chore: drop the game.over label, show only the result

revert: game-over phrases
fix: game.new button e2e test bundle
2026-06-17 22:58:17 +02:00 · 2026-06-17 22:54:28 +02:00 · 2026-06-17 21:54:22 +02:00 · 2026-06-17 21:34:37 +02:00 · 2026-06-17 20:45:23 +02:00 · 2026-06-17 19:18:27 +02:00
509 changed files with 6766 additions and 40233 deletions
@@ -1,89 +0,0 @@
---
-name: deploy-check
-description: "Use before any deploy-touching change to this repo — phrases like '/deploy-check', 'is this prod-safe', 'before we deploy', 'deploy safety review', 'проверь перед деплоем', 'это безопасно для прода'. Runs a pre-deploy checklist of this project's hard-won runtime constraints against the current diff, so the crash classes that have bitten live environments get caught before shipping instead of after."
---
-
-# Pre-deploy runtime-constraint check
-
-Triggered before shipping anything that touches the deploy contour (Dockerfiles,
-`deploy/`, Caddyfile, compose, migrations, boot guards, the Telegram side-service,
-edge config). The worst frictions in this repo were never logic bugs — they were
-**environment mismatches that crashed a live env and forced a redesign**. Run this
-list against the diff first; turn crash-and-redesign into a single pass.
-
-This checklist is a prompt, **not** the source of truth. The canonical detail
-lives in `deploy/README.md`, `docs/ARCHITECTURE.md`, `docs/EDGE_HTTP3.md`, and the
-agent memory files referenced below — read them when an item is in play, and add a
-new class here when a new incident teaches one.
-
-## How to run it
-
-1. `git diff <base>...HEAD --stat` to see what the change actually touches.
-2. For every risk class below that the diff touches, perform the **Check** and
-   report PASS / FAIL with the exact file:line to fix. Skip classes the diff does
-   not touch — say which you skipped and why.
-3. Remember: **deploy-job green ≠ healthy**. CI's deploy probe has historically
-   passed with a dead backend (it only checked static landing+gateway). Verify the
-   real feature live (`/readyz`, the actual flow) after deploy, not just the green.
-
-## Risk classes
-
-### 1. Container user — distroless nonroot UID 65532
- **Bit us:** TLS keys `chmod 600` for the host owner crash-looped gateway + bot at
-  boot with "permission denied" — service images run UID 65532.
- **Check:** any new/changed mounted secret, key, or config file must be readable by
-  UID 65532 (`0644`, not `0600`). Scan the diff for file modes, `chmod`, and new
-  volume mounts. (memory: `distroless-nonroot-mounted-secrets`)
-
-### 2. Caddy header pipeline ordering
- **Bit us:** `header_up delete` after `set` nulled the value (the honeypot tag went
-  empty); it passed CI and only showed up live.
- **Check:** in any Caddyfile change, verify the `set` / `delete` / `header_up`
-  ordering for every affected route, and test the tripwire/route on the live
-  contour, not just CI.
-
-### 3. Edge Alt-Svc / HTTP3
- **Bit us:** edge advertised `Alt-Svc: h3` while UDP/443 was never exposed
-  (docker tcp-only + ufw tcp-only); clients cached it 30 days and stalled on dead
-  QUIC before falling back to h2 — Mini App "hangs on load".
- **Check:** any edge/caddy change keeps `Alt-Svc: clear` (or only advertises h3 if
-  UDP/443 is genuinely exposed). (memory: `tg-app-load-stall-dead-http3-altsvc`,
-  `docs/EDGE_HTTP3.md`)
-
-### 4. Prod caddy config recreate
- **Bit us:** prod rolling deploy did **not** recreate caddy on a config-only change
-  (pinned `caddy:2-alpine` + `admin off`), so a new Caddyfile deployed GREEN but
-  stayed inert until a manual `docker restart`.
- **Check:** a config-only edge change must `--force-recreate` caddy in
-  `prod-deploy.sh` `roll()`; never trust deploy-green for edge config.
-  (memory: `prod-deploy-caddy-config-recreate`)
-
-### 5. DICT_VERSION / dictionary boot
- **Bit us:** an early `DICT_VERSION` refuse-boot guard was wrong and crashed the
-  live env when bumped on a seeded volume; it had to be redesigned to "marker-wins".
- **Check:** any change touching `DICT_VERSION`, dict load, or the boot guard must
-  keep marker-wins semantics and survive a seeded volume **and** an image rollback.
-  `DICT_VERSION` is a required build-arg (no default), single-sourced. A new dict
-  goes live via the admin console upload, not a redeploy. (memory:
-  `dict-version-deploy-verify`, `contour-schema-change-wipe`)
-
-### 6. Migrations — expand-contract + rollback safety
- **Bit us / risk:** a non-backward-compatible migration breaks image rollback (DB
-  ahead of rolled-back code).
- **Check:** migrations must be **expand-contract** (backward-compatible). A schema
-  change adds the maintenance window + a consistent `pg_dump` in prod-deploy. On the
-  **test contour**, a schema/wire-label change needs `DROP SCHEMA backend CASCADE` +
-  backend restart (new code vs old persisted DB), else the contour breaks. (memory:
-  `contour-schema-change-wipe`)
-
-### 7. Telegram permission model
- **Bit us:** permissions are an **AND-intersection** — default-allow with explicit
-  denies, not default-deny; inverting it broke access.
- **Check:** any change to the Telegram permission / relay logic preserves the
-  AND-intersection default-allow shape. (memory: `telegram-forum-relay-gotchas`)
-
-## Output
-
-A short PASS/FAIL table over the classes the diff touches, each FAIL with the exact
-file:line and the fix. If every touched class passes, say so plainly and name the
-post-deploy live check to run (not just "CI green").
@@ -1,175 +0,0 @@
-# VK Mini App / VK Games — integration reference
-
-Captured research + our implementation map, so a future session does not need to re-fetch
-the VK docs. Authoritative external source: <https://dev.vk.com/> (the `dev.vk.com` portal
-does not render via plain HTTP fetch; the facts below were cross-checked against the VKCOM
-reference repos cited at the end and verified against our own Go implementation).
-
-A VK **game** is technically a **VK Mini App**: an HTML5 SPA VK loads in an **iframe inside
-vk.com** (desktop + mobile web) and in a **WebView** inside the VK mobile apps (iOS/Android).
-We serve our existing SPA under a dedicated `/vk/` path, mirroring the Telegram `/telegram/`
-entry — the single-origin, path-routed model.
-
-## 1. Embedding model
-
- VK loads the app at the **Web iframe URL** configured in the app settings (HTTPS + valid
-  cert required), appending the signed launch parameters as the **URL query string**.
- An optional separate **Mobile iframe URL** is used by the VK mobile apps (we use the same).
- No special `X-Frame-Options` / CSP `frame-ancestors` is required from us — VK frames the
-  configured origin. (Our edge sets **no** framing headers today, so VK works as-is; see the
-  clickjacking note in §Security.)
- URL must match the settings exactly (scheme, host, no stray `www`/whitespace).
-
-## 2. Launch parameters (URL query)
-
-VK appends these to the iframe `src`. The `vk_*` set is what the signature covers.
-
-| Param | Meaning |
-| --- | --- |
-| `vk_user_id` | signed-in VK user numeric id — **the identity** |
-| `vk_app_id` | our registered app id |
-| `vk_is_app_user` | 0/1 — user authorized/installed the app |
-| `vk_are_notifications_enabled` | 0/1 |
-| `vk_language` | 2-letter UI language (`ru`, `en`, …) |
-| `vk_platform` | `mobile_iphone` \| `mobile_android` \| `mobile_web` \| `desktop_web` \| … |
-| `vk_ts` | unix seconds when VK generated the params |
-| `vk_ref` | where the app was opened from (`catalog`, `feed`, …) |
-| `vk_access_token_settings` | comma-separated granted scopes (often empty) |
-| `vk_group_id`, `vk_viewer_group_role`, `vk_is_favorite`, `vk_client` | optional/contextual |
-| `sign` | **the signature** (see §3) — NOT part of the signed set |
-
-Always present: `vk_user_id`, `vk_app_id`, `vk_platform`, `vk_ts`, `sign`.
-
-The user's **name is NOT in the launch params** (only `vk_user_id`). Read it client-side via
-`VKWebAppGetUserInfo` (see §4) — unsigned, so treat it as a cosmetic display seed only.
-
-## 3. Signature verification (`sign`)  — CONFIRMED base64url, not hex
-
-Algorithm (verified against our `gateway/internal/vkauth` + an independent Python reference):
-
-1. Collect the query params whose key starts with `vk_` (exclude `sign`).
-2. Sort by key (alphabetical).
-3. Serialize as a URL-encoded query string `k=v&k=v…` (Go `url.Values.Encode()` matches VK's
-   reference serialization for the constrained launch-param charset).
-4. `HMAC-SHA256(serialized, secret)` where `secret` = the app's **«Защищённый ключ»**
-   (protected / secure key, a.k.a. client_secret) from the app settings.
-5. **base64url, no padding** (`+`→`-`, `/`→`_`, strip `=`).
-6. Constant-time compare against `sign`.
-
-VK launch params have **no built-in expiry** (unlike Telegram's `auth_date`). We do NOT enforce
-freshness — the minted server session is the short-lived credential; a replay only
-re-authenticates the same `vk_user_id`.
-
-Verified against the official doc <https://dev.vk.com/ru/mini-apps/development/launch-params-sign>
-(prose + PHP example: base64url = `strtr('+/','-_')` + `rtrim('=')`) and reproduced identically by
-independent Node `crypto` + Python references. **Doc-example caveat**: that page shows secret
-`wvl68m4dR1UpLrVRli` → sign `exTIBP…`, but the secret is a **placeholder** — recomputing with it does
-NOT yield the shown sign (it was made with the real, unshown key). Don't chase the mismatch; our
-`vkauth.Verify` is correct (`gateway/internal/vkauth/vkauth_test.go` carries cross-checked vectors,
-incl. the `%2C` comma case for `vk_access_token_settings`).
-
-## 4. VK Bridge (client SDK)
-
-`@vkontakte/vk-bridge` (npm, v3.x; bundled — `default` export `bridge`). Methods we use / may use:
-
- `VKWebAppInit` — **required**: tells VK the Mini App loaded (dismisses VK's loading cover).
- `VKWebAppGetUserInfo` — `{ id, first_name, last_name, photo_200, … }`; no extra scope needed.
- `VKWebAppGetLaunchParams` — parsed `vk_*` **without** `sign` (so NOT usable for our server
-  verification — read `window.location.search` instead, which carries `sign`).
- `VKWebAppGetAuthToken` — OAuth access token for VK API calls (only if we ever call VK API).
- `VKWebAppShare` — native share dialog (the friend-code invite uses it; `navigator.share` is absent
-  in the desktop VK iframe). **Used.**
- `VKWebAppCopyText` — clipboard copy that works inside the VK iframe, where `navigator.clipboard` is
-  blocked. **Used** as the copy-code / copy-link path.
- `VKWebAppUpdateConfig` (subscribe) — light/dark scheme; the app follows it while the theme pref is
-  "auto" (the VK webview's prefers-color-scheme does not track it). **Used.**
- `VKWebAppSetViewSettings` / `VKWebAppSetSwipeSettings` — viewport / swipe-back (mobile); not used.
- `VKWebAppUpdateInsets` (+ `VKWebAppUpdateConfig`) — device safe-area insets; the app **max'es** them
-  with CSS `env(safe-area-inset-*)` (viewport-fit=cover) so the bottom home bar is cleared. The bridge
-  value is needed on Android, where the VK webview exposes no `env()` inset. **Used.**
-
-The bridge talks to the embedding VK client over postMessage; it is NOT an external fetch, so
-it has no telegram.org-style load-hang risk. The SDK reads browser globals at import — we import
-it **lazily** so the pure URL helpers stay node-test-importable.
-
-**Deep links — NOT possible on VK (confirmed on the contour).** The VK iframe receives ONLY the signed
-`vk_*` launch params (+ `sign`); VK strips any custom data from the app link. The documented
-`vk.com/app<id>#<payload>` form is eaten by the vk.com SPA (which owns the URL hash), and a
-`vk.com/app<id>?hash=<payload>` query is dropped (the diagnostic showed `rawSearch` with only `vk_*`
-and an empty `hash`). So the friend-code invite link is just `vk.com/app<id>` (`vkShareLink`, app id
-from `vk_app_id`); the recipient enters the **copied code by hand** (`VKWebAppCopyText` works). The
-`vkStartParam` reader + the `bootVK` routing stay as a no-op today, ready if a post-moderation VK
-channel (e.g. an invite API) ever delivers a payload.
-
-## 5. Test mode (to verify before moderation)
-
-1. App already registered (we have the App ID).
-2. In the app settings (dev.vk.com / `vk.com/editapp?act=settings&app_id=<id>`):
-   - Category = **Игра** (Game).
-   - **Web iframe URL** = our public HTTPS `/vk/` (the test-contour origin for contour testing,
-     prod `https://erudit-game.ru/vk/` later). Mobile iframe URL = same.
-   - Copy the **«Защищённый ключ»** → set as `GATEWAY_VK_APP_SECRET` (Gitea `TEST_`/`PROD_` secret).
-   - Add own VK id to **testers**; open in test mode.
-3. Test mode = visible only to admins/testers, no payments processed.
-
-## 6. Auth / identity (our model)
-
- `vk_user_id` (from verified params) → backend identity `kind='vk'`, `external_id=vk_user_id`,
-  auto-confirmed (a platform identity). First contact seeds language from `vk_language` and the
-  display name from the client-supplied `VKWebAppGetUserInfo` name (placeholder if empty).
- No VK access token / VK API call needed for the launch+login MVP.
-
-## 7. Payments / monetization
-
-VK Pay / «голоса» (votes) are **optional**, not required to publish a free game. Not planned.
-
-## 8. ToS / moderation (pre-publish, analyzed — no blocker for a free «Эрудит»)
-
- **Trademark**: "Scrabble" is trademarked. Our public brand is **«Эрудит»** (erudit-game.ru),
-  a generic Russian word-game name → fine. Ensure the VK-registered app name is «Эрудит»/word-game,
-  NOT "Scrabble". The repo name is internal and irrelevant to moderation.
- **Pre-publish requirements**: public **Privacy Policy** + **ToS** URLs (disclose collected data:
-  `vk_user_id`, language; mention VK), **age rating** (likely 6+/12+), icon, description.
- **Dictionary**: standard word lists; VK may expect offensive-word filtering — likely fine for a
-  dictionary game, flag if moderation asks.
- **In-game chat (UGC)**: we already have a moderated chat + support relay → covered.
- Moderation reviews after submission (commonly ~24–72h); rejects on violence/hate/sexual/illegal
-  content or IP infringement — none apply.
-
-## 9. Platforms
-
-Desktop web (iframe), mobile web (iframe), VK iOS app (WKWebView), VK Android app (WebView). Bridge
-methods behave per-platform; the app's own back chevron + app-shell document-pin cover navigation
-without VK-specific code. Theme/viewport fine-tuning is best verified live in the real VK client
-(not reproducible in Playwright — like the iOS gesture caveats).
-
-## 10. Our implementation map (what to touch for VK)
-
- **Wire**: `pkg/fbs/scrabble.fbs` → `VKLoginRequest{ params, browser_tz, display_name }`
-  (regen: `make -C pkg fbs` + `pnpm -C ui codegen`).
- **Gateway**: `internal/vkauth/` (the §3 verify), `internal/transcode` op `auth.vk`
-  (registered via `WithVKAuth(secret)` option; `DomainCode` → `invalid_vk_params`),
-  `internal/backendclient` `VKAuth` → `POST /api/v1/internal/sessions/vk`,
-  config `GATEWAY_VK_APP_SECRET`, SPA mount `/vk/` in `internal/connectsrv/server.go`.
- **Backend**: `internal/account` `KindVK` + `ProvisionVK`/`vkSeed` + `confirmed` for platform
-  kinds; `internal/server/handlers_auth.go` `handleVKAuth` + route; migration
-  `00005_vk_identity.sql` (widen `identities_kind_chk` to include `'vk'`, expand-contract).
- **UI**: `src/lib/vk.ts` (`onVKPath`/`vkLaunchParams`/`insideVK`/`vkInit`/`vkUserName` plus `vkAppId`/
-  `vkStartParam`/`vkShare`/`vkCopyText`/`vkOnScheme`), `app.svelte.ts` `bootVK` (+ deep-link routing
-  and VK scheme→theme) + the `/vk/` dispatch branch + shared `retryMiniAppBoot`, `codec.ts`
-  `encodeVKLogin`, `transport.ts`/`client.ts`/`mock/client.ts` `authVK`, `deeplink.ts` `vkShareLink`,
-  `Friends.svelte` (VK share/copy), `app.css` `--tg-safe-*` defaulting to `env(safe-area-inset-*)`.
- **Edge/deploy**: `deploy/caddy/Caddyfile` `/vk` path; `GATEWAY_VK_APP_SECRET` in
-  `docker-compose.yml` + `.env.example` + `ci.yaml` (`TEST_…` secret) + `prod-deploy.yaml`
-  (`PROD_…` secret, deploy-main).
- **Deferred**: payments (VK Pay / votes), native (Capacitor) VK, account-linking a vk identity to an
-  existing account, VK push. (Done after the launch+auth MVP — Group B: native share + clipboard via
-  the bridge, the friend-code deep link, the auto-theme follow, and the home-bar safe area.)
-
-## Sources
-
- VKCOM/vk-bridge — <https://github.com/VKCOM/vk-bridge>
- VKCOM/vk-apps-launch-params (canonical signature examples) — <https://github.com/VKCOM/vk-apps-launch-params>
- kravetsone/vk-launch-params — <https://github.com/kravetsone/vk-launch-params>
- SevereCloud/vksdk `vkapps.ParamsVerify` (Go reference) — <https://pkg.go.dev/github.com/SevereCloud/vksdk/v2/vkapps>
- VK Mini Apps API — <https://github.com/VKCOM/vk-mini-apps-api>
@@ -26,13 +26,6 @@ on:
  push:
    branches: [development]

-# The dictionary release. One Gitea variable is the single source of truth: the
-# test suite validates against it here (inherited by the unit/integration jobs) and
-# both contours' deploy jobs seed a fresh volume with the same value. A release bump
-# is one edit (the variable). See deploy/README.md.
-env:
-  DICT_VERSION: ${{ vars.DICT_VERSION }}
-
 jobs:
  # changes detects which areas a PR/push touched, so the test jobs can skip when
  # irrelevant. It defaults to running everything when the diff cannot be computed.
@@ -73,9 +66,6 @@ jobs:
            go=false; ui=false
            if echo "$files" | grep -qE '^(backend/|pkg/|gateway/|platform/|loadtest/|go\.work)'; then go=true; fi
            if echo "$files" | grep -qE '^ui/'; then ui=true; fi
-            # The render sidecar bundles ui/src/lib, so its dir rides the ui lane (the
-            # deploy's compose build picks it up either way).
-            if echo "$files" | grep -qE '^renderer/'; then ui=true; fi
            # A workflow or deploy change re-runs everything as a safety net.
            if echo "$files" | grep -qE '^(\.gitea/workflows/|deploy/)'; then go=true; ui=true; fi
          else
@@ -96,6 +86,7 @@ jobs:
      # The engine consumes the published scrabble-solver module from this Gitea;
      # GOPRIVATE makes go fetch it directly (skipping the public proxy/checksum DB).
      GOPRIVATE: gitea.iliadenisov.ru/*
+      DICT_VERSION: v1.0.0
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -143,6 +134,7 @@ jobs:
      # suite's TestMain terminates its own container, so disable it.
      TESTCONTAINERS_RYUK_DISABLED: "true"
      GOPRIVATE: gitea.iliadenisov.ru/*
+      DICT_VERSION: v1.0.0
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -202,14 +194,6 @@ jobs:
      - name: Bundle-size budget
        run: node scripts/bundle-size.mjs

-      # The render sidecar executes the shared ui/src/lib/gameimage.ts on skia-canvas;
-      # its smoke test guards the bundling + skia seam (docs/TESTING.md).
-      - name: Render sidecar test
-        working-directory: renderer
-        run: |
-          pnpm install --frozen-lockfile
-          pnpm test
-
      - name: Install Playwright browsers
        run: pnpm exec playwright install chromium webkit
        timeout-minutes: 5
@@ -218,66 +202,11 @@ jobs:
        run: pnpm run test:e2e
        timeout-minutes: 5

-  # conformance proves the client's local move preview (the ported dawg reader +
-  # validator, ui/src/lib/dict) byte-for-byte against the authoritative Go engine:
-  # a Go step generates golden parity vectors from the release dictionaries, then the
-  # gated Vitest suite replays them. It spans both toolchains, so it runs whenever the
-  # Go engine side or the UI side changed.
-  conformance:
-    needs: changes
-    if: ${{ needs.changes.outputs.go == 'true' || needs.changes.outputs.ui == 'true' }}
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    env:
-      GOPRIVATE: gitea.iliadenisov.ru/*
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Fetch dictionary DAWGs
-        run: |
-          mkdir -p "${GITHUB_WORKSPACE}/dawg"
-          curl -fsSL -o /tmp/dawg.tar.gz "https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/${DICT_VERSION}/scrabble-dawg-${DICT_VERSION}.tar.gz"
-          tar xzf /tmp/dawg.tar.gz -C "${GITHUB_WORKSPACE}/dawg"
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.work
-          cache: true
-
-      - name: Generate golden parity vectors
-        run: |
-          go run ./backend/cmd/dictgen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out /tmp/dictgold
-          go run ./backend/cmd/validategen -dawg-dir "${GITHUB_WORKSPACE}/dawg" -out /tmp/validgold
-
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Install pnpm
-        run: npm install -g pnpm@11.0.9
-
-      - name: Install deps
-        working-directory: ui
-        run: pnpm install --frozen-lockfile
-
-      - name: Local-eval conformance (reader + validator vs the Go engine)
-        working-directory: ui
-        env:
-          DICT_DAWG_DIR: ${{ github.workspace }}/dawg
-          DICT_GOLD_DIR: /tmp/dictgold
-          DICT_VALID_DIR: /tmp/validgold
-        run: pnpm exec vitest run src/lib/dict/
-
  # gate is the single branch-protection required check. It always runs and passes
  # only when each upstream job succeeded or was skipped (a path-filtered no-op),
  # failing the merge if any actually failed or was cancelled.
  gate:
-    needs: [unit, integration, ui, conformance]
+    needs: [unit, integration, ui]
    if: always()
    runs-on: ubuntu-latest
    defaults:
@@ -287,7 +216,7 @@ jobs:
      - name: Aggregate required checks
        run: |
          fail=
-          for r in "unit:${{ needs.unit.result }}" "integration:${{ needs.integration.result }}" "ui:${{ needs.ui.result }}" "conformance:${{ needs.conformance.result }}"; do
+          for r in "unit:${{ needs.unit.result }}" "integration:${{ needs.integration.result }}" "ui:${{ needs.ui.result }}"; do
            name="${r%%:*}"; res="${r#*:}"
            echo "$name = $res"
            case "$res" in
@@ -325,68 +254,29 @@ jobs:
          AWG_CONF: ${{ secrets.TEST_AWG_CONF }}
          GM_BASICAUTH_HASH: ${{ secrets.TEST_GM_BASICAUTH_HASH }}
          GRAFANA_ADMIN_PASSWORD: ${{ secrets.TEST_GRAFANA_ADMIN_PASSWORD }}
-          TELEGRAM_BOT_TOKEN: ${{ secrets.TEST_TELEGRAM_BOT_TOKEN }}
-          TELEGRAM_PROMO_BOT_TOKEN: ${{ secrets.TEST_TELEGRAM_PROMO_BOT_TOKEN }}
-          # VK Mini App protected key (offline HMAC for the launch-param signature); empty
-          # leaves the VK auth path (auth.vk) disabled until the operator sets the secret.
-          # One VK Mini App serves every contour -> unprefixed secret.
-          GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
-          # VK ID web login (browser VK-identity linking): the VK ID "Web" app's protected key
-          # for the server-side confidential code exchange — a SEPARATE VK app from the Mini
-          # App above. One VK ID "Web" app serves every contour -> unprefixed secret.
-          GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
-          # Planted honeytoken bearer: presenting it flags the caller (logs + a ban metric on
-          # test where the IP ban is off; a 24h IP ban on prod). Per-contour secret; empty = trap off.
-          GATEWAY_HONEYTOKEN: ${{ secrets.TEST_GATEWAY_HONEYTOKEN }}
-          # Signs the finished-game export download URLs (backend + compose interpolation).
-          EXPORT_SIGN_KEY: ${{ secrets.TEST_EXPORT_SIGN_KEY }}
-          # Transactional email via the shared Selectel relay: one account for every
-          # contour -> unprefixed host/port/tls/user/pass. Empty host leaves the backend
-          # on the log mailer (email disabled) but the contour still boots.
-          SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
-          SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
-          SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
-          SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
-          SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
-          SMTP_RELAY_FROM: ${{ vars.TEST_SMTP_RELAY_FROM }}
-          # Operator alerts: backend admin emails (new feedback / complaints) + Grafana
-          # infra alerts. Distinct senders + recipients; Grafana uses the relay's STARTTLS
-          # host:port. Empty leaves the alert worker off and Grafana SMTP disabled.
-          SMTP_RELAY_ADMIN_FROM: ${{ vars.TEST_SMTP_RELAY_ADMIN_FROM }}
-          ADMIN_EMAIL: ${{ vars.TEST_ADMIN_EMAIL }}
-          SMTP_RELAY_SERVICE_FROM: ${{ vars.TEST_SMTP_RELAY_SERVICE_FROM }}
-          SERVICE_EMAIL: ${{ vars.TEST_SERVICE_EMAIL }}
-          GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
-          GF_SMTP_ENABLED: ${{ vars.TEST_GF_SMTP_ENABLED }}
-          # Canonical public origin for links in the email (this contour's URL);
-          # required by the backend whenever SMTP_RELAY_HOST is set.
-          PUBLIC_BASE_URL: ${{ vars.TEST_PUBLIC_BASE_URL }}
+          TELEGRAM_BOT_TOKEN_EN: ${{ secrets.TEST_TELEGRAM_BOT_TOKEN_EN }}
+          TELEGRAM_BOT_TOKEN_RU: ${{ secrets.TEST_TELEGRAM_BOT_TOKEN_RU }}
          GM_BASICAUTH_USER: ${{ vars.TEST_GM_BASICAUTH_USER }}
+          GRAFANA_ROOT_URL: ${{ vars.TEST_GRAFANA_ROOT_URL }}
          CADDY_SITE_ADDRESS: ${{ vars.TEST_CADDY_SITE_ADDRESS }}
-          # TELEGRAM_MINIAPP_URL, GRAFANA_ROOT_URL and VITE_VK_ID_REDIRECT_URL are derived
-          # from PUBLIC_BASE_URL in the run step below, not stored as their own variables.
-          TELEGRAM_GAME_CHANNEL_ID: ${{ vars.TEST_TELEGRAM_GAME_CHANNEL_ID }}
-          TELEGRAM_CHAT_ID: ${{ vars.TEST_TELEGRAM_CHAT_ID }}
-          TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.TEST_TELEGRAM_SUPPORT_CHAT_ID }}
-          TELEGRAM_BOT_USERNAME: ${{ vars.TEST_TELEGRAM_BOT_USERNAME }}
-          # The promo button reuses the UI's Mini App link variable.
-          TELEGRAM_BOT_LINK: ${{ vars.TEST_VITE_TELEGRAM_LINK }}
+          TELEGRAM_MINIAPP_URL: ${{ vars.TEST_TELEGRAM_MINIAPP_URL }}
+          TELEGRAM_GAME_CHANNEL_ID_EN: ${{ vars.TEST_TELEGRAM_GAME_CHANNEL_ID_EN }}
+          TELEGRAM_GAME_CHANNEL_ID_RU: ${{ vars.TEST_TELEGRAM_GAME_CHANNEL_ID_RU }}
          # The test contour always uses Telegram's test environment — pinned here,
          # not an operator variable. The prod workflow leaves it false.
          TELEGRAM_TEST_ENV: "true"
          VITE_TELEGRAM_BOT_ID: ${{ vars.TEST_VITE_TELEGRAM_BOT_ID }}
          VITE_TELEGRAM_LINK: ${{ vars.TEST_VITE_TELEGRAM_LINK }}
-          VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.TEST_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
-          # VK Mini App landing link + VK ID "Web" app id: one value each serves every
-          # contour -> unprefixed. VITE_VK_APP_ID also feeds the gateway (GATEWAY_VK_ID_APP_ID);
-          # the VK ID redirect URL is derived from PUBLIC_BASE_URL in the run step below.
-          VITE_VK_APP_LINK: ${{ vars.VITE_VK_APP_LINK }}
-          VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-          # VITE_GATEWAY_URL omitted: the SPA is served same-origin, so it stays the
-          # compose ":-" empty default. Other unset vars likewise fall to their defaults.
+          VITE_TELEGRAM_LINK_EN: ${{ vars.TEST_VITE_TELEGRAM_LINK_EN }}
+          VITE_TELEGRAM_LINK_RU: ${{ vars.TEST_VITE_TELEGRAM_LINK_RU }}
+          VITE_TELEGRAM_GAME_CHANNEL_NAME_EN: ${{ vars.TEST_VITE_TELEGRAM_GAME_CHANNEL_NAME_EN }}
+          VITE_TELEGRAM_GAME_CHANNEL_NAME_RU: ${{ vars.TEST_VITE_TELEGRAM_GAME_CHANNEL_NAME_RU }}
+          VITE_GATEWAY_URL: ${{ vars.TEST_VITE_GATEWAY_URL }}
+          GATEWAY_DEFAULT_SUPPORTED_LANGUAGES: ${{ vars.TEST_GATEWAY_DEFAULT_SUPPORTED_LANGUAGES }}
+          # Unset vars render empty -> the compose ":-" defaults apply.
          POSTGRES_DB: ${{ vars.TEST_POSTGRES_DB }}
          POSTGRES_USER: ${{ vars.TEST_POSTGRES_USER }}
-          DICT_VERSION: ${{ vars.DICT_VERSION }}
+          DICT_VERSION: ${{ vars.TEST_DICT_VERSION }}
          LOG_LEVEL: ${{ vars.TEST_LOG_LEVEL }}
        run: |
          # Seed the config files to a stable host path. The runner checks out into
@@ -397,138 +287,64 @@ jobs:
          conf="$HOME/.scrabble-deploy"
          rm -rf "$conf"
          mkdir -p "$conf"
-          cp -r caddy otelcol prometheus tempo grafana blackbox "$conf"/
+          cp -r caddy otelcol prometheus tempo grafana "$conf"/
          export SCRABBLE_CONFIG_DIR="$conf"
-          # Maintenance page for the redeploy window, mirroring prod-deploy.sh so the SPA
-          # overlay is exercised on the test contour too (not only prod). Raised just before
-          # the recreate and lowered once caddy is back (below); the trap clears it if the
-          # step fails so the contour never sticks in maintenance (and the reseed above wipes a
-          # stale flag anyway). The caddy-routed probes run in the NEXT step, after it is lowered.
-          maint_flag="$conf/caddy/on"
-          trap 'rm -f "$maint_flag"' EXIT
-          # Derive the public URLs from the one canonical origin instead of storing each as
-          # its own variable (paths are structural SPA routes / the Caddy /_gm sub-path).
-          # Exported before build so the VK ID redirect is baked into the SPA.
-          base="${PUBLIC_BASE_URL%/}"
-          export TELEGRAM_MINIAPP_URL="$base/telegram/"
-          export GRAFANA_ROOT_URL="$base/_gm/grafana/"
-          export VITE_VK_ID_REDIRECT_URL="$base/app/"
-          # Grafana's SMTP from_address must be a BARE address (it rejects the "Name" <addr>
-          # form the backend go-mail accepts) and validates it even when SMTP is disabled — a
-          # bad value crash-loops Grafana. Split the display-format SERVICE From into a bare
-          # address + name for Grafana; the backend keeps the full form.
-          svc_from="${SMTP_RELAY_SERVICE_FROM:-}"
-          case "$svc_from" in
-            *"<"*">"*)
-              export GRAFANA_SMTP_FROM_ADDRESS="$(printf '%s' "$svc_from" | sed -E 's/.*<([^>]+)>.*/\1/')"
-              export GRAFANA_SMTP_FROM_NAME="$(printf '%s' "$svc_from" | sed -E 's/[[:space:]]*<[^>]*>.*$//; s/^"//; s/"$//')" ;;
-            *)
-              export GRAFANA_SMTP_FROM_ADDRESS="$svc_from" ;;
-          esac
-          # Bot-link mTLS material for the test contour: a private CA + gateway/bot
-          # leaves (CN=gateway, the service name the bot dials). Prod supplies these
-          # from PROD_ secrets instead. Regenerated each deploy; both ends redeploy
-          # together so they always share the fresh CA (see deploy/gen-certs.sh).
-          bash "$GITHUB_WORKSPACE/deploy/gen-certs.sh" "$conf/certs"
          # App version for the About screen: the git tag if present, else the short SHA
          # (the test checkout is shallow/untagged, so this is the SHA here — fine).
          export APP_VERSION="$(git -C "$GITHUB_WORKSPACE" describe --tags --always 2>/dev/null || echo dev)"
-          # The telegram-local profile brings the bot + its VPN sidecar; prod runs the
-          # bot on its own host instead (deploy/docker-compose.bot.yml), and the prod
-          # main host omits both. Without the profile they would not start here.
-          docker compose --ansi never --profile telegram-local build --progress plain
-          # Raise the maintenance page, THEN bring caddy onto the reseeded config mount so it
-          # actually carries the flag: the running caddy sits on the stale pre-reseed mount (the
-          # dir was rm'd + recreated — see the force-recreate note below), so a flag written to
-          # the new dir is invisible until caddy is recreated. With the fresh caddy up, an open
-          # SPA sees the 503 marker + overlay for the whole recreate window, not a bare reconnect.
-          : > "$maint_flag"
-          docker compose --ansi never up -d --force-recreate --no-deps caddy
-          docker compose --ansi never --profile telegram-local up -d --remove-orphans
+          docker compose --ansi never build --progress plain
+          docker compose --ansi never up -d --remove-orphans
          # The config-only services bind-mount the reseeded config dir. A plain `up -d`
          # leaves them on the previous bind mount (the dir was rm'd + recreated), so a
-          # changed Grafana dashboard is ignored — force-recreate them to pick up the fresh
-          # config. (Caddy was already recreated above so it would carry the maintenance flag.)
-          docker compose --ansi never up -d --force-recreate --no-deps otelcol prometheus tempo grafana
-          # Lower the maintenance page: services are back. An open SPA's poll now gets through
-          # (once the gateway finishes booting) and reloads into the fresh client; the caddy
-          # probes in the next step see 200. The EXIT trap is a backstop if we failed earlier.
-          rm -f "$maint_flag"
+          # changed Caddyfile or Grafana dashboard is ignored — force-recreate them to
+          # pick up the fresh config.
+          docker compose --ansi never up -d --force-recreate --no-deps caddy otelcol prometheus tempo grafana

-      - name: Probe the landing, gateway and backend
+      - name: Probe the landing and the gateway through caddy
        run: |
          set -u
-          # Three probes. "/" is the static landing container and "/app/" the
-          # gateway-served SPA shell (both through the contour caddy on the edge net).
-          # The backend /readyz is probed on the internal net as well: the caddy probes
-          # are blind to a crash-looping backend (the landing is static and the SPA
-          # shell is served without it), which let a bad deploy go green while the
-          # backend was down — so check it directly here.
+          # Two probes through the contour caddy: "/" is the static
+          # landing container, "/app/" is the gateway-served SPA shell.
          for i in $(seq 1 20); do
            if docker run --rm --network edge alpine:3.20 wget -q -T 5 -O /dev/null http://scrabble/ &&
-               docker run --rm --network edge alpine:3.20 wget -q -T 5 -O /dev/null http://scrabble/app/ &&
-               docker run --rm --network scrabble-internal alpine:3.20 wget -q -T 5 -O /dev/null http://backend:8080/readyz; then
-              echo "healthy: GET / (landing) + /app/ (gateway) + backend /readyz"
+               docker run --rm --network edge alpine:3.20 wget -q -T 5 -O /dev/null http://scrabble/app/; then
+              echo "healthy: GET http://scrabble/ (landing) + /app/ (gateway)"
              exit 0
            fi
            sleep 3
          done
-          echo "probe failed; recent landing + gateway + backend logs:"
+          echo "probe failed; recent landing + gateway logs:"
          docker logs --tail 50 scrabble-landing || true
          docker logs --tail 50 scrabble-gateway || true
-          docker logs --tail 50 scrabble-backend || true
          exit 1

-      - name: Probe the /dict edge route reaches the gateway
+      - name: Probe the Telegram connector liveness
        run: |
          set -u
-          # The client fetches each game's dictionary blob at {edge}/dict/{variant}/{version}
-          # for the local move preview. If caddy does not route /dict to the gateway the request
-          # falls to the static landing and the client silently gets a non-dawg blob. Probed
-          # unauthenticated it must be the gateway's 401 (the route reaches the gateway), never a
-          # 404/200 from the landing catch-all.
-          out="$(docker run --rm --network edge alpine:3.20 wget -S -q -O /dev/null http://scrabble/dict/scrabble_en/v1 2>&1 || true)"
-          echo "$out" | grep -E "HTTP/" || true
-          if echo "$out" | grep -q " 401"; then
-            echo "ok: /dict reaches the gateway (401 unauthenticated)"
-          else
-            echo "FAIL: /dict did not reach the gateway (expected 401) — caddy route missing?"
-            exit 1
-          fi
-
-      - name: Probe the Telegram validator and bot liveness
-        run: |
-          set -u
-          # The gateway/backend probes cannot see a crash-looping validator or bot
-          # (the validator answers only internal gRPC; the bot long-polls + egresses
-          # through the VPN sidecar with no public ingress). Inspect the containers
-          # directly: each must be running, not restarting, with a stable restart
-          # count. A grace period lets the VPN handshake and the bot-link dial settle.
+          # The gateway probe cannot see a crash-looping connector (it long-polls and
+          # egresses through the VPN sidecar, with no public ingress). Inspect the
+          # container directly: it must be running, not restarting, with a stable
+          # restart count. A grace period lets the VPN handshake settle (the connector
+          # may restart a few times first).
          sleep 20
-          for name in scrabble-telegram-validator scrabble-telegram-bot; do
-            ok=
          for i in $(seq 1 20); do
-              status="$(docker inspect -f '{{.State.Status}}' "$name" 2>/dev/null || echo missing)"
-              restarting="$(docker inspect -f '{{.State.Restarting}}' "$name" 2>/dev/null || echo true)"
+            status="$(docker inspect -f '{{.State.Status}}' scrabble-telegram 2>/dev/null || echo missing)"
+            restarting="$(docker inspect -f '{{.State.Restarting}}' scrabble-telegram 2>/dev/null || echo true)"
            if [ "$status" = "running" ] && [ "$restarting" = "false" ]; then
-                c1="$(docker inspect -f '{{.RestartCount}}' "$name")"
+              c1="$(docker inspect -f '{{.RestartCount}}' scrabble-telegram)"
              sleep 5
-                c2="$(docker inspect -f '{{.RestartCount}}' "$name")"
+              c2="$(docker inspect -f '{{.RestartCount}}' scrabble-telegram)"
              if [ "$c1" = "$c2" ]; then
-                  echo "$name healthy: status=$status restarts=$c2"
-                  ok=1
-                  break
+                echo "connector healthy: status=$status restarts=$c2"
+                exit 0
              fi
-                echo "$name still restarting ($c1 -> $c2); waiting"
+              echo "connector still restarting ($c1 -> $c2); waiting"
            fi
            sleep 3
          done
-            if [ -z "$ok" ]; then
-              echo "$name not healthy; recent logs:"
-              docker logs --tail 80 "$name" || true
+          echo "connector not healthy; recent logs:"
+          docker logs --tail 80 scrabble-telegram || true
          exit 1
-            fi
-          done

      - name: Prune dangling images
        if: always()
@@ -1,285 +0,0 @@
-# Manual production rollout. Runs ONLY from master, ONLY on workflow_dispatch with
-# confirm=deploy (development->master is merged + green first; this is the separate,
-# deliberate prod step). Visible sequential jobs from most to least significant:
-#   build -> deploy-main -> deploy-bot -> verify
-# The per-service rolling (postgres->backend->gateway->landing->validator->caddy),
-# health-gating and auto-rollback live in deploy/prod-deploy.sh on the main host and
-# show in the deploy-main log. Manual post-deploy rollback is prod-rollback.yaml.
-# See deploy/README.md (prod runbook).
-name: prod-deploy
-run-name: "prod deploy ${{ github.sha }}"
-
-on:
-  workflow_dispatch:
-    inputs:
-      confirm:
-        description: 'Type "deploy" to confirm a production rollout from master.'
-        required: true
-        default: ""
-
-permissions:
-  contents: read
-
-env:
-  NO_COLOR: "1"
-  DOCKER_CLI_HINTS: "false"
-  REGISTRY: docker.iliadenisov.ru/developer
-
-jobs:
-  build:
-    if: ${{ github.ref == 'refs/heads/master' && inputs.confirm == 'deploy' }}
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    outputs:
-      tag: ${{ steps.ver.outputs.tag }}
-    env:
-      PROD_REGISTRY_USER: ${{ vars.PROD_REGISTRY_USER }}
-      PROD_REGISTRY_PASSWORD: ${{ secrets.PROD_REGISTRY_PASSWORD }}
-      VITE_TELEGRAM_BOT_ID: ${{ vars.PROD_VITE_TELEGRAM_BOT_ID }}
-      VITE_TELEGRAM_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
-      VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.PROD_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
-      # VK Mini App link + VK ID "Web" app id: one value each serves every contour.
-      VITE_VK_APP_LINK: ${{ vars.VITE_VK_APP_LINK }}
-      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-      # VITE_GATEWAY_URL omitted: the SPA is served same-origin (compose ":-" default).
-      POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }}
-      GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
-      # `docker compose build` interpolates the WHOLE compose file, so every :?-guarded
-      # runtime var must be present at build even though it is not a build-arg — incl. the
-      # backend's EXPORT_SIGN_KEY (added with the finished-game export after v1.7.0, which is
-      # why the first v1.8.0 build tripped on it). POSTGRES_PASSWORD/GM_BASICAUTH_HASH above
-      # are here for the same reason; DICT_VERSION + the derived Mini App URL cover the rest.
-      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
-      # PUBLIC_BASE_URL drives the derived VK ID redirect (baked into the SPA) and the
-      # Mini App URL; both are computed in the build step, not stored variables.
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
-      DICT_VERSION: ${{ vars.DICT_VERSION }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Compute version tag
-        id: ver
-        run: echo "tag=$(git describe --tags --always)" >> "$GITHUB_OUTPUT"
-      - name: Registry login
-        run: echo "$PROD_REGISTRY_PASSWORD" | docker login "${REGISTRY%%/*}" -u "$PROD_REGISTRY_USER" --password-stdin
-      - name: Build and push images
-        working-directory: deploy
-        run: |
-          export TAG="${{ steps.ver.outputs.tag }}" APP_VERSION="${{ steps.ver.outputs.tag }}" SCRABBLE_CONFIG_DIR=.
-          # Derive the public URLs from the one canonical origin: the VK ID redirect is a
-          # build-arg baked into the SPA, and the Mini App URL satisfies the (profiled-out)
-          # bot service's compose ":?" guard during parse. See deploy/write-prod-env.sh.
-          base="${PUBLIC_BASE_URL%/}"
-          export VITE_VK_ID_REDIRECT_URL="$base/app/" TELEGRAM_MINIAPP_URL="$base/telegram/"
-          # The main-stack images via compose (reuses the build args, incl. VERSION);
-          # the bot separately, since it is profiled out of the prod compose.
-          docker compose -f docker-compose.yml -f docker-compose.prod.yml build
-          docker compose -f docker-compose.yml -f docker-compose.prod.yml push backend gateway landing validator renderer
-          docker build -f ../platform/telegram/Dockerfile --target bot --build-arg VERSION="$TAG" -t "$REGISTRY/scrabble-telegram-bot:$TAG" ..
-          docker push "$REGISTRY/scrabble-telegram-bot:$TAG"
-
-  deploy-main:
-    needs: build
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    env:
-      TAG: ${{ needs.build.outputs.tag }}
-      PROD_REGISTRY_USER: ${{ vars.PROD_REGISTRY_USER }}
-      PROD_REGISTRY_PASSWORD: ${{ secrets.PROD_REGISTRY_PASSWORD }}
-      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
-      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
-      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
-      POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }}
-      GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
-      GRAFANA_ADMIN_PASSWORD: ${{ secrets.PROD_GRAFANA_ADMIN_PASSWORD }}
-      TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
-      GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
-      # VK ID web login: the "Web" app id (the gateway reuses it as GATEWAY_VK_ID_APP_ID at
-      # runtime) + the app's protected key. Both shared across contours. The redirect URL is
-      # derived from PUBLIC_BASE_URL in deploy/write-prod-env.sh.
-      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-      GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
-      # Planted honeytoken bearer: presenting it earns a 24h IP ban + a high-severity alarm.
-      # Per-contour secret; empty = trap off. Rendered by deploy/write-prod-env.sh.
-      GATEWAY_HONEYTOKEN: ${{ secrets.PROD_GATEWAY_HONEYTOKEN }}
-      # Signs the finished-game export download URLs (backend BACKEND_EXPORT_SIGN_KEY).
-      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
-      # Transactional email via the shared Selectel relay (confirm-codes): one account for
-      # every contour -> unprefixed host/port/tls/user/pass.
-      SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
-      SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
-      SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
-      SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
-      SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
-      SMTP_RELAY_FROM: ${{ vars.PROD_SMTP_RELAY_FROM }}
-      # Operator alerts: backend admin emails + Grafana infra alerts (distinct senders +
-      # recipients; Grafana uses the relay's STARTTLS host:port).
-      SMTP_RELAY_ADMIN_FROM: ${{ vars.PROD_SMTP_RELAY_ADMIN_FROM }}
-      ADMIN_EMAIL: ${{ vars.PROD_ADMIN_EMAIL }}
-      SMTP_RELAY_SERVICE_FROM: ${{ vars.PROD_SMTP_RELAY_SERVICE_FROM }}
-      SERVICE_EMAIL: ${{ vars.PROD_SERVICE_EMAIL }}
-      GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
-      GF_SMTP_ENABLED: ${{ vars.PROD_GF_SMTP_ENABLED }}
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
-      PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
-      PROD_BOTLINK_GATEWAY_CERT: ${{ secrets.PROD_BOTLINK_GATEWAY_CERT }}
-      PROD_BOTLINK_GATEWAY_KEY: ${{ secrets.PROD_BOTLINK_GATEWAY_KEY }}
-      GM_BASICAUTH_USER: ${{ vars.PROD_GM_BASICAUTH_USER }}
-      CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
-      LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      DICT_VERSION: ${{ vars.DICT_VERSION }}
-      POSTGRES_DB: ${{ vars.PROD_POSTGRES_DB }}
-      POSTGRES_USER: ${{ vars.PROD_POSTGRES_USER }}
-      # TELEGRAM_MINIAPP_URL and GRAFANA_ROOT_URL are derived from PUBLIC_BASE_URL in
-      # deploy/write-prod-env.sh, not stored variables.
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
-          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-      - name: Determine previous tag and migration
-        run: |
-          ssh_main() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "$@"; }
-          PREV_TAG="$(ssh_main 'cat /opt/scrabble/DEPLOYED_TAG 2>/dev/null || echo none')"
-          MIGRATION=0
-          if [ "$PREV_TAG" != none ]; then
-            if ! git cat-file -e "$PREV_TAG^{commit}" 2>/dev/null; then
-              MIGRATION=1
-            elif git diff --name-only "$PREV_TAG..$TAG" -- backend/internal/postgres/migrations/ | grep -q .; then
-              MIGRATION=1
-            fi
-          fi
-          { echo "PREV_TAG=$PREV_TAG"; echo "MIGRATION=$MIGRATION"; } >> "$GITHUB_ENV"
-          echo "prev=$PREV_TAG migration=$MIGRATION"
-      - name: Render main env + certs
-        run: |
-          umask 077
-          mkdir -p stage/certs-main
-          # Shared with prod-rollback so the two paths render an identical runtime env.
-          APP_VERSION="$TAG" bash deploy/write-prod-env.sh stage/env.sh
-          printf '%s\n' "$PROD_BOTLINK_CA"           > stage/certs-main/ca.crt
-          printf '%s\n' "$PROD_BOTLINK_GATEWAY_CERT" > stage/certs-main/gateway.crt
-          printf '%s\n' "$PROD_BOTLINK_GATEWAY_KEY"  > stage/certs-main/gateway.key
-          chmod 644 stage/certs-main/*
-      - name: Deploy the main host
-        run: |
-          ssh_main() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "$@"; }
-          ssh_main 'mkdir -p /opt/scrabble/compose'
-          tar -C deploy -czf - docker-compose.yml docker-compose.prod.yml prod-deploy.sh \
-            | ssh_main 'tar -C /opt/scrabble/compose -xzf -'
-          tar -C deploy -czf - caddy otelcol prometheus tempo grafana blackbox \
-            | ssh_main 'tar -C /opt/scrabble -xzf -'
-          tar -C stage -czf - certs-main \
-            | ssh_main 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
-          scp -i ~/.ssh/id_deploy -o BatchMode=yes stage/env.sh "deploy@$MAIN_HOST:/opt/scrabble/env.sh"
-          echo "$PROD_REGISTRY_PASSWORD" | ssh_main "docker login ${REGISTRY%%/*} -u $PROD_REGISTRY_USER --password-stdin"
-          ssh_main "TAG='$TAG' PREV_TAG='$PREV_TAG' MIGRATION='$MIGRATION' bash /opt/scrabble/compose/prod-deploy.sh"
-
-  deploy-bot:
-    needs: [build, deploy-main]
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    env:
-      TAG: ${{ needs.build.outputs.tag }}
-      PROD_REGISTRY_USER: ${{ vars.PROD_REGISTRY_USER }}
-      PROD_REGISTRY_PASSWORD: ${{ secrets.PROD_REGISTRY_PASSWORD }}
-      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
-      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
-      TG_HOST: ${{ vars.PROD_TG_HOST }}
-      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
-      TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
-      TELEGRAM_PROMO_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_PROMO_BOT_TOKEN }}
-      PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
-      PROD_BOTLINK_BOT_CERT: ${{ secrets.PROD_BOTLINK_BOT_CERT }}
-      PROD_BOTLINK_BOT_KEY: ${{ secrets.PROD_BOTLINK_BOT_KEY }}
-      LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      # PUBLIC_BASE_URL drives the derived Mini App URL in deploy/write-prod-bot-env.sh.
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
-      TELEGRAM_GAME_CHANNEL_ID: ${{ vars.PROD_TELEGRAM_GAME_CHANNEL_ID }}
-      TELEGRAM_CHAT_ID: ${{ vars.PROD_TELEGRAM_CHAT_ID }}
-      TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.PROD_TELEGRAM_SUPPORT_CHAT_ID }}
-      TELEGRAM_BOT_USERNAME: ${{ vars.PROD_TELEGRAM_BOT_USERNAME }}
-      TELEGRAM_BOT_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
-          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-      - name: Render bot env + certs
-        run: |
-          umask 077
-          mkdir -p stage/certs-bot
-          # Shared with prod-rollback so the two paths render an identical bot env.
-          BOT_IMAGE="$REGISTRY/scrabble-telegram-bot:$TAG" bash deploy/write-prod-bot-env.sh stage/env.bot.sh
-          printf '%s\n' "$PROD_BOTLINK_CA"       > stage/certs-bot/ca.crt
-          printf '%s\n' "$PROD_BOTLINK_BOT_CERT" > stage/certs-bot/bot.crt
-          printf '%s\n' "$PROD_BOTLINK_BOT_KEY"  > stage/certs-bot/bot.key
-          chmod 644 stage/certs-bot/*
-      - name: Deploy the bot host
-        run: |
-          ssh_tg() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$TG_HOST" "$@"; }
-          ssh_tg 'mkdir -p /opt/scrabble/compose'
-          tar -C deploy -czf - docker-compose.bot.yml | ssh_tg 'tar -C /opt/scrabble/compose -xzf -'
-          tar -C stage -czf - certs-bot \
-            | ssh_tg 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
-          scp -i ~/.ssh/id_deploy -o BatchMode=yes stage/env.bot.sh "deploy@$TG_HOST:/opt/scrabble/env.bot.sh"
-          echo "$PROD_REGISTRY_PASSWORD" | ssh_tg "docker login ${REGISTRY%%/*} -u $PROD_REGISTRY_USER --password-stdin"
-          ssh_tg 'set -a; . /opt/scrabble/env.bot.sh; set +a; cd /opt/scrabble/compose;
-            docker compose -f docker-compose.bot.yml pull;
-            docker compose -f docker-compose.bot.yml up -d'
-          ssh_tg 'for i in $(seq 1 20); do
-              s=$(docker inspect -f "{{.State.Status}}" scrabble-telegram-bot 2>/dev/null || echo missing)
-              r=$(docker inspect -f "{{.State.Restarting}}" scrabble-telegram-bot 2>/dev/null || echo true)
-              if [ "$s" = running ] && [ "$r" = false ]; then
-                c1=$(docker inspect -f "{{.RestartCount}}" scrabble-telegram-bot); sleep 5
-                c2=$(docker inspect -f "{{.RestartCount}}" scrabble-telegram-bot)
-                [ "$c1" = "$c2" ] && { echo "bot healthy"; exit 0; }
-              fi
-              sleep 3
-            done
-            echo "bot not healthy:"; docker logs --tail 80 scrabble-telegram-bot; exit 1'
-
-  verify:
-    needs: [deploy-main, deploy-bot]
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    env:
-      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
-      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
-      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
-      CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
-    steps:
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
-          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-      - name: Verify the public site
-        run: |
-          domain="${CADDY_SITE_ADDRESS%% *}"
-          ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "for i in \$(seq 1 20); do
-              if curl -fsS -k --resolve $domain:443:127.0.0.1 https://$domain/ -o /dev/null &&
-                 curl -fsS -k --resolve $domain:443:127.0.0.1 https://$domain/app/ -o /dev/null &&
-                 docker run --rm --network scrabble-internal alpine:3.20 wget -q -T 5 -O /dev/null http://backend:8080/readyz; then
-                echo 'public site + /app/ + backend healthy'; exit 0
-              fi
-              sleep 5
-            done
-            echo 'public verify failed; recent caddy + gateway + backend logs:'
-            docker logs --tail 40 scrabble-caddy; docker logs --tail 40 scrabble-gateway; docker logs --tail 40 scrabble-backend
-            exit 1"
@@ -1,218 +0,0 @@
-# Manual production rollback. Runs ONLY from master, ONLY on workflow_dispatch with
-# confirm=rollback. Re-deploys an already-published image tag (no build): leave
-# target_version blank to roll back to the previously deployed version (read from the
-# main host), or set it to a specific release tag from the Releases page. The
-# re-deploy is the same rolling, health-gated path as prod-deploy (TAG=target,
-# MIGRATION=0 — rollback is image-only and never migrates the DB; image rollback is
-# DB-safe under the expand-contract rule). See deploy/README.md (prod runbook).
-name: prod-rollback
-run-name: "prod rollback ${{ inputs.target_version || 'previous' }}"
-
-on:
-  workflow_dispatch:
-    inputs:
-      confirm:
-        description: 'Type "rollback" to confirm a production rollback.'
-        required: true
-        default: ""
-      target_version:
-        description: "Release tag to roll back to (blank = the previous deployed version)."
-        required: false
-        default: ""
-
-permissions:
-  contents: read
-
-env:
-  NO_COLOR: "1"
-  DOCKER_CLI_HINTS: "false"
-  REGISTRY: docker.iliadenisov.ru/developer
-
-jobs:
-  rollback-main:
-    if: ${{ github.ref == 'refs/heads/master' && inputs.confirm == 'rollback' }}
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    outputs:
-      target: ${{ steps.resolve.outputs.target }}
-    env:
-      PROD_REGISTRY_USER: ${{ vars.PROD_REGISTRY_USER }}
-      PROD_REGISTRY_PASSWORD: ${{ secrets.PROD_REGISTRY_PASSWORD }}
-      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
-      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
-      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
-      POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }}
-      GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
-      GRAFANA_ADMIN_PASSWORD: ${{ secrets.PROD_GRAFANA_ADMIN_PASSWORD }}
-      TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
-      PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
-      PROD_BOTLINK_GATEWAY_CERT: ${{ secrets.PROD_BOTLINK_GATEWAY_CERT }}
-      PROD_BOTLINK_GATEWAY_KEY: ${{ secrets.PROD_BOTLINK_GATEWAY_KEY }}
-      GM_BASICAUTH_USER: ${{ vars.PROD_GM_BASICAUTH_USER }}
-      CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
-      LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      DICT_VERSION: ${{ vars.DICT_VERSION }}
-      POSTGRES_DB: ${{ vars.PROD_POSTGRES_DB }}
-      POSTGRES_USER: ${{ vars.PROD_POSTGRES_USER }}
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
-      # Full runtime env — parity with prod-deploy's deploy-main so a rollback re-renders
-      # the SAME env.sh (email / VK login / Grafana alerts survive a rollback). TELEGRAM_MINIAPP_URL
-      # and GRAFANA_ROOT_URL are derived from PUBLIC_BASE_URL in deploy/write-prod-env.sh.
-      GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
-      VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
-      GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
-      GATEWAY_HONEYTOKEN: ${{ secrets.PROD_GATEWAY_HONEYTOKEN }}
-      EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
-      SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
-      SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
-      SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
-      SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
-      SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
-      SMTP_RELAY_FROM: ${{ vars.PROD_SMTP_RELAY_FROM }}
-      SMTP_RELAY_ADMIN_FROM: ${{ vars.PROD_SMTP_RELAY_ADMIN_FROM }}
-      ADMIN_EMAIL: ${{ vars.PROD_ADMIN_EMAIL }}
-      SMTP_RELAY_SERVICE_FROM: ${{ vars.PROD_SMTP_RELAY_SERVICE_FROM }}
-      SERVICE_EMAIL: ${{ vars.PROD_SERVICE_EMAIL }}
-      GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
-      GF_SMTP_ENABLED: ${{ vars.PROD_GF_SMTP_ENABLED }}
-      INPUT_TARGET: ${{ inputs.target_version }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
-          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-      - name: Resolve rollback target
-        id: resolve
-        run: |
-          ssh_main() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "$@"; }
-          CURRENT="$(ssh_main 'cat /opt/scrabble/DEPLOYED_TAG 2>/dev/null || echo none')"
-          if [ -n "$INPUT_TARGET" ]; then
-            TARGET="$INPUT_TARGET"
-          else
-            TARGET="$(ssh_main 'cat /opt/scrabble/PREVIOUS_TAG 2>/dev/null || echo none')"
-          fi
-          if [ -z "$TARGET" ] || [ "$TARGET" = none ]; then
-            echo "no rollback target (no PREVIOUS_TAG on the host and no target_version input)"; exit 1
-          fi
-          if [ "$TARGET" = "$CURRENT" ]; then
-            echo "target $TARGET is already the deployed version; nothing to do"; exit 1
-          fi
-          echo "rolling back: current=$CURRENT -> target=$TARGET"
-          echo "target=$TARGET" >> "$GITHUB_OUTPUT"
-          { echo "TARGET=$TARGET"; echo "CURRENT=$CURRENT"; } >> "$GITHUB_ENV"
-      - name: Render main env + certs
-        run: |
-          umask 077
-          mkdir -p stage/certs-main
-          # Same writer as prod-deploy's deploy-main -> the rollback re-renders the FULL
-          # runtime env (not a subset), so email / VK login / Grafana alerts survive it.
-          APP_VERSION="$TARGET" bash deploy/write-prod-env.sh stage/env.sh
-          printf '%s\n' "$PROD_BOTLINK_CA"           > stage/certs-main/ca.crt
-          printf '%s\n' "$PROD_BOTLINK_GATEWAY_CERT" > stage/certs-main/gateway.crt
-          printf '%s\n' "$PROD_BOTLINK_GATEWAY_KEY"  > stage/certs-main/gateway.key
-          chmod 644 stage/certs-main/*
-      - name: Roll the main host back
-        run: |
-          ssh_main() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "$@"; }
-          ssh_main 'mkdir -p /opt/scrabble/compose'
-          tar -C deploy -czf - docker-compose.yml docker-compose.prod.yml prod-deploy.sh \
-            | ssh_main 'tar -C /opt/scrabble/compose -xzf -'
-          tar -C deploy -czf - caddy otelcol prometheus tempo grafana \
-            | ssh_main 'tar -C /opt/scrabble -xzf -'
-          tar -C stage -czf - certs-main \
-            | ssh_main 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
-          scp -i ~/.ssh/id_deploy -o BatchMode=yes stage/env.sh "deploy@$MAIN_HOST:/opt/scrabble/env.sh"
-          echo "$PROD_REGISTRY_PASSWORD" | ssh_main "docker login ${REGISTRY%%/*} -u $PROD_REGISTRY_USER --password-stdin"
-          # Image-only rollback: no migration window (TAG=target, MIGRATION=0). A failed
-          # rollback's auto-revert returns to the current version (PREV_TAG=$CURRENT).
-          ssh_main "TAG='$TARGET' PREV_TAG='$CURRENT' MIGRATION=0 bash /opt/scrabble/compose/prod-deploy.sh"
-
-  rollback-bot:
-    needs: rollback-main
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    env:
-      TARGET: ${{ needs.rollback-main.outputs.target }}
-      PROD_REGISTRY_USER: ${{ vars.PROD_REGISTRY_USER }}
-      PROD_REGISTRY_PASSWORD: ${{ secrets.PROD_REGISTRY_PASSWORD }}
-      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
-      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
-      TG_HOST: ${{ vars.PROD_TG_HOST }}
-      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
-      TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
-      TELEGRAM_PROMO_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_PROMO_BOT_TOKEN }}
-      PROD_BOTLINK_CA: ${{ secrets.PROD_BOTLINK_CA }}
-      PROD_BOTLINK_BOT_CERT: ${{ secrets.PROD_BOTLINK_BOT_CERT }}
-      PROD_BOTLINK_BOT_KEY: ${{ secrets.PROD_BOTLINK_BOT_KEY }}
-      LOG_LEVEL: ${{ vars.PROD_LOG_LEVEL }}
-      # PUBLIC_BASE_URL drives the derived Mini App URL; SUPPORT_CHAT_ID for parity with deploy.
-      PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
-      TELEGRAM_GAME_CHANNEL_ID: ${{ vars.PROD_TELEGRAM_GAME_CHANNEL_ID }}
-      TELEGRAM_CHAT_ID: ${{ vars.PROD_TELEGRAM_CHAT_ID }}
-      TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.PROD_TELEGRAM_SUPPORT_CHAT_ID }}
-      TELEGRAM_BOT_USERNAME: ${{ vars.PROD_TELEGRAM_BOT_USERNAME }}
-      TELEGRAM_BOT_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
-          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-      - name: Render bot env + certs
-        run: |
-          umask 077
-          mkdir -p stage/certs-bot
-          # Same writer as prod-deploy's deploy-bot (parity; includes TELEGRAM_SUPPORT_CHAT_ID).
-          BOT_IMAGE="$REGISTRY/scrabble-telegram-bot:$TARGET" bash deploy/write-prod-bot-env.sh stage/env.bot.sh
-          printf '%s\n' "$PROD_BOTLINK_CA"       > stage/certs-bot/ca.crt
-          printf '%s\n' "$PROD_BOTLINK_BOT_CERT" > stage/certs-bot/bot.crt
-          printf '%s\n' "$PROD_BOTLINK_BOT_KEY"  > stage/certs-bot/bot.key
-          chmod 644 stage/certs-bot/*
-      - name: Roll the bot host back
-        run: |
-          ssh_tg() { ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$TG_HOST" "$@"; }
-          ssh_tg 'mkdir -p /opt/scrabble/compose'
-          tar -C deploy -czf - docker-compose.bot.yml | ssh_tg 'tar -C /opt/scrabble/compose -xzf -'
-          tar -C stage -czf - certs-bot \
-            | ssh_tg 'rm -rf /opt/scrabble/certs && mkdir -p /opt/scrabble/certs && tar -C /opt/scrabble/certs --strip-components=1 -xzf -'
-          scp -i ~/.ssh/id_deploy -o BatchMode=yes stage/env.bot.sh "deploy@$TG_HOST:/opt/scrabble/env.bot.sh"
-          echo "$PROD_REGISTRY_PASSWORD" | ssh_tg "docker login ${REGISTRY%%/*} -u $PROD_REGISTRY_USER --password-stdin"
-          ssh_tg 'set -a; . /opt/scrabble/env.bot.sh; set +a; cd /opt/scrabble/compose;
-            docker compose -f docker-compose.bot.yml pull;
-            docker compose -f docker-compose.bot.yml up -d'
-
-  verify:
-    needs: [rollback-main, rollback-bot]
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    env:
-      PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
-      PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
-      MAIN_HOST: ${{ vars.PROD_MAIN_HOST }}
-      CADDY_SITE_ADDRESS: ${{ vars.PROD_CADDY_SITE_ADDRESS }}
-    steps:
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
-          printf '%s\n' "$PROD_SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
-      - name: Verify the public site
-        run: |
-          domain="${CADDY_SITE_ADDRESS%% *}"
-          ssh -i ~/.ssh/id_deploy -o BatchMode=yes "deploy@$MAIN_HOST" "for i in \$(seq 1 20); do
-              if curl -fsS -k --resolve $domain:443:127.0.0.1 https://$domain/ -o /dev/null &&
-                 docker run --rm --network scrabble-internal alpine:3.20 wget -q -T 5 -O /dev/null http://backend:8080/readyz; then
-                echo 'rolled-back site healthy'; exit 0
-              fi
-              sleep 5
-            done
-            echo 'verify failed'; docker logs --tail 40 scrabble-caddy; docker logs --tail 40 scrabble-backend; exit 1"
@@ -17,9 +17,5 @@
 **/.env.local
 **/.env.*.local

-# Bot-link mTLS material: private keys never belong in the repo. The test contour
-# generates them with deploy/gen-certs.sh; prod supplies them from PROD_ secrets.
-deploy/certs/
-
 # Claude Code harness runtime artifacts
 .claude/scheduled_tasks.lock
@@ -1,97 +1,96 @@
 # scrabble-game — project guide

-Multiplatform Scrabble game, **in production** at `https://erudit-game.ru`. Read this
-first every session. The repository — not conversation memory — is the source of
-continuity; keep it that way.
+Multiplatform Scrabble game. Read this first every session. The owner drives the
+project **one stage per session** (tariff constraint), so the repository — not
+conversation memory — is the source of continuity. Keep it that way.

 ## Sources of truth (read before changing behaviour)

- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — architecture, transport, security,
-  the decision record. Always describes the current state.
- [`docs/FUNCTIONAL.md`](docs/FUNCTIONAL.md) (+ [`_ru`](docs/FUNCTIONAL_ru.md) mirror)
-  — per-domain user stories. English authoritative.
- [`docs/TESTING.md`](docs/TESTING.md) — test layers + the CI gate.
+- [`PLAN.md`](PLAN.md) — staged plan + **stage tracker** + per-stage *open
+  details to interview*.
+- [`PRERELEASE.md`](PRERELEASE.md) — pre-release hardening tracker (phases R1–R7
+  before Stage 18); same per-phase *interview + bake-back* discipline as `PLAN.md`.
+- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — architecture, transport,
+  security, the decision record. Always describes current state.
+- [`docs/FUNCTIONAL.md`](docs/FUNCTIONAL.md) (+ [`_ru`](docs/FUNCTIONAL_ru.md)
+  mirror) — per-domain user stories. English authoritative.
+- [`docs/TESTING.md`](docs/TESTING.md) — test layers + the per-stage CI gate.
 - [`docs/UI_DESIGN.md`](docs/UI_DESIGN.md) — the `ui` visual/interaction design system.
- [`deploy/README.md`](deploy/README.md) — the deploy contour + the production
-  rollout / rollback runbook.

-## How we work
+## Mandatory per-stage workflow

- Inspect the relevant code path and the docs above before changing behaviour.
- **Interview the owner on every fork** — do not silently pick borderline decisions;
-  offer options with brief pros/cons.
- Smallest correct diff. Prefer compact code; reuse before adding; do not add deps,
-  seams or knobs until they are needed.
- **Update or add tests for every functional change**, at the layers
-  `docs/TESTING.md` calls out.
- **Bake docs in the same PR**: update `docs/ARCHITECTURE.md`, `docs/FUNCTIONAL.md`
-  (+`_ru`), the affected service `README` and Go Doc comments alongside the change.
- Document added packages, types, funcs, consts and vars with Go Doc comments.
+**Start of a stage**
+1. Read `PLAN.md` (the stage's scope + *open details*) and the relevant `docs/`.
+2. Analyse what the stage actually requires against the current code.
+3. **Interview the owner** on every open detail and any fork not already fixed
+   in the plan — do not silently pick borderline decisions. Offer options with
+   brief pros/cons.
+4. Only then implement, strictly within the stage's scope.
+
+**End of a stage**
+1. Bake every new agreement back into `PLAN.md`, `docs/ARCHITECTURE.md`,
+   `docs/FUNCTIONAL.md` (+ `_ru`), the affected service `README`, and Go Doc
+   comments — in the **same** PR. Correct earlier stages' docs/code if a new
+   decision changes them.
+2. Update the stage tracker; add a line under *Refinements logged during
+   implementation* for any plan deviation.
+3. Get CI green, then mark the stage done.
+
+(The `stage-implementation` skill encodes this same loop and can be invoked.)

 ## Conventions

 - All code, comments, identifiers, commits, docs, filenames in **English**.
- Chat with the owner follows the user-level `~/.claude/CLAUDE.md` (Russian, the
-  agreed persona and translation rules).
- Mirror every point edit of `docs/FUNCTIONAL.md` into `docs/FUNCTIONAL_ru.md` in the
-  same patch (translate only the touched paragraphs).
+- Chat with the owner follows the user-level `~/.claude/CLAUDE.md` (Russian,
+  the agreed persona and translation rules).
+- Mirror every point edit of `docs/FUNCTIONAL.md` into `docs/FUNCTIONAL_ru.md`
+  in the same patch (translate only the touched paragraphs).
+- Prefer compact code; do not add deps, seams or knobs until a stage needs them.
+  Reuse before adding. Document added packages/types/funcs with Go Doc comments.
+- Update or add tests for every functional change.

-## Branching, CI & production
+## Branching & CI

- **Two long-lived branches**: **`development`** is the integration branch; **`master`**
-  is the production trunk. Cut `feature/*` from `development` and PR back into it;
-  promote `development → master` via PR when ready to release. Both branches require
-  one approval + the `CI / gate` check.
- A commit to a `feature/*` branch triggers nothing. The single workflow
-  `.gitea/workflows/ci.yaml` runs the full suite (`unit` + `integration` + `ui`) on a
-  PR into `development` or `master`, and the gated **`deploy`** job auto-rolls the
-  **test contour** on a PR into — or a push to — `development`
-  (`docker compose up -d --build` on the runner host + landing/SPA/backend probes). A
-  PR into `master` is test-only.
- **Production is live on two hosts** (main + the Telegram bot host) and deploys
-  **only manually** (`workflow_dispatch`), never automatically:
-  - **`.gitea/workflows/prod-deploy.yaml`** (`confirm=deploy`, from `master`) builds +
-    pushes the images to the registry, then SSH-deploys both hosts — rolling per
-    service in dependency order, health-gated, **auto-rollback to the previous tag**;
-    a schema migration adds a maintenance window + a consistent `pg_dump`. Four visible
-    jobs: build → deploy-main → deploy-bot → verify.
-  - **`.gitea/workflows/prod-rollback.yaml`** (`confirm=rollback`) re-deploys a prior
-    release (blank `target_version` = the previous deployed version) — image-only,
-    rolling, health-gated.
-  - **Releases are git tags `vX.Y.Z` on `master`**; the deploy stamps `git describe
-    --tags` into the image tag, every binary (`pkg/version` via `-ldflags` → the
-    `service.version` telemetry attribute) and the SPA About screen. Tag the release
-    before deploying.
-  - Hosts are provisioned idempotently by **`deploy/ansible/`**. Per-contour
-    secrets/variables use the `TEST_` / `PROD_` prefix (Gitea 1.26 has no deployment
-    environments). Migrations must be **expand-contract** (backward-compatible) so
-    image rollback stays DB-safe. Full runbook + variable list in `deploy/README.md`.
- After any push, merge or deploy, **watch the run to green** before declaring done —
-  use the ready-made watcher (run it in the background), never an inline poll loop:
-  `python3 ~/.claude/bin/gitea-ci-watch.py`. It reads `$GITEA_URL` / `$GITEA_TOKEN`;
-  `gitea.iliadenisov.ru` is allow-listed in `.claude/settings.json`. Remote:
-  `origin git@gitea.iliadenisov.ru:developer/scrabble-game.git`.
+- **Two long-lived branches** (Stage 16 onward): **`development`** is the
+  integration branch; **`master`** is the production trunk. Cut `feature/*`
+  branches **from `development`** and PR them back into it. (Stages 0–15 used
+  `master` as the trunk with `feature/* → master`; the genesis Stage 0 commit is
+  on `master` by necessity.)
+- A commit to a `feature/*` branch triggers **nothing**. The single workflow
+  `.gitea/workflows/ci.yaml` runs the full suite (`unit` + `integration` + `ui`)
+  on a PR into `development` or `master`, and the gated **`deploy`** job auto-rolls
+  the **test contour** on a PR into — or a push to — `development`
+  (`docker compose up -d --build` on the runner host + a `GET /` probe). A PR into
+  `master` is test-only.
+- Merge `development → master` only when CI is green; the **prod** deploy is then a
+  **manual** workflow (Stage 18), never automatic. Secrets/variables are prefixed
+  `TEST_` / `PROD_` per contour (Gitea 1.26 has no deployment environments).
+- After any push, watch the run to green before declaring a stage done — use the
+  ready-made watcher, never an inline poll loop:
+  `python3 ~/.claude/bin/gitea-ci-watch.py` (background). It reads `$GITEA_URL`
+  / `$GITEA_TOKEN`; `gitea.iliadenisov.ru` is allow-listed in
+  `.claude/settings.json`. Remote: `origin git@gitea.iliadenisov.ru:developer/scrabble-game.git`.

