the banner strip:
+// background, foreground (text) and link, each a "#rrggbb" hex string. The three
+// are set together or the whole set is absent (a nil *ColorSet).
+type ColorSet struct {
+	Bg   string
+	Fg   string
+	Link string
+}
+
 // Campaign is one advertising placement order with its messages.
 type Campaign struct {
 	ID        uuid.UUID // uuid.Nil on create
@@ -40,6 +49,16 @@ type Campaign struct {
 	StartsAt  *time.Time // nil = open-ended start; always nil for the default
 	EndsAt    *time.Time // nil = open-ended end; always nil for the default
 	Messages  []Message
+	// OverrideAll paints the strip on every theme; OverrideDark, when set, further
+	// overrides the dark theme (the client resolves dark ← dark ?? all ?? token,
+	// light ← all ?? token). Both are nil for the default campaign and for a
+	// campaign that keeps the neutral theme tokens. Non-default only.
+	OverrideAll  *ColorSet
+	OverrideDark *ColorSet
+	// Urgent forces the banner on every viewer (bypassing eligibility) and, while
+	// any urgent campaign is active, suppresses every non-urgent campaign and the
+	// default remainder. Non-default only; always false for the default campaign.
+	Urgent    bool
 	CreatedAt time.Time
 	UpdatedAt time.Time
 }
@@ -70,10 +89,15 @@ type Timings struct {
 
 // ActiveCampaign is one campaign in the resolved rotation feed sent to a client:
 // its GCD-reduced show weight and its messages, already resolved to the viewer's
-// language and in display (round-robin) order.
+// language and in display (round-robin) order, plus the optional colour overrides
+// the client applies to the strip (nil = the neutral theme tokens). Urgency is not
+// carried here: it is resolved server-side into the set's membership and the
+// eligibility bypass, so the client only ever renders what it is sent.
 type ActiveCampaign struct {
-	Weight   int
-	Messages []string
+	Weight       int
+	Messages     []string
+	OverrideAll  *ColorSet
+	OverrideDark *ColorSet
 }
 
 // Eligible reports whether an account should be shown the advertising banner: a
@@ -85,14 +109,20 @@ func Eligible(paidAccount bool, hintBalance int, hasNoBanner bool) bool {
 }
 
 // computeActiveSet builds the resolved rotation feed from the enabled campaigns
-// at time now, in language lang. Campaigns outside their validity window, and
-// campaigns with no messages, are dropped. The default campaign's effective
-// weight is the remainder up to 100% — max(0, 100 - sum of active timed
-// weights) — so it fills unsold inventory and is dropped entirely when timed
-// campaigns already reach 100%. Weights are then reduced by their GCD so the
-// fair rotation cycle stays short. The input is expected to be the enabled
-// campaigns (ActiveCampaigns); disabled ones must already be excluded.
-func computeActiveSet(campaigns []Campaign, now time.Time, lang string) []ActiveCampaign {
+// at time now, in language lang, and reports whether the feed is an urgent one.
+// Campaigns outside their validity window, and campaigns with no messages, are
+// dropped.
+//
+// While any active campaign is urgent, the feed is the urgent campaigns alone —
+// every non-urgent timed campaign and the default remainder are suppressed for
+// the duration (and the caller shows the feed to every viewer, bypassing
+// eligibility). Otherwise the default campaign's effective weight is the
+// remainder up to 100% — max(0, 100 - sum of active timed weights) — so it fills
+// unsold inventory and is dropped entirely when timed campaigns already reach
+// 100%. Weights are then reduced by their GCD so the fair rotation cycle stays
+// short. The input is expected to be the enabled campaigns (ActiveCampaigns);
+// disabled ones must already be excluded.
+func computeActiveSet(campaigns []Campaign, now time.Time, lang string) ([]ActiveCampaign, bool) {
 	var timed []Campaign
 	var def *Campaign
 	for i := range campaigns {
@@ -108,20 +138,54 @@ func computeActiveSet(campaigns []Campaign, now time.Time, lang string) []Active
 			timed = append(timed, c)
 		}
 	}
+	if urgent := filterUrgent(timed); len(urgent) > 0 {
+		out := make([]ActiveCampaign, 0, len(urgent))
+		for _, c := range urgent {
+			out = append(out, activeFrom(c, lang))
+		}
+		reduceByGCD(out)
+		return out, true
+	}
 	sumTimed := 0
 	for _, c := range timed {
 		sumTimed += c.Weight
 	}
 	out := make([]ActiveCampaign, 0, len(timed)+1)
 	for _, c := range timed {
-		out = append(out, ActiveCampaign{Weight: c.Weight, Messages: resolveBodies(c.Messages, lang)})
+		out = append(out, activeFrom(c, lang))
 	}
 	if def != nil {
 		if dw := 100 - sumTimed; dw > 0 {
-			out = append(out, ActiveCampaign{Weight: dw, Messages: resolveBodies(def.Messages, lang)})
+			a := activeFrom(*def, lang)
+			a.Weight = dw // the default's stored weight is nominal; it fills the remainder
+			out = append(out, a)
 		}
 	}
 	reduceByGCD(out)
+	return out, false
+}
+
+// activeFrom projects a campaign to its rotation-feed entry: its show weight, its
+// language-resolved messages and its colour overrides (carried through by
+// reference, they are read-only).
+func activeFrom(c Campaign, lang string) ActiveCampaign {
+	return ActiveCampaign{
+		Weight:       c.Weight,
+		Messages:     resolveBodies(c.Messages, lang),
+		OverrideAll:  c.OverrideAll,
+		OverrideDark: c.OverrideDark,
+	}
+}
+
+// filterUrgent returns the urgent campaigns among cs, preserving order. It is the
+// preempt selector: a non-empty result makes the whole feed urgent.
+func filterUrgent(cs []Campaign) []Campaign {
+	var out []Campaign
+	for _, c := range cs {
+		if c.Urgent {
+			out = append(out, c)
+		}
+	}
 	return out
 }
 

backend/internal/ads/ads_test.go

@@ -46,12 +46,19 @@ func TestComputeActiveSet(t *testing.T) {
 	timed := func(name string, weight int, starts, ends *time.Time, msgs []Message) Campaign {
 		return Campaign{Name: name, Weight: weight, Enabled: true, StartsAt: starts, EndsAt: ends, Messages: msgs}
 	}
+	urgent := func(name string, weight int, msgs []Message) Campaign {
+		c := timed(name, weight, nil, nil, msgs)
+		c.Urgent = true
+		return c
+	}
+	red := &ColorSet{Bg: "#aa0000", Fg: "#ffffff", Link: "#ffdd00"}
 
 	tests := []struct {
-		name      string
-		campaigns []Campaign
-		lang      string
-		want      []ActiveCampaign
+		name       string
+		campaigns  []Campaign
+		lang       string
+		want       []ActiveCampaign
+		wantUrgent bool
 	}{
 		{
 			name:      "default only reduces to weight 1",
@@ -152,22 +159,71 @@ func TestComputeActiveSet(t *testing.T) {
 			lang: "en",
 			want: []ActiveCampaign{{Weight: 1, Messages: []string{"one-en", "two-en"}}},
 		},
+		{
+			name: "urgent preempts default and normal timed",
+			campaigns: []Campaign{
+				def(msg("house")),
+				timed("promo", 40, nil, nil, msg("promo")),
+				urgent("alert", 50, msg("alert")),
+			},
+			lang: "en",
+			// only the urgent campaign survives; a lone weight reduces to 1.
+			want:       []ActiveCampaign{{Weight: 1, Messages: []string{"alert-en"}}},
+			wantUrgent: true,
+		},
+		{
+			name: "multiple urgent share the feed by gcd",
+			campaigns: []Campaign{
+				def(msg("house")),
+				urgent("a", 60, msg("a")),
+				urgent("b", 40, msg("b")),
+			},
+			lang: "en",
+			// default and any non-urgent dropped; gcd(60,40)=20 -> 3 and 2.
+			want: []ActiveCampaign{
+				{Weight: 3, Messages: []string{"a-en"}},
+				{Weight: 2, Messages: []string{"b-en"}},
+			},
+			wantUrgent: true,
+		},
+		{
+			name: "out-of-window urgent does not preempt",
+			campaigns: []Campaign{
+				def(msg("house")),
+				func() Campaign { c := urgent("future", 50, msg("future")); c.StartsAt = &future; return c }(),
+			},
+			lang: "en",
+			// the urgent campaign is not yet live, so the normal default feed stands.
+			want: []ActiveCampaign{{Weight: 1, Messages: []string{"house-en"}}},
+		},
+		{
+			name: "colour overrides ride the active campaign",
+			campaigns: []Campaign{
+				def(msg("house")),
+				func() Campaign { c := timed("promo", 100, nil, nil, msg("promo")); c.OverrideAll = red; return c }(),
+			},
+			lang: "en",
+			want: []ActiveCampaign{{Weight: 1, Messages: []string{"promo-en"}, OverrideAll: red}},
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := computeActiveSet(tt.campaigns, now, tt.lang)
+			got, gotUrgent := computeActiveSet(tt.campaigns, now, tt.lang)
 			if !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("computeActiveSet() =\n  %#v\nwant\n  %#v", got, tt.want)
 			}
+			if gotUrgent != tt.wantUrgent {
+				t.Errorf("computeActiveSet() urgent = %v, want %v", gotUrgent, tt.wantUrgent)
+			}
 		})
 	}
 }
 
 func TestComputeActiveSetEmpty(t *testing.T) {
 	// No campaigns at all yields an empty (non-nil-or-nil) feed without panicking.
-	if got := computeActiveSet(nil, time.Now(), "en"); len(got) != 0 {
-		t.Errorf("computeActiveSet(nil) = %#v, want empty", got)
+	if got, urgent := computeActiveSet(nil, time.Now(), "en"); len(got) != 0 || urgent {
+		t.Errorf("computeActiveSet(nil) = %#v urgent=%v, want empty non-urgent", got, urgent)
 	}
 }
 

backend/internal/ads/service.go

@@ -3,6 +3,7 @@ package ads
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"strings"
 	"time"
 
@@ -40,17 +41,20 @@ func NewService(store *Store) *Service { return &Service{store: store} }
 // ActiveSet returns the resolved rotation feed for a viewer in language lang
 // (en/ru) together with the global display timings: the currently-active
 // campaigns, each with its GCD-reduced show weight and its messages resolved to
-// lang, ready for the client's weighted round-robin.
-func (s *Service) ActiveSet(ctx context.Context, lang string) ([]ActiveCampaign, Timings, error) {
+// lang, ready for the client's weighted round-robin. The bool result reports
+// whether the feed is urgent — an urgent feed is shown to every viewer
+// regardless of eligibility (the caller skips the eligibility gate for it).
+func (s *Service) ActiveSet(ctx context.Context, lang string) ([]ActiveCampaign, Timings, bool, error) {
 	campaigns, err := s.store.ActiveCampaigns(ctx)
 	if err != nil {
-		return nil, Timings{}, err
+		return nil, Timings{}, false, err
 	}
 	timings, err := s.store.Settings(ctx)
 	if err != nil {
-		return nil, Timings{}, err
+		return nil, Timings{}, false, err
 	}
-	return computeActiveSet(campaigns, time.Now().UTC(), lang), timings, nil
+	set, urgent := computeActiveSet(campaigns, time.Now().UTC(), lang)
+	return set, timings, urgent, nil
 }
 
 // ListCampaigns returns every campaign with its messages, for the admin console.
@@ -76,8 +80,13 @@ func (s *Service) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, er
 	if err := validWindow(c.StartsAt, c.EndsAt); err != nil {
 		return uuid.Nil, err
 	}
+	all, dark, err := validOverrides(c.OverrideAll, c.OverrideDark)
+	if err != nil {
+		return uuid.Nil, err
+	}
 	return s.store.CreateCampaign(ctx, Campaign{
 		Name: name, Weight: c.Weight, Enabled: c.Enabled, StartsAt: c.StartsAt, EndsAt: c.EndsAt,
+		OverrideAll: all, OverrideDark: dark, Urgent: c.Urgent,
 	})
 }
 
@@ -99,6 +108,7 @@ func (s *Service) UpdateCampaign(ctx context.Context, c Campaign) error {
 		upd.Enabled = true
 		upd.StartsAt = nil
 		upd.EndsAt = nil
+		// The default (house) campaign stays plain: no colour overrides, never urgent.
 	} else {
 		if err := validWeight(c.Weight); err != nil {
 			return err
@@ -106,10 +116,17 @@ func (s *Service) UpdateCampaign(ctx context.Context, c Campaign) error {
 		if err := validWindow(c.StartsAt, c.EndsAt); err != nil {
 			return err
 		}
+		all, dark, err := validOverrides(c.OverrideAll, c.OverrideDark)
+		if err != nil {
+			return err
+		}
 		upd.Weight = c.Weight
 		upd.Enabled = c.Enabled
 		upd.StartsAt = c.StartsAt
 		upd.EndsAt = c.EndsAt
+		upd.OverrideAll = all
+		upd.OverrideDark = dark
+		upd.Urgent = c.Urgent
 	}
 	return s.store.UpdateCampaign(ctx, upd)
 }
@@ -254,6 +271,46 @@ func validWindow(starts, ends *time.Time) error {
 	return nil
 }
 
+// hexColor matches a "#rrggbb" colour — the format the console's native colour
+// input emits and the wire carries.
+var hexColor = regexp.MustCompile(`^#[0-9a-fA-F]{6}$`)
+
+// validOverrides validates the two optional colour sets together and returns
+// their normalised copies (nil when a set is absent), so a caller can store them
+// directly.
+func validOverrides(all, dark *ColorSet) (*ColorSet, *ColorSet, error) {
+	va, err := validColorSet(all)
+	if err != nil {
+		return nil, nil, err
+	}
+	vd, err := validColorSet(dark)
+	if err != nil {
+		return nil, nil, err
+	}
+	return va, vd, nil
+}
+
+// validColorSet validates one optional colour override: a nil set passes (no
+// override); otherwise all three colours must be present and "#rrggbb". It
+// returns a trimmed, lower-cased copy.
+func validColorSet(cs *ColorSet) (*ColorSet, error) {
+	if cs == nil {
+		return nil, nil
+	}
+	bg := strings.TrimSpace(cs.Bg)
+	fg := strings.TrimSpace(cs.Fg)
+	link := strings.TrimSpace(cs.Link)
+	if bg == "" || fg == "" || link == "" {
+		return nil, fmt.Errorf("%w: a colour override needs all of background, text and link", ErrValidation)
+	}
+	for _, h := range []string{bg, fg, link} {
+		if !hexColor.MatchString(h) {
+			return nil, fmt.Errorf("%w: colours must be #rrggbb hex", ErrValidation)
+		}
+	}
+	return &ColorSet{Bg: strings.ToLower(bg), Fg: strings.ToLower(fg), Link: strings.ToLower(link)}, nil
+}
+
 // validBodies trims and bounds both mandatory language bodies of a message.
 func validBodies(bodyEn, bodyRu string) (string, string, error) {
 	en := strings.TrimSpace(bodyEn)

backend/internal/ads/store.go

@@ -90,15 +90,23 @@ func (s *Store) Campaign(ctx context.Context, id uuid.UUID) (Campaign, error) {
 func (s *Store) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, error) {
 	id := uuid.New()
 	now := time.Now().UTC()
+	abg, afg, alink := colorCols(c.OverrideAll)
+	dbg, dfg, dlink := colorCols(c.OverrideDark)
 	stmt := table.AdCampaigns.INSERT(
 		table.AdCampaigns.CampaignID, table.AdCampaigns.Name, table.AdCampaigns.Weight,
 		table.AdCampaigns.IsDefault, table.AdCampaigns.Enabled,
 		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt,
+		table.AdCampaigns.OverrideBg, table.AdCampaigns.OverrideFg, table.AdCampaigns.OverrideLink,
+		table.AdCampaigns.OverrideBgDark, table.AdCampaigns.OverrideFgDark, table.AdCampaigns.OverrideLinkDark,
+		table.AdCampaigns.Urgent,
 		table.AdCampaigns.CreatedAt, table.AdCampaigns.UpdatedAt,
 	).VALUES(
 		postgres.UUID(id), postgres.String(c.Name), postgres.Int(int64(c.Weight)),
 		postgres.Bool(false), postgres.Bool(c.Enabled),
 		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt),
+		abg, afg, alink,
+		dbg, dfg, dlink,
+		postgres.Bool(c.Urgent),
 		postgres.TimestampzT(now), postgres.TimestampzT(now),
 	)
 	if _, err := stmt.ExecContext(ctx, s.db); err != nil {
@@ -111,12 +119,20 @@ func (s *Store) CreateCampaign(ctx context.Context, c Campaign) (uuid.UUID, erro
 // window. The default flag is never touched here. Returns ErrNotFound when no
 // campaign matches.
 func (s *Store) UpdateCampaign(ctx context.Context, c Campaign) error {
+	abg, afg, alink := colorCols(c.OverrideAll)
+	dbg, dfg, dlink := colorCols(c.OverrideDark)
 	stmt := table.AdCampaigns.UPDATE(
 		table.AdCampaigns.Name, table.AdCampaigns.Weight, table.AdCampaigns.Enabled,
-		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt, table.AdCampaigns.UpdatedAt,
+		table.AdCampaigns.StartsAt, table.AdCampaigns.EndsAt,
+		table.AdCampaigns.OverrideBg, table.AdCampaigns.OverrideFg, table.AdCampaigns.OverrideLink,
+		table.AdCampaigns.OverrideBgDark, table.AdCampaigns.OverrideFgDark, table.AdCampaigns.OverrideLinkDark,
+		table.AdCampaigns.Urgent, table.AdCampaigns.UpdatedAt,
 	).SET(
 		postgres.String(c.Name), postgres.Int(int64(c.Weight)), postgres.Bool(c.Enabled),
-		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt), postgres.TimestampzT(time.Now().UTC()),
+		tsOrNull(c.StartsAt), tsOrNull(c.EndsAt),
+		abg, afg, alink,
+		dbg, dfg, dlink,
+		postgres.Bool(c.Urgent), postgres.TimestampzT(time.Now().UTC()),
 	).WHERE(table.AdCampaigns.CampaignID.EQ(postgres.UUID(c.ID)))
 	return execOne(ctx, s.db, stmt, "update campaign")
 }
@@ -257,18 +273,40 @@ func execOne(ctx context.Context, db qrm.Executable, stmt postgres.Statement, wh
 
 func modelToCampaign(r model.AdCampaigns) Campaign {
 	return Campaign{
-		ID:        r.CampaignID,
-		Name:      r.Name,
-		Weight:    int(r.Weight),
-		IsDefault: r.IsDefault,
-		Enabled:   r.Enabled,
-		StartsAt:  r.StartsAt,
-		EndsAt:    r.EndsAt,
-		CreatedAt: r.CreatedAt,
-		UpdatedAt: r.UpdatedAt,
+		ID:           r.CampaignID,
+		Name:         r.Name,
+		Weight:       int(r.Weight),
+		IsDefault:    r.IsDefault,
+		Enabled:      r.Enabled,
+		StartsAt:     r.StartsAt,
+		EndsAt:       r.EndsAt,
+		OverrideAll:  colorSetFrom(r.OverrideBg, r.OverrideFg, r.OverrideLink),
+		OverrideDark: colorSetFrom(r.OverrideBgDark, r.OverrideFgDark, r.OverrideLinkDark),
+		Urgent:       r.Urgent,
+		CreatedAt:    r.CreatedAt,
+		UpdatedAt:    r.UpdatedAt,
 	}
 }
 
+// colorSetFrom rebuilds an optional ColorSet from three nullable colour columns.
+// The all-or-nothing CHECK keeps the trio consistent, so a nil in any one means
+// the set is absent.
+func colorSetFrom(bg, fg, link *string) *ColorSet {
+	if bg == nil || fg == nil || link == nil {
+		return nil
+	}
+	return &ColorSet{Bg: *bg, Fg: *fg, Link: *link}
+}
+
+// colorCols renders a *ColorSet as its three column value-expressions in
+// bg, fg, link order — NULL for each when the set is absent.
+func colorCols(cs *ColorSet) (bg, fg, link postgres.Expression) {
+	if cs == nil {
+		return postgres.NULL, postgres.NULL, postgres.NULL
+	}
+	return postgres.String(cs.Bg), postgres.String(cs.Fg), postgres.String(cs.Link)
+}
+
 func modelToMessage(r model.AdMessages) Message {
 	return Message{
 		ID:         r.MessageID,

backend/internal/inttest/banner_console_test.go

@@ -192,8 +192,9 @@ func TestBannerMessageOwnership(t *testing.T) {
 type profileBanner struct {
 	Banner *struct {
 		Campaigns []struct {
-			Weight   int      `json:"weight"`
-			Messages []string `json:"messages"`
+			Weight     int      `json:"weight"`
+			Messages   []string `json:"messages"`
+			OverrideBg string   `json:"override_bg"`
 		} `json:"campaigns"`
 		Timings struct {
 			HoldMs int `json:"hold_ms"`
@@ -274,3 +275,142 @@ func TestBannerSurvivesProfileUpdate(t *testing.T) {
 		t.Fatalf("profile update dropped the banner block: %v", p.Banner)
 	}
 }
+
+// TestBannerConsoleColorsAndUrgent drives the colour-override + urgent editor over
+// HTTP against real Postgres: an incomplete or malformed colour set is refused, a
+// full two-set override + urgent round-trips through the store (exercising the new
+// columns and CHECK constraints), clearing the sets removes the override, and the
+// default campaign stays plain (colours + urgent are ignored for it).
+func TestBannerConsoleColorsAndUrgent(t *testing.T) {
+	ctx := context.Background()
+	srv, adsSvc := bannerServer(t)
+	h := srv.Handler()
+	base := "http://admin.test/_gm"
+	const origin = "http://admin.test"
+
+	name := "Brand-" + uuid.NewString()[:8]
+	if code, body := consoleDo(h, http.MethodPost, base+"/banners", "name="+name+"&weight=20&enabled=on", origin); code != http.StatusOK || !strings.Contains(body, "Created") {
+		t.Fatalf("create = %d, has Created=%v", code, strings.Contains(body, "Created"))
+	}
+	id := findCampaign(t, adsSvc, name)
+	t.Cleanup(func() { _ = adsSvc.DeleteCampaign(ctx, id) })
+	detail := base + "/banners/" + id.String()
+
+	// A partial colour set (a missing colour) is refused by validation.
+	partial := "name=" + name + "&weight=20&enabled=on&override_all_on=on&override_bg=%23aa0000&override_fg=&override_link=%23ffdd00"
+	if code, b := consoleDo(h, http.MethodPost, detail, partial, origin); code != http.StatusOK || !strings.Contains(b, "Not saved") {
+		t.Fatalf("partial colour = %d, has 'Not saved'=%v", code, strings.Contains(b, "Not saved"))
+	}
+	// A malformed hex is refused.
+	badHex := "name=" + name + "&weight=20&enabled=on&override_all_on=on&override_bg=red&override_fg=%23ffffff&override_link=%23ffdd00"
+	if code, b := consoleDo(h, http.MethodPost, detail, badHex, origin); code != http.StatusOK || !strings.Contains(b, "Not saved") {
+		t.Fatalf("bad hex = %d, has 'Not saved'=%v", code, strings.Contains(b, "Not saved"))
+	}
+	// Both colour sets + urgent persist and round-trip through the store.
+	full := "name=" + name + "&weight=20&enabled=on&urgent=on" +
+		"&override_all_on=on&override_bg=%23aa0000&override_fg=%23ffffff&override_link=%23ffdd00" +
+		"&override_dark_on=on&override_bg_dark=%23330000&override_fg_dark=%23eeeeee&override_link_dark=%23ffcc00"
+	if code, b := consoleDo(h, http.MethodPost, detail, full, origin); code != http.StatusOK || !strings.Contains(b, "Saved") {
+		t.Fatalf("full save = %d, has Saved=%v", code, strings.Contains(b, "Saved"))
+	}
+	cm, err := adsSvc.Campaign(ctx, id)
+	if err != nil {
+		t.Fatalf("read campaign: %v", err)
+	}
+	if cm.OverrideAll == nil || cm.OverrideAll.Bg != "#aa0000" || cm.OverrideAll.Fg != "#ffffff" || cm.OverrideAll.Link != "#ffdd00" {
+		t.Fatalf("override all = %+v", cm.OverrideAll)
+	}
+	if cm.OverrideDark == nil || cm.OverrideDark.Bg != "#330000" || cm.OverrideDark.Fg != "#eeeeee" || cm.OverrideDark.Link != "#ffcc00" {
+		t.Fatalf("override dark = %+v", cm.OverrideDark)
+	}
+	if !cm.Urgent {
+		t.Fatal("urgent not persisted")
+	}
+	// Clearing the sets (both checkboxes off, urgent off) removes the override.
+	if code, _ := consoleDo(h, http.MethodPost, detail, "name="+name+"&weight=20&enabled=on", origin); code != http.StatusOK {
+		t.Fatalf("clear = %d", code)
+	}
+	if cm, _ := adsSvc.Campaign(ctx, id); cm.OverrideAll != nil || cm.OverrideDark != nil || cm.Urgent {
+		t.Fatalf("override not cleared: all=%v dark=%v urgent=%v", cm.OverrideAll, cm.OverrideDark, cm.Urgent)
+	}
+
+	// The default campaign stays plain: submitted colours + urgent are ignored for it.
+	def := defaultCampaign(t, adsSvc)
+	defForm := "name=Default+%28house%29&urgent=on&override_all_on=on&override_bg=%23aa0000&override_fg=%23ffffff&override_link=%23ffdd00"
+	if code, _ := consoleDo(h, http.MethodPost, base+"/banners/"+def.ID.String(), defForm, origin); code != http.StatusOK {
+		t.Fatalf("update default = %d", code)
+	}
+	if again := defaultCampaign(t, adsSvc); again.OverrideAll != nil || again.OverrideDark != nil || again.Urgent {
+		t.Fatalf("default not plain: all=%v dark=%v urgent=%v", again.OverrideAll, again.OverrideDark, again.Urgent)
+	}
+}
+
+// TestBannerUrgentBypassesEligibility checks the urgent flag at the profile level:
+// an urgent campaign preempts the feed (only it shows, with its colours) and reaches
+// every viewer — including the no_banner role and a non-empty hint wallet that
+// otherwise suppress the banner.
+func TestBannerUrgentBypassesEligibility(t *testing.T) {
+	ctx := context.Background()
+	srv, adsSvc := bannerServer(t)
+	accounts := account.NewStore(testDB)
+	id := provisionAccount(t)
+
+	urgentID, err := adsSvc.CreateCampaign(ctx, ads.Campaign{
+		Name: "Alert-" + uuid.NewString()[:8], Weight: 10, Enabled: true, Urgent: true,
+		OverrideAll: &ads.ColorSet{Bg: "#aa0000", Fg: "#ffffff", Link: "#ffdd00"},
+	})
+	if err != nil {
+		t.Fatalf("create urgent: %v", err)
+	}
+	t.Cleanup(func() { _ = adsSvc.DeleteCampaign(ctx, urgentID) })
+	if _, err := adsSvc.AddMessage(ctx, urgentID, "System maintenance tonight", "Ночью тех.работы"); err != nil {
+		t.Fatalf("add urgent message: %v", err)
+	}
+
+	get := func() profileBanner {
+		t.Helper()
+		rec := userGet(t, srv, "/api/v1/user/profile", id)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("profile = %d", rec.Code)
+		}
+		var p profileBanner
+		if err := json.Unmarshal(rec.Body.Bytes(), &p); err != nil {
+			t.Fatalf("decode: %v", err)
+		}
+		return p
+	}
+	assertUrgentOnly := func(what string, p profileBanner) {
+		t.Helper()
+		if p.Banner == nil {
+			t.Fatalf("%s: no banner", what)
+		}
+		if len(p.Banner.Campaigns) != 1 {
+			t.Fatalf("%s: %d campaigns, want only the urgent one (default preempted)", what, len(p.Banner.Campaigns))
+		}
+		c := p.Banner.Campaigns[0]
+		if len(c.Messages) != 1 || c.Messages[0] != "System maintenance tonight" {
+			t.Fatalf("%s: messages = %v, want only the urgent one", what, c.Messages)
+		}
+		if c.OverrideBg != "#aa0000" {
+			t.Fatalf("%s: override_bg = %q, want #aa0000", what, c.OverrideBg)
+		}
+	}
+
+	// A normal viewer sees only the urgent campaign (the default is preempted).
+	assertUrgentOnly("eligible", get())
+
+	// The no_banner role no longer suppresses it — urgent reaches everyone.
+	if err := accounts.GrantRole(ctx, id, account.RoleNoBanner); err != nil {
+		t.Fatalf("grant role: %v", err)
+	}
+	assertUrgentOnly("no_banner", get())
+	if err := accounts.RevokeRole(ctx, id, account.RoleNoBanner); err != nil {
+		t.Fatalf("revoke role: %v", err)
+	}
+
+	// A non-empty hint wallet no longer suppresses it either.
+	if _, err := accounts.GrantHints(ctx, id, 5); err != nil {
+		t.Fatalf("grant hints: %v", err)
+	}
+	assertUrgentOnly("hints", get())
+}

backend/internal/inttest/email_test.go

@@ -206,7 +206,7 @@ func TestEmailLoginFlow(t *testing.T) {
 	svc := account.NewEmailService(account.NewStore(testDB), mailer, "https://erudit-game.ru")
 	email := "login-" + uuid.NewString() + "@example.com"
 