 ## Stack

-Go 1.26.3, `go.work` monorepo, module paths `scrabble/<name>`. Backend uses `gin` +
-`zap` + `pgx`/`go-jet`/`goose`/OTel. Client↔gateway is Connect-RPC + FlatBuffers
-(h2c); gateway↔backend is REST/JSON + `X-User-ID` plus a gRPC server-stream for live
-events. UI is pure HTML5/CSS on plain Svelte + Vite, packaged to native with
-Capacitor. No Redis.
+Go 1.26.3, `go.work` monorepo, module paths `scrabble/<name>`. Dependencies are
+added **when first used** (incremental): backend uses `gin` + `zap` +
+`pgx`/`go-jet`/`goose`/OTel (added in Stage 1). Client↔gateway is Connect-RPC +
+FlatBuffers (h2c); gateway↔backend is REST/JSON + `X-User-ID` plus a gRPC
+server-stream for live events. UI is pure HTML5/CSS on plain Svelte + Vite,
+packaged to native with Capacitor. Likely no Redis.

 ## Reused engine: `../scrabble-solver` (module `scrabble-solver`, Go 1.26.3)

-Embedded **in-process as a library** (`replace scrabble-solver => ../scrabble-solver`
-in `go.work`; CI checks out the sibling from
-`https://gitea.iliadenisov.ru/.../scrabble-solver.git`). There is no per-game
-container. Public API to reuse (do not reimplement):
+Embedded **in-process as a library** — there is no per-game container. Public
+API to reuse (do not reimplement):

- `scrabble.NewSolver(rs, finder)` → `GenerateMoves(b, r, mode)` (ranked, highest
-  score first), `ValidatePlay(b, dir, tiles)`, `ScorePlay(...)`; `scrabble.Apply(b, m)`;
-  types `Move/Word/Placement/Direction/Mode`
+- `scrabble.NewSolver(rs, finder)` → `GenerateMoves(b, r, mode)` (ranked,
+  highest score first), `ValidatePlay(b, dir, tiles)`, `ScorePlay(...)`;
+  `scrabble.Apply(b, m)`; types `Move/Word/Placement/Direction/Mode`
  (`scrabble-solver/scrabble/{solver,move,apply}.go`).
- `rules.English() / RussianScrabble() / Erudit()` (`scrabble-solver/rules/rules.go`).
+- `rules.English() / RussianScrabble() / Erudit()`
+  (`scrabble-solver/rules/rules.go`).
 - `board.New / Parse / Clone / Transpose`; `rack.New / Add / Remove / Clone`;
  `selfplay.NewBag / Draw / Len` (bag pattern).
 - Load committed dictionaries with `dawg.Load(path)` from
@@ -100,17 +99,20 @@ container. Public API to reuse (do not reimplement):

 Constraints:
 - Words/tiles are **alphabet-index bytes**, meaningful only with the matching
-  `rules.Ruleset` (`Alphabet.Decode`); the blank flag is carried separately. **Decode
+  `rules.Ruleset` (`Alphabet.Decode`); blank flag carried separately. **Decode
  to real characters before persisting history** (history must be
  dictionary-independent — see `docs/ARCHITECTURE.md` §9.1).
 - The solver's `internal/*` is NOT importable from this sibling module.
 - **GCG is test-only** in the solver (no public writer) — we ship our own.
- The solver uses published `github.com/iliadenisov/{alphabet,dafsa}` (no local replace).
+- Wiring: add `replace scrabble-solver => ../scrabble-solver` to `go.work` in
+  **Stage 2** (when `internal/engine` first imports it), and make CI check out
+  the solver sibling (`https://gitea.iliadenisov.ru/.../scrabble-solver.git`).
+  It uses published `github.com/iliadenisov/{alphabet,dafsa}` (no local replace).

 ## Repository layout

 ```
-go.work                      # the go.work monorepo
+go.work                      # use the existing modules; grows per stage
 backend/                     # module scrabble/backend
  cmd/backend/               # main: telemetry -> db+migrate -> cache -> server
  cmd/jetgen/                # dev tool: regenerate go-jet code (throwaway container)
@@ -121,15 +123,12 @@ backend/                     # module scrabble/backend
  internal/session/          # opaque tokens, sessions store, cache, service
  internal/server/           # gin engine, /api/v1 groups, X-User-ID, probes
  internal/inttest/          # //go:build integration Postgres-backed tests
-gateway/                     # module scrabble/gateway: Connect-RPC edge, embeds the SPA
-ui/                          # Svelte + Vite SPA + landing (Node project, not in go.work)
-pkg/                         # shared: telemetry, version, wire/FlatBuffers, proto, mtls
-platform/telegram/           # Telegram side-service: cmd/validator (HMAC, no VPN) + cmd/bot (Bot API; dials gateway over reverse mTLS bot-link)
-renderer/                    # image-render sidecar (Node + skia-canvas): runs ui/src/lib/gameimage.ts server-side for the finished-game PNG export
-loadtest/                    # module scrabble/loadtest: the load/stress harness
-docs/  .gitea/workflows/  CLAUDE.md  README.md
-backend/Dockerfile gateway/Dockerfile platform/telegram/Dockerfile loadtest/Dockerfile renderer/Dockerfile  # multi-stage distroless (renderer: node:22-slim + skia-canvas + fonts); gateway/Dockerfile has the `landing` target, platform/telegram/Dockerfile has `validator`+`bot` targets
-deploy/                      # docker-compose (+ prod overlay + bot host) + ansible provisioning + caddy + landing + otelcol (OTLP + docker_stats) + prometheus/tempo/grafana + node_exporter + postgres_exporter; prod-deploy.sh
+docs/  .gitea/workflows/  PLAN.md  CLAUDE.md  README.md
+gateway/  ui/  pkg/              # added by their stages
+platform/telegram/               # Telegram connector side-service (Stage 9): bot + gRPC API
+loadtest/                        # module scrabble/loadtest: the pre-release stress harness (R2)
+backend/Dockerfile gateway/Dockerfile platform/telegram/Dockerfile loadtest/Dockerfile  # multi-stage distroless (Stage 16; loadtest R2); gateway/Dockerfile also has the `landing` target (R3)
+deploy/                          # docker-compose (per-service limits, R7) + caddy + landing + otelcol (OTLP + docker_stats per-container metrics) + prometheus/tempo/grafana + postgres_exporter
 ```

 ## Build & test
@@ -139,20 +138,20 @@ go build ./backend/...          # per module ('./...' from the root won't span t
 go vet ./backend/...
 gofmt -l .                      # must print nothing
 go test -count=1 ./backend/...
-go build ./platform/telegram/... && go test ./platform/telegram/...  # Telegram validator + bot
+go build ./platform/telegram/... && go test ./platform/telegram/...  # Telegram connector (Stage 9)
 go run ./backend/cmd/backend    # /healthz, /readyz on :8080

-cd ui && pnpm install && pnpm check && pnpm test:unit && pnpm build  # the UI
+cd ui && pnpm install && pnpm check && pnpm test:unit && pnpm build  # the UI (Stage 7+)
 pnpm start                      # UI mock mode: lobby -> game, no backend
-cd renderer && pnpm install && pnpm test  # image-render sidecar (bundles ui/src/lib/gameimage.ts, skia smoke)

-docker build --build-arg DICT_VERSION=v1.3.0 -f backend/Dockerfile -t scrabble-backend .  # DICT_VERSION required (no default); gateway embeds the SPA
+docker build -f backend/Dockerfile -t scrabble-backend .   # images (Stage 16); gateway embeds the SPA
 docker build -f gateway/Dockerfile --target gateway -t scrabble-gateway .
-docker build -f gateway/Dockerfile --target landing -t scrabble-landing .  # static landing
+docker build -f gateway/Dockerfile --target landing -t scrabble-landing .  # static landing (R3)
 docker compose -f deploy/docker-compose.yml config         # validate the full contour
 ```

-The `ui` module is a Node project (pnpm), **not** in `go.work`; it is the `ui` job of
-the single `.gitea/workflows/ci.yaml`. Committed edge codegen under `ui/src/gen/`
+The `ui` module is a Node project (pnpm), **not** in `go.work`; it is the `ui` job
+of the single `.gitea/workflows/ci.yaml` (Stage 16 folded the former go-unit /
+integration / ui-test workflows into it). Committed edge codegen under `ui/src/gen/`
 (regenerate with `pnpm codegen`); pnpm build-script approval lives in
 `ui/pnpm-workspace.yaml` (`allowBuilds: esbuild: true`).
@@ -0,0 +1,548 @@
+# Pre-release plan — hardening before Stage 18
+
+Living tracker for the pre-release hardening pass that runs **before Stage 18** (the
+prod cutover). Same discipline as [`PLAN.md`](PLAN.md): one phase per session,
+**interview the owner on the open details** at the start of each phase, bake every
+decision back into `PLAN.md` / `docs/` / the affected `README`s / Go Doc comments in
+the **same** PR, get CI green, then mark the phase done. Phases run as
+`feature/* → development` PRs (the Stage 16 branch model); the owner approves+merges.
+
+**Why now:** the system is feature-complete through Stage 17 and the test contour is
+green, but there is **no prod data yet** — schema, wire labels and the dictionary
+layout can still change for free. These phases spend that one-time freedom and harden
+the edge before prod. Each phase maps back to the owner's raw pre-release TODO list
+(numbers in the tracker).
+
+## Phase tracker
+
+| # | Phase | Raw TODOs | Status |
+|---|-------|-----------|--------|
+| R1 | Schema & naming reset | 1 + 10 | **done** |
+| R2 | Stress harness + contour observability + early run | 9a | **done** |
+| R3 | Edge hardening | 2 + 8 + 3 | **done** |
+| R4 | Push enrichment + kill the last poll | 4 + 5 | **done** |
+| R5 | Bundle slimming | 6 | **done** |
+| R6 | Refactor + docs reconciliation + de-staging | 7 | **done** |
+| R7 | Final stress run + tuning | 9b | **done** |
+| UI | Tab-bar navigation redesign (drop the hamburger) | owner ad-hoc | **done** |
+| MW | "Multiple words per turn" rule for Russian games (engine v1.1.0) | owner ad-hoc | **done** |
+| MW2 | Single-word rule connectivity fix: the word must run along its own line through an existing tile (perpendicular-only contact no longer connects); single-tile direction picks the best legal word (engine v1.1.1) | owner ad-hoc | **done** |
+| MW3 | Graceful replay degradation: a game whose journalled move became illegal under MW2 is closed as a draw (`end_reason='aborted'`) on open instead of erroring, with an impersonal organizer note in the history + GCG (migration `00002`) | owner ad-hoc | **done** |
+| OW | Open auto-match: enter the game at once and wait inside it (robot after 90–180 s) | owner ad-hoc | **done** |
+| DA | Dictionary admin: online release-archive upload → word-diff preview → install/activate; versioned dict volume; active version persisted in DB; resident label = release tag | owner ad-hoc | **done** |
+| AB | Manual account block (admin suspension): permanent/temporary with an editable en+ru reason picklist; a block forfeits the player's active games + cancels their open ones; a backend gate refuses a blocked account with **403 `account_blocked`**; the UI shows a terminal blocked screen and stops all push/poll; manual unblock; temporary blocks self-expire (migration `00003`) | owner ad-hoc | **done** |
+| AI | Honest AI opponent in quick game: an explicit 🤖 AI / 👤 random selector (AI default); the robot is seated and moves at once; 7-day inactivity loss (the per-turn timeout reused); chat/nudge disabled, no statistics; the opponent is shown as 🤖 everywhere | owner ad-hoc | **done** |
+| AD | Advertising banner ("ad network"): server-driven weighted campaigns (percent weight + validity window; the perpetual default fills the remainder up to 100%), bilingual messages shown by bot (`service_language`); eligibility = free account + empty hint wallet + no `no_banner` role (guests included); the resolved feed rides `profile.get` with a `notify` `banner` re-poll on eligibility change; `/_gm/banners` admin + global display timings; client smooth-weighted-round-robin rotation + fade-out/gap/fade-in UX. A single `app.load` bootstrap aggregator was considered and **deferred** (see ARCHITECTURE §10). | owner ad-hoc | **done** (PR1 backend+admin, PR2 UI rotation) |
+| GL | Simultaneous quick-game cap (10): grey "New Game" + a lobby notice at the cap; backend gate on quick enqueue + invitation creation (409 `game_limit_reached`), accepting invitations exempt; `at_game_limit` rides `games.list` | owner ad-hoc | **done** |
+| CR | In-game chat read receipts: per-message `unread_seats` bitmask (migration `00008`); a per-viewer unread **dot** in the lobby + game header (a nudge counts and clears when its recipient moves); reading = opening the move history (the 💬 fade-blinks twice) or the chat, acked (`chat.read`) only when unread; `chat_read_duration` + `chat_unread_messages` metrics + tracing + the **Scrabble — Messages** Grafana dashboard (follow-up PR); a message to a disguised robot opponent is born read; admin unread-only filter / read column / per-seat read card | owner ad-hoc | **done** |
+| → | Stage 18 — prod contour deploy | — | see [`PLAN.md`](PLAN.md) |
+
+## Key findings (these reshaped the raw list — read before starting a phase)
+
+- **R1 (TODO 1 + 10) is one cheap moment, now.** Squashing the 12 goose migrations is
+  safe precisely because there is no prod data and the contour DB is wiped. Folding the
+  new variant labels (`scrabble_ru`/`scrabble_en`/`erudit_ru`) into that single baseline
+  makes the rename need **no data migration and no back-compat mapping**. Today's labels
+  (`english`/`russian_scrabble`/`erudit`) are persisted in `games.variant`,
+  `game_invitations.variant`, in `pkg/fbs` and the UI — ~100 files, but a mechanical sweep
+  on a clean DB.
+- **R4 (TODO 4 + 5): the app is already push-first.** Game state refreshes on
+  `your_turn`/`opponent_moved`, the lobby on `notify`, chat on `chat_message`. The **only**
+  genuine periodic server poll is `lobby.poll` (matchmaking, 2.5 s,
+  `ui/src/screens/NewGame.svelte`). What remains is killing that one poll **and** enriching
+  push events to carry payloads so the UI stops re-fetching after each signal.
+- **R3 (TODO 2): identity forgery is already mitigated.** Identity is always derived from
+  the session (`Authorization: Bearer` → `X-User-ID`); the client cannot inject identity,
+  the backend re-validates resource ownership, Telegram initData is HMAC-checked. The real
+  gaps are a missing **request-body size limit** (cheap DoS) and **invisible rate-limit
+  rejections** (no log/metric/admin view — that is TODO 8). Static landing serving is **not**
+  covered by the gateway token bucket (it only guards `Execute`).
+- **R6 (TODO 7) scale:** ~431 `Stage N` references across ~104 files (incl. the file name
+  `backend/internal/inttest/stage6_test.go`). Code is the source of truth; `docs/` describe
+  current state; `PLAN.md` keeps the decision history.
+
+## Locked decisions (owner interview)
+
+- **Stress test (TODO 9):** **early + final** runs. Driver = **edge protocol** (Connect/FB
+  through the gateway, moves generated by the solver) **plus a separate gateway-hammer**
+  saturation test. Pacing = **realistic (under limits) + saturation (ramp to the knee)**.
+  Resource metrics = **add cAdvisor + postgres_exporter to the contour** (today only
+  Go-runtime metrics exist). The harness stays in the repo for repeats.
+- **Push (TODO 4 + 5):** **both** — kill `lobby.poll` (use the existing `match_found`, keep
+  poll as the ws-down fallback) **and** enrich push events with payloads.
+- **Refactor (TODO 7):** **hygiene + structural changes by a reviewed list** —
+  behaviour-preserving, test-gated, contentious items surfaced to the owner before applying.
+- **Landing (TODO 3):** **separate static container** behind the project caddy
+  (`/` → landing, `/app/` + `/telegram/` → gateway); drop `landing.html` from the gateway
+  `go:embed`.
+- **Rate-abuse (TODO 8):** metric + Grafana + admin view **plus a conservative auto-flag** —
+  a *soft, reversible* "suspected high-rate" marker for operator review, tunable threshold,
+  **no auto-ban**.
+- **Open auto-match (owner ad-hoc):** a quick game **enters a real game at once and waits inside
+  it** (status `open`, the opponent seat empty); a second human searching the same variant+rule
+  joins it, or a robot fills it after a **90 s + random 0–90 s** wait, pushing the in-app
+  **opponent_joined** event. While open, the starter may move on their turn but resign, chat and
+  nudge are disabled, and the lobby + opponent card read "searching for opponent". Matchmaking is
+  now **DB-backed open games** — the in-memory pool, `lobby.poll` and `lobby.cancel` are gone. The
+  schema is edited in the baseline (no prod data); `game_players.account_id` is nullable for the
+  empty seat.
+
+## Phases
+
+Each phase: read this tracker + the relevant `docs/`, **interview the owner on the open
+details below**, implement within scope, then update the tracker + docs/code and get CI
+green before marking it done.
+
+### R1 — Schema & naming reset *(TODO 1 + 10)* — first
+Squash `backend/internal/postgres/migrations/00001..00012` into one `00001_baseline.sql`
+(method: `pg_dump --schema-only` from a fully-migrated DB → wrap as the goose baseline →
+prove a fresh migrate yields a schema identical to the 12-migration chain via the
+integration suite → delete the old files; keep goose). Bake the new variant labels into the
+baseline. Propagate `scrabble_ru`/`scrabble_en`/`erudit_ru` through the backend
+(`engine.Variant`/`ParseVariant`, `registry.dictFiles`, the CHECK values), the wire
+(`pkg/fbs` `variant:string`, regenerate FB) and the UI (`lib/model.ts` union, `variants.ts`,
+fixtures, premium/alphabet keys, tests); i18n display keys stay display-only. Tidy
+`../scrabble-dictionary` to a single source→dawg build point and align the dawg artifact
+names to the new labels (crosses into `../scrabble-solver`'s committed fixtures — keep them
+byte-identical). After merge, **wipe the contour DB** (drop the volume) so it re-provisions
+on the next deploy.
+- Critical files: `backend/internal/postgres/migrations/`,
+  `backend/internal/engine/{engine,registry}.go`, `pkg/fbs/scrabble.fbs`,
+  `ui/src/lib/{model,variants}.ts`, `../scrabble-dictionary/{Makefile,cmd/builddict,…}`.
+- Open details to interview: the exact dawg filename scheme; whether the dict-repo tidy is
+  one PR or split; how to script the contour DB wipe in the deploy.
+
+### R2 — Stress harness + contour observability + early run *(TODO 9, part 1)*
+Build the reusable load harness as a new `loadtest` module in `go.work` (reuses `pkg/fbs`,
+`connect-go`, and `scrabble-solver` for legal-move generation): a seeder that inserts
+**1000 guest + 10000 durable** accounts with pre-created sessions (token hashes) directly in
+the DB and hands the plaintext tokens to the client; a driver that runs N virtual users,
+each in 3–5 concurrent 2–4-player games, exercising submit-play / pass / exchange / nudge /
+chat / check-word / draft-move / profile-save through the **edge protocol**, in
+**realistic** (under rate limits) and **saturation** (ramp) modes; plus a separate
+**gateway-hammer** that deliberately exceeds limits to verify the limiter holds and measure
+its cost. Add **cAdvisor + postgres_exporter** to `deploy/docker-compose.yml` and a Grafana
+resource dashboard. Run the **early pass** against the freshly-wiped contour; produce a
+**trip report** (logic/concurrency bugs + a resource baseline) that feeds R3 and R6.
+- Critical files: new `loadtest/`, `deploy/docker-compose.yml`, `deploy/observability/*`,
+  `docs/TESTING.md`.
+- Open details: the scale ramp steps; the move-selection policy (a mid-ranked solver move
+  for realistic game progress); run duration; the pass/fail bar.
+
+### R3 — Edge hardening *(TODO 2 + 8 + 3)*
+Add a **request-body size cap** at the gateway h2c mux / `Execute` (e.g. ~1 MB). Add
+**rate-limit observability**: a `gateway_rate_limited_total{class}` counter + a structured
+log per rejection; an **aggregate** Grafana panel (request rate + rejection rate — spikes
+visible without per-user label cardinality, honouring the Stage 12/17 discipline); an
+**admin-console view** of recently throttled users/IPs (in-memory ring buffer, single-
+instance, reset-on-restart, like the `active_users` gauge). Add the **conservative
+auto-flag**: when a user is *sustained*-throttled past a tunable threshold, set a soft,
+reversible `account.flagged_high_rate_at` marker (baked into the R1 baseline) surfaced in the
+admin user list/detail — **no auto-ban**; the operator clears it. Split the **landing** into
+its own static container (`deploy/` + a Caddyfile route `/` → landing) and drop
+`landing.html` from the gateway `go:embed`.
+- Critical files: `gateway/internal/connectsrv/server.go`, `gateway/internal/ratelimit/`,
+  `gateway/internal/connectsrv/metrics.go`, `backend/internal/adminconsole/`,
+  `deploy/caddy/Caddyfile`, `deploy/docker-compose.yml`, `gateway/internal/webui/`.
+- Open details: the auto-flag threshold/window + whether the marker is persisted vs
+  in-memory; the landing image base (caddy vs nginx).
+
+### R4 — Push enrichment + kill the last poll *(TODO 4 + 5)*
+Replace `lobby.poll` with the existing `match_found` push (keep the poll as a ws-down
+fallback). Enrich `your_turn`/`opponent_moved`/`notify` to carry the state payload so the UI
+renders from the event without a follow-up `game.state` (removes the lobby↔game nav latency
+the owner noticed). Wire-contract change: `pkg/fbs` event payloads → backend `notify` emit →
+UI stream consumers (`ui/src/lib/app.svelte.ts`), with the per-game cache as the landing
+spot; regenerate FB.
+- Critical files: `pkg/fbs/scrabble.fbs`, `backend/internal/notify/events.go`,
+  `ui/src/lib/{app.svelte,transport}.ts`, `ui/src/screens/NewGame.svelte`.
+- Open details: which events carry full vs delta payloads; the fallback-poll cadence when the
+  stream is down.
+
+### R5 — Bundle slimming *(TODO 6)* — done
+Analysed the bundle against the 100 KB-gzip budget; **no code slimming was warranted**, and the
+budget metric was retargeted to measure the app correctly. The build already minifies +
+tree-shakes; the dominant cost is the Connect/FlatBuffers transport runtime + generated bindings
+ the Svelte runtime (≈⅔ of `main`'s source is third-party/generated) — irreducible within scope.
+**Lazy-loading was rejected**: `bundle-size.mjs` sums every emitted chunk, so code-splitting yields
+no total-size win and adds request latency (+N gateway fetches on first navigation to a split
+screen). i18n lazy-load was skipped (the catalogs are a sliver of a Svelte-runtime-dominated shared
+chunk, and `en` must stay bundled as the `MessageKey` type source + fallback). Instead,
+`bundle-size.mjs` now measures **per HTML entry**, with three independent gates on the natural chunk
+boundaries — **app entry ≤ 100 KB, the Svelte+i18n shared chunk ≤ 30 KB, the landing's own chunk
+≤ 5 KB** — since the app's real payload is its entry chunk plus the shared chunk (≈97 KB), while the
+landing (≈24 KB) is reported separately and kept minimal. Same CLI + exit-code contract, so the CI
+step is unchanged.
+- Critical files: `ui/scripts/bundle-size.mjs`; no app code changed.
+
+### R6 — Refactor + docs reconciliation + de-staging *(TODO 7)* — done
+Behaviour-preserving only. Three separable, separately-committed passes: (a) mechanical
+**de-staging** — remove `Stage N`/`TODO-N` references from code, comments and service
+READMEs (rename `stage6_test.go`); (b) **docs↔code reconciliation** — reconcile
+`docs/ARCHITECTURE.md` / `docs/FUNCTIONAL.md`(+`_ru`) against the code-as-truth, fixing drift
+and Go Doc comments; (c) **structural changes by a reviewed list** — surface a list of
+proposed optimizations / test-suite consolidations to the owner, apply only the approved,
+behaviour-preserving, test-gated ones. The full suite + the final stress run (R7) are the
+regression gate. Incorporates the early-run (R2) bug fixes not already shipped.
+- Open details: the structural-changes list itself (owner-approved before applying); the test
+  consolidation targets.
+
+### R7 — Final stress run + tuning *(TODO 9, part 2)* — done
+Re-run the R2 harness against the final, refactored system on a clean contour; analyse
+resource consumption across **all** components (gateway, backend, Postgres, the
+metrics/observability stack, docker log volume) and agree the tuning (pool sizes, rate
+limits, cache TTLs, container limits, GOMAXPROCS, log levels). Apply the agreed tuning; record
+the methodology + results in the repo.
+
+→ **Stage 18** (prod contour) then proceeds per [`PLAN.md`](PLAN.md).
+
+## Sequencing rationale
+
+`R1` first (cheapest now; everything builds on the final schema/naming and the stress test
+must run against it). `R2` builds the harness and runs the **early** pass to surface bugs and
+a resource baseline that feed `R3` and `R6`. `R3`/`R4`/`R5` harden and improve the system.
+`R6` (de-stage + reconcile + structural) runs near the end so it sweeps settled code once and
+benefits from all accumulated bug knowledge. `R7` validates the final system and tunes it.
+Then Stage 18.
+
+## Regression-safety discipline (cross-cutting)
+
+- Every phase is a `feature/* → development` PR; CI (`unit` + `integration` + `ui` behind the
+  `CI / gate` check) must be green before the owner merges; watch the post-merge contour
+  deploy with `gitea-ci-watch.py`.
+- `R6` structural changes are behaviour-preserving, test-gated, and split from the mechanical
+  sweeps; contentious items are owner-approved first.
+- The two stress runs (`R2` early, `R7` final) are the system-level regression gate.
+
+## Verification (per phase)
+
+- `go build ./<module>/...`, `go vet`, `gofmt -l .` clean, `go test -count=1 ./<module>/...`;
+  UI: `pnpm check && pnpm test:unit && pnpm build`; the integration suite
+  (`-tags integration`) for DB/schema changes; `docker compose config` for deploy changes;
+  green CI on the PR + a healthy contour deploy.
+- `R1`: prove the squashed baseline yields a schema identical to the 12-migration chain
+  (integration suite on a fresh DB) **before** deleting the old files.
+- `R2`/`R7`: the harness runs end-to-end against the contour; the trip report lists concrete
+  defects + a resource profile from the Grafana cAdvisor/postgres_exporter panels.
+
+## Refinements logged during implementation
+
+- **R1** (interview + implementation):
+  - **Variant labels** `english`/`russian_scrabble`/`erudit` → **`scrabble_en`/`scrabble_ru`/`erudit_ru`**
+    across the backend (`engine.Variant.String`/`ParseVariant`; the `games`/`game_invitations` `variant`
+    CHECK in the baseline; GCG `#lexicon` and the `variant` metric attribute both flow from `String`),
+    the wire (`pkg/fbs` `variant` is a `string` field — values change with **no FlatBuffers regen**) and
+    the UI (`model.ts` union, `variants.ts` records, `codec`/`premiums`/mocks/tests, the admin
+    `dictionary.gohtml`). **Kept:** the Go enum identifiers (`VariantEnglish`…, internal) and the i18n
+    display keys (`new.english`/`new.russian`/`new.erudit`, display-only). `complaints.variant` stays
+    free-text (no CHECK, as before).
+  - **dawg filenames kept descriptive** (`en_sowpods`/`ru_scrabble`/`ru_erudit`) — only the registry's
+    `Variant` key carries the rename, so `registry.go`, the published `scrabble-solver` fixtures and the
+    dictionary release artifact are untouched (decouples the three repos).
+  - **Migrations squashed** 12 → one hand-written `00001_baseline.sql`. Verified by a
+    `pg_dump --schema-only` diff (the chain vs the baseline are **identical** but for the two intended
+    variant-CHECK values) plus the green integration suite. **No data migration** (no production data).
+  - **Done (cross-repo + contour):** the **`scrabble-dictionary` tidy** merged (PR #2) and was re-cut as
+    the **byte-identical `v1.0.1`** release for clean provenance (the backend stays on `v1.0.0` — same
+    bytes, no rewire; the backend pulls a version-pinned release artifact, not master). Post-merge the
+    contour `backend` schema was wiped (`DROP SCHEMA backend CASCADE` + restart, not a volume drop) and
+    re-migrated to the baseline — verified the new variant CHECK (`scrabble_en/scrabble_ru/erudit_ru`),
+    `games`=0 and a clean boot.
+
+- **R2** (interview + implementation):
+  - **Locked decisions:** game assembly via **invitations** (real path, no robots; not direct game-row
+    inserts); **moderate** ramp **50 → 200 → 500** at 10 min/step; **diagnostic** pass bar (no SLO gate);
+    run as a **one-shot container on `scrabble-internal`** in this PR.
+  - **Harness** = new `scrabble/loadtest` module (`use ./loadtest` + a `replace scrabble/gateway` for the
+    dot-free edge-proto import). It seeds 1000 guest + 10000 durable accounts + sessions **directly in
+    Postgres** (token hash mirrors `backend/internal/session`), drives players over the **edge protocol**,
+    generates **mid-ranked legal moves locally** with the embedded `scrabble-solver` by replaying
+    `game.history` (the edge carries no board — mirrors `engine.ReplayBoard` via the public API), and a
+    **gateway-hammer**. Compact CLI (`run` / `cleanup`), distroless Dockerfile (DAWGs baked), Go unit tests.
+  - **Adding the module broke the other images' builds** — backend/gateway/telegram Dockerfiles reduce the
+    workspace but still referenced `./loadtest` (not in their context); each now also
+    `-dropuse=./loadtest` (backend/telegram additionally `-dropreplace` the gateway replace). Caught by the
+    first deploy run; verified by building all four images.
+  - **Harness payload fixes found by the smoke pass:** the draft DTO's `rack_order` is a string (was sent
+    as `[]` → `bad_request`); the display-name validator forbids digits/colons, so the cleanup marker
+    became a letters-only `Zzloadtest` so `profile.update` resends the seeded name. `chat_not_your_turn` /
+    `nudge_own_turn` are **by-design** turn gates, correctly exercised.
+  - **Observability:** added **cAdvisor + postgres_exporter** + the **Scrabble — Resources** dashboard +
+    two Prometheus jobs. **Finding:** cAdvisor yields only the root cgroup on the contour host (separate
+    XFS `/var/lib/docker` breaks its layer-ID resolution — the existing galaxy deploy has the same limit),
+    so per-container CPU/RSS for the early pass was captured via `docker stats`. **R7:** adopt the otelcol
+    `docker_stats` receiver (already the contrib image) for per-container metrics in Grafana.
+  - **Early run (2026-06-09):** ramped clean to 500 players, no crash/deadlock, cleanup removed all 11000
+    accounts. 1.2 M edge calls, 48 870 plays, 2 798 games finished; the per-user limiter held under the
+    hammer (99.97 % rejected, p99 2 ms). **Top finding:** ~14 % `transport_error` on `game.state` at 500
+    players, under CPU saturation (backend/gateway/Postgres each ~1 core) and amplified by the harness's
+    single shared `http2.Transport`; the harness itself peaked at 86 % of a core on the same host, so the
+    figures are pessimistic. Full trip report in [`../loadtest/REPORT-R2.md`](../loadtest/REPORT-R2.md);
+    it feeds R3 (h2c `MaxConcurrentStreams`/timeouts, body-size cap), R6 and R7 (per-player transports,
+    separate hardware, pool/limit sizing).
+  - **CI:** `./loadtest/...` added to the path filter + vet/build/test; `go.work.sum` carries the new deps.
+
+- **R3** (interview + implementation):
+  - **Locked decisions:** the flag column lands by **editing the R1 baseline** (+ a contour schema
+    wipe after merge — no migration chain accrues before prod); auto-flag defaults **1000 rejected /
+    10 min** (`BACKEND_HIGHRATE_FLAG_THRESHOLD`/`_WINDOW`, rolling window, set-once, operator clears,
+    no auto-ban); landing image = **caddy:2-alpine**; throttle data flows **gateway → backend** (a
+    30 s per-key summary POST to the new `/api/v1/internal/ratelimit/report`, the existing trusted
+    direction) with the episode window + flag rule in the backend (`internal/ratewatch`); rejection
+    logging = **Warn summary per key per window + Debug per rejection** — a deliberate deviation from
+    the phase's "structured log per rejection" (the R2 hammer would have logged ~522k lines in
+    minutes); all three R2-report tails included (explicit h2c sizing, the session-resolve failure
+    cause at Warn, reviving the admin limiter).
+  - **Body cap:** `GATEWAY_MAX_BODY_BYTES` (default 1 MiB) as both the Connect per-message read limit
+    and an `http.MaxBytesReader` wrap of the public mux; an oversized Execute is `resource_exhausted`.
+  - **Dead config found:** `AdminPerMinute`/`AdminBurst` were never wired — the gateway `/_gm` mount is
+    now 429-guarded per IP ahead of its Basic-Auth. The caddy-fronted contour path stays unlimited
+    (stock caddy has no limiter) — an accepted gap, recorded in `docs/ARCHITECTURE.md` §12.
+  - **Landing split:** a `landing` target in `gateway/Dockerfile` (the UI build stage is shared;
+    identical compose build args keep it one cached build); the gateway drops `landing.html` from the
+    embed and 308-redirects `/` → `/app/`; the contour caddy routes `/app/`, `/telegram/` and the
+    Connect path to the gateway and the catch-all to the landing container; the CI deploy probe now
+    checks both `/` (landing) and `/app/` (gateway).
+  - **Observability:** `gateway_rate_limited_total{class}` (user/public/email/admin, aggregate-only)
+    + a rate-vs-rejections panel on the Edge/UX dashboard; the admin console gains the **Throttled**
+    page (the in-memory episode window, reset-on-restart like `active_users`, plus the flagged-account
+    queue) and the flag badge / clear action on the user list / card.
+  - The jet regen also restored the previously missing `game_drafts`/`game_hidden` generated models
+    (their tables were added after the last jetgen run; no behaviour change).
+
+- **R4** (interview + implementation):
+  - **Locked decisions:** **delta-first**, not full snapshots — an event carries only the new move and
+    the UI applies it to its per-game cache, keyed on `move_count` (idempotent + gap-safe: a gap or the
+    actor's own move falls back to a `game.state` + `game.history` refetch). `match_found` /
+    `game_started` carry the recipient's **initial `StateView`** (instant lobby→game); the fallback
+    refetch stays the existing two calls (no merged endpoint); the matchmaking poll runs **only while
+    the stream is down** (2.5 s); **all** UI-state-changing events carry their payload (incl. lobby `notify`).
+  - **Enriched events** (`pkg/fbs` trailing fields — backward-compatible, no FB regen of *values*, only
+    the schema): `opponent_moved` (+`move`/`game`/`bag_len`), `your_turn` (+`move_count`), `match_found`
+    (+`state`), `game_over` (+`game`), `notify` (+`account`/`invitation`/`state`). The pre-R4
+    `opponent_moved` scalars (`seat`/`action`/`score`/`total`) stay for wire back-compat, now redundant
+    with `move`/`game` — slated for the R6 de-stage.
+  - **Encoding placement:** the `notify` package keeps ownership of the FlatBuffers encoding (a new
+    `encode.go` mirrors the gateway transcode but reads wire-agnostic `notify.*` input structs +
+    `engine.MoveRecord`); the game/lobby/social services map their domain types to those structs, so the
+    wire schema stays out of the domain. **Flagged for R6:** this partly duplicates the gateway encoders
+    (different source types) — a candidate consolidation.
+  - **Actor self-fetch killed too** (beyond literal "push"): the `submit_play`/`pass`/`exchange`/`resign`
+    **response** (`MoveResult`) now returns the actor's refilled rack + bag size, so the mover renders the
+    next turn from the response — `Game.svelte`'s `commit`/`pass`/`exchange`/`resign` drop their `await load()`.
+  - **`match_found` enrichment** needs a per-seat initial state: `lobby.GameCreator` gained `InitialState`,
+    and `game.Service.InitialState` builds the `notify.PlayerState` (rack re-encoded to wire indices, the
+    variant alphabet embedded for a first-seen variant).
+  - **UI:** a pure `lib/gamedelta.ts` reducer (`applyMoveDelta` / `applyGameOver` / `seedInitialState`,
+    unit-tested) advances the cache; `app.svelte` seeds it on `match_found` / `game_started`; `Game.svelte`
+    applies the delta (falling back to `load()` while composing, on a gap, or on its own move's new rack);
+    `NewGame.svelte` polls only when `app.streamAlive` is false and guards its teardown so a push-delivered
+    match is not cancelled.
+  - **notify (friends/invitations) scope:** the backend carries the full account / invitation payload on the
+    wire (per "all events → push"); the UI seeds the game cache from `game_started` but keeps its lightweight
+    **authoritative** badge refresh (`refreshNotifications`, on the rare `notify` event + on foreground) rather
+    than adding client-side friend/invitation caches — the per-move hot path is fully de-fetched, which was the
+    goal. Deeper lobby-cache consumption is an easy follow-up.
+  - **No schema change** (no migration); the contour needs no DB wipe. Tests: `notify` FB round-trips +
+    `emitMove` delta + the `gamedelta` reducer; the e2e mock now emits the enriched delta.
+
+- **R5** (interview + implementation):
+  - **No code slimming — by analysis.** A gzip measure + sourcemap attribution of the real `dist` showed
+    the app bundle is already minified + tree-shaken and dominated by the Connect/FlatBuffers transport
+    runtime + generated FB/PB bindings (≈⅔ of `main`'s source) and the Svelte runtime — all
+    third-party/generated, irreducible within R5's scope. App-authored code carries no hand-trimmable fat.
+  - **Lazy-load rejected** (screens *and* i18n): `bundle-size.mjs` sums every emitted chunk, so
+    code-splitting moves bytes between chunks for **zero total-size win** while adding request latency (+N
+    gateway fetches on first navigation to a split screen). i18n lazy-load additionally buys ≤3 KB (en-only
+    users) at the cost of an async `t()`, and `en` must stay bundled (it is the `MessageKey` type source +
+    fallback). **Chunk-collapsing rejected** too — keeping the near-static Svelte runtime in its own
+    cacheable chunk is the recommended practice (an app deploy then re-busts only `main`, not the runtime),
+    and HTTP/2 makes the extra preload request negligible.
+  - **Metric retargeted to the app.** The two-entry build (`index.html` app + `landing.html`) makes Rollup
+    hoist the code shared by both (Svelte runtime + i18n + `aboutContent`) into one preloaded chunk, so the
+    app actually loads its entry chunk **+ the shared chunk** (≈74 + ≈23 = **≈97 KB**), never `landing.js`
+    (≈1.6 KB). The old script summed all three chunks (98.8 KB), over-counting the app by `landing.js`.
+    `bundle-size.mjs` now parses each built HTML for the JS it eagerly loads and gates three parts
+    independently — **app entry ≤ 100 KB, shared (Svelte+i18n) ≤ 30 KB, landing-own ≤ 5 KB** — reporting the
+    app total (≈97) and landing total (≈24.5). Same CLI + exit-code contract, so the CI step is unchanged.
+  - **No app/source/build change** (`App.svelte`, `lib/i18n/`, `vite.config.ts` untouched); no schema
+    change, no contour wipe. The stale "~82 KB" figure was corrected in `bundle-size.mjs` and `ui/README.md`.
+
+- **R6** (interview + implementation):
+  - **Locked decisions:** apply **both** wire/code structural changes (**B** + **A**) and **only C1+C2** of
+    the test consolidation (not C3/C5); strip the `*(Stage N)*` tags from **all current-state docs**
+    (ARCHITECTURE / FUNCTIONAL+`_ru` / TESTING / UI_DESIGN), keeping PLAN.md / PRERELEASE.md / CLAUDE.md as
+    history; **split `stage6_test.go`** by domain. The `h2cMaxConcurrentStreams` sizing stays an **R7**
+    concern (tuning, not behaviour-preserving); the R2 early run forced no code fix, so nothing was carried in.
+  - **(a) De-staging:** removed the `Stage N` / `TODO-N` / `(RN)` references across code, comments, service
+    READMEs and the current-state docs, rewording narratives to present tense (no technical content lost).
+    Renamed the only stage-named identifiers (`registerStage8`→`registerSocialOps`,
+    `registerStage11`→`registerLinkOps`) and split `stage6_test.go` (`TestEmailLoginFlow`→`email_test.go`;
+    `TestGuestAutoMatchLeavesNoStats`+`provisionGuest`→`account_test.go`). De-staged the `.fbs`/`.proto`
+    comments and regenerated: only the `.proto`-derived Go docstrings (`*_grpc.pb.go`, `push.pb.go`) changed —
+    flatc strips schema comments, so the FB Go/TS bindings were untouched.
+  - **(b) Reconciliation:** the docs were accurate (each R-phase baked its own); the one drift was a stale
+    "guest-reaping deferred (TODO-3)" note in `ARCHITECTURE.md` §3 — guest reaping is implemented, so the
+    note was replaced with the current behaviour (FUNCTIONAL/TESTING already described it).
+  - **(c) B — dead `opponent_moved` scalars:** removed `seat/action/score/total` from `OpponentMovedEvent`
+    (`pkg/fbs/scrabble.fbs` + the `notify` emit + the round-trip test); regenerated FB Go + TS. No reader
+    used them (the UI codec/mock take `move`/`game`/`bag_len`; the gateway forwards the payload verbatim).
+    A pre-release wire-slot renumber — free with no prod data, no DB change.
+  - **(c) A — shared FB builders:** new `scrabble/pkg/wire` holds the single definition of the nested wire
+    tables (GameView / MoveRecord / StateView / AccountRef / Invitation) shared by the backend `notify`
+    encoder and the gateway `transcode`; both map their own source types to neutral `wire.*` structs and
+    delegate. **Honest tradeoff:** the verbose `Start/Add/End` + reverse-prepend boilerplate is now written
+    once, but the field *set* is still mapped per side, and the new package makes the change net **+~145 LOC**
+    — a single-source / anti-drift win for the fiddly mechanics rather than a line-count cut. Behaviour-
+    preserving: the two sides' field sets were verified identical and the round-trip tests pass unchanged.
+  - **(c) C1+C2 — inttest fixtures:** moved the cross-file service/game fixtures (`newGameService` was used by
+    10 files) into `backend/internal/inttest/helpers.go`; single-file helpers stay local. Pure relocation.
+  - **No schema change → no contour DB wipe.** Regression gate: the full unit + integration + UI suites plus
+    the R7 stress run.
+
+- **R7** (interview + implementation):
+  - **Locked decisions:** run the harness **same-host** (one-shot container on `scrabble-internal`, capped
+    `--cpus=3` so the contour keeps spare cores); **apply container limits + `GOMAXPROCS` now** (not just a
+    prod recommendation); **replace cAdvisor with the otelcol `docker_stats` receiver** (it resolved only the
+    root cgroup on this host); keep rate-limit / h2c knobs **compiled-in** (change values only if the data
+    demands — it did not).
+  - **Harness refinements (pre-run):** each virtual player builds its **own `edge.Client`** (its own h2c
+    connection for its Subscribe stream + Execute calls) instead of all players sharing one `http2.Transport` —
+    the R2 `transport_error` artifact; and `playTurn` now reports a **finished** game so the player drops it
+    from rotation. Effect, measured: `game.state` `transport_error` 14 % (R2) → **2.49 %**; `game_finished` on
+    chat ≈ 3 900 → **35**.
+  - **Observability:** added the `docker_stats` receiver to `otelcol` (`api_version: "1.44"` — the daemon's
+    minimum is 1.40; the receiver defaults to 1.25 and crash-looped until pinned), mounted the docker socket
+    read-only with `group_add` (the contrib image runs as UID 10001), dropped the cAdvisor service + its
+    Prometheus job, and retargeted the **Scrabble — Resources** dashboard to the docker_stats metric names
+    (`container_cpu_utilization`/100 == cores). Cross-checked against `docker stats` within sampling error.
+  - **Profile (final run, 500 players, limits in force):** the **gateway is the binding constraint** — with
+    one connection per player it bursts into its 2-core cap (the residual 2.49 % `transport_error`); backend
+    ~0.85 core and postgres ~1.4 cores had headroom; **tempo reached its 1 GiB cap**; the backend pool sat at
+    its `MaxOpenConns=25` cap (28 backends); docker logs were unbounded (~14 MiB / 30 min on the backend at
+    info). Full write-up in [`../loadtest/REPORT-R7.md`](../loadtest/REPORT-R7.md).
+  - **Round-2 tuning (owner-agreed, all in `deploy/docker-compose.yml`, no code change):** gateway **2 → 3
+    cores + `GOMAXPROCS=3`**; tempo memory **1 → 2 GiB**; backend `MAX_OPEN_CONNS` **25 → 40**; a json-file
+    **log-rotation** default (10m × 3) applied contour-wide via a YAML anchor (level stays info).
+    backend/postgres kept at 2 cores / 512 MiB (headroom is cheap on the shared host).
+  - **Validation:** the same gradual ramp on the tuned contour cut `game.state` `transport_error` to **0.72 %**
+    (gateway ~2 cores, now under the 3-core cap, no throttle; tempo ~1.27 GiB, under 2 GiB). A separate
+    **burst** run (a single 100 → 500 jump) pegged the gateway at 3 cores (≈296 % sustained, 9.27 % error),
+    confirming it is **connection-CPU-bound** — a true arrival spike is a **horizontal-scaling** lever, not
+    more cores per node (recorded in the prod-sizing recommendation).
+  - **No schema change → no contour DB wipe.** Bake-back: `loadtest/REPORT-R7.md` (new), `loadtest/README.md`,
+    `docs/TESTING.md`, the telemetry/observability section of `docs/ARCHITECTURE.md`, the repo-layout line in `CLAUDE.md`.
+
+- **UI — Tab-bar navigation redesign** (owner ad-hoc, not on the raw TODO list): drop the hamburger
+  `Menu.svelte` everywhere (it fought the Telegram-fullscreen layout, where it had to be re-centred).
+  - **Locked decisions (interview):** the in-Settings sub-nav is a **bottom TabBar with the active tab
+    highlighted** (icon-only); **Export GCG** moves to the left slot of the move-history header (free in a
+    finished game, where 🏁 *leave* does not apply); the lobby **⚙️ badge counts incoming friend requests
+    only** (invitations keep their own lobby section); unread chat is badged on **the score bar and the 💬**.
+  - **What shipped:** a ⚙️ **Settings hub** (`screens/SettingsHub.svelte`) over the existing
+    Settings/Profile/Friends/About bodies and an in-game **comms hub** (`game/CommsHub.svelte`) over
+    chat + dictionary, both with in-place tabs and a fixed back target; the game's menu items relocate into
+    the open move history (🏁 leave / 📤 export + 💬 comms header) and the player cards (🤝 add-friend); a
+    shared **TapConfirm** (`components/TapConfirm.svelte`, `lib/tapconfirm.ts`) — tap → fading ✅ → tap —
+    replaces the Skip/Hint press-and-hold popovers and drives the add-friend confirm. Fixed the move-history
+    "jump" bug (the slid board is now inert and the stage can't scroll, so a swipe up genuinely closes it).
+    `Menu.svelte` + `HoldConfirm.svelte` removed.
+  - **No schema/wire change → no contour DB wipe.** Bake-back: `docs/UI_DESIGN.md`, `docs/FUNCTIONAL.md`
+    (+`_ru`). Regression gate: UI `check` + unit (`tapconfirm`) + build + bundle budget + e2e (Chromium &
+    WebKit), all green.
+
+- **UI — Merge Exchange/Pass; drop the dead Tournaments tab** (owner ad-hoc, not on the raw TODO
+  list): the lobby's 🏆 *Tournaments* tab was an inert `lobby.soon` toast — removed (the lobby is back
+  to three tabs, matching `docs/FUNCTIONAL.md`). In-game the separate 🥺 *Skip* (pass) tab folds into
+  the 🔄 tab, now **Exchange/Pass**, whose dialog passes when no tile is selected and exchanges when
+  tiles are.
+  - **Decision — a pass is NOT an exchange of zero (verified against the rules + GCG):** the merge is
+    **UI-only**. Pass and exchange stay distinct game actions end-to-end — wire (`GameActionRequest` vs
+    `ExchangeRequest`), engine (`ActionPass` vs `ActionExchange`), and the GCG Poslfit dialect (a pass is
+    a bare `-`, an exchange is `-TILES`). The engine forbids a zero-tile exchange (`ErrNothingToExchange`)
+    and allows an exchange only with a full rack left in the bag (`ErrNotEnoughTilesToExchange`), while a
+    pass is always legal — collapsing them would lose a real distinction. The dialog dispatches the
+    existing `gateway.pass` / `gateway.exchange`.
+  - **What shipped:** `Lobby.svelte` (tab removed); `Game.svelte` (one 🔄 Exchange/Pass tab no longer
+    gated on an empty bag; the dialog disables tile selection while the bag is below a full rack
+    (`bagLen >= RACK_SIZE`), its confirm button reading **Pass without exchanging** / **Exchange N**);
+    i18n (`game.draw` → Exchange/Pass, new `game.passNoExchange`, dropped `game.skip` /
+    `lobby.tournaments` / `lobby.soon`). No backend/wire/history/GCG change.
+  - **No schema/wire change → no contour DB wipe.** Bake-back: `docs/UI_DESIGN.md`, `docs/FUNCTIONAL.md`
+    (+`_ru`). Regression gate: UI `check` + unit + build + bundle budget + e2e (Chromium & WebKit).
+
+- **AI — Honest AI opponent in quick game** (owner ad-hoc, not on the raw TODO list): a second quick-game
+  opponent the player *knowingly* chooses, distinct from the disguised robot of the random/open path
+  (which is kept as-is). New Game's quick-game mode replaces the "auto-match" subtitle with a two-button
+  selector **🤖 AI / 👤 Random player** (the `.seg`/`.opt` segmented style, AI the default); for AI the
+  move-clock line reads "Loss after 7 days of inactivity" and the "searching" hint is hidden.
+  - **Locked decisions (interview):** AI move is **event-driven** (the robot replies the instant the
+    player's move commits; the 30 s driver is the fallback); AI games **do not touch `account_stats`**
+    (practice, like guests); the **Stage 5 strength logic is reused unchanged** (`playToWin` 40 % from the
+    seed + margin band); **no per-move timeout — a 7-day inactivity loss** instead; the 7-day line lives on
+    the New Game screen (the in-game screen has no move-clock line); chat + nudge **disabled**, word-check
+    kept, add-friend never drawn, opponent shown as **🤖** everywhere.
+  - **The 7-day rule reuses the existing per-turn timeout:** an AI game is created with
+    `turn_timeout_secs = AIInactivityTimeout` (7 days) and the existing timeout sweeper resigns the overdue
+    seat — since the robot moves at once, only the human is ever on the clock, so the per-turn timeout *is*
+    the abandon rule (no new column, no new sweeper).
+  - **One game flag drives everything:** `games.vs_ai` (edited into the R1 baseline — pre-release, so a
+    contour DB wipe after merge). It is set **only** on AI-started games, so a robot-filled random game keeps
+    `vs_ai=false` and the disguised opponent is never revealed; the UI derives 🤖 / the gates **from the flag,
+    never from the opponent account**. New backend path `Matchmaker.StartVsAI` (picks a pooled robot via the
+    existing `Pick`, creates an **active** seated game via `game.Service.Create`, random seat order) — the AI
+    request never enters the open pool, so the open-game reaper never touches it. The robot driver gains a
+    `vs_ai` branch (no sleep, no proactive nudge, zero delay) and a focused `DriveGame`/`TriggerMove` fast
+    path wired from the game service's after-create/after-commit hook (`SetAITrigger`, a func value so the
+    game package never imports the robot package). Chat/nudge gated by a new `social` `VsAI` check
+    (`ErrGameVsAI` → 409 `ai_game`); statistics skipped in `commit` when `vs_ai`.
+  - **Wire:** `EnqueueRequest` += `vs_ai`, `GameView` += `vs_ai` (trailing FB fields, regenerated Go + TS),
+    threaded through the backend DTO, the gateway transcode and the `pkg/wire` + `notify` builders.
+  - **Tests:** `lobby` unit (StartVsAI seats a robot + flags the game; empty pool leaves no game); backend
+    integration (`ai_game_test.go`: active+seated+vs_ai+7-day clock, robot moves immediately, stats skipped,
+    7-day timeout resigns the human, chat/nudge rejected); UI codec round-trip (`vs_ai` on enqueue + game
+    view); e2e (an AI game shows 🤖, no "searching", chat disabled, the dictionary still works) + the
+    existing quick-match e2e updated to pick **Random player** (the default is now AI).
+  - **Schema/wire change → a contour DB wipe** after merge (`DROP SCHEMA backend CASCADE` + restart, the
+    R1/R3 pattern). Bake-back: `docs/ARCHITECTURE.md`, `docs/FUNCTIONAL.md` (+`_ru`), `docs/UI_DESIGN.md`,
+    `backend/README.md`, Go Doc comments.
+  - **Post-review refinements (owner, same PR):** (1) the **GCG export labels the robot seat "AI"** rather
+    than its human-like pool name (`ExportGCG` overrides the name via `accounts.IsRobot`; the in-app 🤖 is
+    unchanged); (2) honest-AI games **emit no `your_turn`** — the robot replies instantly, so the signal
+    would arrive with the move and be pointless; `opponent_moved` still advances the UI; (3) the **admin
+    console surfaces the AI flag** — a **🤖 column** in `/games` and an "AI game" line on the game card
+    (`GameRow`/`GameDetailView` gain `VsAI`); (4) `games_started_total` / `games_abandoned_total` gain a
+    **`vs_ai`** attribute and the Grafana *Game domain* dashboard splits started/abandoned into **human**
+    and **AI** panels.
+  - **Follow-up (separate PR — strategy deviation):** the robot now plays **≈20%** of opening/midgame moves
+    *against* its per-game `playToWin` intent (toward the opposite margin band — a winning robot eases off, a
+    losing one surges ahead), tapering linearly to **0 over the last 14 bag tiles** and **0 once the bag is
+    empty**, so the endgame follows the chosen strategy strictly while earlier outcomes can swing the human's
+    way. Deterministic from the seed (`mix(seed,"deviate",moveCount)`), applied to **both** robot paths via
+    the shared `selectMove`; the per-game intent (and the admin card) is unchanged. Tests: `robot` unit
+    (taper bounds + monotonicity, never-in-endgame, determinism, ~20% distribution). Bake-back:
+    `docs/ARCHITECTURE.md` §7, `docs/FUNCTIONAL.md` (+`_ru`), `backend/README.md`, `PLAN.md` Stage 5.
+
+- **GL — Simultaneous quick-game cap** (owner ad-hoc, not on the raw TODO list): a player may hold at
+  most **10** active quick games; at the cap the lobby greys **New Game** and shows a plain notice
+  "Вы достигли лимита одновременных партий", both clearing automatically when an active game finishes.
+  - **Locked decisions (interview):** what counts = active **+** open (searching) quick games, **including
+    AI** (`vs_ai`); friend games (invitation-linked) **never** count. The backend gate refuses **all** new-game
+    creation at the cap — `lobby/enqueue` **and** `invitations` — with **409 `game_limit_reached`**; **accepting**
+    an invitation is never gated, so friend games are capped "from the other end". Delivery = a boolean
+    **`at_game_limit`** on the existing `games.list` (no per-event payload: a turn change does not move the count,
+    and the lobby already re-fetches `games.list` on entry + every game event); the first uncached lobby frame
+    defaults the button **enabled** (the backend gate is the authority).
+  - **What shipped:** `game.MaxActiveQuickGames` + `Store/Service.CountActiveQuickGames` (active/open seats, no
+    `game_invitations` row; hidden games still count → a dedicated count, not a filter over the lobby list);
+    `Server.atGameLimit`/`ensureUnderGameLimit` gating `handleEnqueue` + `handleCreateInvitation`;
+    `gameListDTO.at_game_limit`; the FB `GameList` trailing `at_game_limit` (regenerated Go + TS) threaded through
+    the gateway transcode + UI codec; `lib/model` + `lobbycache` snapshot + `Lobby.svelte` (disabled tab + a muted
+    `.limit` notice); i18n `lobby.limitReached` (en authoritative + ru).
+  - **Caveat (logged):** the gate is a pre-check, not transaction-atomic — concurrent creates from one account could
+    momentarily exceed by 1–2 (harmless soft cap; the UI disables the button regardless). Strict atomicity was judged
+    a disproportionate diff across the two create paths.
+  - **No schema change → no contour DB wipe** (only a trailing FB field, no migration). Tests: backend integration
+    (`game_limit_test.go`: count rule + HTTP gate 409 + accept bypass), server unit (error mapping), gateway
+    transcode round-trip, UI codec + lobbycache unit, e2e (`gamelimit.spec.ts`). Bake-back: `docs/FUNCTIONAL.md`
+    (+`_ru`), `docs/ARCHITECTURE.md` §8, `docs/UI_DESIGN.md`, `backend/README.md`.
@@ -22,8 +22,9 @@ supports English Scrabble, Russian Scrabble and Эрудит.
  security, cross-service contracts.
 - [`docs/FUNCTIONAL.md`](docs/FUNCTIONAL.md) (+ [`_ru`](docs/FUNCTIONAL_ru.md)) —
  per-domain user stories.
- [`docs/TESTING.md`](docs/TESTING.md) — test layers and the CI gate.
- [`CLAUDE.md`](CLAUDE.md) — project guide and development workflow.
+- [`docs/TESTING.md`](docs/TESTING.md) — test layers and the per-stage CI gate.
+- [`PLAN.md`](PLAN.md) — the staged implementation plan and stage tracker.
+- [`CLAUDE.md`](CLAUDE.md) — project guide and the mandatory per-stage workflow.

 ## Build & test

@@ -89,7 +90,7 @@ observability stack (OTel Collector → Prometheus + Tempo → Grafana) + a fron
 services build from multi-stage distroless `*/Dockerfile`.