-	accountID, err := svc.RequestLoginCode(ctx, email, "+02:00", "en")
+	accountID, err := svc.RequestLoginCode(ctx, email, "+02:00", "en", false)
 	if err != nil {
 		t.Fatalf("request login code: %v", err)
 	}
@@ -233,7 +233,7 @@ func TestEmailLoginFlow(t *testing.T) {
 	}
 
 	// A second login for the same email is the returning user: same account.
-	if _, err := svc.RequestLoginCode(ctx, email, "", "ru"); err != nil {
+	if _, err := svc.RequestLoginCode(ctx, email, "", "ru", false); err != nil {
 		t.Fatalf("second request: %v", err)
 	}
 	acc2, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody))
@@ -255,7 +255,7 @@ func TestEmailLoginProvisionsGuestUntilConfirmed(t *testing.T) {
 	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
 	email := "squat-" + uuid.NewString() + "@example.com"
 
-	id, err := svc.RequestLoginCode(ctx, email, "", "en")
+	id, err := svc.RequestLoginCode(ctx, email, "", "en", false)
 	if err != nil {
 		t.Fatalf("request login code: %v", err)
 	}
@@ -279,6 +279,34 @@ func TestEmailLoginProvisionsGuestUntilConfirmed(t *testing.T) {
 	}
 }
 
+// TestEmailLoginPWAOmitsLink: a login requested from an installed PWA (pwa=true) mails only the
+// code — no one-tap confirm link, which would otherwise open in a separate browser out of the
+// PWA's reach. A non-PWA request keeps the link.
+func TestEmailLoginPWAOmitsLink(t *testing.T) {
+	ctx := context.Background()
+	mailer := &capturingMailer{}
+	svc := account.NewEmailService(account.NewStore(testDB), mailer, "https://erudit-game.ru")
+
+	pwaEmail := "pwa-login-" + uuid.NewString() + "@example.com"
+	if _, err := svc.RequestLoginCode(ctx, pwaEmail, "", "en", true); err != nil {
+		t.Fatalf("pwa request login: %v", err)
+	}
+	if sixDigit.FindString(mailer.lastBody) == "" {
+		t.Errorf("pwa login mail must still carry the code, body %q", mailer.lastBody)
+	}
+	if confirmToken.MatchString(mailer.lastBody) {
+		t.Errorf("pwa login mail must omit the one-tap confirm link, body %q", mailer.lastBody)
+	}
+
+	webEmail := "web-login-" + uuid.NewString() + "@example.com"
+	if _, err := svc.RequestLoginCode(ctx, webEmail, "", "en", false); err != nil {
+		t.Fatalf("web request login: %v", err)
+	}
+	if !confirmToken.MatchString(mailer.lastBody) {
+		t.Errorf("non-pwa login mail must keep the one-tap confirm link, body %q", mailer.lastBody)
+	}
+}
+
 // confirmToken extracts the one-tap deeplink token from the /app/#/confirm/<token> link
 // the branded email carries.
 var confirmToken = regexp.MustCompile(`/confirm/([A-Za-z0-9_-]+)`)
@@ -301,7 +329,7 @@ func TestConfirmByTokenLogin(t *testing.T) {
 	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
 	email := "tok-login-" + uuid.NewString() + "@example.com"
 
-	id, err := svc.RequestLoginCode(ctx, email, "", "en")
+	id, err := svc.RequestLoginCode(ctx, email, "", "en", false)
 	if err != nil {
 		t.Fatalf("request login: %v", err)
 	}
@@ -382,7 +410,7 @@ func TestEmailAccountSeedsDisplayName(t *testing.T) {
 	svc := account.NewEmailService(store, &capturingMailer{}, "https://erudit-game.ru")
 	local := "kaya-" + uuid.NewString()[:8]
 
-	id, err := svc.RequestLoginCode(ctx, local+"@example.com", "", "en")
+	id, err := svc.RequestLoginCode(ctx, local+"@example.com", "", "en", false)
 	if err != nil {
 		t.Fatalf("request login: %v", err)
 	}

backend/internal/postgres/jet/backend/model/ad_campaigns.go

@@ -13,13 +13,20 @@ import (
 )
 
 type AdCampaigns struct {
-	CampaignID uuid.UUID `sql:"primary_key"`
-	Name       string
-	Weight     int32
-	IsDefault  bool
-	Enabled    bool
-	StartsAt   *time.Time
-	EndsAt     *time.Time
-	CreatedAt  time.Time
-	UpdatedAt  time.Time
+	CampaignID       uuid.UUID `sql:"primary_key"`
+	Name             string
+	Weight           int32
+	IsDefault        bool
+	Enabled          bool
+	StartsAt         *time.Time
+	EndsAt           *time.Time
+	CreatedAt        time.Time
+	UpdatedAt        time.Time
+	OverrideBg       *string
+	OverrideFg       *string
+	OverrideLink     *string
+	OverrideBgDark   *string
+	OverrideFgDark   *string
+	OverrideLinkDark *string
+	Urgent           bool
 }

backend/internal/postgres/jet/backend/table/ad_campaigns.go

@@ -17,15 +17,22 @@ type adCampaignsTable struct {
 	postgres.Table
 
 	// Columns
-	CampaignID postgres.ColumnString
-	Name       postgres.ColumnString
-	Weight     postgres.ColumnInteger
-	IsDefault  postgres.ColumnBool
-	Enabled    postgres.ColumnBool
-	StartsAt   postgres.ColumnTimestampz
-	EndsAt     postgres.ColumnTimestampz
-	CreatedAt  postgres.ColumnTimestampz
-	UpdatedAt  postgres.ColumnTimestampz
+	CampaignID       postgres.ColumnString
+	Name             postgres.ColumnString
+	Weight           postgres.ColumnInteger
+	IsDefault        postgres.ColumnBool
+	Enabled          postgres.ColumnBool
+	StartsAt         postgres.ColumnTimestampz
+	EndsAt           postgres.ColumnTimestampz
+	CreatedAt        postgres.ColumnTimestampz
+	UpdatedAt        postgres.ColumnTimestampz
+	OverrideBg       postgres.ColumnString
+	OverrideFg       postgres.ColumnString
+	OverrideLink     postgres.ColumnString
+	OverrideBgDark   postgres.ColumnString
+	OverrideFgDark   postgres.ColumnString
+	OverrideLinkDark postgres.ColumnString
+	Urgent           postgres.ColumnBool
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -67,33 +74,47 @@ func newAdCampaignsTable(schemaName, tableName, alias string) *AdCampaignsTable
 
 func newAdCampaignsTableImpl(schemaName, tableName, alias string) adCampaignsTable {
 	var (
-		CampaignIDColumn = postgres.StringColumn("campaign_id")
-		NameColumn       = postgres.StringColumn("name")
-		WeightColumn     = postgres.IntegerColumn("weight")
-		IsDefaultColumn  = postgres.BoolColumn("is_default")
-		EnabledColumn    = postgres.BoolColumn("enabled")
-		StartsAtColumn   = postgres.TimestampzColumn("starts_at")
-		EndsAtColumn     = postgres.TimestampzColumn("ends_at")
-		CreatedAtColumn  = postgres.TimestampzColumn("created_at")
-		UpdatedAtColumn  = postgres.TimestampzColumn("updated_at")
-		allColumns       = postgres.ColumnList{CampaignIDColumn, NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn}
-		mutableColumns   = postgres.ColumnList{NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn}
-		defaultColumns   = postgres.ColumnList{IsDefaultColumn, EnabledColumn, CreatedAtColumn, UpdatedAtColumn}
+		CampaignIDColumn       = postgres.StringColumn("campaign_id")
+		NameColumn             = postgres.StringColumn("name")
+		WeightColumn           = postgres.IntegerColumn("weight")
+		IsDefaultColumn        = postgres.BoolColumn("is_default")
+		EnabledColumn          = postgres.BoolColumn("enabled")
+		StartsAtColumn         = postgres.TimestampzColumn("starts_at")
+		EndsAtColumn           = postgres.TimestampzColumn("ends_at")
+		CreatedAtColumn        = postgres.TimestampzColumn("created_at")
+		UpdatedAtColumn        = postgres.TimestampzColumn("updated_at")
+		OverrideBgColumn       = postgres.StringColumn("override_bg")
+		OverrideFgColumn       = postgres.StringColumn("override_fg")
+		OverrideLinkColumn     = postgres.StringColumn("override_link")
+		OverrideBgDarkColumn   = postgres.StringColumn("override_bg_dark")
+		OverrideFgDarkColumn   = postgres.StringColumn("override_fg_dark")
+		OverrideLinkDarkColumn = postgres.StringColumn("override_link_dark")
+		UrgentColumn           = postgres.BoolColumn("urgent")
+		allColumns             = postgres.ColumnList{CampaignIDColumn, NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn, OverrideBgColumn, OverrideFgColumn, OverrideLinkColumn, OverrideBgDarkColumn, OverrideFgDarkColumn, OverrideLinkDarkColumn, UrgentColumn}
+		mutableColumns         = postgres.ColumnList{NameColumn, WeightColumn, IsDefaultColumn, EnabledColumn, StartsAtColumn, EndsAtColumn, CreatedAtColumn, UpdatedAtColumn, OverrideBgColumn, OverrideFgColumn, OverrideLinkColumn, OverrideBgDarkColumn, OverrideFgDarkColumn, OverrideLinkDarkColumn, UrgentColumn}
+		defaultColumns         = postgres.ColumnList{IsDefaultColumn, EnabledColumn, CreatedAtColumn, UpdatedAtColumn, UrgentColumn}
 	)
 
 	return adCampaignsTable{
 		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
 
 		//Columns
-		CampaignID: CampaignIDColumn,
-		Name:       NameColumn,
-		Weight:     WeightColumn,
-		IsDefault:  IsDefaultColumn,
-		Enabled:    EnabledColumn,
-		StartsAt:   StartsAtColumn,
-		EndsAt:     EndsAtColumn,
-		CreatedAt:  CreatedAtColumn,
-		UpdatedAt:  UpdatedAtColumn,
+		CampaignID:       CampaignIDColumn,
+		Name:             NameColumn,
+		Weight:           WeightColumn,
+		IsDefault:        IsDefaultColumn,
+		Enabled:          EnabledColumn,
+		StartsAt:         StartsAtColumn,
+		EndsAt:           EndsAtColumn,
+		CreatedAt:        CreatedAtColumn,
+		UpdatedAt:        UpdatedAtColumn,
+		OverrideBg:       OverrideBgColumn,
+		OverrideFg:       OverrideFgColumn,
+		OverrideLink:     OverrideLinkColumn,
+		OverrideBgDark:   OverrideBgDarkColumn,
+		OverrideFgDark:   OverrideFgDarkColumn,
+		OverrideLinkDark: OverrideLinkDarkColumn,
+		Urgent:           UrgentColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/migrations/00009_banner_colors_urgent.sql

@@ -0,0 +1,60 @@
+-- Per-campaign banner colour overrides and the urgent (always-show) flag.
+--
+-- ad_campaigns gains two optional colour sets and an urgent flag, all for
+-- non-default campaigns only:
+--   override_bg/fg/link           — paints the strip on every theme
+--   override_bg/fg/link_dark      — further overrides the dark theme
+--   urgent                        — force the banner on every viewer (bypassing
+--                                   eligibility) and suppress all non-urgent
+--                                   campaigns while any urgent one is active
+--
+-- Each colour set is all-or-nothing (bg+fg+link together, or absent) and every
+-- colour is a "#rrggbb" hex string. The default (house) campaign stays plain: no
+-- colours, never urgent.
+--
+-- Expand-contract: additive (nullable columns plus one NOT NULL boolean with a
+-- default), so a backend image rollback stays DB-safe — older code ignores them.
+-- The ad_campaigns table shape changes, so its generated go-jet model is
+-- regenerated (by hand here, to keep the diff to this one table).
+
+-- +goose Up
+ALTER TABLE backend.ad_campaigns
+    ADD COLUMN override_bg text,
+    ADD COLUMN override_fg text,
+    ADD COLUMN override_link text,
+    ADD COLUMN override_bg_dark text,
+    ADD COLUMN override_fg_dark text,
+    ADD COLUMN override_link_dark text,
+    ADD COLUMN urgent boolean DEFAULT false NOT NULL,
+    ADD CONSTRAINT ad_campaigns_override_all_chk CHECK (
+        (override_bg IS NULL AND override_fg IS NULL AND override_link IS NULL)
+        OR (override_bg IS NOT NULL AND override_fg IS NOT NULL AND override_link IS NOT NULL)
+    ),
+    ADD CONSTRAINT ad_campaigns_override_dark_chk CHECK (
+        (override_bg_dark IS NULL AND override_fg_dark IS NULL AND override_link_dark IS NULL)
+        OR (override_bg_dark IS NOT NULL AND override_fg_dark IS NOT NULL AND override_link_dark IS NOT NULL)
+    ),
+    ADD CONSTRAINT ad_campaigns_override_hex_chk CHECK (
+        (override_bg IS NULL OR override_bg ~ '^#[0-9a-fA-F]{6}$')
+        AND (override_fg IS NULL OR override_fg ~ '^#[0-9a-fA-F]{6}$')
+        AND (override_link IS NULL OR override_link ~ '^#[0-9a-fA-F]{6}$')
+        AND (override_bg_dark IS NULL OR override_bg_dark ~ '^#[0-9a-fA-F]{6}$')
+        AND (override_fg_dark IS NULL OR override_fg_dark ~ '^#[0-9a-fA-F]{6}$')
+        AND (override_link_dark IS NULL OR override_link_dark ~ '^#[0-9a-fA-F]{6}$')
+    ),
+    ADD CONSTRAINT ad_campaigns_default_plain_chk CHECK (
+        (NOT is_default)
+        OR (override_bg IS NULL AND override_fg IS NULL AND override_link IS NULL
+            AND override_bg_dark IS NULL AND override_fg_dark IS NULL AND override_link_dark IS NULL
+            AND NOT urgent)
+    );
+
+-- +goose Down
+ALTER TABLE backend.ad_campaigns
+    DROP COLUMN override_bg,
+    DROP COLUMN override_fg,
+    DROP COLUMN override_link,
+    DROP COLUMN override_bg_dark,
+    DROP COLUMN override_fg_dark,
+    DROP COLUMN override_link_dark,
+    DROP COLUMN urgent;

backend/internal/robot/strategyfixture_test.go

@@ -0,0 +1,146 @@
+package robot
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"scrabble/backend/internal/engine"
+)
+
+// The client-side offline robot (ui/src/lib/robot) reproduces the robot's move choice
+// so a local vs_ai game plays the same way as the server. These golden fixtures pin that
+// TS port to the real Go strategy. Being in-package, this emitter can exercise the
+// unexported mix / playToWin / deviates / selectMove that the port mirrors.
+
+type mixCase struct {
+	Seed  string `json:"seed"`
+	Salt  string `json:"salt"`
+	Nums  []int  `json:"nums"`
+	Value string `json:"value"` // the mix() uint64, as a decimal string (exceeds JS safe ints)
+}
+
+type decisionCase struct {
+	Seed       string `json:"seed"`
+	MoveCount  int    `json:"moveCount"`
+	MyScore    int    `json:"myScore"`
+	OppScore   int    `json:"oppScore"`
+	CandScores []int  `json:"candScores"`
+	RackLen    int    `json:"rackLen"`
+	BagLen     int    `json:"bagLen"`
+	PlayToWin  bool   `json:"playToWin"`
+	Win        bool   `json:"win"` // the per-turn intent after the deviate flip
+	Kind       string `json:"kind"`
+	Index      int    `json:"index"` // chosen candidate index for a play, else -1
+}
+
+type strategyFixture struct {
+	PlayToWinPercent int            `json:"playToWinPercent"`
+	Mix              []mixCase      `json:"mix"`
+	Decisions        []decisionCase `json:"decisions"`
+}
+
+// scenario is one selectMove situation exercised across several seeds.
+type scenario struct {
+	moveCount, myScore, oppScore, rackLen, bagLen int
+	cands                                         []int
+}
+
+// TestEmitStrategyFixtures regenerates ui/src/lib/robot/testdata/strategy.json. It is
+// gated by EMIT_STRATEGY_FIXTURES so a normal `go test` skips it; the committed output is
+// what the TS parity test consumes. Regenerate with:
+//
+//	EMIT_STRATEGY_FIXTURES=1 go test ./backend/internal/robot -run TestEmitStrategyFixtures
+func TestEmitStrategyFixtures(t *testing.T) {
+	if os.Getenv("EMIT_STRATEGY_FIXTURES") == "" {
+		t.Skip("set EMIT_STRATEGY_FIXTURES=1 to regenerate ui/src/lib/robot/testdata/strategy.json")
+	}
+
+	seeds := []int64{1, 42, -7, 1000003, 9999999999, 123456789, -123456789}
+
+	mixCases := []mixCase{}
+	addMix := func(seed int64, salt string, nums ...int) {
+		mixCases = append(mixCases, mixCase{
+			Seed:  strconv.FormatInt(seed, 10),
+			Salt:  salt,
+			Nums:  append([]int{}, nums...),
+			Value: strconv.FormatUint(mix(seed, salt, nums...), 10),
+		})
+	}
+	for _, sd := range seeds {
+		addMix(sd, "win")
+		addMix(sd, "deviate", 0)
+		addMix(sd, "deviate", 7)
+	}
+
+	scenarios := []scenario{
+		{3, 40, 55, 7, 20, []int{30, 12, 8}},   // behind, mid-game
+		{10, 120, 90, 7, 8, []int{25, 18, 5}},  // ahead, late
+		{1, 0, 0, 7, 30, []int{60, 30, 15, 7}}, // first move, big spread
+		{20, 200, 40, 5, 2, []int{50, 20}},     // big lead, bag near empty (no deviate)
+		{5, 30, 30, 7, 14, []int{20, 20, 20}},  // equal margins (tie-break)
+		{8, 50, 60, 7, 20, []int{}},            // no play, bag can refill -> exchange
+		{8, 50, 60, 3, 2, []int{}},             // no play, bag can't refill -> pass
+		{15, 300, 10, 7, 6, []int{80, 40, 10}}, // overshoots the band -> nearest to +30
+	}
+
+	decisions := []decisionCase{}
+	for _, sd := range seeds {
+		for _, sc := range scenarios {
+			cands := make([]engine.MoveRecord, len(sc.cands))
+			for i, s := range sc.cands {
+				cands[i] = engine.MoveRecord{Score: s, Player: i}
+			}
+			rack := make([]string, sc.rackLen)
+			for i := range rack {
+				rack[i] = "a"
+			}
+
+			ptw := playToWin(sd)
+			win := ptw
+			if deviates(sd, sc.moveCount, sc.bagLen) {
+				win = !win
+			}
+			d := selectMove(cands, sc.myScore, sc.oppScore, win, defaultBand, rack, sc.bagLen)
+
+			kind, index := "pass", -1
+			switch d.kind {
+			case decidePlay:
+				kind, index = "play", d.move.Player
+			case decideExchange:
+				kind = "exchange"
+			}
+
+			decisions = append(decisions, decisionCase{
+				Seed:       strconv.FormatInt(sd, 10),
+				MoveCount:  sc.moveCount,
+				MyScore:    sc.myScore,
+				OppScore:   sc.oppScore,
+				CandScores: append([]int{}, sc.cands...),
+				RackLen:    sc.rackLen,
+				BagLen:     sc.bagLen,
+				PlayToWin:  ptw,
+				Win:        win,
+				Kind:       kind,
+				Index:      index,
+			})
+		}
+	}
+
+	fx := strategyFixture{PlayToWinPercent: playToWinPercent, Mix: mixCases, Decisions: decisions}
+	dir := filepath.Join("..", "..", "..", "ui", "src", "lib", "robot", "testdata")
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatalf("mkdir %s: %v", dir, err)
+	}
+	data, err := json.MarshalIndent(fx, "", "  ")
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	path := filepath.Join(dir, "strategy.json")
+	if err := os.WriteFile(path, append(data, '\n'), 0o644); err != nil {
+		t.Fatalf("write %s: %v", path, err)
+	}
+	t.Logf("wrote %s (%d mix, %d decisions)", path, len(mixCases), len(decisions))
+}

backend/internal/server/banner.go

@@ -22,10 +22,20 @@ type bannerDTO struct {
 
 // bannerCampaignDTO is one campaign in the rotation feed: its GCD-reduced show
 // weight (for the client's smooth weighted round-robin) and its messages, in
-// display order, already resolved to one language.
+// display order, already resolved to one language. The override_* colours are
+// present only for a campaign that carries a colour override: override_bg/fg/link
+// paint every theme, and the *_dark trio further overrides the dark theme (the
+// client resolves the cascade). They are absent for a plain campaign, which keeps
+// the neutral theme tokens.
 type bannerCampaignDTO struct {
-	Weight   int      `json:"weight"`
-	Messages []string `json:"messages"`
+	Weight           int      `json:"weight"`
+	Messages         []string `json:"messages"`
+	OverrideBg       string   `json:"override_bg,omitempty"`
+	OverrideFg       string   `json:"override_fg,omitempty"`
+	OverrideLink     string   `json:"override_link,omitempty"`
+	OverrideBgDark   string   `json:"override_bg_dark,omitempty"`
+	OverrideFgDark   string   `json:"override_fg_dark,omitempty"`
+	OverrideLinkDark string   `json:"override_link_dark,omitempty"`
 }
 
 // bannerTimingsDTO mirrors ads.Timings on the wire.
@@ -83,22 +93,27 @@ func (s *Server) bannerFor(ctx context.Context, acc account.Account) *bannerDTO
 	if s.ads == nil {
 		return nil
 	}
-	hasNoBanner, err := s.accounts.HasRole(ctx, acc.ID, account.RoleNoBanner)
-	if err != nil {
-		s.log.Warn("banner: role check failed", zap.String("account", acc.ID.String()), zap.Error(err))
-		return nil
-	}
-	if !ads.Eligible(acc.PaidAccount, acc.HintBalance, hasNoBanner) {
-		return nil
-	}
-	set, timings, err := s.ads.ActiveSet(ctx, bannerLang(acc))
+	set, timings, urgent, err := s.ads.ActiveSet(ctx, bannerLang(acc))
 	if err != nil {
 		s.log.Warn("banner: active set failed", zap.String("account", acc.ID.String()), zap.Error(err))
 		return nil
 	}
+	// An urgent campaign is shown to every viewer; otherwise the normal eligibility
+	// gate applies (a paid account, a non-empty hint wallet or the no_banner role
+	// hides the banner).
+	if !urgent {
+		hasNoBanner, err := s.accounts.HasRole(ctx, acc.ID, account.RoleNoBanner)
+		if err != nil {
+			s.log.Warn("banner: role check failed", zap.String("account", acc.ID.String()), zap.Error(err))
+			return nil
+		}
+		if !ads.Eligible(acc.PaidAccount, acc.HintBalance, hasNoBanner) {
+			return nil
+		}
+	}
 	campaigns := make([]bannerCampaignDTO, 0, len(set))
 	for _, c := range set {
-		campaigns = append(campaigns, bannerCampaignDTO{Weight: c.Weight, Messages: c.Messages})
+		campaigns = append(campaigns, bannerCampaignFromActive(c))
 	}
 	return &bannerDTO{
 		Campaigns: campaigns,
@@ -113,6 +128,20 @@ func (s *Server) bannerFor(ctx context.Context, acc account.Account) *bannerDTO
 	}
 }
 
+// bannerCampaignFromActive flattens a resolved campaign into its wire DTO,
+// projecting each optional colour set into its three "#rrggbb" fields (empty when
+// the set is absent, so JSON omitempty drops them).
+func bannerCampaignFromActive(c ads.ActiveCampaign) bannerCampaignDTO {
+	d := bannerCampaignDTO{Weight: c.Weight, Messages: c.Messages}
+	if c.OverrideAll != nil {
+		d.OverrideBg, d.OverrideFg, d.OverrideLink = c.OverrideAll.Bg, c.OverrideAll.Fg, c.OverrideAll.Link
+	}
+	if c.OverrideDark != nil {
+		d.OverrideBgDark, d.OverrideFgDark, d.OverrideLinkDark = c.OverrideDark.Bg, c.OverrideDark.Fg, c.OverrideDark.Link
+	}
+	return d
+}
+
 // bannerLang resolves the message language for a viewer: their interface language
 // (Russian, or English by default).
 func bannerLang(acc account.Account) string {

backend/internal/server/handlers_admin_banners.go

@@ -19,6 +19,15 @@ const bannersBack = "/_gm/banners"
 // bound; the operator's entry is interpreted as UTC.
 const localTimeLayout = "2006-01-02T15:04"
 
+// Neutral banner theme tokens, mirrored from ui/src/app.css (--ad-bg,
+// --text-muted, --accent for the light and dark themes). They seed the console's
+// colour pickers and the preview fallback when a campaign has no override, so the
+// operator always edits against the real neutral colours.
+const (
+	tokenLightBg, tokenLightFg, tokenLightLink = "#e3e7ee", "#6b7280", "#2f6df6"
+	tokenDarkBg, tokenDarkFg, tokenDarkLink    = "#272f3c", "#9aa3b2", "#5b8cff"
+)
+
 // consoleBanners lists the advertising campaigns (default first), each with its
 // weight, validity window, enabled flag, message count and live-now status.
 func (s *Server) consoleBanners(c *gin.Context) {
@@ -56,14 +65,19 @@ func (s *Server) consoleBannerDetail(c *gin.Context) {
 		return
 	}
 	view := adminconsole.BannerDetailView{
-		ID:        cm.ID.String(),
-		Name:      cm.Name,
-		Weight:    cm.Weight,
-		IsDefault: cm.IsDefault,
-		Enabled:   cm.Enabled,
-		StartsAt:  localInput(cm.StartsAt),
-		EndsAt:    localInput(cm.EndsAt),
+		ID:             cm.ID.String(),
+		Name:           cm.Name,
+		Weight:         cm.Weight,
+		IsDefault:      cm.IsDefault,
+		Enabled:        cm.Enabled,
+		StartsAt:       localInput(cm.StartsAt),
+		EndsAt:         localInput(cm.EndsAt),
+		Urgent:         cm.Urgent,
+		OverrideAllOn:  cm.OverrideAll != nil,
+		OverrideDarkOn: cm.OverrideDark != nil,
 	}
+	view.AllBg, view.AllFg, view.AllLink = seedColors(cm.OverrideAll, tokenLightBg, tokenLightFg, tokenLightLink)
+	view.DarkBg, view.DarkFg, view.DarkLink = seedColors(cm.OverrideDark, tokenDarkBg, tokenDarkFg, tokenDarkLink)
 	for i, m := range cm.Messages {
 		view.Messages = append(view.Messages, adminconsole.BannerMessageRow{
 			ID:     m.ID.String(),
@@ -111,12 +125,15 @@ func (s *Server) consoleUpdateBanner(c *gin.Context) {
 		return
 	}
 	err = s.ads.UpdateCampaign(c.Request.Context(), ads.Campaign{
-		ID:       id,
-		Name:     trimForm(c, "name"),
-		Weight:   atoiForm(c, "weight"),
-		Enabled:  c.PostForm("enabled") != "",
-		StartsAt: starts,
-		EndsAt:   ends,
+		ID:           id,
+		Name:         trimForm(c, "name"),
+		Weight:       atoiForm(c, "weight"),
+		Enabled:      c.PostForm("enabled") != "",
+		StartsAt:     starts,
+		EndsAt:       ends,
+		Urgent:       c.PostForm("urgent") != "",
+		OverrideAll:  colorSetForm(c, "override_all_on", "override_bg", "override_fg", "override_link"),
+		OverrideDark: colorSetForm(c, "override_dark_on", "override_bg_dark", "override_fg_dark", "override_link_dark"),
 	})
 	if err != nil {
 		s.bannerError(c, err, back)
@@ -321,3 +338,29 @@ func atoiForm(c *gin.Context, name string) int {
 	n, _ := strconv.Atoi(trimForm(c, name))
 	return n
 }
+
+// seedColors returns the three colour-input seed values for a campaign's optional
+// override: the stored colours when the set is present, otherwise the given
+// neutral theme tokens (so the native picker starts sensibly and the preview
+// shows the real fallback).
+func seedColors(cs *ads.ColorSet, tokenBg, tokenFg, tokenLink string) (bg, fg, link string) {
+	if cs == nil {
+		return tokenBg, tokenFg, tokenLink
+	}
+	return cs.Bg, cs.Fg, cs.Link
+}
+
+// colorSetForm reads an optional colour override from the form: the on flag gates
+// it (an unchecked set is absent, nil), otherwise the three posted colours are
+// returned for the ads service to validate. The colour inputs are disabled in the
+// browser while the set is off, so they are not posted then.
+func colorSetForm(c *gin.Context, on, bg, fg, link string) *ads.ColorSet {
+	if c.PostForm(on) == "" {
+		return nil
+	}
+	return &ads.ColorSet{
+		Bg:   trimForm(c, bg),
+		Fg:   trimForm(c, fg),
+		Link: trimForm(c, link),
+	}
+}

backend/internal/server/handlers_auth.go

@@ -174,6 +174,10 @@ type emailRequest struct {
 	Email     string `json:"email"`
 	BrowserTZ string `json:"browser_tz"`
 	Language  string `json:"language"`
+	// Pwa marks a request from an installed PWA (standalone display mode): the login email then
+	// omits the one-tap confirm link so the code is typed in the same window (the link would open
+	// in a separate browser whose session cannot reach the PWA). See EmailService.RequestLoginCode.
+	Pwa bool `json:"pwa"`
 }
 
 // handleEmailRequest issues a login confirm-code to the email. It always reports
@@ -185,7 +189,7 @@ func (s *Server) handleEmailRequest(c *gin.Context) {
 		abortBadRequest(c, "email is required")
 		return
 	}
-	if _, err := s.emails.RequestLoginCode(c.Request.Context(), req.Email, req.BrowserTZ, req.Language); err != nil {
+	if _, err := s.emails.RequestLoginCode(c.Request.Context(), req.Email, req.BrowserTZ, req.Language, req.Pwa); err != nil {
 		s.abortErr(c, err)
 		return
 	}

docs/ARCHITECTURE.md

@@ -244,7 +244,9 @@ arrive from a platform rather than completing a mandatory registration).
   256-bit token stored only as its SHA-256, 12-hour TTL): a login mints a session in the
   browser that opens it (magic-link), a link confirms the identity and emits a `notify`
   profile-refresh to the in-app session, a change switches the account's email in place,
-  and a would-be merge is deferred to the interactive flow. The confirm runs on load; the token rides the URL fragment (never
+  and a would-be merge is deferred to the interactive flow. A login requested from an installed **PWA** omits the deeplink
+  entirely — its email carries the code only, typed in the same window, since the link would open
+  in a separate browser whose minted session cannot reach the PWA. The confirm runs on load; the token rides the URL fragment (never
   sent to the server), so a plain link prefetch cannot reach it, and the manual
   six-digit code is the fallback if an aggressive scanner runs the page. An
   **email-login** account is created flagged `is_guest` and stays reapable until the
@@ -980,10 +982,25 @@ edge-pause, scroll speed, and the fade-out → gap → fade-in transition) are o
 eligibility inputs (grants hints, grants/revokes `no_banner`; a future payment flow sets
 `paid_account`), the backend emits a `notify` **`banner`** sub-kind (a payload-free re-poll signal),
 and the open client re-fetches `profile.get` to show or hide the banner in place. Operator *content*
-edits take effect on the next `profile.get` (open/reconnect/foreground), not mid-session. The same
+edits take effect on the next `profile.get` (open/reconnect/foreground), not mid-session. A
+non-default campaign may also carry an optional **colour override** (background, text, link) in two
+sets — one for every theme, one for the dark theme only — plus an **urgent** flag. The colours ride
+the same block (six optional strings appended to each `BannerCampaign` on the wire — trailing,
+backward-compatible); the client resolves the cascade (dark ← dark ?? all, light ← all) and derives
+the strip's border from the background in JS (no CSS `color-mix`, for the old-WebView floor).
+**Urgent is resolved entirely server-side, with no wire field**: while any enabled, in-window urgent
+campaign exists, `computeActiveSet` returns *only* the urgent campaigns (preempting the timed set and
+the default remainder) and `bannerFor` **skips the eligibility gate** for that feed, so an urgent
+notice reaches every viewer — paid, hint-holding or `no_banner` included. There is no instant
+broadcast on an urgent toggle (the notify path is per-user); an urgent campaign appears on each
+viewer's next `profile.get`. The default campaign stays plain (no colours, never urgent), enforced by
+both the service and a DB CHECK. The same
 mechanism carries a **`profile`** sub-kind — a payload-free re-fetch signal emitted when a viewer's
 own account changed out of band (an email confirmed through the one-tap deeplink opened in another
-browser), so an open in-app session reflects it at once.
+browser), so an open in-app session reflects it at once. The live stream is single-shot with no
+replay, so a **backgrounded Mini App** — suspended while the user is in their mail app tapping the
+link — misses the event; while an add-email confirmation is pending the client therefore also
+**polls `profile.get`** (and on foreground regain) as a fallback until the address lands.
 
 > A single `app.load` bootstrap aggregator (collapsing `profile.get` + lobby + badge fetches into
 > one round-trip) was **considered and deferred**: client↔gateway is HTTP/2 (h2c), so the bootstrap
@@ -1026,7 +1043,9 @@ browser), so an open in-app session reflects it at once.
   (`internal/adminalert`, started from `main`) emails the operator (`ADMIN_EMAIL`, from a
   distinct `SMTP_RELAY_ADMIN_FROM`) when new player feedback or word complaints arrive,
   **coalescing** a burst into one digest per interval; both recipients may be several
-  comma-separated addresses. Both paths are inert unless configured.
+  comma-separated addresses. The digest carries **no admin-console link** — an admin URL must
+  never travel in an email, where a mail provider could cache or index it; the operator opens the
+  console directly. Both paths are inert unless configured.
 - Per-request server-side timing via gin middleware from day one (the access log
   carries method, route, status, latency and the active trace id). A
   client-measured RTT piggybacked on the next request is a later enhancement.
@@ -1218,7 +1237,14 @@ origin, so the test contour canonicalises to production instead of being indexed
 separate site; the SPA shell is `noindex`, and the landing always boots in Russian (no
 browser-language detection — crawlers render with arbitrary languages). The favicon set,
 `og-image.png` and `robots.txt` ship unhashed from `ui/public/` (generated by
-`assets/icons/`, same tile design as the VK loader). Hash-named `/assets/*` are served
+`assets/icons/`, same tile design as the VK loader). On the web (`/app/`) the SPA is an installable **PWA**:
+`manifest.webmanifest` and an install-only **service worker** (`sw.js`) ship unhashed from
+`ui/public/`, and the client registers the worker **web-only** — never inside a Mini App or the
+mock build. The worker intercepts only top-level navigations (network-first with a cached-shell
+fallback), leaving `/assets/*` and the Connect stream untouched; it exists to satisfy Chromium's
+installability requirement (a registered SW, needed for install on Android) and is the single
+growth point for a future opt-in offline mode. The gateway registers the `.webmanifest` MIME type
+in-process (the distroless image has no `/etc/mime.types`). Hash-named `/assets/*` are served
 `immutable` (a relaunch is a cache hit, not a re-download); the HTML shells are
 `no-cache` so a new deploy is picked up — both containers apply the same caching. An
 in-compose **caddy** is the contour's edge: it owns a single `/_gm` Basic-Auth and

docs/FUNCTIONAL.md

@@ -21,7 +21,8 @@ Settings also pick the board's bonus-label style (beginner / classic / none). A
 costs nothing when the rack has no legal move. The word-check accepts only the
 variant's alphabet, remembers answers within the session and rate-limits repeats.
 A public **landing page** at the site root introduces the game, switches language and
-theme, and links to the Telegram game channel and the VK Mini App; the game itself runs at
+theme, and links to the Telegram game channel, the VK Mini App and the **web version**
+(`/app/`) — each under a caption (Telegram / VK / Веб-версия); the game itself runs at
 `/app/` (web), `/telegram/` (the Telegram Mini App) and `/vk/` (the VK Mini App). The landing's theme is ephemeral
 (it follows the system scheme, not the saved preference); its language choice is saved. The
 landing always opens in **Russian** — the browser language is never auto-detected (crawlers
@@ -31,6 +32,11 @@ nondeterministic); a saved 🌐 choice still wins. The page carries a static Rus
 pinned to the production origin, JSON-LD, the favicon set and `robots.txt`), while the SPA
 shell is `noindex` — the landing is the only indexable page.
 
+On the plain web the client is an **installable PWA**: a logged-out player sees an install
+call-to-action under the login form (and at the bottom of Settings) that installs the app to the
+home screen / desktop in one tap where the browser supports it (Chromium), or shows manual
+Add-to-Home-Screen steps on iOS Safari; it is hidden once installed and inside the Mini Apps.
+
 ### First-run onboarding
 The first time a player opens the app it walks them through the interface with a light
 **coachmark overlay**: a dimmed layer draws one hint bubble at a time, each pointing — with a
@@ -70,7 +76,9 @@ per address), so a mistyped address or an impatient tap cannot flood an inbox. T
 also carries a **one-tap link** that confirms the address — or signs the player straight
 in — in a single tap; opening it in another browser reflects in the app at once, and a
 mail scanner that merely fetches the link cannot reach it — the token rides the URL
-fragment, which is never sent to the server.
+fragment, which is never sent to the server. A sign-in requested from an **installed PWA** omits
+this link: the email carries only the code, entered in the same window, since the link would open
+in a separate browser the app cannot reach.
 Telegram runs a **single bot**: every player uses
 the same bot, and all of its chat and out-of-app notifications are written in the
 player's own **interface language** (en/ru). A separate optional **promo bot** can run alongside the
@@ -109,7 +117,9 @@ two accounts share a game still in progress.
 
 The profile lists the account's **sign-in methods**. On the web a player can add
 Telegram (a login-widget popup) or VK (VK ID web login — a redirect to VK's sign-in and
-back); inside a Mini App the host platform is already linked. Linking a provider that
+back); inside a Mini App the host platform is already linked, and its own sign-in-method
+row is hidden — the platform the player is currently signed in through cannot be unlinked
+from there, only the other provider's row is shown. Linking a provider that
 already belongs to another account offers the same irreversible **merge** as email
 linking. A linked provider can be **unlinked** — except the last
 remaining sign-in method, which is refused so the account stays reachable. **Email is
@@ -483,8 +493,19 @@ through**, regardless of their interface language. The client rotates the eligib
 **fairly** — every campaign gets its weighted share each cycle, evenly spread rather than at random —
 and a campaign with several messages shows them in turn.
 
+A non-default campaign can carry its own **colours** — background, text and link — so a sponsored or
+operational message stands out from the neutral strip. Colours come in two sets: one that applies on
+**every theme**, and an optional second that overrides the **dark theme** only, so a campaign reads
+well on both; the strip's border is derived from the background automatically. A campaign can also be
+marked **urgent**: an urgent campaign is shown to **everyone** — even paid players, hint holders and
+`no_banner` users — and, while it is live, it is the **only** thing the strip shows (ordinary
+campaigns and the house default step aside). Urgent is for genuine system notices (maintenance,
+outages), not advertising.
+
 Operators manage all of this in the admin console at **`/_gm/banners`**: create, edit, enable/disable
-and schedule campaigns, write each campaign's bilingual messages (reorder or remove them), and set
-the global display **timings** (how long a message holds, the scroll of an over-long message, and the
-fade-out → gap → fade-in transition between messages). The default campaign cannot be deleted and
-keeps at least one message.
+and schedule campaigns, write each campaign's bilingual messages (reorder or remove them), pick a
+non-default campaign's optional override colours (a native colour picker with a live light-and-dark
+preview of the strip) and mark it urgent, and set the global display **timings** (how long a message
+holds, the scroll of an over-long message, and the fade-out → gap → fade-in transition between
+messages). The default campaign cannot be deleted, keeps at least one message, and stays plain (no
+colours, never urgent).

docs/FUNCTIONAL_ru.md

@@ -22,7 +22,8 @@ top-1 подсказку, безлимитную проверку слова с
 Проверка слова принимает только алфавит варианта, запоминает ответы в рамках сессии
 и ограничивает частоту повторов.
 Публичная **посадочная страница** в корне сайта представляет игру, переключает язык и
-тему и ведёт в Telegram-канал игры и в VK Mini App; сама игра живёт по адресам
+тему и ведёт в Telegram-канал игры, в VK Mini App и в **веб-версию** (`/app/`) — каждая под
+подписью (Telegram / VK / Веб-версия); сама игра живёт по адресам
 `/app/` (веб), `/telegram/` (Telegram Mini App) и `/vk/` (VK Mini App). Тема на странице эфемерна (берётся из
 системной настройки, а не из сохранённой), выбор языка сохраняется. Страница всегда
 открывается на **русском** — язык браузера не определяется автоматически (роботы
@@ -33,6 +34,11 @@ Open Graph, которую используют превью ссылок в Tel
 продакшен-домена, JSON-LD, набор favicon и `robots.txt`), а оболочка SPA помечена
 `noindex` — индексируется только посадочная страница.
 
+В обычном вебе клиент — **устанавливаемое PWA**: незалогиненный игрок видит призыв к установке
+под формой входа (и внизу «Настроек»), который в один тап ставит приложение на рабочий стол
+(домашний экран) там, где браузер это умеет (Chromium), либо показывает ручные шаги
+«На экран „Домой“» в Safari на iOS; он скрыт после установки и внутри Mini App.
+
 ### Первый запуск: онбординг
 При первом открытии приложения игрока один раз проводят по интерфейсу лёгким
 **coachmark-оверлеем**: затемнённый слой показывает по одной подсказке-«облачку» за раз, каждое
@@ -74,7 +80,9 @@ launch-параметрам VK (их проверяет gateway), и при пе
 не завалили почтовый ящик. В письме также есть **ссылка одного нажатия**, которая подтверждает
 адрес — или сразу выполняет вход — в один тап; открытие её в другом браузере тут же отражается в
 приложении, а почтовый сканер, который просто загружает ссылку, до токена не дотянется —
-он едет в URL-фрагменте, который не уходит на сервер.
+он едет в URL-фрагменте, который не уходит на сервер. Вход, запрошенный из **установленного
+PWA**, эту ссылку не содержит: в письме только код, который вводится в том же окне (ссылка
+открылась бы в отдельном браузере, недоступном приложению).
 Telegram держит **единого бота**: все игроки пользуются одним
 и тем же ботом, а весь его чат и внеприложенческие уведомления пишутся на **языке
 интерфейса** самого игрока (en/ru). Рядом с основным может работать отдельный опциональный
@@ -113,7 +121,9 @@ Telegram держит **единого бота**: все игроки поль
 
 В профиле перечислены **способы входа** аккаунта. В вебе игрок может добавить
 Telegram (попап логин-виджета) или VK (веб-вход VK ID — редирект на страницу входа VK и
-обратно); внутри Mini App платформа-хозяин уже привязана. Привязка провайдера, уже
+обратно); внутри Mini App платформа-хозяин уже привязана, и её собственная плашка способа
+входа скрыта — платформу, через которую игрок сейчас вошёл, отсюда отвязать нельзя,
+показывается только плашка другого провайдера. Привязка провайдера, уже
 принадлежащего другому аккаунту, предлагает то же необратимое **слияние**, что и привязка
 email. Привязанного провайдера можно **отвязать** — кроме последнего
 оставшегося способа входа: он не отвязывается, чтобы аккаунт оставался достижимым.
@@ -494,8 +504,19 @@ high-rate флага. С карточки пользователя операт
 **честно** — каждая получает свою долю по весу за цикл, равномерно размазанную, а не случайно — а
 кампания с несколькими сообщениями показывает их по очереди.
 
+Недефолтная кампания может нести собственные **цвета** — фон, текст и ссылку — чтобы рекламное или
+служебное сообщение выделялось на фоне нейтральной ленты. Цвета задаются двумя наборами: один
+применяется на **любой теме**, а необязательный второй переопределяет только **тёмную тему**, чтобы
+кампания хорошо читалась на обеих; рамка ленты выводится из фона автоматически. Кампанию можно также
+пометить как **срочную (urgent)**: срочная кампания показывается **всем** — даже платным игрокам,
+владельцам подсказок и пользователям с ролью `no_banner` — и, пока она активна, лента показывает
+**только её** (обычные кампании и домашняя дефолтная уступают место). Срочность — для настоящих
+системных уведомлений (тех.работы, сбои), а не для рекламы.
+
 Всем этим оператор управляет в админ-консоли по адресу **`/_gm/banners`**: создаёт, редактирует,
 включает/выключает и планирует кампании, пишет двуязычные сообщения кампании (переставляет и удаляет
-их) и задаёт общие **тайминги** показа (сколько держится сообщение, прокрутка слишком длинного, и
-переход fade-out → пауза → fade-in между сообщениями). Дефолтную кампанию нельзя удалить, и в ней
-всегда остаётся хотя бы одно сообщение.
+их), выбирает необязательные цвета недефолтной кампании (нативный color-picker с живым превью ленты
+на светлой и тёмной темах) и помечает её срочной, а также задаёт общие **тайминги** показа (сколько
+держится сообщение, прокрутка слишком длинного, и переход fade-out → пауза → fade-in между
+сообщениями). Дефолтную кампанию нельзя удалить, в ней всегда остаётся хотя бы одно сообщение, и она
+остаётся простой (без цветов, никогда не срочная).

docs/UI_DESIGN.md

@@ -315,6 +315,19 @@ left. A **viewport size change** (e.g. a portrait↔landscape rotation) re-measu
 operator-set (`/_gm/banner-settings`). Under **reduce-motion** the fades collapse to an instant swap
 and a long message does not scroll.
 
+**Per-campaign colours.** A campaign may override the strip's colours (background, text, link). The
+engine carries the current message's campaign colours to the host, and `AdBanner` resolves them for
+the **rendered theme** (`lib/bannerColors`: dark ← dark-set ?? all-set, light ← all-set) and applies
+them as inline CSS variables scoped to `.ad` (`--ad-bg`, `--text-muted`, `--accent`, and a derived
+`--ad-border`) — so an override never leaks past the strip, and a campaign with no override keeps the
+neutral tokens. The border is computed from the background in JS (a luminance-aware nudge toward
+black/white — no CSS `color-mix`, which the old Android WebView floor lacks), matching the admin
+console's live preview. The resolution re-runs when the theme flips (a `[data-theme]` /
+`prefers-color-scheme` observer), so switching light↔dark repaints an overridden strip at once. An
+**urgent** campaign has no client-specific styling — it simply arrives (with its colours) as the only
+campaign in the feed; the preempt-and-show-everyone behaviour is entirely server-side (ARCHITECTURE
+§10).
+
 ## Result / status iconography (`lib/result.ts`)
 
 Lobby rows show two lines (opponents, then result + score) with a large place-based emoji

gateway/README.md

@@ -8,6 +8,9 @@ backend over REST/JSON, and bridges the backend's gRPC push stream to each
 client's in-app live channel. It **embeds the static UI build** (`go:embed`, baked
 in by the gateway image's node stage) and serves a **landing page** at `/` and the game
 **SPA** at `/app/` (web), `/telegram/` (the Telegram Mini App) and `/vk/` (the VK Mini App) — the single-origin model.
+The web SPA is an installable **PWA**: it serves `manifest.webmanifest` (with the `.webmanifest`
+MIME type registered in-process — the distroless image has no `/etc/mime.types`) and the
+install-only `sw.js`, both shipped unhashed from `ui/public/`.
 Hash-named `/assets/*` are served `immutable`; the HTML shells are `no-cache`. It can also serve the
 backend's admin console at `/_gm` behind HTTP Basic-Auth for a local non-caddy run;
 in the deployed contour the front caddy owns `/_gm` (see

gateway/internal/backendclient/api.go

@@ -53,9 +53,18 @@ type BannerResp struct {
 
 // BannerCampaignResp is one campaign in the rotation feed: a GCD-reduced show
 // weight and its messages, in display order, already resolved to one language.
+// The override_* colours are the optional per-campaign palette (empty when the
+// campaign keeps the neutral theme tokens); they ride through to the client
+// verbatim, mirroring the backend DTO.
 type BannerCampaignResp struct {
-	Weight   int      `json:"weight"`
-	Messages []string `json:"messages"`
+	Weight           int      `json:"weight"`
+	Messages         []string `json:"messages"`
+	OverrideBg       string   `json:"override_bg,omitempty"`
+	OverrideFg       string   `json:"override_fg,omitempty"`
+	OverrideLink     string   `json:"override_link,omitempty"`
+	OverrideBgDark   string   `json:"override_bg_dark,omitempty"`
+	OverrideFgDark   string   `json:"override_fg_dark,omitempty"`
+	OverrideLinkDark string   `json:"override_link_dark,omitempty"`
 }
 
 // BannerTimingsResp mirrors the backend's global display timings.
@@ -280,10 +289,11 @@ func (c *Client) GuestAuth(ctx context.Context, browserTz string) (SessionResp,
 
 // EmailRequest asks the backend to mail a login code, provisioning the account on
 // first contact; browserTz (the client's detected "±HH:MM" UTC offset) seeds the new
-// account's time zone, since the email account is created here, not at login.
-func (c *Client) EmailRequest(ctx context.Context, email, browserTz, language string) error {
+// account's time zone, since the email account is created here, not at login. pwa marks a
+// request from an installed PWA, so the backend omits the one-tap confirm link from the email.
+func (c *Client) EmailRequest(ctx context.Context, email, browserTz, language string, pwa bool) error {
 	return c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/email/request", "", "",
-		map[string]string{"email": email, "browser_tz": browserTz, "language": language}, nil)
+		map[string]any{"email": email, "browser_tz": browserTz, "language": language, "pwa": pwa}, nil)
 }
 
 // EmailLogin verifies a login code and mints a session.

gateway/internal/connectsrv/metrics.go

@@ -46,7 +46,13 @@ func newServerMetrics(meter metric.Meter) *serverMetrics {
 	}
 	h, err := meter.Float64Histogram("edge_request_duration",
 		metric.WithUnit("s"),
-		metric.WithDescription("Seconds to serve one Connect Execute call, by message type and result."))
+		metric.WithDescription("Seconds to serve one Connect Execute call, by message type and result."),
+		// Explicit second-scale buckets. The durations are recorded in seconds, so the SDK's
+		// default millisecond-calibrated boundaries (first boundary 5) would bin every sub-5s
+		// request into one bucket — making histogram_quantile(0.99) interpolate to ~4.95s
+		// regardless of the real latency, which flapped the >1s edge-latency alert. These
+		// boundaries straddle the 1s SLO so the p99 reflects real (mostly sub-second) latency.
+		metric.WithExplicitBucketBoundaries(0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10))
 	if err != nil {
 		h, _ = noop.NewMeterProvider().Meter(meterName).Float64Histogram("edge_request_duration")
 	}

gateway/internal/connectsrv/metrics_test.go

@@ -29,6 +29,7 @@ func TestEdgeMetric(t *testing.T) {
 
 	type key struct{ messageType, result string }
 	counts := map[key]uint64{}
+	var bounds []float64
 	for _, sm := range rm.ScopeMetrics {
 		for _, md := range sm.Metrics {
 			if md.Name != "edge_request_duration" {
@@ -42,6 +43,7 @@ func TestEdgeMetric(t *testing.T) {
 				mt, _ := dp.Attributes.Value(attribute.Key("message_type"))
 				res, _ := dp.Attributes.Value(attribute.Key("result"))
 				counts[key{mt.AsString(), res.AsString()}] += dp.Count
+				bounds = dp.Bounds
 			}
 		}
 	}
@@ -51,6 +53,19 @@ func TestEdgeMetric(t *testing.T) {
 	if got := counts[key{"auth.guest", "domain"}]; got != 1 {
 		t.Errorf("edge auth.guest/domain = %d, want 1", got)
 	}
+	// The buckets must be second-scaled. The default (millisecond-calibrated) boundaries have no
+	// boundary between 0 and 5, so every sub-5s request bins into one bucket and p99 interpolates
+	// to ~4.95s, flapping the >1s alert. Require at least one sub-second boundary.
+	subSecond := false
+	for _, b := range bounds {
+		if b > 0 && b < 1 {
+			subSecond = true
+			break
+		}
+	}
+	if !subSecond {
+		t.Errorf("edge_request_duration bounds = %v, want sub-second boundaries (seconds-scaled)", bounds)
+	}
 }
 