 ```sh
-docker build --build-arg DICT_VERSION=v1.3.0 -f backend/Dockerfile -t scrabble-backend .  # DICT_VERSION required; pulls that DAWG release artifact
+docker build -f backend/Dockerfile -t scrabble-backend .   # pulls the DAWG release artifact
 docker build -f gateway/Dockerfile -t scrabble-gateway .   # node stage builds + embeds the UI
 docker compose -f deploy/docker-compose.yml config         # validate (needs the TEST_/PROD_ env)
 ```
@@ -1,41 +0,0 @@
-# Erudit — site icons + Open Graph card
-
-The favicon set and the `og:image` link-preview card for the public landing
-(`ui/landing.html`) and the SPA shell (`ui/index.html`). Same design language as the
-[VK loading-screen logo](../vk/README.md): the wooden Erudit «Э» tile (score `8`),
-with the wordmark on the app's dark board green (`ui/src/app.css` tokens).
-
-| Output (committed to `ui/public/`) | Purpose |
-|------|---------|
-| `favicon.svg` | Vector favicon, transparent; tile + «Э» only (the score is illegible below ~32 px). |
-| `favicon.ico` | 32×32 PNG-in-ICO fallback (also answers the browsers' blind `/favicon.ico` probe). |
-| `apple-touch-icon.png` | 180×180 opaque full-bleed tile; iOS masks its own corners. |
-| `og-image.png` | 1200×630 card: tile + «Эрудит / Скрэббл — игра в слова». Referenced absolutely as `https://erudit-game.ru/og-image.png`. |
-
-## How it works
-
-`build/extract.js` extracts the needed glyph outlines (tile glyphs + every wordmark
-character) from LiberationSans (Arial-metric, the game's font stack) with their
-advance widths into `build/glyphs.json` (committed). `build/generate.js` composes
-plain SVG from those outlines — no font is needed at generation time — writes
-`favicon.svg` and rasterises the PNG/ICO outputs by screenshotting the SVGs with the
-`ui` package's Playwright chromium (`@playwright/test`); the `.ico` container is
-assembled in-script (a single PNG entry). Raster bytes therefore depend on the
-installed chromium version; the SVG sources are deterministic.
-
-## Regenerate
-
-Requirements: Node ≥ 18, `ui` installed (`pnpm install`, provides Playwright).
-`extract.js` additionally needs `opentype.js` (`npm i opentype.js`); **`generate.js`
-needs no extra packages**.
-
-```sh
-cd assets/icons
-
-# 1. (optional) re-extract the glyphs — only if the font or the wordmark changes:
-#    default font: /usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf
-node build/extract.js [/path/to/font.ttf]      # -> build/glyphs.json
-
-# 2. regenerate everything in ui/public/:
-node build/generate.js
-```
@@ -1,78 +0,0 @@
-'use strict';
-// Extract the glyph outlines the site icons and the og-image wordmark need from a
-// grotesque font (LiberationSans = Arial-metric, matching the game's system-ui/Arial
-// stack) and emit cubic-bezier contours per character, baseline at y=0, y-down,
-// plus the advance width so generate.js can lay out words without the font.
-// Same outline conversion as ../../vk/build/extract.js, generalised to a char set.
-const opentype = require('opentype.js');
-const fs = require('fs');
-
-const FONT = process.argv[2] || '/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf';
-const b = fs.readFileSync(FONT);
-const font = opentype.parse(b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength));
-const FS = 1000; // em scale
-
-// The tile glyphs («Э», «8») + every character of the og-image wordmark lines
-// («Эрудит», «Скрэббл — игра в слова»). The space carries only an advance.
-const CHARS = [...new Set('Э8рудитСкэббл—игра в слова')];
-
-function glyphData(ch) {
-  const g = font.charToGlyph(ch);
-  const p = g.getPath(0, 0, FS); // baseline at y=0, y-down
-  const contours = [];
-  let cur = null, prev = null;
-  for (const c of p.commands) {
-    if (c.type === 'M') {
-      if (cur) contours.push(cur);
-      cur = [{ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] }];
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'L') {
-      cur.push({ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'C') {
-      cur[cur.length - 1].o = [c.x1, c.y1];
-      cur.push({ v: [c.x, c.y], i: [c.x2, c.y2], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Q') {
-      const c1 = [prev.x + 2 / 3 * (c.x1 - prev.x), prev.y + 2 / 3 * (c.y1 - prev.y)];
-      const c2 = [c.x + 2 / 3 * (c.x1 - c.x), c.y + 2 / 3 * (c.y1 - c.y)];
-      cur[cur.length - 1].o = c1;
-      cur.push({ v: [c.x, c.y], i: c2, o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Z') {
-      if (cur && cur.length > 1) {
-        const last = cur[cur.length - 1], first = cur[0];
-        if (Math.hypot(last.v[0] - first.v[0], last.v[1] - first.v[1]) < 1e-3) {
-          first.i = last.i; // fold the duplicate closing point into the first
-          cur.pop();
-        }
-      }
-      if (cur) { contours.push(cur); cur = null; }
-    }
-  }
-  if (cur) contours.push(cur);
-
-  let minx = Infinity, miny = Infinity, maxx = -Infinity, maxy = -Infinity;
-  const out = contours.map(ct => {
-    const v = [], i = [], o = [];
-    ct.forEach(pt => {
-      v.push(pt.v);
-      i.push([pt.i[0] - pt.v[0], pt.i[1] - pt.v[1]]);
-      o.push([pt.o[0] - pt.v[0], pt.o[1] - pt.v[1]]);
-      minx = Math.min(minx, pt.v[0]); maxx = Math.max(maxx, pt.v[0]);
-      miny = Math.min(miny, pt.v[1]); maxy = Math.max(maxy, pt.v[1]);
-    });
-    return { i, o, v, c: true };
-  });
-  const bbox = out.length
-    ? { x: minx, y: miny, w: maxx - minx, h: maxy - miny }
-    : { x: 0, y: 0, w: 0, h: 0 }; // the space has no outline
-  return { adv: g.advanceWidth * (FS / font.unitsPerEm), bbox, contours: out };
-}
-
-const glyphs = {};
-for (const ch of CHARS) glyphs[ch] = glyphData(ch);
-
-const out = __dirname + '/glyphs.json';
-fs.writeFileSync(out, JSON.stringify({ em: FS, glyphs }));
-console.log('wrote', out, fs.statSync(out).size, 'bytes;', CHARS.length, 'glyphs:', CHARS.join(''));
@@ -1,128 +0,0 @@
-'use strict';
-// Site icons + the Open Graph card for the public landing, drawn from the same
-// design as ../../vk (the wooden Erudit tile: face «Э», score «8») and the app's
-// board palette (ui/src/app.css). Everything is composed as SVG from the committed
-// glyph outlines (build/extract.js -> glyphs.json), so no font is needed at build
-// time; the PNG/ICO rasters are screenshots taken with the ui package's Playwright
-// chromium (@playwright/test re-exports the browser API). Outputs go straight to
-// ui/public/:
-//   favicon.svg          96 viewBox, transparent, tile + «Э» (the score is illegible small)
-//   favicon.ico          32x32 PNG-in-ICO render of the same
-//   apple-touch-icon.png 180x180 opaque full-bleed tile (iOS masks its own corners)
-//   og-image.png         1200x630 card: tile + wordmark on the board green
-const fs = require('fs');
-const path = require('path');
-
-const G = JSON.parse(fs.readFileSync(path.join(__dirname, 'glyphs.json'), 'utf8'));
-const UI = path.resolve(__dirname, '../../../ui');
-const OUT = path.join(UI, 'public');
-
-// ---- palette (vk loader tile + app.css board tokens) ------------------------
-const FACE = '#D9B978', BORDER = '#B49559', GLYPH = '#1A1A1A';
-const BOARD_DARK = '#2a3330', TEXT = '#e7ece8', TEXT_MUTED = '#cdd6cf';
-
-// ---- glyph outlines -> SVG path data ----------------------------------------
-const r2 = n => Math.round(n * 100) / 100;
-// pathD renders one glyph's contours scaled by sc and translated by (tx, ty).
-function pathD(g, sc, tx, ty) {
-  const pt = (v, d) => `${r2(v[0] * sc + tx + d[0] * sc)} ${r2(v[1] * sc + ty + d[1] * sc)}`;
-  const Z = [0, 0];
-  return g.contours.map(ct => {
-    const n = ct.v.length;
-    let d = `M${pt(ct.v[0], Z)}`;
-    for (let k = 1; k <= n; k++) {
-      const a = k - 1, b = k % n;
-      d += `C${pt(ct.v[a], ct.o[a])} ${pt(ct.v[b], ct.i[b])} ${pt(ct.v[b], Z)}`;
-    }
-    return d + 'Z';
-  }).join('');
-}
-// glyphAt centres a glyph's bbox at (cx, cy) with the given pixel cap height, the
-// same placement rule as the vk loader's glyph(). stroke fattens it slightly.
-function glyphAt(ch, capPx, cx, cy, stroke, colour) {
-  const g = G.glyphs[ch], sc = capPx / g.bbox.h;
-  const d = pathD(g, sc, cx - (g.bbox.x + g.bbox.w / 2) * sc, cy - (g.bbox.y + g.bbox.h / 2) * sc);
-  return `<path d="${d}" fill="${colour}" stroke="${colour}" stroke-width="${r2(stroke)}"/>`;
-}
-// textLine lays out a string on a baseline from the per-glyph advances; capPx sets
-// the capital height (measured on «Э»). Returns the combined path + the width.
-function textLine(str, capPx, x, y, colour) {
-  const sc = capPx / G.glyphs['Э'].bbox.h;
-  let d = '', w = 0;
-  for (const ch of str) {
-    const g = G.glyphs[ch];
-    if (g.contours.length) d += pathD(g, sc, x + w, y);
-    w += g.adv * sc;
-  }
-  return { svg: `<path d="${d}" fill="${colour}"/>`, width: w };
-}
-// tile draws the rounded wooden tile centred at (cx, cy): size px wide/high, with
-// the vk loader's corner (6/52) and rim proportions, «Э» and optionally the «8».
-function tile(cx, cy, size, withScore) {
-  const h = size / 2, rx = size * (6 / 52), rim = size * (1.8 / 52);
-  let s = `<rect x="${r2(cx - h + rim / 2)}" y="${r2(cy - h + rim / 2)}" width="${r2(size - rim)}" height="${r2(size - rim)}" rx="${r2(rx)}" fill="${FACE}" stroke="${BORDER}" stroke-width="${r2(rim)}"/>`;
-  s += glyphAt('Э', size * (32 / 52), cx, cy - size * (1 / 52), size * (1 / 52), GLYPH);
-  if (withScore) s += glyphAt('8', size * (8.5 / 52), cx + size * (19.5 / 52), cy + size * (18.5 / 52), size * (0.5 / 52), GLYPH);
-  return s;
-}
-const svg = (w, h, body) => `<svg xmlns="http://www.w3.org/2000/svg" width="${w}" height="${h}" viewBox="0 0 ${w} ${h}">${body}</svg>`;
-
-// ---- favicon.svg (the committed vector master) -------------------------------
-const favicon = svg(96, 96, tile(48, 48, 88, false)) + '\n';
-
-// ---- apple-touch-icon: opaque full bleed, iOS applies its own corner mask ----
-const appleTouch = svg(180, 180,
-  `<rect width="180" height="180" fill="${FACE}"/>` +
-  `<rect x="8" y="8" width="164" height="164" rx="18" fill="none" stroke="${BORDER}" stroke-width="4"/>` +
-  glyphAt('Э', 100, 90, 88, 3, GLYPH) +
-  glyphAt('8', 26, 146, 142, 1.5, GLYPH));
-
-// ---- og-image: tile + wordmark, centred as one group on the board green ------
-function ogImage() {
-  const W = 1200, H = 630, tileSize = 340, gap = 84;
-  const l1 = textLine('Эрудит', 112, 0, 0, TEXT);
-  const l2 = textLine('Скрэббл — игра в слова', 44, 0, 0, TEXT_MUTED);
-  const textW = Math.max(l1.width, l2.width);
-  const left = (W - (tileSize + gap + textW)) / 2;
-  const tx = left + tileSize + gap;
-  // Two baselines around the vertical centre; the tile centre sits between them.
-  const b1 = 295, b2 = 408;
-  const body =
-    `<rect width="${W}" height="${H}" fill="${BOARD_DARK}"/>` +
-    tile(left + tileSize / 2, H / 2, tileSize, true) +
-    textLine('Эрудит', 112, tx, b1, TEXT).svg +
-    textLine('Скрэббл — игра в слова', 44, tx, b2, TEXT_MUTED).svg;
-  console.log(`og-image: text ${Math.round(textW)}px wide, group left ${Math.round(left)}px`);
-  return svg(W, H, body);
-}
-
-// ---- rasterisation (Playwright chromium from ui/node_modules) ----------------
-async function shoot(page, markup, w, h, transparent) {
-  await page.setViewportSize({ width: w, height: h });
-  await page.setContent(`<body style="margin:0">${markup}</body>`);
-  return page.screenshot({ omitBackground: transparent });
-}
-// icoFromPNG wraps one PNG as a single-entry .ico (ICONDIR + ICONDIRENTRY + PNG).
-function icoFromPNG(png, sizePx) {
-  const h = Buffer.alloc(22);
-  h.writeUInt16LE(0, 0); h.writeUInt16LE(1, 2); h.writeUInt16LE(1, 4); // icon, 1 image
-  h.writeUInt8(sizePx, 6); h.writeUInt8(sizePx, 7);                    // 32x32
-  h.writeUInt16LE(1, 10); h.writeUInt16LE(32, 12);                     // planes, 32bpp
-  h.writeUInt32LE(png.length, 14); h.writeUInt32LE(22, 18);            // size, offset
-  return Buffer.concat([h, png]);
-}
-
-(async () => {
-  fs.writeFileSync(path.join(OUT, 'favicon.svg'), favicon);
-  const { chromium } = require(path.join(UI, 'node_modules', '@playwright/test'));
-  const browser = await chromium.launch();
-  const page = await browser.newPage();
-  const fav32 = await shoot(page, svg(32, 32, tile(16, 16, 29.33, false)), 32, 32, true);
-  fs.writeFileSync(path.join(OUT, 'favicon.ico'), icoFromPNG(fav32, 32));
-  fs.writeFileSync(path.join(OUT, 'apple-touch-icon.png'), await shoot(page, appleTouch, 180, 180, false));
-  fs.writeFileSync(path.join(OUT, 'og-image.png'), await shoot(page, ogImage(), 1200, 630, false));
-  await browser.close();
-  for (const f of ['favicon.svg', 'favicon.ico', 'apple-touch-icon.png', 'og-image.png']) {
-    console.log('wrote', path.join(OUT, f), fs.statSync(path.join(OUT, f)).size, 'bytes');
-  }
-})();
@@ -1,115 +0,0 @@
-# Erudit — VK loading-screen logo (Lottie)
-
-Animated logo for the **VK app loading screen** (shown before the SPA assets load).
-The Erudit «Э» tile (score `8`) **drops in under gravity, lands with a soft squash —
-its left/right edges bulging into a cushion — then springs back up**, looping. A light
-"glint" is caught at the moment of the bounce.
-
-| File | Purpose |
-|------|---------|
-| `erudit-loader.json` | The Lottie to upload to VK. |
-| `erudit-loader-preview.gif` | Looping preview. Rendered on a green "baize" background **only in the preview** — the real asset has a **transparent** background. |
-| `build/` | The reproducible build pipeline (see *Regenerate*). |
-
-**VK requirements met:** 96×96 px · vector Lottie JSON · ≤ 24 KB (~11 KB) · seamless
-~1.1 s loop · transparent background.
-
-Design reference: a photo of the physical wooden Erudit tile.
-
---
-
-## How it works
-
-A single flat layer holds the tile — a rounded-rect **face path**, the two glyphs, and
-a thin border — and everything is driven by that layer's transform plus a few colour /
-shape tracks. The anchor sits on the tile's **bottom edge**, so the squash happens
-against the floor.
-
-### Bounce (gravity)
-`position.y` of the bottom edge goes apex → floor → apex with **no dwell** (the apex is
-an instantaneous turn-around). The fall uses a strong **ease-in** (accelerate) and the
-rise a strong **ease-out** (decelerate), so it reads as real gravity. While falling fast
-the tile slightly **stretches** (tall+thin); that is the squash-and-stretch setup.
-
-### Soft cushion (squash)
-On contact the layer **squashes** (scaleY↓, scaleX↑) about the bottom anchor, with a
-touch of skew. Crucially the squash/cushion is **decoupled from the fall speed** — it
-eases in and out *slowly* (`ES`), so the landing feels soft even though the fall is
-fast. The squash is deliberately gentle (≈ 86 % / 112 %).
-
-### The cushion shape (the hard part)
-The face is **not** a plain rounded rect — it is a path whose left/right contour bows
-out into a convex cushion on impact:
- the rest rounded-rect outline is sampled (fine corner arcs + edge mids), and on impact
-  every point is pushed outward by a smooth **barrel** profile `f(y) = b·(1 − (y/HH)²)`
-  (max at the middle, fading to zero at the top/bottom);
- so the **whole side — corners included — bows out as one piece**, never just the
-  straight middle;
- bezier handles are computed as a **chordal spline** (handle length ∝ the adjacent
-  chord), which stays smooth across the uneven corner/edge point spacing. This is what
-  keeps the corner↔cushion junction kink-free — both at rest and fully bulged — which a
-  naïve uniform Catmull-Rom (or moving discrete points with fixed tangents) does not.
-
-### Glint
-At the bounce the face flashes a little lighter (`FACE_GLINT`) and the glyphs warm
-toward brown-red (`BLACK_LIT`), then settle back. A cheap, warm "catch the light".
-
-### Border & background
-The tile carries a thin static **border** a touch darker than the face (`BORDER`) so it
-reads on any background. The **green baize background is added only when rendering the
-preview GIF** — the Lottie itself is transparent.
-
-### Player compatibility
-Only plain 2-D shapes (`ddd:0`) — no 3-D layers, expressions or effects — so every
-Lottie player (lottie-web on the web, rlottie on native) renders it identically.
-
---
-
-## Glyphs
-
-`Э` (U+042D) and `8` are **real outlines from LiberationSans-Regular** — metric-
-compatible with Arial, matching the game's `--font: system-ui … Arial` stack
-(see `ui/src/app.css`). `build/extract.js` pulls the contours into `build/glyphs.json`
-as Lottie cubic paths; a hair of same-colour stroke adds a touch of weight.
-
---
-
-## Regenerate
-
-Requirements: Node ≥ 18. `extract.js` additionally needs `opentype.js`
-(`npm i opentype.js`); **`generate.js` has no dependencies**.
-
-```sh
-cd assets/vk
-
-# 1. (optional) re-extract the glyphs — only if you change the font:
-#    default font: /usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf
-node build/extract.js [/path/to/font.ttf]      # -> build/glyphs.json
-
-# 2. build the animation (reads build/glyphs.json):
-node build/generate.js erudit-loader.json      # -> erudit-loader.json
-
-# 3. (optional) live preview — needs lottie-web (npm i lottie-web):
-node build/build-preview.js erudit-loader.json preview.html
-#    then open preview.html in a browser.
-```
-
-The preview GIF is assembled by rendering the Lottie frame-by-frame (lottie-web canvas,
-filled with the green baize) and stitching with `ffmpeg`; the live HTML preview is the
-quickest way to eyeball changes.
-
-## Tunables (top of `build/generate.js`)
-
-| Symbol | Meaning |
-|--------|---------|
-| `OP`, `FR` | loop length (frames) / fps — overall speed |
-| `T_HIT / T_PEAK / T_LIFT / T_REC` | beats: contact / squash peak / lift-off / cushion recovered |
-| `EI / EO / ES` | easings: fast fall / fast rise / slow soft cushion |
-| `APEX`, `FLOOR` | bottom-edge screen-y at the top of the bounce / at rest |
-| `HW`, `HH`, `CR` | tile half-width / half-height / corner radius |
-| `scl` squash values | the squash amount (scaleX↑ / scaleY↓) |
-| `bulge` `b` | cushion depth (how far the sides bow out) |
-| `FACE / FACE_GLINT` | wood face / glint flash |
-| `BORDER` | tile rim colour |
-| `BLACK / BLACK_LIT` | glyph / glyph-at-glint (brown-red) |
-| preview bg `#3C7858` | the green-baize colour used **only** in the GIF |
@@ -1,31 +0,0 @@
-'use strict';
-const fs = require('fs');
-const data = fs.readFileSync(process.argv[2] || 'erudit.json', 'utf8');
-const lottiePath = __dirname + '/node_modules/lottie-web/build/player/lottie.min.js';
-const html = `<!doctype html><html><head><meta charset="utf8"><style>
-body{margin:0;background:#2b2b2b;font-family:sans-serif;color:#ccc}
-.row{display:flex;gap:18px;padding:18px;align-items:flex-end;flex-wrap:wrap}
-.cell{text-align:center}
-.chk{background-image:linear-gradient(45deg,#8a8a8a 25%,transparent 25%),linear-gradient(-45deg,#8a8a8a 25%,transparent 25%),linear-gradient(45deg,transparent 75%,#8a8a8a 75%),linear-gradient(-45deg,transparent 75%,#8a8a8a 75%);background-size:16px 16px;background-position:0 0,0 8px,8px -8px,-8px 0;background-color:#b5b5b5}
-.s96{width:96px;height:96px}.big{width:336px;height:336px}small{font-size:11px}
-</style></head><body><div class="row" id="row"></div>
-<script src="./lottie.min.js"></script>
-<script>
-const animationData=${data};window.AD=animationData;
-const row=document.getElementById('row');window.anims=[];
-function make(cls,frame,label){
-  const cell=document.createElement('div');cell.className='cell';
-  const box=document.createElement('div');box.className='chk '+cls;cell.appendChild(box);
-  cell.appendChild(document.createElement('br'));
-  const cap=document.createElement('small');cap.textContent=label;cell.appendChild(cap);
-  row.appendChild(cell);
-  const a=lottie.loadAnimation({container:box,renderer:'svg',loop:false,autoplay:false,animationData:JSON.parse(JSON.stringify(animationData))});
-  a.addEventListener('DOMLoaded',()=>a.goToAndStop(frame,true));
-  window.anims.push(a);
-}
-[0,22,45,68].forEach(f=>make('s96',f,'f'+f));
-make('big',22,'f22 x3.5');
-window.__ready=true;
-</script></body></html>`;
-fs.writeFileSync(process.argv[3] || 'preview.html', html);
-console.log('wrote', process.argv[3] || 'preview.html');
@@ -1,67 +0,0 @@
-'use strict';
-// Extract the Cyrillic "Э" (U+042D) and the digit "8" outlines from a grotesque
-// font (LiberationSans = Arial-metric, matching the game's system-ui/Arial stack)
-// and emit Lottie cubic-bezier contours, centred at the origin, y-down.
-const opentype = require('opentype.js');
-const fs = require('fs');
-
-const FONT = process.argv[2] || '/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf';
-const b = fs.readFileSync(FONT);
-const font = opentype.parse(b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength));
-const FS = 1000; // em scale
-
-function glyphContours(ch) {
-  const p = font.charToGlyph(ch).getPath(0, 0, FS); // baseline at y=0, y-down
-  const contours = [];
-  let cur = null, prev = null;
-  for (const c of p.commands) {
-    if (c.type === 'M') {
-      if (cur) contours.push(cur);
-      cur = [{ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] }];
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'L') {
-      cur.push({ v: [c.x, c.y], i: [c.x, c.y], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'C') {
-      cur[cur.length - 1].o = [c.x1, c.y1];
-      cur.push({ v: [c.x, c.y], i: [c.x2, c.y2], o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Q') {
-      const c1 = [prev.x + 2 / 3 * (c.x1 - prev.x), prev.y + 2 / 3 * (c.y1 - prev.y)];
-      const c2 = [c.x + 2 / 3 * (c.x1 - c.x), c.y + 2 / 3 * (c.y1 - c.y)];
-      cur[cur.length - 1].o = c1;
-      cur.push({ v: [c.x, c.y], i: c2, o: [c.x, c.y] });
-      prev = { x: c.x, y: c.y };
-    } else if (c.type === 'Z') {
-      if (cur && cur.length > 1) {
-        const last = cur[cur.length - 1], first = cur[0];
-        if (Math.hypot(last.v[0] - first.v[0], last.v[1] - first.v[1]) < 1e-3) {
-          first.i = last.i;            // fold the duplicate closing point into the first
-          cur.pop();
-        }
-      }
-      if (cur) { contours.push(cur); cur = null; }
-    }
-  }
-  if (cur) contours.push(cur);
-
-  let minx = Infinity, miny = Infinity, maxx = -Infinity, maxy = -Infinity;
-  const out = contours.map(ct => {
-    const v = [], i = [], o = [];
-    ct.forEach(pt => {
-      v.push(pt.v);
-      i.push([pt.i[0] - pt.v[0], pt.i[1] - pt.v[1]]);
-      o.push([pt.o[0] - pt.v[0], pt.o[1] - pt.v[1]]);
-      minx = Math.min(minx, pt.v[0]); maxx = Math.max(maxx, pt.v[0]);
-      miny = Math.min(miny, pt.v[1]); maxy = Math.max(maxy, pt.v[1]);
-    });
-    return { i, o, v, c: true };
-  });
-  return { contours: out, bbox: { x: minx, y: miny, w: maxx - minx, h: maxy - miny } };
-}
-
-const E = glyphContours('Э');
-const D8 = glyphContours('8');
-fs.writeFileSync('glyphs.json', JSON.stringify({ em: FS, E, D8 }));
-console.log('Э bbox', E.bbox, 'contours', E.contours.map(c => c.v.length));
-console.log('8 bbox', D8.bbox, 'contours', D8.contours.map(c => c.v.length));
@@ -1,153 +0,0 @@
-'use strict';
-// VK preloader Lottie: a flat wooden Erudit tile ("Э" + score "8") that drops in
-// under gravity, squashes on impact (convex cushion bulging out the left/right edges
-// + a touch of skew), and springs back up — looping. A light "glint" is caught at the
-// moment of the bounce. Pure 2D shapes (ddd:0). Glyphs are real LiberationSans
-// outlines (Arial-metric, = the game's font stack); see extract.js -> glyphs.json.
-const fs = require('fs');
-const G = JSON.parse(fs.readFileSync(__dirname + '/glyphs.json', 'utf8'));
-
-// ---- canvas / timing -------------------------------------------------------
-const W = 96, H = 96, cx = 48;
-const FR = 30, OP = 34;                      // ~1.13 s loop (dynamic, 25% faster)
-// keyframe beats (frames): fast fall -> soft squash -> lift -> fast rise -> apex (no dwell)
-const T_HIT = 13, T_PEAK = 18, T_LIFT = 19, T_REC = 28;
-
-// ---- geometry --------------------------------------------------------------
-const HW = 26, HH = 26, CR = 6;              // tile half-width / half-height / corner radius
-const FLOOR = 90, APEX = 60;                 // bottom-centre screen-y at rest / at the top of the bounce
-
-// ---- palette ---------------------------------------------------------------
-const col = h => [parseInt(h.slice(1,3),16)/255, parseInt(h.slice(3,5),16)/255, parseInt(h.slice(5,7),16)/255];
-const FACE = col('#D9B978');                 // wood face (flat)
-const FACE_GLINT = col('#E7CD95');           // face flash caught on impact (gentle, not blinding)
-const BORDER = col('#B49559');               // tile rim: a touch darker than the face, reads on any bg
-const BLACK = col('#1A1A1A');
-const BLACK_LIT = col('#421A0B');            // glyph warms to brown-red on the glint
-const lerp = (a, b, t) => a.map((v, i) => v + (b[i] - v) * t);
-
-// ---- property / easing helpers ---------------------------------------------
-const still = v => ({ a: 0, k: v });
-const EI = { o: { x: [0.82], y: [0] }, i: { x: [1], y: [1] } };  // strong accelerate (gravity fall)
-const EO = { o: { x: [0], y: [0] }, i: { x: [0.18], y: [1] } };  // strong decelerate (rise to apex)
-const ES = { o: { x: [0.42], y: [0] }, i: { x: [0.58], y: [1] } }; // soft/slow (the cushion)
-function anim(samples) {                      // samples: {t, v, e?} ; e = easing toward the NEXT key
-  return { a: 1, k: samples.map((s, idx) => {
-    const kf = { t: s.t, s: s.v };
-    if (idx < samples.length - 1) { const e = s.e || ES; kf.o = e.o; kf.i = e.i; }
-    return kf;
-  }) };
-}
-const animColor = s => anim(s.map(x => ({ t: x.t, v: [...x.v, 1], e: x.e })));
-
-// ---- shape helpers ---------------------------------------------------------
-const tr = () => ({ ty: 'tr', p: still([0,0]), a: still([0,0]), s: still([100,100]), r: still(0), o: still(100) });
-const grp = (items, nm) => ({ ty: 'gr', it: [...items, tr()], nm });
-const fill = c => ({ ty: 'fl', c, o: still(100), r: 1, bm: 0 });
-const stroke = (c,w) => ({ ty: 'st', c: still(c), o: still(100), w: still(w), lc: 2, lj: 2, ml: 4, bm: 0 });
-function glyph(gd, hpx, px, py, bold, colour, nm) {  // font glyph -> filled+stroked group
-  const sc = hpx / gd.bbox.h;
-  const bcx = gd.bbox.x + gd.bbox.w / 2, bcy = gd.bbox.y + gd.bbox.h / 2;
-  const shapes = gd.contours.map(ct => ({
-    ty: 'sh', d: 1, ks: still({
-      i: ct.i.map(p => [p[0]*sc, p[1]*sc]), o: ct.o.map(p => [p[0]*sc, p[1]*sc]),
-      v: ct.v.map(p => [(p[0]-bcx)*sc + px, (p[1]-bcy)*sc + py]), c: true,
-    }),
-  }));
-  return grp([...shapes, fill(colour), stroke(BLACK, bold)], nm);
-}
-
-// Sample the rest rounded-rect outline (clockwise): fine corner arcs + one mid point
-// per straight edge, so a smooth interpolant reproduces it cleanly.
-function arc(ccx, ccy, a0, a1, n) {
-  const out = [];
-  for (let i = 0; i < n; i++) { const a = (a0 + (a1 - a0) * i / (n - 1)) * Math.PI / 180; out.push([ccx + CR*Math.cos(a), ccy + CR*Math.sin(a)]); }
-  return out;
-}
-const REST = (() => {
-  const NC = 7, yi = HH - CR, xi = HW - CR;
-  const C = [ arc(xi,-yi,-90,0,NC), arc(xi,yi,0,90,NC), arc(-xi,yi,90,180,NC), arc(-xi,-yi,180,270,NC) ];
-  const pts = [];
-  for (let k = 0; k < 4; k++) {
-    pts.push(...C[k]);
-    const a = C[k][NC-1], b = C[(k+1)%4][0];
-    pts.push([(a[0]+b[0])/2, (a[1]+b[1])/2]);   // straight-edge mid point (keeps the edge straight)
-  }
-  return pts;
-})();
-// The whole left/right contour (corners + side) bows out by one smooth barrel profile;
-// Catmull-Rom tangents (from neighbours) make every junction C1-smooth -> no kink, the
-// corners follow the cushion and the cushion melts into the corners, bulged or not.
-function facePath(b) {
-  const f = y => b * (1 - (y/HH) * (y/HH));                       // 0 at top/bottom, max at the middle
-  const V = REST.map(([x, y]) => [x + Math.sign(x) * f(y), y]);   // push the sides out, top/bottom stay
-  const n = V.length, I = [], O = [];
-  for (let k = 0; k < n; k++) {
-    const p0 = V[(k-1+n)%n], p1 = V[k], p2 = V[(k+1)%n];
-    let dx = p2[0]-p0[0], dy = p2[1]-p0[1];                       // tangent direction (neighbours)
-    const dl = Math.hypot(dx, dy) || 1; dx /= dl; dy /= dl;
-    const ln = Math.hypot(p2[0]-p1[0], p2[1]-p1[1]) / 3;          // handles ~ 1/3 of the adjacent chord
-    const lp = Math.hypot(p1[0]-p0[0], p1[1]-p0[1]) / 3;          // -> chordal spline, no overshoot/facets
-    O.push([dx*ln, dy*ln]); I.push([-dx*lp, -dy*lp]);
-  }
-  return { i: I, o: O, v: V, c: true };
-}
-const facePathKeys = samples => ({ a: 1, k: samples.map((s, idx) => {
-  const kf = { t: s.t, s: [facePath(s.b)] };
-  if (idx < samples.length - 1) { const e = s.e || ES; kf.o = e.o; kf.i = e.i; }
-  return kf;
-}) });
-
-// ---- animation tracks ------------------------------------------------------
-// bottom-centre screen-y (the tile rests/squashes on its bottom edge)
-const posY = anim([
-  { t: 0,      v: [cx, APEX, 0],  e: EI },           // apex -> immediately falls (no dwell)
-  { t: T_HIT,  v: [cx, FLOOR, 0], e: ES },           // FAST fall (accelerate) -> floor
-  { t: T_LIFT, v: [cx, FLOOR, 0], e: EO },           // sit on the floor while the cushion absorbs
-  { t: OP,     v: [cx, APEX, 0] },                   // FAST rise (decelerate) -> apex = loop start
-]);
-// scale about the bottom anchor: stretch while falling, gentle/slow cushion squash on impact
-const scl = anim([
-  { t: 0,        v: [100, 100, 100], e: ES },
-  { t: T_HIT-5,  v: [95, 106, 100], e: ES },         // stretch while falling fast
-  { t: T_HIT,    v: [104, 95, 100], e: ES },         // touch down
-  { t: T_PEAK,   v: [112, 86, 100], e: ES },         // soft squash peak (gentler, less plче)
-  { t: T_REC,    v: [100, 100, 100], e: ES },        // slow cushion release -> soft landing
-  { t: OP,       v: [100, 100, 100] },
-]);
-// a touch of skew through the squash (organic deform), back to 0
-const skw = anim([
-  { t: T_HIT, v: [0], e: ES }, { t: T_PEAK, v: [4], e: ES }, { t: T_REC, v: [0] }, { t: OP, v: [0] },
-]);
-// left/right cushion bulge: 0 -> gentle peak -> 0 (never inward)
-const bulge = facePathKeys([
-  { t: T_HIT, b: 0, e: ES }, { t: T_PEAK, b: 4, e: ES }, { t: T_REC, b: 0 }, { t: OP, b: 0 },
-]);
-// glint: face + glyph catch the light at the bounce
-const faceCol = animColor([
-  { t: T_HIT-2, v: FACE, e: ES }, { t: T_PEAK, v: FACE_GLINT, e: ES }, { t: T_REC, v: FACE }, { t: OP, v: FACE },
-]);
-const glyphCol = animColor([
-  { t: T_HIT-2, v: BLACK, e: ES }, { t: T_PEAK, v: BLACK_LIT, e: ES }, { t: T_REC, v: BLACK }, { t: OP, v: BLACK },
-]);
-
-// ---- layer (face + glyphs share the bounce/squash transform) ---------------
-const faceShape = grp([ { ty: 'sh', d: 1, ks: bulge }, fill(faceCol), stroke(BORDER, 1.8) ], 'face');
-const glyphE = glyph(G.E,  32, 0, -1, 1.0, glyphCol, 'E');                 // centred Э
-const glyph8 = glyph(G.D8, 8.5, HW-6.5, HH-7.5, 0.5, glyphCol, 'score');   // 8 in the corner
-
-const tile = {
-  ddd: 0, ind: 1, ty: 4, nm: 'tile', sr: 1,
-  ks: { o: still(100), r: still(0), p: posY, a: still([0, HH, 0]), s: scl, sk: skw, sa: still(0) },
-  ao: 0, shapes: [ glyph8, glyphE, faceShape ], ip: 0, op: OP, st: 0, bm: 0,
-};
-
-const root = {
-  v: '5.7.4', fr: FR, ip: 0, op: OP, w: W, h: H, nm: 'erudit-vk-loader', ddd: 0,
-  assets: [], layers: [ tile ], markers: [],
-};
-
-const out = process.argv[2] || 'erudit.json';
-const round = (k, v) => (typeof v === 'number' ? Math.round(v * 100) / 100 : v);
-fs.writeFileSync(out, JSON.stringify(root, round));
-console.log('wrote', out, fs.statSync(out).size, 'bytes');
@@ -7,14 +7,12 @@
 # (GOPRIVATE), so the build stage needs git and network.
 #
 # Build from the repository root so go.work, go.work.sum, pkg/ and backend/ are all
-# in the Docker context. DICT_VERSION has no default — the caller supplies the
-# scrabble-dictionary release tag (compose/CI pass it; see deploy/README.md
-# "Bumping the dictionary version"):
-#   docker build --build-arg DICT_VERSION=v1.3.0 -f backend/Dockerfile -t scrabble-backend .
+# in the Docker context:
+#   docker build -f backend/Dockerfile -t scrabble-backend .

 # --- dictionary artifact -----------------------------------------------------
 FROM alpine:3.20 AS dawg
-ARG DICT_VERSION
+ARG DICT_VERSION=v1.0.0
 RUN apk add --no-cache curl tar
 RUN mkdir -p /dawg \
 && curl -fsSL -o /tmp/dawg.tar.gz \
@@ -35,16 +33,14 @@ COPY backend ./backend
 # Reduce the workspace to what the backend needs: backend + pkg. loadtest and the
 # gateway replace it requires are not in this context, so drop both.
 RUN go work edit -dropuse=./gateway -dropuse=./platform/telegram -dropuse=./loadtest -dropreplace=scrabble/gateway@v0.0.0
-# VERSION (the deploy passes the git tag) is stamped into the binary via the linker.
-ARG VERSION=dev
-RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-X scrabble/pkg/version.Version=${VERSION}" -o /out/backend ./backend/cmd/backend
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/backend ./backend/cmd/backend

 # --- runtime -----------------------------------------------------------------
 FROM gcr.io/distroless/static-debian12:nonroot
 # Re-declare the build arg in this stage so it labels the seed dictionary. One
 # DICT_VERSION drives both the artifact the dawg stage downloads and the version
 # label the binary pins, so the resident version equals the release tag.
-ARG DICT_VERSION
+ARG DICT_VERSION=v1.0.0
 COPY --from=build /out/backend /usr/local/bin/backend
 # Own the seed dictionary as the nonroot runtime user (UID 65532): a named volume
 # mounted at /opt/dawg inherits this ownership on first use, so the admin console
@@ -43,13 +43,8 @@ per-user blocks, and per-game chat with nudges folded in as a message kind; chat
 messages are length-capped, content-filtered (no links/emails/phone numbers,
 including obfuscated forms) and stored with the sender's IP. Each message carries an
 `unread_seats` read bitmask (a set bit per recipient seat still to read it); `MarkRead`
-clears a reader's bit when they open the move history or chat, a wired `NudgeClearer`
-clears a nudge when its recipient moves, and a wired `NudgeExpirer` clears **all** of a game's
-nudges when it finishes (any completion path) — the first two record the publish-to-read latency,
-the completion expiry does not (it is not a read); chat messages stay unread on completion.
-A friend request (or block) aimed at a **disguised pooled robot** is recorded per game+seat
-in `robot_friend_requests` / `robot_blocks`, never against the shared robot account; a
-background reaper drops a robot friend request once its game has been finished for **7 days**.
+clears a reader's bit when they open the move history or chat, and a wired `NudgeClearer`
+clears a nudge when its recipient moves — both record the publish-to-read latency.
 `internal/account`
 gains profile editing and the email confirm-code flow (a `Mailer` seam: SMTP or a
 development log mailer). The engine now also handles **multi-player drop-out**: in
@@ -73,10 +68,7 @@ win (≈ 40%), targets a small score margin — with an occasional off-strategy
 none as the bag empties — and times its moves with a move-number-aware
 right-skewed delay (quick openings, long endgames), a night-sleep window anchored to the opponent's timezone, and nudge
 behaviour — all derived deterministically from the game seed, so it keeps no extra
-state. In a dead-drawn endgame — the last two journal moves are both passes, so the robot is bound
-to pass again — it shortens that delay to a `[0.8, 1.5]×` band around the human's last-move think
-time (the gap between the last two moves), clamped to `[30 s, 8 min]` and `min`-ed with the normal
-delay, so a decided game is not dragged out while the robot never moves slower than usual. A background **reaper** seats a pooled robot (matching the game's language) in any open
+state. A background **reaper** seats a pooled robot (matching the game's language) in any open
 game whose wait window — a fixed **90 s** plus a random **0–90 s** (so **90–180 s**) — has
 elapsed, and the waiting starter is told an opponent took the seat by an in-app
 **opponent_joined** push (carrying their refreshed game state) that fills the opponent card and
@@ -105,16 +97,9 @@ second listener — `internal/pushgrpc`, a gRPC server (`BACKEND_GRPC_ADDR`) str
 live events (your-turn, opponent-moved, chat, nudge, match-found, notify) to the
 gateway. The gateway-only `POST /api/v1/internal/push-target` (a user's
 Telegram `external_id`, language and `notifications_in_app_only` flag) lets the gateway
-route out-of-app push to the Telegram bot over the gateway bot-link; the Telegram login
+route out-of-app push to the Telegram connector; the Telegram login
 seeds a new account's language and display name from the launch fields, and the
 `accounts.notifications_in_app_only` flag (default true).
-The gateway-only `POST /api/v1/internal/chat-access` resolves a Telegram identity (the
-bot's join-time query) or an account id (a `chat_access_changed` event) to its
-**moderated-chat write eligibility** — `registered AND NOT suspended AND NOT chat_muted`.
-That event is emitted on an admin block/unblock, a `chat_muted` role grant/revoke, or — via
-the `account.SuspensionSweeper` started in `cmd/backend` — a temporary block lapsing;
-`chat_muted` is an `account.KnownRoles` entry, a chat-only mute distinct from the game
-suspension (which dominates it).
 `accounts.is_guest` marks an ephemeral guest — a durable row
 with no identity, excluded from statistics. The server-rendered
 **admin console** at `/_gm` (`internal/adminconsole` + `internal/server/handlers_admin_console.go`;
@@ -125,15 +110,16 @@ pipeline, the online **dictionary update** (upload the `scrabble-dawg-vX.Y.Z.tar
 archive, preview the per-variant word diff, then install + activate — `internal/dictadmin` +
 `engine.DiffWords` / `Registry.LoadAvailable`, written to per-version subdirectories of the
 `BACKEND_DICT_DIR` volume with the active version persisted in `dictionary_state`), and operator **broadcasts** via a
-backend client (`internal/connector`, `BACKEND_CONNECTOR_ADDR`) that calls the gateway's
-**bot-link relay** — each broadcast renders through the bot in an operator-chosen language
-and the relay awaits the bot's delivery ack. There is one bot,
-so `/internal/push-target` returns the recipient's `preferred_language` as the render
-language for out-of-app push; no per-bot routing remains. The console also manages the **advertising banner** (`/_gm/banners` +
+backend Telegram-connector client (`internal/connector`, `BACKEND_CONNECTOR_ADDR`) — each
+broadcast picks the delivering bot by an operator-chosen language. `accounts.service_language`
+holds the language tag of the bot a Telegram
+user last signed in through, written on every login and returned by
+`/internal/push-target` (falling back to `preferred_language`) so out-of-app push routes
+to the right bot. The console also manages the **advertising banner** (`/_gm/banners` +
 `/_gm/banner-settings`, `internal/ads`): operator campaigns with a percent weight, an optional
 window and bilingual messages, plus the global display timings. `GET /api/v1/user/profile` attaches
 the resolved, weighted campaign feed for an **eligible** viewer (`!paid_account && hint_balance == 0
-&& !no_banner` role, the message language picked by `preferred_language`); changing those inputs
+&& !no_banner` role, the message language picked by `service_language`); changing those inputs
 publishes a `notify` `banner` re-poll signal so the client shows/hides it in place. The shared wire
 contracts live in the sibling [`../pkg`](../pkg) module.

@@ -157,13 +143,6 @@ rejected calls within `BACKEND_HIGHRATE_FLAG_WINDOW` gets the soft, reversible
 `accounts.flagged_high_rate_at` marker (set-once; a badge in the user list and a
 **Clear** action on the user card; never an automatic ban).

-The gateway also syncs its active IP bans (prod-only — see ARCHITECTURE §11) to
-`POST /api/v1/internal/bans/sync`; `internal/banview` mirrors them for the console's
-**Throttled** page (an **Active IP bans** panel with an **Unban** action) and returns
-the operator's pending unbans in the response, which the gateway applies on its next
-sync. Like `ratewatch` it is in-memory and resets on restart — the enforced ban lives
-in the gateway, not here.
-
 ## Package layout

 ```
@@ -187,9 +166,8 @@ internal/lobby/      # auto-match (DB-backed open games + robot substitution) +
 internal/robot/      # human-like robot opponent: account pool, seed-derived strategy, move driver
 internal/adminconsole/ # server-rendered admin console (Go templates + embedded CSS, view models), served at /_gm
 internal/ads/        # advertising banner: campaigns + bilingual messages + display timings, weighted-rotation feed (ActiveSet)
-internal/connector/  # backend gRPC client to the gateway bot-link relay (operator broadcasts)
+internal/connector/  # backend gRPC client to the Telegram connector (operator broadcasts)
 internal/ratewatch/  # gateway rate-limit reports: episode window for the console + the high-rate auto-flag
-internal/banview/    # gateway active-ban mirror: the console's Active IP bans panel + the operator unban backchannel
 ```

 ## Configuration (environment)
@@ -208,20 +186,18 @@ internal/banview/    # gateway active-ban mirror: the console's Active IP bans p
 | `BACKEND_OTEL_TRACES_EXPORTER` | `none` | `none`, `stdout` or `otlp` (gRPC; endpoint from the standard `OTEL_EXPORTER_OTLP_*`). |
 | `BACKEND_OTEL_METRICS_EXPORTER` | `none` | `none`, `stdout` or `otlp`. |
 | `BACKEND_DICT_DIR` | — | **Required.** Directory of committed `.dawg` dictionaries. |
-| `BACKEND_DICT_VERSION` | `v1` | Version label for the flat dictionary dir. Recorded in a `.seed_version` marker on first boot and authoritative after: on a seeded volume a changed value is ignored (it seeds only a fresh volume) — the seed-drift guard (ARCHITECTURE.md §5). |
+| `BACKEND_DICT_VERSION` | `v1` | Dictionary version new games pin. |
 | `BACKEND_GAME_TIMEOUT_SWEEP_INTERVAL` | `1m` | How often the turn-timeout sweeper runs. |
 | `BACKEND_GAME_CACHE_TTL` | `24h` | Idle window before a live game is evicted from cache. |
 | `BACKEND_LOBBY_ROBOT_WAIT` | `10s` | Auto-match wait before a robot is substituted for a missing human. |
 | `BACKEND_LOBBY_REAPER_INTERVAL` | `1s` | How often the substitution reaper scans for over-waited players. |
 | `BACKEND_ROBOT_DRIVE_INTERVAL` | `30s` | How often the robot driver scans for due robot turns. |
-| `BACKEND_SMTP_HOST` | — | Confirm-code relay host. **Empty selects the development log mailer** (the code is logged, not sent). |
-| `BACKEND_SMTP_PORT` | `587` | Relay port. No client certificate is needed (the server cert is validated against the system roots). |
-| `BACKEND_SMTP_TLS` | — | Transport security: `ssl` (implicit TLS from connect) or `starttls`. Empty derives it from the port (implicit on `465`, STARTTLS otherwise); set it for a relay on a non-standard port (e.g. Selectel's `1127` = SSL, `1126` = STARTTLS). |
-| `BACKEND_SMTP_USERNAME` | — | SMTP AUTH user; empty relays without authentication. |
-| `BACKEND_SMTP_PASSWORD` | — | SMTP AUTH password. |
-| `BACKEND_SMTP_FROM` | `no-reply@localhost` | From address. A deployed contour must use the prod domain (the relay only accepts its verified sender domain). |
-| `BACKEND_PUBLIC_BASE_URL` | — | Canonical public origin (scheme + host) for links in the email. **Required when `BACKEND_SMTP_HOST` is set.** Never derived from a request Host header (anti-injection). |
-| `BACKEND_CONNECTOR_ADDR` | — | the gateway bot-link relay gRPC address for admin-console operator broadcasts. Empty disables broadcasts. |
+| `BACKEND_SMTP_HOST` | — | Email relay host. **Empty selects the development log mailer** (the confirm-code is logged, not sent). |
+| `BACKEND_SMTP_PORT` | `587` | Email relay port. |
+| `BACKEND_SMTP_USERNAME` | — | SMTP user; empty relays without authentication. |
+| `BACKEND_SMTP_PASSWORD` | — | SMTP password. |
+| `BACKEND_SMTP_FROM` | `no-reply@localhost` | Envelope/From address for confirm-codes. |
+| `BACKEND_CONNECTOR_ADDR` | — | Telegram connector gRPC address for admin-console operator broadcasts. Empty disables broadcasts. |
 | `BACKEND_GUEST_REAP_INTERVAL` | `1h` | How often the abandoned-guest reaper sweeps. |
 | `BACKEND_GUEST_RETENTION` | `720h` | Account age past which a guest with no game seat is deleted. |
 | `BACKEND_HIGHRATE_FLAG_THRESHOLD` | `1000` | Gateway-reported rejected calls within the window past which an account is soft-flagged. |
@@ -232,7 +208,7 @@ internal/banview/    # gateway active-ban mirror: the console's Active IP bans p
 ```sh
 docker run -d --name scrabble-pg -e POSTGRES_PASSWORD=dev -p 5432:5432 postgres:17-alpine
 # DAWGs: extract the dictionary release artifact (or point at a local scrabble-solver/dawg):
-mkdir -p /tmp/dawg && curl -fsSL https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/v1.3.0/scrabble-dawg-v1.3.0.tar.gz | tar xz -C /tmp/dawg
+mkdir -p /tmp/dawg && curl -fsSL https://gitea.iliadenisov.ru/developer/scrabble-dictionary/releases/download/v1.0.0/scrabble-dawg-v1.0.0.tar.gz | tar xz -C /tmp/dawg
 BACKEND_POSTGRES_DSN='postgres://postgres:dev@localhost:5432/postgres?search_path=backend&sslmode=disable' \
  BACKEND_DICT_DIR=/tmp/dawg \
  GOPRIVATE='gitea.iliadenisov.ru/*' \
@@ -271,14 +247,7 @@ local solver co-development you may add a temporary replace — see `go.work`).
 from the [`scrabble-dictionary`](https://gitea.iliadenisov.ru/developer/scrabble-dictionary)
 repo (one semver per set); the engine loads them by `(variant, dict_version)` from
 `BACKEND_DICT_DIR`. The backend loads them at startup as a hard dependency
-(a missing dictionary aborts the boot). The flat directory is the seed version,
-labelled `BACKEND_DICT_VERSION`; uploaded versions live in `<version>/`
-subdirectories the admin console writes and a restart re-loads. Because the DAWGs
-carry no embedded version, the first boot records the seed in a `.seed_version`
-marker that is authoritative after: on a seeded volume a changed `BACKEND_DICT_VERSION`
-is ignored (it seeds only a fresh volume) — the seed-drift guard — so a live contour's
-dictionary is changed through the console, never by bumping the build seed
-(ARCHITECTURE.md §5).
+(a missing dictionary aborts the boot).

 ## Tests

@@ -3,8 +3,8 @@
 // loads the dictionaries into the engine registry, warms the session cache,
 // constructs the game domain and starts its turn-timeout sweeper, constructs the
 // lobby and social domains, then serves the HTTP listener with the infrastructure
-// probes and the /api/v1 route group, behind which the domains expose their HTTP
-// endpoints to the gateway.
+// probes and the /api/v1 route-group skeleton. Domain HTTP endpoints are added
+// with the gateway in a later stage described in PLAN.md.
 package main

 import (
@@ -12,18 +12,14 @@ import (
 	"fmt"
 	"log"
 	"os/signal"
-	"strings"
 	"syscall"
 	"time"

-	"github.com/google/uuid"
 	"go.uber.org/zap"

 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/accountmerge"
-	"scrabble/backend/internal/adminalert"
 	"scrabble/backend/internal/ads"
-	"scrabble/backend/internal/banview"
 	"scrabble/backend/internal/config"
 	"scrabble/backend/internal/connector"
 	"scrabble/backend/internal/engine"
@@ -35,7 +31,6 @@ import (
 	"scrabble/backend/internal/postgres"
 	"scrabble/backend/internal/pushgrpc"
 	"scrabble/backend/internal/ratewatch"
-	"scrabble/backend/internal/render"
 	"scrabble/backend/internal/robot"
 	"scrabble/backend/internal/server"
 	"scrabble/backend/internal/session"
@@ -46,10 +41,6 @@ import (
 // telemetryShutdownTimeout bounds the OpenTelemetry flush during process exit.
 const telemetryShutdownTimeout = 5 * time.Second

-// adminAlertInterval is how often the operator-alert worker checks for new feedback /
-// complaints; a burst within one interval coalesces into a single digest email.
-const adminAlertInterval = 5 * time.Minute
-
 func main() {
 	cfg, err := config.Load()
 	if err != nil {
@@ -168,63 +159,21 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		zap.Duration("interval", cfg.GuestReapInterval),
 		zap.Duration("retention", cfg.GuestRetention))

-	// Purge the account-deletion legal dossier past its retention TTL: the
-	// retained-identities journal, and the feedback thread + dossier PII of long-deleted
-	// accounts (chat is kept). Checked daily; the TTL is a two-year policy constant.
-	retentionReaper := account.NewRetentionReaper(accounts, account.RetentionTTL, logger)
-	go retentionReaper.Run(ctx, 24*time.Hour)
-	logger.Info("retention reaper started",
-		zap.Duration("interval", 24*time.Hour),
-		zap.Duration("retention", account.RetentionTTL))
-
-	// Re-evaluate moderated-chat write access when a temporary block self-expires:
-	// no operator action fires then, so the sweeper emits the chat-access-changed
-	// event for lapsed blocks and the gateway re-pushes the chat-gate command.
-	chatSweeper := account.NewSuspensionSweeper(accounts, func(id uuid.UUID) {
-		hub.Publish(notify.ChatAccessChanged(id))
-	}, logger)
-	go chatSweeper.Run(ctx)
-	logger.Info("suspension expiry sweeper started", zap.Duration("interval", chatSweeper.Interval()))
-
 	// Lobby & social domains. Their REST and stream surface lives in the gateway,
 	// so they are handed to the server (like the route groups) for the handlers.
 	mailer := newMailer(cfg.SMTP, logger)
-	emails := account.NewEmailService(accounts, mailer, cfg.PublicBaseURL)
-	// Throttle confirm-code sends per recipient: at most one per minute and five per
-	// rolling hour, guarding against email bombing and the relay's own quota.
-	emails.SetSendLimiter(account.NewSendLimiter(time.Minute, 5))
+	emails := account.NewEmailService(accounts, mailer)
 	// Account linking & merge: the orchestrator over the account, merge and
 	// session layers. Wired to the /api/v1/user/link REST surface below.
 	links := link.NewService(emails, accounts, accountmerge.NewMerger(db), sessions)
 	socialSvc := social.NewService(social.NewStore(db), accounts, games)
 	socialSvc.SetNotifier(hub)
 	socialSvc.SetMetrics(tel.MeterProvider().Meter("scrabble/backend/social"))
-	// A nudge the recipient answered by moving is marked read on the move path; every nudge in a
-	// game is marked read when the game finishes (a stale badge), on any completion path.
+	// A nudge the recipient answered by moving is marked read on the move path.
 	games.SetNudgeClearer(socialSvc.ClearNudges)
-	games.SetNudgeExpirer(socialSvc.ExpireNudges)
-	// Reap per-game disguised-robot friend requests once their game is long finished
-	// (the robot ignores them; the row only pins the in-game "request sent" state).
-	robotReqReaper := social.NewRobotFriendRequestReaper(socialSvc, logger)
-	go robotReqReaper.Run(ctx)
-	logger.Info("robot friend request reaper started",
-		zap.Duration("interval", robotReqReaper.Interval()),
-		zap.Duration("retention", robotReqReaper.Retention()))
 	feedbackSvc := feedback.NewService(feedback.NewStore(db), accounts)
 	feedbackSvc.SetNotifier(hub)

-	// Operator alert emails on new feedback / word complaints, coalesced into one digest
-	// per interval. Inert unless a distinct admin sender and recipient are configured.
-	if cfg.SMTP.AdminFrom != "" && cfg.SMTP.AdminTo != "" {
-		consoleURL := ""
-		if cfg.PublicBaseURL != "" {
-			consoleURL = strings.TrimRight(cfg.PublicBaseURL, "/") + "/_gm"
-		}
-		alerts := adminalert.New(mailer, feedbackSvc, games, cfg.SMTP.AdminFrom, cfg.SMTP.AdminTo, consoleURL, logger)
-		go alerts.Run(ctx, adminAlertInterval)
-		logger.Info("admin alert worker started", zap.Duration("interval", adminAlertInterval))
-	}
-
 	// Robot opponent: provision its durable account pool (a hard startup
 	// dependency, like the dictionaries) and start its move driver. The matchmaker
 	// substitutes a pooled robot for a missing human after the wait window.
@@ -240,7 +189,6 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {

 	matchmaker := lobby.NewMatchmaker(games, robots, cfg.Lobby.RobotWait, cfg.Lobby.RobotWaitJitter, logger)
 	matchmaker.SetNotifier(hub)
-	matchmaker.SetBlocker(socialSvc)
 	go matchmaker.RunReaper(ctx, cfg.Lobby.ReaperInterval)
 	invitations := lobby.NewInvitationService(lobby.NewStore(db), games, accounts, socialSvc)
 	invitations.SetNotifier(hub)
@@ -255,21 +203,10 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		zap.Int("flag_threshold", cfg.RateWatch.FlagThreshold),
 		zap.Duration("flag_window", cfg.RateWatch.FlagWindow))

-	// Ban observability: mirror the gateway's active IP bans for the admin console's
-	// active-bans panel and collect operator unban requests.
-	banView := banview.New()
-
 	// Advertising-banner domain: campaign rotation feeding the profile.get banner
 	// block and the banner admin console section.
 	adsSvc := ads.NewService(ads.NewStore(db))

-	// The image-render sidecar client for the PNG export artifact; nil (PNG
-	// download answers 404) when BACKEND_RENDERER_URL is unset.
-	var renderer *render.Client
-	if cfg.RendererURL != "" {
-		renderer = render.New(cfg.RendererURL)
-	}
-
 	srv := server.New(cfg.HTTPAddr, server.Deps{
 		Logger:        logger,
 		DB:            db,
@@ -288,11 +225,8 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		DictDir:       cfg.Game.DictDir,
 		Connector:     conn,
 		RateWatch:     rateWatch,
-		BanView:       banView,
 		Ads:           adsSvc,
 		Notifier:      hub,
-		ExportSignKey: cfg.ExportSignKey,
-		Renderer:      renderer,
 	})
 	pushSrv := pushgrpc.NewServer(cfg.GRPCAddr, hub, logger)

@@ -1,193 +0,0 @@
-// Command dictgen dumps golden parity vectors from the committed dawg
-// dictionaries so the TypeScript dawg reader can be checked byte-for-byte
-// against the authoritative Go dafsa reader.
-//
-// For each *.dawg file it writes, into the output directory:
-//
-//   - <name>.words.bin — every stored word as alphabet-index bytes, in index
-//     order, framed as [1-byte length][length index bytes]. The word at stream
-//     position k has IndexOfB == k.
-//   - <name>.neg.bin — negative lookups (sequences whose IndexOfB is -1), same
-//     framing, to exercise the not-found path at varying depths.
-//   - <name>.meta.json — NumAdded/NumNodes/NumEdges plus the alphabet size, for
-//     a header-parse sanity cross-check on the TS side.
-//
-// It is a development tool (not built into any service), analogous to
-// cmd/jetgen. Run it from the repository root:
-//
-//	go run ./backend/cmd/dictgen -dawg-dir ../scrabble-solver/dawg -out <dir>
-package main
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"math/rand"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-
-	dawg "github.com/iliadenisov/dafsa"
-)
-
-// meta is the per-dictionary sanity payload cross-checked by the TS reader.
-type meta struct {
-	NumAdded int `json:"numAdded"`
-	NumNodes int `json:"numNodes"`
-	NumEdges int `json:"numEdges"`
-	Alphabet int `json:"alphabet"`
-}
-
-func main() {
-	dawgDir := flag.String("dawg-dir", "../scrabble-solver/dawg", "directory holding the .dawg files")
-	outDir := flag.String("out", "", "output directory for the golden files (required)")
-	negCount := flag.Int("neg", 20000, "number of negative lookups to emit per dictionary")
-	flag.Parse()
-
-	if *outDir == "" {
-		fail("-out is required")
-	}
-	if err := os.MkdirAll(*outDir, 0o755); err != nil {
-		fail("mkdir out: %v", err)
-	}
-
-	files, err := filepath.Glob(filepath.Join(*dawgDir, "*.dawg"))
-	if err != nil {
-		fail("glob: %v", err)
-	}
-	sort.Strings(files)
-	if len(files) == 0 {
-		fail("no .dawg files in %s", *dawgDir)
-	}
-
-	for _, f := range files {
-		if err := process(f, *outDir, *negCount); err != nil {
-			fail("%s: %v", filepath.Base(f), err)
-		}
-	}
-}
-
-// process emits the golden files for a single dawg dictionary.
-func process(path, outDir string, negCount int) error {
-	name := strings.TrimSuffix(filepath.Base(path), ".dawg")
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return err
-	}
-	finder, err := dawg.Read(bytes.NewReader(data), 0)
-	if err != nil {
-		return fmt.Errorf("read dawg: %w", err)
-	}
-	defer finder.Close()
-
-	// Stream every stored word in index order; keep a decimated sample and the
-	// maximum alphabet index for negative generation.
-	wf, err := os.Create(filepath.Join(outDir, name+".words.bin"))
-	if err != nil {
-		return err
-	}
-	bw := bufio.NewWriter(wf)
-
-	var (
-		count  int
-		maxIx  byte
-		sample [][]byte
-	)
-	finder.EnumerateB(func(index int, word []byte, final bool) int {
-		if !final {
-			return 0 // Continue
-		}
-		if index != count {
-			panic(fmt.Sprintf("%s: enumerate index gap: got %d want %d", name, index, count))
-		}
-		writeWord(bw, word)
-		for _, b := range word {
-			if b > maxIx {
-				maxIx = b
-			}
-		}
-		if count%4 == 0 && len(sample) < 60000 {
-			sample = append(sample, append([]byte(nil), word...))
-		}
-		count++
-		return 0 // Continue
-	})
-	if err := bw.Flush(); err != nil {
-		return err
-	}
-	if err := wf.Close(); err != nil {
-		return err
-	}
-	if count != finder.NumAdded() {
-		return fmt.Errorf("word count %d != NumAdded %d", count, finder.NumAdded())
-	}
-
-	alphabet := int(maxIx) + 1
-
-	// Negatives: mutate sampled real words and keep the ones the reader rejects.
-	nf, err := os.Create(filepath.Join(outDir, name+".neg.bin"))
-	if err != nil {
-		return err
-	}
-	nbw := bufio.NewWriter(nf)
-	rng := rand.New(rand.NewSource(1))
-	neg := 0
-	for neg < negCount && len(sample) > 0 {
-		base := sample[rng.Intn(len(sample))]
-		cand := append([]byte(nil), base...)
-		switch rng.Intn(3) {
-		case 0: // extend by one index
-			cand = append(cand, byte(rng.Intn(alphabet)))
-		case 1: // flip one index
-			if len(cand) > 0 {
-				cand[rng.Intn(len(cand))] = byte(rng.Intn(alphabet))
-			}
-		case 2: // drop the tail and flip the new last index
-			if len(cand) > 1 {
-				cand = cand[:len(cand)-1]
-				cand[len(cand)-1] = byte(rng.Intn(alphabet))
-			}
-		}
-		if finder.IndexOfB(cand) == -1 {
-			writeWord(nbw, cand)
-			neg++
-		}
-	}
-	if err := nbw.Flush(); err != nil {
-		return err
-	}
-	if err := nf.Close(); err != nil {
-		return err
-	}
-
-	m := meta{NumAdded: finder.NumAdded(), NumNodes: finder.NumNodes(), NumEdges: finder.NumEdges(), Alphabet: alphabet}
-	mb, err := json.MarshalIndent(m, "", "  ")
-	if err != nil {
-		return err
-	}
-	if err := os.WriteFile(filepath.Join(outDir, name+".meta.json"), mb, 0o644); err != nil {
-		return err
-	}
-
-	fmt.Printf("%-12s words=%d negatives=%d alphabet=%d nodes=%d edges=%d\n",
-		name, count, neg, alphabet, finder.NumNodes(), finder.NumEdges())
-	return nil
-}
-
-// writeWord frames one index-byte word as [length][bytes].
-func writeWord(w *bufio.Writer, word []byte) {
-	if len(word) > 255 {
-		panic(fmt.Sprintf("word too long to frame: %d", len(word)))
-	}
-	w.WriteByte(byte(len(word)))
-	w.Write(word)
-}
-
-func fail(format string, args ...any) {
-	fmt.Fprintf(os.Stderr, "dictgen: "+format+"\n", args...)
-	os.Exit(1)
-}
@@ -1,486 +0,0 @@
-// Command validategen produces golden conformance fixtures for the TypeScript
-// move validator (ui/src/lib/dict/validate.ts). For each variant it self-plays
-// greedy games with the authoritative scrabble-solver engine to build realistic
-// board positions, then records a battery of candidate plays — the engine's own
-// top move, letter-mutated variants, random scatters and (on the empty board) an
-// off-centre translation — each paired with the ground-truth result of
-// ValidatePlayOpts (legal, score, the words formed). The TS conformance test
-// replays these and must agree exactly.
-//
-// It is a development tool (not built into any service), analogous to
-// cmd/dictgen. Run it from the repository root:
-//
-//	go run ./backend/cmd/validategen -dawg-dir ../scrabble-solver/dawg -out <dir>
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"flag"
-	"fmt"
-	"math/rand"
-	"os"
-	"path/filepath"
-
-	"gitea.iliadenisov.ru/developer/scrabble-solver/board"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rack"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/rules"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/scrabble"
-	"gitea.iliadenisov.ru/developer/scrabble-solver/selfplay"
-	dawg "github.com/iliadenisov/dafsa"
-)
-
-// blankTile marks a blank tile in a drawn hand (matches selfplay).
-const blankTile byte = 0xff
-
-// variantSpec pairs a variant label with its ruleset and dawg file.
-type variantSpec struct {
-	name  string
-	rules *rules.Ruleset
-	dawg  string
-}
-
-// cell is an occupied board square or a placement (alphabet-index letter).
-type cell struct {
-	R, C, Letter int
-	Blank        bool
-}
-
-// word mirrors scrabble.Word in index space.
-type word struct {
-	Row, Col, Dir int
-	Letters       []int
-	Blanks        []bool
-	Score         int
-}
-
-// fixture is one candidate play with the engine's ground-truth verdict.
-type fixture struct {
-	Board            int    `json:"board"` // index into the boards list
-	Dir              int    `json:"dir"`
-	IgnoreCrossWords bool   `json:"ignoreCrossWords"`
-	Tiles            []cell `json:"tiles"`
-	Legal            bool   `json:"legal"`
-	Score            int    `json:"score"`
-	Bonus            int    `json:"bonus"`
-	Main             *word  `json:"main,omitempty"`
-	Cross            []word `json:"cross,omitempty"`
-}
-
-// alphaEntry mirrors one row of the per-variant alphabet table the server sends the
-// client (index, concrete letter as the ruleset emits it, tile value), so the adapter
-// cross-test can drive the letter-space client path exactly as production does.
-type alphaEntry struct {
-	Index  int    `json:"index"`
-	Letter string `json:"letter"`
-	Value  int    `json:"value"`
-}
-
-// variantFile is the whole conformance payload for one variant.
-type variantFile struct {
-	Variant  string       `json:"variant"`
-	Rows     int          `json:"rows"`
-	Cols     int          `json:"cols"`
-	Center   int          `json:"center"`
-	RackSize int          `json:"rackSize"`
-	Bingo    int          `json:"bingo"`
-	Values   []int        `json:"values"`
-	Premiums []int        `json:"premiums"` // row-major rules.Premium codes
-	Alphabet []alphaEntry `json:"alphabet"`
-	Boards   [][]cell     `json:"boards"`
-	Fixtures []fixture    `json:"fixtures"`
-}
-
-func main() {
-	dawgDir := flag.String("dawg-dir", "../scrabble-solver/dawg", "directory holding the .dawg files")
-	outDir := flag.String("out", "", "output directory for the fixture files (required)")
-	games := flag.Int("games", 6, "self-play games per (variant, rule)")
-	plies := flag.Int("plies", 40, "maximum plies captured per game")
-	flag.Parse()
-	if *outDir == "" {
-		fail("-out is required")
-	}
-	if err := os.MkdirAll(*outDir, 0o755); err != nil {
-		fail("mkdir out: %v", err)
-	}
-
-	specs := []variantSpec{
-		{"scrabble_en", rules.English(), "en_sowpods.dawg"},
-		{"scrabble_ru", rules.RussianScrabble(), "ru_scrabble.dawg"},
-		{"erudit_ru", rules.Erudit(), "ru_erudit.dawg"},
-	}
-	for _, sp := range specs {
-		if err := generate(sp, *dawgDir, *outDir, *games, *plies); err != nil {
-			fail("%s: %v", sp.name, err)
-		}
-	}
-}
-
-func generate(sp variantSpec, dawgDir, outDir string, games, plies int) error {
-	data, err := os.ReadFile(filepath.Join(dawgDir, sp.dawg))
-	if err != nil {
-		return err
-	}
-	finder, err := dawg.Read(bytes.NewReader(data), 0)
-	if err != nil {
-		return fmt.Errorf("read dawg: %w", err)
-	}
-	defer finder.Close()
-
-	rs := sp.rules
-	solver := scrabble.NewSolver(rs, finder)
-
-	out := variantFile{
-		Variant: sp.name, Rows: rs.Rows, Cols: rs.Cols, Center: rs.Center,
-		RackSize: rs.RackSize, Bingo: rs.Bingo, Values: rs.Values,
-		Premiums: premiumCodes(rs), Alphabet: alphabetOf(rs),
-	}
-
-	// Capture under both the standard rule and the single-word rule, building the
-	// board with the same rule so positions are reachable under it.
-	for _, ignore := range []bool{false, true} {
-		opts := scrabble.PlayOptions{IgnoreCrossWords: ignore}
-		for g := range games {
-			seed := int64(g*1000) + boolseed(ignore) + variantSeed(sp.name)
-			playAndCapture(&out, rs, solver, opts, seed, plies)
-		}
-	}
-
-	b, err := json.Marshal(&out)
-	if err != nil {
-		return err
-	}
-	if err := os.WriteFile(filepath.Join(outDir, sp.name+".fixtures.json"), b, 0o644); err != nil {
-		return err
-	}
-	fmt.Printf("%-12s boards=%d fixtures=%d\n", sp.name, len(out.Boards), len(out.Fixtures))
-	return nil
-}
-
-// playAndCapture greedily self-plays one game, recording candidate plays against
-// each board position along the way.
-func playAndCapture(out *variantFile, rs *rules.Ruleset, solver *scrabble.Solver, opts scrabble.PlayOptions, seed int64, plies int) {
-	rng := rand.New(rand.NewSource(seed))
-	bag := selfplay.NewBag(rs, seed)
-	b := board.New(rs.Rows, rs.Cols)
-	hands := [2][]byte{bag.Draw(rs.RackSize), bag.Draw(rs.RackSize)}
-
-	passes := 0
-	for turn := range plies {
-		p := turn % 2
-		rk := rackOf(hands[p], rs.Size())
-		moves := solver.GenerateMovesOpts(b, rk, scrabble.Both, opts)
-		if len(moves) == 0 {
-			if passes++; passes >= 4 {
-				break
-			}
-			continue
-		}
-		passes = 0
-		top := moves[0]
-
-		boardIdx := len(out.Boards)
-		out.Boards = append(out.Boards, boardCells(b))
-		captureCandidates(out, rs, solver, opts, b, boardIdx, top, rng)
-
-		scrabble.Apply(b, top)
-		hands[p] = removeUsed(hands[p], top)
-		if need := rs.RackSize - len(hands[p]); need > 0 {
-			hands[p] = append(hands[p], bag.Draw(need)...)
-		}
-		if len(hands[p]) == 0 && bag.Len() == 0 {
-			break
-		}
-	}
-}
-
-// captureCandidates records the engine's top move plus derived candidates for one
-// board, each with its ValidatePlayOpts verdict.
-func captureCandidates(out *variantFile, rs *rules.Ruleset, solver *scrabble.Solver, opts scrabble.PlayOptions, b *board.Board, boardIdx int, top scrabble.Move, rng *rand.Rand) {
-	size := rs.Size()
-	record := func(tiles []scrabble.Placement) {
-		if len(tiles) == 0 {
-			return
-		}
-		out.Fixtures = append(out.Fixtures, makeFixture(solver, opts, b, boardIdx, tiles))
-	}
-
-	// The engine's own top move (legal).
-	record(top.Tiles)
-
-	// Letter-mutated variants: usually reject on the dictionary, occasionally form
-	// a different legal word.
-	for range 3 {
-		mut := clonePlacements(top.Tiles)
-		i := rng.Intn(len(mut))
-		mut[i].Letter = byte((int(mut[i].Letter) + 1 + rng.Intn(size-1)) % size)
-		record(mut)
-	}
-
-	// Random scatters: exercise geometry, dictionary and connectivity paths.
-	for range 3 {
-		record(randomScatter(b, size, 2+rng.Intn(4), rng))
-	}
-
-	// Single tiles abutting the board exercise the direction inference — a single
-	// tile is ambiguous, its orientation resolved from which axis it extends.
-	for range 3 {
-		if t, ok := randomAdjacentSingle(b, size, rng); ok {
-			record([]scrabble.Placement{t})
-		}
-	}
-
-	// On the empty board, an off-centre translation of the first move exercises the
-	// first-move centre rule.
-	if b.IsEmpty() {
-		shifted := clonePlacements(top.Tiles)
-		ok := true
-		for i := range shifted {
-			shifted[i].Row++
-			shifted[i].Col++
-			if !b.InBounds(shifted[i].Row, shifted[i].Col) {
-				ok = false
-				break
-			}
-		}
-		if ok {
-			record(shifted)
-		}
-	}
-}
-
-// makeFixture validates a candidate against board b and serializes it with its
-// ground truth. Word breakdown is recorded only for legal plays (the TS test
-// checks words only then); an illegal play records legal=false alone.
-func makeFixture(solver *scrabble.Solver, opts scrabble.PlayOptions, b *board.Board, boardIdx int, tiles []scrabble.Placement) fixture {
-	// Infer the orientation exactly as the backend evaluate does (dir-less), so the
-	// fixture matches the real eval path and pins the client's ported inference.
-	dir := playDirectionMirror(solver, b, tiles, opts)
-	fx := fixture{
-		Board:            boardIdx,
-		Dir:              int(dir),
-		IgnoreCrossWords: opts.IgnoreCrossWords,
-		Tiles:            placementCells(tiles),
-	}
-	m, err := solver.ValidatePlayOpts(b, dir, tiles, opts)
-	if err == nil {
-		fx.Legal = true
-		fx.Score = m.Score
-		fx.Bonus = m.Bonus
-		fx.Main = toWord(m.Main)
-		for _, cw := range m.Cross {
-			fx.Cross = append(fx.Cross, *toWord(cw))
-		}
-	}
-	return fx
-}
-
-func placementCells(ts []scrabble.Placement) []cell {
-	cs := make([]cell, len(ts))
-	for i, t := range ts {
-		cs[i] = cell{R: t.Row, C: t.Col, Letter: int(t.Letter), Blank: t.Blank}
-	}
-	return cs
-}
-
-func toWord(w scrabble.Word) *word {
-	letters := make([]int, len(w.Letters))
-	for i, l := range w.Letters {
-		letters[i] = int(l)
-	}
-	return &word{
-		Row: w.Row, Col: w.Col, Dir: int(w.Dir),
-		Letters: letters, Blanks: append([]bool(nil), w.Blanks...), Score: w.Score,
-	}
-}
-
-func alphabetOf(rs *rules.Ruleset) []alphaEntry {
-	n := rs.Alphabet.Size()
-	out := make([]alphaEntry, n)
-	for i := range n {
-		ch, _ := rs.Alphabet.Character(byte(i))
-		out[i] = alphaEntry{Index: i, Letter: ch, Value: rs.Values[i]}
-	}
-	return out
-}
-
-func premiumCodes(rs *rules.Ruleset) []int {
-	codes := make([]int, rs.Rows*rs.Cols)
-	for i := range codes {
-		codes[i] = int(rs.PremiumAt(i))
-	}
-	return codes
-}
-
-func boardCells(b *board.Board) []cell {
-	var cs []cell
-	for r := 0; r < b.Rows(); r++ {
-		for c := 0; c < b.Cols(); c++ {
-			if b.Filled(r, c) {
-				v := b.At(r, c)
-				cs = append(cs, cell{R: r, C: c, Letter: int(v&0x3f) - 1, Blank: v&0x80 != 0})
-			}
-		}
-	}
-	return cs
-}
-
-func clonePlacements(ts []scrabble.Placement) []scrabble.Placement {
-	return append([]scrabble.Placement(nil), ts...)
-}
-
-// randomScatter picks n distinct empty in-bounds squares with random letters.
-func randomScatter(b *board.Board, size, n int, rng *rand.Rand) []scrabble.Placement {
-	seen := map[[2]int]bool{}
-	var ts []scrabble.Placement
-	for tries := 0; tries < n*20 && len(ts) < n; tries++ {
-		r := rng.Intn(b.Rows())
-		c := rng.Intn(b.Cols())
-		if seen[[2]int{r, c}] || b.Filled(r, c) {
-			continue
-		}
-		seen[[2]int{r, c}] = true
-		ts = append(ts, scrabble.Placement{Row: r, Col: c, Letter: byte(rng.Intn(size)), Blank: rng.Intn(10) == 0})
-	}
-	return ts
-}
-
-// randomAdjacentSingle picks a random empty in-bounds square abutting at least one
-// filled square, with a random letter — a single-tile play whose orientation the
-// inference must resolve. It returns ok=false on an empty board.
-func randomAdjacentSingle(b *board.Board, size int, rng *rand.Rand) (scrabble.Placement, bool) {
-	var cands [][2]int
-	for r := 0; r < b.Rows(); r++ {
-		for c := 0; c < b.Cols(); c++ {
-			if b.Filled(r, c) {
-				continue
-			}
-			if b.Filled(r-1, c) || b.Filled(r+1, c) || b.Filled(r, c-1) || b.Filled(r, c+1) {
-				cands = append(cands, [2]int{r, c})
-			}
-		}
-	}
-	if len(cands) == 0 {
-		return scrabble.Placement{}, false
-	}
-	rc := cands[rng.Intn(len(cands))]
-	return scrabble.Placement{Row: rc[0], Col: rc[1], Letter: byte(rng.Intn(size)), Blank: rng.Intn(10) == 0}, true
-}
-
-// playDirectionMirror mirrors engine (*Game).playDirection: the geometric
-// resolution, except a single tile under the single-word rule tries both
-// orientations through the solver and keeps the higher-scoring legal one (H wins
-// ties). It reproduces the orientation the backend evaluate infers.
-func playDirectionMirror(solver *scrabble.Solver, b *board.Board, placements []scrabble.Placement, opts scrabble.PlayOptions) scrabble.Direction {
-	geo := resolveDirectionMirror(b, placements)
-	if len(placements) != 1 || !opts.IgnoreCrossWords {
-		return geo
-	}
-	best, found, bestScore := geo, false, 0
-	for _, dir := range [...]scrabble.Direction{scrabble.Horizontal, scrabble.Vertical} {
-		m, err := solver.ValidatePlayOpts(b, dir, placements, opts)
-		if err != nil {
-			continue
-		}
-		if !found || m.Score > bestScore {
-			best, found, bestScore = dir, true, m.Score
-		}
-	}
-	return best
-}
-
-// resolveDirectionMirror mirrors engine.resolveDirection.
-func resolveDirectionMirror(b *board.Board, placements []scrabble.Placement) scrabble.Direction {
-	if len(placements) >= 2 {
-		row := placements[0].Row
-		for _, p := range placements[1:] {
-			if p.Row != row {
-				return scrabble.Vertical
-			}
-		}
-		return scrabble.Horizontal
-	}
-	if len(placements) == 1 {
-		p := placements[0]
-		h := runLengthMirror(b, p.Row, p.Col, scrabble.Horizontal)
-		v := runLengthMirror(b, p.Row, p.Col, scrabble.Vertical)
-		if v >= 2 && v > h {
-			return scrabble.Vertical
-		}
-		if h >= 2 {
-			return scrabble.Horizontal
-		}
-		if v >= 2 {
-			return scrabble.Vertical
-		}
-	}
-	return scrabble.Horizontal
-}
-
-// runLengthMirror mirrors engine.runLength.
-func runLengthMirror(b *board.Board, row, col int, dir scrabble.Direction) int {
-	dr, dc := 0, 1
-	if dir == scrabble.Vertical {
-		dr, dc = 1, 0
-	}
-	n := 1
-	for r, c := row-dr, col-dc; b.Filled(r, c); r, c = r-dr, c-dc {
-		n++
-	}
-	for r, c := row+dr, col+dc; b.Filled(r, c); r, c = r+dr, c+dc {
-		n++
-	}
-	return n
-}
-
-// rackOf builds a generation rack from a hand of tiles (reimplemented from the
-// unexported selfplay helper).
-func rackOf(tiles []byte, size int) rack.Rack {
-	r := rack.New(size)
-	for _, t := range tiles {
-		if t == blankTile {
-			r.AddBlank()
-		} else {
-			r.Add(t)
-		}
-	}
-	return r
-}
-
-// removeUsed returns the hand with the tiles consumed by m removed.
-func removeUsed(tiles []byte, m scrabble.Move) []byte {
-	out := append([]byte(nil), tiles...)
-	for _, p := range m.Tiles {
-		want := p.Letter
-		if p.Blank {
-			want = blankTile
-		}
-		for i, t := range out {
-			if t == want {
-				out = append(out[:i], out[i+1:]...)
-				break
-			}
-		}
-	}
-	return out
-}
-
-func boolseed(b bool) int64 {
-	if b {
-		return 500000
-	}
-	return 0
-}
-
-func variantSeed(name string) int64 {
-	var s int64
-	for _, r := range name {
-		s = s*131 + int64(r)
-	}
-	return s
-}
-
-func fail(format string, args ...any) {
-	fmt.Fprintf(os.Stderr, "validategen: "+format+"\n", args...)
-	os.Exit(1)
-}
@@ -13,7 +13,6 @@ require (
 	github.com/pressly/goose/v3 v3.27.1
 	github.com/testcontainers/testcontainers-go v0.42.0
 	github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0
-	github.com/wneessen/go-mail v0.7.3
 	go.opentelemetry.io/otel v1.43.0
 	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0
@@ -110,7 +109,7 @@ require (
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
@@ -279,8 +279,6 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
 github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
-github.com/wneessen/go-mail v0.7.3 h1:g3DravXC5SMlVdboFrQA8Jx95A8sOzoBeS5F+vzNRK0=
-github.com/wneessen/go-mail v0.7.3/go.mod h1:QGhBX0yNbc1J+Mkjcu7z2rpj4B4l+BmDY8gYznPC9sk=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
@@ -402,8 +400,6 @@ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
 golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
@@ -22,13 +22,12 @@ import (
 	"scrabble/backend/internal/postgres/jet/backend/table"
 )

-// Identity kinds recognised by the backend. Telegram and VK are platform identities,
-// auto-confirmed on first contact. Email is modelled as an identity alongside them; its
-// confirmed flag is driven by the email confirm-code flow. Robot is a synthetic kind:
-// each pooled robot opponent is a durable account bound to one robot identity.
+// Identity kinds recognised by the backend. Email is modelled as an identity
+// alongside platform identities; its confirmed flag is driven by the email
+// confirm-code flow. Robot is a synthetic kind: each pooled
+// robot opponent is a durable account bound to one robot identity.
 const (
 	KindTelegram = "telegram"
-	KindVK       = "vk"
 	KindEmail    = "email"
 	KindRobot    = "robot"
 )
@@ -56,12 +55,12 @@ type Account struct {
 	HintBalance         int
 	BlockChat           bool
 	BlockFriendRequests bool
-	// VariantPreferences is the set of game variants (engine.Variant stable labels:
-	// "scrabble_en", "scrabble_ru", "erudit_ru") the player is willing to be matched
-	// into. It gates the New Game picker, the matchmaker and the friend-invite the
-	// player creates; an invited friend may still accept any variant. A new account
-	// defaults to Erudit only. Never empty — enforced on update and by a DB check.
-	VariantPreferences []string
+	// ServiceLanguage is the language tag (en/ru) of the bot the account last
+	// authenticated through (its last Telegram ValidateInitData); it routes the
+	// account's out-of-app push back through the right bot. Empty when the account
+	// has never signed in through a tagged bot. Distinct from PreferredLanguage (the
+	// interface language) and from a game's variant language.
+	ServiceLanguage string
 	// IsGuest marks an ephemeral guest account: a durable row with no identity,
 	// excluded from statistics, friends and history.
 	IsGuest bool
@@ -120,47 +119,6 @@ func (s *Store) ProvisionByIdentity(ctx context.Context, kind, externalID string
 	return s.provision(ctx, kind, externalID, provisionSeed{})
 }

-// ProvisionEmail returns the account owning the email identity externalID, creating
-// it on first contact with browserTZ — the client's detected "±HH:MM" UTC offset —
-// seeded into its time zone, language seeded from the client's UI language, and its
-// display name seeded from the email's local part (so it is not left nameless). Like
-// ProvisionByIdentity it is race-safe and leaves an existing account untouched, so a
-// returning user's saved zone, language and name are never overwritten. The email account is
-// created here (the code-request step), not at the later login, so this is where its
-// zone and language are seeded. It is created flagged is_guest with an unconfirmed
-// email identity: an abandoned, never-confirmed login is then reaped like any guest,
-// freeing the reserved address, and confirming the code clears the guest flag.
-func (s *Store) ProvisionEmail(ctx context.Context, externalID, browserTZ, language string) (Account, error) {
-	return s.provision(ctx, KindEmail, externalID, provisionSeed{
-		displayName:       emailDisplayName(externalID),
-		timeZone:          seedZone(browserTZ),
-		preferredLanguage: supportedLanguage(language),
-		isGuest:           true,
-	})
-}
-
-// emailDisplayName derives a display name from an email address — the local part
-// before '@', trimmed and capped to the column width — so a new email account is not
-// left nameless. It is only the first-contact seed; the user can rename it later.
-func emailDisplayName(email string) string {
-	local, _, _ := strings.Cut(email, "@")
-	local = strings.TrimSpace(local)
-	if r := []rune(local); len(r) > maxDisplayName {
-		local = strings.TrimRight(string(r[:maxDisplayName]), " ")
-	}
-	return local
-}
-
-// supportedLanguage returns code normalised to a supported UI language ("en" or
-// "ru"), or "" when it maps to neither, so a new account keeps the 'en' default. It
-// accepts region-tagged codes ("ru-RU").
-func supportedLanguage(code string) string {
-	if lang, _, _ := strings.Cut(strings.ToLower(strings.TrimSpace(code)), "-"); lang == "en" || lang == "ru" {
-		return lang
-	}
-	return ""
-}
-
 // ProvisionRobot provisions (or finds) the durable account backing a robot pool
 // member: a KindRobot identity carrying displayName, with chat blocked but friend
 // requests NOT blocked — a request to a robot is accepted as pending and, since the
@@ -193,50 +151,14 @@ func (s *Store) ProvisionRobot(ctx context.Context, externalID, displayName stri
 	return modelToAccount(row), nil
 }

-// ProvisionTelegram provisions (or finds) the account bound to a Telegram identity,
-// reporting whether this call created it (first contact). On first contact only, it
-// seeds the new account's preferred language from the Telegram client languageCode
-// (when it maps to a supported language) and its display name sanitized from firstName
-// (falling back to username, then to a generated placeholder when neither yields any
-// letters); an already-existing account is returned unchanged, so a later profile edit
-// is never overwritten. The created flag lets the auth handler re-evaluate moderated-
-// chat write access on first registration — the path of a user who joined the chat
-// before registering, whom no chat_member event covers.
-func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode, username, firstName, browserTZ string) (Account, bool, error) {
-	// Pre-check whether the identity already exists so the caller can act on first
-	// contact. A race with a concurrent create only over- or under-reports created for
-	// that one call, which the idempotent chat-access re-evaluation tolerates.
-	_, err := s.findByIdentity(ctx, KindTelegram, externalID)
-	created := errors.Is(err, ErrNotFound)
-	if err != nil && !created {
-		return Account{}, false, err
-	}
-	seed := telegramSeed(languageCode, username, firstName)
-	seed.timeZone = seedZone(browserTZ)
-	acc, err := s.provision(ctx, KindTelegram, externalID, seed)
-	return acc, created, err
-}
-
-// ProvisionVK provisions (or finds) the account bound to a VK identity, reporting
-// whether this call created it (first contact). On first contact only, it seeds the new
-// account's preferred language from the VK languageCode (vk_language, when it maps to a
-// supported language) and its display name sanitized from displayName — the name read
-// client-side via VKWebAppGetUserInfo, since VK omits it from the signed launch params —
-// falling back to a generated placeholder when it yields no letters; an already-existing
+// ProvisionTelegram provisions (or finds) the account bound to a Telegram
+// identity. On first contact only, it seeds the new account's preferred language
+// from the Telegram client languageCode (when it maps to a supported language) and
+// its display name sanitized from firstName (falling back to username, then to a
+// generated placeholder when neither yields any letters); an already-existing
 // account is returned unchanged, so a later profile edit is never overwritten.
-func (s *Store) ProvisionVK(ctx context.Context, externalID, languageCode, displayName, browserTZ string) (Account, bool, error) {
-	// Pre-check whether the identity already exists so the caller can act on first
-	// contact (mirrors ProvisionTelegram); a create race only mis-reports created for
-	// that one call.
-	_, err := s.findByIdentity(ctx, KindVK, externalID)
-	created := errors.Is(err, ErrNotFound)
-	if err != nil && !created {
-		return Account{}, false, err
-	}
-	seed := vkSeed(languageCode, displayName)
-	seed.timeZone = seedZone(browserTZ)
-	acc, err := s.provision(ctx, KindVK, externalID, seed)
-	return acc, created, err
+func (s *Store) ProvisionTelegram(ctx context.Context, externalID, languageCode, username, firstName string) (Account, error) {
+	return s.provision(ctx, KindTelegram, externalID, telegramSeed(languageCode, username, firstName))
 }