 // TestRateLimitedMetric records limiter rejections through a manual reader and

gateway/internal/transcode/encode.go

@@ -118,6 +118,23 @@ func encodeProfile(p backendclient.ProfileResp) []byte {
 	return b.FinishedBytes()
 }
 
+// optString creates a FlatBuffers string for a non-empty value, or 0 to omit the
+// optional field (the client then reads it as absent).
+func optString(b *flatbuffers.Builder, s string) flatbuffers.UOffsetT {
+	if s == "" {
+		return 0
+	}
+	return b.CreateString(s)
+}
+
+// addOptString adds an optional string slot only when it was created (a 0 offset
+// leaves the field absent). add is the generated BannerCampaignAdd* setter.
+func addOptString(b *flatbuffers.Builder, add func(*flatbuffers.Builder, flatbuffers.UOffsetT), off flatbuffers.UOffsetT) {
+	if off != 0 {
+		add(b, off)
+	}
+}
+
 // encodeBanner builds a BannerInfo table from the resolved banner block and
 // returns its offset. It is bottom-up: each campaign's messages vector and table
 // are built first, then the campaigns vector, then the BannerInfo table. The
@@ -134,9 +151,23 @@ func encodeBanner(b *flatbuffers.Builder, banner backendclient.BannerResp) flatb
 			b.PrependUOffsetT(msgOffsets[j])
 		}
 		msgs := b.EndVector(len(msgOffsets))
+		// The optional colour strings must be created before the table starts; an
+		// empty colour is omitted (offset 0), so the client reads it as absent.
+		obg := optString(b, c.OverrideBg)
+		ofg := optString(b, c.OverrideFg)
+		olink := optString(b, c.OverrideLink)
+		obgD := optString(b, c.OverrideBgDark)
+		ofgD := optString(b, c.OverrideFgDark)
+		olinkD := optString(b, c.OverrideLinkDark)
 		fb.BannerCampaignStart(b)
 		fb.BannerCampaignAddWeight(b, int32(c.Weight))
 		fb.BannerCampaignAddMessages(b, msgs)
+		addOptString(b, fb.BannerCampaignAddOverrideBg, obg)
+		addOptString(b, fb.BannerCampaignAddOverrideFg, ofg)
+		addOptString(b, fb.BannerCampaignAddOverrideLink, olink)
+		addOptString(b, fb.BannerCampaignAddOverrideBgDark, obgD)
+		addOptString(b, fb.BannerCampaignAddOverrideFgDark, ofgD)
+		addOptString(b, fb.BannerCampaignAddOverrideLinkDark, olinkD)
 		campOffsets[i] = fb.BannerCampaignEnd(b)
 	}
 	fb.BannerInfoStartCampaignsVector(b, len(campOffsets))

gateway/internal/transcode/transcode.go

@@ -253,7 +253,7 @@ func authGuestHandler(backend *backendclient.Client) Handler {
 func authEmailRequestHandler(backend *backendclient.Client) Handler {
 	return func(ctx context.Context, req Request) ([]byte, error) {
 		in := fb.GetRootAsEmailRequestRequest(req.Payload, 0)
-		if err := backend.EmailRequest(ctx, string(in.Email()), string(in.BrowserTz()), string(in.Language())); err != nil {
+		if err := backend.EmailRequest(ctx, string(in.Email()), string(in.BrowserTz()), string(in.Language()), in.Pwa()); err != nil {
 			return nil, err
 		}
 		return encodeAck(true), nil

gateway/internal/transcode/transcode_banner_test.go

@@ -61,6 +61,54 @@ func TestProfileGetEncodesBanner(t *testing.T) {
 	}
 }
 
+// TestProfileGetEncodesBannerColors verifies the gateway carries a campaign's
+// optional colour overrides into the FlatBuffers payload, and leaves an absent
+// colour (or an absent set) empty so the client falls back to the theme tokens.
+func TestProfileGetEncodesBannerColors(t *testing.T) {
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte(`{"user_id":"u-1","display_name":"Kaya","preferred_language":"en",` +
+			`"banner":{"campaigns":[` +
+			`{"weight":1,"messages":["promo-en"],` +
+			`"override_bg":"#aa0000","override_fg":"#ffffff","override_link":"#ffdd00",` +
+			`"override_bg_dark":"#330000","override_fg_dark":"#eeeeee","override_link_dark":"#ffcc00"},` +
+			`{"weight":1,"messages":["plain-en"]}],` +
+			`"timings":{"hold_ms":60000,"edge_pause_ms":5000,"scroll_px_per_sec":40,` +
+			`"fade_out_ms":1000,"gap_ms":250,"fade_in_ms":1000}}}`))
+	})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, nil)
+	op, _ := reg.Lookup(transcode.MsgProfileGet)
+	payload, err := op.Handler(context.Background(), transcode.Request{UserID: "u-1"})
+	if err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+	banner := fb.GetRootAsProfile(payload, 0).Banner(nil)
+	if banner == nil {
+		t.Fatal("profile carries no banner block")
+	}
+	var c fb.BannerCampaign
+	banner.Campaigns(&c, 0)
+	if got := string(c.OverrideBg()); got != "#aa0000" {
+		t.Errorf("override_bg = %q, want #aa0000", got)
+	}
+	if got := string(c.OverrideLink()); got != "#ffdd00" {
+		t.Errorf("override_link = %q, want #ffdd00", got)
+	}
+	if got := string(c.OverrideBgDark()); got != "#330000" {
+		t.Errorf("override_bg_dark = %q, want #330000", got)
+	}
+	if got := string(c.OverrideLinkDark()); got != "#ffcc00" {
+		t.Errorf("override_link_dark = %q, want #ffcc00", got)
+	}
+	// The second campaign has no override: every colour field must be absent (nil).
+	banner.Campaigns(&c, 1)
+	if c.OverrideBg() != nil || c.OverrideFg() != nil || c.OverrideLink() != nil ||
+		c.OverrideBgDark() != nil || c.OverrideFgDark() != nil || c.OverrideLinkDark() != nil {
+		t.Error("plain campaign unexpectedly carries a colour override")
+	}
+}
+
 // TestProfileGetNoBanner verifies an ineligible viewer's profile carries no
 // banner block (the backend omits it).
 func TestProfileGetNoBanner(t *testing.T) {

gateway/internal/webui/webui.go

@@ -17,6 +17,7 @@ package webui
 import (
 	"embed"
 	"io/fs"
+	"mime"
 	"net/http"
 	"path"
 	"strings"
@@ -35,13 +36,25 @@ func distFS() fs.FS {
 	return sub
 }
 
-// Handler serves the embedded UI. An existing file is served directly (hash-named assets get
-// an immutable cache); every other path falls back to indexName (the SPA shell) so a
-// client-side deep link still loads. When stripPrefix is non-empty it is removed from the
-// request path before lookup, so the same build serves under a sub-path (e.g. "/app/" or
-// "/telegram/").
+// init registers the MIME type for .webmanifest, which Go's built-in table lacks and the
+// distroless runtime image has no /etc/mime.types to supply. Without it the PWA Web App Manifest
+// served under /app/ would be content-sniffed to text/plain, which some browsers reject.
+func init() {
+	_ = mime.AddExtensionType(".webmanifest", "application/manifest+json")
+}
+
+// Handler serves the compile-time embedded UI build over the public edge — the game SPA under
+// /app/, /telegram/ and /vk/. It delegates to handlerFor over the embedded dist/.
 func Handler(stripPrefix, indexName string) http.Handler {
-	content := distFS()
+	return handlerFor(distFS(), stripPrefix, indexName)
+}
+
+// handlerFor serves content as the UI: an existing file is served directly (hash-named assets get
+// an immutable cache); every other path falls back to indexName (the SPA shell) so a client-side
+// deep link still loads. When stripPrefix is non-empty it is removed from the request path before
+// lookup, so the same build serves under a sub-path (e.g. "/app/" or "/telegram/"). Split from
+// Handler so it can be exercised over an in-memory fs.FS in tests.
+func handlerFor(content fs.FS, stripPrefix, indexName string) http.Handler {
 	files := http.FileServer(http.FS(content))
 	h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		name := strings.TrimPrefix(path.Clean("/"+r.URL.Path), "/")

gateway/internal/webui/webui_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"testing/fstest"
 )
 
 // get drives the handler with a GET for the given path and returns the response.
@@ -55,3 +56,56 @@ func TestAppMountServesShellStripsPrefixAndCachesAssets(t *testing.T) {
 		}
 	}
 }
+
+// testFS mirrors what Vite emits into dist/: the SPA shell, the PWA manifest + service worker at
+// the root (copied from ui/public), and a hash-named asset. The compile-time embedded dist/ holds
+// only a placeholder shell, so the manifest/sw.js serving is exercised over this in-memory FS.
+func testFS() fstest.MapFS {
+	return fstest.MapFS{
+		"index.html":           {Data: []byte("<!doctype html><title>shell</title>")},
+		"manifest.webmanifest": {Data: []byte(`{"name":"Эрудит"}`)},
+		"sw.js":                {Data: []byte("self.addEventListener('fetch', () => {});")},
+		"assets/app-abc123.js": {Data: []byte("export const x = 1;")},
+	}
+}
+
+// TestHandlerServesManifestWithManifestType: the PWA manifest is served with the manifest MIME
+// type (registered in init, since the distroless image has no /etc/mime.types), not sniffed to
+// text/plain, which some browsers reject.
+func TestHandlerServesManifestWithManifestType(t *testing.T) {
+	h := handlerFor(testFS(), "/app/", "index.html")
+	resp := get(t, h, "/app/manifest.webmanifest")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want 200", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "application/manifest+json") {
+		t.Errorf("Content-Type = %q, want application/manifest+json", ct)
+	}
+}
+
+// TestHandlerServesServiceWorkerAsJavaScript: sw.js is served as JavaScript from the root, so its
+// registration (scope /app/) succeeds.
+func TestHandlerServesServiceWorkerAsJavaScript(t *testing.T) {
+	h := handlerFor(testFS(), "/app/", "index.html")
+	resp := get(t, h, "/app/sw.js")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want 200", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "text/javascript") {
+		t.Errorf("Content-Type = %q, want text/javascript", ct)
+	}
+}
+
+// TestHandlerFallsBackToShellForUnknownManifestPath guards the trap: a manifest/sw path NOT emitted
+// into dist/ falls back to the SPA shell as text/html, on which SW registration would fail. The two
+// tests above pin that the real files are served instead of the shell.
+func TestHandlerFallsBackToShellForUnknownManifestPath(t *testing.T) {
+	h := handlerFor(testFS(), "/app/", "index.html")
+	resp := get(t, h, "/app/not-emitted.webmanifest")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want 200", resp.StatusCode)
+	}
+	if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "text/html") {
+		t.Errorf("Content-Type = %q, want text/html (SPA shell fallback)", ct)
+	}
+}

pkg/fbs/scrabble.fbs

@@ -138,6 +138,11 @@ table EmailRequestRequest {
   email:string;
   browser_tz:string;
   language:string;
+  // Set when the request originates from an installed PWA (standalone display mode): the
+  // backend then omits the one-tap confirm link from the login email so the code is typed in
+  // the same window, avoiding a link that opens in a separate browser (a different storage
+  // context) where the minted session could not reach the PWA.
+  pwa:bool;
 }
 
 // EmailLoginRequest logs in to the account owning email (provisioned at the
@@ -180,10 +185,20 @@ table Ack {
 // BannerCampaign is one campaign in the rotation feed: a GCD-reduced show weight
 // (the client runs a smooth weighted round-robin over campaigns by this weight)
 // and its messages in display order, each already resolved to the viewer's bot
-// language (the stored en/ru pair is picked server-side).
+// language (the stored en/ru pair is picked server-side). The override_* colours
+// are an optional per-campaign palette: override_bg/fg/link paint the strip on
+// every theme, and the *_dark trio further overrides the dark theme (the client
+// resolves dark ← dark ?? all ?? token, light ← all ?? token). Empty means the
+// campaign keeps the neutral theme tokens (all added trailing — backward-compatible).
 table BannerCampaign {
   weight:int;
   messages:[string];
+  override_bg:string;
+  override_fg:string;
+  override_link:string;
+  override_bg_dark:string;
+  override_fg_dark:string;
+  override_link_dark:string;
 }
 
 // BannerInfo is the advertising-banner block of an eligible viewer's profile: the

pkg/fbs/scrabblefb/BannerCampaign.go

@@ -70,8 +70,56 @@ func (rcv *BannerCampaign) MessagesLength() int {
 	return 0
 }
 
+func (rcv *BannerCampaign) OverrideBg() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(8))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *BannerCampaign) OverrideFg() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(10))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *BannerCampaign) OverrideLink() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(12))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *BannerCampaign) OverrideBgDark() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(14))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *BannerCampaign) OverrideFgDark() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(16))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
+func (rcv *BannerCampaign) OverrideLinkDark() []byte {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(18))
+	if o != 0 {
+		return rcv._tab.ByteVector(o + rcv._tab.Pos)
+	}
+	return nil
+}
+
 func BannerCampaignStart(builder *flatbuffers.Builder) {
-	builder.StartObject(2)
+	builder.StartObject(8)
 }
 func BannerCampaignAddWeight(builder *flatbuffers.Builder, weight int32) {
 	builder.PrependInt32Slot(0, weight, 0)
@@ -82,6 +130,24 @@ func BannerCampaignAddMessages(builder *flatbuffers.Builder, messages flatbuffer
 func BannerCampaignStartMessagesVector(builder *flatbuffers.Builder, numElems int) flatbuffers.UOffsetT {
 	return builder.StartVector(4, numElems, 4)
 }
+func BannerCampaignAddOverrideBg(builder *flatbuffers.Builder, overrideBg flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(2, flatbuffers.UOffsetT(overrideBg), 0)
+}
+func BannerCampaignAddOverrideFg(builder *flatbuffers.Builder, overrideFg flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(3, flatbuffers.UOffsetT(overrideFg), 0)
+}
+func BannerCampaignAddOverrideLink(builder *flatbuffers.Builder, overrideLink flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(4, flatbuffers.UOffsetT(overrideLink), 0)
+}
+func BannerCampaignAddOverrideBgDark(builder *flatbuffers.Builder, overrideBgDark flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(5, flatbuffers.UOffsetT(overrideBgDark), 0)
+}
+func BannerCampaignAddOverrideFgDark(builder *flatbuffers.Builder, overrideFgDark flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(6, flatbuffers.UOffsetT(overrideFgDark), 0)
+}
+func BannerCampaignAddOverrideLinkDark(builder *flatbuffers.Builder, overrideLinkDark flatbuffers.UOffsetT) {
+	builder.PrependUOffsetTSlot(7, flatbuffers.UOffsetT(overrideLinkDark), 0)
+}
 func BannerCampaignEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }

pkg/fbs/scrabblefb/EmailRequestRequest.go

@@ -65,8 +65,20 @@ func (rcv *EmailRequestRequest) Language() []byte {
 	return nil
 }
 
+func (rcv *EmailRequestRequest) Pwa() bool {
+	o := flatbuffers.UOffsetT(rcv._tab.Offset(10))
+	if o != 0 {
+		return rcv._tab.GetBool(o + rcv._tab.Pos)
+	}
+	return false
+}
+
+func (rcv *EmailRequestRequest) MutatePwa(n bool) bool {
+	return rcv._tab.MutateBoolSlot(10, n)
+}
+
 func EmailRequestRequestStart(builder *flatbuffers.Builder) {
-	builder.StartObject(3)
+	builder.StartObject(4)
 }
 func EmailRequestRequestAddEmail(builder *flatbuffers.Builder, email flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(0, flatbuffers.UOffsetT(email), 0)
@@ -77,6 +89,9 @@ func EmailRequestRequestAddBrowserTz(builder *flatbuffers.Builder, browserTz fla
 func EmailRequestRequestAddLanguage(builder *flatbuffers.Builder, language flatbuffers.UOffsetT) {
 	builder.PrependUOffsetTSlot(2, flatbuffers.UOffsetT(language), 0)
 }
+func EmailRequestRequestAddPwa(builder *flatbuffers.Builder, pwa bool) {
+	builder.PrependBoolSlot(3, pwa, false)
+}
 func EmailRequestRequestEnd(builder *flatbuffers.Builder) flatbuffers.UOffsetT {
 	return builder.EndObject()
 }

ui/e2e/install.spec.ts

@@ -0,0 +1,59 @@
+import { expect, test } from './fixtures';
+
+// The install CTA (components/InstallApp.svelte) is platform-adaptive: a one-tap button where the
+// browser offers a beforeinstallprompt (Chromium), a manual instructions modal on iOS Safari, and
+// nothing elsewhere / once installed / inside a Mini App. The native OS install dialog is
+// browser-level and not drivable from Playwright, so these assert the CTA's presence and branch.
+
+const IPHONE_SAFARI =
+  'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1';
+
+test('web: a captured install prompt shows the one-tap CTA and clicking it prompts', async ({ page }) => {
+  await page.goto('/');
+  // The web login screen is shown (an ordinary browser tab, not a Mini App).
+  await expect(page.getByRole('button', { name: /guest/i })).toBeVisible();
+
+  // Hidden until the browser offers installation (Playwright never fires beforeinstallprompt).
+  await expect(page.getByRole('button', { name: /Install the app/i })).toHaveCount(0);
+
+  // Simulate Chromium offering the install: dispatch a beforeinstallprompt the app can capture.
+  await page.evaluate(() => {
+    const e = new Event('beforeinstallprompt') as Event & {
+      prompt?: () => Promise<void>;
+      userChoice?: Promise<unknown>;
+    };
+    (window as unknown as { __promptCalled: boolean }).__promptCalled = false;
+    e.prompt = () => {
+      (window as unknown as { __promptCalled: boolean }).__promptCalled = true;
+      return Promise.resolve();
+    };
+    e.userChoice = Promise.resolve({ outcome: 'accepted', platform: '' });
+    window.dispatchEvent(e);
+  });
+
+  const cta = page.getByRole('button', { name: /Install the app/i });
+  await expect(cta).toBeVisible();
+  await cta.click();
+  // Clicking calls the captured prompt (the native dialog itself is not observable here).
+  await expect
+    .poll(() => page.evaluate(() => (window as unknown as { __promptCalled: boolean }).__promptCalled))
+    .toBe(true);
+});
+
+test.describe('iOS Safari', () => {
+  test.use({ userAgent: IPHONE_SAFARI });
+
+  test('shows manual Add-to-Home-Screen instructions (no programmatic install)', async ({ page }) => {
+    await page.goto('/');
+    await expect(page.getByRole('button', { name: /guest/i })).toBeVisible();
+
+    // On iOS Safari the CTA shows at once (no beforeinstallprompt is ever fired there).
+    const cta = page.getByRole('button', { name: /Install the app/i });
+    await expect(cta).toBeVisible();
+    await cta.click();
+
+    // It opens the app's own instructions modal (not a native / Telegram popup).
+    await expect(page.getByRole('heading', { name: 'Add to Home Screen' })).toBeVisible();
+    await expect(page.getByText(/Tap the Share button/)).toBeVisible();
+  });
+});

ui/e2e/landing.spec.ts

@@ -46,3 +46,15 @@ test('the landing is a normal scrolling document (the SPA document-pin does not
   expect(state.shell).toBe(false);
   expect(state.bodyPosition).not.toBe('fixed');
 });
+
+// The web-version entry (/app/) is always present, alongside the build-var-gated Telegram/VK ones
+// (absent here, since e2e sets no VITE_* vars), each with a caption.
+test('the landing shows a web-version entry linking /app/, with a caption', async ({ page }) => {
+  await page.goto('/landing.html');
+  await expect(page.getByText(/Играй в «Эрудита»/)).toBeVisible(); // Russian by default
+
+  const web = page.getByRole('link', { name: 'Играть в браузере' });
+  await expect(web).toBeVisible();
+  expect(await web.getAttribute('href')).toContain('/app/');
+  await expect(page.getByText('Веб-версия')).toBeVisible();
+});

ui/e2e/social.spec.ts

@@ -327,6 +327,36 @@ test('change email: a free address replaces the current one', async ({ page }) =
   await expect(page.getByText('you@example.com')).toHaveCount(0);
 });
 
+// The add-email confirmation can complete out of band: the recipient taps the one-tap link in the
+// email, which confirms in another browser/session. A backgrounded Mini App misses the live
+// 'profile' event (the stream is single-shot, no replay), so the open code form falls back to
+// polling the profile until the address lands. The mock attaches the email WITHOUT emitting an
+// event, so only the poll can surface it.
+test('add email: an out-of-band confirmation surfaces on the open form via polling', async ({ page }) => {
+  await loginLobby(page);
+  await openProfile(page);
+
+  // Drop the seeded email so the sign-in section offers the add-email flow.
+  await page.evaluate(() => (window as unknown as { __mock: { clearEmail(): void } }).__mock.clearEmail());
+  const emailInput = page.locator('.accounts input[type="email"]');
+  await expect(emailInput).toBeVisible();
+
+  await emailInput.fill('linked@example.com');
+  await page.getByRole('button', { name: 'Send code' }).click();
+  await expect(page.locator('.accounts .codein')).toBeVisible();
+
+  // Confirmed elsewhere via the one-tap link, with no live event delivered: only the poll surfaces it.
+  await page.evaluate(() =>
+    (
+      window as unknown as { __mock: { confirmEmailOutOfBand(email: string): void } }
+    ).__mock.confirmEmailOutOfBand('linked@example.com'),
+  );
+
+  // The confirmed address surfaces as the email row, and the code form is gone.
+  await expect(page.locator('.acctrow').filter({ hasText: 'linked@example.com' })).toBeVisible({ timeout: 10000 });
+  await expect(page.locator('.accounts .codein')).toHaveCount(0);
+});
+
 test('link then unlink Telegram from the sign-in methods', async ({ page }) => {
   await loginLobby(page);
   await openProfile(page);

ui/index.html

@@ -256,6 +256,18 @@
     <link rel="icon" href="favicon.ico" sizes="32x32" />
     <link rel="icon" type="image/svg+xml" href="favicon.svg" />
     <link rel="apple-touch-icon" href="apple-touch-icon.png" />
+    <!-- PWA installability (web /app/ only): the manifest + a service worker (registered from
+         lib/pwa, web-only) let the app be added to the home screen / desktop. The relative href
+         resolves per serving path; these tags are inert inside the Telegram/VK Mini App webviews,
+         which manage their own chrome. theme-color mirrors the light/dark --bg tokens (app.css). -->
+    <link rel="manifest" href="manifest.webmanifest" />
+    <meta name="theme-color" content="#f3f4f6" media="(prefers-color-scheme: light)" />
+    <meta name="theme-color" content="#0f1115" media="(prefers-color-scheme: dark)" />
+    <meta name="mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-status-bar-style" content="default" />
+    <meta name="apple-mobile-web-app-title" content="Эрудит" />
+    <meta name="application-name" content="Эрудит" />
   </head>
   <body>
     <div id="app"></div>

ui/public/manifest.webmanifest

@@ -0,0 +1,17 @@
+{
+  "name": "Эрудит (Скрэббл)",
+  "short_name": "Эрудит",
+  "description": "Игра в слова «Эрудит» (Скрэббл): играйте с друзьями, случайным соперником или ИИ-роботом.",
+  "lang": "ru",
+  "dir": "ltr",
+  "start_url": ".",
+  "scope": ".",
+  "display": "standalone",
+  "background_color": "#f3f4f6",
+  "theme_color": "#f3f4f6",
+  "icons": [
+    { "src": "icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any" },
+    { "src": "icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any" },
+    { "src": "icon-maskable-512.png", "sizes": "512x512", "type": "image/png", "purpose": "maskable" }
+  ]
+}

ui/public/sw.js

@@ -0,0 +1,53 @@
+// Install-only service worker.
+//
+// Its sole job today is to satisfy Chromium's PWA installability requirement (a registered
+// service worker with a fetch handler) so the web app can be installed to the home screen /
+// desktop — notably on Android, where the manifest alone is not enough. It deliberately does
+// NOT cache assets or the Connect-RPC stream: only top-level navigations are handled,
+// network-first with a cached-shell fallback, so the live app, its immutable hashed assets and
+// the live event stream are never served stale.
+//
+// This is the single designated growth point for the planned offline mode (a Settings toggle,
+// default online — see docs/ARCHITECTURE.md). Extend the fetch router here; keep the same
+// /app/ scope; gate any real caching behind the toggle and coordinate updates with the boot
+// version guard.
+const SHELL = 'scrabble-shell-v1'; // bump only when the SW strategy itself changes.
+
+self.addEventListener('install', () => {
+  // No cached content to migrate carefully, so activate the new worker immediately.
+  self.skipWaiting();
+});
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil(
+    (async () => {
+      const keys = await caches.keys();
+      await Promise.all(keys.filter((k) => k !== SHELL).map((k) => caches.delete(k)));
+      await self.clients.claim();
+    })(),
+  );
+});
+
+self.addEventListener('fetch', (event) => {
+  const req = event.request;
+  // Only top-level navigations are handled. Hashed assets and the Connect-RPC requests are
+  // left untouched (no respondWith -> the browser performs its default fetch), so the worker
+  // can never break the live stream or serve a stale immutable asset.
+  if (req.mode !== 'navigate') return;
+  event.respondWith(
+    (async () => {
+      try {
+        const res = await fetch(req);
+        const cache = await caches.open(SHELL);
+        // One shell entry regardless of the deep-link path: the hash router resolves the route
+        // client-side, so any offline navigation can be served the same cached shell.
+        cache.put('shell', res.clone());
+        return res;
+      } catch {
+        const cache = await caches.open(SHELL);
+        const cached = await cache.match('shell');
+        return cached ?? Response.error();
+      }
+    })(),
+  );
+});

ui/scripts/bundle-size.mjs

@@ -19,10 +19,11 @@ import { join } from 'node:path';
 
 const DIST = 'dist';
 
-// Per-chunk gzip budgets in KB. The app entry was raised to 110 when the local
-// move-preview wiring landed (the heavy dict subsystem stays in lazy chunks; this
-// covers the small in-entry game/debug wiring it needs).
-const BUDGET = { app: 110, shared: 30, landing: 5 };
+// Per-chunk gzip budgets in KB. The app entry was raised to 110 for the local move-preview
+// wiring, then to 112 for the PWA install feature (the install CTA + the pwa detection /
+// service-worker registration live in the app entry; the heavy dict subsystem stays in lazy
+// chunks). Its scoped CSS lands in the CSS chunk, not this JS budget.
+const BUDGET = { app: 112, shared: 30, landing: 5 };
 
 // gzipped returns the gzipped byte size of a built asset, or 0 when the reference is not a
 // local file (e.g. the Telegram SDK loaded from a CDN) or is missing.

ui/src/Landing.svelte

@@ -80,20 +80,26 @@
   <section class="hero">
     <h1>{about.title}</h1>
     <p class="tagline">{t('landing.tagline')}</p>
-    {#if tgLink || vkLink}
-      <div class="entries">
-        {#if tgLink}
-          <a class="entry" href={tgLink} target="_blank" rel="noopener noreferrer" aria-label={t('landing.playTelegram')}>
-            <img src="telegram-logo.svg" alt="" width="64" height="64" />
-          </a>
-        {/if}
-        {#if vkLink}
-          <a class="entry" href={vkLink} target="_blank" rel="noopener noreferrer" aria-label={t('landing.playVK')}>
-            <img src="vk-logo.svg" alt="" width="64" height="64" />
-          </a>
-        {/if}
-      </div>
-    {/if}
+    <!-- Platform entries: Telegram/VK are gated by their build vars; the web version (/app/) is
+         always available. A caption under each clarifies what it opens. -->
+    <div class="entries">
+      {#if tgLink}
+        <a class="entry" href={tgLink} target="_blank" rel="noopener noreferrer" aria-label={t('landing.playTelegram')}>
+          <img src="telegram-logo.svg" alt="" width="64" height="64" />
+          <span class="caption">{t('landing.captionTelegram')}</span>
+        </a>
+      {/if}
+      {#if vkLink}
+        <a class="entry" href={vkLink} target="_blank" rel="noopener noreferrer" aria-label={t('landing.playVK')}>
+          <img src="vk-logo.svg" alt="" width="64" height="64" />
+          <span class="caption">{t('landing.captionVK')}</span>
+        </a>
+      {/if}
+      <a class="entry" href="/app/" aria-label={t('landing.playWeb')}>
+        <img src="favicon.svg" alt="" width="64" height="64" />
+        <span class="caption">{t('landing.captionWeb')}</span>
+      </a>
+    </div>
   </section>
 
   <section class="info">
@@ -207,8 +213,8 @@
     color: var(--text-muted);
     font-size: 1.05rem;
   }
-  /* The platform entries are just the bigger logos in a row (no button chrome, no captions);
-     each link keeps an aria-label for assistive tech. */
+  /* The platform entries are the bigger logos in a row, each with a short caption below; the
+     link keeps an aria-label for assistive tech. */
   .entries {
     align-self: center;
     display: flex;
@@ -217,6 +223,11 @@
   }
   .entry {
     display: inline-flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 8px;
+    text-decoration: none;
+    color: var(--text);
   }
   .entry img {
     display: block;
@@ -225,6 +236,10 @@
   .entry:hover img {
     transform: scale(1.06);
   }
+  .caption {
+    font-size: 0.9rem;
+    color: var(--text-muted);
+  }
   .info {
     background: var(--surface-2);
     border-radius: var(--radius-sm);

ui/src/components/AdBanner.svelte

@@ -3,12 +3,14 @@
   import {
     attachBannerHost,
     bannerCurrent,
+    bannerCurrentColors,
     configureBanner,
     detachBannerHost,
     remeasureBanner,
   } from '../lib/bannerEngine';
   import { defaultBannerTimings, linkify, type BannerHost } from '../lib/banner';
-  import type { BannerCampaign, BannerTimings } from '../lib/model';
+  import { resolveBannerColors, type ThemeMode } from '../lib/bannerColors';
+  import type { BannerCampaign, BannerColors, BannerTimings } from '../lib/model';
   import { onExternalLinkClick } from '../lib/links';
 
   let {
@@ -21,12 +23,33 @@
   // current message and is visible at once (no fade — see inFade), so a screen change does not
   // replay the fade. Empty on the very first mount (engine not yet started).
   let current = $state(bannerCurrent());
+  let currentColors = $state<BannerColors>(bannerCurrentColors());
   let visible = $state(bannerCurrent() !== '');
   let tx = $state(0);
   let txDur = $state(0);
   let track = $state<HTMLElement>();
   let viewport = $state<HTMLElement>();
 
+  // The rendered theme (light/dark), tracked so a campaign's colour override resolves against the
+  // theme actually on screen and re-resolves live when the operator/OS flips it. It follows the
+  // [data-theme] attribute (theme.ts), or the OS preference when unset ('auto').
+  let themeMode = $state<ThemeMode>(resolveThemeMode());
+  function resolveThemeMode(): ThemeMode {
+    if (typeof document === 'undefined') return 'light';
+    const attr = document.documentElement.getAttribute('data-theme');
+    if (attr === 'dark' || attr === 'light') return attr;
+    return window.matchMedia?.('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
+  }
+
+  // The strip's colours for the current campaign + theme (null = the neutral tokens). Applied as
+  // inline CSS variables scoped to .ad, so an override never leaks to the rest of the page.
+  const adColors = $derived(resolveBannerColors(currentColors, themeMode));
+  const adStyle = $derived(
+    adColors
+      ? `--ad-bg:${adColors.bg};--text-muted:${adColors.fg};--accent:${adColors.link};--ad-border:${adColors.border}`
+      : '',
+  );
+
   // The first appearance after mounting onto an already-running cycle is instant; every later
   // message change fades. (Consumed by the first in:fade.)
   let instantOnce = bannerCurrent() !== '';
@@ -50,8 +73,9 @@
   // The DOM host the engine drives. The fade lives on the {#if} layer (transition:fade), the scroll
   // on the inner track's transform, so a long message's scroll never blocks its fade in/out.
   const host: BannerHost = {
-    show(md) {
+    show(md, colors) {
       current = md;
+      currentColors = colors;
       tx = 0;
       txDur = 0;
       visible = true;
@@ -93,6 +117,20 @@
   $effect(() => {
     configureBanner(campaigns, eff);
   });
+  // Track the rendered theme so a colour override re-resolves when the theme flips: watch the
+  // [data-theme] attribute (Settings toggle / Telegram) and, for 'auto', the OS colour scheme.
+  $effect(() => {
+    const update = () => (themeMode = resolveThemeMode());
+    update();
+    const obs = new MutationObserver(update);
+    obs.observe(document.documentElement, { attributes: true, attributeFilter: ['data-theme'] });
+    const mq = window.matchMedia?.('(prefers-color-scheme: dark)');
+    mq?.addEventListener('change', update);
+    return () => {
+      obs.disconnect();
+      mq?.removeEventListener('change', update);
+    };
+  });
   // Re-measure on a viewport size change (e.g. a portrait↔landscape rotation): a message that fit
   // may now overflow, or vice versa, so the scroll must be re-evaluated. Debounced.
   $effect(() => {
@@ -116,7 +154,7 @@
      confirmation, the VK away-redirect keeps the Android WebView on the game. -->
 <!-- svelte-ignore a11y_no_static_element_interactions -->
 <!-- svelte-ignore a11y_click_events_have_key_events -->
-<div class="ad" bind:this={viewport} onclick={onExternalLinkClick}>
+<div class="ad" bind:this={viewport} style={adStyle} onclick={onExternalLinkClick}>
   <!-- An always-present, invisible spacer reserves exactly one line of height, so the strip never
        collapses while the message layer is absent during the fade gap (the message is overlaid
        absolutely, so its presence/absence does not change the strip height). -->
@@ -145,8 +183,8 @@
     font-size: 0.85rem;
     line-height: 1.2;
     box-shadow: inset 0 1px 2px rgba(0, 0, 0, 0.18);
-    border-top: 1px solid var(--border);
-    border-bottom: 1px solid var(--border);
+    border-top: 1px solid var(--ad-border, var(--border));
+    border-bottom: 1px solid var(--ad-border, var(--border));
     user-select: none;
   }
   /* Reserves one line of height inside the padding so .ad keeps a constant height even during the

ui/src/components/InstallApp.svelte

@@ -0,0 +1,85 @@
+<script lang="ts">
+  import { t } from '../lib/i18n/index.svelte';
+  import { installMode, promptInstall } from '../lib/pwa.svelte';
+  import Modal from './Modal.svelte';
+
+  // Platform-adaptive: 'oneTap' fires the native Chromium install dialog; 'iosInstructions' opens
+  // the manual Share -> Add-to-Home-Screen guide (iOS Safari has no programmatic install); 'hidden'
+  // renders nothing (already installed, inside a Telegram/VK Mini App, or an unsupported browser).
+  const mode = $derived(installMode());
+  let showIos = $state(false);
+
+  function onClick(): void {
+    // promptInstall must run synchronously from this gesture — the deferred prompt is gated on it.
+    if (mode === 'oneTap') void promptInstall();
+    else if (mode === 'iosInstructions') showIos = true;
+  }
+</script>
+
+{#if mode !== 'hidden'}
+  <button type="button" class="install" onclick={onClick}>
+    <img src="favicon.svg" alt="" width="40" height="40" />
+    <span class="text">
+      <span class="title">{t('install.title')}</span>
+      <span class="subtitle">{t('install.subtitle')}</span>
+    </span>
+  </button>
+{/if}
+
+{#if showIos}
+  <Modal title={t('install.iosTitle')} onclose={() => (showIos = false)}>
+    <ol class="steps">
+      <li>{t('install.iosStep1')}</li>
+      <li>{t('install.iosStep2')}</li>
+      <li>{t('install.iosStep3')}</li>
+    </ol>
+    <button type="button" class="ok" onclick={() => (showIos = false)}>{t('common.ok')}</button>
+  </Modal>
+{/if}
+
+<style>
+  .install {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    width: 100%;
+    text-align: left;
+    padding: 12px;
+    border: 1px solid var(--border);
+    border-radius: var(--radius-sm);
+    background: var(--surface);
+    color: var(--text);
+    cursor: pointer;
+  }
+  .install img {
+    flex: none;
+    border-radius: 8px;
+  }
+  .text {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+    min-width: 0;
+  }
+  .title {
+    font-weight: 600;
+  }
+  .subtitle {
+    font-size: 0.85rem;
+    color: var(--text-muted);
+    line-height: 1.35;
+  }
+  .steps {
+    margin: 0 0 16px;
+    padding-left: 1.25rem;
+    line-height: 1.6;
+  }
+  .ok {
+    width: 100%;
+    padding: 10px 12px;
+    border: 1px solid var(--accent);
+    background: var(--accent);
+    color: var(--accent-text);
+    border-radius: var(--radius-sm);
+  }
+</style>

ui/src/components/Toast.svelte

@@ -3,8 +3,9 @@
   import { app, dismissToast } from '../lib/app.svelte';
 
   const dur = $derived(app.reduceMotion ? 0 : 260);
-  // An info bubble owns its whole 2s life through a CSS rise-and-fade animation, so it takes
-  // no Svelte enter/leave transition; an error keeps the fly-in / fade-out dwell behaviour.
+  // An info bubble owns its whole 3s life through a CSS animation — appear, a ~1s hold at rest,
+  // then rise-and-fade — so it takes no Svelte enter/leave transition; an error keeps the fly-in /
+  // fade-out dwell behaviour.
   const isInfo = $derived(app.toast?.kind !== 'error');
 </script>
 
@@ -50,17 +51,19 @@
     border-color: var(--danger);
     color: var(--danger);
   }
-  /* An info bubble fades in, then drifts up by roughly the tab-bar height while fading out,
-     all within 2s; the X centring is preserved across the rise. */
+  /* An info bubble fades in, holds for ~1s at rest, then drifts up by roughly the tab-bar height
+     while fading out, all within 3s; the X centring is preserved across the rise. The 8%/41%
+     stops are the appear (~240ms) and the end of the ~1s hold. */
   .toast.rise {
-    animation: toast-rise 2s ease-out forwards;
+    animation: toast-rise 3s ease-out forwards;
   }
   @keyframes toast-rise {
     0% {
       opacity: 0;
       transform: translateX(-50%) translateY(8px);
     }
-    12% {
+    8%,
+    41% {
       opacity: 1;
       transform: translateX(-50%) translateY(0);
     }
@@ -69,16 +72,16 @@
       transform: translateX(-50%) translateY(-56px);
     }
   }
-  /* Reduced motion: the same 2s life, fade only — no upward travel. */
+  /* Reduced motion: the same 3s life (appear, ~1s hold, fade), fade only — no upward travel. */
   .toast.rise-reduced {
-    animation: toast-rise-reduced 2s ease-out forwards;
+    animation: toast-rise-reduced 3s ease-out forwards;
   }
   @keyframes toast-rise-reduced {
     0% {
       opacity: 0;
     }
-    12%,
-    70% {
+    8%,
+    41% {
       opacity: 1;
     }
     100% {

ui/src/gen/fbs/scrabblefb/banner-campaign.ts

@@ -37,8 +37,50 @@ messagesLength():number {
   return offset ? this.bb!.__vector_len(this.bb_pos + offset) : 0;
 }
 
+overrideBg():string|null
+overrideBg(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideBg(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+overrideFg():string|null
+overrideFg(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideFg(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+overrideLink():string|null
+overrideLink(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideLink(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 12);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+overrideBgDark():string|null
+overrideBgDark(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideBgDark(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 14);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+overrideFgDark():string|null
+overrideFgDark(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideFgDark(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 16);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+overrideLinkDark():string|null
+overrideLinkDark(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+overrideLinkDark(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 18);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
 static startBannerCampaign(builder:flatbuffers.Builder) {
-  builder.startObject(2);
+  builder.startObject(8);
 }
 
 static addWeight(builder:flatbuffers.Builder, weight:number) {
@@ -61,15 +103,45 @@ static startMessagesVector(builder:flatbuffers.Builder, numElems:number) {
   builder.startVector(4, numElems, 4);
 }
 
+static addOverrideBg(builder:flatbuffers.Builder, overrideBgOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(2, overrideBgOffset, 0);
+}
+
+static addOverrideFg(builder:flatbuffers.Builder, overrideFgOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(3, overrideFgOffset, 0);
+}
+
+static addOverrideLink(builder:flatbuffers.Builder, overrideLinkOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(4, overrideLinkOffset, 0);
+}
+
+static addOverrideBgDark(builder:flatbuffers.Builder, overrideBgDarkOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(5, overrideBgDarkOffset, 0);
+}
+
+static addOverrideFgDark(builder:flatbuffers.Builder, overrideFgDarkOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(6, overrideFgDarkOffset, 0);
+}
+
+static addOverrideLinkDark(builder:flatbuffers.Builder, overrideLinkDarkOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(7, overrideLinkDarkOffset, 0);
+}
+
 static endBannerCampaign(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createBannerCampaign(builder:flatbuffers.Builder, weight:number, messagesOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createBannerCampaign(builder:flatbuffers.Builder, weight:number, messagesOffset:flatbuffers.Offset, overrideBgOffset:flatbuffers.Offset, overrideFgOffset:flatbuffers.Offset, overrideLinkOffset:flatbuffers.Offset, overrideBgDarkOffset:flatbuffers.Offset, overrideFgDarkOffset:flatbuffers.Offset, overrideLinkDarkOffset:flatbuffers.Offset):flatbuffers.Offset {
   BannerCampaign.startBannerCampaign(builder);
   BannerCampaign.addWeight(builder, weight);
   BannerCampaign.addMessages(builder, messagesOffset);
+  BannerCampaign.addOverrideBg(builder, overrideBgOffset);
+  BannerCampaign.addOverrideFg(builder, overrideFgOffset);
+  BannerCampaign.addOverrideLink(builder, overrideLinkOffset);
+  BannerCampaign.addOverrideBgDark(builder, overrideBgDarkOffset);
+  BannerCampaign.addOverrideFgDark(builder, overrideFgDarkOffset);
+  BannerCampaign.addOverrideLinkDark(builder, overrideLinkDarkOffset);
   return BannerCampaign.endBannerCampaign(builder);
 }
 }

ui/src/gen/fbs/scrabblefb/email-request-request.ts

@@ -41,8 +41,13 @@ language(optionalEncoding?:any):string|Uint8Array|null {
   return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
 }
 
+pwa():boolean {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? !!this.bb!.readInt8(this.bb_pos + offset) : false;
+}
+
 static startEmailRequestRequest(builder:flatbuffers.Builder) {
-  builder.startObject(3);
+  builder.startObject(4);
 }
 
 static addEmail(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset) {
@@ -57,16 +62,21 @@ static addLanguage(builder:flatbuffers.Builder, languageOffset:flatbuffers.Offse
   builder.addFieldOffset(2, languageOffset, 0);
 }
 
+static addPwa(builder:flatbuffers.Builder, pwa:boolean) {
+  builder.addFieldInt8(3, +pwa, +false);
+}
+
 static endEmailRequestRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createEmailRequestRequest(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset, languageOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createEmailRequestRequest(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset, languageOffset:flatbuffers.Offset, pwa:boolean):flatbuffers.Offset {
   EmailRequestRequest.startEmailRequestRequest(builder);
   EmailRequestRequest.addEmail(builder, emailOffset);
   EmailRequestRequest.addBrowserTz(builder, browserTzOffset);
   EmailRequestRequest.addLanguage(builder, languageOffset);
+  EmailRequestRequest.addPwa(builder, pwa);
   return EmailRequestRequest.endEmailRequestRequest(builder);
 }
 }

ui/src/lib/app.svelte.ts

@@ -35,6 +35,8 @@ import {
 } from './telegram';
 import { onVKPath, insideVK, vkInit, vkClose, vkDisableSwipeBack, vkLaunchParams, vkUserName, vkStartParam, vkOnScheme, vkOnInsets, vkSetViewSettings, appearanceForBg } from './vk';
 import { pendingVKLink, type VKLinkCallback } from './vkid';
+import { isStandalone } from './pwa';
+import { registerServiceWorker } from './pwa.svelte';
 import { haptic } from './haptics';
 import { CLOUD_PREFS_KEY, decodeClientPrefs, encodeClientPrefs } from './cloudprefs';
 import { parseStartParam } from './deeplink';
@@ -214,9 +216,9 @@ function goForeground(): void {
 export function showToast(text: string, kind: Toast['kind'] = 'info'): void {
   app.toast = { kind, text, seq: ++toastSeq };
   if (toastTimer) clearTimeout(toastTimer);
-  // An info bubble lives exactly as long as its rise-and-fade animation (2s); an error
-  // dwells longer (4s) so it is not missed.
-  toastTimer = setTimeout(() => (app.toast = null), kind === 'error' ? 4000 : 2000);
+  // An info bubble lives exactly as long as its appear + ~1s hold + rise-and-fade animation (3s);
+  // an error dwells longer (4s) so it is not missed.
+  toastTimer = setTimeout(() => (app.toast = null), kind === 'error' ? 4000 : 3000);
 }
 
 /** dismissToast hides the current toast at once — a tap on the bubble dismisses it. */
@@ -783,6 +785,11 @@ export async function bootstrap(): Promise<void> {
     return;
   }
 
+  // On the plain web (both Mini-App branches returned above) register the install-only service
+  // worker so the app is installable — Chromium needs a registered SW, notably on Android. Web-only
+  // and skipped in the mock build; see lib/pwa.svelte.
+  registerServiceWorker();
+
   const saved = await loadSession();
   // A VK ID web-link callback (?code&device_id&state) rides the URL after the redirect back
   // from VK; capture and clear it here (it needs the restored session to link against).
@@ -974,7 +981,7 @@ export async function loginGuest(): Promise<void> {
 
 export async function requestEmailCode(email: string): Promise<boolean> {
   try {
-    await gateway.authEmailRequest(email, app.locale);
+    await gateway.authEmailRequest(email, app.locale, isStandalone());
     return true;
   } catch (err) {
     handleError(err);

ui/src/lib/banner.test.ts

@@ -29,7 +29,7 @@ describe('createScheduler', () => {
       { weight: 7, messages: ['b'] },
     ]);
     expect(sched.total).toBe(2);
-    const cycle = Array.from({ length: 10 }, () => sched.next());
+    const cycle = Array.from({ length: 10 }, () => sched.next().md);
     const a = cycle.filter((m) => m === 'a').length;
     const b = cycle.filter((m) => m === 'b').length;
     expect(a).toBe(3);
@@ -42,7 +42,7 @@ describe('createScheduler', () => {
   it('round-robins messages within a campaign', () => {
     const sched = createScheduler([{ weight: 1, messages: ['m0', 'm1', 'm2'] }]);
     expect(sched.total).toBe(3);
-    expect([sched.next(), sched.next(), sched.next(), sched.next()]).toEqual(['m0', 'm1', 'm2', 'm0']);
+    expect([sched.next().md, sched.next().md, sched.next().md, sched.next().md]).toEqual(['m0', 'm1', 'm2', 'm0']);
   });
 
   it('drops empty and non-positive-weight campaigns', () => {
@@ -52,13 +52,27 @@ describe('createScheduler', () => {
       { weight: 2, messages: ['keep'] },
     ]);
     expect(sched.total).toBe(1);
-    expect(sched.next()).toBe('keep');
+    expect(sched.next().md).toBe('keep');
   });
 
   it('is empty for no campaigns', () => {
     const sched = createScheduler([]);
     expect(sched.total).toBe(0);
-    expect(sched.next()).toBe('');
+    expect(sched.next().md).toBe('');
+  });
+
+  it('carries each campaign colour override with its message', () => {
+    const red = { bg: '#aa0000', fg: '#ffffff', link: '#ffdd00' };
+    const darkRed = { bg: '#330000', fg: '#eeeeee', link: '#ffcc00' };
+    const sched = createScheduler([
+      { weight: 1, messages: ['plain'] },
+      { weight: 1, messages: ['branded'], overrideAll: red, overrideDark: darkRed },
+    ]);
+    const two = [sched.next(), sched.next()];
+    const branded = two.find((it) => it.md === 'branded');
+    const plain = two.find((it) => it.md === 'plain');
+    expect(branded?.colors).toEqual({ all: red, dark: darkRed });
+    expect(plain?.colors).toEqual({ all: null, dark: null });
   });
 });
 

ui/src/lib/banner.ts

@@ -4,7 +4,7 @@
 // unit-testable with fake timers. The campaigns + timings come from the profile's
 // banner block (see lib/model, ARCHITECTURE §10); the host is AdBanner.svelte.
 
-import type { BannerCampaign, BannerTimings } from './model';
+import type { BannerCampaign, BannerColors, BannerTimings } from './model';
 
 /** Fallback display timings, matching the seeded ad_settings defaults. */
 export const defaultBannerTimings: BannerTimings = {
@@ -16,9 +16,15 @@ export const defaultBannerTimings: BannerTimings = {
   fadeInMs: 1_000,
 };
 
+/** BannerItem is one scheduled message plus its campaign's colour override (for the strip). */
+export interface BannerItem {
+  md: string;
+  colors: BannerColors;
+}
+
 /** Scheduler yields the next message to show, fairly across weighted campaigns. */
 export interface Scheduler {
-  next(): string;
+  next(): BannerItem;
   /** Total messages across all (non-empty, positive-weight) campaigns. */
   readonly total: number;
 }
@@ -33,15 +39,17 @@ export interface Scheduler {
  */
 export function createScheduler(campaigns: BannerCampaign[]): Scheduler {
   const cs = campaigns.filter((c) => c.weight > 0 && c.messages.length > 0);
+  const colors: BannerColors[] = cs.map((c) => ({ all: c.overrideAll ?? null, dark: c.overrideDark ?? null }));
   const current = cs.map(() => 0); // SWRR running weights
   const cursor = cs.map(() => 0); // per-campaign round-robin position
   const totalWeight = cs.reduce((sum, c) => sum + c.weight, 0);
   const total = cs.reduce((sum, c) => sum + c.messages.length, 0);
+  const empty: BannerColors = { all: null, dark: null };
 
   return {
     total,
-    next(): string {
-      if (cs.length === 0) return '';
+    next(): BannerItem {
+      if (cs.length === 0) return { md: '', colors: empty };
       let best = 0;
       for (let i = 0; i < cs.length; i++) {
         current[i] += cs[i].weight;
@@ -51,15 +59,16 @@ export function createScheduler(campaigns: BannerCampaign[]): Scheduler {
       const c = cs[best];
       const md = c.messages[cursor[best] % c.messages.length];
       cursor[best]++;
-      return md;
+      return { md, colors: colors[best] };
     },
   };
 }
 
 /** The host the rotator drives; AdBanner.svelte supplies the DOM measurements and effects. */
 export interface BannerHost {
-  /** Render md and fade it in (over fadeInMs), with the scroll reset to the start. */
-  show(md: string): void;
+  /** Render md and fade it in (over fadeInMs), with the scroll reset to the start. colors is the
+   *  source campaign's colour override, applied to the strip (its neutral tokens when unset). */
+  show(md: string, colors: BannerColors): void;
   /** Reset the scroll to the start without re-fading (to loop a long message). */
   resetScroll(): void;
   /** Fade the current message out over durationMs. */
@@ -98,7 +107,7 @@ export function createBannerRotator(
   const sched = createScheduler(campaigns);
   let running = false;
   let cycleStart = 0;
-  let lastShown = ''; // the message currently presented, for restart() (re-measure)
+  let lastShown: BannerItem | null = null; // the item currently presented, for restart() (re-measure)
   const timers: ReturnType<typeof setTimeout>[] = [];
 
   const at = (ms: number, fn: () => void) => {
@@ -109,11 +118,11 @@ export function createBannerRotator(
     timers.length = 0;
   };
 
-  function present(md: string) {
+  function present(item: BannerItem) {
     if (!running) return;
     clear();
-    lastShown = md;
-    host.show(md);
+    lastShown = item;
+    host.show(item.md, item.colors);
     at(config.fadeInMs, measure);
   }
 