 // provision finds the account for (kind, externalID) or creates it with seed,
@@ -263,38 +185,20 @@ func (s *Store) provision(ctx context.Context, kind, externalID string, seed pro
 }

 // provisionSeed carries the optional create-time profile seed for a brand-new
-// account (first contact). Empty fields fall back to the accounts table defaults,
-// so an unknown language keeps the 'en' default, an empty name keeps the ” default
-// and an empty time zone keeps the 'UTC' default.
+// account (Telegram first contact). Empty fields fall back to the accounts table
+// defaults, so an unknown language keeps the 'en' default and an empty name keeps
+// the ” default.
 type provisionSeed struct {
 	preferredLanguage string
 	displayName       string
-	timeZone          string
-	// isGuest creates the account flagged is_guest. It is set for an email-login
-	// account, which stays a guest until the address is confirmed (so an abandoned,
-	// never-confirmed login is reaped and its address freed); confirming clears the
-	// flag. Platform identities (telegram/vk) are durable from creation.
-	isGuest bool
-}
-
-// seedZone returns browserTZ when it is a well-formed zone to persist at account
-// creation (a "±HH:MM" offset or a loadable IANA name), else "" so the new account
-// falls back to the accounts table's 'UTC' default. The client reports the device's
-// detected offset deterministically; a bad value is dropped rather than guessed at.
-func seedZone(browserTZ string) string {
-	if validZone(browserTZ) {
-		return browserTZ
-	}
-	return ""
 }

 // telegramSeed derives the create-time seed from Telegram launch fields: a
 // supported preferred language from languageCode (an ISO-639 code, possibly
-// region-tagged like "ru-RU"), and a display name. The name precedence is the real
-// name (firstName, sanitized to the editable format) → the @username taken verbatim
-// (already a valid handle, only trimmed and length-capped, never character-stripped)
-// → a generated placeholder in the seeded language (placeholderDisplayName), reached
-// only when firstName has no usable letters and no username is set.
+// region-tagged like "ru-RU"), and a display name sanitized from firstName or,
+// failing that, username (sanitizeDisplayName strips disallowed characters to the
+// editable format). When neither yields any letters, it falls back to a generated
+// placeholder in the seeded language (placeholderDisplayName).
 func telegramSeed(languageCode, username, firstName string) provisionSeed {
 	var seed provisionSeed
 	if lang, _, _ := strings.Cut(strings.ToLower(strings.TrimSpace(languageCode)), "-"); lang == "en" || lang == "ru" {
@@ -302,32 +206,8 @@ func telegramSeed(languageCode, username, firstName string) provisionSeed {
 	}
 	name := sanitizeDisplayName(firstName)
 	if name == "" {
-		// The real name yielded nothing usable: fall back to the @username verbatim
-		// (Telegram guarantees a valid handle), only trimmed and capped to the column
-		// width — never character-stripped like the real name.
-		name = strings.TrimSpace(username)
-		if r := []rune(name); len(r) > maxDisplayName {
-			name = strings.TrimRight(string(r[:maxDisplayName]), " ")
+		name = sanitizeDisplayName(username)
 	}
-	}
-	if name == "" {
-		name = placeholderDisplayName(seed.preferredLanguage)
-	}
-	seed.displayName = name
-	return seed
-}
-
-// vkSeed derives the create-time seed from VK launch fields: a supported preferred
-// language from languageCode (vk_language, normally a 2-letter code) and a display name
-// from displayName (sanitized to the editable format), falling back to a generated
-// placeholder in the seeded language when the name yields no usable letters. Unlike
-// telegramSeed there is no @username fallback — VK provides only the name.
-func vkSeed(languageCode, displayName string) provisionSeed {
-	var seed provisionSeed
-	if lang, _, _ := strings.Cut(strings.ToLower(strings.TrimSpace(languageCode)), "-"); lang == "en" || lang == "ru" {
-		seed.preferredLanguage = lang
-	}
-	name := sanitizeDisplayName(displayName)
 	if name == "" {
 		name = placeholderDisplayName(seed.preferredLanguage)
 	}
@@ -423,14 +303,6 @@ func (s *Store) CountAccounts(ctx context.Context) (int, error) {
 	return int(dest.Count), nil
 }

-// AccountByIdentity returns the account bound to (kind, externalID), or ErrNotFound
-// when none exists. Unlike ProvisionByIdentity it never creates one: the chat-access
-// resolver uses it to tell a registered Telegram user (eligible to be granted chat
-// write access) from an unregistered one (left muted).
-func (s *Store) AccountByIdentity(ctx context.Context, kind, externalID string) (Account, error) {
-	return s.findByIdentity(ctx, kind, externalID)
-}
-
 // findByIdentity joins identities to accounts and returns the matching account,
 // or ErrNotFound.
 func (s *Store) findByIdentity(ctx context.Context, kind, externalID string) (Account, error) {
@@ -469,22 +341,16 @@ func (s *Store) create(ctx context.Context, kind, externalID string, seed provis

 	var created Account
 	err = withTx(ctx, s.db, func(tx *sql.Tx) error {
-		// Seed the new row's display name, language and time zone (first contact); an
-		// empty seed reproduces the table defaults ('', 'en' and 'UTC') the other callers
-		// relied on, so their behaviour is unchanged. time_zone is written explicitly (the
-		// detected offset, or 'UTC' equal to the column default) so a seeded zone lands at
-		// creation while an unseeded one stays UTC.
+		// Seed the new row's display name and language (Telegram first contact); an
+		// empty seed reproduces the table defaults ('' and 'en') the other callers
+		// relied on, so their behaviour is unchanged.
 		lang := seed.preferredLanguage
 		if lang == "" {
 			lang = "en"
 		}
-		tz := seed.timeZone
-		if tz == "" {
-			tz = "UTC"
-		}
 		insertAccount := table.Accounts.
-			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage, table.Accounts.TimeZone, table.Accounts.IsGuest).
-			VALUES(accountID, seed.displayName, lang, tz, seed.isGuest).
+			INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.PreferredLanguage).
+			VALUES(accountID, seed.displayName, lang).
 			RETURNING(table.Accounts.AllColumns)

 		var row model.Accounts
@@ -498,7 +364,7 @@ func (s *Store) create(ctx context.Context, kind, externalID string, seed provis
 			table.Identities.Kind,
 			table.Identities.ExternalID,
 			table.Identities.Confirmed,
-		).VALUES(identityID, accountID, kind, externalID, kind == KindTelegram || kind == KindVK)
+		).VALUES(identityID, accountID, kind, externalID, kind == KindTelegram)
 		if _, err := insertIdentity.ExecContext(ctx, tx); err != nil {
 			return err
 		}
@@ -523,21 +389,15 @@ const guestDisplayName = "Guest"
 // ProvisionGuest creates a fresh ephemeral guest account: a durable row carrying
 // no identity, flagged is_guest, so it can hold a session and a game seat (both
 // foreign-key the accounts table) while being excluded from statistics, friends
-// and history. Guests are not reused — each bootstrap mints a new account. browserTZ
-// (the client's detected "±HH:MM" UTC offset) seeds the guest's time zone, falling
-// back to the 'UTC' default when empty or malformed.
-func (s *Store) ProvisionGuest(ctx context.Context, browserTZ string) (Account, error) {
+// and history. Guests are not reused — each bootstrap mints a new account.
+func (s *Store) ProvisionGuest(ctx context.Context) (Account, error) {
 	accountID, err := uuid.NewV7()
 	if err != nil {
 		return Account{}, fmt.Errorf("account: new guest id: %w", err)
 	}
-	tz := seedZone(browserTZ)
-	if tz == "" {
-		tz = "UTC"
-	}
 	stmt := table.Accounts.
-		INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.IsGuest, table.Accounts.TimeZone).
-		VALUES(accountID, guestDisplayName, true, tz).
+		INSERT(table.Accounts.AccountID, table.Accounts.DisplayName, table.Accounts.IsGuest).
+		VALUES(accountID, guestDisplayName, true).
 		RETURNING(table.Accounts.AllColumns)

 	var row model.Accounts
@@ -631,12 +491,36 @@ func (s *Store) ClearHighRateFlag(ctx context.Context, id uuid.UUID) error {
 	return nil
 }

+// SetServiceLanguage records the service language (en/ru) of the bot a Telegram
+// user authenticated through. It is called on every Telegram login — new and
+// existing accounts — so it tracks the bot the user last came through (last-login-
+// wins), and the out-of-app push routes by it. It is a no-op for an empty language
+// (a non-Telegram login carries none) and does not bump updated_at (an infra
+// routing field, not a user profile edit).
+func (s *Store) SetServiceLanguage(ctx context.Context, id uuid.UUID, language string) error {
+	if language == "" {
+		return nil
+	}
+	stmt := table.Accounts.
+		UPDATE(table.Accounts.ServiceLanguage).
+		SET(postgres.String(language)).
+		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(id)))
+	if _, err := stmt.ExecContext(ctx, s.db); err != nil {
+		return fmt.Errorf("account: set service language %s: %w", id, err)
+	}
+	return nil
+}
+
 // modelToAccount projects a generated model row into the public Account struct.
 func modelToAccount(row model.Accounts) Account {
 	var mergedInto uuid.UUID
 	if row.MergedInto != nil {
 		mergedInto = *row.MergedInto
 	}
+	var serviceLanguage string
+	if row.ServiceLanguage != nil {
+		serviceLanguage = *row.ServiceLanguage
+	}
 	var flaggedHighRateAt time.Time
 	if row.FlaggedHighRateAt != nil {
 		flaggedHighRateAt = *row.FlaggedHighRateAt
@@ -645,7 +529,7 @@ func modelToAccount(row model.Accounts) Account {
 		ID:                     row.AccountID,
 		DisplayName:            row.DisplayName,
 		PreferredLanguage:      row.PreferredLanguage,
-		VariantPreferences:     []string(row.VariantPreferences),
+		ServiceLanguage:        serviceLanguage,
 		TimeZone:               row.TimeZone,
 		AwayStart:              row.AwayStart,
 		AwayEnd:                row.AwayEnd,
@@ -5,7 +5,6 @@ import (
 	crand "crypto/rand"
 	"crypto/sha256"
 	"database/sql"
-	"encoding/base64"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -27,22 +26,6 @@ const (
 	emailCodeTTL = 15 * time.Minute
 	// emailCodeMaxAttempts caps wrong-code submissions before a code is dead.
 	emailCodeMaxAttempts = 5
-	// linkTokenBytes is the entropy of a confirm deeplink token: 256 bits.
-	linkTokenBytes = 32
-	// emailConfirmPath is the SPA route the one-tap confirm deeplink opens (the token
-	// is appended). The SPA is served under /app/ behind a hash router.
-	emailConfirmPath = "/app/#/confirm/"
-)
-
-// Confirmation purposes recorded on a pending confirm-code row. They select what
-// verifying the code or the deeplink token does: sign in (login), link/confirm the
-// address on the current account (link), or replace the account's confirmed email with
-// a new address (change). Account deletion adds a further purpose in a later stage.
-const (
-	purposeLogin  = "login"
-	purposeLink   = "link"
-	purposeChange = "change"
-	purposeDelete = "delete"
 )

 // Errors returned by the email confirm-code flow.
@@ -63,12 +46,6 @@ var (
 	ErrTooManyAttempts = errors.New("account: too many confirmation attempts")
 	// ErrCodeMismatch is returned when the submitted code does not match.
 	ErrCodeMismatch = errors.New("account: confirmation code does not match")
-	// ErrTooManyRequests is returned when confirm-code sends to an address are being
-	// requested too frequently (the resend cooldown or the rolling-hour cap).
-	ErrTooManyRequests = errors.New("account: too many code requests")
-	// ErrNoEmail is returned when an email-code step-up is requested for an account that
-	// holds no confirmed email (the caller must use the typed-phrase path instead).
-	ErrNoEmail = errors.New("account: no confirmed email")
 )

 // EmailService runs the email confirm-code flow: it issues a 6-digit code over a
@@ -80,78 +57,12 @@ var (
 type EmailService struct {
 	store  *Store
 	mailer Mailer
-	baseURL string
-	limiter *SendLimiter
 	now    func() time.Time
 }

-// NewEmailService constructs an EmailService over store, sending via mailer. baseURL
-// is the canonical public origin (scheme + host) used to build the one-tap confirm
-// deeplink and the email footer landing link; an empty baseURL omits the deeplink
-// (development / log mailer).
-func NewEmailService(store *Store, mailer Mailer, baseURL string) *EmailService {
-	return &EmailService{store: store, mailer: mailer, baseURL: baseURL, now: func() time.Time { return time.Now().UTC() }}
-}
-
-// SetSendLimiter installs a per-recipient send throttle. When unset (nil), sends are
-// not throttled — production wires a limiter; tests leave it off.
-func (s *EmailService) SetSendLimiter(l *SendLimiter) { s.limiter = l }
-
-// allowSend reports whether a confirm-code send to email is permitted now, recording
-// it when so. A nil limiter permits every send.
-func (s *EmailService) allowSend(email string) bool {
-	return s.limiter == nil || s.limiter.Allow(email)
-}
-
-// issueCode generates a fresh confirm-code and one-tap deeplink token for (accountID,
-// email), replaces any prior pending confirmation, and mails the branded code in
-// locale; purpose selects the email wording and what verifying does. Only the SHA-256
-// hashes of the code and token are stored.
-func (s *EmailService) issueCode(ctx context.Context, accountID uuid.UUID, email, purpose, locale string) error {
-	code, codeHash, err := generateCode()
-	if err != nil {
-		return err
-	}
-	token, tokenHash, err := generateLinkToken()
-	if err != nil {
-		return err
-	}
-	if err := s.store.replacePendingConfirmation(ctx, accountID, email, codeHash, tokenHash, purpose, s.now().Add(emailCodeTTL)); err != nil {
-		return err
-	}
-	// Account deletion is never a one-tap link (a prefetch or a stray click must not delete
-	// an account): the delete code is entered in the app only, so the email omits the
-	// deeplink and ConfirmByToken refuses a delete token.
-	deeplink := s.confirmURL(token, locale)
-	if purpose == purposeDelete {
-		deeplink = ""
-	}
-	msg, err := renderConfirmationEmail(purpose, code, deeplink, s.baseURL, locale)
-	if err != nil {
-		return err
-	}
-	msg.To = email
-	return s.mailer.Send(ctx, msg)
-}
-
-// confirmURL builds the absolute one-tap confirm deeplink for token in locale, or ""
-// when no public base URL is configured. The locale rides the fragment as ?lang so the
-// confirm screen (opened in a browser with no session) renders in the email's language.
-func (s *EmailService) confirmURL(token, locale string) string {
-	if s.baseURL == "" {
-		return ""
-	}
-	return strings.TrimRight(s.baseURL, "/") + emailConfirmPath + token + "?lang=" + normalizeLocale(locale)
-}
-
-// accountLocale returns the account's preferred UI language for localising email,
-// defaulting to "en" when the account cannot be loaded.
-func (s *EmailService) accountLocale(ctx context.Context, accountID uuid.UUID) string {
-	acc, err := s.store.GetByID(ctx, accountID)
-	if err != nil {
-		return "en"
-	}
-	return acc.PreferredLanguage
+// NewEmailService constructs an EmailService over store, sending via mailer.
+func NewEmailService(store *Store, mailer Mailer) *EmailService {
+	return &EmailService{store: store, mailer: mailer, now: func() time.Time { return time.Now().UTC() }}
 }

 // RequestCode issues a fresh confirm-code for email to accountID and mails it,
@@ -162,9 +73,6 @@ func (s *EmailService) RequestCode(ctx context.Context, accountID uuid.UUID, ema
 	if err != nil {
 		return err
 	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
 	owner, ok, err := s.store.confirmedEmailAccount(ctx, addr)
 	if err != nil {
 		return err
@@ -175,7 +83,16 @@ func (s *EmailService) RequestCode(ctx context.Context, accountID uuid.UUID, ema
 		}
 		return ErrEmailTaken
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID))
+	code, hash, err := generateCode()
+	if err != nil {
+		return err
+	}
+	if err := s.store.replacePendingConfirmation(ctx, accountID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return err
+	}
+	subject := "Your Scrabble confirmation code"
+	body := fmt.Sprintf("Your confirmation code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	return s.mailer.Send(ctx, addr, subject, body)
 }

 // ConfirmCode verifies code for accountID and email. On success it attaches a
@@ -206,35 +123,34 @@ func (s *EmailService) ConfirmCode(ctx context.Context, accountID uuid.UUID, ema
 	if err := s.store.confirmEmailIdentity(ctx, conf.id, accountID, addr, s.now()); err != nil {
 		return Account{}, err
 	}
-	// Binding the first confirmed email promotes a guest to a durable account, matching the
-	// link and deeplink flows (defence-in-depth: no confirmed-email path leaves is_guest set).
-	if err := s.store.ClearGuest(ctx, accountID); err != nil {
-		return Account{}, err
-	}
 	return s.store.GetByID(ctx, accountID)
 }

 // RequestLoginCode issues a login confirm-code to the account that owns email,
-// provisioning a fresh (unconfirmed) guest account when the email is new — it becomes
-// durable once the code is confirmed. It is the unauthenticated email-login entry
-// point and, unlike RequestCode, does not refuse an already-confirmed email — that is
-// the ordinary returning-user login. The code is mailed to the address, so only its
-// real owner can complete the login. On first contact browserTZ (the client's
-// detected "±HH:MM" UTC offset) seeds the new account's time zone and language its UI
-// language. It returns the target account id for the subsequent LoginWithCode.
-func (s *EmailService) RequestLoginCode(ctx context.Context, email, browserTZ, language string) (uuid.UUID, error) {
+// provisioning a fresh (unconfirmed) durable account when the email is new. It is
+// the unauthenticated email-login entry point and, unlike RequestCode,
+// does not refuse an already-confirmed email — that is the ordinary returning-user
+// login. The code is mailed to the address, so only its real owner can complete
+// the login. It returns the target account id for the subsequent LoginWithCode.
+func (s *EmailService) RequestLoginCode(ctx context.Context, email string) (uuid.UUID, error) {
 	addr, err := normalizeEmail(email)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	if !s.allowSend(addr) {
-		return uuid.UUID{}, ErrTooManyRequests
-	}
-	acc, err := s.store.ProvisionEmail(ctx, addr, browserTZ, language)
+	acc, err := s.store.ProvisionByIdentity(ctx, KindEmail, addr)
 	if err != nil {
 		return uuid.UUID{}, err
 	}
-	if err := s.issueCode(ctx, acc.ID, addr, purposeLogin, language); err != nil {
+	code, hash, err := generateCode()
+	if err != nil {
+		return uuid.UUID{}, err
+	}
+	if err := s.store.replacePendingConfirmation(ctx, acc.ID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return uuid.UUID{}, err
+	}
+	subject := "Your Scrabble login code"
+	body := fmt.Sprintf("Your login code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	if err := s.mailer.Send(ctx, addr, subject, body); err != nil {
 		return uuid.UUID{}, err
 	}
 	return acc.ID, nil
@@ -273,104 +189,9 @@ func (s *EmailService) LoginWithCode(ctx context.Context, email, code string) (A
 	if err := s.store.confirmEmailLogin(ctx, conf.id, acc.ID, addr, s.now()); err != nil {
 		return Account{}, err
 	}
-	if err := s.store.ClearGuest(ctx, acc.ID); err != nil {
-		return Account{}, err
-	}
 	return s.store.GetByID(ctx, acc.ID)
 }

-// LinkConfirmation is the outcome of confirming a one-tap deeplink token: what the
-// transport layer must finish. Purpose is the pending row's purpose. For a login,
-// Account is the account to sign in. For a link, Account is the account the email was
-// (or would be) attached to; NeedsMerge is set when another account (MergeOwner)
-// already owns the address, so the caller drives the interactive merge instead of a
-// plain link — the token is left unconsumed for that merge step.
-type LinkConfirmation struct {
-	Purpose    string
-	Account    uuid.UUID
-	NeedsMerge bool
-	MergeOwner uuid.UUID
-}
-
-// IsLogin reports whether the confirmation is a login (the caller mints a session)
-// rather than a link (attach the identity, or drive a merge).
-func (r LinkConfirmation) IsLogin() bool { return r.Purpose == purposeLogin }
-
-// ConfirmByToken verifies a one-tap deeplink token and performs its purpose. A login
-// confirms the email identity, clears the guest flag and returns the account to sign
-// in. A link attaches the confirmed email to the pending account when the address is
-// free, or reports NeedsMerge when another account already owns it (leaving the token
-// live so the caller's merge step can re-verify). It returns ErrNoPendingCode when the
-// token matches no live confirmation and ErrCodeExpired when it has lapsed. The token
-// is high-entropy, so there is no wrong-attempt counter.
-func (s *EmailService) ConfirmByToken(ctx context.Context, token string) (LinkConfirmation, error) {
-	pend, err := s.store.pendingByTokenHash(ctx, hashCode(token))
-	if err != nil {
-		return LinkConfirmation{}, err
-	}
-	if s.now().After(pend.expiresAt) {
-		return LinkConfirmation{}, ErrCodeExpired
-	}
-	switch pend.purpose {
-	case purposeLogin:
-		if err := s.store.confirmEmailLogin(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		if err := s.store.ClearGuest(ctx, pend.accountID); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeLogin, Account: pend.accountID}, nil
-	case purposeLink:
-		owner, ok, err := s.store.confirmedEmailAccount(ctx, pend.email)
-		if err != nil {
-			return LinkConfirmation{}, err
-		}
-		if ok {
-			if owner == pend.accountID {
-				if err := s.store.consumeConfirmation(ctx, pend.id, s.now()); err != nil {
-					return LinkConfirmation{}, err
-				}
-				return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID}, nil
-			}
-			return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID, NeedsMerge: true, MergeOwner: owner}, nil
-		}
-		if err := s.store.confirmEmailIdentity(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		// Binding the first email promotes a guest to a durable account, matching the
-		// code-based link flow (which clears the guest flag in the link service).
-		if err := s.store.ClearGuest(ctx, pend.accountID); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeLink, Account: pend.accountID}, nil
-	case purposeChange:
-		owner, ok, err := s.store.confirmedEmailAccount(ctx, pend.email)
-		if err != nil {
-			return LinkConfirmation{}, err
-		}
-		if ok && owner != pend.accountID {
-			// The new address is confirmed by a different account: refuse without
-			// disclosing it (anti-enumeration). Unlike a link, a change never merges.
-			return LinkConfirmation{}, ErrEmailTaken
-		}
-		if ok && owner == pend.accountID {
-			if err := s.store.consumeConfirmation(ctx, pend.id, s.now()); err != nil {
-				return LinkConfirmation{}, err
-			}
-			return LinkConfirmation{Purpose: purposeChange, Account: pend.accountID}, nil
-		}
-		if err := s.store.replaceEmailIdentity(ctx, pend.id, pend.accountID, pend.email, s.now()); err != nil {
-			return LinkConfirmation{}, err
-		}
-		return LinkConfirmation{Purpose: purposeChange, Account: pend.accountID}, nil
-	case purposeDelete:
-		// Deletion is confirmed in the app with the code, never via a one-tap link.
-		return LinkConfirmation{}, fmt.Errorf("account: deletion cannot be confirmed by link")
-	default:
-		return LinkConfirmation{}, fmt.Errorf("account: unsupported confirmation purpose %q", pend.purpose)
-	}
-}
-
 // emailConfirmation is a pending confirm-code row in domain form.
 type emailConfirmation struct {
 	id        uuid.UUID
@@ -399,30 +220,9 @@ func (s *Store) confirmedEmailAccount(ctx context.Context, email string) (uuid.U
 	return row.AccountID, true, nil
 }

-// confirmedEmailOf returns the account's confirmed email address and true, or ("", false)
-// when it holds none. It backs the deletion step-up, which mails a code to the account's
-// own address.
-func (s *Store) confirmedEmailOf(ctx context.Context, accountID uuid.UUID) (string, bool, error) {
-	stmt := postgres.SELECT(table.Identities.ExternalID).
-		FROM(table.Identities).
-		WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))).
-				AND(table.Identities.Confirmed.EQ(postgres.Bool(true))),
-		).LIMIT(1)
-	var row model.Identities
-	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return "", false, nil
-		}
-		return "", false, fmt.Errorf("account: confirmed email of %s: %w", accountID, err)
-	}
-	return row.ExternalID, true, nil
-}
-
 // replacePendingConfirmation clears any pending code for (accountID, email) and
 // inserts a fresh one, inside one transaction.
-func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.UUID, email, codeHash, linkTokenHash, purpose string, expiresAt time.Time) error {
+func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.UUID, email, codeHash string, expiresAt time.Time) error {
 	id, err := uuid.NewV7()
 	if err != nil {
 		return fmt.Errorf("account: new confirmation id: %w", err)
@@ -439,8 +239,7 @@ func (s *Store) replacePendingConfirmation(ctx context.Context, accountID uuid.U
 		ins := table.EmailConfirmations.INSERT(
 			table.EmailConfirmations.ConfirmationID, table.EmailConfirmations.AccountID,
 			table.EmailConfirmations.Email, table.EmailConfirmations.CodeHash, table.EmailConfirmations.ExpiresAt,
-			table.EmailConfirmations.LinkTokenHash, table.EmailConfirmations.Purpose,
-		).VALUES(id, accountID, email, codeHash, expiresAt, linkTokenHash, purpose)
+		).VALUES(id, accountID, email, codeHash, expiresAt)
 		if _, err := ins.ExecContext(ctx, tx); err != nil {
 			return fmt.Errorf("insert confirmation: %w", err)
 		}
@@ -473,54 +272,6 @@ func (s *Store) latestPendingConfirmation(ctx context.Context, accountID uuid.UU
 	}, nil
 }

-// pendingConfirmation is a pending confirm-code row loaded by its deeplink token, in
-// domain form.
-type pendingConfirmation struct {
-	id        uuid.UUID
-	accountID uuid.UUID
-	email     string
-	purpose   string
-	expiresAt time.Time
-}
-
-// pendingByTokenHash loads the unconsumed confirmation whose deeplink token hashes to
-// tokenHash, or ErrNoPendingCode. The high-entropy token needs no attempt counter, so
-// a partial-unique index guarantees at most one match.
-func (s *Store) pendingByTokenHash(ctx context.Context, tokenHash string) (pendingConfirmation, error) {
-	stmt := postgres.SELECT(table.EmailConfirmations.AllColumns).
-		FROM(table.EmailConfirmations).
-		WHERE(
-			table.EmailConfirmations.LinkTokenHash.EQ(postgres.String(tokenHash)).
-				AND(table.EmailConfirmations.ConsumedAt.IS_NULL()),
-		).LIMIT(1)
-	var row model.EmailConfirmations
-	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return pendingConfirmation{}, ErrNoPendingCode
-		}
-		return pendingConfirmation{}, fmt.Errorf("account: load confirmation by token: %w", err)
-	}
-	return pendingConfirmation{
-		id:        row.ConfirmationID,
-		accountID: row.AccountID,
-		email:     row.Email,
-		purpose:   row.Purpose,
-		expiresAt: row.ExpiresAt,
-	}, nil
-}
-
-// consumeConfirmation marks a confirmation consumed without writing an identity, used
-// for the idempotent already-linked deeplink path.
-func (s *Store) consumeConfirmation(ctx context.Context, id uuid.UUID, now time.Time) error {
-	upd := table.EmailConfirmations.UPDATE(table.EmailConfirmations.ConsumedAt).
-		SET(postgres.TimestampzT(now)).
-		WHERE(table.EmailConfirmations.ConfirmationID.EQ(postgres.UUID(id)))
-	if _, err := upd.ExecContext(ctx, s.db); err != nil {
-		return fmt.Errorf("account: consume confirmation: %w", err)
-	}
-	return nil
-}
-
 // bumpConfirmationAttempts increments a code's wrong-attempt counter by one.
 func (s *Store) bumpConfirmationAttempts(ctx context.Context, id uuid.UUID) error {
 	stmt := table.EmailConfirmations.
@@ -567,69 +318,6 @@ func (s *Store) confirmEmailIdentity(ctx context.Context, confirmationID, accoun
 	return nil
 }

-// replaceEmailIdentity consumes the confirmation, deletes the account's existing email
-// identity (freeing the old address) and inserts newEmail as its confirmed email, inside
-// one transaction. It backs the change-email flow. A unique-constraint violation — the
-// new address was confirmed elsewhere in the meantime — surfaces as ErrEmailTaken. When
-// the account holds no email identity yet the delete is a no-op, so this doubles as an
-// attach.
-func (s *Store) replaceEmailIdentity(ctx context.Context, confirmationID, accountID uuid.UUID, newEmail string, now time.Time) error {
-	identityID, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("account: new identity id: %w", err)
-	}
-	err = withTx(ctx, s.db, func(tx *sql.Tx) error {
-		upd := table.EmailConfirmations.
-			UPDATE(table.EmailConfirmations.ConsumedAt).
-			SET(postgres.TimestampzT(now)).
-			WHERE(table.EmailConfirmations.ConfirmationID.EQ(postgres.UUID(confirmationID)))
-		if _, err := upd.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("consume confirmation: %w", err)
-		}
-		// Journal the outgoing email before replacing it, so the legal dossier keeps the
-		// address the account used to hold (see retention.go).
-		var old model.Identities
-		sel := postgres.SELECT(
-			table.Identities.ExternalID, table.Identities.Confirmed, table.Identities.CreatedAt,
-		).FROM(table.Identities).WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))),
-		).LIMIT(1)
-		switch err := sel.QueryContext(ctx, tx, &old); {
-		case err == nil:
-			if err := retainIdentityTx(ctx, tx, accountID, KindEmail, old.ExternalID, old.Confirmed, old.CreatedAt, retainChange); err != nil {
-				return err
-			}
-		case errors.Is(err, qrm.ErrNoRows):
-			// No prior email (this doubles as an attach); nothing to retain.
-		default:
-			return fmt.Errorf("load outgoing email identity: %w", err)
-		}
-		del := table.Identities.DELETE().WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(KindEmail))),
-		)
-		if _, err := del.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("delete old email identity: %w", err)
-		}
-		ins := table.Identities.INSERT(
-			table.Identities.IdentityID, table.Identities.AccountID, table.Identities.Kind,
-			table.Identities.ExternalID, table.Identities.Confirmed,
-		).VALUES(identityID, accountID, KindEmail, newEmail, true)
-		if _, err := ins.ExecContext(ctx, tx); err != nil {
-			return err
-		}
-		return nil
-	})
-	if err != nil {
-		if isUniqueViolation(err) {
-			return ErrEmailTaken
-		}
-		return fmt.Errorf("account: replace email identity: %w", err)
-	}
-	return nil
-}
-
 // confirmEmailLogin consumes the login code and marks the existing email
 // identity confirmed, inside one transaction. The identity already exists (a
 // login provisioned it), so this updates rather than inserts and is idempotent
@@ -677,18 +365,6 @@ func generateCode() (code, hash string, err error) {
 	return code, hashCode(code), nil
 }

-// generateLinkToken returns a fresh opaque one-tap confirm deeplink token (URL-safe
-// base64, 256-bit) and its hex SHA-256 hash. Only the hash is stored; the token
-// travels only in the emailed link, mirroring the session-token model.
-func generateLinkToken() (token, hash string, err error) {
-	buf := make([]byte, linkTokenBytes)
-	if _, err := crand.Read(buf); err != nil {
-		return "", "", fmt.Errorf("account: generate link token: %w", err)
-	}
-	token = base64.RawURLEncoding.EncodeToString(buf)
-	return token, hashCode(token), nil
-}
-
 // hashCode returns the hex-encoded SHA-256 of a confirm-code.
 func hashCode(code string) string {
 	sum := sha256.Sum256([]byte(code))
@@ -1,239 +0,0 @@
-package account
-
-import (
-	"fmt"
-	"html/template"
-	"strings"
-	tmpltext "text/template"
-	"time"
-)
-
-// emailBrandColor is the single accent used in the confirmation email — a calm
-// tile green, matching the "no riot of colours" brief.
-const emailBrandColor = "#2f7d4f"
-
-// confirmEmailView is the fully-localised data the confirmation email templates
-// render. Every string is resolved before rendering, so the templates carry no
-// localisation logic.
-type confirmEmailView struct {
-	Brand        string
-	Heading      string
-	Intro        string
-	Code         string
-	Expiry       string
-	CTALabel     string
-	DeeplinkURL  string
-	FooterIgnore string
-	LandingURL   string
-	LandingLabel string
-	Preheader    string
-	Locale       string
-	Accent       string
-}
-
-// emailCopy is the purpose- and locale-specific wording of a confirmation email.
-type emailCopy struct {
-	Subject      string
-	Preheader    string
-	Heading      string
-	Intro        string
-	CTALabel     string
-	FooterIgnore string
-}
-
-// confirmEmailCopy holds the wording per (purpose, locale). Unknown purposes fall
-// back to the neutral link wording and unknown locales fall back to English.
-var confirmEmailCopy = map[string]map[string]emailCopy{
-	purposeLogin: {
-		"en": {
-			Subject:      "Your Erudit sign-in code",
-			Preheader:    "Your sign-in code",
-			Heading:      "Sign in to Erudit",
-			Intro:        "Enter this code to sign in:",
-			CTALabel:     "Sign in with one tap",
-			FooterIgnore: "If you didn't request this email, you can safely ignore it.",
-		},
-		"ru": {
-			Subject:      "Код для входа в Эрудит",
-			Preheader:    "Ваш код для входа",
-			Heading:      "Вход в Эрудит",
-			Intro:        "Введите этот код, чтобы войти в игру:",
-			CTALabel:     "Войти одним нажатием",
-			FooterIgnore: "Если вы не запрашивали это письмо, просто проигнорируйте его.",
-		},
-	},
-	purposeLink: {
-		"en": {
-			Subject:      "Your Erudit confirmation code",
-			Preheader:    "Your confirmation code",
-			Heading:      "Confirm your e-mail",
-			Intro:        "Enter this code to confirm your address:",
-			CTALabel:     "Confirm with one tap",
-			FooterIgnore: "If you didn't request this email, you can safely ignore it.",
-		},
-		"ru": {
-			Subject:      "Код подтверждения Эрудит",
-			Preheader:    "Ваш код подтверждения",
-			Heading:      "Подтверждение e-mail",
-			Intro:        "Введите этот код, чтобы подтвердить адрес:",
-			CTALabel:     "Подтвердить одним нажатием",
-			FooterIgnore: "Если вы не запрашивали это письмо, просто проигнорируйте его.",
-		},
-	},
-	purposeChange: {
-		"en": {
-			Subject:      "Confirm your new Erudit e-mail",
-			Preheader:    "Confirm your new address",
-			Heading:      "Confirm your new e-mail",
-			Intro:        "Enter this code to switch your account to this address:",
-			CTALabel:     "Confirm with one tap",
-			FooterIgnore: "If you didn't request this change, you can safely ignore it — your address stays the same.",
-		},
-		"ru": {
-			Subject:      "Подтвердите новый e-mail в Эрудит",
-			Preheader:    "Подтвердите новый адрес",
-			Heading:      "Смена e-mail",
-			Intro:        "Введите этот код, чтобы привязать аккаунт к новому адресу:",
-			CTALabel:     "Подтвердить одним нажатием",
-			FooterIgnore: "Если вы не запрашивали смену, просто проигнорируйте письмо — адрес останется прежним.",
-		},
-	},
-	purposeDelete: {
-		"en": {
-			Subject:      "Confirm your Erudit account deletion",
-			Preheader:    "Confirm account deletion",
-			Heading:      "Delete your account",
-			Intro:        "Enter this code in the app to permanently delete your account:",
-			CTALabel:     "",
-			FooterIgnore: "If you didn't request this, ignore it — your account stays as it is.",
-		},
-		"ru": {
-			Subject:      "Подтвердите удаление аккаунта Эрудит",
-			Preheader:    "Подтверждение удаления аккаунта",
-			Heading:      "Удаление аккаунта",
-			Intro:        "Введите этот код в приложении, чтобы удалить аккаунт без восстановления:",
-			CTALabel:     "",
-			FooterIgnore: "Если вы не запрашивали удаление, проигнорируйте письмо — аккаунт останется.",
-		},
-	},
-}
-
-// emailBrand is the brand wordmark per locale.
-var emailBrand = map[string]string{"en": "Erudit", "ru": "Эрудит"}
-
-// emailExpiry formats the code-lifetime line per locale (abbreviated minutes to
-// avoid plural agreement).
-func emailExpiry(locale string, d time.Duration) string {
-	min := int(d / time.Minute)
-	if locale == "ru" {
-		return fmt.Sprintf("Код действует %d мин.", min)
-	}
-	return fmt.Sprintf("The code is valid for %d minutes.", min)
-}
-
-// normalizeLocale maps an account language to a supported email locale, defaulting
-// to English.
-func normalizeLocale(locale string) string {
-	if locale == "ru" {
-		return "ru"
-	}
-	return "en"
-}
-
-// renderConfirmationEmail builds the branded confirmation email for purpose in
-// locale: a large readable code plus a one-tap deeplink button, with an
-// ignore-notice footer and a landing link. Both a plain-text body and an HTML
-// alternative are produced. deeplinkURL is the absolute /confirm link and
-// landingURL the public landing origin.
-func renderConfirmationEmail(purpose, code, deeplinkURL, landingURL, locale string) (Message, error) {
-	loc := normalizeLocale(locale)
-	byLocale, ok := confirmEmailCopy[purpose]
-	if !ok {
-		byLocale = confirmEmailCopy[purposeLink]
-	}
-	cp := byLocale[loc]
-	view := confirmEmailView{
-		Brand:        emailBrand[loc],
-		Heading:      cp.Heading,
-		Intro:        cp.Intro,
-		Code:         code,
-		Expiry:       emailExpiry(loc, emailCodeTTL),
-		CTALabel:     cp.CTALabel,
-		DeeplinkURL:  deeplinkURL,
-		FooterIgnore: cp.FooterIgnore,
-		LandingURL:   landingURL,
-		LandingLabel: emailBrand[loc],
-		Preheader:    cp.Preheader,
-		Locale:       loc,
-		Accent:       emailBrandColor,
-	}
-	var html strings.Builder
-	if err := confirmEmailHTML.Execute(&html, view); err != nil {
-		return Message{}, fmt.Errorf("account: render confirmation email (html): %w", err)
-	}
-	var text strings.Builder
-	if err := confirmEmailText.Execute(&text, view); err != nil {
-		return Message{}, fmt.Errorf("account: render confirmation email (text): %w", err)
-	}
-	return Message{Subject: cp.Subject, Text: text.String(), HTML: html.String()}, nil
-}
-
-// confirmEmailHTML is a compact, image-free, mobile-friendly HTML email. Layout is
-// table-based for broad mail-client compatibility and all styling is inlined
-// because clients strip <style> blocks.
-var confirmEmailHTML = template.Must(template.New("confirmEmailHTML").Parse(`<!DOCTYPE html>
-<html lang="{{.Locale}}">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>{{.Brand}}</title>
-</head>
-<body style="margin:0;padding:0;background:#f4f5f7;">
-<span style="display:none;max-height:0;overflow:hidden;opacity:0;">{{.Preheader}}</span>
-<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="background:#f4f5f7;padding:24px 12px;">
-<tr><td align="center">
-<table role="presentation" width="100%" cellpadding="0" cellspacing="0" style="max-width:460px;background:#ffffff;border:1px solid #e5e7eb;border-radius:14px;overflow:hidden;font-family:-apple-system,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;">
-<tr><td style="padding:28px 32px 4px;">
-<div style="font-size:15px;font-weight:700;letter-spacing:.04em;color:{{.Accent}};">{{.Brand}}</div>
-</td></tr>
-<tr><td style="padding:8px 32px 0;">
-<h1 style="margin:0;font-size:20px;line-height:1.3;color:#111827;font-weight:600;">{{.Heading}}</h1>
-<p style="margin:12px 0 0;font-size:15px;line-height:1.5;color:#374151;">{{.Intro}}</p>
-</td></tr>
-<tr><td style="padding:18px 32px 0;">
-<div style="font-size:34px;font-weight:700;letter-spacing:8px;text-align:center;color:#111827;background:#f3f4f6;border-radius:10px;padding:18px 0;font-family:'SFMono-Regular',Consolas,Menlo,monospace;">{{.Code}}</div>
-<p style="margin:10px 0 0;font-size:13px;line-height:1.5;color:#6b7280;text-align:center;">{{.Expiry}}</p>
-</td></tr>
-{{if .DeeplinkURL}}<tr><td style="padding:22px 32px 0;" align="center">
-<a href="{{.DeeplinkURL}}" style="display:inline-block;background:{{.Accent}};color:#ffffff;text-decoration:none;font-size:15px;font-weight:600;padding:12px 26px;border-radius:9px;">{{.CTALabel}}</a>
-</td></tr>
-{{end}}<tr><td style="padding:26px 32px 28px;">
-<hr style="border:none;border-top:1px solid #eceef1;margin:0 0 16px;">
-<p style="margin:0;font-size:12px;line-height:1.6;color:#9ca3af;">{{.FooterIgnore}}</p>
-<p style="margin:10px 0 0;font-size:12px;color:#9ca3af;"><a href="{{.LandingURL}}" style="color:#6b7280;text-decoration:none;">{{.LandingLabel}}</a></p>
-</td></tr>
-</table>
-</td></tr>
-</table>
-</body>
-</html>
-`))
-
-// confirmEmailText is the plain-text alternative (and multipart fallback).
-var confirmEmailText = tmpltext.Must(tmpltext.New("confirmEmailText").Parse(`{{.Brand}}
-
-{{.Heading}}
-
-{{.Intro}}
-
-    {{.Code}}
-
-{{.Expiry}}
-
-{{if .DeeplinkURL}}{{.CTALabel}}:
-{{.DeeplinkURL}}
-
-{{end}}—
-{{.FooterIgnore}}
-{{.LandingLabel}} — {{.LandingURL}}
-`))
@@ -1,54 +0,0 @@
-package account
-
-import (
-	"strings"
-	"testing"
-)
-
-// TestRenderConfirmationEmail checks that each (purpose, locale) renders a localised
-// subject, embeds the code and the one-tap deeplink in both bodies, and produces HTML.
-func TestRenderConfirmationEmail(t *testing.T) {
-	const deeplink = "https://erudit-game.ru/app/#/confirm/tok123"
-	cases := []struct {
-		name, purpose, locale, subjectSub string
-	}{
-		{"login ru", purposeLogin, "ru", "вход"},
-		{"login en", purposeLogin, "en", "sign-in"},
-		{"link ru", purposeLink, "ru", "подтвержд"},
-		{"link en", purposeLink, "en", "confirmation"},
-		{"change ru", purposeChange, "ru", "новый"},
-		{"change en", purposeChange, "en", "new"},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			msg, err := renderConfirmationEmail(c.purpose, "123456", deeplink, "https://erudit-game.ru", c.locale)
-			if err != nil {
-				t.Fatalf("render: %v", err)
-			}
-			if !strings.Contains(strings.ToLower(msg.Subject), c.subjectSub) {
-				t.Errorf("subject %q does not contain %q", msg.Subject, c.subjectSub)
-			}
-			if !strings.Contains(msg.Text, "123456") || !strings.Contains(msg.HTML, "123456") {
-				t.Error("code missing from a body")
-			}
-			if !strings.Contains(msg.Text, deeplink) || !strings.Contains(msg.HTML, "confirm/tok123") {
-				t.Error("deeplink missing from a body")
-			}
-			if !strings.Contains(msg.HTML, "<html") {
-				t.Error("HTML body is not HTML")
-			}
-		})
-	}
-}
-
-// TestRenderConfirmationEmailUnknownLocaleDefaultsEnglish falls back to English for an
-// unsupported locale rather than erroring or emitting an empty subject.
-func TestRenderConfirmationEmailUnknownLocaleDefaultsEnglish(t *testing.T) {
-	msg, err := renderConfirmationEmail(purposeLogin, "000000", "", "https://erudit-game.ru", "de")
-	if err != nil {
-		t.Fatalf("render: %v", err)
-	}
-	if !strings.Contains(strings.ToLower(msg.Subject), "sign-in") {
-		t.Errorf("unknown locale should default to English, got subject %q", msg.Subject)
-	}
-}
@@ -2,7 +2,6 @@ package account

 import (
 	"context"
-	"database/sql"
 	"errors"
 	"fmt"
 	"time"
@@ -17,68 +16,6 @@ import (
 // belongs to another account; the caller turns it into a merge.
 var ErrIdentityTaken = errors.New("account: identity already linked to another account")

-// ErrLastIdentity is returned when removing an identity would leave the account with
-// none, making it unreachable after logout. The admin email-erase refuses it.
-var ErrLastIdentity = errors.New("account: cannot remove the last identity")
-
-// RemoveIdentity deletes the account's identity of the given kind (and, for an email,
-// any pending confirmations for it), freeing it for reuse. It refuses when that is the
-// account's only identity (ErrLastIdentity) — which would leave the account
-// unreachable — and returns ErrNotFound when the account has no identity of that kind.
-// It backs the profile Unlink control and the admin "erase email" action.
-func (s *Store) RemoveIdentity(ctx context.Context, accountID uuid.UUID, kind string) error {
-	ids, err := s.Identities(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	var toRetain []Identity
-	others := 0
-	for _, id := range ids {
-		if id.Kind == kind {
-			toRetain = append(toRetain, id)
-		} else {
-			others++
-		}
-	}
-	if len(toRetain) == 0 {
-		return ErrNotFound
-	}
-	if others == 0 {
-		return ErrLastIdentity
-	}
-	return withTx(ctx, s.db, func(tx *sql.Tx) error {
-		// Journal the detached credential before removing it, so the legal dossier
-		// survives while the identity frees for reuse (see retention.go).
-		for _, id := range toRetain {
-			if err := retainIdentityTx(ctx, tx, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, retainUnlink); err != nil {
-				return err
-			}
-		}
-		delID := table.Identities.DELETE().WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(accountID)).
-				AND(table.Identities.Kind.EQ(postgres.String(kind))),
-		)
-		if _, err := delID.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("account: delete %s identity %s: %w", kind, accountID, err)
-		}
-		if kind == KindEmail {
-			delConf := table.EmailConfirmations.DELETE().WHERE(
-				table.EmailConfirmations.AccountID.EQ(postgres.UUID(accountID)),
-			)
-			if _, err := delConf.ExecContext(ctx, tx); err != nil {
-				return fmt.Errorf("account: delete email confirmations %s: %w", accountID, err)
-			}
-		}
-		return nil
-	})
-}
-
-// RemoveEmailIdentity erases the account's email identity. It backs the admin console's
-// "erase email" action; the user-facing profile never unlinks email (it is changed).
-func (s *Store) RemoveEmailIdentity(ctx context.Context, accountID uuid.UUID) error {
-	return s.RemoveIdentity(ctx, accountID, KindEmail)
-}
-
 // RequestLinkCode issues and mails a confirm-code for email to accountID,
 // replacing any prior pending code. Unlike RequestCode it never refuses up front
 // (taken or already-confirmed): possession of the address is the authorization for
@@ -89,10 +26,16 @@ func (s *EmailService) RequestLinkCode(ctx context.Context, accountID uuid.UUID,
 	if err != nil {
 		return err
 	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
+	code, hash, err := generateCode()
+	if err != nil {
+		return err
 	}
-	return s.issueCode(ctx, accountID, addr, purposeLink, s.accountLocale(ctx, accountID))
+	if err := s.store.replacePendingConfirmation(ctx, accountID, addr, hash, s.now().Add(emailCodeTTL)); err != nil {
+		return err
+	}
+	subject := "Your Scrabble confirmation code"
+	body := fmt.Sprintf("Your confirmation code is %s. It expires in %d minutes.", code, int(emailCodeTTL/time.Minute))
+	return s.mailer.Send(ctx, addr, subject, body)
 }

 // ConfirmLink verifies code for (accountID, email) and reports the address's
@@ -127,100 +70,6 @@ func (s *EmailService) ConfirmLink(ctx context.Context, accountID uuid.UUID, ema
 	return accountID, true, nil
 }

-// RequestChangeCode issues and mails a confirm-code to newEmail for an authenticated
-// email change on accountID, replacing any prior pending code. Like RequestLinkCode it
-// never refuses up front on "taken" (anti-enumeration): possession of newEmail is the
-// authorization, and a conflict with another account is revealed only at confirm — as a
-// non-disclosing refusal, never a merge.
-func (s *EmailService) RequestChangeCode(ctx context.Context, accountID uuid.UUID, newEmail string) error {
-	addr, err := normalizeEmail(newEmail)
-	if err != nil {
-		return err
-	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
-	return s.issueCode(ctx, accountID, addr, purposeChange, s.accountLocale(ctx, accountID))
-}
-
-// ConfirmChange verifies code for (accountID, newEmail) and atomically replaces the
-// account's confirmed email with newEmail, freeing the old address. When newEmail is
-// already confirmed by another account it refuses with ErrEmailTaken (surfaced to the
-// user as a non-disclosing "check the address or contact support"), never merging; when
-// the account already owns newEmail it is an idempotent no-op. It returns the usual
-// confirm-code errors (ErrNoPendingCode, ErrCodeExpired, ErrTooManyAttempts,
-// ErrCodeMismatch) and the updated account on success.
-func (s *EmailService) ConfirmChange(ctx context.Context, accountID uuid.UUID, newEmail, code string) (Account, error) {
-	addr, err := normalizeEmail(newEmail)
-	if err != nil {
-		return Account{}, err
-	}
-	conf, err := s.verifyPendingCode(ctx, accountID, addr, code)
-	if err != nil {
-		return Account{}, err
-	}
-	owner, ok, err := s.store.confirmedEmailAccount(ctx, addr)
-	if err != nil {
-		return Account{}, err
-	}
-	if ok && owner != accountID {
-		return Account{}, ErrEmailTaken
-	}
-	if ok && owner == accountID {
-		if err := s.store.consumeConfirmation(ctx, conf.id, s.now()); err != nil {
-			return Account{}, err
-		}
-		return s.store.GetByID(ctx, accountID)
-	}
-	if err := s.store.replaceEmailIdentity(ctx, conf.id, accountID, addr, s.now()); err != nil {
-		return Account{}, err
-	}
-	return s.store.GetByID(ctx, accountID)
-}
-
-// HasEmail reports whether accountID owns a confirmed email. The account-deletion step-up
-// mails a confirm-code when it does, and falls back to a typed phrase otherwise.
-func (s *EmailService) HasEmail(ctx context.Context, accountID uuid.UUID) (bool, error) {
-	_, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	return ok, err
-}
-
-// RequestDeleteCode mails an account-deletion confirm-code to the account's own confirmed
-// email (no deeplink — deletion is confirmed in the app). It returns ErrNoEmail when the
-// account holds no email, ErrTooManyRequests when throttled.
-func (s *EmailService) RequestDeleteCode(ctx context.Context, accountID uuid.UUID) error {
-	addr, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	if !ok {
-		return ErrNoEmail
-	}
-	if !s.allowSend(addr) {
-		return ErrTooManyRequests
-	}
-	return s.issueCode(ctx, accountID, addr, purposeDelete, s.accountLocale(ctx, accountID))
-}
-
-// VerifyDeleteCode verifies the account-deletion code against the account's own email and
-// consumes it on success. It returns ErrNoEmail (no email), the usual confirm-code errors
-// (ErrNoPendingCode, ErrCodeExpired, ErrTooManyAttempts, ErrCodeMismatch), or nil when the
-// code is valid — the caller then performs the deletion.
-func (s *EmailService) VerifyDeleteCode(ctx context.Context, accountID uuid.UUID, code string) error {
-	addr, ok, err := s.store.confirmedEmailOf(ctx, accountID)
-	if err != nil {
-		return err
-	}
-	if !ok {
-		return ErrNoEmail
-	}
-	conf, err := s.verifyPendingCode(ctx, accountID, addr, code)
-	if err != nil {
-		return err
-	}
-	return s.store.consumeConfirmation(ctx, conf.id, s.now())
-}
-
 // verifyPendingCode loads and checks the pending confirm-code for (accountID,
 // addr), counting a wrong attempt. It returns the confirmation on success.
 func (s *EmailService) verifyPendingCode(ctx context.Context, accountID uuid.UUID, addr, code string) (emailConfirmation, error) {
@@ -3,99 +3,33 @@ package account
 import (
 	"context"
 	"fmt"
-	"strconv"
-	"strings"
-	"time"
+	"net"
+	"net/smtp"

-	"github.com/wneessen/go-mail"
 	"go.uber.org/zap"
 )

-// Message is a transactional email to send through a Mailer. Text is the
-// required plain-text body and doubles as the multipart/alternative fallback;
-// HTML, when non-empty, is the preferred body a capable client renders instead.
-type Message struct {
-	// To is the recipient address, or several comma-separated (all get the one message).
-	To string
-	// From, when non-empty, overrides the configured sender for this message — the admin
-	// alert path uses a distinct From from the user-facing confirm-code sender.
-	From    string
-	Subject string
-	Text    string
-	HTML    string
-}
-
 // Mailer delivers a transactional email. It is the seam behind which the email
 // confirm-code flow sends codes, so the relay is swappable and unit tests use a
-// fixture (see docs/TESTING.md: no real network in tests). The context bounds the
-// delivery and is honoured by the SMTP implementation.
+// fixture (see docs/TESTING.md: no real network in tests). The context is offered
+// for cancellation; the standard-library SMTP implementation sends synchronously
+// and ignores it.
 type Mailer interface {
-	Send(ctx context.Context, msg Message) error
-}
-
-// splitAddrs splits a comma-separated recipient list into trimmed, non-empty addresses.
-func splitAddrs(list string) []string {
-	parts := strings.Split(list, ",")
-	out := make([]string, 0, len(parts))
-	for _, p := range parts {
-		if a := strings.TrimSpace(p); a != "" {
-			out = append(out, a)
-		}
-	}
-	return out
+	Send(ctx context.Context, to, subject, body string) error
 }

 // SMTPConfig configures the SMTP relay. An empty Host selects the LogMailer
 // instead, so a deployment without a relay still runs (the code lands in the log).
-// TLS is always used and no client certificate is required — only the server
-// certificate is validated against the system roots.
 type SMTPConfig struct {
 	Host     string
 	Port     string
 	Username string
 	Password string
 	From     string
-	// TLS selects the transport security: "ssl" for implicit TLS from connect, or
-	// "starttls" to upgrade a plaintext connection. Empty derives the mode from the
-	// port (implicit TLS on 465, STARTTLS otherwise); set it explicitly for a relay on
-	// a non-standard port (e.g. Selectel's 1127 = SSL, 1126 = STARTTLS).
-	TLS string
-	// AdminFrom / AdminTo drive the operator alert emails (new feedback / word complaints),
-	// distinct from the user-facing confirm-code sender. AdminTo may be several
-	// comma-separated addresses. Both empty disables the alert worker.
-	AdminFrom string
-	AdminTo   string
 }

-const (
-	// SMTP transport-security modes for SMTPConfig.TLS.
-	smtpTLSImplicit = "ssl"
-	smtpTLSSTARTTLS = "starttls"
-	// smtpDialTimeout bounds a single relay connect-and-send. The confirm-code send
-	// is synchronous on the request path, so an unreachable relay must fail fast
-	// rather than hold the request open.
-	smtpDialTimeout = 15 * time.Second
-)
-
-// tlsMode resolves the transport-security mode for the relay: the explicitly
-// configured SMTPConfig.TLS, or — when unset — implicit TLS on the conventional SSL
-// port 465 and STARTTLS on any other port.
-func (cfg SMTPConfig) tlsMode(port int) string {
-	switch strings.ToLower(strings.TrimSpace(cfg.TLS)) {
-	case smtpTLSImplicit, "tls":
-		return smtpTLSImplicit
-	case smtpTLSSTARTTLS:
-		return smtpTLSSTARTTLS
-	}
-	if port == 465 {
-		return smtpTLSImplicit
-	}
-	return smtpTLSSTARTTLS
-}
-
-// SMTPMailer sends mail through an SMTP relay using go-mail. When a username is
-// set it authenticates, auto-discovering the strongest mechanism the relay
-// advertises; otherwise it relays unauthenticated.
+// SMTPMailer sends mail through an SMTP relay using the standard library. When a
+// username is set it authenticates with PLAIN; otherwise it relays unauthenticated.
 type SMTPMailer struct {
 	cfg SMTPConfig
 }
@@ -105,55 +39,29 @@ func NewSMTPMailer(cfg SMTPConfig) SMTPMailer {
 	return SMTPMailer{cfg: cfg}
 }

-// Send delivers a UTF-8 message to msg.To via the configured relay. When msg.HTML
-// is set the message is multipart/alternative (plain text plus HTML); otherwise
-// it is plain text only.
-func (m SMTPMailer) Send(ctx context.Context, msg Message) error {
-	port, err := strconv.Atoi(m.cfg.Port)
-	if err != nil {
-		return fmt.Errorf("account: invalid SMTP port %q: %w", m.cfg.Port, err)
-	}
-	opts := []mail.Option{mail.WithPort(port), mail.WithTimeout(smtpDialTimeout)}
-	if m.cfg.tlsMode(port) == smtpTLSImplicit {
-		opts = append(opts, mail.WithSSL())
-	} else {
-		opts = append(opts, mail.WithTLSPortPolicy(mail.TLSMandatory))
-	}
+// Send delivers a plain-text UTF-8 message to to via the configured relay.
+func (m SMTPMailer) Send(_ context.Context, to, subject, body string) error {
+	addr := net.JoinHostPort(m.cfg.Host, m.cfg.Port)
+	var auth smtp.Auth
 	if m.cfg.Username != "" {
-		opts = append(opts,
-			mail.WithSMTPAuth(mail.SMTPAuthAutoDiscover),
-			mail.WithUsername(m.cfg.Username),
-			mail.WithPassword(m.cfg.Password),
-		)
+		auth = smtp.PlainAuth("", m.cfg.Username, m.cfg.Password, m.cfg.Host)
 	}
-	client, err := mail.NewClient(m.cfg.Host, opts...)
-	if err != nil {
-		return fmt.Errorf("account: build mail client: %w", err)
-	}
-	out := mail.NewMsg()
-	from := m.cfg.From
-	if msg.From != "" {
-		from = msg.From
-	}
-	if err := out.From(from); err != nil {
-		return fmt.Errorf("account: set From %q: %w", from, err)
-	}
-	// To may carry several comma-separated recipients; go-mail wants them as separate
-	// arguments (a single joined string parses as one malformed address).
-	if err := out.To(splitAddrs(msg.To)...); err != nil {
-		return fmt.Errorf("account: set To %q: %w", msg.To, err)
-	}
-	out.Subject(msg.Subject)
-	out.SetBodyString(mail.TypeTextPlain, msg.Text)
-	if msg.HTML != "" {
-		out.AddAlternativeString(mail.TypeTextHTML, msg.HTML)
-	}
-	if err := client.DialAndSendWithContext(ctx, out); err != nil {
-		return fmt.Errorf("account: send mail to %s: %w", msg.To, err)
+	if err := smtp.SendMail(addr, auth, m.cfg.From, []string{to}, message(m.cfg.From, to, subject, body)); err != nil {
+		return fmt.Errorf("account: send mail to %s: %w", to, err)
 	}
 	return nil
 }

+// message renders a minimal RFC 5322 plain-text email.
+func message(from, to, subject, body string) []byte {
+	return []byte("From: " + from + "\r\n" +
+		"To: " + to + "\r\n" +
+		"Subject: " + subject + "\r\n" +
+		"MIME-Version: 1.0\r\n" +
+		"Content-Type: text/plain; charset=UTF-8\r\n" +
+		"\r\n" + body + "\r\n")
+}
+
 // LogMailer logs the message instead of sending it. It is the default when no
 // SMTP relay is configured and is intended for development only: it logs the body,
 // which carries the confirm-code, so it must not be used in production.
@@ -166,12 +74,11 @@ func NewLogMailer(log *zap.Logger) LogMailer {
 	return LogMailer{log: log}
 }

-// Send logs the message at info level and reports success. It logs the plain-text
-// body only (which carries the confirm-code); the HTML alternative is omitted.
-func (m LogMailer) Send(_ context.Context, msg Message) error {
+// Send logs the message at info level and reports success.
+func (m LogMailer) Send(_ context.Context, to, subject, body string) error {
 	if m.log != nil {
 		m.log.Info("email not sent (log mailer)",
-			zap.String("to", msg.To), zap.String("subject", msg.Subject), zap.String("body", msg.Text))
+			zap.String("to", to), zap.String("subject", subject), zap.String("body", body))
 	}
 	return nil
 }
@@ -1,51 +0,0 @@
-package account
-
-import (
-	"slices"
-	"testing"
-)
-
-// TestSplitAddrs covers the comma-separated recipient parsing used for the admin alert
-// To (several operator mailboxes in one message), including trimming and empty entries.
-func TestSplitAddrs(t *testing.T) {
-	cases := []struct {
-		in   string
-		want []string
-	}{
-		{"a@x.ru", []string{"a@x.ru"}},
-		{"a@x.ru, b@y.ru", []string{"a@x.ru", "b@y.ru"}},
-		{" a@x.ru ,, b@y.ru ,", []string{"a@x.ru", "b@y.ru"}},
-		{"", nil},
-	}
-	for _, c := range cases {
-		if got := splitAddrs(c.in); !slices.Equal(got, c.want) {
-			t.Errorf("splitAddrs(%q) = %v, want %v", c.in, got, c.want)
-		}
-	}
-}
-
-// TestSMTPTLSMode covers the explicit TLS mode and the port-based fallback, including
-// the non-standard Selectel ports (1127 = SSL, 1126 = STARTTLS) that the 465 heuristic
-// alone cannot classify.
-func TestSMTPTLSMode(t *testing.T) {
-	cases := []struct {
-		name string
-		tls  string
-		port int
-		want string
-	}{
-		{"explicit ssl on a custom port (Selectel 1127)", "ssl", 1127, smtpTLSImplicit},
-		{"explicit starttls on a custom port (Selectel 1126)", "starttls", 1126, smtpTLSSTARTTLS},
-		{"tls is an alias for ssl", "TLS", 2525, smtpTLSImplicit},
-		{"empty derives implicit TLS on 465", "", 465, smtpTLSImplicit},
-		{"empty derives STARTTLS on 587", "", 587, smtpTLSSTARTTLS},
-		{"an unknown value falls back to the port heuristic", "bogus", 465, smtpTLSImplicit},
-	}
-	for _, c := range cases {
-		t.Run(c.name, func(t *testing.T) {
-			if got := (SMTPConfig{TLS: c.tls}).tlsMode(c.port); got != c.want {
-				t.Errorf("tlsMode(TLS=%q, port=%d) = %q, want %q", c.tls, c.port, got, c.want)
-			}
-		})
-	}
-}
@@ -14,7 +14,6 @@ import (
 	"github.com/go-jet/jet/v2/postgres"
 	"github.com/go-jet/jet/v2/qrm"
 	"github.com/google/uuid"
-	"github.com/lib/pq"

 	"scrabble/backend/internal/postgres/jet/backend/model"
 	"scrabble/backend/internal/postgres/jet/backend/table"
@@ -59,106 +58,6 @@ type ProfileUpdate struct {
 	BlockChat              bool
 	BlockFriendRequests    bool
 	NotificationsInAppOnly bool
-	// VariantPreferences is the set of game variants the player allows themselves to
-	// be matched into (engine.Variant stable labels). UpdateProfile cleans it to a
-	// deduplicated, canonically ordered subset of the known variants and rejects an
-	// empty set.
-	VariantPreferences []string
-}
-
-// knownVariants is the closed set of game-variant labels (engine.Variant stable
-// labels) a profile's variant preferences may contain. It lives here so the store
-// does not depend on the engine package; the server handler additionally validates
-// against engine.ParseVariant, and a DB check enforces the same subset.
-var knownVariants = map[string]bool{"erudit_ru": true, "scrabble_ru": true, "scrabble_en": true}
-
-// canonicalVariantOrder is the deterministic order variant preferences are stored
-// in (Erudit, Russian Scrabble, English), independent of the client's order.
-var canonicalVariantOrder = []string{"erudit_ru", "scrabble_ru", "scrabble_en"}
-
-// validateVariantPreferences cleans a profile's variant-preference set: it drops
-// duplicates, rejects an unknown label or an empty set (ErrInvalidProfile) and
-// returns the preferences in canonicalVariantOrder so the stored value is
-// deterministic regardless of the order the client sent.
-func validateVariantPreferences(prefs []string) ([]string, error) {
-	seen := make(map[string]bool, len(prefs))
-	for _, p := range prefs {
-		p = strings.TrimSpace(p)
-		if !knownVariants[p] {
-			return nil, fmt.Errorf("%w: variant preference %q", ErrInvalidProfile, p)
-		}
-		seen[p] = true
-	}
-	if len(seen) == 0 {
-		return nil, fmt.Errorf("%w: variant preferences must not be empty", ErrInvalidProfile)
-	}
-	out := make([]string, 0, len(seen))
-	for _, v := range canonicalVariantOrder {
-		if seen[v] {
-			out = append(out, v)
-		}
-	}
-	return out, nil
-}
-
-// variantSeedPrefix marks a Telegram start-param payload that seeds a brand-new
-// account's variant preferences (e.g. "verudit_ru-scrabble_en"): the prefix, then the
-// canonical variant labels joined by "-". It is deliberately distinct from the routing
-// deep links (g/i/f; see platform/telegram .../deeplink) so the client's start-param
-// router falls through to the lobby for it.
-const variantSeedPrefix = "v"
-
-// SeedVariantsFromStartParam decodes a promo deep-link start-param into the variant
-// preference set to seed onto a brand-new account: the variantSeedPrefix followed by
-// the canonical variant labels joined by "-" (e.g. "verudit_ru-scrabble_en"). It
-// returns nil for any payload that is not a variant-seed link or that fails validation
-// against the known variants, so a malformed, empty or unrelated start-param simply
-// leaves the account on its default preferences rather than failing the login.
-func SeedVariantsFromStartParam(startParam string) []string {
-	if !strings.HasPrefix(startParam, variantSeedPrefix) {
-		return nil
-	}
-	body := strings.TrimPrefix(startParam, variantSeedPrefix)
-	if body == "" {
-		return nil
-	}
-	prefs, err := validateVariantPreferences(strings.Split(body, "-"))
-	if err != nil {
-		return nil
-	}
-	return prefs
-}
-
-// SetVariantPreferences overwrites only the variant-preference set of the account,
-// cleaning it to a deduplicated, canonically ordered subset of the known variants
-// (rejecting an empty or unknown set with ErrInvalidProfile) and bumping updated_at; it
-// reports ErrNotFound when no account matches id. It is the narrow counterpart to
-// UpdateProfile used to seed a promo-onboarded account's variants at first contact
-// without disturbing its other profile fields.
-func (s *Store) SetVariantPreferences(ctx context.Context, id uuid.UUID, prefs []string) (Account, error) {
-	clean, err := validateVariantPreferences(prefs)
-	if err != nil {
-		return Account{}, err
-	}
-	stmt := table.Accounts.UPDATE(
-		table.Accounts.VariantPreferences, table.Accounts.UpdatedAt,
-	).SET(
-		// clean is validated against the closed knownVariants set; bind as a text[]
-		// parameter (lib/pq encodes the array, the cast pins the column type), mirroring
-		// UpdateProfile.
-		postgres.Raw("#variant_prefs::text[]", map[string]interface{}{"#variant_prefs": pq.StringArray(clean)}),
-		postgres.TimestampzT(time.Now().UTC()),
-	).WHERE(table.Accounts.AccountID.EQ(postgres.UUID(id))).
-		RETURNING(table.Accounts.AllColumns)
-
-	var row model.Accounts
-	if err := stmt.QueryContext(ctx, s.db, &row); err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return Account{}, ErrNotFound
-		}
-		return Account{}, fmt.Errorf("account: set variant preferences %s: %w", id, err)
-	}
-	return modelToAccount(row), nil
 }

 // UpdateProfile validates and overwrites the editable fields of the account, then
@@ -180,26 +79,17 @@ func (s *Store) UpdateProfile(ctx context.Context, id uuid.UUID, p ProfileUpdate
 	if err := validateAwayWindow(p.AwayStart, p.AwayEnd); err != nil {
 		return Account{}, err
 	}
-	prefs, err := validateVariantPreferences(p.VariantPreferences)
-	if err != nil {
-		return Account{}, err
-	}

 	stmt := table.Accounts.UPDATE(
 		table.Accounts.DisplayName, table.Accounts.PreferredLanguage, table.Accounts.TimeZone,
 		table.Accounts.AwayStart, table.Accounts.AwayEnd,
 		table.Accounts.BlockChat, table.Accounts.BlockFriendRequests,
-		table.Accounts.NotificationsInAppOnly, table.Accounts.VariantPreferences,
-		table.Accounts.UpdatedAt,
+		table.Accounts.NotificationsInAppOnly, table.Accounts.UpdatedAt,
 	).SET(
 		postgres.String(name), postgres.String(lang), postgres.String(tz),
 		postgres.TimeT(p.AwayStart), postgres.TimeT(p.AwayEnd),
 		postgres.Bool(p.BlockChat), postgres.Bool(p.BlockFriendRequests),
-		postgres.Bool(p.NotificationsInAppOnly),
-		// prefs are validated against the closed knownVariants set; bind as a text[]
-		// parameter (lib/pq encodes the array, the cast pins the column type).
-		postgres.Raw("#variant_prefs::text[]", map[string]interface{}{"#variant_prefs": pq.StringArray(prefs)}),
-		postgres.TimestampzT(time.Now().UTC()),
+		postgres.Bool(p.NotificationsInAppOnly), postgres.TimestampzT(time.Now().UTC()),
 	).WHERE(table.Accounts.AccountID.EQ(postgres.UUID(id))).
 		RETURNING(table.Accounts.AllColumns)

@@ -3,7 +3,6 @@ package account
 import (
 	"context"
 	"errors"
-	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -17,7 +16,7 @@ import (
 // offset/IANA timezone), not just their unit tests in validate_test.go.
 func TestUpdateProfileValidation(t *testing.T) {
 	s := &Store{}
-	base := ProfileUpdate{DisplayName: "Kaya", PreferredLanguage: "en", TimeZone: "UTC", VariantPreferences: []string{"erudit_ru"}}
+	base := ProfileUpdate{DisplayName: "Kaya", PreferredLanguage: "en", TimeZone: "UTC"}
 	hm := func(h, m int) time.Time { return time.Date(0, 1, 1, h, m, 0, 0, time.UTC) }
 	tests := []struct {
 		name string
@@ -29,8 +28,6 @@ func TestUpdateProfileValidation(t *testing.T) {
 		{"over-long name", func(p *ProfileUpdate) { p.DisplayName = strings.Repeat("x", maxDisplayName+1) }},
 		{"bad name layout", func(p *ProfileUpdate) { p.DisplayName = "Bad__Name" }},
 		{"away over 12h", func(p *ProfileUpdate) { p.AwayStart, p.AwayEnd = hm(8, 0), hm(21, 0) }},
-		{"empty variant preferences", func(p *ProfileUpdate) { p.VariantPreferences = nil }},
-		{"unknown variant preference", func(p *ProfileUpdate) { p.VariantPreferences = []string{"chess"} }},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
@@ -42,22 +39,3 @@ func TestUpdateProfileValidation(t *testing.T) {
 		})
 	}
 }
-
-// TestValidateVariantPreferences checks the cleaning of a profile's variant set:
-// duplicates collapse, the result is canonically ordered (Erudit, Russian Scrabble,
-// English) regardless of input order, and an empty or unknown set is rejected.
-func TestValidateVariantPreferences(t *testing.T) {
-	got, err := validateVariantPreferences([]string{"scrabble_en", "erudit_ru", "scrabble_en"})
-	if err != nil {
-		t.Fatalf("validate: %v", err)
-	}
-	if want := []string{"erudit_ru", "scrabble_en"}; !slices.Equal(got, want) {
-		t.Fatalf("got %v, want %v", got, want)
-	}
-	if _, err := validateVariantPreferences(nil); !errors.Is(err, ErrInvalidProfile) {
-		t.Fatalf("empty err = %v, want ErrInvalidProfile", err)
-	}
-	if _, err := validateVariantPreferences([]string{"chess"}); !errors.Is(err, ErrInvalidProfile) {
-		t.Fatalf("unknown err = %v, want ErrInvalidProfile", err)
-	}
-}
@@ -9,9 +9,8 @@ import (

 // TestTelegramSeed covers the pure mapping from Telegram launch fields to the
 // create-time account seed: supported-language detection (bare and region-tagged),
-// the real-name → @username (verbatim) → placeholder display-name precedence, and
-// the sanitization of the real name (emoji, digits, punctuation stripped to the
-// editable format). The username, when used, is kept verbatim.
+// the first-name / username display-name precedence, and the sanitization that
+// strips disallowed characters (emoji, digits, punctuation) to the editable format.
 func TestTelegramSeed(t *testing.T) {
 	cases := map[string]struct {
 		languageCode, username, firstName string
@@ -29,7 +28,6 @@ func TestTelegramSeed(t *testing.T) {
 		"punct to space":      {"en", "user", "John❤Doe", "en", "John Doe"},
 		"digits dropped":      {"ru", "user", "Маша123", "ru", "Маша"},
 		"garbage to username": {"en", "good", "123!@#", "en", "good"},
-		"username verbatim":   {"en", "co_ol99", "🎮🎮", "en", "co_ol99"},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
@@ -54,7 +52,7 @@ func TestTelegramSeedPlaceholder(t *testing.T) {
 		"en empty":     {"en", "", "", `^Player-\d{5}$`},
 		"ru empty":     {"ru", "", "", `^Игрок-\d{5}$`},
 		"default en":   {"fr", "", "", `^Player-\d{5}$`},
-		"name garbage, no username": {"ru", "", "!!!", `^Игрок-\d{5}$`},
+		"both garbage": {"ru", "123", "!!!", `^Игрок-\d{5}$`},
 	}
 	for name, tc := range cases {
 		t.Run(name, func(t *testing.T) {
@@ -75,55 +73,3 @@ func TestTelegramSeedTruncatesLongName(t *testing.T) {
 		t.Errorf("display name rune count = %d, want %d", n, maxDisplayName)
 	}
 }
-
-// TestVKSeed covers the pure mapping from VK launch fields to the create-time account
-// seed: supported-language detection from vk_language (bare and region-tagged) and the
-// display name sanitized from the client-supplied name. Unlike Telegram there is no
-// @username fallback — VK provides only the name.
-func TestVKSeed(t *testing.T) {
-	cases := map[string]struct {
-		languageCode, displayName string
-		wantLang, wantName        string
-	}{
-		"ru bare":          {"ru", "Иван", "ru", "Иван"},
-		"en region-tagged": {"en-US", "John", "en", "John"},
-		"full name kept":   {"ru", "Иван Петров", "ru", "Иван Петров"},
-		"unknown language": {"uk", "Тарас", "", "Тарас"},
-		"empty language":   {"", "Neo", "", "Neo"},
-		"trimmed":          {" RU ", "  Anna  ", "ru", "Anna"},
-		"emoji stripped":   {"en", "🎮Kaya🎮", "en", "Kaya"},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			got := vkSeed(tc.languageCode, tc.displayName)
-			if got.preferredLanguage != tc.wantLang {
-				t.Errorf("preferredLanguage = %q, want %q", got.preferredLanguage, tc.wantLang)
-			}
-			if got.displayName != tc.wantName {
-				t.Errorf("displayName = %q, want %q", got.displayName, tc.wantName)
-			}
-		})
-	}
-}
-
-// TestVKSeedPlaceholder checks a VK name with no usable letters falls back to a
-// generated placeholder in the seeded language ("Player-NNNNN" / "Игрок-NNNNN").
-func TestVKSeedPlaceholder(t *testing.T) {
-	cases := map[string]struct {
-		languageCode, displayName string
-		wantRe                    string
-	}{
-		"en empty":     {"en", "", `^Player-\d{5}$`},
-		"ru empty":     {"ru", "", `^Игрок-\d{5}$`},
-		"default en":   {"uk", "", `^Player-\d{5}$`},
-		"name garbage": {"ru", "123!@#", `^Игрок-\d{5}$`},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			got := vkSeed(tc.languageCode, tc.displayName).displayName
-			if !regexp.MustCompile(tc.wantRe).MatchString(got) {
-				t.Errorf("displayName = %q, want match %s", got, tc.wantRe)
-			}
-		})
-	}
-}
@@ -1,66 +0,0 @@
-package account
-
-import (
-	"sync"
-	"time"
-)
-
-// SendLimiter throttles confirm-code sends per recipient address: it enforces a
-// minimum cooldown between two sends and a cap over a rolling hour. It guards against
-// email bombing and protects the relay's own quota. State is in-memory (per process,
-// reset on restart) and keyed by the normalised recipient address, which is adequate
-// for the single-instance backend. Safe for concurrent use.
-type SendLimiter struct {
-	mu       sync.Mutex
-	cooldown time.Duration
-	perHour  int
-	now      func() time.Time
-	sends    map[string][]time.Time
-}
-
-// NewSendLimiter returns a SendLimiter allowing at most one send per cooldown and at
-// most perHour sends over any rolling hour, to the same recipient.
-func NewSendLimiter(cooldown time.Duration, perHour int) *SendLimiter {
-	return &SendLimiter{
-		cooldown: cooldown,
-		perHour:  perHour,
-		now:      func() time.Time { return time.Now() },
-		sends:    make(map[string][]time.Time),
-	}
-}
-
-// Allow reports whether a send to key is permitted now, recording the send when it is.
-// It is denied when the last send was within the cooldown or the rolling-hour cap is
-// already reached.
-func (l *SendLimiter) Allow(key string) bool {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	now := l.now()
-	cutoff := now.Add(-time.Hour)
-	kept := l.sends[key][:0]
-	for _, t := range l.sends[key] {
-		if t.After(cutoff) {
-			kept = append(kept, t)
-		}
-	}
-	if n := len(kept); n > 0 && now.Sub(kept[n-1]) < l.cooldown {
-		l.set(key, kept)
-		return false
-	}
-	if len(kept) >= l.perHour {
-		l.set(key, kept)
-		return false
-	}
-	l.set(key, append(kept, now))
-	return true
-}
-
-// set stores the retained send times for key, dropping the entry entirely once empty
-// so the map stays bounded to recipients active within the last hour.
-func (l *SendLimiter) set(key string, times []time.Time) {
-	if len(times) == 0 {
-		delete(l.sends, key)
-		return
-	}
-	l.sends[key] = times
-}
@@ -1,43 +0,0 @@
-package account
-
-import (
-	"testing"
-	"time"
-)
-
-// TestSendLimiter checks the per-recipient cooldown and the rolling-hour cap, and
-// that recipients are throttled independently.
-func TestSendLimiter(t *testing.T) {
-	base := time.Now()
-	now := base
-	l := NewSendLimiter(time.Minute, 3)
-	l.now = func() time.Time { return now }
-
-	if !l.Allow("a") {
-		t.Fatal("send 1 should be allowed")
-	}
-	if l.Allow("a") {
-		t.Fatal("immediate resend must be blocked by the cooldown")
-	}
-	if !l.Allow("b") {
-		t.Fatal("a different recipient is independent")
-	}
-
-	now = base.Add(time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("send 2 after the cooldown should be allowed")
-	}
-	now = base.Add(2 * time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("send 3 should be allowed")
-	}
-	now = base.Add(3 * time.Minute)
-	if l.Allow("a") {
-		t.Fatal("send 4 within the hour must be blocked by the cap")
-	}
-
-	now = base.Add(time.Hour + time.Minute)
-	if !l.Allow("a") {
-		t.Fatal("after the rolling hour the cap resets")
-	}
-}
@@ -1,224 +0,0 @@
-package account
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/go-jet/jet/v2/postgres"
-	"github.com/go-jet/jet/v2/qrm"
-	"github.com/google/uuid"
-	"go.uber.org/zap"
-
-	"scrabble/backend/internal/postgres/jet/backend/model"
-	"scrabble/backend/internal/postgres/jet/backend/table"
-)
-
-// RetentionTTL bounds how long the account-deletion legal dossier is kept before the
-// reaper purges it: two years from the detach/deletion event (owner policy, 2026-07-03).
-const RetentionTTL = 2 * 365 * 24 * time.Hour
-
-// Reasons recorded on a retained_identities row: what detached the credential from its
-// account (unlink / email change / account deletion here; an account merge that drops a
-// same-kind colliding identity writes reason "merge" from the accountmerge package). The
-// row is written just before the live identities row is removed, preserving the legal
-// dossier (which email/vk/tg was linked, and when) even as the identity frees for reuse.
-// See docs/ARCHITECTURE.md §9.1.
-const (
-	retainUnlink = "unlink"
-	retainChange = "change"
-	retainDelete = "delete"
-)
-
-// retainIdentityTx appends a retention-journal row for one identity being detached, inside
-// tx. linkedAt is the identity's original creation time; detached_at defaults to now(). It
-// must run in the same transaction as the identity removal, so the dossier and the live
-// state can never diverge.
-func retainIdentityTx(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, kind, externalID string, confirmed bool, linkedAt time.Time, reason string) error {
-	id, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("account: new retained id: %w", err)
-	}
-	ins := table.RetainedIdentities.INSERT(
-		table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
-		table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
-		table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
-		table.RetainedIdentities.Reason,
-	).VALUES(id, accountID, kind, externalID, confirmed, linkedAt, reason)
-	if _, err := ins.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("account: retain identity (%s, %s): %w", kind, externalID, err)
-	}
-	return nil
-}
-
-// StampLastLogin records the account's last cold-load time and client IP, but only when
-// the stored value is missing or older than an hour — so it costs at most one write per
-// account per hour (its caller, the profile fetch, runs once per cold app-load). It is a
-// best-effort audit signal that feeds the account-deletion dossier.
-func (s *Store) StampLastLogin(ctx context.Context, accountID uuid.UUID, ip string) error {
-	now := time.Now().UTC()
-	upd := table.Accounts.UPDATE(table.Accounts.LastLoginAt, table.Accounts.LastLoginIP).
-		SET(postgres.TimestampzT(now), postgres.String(ip)).
-		WHERE(
-			table.Accounts.AccountID.EQ(postgres.UUID(accountID)).
-				AND(
-					table.Accounts.LastLoginAt.IS_NULL().
-						OR(table.Accounts.LastLoginAt.LT(postgres.TimestampzT(now.Add(-time.Hour)))),
-				),
-		)
-	if _, err := upd.ExecContext(ctx, s.db); err != nil {
-		return fmt.Errorf("account: stamp last login %s: %w", accountID, err)
-	}
-	return nil
-}
-
-// ReapExpiredRetention purges retention data whose event is older than cutoff: every
-// retained_identities row by its detached_at (covering unlink/change on live accounts as
-// well as deleted ones), plus — for accounts tombstoned before cutoff — the retained
-// feedback thread and the dossier PII (deleted_display_name, last_login_ip). Chat is kept
-// (a shared game artifact), and the tombstone account row itself stays (its no-cascade
-// foreign keys). It returns how many journal rows and feedback messages were removed.
-func (s *Store) ReapExpiredRetention(ctx context.Context, cutoff time.Time) (identities, feedback int64, err error) {
-	cut := postgres.TimestampzT(cutoff)
-	delJournal := table.RetainedIdentities.DELETE().
-		WHERE(table.RetainedIdentities.DetachedAt.LT(cut))
-	res, err := delJournal.ExecContext(ctx, s.db)
-	if err != nil {
-		return 0, 0, fmt.Errorf("account: reap retained identities: %w", err)
-	}
-	identities, _ = res.RowsAffected()
-
-	expired := postgres.SELECT(table.Accounts.AccountID).
-		FROM(table.Accounts).
-		WHERE(table.Accounts.DeletedAt.IS_NOT_NULL().AND(table.Accounts.DeletedAt.LT(cut)))
-	delFeedback := table.FeedbackMessages.DELETE().
-		WHERE(table.FeedbackMessages.AccountID.IN(expired))
-	fbRes, err := delFeedback.ExecContext(ctx, s.db)
-	if err != nil {
-		return identities, 0, fmt.Errorf("account: reap deleted feedback: %w", err)
-	}
-	feedback, _ = fbRes.RowsAffected()
-
-	clearPII := table.Accounts.UPDATE(table.Accounts.DeletedDisplayName, table.Accounts.LastLoginIP).
-		SET(postgres.NULL, postgres.NULL).
-		WHERE(
-			table.Accounts.DeletedAt.IS_NOT_NULL().
-				AND(table.Accounts.DeletedAt.LT(cut)).
-				AND(table.Accounts.DeletedDisplayName.IS_NOT_NULL().
-					OR(table.Accounts.LastLoginIP.IS_NOT_NULL())),
-		)
-	if _, err := clearPII.ExecContext(ctx, s.db); err != nil {
-		return identities, feedback, fmt.Errorf("account: clear expired dossier PII: %w", err)
-	}
-	return identities, feedback, nil
-}
-
-// RetainedIdentity is one row of the retention journal, for the admin dossier.
-type RetainedIdentity struct {
-	Kind       string
-	ExternalID string
-	Reason     string
-	Confirmed  bool
-	LinkedAt   time.Time
-	DetachedAt time.Time
-}
-
-// RetainedIdentities returns the account's retention-journal rows (the legal dossier of
-// detached credentials), newest detach first, for the admin console.
-func (s *Store) RetainedIdentities(ctx context.Context, accountID uuid.UUID) ([]RetainedIdentity, error) {
-	var rows []model.RetainedIdentities
-	err := postgres.SELECT(table.RetainedIdentities.AllColumns).
-		FROM(table.RetainedIdentities).
-		WHERE(table.RetainedIdentities.AccountID.EQ(postgres.UUID(accountID))).
-		ORDER_BY(table.RetainedIdentities.DetachedAt.DESC()).
-		QueryContext(ctx, s.db, &rows)
-	if err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return nil, fmt.Errorf("account: retained identities %s: %w", accountID, err)
-	}
-	out := make([]RetainedIdentity, 0, len(rows))
-	for _, r := range rows {
-		out = append(out, RetainedIdentity{
-			Kind: r.Kind, ExternalID: r.ExternalID, Reason: r.Reason,
-			Confirmed: r.Confirmed, LinkedAt: r.LinkedAt, DetachedAt: r.DetachedAt,
-		})
-	}
-	return out, nil
-}
-
-// DeletionInfo is a tombstoned account's dossier header, for the admin console.
-type DeletionInfo struct {
-	DeletedAt          *time.Time
-	DeletedDisplayName string
-	LastLoginAt        *time.Time
-	LastLoginIP        string
-}
-
-// DeletionInfo reads the account's deletion tombstone + last-login dossier fields.
-func (s *Store) DeletionInfo(ctx context.Context, accountID uuid.UUID) (DeletionInfo, error) {
-	var row model.Accounts
-	err := postgres.SELECT(
-		table.Accounts.DeletedAt, table.Accounts.DeletedDisplayName,
-		table.Accounts.LastLoginAt, table.Accounts.LastLoginIP,
-	).FROM(table.Accounts).
-		WHERE(table.Accounts.AccountID.EQ(postgres.UUID(accountID))).
-		QueryContext(ctx, s.db, &row)
-	if err != nil {
-		if errors.Is(err, qrm.ErrNoRows) {
-			return DeletionInfo{}, ErrNotFound
-		}
-		return DeletionInfo{}, fmt.Errorf("account: deletion info %s: %w", accountID, err)
-	}
-	info := DeletionInfo{DeletedAt: row.DeletedAt, LastLoginAt: row.LastLoginAt}
-	if row.DeletedDisplayName != nil {
-		info.DeletedDisplayName = *row.DeletedDisplayName
-	}
-	if row.LastLoginIP != nil {
-		info.LastLoginIP = *row.LastLoginIP
-	}
-	return info, nil
-}
-
-// RetentionReaper periodically purges expired account-deletion retention data via
-// Store.ReapExpiredRetention, mirroring GuestReaper: one background goroutine started once
-// from main.
-type RetentionReaper struct {
-	store *Store
-	ttl   time.Duration
-	clock func() time.Time
-	log   *zap.Logger
-}
-
-// NewRetentionReaper constructs a reaper purging retention data older than ttl. log may be
-// nil.
-func NewRetentionReaper(store *Store, ttl time.Duration, log *zap.Logger) *RetentionReaper {
-	if log == nil {
-		log = zap.NewNop()
-	}
-	return &RetentionReaper{
-		store: store,
-		ttl:   ttl,
-		clock: func() time.Time { return time.Now().UTC() },
-		log:   log,
-	}
-}
-
-// Run purges expired retention data on each tick until ctx is cancelled.
-func (r *RetentionReaper) Run(ctx context.Context, interval time.Duration) {
-	ticker := time.NewTicker(interval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			idn, fb, err := r.store.ReapExpiredRetention(ctx, r.clock().Add(-r.ttl))
-			if err != nil {
-				r.log.Warn("retention reap failed", zap.Error(err))
-			} else if idn > 0 || fb > 0 {
-				r.log.Info("reaped expired retention", zap.Int64("identities", idn), zap.Int64("feedback", fb))
-			}
-		}
-	}
-}
@@ -24,19 +24,11 @@ const (
 	// unconditionally, overriding the usual eligibility (a free account with an
 	// empty hint wallet otherwise sees it). See internal/ads.
 	RoleNoBanner = "no_banner"
-
-	// RoleChatMuted forbids the account from writing in the moderated Telegram
-	// discussion chat, without otherwise restricting the game (the chat-only
-	// counterpart to a full account suspension). It is one input to the chat-access
-	// gate; an active admin suspension mutes the player regardless, so this role only
-	// matters for an account that is not suspended. Granting or revoking it re-pushes
-	// the chat-gate command for a member currently in the chat.
-	RoleChatMuted = "chat_muted"
 )

 // KnownRoles is the set of roles the console may grant or revoke; an operator
 // cannot assign an unrecognised role.
-var KnownRoles = []string{RoleFeedbackBanned, RoleNoBanner, RoleChatMuted}
+var KnownRoles = []string{RoleFeedbackBanned, RoleNoBanner}

 // IsKnownRole reports whether role is a recognised account role.
 func IsKnownRole(role string) bool {
@@ -46,10 +46,6 @@ type Stats struct {
 	Draws         int
 	MaxGamePoints int
 	MaxWordPoints int
-	// Moves is the lifetime count of the account's plays (tile placements); HintsUsed is the
-	// lifetime count of hints taken. The statistics screen shows the hint share (HintsUsed / Moves).
-	Moves     int
-	HintsUsed int
 	BestMoves     []BestMove
 }

@@ -78,8 +74,6 @@ func (s *Store) GetStats(ctx context.Context, id uuid.UUID) (Stats, error) {
 		Draws:         int(row.Draws),
 		MaxGamePoints: int(row.MaxGamePoints),
 		MaxWordPoints: int(row.MaxWordPoints),
-		Moves:         int(row.Moves),
-		HintsUsed:     int(row.HintsUsed),
 		BestMoves:     best,
 	}, nil
 }
@@ -161,31 +161,6 @@ func (s *Store) queryCurrentSuspension(ctx context.Context, accountID uuid.UUID,
 	return modelToSuspension(row), true, nil
 }

-// SuspensionsExpiredBetween returns the distinct account ids whose temporary block lapsed in the
-// half-open window (since, until]: a non-lifted suspension with a blocked_until in that range. The
-// chat-access sweeper uses it to re-evaluate chat write access when a temporary block self-expires,
-// since no operator action fires then. An account that still has another active block may be
-// included; the eligibility resolver returns the true state, so emitting for it is harmless.
-func (s *Store) SuspensionsExpiredBetween(ctx context.Context, since, until time.Time) ([]uuid.UUID, error) {
-	rows, err := s.db.QueryContext(ctx,
-		`SELECT DISTINCT account_id FROM backend.account_suspensions
-		 WHERE lifted_at IS NULL AND blocked_until > $1 AND blocked_until <= $2`,
-		since.UTC(), until.UTC())
-	if err != nil {
-		return nil, fmt.Errorf("account: suspensions expired between: %w", err)
-	}
-	defer rows.Close()
-	var out []uuid.UUID
-	for rows.Next() {
-		var id uuid.UUID
-		if err := rows.Scan(&id); err != nil {
-			return nil, fmt.Errorf("account: scan expired suspension: %w", err)
-		}
-		out = append(out, id)
-	}
-	return out, rows.Err()
-}
-
 // invalidateSuspension drops the account's cached block so the next CurrentSuspension re-reads it.
 // Called after Suspend and LiftSuspension.
 func (s *Store) invalidateSuspension(accountID uuid.UUID) {
@@ -1,84 +0,0 @@
-package account
-
-import (
-	"context"
-	"time"
-
-	"github.com/google/uuid"
-	"go.uber.org/zap"
-)
-
-// suspensionSweepInterval is how often the sweeper re-checks for temporary blocks
-// that lapsed. A minute is well under the coarsest block grain (operators pick day
-// presets) while keeping the query trivial.
-const suspensionSweepInterval = time.Minute
-
-// suspensionExpiryQuerier is the slice of the account store the sweeper depends on:
-// the accounts whose temporary block lapsed in a window. *Store satisfies it; a fake
-// drives the sweeper's unit tests.
-type suspensionExpiryQuerier interface {
-	SuspensionsExpiredBetween(ctx context.Context, since, until time.Time) ([]uuid.UUID, error)
-}
-
-// SuspensionSweeper re-evaluates chat write access when a temporary block self-
-// expires. No operator action fires on expiry — the suspension gate just re-reads
-// the wall clock — so without this a temporarily blocked player would stay muted in
-// the moderated discussion chat after their block lapsed. Each tick it finds blocks
-// that expired since the previous tick and calls onExpire for the affected accounts;
-// onExpire is wired to publish the chat-access-changed event, after which the gateway
-// re-resolves the true eligibility. A liberal call (an account that still has another
-// active block) is therefore harmless. The window is in-memory, so a block that
-// expires while the process is down is not re-granted until the next operator action
-// or the player rejoins — an accepted best-effort gap.
-type SuspensionSweeper struct {
-	store    suspensionExpiryQuerier
-	onExpire func(accountID uuid.UUID)
-	log      *zap.Logger
-	// since is the upper bound of the previous swept window; the next sweep covers
-	// (since, now]. It advances only on a successful query, so a failed tick retries
-	// the same window rather than dropping expiries.
-	since time.Time
-}
-
-// NewSuspensionSweeper builds the sweeper over the account store, the per-account
-// expiry callback (publishing the chat-access-changed event) and a logger. The first
-// window opens at construction time, so blocks that lapsed earlier are not re-emitted.
-func NewSuspensionSweeper(store *Store, onExpire func(accountID uuid.UUID), log *zap.Logger) *SuspensionSweeper {
-	if log == nil {
-		log = zap.NewNop()
-	}
-	return &SuspensionSweeper{store: store, onExpire: onExpire, log: log, since: time.Now().UTC()}
-}
-
-// Interval reports the sweep cadence, for the startup log line.
-func (w *SuspensionSweeper) Interval() time.Duration { return suspensionSweepInterval }
-
-// Run sweeps every Interval until ctx is cancelled.
-func (w *SuspensionSweeper) Run(ctx context.Context) {
-	ticker := time.NewTicker(suspensionSweepInterval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			w.sweep(ctx)
-		}
-	}
-}
-
-// sweep emits a chat-access-changed signal for every account whose temporary block
-// lapsed in (since, now], then advances the window. On a query error it keeps the
-// window so the next tick retries it.
-func (w *SuspensionSweeper) sweep(ctx context.Context) {
-	now := time.Now().UTC()
-	ids, err := w.store.SuspensionsExpiredBetween(ctx, w.since, now)
-	if err != nil {
-		w.log.Warn("suspension expiry sweep failed", zap.Error(err))
-		return
-	}
-	w.since = now
-	for _, id := range ids {
-		w.onExpire(id)
-	}
-}
@@ -1,80 +0,0 @@
-package account
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.uber.org/zap"
-)
-
-// fakeExpiryQuerier records the `since` bound of each call and replays a scripted
-// result/error per call, so the sweeper's window and dispatch logic is testable
-// without a database.
-type fakeExpiryQuerier struct {
-	results [][]uuid.UUID
-	errs    []error
-	sinces  []time.Time
-	idx     int
-}
-
-func (f *fakeExpiryQuerier) SuspensionsExpiredBetween(_ context.Context, since, _ time.Time) ([]uuid.UUID, error) {
-	f.sinces = append(f.sinces, since)
-	i := f.idx
-	f.idx++
-	if i < len(f.errs) && f.errs[i] != nil {
-		return nil, f.errs[i]
-	}
-	if i < len(f.results) {
-		return f.results[i], nil
-	}
-	return nil, nil
-}
-
-func newSweeper(store suspensionExpiryQuerier, onExpire func(uuid.UUID)) *SuspensionSweeper {
-	return &SuspensionSweeper{
-		store:    store,
-		onExpire: onExpire,
-		log:      zap.NewNop(),
-		since:    time.Now().Add(-time.Minute).UTC(),
-	}
-}
-
-func TestSuspensionSweeperDispatchesAndAdvances(t *testing.T) {
-	id1, id2 := uuid.New(), uuid.New()
-	fake := &fakeExpiryQuerier{results: [][]uuid.UUID{{id1, id2}, nil}}
-	var got []uuid.UUID
-	w := newSweeper(fake, func(id uuid.UUID) { got = append(got, id) })
-
-	first := w.since
-	w.sweep(context.Background())
-	assert.Equal(t, []uuid.UUID{id1, id2}, got, "every expired account is dispatched")
-	assert.True(t, w.since.After(first), "the window advances on success")
-
-	// A second sweep opens the next window at the previous upper bound.
-	prev := w.since
-	w.sweep(context.Background())
-	require.Len(t, fake.sinces, 2)
-	assert.True(t, fake.sinces[1].After(fake.sinces[0]), "consecutive windows are contiguous and forward")
-	assert.True(t, fake.sinces[1].Equal(prev), "the next window starts at the previous upper bound")
-}
-
-func TestSuspensionSweeperKeepsWindowOnError(t *testing.T) {
-	fake := &fakeExpiryQuerier{errs: []error{errors.New("db down")}}
-	w := newSweeper(fake, func(uuid.UUID) { t.Fatal("onExpire must not run when the query fails") })
-
-	before := w.since
-	w.sweep(context.Background())
-	assert.True(t, w.since.Equal(before), "the window is retained on error so the next tick retries it")
-}
-
-func TestNewSuspensionSweeperDefaults(t *testing.T) {
-	w := NewSuspensionSweeper(nil, func(uuid.UUID) {}, nil)
-	assert.Equal(t, time.Minute, w.Interval())
-	assert.NotNil(t, w.log, "a nil logger is tolerated")
-	assert.WithinDuration(t, time.Now().UTC(), w.since, time.Second, "the first window opens at construction time")
-}
@@ -19,9 +19,6 @@ type UserListItem struct {
 	PreferredLanguage string
 	IsGuest           bool
 	IsRobot           bool
-	// IsDeleted marks a tombstoned account (deleted_at set), shown as a badge — a search
-	// spans both lists, so a result can be either live or deleted.
-	IsDeleted bool
 	// FlaggedHighRateAt is the soft high-rate marker (zero when unflagged), shown
 	// as a badge in the console list.
 	FlaggedHighRateAt time.Time
@@ -29,17 +26,13 @@ type UserListItem struct {
 }

 // UserFilter narrows the admin user list: Robots selects robot accounts (otherwise the
-// non-robot "people"); Deleted selects tombstoned accounts (every other scope hides them);
-// NameMask and ExternalIDMask are glob masks ('*' = any run, '?' = one char) matched
-// case-insensitively against the display name / any identity's external id; EmailExact is a
-// strict (exact) match against an account's email identity. An empty value means no filter
-// on that field.
+// non-robot "people"); NameMask and ExternalIDMask are glob masks ('*' = any run, '?' =
+// one char) matched case-insensitively against the display name / any identity's external
+// id. An empty mask means no filter on that field.
 type UserFilter struct {
 	Robots         bool
-	Deleted        bool
 	NameMask       string
 	ExternalIDMask string
-	EmailExact     string
 }

 // robotExists is the correlated subquery testing whether account a is a robot.
@@ -58,42 +51,17 @@ func (s *Store) IsRobot(ctx context.Context, accountID uuid.UUID) (bool, error)
 	return ok, nil
 }

-// userListWhere builds the shared WHERE clause and its positional args (from $1). On the
-// Robots tab it lists/searches robots only. Otherwise a search (any of the name /
-// external-id / email filters) spans live and deleted people alike — never robots — so the
-// operator finds a match from one query regardless of the People / Deleted tab; the search
-// also looks in the retention journal, so a deleted account is still found by the email /
-// external id it held (those rows moved from identities to retained_identities on deletion)
-// and by its retained real name. With no search, the People / Deleted tab scope applies.
+// userListWhere builds the shared WHERE clause and its positional args (from $1).
 func userListWhere(f UserFilter) (string, []any) {
-	name := LikePattern(f.NameMask)
-	ext := LikePattern(f.ExternalIDMask)
-	email := strings.ToLower(strings.TrimSpace(f.EmailExact))
-	searching := name != "" || ext != "" || email != ""
-
-	var args []any
-	var where string
-	switch {
-	case f.Robots:
-		where = robotExists + ` = true`
-	case searching:
-		where = robotExists + ` = false`
-	case f.Deleted:
-		where = robotExists + ` = false AND a.deleted_at IS NOT NULL`
-	default:
-		where = robotExists + ` = false AND a.deleted_at IS NULL`
-	}
-	if name != "" {
+	args := []any{f.Robots}
+	where := robotExists + ` = $1`
+	if name := LikePattern(f.NameMask); name != "" {
 		args = append(args, name)
-		where += fmt.Sprintf(` AND (a.display_name ILIKE $%d ESCAPE '\' OR a.deleted_display_name ILIKE $%d ESCAPE '\')`, len(args), len(args))
+		where += fmt.Sprintf(` AND a.display_name ILIKE $%d ESCAPE '\'`, len(args))
 	}
-	if ext != "" {
+	if ext := LikePattern(f.ExternalIDMask); ext != "" {
 		args = append(args, ext)
-		where += fmt.Sprintf(` AND (EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.external_id ILIKE $%d ESCAPE '\') OR EXISTS (SELECT 1 FROM backend.retained_identities r WHERE r.account_id = a.account_id AND r.external_id ILIKE $%d ESCAPE '\'))`, len(args), len(args))
-	}
-	if email != "" {
-		args = append(args, email)
-		where += fmt.Sprintf(` AND (EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.kind = 'email' AND i.external_id = $%d) OR EXISTS (SELECT 1 FROM backend.retained_identities r WHERE r.account_id = a.account_id AND r.kind = 'email' AND r.external_id = $%d))`, len(args), len(args))
+		where += fmt.Sprintf(` AND EXISTS (SELECT 1 FROM backend.identities i WHERE i.account_id = a.account_id AND i.external_id ILIKE $%d ESCAPE '\')`, len(args))
 	}
 	return where, args
 }
@@ -101,7 +69,7 @@ func userListWhere(f UserFilter) (string, []any) {
 // ListUsers returns the filtered admin user list, newest first, paginated.
 func (s *Store) ListUsers(ctx context.Context, f UserFilter, limit, offset int) ([]UserListItem, error) {
 	where, args := userListWhere(f)
-	q := `SELECT a.account_id, a.display_name, a.preferred_language, a.is_guest, a.flagged_high_rate_at, a.created_at, ` + robotExists + ` AS is_robot, (a.deleted_at IS NOT NULL) AS is_deleted
+	q := `SELECT a.account_id, a.display_name, a.preferred_language, a.is_guest, a.flagged_high_rate_at, a.created_at, ` + robotExists + ` AS is_robot
 FROM backend.accounts a WHERE ` + where +
 		fmt.Sprintf(` ORDER BY a.created_at DESC LIMIT $%d OFFSET $%d`, len(args)+1, len(args)+2)
 	args = append(args, limit, offset)
@@ -114,7 +82,7 @@ FROM backend.accounts a WHERE ` + where +
 	for rows.Next() {
 		var it UserListItem
 		var flagged sql.NullTime
-		if err := rows.Scan(&it.ID, &it.DisplayName, &it.PreferredLanguage, &it.IsGuest, &flagged, &it.CreatedAt, &it.IsRobot, &it.IsDeleted); err != nil {
+		if err := rows.Scan(&it.ID, &it.DisplayName, &it.PreferredLanguage, &it.IsGuest, &flagged, &it.CreatedAt, &it.IsRobot); err != nil {
 			return nil, fmt.Errorf("account: scan user: %w", err)
 		}
 		if flagged.Valid {
@@ -1,37 +0,0 @@
-package account
-
-import (
-	"slices"
-	"testing"
-)
-
-// TestSeedVariantsFromStartParam covers decoding a promo deep-link start-param into the
-// variant-preference set to seed: a valid "v"-prefixed, "-"-joined label list is cleaned
-// to the canonical order and deduplicated, while anything that is not a variant-seed link
-// or that names an unknown variant yields nil (leaving the account on its defaults).
-func TestSeedVariantsFromStartParam(t *testing.T) {
-	tests := []struct {
-		name  string
-		param string
-		want  []string
-	}{
-		{"english promo", "verudit_ru-scrabble_en", []string{"erudit_ru", "scrabble_en"}},
-		{"single variant", "vscrabble_en", []string{"scrabble_en"}},
-		{"canonical order regardless of payload order", "vscrabble_en-erudit_ru", []string{"erudit_ru", "scrabble_en"}},
-		{"deduplicated", "verudit_ru-erudit_ru", []string{"erudit_ru"}},
-		{"empty", "", nil},
-		{"prefix only", "v", nil},
-		{"routing game link is not a seed", "g0190abcd", nil},
-		{"friend code link is not a seed", "f123456", nil},
-		{"unknown variant rejected", "vscrabble_de", nil},
-		{"one unknown label rejects the whole set", "verudit_ru-scrabble_de", nil},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := SeedVariantsFromStartParam(tc.param)
-			if !slices.Equal(got, tc.want) {
-				t.Errorf("SeedVariantsFromStartParam(%q) = %v, want %v", tc.param, got, tc.want)
-			}
-		})
-	}
-}
@@ -1,223 +0,0 @@
-// Package accountdelete deactivates an account as legal retention, not erasure: it keeps
-// the account row as a tombstone (its chat/complaint foreign keys have no cascade, so a
-// hard delete is impossible) while journalling and freeing the account's credentials,
-// anonymising the live surfaces, and dropping the account's own social/ephemeral rows.
-// The retained_identities journal plus the tombstone (deleted_at, deleted_display_name,
-// last_login_at/ip) form the admin/legal dossier; messages are deliberately kept. Session
-// revocation and active-game forfeit are orchestrated one layer up (they need the session
-// cache and the game service). See docs/ARCHITECTURE.md §9.1 and the retention TTL reaper.
-package accountdelete
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/go-jet/jet/v2/postgres"
-	"github.com/go-jet/jet/v2/qrm"
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/postgres/jet/backend/model"
-	"scrabble/backend/internal/postgres/jet/backend/table"
-)
-
-// AnonymizedName is the label a deleted account shows to opponents. Display names are
-// stored strings resolved identically for every viewer (no per-viewer localisation in this
-// codebase), so a single canonical label is used. The brackets are deliberate: the
-// editable-name rule (account.displayNameRe) forbids them, so a live player can never set a
-// name that impersonates a deleted account.
-const AnonymizedName = "[Deleted]"
-
-// retainDelete is the retained_identities reason written when a credential is journalled
-// because its account is being deleted.
-const retainDelete = "delete"
-
-// Deleter performs the SQL-atomic part of account deletion over a Postgres handle.
-type Deleter struct {
-	db  *sql.DB
-	now func() time.Time
-}
-
-// NewDeleter constructs a Deleter over db.
-func NewDeleter(db *sql.DB) *Deleter {
-	return &Deleter{db: db, now: func() time.Time { return time.Now().UTC() }}
-}
-
-// AnonymizeAndTombstone retires accountID atomically: it journals every live identity into
-// retained_identities (reason=delete) then removes them so the credentials free for reuse,
-// snapshots the real display name into deleted_display_name and scrubs the live one to
-// AnonymizedName, sets deleted_at, anonymises the account's game-seat snapshots, and drops
-// its friendships, blocks, invitations, friend codes, drafts and pending codes. Chat,
-// feedback and complaints are kept (the surviving tombstone keeps their no-cascade foreign
-// keys valid). It is idempotent-safe on an already-tombstoned account (re-journalling
-// nothing, since the identities are already gone).
-func (d *Deleter) AnonymizeAndTombstone(ctx context.Context, accountID uuid.UUID) error {
-	now := d.now()
-	return withTx(ctx, d.db, func(tx *sql.Tx) error {
-		if err := journalAndDropIdentities(ctx, tx, accountID, now); err != nil {
-			return err
-		}
-		if err := tombstone(ctx, tx, accountID, now); err != nil {
-			return err
-		}
-		if _, err := table.GamePlayers.UPDATE(table.GamePlayers.DisplayName).
-			SET(postgres.String(AnonymizedName)).
-			WHERE(table.GamePlayers.AccountID.EQ(postgres.UUID(accountID))).
-			ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountdelete: anonymise seats: %w", err)
-		}
-		return dropSocialAndEphemerals(ctx, tx, accountID)
-	})
-}
-
-// dropAllRobotGamesSQL deletes every game in which the account plays and no other seat is a
-// human — a robot seat is one whose account holds a 'robot' identity, so this covers both
-// honest vs-AI games and disguised auto-match substitutes. The game rows are deleted; their
-// moves/chat/players/complaints fall away through ON DELETE CASCADE.
-const dropAllRobotGamesSQL = `
-DELETE FROM games g
-WHERE EXISTS (
-    SELECT 1 FROM game_players p WHERE p.game_id = g.game_id AND p.account_id = $1
-) AND NOT EXISTS (
-    SELECT 1 FROM game_players o
-    WHERE o.game_id = g.game_id AND o.account_id <> $1
-      AND NOT EXISTS (
-          SELECT 1 FROM identities i WHERE i.account_id = o.account_id AND i.kind = 'robot'
-      )
-)`
-
-// DropAllRobotGames deletes the account's games that have no human opponent (solo vs-AI or
-// auto-match-robot games), returning how many were removed. Games with any human seat are
-// kept — their seat is anonymised by AnonymizeAndTombstone instead. Run it after the
-// account's active games are resigned, so no live game is removed under the robot driver.
-func (d *Deleter) DropAllRobotGames(ctx context.Context, accountID uuid.UUID) (int64, error) {
-	res, err := d.db.ExecContext(ctx, dropAllRobotGamesSQL, accountID)
-	if err != nil {
-		return 0, fmt.Errorf("accountdelete: drop all-robot games: %w", err)
-	}
-	n, err := res.RowsAffected()
-	if err != nil {
-		return 0, fmt.Errorf("accountdelete: dropped games count: %w", err)
-	}
-	return n, nil
-}
-
-// journalAndDropIdentities copies the account's live identities into the retention journal
-// (reason=delete) and then removes them, freeing each (kind, external_id) for reuse.
-func journalAndDropIdentities(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, now time.Time) error {
-	var ids []model.Identities
-	err := postgres.SELECT(table.Identities.AllColumns).
-		FROM(table.Identities).
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(accountID))).
-		QueryContext(ctx, tx, &ids)
-	if err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return fmt.Errorf("accountdelete: load identities: %w", err)
-	}
-	for _, id := range ids {
-		rid, err := uuid.NewV7()
-		if err != nil {
-			return fmt.Errorf("accountdelete: new retained id: %w", err)
-		}
-		ins := table.RetainedIdentities.INSERT(
-			table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
-			table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
-			table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
-			table.RetainedIdentities.DetachedAt, table.RetainedIdentities.Reason,
-		).VALUES(rid, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, now, retainDelete)
-		if _, err := ins.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountdelete: retain identity %s: %w", id.Kind, err)
-		}
-	}
-	if _, err := table.Identities.DELETE().
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(accountID))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete identities: %w", err)
-	}
-	return nil
-}
-
-// tombstone marks the account deleted, snapshotting the real display name into
-// deleted_display_name (evaluated from the old row) before scrubbing the live one.
-func tombstone(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, now time.Time) error {
-	upd := table.Accounts.UPDATE(
-		table.Accounts.DeletedAt, table.Accounts.DeletedDisplayName,
-		table.Accounts.DisplayName, table.Accounts.UpdatedAt,
-	).SET(
-		postgres.TimestampzT(now), table.Accounts.DisplayName,
-		postgres.String(AnonymizedName), postgres.TimestampzT(now),
-	).WHERE(table.Accounts.AccountID.EQ(postgres.UUID(accountID)))
-	if _, err := upd.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: tombstone account: %w", err)
-	}
-	return nil
-}
-
-// dropSocialAndEphemerals removes the account's own friendships, blocks, invitations
-// (as inviter and as invitee), friend codes, drafts and pending confirm-codes. These are
-// the deleting user's private data with no dossier value; chat and feedback are kept.
-func dropSocialAndEphemerals(ctx context.Context, tx *sql.Tx, accountID uuid.UUID) error {
-	id := postgres.UUID(accountID)
-	// Friendships and blocks are two-account edges keyed on either endpoint.
-	if _, err := table.Friendships.DELETE().
-		WHERE(table.Friendships.RequesterID.EQ(id).OR(table.Friendships.AddresseeID.EQ(id))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete friendships: %w", err)
-	}
-	if _, err := table.Blocks.DELETE().
-		WHERE(table.Blocks.BlockerID.EQ(id).OR(table.Blocks.BlockedID.EQ(id))).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete blocks: %w", err)
-	}
-	// Invitations: drop the account's invitee rows, then its own invitations' invitees and
-	// the invitations themselves (children first, to respect the foreign key).
-	if _, err := table.GameInvitationInvitees.DELETE().
-		WHERE(table.GameInvitationInvitees.AccountID.EQ(id)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete invitee rows: %w", err)
-	}
-	ownInvitations := postgres.SELECT(table.GameInvitations.InvitationID).
-		FROM(table.GameInvitations).
-		WHERE(table.GameInvitations.InviterID.EQ(id))
-	if _, err := table.GameInvitationInvitees.DELETE().
-		WHERE(table.GameInvitationInvitees.InvitationID.IN(ownInvitations)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete own invitation invitees: %w", err)
-	}
-	if _, err := table.GameInvitations.DELETE().
-		WHERE(table.GameInvitations.InviterID.EQ(id)).
-		ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete invitations: %w", err)
-	}
-	// Ephemerals: friend codes, move drafts, pending confirm-codes.
-	if _, err := table.FriendCodes.DELETE().
-		WHERE(table.FriendCodes.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete friend codes: %w", err)
-	}
-	if _, err := table.GameDrafts.DELETE().
-		WHERE(table.GameDrafts.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete drafts: %w", err)
-	}
-	if _, err := table.EmailConfirmations.DELETE().
-		WHERE(table.EmailConfirmations.AccountID.EQ(id)).ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountdelete: delete confirmations: %w", err)
-	}
-	return nil
-}
-
-// withTx runs fn inside a transaction, committing on success and rolling back on error.
-func withTx(ctx context.Context, db *sql.DB, fn func(tx *sql.Tx) error) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("accountdelete: begin tx: %w", err)
-	}
-	if err := fn(tx); err != nil {
-		_ = tx.Rollback()
-		return err
-	}
-	if err := tx.Commit(); err != nil {
-		return fmt.Errorf("accountdelete: commit tx: %w", err)
-	}
-	return nil
-}
@@ -1,6 +1,5 @@
 // Package accountmerge retires a secondary account into a primary one in a single
-// transaction: it sums statistics (merging the per-variant best moves), sums the hint
-// wallet, ORs the paid flag, repoints
+// transaction: it sums statistics and the hint wallet, ORs the paid flag, repoints
 // the secondary's identities, transfers its games/chat/complaints/invitations,
 // de-duplicates friends and blocks, and leaves the secondary as an audit tombstone
 // (accounts.merged_into). It is the data core of account linking & merge
@@ -27,11 +26,6 @@ import (
 // without taking a dependency on the game package.
 const statusActive = "active"

-// retainReasonMerge is the retained_identities.reason for a credential dropped by a merge
-// collision (both accounts held the same kind). It mirrors the account package's retain
-// reasons, kept local to avoid importing that package's unexported constants.
-const retainReasonMerge = "merge"
-
 // Friendship statuses, highest precedence first, mirroring internal/social.
 const (
 	friendAccepted = "accepted"
@@ -74,15 +68,9 @@ func (m *Merger) Merge(ctx context.Context, primary, secondary uuid.UUID) error
 		if err := mergeStats(ctx, tx, primary, secondary, now); err != nil {
 			return err
 		}
-		if err := mergeBestMoves(ctx, tx, primary, secondary, now); err != nil {
-			return err
-		}
 		if err := mergeAccountFields(ctx, tx, primary, secondary, now); err != nil {
 			return err
 		}
-		if err := dedupeIdentities(ctx, tx, primary, secondary); err != nil {
-			return err
-		}
 		if err := reassignColumn(ctx, tx, table.Identities, table.Identities.AccountID, primary, secondary); err != nil {
 			return fmt.Errorf("accountmerge: identities: %w", err)
 		}
@@ -159,8 +147,8 @@ func activeGameIDs(ctx context.Context, tx *sql.Tx, accountID uuid.UUID) ([]uuid
 	return out, nil
 }

-// mergeStats folds secondary's lifetime statistics into primary (wins/losses/draws and
-// the moves/hints-used counters summed, max points kept) and deletes the secondary row.
+// mergeStats folds secondary's lifetime statistics into primary (wins/losses/draws
+// summed, max points kept) and deletes the secondary row.
 func mergeStats(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID, now time.Time) error {
 	var sec model.AccountStats
 	err := postgres.SELECT(table.AccountStats.AllColumns).
@@ -190,16 +178,13 @@ func mergeStats(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID, n

 	upd := table.AccountStats.UPDATE(
 		table.AccountStats.Wins, table.AccountStats.Losses, table.AccountStats.Draws,
-		table.AccountStats.MaxGamePoints, table.AccountStats.MaxWordPoints,
-		table.AccountStats.Moves, table.AccountStats.HintsUsed, table.AccountStats.UpdatedAt,
+		table.AccountStats.MaxGamePoints, table.AccountStats.MaxWordPoints, table.AccountStats.UpdatedAt,
 	).SET(
 		postgres.Int(int64(pri.Wins+sec.Wins)),
 		postgres.Int(int64(pri.Losses+sec.Losses)),
 		postgres.Int(int64(pri.Draws+sec.Draws)),
 		postgres.Int(int64(max(pri.MaxGamePoints, sec.MaxGamePoints))),
 		postgres.Int(int64(max(pri.MaxWordPoints, sec.MaxWordPoints))),
-		postgres.Int(int64(pri.Moves+sec.Moves)),
-		postgres.Int(int64(pri.HintsUsed+sec.HintsUsed)),
 		postgres.TimestampzT(now),
 	).WHERE(table.AccountStats.AccountID.EQ(postgres.UUID(primary)))
 	if _, err := upd.ExecContext(ctx, tx); err != nil {
@@ -213,41 +198,6 @@ func mergeStats(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID, n
 	return nil
 }

-// mergeBestMoves folds secondary's per-variant best moves into primary, keeping the
-// higher-scoring play per variant (the same rule the per-game upsert uses), then deletes
-// the secondary's rows — the secondary is only tombstoned, not removed, so without this
-// they would linger on a dead account and never reach the merged statistics screen.
-func mergeBestMoves(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID, now time.Time) error {
-	var srows []model.AccountBestMove
-	err := postgres.SELECT(table.AccountBestMove.AllColumns).
-		FROM(table.AccountBestMove).
-		WHERE(table.AccountBestMove.AccountID.EQ(postgres.UUID(secondary))).
-		QueryContext(ctx, tx, &srows)
-	if err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return fmt.Errorf("accountmerge: load secondary best moves: %w", err)
-	}
-	for _, s := range srows {
-		ins := table.AccountBestMove.
-			INSERT(table.AccountBestMove.AccountID, table.AccountBestMove.Variant,
-				table.AccountBestMove.Score, table.AccountBestMove.Tiles, table.AccountBestMove.UpdatedAt).
-			VALUES(primary, s.Variant, s.Score, s.Tiles, postgres.TimestampzT(now)).
-			ON_CONFLICT(table.AccountBestMove.AccountID, table.AccountBestMove.Variant).
-			DO_UPDATE(postgres.SET(
-				table.AccountBestMove.Score.SET(table.AccountBestMove.EXCLUDED.Score),
-				table.AccountBestMove.Tiles.SET(table.AccountBestMove.EXCLUDED.Tiles),
-				table.AccountBestMove.UpdatedAt.SET(table.AccountBestMove.EXCLUDED.UpdatedAt),
-			).WHERE(table.AccountBestMove.EXCLUDED.Score.GT(table.AccountBestMove.Score)))
-		if _, err := ins.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountmerge: merge best move %s: %w", s.Variant, err)
-		}
-	}
-	del := table.AccountBestMove.DELETE().WHERE(table.AccountBestMove.AccountID.EQ(postgres.UUID(secondary)))
-	if _, err := del.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountmerge: delete secondary best moves: %w", err)
-	}
-	return nil
-}
-
 // mergeAccountFields adds secondary's hint wallet to primary and ORs the paid flag;
 // all other profile fields stay the primary's.
 func mergeAccountFields(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID, now time.Time) error {
@@ -308,77 +258,6 @@ func reassignColumn(ctx context.Context, tx *sql.Tx, tbl postgres.Table, col pos
 	return err
 }

-// dedupeIdentities resolves a same-kind identity collision before the blanket identity
-// reassign: when both accounts already hold an identity of the same kind (e.g. each has a
-// confirmed email — reachable when two email-bearing accounts merge), the primary keeps
-// its own and the secondary's is journaled to retained_identities (reason=merge) and
-// removed. Without this the blanket reassign would leave the survivor with two identities
-// of one kind (there is no per-account-kind unique on identities), which the profile and
-// the retention dossier both treat as singular. Non-colliding identities are untouched and
-// move with the blanket reassign.
-func dedupeIdentities(ctx context.Context, tx *sql.Tx, primary, secondary uuid.UUID) error {
-	var prows []model.Identities
-	if err := postgres.SELECT(table.Identities.Kind).
-		FROM(table.Identities).
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(primary))).
-		QueryContext(ctx, tx, &prows); err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return fmt.Errorf("accountmerge: primary identity kinds: %w", err)
-	}
-	occupied := make(map[string]struct{}, len(prows))
-	for _, r := range prows {
-		occupied[r.Kind] = struct{}{}
-	}
-	if len(occupied) == 0 {
-		return nil
-	}
-	var srows []model.Identities
-	if err := postgres.SELECT(
-		table.Identities.Kind, table.Identities.ExternalID,
-		table.Identities.Confirmed, table.Identities.CreatedAt,
-	).FROM(table.Identities).
-		WHERE(table.Identities.AccountID.EQ(postgres.UUID(secondary))).
-		QueryContext(ctx, tx, &srows); err != nil && !errors.Is(err, qrm.ErrNoRows) {
-		return fmt.Errorf("accountmerge: secondary identities: %w", err)
-	}
-	for _, s := range srows {
-		if _, dup := occupied[s.Kind]; !dup {
-			continue
-		}
-		if err := retainMergedIdentity(ctx, tx, secondary, s); err != nil {
-			return err
-		}
-		del := table.Identities.DELETE().WHERE(
-			table.Identities.AccountID.EQ(postgres.UUID(secondary)).
-				AND(table.Identities.Kind.EQ(postgres.String(s.Kind))).
-				AND(table.Identities.ExternalID.EQ(postgres.String(s.ExternalID))),
-		)
-		if _, err := del.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("accountmerge: drop colliding %s identity: %w", s.Kind, err)
-		}
-	}
-	return nil
-}
-
-// retainMergedIdentity appends a retained_identities row for a secondary identity dropped
-// by a merge collision (reason=merge), preserving it in the legal dossier. It mirrors
-// account.retainIdentityTx, which is unexported; detached_at falls to the column default.
-func retainMergedIdentity(ctx context.Context, tx *sql.Tx, accountID uuid.UUID, id model.Identities) error {
-	rid, err := uuid.NewV7()
-	if err != nil {
-		return fmt.Errorf("accountmerge: new retained id: %w", err)
-	}
-	ins := table.RetainedIdentities.INSERT(
-		table.RetainedIdentities.RetainedID, table.RetainedIdentities.AccountID,
-		table.RetainedIdentities.Kind, table.RetainedIdentities.ExternalID,
-		table.RetainedIdentities.Confirmed, table.RetainedIdentities.LinkedAt,
-		table.RetainedIdentities.Reason,
-	).VALUES(rid, accountID, id.Kind, id.ExternalID, id.Confirmed, id.CreatedAt, retainReasonMerge)
-	if _, err := ins.ExecContext(ctx, tx); err != nil {
-		return fmt.Errorf("accountmerge: retain merged %s identity: %w", id.Kind, err)
-	}
-	return nil
-}
-
 // friendRank ranks a friendship status for dedupe precedence (higher wins).
 func friendRank(status string) int {
 	switch status {
@@ -1,116 +0,0 @@
-// Package adminalert emails the operator when new player feedback or word complaints
-// arrive, coalescing a burst into a single digest per interval so a flood is one email,
-// not N. It is inert unless an admin sender and recipient are configured. The sender is
-// distinct from the user-facing confirm-code From, and the recipient may be several
-// comma-separated addresses (the mailer splits them).
-package adminalert
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"time"
-
-	"go.uber.org/zap"
-
-	"scrabble/backend/internal/account"
-)
-
-// FeedbackCounter counts feedback created since a time (satisfied by feedback.Service).
-type FeedbackCounter interface {
-	CountSince(ctx context.Context, since time.Time) (int, error)
-}
-
-// ComplaintCounter counts word complaints filed since a time (satisfied by game.Service).
-type ComplaintCounter interface {
-	CountComplaintsSince(ctx context.Context, since time.Time) (int, error)
-}
-
-// Notifier polls for new feedback and complaints and emails the operator a digest.
-type Notifier struct {
-	mailer     account.Mailer
-	feedback   FeedbackCounter
-	complaints ComplaintCounter
-	from       string
-	to         string
-	consoleURL string
-	clock      func() time.Time
-	log        *zap.Logger
-	last       time.Time
-}
-
-// New constructs a Notifier. from and to are the alert sender and recipient(s); consoleURL,
-// when non-empty, is the admin-console link included in the email. log may be nil. The
-// watermark starts at "now", so only items arriving after start-up are reported.
-func New(mailer account.Mailer, fb FeedbackCounter, cp ComplaintCounter, from, to, consoleURL string, log *zap.Logger) *Notifier {
-	if log == nil {
-		log = zap.NewNop()
-	}
-	return &Notifier{
-		mailer: mailer, feedback: fb, complaints: cp, from: from, to: to, consoleURL: consoleURL,
-		clock: func() time.Time { return time.Now().UTC() }, log: log, last: time.Now().UTC(),
-	}
-}
-
-// Run polls on each tick until ctx is cancelled.
-func (n *Notifier) Run(ctx context.Context, interval time.Duration) {
-	ticker := time.NewTicker(interval)
-	defer ticker.Stop()
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			n.tick(ctx)
-		}
-	}
-}
-
-// tick counts what arrived since the last watermark and, if anything did, emails one
-// digest. The watermark only advances after a successful send (or a quiet tick), so a
-// transient send failure is retried on the next tick — the counts simply grow.
-func (n *Notifier) tick(ctx context.Context) {
-	now := n.clock()
-	fb, err := n.feedback.CountSince(ctx, n.last)
-	if err != nil {
-		n.log.Warn("admin alert: count feedback failed", zap.Error(err))
-		return
-	}
-	cp, err := n.complaints.CountComplaintsSince(ctx, n.last)
-	if err != nil {
-		n.log.Warn("admin alert: count complaints failed", zap.Error(err))
-		return
-	}
-	if fb == 0 && cp == 0 {
-		n.last = now
-		return
-	}
-	if err := n.mailer.Send(ctx, n.digest(fb, cp)); err != nil {
-		n.log.Warn("admin alert: send failed", zap.Error(err))
-		return
-	}
-	n.log.Info("admin alert sent", zap.Int("feedback", fb), zap.Int("complaints", cp))
-	n.last = now
-}
-
-// digest builds the operator alert email for fb new feedback and cp new complaints.
-func (n *Notifier) digest(fb, cp int) account.Message {
-	var parts []string
-	if fb > 0 {
-		parts = append(parts, fmt.Sprintf("%d new feedback message(s)", fb))
-	}
-	if cp > 0 {
-		parts = append(parts, fmt.Sprintf("%d new word complaint(s)", cp))
-	}
-	summary := strings.Join(parts, ", ")
-	text := summary + "."
-	if n.consoleURL != "" {
-		text += "\n\nOpen the admin console: " + n.consoleURL
-	}
-	return account.Message{
-		From:    n.from,
-		To:      n.to,
-		Subject: "Erudit — " + summary,
-		Text:    text,
-	}
-}
@@ -1,55 +0,0 @@
-package adminalert
-
-import (
-	"context"
-	"strings"
-	"testing"
-	"time"
-
-	"scrabble/backend/internal/account"
-)
-
-// The fakes ignore the watermark and return a fixed count, which is all the digest logic
-// needs.
-type fbCounter struct{ n int }
-
-func (f fbCounter) CountSince(context.Context, time.Time) (int, error) { return f.n, nil }
-
-type cpCounter struct{ n int }
-
-func (c cpCounter) CountComplaintsSince(context.Context, time.Time) (int, error) { return c.n, nil }
-
-type recordingMailer struct{ sent []account.Message }
-
-func (m *recordingMailer) Send(_ context.Context, msg account.Message) error {
-	m.sent = append(m.sent, msg)
-	return nil
-}
-
-func TestNotifierSkipsWhenNothingNew(t *testing.T) {
-	mailer := &recordingMailer{}
-	n := New(mailer, fbCounter{0}, cpCounter{0}, "alerts@erudit-game.ru", "op@x.ru", "", nil)
-	n.tick(context.Background())
-	if len(mailer.sent) != 0 {
-		t.Fatalf("sent %d emails, want 0 when nothing is new", len(mailer.sent))
-	}
-}
-
-func TestNotifierDigestsNewItems(t *testing.T) {
-	mailer := &recordingMailer{}
-	n := New(mailer, fbCounter{2}, cpCounter{1}, "alerts@erudit-game.ru", "op@x.ru, two@x.ru", "https://erudit-game.ru/_gm", nil)
-	n.tick(context.Background())
-	if len(mailer.sent) != 1 {
-		t.Fatalf("sent %d emails, want 1 digest", len(mailer.sent))
-	}
-	msg := mailer.sent[0]
-	if msg.From != "alerts@erudit-game.ru" || msg.To != "op@x.ru, two@x.ru" {
-		t.Errorf("digest addressing = From %q To %q", msg.From, msg.To)
-	}
-	if !strings.Contains(msg.Subject, "2 new feedback") || !strings.Contains(msg.Subject, "1 new word complaint") {
-		t.Errorf("digest subject = %q, want the feedback + complaint counts", msg.Subject)
-	}
-	if !strings.Contains(msg.Text, "/_gm") {
-		t.Errorf("digest body = %q, want the console link", msg.Text)
-	}
-}
@@ -137,59 +137,3 @@ code { background: var(--bg); padding: 0.05rem 0.3rem; border-radius: 4px; }
   an image attachment is previewed inline, bounded so it cannot dominate the page. */
 .msgbody { white-space: pre-wrap; word-break: break-word; background: var(--bg); padding: 0.6rem 0.8rem; border-radius: 6px; margin: 0.6rem 0; }
 .attach { max-width: 100%; max-height: 480px; height: auto; border: 1px solid var(--line); border-radius: 6px; }
-
-/* Game replay (admin): a script-stepped board with rack panels around it, a move log and the
-   first-move draw. A placed tile shows its value as a subscript; a 0 value (a blank) shows none. */
-.replay-stage {
-  display: grid;
-  grid-template-columns: auto minmax(0, 1fr) auto;
-  grid-template-areas: ".    top    ." "left board  right" ".    bottom .";
-  gap: 0.5rem;
-  align-items: center;
-  justify-items: center;
-  margin-bottom: 0.6rem;
-}
-.rack-top { grid-area: top; }
-.rack-bottom { grid-area: bottom; }
-.rack-left { grid-area: left; }
-.rack-right { grid-area: right; }
-.replay-board { grid-area: board; overflow: auto; }
-.board-grid {
-  display: grid;
-  grid-template-columns: 1.4rem repeat(15, 1.7rem);
-  grid-auto-rows: 1.7rem;
-  gap: 1px;
-  background: var(--line);
-  border: 1px solid var(--line);
-  width: max-content;
-}
-.board-grid .bh { display: flex; align-items: center; justify-content: center; font-size: 0.6rem; color: var(--ink-dim); background: var(--panel); }
-.board-grid .cell { position: relative; display: flex; align-items: center; justify-content: center; background: var(--panel-hi); }
-.cell .prem { font-size: 0.55rem; color: var(--ink); opacity: 0.8; }
-.cell.tw { background: #7a2230; }
-.cell.dw { background: #a8506a; }
-.cell.tl { background: #235a7a; }
-.cell.dl { background: #3f87a8; }
-.cell.centre .prem { font-size: 0.95rem; color: var(--warn); opacity: 1; }
-.tile {
-  display: inline-flex; align-items: baseline; justify-content: center;
-  min-width: 1.35rem; height: 1.35rem; padding: 0 0.12rem;
-  background: #e8d9a0; color: #1b1408; border-radius: 3px;
-  font-weight: 700; font-size: 0.8rem; line-height: 1.35rem;
-}
-.tile sub { font-size: 0.5rem; font-weight: 600; line-height: 1; align-self: flex-end; margin-left: 1px; }
-.tile.blank { background: #cdbfe0; }
-.cell.filled { background: var(--panel-hi); }
-.cell.filled .tile { width: 100%; height: 100%; border-radius: 2px; }
-.rack-slot { padding: 0.25rem; border-radius: 6px; }
-.rack-slot.active { outline: 2px solid var(--accent); background: var(--panel-hi); }
-.rack-name { font-size: 0.72rem; color: var(--ink-dim); margin-bottom: 0.2rem; text-align: center; }
-.rack-tiles { display: flex; gap: 2px; flex-wrap: wrap; justify-content: center; }
-.rack-left .rack-tiles, .rack-right .rack-tiles { flex-direction: column; }
-.replay-controls { display: flex; align-items: center; gap: 0.8rem; justify-content: center; margin: 0.6rem 0; }
-.replay-controls button { background: var(--panel-hi); color: var(--ink); border: 1px solid var(--line); font-weight: 600; }
-.replay-controls button:disabled { opacity: 0.4; cursor: default; }
-.replay-pos { color: var(--ink-dim); font-variant-numeric: tabular-nums; }
-.replay-log { margin: 0.4rem 0 0; padding-left: 1.4rem; max-height: 14rem; overflow: auto; font-size: 0.85rem; }
-.replay-log li { color: var(--ink-dim); padding: 0.1rem 0; }
-.replay-log li.cur { color: var(--ink); font-weight: 600; }
@@ -24,14 +24,8 @@ func TestRendererRendersEveryPage(t *testing.T) {
 		{"dashboard", DashboardView{Accounts: 3, Variants: []VariantVersions{{Variant: "scrabble_en", Latest: "v1", Versions: []string{"v1"}}}}, "Dashboard"},
 		{"users", UsersView{Items: []UserRow{{ID: "a1", DisplayName: "Kaya", FlaggedHighRate: true}}, Pager: NewPager(1, 50, 1)}, "high-rate"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", HasStats: true, Stats: StatsRow{Wins: 2}, TelegramID: "123", ConnectorEnabled: true}, "Send Telegram message"},
-		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", VKID: "494075"}, "vk.com/id494075"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", FlaggedHighRateAt: "2026-06-10 12:00"}, "Clear high-rate flag"},
 		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya", Roles: []string{"feedback_banned"}, KnownRoles: []string{"feedback_banned"}}, "feedback_banned"},
-		{"user_detail", UserDetailView{ID: "a1", DisplayName: "Kaya",
-			Friends:   []RelationRow{{AccountID: "b2", DisplayName: "Ann", Date: "2026-06-10 12:00"}},
-			Blocks:    []RelationRow{{AccountID: "c3", DisplayName: "Bob", Date: "2026-06-11 09:00"}},
-			BlockedBy: []RelationRow{{AccountID: "d4", DisplayName: "Cay", Date: "2026-06-12 08:00"}},
-		}, `/_gm/users/c3`},
 		{"throttled", ThrottledView{
 			Episodes:      []ThrottleEpisodeRow{{Class: "user", Key: "a1", UserID: "a1", Rejected: 1234, FirstSeen: "2026-06-10 12:00", LastSeen: "2026-06-10 12:05"}},
 			Flagged:       []FlaggedAccountRow{{ID: "a1", DisplayName: "Kaya", FlaggedAt: "2026-06-10 12:05"}},
@@ -44,7 +38,7 @@ func TestRendererRendersEveryPage(t *testing.T) {
 		{"messages", MessagesView{Items: []MessageRow{{ID: "m1", SenderID: "a1", SenderName: "Kaya", Source: "telegram", Body: "good luck", GameID: "g1", Unread: true}}, UnreadOnly: true, Pager: NewPager(1, 50, 1)}, "unread only"},
 		{"chatmessage", ChatMessageDetailView{ID: "m1", GameID: "g1", SenderID: "a1", SenderName: "Kaya", Source: "telegram", Kind: "message", Body: "good luck", Unread: true, Seats: []ChatSeatStatusRow{{Seat: 0, AccountID: "a1", DisplayName: "Kaya", Role: "sender"}, {Seat: 1, AccountID: "b2", DisplayName: "Opp", Role: "unread"}}}, "Read by seat"},
 		{"feedback", FeedbackView{Items: []FeedbackRow{{ID: "f1", AccountID: "a1", SenderName: "Kaya", Source: "telegram", Channel: "web", HasAttachment: true, Replied: true}}, Status: "unread", Pager: NewPager(1, 50, 1)}, "replied"},
-		{"feedback_detail", FeedbackDetailView{ID: "f1", AccountID: "a1", SenderName: "Kaya", Channel: "telegram", InterfaceLanguage: "en", Body: "please fix the board", HasAttachment: true, AttachmentName: "shot.png", IsImage: true, Banned: true}, "Interface language"},
+		{"feedback_detail", FeedbackDetailView{ID: "f1", AccountID: "a1", SenderName: "Kaya", Channel: "telegram", InterfaceLanguage: "en", BotLanguage: "ru", Body: "please fix the board", HasAttachment: true, AttachmentName: "shot.png", IsImage: true, Banned: true}, "bot: ru"},
 		{"complaint_detail", ComplaintDetailView{ID: "c1", Word: "qi", Variant: "scrabble_en"}, "Resolve"},
 		{"dictionary", DictionaryView{ActiveVersion: "v1.0.0", Variants: []VariantVersions{{Variant: "scrabble_en", Versions: []string{"v1.0.0"}}}, Changes: []DictChangeRow{{Variant: "scrabble_en", Word: "qi", Action: "add"}}}, "Update dictionaries"},
 		{"dictionary_preview", DictionaryPreviewView{Version: "v1.1.0", Token: "0123456789abcdef0123456789abcdef", ActiveVersion: "v1.0.0", Variants: []VariantDiffRow{{Variant: "scrabble_en", AddedCount: 2, RemovedCount: 1, AddedSample: []string{"qi", "za"}, RemovedSample: []string{"xqz"}, RemovedTruncated: true}}}, "v1.1.0"},
@@ -5,6 +5,7 @@
 {{if .ConnectorEnabled}}
 <form class="form col" method="post" action="/_gm/broadcast">
 <label>Message <textarea name="text" required></textarea></label>
+<label>Bot language <select name="language"><option value="en">en</option><option value="ru">ru</option></select></label>
 <div><button type="submit">Post to channel</button></div>
 </form>
 {{else}}<p class="note">connector not configured (set BACKEND_CONNECTOR_ADDR)</p>{{end}}
@@ -5,11 +5,10 @@
 <section class="panel"><h2>Message</h2>
 <ul class="kv">
 <li><b>From</b> <a href="/_gm/users/{{.AccountID}}">{{.SenderName}}</a> ({{.Source}})</li>
-<li><b>Channel</b> {{.Channel}}</li>
+<li><b>Channel</b> {{.Channel}}{{if .BotLanguage}} (bot: {{.BotLanguage}}){{end}}</li>
 <li><b>Interface language</b> {{.InterfaceLanguage}}</li>
-<li><b>App version</b> {{if .Version}}<code>{{.Version}}</code>{{else}}<span class="note">unknown</span>{{end}}</li>
 <li><b>IP</b> {{if .IP}}<code>{{.IP}}</code>{{else}}<span class="note">none</span>{{end}}</li>
-<li><b>Filed</b> {{.CreatedAt}} UTC &middot; browser {{if .CreatedAtBrowser}}{{.CreatedAtBrowser}} ({{.BrowserTZ}}){{else}}<span class="note">N/A</span>{{end}} &middot; user {{if .CreatedAtUser}}{{.CreatedAtUser}} ({{.UserTZ}}){{else}}<span class="note">N/A</span>{{end}}</li>
+<li><b>Filed</b> {{.CreatedAt}}</li>
 <li><b>State</b> {{if .Archived}}archived{{else if .Read}}read{{else}}<span class="warn">unread</span>{{end}}</li>
 {{if .Banned}}<li><b>Feedback</b> <span class="warn">sender is banned from feedback</span></li>{{end}}
 </ul>
@@ -27,87 +27,5 @@
 </table>
 {{if .HasRobot}}<p><small>Play-to-win is decided once per game from the bag seed; robots play to win in ~{{.RobotTargetPct}}% of games.</small></p>{{end}}
 </section>
-{{if .SetupDraws}}
-<section class="panel"><h2>First-move draw</h2>
-<p class="note">Each player draws a tile; the one closest to &ldquo;A&rdquo; moves first (a blank beats every letter), ties re-drawing until a single leader remains.{{if .FirstMover}} <b>{{.FirstMover}}</b> leads.{{end}}</p>
-<table class="list">
-<thead><tr><th>Round</th><th>Player</th><th>Tile</th><th>Rank</th></tr></thead>
-<tbody>
-{{range .SetupDraws}}
-<tr><td>{{.Round}}</td><td>{{if .AccountID}}<a href="/_gm/users/{{.AccountID}}">{{.Name}}</a>{{else}}{{.Name}}{{end}}</td><td>{{.Letter}}{{if .Blank}} <small>(blank)</small>{{end}}</td><td>{{.Rank}}</td></tr>
-{{end}}
-</tbody>
-</table>
-</section>
-{{end}}
-{{if .HasReplay}}
-<section class="panel"><h2>Replay</h2>
-<div class="replay-stage">
-  <div class="rack-slot rack-top" data-seat="0"></div>
-  <div class="rack-slot rack-left" data-seat="2"></div>
-  <div class="replay-board" id="replay-board"></div>
-  <div class="rack-slot rack-right" data-seat="3"></div>
-  <div class="rack-slot rack-bottom" data-seat="1"></div>
-</div>
-<div class="replay-controls">
-  <button type="button" id="replay-prev">&#9664; prev</button>
-  <span class="replay-pos" id="replay-pos"></span>
-  <button type="button" id="replay-next">next &#9654;</button>
-</div>
-<ol class="replay-log" id="replay-log"></ol>
-<script>
-const REPLAY = {{.ReplayJSON}};
-(function(){
-  if(!REPLAY||!REPLAY.steps){return;}
-  const N=15, COLS="ABCDEFGHIJKLMNO", PREM={tw:"3W",dw:"2W",tl:"3L",dl:"2L"};
-  const boardEl=document.getElementById("replay-board"), logEl=document.getElementById("replay-log");
-  const posEl=document.getElementById("replay-pos"), prevBtn=document.getElementById("replay-prev"), nextBtn=document.getElementById("replay-next");
-  let step=0;
-  function esc(s){const d=document.createElement("div");d.textContent=s==null?"":s;return d.innerHTML;}
-  function tileHTML(t){const sub=(t.v&&t.v>0)?"<sub>"+t.v+"<\/sub>":"";return "<span class=\"tile"+(t.b?" blank":"")+"\">"+esc(t.l)+sub+"<\/span>";}
-  function placedAt(k){const m={};for(let s=1;s<=k;s++){const mv=REPLAY.steps[s]&&REPLAY.steps[s].move;if(mv&&mv.placements){for(const p of mv.placements){m[p.r+","+p.c]=p;}}}return m;}
-  function renderBoard(){
-    const placed=placedAt(step);let h="<div class=\"board-grid\"><div class=\"bh corner\"><\/div>";
-    for(let c=0;c<N;c++){h+="<div class=\"bh\">"+COLS[c]+"<\/div>";}
-    for(let r=0;r<N;r++){h+="<div class=\"bh\">"+(r+1)+"<\/div>";
-      for(let c=0;c<N;c++){const p=placed[r+","+c];
-        if(p){h+="<div class=\"cell filled\">"+tileHTML(p)+"<\/div>";continue;}
-        const prem=REPLAY.premium[r][c], centre=(r===REPLAY.centre[0]&&c===REPLAY.centre[1]);
-        const label=centre?"&#9733;":(prem?PREM[prem]:"");
-        h+="<div class=\"cell "+(prem||"")+(centre?" centre":"")+"\">"+(label?"<span class=\"prem\">"+label+"<\/span>":"")+"<\/div>";}}
-    h+="<\/div>";boardEl.innerHTML=h;
-  }
-  function renderRacks(){
-    const st=REPLAY.steps[step];
-    document.querySelectorAll(".rack-slot").forEach(function(slot){
-      const seat=parseInt(slot.dataset.seat,10), info=REPLAY.seats.find(function(s){return s.seat===seat;}), rack=st.racks[seat];
-      if(!info||!rack){slot.style.display="none";slot.innerHTML="";return;}
-      slot.style.display="";slot.classList.toggle("active",st.toMove===seat);
-      const nm=info.accountId?"<a href=\"/_gm/users/"+info.accountId+"\">"+esc(info.name)+"<\/a>":esc(info.name||("seat "+seat));
-      slot.innerHTML="<div class=\"rack-name\">"+nm+" &middot; "+(st.scores[seat]||0)+"<\/div><div class=\"rack-tiles\">"+rack.map(tileHTML).join("")+"<\/div>";
-    });
-  }
-  function renderLog(){
-    let h="";
-    for(let s=1;s<=step;s++){const st=REPLAY.steps[s], m=st.move;if(!m){continue;}
-      const who=((REPLAY.seats.find(function(x){return x.seat===m.seat;})||{}).name)||("seat "+m.seat);
-      let desc;
-      if(m.action==="play"){desc="played "+((m.words&&m.words.length)?m.words.join(", "):"")+" for "+m.score;}
-      else if(m.action==="exchange"){desc="exchanged "+((m.exchanged&&m.exchanged.length)||0)+" tiles";}
-      else if(m.action==="pass"){desc="passed";}
-      else{desc=m.action;}
-      const drew=(st.drawn&&st.drawn.length)?" &middot; drew "+st.drawn.map(function(t){return t.l;}).join(""):"";
-      h+="<li class=\""+(s===step?"cur":"")+"\">"+esc(who)+" "+esc(desc)+drew+" &middot; bag "+st.bagLen+"<\/li>";}
-    logEl.innerHTML=h||"<li class=\"note\">opening position<\/li>";
-  }
-  function render(){renderBoard();renderRacks();renderLog();posEl.textContent=step+" / "+(REPLAY.steps.length-1);prevBtn.disabled=step<=0;nextBtn.disabled=step>=REPLAY.steps.length-1;}
-  prevBtn.onclick=function(){if(step>0){step--;render();}};
-  nextBtn.onclick=function(){if(step<REPLAY.steps.length-1){step++;render();}};
-  document.addEventListener("keydown",function(e){if(e.key==="ArrowLeft"){prevBtn.click();}else if(e.key==="ArrowRight"){nextBtn.click();}});
-  render();
-})();
-</script>
-</section>
-{{end}}
 {{end}}
 {{- end}}
@@ -5,26 +5,6 @@
 list is in-memory and resets on a backend restart. An account sustaining
 {{.FlagThreshold}}+ rejected calls within {{.FlagWindow}} is soft-flagged for review
 below — never banned automatically; clear the flag on the user card.</p>
-<section class="panel"><h2>Active IP bans</h2>
-<p class="note">Temporary IP bans the gateway is currently enforcing (in-memory, prod-only;
-reset on a gateway restart). Unban applies on the gateway's next sync.</p>
-<table class="list">
-<thead><tr><th>IP</th><th>Reason</th><th>Since</th><th>Expires</th><th></th></tr></thead>
-<tbody>
-{{range .Bans}}
-<tr>
-<td><code>{{.IP}}</code></td>
-<td>{{.Reason}}</td>
-<td>{{.Since}}</td>
-<td>{{.Expires}}</td>
-<td><form class="form" method="post" action="/_gm/bans/unban"><input type="hidden" name="ip" value="{{.IP}}"><button type="submit">Unban</button></form></td>
-</tr>
-{{else}}
-<tr><td colspan="5"><span class="note">no active bans</span></td></tr>
-{{end}}
-</tbody>
-</table>
-</section>
 <section class="panel"><h2>Recent episodes</h2>
 <table class="list">
 <thead><tr><th>Class</th><th>Key</th><th class="num">Rejected</th><th>First seen</th><th>Last seen</th></tr></thead>
@@ -32,8 +32,6 @@
 <li><b>Wins</b> {{.Stats.Wins}}</li>
 <li><b>Losses</b> {{.Stats.Losses}}</li>
 <li><b>Draws</b> {{.Stats.Draws}}</li>
-<li><b>Moves</b> {{.Stats.Moves}}</li>
-<li><b>Hints used</b> {{.Stats.HintsUsed}}</li>
 <li><b>Best game</b> {{.Stats.MaxGamePoints}}</li>
 <li><b>Best move</b> {{.Stats.MaxWordPoints}}</li>
 </ul>
@@ -101,75 +99,18 @@
 {{else}}<tr><td colspan="4"><span class="note">no identities (guest)</span></td></tr>{{end}}
 </tbody>
 </table>
-{{if .HasEmail}}
-<form class="form" method="post" action="/_gm/users/{{.ID}}/remove-email" onsubmit="return confirm('Erase the email identity from this account? The address will be freed.')">
-<button type="submit">Erase email</button>
-</form>
-{{end}}
-</section>
-<section class="panel"><h2>Deletion &amp; retention</h2>
-{{if .LastLoginAt}}<p class="note">Last login: {{.LastLoginAt}}{{if .LastLoginIP}} — <code>{{.LastLoginIP}}</code>{{end}}</p>{{end}}
-{{if .Deleted}}<p><span class="warn">Deleted</span> at {{.DeletedAt}}{{if .DeletedName}} — was <code>{{.DeletedName}}</code>{{end}}</p>{{end}}
-{{if .Retained}}
-<h3>Retention journal (legal dossier of detached credentials)</h3>
-<table class="list">
-<thead><tr><th>Kind</th><th>Credential</th><th>Reason</th><th>Detached</th></tr></thead>
-<tbody>
-{{range .Retained}}<tr><td>{{.Kind}}</td><td><code>{{.ExternalID}}</code></td><td>{{.Reason}}</td><td>{{.DetachedAt}}</td></tr>{{end}}
-</tbody>
-</table>
-{{end}}
-{{if not .Deleted}}
-<form class="form" method="post" action="/_gm/users/{{.ID}}/delete" onsubmit="return confirm('Delete this account? Its credentials are journalled and freed, its data anonymised, and its sessions revoked. This cannot be undone.')">
-<button type="submit">Delete user</button>
-</form>
-{{end}}
-</section>
-<section class="panel"><h2>Friends</h2>
-<table class="list">
-<thead><tr><th>Account</th><th>Friends since</th></tr></thead>
-<tbody>
-{{range .Friends}}
-<tr><td><a href="/_gm/users/{{.AccountID}}">{{.DisplayName}}</a></td><td>{{.Date}}</td></tr>
-{{else}}<tr><td colspan="2"><span class="note">no friends</span></td></tr>{{end}}
-</tbody>
-</table>
-</section>
-<section class="panel"><h2>Blocks</h2>
-<table class="list">
-<thead><tr><th>Account</th><th>Blocked at</th></tr></thead>
-<tbody>
-{{range .Blocks}}
-<tr><td><a href="/_gm/users/{{.AccountID}}">{{.DisplayName}}</a></td><td>{{.Date}}</td></tr>
-{{else}}<tr><td colspan="2"><span class="note">blocks no one</span></td></tr>{{end}}
-</tbody>
-</table>
-</section>
-<section class="panel"><h2>Blocked by</h2>
-<table class="list">
-<thead><tr><th>Account</th><th>Blocked at</th></tr></thead>
-<tbody>
-{{range .BlockedBy}}
-<tr><td><a href="/_gm/users/{{.AccountID}}">{{.DisplayName}}</a></td><td>{{.Date}}</td></tr>
-{{else}}<tr><td colspan="2"><span class="note">blocked by no one</span></td></tr>{{end}}
-</tbody>
-</table>
 </section>
 {{if .TelegramID}}
 <section class="panel"><h2>Send Telegram message</h2>
 {{if .ConnectorEnabled}}
 <form class="form col" method="post" action="/_gm/users/{{.ID}}/message">
 <label>Message <textarea name="text" required></textarea></label>
+<label>Bot language <select name="language"><option value="en">en</option><option value="ru">ru</option></select></label>
 <div><button type="submit">Send to user</button></div>
 </form>
 {{else}}<p class="note">connector not configured (set BACKEND_CONNECTOR_ADDR)</p>{{end}}
 </section>
 {{end}}
-{{if .VKID}}
-<section class="panel"><h2>VK</h2>
-<p>VK ID: <code>{{.VKID}}</code> · <a href="https://vk.com/id{{.VKID}}" target="_blank" rel="noopener">open profile</a></p>
-</section>
-{{end}}
 <section class="panel"><h2>Games</h2>
 <table class="list">
 <thead><tr><th>Game</th><th>Variant</th><th>Status</th><th class="num">Players</th><th>Updated</th></tr></thead>
@@ -2,15 +2,13 @@
 <h1>Users</h1>
 {{with .Data}}
 <nav class="subnav">
-<a href="/_gm/users"{{if and (not .Robots) (not .Deleted)}} class="active"{{end}}>People</a> ·
-<a href="/_gm/users?kind=deleted"{{if .Deleted}} class="active"{{end}}>Deleted</a> ·
+<a href="/_gm/users"{{if not .Robots}} class="active"{{end}}>People</a> ·
 <a href="/_gm/users?kind=robots"{{if .Robots}} class="active"{{end}}>Robots</a>
 </nav>
 <form class="form" method="get" action="/_gm/users">
-{{if .Robots}}<input type="hidden" name="kind" value="robots">{{end}}{{if .Deleted}}<input type="hidden" name="kind" value="deleted">{{end}}
+{{if .Robots}}<input type="hidden" name="kind" value="robots">{{end}}
 <input name="name" value="{{.NameMask}}" placeholder="display name mask (* ?)">
 <input name="ext" value="{{.ExternalIDMask}}" placeholder="external id mask (* ?)">
-<input name="email" value="{{.EmailExact}}" placeholder="email (exact)" type="search">
 <button type="submit">Filter</button>
 </form>
 <table class="list">
@@ -19,7 +17,7 @@
 {{range .Items}}
 <tr>
 <td><a href="/_gm/users/{{.ID}}">{{.ID}}</a></td>
-<td>{{.DisplayName}}{{if .Deleted}} <span class="pill">deleted</span>{{end}}{{if .Guest}} <span class="pill">guest</span>{{end}}{{if .FlaggedHighRate}} <span class="pill">high-rate</span>{{end}}</td>
+<td>{{.DisplayName}}{{if .Guest}} <span class="pill">guest</span>{{end}}{{if .FlaggedHighRate}} <span class="pill">high-rate</span>{{end}}</td>
 <td>{{.Kind}}</td>
 <td>{{.Language}}</td>
 <td>{{.CreatedAt}}</td>
@@ -60,10 +60,8 @@ type UsersView struct {
 	// be emitted verbatim — interpolated as a plain string it would have its "=" and "&"
 	// percent-encoded again by the contextual escaper.
 	Robots         bool
-	Deleted        bool
 	NameMask       string
 	ExternalIDMask string
-	EmailExact     string
 	FilterQuery    template.URL
 }