@@ -143,7 +152,7 @@ export function createBannerRotator(
           // the same fade as a message change, not a hard jump.
           host.hide(config.fadeOutMs);
           at(config.fadeOutMs + config.gapMs, () => {
-            host.show(lastShown);
+            if (lastShown) host.show(lastShown.md, lastShown.colors);
             at(config.fadeInMs, () => scrollCycle(over));
           });
         }

ui/src/lib/bannerColors.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { derivedBorder, resolveBannerColors } from './bannerColors';
+import type { BannerColors } from './model';
+
+const red = { bg: '#aa0000', fg: '#ffffff', link: '#ffdd00' };
+const darkRed = { bg: '#330000', fg: '#eeeeee', link: '#ffcc00' };
+
+describe('resolveBannerColors', () => {
+  it('returns null when the campaign has no override (neutral tokens)', () => {
+    const none: BannerColors = { all: null, dark: null };
+    expect(resolveBannerColors(none, 'light')).toBeNull();
+    expect(resolveBannerColors(none, 'dark')).toBeNull();
+  });
+
+  it('applies the all-themes set on both themes when no dark override', () => {
+    const c: BannerColors = { all: red, dark: null };
+    expect(resolveBannerColors(c, 'light')).toMatchObject({ bg: red.bg, fg: red.fg, link: red.link });
+    expect(resolveBannerColors(c, 'dark')).toMatchObject({ bg: red.bg, fg: red.fg, link: red.link });
+  });
+
+  it('prefers the dark override on the dark theme, and the all set on light', () => {
+    const c: BannerColors = { all: red, dark: darkRed };
+    expect(resolveBannerColors(c, 'light')).toMatchObject({ bg: red.bg });
+    expect(resolveBannerColors(c, 'dark')).toMatchObject({ bg: darkRed.bg });
+  });
+
+  it('supports a dark-only override (light keeps the neutral tokens)', () => {
+    const c: BannerColors = { all: null, dark: darkRed };
+    expect(resolveBannerColors(c, 'light')).toBeNull();
+    expect(resolveBannerColors(c, 'dark')).toMatchObject({ bg: darkRed.bg });
+  });
+
+  it('derives the border from the resolved background', () => {
+    const c: BannerColors = { all: red, dark: null };
+    expect(resolveBannerColors(c, 'light')?.border).toBe(derivedBorder(red.bg));
+  });
+});
+
+describe('derivedBorder', () => {
+  it('darkens a light background and lightens a dark one', () => {
+    expect(derivedBorder('#ffffff')).toBe('#dbdbdb');
+    expect(derivedBorder('#000000')).toBe('#242424');
+  });
+
+  it('returns a malformed colour unchanged', () => {
+    expect(derivedBorder('nope')).toBe('nope');
+  });
+});

ui/src/lib/bannerColors.ts

@@ -0,0 +1,69 @@
+// Banner colour resolution. A campaign may carry two optional colour sets (see
+// lib/model BannerColors): one for every theme and one that further overrides the
+// dark theme. resolveBannerColors collapses them to the colours the strip paints on
+// the currently-rendered theme, or null when the campaign keeps the neutral
+// --ad-bg / --text-muted / --accent tokens. Pure and DOM-free, so it is unit-tested
+// directly; AdBanner.svelte applies the result as inline CSS variables.
+
+import type { BannerColors } from './model';
+
+export type ThemeMode = 'light' | 'dark';
+
+/** ResolvedBannerColors is the strip's colours for one theme, border already derived. */
+export interface ResolvedBannerColors {
+  bg: string;
+  fg: string;
+  link: string;
+  border: string;
+}
+
+/**
+ * resolveBannerColors picks the colour set for the rendered theme — dark ← dark ?? all,
+ * light ← all — and returns null when there is no override for that theme (the strip then
+ * keeps the neutral tokens). The border is derived from the background so it stays subtle
+ * on any colour.
+ */
+export function resolveBannerColors(colors: BannerColors, mode: ThemeMode): ResolvedBannerColors | null {
+  const set = mode === 'dark' ? (colors.dark ?? colors.all) : colors.all;
+  if (!set) return null;
+  return { bg: set.bg, fg: set.fg, link: set.link, border: derivedBorder(set.bg) };
+}
+
+/**
+ * derivedBorder nudges the background 14% toward black on a light background and toward
+ * white on a dark one — a subtle edge that suits any override colour. It is computed in
+ * JS (no CSS color-mix) so it works on the old Android WebView floor (Chrome 67), and
+ * mirrors the admin console preview (banner_detail.gohtml). A malformed colour is
+ * returned unchanged.
+ */
+export function derivedBorder(bgHex: string): string {
+  const rgb = hexToRgb(bgHex);
+  if (!rgb) return bgHex;
+  const target: RGB = luminance(rgb) > 0.5 ? [0, 0, 0] : [255, 255, 255];
+  return rgbToHex(mix(rgb, target, 0.14));
+}
+
+type RGB = [number, number, number];
+
+function hexToRgb(h: string): RGB | null {
+  const m = /^#([0-9a-fA-F]{6})$/.exec(h.trim());
+  if (!m) return null;
+  const n = m[1];
+  return [parseInt(n.slice(0, 2), 16), parseInt(n.slice(2, 4), 16), parseInt(n.slice(4, 6), 16)];
+}
+
+function mix(a: RGB, b: RGB, t: number): RGB {
+  return [a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t, a[2] + (b[2] - a[2]) * t];
+}
+
+function luminance(r: RGB): number {
+  return (0.2126 * r[0] + 0.7152 * r[1] + 0.0722 * r[2]) / 255;
+}
+
+function pad(x: number): string {
+  return Math.max(0, Math.min(255, Math.round(x))).toString(16).padStart(2, '0');
+}
+
+function rgbToHex(r: RGB): string {
+  return '#' + pad(r[0]) + pad(r[1]) + pad(r[2]);
+}

ui/src/lib/bannerEngine.ts

@@ -4,11 +4,14 @@
 // independent of route transitions (the cycle is not restarted on navigation).
 
 import { createBannerRotator, type BannerHost, type Rotator } from './banner';
-import type { BannerCampaign, BannerTimings } from './model';
+import type { BannerCampaign, BannerColors, BannerTimings } from './model';
+
+const noColors: BannerColors = { all: null, dark: null };
 
 let rotator: Rotator | null = null;
 let mounted: BannerHost | null = null;
 let current = '';
+let currentColors: BannerColors = noColors;
 let key = '';
 // The in-flight horizontal scroll of the current message, so a view mounted by navigation can
 // resume it from the same offset instead of restarting at the left. Null when not scrolling.
@@ -17,10 +20,11 @@ let activeScroll: { toPx: number; dur: number; start: number } | null = null;
 // proxy is the rotator's host: it records the current message + scroll (so a freshly-mounted view
 // can resume them) and forwards every effect to the currently-attached DOM host, if any.
 const proxy: BannerHost = {
-  show(md) {
+  show(md, colors) {
     current = md;
+    currentColors = colors;
     activeScroll = null;
-    mounted?.show(md);
+    mounted?.show(md, colors);
   },
   resetScroll() {
     activeScroll = null;
@@ -58,6 +62,7 @@ export function configureBanner(campaigns: BannerCampaign[], timings: BannerTimi
   key = k;
   rotator?.stop();
   current = '';
+  currentColors = noColors;
   rotator = createBannerRotator(campaigns, proxy, timings);
   rotator.start();
 }
@@ -71,6 +76,15 @@ export function bannerCurrent(): string {
   return current;
 }
 
+/**
+ * bannerCurrentColors returns the colour override of the campaign whose message is currently
+ * displayed (neutral tokens — both sets null — before the first message). A freshly-mounted view
+ * reads it alongside bannerCurrent so the strip paints the right colours immediately on mount.
+ */
+export function bannerCurrentColors(): BannerColors {
+  return currentColors;
+}
+
 /**
  * attachBannerHost connects a freshly-mounted view as the DOM host. It does NOT re-show the
  * current message (the view renders it itself from bannerCurrent on mount): re-showing here would

ui/src/lib/client.ts

@@ -65,7 +65,7 @@ export interface GatewayClient {
    *  cosmetic seed for a brand-new account). */
   authVK(params: string, displayName: string): Promise<Session>;
   authGuest(locale?: string): Promise<Session>;
-  authEmailRequest(email: string, language: string): Promise<void>;
+  authEmailRequest(email: string, language: string, pwa: boolean): Promise<void>;
   authEmailLogin(email: string, code: string): Promise<Session>;
   /** Confirm a one-tap email deeplink token: a login returns a session to adopt; a
    *  link returns a status ('confirmed' | 'merge_required'). */

ui/src/lib/codec.test.ts

@@ -122,10 +122,11 @@ describe('codec', () => {
     expect(guest.browserTz()).toBe('-05:30');
 
     const email = fb.EmailRequestRequest.getRootAsEmailRequestRequest(
-      new ByteBuffer(encodeEmailRequest('a@example.com', '+00:00', 'en')),
+      new ByteBuffer(encodeEmailRequest('a@example.com', '+00:00', 'en', true)),
     );
     expect(email.email()).toBe('a@example.com');
     expect(email.browserTz()).toBe('+00:00');
+    expect(email.pwa()).toBe(true);
     expect(email.language()).toBe('en');
 
     const confirm = fb.EmailConfirmLinkRequest.getRootAsEmailConfirmLinkRequest(
@@ -647,7 +648,10 @@ describe('codec', () => {
     const uid = b.createString('u-1');
     const m0 = b.createString('promo-en');
     const msgs = fb.BannerCampaign.createMessagesVector(b, [m0]);
-    const camp = fb.BannerCampaign.createBannerCampaign(b, 3, msgs);
+    fb.BannerCampaign.startBannerCampaign(b);
+    fb.BannerCampaign.addWeight(b, 3);
+    fb.BannerCampaign.addMessages(b, msgs);
+    const camp = fb.BannerCampaign.endBannerCampaign(b);
     const camps = fb.BannerInfo.createCampaignsVector(b, [camp]);
     const banner = fb.BannerInfo.createBannerInfo(b, camps, 60000, 5000, 40, 1000, 250, 1000);
     fb.Profile.startProfile(b);
@@ -656,7 +660,8 @@ describe('codec', () => {
     b.finish(fb.Profile.endProfile(b));
 
     const p = decodeProfile(b.asUint8Array());
-    expect(p.banner?.campaigns).toEqual([{ weight: 3, messages: ['promo-en'] }]);
+    // A plain campaign carries no override (both sets null → the neutral theme tokens).
+    expect(p.banner?.campaigns).toEqual([{ weight: 3, messages: ['promo-en'], overrideAll: null, overrideDark: null }]);
     expect(p.banner?.timings).toEqual({
       holdMs: 60000,
       edgePauseMs: 5000,
@@ -667,6 +672,26 @@ describe('codec', () => {
     });
   });
 
+  it('decodes a campaign colour override (both sets)', () => {
+    const b = new Builder(256);
+    const uid = b.createString('u-1');
+    const m0 = b.createString('branded');
+    const msgs = fb.BannerCampaign.createMessagesVector(b, [m0]);
+    const s = (v: string) => b.createString(v);
+    const [obg, ofg, ol, obgd, ofgd, old] = ['#aa0000', '#ffffff', '#ffdd00', '#330000', '#eeeeee', '#ffcc00'].map(s);
+    const camp = fb.BannerCampaign.createBannerCampaign(b, 1, msgs, obg, ofg, ol, obgd, ofgd, old);
+    const camps = fb.BannerInfo.createCampaignsVector(b, [camp]);
+    const banner = fb.BannerInfo.createBannerInfo(b, camps, 60000, 5000, 40, 1000, 250, 1000);
+    fb.Profile.startProfile(b);
+    fb.Profile.addUserId(b, uid);
+    fb.Profile.addBanner(b, banner);
+    b.finish(fb.Profile.endProfile(b));
+
+    const p = decodeProfile(b.asUint8Array());
+    expect(p.banner?.campaigns[0].overrideAll).toEqual({ bg: '#aa0000', fg: '#ffffff', link: '#ffdd00' });
+    expect(p.banner?.campaigns[0].overrideDark).toEqual({ bg: '#330000', fg: '#eeeeee', link: '#ffcc00' });
+  });
+
   it('leaves the profile banner undefined when absent', () => {
     const b = new Builder(64);
     const uid = b.createString('u-1');

ui/src/lib/codec.ts

@@ -19,6 +19,7 @@ import type {
   BestMoveTile,
   BlockStatus,
   ChatMessage,
+  ColorTriple,
   EvalResult,
   FeedbackState,
   FriendCode,
@@ -213,7 +214,12 @@ export function encodeGuestLogin(locale: string, browserTz: string): Uint8Array
   return finish(b, fb.GuestLoginRequest.endGuestLoginRequest(b));
 }
 
-export function encodeEmailRequest(email: string, browserTz: string, language: string): Uint8Array {
+export function encodeEmailRequest(
+  email: string,
+  browserTz: string,
+  language: string,
+  pwa: boolean,
+): Uint8Array {
   const b = new Builder(128);
   const e = b.createString(email);
   const tz = b.createString(browserTz);
@@ -222,6 +228,7 @@ export function encodeEmailRequest(email: string, browserTz: string, language: s
   fb.EmailRequestRequest.addEmail(b, e);
   fb.EmailRequestRequest.addBrowserTz(b, tz);
   fb.EmailRequestRequest.addLanguage(b, l);
+  fb.EmailRequestRequest.addPwa(b, pwa);
   return finish(b, fb.EmailRequestRequest.endEmailRequestRequest(b));
 }
 
@@ -368,6 +375,12 @@ function decodeVariantPreferences(p: fb.Profile): Variant[] {
   return out;
 }
 
+// bannerTriple builds a colour override from the three wire fields, or null when the
+// set is absent (any field empty/missing) — the strip then keeps the neutral tokens.
+function bannerTriple(bg: string | null, fg: string | null, link: string | null): ColorTriple | null {
+  return bg && fg && link ? { bg, fg, link } : null;
+}
+
 // decodeBanner projects the optional advertising-banner block of a Profile, or
 // undefined when the viewer is not eligible (the field is absent).
 function decodeBanner(p: fb.Profile): Banner | undefined {
@@ -379,7 +392,12 @@ function decodeBanner(p: fb.Profile): Banner | undefined {
     if (!c) continue;
     const messages: string[] = [];
     for (let j = 0; j < c.messagesLength(); j++) messages.push(c.messages(j));
-    campaigns.push({ weight: c.weight(), messages });
+    campaigns.push({
+      weight: c.weight(),
+      messages,
+      overrideAll: bannerTriple(c.overrideBg(), c.overrideFg(), c.overrideLink()),
+      overrideDark: bannerTriple(c.overrideBgDark(), c.overrideFgDark(), c.overrideLinkDark()),
+    });
   }
   return {
     campaigns,

ui/src/lib/dict/dawg.cursor.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { Dawg } from './dawg';
+
+// The step-by-step DAWG cursor (root/final/next/arcs) is the primitive the move
+// generator walks. These fast unit tests pin it against a small committed sample
+// dictionary (backend/cmd/movegen); the full parity vs the Go solver lands with
+// the generator's conformance fixtures.
+const bytes = new Uint8Array(readFileSync(new URL('./testdata/sample_en.dawg', import.meta.url)));
+const fixture = JSON.parse(
+  readFileSync(new URL('./testdata/sample_en.words.json', import.meta.url), 'utf8'),
+) as { numAdded: number; words: string[]; indexes: number[][] };
+
+const key = (w: number[]): string => w.join(',');
+
+// enumerateWords walks the whole automaton depth-first, collecting the index path
+// at every accepting node — i.e. every stored word.
+function enumerateWords(d: Dawg): number[][] {
+  const out: number[][] = [];
+  const path: number[] = [];
+  const visit = (node: number): void => {
+    d.arcs(node, (label, dest, final) => {
+      path.push(label);
+      if (final) out.push(path.slice());
+      visit(dest);
+      path.pop();
+      return true;
+    });
+  };
+  if (d.final(d.root())) out.push([]);
+  visit(d.root());
+  return out;
+}
+
+describe('dawg cursor', () => {
+  it('parses the sample fixture', () => {
+    const d = new Dawg(bytes);
+    expect(d.numAdded).toBe(fixture.numAdded);
+  });
+
+  it('root is not an accepting state (the sample has no empty word)', () => {
+    const d = new Dawg(bytes);
+    expect(d.final(d.root())).toBe(false);
+  });
+
+  it('enumerates exactly the stored words', () => {
+    const d = new Dawg(bytes);
+    const got = enumerateWords(d).map(key).sort();
+    const want = fixture.indexes.map(key).sort();
+    expect(got).toEqual(want);
+  });
+
+  it('next walks a stored word to an accepting node and rejects a non-edge', () => {
+    const d = new Dawg(bytes);
+    let node = d.root();
+    for (const ch of [2, 0, 17, 4, 3]) {
+      // "cared"
+      node = d.next(node, ch);
+      expect(node).toBeGreaterThanOrEqual(0);
+    }
+    expect(d.final(node)).toBe(true);
+    // "care" (index [2,0,17,4]) is an internal accepting node on the way to "cared".
+    const care = [2, 0, 17, 4].reduce((n, ch) => d.next(n, ch), d.root());
+    expect(d.final(care)).toBe(true);
+    // No stored word starts with 'z' (index 25).
+    expect(d.next(d.root(), 25)).toBe(-1);
+  });
+});

ui/src/lib/dict/dawg.ts

@@ -95,6 +95,85 @@ export class Dawg {
     return this.indexOf(word) >= 0;
   }
 
+  // --- Step-by-step traversal (the move generator's primitive) ---------------
+  //
+  // A `Node` is a bit offset into the graph; 0 denotes the root (which resolves
+  // to firstNodeOffset). These mirror dafsa's traverse.go Cursor (Root/Final/
+  // Next/Arcs) over the same bitstream this reader already decodes, so the ported
+  // generator can drive the automaton one transition at a time. Single-threaded
+  // JS shares this reader's position across calls; every method re-seeks to its
+  // node on entry, and arcs brackets the callback with a save/restore, so nested
+  // use during a walk is safe. Mirrors dafsa (*Cursor).
+
+  /** root returns the start state of the automaton. */
+  root(): number {
+    return 0;
+  }
+
+  /** final reports whether node is an accepting state (a stored word ends there). */
+  final(node: number): boolean {
+    if (this.numEdges <= 0) {
+      return this.hasEmptyWord && node === 0;
+    }
+    this.p = node === 0 ? this.firstNodeOffset : node;
+    return this.readBits(1) === 1;
+  }
+
+  /**
+   * next follows the edge labelled ch (an alphabet index) from node, returning the
+   * destination node, or -1 when no such edge exists.
+   */
+  next(node: number, ch: number): number {
+    return this.getEdge(node, ch) ? this.eNode : -1;
+  }
+
+  /**
+   * arcs calls fn for each out-edge of node in ascending label order, passing the
+   * edge's label, its destination node and whether that destination is accepting.
+   * It stops early if fn returns false. Mirrors dafsa (*Cursor).Arcs.
+   */
+  arcs(node: number, fn: (label: number, dest: number, final: boolean) => boolean): void {
+    if (this.numEdges <= 0) {
+      return;
+    }
+    this.p = node === 0 ? this.firstNodeOffset : node;
+    this.readBits(1); // node final flag — not needed here
+    const fallthrough = this.readBits(1);
+
+    if (fallthrough === 1) {
+      const label = this.readBits(this.cbits);
+      // The reader now sits at the destination node, whose first bit is its final flag.
+      const dest = this.p;
+      const final = this.readBits(1) === 1;
+      fn(label, dest, final);
+      return;
+    }
+
+    const nskiplen = bitsLen(this.wbits);
+    let nskip = 0;
+    let numEdges = 1;
+    if (this.readBits(1) !== 1) {
+      // not a single edge
+      numEdges = this.readUnsigned();
+      nskip = this.readBits(nskiplen);
+    }
+
+    for (let i = 0; i < numEdges; i++) {
+      const label = this.readBits(this.cbits);
+      if (i > 0) {
+        this.readBits(nskip); // per-edge skip count, unused for traversal
+      }
+      const dest = this.readBits(this.abits);
+      const resume = this.p;
+      this.p = dest;
+      const final = this.readBits(1) === 1;
+      if (!fn(label, dest, final)) {
+        return;
+      }
+      this.p = resume;
+    }
+  }
+
   // getEdge resolves the outgoing edge for ch from the node at the given bit
   // offset. On success it fills eNode/eCount/eFinal and returns true. Mirrors
   // dafsa (*dawg).getEdge.

ui/src/lib/dict/generate.parity.test.ts

@@ -0,0 +1,99 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { Dawg } from './dawg';
+import { generateMoves, GenRack, type GenBoard, type Mode } from './generate';
+import type { Ruleset } from './validate';
+
+// Conformance gate for the ported move generator: for each committed position it must
+// return exactly the ranked play list the real Go solver returns (backend/cmd/movegen).
+// The Russian sample reaches alphabet index 32, exercising the 33-letter cross-set.
+
+interface Tile {
+  row: number;
+  col: number;
+  letter: number;
+  blank: boolean;
+}
+interface GenMove {
+  dir: number;
+  tiles: Tile[];
+  score: number;
+}
+interface Fixture {
+  ruleset: {
+    size: number;
+    cols: number;
+    center: number;
+    rackSize: number;
+    bingo: number;
+    values: number[];
+    letterMult: number[][];
+    wordMult: number[][];
+  };
+  cases: {
+    name: string;
+    placed: Tile[] | null;
+    rack: { letters: number[]; blanks: number };
+    mode: number;
+    ignoreCrossWords: boolean;
+    moves: GenMove[];
+  }[];
+}
+
+function load(tag: string): { dawg: Dawg; fx: Fixture } {
+  const bytes = new Uint8Array(readFileSync(new URL(`./testdata/sample_${tag}.dawg`, import.meta.url)));
+  const fx = JSON.parse(
+    readFileSync(new URL(`./testdata/sample_${tag}.gen.json`, import.meta.url), 'utf8'),
+  ) as Fixture;
+  return { dawg: new Dawg(bytes), fx };
+}
+
+function buildBoard(placed: Tile[], cols: number): GenBoard {
+  const grid: ({ letter: number; blank: boolean } | null)[] = new Array(cols * cols).fill(null);
+  for (const t of placed) grid[t.row * cols + t.col] = { letter: t.letter, blank: t.blank };
+  const inBounds = (r: number, c: number): boolean => r >= 0 && r < cols && c >= 0 && c < cols;
+  return {
+    rows: cols,
+    cols,
+    inBounds,
+    filled: (r, c) => inBounds(r, c) && grid[r * cols + c] !== null,
+    cellAt: (r, c) => grid[r * cols + c]!,
+    isEmpty: () => placed.length === 0,
+  };
+}
+
+function rulesetFor(fx: Fixture, ignoreCrossWords: boolean): Ruleset {
+  const r = fx.ruleset;
+  return {
+    cols: r.cols,
+    center: r.center,
+    rackSize: r.rackSize,
+    bingo: r.bingo,
+    values: r.values,
+    letterMult: (row, col) => r.letterMult[row][col],
+    wordMult: (row, col) => r.wordMult[row][col],
+    ignoreCrossWords,
+  };
+}
+
+// sig is an order-stable signature of a move: orientation, score and its placed tiles
+// sorted by square — so two lists compare equal iff they rank the same plays the same way.
+function sig(m: GenMove): string {
+  const ts = m.tiles.slice().sort((a, b) => (a.row !== b.row ? a.row - b.row : a.col - b.col));
+  return `${m.dir}#${m.score}#` + ts.map((t) => `${t.row},${t.col},${t.letter}${t.blank ? '*' : ''}`).join(';');
+}
+
+for (const tag of ['en', 'ru']) {
+  describe(`move generator parity vs Go solver (${tag})`, () => {
+    const { dawg, fx } = load(tag);
+    for (const c of fx.cases) {
+      it(c.name, () => {
+        const board = buildBoard(c.placed ?? [], fx.ruleset.cols);
+        const rack = GenRack.from(fx.ruleset.size, c.rack.letters, c.rack.blanks);
+        const rs = rulesetFor(fx, c.ignoreCrossWords);
+        const got = generateMoves(dawg, board, rack, rs, c.mode as Mode);
+        expect(got.map(sig)).toEqual(c.moves.map(sig));
+      });
+    }
+  });
+}

ui/src/lib/dict/generate.realparity.test.ts

@@ -0,0 +1,113 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { Dawg } from './dawg';
+import { generateMoves, GenRack, type GenBoard, type Mode } from './generate';
+import type { Ruleset } from './validate';
+
+// Full-dictionary conformance for the ported move generator: for positions over the real
+// shipped dictionaries (deep graphs and full 26/33-letter alphabets the tiny committed
+// samples cannot reach) it must return exactly the ranked list the Go solver does. The
+// golden vectors come from `go run ./backend/cmd/movegen -dawg-dir <dawg> -out <dir>` and
+// the CI conformance job wires the two directories in; the suite skips when they are unset.
+const dawgDir = process.env.DICT_DAWG_DIR;
+const goldDir = process.env.DICT_MOVEGEN_DIR;
+const ready = !!dawgDir && !!goldDir && existsSync(dawgDir) && existsSync(goldDir);
+
+// variant -> the release dawg file name (matches dawg.parity.test.ts / the movegen tool).
+const variants = [
+  { variant: 'scrabble_en', dawg: 'en_sowpods' },
+  { variant: 'scrabble_ru', dawg: 'ru_scrabble' },
+  { variant: 'erudit_ru', dawg: 'ru_erudit' },
+];
+
+interface Tile {
+  row: number;
+  col: number;
+  letter: number;
+  blank: boolean;
+}
+interface GenMove {
+  dir: number;
+  tiles: Tile[];
+  score: number;
+}
+interface Fixture {
+  ruleset: {
+    size: number;
+    cols: number;
+    center: number;
+    rackSize: number;
+    bingo: number;
+    values: number[];
+    letterMult: number[][];
+    wordMult: number[][];
+  };
+  cases: {
+    name: string;
+    placed: Tile[] | null;
+    rack: { letters: number[]; blanks: number };
+    mode: number;
+    ignoreCrossWords: boolean;
+    moves: GenMove[];
+  }[];
+}
+
+function buildBoard(placed: Tile[], cols: number): GenBoard {
+  const grid: ({ letter: number; blank: boolean } | null)[] = new Array(cols * cols).fill(null);
+  for (const t of placed) grid[t.row * cols + t.col] = { letter: t.letter, blank: t.blank };
+  const inBounds = (r: number, c: number): boolean => r >= 0 && r < cols && c >= 0 && c < cols;
+  return {
+    rows: cols,
+    cols,
+    inBounds,
+    filled: (r, c) => inBounds(r, c) && grid[r * cols + c] !== null,
+    cellAt: (r, c) => grid[r * cols + c]!,
+    isEmpty: () => placed.length === 0,
+  };
+}
+
+function rulesetFor(fx: Fixture, ignoreCrossWords: boolean): Ruleset {
+  const r = fx.ruleset;
+  return {
+    cols: r.cols,
+    center: r.center,
+    rackSize: r.rackSize,
+    bingo: r.bingo,
+    values: r.values,
+    letterMult: (row, col) => r.letterMult[row][col],
+    wordMult: (row, col) => r.wordMult[row][col],
+    ignoreCrossWords,
+  };
+}
+
+function sig(m: GenMove): string {
+  const ts = m.tiles.slice().sort((a, b) => (a.row !== b.row ? a.row - b.row : a.col - b.col));
+  return `${m.dir}#${m.score}#` + ts.map((t) => `${t.row},${t.col},${t.letter}${t.blank ? '*' : ''}`).join(';');
+}
+
+describe.skipIf(!ready)('move generator parity vs Go on the real dictionaries', () => {
+  for (const v of variants) {
+    describe(v.variant, () => {
+      // Guard the collection-time reads: the block is skipped when the dirs are unset, but
+      // the describe callback still runs to register tests, so touch the filesystem only
+      // when ready (otherwise join(undefined, …) would throw during a normal unit run).
+      if (!ready) return;
+      const fx = JSON.parse(readFileSync(join(goldDir!, `${v.variant}.movegen.json`), 'utf8')) as Fixture;
+      const dawg = new Dawg(new Uint8Array(readFileSync(join(dawgDir!, `${v.dawg}.dawg`))));
+      for (const c of fx.cases) {
+        it(
+          c.name,
+          () => {
+            const board = buildBoard(c.placed ?? [], fx.ruleset.cols);
+            const rack = GenRack.from(fx.ruleset.size, c.rack.letters, c.rack.blanks);
+            const rs = rulesetFor(fx, c.ignoreCrossWords);
+            const got = generateMoves(dawg, board, rack, rs, c.mode as Mode);
+            expect(got.map(sig)).toEqual(c.moves.map(sig));
+          },
+          60_000,
+        );
+      }
+    });
+  }
+});