@@ -76,7 +74,6 @@ type UserRow struct {
 	Kind            string
 	Language        string
 	Guest           bool
-	Deleted         bool
 	FlaggedHighRate bool
 	CreatedAt       string
 	HasMoveStats    bool
@@ -153,15 +150,6 @@ type UserDetailView struct {
 	// MergedInto is the primary account id when this account has been retired by a
 	// merge, or empty for a live account.
 	MergedInto string
-	// The account-deletion dossier. Deleted marks a tombstoned account; DeletedAt and
-	// DeletedName are its deletion time and retained real name; LastLoginAt/IP are the
-	// last cold-load stamp (shown for any account); Retained is the credential journal.
-	Deleted     bool
-	DeletedAt   string
-	DeletedName string
-	LastLoginAt string
-	LastLoginIP string
-	Retained    []RetainedRow
 	// FlaggedHighRateAt is the pre-formatted soft high-rate marker timestamp,
 	// empty for an unflagged account; the card shows it with the Clear action.
 	FlaggedHighRateAt string
@@ -173,14 +161,8 @@ type UserDetailView struct {
 	HasStats         bool
 	Stats            StatsRow
 	Identities       []IdentityRow
-	// HasEmail gates the "Erase email" action; set when the account carries an email identity.
-	HasEmail bool
 	Games            []GameRow
-	// TelegramID and VKID are the account's platform external ids (empty when absent).
-	// TelegramID gates the "Send Telegram message" operator action; VKID surfaces the VK
-	// user id with a link to the VK profile (there is no VK messaging to drive).
 	TelegramID       string
-	VKID             string
 	ConnectorEnabled bool
 	// MoveChart is the pre-rendered inline SVG of the account's per-move-number think
 	// time (min/mean/max), empty when the account has no timed move.
@@ -193,21 +175,6 @@ type UserDetailView struct {
 	// grant form offers. The first role is the feedback ban (see internal/account).
 	Roles      []string
 	KnownRoles []string
-	// Blocks, BlockedBy and Friends are the social graph on the card: who this account has
-	// blocked, who currently blocks it, and its mutual friendships — each cross-linked to the
-	// other account with the date it happened. They are the full truth; the asymmetric block
-	// suppression that hides relationships from players never applies to the console.
-	Blocks    []RelationRow
-	BlockedBy []RelationRow
-	Friends   []RelationRow
-}
-
-// RelationRow is one cross-linked account in the user card's blocks / blocked-by / friends
-// lists: the other account's id (the link target), its display name, and the pre-formatted date.
-type RelationRow struct {
-	AccountID   string
-	DisplayName string
-	Date        string
 }

 // SuspensionView is an account's current manual-block state shown on the user card: whether it
@@ -236,8 +203,6 @@ type StatsRow struct {
 	Draws         int
 	MaxGamePoints int
 	MaxWordPoints int
-	Moves         int
-	HintsUsed     int
 }

 // IdentityRow is one platform/email identity of an account.
@@ -248,17 +213,6 @@ type IdentityRow struct {
 	CreatedAt  string
 }

-// RetainedRow is one credential in the account-deletion retention journal (the legal
-// dossier of detached credentials): what was detached, when, and why.
-type RetainedRow struct {
-	Kind       string
-	ExternalID string
-	Reason     string
-	Confirmed  bool
-	LinkedAt   string
-	DetachedAt string
-}
-
 // GameRow is one game row in a list.
 type GameRow struct {
 	ID        string
@@ -297,27 +251,6 @@ type GameDetailView struct {
 	// RobotTargetPct is the configured global play-to-win rate, in percent.
 	HasRobot       bool
 	RobotTargetPct int
-	// ReplayJSON is the game-replay payload (board, seats, per-step racks/scores/bag) the
-	// game_detail page feeds to its vanilla-JS stepper; HasReplay gates the replay section.
-	ReplayJSON template.JS
-	HasReplay  bool
-	// SetupDraws is the first-move draw — one row per tile drawn (docs/ARCHITECTURE.md §6) —
-	// and FirstMover is the resolved name of the seat-0 player the draw elected.
-	SetupDraws []SetupDrawRow
-	FirstMover string
-}
-
-// SetupDrawRow is one tile drawn in the first-move seeding (docs/ARCHITECTURE.md §6): the
-// round, the player (Name/AccountID, or "(opponent)" with an empty AccountID for an
-// auto-match synthetic draw not yet back-filled), the drawn letter (upper-cased; "?" for a
-// blank) and its draw rank.
-type SetupDrawRow struct {
-	Round     int
-	Name      string
-	AccountID string
-	Letter    string
-	Blank     bool
-	Rank      int
 }

 // SeatRow is one seat of a game. For a robot seat (IsRobot) RobotIntent is the game's
@@ -418,27 +351,17 @@ type BroadcastView struct {
 	ConnectorEnabled bool
 }

-// ThrottledView is the rate-limit observability page: the temporary IP bans the
-// gateway is currently enforcing, the recent gateway-reported throttle episodes
-// (in-memory, reset on restart) and the accounts currently carrying the high-rate
-// flag. FlagThreshold and FlagWindow caption the active auto-flag tuning.
+// ThrottledView is the rate-limit observability page: the recent gateway-reported
+// throttle episodes (in-memory, reset on restart) and the accounts currently
+// carrying the high-rate flag. FlagThreshold and FlagWindow caption the active
+// auto-flag tuning.
 type ThrottledView struct {
-	Bans          []BanRow
 	Episodes      []ThrottleEpisodeRow
 	Flagged       []FlaggedAccountRow
 	FlagThreshold int
 	FlagWindow    string
 }

-// BanRow is one temporary IP ban the gateway is enforcing, with its reason and its
-// since/expiry timestamps; the row carries an unban action.
-type BanRow struct {
-	IP      string
-	Reason  string
-	Since   string
-	Expires string
-}
-
 // ThrottleEpisodeRow is one recently throttled limiter key. UserID links to the
 // user card and is set only for the user class (the other classes key by IP).
 type ThrottleEpisodeRow struct {
@@ -570,8 +493,11 @@ type FeedbackDetailView struct {
 	SenderName string
 	Source     string
 	Channel    string
-	// InterfaceLanguage is the sender's interface language (account preference).
+	// InterfaceLanguage is the sender's interface language (account preference);
+	// BotLanguage is the connector bot they last used (en/ru), set only for a
+	// message that arrived through an external connector (Telegram).
 	InterfaceLanguage string
+	BotLanguage       string
 	IP                string
 	Body              string
 	HasAttachment     bool
@@ -583,17 +509,5 @@ type FeedbackDetailView struct {
 	ReplyBody         string
 	RepliedAt         string
 	CreatedAt         string
-	// Version is the client app build the report was sent from (empty for rows that predate it).
-	Version string
-	// The Filed time is shown in three zones so the operator can tell what is certainly known from
-	// what is merely defaulted. CreatedAt is the authoritative UTC time. CreatedAtBrowser is that
-	// instant in the client's UTC offset detected at submit (BrowserTZ its "±HH:MM" label), empty
-	// when the client reported none (an older build). CreatedAtUser is that instant in the sender's
-	// saved profile zone (UserTZ its label), empty when the account has no zone beyond the UTC
-	// default — the template then shows "N/A" so the missing datum is explicit.
-	CreatedAtBrowser string
-	BrowserTZ        string
-	CreatedAtUser    string
-	UserTZ           string
 	Banned            bool
 }
@@ -1,92 +0,0 @@
-// Package banview mirrors the gateway's active IP bans for the admin console and
-// collects operator unban requests for the gateway to apply. Like ratewatch it is
-// in-memory, single-instance and resets on a backend restart by design — the
-// gateway re-reports its active set on the next sync, and the durable effect (the
-// ban itself) lives in the gateway, not here.
-package banview
-
-import (
-	"sort"
-	"sync"
-	"time"
-)
-
-// Ban is one active IP ban as reported by the gateway.
-type Ban struct {
-	IP      string
-	Reason  string
-	Since   time.Time
-	Expires time.Time
-}
-
-// View holds the last-reported active bans and the operator's pending unbans.
-type View struct {
-	now func() time.Time
-
-	mu    sync.Mutex
-	bans  map[string]Ban      // last reported active set, keyed by IP
-	unban map[string]struct{} // IPs an operator marked for unban
-}
-
-// New constructs an empty View.
-func New() *View {
-	return &View{now: time.Now, bans: make(map[string]Ban), unban: make(map[string]struct{})}
-}
-
-// Ingest replaces the mirrored active set with the gateway's latest report,
-// skipping entries with an empty IP or one that has already expired.
-func (v *View) Ingest(active []Ban) {
-	now := v.now()
-	v.mu.Lock()
-	defer v.mu.Unlock()
-	v.bans = make(map[string]Ban, len(active))
-	for _, b := range active {
-		if b.IP == "" || !now.Before(b.Expires) {
-			continue
-		}
-		v.bans[b.IP] = b
-	}
-}
-
-// Recent returns the mirrored active bans, most recently banned first.
-func (v *View) Recent() []Ban {
-	now := v.now()
-	v.mu.Lock()
-	defer v.mu.Unlock()
-	out := make([]Ban, 0, len(v.bans))
-	for _, b := range v.bans {
-		if now.Before(b.Expires) {
-			out = append(out, b)
-		}
-	}
-	sort.Slice(out, func(i, j int) bool { return out[i].Since.After(out[j].Since) })
-	return out
-}
-
-// RequestUnban records an operator request to lift the ban on ip; the gateway
-// applies it on its next sync (so the console reflects it within the sync
-// interval). An empty ip is ignored.
-func (v *View) RequestUnban(ip string) {
-	if ip == "" {
-		return
-	}
-	v.mu.Lock()
-	defer v.mu.Unlock()
-	v.unban[ip] = struct{}{}
-}
-
-// DrainUnbans returns and clears the IPs operators have marked for unban since the
-// previous drain. It returns nil when there are none.
-func (v *View) DrainUnbans() []string {
-	v.mu.Lock()
-	defer v.mu.Unlock()
-	if len(v.unban) == 0 {
-		return nil
-	}
-	out := make([]string, 0, len(v.unban))
-	for ip := range v.unban {
-		out = append(out, ip)
-	}
-	clear(v.unban)
-	return out
-}
@@ -1,64 +0,0 @@
-package banview
-
-import (
-	"testing"
-	"time"
-)
-
-func viewAt(clk *time.Time) *View {
-	v := New()
-	v.now = func() time.Time { return *clk }
-	return v
-}
-
-func TestIngestRecentDropsExpired(t *testing.T) {
-	clk := time.Date(2026, 6, 21, 12, 0, 0, 0, time.UTC)
-	v := viewAt(&clk)
-	v.Ingest([]Ban{
-		{IP: "1.1.1.1", Reason: "tripwire", Since: clk, Expires: clk.Add(time.Hour)},
-		{IP: "2.2.2.2", Reason: "rejections", Since: clk.Add(-2 * time.Hour), Expires: clk.Add(-time.Hour)}, // expired
-		{IP: "", Reason: "x", Since: clk, Expires: clk.Add(time.Hour)},                                      // empty IP
-	})
-	got := v.Recent()
-	if len(got) != 1 || got[0].IP != "1.1.1.1" || got[0].Reason != "tripwire" {
-		t.Fatalf("Recent = %+v, want one live ban for 1.1.1.1", got)
-	}
-}
-
-func TestIngestReplaces(t *testing.T) {
-	clk := time.Date(2026, 6, 21, 12, 0, 0, 0, time.UTC)
-	v := viewAt(&clk)
-	v.Ingest([]Ban{{IP: "1.1.1.1", Since: clk, Expires: clk.Add(time.Hour)}})
-	v.Ingest([]Ban{{IP: "2.2.2.2", Since: clk, Expires: clk.Add(time.Hour)}})
-	got := v.Recent()
-	if len(got) != 1 || got[0].IP != "2.2.2.2" {
-		t.Fatalf("Recent = %+v, want only the latest report (2.2.2.2)", got)
-	}
-}
-
-func TestRecentOrdersBySince(t *testing.T) {
-	clk := time.Date(2026, 6, 21, 12, 0, 0, 0, time.UTC)
-	v := viewAt(&clk)
-	v.Ingest([]Ban{
-		{IP: "old", Since: clk.Add(-10 * time.Minute), Expires: clk.Add(time.Hour)},
-		{IP: "new", Since: clk.Add(-1 * time.Minute), Expires: clk.Add(time.Hour)},
-	})
-	got := v.Recent()
-	if len(got) != 2 || got[0].IP != "new" || got[1].IP != "old" {
-		t.Fatalf("Recent order = %+v, want most recent first", got)
-	}
-}
-
-func TestUnbanRoundTrip(t *testing.T) {
-	clk := time.Date(2026, 6, 21, 12, 0, 0, 0, time.UTC)
-	v := viewAt(&clk)
-	v.RequestUnban("3.3.3.3")
-	v.RequestUnban("") // ignored
-	drained := v.DrainUnbans()
-	if len(drained) != 1 || drained[0] != "3.3.3.3" {
-		t.Fatalf("DrainUnbans = %v, want [3.3.3.3]", drained)
-	}
-	if again := v.DrainUnbans(); again != nil {
-		t.Fatalf("second DrainUnbans = %v, want nil (cleared)", again)
-	}
-}
@@ -4,7 +4,6 @@ package config

 import (
 	"fmt"
-	"net/url"
 	"os"
 	"strconv"
 	"time"
@@ -43,12 +42,6 @@ type Config struct {
 	// SMTP configures the email relay used for confirm-codes. An empty Host
 	// selects the development log mailer (the code is logged, not sent).
 	SMTP account.SMTPConfig
-	// PublicBaseURL is the canonical public origin (scheme + host, e.g.
-	// https://erudit-game.ru) used to build absolute links in outgoing email — the
-	// confirm deeplink and the footer landing link. It is deliberately not derived
-	// from a request Host header, which would let an attacker inject a phishing link
-	// into the email. Required whenever an SMTP relay is configured.
-	PublicBaseURL string
 	// ConnectorAddr is the gRPC address of the Telegram platform connector
 	// side-service, used by the admin console to send operator broadcasts. Empty
 	// disables broadcasts (the admin broadcast actions report "not configured").
@@ -58,12 +51,6 @@ type Config struct {
 	// GuestRetention is the account age past which an unused guest (no game seat)
 	// is eligible for deletion by the reaper.
 	GuestRetention time.Duration
-	// ExportSignKey signs the finished-game export download URLs. Empty leaves
-	// the export-URL endpoints disabled (503 on mint, 404 on download).
-	ExportSignKey string
-	// RendererURL is the base URL of the internal image-render sidecar (e.g.
-	// http://renderer:8090). Empty disables the PNG export artifact.
-	RendererURL string
 }

 // Defaults applied when the corresponding environment variable is unset.
@@ -148,9 +135,6 @@ func Load() (Config, error) {
 		Username: os.Getenv("BACKEND_SMTP_USERNAME"),
 		Password: os.Getenv("BACKEND_SMTP_PASSWORD"),
 		From:     envOr("BACKEND_SMTP_FROM", "no-reply@localhost"),
-		TLS:       os.Getenv("BACKEND_SMTP_TLS"),
-		AdminFrom: os.Getenv("BACKEND_SMTP_ADMIN_FROM"),
-		AdminTo:   os.Getenv("BACKEND_ADMIN_EMAIL"),
 	}

 	c := Config{
@@ -164,12 +148,9 @@ func Load() (Config, error) {
 		Robot:             rb,
 		RateWatch:         rw,
 		SMTP:              smtp,
-		PublicBaseURL:     os.Getenv("BACKEND_PUBLIC_BASE_URL"),
 		ConnectorAddr:     os.Getenv("BACKEND_CONNECTOR_ADDR"),
 		GuestReapInterval: guestReapInterval,
 		GuestRetention:    guestRetention,
-		ExportSignKey:     os.Getenv("BACKEND_EXPORT_SIGN_KEY"),
-		RendererURL:       os.Getenv("BACKEND_RENDERER_URL"),
 	}
 	if err := c.validate(); err != nil {
 		return Config{}, err
@@ -214,14 +195,6 @@ func (c Config) validate() error {
 	if c.GuestRetention <= 0 {
 		return fmt.Errorf("config: BACKEND_GUEST_RETENTION must be positive")
 	}
-	if c.SMTP.Host != "" {
-		if c.PublicBaseURL == "" {
-			return fmt.Errorf("config: BACKEND_PUBLIC_BASE_URL must be set when BACKEND_SMTP_HOST is configured")
-		}
-		if u, err := url.Parse(c.PublicBaseURL); err != nil || u.Scheme == "" || u.Host == "" {
-			return fmt.Errorf("config: BACKEND_PUBLIC_BASE_URL %q must be an absolute URL (scheme://host)", c.PublicBaseURL)
-		}
-	}
 	return nil
 }

@@ -1,10 +1,11 @@
-// Package connector is the backend's gRPC client for operator broadcasts: a direct
-// message to one user, or a post to the game channel. It calls the gateway's
-// bot-link relay (which forwards the send to the remote bot over the reverse mTLS
-// link and reports back whether it was delivered). The relay lives on the trusted
-// internal network, so the connection uses insecure (plaintext) transport
-// credentials (docs/ARCHITECTURE.md §12). It speaks the Telegram service contract,
-// narrowed to the two broadcast methods the admin surface needs.
+// Package connector is the backend's gRPC client for the Telegram platform
+// connector side-service. The admin console uses it to send operator broadcasts:
+// a direct message to one user, or a post to a game channel. Each broadcast
+// selects the delivering bot by language (an operator choice, since the connector
+// hosts one bot per service language). The connector lives on the trusted internal
+// network, so the connection uses insecure (plaintext) transport credentials
+// (docs/ARCHITECTURE.md §12). It mirrors gateway/internal/connector, narrowed to
+// the two broadcast methods the admin surface needs.
 package connector

 import (
@@ -36,21 +37,22 @@ func New(addr string) (*Client, error) {
 func (c *Client) Close() error { return c.conn.Close() }

 // SendToUser sends an operator text message to one user, addressed by their
-// platform external_id, through the bot. delivered reports whether the connector
-// actually sent it (false when the user has not started the bot).
-func (c *Client) SendToUser(ctx context.Context, externalID, text string) (bool, error) {
-	resp, err := c.c.SendToUser(ctx, &telegramv1.SendToUserRequest{ExternalId: externalID, Text: text})
+// platform external_id, through the bot for the given language. delivered reports
+// whether the connector actually sent it (false when the user has not started that
+// bot).
+func (c *Client) SendToUser(ctx context.Context, externalID, text, language string) (bool, error) {
+	resp, err := c.c.SendToUser(ctx, &telegramv1.SendToUserRequest{ExternalId: externalID, Text: text, Language: language})
 	if err != nil {
 		return false, err
 	}
 	return resp.GetDelivered(), nil
 }

-// SendToGameChannel posts an operator text message to the bot's game channel.
-// delivered reports whether the connector sent it (false when the bot has no
-// channel configured).
-func (c *Client) SendToGameChannel(ctx context.Context, text string) (bool, error) {
-	resp, err := c.c.SendToGameChannel(ctx, &telegramv1.SendToGameChannelRequest{Text: text})
+// SendToGameChannel posts an operator text message to the game channel of the bot
+// for the given language. delivered reports whether the connector sent it (false
+// when that bot has no channel configured).
+func (c *Client) SendToGameChannel(ctx context.Context, text, language string) (bool, error) {
+	resp, err := c.c.SendToGameChannel(ctx, &telegramv1.SendToGameChannelRequest{Text: text, Language: language})
 	if err != nil {
 		return false, err
 	}
@@ -21,7 +21,7 @@ const (
 	// ActionResign abandons the game.
 	ActionResign
 	// ActionTimeout is the auto-resignation a missed turn becomes; recorded by
-	// the game domain, never produced by the engine itself.
+	// the game domain in a later stage, never produced by the engine itself.
 	ActionTimeout
 )

@@ -10,7 +10,7 @@
 // characters (see decode.go and docs/ARCHITECTURE.md §9.1), so archived games
 // replay independently of any dictionary. Second, the engine owns rules and
 // scoring only: turn scheduling, the 24-hour timeout, persistence and transport
-// belong to the game domain.
+// belong to the game domain in a later stage.
 package engine

 import (
@@ -21,19 +21,17 @@ var dictFiles = map[Variant]string{
 	VariantErudit:          "ru_erudit.dawg",
 }

-// entry is one resident dictionary: the loaded finder, the solver built over it
-// and the file it was loaded from. The finder is retained so Close can release
-// it; path is retained so the raw bytes can be re-read for the client download.
+// entry is one resident dictionary: the loaded finder and the solver built over
+// it. The finder is retained so Close can release it.
 type entry struct {
 	finder dawg.Finder
 	solver *scrabble.Solver
-	path   string
 }

 // Registry holds the dictionaries resident in memory, addressed by variant and
 // dictionary version, and the solvers built over them. Several versions of a
 // variant may be resident at once; a game pins the version it started on. The
-// admin reload flow registers a new version through Load.
+// admin reload flow (a later stage) registers a new version through Load.
 // Registry is safe for concurrent use.
 type Registry struct {
 	mu      sync.RWMutex
@@ -72,21 +70,11 @@ func Open(dir, version string, variants ...Variant) (*Registry, error) {
 // immediate subdirectory of dir: a subdirectory named V contributes, under
 // version V, the variants whose committed DAWG it carries. This is the
 // restart-side of the admin dictionary reload — a version reloaded into dir/<V>/
-// at runtime is resident again after a restart. The flat dir's version is resolved
-// from its .seed_version marker (see resolveSeedVersion): a fresh dir records
-// bootVersion, an already-seeded dir keeps its recorded label and ignores bootVersion,
-// so a bumped build seed never relabels live bytes. A subdirectory named like the
-// resolved seed version is skipped (the flat dir already is it). A partially loaded
-// registry is closed before any error is returned.
+// at runtime is resident again after a restart. A subdirectory named like the
+// boot version is skipped (the flat dir already is the boot version). A partially
+// loaded registry is closed before any error is returned.
 func OpenWithVersions(dir, bootVersion string) (*Registry, error) {
-	// Resolve the flat dir's version from its seed marker first: on an already-seeded
-	// volume the marker wins and bootVersion is ignored, so a bumped build seed cannot
-	// relabel live bytes (see resolveSeedVersion).
-	seed, err := resolveSeedVersion(dir, bootVersion)
-	if err != nil {
-		return nil, err
-	}
-	r, err := Open(dir, seed)
+	r, err := Open(dir, bootVersion)
 	if err != nil {
 		return nil, err
 	}
@@ -96,9 +84,9 @@ func OpenWithVersions(dir, bootVersion string) (*Registry, error) {
 		return nil, fmt.Errorf("engine: scan dictionary dir %s: %w", dir, err)
 	}
 	for _, e := range entries {
-		// Skip non-directories, the resolved seed version (already loaded as the flat
-		// dir) and dot-prefixed directories (the upload staging area, dir/.staging/).
-		if !e.IsDir() || e.Name() == seed || strings.HasPrefix(e.Name(), ".") {
+		// Skip non-directories, the boot version (already loaded as the flat dir)
+		// and dot-prefixed directories (the upload staging area, dir/.staging/).
+		if !e.IsDir() || e.Name() == bootVersion || strings.HasPrefix(e.Name(), ".") {
 			continue
 		}
 		if _, err := r.LoadAvailable(filepath.Join(dir, e.Name()), e.Name()); err != nil {
@@ -132,7 +120,7 @@ func (r *Registry) Load(v Variant, version, dir string) error {
 	if old, ok := r.entries[v][version]; ok {
 		_ = old.finder.Close()
 	}
-	r.entries[v][version] = entry{finder: finder, solver: scrabble.NewSolver(rs, finder), path: path}
+	r.entries[v][version] = entry{finder: finder, solver: scrabble.NewSolver(rs, finder)}
 	r.latest[v] = version
 	return nil
 }
@@ -204,30 +192,6 @@ func (r *Registry) Versions(v Variant) []string {
 	return versions
 }

-// DictBytes returns the raw serialized DAWG for the (variant, version) pair,
-// re-read from the file it was loaded from — the same immutable bytes the solver
-// holds. It backs the client-side dictionary download for the local move
-// preview. It returns ErrUnknownVariant or ErrUnknownVersion when that dictionary
-// is not resident, and wraps any read error. The file is read outside the lock.
-func (r *Registry) DictBytes(v Variant, version string) ([]byte, error) {
-	r.mu.RLock()
-	versions, ok := r.entries[v]
-	if !ok {
-		r.mu.RUnlock()
-		return nil, fmt.Errorf("%w: %s", ErrUnknownVariant, v)
-	}
-	e, ok := versions[version]
-	r.mu.RUnlock()
-	if !ok {
-		return nil, fmt.Errorf("%w: %s/%s", ErrUnknownVersion, v, version)
-	}
-	data, err := os.ReadFile(e.path)
-	if err != nil {
-		return nil, fmt.Errorf("engine: read %s/%s dictionary bytes from %s: %w", v, version, e.path, err)
-	}
-	return data, nil
-}
-
 // Lookup reports whether word is present in the (variant, version) dictionary,
 // backing the unlimited word-check tool. It returns ErrUnknownVariant or
 // ErrUnknownVersion when that dictionary is not resident, and an error when word
@@ -5,7 +5,6 @@ import (
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 )

@@ -113,103 +112,6 @@ func TestOpenWithVersionsSkipsDotDirs(t *testing.T) {
 	}
 }

-// TestOpenWithVersionsRecordsSeedMarker verifies the first boot records the seed
-// version in the flat dir's marker, the marker is not mistaken for a version, and a
-// reboot at the same seed version succeeds.
-func TestOpenWithVersionsRecordsSeedMarker(t *testing.T) {
-	dir := t.TempDir()
-	for _, v := range Variants() {
-		copyDawg(t, testDictDir(), dir, v)
-	}
-
-	reg, err := OpenWithVersions(dir, "v1")
-	if err != nil {
-		t.Fatalf("first open: %v", err)
-	}
-	if got := reg.Versions(VariantEnglish); len(got) != 1 || got[0] != "v1" {
-		t.Errorf("versions = %v, want only [v1] (marker not a version)", got)
-	}
-	_ = reg.Close()
-
-	data, err := os.ReadFile(filepath.Join(dir, seedMarkerFile))
-	if err != nil {
-		t.Fatalf("read seed marker: %v", err)
-	}
-	if got := strings.TrimSpace(string(data)); got != "v1" {
-		t.Fatalf("seed marker = %q, want v1", got)
-	}
-
-	reg2, err := OpenWithVersions(dir, "v1")
-	if err != nil {
-		t.Fatalf("reboot at same seed: %v", err)
-	}
-	_ = reg2.Close()
-}
-
-// TestOpenWithVersionsMarkerWinsOverBoot verifies the recorded .seed_version marker
-// is authoritative: once a directory is seeded, a different bootVersion
-// (BACKEND_DICT_VERSION) is ignored — the flat dir keeps its recorded label — so a
-// bumped build seed on a live volume cannot relabel the already-seeded bytes.
-func TestOpenWithVersionsMarkerWinsOverBoot(t *testing.T) {
-	dir := t.TempDir()
-	for _, v := range Variants() {
-		copyDawg(t, testDictDir(), dir, v)
-	}
-
-	reg, err := OpenWithVersions(dir, "v1") // seeds the marker = v1
-	if err != nil {
-		t.Fatalf("seed open: %v", err)
-	}
-	_ = reg.Close()
-
-	// Reboot with a bumped boot version: the marker (v1) wins, no error, v2 ignored.
-	reg2, err := OpenWithVersions(dir, "v2")
-	if err != nil {
-		t.Fatalf("reboot with bumped boot version: %v", err)
-	}
-	defer func() { _ = reg2.Close() }()
-	if got := reg2.Versions(VariantEnglish); len(got) != 1 || got[0] != "v1" {
-		t.Errorf("versions = %v, want [v1] (marker wins, v2 ignored)", got)
-	}
-	if _, err := reg2.Solver(VariantEnglish, "v2"); !errors.Is(err, ErrUnknownVersion) {
-		t.Errorf("v2 must not be resident: got %v", err)
-	}
-	data, _ := os.ReadFile(filepath.Join(dir, seedMarkerFile))
-	if got := strings.TrimSpace(string(data)); got != "v1" {
-		t.Errorf("marker = %q, want v1 (unchanged)", got)
-	}
-}
-
-// TestOpenWithVersionsBumpedBootKeepsSubdir mirrors the live-contour case: a volume
-// seeded as v1 with a v2 subdirectory (uploaded via the console), booted with a bumped
-// build seed bootVersion=v2. The marker (v1) wins for the flat dir, and the v2
-// subdirectory is still loaded — not skipped as "the boot version" — so both versions
-// stay resident. (Skipping it would silently leave only the flat v1 bytes under v2.)
-func TestOpenWithVersionsBumpedBootKeepsSubdir(t *testing.T) {
-	dir := t.TempDir()
-	for _, v := range Variants() {
-		copyDawg(t, testDictDir(), dir, v)
-	}
-	reg0, err := OpenWithVersions(dir, "v1") // seed marker = v1
-	if err != nil {
-		t.Fatalf("seed: %v", err)
-	}
-	_ = reg0.Close()
-	copyDawg(t, testDictDir(), filepath.Join(dir, "v2"), VariantEnglish) // console upload
-
-	reg, err := OpenWithVersions(dir, "v2") // bumped build seed
-	if err != nil {
-		t.Fatalf("boot v2: %v", err)
-	}
-	defer func() { _ = reg.Close() }()
-	if _, err := reg.Solver(VariantEnglish, "v1"); err != nil {
-		t.Errorf("flat v1 must stay resident: %v", err)
-	}
-	if _, err := reg.Solver(VariantEnglish, "v2"); err != nil {
-		t.Errorf("v2 subdir must be resident (not skipped): %v", err)
-	}
-}
-
 // TestReloadRegistersNewVersion verifies Load adds a second version to a variant
 // already resident, moves the latest pointer and keeps the earlier version.
 func TestReloadRegistersNewVersion(t *testing.T) {
@@ -1,53 +0,0 @@
-package engine
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// seedMarkerFile names the file, in the flat dictionary directory, that records the
-// version the directory was first seeded as. It is dot-prefixed so OpenWithVersions'
-// version scan skips it (like the .staging upload area).
-const seedMarkerFile = ".seed_version"
-
-// resolveSeedVersion returns the version label the flat dictionary directory is
-// addressed by, recording it on first use.
-//
-// The contour's dictionary lives on a named volume seeded from the image once and
-// never re-seeded (deploy/docker-compose.yml). The flat DAWGs carry no embedded
-// version, so the version a volume was first seeded as is recorded in a
-// .seed_version marker and is **authoritative** from then on:
-//
-//   - fresh directory (no marker): record bootVersion (the build's
-//     BACKEND_DICT_VERSION) and return it — the seed of a fresh volume;
-//   - already-seeded directory: return the recorded marker and ignore bootVersion.
-//
-// So bumping the build seed on a live volume is a harmless no-op (it only takes
-// effect on a future fresh volume) instead of relabelling the already-seeded bytes —
-// which would void games pinned to the prior label and mis-serve new ones. New games
-// still pin the active version (DB-persisted, set by the admin console), which is the
-// real way a running contour moves to a new release.
-//
-// A directory that cannot be written makes the first record fail; that also breaks
-// the admin console (which writes version subdirectories here), so the error is
-// returned rather than swallowed, matching the package's fail-loud dictionary setup.
-func resolveSeedVersion(dir, bootVersion string) (string, error) {
-	path := filepath.Join(dir, seedMarkerFile)
-	data, err := os.ReadFile(path)
-	if err != nil && !errors.Is(err, os.ErrNotExist) {
-		return "", fmt.Errorf("engine: read dictionary seed marker %s: %w", path, err)
-	}
-	if err == nil {
-		if recorded := strings.TrimSpace(string(data)); recorded != "" {
-			return recorded, nil
-		}
-		// An empty/corrupt marker falls through and is rewritten from bootVersion.
-	}
-	if werr := os.WriteFile(path, []byte(bootVersion+"\n"), 0o644); werr != nil {
-		return "", fmt.Errorf("engine: record dictionary seed marker %s: %w", path, werr)
-	}
-	return bootVersion, nil
-}
@@ -1,52 +0,0 @@
-package engine
-
-import "fmt"
-
-// SetupTile is one tile of a variant's full bag, decoded for the first-move draw
-// (docs/ARCHITECTURE.md §6): its concrete letter (or the blank marker), a blank
-// flag, and its draw rank. Lower rank wins the draw — a blank ranks above every
-// letter, and letters rank by alphabet index, so the tile closest to the start of
-// the alphabet ("A") wins. It is dictionary-independent, built from the variant's
-// solver ruleset alone.
-type SetupTile struct {
-	// Letter is the concrete character (the case the solver ruleset emits), or
-	// the blank marker "?" for a blank.
-	Letter string
-	// Blank reports whether the tile is a blank.
-	Blank bool
-	// Rank orders the draw: BlankRank for a blank (best), else the letter's
-	// alphabet index (0 = closest to "A").
-	Rank int
-}
-
-// BlankRank is the first-move draw rank of a blank: below every letter index, so a
-// blank always beats a lettered tile, matching the official rule that a blank
-// supersedes all letters.
-const BlankRank = -1
-
-// SetupBag returns variant's full tile bag — every lettered tile expanded by its
-// count, plus one entry per blank — decoded for the first-move seeding draw. The
-// order is deterministic (alphabet order, blanks last); callers shuffle it with
-// their own entropy. It needs no dictionary, so it is built from the variant's
-// ruleset alone and reports ErrUnknownVariant for an unrecognised variant.
-func SetupBag(v Variant) ([]SetupTile, error) {
-	rs, ok := v.ruleset()
-	if !ok {
-		return nil, fmt.Errorf("%w: %d", ErrUnknownVariant, v)
-	}
-	bag := make([]SetupTile, 0, 128)
-	for i, n := range rs.Counts {
-		ch, err := rs.Alphabet.Character(byte(i))
-		if err != nil {
-			// An offered variant's alphabet never yields a bad index; skip defensively.
-			continue
-		}
-		for range n {
-			bag = append(bag, SetupTile{Letter: ch, Rank: i})
-		}
-	}
-	for range rs.Blanks {
-		bag = append(bag, SetupTile{Letter: blankLetter, Blank: true, Rank: BlankRank})
-	}
-	return bag, nil
-}
@@ -1,47 +0,0 @@
-package engine
-
-import (
-	"errors"
-	"testing"
-)
-
-func TestSetupBagEnglish(t *testing.T) {
-	bag, err := SetupBag(VariantEnglish)
-	if err != nil {
-		t.Fatalf("SetupBag: %v", err)
-	}
-	// English Scrabble: 98 lettered tiles + 2 blanks = 100.
-	if len(bag) != 100 {
-		t.Fatalf("bag size = %d, want 100", len(bag))
-	}
-	blanks, aCount := 0, 0
-	for _, tl := range bag {
-		switch {
-		case tl.Blank:
-			blanks++
-			if tl.Rank != BlankRank {
-				t.Errorf("blank rank = %d, want %d", tl.Rank, BlankRank)
-			}
-			if tl.Letter != blankLetter {
-				t.Errorf("blank letter = %q, want %q", tl.Letter, blankLetter)
-			}
-		case tl.Letter == "a":
-			aCount++
-			if tl.Rank != 0 {
-				t.Errorf("'a' rank = %d, want 0 (closest to A)", tl.Rank)
-			}
-		}
-	}
-	if blanks != 2 {
-		t.Errorf("blanks = %d, want 2", blanks)
-	}
-	if aCount != 9 {
-		t.Errorf("'a' count = %d, want 9", aCount)
-	}
-}
-
-func TestSetupBagUnknownVariant(t *testing.T) {
-	if _, err := SetupBag(Variant(99)); !errors.Is(err, ErrUnknownVariant) {
-		t.Fatalf("err = %v, want ErrUnknownVariant", err)
-	}
-}
@@ -72,7 +72,7 @@ func (svc *Service) SetNotifier(p notify.Publisher) {
 // validates the body (non-empty, within the rune limit) and the optional
 // attachment (size and extension allow-list). senderIP is the gateway-forwarded
 // client IP (validated); channel is the submitting platform.
-func (svc *Service) Submit(ctx context.Context, accountID uuid.UUID, body string, attachment []byte, attachmentName, channel, version, browserTZ, senderIP string) error {
+func (svc *Service) Submit(ctx context.Context, accountID uuid.UUID, body string, attachment []byte, attachmentName, channel, senderIP string) error {
 	acc, err := svc.accounts.GetByID(ctx, accountID)
 	if err != nil {
 		return err
@@ -112,10 +112,14 @@ func (svc *Service) Submit(ctx context.Context, accountID uuid.UUID, body string
 		attachmentName = "" // a name without bytes carries no attachment
 	}
 	ch := normalizeChannel(channel)
-	// Snapshot the sender's interface language, the client app version and the client's
-	// detected UTC offset at submit time (acc is already loaded for the guest check) so the
-	// operator later sees the state as it was.
-	_, err = svc.store.Insert(ctx, accountID, body, attachment, attachmentName, ch, acc.PreferredLanguage, version, browserTZ, parseIP(senderIP))
+	// Snapshot the languages at submit time (acc is already loaded for the guest check):
+	// the sender's interface language, and the connector bot language when the message
+	// came through an external connector (currently Telegram).
+	var channelLang string
+	if ch == "telegram" {
+		channelLang = acc.ServiceLanguage
+	}
+	_, err = svc.store.Insert(ctx, accountID, body, attachment, attachmentName, ch, acc.PreferredLanguage, channelLang, parseIP(senderIP))
 	return err
 }

@@ -195,11 +199,6 @@ func (svc *Service) CountUnread(ctx context.Context) (int, error) {
 	return svc.store.CountUnread(ctx)
 }

-// CountSince counts feedback created after since, for the operator alert worker.
-func (svc *Service) CountSince(ctx context.Context, since time.Time) (int, error) {
-	return svc.store.CountSince(ctx, since)
-}
-
 // Attachment returns a message's file name and bytes, reporting false when absent.
 func (svc *Service) Attachment(ctx context.Context, id uuid.UUID) (string, []byte, bool, error) {
 	return svc.store.Attachment(ctx, id)
@@ -34,10 +34,11 @@ func NewStore(db *sql.DB) *Store {

 // Insert stores one feedback message from accountID and returns its id. attachment
 // is the raw file bytes (nil for none); attachmentName, ip and a non-default
-// channel are stored as given. lang (interface language), version (client app build) and
-// browserTZ (the client's detected "±HH:MM" UTC offset) are snapshots taken now, so the operator
-// later sees the state at submit time. created_at defaults to now() in the database.
-func (s *Store) Insert(ctx context.Context, accountID uuid.UUID, body string, attachment []byte, attachmentName, channel, lang, version, browserTZ string, ip *string) (uuid.UUID, error) {
+// channel are stored as given. lang (the sender's interface language) and channelLang
+// (the connector bot language, empty for a non-connector channel) are snapshots taken
+// now, so the operator later sees the state at submit time. created_at defaults to
+// now() in the database.
+func (s *Store) Insert(ctx context.Context, accountID uuid.UUID, body string, attachment []byte, attachmentName, channel, lang, channelLang string, ip *string) (uuid.UUID, error) {
 	id, err := uuid.NewV7()
 	if err != nil {
 		return uuid.Nil, fmt.Errorf("feedback: new message id: %w", err)
@@ -48,9 +49,9 @@ func (s *Store) Insert(ctx context.Context, accountID uuid.UUID, body string, at
 	}
 	if _, err := s.db.ExecContext(ctx,
 		`INSERT INTO backend.feedback_messages
-		   (message_id, account_id, body, attachment, attachment_name, channel, lang, app_version, browser_tz, sender_ip)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
-		id, accountID, body, att, nullStr(attachmentName), channel, nullStr(lang), nullStr(version), nullStr(browserTZ), ip); err != nil {
+		   (message_id, account_id, body, attachment, attachment_name, channel, lang, channel_lang, sender_ip)
+		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
+		id, accountID, body, att, nullStr(attachmentName), channel, nullStr(lang), nullStr(channelLang), ip); err != nil {
 		return uuid.Nil, fmt.Errorf("feedback: insert: %w", err)
 	}
 	return id, nil
@@ -227,16 +228,10 @@ type AdminMessage struct {
 	Source     string
 	Body       string
 	Channel    string
-	// Lang is the sender's interface language, snapshotted at submit time.
+	// Lang is the sender's interface language and ChannelLang the connector bot language
+	// (en/ru, empty for a non-connector channel) — both snapshotted at submit time.
 	Lang           string
-	// Version is the client app build the report was sent from, snapshotted at submit time.
-	Version string
-	// BrowserTZ is the client's detected "±HH:MM" UTC offset at submit time, snapshotted so the
-	// filed time can be shown in the sender's browser-local zone even before they save a profile.
-	BrowserTZ string
-	// TimeZone is the sender account's stored zone ("±HH:MM" offset, IANA name, or ""), for
-	// rendering CreatedAt in the sender's own configured time alongside UTC.
-	TimeZone       string
+	ChannelLang    string
 	SenderIP       string
 	HasAttachment  bool
 	AttachmentName string
@@ -351,7 +346,7 @@ func (s *Store) AdminGet(ctx context.Context, id uuid.UUID) (AdminMessage, error
 	var m AdminMessage
 	var repliedAt sql.NullTime
 	q := `SELECT m.message_id, m.account_id, a.display_name, ` + feedbackSource + ` AS source, m.body, m.channel,
-		COALESCE(m.lang, ''), COALESCE(m.app_version, ''), COALESCE(m.browser_tz, ''), a.time_zone,
+		COALESCE(m.lang, ''), COALESCE(m.channel_lang, ''),
 		COALESCE(m.sender_ip, ''), (m.attachment IS NOT NULL), COALESCE(m.attachment_name, ''),
 		(m.read_at IS NOT NULL), (m.archived_at IS NOT NULL), (m.reply_body IS NOT NULL),
 		COALESCE(m.reply_body, ''), m.replied_at, m.created_at
@@ -360,7 +355,7 @@ func (s *Store) AdminGet(ctx context.Context, id uuid.UUID) (AdminMessage, error
 	WHERE m.message_id = $1`
 	err := s.db.QueryRowContext(ctx, q, id).Scan(
 		&m.ID, &m.AccountID, &m.SenderName, &m.Source, &m.Body, &m.Channel,
-		&m.Lang, &m.Version, &m.BrowserTZ, &m.TimeZone,
+		&m.Lang, &m.ChannelLang,
 		&m.SenderIP, &m.HasAttachment, &m.AttachmentName,
 		&m.Read, &m.Archived, &m.Replied, &m.ReplyBody, &repliedAt, &m.CreatedAt)
 	if errors.Is(err, sql.ErrNoRows) {
@@ -386,15 +381,3 @@ func (s *Store) CountUnread(ctx context.Context) (int, error) {
 	}
 	return n, nil
 }
-
-// CountSince counts feedback messages created strictly after since — the operator alert
-// worker's "new since the last check" signal.
-func (s *Store) CountSince(ctx context.Context, since time.Time) (int, error) {
-	var n int
-	if err := s.db.QueryRowContext(ctx,
-		`SELECT COUNT(*) FROM backend.feedback_messages WHERE created_at > $1`, since,
-	).Scan(&n); err != nil {
-		return 0, fmt.Errorf("feedback: count since: %w", err)
-	}
-	return n, nil
-}
@@ -63,7 +63,6 @@ type gameCache struct {

 type cachedGame struct {
 	game       *engine.Game
-	seats      []Seat
 	variant    string
 	lastAccess time.Time
 }
@@ -72,27 +71,24 @@ func newGameCache(ttl time.Duration, now func() time.Time) *gameCache {
 	return &gameCache{entries: make(map[uuid.UUID]*cachedGame), ttl: ttl, now: now}
 }

-// get returns the live game and its immutable seat list for id and refreshes its idle
-// timer, or (nil, nil, false). The seats let a read check membership (and label seats)
-// without re-loading the game from the store, since seats never change after a game starts.
-func (c *gameCache) get(id uuid.UUID) (*engine.Game, []Seat, bool) {
+// get returns the live game for id and refreshes its idle timer, or (nil, false).
+func (c *gameCache) get(id uuid.UUID) (*engine.Game, bool) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	e, ok := c.entries[id]
 	if !ok {
-		return nil, nil, false
+		return nil, false
 	}
 	e.lastAccess = c.now()
-	return e.game, e.seats, true
+	return e.game, true
 }

-// put stores g as the live game for id together with its seat list. variant labels the
-// entry so the active-games gauge can report counts by variant without inspecting engine
-// internals; seats are the game's immutable seat standings for the membership fast path.
-func (c *gameCache) put(id uuid.UUID, g *engine.Game, variant string, seats []Seat) {
+// put stores g as the live game for id. variant labels the entry so the active-
+// games gauge can report counts by variant without inspecting engine internals.
+func (c *gameCache) put(id uuid.UUID, g *engine.Game, variant string) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	c.entries[id] = &cachedGame{game: g, seats: seats, variant: variant, lastAccess: c.now()}
+	c.entries[id] = &cachedGame{game: g, variant: variant, lastAccess: c.now()}
 }

 // remove drops id from the cache (used on a finished game and after a failed
@@ -16,5 +16,5 @@
 // word-check tool with complaint capture, per-player game state, history and GCG
 // export, and the per-game turn-timeout sweeper that auto-resigns an overdue
 // player (honouring their daily away window). The HTTP surface that fronts these
-// operations is exposed to the gateway.
+// operations is added with the gateway in a later stage.
 package game
@@ -68,6 +68,10 @@ func TestEmitMoveNotifiesActor(t *testing.T) {
 	if got := string(yt.ScoreLine()); got != "13:19" { // seat 1 (recipient) first, then seat 0
 		t.Errorf("your_turn score_line = %q, want 13:19", got)
 	}
+	// Routed out-of-app by the game's language (the default Variant is English).
+	if yourTurn.Language != "en" {
+		t.Errorf("your_turn language = %q, want en", yourTurn.Language)
+	}
 }

 // TestEmitMoveAnnouncesGameOver checks the closing move sends a game_over push to every seat,
@@ -102,4 +106,7 @@ func TestEmitMoveAnnouncesGameOver(t *testing.T) {
 	if string(l.Result()) != "lost" || string(l.ScoreLine()) != "95:120" {
 		t.Errorf("loser game_over = %q / %q, want lost / 95:120", l.Result(), l.ScoreLine())
 	}
+	if over[winner].Language != "en" || over[loser].Language != "en" {
+		t.Errorf("game_over languages = %q/%q, want en/en", over[winner].Language, over[loser].Language)
+	}
 }
@@ -94,8 +94,8 @@ func TestGameCacheEviction(t *testing.T) {
 	cur := time.Unix(1_700_000_000, 0)
 	cache := newGameCache(time.Hour, func() time.Time { return cur })
 	id := uuid.New()
-	cache.put(id, nil, "scrabble_en", nil)
-	if _, _, ok := cache.get(id); !ok {
+	cache.put(id, nil, "scrabble_en")
+	if _, ok := cache.get(id); !ok {
 		t.Fatal("game must be resident after put")
 	}
 	cur = cur.Add(30 * time.Minute)
@@ -104,7 +104,7 @@ func TestGameCacheEviction(t *testing.T) {
 	if n := cache.sweep(); n != 1 {
 		t.Errorf("sweep evicted %d, want 1", n)
 	}
-	if _, _, ok := cache.get(id); ok {
+	if _, ok := cache.get(id); ok {
 		t.Error("game must be evicted after idle TTL")
 	}
 	if cache.size() != 0 {
@@ -1,144 +0,0 @@
-package game
-
-import (
-	"context"
-	"errors"
-	"fmt"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/engine"
-)
-
-// ReplayStep is one step of an admin game replay: the move that produced it (nil for the
-// initial dealt state, step 0) and the resulting position — every seat's rack, the running
-// scores, whose turn it is and the bag remainder. Step k's board is the union of every
-// play's placements through step k, which the renderer accumulates onto an empty grid
-// (docs/ARCHITECTURE.md §9.1 visual replay).
-type ReplayStep struct {
-	// Move is the journalled move that produced this state, or nil for the initial deal.
-	Move *HistoryMove
-	// Drawn lists the tiles the mover drew from the bag after this move ("?" for a blank);
-	// empty for the initial deal, a pass or a resignation.
-	Drawn []string
-	// Racks holds every seat's rack at this step, indexed by seat ("?" for a blank).
-	Racks [][]string
-	// Scores holds every seat's running score, indexed by seat.
-	Scores []int
-	// ToMove is the seat to move at this step.
-	ToMove int
-	// BagLen is the number of tiles left in the bag at this step.
-	BagLen int
-}
-
-// ReplayTimelineView is the admin replay of a game: the persisted game plus the ordered
-// replay steps (the initial deal followed by one step per journalled move).
-type ReplayTimelineView struct {
-	Game  Game
-	Steps []ReplayStep
-}
-
-// ReplayTimeline rebuilds a game from its pinned seed and journal and returns the ordered
-// replay steps for the admin console: the initial deal (step 0) then one step per
-// journalled move, each carrying the resulting racks, scores, turn cursor, bag size and the
-// tiles the mover drew. The deterministic bag makes the reconstruction exact. It needs no
-// dictionary beyond the engine the seed deals, and — like the live replay — stops early if a
-// committed move became illegal under tightened rules rather than failing.
-func (svc *Service) ReplayTimeline(ctx context.Context, gameID uuid.UUID) (ReplayTimelineView, error) {
-	pre, err := svc.store.GetGame(ctx, gameID)
-	if err != nil {
-		return ReplayTimelineView{}, err
-	}
-	seed, err := svc.store.GameSeed(ctx, gameID)
-	if err != nil {
-		return ReplayTimelineView{}, err
-	}
-	g, err := engine.New(svc.registry, engine.Options{
-		Variant:              pre.Variant,
-		Version:              pre.DictVersion,
-		Players:              pre.Players,
-		Seed:                 seed,
-		DropoutTiles:         pre.DropoutTiles,
-		MultipleWordsPerTurn: pre.MultipleWordsPerTurn,
-	})
-	if err != nil {
-		return ReplayTimelineView{}, err
-	}
-	moves, err := svc.store.GetJournal(ctx, gameID)
-	if err != nil {
-		return ReplayTimelineView{}, err
-	}
-	steps := make([]ReplayStep, 0, len(moves)+1)
-	steps = append(steps, snapshotStep(g, nil, nil))
-	for i := range moves {
-		mv := moves[i]
-		before := g.Hand(mv.Seat)
-		if err := replayMove(g, mv); err != nil {
-			if errors.Is(err, engine.ErrIllegalPlay) {
-				g.Abort()
-				break
-			}
-			return ReplayTimelineView{}, fmt.Errorf("game: replay-timeline %s move %d: %w", gameID, mv.Seq, err)
-		}
-		moveCopy := mv
-		steps = append(steps, snapshotStep(g, &moveCopy, drawnTiles(before, g.Hand(mv.Seat), usedTiles(mv))))
-	}
-	return ReplayTimelineView{Game: pre, Steps: steps}, nil
-}
-
-// snapshotStep captures the position after applying move (nil for the initial deal): every
-// seat's rack and score, the turn cursor and the bag size, with the supplied drawn tiles.
-func snapshotStep(g *engine.Game, move *HistoryMove, drawn []string) ReplayStep {
-	n := g.Players()
-	racks := make([][]string, n)
-	scores := make([]int, n)
-	for i := 0; i < n; i++ {
-		racks[i] = g.Hand(i)
-		scores[i] = g.Score(i)
-	}
-	return ReplayStep{Move: move, Drawn: drawn, Racks: racks, Scores: scores, ToMove: g.ToMove(), BagLen: g.BagLen()}
-}
-
-// usedTiles returns the rack tiles a move consumed ("?" for a blank): the placed tiles of a
-// play or the swapped tiles of an exchange; a pass or resignation consumes none.
-func usedTiles(mv HistoryMove) []string {
-	switch mv.Action {
-	case "play":
-		used := make([]string, len(mv.Tiles))
-		for i, t := range mv.Tiles {
-			if t.Blank {
-				used[i] = "?" // a placed blank leaves the rack as the blank marker
-			} else {
-				used[i] = t.Letter
-			}
-		}
-		return used
-	case "exchange":
-		return mv.Exchanged
-	}
-	return nil
-}
-
-// drawnTiles returns the tiles the mover drew from the bag: the post-move rack (after) minus
-// the tiles kept (before minus used). It compares the racks as multisets, so duplicate
-// letters are counted correctly.
-func drawnTiles(before, after, used []string) []string {
-	kept := make(map[string]int, len(before))
-	for _, t := range before {
-		kept[t]++
-	}
-	for _, t := range used {
-		if kept[t] > 0 {
-			kept[t]--
-		}
-	}
-	var drawn []string
-	for _, t := range after {
-		if kept[t] > 0 {
-			kept[t]--
-			continue
-		}
-		drawn = append(drawn, t)
-	}
-	return drawn
-}
@@ -1,50 +0,0 @@
-package game
-
-import (
-	"reflect"
-	"testing"
-
-	"scrabble/backend/internal/engine"
-)
-
-func TestUsedTiles(t *testing.T) {
-	tests := []struct {
-		name string
-		mv   HistoryMove
-		want []string
-	}{
-		{"pass", HistoryMove{Action: "pass"}, nil},
-		{"resign", HistoryMove{Action: "resign"}, nil},
-		{"play with blank", HistoryMove{Action: "play", Tiles: []engine.TileRecord{{Letter: "a"}, {Letter: "b", Blank: true}}}, []string{"a", "?"}},
-		{"exchange", HistoryMove{Action: "exchange", Exchanged: []string{"a", "?"}}, []string{"a", "?"}},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := usedTiles(tt.mv); !reflect.DeepEqual(got, tt.want) {
-				t.Fatalf("usedTiles = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestDrawnTiles(t *testing.T) {
-	tests := []struct {
-		name         string
-		before, used []string
-		after        []string
-		want         []string
-	}{
-		{"play refill", []string{"a", "b", "c", "d"}, []string{"a", "b"}, []string{"c", "d", "e", "f"}, []string{"e", "f"}},
-		{"blank played", []string{"?", "a"}, []string{"?"}, []string{"a", "x"}, []string{"x"}},
-		{"pass keeps rack", []string{"a", "b"}, nil, []string{"a", "b"}, nil},
-		{"duplicate letters", []string{"e", "e", "e"}, []string{"e"}, []string{"e", "e", "q"}, []string{"q"}},
-		{"empty bag no refill", []string{"a", "b"}, []string{"a"}, []string{"b"}, nil},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := drawnTiles(tt.before, tt.after, tt.used); !reflect.DeepEqual(got, tt.want) {
-				t.Fatalf("drawnTiles = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
@@ -1,156 +0,0 @@
-package game
-
-import (
-	"crypto/rand"
-	"fmt"
-	"math/big"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/engine"
-)
-
-// maxSeedingRounds caps the first-move draw's tie re-draws. With a real bag a tie
-// breaks with positive probability each round, so this is reached only by a
-// degenerate (e.g. test) entropy source that ties forever; the cap turns that into
-// an error instead of an infinite loop.
-const maxSeedingRounds = 1000
-
-// SetupDraw is one recorded tile draw of the first-move seeding — one row of
-// game_setup_draws (docs/ARCHITECTURE.md §6, §9): the round, the draw order within
-// it, the seated account that drew, and the decoded tile with its rank. It is
-// dictionary-independent: the letter, the blank flag and the numeric rank describe
-// the draw without any alphabet table.
-type SetupDraw struct {
-	Round   int
-	PickNo  int
-	Account uuid.UUID
-	Letter  string
-	Blank   bool
-	Rank    int
-}
-
-// seedingResult is the outcome of the first-move seeding: the winning account, the
-// seated accounts rotated so the winner leads (seat 0), and the full draw log to
-// persist.
-type seedingResult struct {
-	winner uuid.UUID
-	order  []uuid.UUID
-	draws  []SetupDraw
-}
-
-// drawIntn returns a uniformly random integer in [0, n) for n > 0. It is the
-// entropy seam of the first-move seeding: production uses crypto/rand (cryptoIntn),
-// so every draw is honestly random with no single seed; tests inject a
-// deterministic source.
-type drawIntn func(n int) (int, error)
-
-// cryptoIntn draws a uniform integer in [0, n) from crypto/rand — the honest,
-// seedless entropy the first-move draw requires.
-func cryptoIntn(n int) (int, error) {
-	v, err := rand.Int(rand.Reader, big.NewInt(int64(n)))
-	if err != nil {
-		return 0, fmt.Errorf("game: first-move draw entropy: %w", err)
-	}
-	return int(v.Int64()), nil
-}
-
-// seedFirstMove runs the official first-move draw over accounts for variant v,
-// drawing tiles with the entropy source intn. Each round every contender draws one
-// tile (without replacement) from a fresh full bag; the tile closest to "A" wins, a
-// blank beating every letter; contenders tied for the best tile re-draw in the next
-// round until a single leader remains. It returns the leader, the rotation that
-// seats the leader first (preserving the others' seating order), and every draw for
-// the record. It performs no I/O beyond calling intn.
-func seedFirstMove(v engine.Variant, accounts []uuid.UUID, intn drawIntn) (seedingResult, error) {
-	if len(accounts) < 2 {
-		return seedingResult{}, fmt.Errorf("game: first-move seeding needs at least 2 accounts, got %d", len(accounts))
-	}
-	full, err := engine.SetupBag(v)
-	if err != nil {
-		return seedingResult{}, err
-	}
-	contenders := append([]uuid.UUID(nil), accounts...)
-	var draws []SetupDraw
-	for round := 1; ; round++ {
-		if round > maxSeedingRounds {
-			return seedingResult{}, fmt.Errorf("game: first-move seeding unresolved after %d rounds", maxSeedingRounds)
-		}
-		bag := append([]engine.SetupTile(nil), full...)
-		picks := make([]engine.SetupTile, len(contenders))
-		for i, acc := range contenders {
-			tile, rest, err := drawSetupTile(bag, intn)
-			if err != nil {
-				return seedingResult{}, err
-			}
-			bag = rest
-			picks[i] = tile
-			draws = append(draws, SetupDraw{
-				Round: round, PickNo: i, Account: acc,
-				Letter: tile.Letter, Blank: tile.Blank, Rank: tile.Rank,
-			})
-		}
-		winners := bestContenders(contenders, picks)
-		if len(winners) == 1 {
-			return seedingResult{winner: winners[0], order: rotateToFirst(accounts, winners[0]), draws: draws}, nil
-		}
-		contenders = winners
-	}
-}
-
-// drawSetupTile removes one uniformly random tile from bag using the entropy source
-// intn and returns it with the shrunk bag (a fresh slice, leaving bag untouched).
-// It is the per-tile draw primitive — the seam a future manual "player N draws a
-// tile" tournament API will drive, one call per external request.
-func drawSetupTile(bag []engine.SetupTile, intn drawIntn) (engine.SetupTile, []engine.SetupTile, error) {
-	if len(bag) == 0 {
-		return engine.SetupTile{}, nil, fmt.Errorf("game: first-move draw from an empty bag")
-	}
-	i, err := intn(len(bag))
-	if err != nil {
-		return engine.SetupTile{}, nil, err
-	}
-	if i < 0 || i >= len(bag) {
-		return engine.SetupTile{}, nil, fmt.Errorf("game: first-move draw index %d out of range %d", i, len(bag))
-	}
-	tile := bag[i]
-	rest := make([]engine.SetupTile, 0, len(bag)-1)
-	rest = append(rest, bag[:i]...)
-	rest = append(rest, bag[i+1:]...)
-	return tile, rest, nil
-}
-
-// bestContenders returns the contenders whose drawn tile has the lowest (best)
-// rank — the sole winner if one, else the tied set that re-draws. picks is aligned
-// with contenders by index.
-func bestContenders(contenders []uuid.UUID, picks []engine.SetupTile) []uuid.UUID {
-	best := picks[0].Rank
-	for _, p := range picks[1:] {
-		if p.Rank < best {
-			best = p.Rank
-		}
-	}
-	var winners []uuid.UUID
-	for i, p := range picks {
-		if p.Rank == best {
-			winners = append(winners, contenders[i])
-		}
-	}
-	return winners
-}
-
-// rotateToFirst returns accounts rotated cyclically so winner sits first (seat 0),
-// preserving the seating order of the rest (docs/ARCHITECTURE.md §6). winner must be
-// present in accounts.
-func rotateToFirst(accounts []uuid.UUID, winner uuid.UUID) []uuid.UUID {
-	i := 0
-	for ; i < len(accounts); i++ {
-		if accounts[i] == winner {
-			break
-		}
-	}
-	out := make([]uuid.UUID, 0, len(accounts))
-	out = append(out, accounts[i:]...)
-	out = append(out, accounts[:i]...)
-	return out
-}
@@ -1,130 +0,0 @@
-package game
-
-import (
-	"testing"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/engine"
-)
-
-// scriptIntn returns a drawIntn that yields the scripted indices in order, failing
-// the test if the script is exhausted or an index is out of range. It lets a test
-// drive the first-move draw deterministically (English SetupBag order: 9 'a' at
-// 0..8, then 'b' …, blanks last).
-func scriptIntn(t *testing.T, seq ...int) drawIntn {
-	t.Helper()
-	i := 0
-	return func(n int) (int, error) {
-		if i >= len(seq) {
-			t.Fatalf("intn script exhausted (asked for [0,%d))", n)
-		}
-		v := seq[i]
-		i++
-		if v < 0 || v >= n {
-			t.Fatalf("intn script value %d out of range [0,%d)", v, n)
-		}
-		return v, nil
-	}
-}
-
-func TestSeedFirstMoveDirectWinner(t *testing.T) {
-	a, b := uuid.New(), uuid.New()
-	// a draws bag[0]='a' (rank 0); b draws bag[8]='b' (rank 1) → a wins, no tie.
-	res, err := seedFirstMove(engine.VariantEnglish, []uuid.UUID{a, b}, scriptIntn(t, 0, 8))
-	if err != nil {
-		t.Fatalf("seedFirstMove: %v", err)
-	}
-	if res.winner != a {
-		t.Fatalf("winner = %v, want %v", res.winner, a)
-	}
-	if got := res.order; len(got) != 2 || got[0] != a || got[1] != b {
-		t.Fatalf("order = %v, want [a b]", got)
-	}
-	if len(res.draws) != 2 {
-		t.Fatalf("draws = %d, want 2", len(res.draws))
-	}
-}
-
-func TestSeedFirstMoveBlankSupersedes(t *testing.T) {
-	a, b := uuid.New(), uuid.New()
-	// a draws 'a' (rank 0); after the draw the two blanks sit at 97,98 — b draws
-	// bag[97], a blank, which beats every letter.
-	res, err := seedFirstMove(engine.VariantEnglish, []uuid.UUID{a, b}, scriptIntn(t, 0, 97))
-	if err != nil {
-		t.Fatalf("seedFirstMove: %v", err)
-	}
-	if res.winner != b {
-		t.Fatalf("winner = %v, want %v (blank supersedes)", res.winner, b)
-	}
-	last := res.draws[len(res.draws)-1]
-	if !last.Blank || last.Rank != engine.BlankRank || last.Letter != "?" {
-		t.Fatalf("winning draw = %+v, want a blank (rank %d, '?')", last, engine.BlankRank)
-	}
-}
-
-func TestSeedFirstMoveTieRedraw(t *testing.T) {
-	a, b, c := uuid.New(), uuid.New(), uuid.New()
-	// Round 1: a→bag[0]='a'(0), b→bag[0]='a'(0), c→bag[7]='b'(1) → a,b tie best.
-	// Round 2 (a,b only): a→bag[0]='a'(0), b→bag[8]='b'(1) → a wins.
-	res, err := seedFirstMove(engine.VariantEnglish, []uuid.UUID{a, b, c}, scriptIntn(t, 0, 0, 7, 0, 8))
-	if err != nil {
-		t.Fatalf("seedFirstMove: %v", err)
-	}
-	if res.winner != a {
-		t.Fatalf("winner = %v, want %v", res.winner, a)
-	}
-	if len(res.draws) != 5 {
-		t.Fatalf("draws = %d, want 5 (3 in round 1, 2 in round 2)", len(res.draws))
-	}
-	if res.draws[2].Round != 1 || res.draws[3].Round != 2 {
-		t.Fatalf("round boundaries wrong: %+v", res.draws)
-	}
-	// The full table keeps every account's seating order, winner first.
-	if got := res.order; got[0] != a || got[1] != b || got[2] != c {
-		t.Fatalf("order = %v, want [a b c]", got)
-	}
-}
-
-func TestSeedFirstMoveTooFewAccounts(t *testing.T) {
-	if _, err := seedFirstMove(engine.VariantEnglish, []uuid.UUID{uuid.New()}, scriptIntn(t)); err == nil {
-		t.Fatal("want error for a single account")
-	}
-}
-
-func TestSeedFirstMovePerpetualTieCapped(t *testing.T) {
-	a, b := uuid.New(), uuid.New()
-	// Always drawing bag[0] gives both players an 'a' every round — a tie that never
-	// resolves; the round cap must turn it into an error, not an infinite loop.
-	alwaysZero := drawIntn(func(int) (int, error) { return 0, nil })
-	if _, err := seedFirstMove(engine.VariantEnglish, []uuid.UUID{a, b}, alwaysZero); err == nil {
-		t.Fatal("want error when ties never resolve")
-	}
-}
-
-func TestRotateToFirst(t *testing.T) {
-	a, b, c, d := uuid.New(), uuid.New(), uuid.New(), uuid.New()
-	tests := []struct {
-		name     string
-		accounts []uuid.UUID
-		winner   uuid.UUID
-		want     []uuid.UUID
-	}{
-		{"two winner second", []uuid.UUID{a, b}, b, []uuid.UUID{b, a}},
-		{"three winner first", []uuid.UUID{a, b, c}, a, []uuid.UUID{a, b, c}},
-		{"four winner third", []uuid.UUID{a, b, c, d}, c, []uuid.UUID{c, d, a, b}},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := rotateToFirst(tt.accounts, tt.winner)
-			if len(got) != len(tt.want) {
-				t.Fatalf("len = %d, want %d", len(got), len(tt.want))
-			}
-			for i := range got {
-				if got[i] != tt.want[i] {
-					t.Fatalf("rotate = %v, want %v", got, tt.want)
-				}
-			}
-		})
-	}
-}
@@ -38,11 +38,6 @@ type Service struct {
 	version string
 	clock   func() time.Time
 	rng     func() int64
-	// firstMoveEntropy returns the entropy source for one game's first-move draw
-	// (docs/ARCHITECTURE.md §6). The default is crypto/rand — an honest, seedless draw;
-	// tests override it via SetFirstMoveEntropy for a deterministic turn order. It is a
-	// factory so a stateful test source restarts cleanly per game.
-	firstMoveEntropy func() drawIntn
 	pub     notify.Publisher
 	// aiTrigger, when set, is called after an honest-AI game is created or advanced and
 	// is still on a robot's potential turn, so the robot replies at once instead of
@@ -54,12 +49,6 @@ type Service struct {
 	// have committed a move (a nudge answered by moving stops counting as unread). It is
 	// best-effort and kept as a func so the game package never imports the social package.
 	clearNudges func(ctx context.Context, gameID, accountID uuid.UUID) error
-	// expireNudges, when set, marks every pending nudge in a game read once the game
-	// finishes (the nudge badge is stale on a completed game). Unlike clearNudges it is
-	// keyed by game alone — it clears all seats' nudges, not one mover's — and runs on
-	// every completion path through commit. Best-effort; a func so the game package never
-	// imports the social package.
-	expireNudges func(ctx context.Context, gameID uuid.UUID) error
 	metrics     *gameMetrics
 	log         *zap.Logger
 }
@@ -78,7 +67,6 @@ func NewService(store *Store, accounts *account.Store, registry *engine.Registry
 		version:  cfg.DictVersion,
 		clock:    clock,
 		rng:      randomSeed,
-		firstMoveEntropy: func() drawIntn { return cryptoIntn },
 		pub:      notify.Nop{},
 		metrics:  defaultGameMetrics(),
 		log:      log,
@@ -113,27 +101,6 @@ func (svc *Service) SetNudgeClearer(fn func(ctx context.Context, gameID, account
 	svc.clearNudges = fn
 }

-// SetNudgeExpirer installs the hook that marks every pending nudge in a game read once the
-// game finishes, on any completion path (a closing move, a resignation, a turn-timeout or a
-// forfeit). It must be called during startup wiring; the default (nil) leaves a finished
-// game's nudges to expire only when a recipient opens the move history or chat. The social
-// package wires its ExpireNudges here. Chat messages are deliberately left unread.
-func (svc *Service) SetNudgeExpirer(fn func(ctx context.Context, gameID uuid.UUID) error) {
-	svc.expireNudges = fn
-}
-
-// SetFirstMoveEntropy overrides the entropy source for the first-move draw
-// (docs/ARCHITECTURE.md §6). It must be called during wiring or test setup before any
-// game is created; the production default is crypto/rand and is never overridden.
-// factory returns a fresh draw function per game, so a stateful deterministic test
-// source restarts cleanly for each game. It exists for deterministic tests.
-func (svc *Service) SetFirstMoveEntropy(factory func() func(n int) (int, error)) {
-	if factory == nil {
-		return
-	}
-	svc.firstMoveEntropy = func() drawIntn { return drawIntn(factory()) }
-}
-
 // triggerAI fires the honest-AI fast-move hook for an active vs_ai game (best-effort,
 // fire-and-forget). It is a no-op for non-AI games, finished games and when no hook is
 // installed, so callers can invoke it unconditionally after a create or commit.
@@ -224,32 +191,15 @@ func (svc *Service) Create(ctx context.Context, params CreateParams) (Game, erro
 		}
 	}
 	seen := make(map[uuid.UUID]bool, len(params.Seats))
-	for _, id := range params.Seats {
+	seats := make([]seatInsert, len(params.Seats))
+	for i, id := range params.Seats {
 		if seen[id] {
 			return Game{}, fmt.Errorf("%w: account %s seated twice", ErrInvalidConfig, id)
 		}
 		seen[id] = true
-	}
-
-	// Decide who moves first by the official draw (docs/ARCHITECTURE.md §6): each seated
-	// account draws a tile, the one closest to "A" leads (a blank supersedes all letters),
-	// ties re-drawing until a single leader remains. Each draw uses fresh entropy, not the
-	// game seed, so the recorded draws — persisted with the game — are the only account of
-	// the outcome. The winner takes seat 0; the rest keep their order.
-	seeding, err := seedFirstMove(params.Variant, params.Seats, svc.firstMoveEntropy())
-	if err != nil {
-		if errors.Is(err, engine.ErrUnknownVariant) {
-			return Game{}, fmt.Errorf("%w: %v", ErrInvalidConfig, err)
-		}
-		return Game{}, err
-	}
-
-	// Build the seats in the drawn turn order, snapshotting each seat's display name. For a
-	// vs-AI game this stamps the robot's seeded account name (unchanged behaviour); a
-	// disguised auto-match robot instead gets a fresh per-game name when the reaper attaches
-	// it (AttachRobot).
-	seats := make([]seatInsert, len(seeding.order))
-	for i, id := range seeding.order {
+		// Snapshot each seat's display name at creation. For a vs-AI game this stamps the
+		// robot's seeded account name (unchanged behaviour); a disguised auto-match robot
+		// instead gets a fresh per-game name when the reaper attaches it (AttachRobot).
 		acc, err := svc.accounts.GetByID(ctx, id)
 		if err != nil {
 			if errors.Is(err, account.ErrNotFound) {
@@ -299,15 +249,15 @@ func (svc *Service) Create(ctx context.Context, params CreateParams) (Game, erro
 		multipleWordsPerTurn: params.MultipleWordsPerTurn,
 		vsAI:                 params.VsAI,
 	}
-	if err := svc.store.CreateGame(ctx, ins, seats, seeding.draws); err != nil {
+	if err := svc.store.CreateGame(ctx, ins, seats); err != nil {
 		return Game{}, err
 	}
+	svc.cache.put(id, g, params.Variant.String())
 	svc.metrics.recordStarted(ctx, params.Variant, params.VsAI)
 	created, err := svc.store.GetGame(ctx, id)
 	if err != nil {
 		return Game{}, err
 	}
-	svc.cache.put(id, g, params.Variant.String(), created.Seats)
 	// Honest-AI game seated with a robot: if the robot moves first, reply at once
 	// (the periodic driver is the fallback). No-op for every human-only game.
 	svc.triggerAI(created)
@@ -316,15 +266,14 @@ func (svc *Service) Create(ctx context.Context, params CreateParams) (Game, erro

 // OpenOrJoin enters accountID into auto-match for the variant and per-turn rule in
 // params and returns the game they land in immediately: another waiting player's open
-// game (joined=true), or a fresh open game seating only the caller with an empty
-// opponent seat that a human or the reaper's robot fills later. A re-enqueue while the
-// caller is already waiting opens another game rather than returning their own.
-// openDeadline is when the reaper substitutes a robot into a freshly opened game
-// (ignored when joining one). The bag seed defaults to random; params.Seed
+// game (joined=true), the caller's own still-open game on a re-enqueue, or a fresh open
+// game seating only the caller with an empty opponent seat that a human or the reaper's
+// robot fills later. openDeadline is when the reaper substitutes a robot into a freshly
+// opened game (ignored when joining one). The bag seed defaults to random; params.Seed
 // pins it. First-move fairness comes from seating the caller at seat 0 or seat 1
 // (derived from the seed): seated at seat 1, the still-empty seat 0 moves first, so the
 // caller just waits for the opponent. It backs the lobby auto-match enqueue.
-func (svc *Service) OpenOrJoin(ctx context.Context, accountID uuid.UUID, params CreateParams, openDeadline time.Time, exclude []uuid.UUID) (Game, bool, error) {
+func (svc *Service) OpenOrJoin(ctx context.Context, accountID uuid.UUID, params CreateParams, openDeadline time.Time) (Game, bool, error) {
 	acc, err := svc.accounts.GetByID(ctx, accountID)
 	if err != nil {
 		if errors.Is(err, account.ErrNotFound) {
@@ -362,27 +311,14 @@ func (svc *Service) OpenOrJoin(ctx context.Context, accountID uuid.UUID, params
 		status:               StatusOpen,
 		openDeadline:         &deadline,
 	}
-	// Decide the first move now by the official draw, with the not-yet-arrived opponent as a
-	// synthetic placeholder (uuid.Nil): the draw fixes who sits at seat 0 — and so moves
-	// first — before either player acts (docs/ARCHITECTURE.md §6). The caller takes their
-	// drawn seat; the opponent seat is left empty. The opponent's draw rows are recorded with
-	// a NULL account and back-filled when a real opponent joins. Each draw uses fresh entropy,
-	// not the game seed. seats/draws are used only when a fresh game is opened.
-	seeding, err := seedFirstMove(params.Variant, []uuid.UUID{accountID, uuid.Nil}, svc.firstMoveEntropy())
-	if err != nil {
-		if errors.Is(err, engine.ErrUnknownVariant) {
-			return Game{}, false, fmt.Errorf("%w: %v", ErrInvalidConfig, err)
-		}
-		return Game{}, false, err
-	}
+	// Seat the caller at seat 0 or seat 1 (seat 0 always moves first), snapshotting their
+	// display name; the other seat is left empty (a zero seatInsert) for the opponent.
 	caller := seatInsert{accountID: accountID, displayName: acc.DisplayName}
-	seats := make([]seatInsert, len(seeding.order))
-	for seat, who := range seeding.order {
-		if who == accountID {
-			seats[seat] = caller // the empty opponent seat stays a zero seatInsert
+	seats := []seatInsert{caller, {}}
+	if seed&1 == 1 {
+		seats = []seatInsert{{}, caller}
 	}
-	}
-	gameID, joined, created, err := svc.store.OpenOrJoin(ctx, accountID, acc.DisplayName, ins, seats, exclude, seeding.draws)
+	gameID, joined, created, err := svc.store.OpenOrJoin(ctx, accountID, acc.DisplayName, ins, seats)
 	if err != nil {
 		return Game{}, false, err
 	}
@@ -569,6 +505,16 @@ func (svc *Service) GameVariant(ctx context.Context, gameID uuid.UUID) (engine.V
 	return svc.store.GetGameVariant(ctx, gameID)
 }

+// GameLanguage returns the game's language tag ("en"/"ru"), derived from its variant, so a
+// game push routes out-of-app to the game's own bot rather than the recipient's last-login bot.
+func (svc *Service) GameLanguage(ctx context.Context, gameID uuid.UUID) (string, error) {
+	v, err := svc.GameVariant(ctx, gameID)
+	if err != nil {
+		return "", err
+	}
+	return v.Language(), nil
+}
+
 // RobotSchedule returns a game's bag seed and turn-start time, for the admin console's
 // robot-schedule panel (the deterministic play-to-win intent and next-move ETA).
 func (svc *Service) RobotSchedule(ctx context.Context, gameID uuid.UUID) (seed int64, turnStartedAt time.Time, err error) {
@@ -600,9 +546,8 @@ func (svc *Service) transition(ctx context.Context, gameID, accountID uuid.UUID,
 		return MoveResult{}, ErrNotAPlayer
 	}
 	// A move is allowed while the game is active or still open (the starter may move on
-	// their turn before an opponent joins; the first-move draw ran when the game opened, so
-	// the seats are already fixed); only a finished game rejects it. The turn check below
-	// keeps the starter off the still-empty opponent seat.
+	// their turn before an opponent joins); only a finished game rejects it. The turn
+	// check below keeps the starter off the still-empty opponent seat.
 	if pre.Status == StatusFinished {
 		return MoveResult{}, ErrFinished
 	}
@@ -714,16 +659,6 @@ func (svc *Service) commit(ctx context.Context, gameID uuid.UUID, g *engine.Game
 	}
 	if c.finished {
 		svc.cache.remove(gameID)
-		// A finished game's nudges are stale, so clear them all here — every completion path
-		// funnels through commit (a closing move, a resignation, a forfeit or a turn-timeout),
-		// and only the move path also clears the mover's nudge on its own. Best-effort like
-		// clearNudges: the finish has committed, so a cleanup failure is logged, not surfaced.
-		// ExpireNudges leaves chat messages unread.
-		if svc.expireNudges != nil {
-			if err := svc.expireNudges(ctx, gameID); err != nil {
-				svc.log.Warn("expire nudges on game finish", zap.Error(err))
-			}
-		}
 	}
 	post, err := svc.store.GetGame(ctx, gameID)
 	if err != nil {
@@ -755,6 +690,9 @@ func (svc *Service) emitMove(ctx context.Context, post Game, rec engine.MoveReco
 		}
 		intents = append(intents, notify.OpponentMoved(s.AccountID, post.ID, rec, summary, bagLen))
 	}
+	// Game pushes are routed out-of-app by the game's own language, not the recipient's
+	// last-login bot.
+	lang := post.Variant.Language()
 	switch post.Status {
 	case StatusActive:
 		// Honest-AI games suppress your_turn: the robot replies instantly, so a "your turn"
@@ -769,6 +707,7 @@ func (svc *Service) emitMove(ctx context.Context, post Game, rec engine.MoveReco
 			}
 			opponent := svc.displayName(ctx, post.Seats, rec.Player)
 			yourTurn := notify.YourTurn(next, post.ID, deadline, opponent, action, word, scoreLine(post, post.ToMove), post.MoveCount)
+			yourTurn.Language = lang
 			intents = append(intents, yourTurn)
 		}
 	case StatusFinished:
@@ -780,6 +719,7 @@ func (svc *Service) emitMove(ctx context.Context, post Game, rec engine.MoveReco
 				continue
 			}
 			over := notify.GameOver(s.AccountID, post.ID, seatResult(post.Seats, s.Seat), scoreLine(post, s.Seat), summary)
+			over.Language = lang
 			intents = append(intents, over)
 		}
 	}
@@ -915,35 +855,26 @@ func (svc *Service) timeoutGame(ctx context.Context, gameID uuid.UUID, now time.
 // EvaluatePlay previews a tentative play for a seated player against the current
 // board without committing it: whether it is legal and what it would score.
 func (svc *Service) EvaluatePlay(ctx context.Context, gameID, accountID uuid.UUID, tiles []engine.TileRecord) (EvalResult, error) {
-	unlock := svc.locks.lock(gameID)
-	defer unlock()
-
-	// Hot path: an active game stays cached — the engine game is mutated in place across
-	// moves and evicted only when it finishes — so on a hit the cached live game and its
-	// immutable seat list answer the membership check and the score with no DB read. This
-	// preview is fired on every tile placement, the hottest gameplay call at scale.
-	g, seats, ok := svc.cache.get(gameID)
-	if !ok {
-		// Cold path: load and validate from the store, then replay into the cache.
 	pre, err := svc.store.GetGame(ctx, gameID)
 	if err != nil {
 		return EvalResult{}, err
 	}
+	if _, ok := pre.seatOf(accountID); !ok {
+		return EvalResult{}, ErrNotAPlayer
+	}
 	if pre.Status == StatusFinished {
 		return EvalResult{}, ErrFinished
 	}
-		if g, err = svc.liveGame(ctx, pre); err != nil {
+
+	unlock := svc.locks.lock(gameID)
+	defer unlock()
+	g, err := svc.liveGame(ctx, pre)
+	if err != nil {
 		return EvalResult{}, err
 	}
-		seats = pre.Seats
-	}
-	if !seatedIn(seats, accountID) {
-		return EvalResult{}, ErrNotAPlayer
-	}
-
 	validateStart := time.Now()
 	rec, err := g.EvaluatePlay(tiles)
-	svc.metrics.recordValidate(ctx, g.Variant(), validateStart)
+	svc.metrics.recordValidate(ctx, pre.Variant, validateStart)
 	if err != nil {
 		if errors.Is(err, engine.ErrIllegalPlay) {
 			return EvalResult{Valid: false}, nil
@@ -1008,12 +939,6 @@ func (svc *Service) CountComplaints(ctx context.Context, status string) (int, er
 	return svc.store.CountComplaints(ctx, status)
 }

-// CountComplaintsSince counts word complaints filed after since, for the operator alert
-// worker.
-func (svc *Service) CountComplaintsSince(ctx context.Context, since time.Time) (int, error) {
-	return svc.store.CountComplaintsSince(ctx, since)
-}
-
 // ResolveComplaint closes a complaint with an operator disposition (reject /
 // accept_add / accept_remove) and an optional note. An accepted complaint then
 // appears in DictionaryChanges until a rebuilt dictionary is loaded and the
@@ -1102,7 +1027,12 @@ func (svc *Service) Hint(ctx context.Context, gameID, accountID uuid.UUID) (Hint
 	}

 	walletAfter := acc.HintBalance
-	if !fromAllowance {
+	if fromAllowance {
+		if err := svc.store.SpendHintAllowance(ctx, gameID, seat); err != nil {
+			return HintResult{}, err
+		}
+		used++
+	} else {
 		spent, err := svc.accounts.SpendHint(ctx, accountID)
 		if err != nil {
 			return HintResult{}, err
@@ -1112,13 +1042,6 @@ func (svc *Service) Hint(ctx context.Context, gameID, accountID uuid.UUID) (Hint
 		}
 		walletAfter--
 	}
-	// hints_used is the per-game total (allowance + wallet): every hint increments it. The first
-	// HintsPerPlayer hints are the free allowance (so fromAllowance above stays correct); the rest
-	// are charged to the wallet. Counting all hints feeds the player's lifetime hint statistics.
-	if err := svc.store.IncHintsUsed(ctx, gameID, seat); err != nil {
-		return HintResult{}, err
-	}
-	used++
 	return HintResult{Move: move, HintsRemaining: hintsRemaining(pre.HintsPerPlayer, used, walletAfter), WalletBalance: walletAfter}, nil
 }

@@ -1361,68 +1284,37 @@ func (svc *Service) History(ctx context.Context, gameID uuid.UUID) (HistoryView,
 	return HistoryView{Game: g, Moves: moves}, nil
 }

-// SetupDraws returns a game's recorded first-move draws (docs/ARCHITECTURE.md §6), ordered by
-// round then pick. It backs the admin console's first-move section. An auto-match opponent's
-// draws carry uuid.Nil until a real opponent joins and back-fills them; an empty slice means
-// the game predates the draw record.
-func (svc *Service) SetupDraws(ctx context.Context, gameID uuid.UUID) ([]SetupDraw, error) {
-	return svc.store.SetupDraws(ctx, gameID)
-}
-
-// ExportView returns a finished game with its journal and per-seat display names —
-// the material every export artifact (the GCG text, the PNG render payload) is built
-// from. It is allowed only on a finished game: exporting an in-progress game would
-// leak the full move journal mid-play, so an active game yields ErrGameActive. In an
-// honest-AI game the robot seat is labelled "AI", not its pool name.
-func (svc *Service) ExportView(ctx context.Context, gameID uuid.UUID) (Game, []HistoryMove, []string, error) {
+// ExportGCG renders a game as GCG text from the journal alone (no dictionary). It
+// is allowed only on a finished game: exporting an in-progress game would leak the
+// full move journal mid-play, so an active game yields ErrGameActive.
+func (svc *Service) ExportGCG(ctx context.Context, gameID uuid.UUID) (string, error) {
 	g, err := svc.store.GetGame(ctx, gameID)
 	if err != nil {
-		return Game{}, nil, nil, err
+		return "", err
 	}
 	if g.Status != StatusFinished {
-		return Game{}, nil, nil, ErrGameActive
+		return "", ErrGameActive
 	}
 	moves, err := svc.store.GetJournal(ctx, gameID)
 	if err != nil {
-		return Game{}, nil, nil, err
+		return "", err
 	}
 	names := svc.seatNames(ctx, g)
 	if g.VsAI {
+		// Label the robot seat "AI" in an honest-AI game's export, not its pool name.
 		for _, s := range g.Seats {
 			if robot, err := svc.accounts.IsRobot(ctx, s.AccountID); err == nil && robot {
 				names[s.Seat] = aiPlayerName
 			}
 		}
 	}
-	return g, moves, names, nil
-}
-
-// EnsureExportable reports whether a game may be exported (it exists and is
-// finished) without loading the journal — the export-URL mint check.
-func (svc *Service) EnsureExportable(ctx context.Context, gameID uuid.UUID) error {
-	g, err := svc.store.GetGame(ctx, gameID)
-	if err != nil {
-		return err
-	}
-	if g.Status != StatusFinished {
-		return ErrGameActive
-	}
-	return nil
-}
-
-// ExportGCG renders a game as GCG text from the journal alone (no dictionary).
-func (svc *Service) ExportGCG(ctx context.Context, gameID uuid.UUID) (string, error) {
-	g, moves, names, err := svc.ExportView(ctx, gameID)
-	if err != nil {
-		return "", err
-	}
 	return writeGCG(g, names, moves), nil
 }

 // liveGame returns the live engine.Game for pre, rebuilding it from the journal
 // on a cache miss. Callers must hold the per-game lock.
 func (svc *Service) liveGame(ctx context.Context, pre Game) (*engine.Game, error) {
-	if g, _, ok := svc.cache.get(pre.ID); ok {
+	if g, ok := svc.cache.get(pre.ID); ok {
 		return g, nil
 	}
 	g, err := svc.replay(ctx, pre)
@@ -1437,7 +1329,7 @@ func (svc *Service) liveGame(ctx context.Context, pre Game) (*engine.Game, error
 		}
 	}
 	if !g.Over() {
-		svc.cache.put(pre.ID, g, pre.Variant.String(), pre.Seats)
+		svc.cache.put(pre.ID, g, pre.Variant.String())
 	}
 	return g, nil
 }
@@ -1494,24 +1386,13 @@ func (svc *Service) voidGame(ctx context.Context, pre Game, g *engine.Game) erro
 	if err != nil {
 		return err
 	}
-	if err := svc.store.VoidGame(ctx, voidCommit{
+	return svc.store.VoidGame(ctx, voidCommit{
 		gameID:    pre.ID,
 		endReason: g.Reason().String(),
 		scores:    scores,
 		now:       svc.clock(),
 		stats:     buildStats(g, statSeats),
-	}); err != nil {
-		return err
-	}
-	// A voided game is finished (as a draw) but bypasses commit, so clear its now-stale nudges
-	// here too. Best-effort, like the commit path: the void has persisted, so a cleanup failure
-	// is logged, not surfaced.
-	if svc.expireNudges != nil {
-		if err := svc.expireNudges(ctx, pre.ID); err != nil {
-			svc.log.Warn("expire nudges on voided game", zap.Error(err))
-		}
-	}
-	return nil
+	})
 }

 // replayMove re-applies one journalled move to g through the decoded engine API.
@@ -1548,12 +1429,10 @@ func buildStats(g *engine.Game, seats []Seat) []statDelta {
 	res := g.Result()
 	bestRec := make(map[int]engine.MoveRecord)
 	blanks := make(map[[2]int]bool)
-	plays := make(map[int]int) // per player: count of plays (tile placements), for the "moves" stat
 	for _, rec := range g.Log() {
 		if rec.Action != engine.ActionPlay {
 			continue
 		}
-		plays[rec.Player]++
 		for _, t := range rec.Tiles {
 			if t.Blank {
 				blanks[[2]int{t.Row, t.Col}] = true
@@ -1567,9 +1446,7 @@ func buildStats(g *engine.Game, seats []Seat) []statDelta {
 	values := letterValues(g.Variant())
 	out := make([]statDelta, 0, len(seats))
 	for _, s := range seats {
-		// moves counts the seat's plays; hintsUsed is the seat's total hints this game. Both are
-		// summed into account_stats so the screen can show the hint share (hints_used / moves).
-		d := statDelta{accountID: s.AccountID, gamePoints: g.Score(s.Seat), moves: plays[s.Seat], hintsUsed: s.HintsUsed}
+		d := statDelta{accountID: s.AccountID, gamePoints: g.Score(s.Seat)}
 		if rec, ok := bestRec[s.Seat]; ok {
 			d.wordPoints = rec.Score
 			if rec.Score > 0 {
@@ -1678,14 +1555,6 @@ func (svc *Service) lookupWord(variant engine.Variant, version, word string) (bo
 	return present, nil
 }

-// DictBytes returns the raw serialized dictionary for the (variant, version) pair
-// from the registry, backing the client-side dictionary download used by the
-// local move preview. It surfaces engine.ErrUnknownVariant /
-// engine.ErrUnknownVersion when that dictionary is not resident.
-func (svc *Service) DictBytes(variant engine.Variant, version string) ([]byte, error) {
-	return svc.registry.DictBytes(variant, version)
-}
-
 // hintsRemaining is a player's remaining hint budget: the unspent per-game
 // allowance plus the profile wallet.
 func hintsRemaining(allowance, used, wallet int) int {
@@ -66,8 +66,6 @@ type statDelta struct {
 	draws       int
 	gamePoints  int
 	wordPoints  int
-	moves       int // plays this game (tile placements), summed into account_stats.moves
-	hintsUsed   int // hints used this game (allowance + wallet), summed into account_stats.hints_used
 	bestVariant string
 	bestScore   int
 	bestTiles   []account.BestMoveTile
@@ -127,14 +125,11 @@ type seatInsert struct {
 	displayName string
 }

-// CreateGame inserts the games row, one game_players row per seat (seat 0 first) and
-// the first-move seeding draws inside a single transaction.
-func (s *Store) CreateGame(ctx context.Context, ins gameInsert, seats []seatInsert, draws []SetupDraw) error {
+// CreateGame inserts the games row and one game_players row per seat (seat 0
+// first) inside a single transaction.
+func (s *Store) CreateGame(ctx context.Context, ins gameInsert, seats []seatInsert) error {
 	return withTx(ctx, s.db, func(tx *sql.Tx) error {
-		if err := insertGameTx(ctx, tx, ins, seats); err != nil {
-			return err
-		}
-		return insertSetupDrawsTx(ctx, tx, ins.id, draws)
+		return insertGameTx(ctx, tx, ins, seats)
 	})
 }

@@ -176,30 +171,6 @@ func insertGameTx(ctx context.Context, tx *sql.Tx, ins gameInsert, seats []seatI
 	return nil
 }

-// insertSetupDrawsTx appends the first-move seeding draws for game gameID on tx —
-// the dictionary-independent record of how the first player was chosen
-// (docs/ARCHITECTURE.md §6). The games row must already exist on tx (the foreign
-// key), so it runs after insertGameTx. An empty draws slice is a no-op.
-func insertSetupDrawsTx(ctx context.Context, tx *sql.Tx, gameID uuid.UUID, draws []SetupDraw) error {
-	for _, d := range draws {
-		// A uuid.Nil account marks the synthetic opponent of an auto-match draw, persisted as
-		// a NULL account_id and back-filled when a real opponent joins.
-		var acc any = d.Account
-		if d.Account == uuid.Nil {
-			acc = postgres.NULL
-		}
-		di := table.GameSetupDraws.INSERT(
-			table.GameSetupDraws.GameID, table.GameSetupDraws.Round, table.GameSetupDraws.PickNo,
-			table.GameSetupDraws.AccountID, table.GameSetupDraws.Letter, table.GameSetupDraws.IsBlank,
-			table.GameSetupDraws.DrawRank,
-		).VALUES(gameID, d.Round, d.PickNo, acc, d.Letter, d.Blank, d.Rank)
-		if _, err := di.ExecContext(ctx, tx); err != nil {
-			return fmt.Errorf("insert setup draw round %d pick %d: %w", d.Round, d.PickNo, err)
-		}
-	}
-	return nil
-}
-
 // openMatchKey hashes an auto-match bucket (variant + per-turn word rule) into the
 // advisory-lock key that serialises concurrent enqueues for that bucket, so two
 // players never both open a game instead of pairing.
@@ -215,42 +186,48 @@ func openMatchKey(variant string, multipleWords bool) int64 {
 }

 // OpenOrJoin atomically resolves an auto-match enqueue for accountID into the game it
-// lands in: it joins another player's waiting open game and flips it active
-// (joined=true), or opens a fresh game seating the caller with an empty opponent seat
-// (created=true). A re-enqueue while the caller already has an open game in the bucket
-// opens another fresh game (or joins a different player's) rather than returning the
-// caller's own, so tapping "random opponent" again always starts a new search. ins
-// supplies the new game's immutable fields and is used only when a game is created. A
-// transaction-scoped advisory lock on the (variant, rule) bucket serialises concurrent
-// enqueues so two callers pair rather than each opening a game. seats is the two-seat
-// arrangement (the caller and uuid.Nil for the still-empty opponent, in the chosen
-// order) used only when a game is created; callerName is the caller's display-name
-// snapshot, stamped on their seat whether they open a fresh game or fill another
-// player's open one. seats and draws (the first-move draw recorded against the synthetic
-// opponent, docs/ARCHITECTURE.md §6) are used only when a game is created.
-func (s *Store) OpenOrJoin(ctx context.Context, accountID uuid.UUID, callerName string, ins gameInsert, seats []seatInsert, exclude []uuid.UUID, draws []SetupDraw) (gameID uuid.UUID, joined, created bool, err error) {
+// lands in: it re-uses the caller's own still-open game (joined=false, created=false,
+// a re-enqueue is idempotent), joins another player's waiting open game and flips it
+// active (joined=true), or opens a fresh game seating the caller with an empty
+// opponent seat (created=true). ins supplies the new game's immutable fields and is
+// used only when a game is created. A transaction-scoped advisory lock on the
+// (variant, rule) bucket serialises concurrent enqueues so two callers pair rather
+// than each opening a game. seats is the two-seat arrangement (the caller and uuid.Nil
+// for the still-empty opponent, in the chosen order) used only when a game is created;
+// callerName is the caller's display-name snapshot, stamped on their seat whether they
+// open a fresh game or fill another player's open one.
+func (s *Store) OpenOrJoin(ctx context.Context, accountID uuid.UUID, callerName string, ins gameInsert, seats []seatInsert) (gameID uuid.UUID, joined, created bool, err error) {
 	err = withTx(ctx, s.db, func(tx *sql.Tx) error {
 		if _, e := tx.ExecContext(ctx, `SELECT pg_advisory_xact_lock($1)`,
 			openMatchKey(ins.variant, ins.multipleWordsPerTurn)); e != nil {
 			return fmt.Errorf("open match lock: %w", e)
 		}
-		// 1. Another player's open game waiting for an opponent — fill its seat and start it.
-		// A game whose waiting player is in exclude (the caller's per-user block set, either
-		// direction) is skipped, so a block keeps the pair out of the same anonymous game;
-		// an empty exclude (the "{}" literal) excludes nothing.
+		// 1. The caller's own still-open game for this bucket — a re-enqueue is idempotent.
+		var own uuid.UUID
+		switch e := tx.QueryRowContext(ctx,
+			`SELECT g.game_id FROM backend.games g
+			   JOIN backend.game_players p ON p.game_id = g.game_id
+			  WHERE g.status = 'open' AND g.variant = $1 AND g.multiple_words_per_turn = $2 AND p.account_id = $3
+			  LIMIT 1`,
+			ins.variant, ins.multipleWordsPerTurn, accountID).Scan(&own); {
+		case e == nil:
+			gameID = own
+			return nil
+		case !errors.Is(e, sql.ErrNoRows):
+			return fmt.Errorf("find own open game: %w", e)
+		}
+		// 2. Another player's open game waiting for an opponent — fill its seat and start it.
 		var other uuid.UUID
 		switch e := tx.QueryRowContext(ctx,
 			`SELECT g.game_id FROM backend.games g
 			  WHERE g.status = 'open' AND g.variant = $1 AND g.multiple_words_per_turn = $2
 			    AND NOT EXISTS (SELECT 1 FROM backend.game_players p
 			                     WHERE p.game_id = g.game_id AND p.account_id = $3)
-			    AND NOT EXISTS (SELECT 1 FROM backend.game_players b
-			                     WHERE b.game_id = g.game_id AND b.account_id = ANY($4::uuid[]))
 			  ORDER BY g.created_at
 			  LIMIT 1 FOR UPDATE SKIP LOCKED`,
-			ins.variant, ins.multipleWordsPerTurn, accountID, uuidArrayLiteral(exclude)).Scan(&other); {
+			ins.variant, ins.multipleWordsPerTurn, accountID).Scan(&other); {
 		case e == nil:
-			if er := fillAndActivate(ctx, tx, other, accountID, callerName); er != nil {
+			if er := fillOpenSeat(ctx, tx, other, accountID, callerName); er != nil {
 				return er
 			}
 			gameID, joined = other, true
@@ -258,15 +235,10 @@ func (s *Store) OpenOrJoin(ctx context.Context, accountID uuid.UUID, callerName
 		case !errors.Is(e, sql.ErrNoRows):
 			return fmt.Errorf("find open game: %w", e)
 		}
-		// 2. None waiting — open a fresh game seating the caller (the other seat empty) and
-		// recording the first-move draw; the synthetic opponent's rows carry a NULL account
-		// until a real opponent joins and back-fills them.
+		// 3. None waiting — open a fresh game seating the caller (the other seat empty).
 		if e := insertGameTx(ctx, tx, ins, seats); e != nil {
 			return e
 		}
-		if e := insertSetupDrawsTx(ctx, tx, ins.id, draws); e != nil {
-			return e
-		}
 		gameID, created = ins.id, true
 		return nil
 	})
@@ -291,7 +263,7 @@ func (s *Store) AttachRobot(ctx context.Context, gameID, robotID uuid.UUID, disp
 		if status != StatusOpen {
 			return nil
 		}
-		if e := fillAndActivate(ctx, tx, gameID, robotID, displayName); e != nil {
+		if e := fillOpenSeat(ctx, tx, gameID, robotID, displayName); e != nil {
 			return e
 		}
 		attached = true
@@ -300,23 +272,15 @@ func (s *Store) AttachRobot(ctx context.Context, gameID, robotID uuid.UUID, disp
 	return attached, err
 }

-// fillAndActivate seats accountID in an open game's empty opponent seat — stamping
-// displayName as the seat's snapshot — back-fills the first-move draw rows the open game
-// recorded for the then-unknown opponent (docs/ARCHITECTURE.md §6), and flips the game to
-// active with a fresh turn clock. The seat the joiner takes was already fixed by the draw at
-// open time, so the journal (any opening move the starter made while waiting) is never
-// disturbed. The caller holds the game row.
-func fillAndActivate(ctx context.Context, tx *sql.Tx, gameID, accountID uuid.UUID, displayName string) error {
+// fillOpenSeat seats accountID in an open game's empty opponent seat — stamping
+// displayName as the seat's display-name snapshot — and flips the game to active with a
+// fresh turn clock. The caller holds the game row.
+func fillOpenSeat(ctx context.Context, tx *sql.Tx, gameID, accountID uuid.UUID, displayName string) error {
 	if _, err := tx.ExecContext(ctx,
 		`UPDATE backend.game_players SET account_id = $2, display_name = $3 WHERE game_id = $1 AND account_id IS NULL`,
 		gameID, accountID, displayName); err != nil {
 		return fmt.Errorf("fill opponent seat: %w", err)
 	}
-	if _, err := tx.ExecContext(ctx,
-		`UPDATE backend.game_setup_draws SET account_id = $2 WHERE game_id = $1 AND account_id IS NULL`,
-		gameID, accountID); err != nil {
-		return fmt.Errorf("back-fill opponent draws: %w", err)
-	}
 	if _, err := tx.ExecContext(ctx,
 		`UPDATE backend.games SET status = 'active', open_deadline_at = NULL, turn_started_at = now(), updated_at = now()
 		  WHERE game_id = $1`, gameID); err != nil {
@@ -355,33 +319,27 @@ func (s *Store) ExpiredOpen(ctx context.Context, now time.Time) ([]OpenGame, err
 // GetGame loads the games row joined with its seats (ordered by seat), or
 // ErrNotFound.
 func (s *Store) GetGame(ctx context.Context, id uuid.UUID) (Game, error) {
-	// One round-trip: the game joined with its seats. A LEFT JOIN keeps a (would-be)
-	// seatless game returning the game with no seats, exactly as the prior two-query
-	// version did; ORDER BY seat preserves seat order. The games columns repeat per seat
-	// row — cheap at 2-4 seats, and one round-trip instead of two, which matters because
-	// GetGame is the universal "load the game" step on every game operation.
-	stmt := postgres.SELECT(table.Games.AllColumns, table.GamePlayers.AllColumns).
-		FROM(table.Games.LEFT_JOIN(table.GamePlayers, table.GamePlayers.GameID.EQ(table.Games.GameID))).
+	gstmt := postgres.SELECT(table.Games.AllColumns).
+		FROM(table.Games).
 		WHERE(table.Games.GameID.EQ(postgres.UUID(id))).
-		ORDER_BY(table.GamePlayers.Seat.ASC())
-	var rows []struct {
-		model.Games
-		model.GamePlayers
-	}
-	if err := stmt.QueryContext(ctx, s.db, &rows); err != nil {
-		return Game{}, fmt.Errorf("game: get %s: %w", id, err)
-	}
-	if len(rows) == 0 {
+		LIMIT(1)
+	var grow model.Games
+	if err := gstmt.QueryContext(ctx, s.db, &grow); err != nil {
+		if errors.Is(err, qrm.ErrNoRows) {
 			return Game{}, ErrNotFound
 		}
-	seats := make([]model.GamePlayers, 0, len(rows))
-	for i := range rows {
-		// Skip the phantom all-NULL seat row a LEFT JOIN yields for a seatless game.
-		if rows[i].GamePlayers.GameID == id {
-			seats = append(seats, rows[i].GamePlayers)
+		return Game{}, fmt.Errorf("game: get %s: %w", id, err)
 	}
+
+	sstmt := postgres.SELECT(table.GamePlayers.AllColumns).
+		FROM(table.GamePlayers).
+		WHERE(table.GamePlayers.GameID.EQ(postgres.UUID(id))).
+		ORDER_BY(table.GamePlayers.Seat.ASC())
+	var srows []model.GamePlayers
+	if err := sstmt.QueryContext(ctx, s.db, &srows); err != nil {
+		return Game{}, fmt.Errorf("game: get seats %s: %w", id, err)
 	}
-	return projectGame(rows[0].Games, seats)
+	return projectGame(grow, srows)
 }

 // GetGameVariant reads just a game's variant — a cheap single-column lookup the edge uses
@@ -634,37 +592,6 @@ func (s *Store) GetJournal(ctx context.Context, id uuid.UUID) ([]HistoryMove, er
 	return out, nil
 }

-// SetupDraws loads the ordered first-move seeding draws for a game (round then pick
-// order), or an empty slice for a game created before the draw was recorded. It
-// backs the admin console's first-move section.
-func (s *Store) SetupDraws(ctx context.Context, id uuid.UUID) ([]SetupDraw, error) {
-	stmt := postgres.SELECT(table.GameSetupDraws.AllColumns).
-		FROM(table.GameSetupDraws).
-		WHERE(table.GameSetupDraws.GameID.EQ(postgres.UUID(id))).
-		ORDER_BY(table.GameSetupDraws.Round.ASC(), table.GameSetupDraws.PickNo.ASC())
-	var rows []model.GameSetupDraws
-	if err := stmt.QueryContext(ctx, s.db, &rows); err != nil {
-		return nil, fmt.Errorf("game: get setup draws %s: %w", id, err)
-	}
-	out := make([]SetupDraw, len(rows))
-	for i, r := range rows {
-		// A NULL account is the synthetic opponent of an auto-match draw not yet back-filled.
-		acc := uuid.Nil
-		if r.AccountID != nil {
-			acc = *r.AccountID
-		}
-		out[i] = SetupDraw{
-			Round:   int(r.Round),
-			PickNo:  int(r.PickNo),
-			Account: acc,
-			Letter:  r.Letter,
-			Blank:   r.IsBlank,
-			Rank:    int(r.DrawRank),
-		}
-	}
-	return out, nil
-}
-
 // CommitMove appends the move and applies the post-move game state — the turn
 // cursor and per-seat scores, plus the finish stamp and statistics when the move
 // ended the game — in one transaction.
@@ -802,17 +729,13 @@ func upsertStats(ctx context.Context, tx *sql.Tx, d statDelta, now time.Time) er
 	draws := row.Draws + int32(d.draws)
 	maxGame := max(row.MaxGamePoints, int32(d.gamePoints))
 	maxWord := max(row.MaxWordPoints, int32(d.wordPoints))
-	moves := row.Moves + int32(d.moves)
-	hintsUsed := row.HintsUsed + int32(d.hintsUsed)

 	upd := table.AccountStats.UPDATE(
 		table.AccountStats.Wins, table.AccountStats.Losses, table.AccountStats.Draws,
 		table.AccountStats.MaxGamePoints, table.AccountStats.MaxWordPoints, table.AccountStats.UpdatedAt,
-		table.AccountStats.Moves, table.AccountStats.HintsUsed,
 	).SET(
 		postgres.Int(int64(wins)), postgres.Int(int64(losses)), postgres.Int(int64(draws)),
 		postgres.Int(int64(maxGame)), postgres.Int(int64(maxWord)), postgres.TimestampzT(now),
-		postgres.Int(int64(moves)), postgres.Int(int64(hintsUsed)),
 	).WHERE(table.AccountStats.AccountID.EQ(postgres.UUID(d.accountID)))
 	if _, err := upd.ExecContext(ctx, tx); err != nil {
 		return fmt.Errorf("update stats %s: %w", d.accountID, err)
@@ -851,10 +774,8 @@ func upsertBestMove(ctx context.Context, tx *sql.Tx, d statDelta, now time.Time)
 	return nil
 }

-// IncHintsUsed increments a seat's per-game hints-used counter by one. It is called for
-// every hint — both the free per-game allowance and the wallet-charged ones — so the counter
-// is the seat's total hints used this game (the first HintsPerPlayer being the allowance).
-func (s *Store) IncHintsUsed(ctx context.Context, gameID uuid.UUID, seat int) error {
+// SpendHintAllowance increments a seat's per-game hint counter by one.
+func (s *Store) SpendHintAllowance(ctx context.Context, gameID uuid.UUID, seat int) error {
 	stmt := table.GamePlayers.
 		UPDATE(table.GamePlayers.HintsUsed).
 		SET(table.GamePlayers.HintsUsed.ADD(postgres.Int(1))).
@@ -863,7 +784,7 @@ func (s *Store) IncHintsUsed(ctx context.Context, gameID uuid.UUID, seat int) er
 				AND(table.GamePlayers.Seat.EQ(postgres.Int(int64(seat)))),
 		)
 	if _, err := stmt.ExecContext(ctx, s.db); err != nil {
-		return fmt.Errorf("game: increment hints used: %w", err)
+		return fmt.Errorf("game: spend hint allowance: %w", err)
 	}
 	return nil
 }
@@ -1040,19 +961,6 @@ func (s *Store) CountComplaints(ctx context.Context, status string) (int, error)
 	return int(dest.Count), nil
 }

-// CountComplaintsSince counts word complaints filed strictly after since — the operator
-// alert worker's "new since the last check" signal.
-func (s *Store) CountComplaintsSince(ctx context.Context, since time.Time) (int, error) {
-	stmt := postgres.SELECT(postgres.COUNT(table.Complaints.ComplaintID).AS("count")).
-		FROM(table.Complaints).
-		WHERE(table.Complaints.CreatedAt.GT(postgres.TimestampzT(since)))
-	var dest struct{ Count int64 }
-	if err := stmt.QueryContext(ctx, s.db, &dest); err != nil {
-		return 0, fmt.Errorf("game: count complaints since: %w", err)
-	}
-	return int(dest.Count), nil
-}
-
 // ActiveGames returns the turn clocks of every in-progress game; the sweeper
 // filters them against the per-move deadline and the player's away window.
 func (s *Store) ActiveGames(ctx context.Context) ([]activeGame, error) {
@@ -1111,18 +1019,13 @@ func (s *Store) RobotTurns(ctx context.Context, ids []uuid.UUID) ([]RobotTurn, e
 	for _, r := range rows {
 		out = append(out, robotTurnFrom(r.Games, r.GamePlayers))
 	}
-	if err := s.fillEndgamePass(ctx, out); err != nil {
-		return nil, err
-	}
 	return out, nil
 }

 // RobotTurnByGame returns the robot turn for a single active game — the seat held by
 // one of ids (the robot pool) — and true, or false when the game is not active, holds
 // no pooled robot, or is gone. It backs the honest-AI after-commit trigger, which
-// drives one game at once rather than scanning the whole pool (RobotTurns). It leaves
-// EndgamePass false: honest-AI games move at once, so the endgame think-time shrink is a
-// human-mimicry concern computed only on the RobotTurns scan.
+// drives one game at once rather than scanning the whole pool (RobotTurns).
 func (s *Store) RobotTurnByGame(ctx context.Context, gameID uuid.UUID, ids []uuid.UUID) (RobotTurn, bool, error) {
 	if len(ids) == 0 {
 		return RobotTurn{}, false, nil
@@ -1175,79 +1078,6 @@ func robotTurnFrom(g model.Games, p model.GamePlayers) RobotTurn {
 	}
 }

-// fillEndgamePass marks the turns whose game is a dead-drawn endgame — its two most
-// recent committed moves are both passes, so the board and racks are frozen and the
-// seated robot is bound to pass again — setting EndgamePass and OppLastMove from the
-// move journal so the driver can shorten the robot's think time. Turns whose game is
-// not in that state are left unchanged. A nil or empty slice is a no-op. It runs one
-// batched journal query for the whole scan, so it adds no per-game round trip.
-func (s *Store) fillEndgamePass(ctx context.Context, turns []RobotTurn) error {
-	if len(turns) == 0 {
-		return nil
-	}
-	ids := make([]uuid.UUID, len(turns))
-	for i := range turns {
-		ids[i] = turns[i].GameID
-	}
-	info, err := s.endgamePassInfo(ctx, ids)
-	if err != nil {
-		return err
-	}
-	for i := range turns {
-		if d, ok := info[turns[i].GameID]; ok {
-			turns[i].EndgamePass = true
-			turns[i].OppLastMove = d
-		}
-	}
-	return nil
-}
-
-// endgamePassInfo returns, for each of ids whose two most recent committed moves are
-// both passes, the human's think time on the most recent of them (the gap between the
-// last two journal entries' created_at). Games with fewer than two moves, or whose last
-// two are not both passes, are absent from the map. It reads the move journal only — no
-// schema change — mirroring the analytics.go duration reports. A negative gap (clock
-// skew) is floored to zero.
-func (s *Store) endgamePassInfo(ctx context.Context, ids []uuid.UUID) (map[uuid.UUID]time.Duration, error) {
-	if len(ids) == 0 {
-		return map[uuid.UUID]time.Duration{}, nil
-	}
-	const q = `
-SELECT q.game_id, q.secs FROM (
-  SELECT t.game_id,
-         bool_and(t.action = 'pass') AS both_pass,
-         COUNT(*) AS n,
-         EXTRACT(EPOCH FROM (MAX(t.created_at) - MIN(t.created_at))) AS secs
-  FROM (
-    SELECT m.game_id, m.action, m.created_at,
-           ROW_NUMBER() OVER (PARTITION BY m.game_id ORDER BY m.seq DESC) AS rn
-    FROM backend.game_moves m
-    WHERE m.game_id = ANY($1::uuid[])
-  ) t
-  WHERE t.rn <= 2
-  GROUP BY t.game_id
-) q
-WHERE q.n = 2 AND q.both_pass`
-	rows, err := s.db.QueryContext(ctx, q, uuidArrayLiteral(ids))
-	if err != nil {
-		return nil, fmt.Errorf("game: endgame pass info: %w", err)
-	}
-	defer rows.Close()
-	out := make(map[uuid.UUID]time.Duration, len(ids))
-	for rows.Next() {
-		var id uuid.UUID
-		var secs float64
-		if err := rows.Scan(&id, &secs); err != nil {
-			return nil, fmt.Errorf("game: scan endgame pass info: %w", err)
-		}
-		if secs < 0 {
-			secs = 0
-		}
-		out[id] = time.Duration(secs * float64(time.Second))
-	}
-	return out, rows.Err()
-}
-
 // GameVsAI reports whether a game is an honest-AI game (games.vs_ai) — a cheap
 // single-column read for the social chat/nudge gate, which must reject both in an
 // AI game even though it reports status 'active'. ErrNotFound when the game is gone.
@@ -105,7 +105,7 @@ const MaxActiveQuickGames = 10
 const aiPlayerName = "AI"

 // CreateParams describes a new game. Seats lists the seated accounts in turn
-// order (seat 0 moves first); lobby/matchmaking assembles it.
+// order (seat 0 moves first); lobby/matchmaking assembles it in a later stage.
 type CreateParams struct {
 	Variant        engine.Variant
 	Seats          []uuid.UUID
@@ -154,8 +154,6 @@ type Seat struct {
 	Seat      int
 	AccountID uuid.UUID
 	Score     int
-	// HintsUsed is the total hints the seat used this game — both the free per-game allowance
-	// and the wallet-charged ones (the first HintsPerPlayer being the allowance).
 	HintsUsed int
 	IsWinner  bool
 	// DisplayName is the seat's display-name snapshot, captured when the seat was taken
@@ -184,18 +182,6 @@ func (g Game) seatOf(accountID uuid.UUID) (int, bool) {
 	return 0, false
 }

-// seatedIn reports whether accountID holds a seat in seats. It backs the read-side
-// membership check against the cached, immutable seat list, so a hot read can skip
-// loading the game from the store.
-func seatedIn(seats []Seat, accountID uuid.UUID) bool {
-	for _, s := range seats {
-		if s.AccountID == accountID {
-			return true
-		}
-	}
-	return false
-}
-
 // MoveResult is the outcome of a committed transition: the decoded move and the
 // post-move game, plus the actor's own refilled rack and the bag size after the draw
 // (Rack/BagLen), so the mover renders the next state from the response without a
@@ -280,15 +266,6 @@ type RobotTurn struct {
 	// VsAI is true when the game is an honest-AI game: the driver then makes the
 	// robot move immediately, with no sleep window and no proactive nudge.
 	VsAI bool
-	// EndgamePass is true when the two most recent committed moves are both passes, so
-	// the board and racks are frozen and the robot is bound to pass again. The driver
-	// then shortens the robot's think time (see robot.endgamePassDelay) so a decided
-	// game is not dragged out. It is false until at least two moves exist.
-	EndgamePass bool
-	// OppLastMove is the human's think time on the most recent move — the gap between
-	// the last two journal entries — used to scale the shortened endgame think time. It
-	// is meaningful only when EndgamePass is true (zero otherwise).
-	OppLastMove time.Duration
 }

 // Complaint is a word-check complaint in the admin review queue. It is filed
@@ -110,139 +110,38 @@ func identityConfirmed(t *testing.T, kind, externalID string) bool {
 }

 // TestProvisionTelegramSeedsNewAccountOnly checks that Telegram first contact
-// seeds the new account's language, display name and time zone from the launch
-// fields / detected offset, defaults the in-app-only flag on, and never overwrites
-// an existing account on a later login (language and zone seeding).
+// seeds the new account's language and display name from the launch fields,
+// defaults the in-app-only flag on, and never overwrites an existing account on a
+// later login (language seeding).
 func TestProvisionTelegramSeedsNewAccountOnly(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	ext := "tg-" + uuid.NewString()

-	acc, created, err := store.ProvisionTelegram(ctx, ext, "ru-RU", "thehandle", "Иван", "+03:00")
+	acc, err := store.ProvisionTelegram(ctx, ext, "ru-RU", "thehandle", "Иван")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
-	if !created {
-		t.Error("created = false on first contact, want true")
-	}
 	if acc.PreferredLanguage != "ru" {
 		t.Errorf("PreferredLanguage = %q, want ru", acc.PreferredLanguage)
 	}
 	if acc.DisplayName != "Иван" {
 		t.Errorf("DisplayName = %q, want Иван", acc.DisplayName)
 	}
-	if acc.TimeZone != "+03:00" {
-		t.Errorf("TimeZone = %q, want the seeded +03:00", acc.TimeZone)
-	}
 	if !acc.NotificationsInAppOnly {
 		t.Error("NotificationsInAppOnly should default to true")
 	}

 	// A later login with different fields returns the same account, unchanged.
-	again, created, err := store.ProvisionTelegram(ctx, ext, "en", "other", "Other", "+09:00")
+	again, err := store.ProvisionTelegram(ctx, ext, "en", "other", "Other")
 	if err != nil {
 		t.Fatalf("re-provision telegram: %v", err)
 	}
-	if created {
-		t.Error("created = true on a repeat login, want false")
-	}
 	if again.ID != acc.ID {
 		t.Errorf("re-provision id = %s, want %s", again.ID, acc.ID)
 	}
-	if again.PreferredLanguage != "ru" || again.DisplayName != "Иван" || again.TimeZone != "+03:00" {
-		t.Errorf("existing account overwritten: lang=%q name=%q tz=%q", again.PreferredLanguage, again.DisplayName, again.TimeZone)
-	}
-}
-
-// TestProvisionVKSeedsNewAccountOnly checks VK first contact seeds the new account's
-// language, display name and time zone from the launch fields / detected offset, records
-// the vk identity as confirmed (a platform identity), and never overwrites an existing
-// account on a later launch. It also exercises the widened identities.kind CHECK — a
-// 'vk' row must insert.
-func TestProvisionVKSeedsNewAccountOnly(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	ext := "vk-" + uuid.NewString()
-
-	acc, created, err := store.ProvisionVK(ctx, ext, "ru", "Иван Петров", "+03:00")
-	if err != nil {
-		t.Fatalf("provision vk: %v", err)
-	}
-	if !created {
-		t.Error("created = false on first contact, want true")
-	}
-	if acc.PreferredLanguage != "ru" {
-		t.Errorf("PreferredLanguage = %q, want ru", acc.PreferredLanguage)
-	}
-	if acc.DisplayName != "Иван Петров" {
-		t.Errorf("DisplayName = %q, want Иван Петров", acc.DisplayName)
-	}
-	if acc.TimeZone != "+03:00" {
-		t.Errorf("TimeZone = %q, want the seeded +03:00", acc.TimeZone)
-	}
-	// A VK identity is a platform identity: confirmed on insert.
-	if !identityConfirmed(t, account.KindVK, ext) {
-		t.Error("vk identity must be confirmed")
-	}
-
-	// A later launch with different fields returns the same account, unchanged.
-	again, created, err := store.ProvisionVK(ctx, ext, "en", "Other Name", "+09:00")
-	if err != nil {
-		t.Fatalf("re-provision vk: %v", err)
-	}
-	if created {
-		t.Error("created = true on a repeat launch, want false")
-	}
-	if again.ID != acc.ID {
-		t.Errorf("re-provision id = %s, want %s", again.ID, acc.ID)
-	}
-	if again.PreferredLanguage != "ru" || again.DisplayName != "Иван Петров" || again.TimeZone != "+03:00" {
-		t.Errorf("existing account overwritten: lang=%q name=%q tz=%q", again.PreferredLanguage, again.DisplayName, again.TimeZone)
-	}
-}
-
-// TestProvisionSeedsTimeZone checks the create-time time-zone seed across paths: a
-// valid detected offset is stored verbatim (even "+00:00", which is deliberately
-// distinct from the unset "UTC" default), a guest is seeded the same way, and a
-// missing or malformed offset falls back to the "UTC" column default rather than
-// being guessed at.
-func TestProvisionSeedsTimeZone(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-
-	// A detected zero offset is written as "+00:00" — we record that the zone was
-	// detected (and equals UTC), distinct from the "UTC" default meaning "unknown".
-	utcDetected, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Zero", "+00:00")
-	if err != nil {
-		t.Fatalf("provision telegram +00:00: %v", err)
-	}
-	if utcDetected.TimeZone != "+00:00" {
-		t.Errorf("TimeZone = %q, want the seeded +00:00", utcDetected.TimeZone)
-	}
-
-	// A malformed offset is dropped: the account keeps the UTC default.
-	bad, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Bad", "not-a-zone")
-	if err != nil {
-		t.Fatalf("provision telegram bad tz: %v", err)
-	}
-	if bad.TimeZone != "UTC" {
-		t.Errorf("TimeZone = %q, want UTC fallback for a malformed offset", bad.TimeZone)
-	}
-
-	// A guest is seeded its detected offset; an empty one keeps the UTC default.
-	guest, err := store.ProvisionGuest(ctx, "-05:30")
-	if err != nil {
-		t.Fatalf("provision guest: %v", err)
-	}
-	if guest.TimeZone != "-05:30" {
-		t.Errorf("guest TimeZone = %q, want the seeded -05:30", guest.TimeZone)
-	}
-	plainGuest, err := store.ProvisionGuest(ctx, "")
-	if err != nil {
-		t.Fatalf("provision plain guest: %v", err)
-	}
-	if plainGuest.TimeZone != "UTC" {
-		t.Errorf("plain guest TimeZone = %q, want UTC default", plainGuest.TimeZone)
+	if again.PreferredLanguage != "ru" || again.DisplayName != "Иван" {
+		t.Errorf("existing account overwritten: lang=%q name=%q", again.PreferredLanguage, again.DisplayName)
 	}
 }

@@ -251,7 +150,7 @@ func TestProvisionSeedsTimeZone(t *testing.T) {
 // language CHECK.
 func TestProvisionTelegramUnknownLanguageDefaults(t *testing.T) {
 	ctx := context.Background()
-	acc, _, err := account.NewStore(testDB).ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "fr", "", "", "")
+	acc, err := account.NewStore(testDB).ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "fr", "", "")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -260,6 +159,46 @@ func TestProvisionTelegramUnknownLanguageDefaults(t *testing.T) {
 	}
 }

+// TestServiceLanguageRoundTrip checks SetServiceLanguage persists the push-routing
+// language (the bot a Telegram user last signed in through): a fresh account has
+// none, a set value reads back, a later login overwrites it (last-login-wins), and
+// an empty value is a no-op. The push-target route coalesces it with the preferred
+// language.
+func TestServiceLanguageRoundTrip(t *testing.T) {
+	ctx := context.Background()
+	store := account.NewStore(testDB)
+	acc, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player")
+	if err != nil {
+		t.Fatalf("provision telegram: %v", err)
+	}
+	if acc.ServiceLanguage != "" {
+		t.Errorf("fresh ServiceLanguage = %q, want empty", acc.ServiceLanguage)
+	}
+
+	if err := store.SetServiceLanguage(ctx, acc.ID, "ru"); err != nil {
+		t.Fatalf("set service language: %v", err)
+	}
+	if got, err := store.GetByID(ctx, acc.ID); err != nil {
+		t.Fatalf("get by id: %v", err)
+	} else if got.ServiceLanguage != "ru" {
+		t.Errorf("ServiceLanguage = %q, want ru", got.ServiceLanguage)
+	}
+
+	// A later login through the other bot updates it; a subsequent empty value
+	// (a non-Telegram login) leaves it unchanged.
+	if err := store.SetServiceLanguage(ctx, acc.ID, "en"); err != nil {
+		t.Fatalf("update service language: %v", err)
+	}
+	if err := store.SetServiceLanguage(ctx, acc.ID, ""); err != nil {
+		t.Fatalf("noop service language: %v", err)
+	}
+	if got, err := store.GetByID(ctx, acc.ID); err != nil {
+		t.Fatalf("get by id: %v", err)
+	} else if got.ServiceLanguage != "en" {
+		t.Errorf("ServiceLanguage after update+noop = %q, want en", got.ServiceLanguage)
+	}
+}
+
 // TestHighRateFlagRoundTrip covers the soft high-rate marker: a fresh account
 // is unflagged, FlagHighRate stamps it exactly once (a second sustained episode
 // never moves the timestamp), ClearHighRateFlag reverses it, and a re-flag after
@@ -267,7 +206,7 @@ func TestProvisionTelegramUnknownLanguageDefaults(t *testing.T) {
 func TestHighRateFlagRoundTrip(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player", "")
+	acc, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -323,7 +262,7 @@ func TestIdentityExternalID(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	ext := "tg-" + uuid.NewString()
-	acc, _, err := store.ProvisionTelegram(ctx, ext, "en", "", "Tg User", "")
+	acc, err := store.ProvisionTelegram(ctx, ext, "en", "", "Tg User")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -348,7 +287,7 @@ func TestIdentityExternalID(t *testing.T) {
 func TestNotificationsInAppOnlyRoundTrip(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player", "")
+	acc, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player")
 	if err != nil {
 		t.Fatalf("provision telegram: %v", err)
 	}
@@ -360,7 +299,6 @@ func TestNotificationsInAppOnlyRoundTrip(t *testing.T) {
 		PreferredLanguage:      "en",
 		TimeZone:               "UTC",
 		NotificationsInAppOnly: false,
-		VariantPreferences:     []string{"erudit_ru"},
 	})
 	if err != nil {
 		t.Fatalf("update profile: %v", err)
@@ -206,12 +206,6 @@ func TestConsoleGameDetailRobotSchedule(t *testing.T) {
 	if !strings.Contains(body, "~40%") {
 		t.Error("robot play-to-win target caption missing")
 	}
-	if !strings.Contains(body, "First-move draw") {
-		t.Error("first-move draw section missing from the game detail")
-	}
-	if !strings.Contains(body, `id="replay-board"`) {
-		t.Error("replay board container missing from the game detail")
-	}
 }

 // TestConsoleThrottledViewAndFlagClear drives the rate-limit surface end to
@@ -222,7 +216,7 @@ func TestConsoleGameDetailRobotSchedule(t *testing.T) {
 func TestConsoleThrottledViewAndFlagClear(t *testing.T) {
 	ctx := context.Background()
 	accounts := account.NewStore(testDB)
-	acc, _, err := accounts.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Throttled Player", "")
+	acc, err := accounts.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Throttled Player")
 	if err != nil {
 		t.Fatalf("provision: %v", err)
 	}
@@ -1,83 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-)
-
-// TestRemoveEmailIdentity erases an account's email identity but refuses when the
-// email is the account's only identity (which would leave it unreachable).
-func TestRemoveEmailIdentity(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-
-	// Email is the only identity → refuse.
-	solo, err := store.ProvisionEmail(ctx, "solo-"+uuid.NewString()+"@example.com", "", "en")
-	if err != nil {
-		t.Fatalf("provision email: %v", err)
-	}
-	if err := store.RemoveEmailIdentity(ctx, solo.ID); !errors.Is(err, account.ErrLastIdentity) {
-		t.Fatalf("remove last identity = %v, want ErrLastIdentity", err)
-	}
-
-	// Telegram + email → erase the email, keep Telegram.
-	tg, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision telegram: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, tg.ID, account.KindEmail, "dual-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	if err := store.RemoveEmailIdentity(ctx, tg.ID); err != nil {
-		t.Fatalf("remove email: %v", err)
-	}
-	ids, err := store.Identities(ctx, tg.ID)
-	if err != nil {
-		t.Fatalf("identities: %v", err)
-	}
-	if len(ids) != 1 || ids[0].Kind != account.KindTelegram {
-		t.Errorf("identities after erase = %+v, want only telegram", ids)
-	}
-}
-
-// TestListUsersEmailExact matches accounts strictly (exactly) by their email identity.
-func TestListUsersEmailExact(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	email := "find-" + uuid.NewString() + "@example.com"
-	acc, err := store.ProvisionEmail(ctx, email, "", "en")
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-
-	items, err := store.ListUsers(ctx, account.UserFilter{EmailExact: email}, 50, 0)
-	if err != nil {
-		t.Fatalf("list: %v", err)
-	}
-	found := false
-	for _, it := range items {
-		if it.ID == acc.ID {
-			found = true
-		}
-	}
-	if !found {
-		t.Error("the exact email filter did not find the account")
-	}
-
-	other, err := store.ListUsers(ctx, account.UserFilter{EmailExact: "nope-" + uuid.NewString() + "@example.com"}, 50, 0)
-	if err != nil {
-		t.Fatalf("list (no match): %v", err)
-	}
-	for _, it := range other {
-		if it.ID == acc.ID {
-			t.Error("a non-matching email filter must not return the account")
-		}
-	}
-}
@@ -256,8 +256,7 @@ func TestBannerSurvivesProfileUpdate(t *testing.T) {
 	id := provisionAccount(t)