ui/src/lib/dict/generate.ts

@@ -0,0 +1,418 @@
+// Local move generator: every legal play for a rack on a board, ranked by
+// descending score. Ported from the scrabble-solver engine — the Appel-Jacobson
+// two-phase algorithm (LeftPart then ExtendRight) over a plain left-to-right DAWG
+// (scrabble/gen_dawg.go, gen.go, crossset.go, solver.go, key.go). It walks the DAWG
+// with the cursor from dawg.ts and scores each play with evaluate() from validate.ts,
+// so the whole robot brain runs on-device. Faithfulness to the Go solver is pinned by
+// generate.parity.test.ts against golden fixtures (backend/cmd/movegen).
+//
+// Everything works in alphabet-index space, mirroring the Go engine. A letterSet is
+// a per-square cross-set (the letters that form a legal perpendicular word there);
+// it is a boolean membership array rather than a uint64, so alphabet indexes past
+// JS's 31-bit shift boundary (Russian has 33 letters) are handled exactly.
+
+import { Dawg } from './dawg';
+import {
+  evaluate,
+  connected,
+  Horizontal,
+  Vertical,
+  type Board,
+  type Ruleset,
+  type Move,
+  type Placement,
+  type Direction,
+} from './validate';
+
+/** Both generates across plays (on the board) and down plays (on its transpose). */
+export const Both = 0;
+/** OnlyHorizontal generates across plays only. */
+export const OnlyHorizontal = 1;
+/** OnlyVertical generates down plays only (Эрудит plays a single orientation per turn). */
+export const OnlyVertical = 2;
+export type Mode = typeof Both | typeof OnlyHorizontal | typeof OnlyVertical;
+
+function modeIncludes(mode: Mode, dir: Direction): boolean {
+  if (mode === Both) return true;
+  if (mode === OnlyHorizontal) return dir === Horizontal;
+  return dir === Vertical;
+}
+
+/**
+ * GenBoard is the board view the generator needs: the validator's read view plus the
+ * dimensions it iterates over. The whole board is square, so a transposed view (below)
+ * satisfies the same shape.
+ */
+export interface GenBoard extends Board {
+  rows: number;
+  cols: number;
+}
+
+/**
+ * GenRack is a rack as per-letter tile counts plus a blank slot, mirroring
+ * scrabble-solver/rack. The generator mutates a single rack in place — removing a
+ * tile, recursing, putting it back — so the operations are O(1) and allocation-free.
+ */
+export class GenRack {
+  private readonly counts: Int32Array;
+
+  /** Construct an empty rack for an alphabet of the given size (a trailing blank slot). */
+  constructor(size: number) {
+    this.counts = new Int32Array(size + 1);
+  }
+
+  /** from builds a rack from a multiset of letter indexes plus a blank count. */
+  static from(size: number, letters: readonly number[], blanks: number): GenRack {
+    const r = new GenRack(size);
+    for (const l of letters) r.counts[l]++;
+    r.counts[size] += blanks;
+    return r;
+  }
+
+  /** has reports whether at least one tile of the letter index is on the rack. */
+  has(letter: number): boolean {
+    return this.counts[letter] > 0;
+  }
+  /** blanks returns how many blank tiles are on the rack. */
+  blanks(): number {
+    return this.counts[this.counts.length - 1];
+  }
+  remove(letter: number): void {
+    this.counts[letter]--;
+  }
+  add(letter: number): void {
+    this.counts[letter]++;
+  }
+  removeBlank(): void {
+    this.counts[this.counts.length - 1]--;
+  }
+  addBlank(): void {
+    this.counts[this.counts.length - 1]++;
+  }
+  /** clone returns an independent copy. */
+  clone(): GenRack {
+    const c = new GenRack(this.counts.length - 1);
+    c.counts.set(this.counts);
+    return c;
+  }
+}
+
+// --- cross-sets ------------------------------------------------------------------
+//
+// A LetterSet is membership over alphabet letter indexes. Mirrors scrabble.letterSet
+// (a uint64) but as a Uint8Array so index 32 (Russian) is exact under JS bit ops.
+type LetterSet = Uint8Array;
+
+function fullSet(size: number): LetterSet {
+  return new Uint8Array(size).fill(1);
+}
+
+// walk follows word (alphabet indexes) left to right from the root; -1 if it derails.
+function walk(dawg: Dawg, word: readonly number[]): number {
+  let n = dawg.root();
+  for (const l of word) {
+    n = dawg.next(n, l);
+    if (n < 0) return -1;
+  }
+  return n;
+}
+
+// completers returns the letters X (< size) whose arc from state leads directly to an
+// accepting node — the deterministic cross-set primitive. Mirrors scrabble.completers.
+function completers(dawg: Dawg, state: number, size: number): LetterSet {
+  const set = new Uint8Array(size);
+  dawg.arcs(state, (label, _dest, final) => {
+    if (final && label < size) set[label] = 1;
+    return true;
+  });
+  return set;
+}
+
+// dawgCrossSet returns the letters X for which above·X·below is a stored word. Mirrors
+// scrabble.dawgCrossSet: a right extension (no tiles below) just completes the prefix
+// above; a left extension (tiles below) probes each X. above/below are letter indexes.
+function dawgCrossSet(dawg: Dawg, above: number[], below: number[], size: number): LetterSet {
+  if (above.length === 0 && below.length === 0) return fullSet(size);
+  if (below.length === 0) {
+    const node = walk(dawg, above);
+    if (node < 0) return new Uint8Array(size);
+    return completers(dawg, node, size);
+  }
+  let node = dawg.root();
+  if (above.length > 0) {
+    node = walk(dawg, above);
+    if (node < 0) return new Uint8Array(size);
+  }
+  const set = new Uint8Array(size);
+  for (let x = 0; x < size; x++) {
+    let m = dawg.next(node, x);
+    if (m < 0) continue;
+    let ok = true;
+    for (const l of below) {
+      m = dawg.next(m, l);
+      if (m < 0) {
+        ok = false;
+        break;
+      }
+    }
+    if (ok && dawg.final(m)) set[x] = 1;
+  }
+  return set;
+}
+
+// columnContext returns the contiguous run of filled cells immediately above and below
+// the empty square (r, c), each top to bottom, as letter indexes — the tiles a
+// perpendicular word through (r, c) would include. Mirrors scrabble.columnContext.
+function columnContext(b: GenBoard, r: number, c: number): { above: number[]; below: number[] } {
+  const above: number[] = [];
+  let start = r;
+  while (start - 1 >= 0 && b.filled(start - 1, c)) start--;
+  for (let rr = start; rr < r; rr++) above.push(b.cellAt(rr, c).letter);
+
+  const below: number[] = [];
+  let end = r;
+  while (end + 1 < b.rows && b.filled(end + 1, c)) end++;
+  for (let rr = r + 1; rr <= end; rr++) below.push(b.cellAt(rr, c).letter);
+  return { above, below };
+}
+
+// transpose returns a view of b with rows and columns swapped, so down-play generation
+// runs as across generation. Mirrors board.Transpose (as a lazy view).
+function transpose(b: GenBoard): GenBoard {
+  return {
+    rows: b.cols,
+    cols: b.rows,
+    inBounds: (r, c) => b.inBounds(c, r),
+    filled: (r, c) => b.filled(c, r),
+    cellAt: (r, c) => b.cellAt(c, r),
+    isEmpty: () => b.isEmpty(),
+  };
+}
+
+// A tentatively placed left-part tile; its column is fixed only at record time.
+interface TileInfo {
+  letter: number;
+  blank: boolean;
+}
+
+// AcrossGen carries one across-generation pass over a board. Mirrors scrabble.acrossGen.
+class AcrossGen {
+  private row = 0;
+  private readonly left: TileInfo[] = [];
+  private readonly right: Placement[] = [];
+
+  constructor(
+    private readonly dawg: Dawg,
+    private readonly bd: GenBoard,
+    private readonly rk: GenRack,
+    private readonly cross: (r: number, c: number) => LetterSet,
+    private readonly emit: (placements: Placement[]) => void,
+  ) {}
+
+  generateRow(row: number, firstMove: boolean, centerRow: number, centerCol: number): void {
+    this.row = row;
+    let limit = 0;
+    for (let col = 0; col < this.bd.cols; col++) {
+      if (this.bd.filled(row, col)) {
+        limit = 0;
+        continue;
+      }
+      const anchor = firstMove ? row === centerRow && col === centerCol : this.hasFilledNeighbor(row, col);
+      if (!anchor) {
+        limit++;
+        continue;
+      }
+      this.left.length = 0;
+      this.right.length = 0;
+      if (col > 0 && this.bd.filled(row, col - 1)) {
+        const pre = this.walkPrefix(row, col);
+        if (pre.ok) this.extendRight(pre.node, col, col);
+      } else {
+        this.leftPart(this.dawg.root(), col, limit);
+      }
+      limit = 0;
+    }
+  }
+
+  private hasFilledNeighbor(r: number, c: number): boolean {
+    return this.bd.filled(r - 1, c) || this.bd.filled(r + 1, c) || this.bd.filled(r, c - 1) || this.bd.filled(r, c + 1);
+  }
+
+  // walkPrefix walks the DAWG through the filled run ending at col-1, returning the
+  // node reached and whether that prefix exists. Mirrors scrabble.acrossGen.walkPrefix.
+  private walkPrefix(row: number, col: number): { node: number; ok: boolean } {
+    let start = col - 1;
+    while (start - 1 >= 0 && this.bd.filled(row, start - 1)) start--;
+    let node = this.dawg.root();
+    for (let c = start; c < col; c++) {
+      node = this.dawg.next(node, this.bd.cellAt(row, c).letter);
+      if (node < 0) return { node, ok: false };
+    }
+    return { node, ok: true };
+  }
+
+  // leftPart places left-part tiles from the rack (up to limit), calling extendRight
+  // after each prefix. Mirrors scrabble.acrossGen.leftPart.
+  private leftPart(node: number, anchorCol: number, limit: number): void {
+    this.extendRight(node, anchorCol, anchorCol);
+    if (limit === 0) return;
+    this.dawg.arcs(node, (label, dest) => {
+      if (this.rk.has(label)) {
+        this.rk.remove(label);
+        this.left.push({ letter: label, blank: false });
+        this.leftPart(dest, anchorCol, limit - 1);
+        this.left.pop();
+        this.rk.add(label);
+      }
+      if (this.rk.blanks() > 0) {
+        this.rk.removeBlank();
+        this.left.push({ letter: label, blank: true });
+        this.leftPart(dest, anchorCol, limit - 1);
+        this.left.pop();
+        this.rk.addBlank();
+      }
+      return true;
+    });
+  }
+
+  // extendRight extends the word rightward from col, placing rack tiles on empty
+  // squares (constrained by cross-sets) and following board tiles. A word is recorded
+  // only past the anchor. Mirrors scrabble.acrossGen.extendRight.
+  private extendRight(node: number, col: number, anchorCol: number): void {
+    if (col >= this.bd.cols) {
+      if (col > anchorCol && this.dawg.final(node)) this.record(anchorCol);
+      return;
+    }
+    if (this.bd.filled(this.row, col)) {
+      const dest = this.dawg.next(node, this.bd.cellAt(this.row, col).letter);
+      if (dest >= 0) this.extendRight(dest, col + 1, anchorCol);
+      return;
+    }
+
+    if (col > anchorCol && this.dawg.final(node)) this.record(anchorCol);
+    const cross = this.cross(this.row, col);
+    this.dawg.arcs(node, (label, dest) => {
+      if (cross[label] !== 1) return true;
+      if (this.rk.has(label)) {
+        this.rk.remove(label);
+        this.right.push({ row: this.row, col, letter: label, blank: false });
+        this.extendRight(dest, col + 1, anchorCol);
+        this.right.pop();
+        this.rk.add(label);
+      }
+      if (this.rk.blanks() > 0) {
+        this.rk.removeBlank();
+        this.right.push({ row: this.row, col, letter: label, blank: true });
+        this.extendRight(dest, col + 1, anchorCol);
+        this.right.pop();
+        this.rk.addBlank();
+      }
+      return true;
+    });
+  }
+
+  // record assembles the play (left part at fixed columns, then the right part) and
+  // reports it, skipping plays that lay no new tile. Mirrors scrabble.acrossGen.record.
+  private record(anchorCol: number): void {
+    if (this.left.length + this.right.length === 0) return;
+    const placements: Placement[] = [];
+    const leftStart = anchorCol - this.left.length;
+    for (let i = 0; i < this.left.length; i++) {
+      placements.push({ row: this.row, col: leftStart + i, letter: this.left[i].letter, blank: this.left[i].blank });
+    }
+    for (const p of this.right) placements.push(p);
+    this.emit(placements);
+  }
+}
+
+// runAcross generates all across plays on bd and reports each via emit in bd's
+// coordinates. Cross-sets are computed lazily (vertical words on bd) and cached.
+// Mirrors DAWGGenerator.runAcross.
+function runAcross(
+  dawg: Dawg,
+  bd: GenBoard,
+  rk: GenRack,
+  size: number,
+  rs: Ruleset,
+  centerRow: number,
+  centerCol: number,
+  emit: (placements: Placement[]) => void,
+): void {
+  let crossFn: (r: number, c: number) => LetterSet;
+  if (rs.ignoreCrossWords) {
+    const full = fullSet(size);
+    crossFn = () => full;
+  } else {
+    const cache = new Array<LetterSet | undefined>(bd.rows * bd.cols);
+    crossFn = (r, c) => {
+      const i = r * bd.cols + c;
+      let s = cache[i];
+      if (!s) {
+        const { above, below } = columnContext(bd, r, c);
+        s = dawgCrossSet(dawg, above, below, size);
+        cache[i] = s;
+      }
+      return s;
+    };
+  }
+
+  const ag = new AcrossGen(dawg, bd, rk, crossFn, emit);
+  const firstMove = bd.isEmpty();
+  for (let row = 0; row < bd.rows; row++) {
+    ag.generateRow(row, firstMove, centerRow, centerCol);
+  }
+}
+
+// moveKey is a canonical string identifying a play (direction plus its placed tiles),
+// used to de-duplicate and rank generated moves. Mirrors scrabble.moveKey.
+export function moveKey(dir: Direction, placements: readonly Placement[]): string {
+  const ps = placements.slice().sort((a, b) => (a.row !== b.row ? a.row - b.row : a.col - b.col));
+  let s = String(dir);
+  for (const p of ps) s += `;${p.row},${p.col},${p.letter}${p.blank ? '*' : ''}`;
+  return s;
+}
+
+/**
+ * generateMoves returns every legal play for rack on board in the mode's orientations,
+ * ranked by descending score (ties broken by the canonical move key). It walks the DAWG
+ * with the cursor and scores each play with evaluate(); the alphabet size is taken from
+ * the ruleset's value table. Mirrors (*Solver).GenerateMovesOpts (the ruleset carries
+ * ignoreCrossWords for the single-word rule).
+ */
+export function generateMoves(dawg: Dawg, board: GenBoard, rack: GenRack, rs: Ruleset, mode: Mode = Both): Move[] {
+  const size = rs.values.length;
+  const rk = rack.clone(); // generation mutates the rack in place and restores it
+  const centerRow = Math.floor(rs.center / rs.cols);
+  const centerCol = rs.center % rs.cols;
+
+  const moves: Move[] = [];
+  const seen = new Set<string>();
+  const emit = (dir: Direction, placements: Placement[]): void => {
+    const key = moveKey(dir, placements);
+    if (seen.has(key)) return;
+    const res = evaluate(board, rs, dir, placements);
+    if (res.err || !res.move) return;
+    seen.add(key);
+    moves.push(res.move);
+  };
+
+  if (modeIncludes(mode, Horizontal)) {
+    runAcross(dawg, board, rk, size, rs, centerRow, centerCol, (p) => emit(Horizontal, p));
+  }
+  if (modeIncludes(mode, Vertical)) {
+    const tb = transpose(board);
+    runAcross(dawg, tb, rk, size, rs, centerCol, centerRow, (p) => {
+      const rp = p.map((pl) => ({ row: pl.col, col: pl.row, letter: pl.letter, blank: pl.blank }));
+      emit(Vertical, rp);
+    });
+  }
+
+  const kept = moves.filter((m) => connected(board, rs, m));
+  kept.sort((a, b) => {
+    if (a.score !== b.score) return b.score - a.score;
+    const ka = moveKey(a.dir, a.tiles);
+    const kb = moveKey(b.dir, b.tiles);
+    return ka < kb ? -1 : ka > kb ? 1 : 0;
+  });
+  return kept;
+}

ui/src/lib/dict/testdata/sample_en.words.json

@@ -0,0 +1,122 @@
+{
+  "alphabet": "en",
+  "numAdded": 18,
+  "words": [
+    "a",
+    "an",
+    "and",
+    "ant",
+    "car",
+    "care",
+    "cared",
+    "cares",
+    "cars",
+    "cat",
+    "cats",
+    "do",
+    "doe",
+    "does",
+    "dog",
+    "dogs",
+    "done",
+    "dot"
+  ],
+  "indexes": [
+    [
+      0
+    ],
+    [
+      0,
+      13
+    ],
+    [
+      0,
+      13,
+      3
+    ],
+    [
+      0,
+      13,
+      19
+    ],
+    [
+      2,
+      0,
+      17
+    ],
+    [
+      2,
+      0,
+      17,
+      4
+    ],
+    [
+      2,
+      0,
+      17,
+      4,
+      3
+    ],
+    [
+      2,
+      0,
+      17,
+      4,
+      18
+    ],
+    [
+      2,
+      0,
+      17,
+      18
+    ],
+    [
+      2,
+      0,
+      19
+    ],
+    [
+      2,
+      0,
+      19,
+      18
+    ],
+    [
+      3,
+      14
+    ],
+    [
+      3,
+      14,
+      4
+    ],
+    [
+      3,
+      14,
+      4,
+      18
+    ],
+    [
+      3,
+      14,
+      6
+    ],
+    [
+      3,
+      14,
+      6,
+      18
+    ],
+    [
+      3,
+      14,
+      13,
+      4
+    ],
+    [
+      3,
+      14,
+      19
+    ]
+  ]
+}

ui/src/lib/dict/testdata/sample_ru.words.json

@@ -0,0 +1,38 @@
+{
+  "alphabet": "ru",
+  "numAdded": 6,
+  "words": [
+    "ад",
+    "ар",
+    "оса",
+    "я",
+    "яд",
+    "яр"
+  ],
+  "indexes": [
+    [
+      0,
+      4
+    ],
+    [
+      0,
+      17
+    ],
+    [
+      15,
+      18,
+      0
+    ],
+    [
+      32
+    ],
+    [
+      32,
+      4
+    ],
+    [
+      32,
+      17
+    ]
+  ]
+}

ui/src/lib/dict/validate.ts

@@ -297,8 +297,9 @@ export function validatePlay(
 }
 
 // connected reports whether the play connects to the position (or covers the
-// centre on the first move). Mirrors (*Solver).connected.
-function connected(b: Board, rs: Ruleset, m: Move): boolean {
+// centre on the first move). Mirrors (*Solver).connected. Exported so the move
+// generator can apply the same post-generation connectivity filter.
+export function connected(b: Board, rs: Ruleset, m: Move): boolean {
   if (b.isEmpty()) {
     const cr = Math.floor(rs.center / rs.cols);
     const cc = rs.center % rs.cols;

ui/src/lib/gateway.ts

@@ -39,6 +39,8 @@ if (isMock && typeof window !== 'undefined') {
         joinOpponentSilently(): void;
         adminReply(): void;
         setGameLimit(v: boolean): void;
+        clearEmail(): void;
+        confirmEmailOutOfBand(email: string): void;
       };
     }
   ).__mock = {
@@ -46,5 +48,7 @@ if (isMock && typeof window !== 'undefined') {
     joinOpponentSilently: () => (gateway as MockGateway).joinPendingOpponentSilently(),
     adminReply: () => (gateway as MockGateway).mockAdminReply(),
     setGameLimit: (v: boolean) => (gateway as MockGateway).setGameLimit(v),
+    clearEmail: () => (gateway as MockGateway).mockClearEmail(),
+    confirmEmailOutOfBand: (email: string) => (gateway as MockGateway).mockConfirmEmailOutOfBand(email),
   };
 }

ui/src/lib/i18n/en.ts

@@ -234,6 +234,17 @@ export const en = {
   'landing.tagline': 'Play Scrabble with friends, random opponent or an AI.',
   'landing.playTelegram': 'Play in Telegram',
   'landing.playVK': 'Play on VK',
+  'landing.playWeb': 'Play in your browser',
+  'landing.captionTelegram': 'Telegram',
+  'landing.captionVK': 'VK',
+  'landing.captionWeb': 'Web',
+
+  'install.title': 'Install the app',
+  'install.subtitle': 'Put the app icon on your desktop (home screen) to open the game in one tap.',
+  'install.iosTitle': 'Add to Home Screen',
+  'install.iosStep1': 'Tap the Share button in the browser toolbar.',
+  'install.iosStep2': 'Choose “Add to Home Screen”.',
+  'install.iosStep3': 'Tap “Add”.',
 
   'lang.en': 'English',
   'lang.ru': 'Русский',

ui/src/lib/i18n/ru.ts

@@ -234,6 +234,17 @@ export const ru: Record<MessageKey, string> = {
   'landing.tagline': 'Играй в «Эрудита» с друзьями, случайным соперником или ИИ-роботом.',
   'landing.playTelegram': 'Играть в Telegram',
   'landing.playVK': 'Играть во ВКонтакте',
+  'landing.playWeb': 'Играть в браузере',
+  'landing.captionTelegram': 'Telegram',
+  'landing.captionVK': 'VK',
+  'landing.captionWeb': 'Веб-версия',
+
+  'install.title': 'Установить приложение',
+  'install.subtitle': 'Поместите иконку приложения на рабочий стол (домашний экран), чтобы открывать игру одним нажатием.',
+  'install.iosTitle': 'На экран «Домой»',
+  'install.iosStep1': 'Нажмите кнопку «Поделиться» на панели браузера.',
+  'install.iosStep2': 'Выберите «На экран „Домой“».',
+  'install.iosStep3': 'Нажмите «Добавить».',
 
   'lang.en': 'English',
   'lang.ru': 'Русский',

ui/src/lib/mock/client.ts

@@ -150,7 +150,7 @@ export class MockGateway implements GatewayClient {
   async authGuest(): Promise<Session> {
     return { ...SESSION };
   }
-  async authEmailRequest(_email: string, _language: string): Promise<void> {}
+  async authEmailRequest(_email: string, _language: string, _pwa: boolean): Promise<void> {}
   async confirmEmailLink(_token: string): Promise<ConfirmLinkResult> {
     return { purpose: 'link', status: 'confirmed', session: null };
   }
@@ -659,6 +659,17 @@ export class MockGateway implements GatewayClient {
     this.profile.email = email;
     return emptyLinked();
   }
+  // e2e hooks (window.__mock, see lib/gateway.ts): mockClearEmail drops the seeded email so the
+  // sign-in section offers the add-email flow; mockConfirmEmailOutOfBand attaches the address
+  // WITHOUT a live event — standing in for the one-tap confirm link opened in another browser,
+  // so the open code form must reflect it by polling the profile, not by a push.
+  mockClearEmail(): void {
+    this.profile.email = '';
+    this.emit({ kind: 'notify', sub: 'profile' });
+  }
+  mockConfirmEmailOutOfBand(email: string): void {
+    this.profile.email = email;
+  }
   async linkEmailMerge(email: string, _code: string): Promise<LinkResult> {
     this.profile.isGuest = false;
     this.profile.email = email;

ui/src/lib/model.ts

@@ -169,12 +169,33 @@ export interface Banner {
   timings: BannerTimings;
 }
 
+/** ColorTriple is a banner colour override's three "#rrggbb" colours. */
+export interface ColorTriple {
+  bg: string;
+  fg: string;
+  link: string;
+}
+
+/**
+ * BannerColors is a campaign's optional palette: `all` overrides every theme, `dark`
+ * further overrides the dark theme (either may be null — the neutral tokens then apply).
+ * resolveBannerColors (lib/bannerColors) collapses it to the rendered theme's colours.
+ */
+export interface BannerColors {
+  all: ColorTriple | null;
+  dark: ColorTriple | null;
+}
+
 /** BannerCampaign is one campaign in the rotation feed. */
 export interface BannerCampaign {
   /** GCD-reduced show weight for the client's smooth weighted round-robin. */
   weight: number;
   /** Messages in display order, already resolved to the viewer's bot language. */
   messages: string[];
+  /** Colour override for every theme; null (or absent) keeps the neutral tokens. */
+  overrideAll?: ColorTriple | null;
+  /** Colour override for the dark theme only; null (or absent) falls back to overrideAll/tokens. */
+  overrideDark?: ColorTriple | null;
 }
 
 /** BannerTimings are the global banner display timings (ms, except scrollPxPerSec). */

ui/src/lib/pwa.svelte.ts

@@ -0,0 +1,88 @@
+// Reactive PWA install runtime: captures the Chromium install prompt, tracks the installed
+// state, and registers the install-only service worker. The pure platform branching lives in
+// pwa.ts. Structured after the other reactive lib modules (app.svelte.ts, router.svelte.ts).
+
+import { isIosSafari, isStandalone, resolveInstallMode, type InstallMode } from './pwa';
+import { insideTelegram } from './telegram';
+import { insideVK } from './vk';
+
+/** inMiniApp reports whether the app runs inside a Telegram or VK Mini App webview, where a web
+ *  install makes no sense (the platform manages its own launcher). Kept here, out of the pure
+ *  pwa.ts, so that module stays free of app imports for the node unit tests. */
+function inMiniApp(): boolean {
+  return insideTelegram() || insideVK();
+}
+
+// beforeinstallprompt is a Chromium-only event, absent from the DOM lib types.
+interface BeforeInstallPromptEvent extends Event {
+  readonly userChoice: Promise<{ outcome: 'accepted' | 'dismissed'; platform: string }>;
+  prompt(): Promise<void>;
+}
+declare global {
+  interface WindowEventMap {
+    beforeinstallprompt: BeforeInstallPromptEvent;
+    appinstalled: Event;
+  }
+}
+
+// Not named `state` (a Svelte-check hazard: `$state` would then read as a store subscription).
+const install = $state<{ deferred: BeforeInstallPromptEvent | null; installed: boolean }>({
+  deferred: null,
+  installed: isStandalone(),
+});
+
+/**
+ * installMode is the reactive install-CTA mode for the current platform and any captured prompt.
+ * Read inside a component's markup / $derived so the CTA updates when a Chromium prompt arrives
+ * (beforeinstallprompt fires shortly after load) or the app is installed.
+ */
+export function installMode(): InstallMode {
+  return resolveInstallMode({
+    deferredAvailable: install.deferred !== null,
+    standalone: install.installed,
+    iosSafari: isIosSafari(),
+    inMiniApp: inMiniApp(),
+  });
+}
+
+/**
+ * initInstallListeners wires the Chromium install prompt and the installed event. Harmless on
+ * any platform — the events fire only in an installable browser — so it may run unconditionally
+ * at startup, early enough to catch a prompt that fires before the CTA mounts.
+ */
+export function initInstallListeners(): void {
+  if (typeof window === 'undefined') return;
+  window.addEventListener('beforeinstallprompt', (e) => {
+    // Suppress Chromium's mini-infobar; the app presents its own CTA instead.
+    e.preventDefault();
+    install.deferred = e;
+  });
+  window.addEventListener('appinstalled', () => {
+    install.deferred = null;
+    install.installed = true;
+  });
+}
+
+/**
+ * promptInstall shows the native Chromium install dialog. It MUST be called directly from a user
+ * gesture (the deferred prompt is gesture-gated — no await before it). A deferred prompt is
+ * single-use, so it is cleared here; a no-op when nothing was captured.
+ */
+export async function promptInstall(): Promise<void> {
+  const deferred = install.deferred;
+  if (!deferred) return;
+  install.deferred = null;
+  await deferred.prompt();
+}
+
+/**
+ * registerServiceWorker registers the install-only worker (ui/public/sw.js). Web-only: skipped in
+ * the mock build (a real worker would perturb the Playwright run) and inside a Telegram/VK Mini
+ * App. Best-effort — a failed registration only means the app is not installable.
+ */
+export function registerServiceWorker(): void {
+  if (typeof navigator === 'undefined' || !('serviceWorker' in navigator)) return;
+  if (import.meta.env.MODE === 'mock') return;
+  if (inMiniApp()) return;
+  void navigator.serviceWorker.register('sw.js').catch(() => {});
+}

ui/src/lib/pwa.test.ts

@@ -0,0 +1,96 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { isIosSafari, isStandalone, resolveInstallMode } from './pwa';
+
+describe('resolveInstallMode', () => {
+  const base = { deferredAvailable: false, standalone: false, iosSafari: false, inMiniApp: false };
+
+  it('hides inside a Mini App even with a captured prompt', () => {
+    expect(resolveInstallMode({ ...base, inMiniApp: true, deferredAvailable: true })).toBe('hidden');
+  });
+
+  it('hides once the app is installed (standalone)', () => {
+    expect(resolveInstallMode({ ...base, standalone: true, deferredAvailable: true })).toBe('hidden');
+  });
+
+  it('offers one-tap when a Chromium prompt was captured', () => {
+    expect(resolveInstallMode({ ...base, deferredAvailable: true })).toBe('oneTap');
+  });
+
+  it('offers iOS instructions on iOS Safari without a prompt', () => {
+    expect(resolveInstallMode({ ...base, iosSafari: true })).toBe('iosInstructions');
+  });
+
+  it('prefers one-tap over iOS instructions when both apply', () => {
+    expect(resolveInstallMode({ ...base, deferredAvailable: true, iosSafari: true })).toBe('oneTap');
+  });
+
+  it('hides on an unsupported browser (no prompt, not iOS)', () => {
+    expect(resolveInstallMode(base)).toBe('hidden');
+  });
+});
+
+describe('isStandalone', () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it('is true when the display-mode media query matches', () => {
+    vi.stubGlobal('window', {
+      matchMedia: (q: string) => ({ matches: q.includes('standalone') }),
+      navigator: {},
+    });
+    expect(isStandalone()).toBe(true);
+  });
+
+  it('is true for the iOS navigator.standalone flag', () => {
+    vi.stubGlobal('window', {
+      matchMedia: () => ({ matches: false }),
+      navigator: { standalone: true },
+    });
+    expect(isStandalone()).toBe(true);
+  });
+
+  it('is false in an ordinary browser tab', () => {
+    vi.stubGlobal('window', {
+      matchMedia: () => ({ matches: false }),
+      navigator: { standalone: false },
+    });
+    expect(isStandalone()).toBe(false);
+  });
+});
+
+describe('isIosSafari', () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  const IPHONE_SAFARI =
+    'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1';
+  const IPHONE_CHROME =
+    'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/120.0 Mobile/15E148 Safari/604.1';
+  const ANDROID_CHROME =
+    'Mozilla/5.0 (Linux; Android 13) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Mobile Safari/537.36';
+  const IPAD_SAFARI =
+    'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15';
+
+  it('is true for Safari on iPhone', () => {
+    vi.stubGlobal('navigator', { userAgent: IPHONE_SAFARI, maxTouchPoints: 5 });
+    expect(isIosSafari()).toBe(true);
+  });
+
+  it('is true for Safari on iPadOS (Mac UA + touch points)', () => {
+    vi.stubGlobal('navigator', { userAgent: IPAD_SAFARI, maxTouchPoints: 5 });
+    expect(isIosSafari()).toBe(true);
+  });
+
+  it('is false for a desktop Mac (no touch points)', () => {
+    vi.stubGlobal('navigator', { userAgent: IPAD_SAFARI, maxTouchPoints: 0 });
+    expect(isIosSafari()).toBe(false);
+  });
+
+  it('is false for Chrome on iOS (CriOS)', () => {
+    vi.stubGlobal('navigator', { userAgent: IPHONE_CHROME, maxTouchPoints: 5 });
+    expect(isIosSafari()).toBe(false);
+  });
+
+  it('is false for Android Chrome', () => {
+    vi.stubGlobal('navigator', { userAgent: ANDROID_CHROME, maxTouchPoints: 5 });
+    expect(isIosSafari()).toBe(false);
+  });
+});

ui/src/lib/pwa.ts

@@ -0,0 +1,57 @@
+// Pure PWA install helpers, kept out of the Svelte layer (and free of app imports) so the
+// platform branching is unit-testable in the node test env. The reactive runtime (the captured
+// install prompt, the Mini-App gate, the service-worker registration) lives in pwa.svelte.ts.
+
+/** InstallMode is how the install call-to-action resolves for the current platform. */
+export type InstallMode = 'oneTap' | 'iosInstructions' | 'hidden';
+
+/**
+ * isStandalone reports whether the app is already running as an installed PWA — launched from
+ * the home screen / desktop rather than a browser tab. Both the standard display-mode media
+ * query and the iOS-only navigator.standalone flag are checked. Returns false with no window
+ * (e.g. under the unit tests).
+ */
+export function isStandalone(): boolean {
+  if (typeof window === 'undefined') return false;
+  const displayMode = window.matchMedia?.('(display-mode: standalone)').matches ?? false;
+  const iosStandalone =
+    (window.navigator as Navigator & { standalone?: boolean }).standalone === true;
+  return displayMode || iosStandalone;
+}
+
+/**
+ * isIosSafari reports whether the app runs in Safari on iOS / iPadOS — the only browser there
+ * that can add a site to the home screen, and one with no programmatic install (it never fires
+ * beforeinstallprompt). In-app webviews (Telegram, VK) and the iOS Chrome/Firefox/Edge wrappers
+ * are excluded, as is desktop Safari. Used to switch the CTA to manual Share -> Add-to-Home-Screen
+ * instructions.
+ */
+export function isIosSafari(): boolean {
+  if (typeof navigator === 'undefined') return false;
+  const ua = navigator.userAgent;
+  // iPadOS 13+ reports a Mac UA but exposes touch points — catch that as iOS too.
+  const isIos =
+    /iPhone|iPod|iPad/.test(ua) || (/Macintosh/.test(ua) && (navigator.maxTouchPoints ?? 0) > 1);
+  if (!isIos) return false;
+  // Safari only: the iOS Chrome (CriOS), Firefox (FxiOS), Edge (EdgiOS), Opera (OPiOS) and the
+  // Google-app (GSA) wrappers all carry "Safari" but cannot add to the home screen from our CTA.
+  return /Safari/.test(ua) && !/CriOS|FxiOS|EdgiOS|OPiOS|GSA/.test(ua);
+}
+
+/**
+ * resolveInstallMode chooses how the install CTA should behave from the platform facts:
+ * `deferredAvailable` — a beforeinstallprompt event was captured (Chromium one-tap); `standalone`
+ * — already installed; `iosSafari` — manual instructions apply; `inMiniApp` — running inside a
+ * Telegram/VK Mini App. The CTA is offered only on the plain web and never once installed.
+ */
+export function resolveInstallMode(facts: {
+  deferredAvailable: boolean;
+  standalone: boolean;
+  iosSafari: boolean;
+  inMiniApp: boolean;
+}): InstallMode {
+  if (facts.inMiniApp || facts.standalone) return 'hidden';
+  if (facts.deferredAvailable) return 'oneTap';
+  if (facts.iosSafari) return 'iosInstructions';
+  return 'hidden';
+}

ui/src/lib/robot/strategy.parity.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { mix, playToWin, deviates, decide, DEFAULT_BAND } from './strategy';
+
+// Conformance gate for the ported robot strategy: the client must fold the game seed and
+// choose its action exactly as backend/internal/robot/strategy.go does, so a local vs_ai
+// game plays the same. Golden fixtures come from the in-package emitter
+// (backend/internal/robot/strategyfixture_test.go).
+
+interface MixCase {
+  seed: string;
+  salt: string;
+  nums: number[];
+  value: string;
+}
+interface DecisionCase {
+  seed: string;
+  moveCount: number;
+  myScore: number;
+  oppScore: number;
+  candScores: number[];
+  rackLen: number;
+  bagLen: number;
+  playToWin: boolean;
+  win: boolean;
+  kind: string;
+  index: number;
+}
+interface Fixture {
+  playToWinPercent: number;
+  mix: MixCase[];
+  decisions: DecisionCase[];
+}
+
+const fx = JSON.parse(
+  readFileSync(new URL('./testdata/strategy.json', import.meta.url), 'utf8'),
+) as Fixture;
+
+describe('robot strategy parity vs Go', () => {
+  it('mix folds the seed like Go FNV-1a', () => {
+    for (const c of fx.mix) {
+      expect(mix(BigInt(c.seed), c.salt, ...c.nums), `${c.seed}/${c.salt}/${c.nums}`).toBe(BigInt(c.value));
+    }
+  });
+
+  it('chooses the same action as the Go robot', () => {
+    for (const c of fx.decisions) {
+      const seed = BigInt(c.seed);
+      const cands = c.candScores.map((score, index) => ({ score, index }));
+      const rack = new Array<string>(c.rackLen).fill('a');
+
+      expect(playToWin(seed), `playToWin ${c.seed}`).toBe(c.playToWin);
+
+      // the per-turn intent after the occasional off-strategy deviation
+      let win = playToWin(seed);
+      if (deviates(seed, c.moveCount, c.bagLen)) win = !win;
+      expect(win, `win ${c.seed}/${c.moveCount}/${c.bagLen}`).toBe(c.win);
+
+      const dec = decide(seed, c.moveCount, cands, c.myScore, c.oppScore, rack, c.bagLen, DEFAULT_BAND);
+      expect(dec.kind, `kind ${JSON.stringify(c)}`).toBe(c.kind);
+      if (dec.kind === 'play') {
+        expect(dec.move.index, `index ${JSON.stringify(c)}`).toBe(c.index);
+      } else if (dec.kind === 'exchange') {
+        expect(dec.exchange.length).toBe(c.rackLen);
+      }
+    }
+  });
+});

ui/src/lib/robot/strategy.ts

@@ -0,0 +1,180 @@
+// The offline robot's move choice, ported from backend/internal/robot/strategy.go so a
+// local vs_ai game plays exactly as the server robot does: it picks the candidate whose
+// resulting score margin lands closest to a target band (playing to win ~40% of games and
+// to lose the rest), with an occasional off-strategy "wobble" that fades as the bag empties.
+//
+// Everything derives deterministically from the game's bag seed, folded by FNV-1a (mix),
+// so the choice is reproducible. The 64-bit hash is computed with BigInt to stay bit-exact
+// with Go's uint64 arithmetic; faithfulness is pinned by strategy.parity.test.ts against
+// golden fixtures. Only the move-choice slice of strategy.go is ported — the server's
+// think-time, sleep-window and nudge scheduling are irrelevant to on-device play.
+
+// playToWinPercent is the probability, in percent, that the robot plays to win for a whole
+// game; the rest of the time it plays to lose, so the human wins about 60% of games.
+const playToWinPercent = 40;
+
+// deviateMaxProb is the peak probability of a single off-strategy move, held through the
+// opening and midgame; it tapers linearly to 0 over the last deviateTaperTiles bag tiles.
+const deviateMaxProb = 0.2;
+const deviateTaperTiles = 14;
+
+const FNV_OFFSET = 14695981039346656037n;
+const FNV_PRIME = 1099511628211n;
+const TWO_POW_64 = 1n << 64n;
+const MASK64 = TWO_POW_64 - 1n;
+
+// u64le returns the 8 little-endian bytes of v reduced mod 2^64, matching Go's
+// binary.LittleEndian.PutUint64(uint64(int64(v))) — negatives wrap two's-complement.
+function u64le(v: bigint): number[] {
+  let x = ((v % TWO_POW_64) + TWO_POW_64) % TWO_POW_64;
+  const out: number[] = [];
+  for (let i = 0; i < 8; i++) {
+    out.push(Number(x & 0xffn));
+    x >>= 8n;
+  }
+  return out;
+}
+
+/**
+ * mix folds the game seed and a salt (a label plus optional integers such as the move
+ * index) into a stable 64-bit value, mirroring robot.mix (FNV-1a over the seed's 8 bytes,
+ * the salt bytes, then each number's 8 bytes). seed is the game's bag seed.
+ */
+export function mix(seed: bigint, salt: string, ...nums: number[]): bigint {
+  let h = FNV_OFFSET;
+  const feed = (b: number): void => {
+    h = ((h ^ BigInt(b & 0xff)) * FNV_PRIME) & MASK64;
+  };
+  for (const b of u64le(seed)) feed(b);
+  for (let i = 0; i < salt.length; i++) feed(salt.charCodeAt(i));
+  for (const n of nums) for (const b of u64le(BigInt(n))) feed(b);
+  return h;
+}
+
+/** unitFloat maps a mixed value to a float in [0, 1), mirroring robot.unitFloat. */
+export function unitFloat(v: bigint): number {
+  return Number(v) / Number(TWO_POW_64);
+}
+
+/**
+ * playToWin reports the robot's once-per-game decision to play to win, derived from the
+ * seed so it is fixed for the whole game. Mirrors robot.playToWin.
+ */
+export function playToWin(seed: bigint): boolean {
+  return mix(seed, 'win') % 100n < BigInt(playToWinPercent);
+}
+
+// deviateProb is the probability of a single off-strategy move given the tiles left in the
+// bag: deviateMaxProb through the midgame, tapering to 0 over the last deviateTaperTiles.
+function deviateProb(bagLen: number): number {
+  if (bagLen <= 0) return 0;
+  if (bagLen >= deviateTaperTiles) return deviateMaxProb;
+  return (deviateMaxProb * bagLen) / deviateTaperTiles;
+}
+
+/**
+ * deviates reports whether the robot plays a single move against its per-game intent at
+ * moveCount, given the tiles left in the bag — a deterministic per-turn draw, never firing
+ * once the bag is empty. Mirrors robot.deviates.
+ */
+export function deviates(seed: bigint, moveCount: number, bagLen: number): boolean {
+  const p = deviateProb(bagLen);
+  if (p <= 0) return false;
+  return unitFloat(mix(seed, 'deviate', moveCount)) < p;
+}
+
+/** MarginBand is an inclusive target range for the resulting score margin (own score after
+ *  the move minus the opponent's). */
+export interface MarginBand {
+  lo: number;
+  hi: number;
+}
+
+/** DEFAULT_BAND aims to lead by 1..30 when playing to win (negated when playing to lose),
+ *  matching robot.defaultBand. */
+export const DEFAULT_BAND: MarginBand = { lo: 1, hi: 30 };
+
+/**
+ * Decision is the robot's chosen action: a play (the picked candidate), an exchange of the
+ * listed tiles, or a pass. Generic over the candidate type (needs only a score) and the
+ * rack tile type.
+ */
+export type Decision<C, R> =
+  | { kind: 'play'; move: C }
+  | { kind: 'exchange'; exchange: R[] }
+  | { kind: 'pass' };
+
+// distanceToBand is how far m lies outside [lo, hi], or 0 when inside.
+function distanceToBand(m: number, lo: number, hi: number): number {
+  if (m < lo) return lo - m;
+  if (m > hi) return m - hi;
+  return 0;
+}
+
+/**
+ * selectMove chooses the robot's action from the ranked candidate plays and the current
+ * scores. With at least one legal play it picks the candidate whose resulting margin
+ * (myScore + score - oppScore) is closest to the band (negated when not playing to win),
+ * breaking ties toward the conservative edge (smallest lead when winning, smallest deficit
+ * when losing). With no legal play it exchanges the whole rack when the bag can refill it,
+ * else passes. Mirrors robot.selectMove.
+ */
+export function selectMove<C extends { score: number }, R>(
+  cands: readonly C[],
+  myScore: number,
+  oppScore: number,
+  win: boolean,
+  band: MarginBand,
+  rack: readonly R[],
+  bagLen: number,
+): Decision<C, R> {
+  if (cands.length === 0) {
+    if (rack.length > 0 && bagLen >= rack.length) {
+      return { kind: 'exchange', exchange: [...rack] };
+    }
+    return { kind: 'pass' };
+  }
+
+  let lo = band.lo;
+  let hi = band.hi;
+  if (!win) {
+    lo = -band.hi;
+    hi = -band.lo;
+  }
+
+  const margin = (c: C): number => myScore + c.score - oppScore;
+  let best = 0;
+  let bestDist = Infinity;
+  for (let i = 0; i < cands.length; i++) {
+    const m = margin(cands[i]);
+    const dist = distanceToBand(m, lo, hi);
+    if (dist < bestDist) {
+      best = i;
+      bestDist = dist;
+    } else if (dist === bestDist) {
+      // Conservative tie-break: keep the lead (win) or the deficit (lose) small.
+      if ((win && m < margin(cands[best])) || (!win && m > margin(cands[best]))) best = i;
+    }
+  }
+  return { kind: 'play', move: cands[best] };
+}
+
+/**
+ * decide is the robot's whole per-turn choice: the once-per-game play-to-win intent, flipped
+ * for this move by the occasional deviation, fed to selectMove. Mirrors the decision slice of
+ * robot (*Service).act. seed is the game's bag seed; cands are the ranked legal plays.
+ */
+export function decide<C extends { score: number }, R>(
+  seed: bigint,
+  moveCount: number,
+  cands: readonly C[],
+  myScore: number,
+  oppScore: number,
+  rack: readonly R[],
+  bagLen: number,
+  band: MarginBand = DEFAULT_BAND,
+): Decision<C, R> {
+  let win = playToWin(seed);
+  if (deviates(seed, moveCount, bagLen)) win = !win;
+  return selectMove(cands, myScore, oppScore, win, band, rack, bagLen);
+}

ui/src/lib/transport.ts

@@ -118,8 +118,8 @@ export function createTransport(baseUrl: string): GatewayClient {
     async authGuest(locale) {
       return codec.decodeSession(await exec('auth.guest', codec.encodeGuestLogin(locale ?? '', browserOffset())));
     },
-    async authEmailRequest(email, language) {
-      await exec('auth.email.request', codec.encodeEmailRequest(email, browserOffset(), language));
+    async authEmailRequest(email, language, pwa) {
+      await exec('auth.email.request', codec.encodeEmailRequest(email, browserOffset(), language, pwa));
     },
     async confirmEmailLink(token) {
       return codec.decodeConfirmLinkResult(await exec('auth.email.confirm_link', codec.encodeEmailConfirmLink(token)));

ui/src/main.ts

@@ -1,10 +1,15 @@
 import { mount } from 'svelte';
 import './app.css';
 import App from './App.svelte';
+import { initInstallListeners } from './lib/pwa.svelte';
 
 // Pin the document for the game SPA (see app.css `html.app-shell`) so iOS/WKWebView — notably
 // the Telegram Mini App — cannot rubber-band the whole page on a vertical drag. The standalone
 // landing page (landing.ts) is a normal scrolling document and deliberately omits this class.
 document.documentElement.classList.add('app-shell');
 
+// Capture the PWA install prompt as early as possible — before the install CTA mounts. Harmless
+// where it never fires (Firefox, Safari, the Telegram/VK Mini App webviews).
+initInstallListeners();
+
 export default mount(App, { target: document.getElementById('app')! });

ui/src/screens/Login.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
   import { loginEmail, loginGuest, requestEmailCode } from '../lib/app.svelte';
   import { t } from '../lib/i18n/index.svelte';
+  import InstallApp from '../components/InstallApp.svelte';
 
   let email = $state('');
   let code = $state('');
@@ -55,6 +56,9 @@
       </button>
     {/if}
   </div>
+  <!-- Web-only install call-to-action, under the login card. Renders nothing unless the app is
+       installable here (see components/InstallApp.svelte / lib/pwa). -->
+  <div class="promo"><InstallApp /></div>
 </main>
 
 <style>
@@ -62,8 +66,15 @@
     height: 100%;
     display: grid;
     place-items: center;
+    /* Centre the card + install promo as a group, with a gap between them. */
+    align-content: center;
+    gap: 16px;
     padding: 16px;
   }
+  /* Match the card width so the install CTA lines up under it. */
+  .promo {
+    width: min(94vw, 360px);
+  }
   .card {
     width: min(94vw, 360px);
     background: var(--surface);

ui/src/screens/Profile.svelte

@@ -7,13 +7,15 @@
     confirmDeleteAccount,
     handleError,
     logout,
+    refreshProfile,
     requestDeleteAccount,
     showToast,
   } from '../lib/app.svelte';
   import { GatewayError } from '../lib/client';
   import { connection } from '../lib/connection.svelte';
   import { gateway } from '../lib/gateway';
-  import { loginWidgetAvailable, requestTelegramLogin } from '../lib/telegram';
+  import { insideTelegram, loginWidgetAvailable, requestTelegramLogin } from '../lib/telegram';
+  import { insideVK } from '../lib/vk';
   import { startVKLink, vkWebLinkAvailable } from '../lib/vkid';
   import { t } from '../lib/i18n/index.svelte';
   import {
@@ -58,6 +60,11 @@
   let deletePhrase = $state('');
   const telegramLinkable = loginWidgetAvailable();
   const vkLinkable = vkWebLinkAvailable();
+  // Inside a host Mini App the current platform's own identity must not be managed from the
+  // profile — unlinking the very platform you are signed in through is meaningless — so that
+  // provider's linked-account row is hidden here (the web / native builds still show both).
+  const hostTelegram = insideTelegram();
+  const hostVK = insideVK();
 
   function defaultTz(): string {
     const b = browserOffset();
@@ -106,6 +113,27 @@
   );
   const canUnlink = $derived(linkedCount >= 2);
 
+  // While an add-email confirmation is pending, the address may be confirmed out of band — the
+  // one-tap link in the email confirms in another browser/session. A backgrounded Mini App drops
+  // the single-shot live stream and misses the 'profile' event (there is no replay), so poll the
+  // profile as a fallback until the address lands; the live push still updates it instantly while
+  // the app stays foregrounded. Scoped to the add-email wait (a code sent, no email yet).
+  const awaitingEmailConfirm = $derived(emailSent && !app.profile?.email);
+  $effect(() => {
+    if (!awaitingEmailConfirm) return;
+    const poll = (): void => void refreshProfile();
+    const id = setInterval(poll, 4000);
+    // Re-check the moment the Mini App returns to the foreground, where the missed event landed.
+    const onVisible = (): void => {
+      if (document.visibilityState === 'visible') poll();
+    };
+    document.addEventListener('visibilitychange', onVisible);
+    return () => {
+      clearInterval(id);
+      document.removeEventListener('visibilitychange', onVisible);
+    };
+  });
+
   // toggleVariant flips a variant in the preference set, refusing to remove the last one —
   // the player must allow themselves at least one variant.
   function toggleVariant(id: Variant) {
@@ -392,8 +420,10 @@
     <!-- Sign-in methods: bind/change an email and link/unlink providers. A returning email
          (add) triggers the merge dialog below. On the web an account can add Telegram via the
          login widget or VK via VK ID web login (a full-page redirect); inside a Mini App the
-         host provider is already linked. Email is never unlinked — it is changed. Unlink is
-         offered only when another identity remains (the backend also refuses the last one). -->
+         host provider is already linked, so its own row is hidden — the platform you are signed
+         in through cannot be unlinked from here (the other provider's row still shows). Email is
+         never unlinked — it is changed. Unlink is offered only when another identity remains
+         (the backend also refuses the last one). -->
     <section class="accounts">
       <h3>{t('profile.accountsTitle')}</h3>
 
@@ -440,7 +470,7 @@
         </div>
       {/if}
 
-      {#if p.telegramLinked}
+      {#if p.telegramLinked && !hostTelegram}
         <div class="acctrow">
           <span class="prov"><img src="telegram-logo.svg" alt="" width="18" height="18" />Telegram</span>
           {#if canUnlink}
@@ -453,7 +483,7 @@
         </button>
       {/if}
 
-      {#if p.vkLinked}
+      {#if p.vkLinked && !hostVK}
         <div class="acctrow">
           <span class="prov"><img src="vk-logo.svg" alt="" width="18" height="18" />VK</span>
           {#if canUnlink}

ui/src/screens/Settings.svelte

@@ -10,6 +10,7 @@
   import type { ThemePref } from '../lib/theme';
   import type { BoardLabelMode } from '../lib/boardlabels';
   import { insideTelegram } from '../lib/telegram';
+  import InstallApp from '../components/InstallApp.svelte';
 
   const themes: ThemePref[] = ['auto', 'light', 'dark'];
   const themeLabel: Record<ThemePref, MessageKey> = {
@@ -73,6 +74,10 @@
       />
     </label>
   </section>
+
+  <!-- Web-only install call-to-action at the bottom of Settings (renders nothing unless the app
+       is installable here — see components/InstallApp.svelte / lib/pwa). -->
+  <InstallApp />
 </div>
 
 <style>