 	body := `{"display_name":"Tester","preferred_language":"ru","time_zone":"UTC","away_start":"00:00",` +
-		`"away_end":"00:00","block_chat":false,"block_friend_requests":false,"notifications_in_app_only":true,` +
-		`"variant_preferences":["erudit_ru"]}`
+		`"away_end":"00:00","block_chat":false,"block_friend_requests":false,"notifications_in_app_only":true}`
 	rec := httptest.NewRecorder()
 	req := httptest.NewRequest(http.MethodPut, "/api/v1/user/profile", strings.NewReader(body))
 	req.Header.Set("X-User-ID", id.String())
@@ -1,322 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-	"scrabble/backend/internal/engine"
-	"scrabble/backend/internal/game"
-	"scrabble/backend/internal/notify"
-	"scrabble/backend/internal/social"
-)
-
-// TestBlockInstantReadsExistingUnread checks that blocking marks read any chat the blocked
-// user had left unread for the blocker in their shared games, so no stale unread badge
-// lingers for someone the blocker no longer sees.
-func TestBlockInstantReadsExistingUnread(t *testing.T) {
-	ctx := context.Background()
-	svc := newSocialService()
-	gameID, seats := newGameWithSeats(t, 2)
-	sender, viewer := seats[0], seats[1] // seat 0 moves first, so it may chat
-
-	if _, err := svc.PostMessage(ctx, gameID, sender, "good luck", ""); err != nil {
-		t.Fatalf("post: %v", err)
-	}
-	if unread, _ := svc.HasUnread(ctx, gameID, viewer); !unread {
-		t.Fatal("viewer should have the message unread before blocking")
-	}
-	if err := svc.Block(ctx, viewer, sender); err != nil {
-		t.Fatalf("block: %v", err)
-	}
-	if unread, _ := svc.HasUnread(ctx, gameID, viewer); unread {
-		t.Error("blocking should instant-read the blocked sender's prior unread message")
-	}
-}
-
-// TestChatFromBlockedIsBornReadAndNotDelivered checks the store-but-hide path for chat: a
-// message the blocked user sends is stored and visible to themselves, but is born read for
-// the blocker, never delivered to them, and hidden from their view.
-func TestChatFromBlockedIsBornReadAndNotDelivered(t *testing.T) {
-	ctx := context.Background()
-	svc := newSocialService()
-	pub := &capturePublisher{}
-	svc.SetNotifier(pub)
-	gameID, seats := newGameWithSeats(t, 2)
-	blocked, blocker := seats[0], seats[1] // seat 0 moves first, so the blocked user may chat
-
-	if err := svc.Block(ctx, blocker, blocked); err != nil {
-		t.Fatalf("block: %v", err)
-	}
-	if _, err := svc.PostMessage(ctx, gameID, blocked, "hello there", ""); err != nil {
-		t.Fatalf("blocked user's post = %v, want nil (it must look ordinary to them)", err)
-	}
-	if unread, _ := svc.HasUnread(ctx, gameID, blocker); unread {
-		t.Error("the blocked sender's message must be born read for the blocker")
-	}
-	if pub.delivered(blocker, notify.KindChatMessage) {
-		t.Error("the blocked sender's message must not be delivered to the blocker")
-	}
-	if msgs, _ := svc.Messages(ctx, gameID, blocker); len(msgs) != 0 {
-		t.Errorf("blocker still sees the blocked sender's message: %+v", msgs)
-	}
-	if msgs, _ := svc.Messages(ctx, gameID, blocked); len(msgs) != 1 {
-		t.Errorf("the blocked sender should see their own message, got %+v", msgs)
-	}
-}
-
-// TestChatToBlockedIsRejected checks the blocker-side guard: a player cannot post when their
-// only opponent is someone they have blocked (the composer is hidden client-side too).
-func TestChatToBlockedIsRejected(t *testing.T) {
-	ctx := context.Background()
-	svc := newSocialService()
-	gameID, seats := newGameWithSeats(t, 2)
-	blocker, blocked := seats[0], seats[1] // blocker moves first, so it is the one trying to chat
-
-	if err := svc.Block(ctx, blocker, blocked); err != nil {
-		t.Fatalf("block: %v", err)
-	}
-	if _, err := svc.PostMessage(ctx, gameID, blocker, "hi", ""); !errors.Is(err, social.ErrRecipientBlocked) {
-		t.Fatalf("chat to blocked opponent = %v, want ErrRecipientBlocked", err)
-	}
-}
-
-// TestNudgeFromBlockedIsBornReadAndNotDelivered checks the store-but-hide path for nudge: a
-// nudge the blocked user sends is recorded (so their once-per-hour cooldown applies, looking
-// ordinary to them) but is born read and never delivered to the blocker.
-func TestNudgeFromBlockedIsBornReadAndNotDelivered(t *testing.T) {
-	ctx := context.Background()
-	svc := newSocialService()
-	pub := &capturePublisher{}
-	svc.SetNotifier(pub)
-	gameID, seats := newGameWithSeats(t, 2)
-	blocker, blocked := seats[0], seats[1] // seat 0 awaited; the blocked seat-1 player nudges it
-
-	if err := svc.Block(ctx, blocker, blocked); err != nil {
-		t.Fatalf("block: %v", err)
-	}
-	if _, err := svc.Nudge(ctx, gameID, blocked); err != nil {
-		t.Fatalf("blocked user's nudge = %v, want nil (it must look ordinary to them)", err)
-	}
-	if unread, _ := svc.HasUnread(ctx, gameID, blocker); unread {
-		t.Error("the blocked sender's nudge must be born read for the blocker")
-	}
-	if pub.delivered(blocker, notify.KindNudge) {
-		t.Error("the blocked sender's nudge must not be delivered to the blocker")
-	}
-	// The nudge is still recorded, so the cooldown applies (the blocked user notices nothing).
-	if _, ok, _ := svc.LastNudgeAt(ctx, gameID, blocked); !ok {
-		t.Error("the suppressed nudge should still be recorded")
-	}
-}
-
-// TestNudgeToBlockedIsRejected checks the blocker-side guard: a player cannot nudge the
-// awaited opponent when they have blocked them.
-func TestNudgeToBlockedIsRejected(t *testing.T) {
-	ctx := context.Background()
-	svc := newSocialService()
-	gameID, seats := newGameWithSeats(t, 2)
-	blocked, blocker := seats[0], seats[1] // seat 0 awaited; the blocker (seat 1) tries to nudge it
-
-	if err := svc.Block(ctx, blocker, blocked); err != nil {
-		t.Fatalf("block: %v", err)
-	}
-	if _, err := svc.Nudge(ctx, gameID, blocker); !errors.Is(err, social.ErrRecipientBlocked) {
-		t.Fatalf("nudge to blocked opponent = %v, want ErrRecipientBlocked", err)
-	}
-}
-
-// TestBlockPublishesToBlockerOnly checks that block and unblock confirm to the blocker (so
-// their other sessions update in place) and never reach the blocked user.
-func TestBlockPublishesToBlockerOnly(t *testing.T) {
-	ctx := context.Background()
-	svc := newSocialService()
-	pub := &capturePublisher{}
-	svc.SetNotifier(pub)
-	blocker, blocked := provisionAccount(t), provisionAccount(t)
-
-	if err := svc.Block(ctx, blocker, blocked); err != nil {
-		t.Fatalf("block: %v", err)
-	}
-	if !pub.notified(blocker, notify.NotifyUserBlocked) {
-		t.Error("the blocker should receive a user_blocked event")
-	}
-	if pub.notified(blocked, notify.NotifyUserBlocked) {
-		t.Error("the blocked user must never receive a user_blocked event")
-	}
-	if err := svc.Unblock(ctx, blocker, blocked); err != nil {
-		t.Fatalf("unblock: %v", err)
-	}
-	if !pub.notified(blocker, notify.NotifyUserUnblocked) {
-		t.Error("the blocker should receive a user_unblocked event")
-	}
-	if pub.notified(blocked, notify.NotifyUserUnblocked) {
-		t.Error("the blocked user must never receive a user_unblocked event")
-	}
-}
-
-// TestMatchmakingExcludesBlockedPlayers checks auto-match never pairs two players with a
-// block between them (either direction), while an unblocked third player still joins.
-func TestMatchmakingExcludesBlockedPlayers(t *testing.T) {
-	ctx := context.Background()
-	clearOpenGames(t)
-	mm := newMatchmaker(t, newRobotService(t, newGameService()), 90*time.Second, 90*time.Second)
-	soc := newSocialService()
-	mm.SetBlocker(soc)
-	a, b, c := provisionAccount(t), provisionAccount(t), provisionAccount(t)
-
-	if err := soc.Block(ctx, a, b); err != nil {
-		t.Fatalf("block: %v", err)
-	}
-	// The block is seen from both sides — the exclusion set unions both directions.
-	if !contains(blockedWith(t, soc, a), b) || !contains(blockedWith(t, soc, b), a) {
-		t.Fatal("a block must appear in BlockedWith for both the blocker and the blocked")
-	}
-
-	// b opens a game awaiting an opponent.
-	r1, err := mm.Enqueue(ctx, b, engine.VariantEnglish, true)
-	if err != nil {
-		t.Fatalf("enqueue b: %v", err)
-	}
-	if r1.Matched {
-		t.Fatal("first enqueue must open a game, not match")
-	}
-	// a must not join b's game (a blocked b): it opens its own instead.
-	r2, err := mm.Enqueue(ctx, a, engine.VariantEnglish, true)
-	if err != nil {
-		t.Fatalf("enqueue a: %v", err)
-	}
-	if r2.Matched || r2.Game.ID == r1.Game.ID {
-		t.Fatalf("a joined the blocked player's game %s (matched %v), want a fresh game", r1.Game.ID, r2.Matched)
-	}
-	// A third, unblocked player joins b's still-open game (the oldest), proving the exclusion
-	// is specific to the blocked pair, not a blanket refusal.
-	r3, err := mm.Enqueue(ctx, c, engine.VariantEnglish, true)
-	if err != nil {
-		t.Fatalf("enqueue c: %v", err)
-	}
-	if !r3.Matched || r3.Game.ID != r1.Game.ID {
-		t.Fatalf("unblocked c = (game %s, matched %v), want it to join b's open game %s", r3.Game.ID, r3.Matched, r1.Game.ID)
-	}
-}
-
-// TestAdminSocialLists checks the admin user card's blocks / blocked-by / friends queries
-// return the full truth in both directions, including a friendship that a block overrides but
-// does not delete.
-func TestAdminSocialLists(t *testing.T) {
-	ctx := context.Background()
-	svc := newSocialService()
-	_, seats := newGameWithSeats(t, 2)
-	a, b := seats[0], seats[1]
-	if err := svc.SendFriendRequest(ctx, a, b); err != nil {
-		t.Fatalf("request: %v", err)
-	}
-	if err := svc.RespondFriendRequest(ctx, b, a, true); err != nil {
-		t.Fatalf("accept: %v", err)
-	}
-	if err := svc.Block(ctx, a, b); err != nil {
-		t.Fatalf("block: %v", err)
-	}
-
-	blocks, err := svc.AdminBlocksBy(ctx, a)
-	if err != nil {
-		t.Fatalf("admin blocks by: %v", err)
-	}
-	if len(blocks) != 1 || blocks[0].AccountID != b || blocks[0].At.IsZero() {
-		t.Errorf("a's blocks = %v, want [b] with a date", blocks)
-	}
-	blockedBy, err := svc.AdminBlockedBy(ctx, b)
-	if err != nil {
-		t.Fatalf("admin blocked by: %v", err)
-	}
-	if len(blockedBy) != 1 || blockedBy[0].AccountID != a {
-		t.Errorf("b's blocked-by = %v, want [a]", blockedBy)
-	}
-	// The friendship survives the block, so it still shows on both admin friend lists.
-	friendsA, err := svc.AdminFriends(ctx, a)
-	if err != nil {
-		t.Fatalf("admin friends: %v", err)
-	}
-	if len(friendsA) != 1 || friendsA[0].AccountID != b || friendsA[0].At.IsZero() {
-		t.Errorf("a's admin friends = %v, want [b] with a date", friendsA)
-	}
-	if friendsB, err := svc.AdminFriends(ctx, b); err != nil || len(friendsB) != 1 || friendsB[0].AccountID != a {
-		t.Errorf("b's admin friends = %v (err %v), want [a]", friendsB, err)
-	}
-}
-
-// TestRobotBlockIsPerGameAndMatchmakerImmune checks that blocking a disguised-robot opponent
-// is recorded per-game in robot_blocks — never in the blocks table or against the shared robot
-// account — so the matchmaker keeps the robot free, and that unblocking by the row id removes it.
-func TestRobotBlockIsPerGameAndMatchmakerImmune(t *testing.T) {
-	ctx := context.Background()
-	svc := newSocialService()
-	accs := account.NewStore(testDB)
-	human := provisionAccount(t)
-	robot, err := accs.ProvisionRobot(ctx, "robot-block-"+uuid.NewString(), "Robbie")
-	if err != nil {
-		t.Fatalf("provision robot: %v", err)
-	}
-	g, err := newGameService().Create(ctx, game.CreateParams{
-		Variant: engine.VariantEnglish, Seats: []uuid.UUID{human, robot.ID},
-		TurnTimeout: 24 * time.Hour, Seed: openingSeed(t),
-	})
-	if err != nil {
-		t.Fatalf("create game: %v", err)
-	}
-
-	if err := svc.BlockInGame(ctx, human, robot.ID, g.ID); err != nil {
-		t.Fatalf("block robot: %v", err)
-	}
-	rbs, err := svc.ListRobotBlocks(ctx, human)
-	if err != nil {
-		t.Fatalf("list robot blocks: %v", err)
-	}
-	if len(rbs) != 1 || rbs[0].GameID != g.ID {
-		t.Fatalf("robot blocks = %v, want one for game %s", rbs, g.ID)
-	}
-	if bl, _ := svc.ListBlocks(ctx, human); len(bl) != 0 {
-		t.Errorf("blocks table must stay empty for a robot block, got %v", bl)
-	}
-	if yes, _ := svc.IsBlocked(ctx, human, robot.ID); yes {
-		t.Error("the shared robot account must never be blocked")
-	}
-	// Matchmaking immunity: the robot is never in the caller's exclusion set, so the matchmaker
-	// keeps giving robots and the player can never be starved by blocking them.
-	if with, _ := svc.BlockedWith(ctx, human); contains(with, robot.ID) {
-		t.Error("a robot block must not put the robot in BlockedWith")
-	}
-	// Unblock by the robot_blocks row id removes it.
-	if err := svc.Unblock(ctx, human, rbs[0].ID); err != nil {
-		t.Fatalf("unblock robot: %v", err)
-	}
-	if rbs, _ := svc.ListRobotBlocks(ctx, human); len(rbs) != 0 {
-		t.Errorf("robot block not removed by unblock: %v", rbs)
-	}
-}
-
-// blockedWith reads the both-direction block set for id.
-func blockedWith(t *testing.T, soc *social.Service, id uuid.UUID) []uuid.UUID {
-	t.Helper()
-	ids, err := soc.BlockedWith(context.Background(), id)
-	if err != nil {
-		t.Fatalf("blocked with: %v", err)
-	}
-	return ids
-}
-
-// contains reports whether ids includes want.
-func contains(ids []uuid.UUID, want uuid.UUID) bool {
-	for _, id := range ids {
-		if id == want {
-			return true
-		}
-	}
-	return false
-}
@@ -1,315 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-	"go.uber.org/zap/zaptest"
-
-	"scrabble/backend/internal/account"
-	"scrabble/backend/internal/notify"
-	"scrabble/backend/internal/server"
-	"scrabble/backend/internal/session"
-)
-
-// chatAccessBody mirrors the backend's /internal/chat-access JSON for the test.
-type chatAccessBody struct {
-	ExternalID string `json:"external_id"`
-	Registered bool   `json:"registered"`
-	Eligible   bool   `json:"eligible"`
-}
-
-// chatAccess issues the gateway-internal chat-access query and asserts a 200.
-func chatAccess(t *testing.T, srv *server.Server, body string) chatAccessBody {
-	t.Helper()
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/internal/chat-access", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
-	srv.Handler().ServeHTTP(rec, req)
-	if rec.Code != http.StatusOK {
-		t.Fatalf("chat-access %s = %d: %s", body, rec.Code, rec.Body.String())
-	}
-	var b chatAccessBody
-	if err := json.Unmarshal(rec.Body.Bytes(), &b); err != nil {
-		t.Fatalf("decode chat-access: %v", err)
-	}
-	return b
-}
-
-// TestChatAccessResolver drives the gateway-internal eligibility resolver over HTTP:
-// the registered/suspended/chat_muted truth table by Telegram identity and by account
-// id, the suspension dominating the chat_muted role, an unknown identity reported
-// unregistered, and an account with no Telegram identity carrying an empty external_id.
-func TestChatAccessResolver(t *testing.T) {
-	ctx := context.Background()
-	accounts := account.NewStore(testDB)
-	srv := server.New(":0", server.Deps{Logger: zaptest.NewLogger(t), DB: testDB, Accounts: accounts})
-
-	ext := "tg-" + uuid.NewString()
-	acc, _, err := accounts.ProvisionTelegram(ctx, ext, "en", "", "Chatter", "")
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	id := acc.ID
-
-	byExt := func() chatAccessBody { return chatAccess(t, srv, `{"external_id":"`+ext+`"}`) }
-	byUser := func() chatAccessBody { return chatAccess(t, srv, `{"user_id":"`+id.String()+`"}`) }
-
-	// A registered, unsuspended, unmuted account is eligible by either address, and the
-	// account-id query resolves back to its Telegram identity.
-	if b := byExt(); !b.Registered || !b.Eligible || b.ExternalID != ext {
-		t.Fatalf("fresh by external_id = %+v, want registered+eligible+ext", b)
-	}
-	if b := byUser(); !b.Registered || !b.Eligible || b.ExternalID != ext {
-		t.Fatalf("fresh by user_id = %+v, want registered+eligible+ext", b)
-	}
-
-	// A suspension mutes; a lift restores.
-	if _, err := accounts.Suspend(ctx, id, nil, "", "", nil); err != nil {
-		t.Fatalf("suspend: %v", err)
-	}
-	if b := byExt(); !b.Registered || b.Eligible {
-		t.Fatalf("suspended = %+v, want registered but not eligible", b)
-	}
-	if err := accounts.LiftSuspension(ctx, id); err != nil {
-		t.Fatalf("lift: %v", err)
-	}
-	if b := byExt(); !b.Eligible {
-		t.Fatalf("after lift = %+v, want eligible", b)
-	}
-
-	// The chat_muted role mutes independently; a revoke restores.
-	if err := accounts.GrantRole(ctx, id, account.RoleChatMuted); err != nil {
-		t.Fatalf("grant chat_muted: %v", err)
-	}
-	if b := byExt(); !b.Registered || b.Eligible {
-		t.Fatalf("chat_muted = %+v, want registered but not eligible", b)
-	}
-
-	// Suspension dominates: while chat_muted is set, lifting a concurrent suspension
-	// must not re-grant chat (the role still mutes).
-	if _, err := accounts.Suspend(ctx, id, nil, "", "", nil); err != nil {
-		t.Fatalf("suspend over mute: %v", err)
-	}
-	if b := byExt(); b.Eligible {
-		t.Fatalf("suspended+muted = %+v, want not eligible", b)
-	}
-	if err := accounts.LiftSuspension(ctx, id); err != nil {
-		t.Fatalf("lift over mute: %v", err)
-	}
-	if b := byExt(); b.Eligible {
-		t.Fatalf("lifted but still muted = %+v, want not eligible", b)
-	}
-	if err := accounts.RevokeRole(ctx, id, account.RoleChatMuted); err != nil {
-		t.Fatalf("revoke chat_muted: %v", err)
-	}
-	if b := byExt(); !b.Eligible {
-		t.Fatalf("after revoke = %+v, want eligible", b)
-	}
-
-	// An unknown Telegram identity is unregistered (and thus left muted).
-	if b := chatAccess(t, srv, `{"external_id":"tg-missing-`+uuid.NewString()+`"}`); b.Registered || b.Eligible {
-		t.Fatalf("unknown identity = %+v, want neither registered nor eligible", b)
-	}
-
-	// An account with no Telegram identity (a guest) carries an empty external_id, so
-	// the gateway has nothing to gate.
-	guest := provisionGuest(t)
-	if b := chatAccess(t, srv, `{"user_id":"`+guest.String()+`"}`); b.ExternalID != "" || b.Registered {
-		t.Fatalf("guest by user_id = %+v, want empty external_id and not registered", b)
-	}
-
-	// A request naming neither address is a bad request.
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/internal/chat-access", strings.NewReader(`{}`))
-	req.Header.Set("Content-Type", "application/json")
-	srv.Handler().ServeHTTP(rec, req)
-	if rec.Code != http.StatusBadRequest {
-		t.Fatalf("empty query = %d, want 400", rec.Code)
-	}
-}
-
-// captureNotifier records every published intent so a test can assert which live
-// events a console action emitted.
-type captureNotifier struct {
-	mu      sync.Mutex
-	intents []notify.Intent
-}
-
-func (c *captureNotifier) Publish(in ...notify.Intent) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.intents = append(c.intents, in...)
-}
-
-// count returns how many intents of kind addressed to user were captured.
-func (c *captureNotifier) count(user uuid.UUID, kind string) int {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	n := 0
-	for _, in := range c.intents {
-		if in.UserID == user && in.Kind == kind {
-			n++
-		}
-	}
-	return n
-}
-
-// TestChatAccessPublishedOnModeration drives the admin console and asserts each
-// moderation action that can change chat eligibility — block, unblock, and the
-// chat_muted role grant/revoke — emits the chat_access_changed signal the gateway
-// turns into a chat-gate command.
-func TestChatAccessPublishedOnModeration(t *testing.T) {
-	notifier := &captureNotifier{}
-	srv := server.New(":0", server.Deps{
-		Logger:   zaptest.NewLogger(t),
-		DB:       testDB,
-		Accounts: account.NewStore(testDB),
-		Games:    newGameService(),
-		Registry: testRegistry,
-		DictDir:  dictDir(),
-		Notifier: notifier,
-	})
-	h := srv.Handler()
-	id := provisionAccount(t)
-	base := "http://admin.test/_gm/users/" + id.String()
-	const origin = "http://admin.test"
-
-	steps := []struct {
-		name, path, body string
-		want             string
-	}{
-		{"block", "/block", "duration=permanent", "Blocked"},
-		{"unblock", "/unblock", "", "Unblocked"},
-		{"grant chat_muted", "/grant-role", "role=chat_muted", "Role granted"},
-		{"revoke chat_muted", "/revoke-role", "role=chat_muted", "Role revoked"},
-	}
-	for i, s := range steps {
-		code, body := consoleDo(h, http.MethodPost, base+s.path, s.body, origin)
-		if code != http.StatusOK || !strings.Contains(body, s.want) {
-			t.Fatalf("%s = %d, has %q = %v", s.name, code, s.want, strings.Contains(body, s.want))
-		}
-		if got := notifier.count(id, notify.KindChatAccessChanged); got != i+1 {
-			t.Fatalf("after %s: chat_access_changed count = %d, want %d", s.name, got, i+1)
-		}
-	}
-}
-
-// TestChatAccessPublishedOnFirstRegistration checks that a Telegram first contact
-// (the sessions/telegram endpoint creating the account) emits chat_access_changed —
-// the re-grant for a user who joined the moderated chat before registering — and that
-// a repeat login does not re-emit.
-func TestChatAccessPublishedOnFirstRegistration(t *testing.T) {
-	notifier := &captureNotifier{}
-	srv := server.New(":0", server.Deps{
-		Logger:   zaptest.NewLogger(t),
-		DB:       testDB,
-		Accounts: account.NewStore(testDB),
-		Sessions: session.NewService(session.NewStore(testDB), session.NewCache()),
-		Notifier: notifier,
-	})
-	h := srv.Handler()
-	ext := "tg-" + uuid.NewString()
-
-	post := func() {
-		rec := httptest.NewRecorder()
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/internal/sessions/telegram",
-			strings.NewReader(`{"external_id":"`+ext+`","language_code":"en","first_name":"Reg"}`))
-		req.Header.Set("Content-Type", "application/json")
-		h.ServeHTTP(rec, req)
-		if rec.Code != http.StatusOK {
-			t.Fatalf("telegram auth = %d: %s", rec.Code, rec.Body.String())
-		}
-	}
-
-	post()
-	acc, err := account.NewStore(testDB).AccountByIdentity(context.Background(), account.KindTelegram, ext)
-	if err != nil {
-		t.Fatalf("lookup: %v", err)
-	}
-	if got := notifier.count(acc.ID, notify.KindChatAccessChanged); got != 1 {
-		t.Fatalf("first registration: chat_access_changed count = %d, want 1", got)
-	}
-	// A repeat login (the account already exists) must not re-emit.
-	post()
-	if got := notifier.count(acc.ID, notify.KindChatAccessChanged); got != 1 {
-		t.Fatalf("repeat login: chat_access_changed count = %d, want still 1", got)
-	}
-}
-
-// TestSuspensionsExpiredBetween checks the sweeper's window query: a non-lifted
-// temporary block whose expiry falls in the window is returned, while one outside the
-// window, a permanent block, and a lifted block are not.
-func TestSuspensionsExpiredBetween(t *testing.T) {
-	ctx := context.Background()
-	accounts := account.NewStore(testDB)
-
-	// A temporary block whose expiry already lapsed at a known instant.
-	tempID := provisionAccount(t)
-	expiry := time.Now().Add(-time.Hour).Truncate(time.Second)
-	if _, err := accounts.Suspend(ctx, tempID, &expiry, "", "", nil); err != nil {
-		t.Fatalf("suspend temp: %v", err)
-	}
-
-	contains := func(ids []uuid.UUID, want uuid.UUID) bool {
-		for _, id := range ids {
-			if id == want {
-				return true
-			}
-		}
-		return false
-	}
-
-	// A window straddling the expiry returns the account.
-	got, err := accounts.SuspensionsExpiredBetween(ctx, expiry.Add(-time.Minute), expiry.Add(time.Minute))
-	if err != nil {
-		t.Fatalf("expired between: %v", err)
-	}
-	if !contains(got, tempID) {
-		t.Fatalf("window over expiry missing the lapsed block %s", tempID)
-	}
-	// A window entirely after the expiry does not.
-	got, err = accounts.SuspensionsExpiredBetween(ctx, expiry.Add(time.Minute), expiry.Add(2*time.Minute))
-	if err != nil {
-		t.Fatalf("expired between (after): %v", err)
-	}
-	if contains(got, tempID) {
-		t.Fatalf("window after expiry should not return %s", tempID)
-	}
-
-	// A permanent block never appears, even in a wide window.
-	permID := provisionAccount(t)
-	if _, err := accounts.Suspend(ctx, permID, nil, "", "", nil); err != nil {
-		t.Fatalf("suspend perm: %v", err)
-	}
-	// A lifted block does not appear either. The block must still be in force when lifted
-	// (LiftSuspension only lifts in-force blocks), so its expiry is in the future and the
-	// wide window below still covers it — yet lifted_at excludes it.
-	liftID := provisionAccount(t)
-	liftExpiry := time.Now().Add(30 * time.Minute).Truncate(time.Second)
-	if _, err := accounts.Suspend(ctx, liftID, &liftExpiry, "", "", nil); err != nil {
-		t.Fatalf("suspend lift: %v", err)
-	}
-	if err := accounts.LiftSuspension(ctx, liftID); err != nil {
-		t.Fatalf("lift: %v", err)
-	}
-	wide, err := accounts.SuspensionsExpiredBetween(ctx, time.Now().Add(-2*time.Hour), time.Now().Add(time.Hour))
-	if err != nil {
-		t.Fatalf("expired between (wide): %v", err)
-	}
-	if contains(wide, permID) {
-		t.Fatalf("permanent block %s must not be reported as expired", permID)
-	}
-	if contains(wide, liftID) {
-		t.Fatalf("lifted block %s must not be reported as expired", liftID)
-	}
-}
@@ -16,8 +16,7 @@ import (
 )

 // TestChatUnreadAndMarkRead checks a text message marks every recipient seat unread (not the
-// sender), surfaces through HasUnread / UnreadGames and the message-level HasUnreadMessage /
-// UnreadMessageGames (it is a real message, not a nudge), and that MarkRead clears the reader's bit.
+// sender), surfaces through HasUnread / UnreadGames, and that MarkRead clears the reader's bit.
 func TestChatUnreadAndMarkRead(t *testing.T) {
 	ctx := context.Background()
 	svc := newSocialService()
@@ -38,15 +37,6 @@ func TestChatUnreadAndMarkRead(t *testing.T) {
 	} else if !set[gameID] {
 		t.Error("UnreadGames should include the game for the recipient")
 	}
-	// A text message also raises the message-level flags (it is not just a nudge).
-	if msg, _ := svc.HasUnreadMessage(ctx, gameID, seats[1]); !msg {
-		t.Error("recipient should have the message flagged as an unread message")
-	}
-	if set, err := svc.UnreadMessageGames(ctx, seats[1]); err != nil {
-		t.Fatalf("unread message games: %v", err)
-	} else if !set[gameID] {
-		t.Error("UnreadMessageGames should include the game for a text message")
-	}

 	// Reading it clears the recipient's bit and reports one entry marked.
 	if n, err := svc.MarkRead(ctx, gameID, seats[1]); err != nil {
@@ -65,8 +55,7 @@ func TestChatUnreadAndMarkRead(t *testing.T) {

 // TestNudgeUnreadTargetsOnlyToMove checks, in a three-player game, that a nudge marks ONLY the
 // awaited (to-move) seat unread — never the other waiting players. This is the owner's nudge
-// targeting invariant, now observable through the unread bitmask. It also checks a nudge raises
-// HasUnread but not the message-level flags, so the badge can colour it apart from a real message.
+// targeting invariant, now observable through the unread bitmask.
 func TestNudgeUnreadTargetsOnlyToMove(t *testing.T) {
 	ctx := context.Background()
 	svc := newSocialService()
@@ -79,13 +68,6 @@ func TestNudgeUnreadTargetsOnlyToMove(t *testing.T) {
 	if unread, _ := svc.HasUnread(ctx, gameID, seats[0]); !unread {
 		t.Error("the awaited seat should have the nudge unread")
 	}
-	// A nudge is not a message: it must not raise the message-level flags.
-	if msg, _ := svc.HasUnreadMessage(ctx, gameID, seats[0]); msg {
-		t.Error("a nudge must not be flagged as an unread message")
-	}
-	if set, _ := svc.UnreadMessageGames(ctx, seats[0]); set[gameID] {
-		t.Error("UnreadMessageGames must not include a game whose only unread entry is a nudge")
-	}
 	if unread, _ := svc.HasUnread(ctx, gameID, seats[2]); unread {
 		t.Error("a non-awaited waiting seat must not receive the nudge")
 	}
@@ -138,65 +120,6 @@ func TestNudgeClearedByMove(t *testing.T) {
 	}
 }

-// TestGameCompletionExpiresNudgesKeepsChat checks that finishing a game by turn-timeout marks every
-// pending nudge in it read — the lobby's nudge badge is stale once the game is over — while leaving
-// real chat messages unread. It reproduces the reported bug: the timeout path commits the finish
-// directly, bypassing the move path's per-mover nudge clear, so without a completion-driven expiry
-// the awaited seat's nudge lingered as a badge on the finished game.
-func TestGameCompletionExpiresNudgesKeepsChat(t *testing.T) {
-	ctx := context.Background()
-	gameSvc := newGameService()
-	socialSvc := newSocialService()
-	gameSvc.SetNudgeExpirer(socialSvc.ExpireNudges)
-
-	seats := []uuid.UUID{provisionAccount(t), provisionAccount(t)}
-	g, err := gameSvc.Create(ctx, game.CreateParams{
-		Variant: engine.VariantEnglish, Seats: seats, TurnTimeout: time.Hour, Seed: openingSeed(t),
-	})
-	if err != nil {
-		t.Fatalf("create: %v", err)
-	}
-
-	// Seat 1 nudges the to-move seat 0 (the awaited player), and seat 0 posts a real chat message,
-	// which seat 1 then holds unread. So before the timeout each side has exactly one unread entry:
-	// seat 0 a nudge, seat 1 a message — letting HasUnread isolate each kind.
-	if _, err := socialSvc.Nudge(ctx, g.ID, seats[1]); err != nil {
-		t.Fatalf("nudge: %v", err)
-	}
-	if _, err := socialSvc.PostMessage(ctx, g.ID, seats[0], "good luck", ""); err != nil {
-		t.Fatalf("post message: %v", err)
-	}
-	if unread, _ := socialSvc.HasUnread(ctx, g.ID, seats[0]); !unread {
-		t.Fatal("seat 0 should hold the nudge unread before the timeout")
-	}
-	if unread, _ := socialSvc.HasUnread(ctx, g.ID, seats[1]); !unread {
-		t.Fatal("seat 1 should hold the message unread before the timeout")
-	}
-
-	// Age the turn past its deadline and time seat 0 out; an empty away window keeps this
-	// deterministic regardless of the wall clock. The sweep finishes the game through the direct
-	// commit path, never the move path.
-	backdate(t, g.ID, time.Now().UTC().Add(-2*time.Hour))
-	setAway(t, seats[0], "UTC", "00:00", "00:00")
-	if n, err := gameSvc.SweepTimeouts(ctx, time.Now().UTC()); err != nil || n < 1 {
-		t.Fatalf("sweep swept %d (err %v), want >= 1", n, err)
-	}
-	if status, reason := gameStatus(t, gameSvc, g.ID); status != game.StatusFinished || reason != "timeout" {
-		t.Fatalf("game not timed out: status %q reason %q", status, reason)
-	}
-
-	// The nudge is stale on a finished game and must be cleared; the chat message must survive.
-	if unread, _ := socialSvc.HasUnread(ctx, g.ID, seats[0]); unread {
-		t.Error("the nudge should be expired once the game has finished")
-	}
-	if unread, _ := socialSvc.HasUnread(ctx, g.ID, seats[1]); !unread {
-		t.Error("a real chat message must stay unread after the game finishes")
-	}
-	if msg, _ := socialSvc.HasUnreadMessage(ctx, g.ID, seats[1]); !msg {
-		t.Error("the chat message must remain flagged as an unread message after completion")
-	}
-}
-
 // TestChatToRobotIsBornRead checks a text message to a disguised robot opponent (a pooled
 // robot substituted into an ordinary, non-AI game) is born read: the robot never opens the
 // chat, so the message must not linger unread (skewing the count and the read metric).
@@ -1,322 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"database/sql"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/account"
-	"scrabble/backend/internal/accountdelete"
-	"scrabble/backend/internal/engine"
-	"scrabble/backend/internal/game"
-)
-
-// deletedFields reads a tombstoned account's retained real name and its deleted_at.
-func deletedFields(t *testing.T, accountID uuid.UUID) (name string, deletedAt sql.NullTime) {
-	t.Helper()
-	var dn sql.NullString
-	err := testDB.QueryRowContext(context.Background(),
-		"SELECT deleted_display_name, deleted_at FROM accounts WHERE account_id = $1", accountID).
-		Scan(&dn, &deletedAt)
-	if err != nil {
-		t.Fatalf("read deleted fields %s: %v", accountID, err)
-	}
-	return dn.String, deletedAt
-}
-
-// TestAnonymizeAndTombstone: deletion journals + frees the credentials, tombstones the
-// account, scrubs the live name while retaining the real one, and frees the creds for a
-// new account to reuse.
-func TestAnonymizeAndTombstone(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "handle", "Иван", "+03:00")
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	email := "del-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, email, true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	before, err := store.GetByID(ctx, acc.ID)
-	if err != nil {
-		t.Fatalf("load before: %v", err)
-	}
-
-	if err := deleter.AnonymizeAndTombstone(ctx, acc.ID); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-
-	// The live identities are gone.
-	if ids, err := store.Identities(ctx, acc.ID); err != nil || len(ids) != 0 {
-		t.Fatalf("identities after delete = %+v (err %v), want none", ids, err)
-	}
-	// Both credentials are journalled with reason=delete.
-	got := retainedRows(t, acc.ID)
-	if len(got) != 2 {
-		t.Fatalf("retained rows = %+v, want 2", got)
-	}
-	for _, r := range got {
-		if r.reason != "delete" {
-			t.Errorf("retained reason = %q, want delete", r.reason)
-		}
-	}
-	// The live name is scrubbed; the real one is retained; deleted_at is set.
-	after, err := store.GetByID(ctx, acc.ID)
-	if err != nil {
-		t.Fatalf("load after: %v", err)
-	}
-	if after.DisplayName != accountdelete.AnonymizedName {
-		t.Errorf("live display name = %q, want %q", after.DisplayName, accountdelete.AnonymizedName)
-	}
-	name, deletedAt := deletedFields(t, acc.ID)
-	if name != before.DisplayName {
-		t.Errorf("retained name = %q, want %q", name, before.DisplayName)
-	}
-	if !deletedAt.Valid || time.Since(deletedAt.Time) > time.Minute {
-		t.Errorf("deleted_at = %+v, want a recent timestamp", deletedAt)
-	}
-	// The credentials are free: a new account can claim the same email.
-	other, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Other", "")
-	if err != nil {
-		t.Fatalf("provision other: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, other.ID, account.KindEmail, email, true); err != nil {
-		t.Fatalf("email should be free after deletion, got: %v", err)
-	}
-}
-
-// TestDeletionDossierReaders: after deletion the admin readers expose the credential
-// journal and the tombstone dossier.
-func TestDeletionDossierReaders(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	acc, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "ru", "handle", "Иван", "+03:00")
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, "dos-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	if err := deleter.AnonymizeAndTombstone(ctx, acc.ID); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-
-	rets, err := store.RetainedIdentities(ctx, acc.ID)
-	if err != nil || len(rets) != 2 {
-		t.Fatalf("RetainedIdentities = (%+v, %v), want 2 rows", rets, err)
-	}
-	for _, r := range rets {
-		if r.Reason != "delete" {
-			t.Errorf("retained reason = %q, want delete", r.Reason)
-		}
-	}
-	info, err := store.DeletionInfo(ctx, acc.ID)
-	if err != nil {
-		t.Fatalf("DeletionInfo: %v", err)
-	}
-	if info.DeletedAt == nil {
-		t.Error("DeletionInfo.DeletedAt should be set")
-	}
-	if info.DeletedDisplayName != "Иван" {
-		t.Errorf("DeletionInfo.DeletedDisplayName = %q, want Иван", info.DeletedDisplayName)
-	}
-}
-
-// listHasID reports whether the user list contains accountID.
-func listHasID(items []account.UserListItem, id uuid.UUID) bool {
-	for _, it := range items {
-		if it.ID == id {
-			return true
-		}
-	}
-	return false
-}
-
-// TestUserListDeletedFilter: a tombstoned account is hidden from the default People list and
-// shown only under the Deleted scope.
-func TestUserListDeletedFilter(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	live, _, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Live", "")
-	if err != nil {
-		t.Fatalf("provision live: %v", err)
-	}
-	goneTg := "tg-" + uuid.NewString()
-	gone, _, err := store.ProvisionTelegram(ctx, goneTg, "en", "", "Gone", "")
-	if err != nil {
-		t.Fatalf("provision gone: %v", err)
-	}
-	goneEmail := "gone-" + uuid.NewString() + "@example.com"
-	if err := store.AttachIdentity(ctx, gone.ID, account.KindEmail, goneEmail, true); err != nil {
-		t.Fatalf("attach gone email: %v", err)
-	}
-	if err := deleter.AnonymizeAndTombstone(ctx, gone.ID); err != nil {
-		t.Fatalf("delete: %v", err)
-	}
-
-	people, err := store.ListUsers(ctx, account.UserFilter{}, 5000, 0)
-	if err != nil {
-		t.Fatalf("list people: %v", err)
-	}
-	if listHasID(people, gone.ID) {
-		t.Error("a deleted account must not appear in the default People list")
-	}
-	if !listHasID(people, live.ID) {
-		t.Error("a live account must appear in the default People list")
-	}
-	deleted, err := store.ListUsers(ctx, account.UserFilter{Deleted: true}, 5000, 0)
-	if err != nil {
-		t.Fatalf("list deleted: %v", err)
-	}
-	if !listHasID(deleted, gone.ID) {
-		t.Error("a deleted account must appear in the Deleted list")
-	}
-	if listHasID(deleted, live.ID) {
-		t.Error("a live account must not appear in the Deleted list")
-	}
-
-	// A search spans both lists and reaches the retention journal: a deleted account is
-	// still found by the email and external id it held (both moved to retained_identities
-	// on deletion, out of the live identities table).
-	byEmail, err := store.ListUsers(ctx, account.UserFilter{EmailExact: goneEmail}, 5000, 0)
-	if err != nil {
-		t.Fatalf("search by email: %v", err)
-	}
-	if !listHasID(byEmail, gone.ID) {
-		t.Error("a deleted account must be found by the email it held (retention journal)")
-	}
-	byExt, err := store.ListUsers(ctx, account.UserFilter{ExternalIDMask: goneTg}, 5000, 0)
-	if err != nil {
-		t.Fatalf("search by external id: %v", err)
-	}
-	if !listHasID(byExt, gone.ID) {
-		t.Error("a deleted account must be found by the external id it held (retention journal)")
-	}
-}
-
-// TestConfirmCodeClearsGuest: confirming an email on a guest via ConfirmCode promotes it to
-// a durable account (defence-in-depth — no confirmed-email path leaves is_guest set).
-func TestConfirmCodeClearsGuest(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	guest, err := store.ProvisionGuest(ctx, "")
-	if err != nil {
-		t.Fatalf("provision guest: %v", err)
-	}
-	email := "cc-" + uuid.NewString() + "@example.com"
-	if err := svc.RequestCode(ctx, guest.ID, email); err != nil {
-		t.Fatalf("request code: %v", err)
-	}
-	if _, err := svc.ConfirmCode(ctx, guest.ID, email, sixDigit.FindString(mailer.lastBody)); err != nil {
-		t.Fatalf("confirm code: %v", err)
-	}
-	after, err := store.GetByID(ctx, guest.ID)
-	if err != nil {
-		t.Fatalf("load: %v", err)
-	}
-	if after.IsGuest {
-		t.Error("confirming an email must clear the guest flag")
-	}
-}
-
-// TestDropAllRobotGames drops the deletee's solo vs-AI game but keeps a game with a human
-// opponent.
-func TestDropAllRobotGames(t *testing.T) {
-	ctx := context.Background()
-	gsvc := newGameService()
-	robots := newRobotService(t, gsvc)
-	if err := robots.EnsurePool(ctx); err != nil {
-		t.Fatalf("ensure pool: %v", err)
-	}
-	mm := newMatchmaker(t, robots, time.Minute, 0)
-	deleter := accountdelete.NewDeleter(testDB)
-
-	user := provisionAccount(t)
-	other := provisionAccount(t)
-
-	aiRes, err := mm.StartVsAI(ctx, user, engine.VariantEnglish, true)
-	if err != nil {
-		t.Fatalf("start vs AI: %v", err)
-	}
-	humanGame, err := gsvc.Create(ctx, game.CreateParams{
-		Variant: engine.VariantEnglish, Seats: []uuid.UUID{user, other}, TurnTimeout: time.Hour, Seed: 1,
-	})
-	if err != nil {
-		t.Fatalf("create human game: %v", err)
-	}
-
-	n, err := deleter.DropAllRobotGames(ctx, user)
-	if err != nil {
-		t.Fatalf("drop: %v", err)
-	}
-	if n != 1 {
-		t.Fatalf("dropped %d games, want 1 (the vs-AI game)", n)
-	}
-	if _, err := gsvc.GameByID(ctx, aiRes.Game.ID); err == nil {
-		t.Error("the vs-AI game should be dropped")
-	}
-	if _, err := gsvc.GameByID(ctx, humanGame.ID); err != nil {
-		t.Errorf("the human game should be kept, got: %v", err)
-	}
-}
-
-// TestDeleteStepUpEmail: an email account's delete code verifies (wrong code rejected, no
-// deeplink in the mail); a platform-only account has no email and cannot request a code.
-func TestDeleteStepUpEmail(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-
-	acc, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision: %v", err)
-	}
-	if err := store.AttachIdentity(ctx, acc.ID, account.KindEmail, "del-"+uuid.NewString()+"@example.com", true); err != nil {
-		t.Fatalf("attach email: %v", err)
-	}
-	if has, err := svc.HasEmail(ctx, acc.ID); err != nil || !has {
-		t.Fatalf("HasEmail = (%v, %v), want true", has, err)
-	}
-	if err := svc.RequestDeleteCode(ctx, acc.ID); err != nil {
-		t.Fatalf("request delete code: %v", err)
-	}
-	if strings.Contains(mailer.lastBody, "/confirm/") {
-		t.Error("a delete email must not carry a one-tap deeplink")
-	}
-	code := sixDigit.FindString(mailer.lastBody)
-	if err := svc.VerifyDeleteCode(ctx, acc.ID, "000000"); err == nil {
-		t.Error("a wrong delete code must be rejected")
-	}
-	if err := svc.VerifyDeleteCode(ctx, acc.ID, code); err != nil {
-		t.Fatalf("verify correct delete code: %v", err)
-	}
-
-	noEmail, err := store.ProvisionByIdentity(ctx, account.KindTelegram, "tg-"+uuid.NewString())
-	if err != nil {
-		t.Fatalf("provision no-email: %v", err)
-	}
-	if has, _ := svc.HasEmail(ctx, noEmail.ID); has {
-		t.Error("HasEmail must be false for a platform-only account")
-	}
-	if err := svc.RequestDeleteCode(ctx, noEmail.ID); !errors.Is(err, account.ErrNoEmail) {
-		t.Errorf("request delete for no-email account = %v, want ErrNoEmail", err)
-	}
-}
@@ -134,13 +134,11 @@ func TestDictionaryUpdateFlow(t *testing.T) {
 // newGameServiceOn builds a game service over the shared pool but a caller-supplied
 // dictionary directory, version and registry, for the isolated dictionary tests.
 func newGameServiceOn(dir, version string, reg *engine.Registry) *game.Service {
-	svc := game.NewService(
+	return game.NewService(
 		game.NewStore(testDB), account.NewStore(testDB), reg,
 		game.Config{DictDir: dir, DictVersion: version, TimeoutSweepInterval: time.Minute, CacheTTL: time.Hour},
 		zap.NewNop(),
 	)
-	svc.SetFirstMoveEntropy(seatZeroFirstMove)
-	return svc
 }

 // seedDawgs copies the committed DAWG of every variant from src into dst (flat).
@@ -6,7 +6,6 @@ import (
 	"context"
 	"errors"
 	"regexp"
-	"slices"
 	"testing"
 	"time"

@@ -19,8 +18,8 @@ import (
 // recover the confirm-code from the body.
 type capturingMailer struct{ lastBody string }

-func (m *capturingMailer) Send(_ context.Context, msg account.Message) error {
-	m.lastBody = msg.Text
+func (m *capturingMailer) Send(_ context.Context, _, _, body string) error {
+	m.lastBody = body
 	return nil
 }

@@ -32,7 +31,7 @@ func TestEmailConfirmFlow(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)

 	acc := provisionAccount(t)
 	email := "user-" + uuid.NewString() + "@example.com"
@@ -62,12 +61,12 @@ func TestEmailConfirmFlow(t *testing.T) {
 }

 // TestEmailAlreadyTakenByAnotherAccount refuses to bind an email confirmed by a
-// different account (combining two accounts is the separate link/merge flow).
+// different account (merge is a later stage).
 func TestEmailAlreadyTakenByAnotherAccount(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)

 	owner := provisionAccount(t)
 	email := "taken-" + uuid.NewString() + "@example.com"
@@ -89,7 +88,7 @@ func TestEmailCodeExpires(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)

 	acc := provisionAccount(t)
 	email := "expire-" + uuid.NewString() + "@example.com"
@@ -111,7 +110,7 @@ func TestEmailTooManyAttempts(t *testing.T) {
 	ctx := context.Background()
 	store := account.NewStore(testDB)
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(store, mailer)

 	acc := provisionAccount(t)
 	email := "lock-" + uuid.NewString() + "@example.com"
@@ -135,20 +134,12 @@ func TestUpdateProfilePersists(t *testing.T) {
 	store := account.NewStore(testDB)
 	acc := provisionAccount(t)

-	// A fresh account defaults to Erudit only (the DB-level column default).
-	if def, err := store.GetByID(ctx, acc); err != nil {
-		t.Fatalf("get default: %v", err)
-	} else if want := []string{"erudit_ru"}; !slices.Equal(def.VariantPreferences, want) {
-		t.Errorf("default variant preferences = %v, want %v", def.VariantPreferences, want)
-	}
-
 	updated, err := store.UpdateProfile(ctx, acc, account.ProfileUpdate{
 		DisplayName:         "Kaya",
 		PreferredLanguage:   "ru",
 		TimeZone:            "Europe/Moscow",
 		BlockChat:           true,
 		BlockFriendRequests: true,
-		VariantPreferences:  []string{"scrabble_en", "erudit_ru"},
 	})
 	if err != nil {
 		t.Fatalf("update profile: %v", err)
@@ -166,10 +157,6 @@ func TestUpdateProfilePersists(t *testing.T) {
 	if reloaded.TimeZone != "Europe/Moscow" || !reloaded.BlockChat {
 		t.Errorf("profile did not persist: %+v", reloaded)
 	}
-	// The text[] column round-trips and is stored canonically (Erudit-first).
-	if want := []string{"erudit_ru", "scrabble_en"}; !slices.Equal(reloaded.VariantPreferences, want) {
-		t.Errorf("variant preferences = %v, want %v", reloaded.VariantPreferences, want)
-	}
 }

 // TestUpdateProfileOffsetTimezone checks the UTC-offset timezone: it is
@@ -183,7 +170,6 @@ func TestUpdateProfileOffsetTimezone(t *testing.T) {
 		DisplayName:       "Kaya",
 		PreferredLanguage: "en",
 		TimeZone:          "+03:00",
-		VariantPreferences: []string{"erudit_ru"},
 	})
 	if err != nil {
 		t.Fatalf("update with offset timezone: %v", err)
@@ -203,10 +189,10 @@ func TestUpdateProfileOffsetTimezone(t *testing.T) {
 func TestEmailLoginFlow(t *testing.T) {
 	ctx := context.Background()
 	mailer := &capturingMailer{}
-	svc := account.NewEmailService(account.NewStore(testDB), mailer, "https://erudit-game.ru")
+	svc := account.NewEmailService(account.NewStore(testDB), mailer)
 	email := "login-" + uuid.NewString() + "@example.com"

-	accountID, err := svc.RequestLoginCode(ctx, email, "+02:00", "en")
+	accountID, err := svc.RequestLoginCode(ctx, email)
 	if err != nil {
 		t.Fatalf("request login code: %v", err)
 	}
@@ -225,15 +211,12 @@ func TestEmailLoginFlow(t *testing.T) {
 	if acc.IsGuest {
 		t.Error("an email account must be durable, not a guest")
 	}
-	if acc.TimeZone != "+02:00" {
-		t.Errorf("TimeZone = %q, want the +02:00 seeded at the request step", acc.TimeZone)
-	}
 	if !identityConfirmed(t, account.KindEmail, email) {
 		t.Error("the email identity must be confirmed after login")
 	}

 	// A second login for the same email is the returning user: same account.
-	if _, err := svc.RequestLoginCode(ctx, email, "", "ru"); err != nil {
+	if _, err := svc.RequestLoginCode(ctx, email); err != nil {
 		t.Fatalf("second request: %v", err)
 	}
 	acc2, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody))
@@ -244,182 +227,3 @@ func TestEmailLoginFlow(t *testing.T) {
 		t.Errorf("returning login account = %s, want %s", acc2.ID, accountID)
 	}
 }
-
-// TestEmailLoginProvisionsGuestUntilConfirmed covers the squat fix: an email-login
-// account is a guest (reapable, so an abandoned never-confirmed login frees its
-// address) until the code is confirmed, which promotes it to a durable account.
-func TestEmailLoginProvisionsGuestUntilConfirmed(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	email := "squat-" + uuid.NewString() + "@example.com"
-
-	id, err := svc.RequestLoginCode(ctx, email, "", "en")
-	if err != nil {
-		t.Fatalf("request login code: %v", err)
-	}
-	before, err := store.GetByID(ctx, id)
-	if err != nil {
-		t.Fatalf("get before confirm: %v", err)
-	}
-	if !before.IsGuest {
-		t.Error("an unconfirmed email-login account must be a guest so it is reapable")
-	}
-
-	if _, err := svc.LoginWithCode(ctx, email, sixDigit.FindString(mailer.lastBody)); err != nil {
-		t.Fatalf("login: %v", err)
-	}
-	after, err := store.GetByID(ctx, id)
-	if err != nil {
-		t.Fatalf("get after confirm: %v", err)
-	}
-	if after.IsGuest {
-		t.Error("confirming the login must clear the guest flag (promote to durable)")
-	}
-}
-
-// confirmToken extracts the one-tap deeplink token from the /app/#/confirm/<token> link
-// the branded email carries.
-var confirmToken = regexp.MustCompile(`/confirm/([A-Za-z0-9_-]+)`)
-
-func tokenFromMail(t *testing.T, body string) string {
-	t.Helper()
-	m := confirmToken.FindStringSubmatch(body)
-	if m == nil {
-		t.Fatalf("no confirm token in mail body %q", body)
-	}
-	return m[1]
-}
-
-// TestConfirmByTokenLogin: the one-tap deeplink token completes an email login,
-// clearing the guest flag.
-func TestConfirmByTokenLogin(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	email := "tok-login-" + uuid.NewString() + "@example.com"
-
-	id, err := svc.RequestLoginCode(ctx, email, "", "en")
-	if err != nil {
-		t.Fatalf("request login: %v", err)
-	}
-	res, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody))
-	if err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	if !res.IsLogin() || res.Account != id {
-		t.Fatalf("login result = %+v, want login for %s", res, id)
-	}
-	if !identityConfirmed(t, account.KindEmail, email) {
-		t.Error("email identity must be confirmed after the token login")
-	}
-	if acc, _ := store.GetByID(ctx, id); acc.IsGuest {
-		t.Error("the token login must clear the guest flag")
-	}
-}
-
-// TestConfirmByTokenLink: the token attaches a free email to the requesting account.
-func TestConfirmByTokenLink(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	acc := provisionAccount(t)
-	email := "tok-link-" + uuid.NewString() + "@example.com"
-
-	if err := svc.RequestLinkCode(ctx, acc, email); err != nil {
-		t.Fatalf("request link: %v", err)
-	}
-	res, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody))
-	if err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	if res.IsLogin() || res.NeedsMerge || res.Account != acc {
-		t.Fatalf("link result = %+v, want a plain link for %s", res, acc)
-	}
-	if !identityConfirmed(t, account.KindEmail, email) {
-		t.Error("email identity must be confirmed after the token link")
-	}
-}
-
-// TestConfirmByTokenLinkMerge: a token for an address owned by another account signals
-// a merge (leaving the token unconsumed for the interactive step).
-func TestConfirmByTokenLinkMerge(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	email := "tok-merge-" + uuid.NewString() + "@example.com"
-
-	owner := provisionAccount(t)
-	if err := svc.RequestCode(ctx, owner, email); err != nil {
-		t.Fatalf("owner request: %v", err)
-	}
-	if _, err := svc.ConfirmCode(ctx, owner, email, sixDigit.FindString(mailer.lastBody)); err != nil {
-		t.Fatalf("owner confirm: %v", err)
-	}
-
-	other := provisionAccount(t)
-	if err := svc.RequestLinkCode(ctx, other, email); err != nil {
-		t.Fatalf("link request: %v", err)
-	}
-	res, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody))
-	if err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	if !res.NeedsMerge || res.MergeOwner != owner {
-		t.Fatalf("merge result = %+v, want NeedsMerge with owner=%s", res, owner)
-	}
-}
-
-// TestEmailAccountSeedsDisplayName seeds a new email account's display name from the
-// email's local part, so an email login is not left nameless.
-func TestEmailAccountSeedsDisplayName(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	svc := account.NewEmailService(store, &capturingMailer{}, "https://erudit-game.ru")
-	local := "kaya-" + uuid.NewString()[:8]
-
-	id, err := svc.RequestLoginCode(ctx, local+"@example.com", "", "en")
-	if err != nil {
-		t.Fatalf("request login: %v", err)
-	}
-	acc, err := store.GetByID(ctx, id)
-	if err != nil {
-		t.Fatalf("get: %v", err)
-	}
-	if acc.DisplayName != local {
-		t.Errorf("display name = %q, want the email local part %q", acc.DisplayName, local)
-	}
-}
-
-// TestConfirmByTokenLinkClearsGuest: binding an email to a guest via the deeplink
-// promotes the guest to a durable account (the deeplink path must match the
-// code-based link flow, which clears the guest flag).
-func TestConfirmByTokenLinkClearsGuest(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	mailer := &capturingMailer{}
-	svc := account.NewEmailService(store, mailer, "https://erudit-game.ru")
-	guest, err := store.ProvisionGuest(ctx, "")
-	if err != nil {
-		t.Fatalf("provision guest: %v", err)
-	}
-	email := "guest-link-" + uuid.NewString() + "@example.com"
-
-	if err := svc.RequestLinkCode(ctx, guest.ID, email); err != nil {
-		t.Fatalf("request link: %v", err)
-	}
-	if _, err := svc.ConfirmByToken(ctx, tokenFromMail(t, mailer.lastBody)); err != nil {
-		t.Fatalf("confirm by token: %v", err)
-	}
-	acc, err := store.GetByID(ctx, guest.ID)
-	if err != nil {
-		t.Fatalf("get: %v", err)
-	}
-	if acc.IsGuest {
-		t.Error("linking an email via the deeplink must promote the guest to durable")
-	}
-}
@@ -38,7 +38,7 @@ func latestFeedbackID(t *testing.T, svc *feedback.Service, acc uuid.UUID) uuid.U
 func TestFeedbackGuestRejected(t *testing.T) {
 	svc := newFeedbackService()
 	guest := provisionGuest(t)
-	if err := svc.Submit(context.Background(), guest, "hi", nil, "", "web", "v1", "+05:00", "1.2.3.4"); !errors.Is(err, feedback.ErrGuestForbidden) {
+	if err := svc.Submit(context.Background(), guest, "hi", nil, "", "web", "1.2.3.4"); !errors.Is(err, feedback.ErrGuestForbidden) {
 		t.Fatalf("guest submit err = %v, want ErrGuestForbidden", err)
 	}
 }
@@ -48,11 +48,11 @@ func TestFeedbackSubmitGateAndReplyLifecycle(t *testing.T) {
 	svc := newFeedbackService()
 	acc := provisionAccount(t)

-	if err := svc.Submit(ctx, acc, "  please fix the board  ", []byte("PNGDATA"), "shot.png", "ios", "v1.2.0", "+03:00", "9.9.9.9"); err != nil {
+	if err := svc.Submit(ctx, acc, "  please fix the board  ", []byte("PNGDATA"), "shot.png", "ios", "9.9.9.9"); err != nil {
 		t.Fatalf("submit: %v", err)
 	}
 	// Anti-spam gate: a second message is refused while the first is unreviewed.
-	if err := svc.Submit(ctx, acc, "again", nil, "", "web", "", "", ""); !errors.Is(err, feedback.ErrPendingReview) {
+	if err := svc.Submit(ctx, acc, "again", nil, "", "web", ""); !errors.Is(err, feedback.ErrPendingReview) {
 		t.Fatalf("second submit err = %v, want ErrPendingReview", err)
 	}
 	if st, err := svc.State(ctx, acc); err != nil {
@@ -69,7 +69,7 @@ func TestFeedbackSubmitGateAndReplyLifecycle(t *testing.T) {
 	if m.Body != "please fix the board" { // trimmed
 		t.Fatalf("body = %q, want trimmed", m.Body)
 	}
-	if !m.HasAttachment || m.AttachmentName != "shot.png" || m.Channel != "ios" || m.SenderIP != "9.9.9.9" || m.Version != "v1.2.0" || m.BrowserTZ != "+03:00" {
+	if !m.HasAttachment || m.AttachmentName != "shot.png" || m.Channel != "ios" || m.SenderIP != "9.9.9.9" {
 		t.Fatalf("admin message = %+v", m)
 	}
 	if name, data, ok, err := svc.Attachment(ctx, id); err != nil || !ok || name != "shot.png" || string(data) != "PNGDATA" {
@@ -116,7 +116,7 @@ func TestFeedbackReplyHiddenAfterNewMessage(t *testing.T) {
 	acc := provisionAccount(t)

 	// msg1, replied → the player can send again and currently sees the reply.
-	if err := svc.Submit(ctx, acc, "first", nil, "", "web", "", "", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "first", nil, "", "web", ""); err != nil {
 		t.Fatalf("submit msg1: %v", err)
 	}
 	if err := svc.Reply(ctx, latestFeedbackID(t, svc, acc), "the answer"); err != nil {
@@ -130,7 +130,7 @@ func TestFeedbackReplyHiddenAfterNewMessage(t *testing.T) {

 	// Sending a new message immediately drops the previous reply (it now belongs to an
 	// older message), even though it is well within the one-week window.
-	if err := svc.Submit(ctx, acc, "second", nil, "", "web", "", "", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "second", nil, "", "web", ""); err != nil {
 		t.Fatalf("submit msg2: %v", err)
 	}
 	st, err := svc.State(ctx, acc)
@@ -145,33 +145,48 @@ func TestFeedbackReplyHiddenAfterNewMessage(t *testing.T) {
 	}
 }

-func TestFeedbackSnapshotsLanguage(t *testing.T) {
+func TestFeedbackSnapshotsLanguages(t *testing.T) {
 	ctx := context.Background()
 	svc := newFeedbackService()
 	acc := provisionAccount(t)
 	if _, err := testDB.ExecContext(ctx,
-		`UPDATE backend.accounts SET preferred_language = 'en' WHERE account_id = $1`, acc); err != nil {
-		t.Fatalf("set language: %v", err)
+		`UPDATE backend.accounts SET preferred_language = 'en', service_language = 'ru' WHERE account_id = $1`, acc); err != nil {
+		t.Fatalf("set languages: %v", err)
 	}
-	// A message snapshots the sender's interface language at submit time.
-	if err := svc.Submit(ctx, acc, "from telegram", nil, "", "telegram", "", "", ""); err != nil {
+	// A Telegram (connector) message snapshots both the interface language and the bot.
+	if err := svc.Submit(ctx, acc, "from telegram", nil, "", "telegram", ""); err != nil {
 		t.Fatalf("submit: %v", err)
 	}
 	id := latestFeedbackID(t, svc, acc)
 	if m, err := svc.AdminGet(ctx, id); err != nil {
 		t.Fatalf("admin get: %v", err)
-	} else if m.Lang != "en" {
-		t.Fatalf("snapshot = lang %q, want en", m.Lang)
+	} else if m.Lang != "en" || m.ChannelLang != "ru" {
+		t.Fatalf("snapshot = lang %q / channel_lang %q, want en / ru", m.Lang, m.ChannelLang)
 	}
 	// Changing the account afterwards must not change the stored snapshot.
 	if _, err := testDB.ExecContext(ctx,
-		`UPDATE backend.accounts SET preferred_language = 'ru' WHERE account_id = $1`, acc); err != nil {
-		t.Fatalf("change language: %v", err)
+		`UPDATE backend.accounts SET preferred_language = 'ru', service_language = 'en' WHERE account_id = $1`, acc); err != nil {
+		t.Fatalf("change languages: %v", err)
 	}
 	if m, err := svc.AdminGet(ctx, id); err != nil {
 		t.Fatal(err)
-	} else if m.Lang != "en" {
-		t.Fatalf("snapshot drifted after account change = lang %q, want en", m.Lang)
+	} else if m.Lang != "en" || m.ChannelLang != "ru" {
+		t.Fatalf("snapshot drifted after account change = lang %q / channel_lang %q", m.Lang, m.ChannelLang)
+	}
+
+	// A non-connector channel records no bot language even when the account has one.
+	acc2 := provisionAccount(t)
+	if _, err := testDB.ExecContext(ctx,
+		`UPDATE backend.accounts SET preferred_language = 'en', service_language = 'ru' WHERE account_id = $1`, acc2); err != nil {
+		t.Fatalf("set languages 2: %v", err)
+	}
+	if err := svc.Submit(ctx, acc2, "from web", nil, "", "web", ""); err != nil {
+		t.Fatalf("submit web: %v", err)
+	}
+	if m, err := svc.AdminGet(ctx, latestFeedbackID(t, svc, acc2)); err != nil {
+		t.Fatal(err)
+	} else if m.Lang != "en" || m.ChannelLang != "" {
+		t.Fatalf("web snapshot = lang %q / channel_lang %q, want en / empty", m.Lang, m.ChannelLang)
 	}
 }

@@ -184,7 +199,7 @@ func TestFeedbackBanRole(t *testing.T) {
 	if err := accounts.GrantRole(ctx, acc, account.RoleFeedbackBanned); err != nil {
 		t.Fatalf("grant role: %v", err)
 	}
-	if err := svc.Submit(ctx, acc, "hi", nil, "", "web", "", "", ""); !errors.Is(err, feedback.ErrBanned) {
+	if err := svc.Submit(ctx, acc, "hi", nil, "", "web", ""); !errors.Is(err, feedback.ErrBanned) {
 		t.Fatalf("banned submit err = %v, want ErrBanned", err)
 	}
 	if st, err := svc.State(ctx, acc); err != nil {
@@ -196,7 +211,7 @@ func TestFeedbackBanRole(t *testing.T) {
 	if err := accounts.RevokeRole(ctx, acc, account.RoleFeedbackBanned); err != nil {
 		t.Fatalf("revoke role: %v", err)
 	}
-	if err := svc.Submit(ctx, acc, "hi again", nil, "", "web", "", "", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "hi again", nil, "", "web", ""); err != nil {
 		t.Fatalf("submit after unban: %v", err)
 	}
 }
@@ -219,7 +234,7 @@ func TestFeedbackValidation(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			acc := provisionAccount(t) // fresh account so the pending gate never fires first
-			if err := svc.Submit(ctx, acc, tt.body, tt.attachment, tt.attachmentName, "web", "", "", ""); !errors.Is(err, tt.want) {
+			if err := svc.Submit(ctx, acc, tt.body, tt.attachment, tt.attachmentName, "web", ""); !errors.Is(err, tt.want) {
 				t.Fatalf("submit err = %v, want %v", err, tt.want)
 			}
 		})
@@ -231,7 +246,7 @@ func TestFeedbackAdminLifecycle(t *testing.T) {
 	svc := newFeedbackService()
 	acc := provisionAccount(t)

-	if err := svc.Submit(ctx, acc, "first report", nil, "", "web", "", "", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "first report", nil, "", "web", ""); err != nil {
 		t.Fatalf("submit: %v", err)
 	}
 	id := latestFeedbackID(t, svc, acc)
@@ -276,7 +291,7 @@ func TestFeedbackDeleteAllByAccount(t *testing.T) {
 	svc := newFeedbackService()
 	acc := provisionAccount(t)

-	if err := svc.Submit(ctx, acc, "one", nil, "", "web", "", "", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "one", nil, "", "web", ""); err != nil {
 		t.Fatalf("submit: %v", err)
 	}
 	if err := svc.DeleteAllByAccount(ctx, acc); err != nil {
@@ -286,7 +301,7 @@ func TestFeedbackDeleteAllByAccount(t *testing.T) {
 	if has, err := svc.ReplyUnread(ctx, acc); err != nil || has {
 		t.Fatalf("reply unread after delete-all = %v (err %v)", has, err)
 	}
-	if err := svc.Submit(ctx, acc, "fresh", nil, "", "web", "", "", ""); err != nil {
+	if err := svc.Submit(ctx, acc, "fresh", nil, "", "web", ""); err != nil {
 		t.Fatalf("submit after delete-all: %v", err)
 	}
 }
@@ -1,154 +0,0 @@
-//go:build integration
-
-package inttest
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/google/uuid"
-
-	"scrabble/backend/internal/engine"
-	"scrabble/backend/internal/game"
-)
-
-// The first-move-draw suite covers the official seeding (docs/ARCHITECTURE.md §6): the draw is
-// recorded with the game, decides seat 0 (the first mover), and — in auto-match — runs against
-// a synthetic opponent at open time whose draw rows are back-filled when a real opponent joins.
-
-// TestCreateRecordsFirstMoveDraws checks a directly-seated game records the draw against the
-// real seated accounts and seats the drawn leader (the suite's deterministic draw elects the
-// first-listed account) at seat 0.
-func TestCreateRecordsFirstMoveDraws(t *testing.T) {
-	ctx := context.Background()
-	svc := newGameService()
-	a := provisionAccount(t)
-	b := provisionAccount(t)
-	g, err := svc.Create(ctx, game.CreateParams{Variant: engine.VariantEnglish, Seats: []uuid.UUID{a, b}, TurnTimeout: 24 * time.Hour, Seed: 1})
-	if err != nil {
-		t.Fatalf("create: %v", err)
-	}
-	if g.Seats[0].AccountID != a || g.Seats[1].AccountID != b {
-		t.Fatalf("seats = [%s %s], want [a b]", g.Seats[0].AccountID, g.Seats[1].AccountID)
-	}
-	draws, err := svc.SetupDraws(ctx, g.ID)
-	if err != nil {
-		t.Fatalf("setup draws: %v", err)
-	}
-	// seatZeroFirstMove resolves in one round: the first contender (a) draws a blank and wins.
-	if len(draws) != 2 {
-		t.Fatalf("draws = %d, want 2 (one round, two players)", len(draws))
-	}
-	if draws[0].Account != a || !draws[0].Blank {
-		t.Fatalf("draw[0] = %+v, want a having drawn a blank", draws[0])
-	}
-	if draws[1].Account != b {
-		t.Fatalf("draw[1] account = %s, want b", draws[1].Account)
-	}
-}
-
-// TestAutoMatchDrawBackfilledOnJoin checks an open auto-match game records the draw at open
-// time against the synthetic opponent (a NULL account) and back-fills those rows to the real
-// opponent when they join.
-func TestAutoMatchDrawBackfilledOnJoin(t *testing.T) {
-	ctx := context.Background()
-	clearOpenGames(t)
-	svc := newGameService()
-	starter := provisionAccount(t)
-	g := openGame(t, svc, starter, evenOpeningSeed(t))
-
-	draws, err := svc.SetupDraws(ctx, g.ID)
-	if err != nil {
-		t.Fatalf("setup draws: %v", err)
-	}
-	if len(draws) != 2 {
-		t.Fatalf("open draws = %d, want 2", len(draws))
-	}
-	var nullSeen, starterSeen bool
-	for _, d := range draws {
-		switch d.Account {
-		case uuid.Nil:
-			nullSeen = true
-		case starter:
-			starterSeen = true
-		}
-	}
-	if !nullSeen || !starterSeen {
-		t.Fatalf("open draws = %+v, want the starter and a NULL synthetic opponent", draws)
-	}
-
-	joiner := provisionAccount(t)
-	if _, joined, err := svc.OpenOrJoin(ctx, joiner, openParams(0), time.Now().Add(time.Minute), nil); err != nil || !joined {
-		t.Fatalf("join = (joined %v, err %v), want joined", joined, err)
-	}
-	after, err := svc.SetupDraws(ctx, g.ID)
-	if err != nil {
-		t.Fatalf("setup draws after join: %v", err)
-	}
-	for _, d := range after {
-		if d.Account == uuid.Nil {
-			t.Fatalf("draw still NULL after join: %+v", d)
-		}
-		if d.Account != starter && d.Account != joiner {
-			t.Fatalf("draw account %s is neither player", d.Account)
-		}
-	}
-}
-
-// TestReplayTimeline checks the admin replay timeline reconstructs the dealt racks and one
-// played move: the step count, the drawn tiles, the bag remainder, the running score and the
-// turn cursor.
-func TestReplayTimeline(t *testing.T) {
-	ctx := context.Background()
-	svc := newGameService()
-	a := provisionAccount(t)
-	b := provisionAccount(t)
-	seed := evenOpeningSeed(t)
-	g, err := svc.Create(ctx, game.CreateParams{Variant: engine.VariantEnglish, Seats: []uuid.UUID{a, b}, TurnTimeout: 24 * time.Hour, Seed: seed})
-	if err != nil {
-		t.Fatalf("create: %v", err)
-	}
-	hint, ok := newMirror(t, seed, 2).HintView()
-	if !ok || len(hint.Tiles) == 0 {
-		t.Fatal("no opening move for the seed")
-	}
-	if _, err := svc.SubmitPlay(ctx, g.ID, a, hint.Tiles); err != nil {
-		t.Fatalf("play: %v", err)
-	}
-
-	tl, err := svc.ReplayTimeline(ctx, g.ID)
-	if err != nil {
-		t.Fatalf("replay timeline: %v", err)
-	}
-	if len(tl.Steps) != 2 {
-		t.Fatalf("steps = %d, want 2 (deal + one move)", len(tl.Steps))
-	}
-	deal := tl.Steps[0]
-	if deal.Move != nil {
-		t.Fatalf("step 0 must be the deal, got move %+v", deal.Move)
-	}
-	rackSize := len(deal.Racks[0])
-	if rackSize == 0 || len(deal.Racks) != 2 || len(deal.Racks[1]) != rackSize {
-		t.Fatalf("deal racks = %v, want two equal full racks", deal.Racks)
-	}
-	move := tl.Steps[1]
-	if move.Move == nil || move.Move.Action != "play" {
-		t.Fatalf("step 1 move = %+v, want a play", move.Move)
-	}
-	if len(move.Drawn) != len(hint.Tiles) {
-		t.Fatalf("drawn = %v, want %d refilled tiles", move.Drawn, len(hint.Tiles))
-	}
-	if move.BagLen != deal.BagLen-len(hint.Tiles) {
-		t.Fatalf("bag after play = %d, want %d", move.BagLen, deal.BagLen-len(hint.Tiles))
-	}
-	if len(move.Racks[0]) != rackSize {
-		t.Fatalf("mover rack after refill = %d, want %d", len(move.Racks[0]), rackSize)
-	}
-	if move.Scores[0] <= 0 {
-		t.Fatalf("seat 0 score after play = %d, want > 0", move.Scores[0])
-	}
-	if move.ToMove != 1 {
-		t.Fatalf("to_move after seat 0 play = %d, want 1", move.ToMove)
-	}
-}
@@ -42,7 +42,7 @@ func TestCountActiveQuickGames(t *testing.T) {
 	// An open (awaiting-opponent) quick game counts.
 	if _, _, err := games.OpenOrJoin(ctx, human, game.CreateParams{
 		Variant: engine.VariantEnglish, TurnTimeout: 24 * time.Hour,
-	}, time.Now().Add(time.Minute), nil); err != nil {
+	}, time.Now().Add(time.Minute)); err != nil {
 		t.Fatalf("open quick game: %v", err)
 	}
 	// An active quick game and an honest-AI quick game both count (neither has an invitation row).
@@ -97,12 +97,10 @@ func TestGameLimitGate(t *testing.T) {
 	if !gamesListAtLimit(t, srv, human) {
 		t.Fatalf("at %d games at_game_limit must be true", game.MaxActiveQuickGames)
 	}
-	// erudit_ru is in the default variant preferences, so the variant gate passes and the
-	// game-limit gate is what fires here.
-	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", human, `{"variant":"erudit_ru"}`); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
+	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", human, `{"variant":"scrabble_en"}`); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
 		t.Fatalf("enqueue at limit = (%d, %q), want (409, game_limit_reached)", rec.Code, errorCode(t, rec))
 	}
-	invBody := fmt.Sprintf(`{"variant":"erudit_ru","invitee_ids":[%q]}`, opp.String())
+	invBody := fmt.Sprintf(`{"variant":"scrabble_en","invitee_ids":[%q]}`, opp.String())
 	if rec := userPost(t, srv, "/api/v1/user/invitations", human, invBody); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
 		t.Fatalf("invitation at limit = (%d, %q), want (409, game_limit_reached)", rec.Code, errorCode(t, rec))
 	}
@@ -150,14 +150,6 @@ func TestGameLifecycleAndStats(t *testing.T) {
 		if err != nil {
 			t.Fatalf("get stats: %v", err)
 		}
-		// The player made at least one scoring play (maxWord > 0), so the moves aggregate is
-		// positive; no hints were taken in this greedy game, so the hints aggregate stays 0.
-		if st.Moves <= 0 {
-			t.Errorf("moves = %d, want > 0", st.Moves)
-		}
-		if st.HintsUsed != 0 {
-			t.Errorf("hints used = %d, want 0 (no hints taken)", st.HintsUsed)
-		}
 		if len(st.BestMoves) != 1 {
 			t.Fatalf("want one best move (only scrabble_en played), got %d: %+v", len(st.BestMoves), st.BestMoves)
 		}
@@ -437,15 +429,6 @@ func TestHintPolicy(t *testing.T) {
 	if res.HintsRemaining != 1 || res.WalletBalance != 1 {
 		t.Errorf("wallet hint: hints=%d wallet=%d, want 1/1", res.HintsRemaining, res.WalletBalance)
 	}
-	// game_players.hints_used counts BOTH hints (1 allowance + 1 wallet) — the per-game total
-	// that feeds the player's lifetime hint statistics, not just the allowance.
-	st2, err := svc.GameState(ctx, g.ID, seats[0])
-	if err != nil {
-		t.Fatalf("state after wallet hint: %v", err)
-	}
-	if got := st2.Game.Seats[0].HintsUsed; got != 2 {
-		t.Errorf("hints_used = %d after allowance + wallet hint, want 2", got)
-	}

 	off, err := svc.Create(ctx, game.CreateParams{
 		Variant: engine.VariantEnglish, Seats: seats, TurnTimeout: 24 * time.Hour,
@@ -543,12 +526,6 @@ func TestEvaluatePlayPreview(t *testing.T) {
 	if bad.Valid {
 		t.Error("disconnected play must be invalid")
 	}
-
-	// A non-seated account cannot preview: with the game warm in the live cache, the
-	// membership check runs against the cached seat list (the hot path that skips GetGame).
-	if _, err := svc.EvaluatePlay(ctx, g.ID, provisionAccount(t), hint.Tiles); !errors.Is(err, game.ErrNotAPlayer) {
-		t.Errorf("evaluate by a non-player = %v, want ErrNotAPlayer", err)
-	}
 }

 // TestConcurrentSubmitSerialized confirms the per-game lock lets only one of two
@@ -26,10 +26,9 @@ import (
 // assembly, and the stats reader. Helpers used by a single test file stay in
 // that file; everything reused across files lives here.

-// newGameService builds a game service over the shared pool and registry, with a
-// deterministic first-move draw so the suite keeps a stable turn order.
+// newGameService builds a game service over the shared pool and registry.
 func newGameService() *game.Service {
-	svc := game.NewService(
+	return game.NewService(
 		game.NewStore(testDB),
 		account.NewStore(testDB),
 		testRegistry,
@@ -41,39 +40,6 @@ func newGameService() *game.Service {
 		},
 		zap.NewNop(),
 	)
-	svc.SetFirstMoveEntropy(seatZeroFirstMove)
-	return svc
-}
-
-// seatZeroFirstMove is a first-move-draw entropy factory that always elects the first
-// listed account as the leader, keeping the integration suite's turn order stable
-// despite the real draw's randomness: the first contender draws a blank — the best
-// possible tile — and wins outright, the rest draw the first remaining tile. It is a
-// factory so each game restarts the one-shot "blank" pick.
-func seatZeroFirstMove() func(n int) (int, error) {
-	first := true
-	return func(n int) (int, error) {
-		if first {
-			first = false
-			return n - 1, nil // a blank sits last in the bag → best rank
-		}
-		return 0, nil
-	}
-}
-
-// seatOneFirstMove is a first-move-draw entropy factory that elects the second contender (in
-// auto-match, the synthetic opponent) as the leader, so the caller is seated at seat 1: the
-// first contender draws the first remaining tile and the second draws a blank, winning.
-func seatOneFirstMove() func(n int) (int, error) {
-	pick := 0
-	return func(n int) (int, error) {
-		i := 0
-		if pick == 1 {
-			i = n - 1 // the second contender draws a blank → best rank
-		}
-		pick++
-		return i, nil
-	}
 }

 // newSocialService builds a social service over the shared pool, reading game
@@ -120,7 +86,7 @@ func provisionAccount(t *testing.T) uuid.UUID {
 // provisionGuest creates a fresh ephemeral guest account and returns its id.
 func provisionGuest(t *testing.T) uuid.UUID {
 	t.Helper()
-	acc, err := account.NewStore(testDB).ProvisionGuest(context.Background(), "")
+	acc, err := account.NewStore(testDB).ProvisionGuest(context.Background())
 	if err != nil {
 		t.Fatalf("provision guest: %v", err)
 	}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ilia Denisov	91c4efc8a8	chore: drop the game.over label, show only the result CI / changes (pull_request) Successful in 2s Details CI / unit (pull_request) Successful in 10s Details CI / integration (pull_request) Successful in 14s Details CI / ui (pull_request) Successful in 51s Details CI / gate (pull_request) Successful in 0s Details CI / deploy (pull_request) Successful in 1m15s Details	2026-06-17 22:58:17 +02:00
Ilia Denisov	da491b6bde	revert: game-over phrases	2026-06-17 22:54:28 +02:00
Ilia Denisov	ffe9150f26	fix: game.new button e2e test bundle CI / changes (pull_request) Successful in 2s Details CI / unit (pull_request) Successful in 9s Details CI / integration (pull_request) Successful in 15s Details CI / ui (pull_request) Successful in 51s Details CI / gate (pull_request) Successful in 0s Details CI / deploy (pull_request) Successful in 1m9s Details	2026-06-17 21:54:22 +02:00
Ilia Denisov	071ff8ac37	fix: game.new button e2e test title CI / changes (pull_request) Successful in 2s Details CI / unit (pull_request) Successful in 9s Details CI / integration (pull_request) Successful in 16s Details CI / ui (pull_request) Failing after 53s Details CI / gate (pull_request) Failing after 0s Details CI / deploy (pull_request) Has been skipped Details	2026-06-17 21:34:37 +02:00
Ilia Denisov	4e347702f3	chore: lobby.new, lobby.stats label CI / changes (pull_request) Successful in 3s Details CI / unit (pull_request) Successful in 9s Details CI / integration (pull_request) Successful in 16s Details CI / ui (pull_request) Failing after 4m45s Details CI / gate (pull_request) Failing after 0s Details CI / deploy (pull_request) Has been skipped Details	2026-06-17 20:45:23 +02:00
Ilia Denisov	63669a3b25	fix: game-over unit test expecttion CI / changes (pull_request) Successful in 2s Details CI / unit (pull_request) Successful in 10s Details CI / integration (pull_request) Successful in 15s Details CI / ui (pull_request) Successful in 51s Details CI / gate (pull_request) Successful in 0s Details CI / deploy (pull_request) Successful in 1m16s Details	2026-06-17 19:18:27 +02:00
Ilia Denisov	7832bf10f5	chore: chat.awaitingReply label CI / changes (pull_request) Successful in 2s Details CI / unit (pull_request) Failing after 9s Details CI / integration (pull_request) Successful in 14s Details CI / ui (pull_request) Successful in 51s Details CI / gate (pull_request) Failing after 0s Details CI / deploy (pull_request) Has been skipped Details	2026-06-17 18:58:25 +02:00
Ilia Denisov	1fe25a3a15	chore: game-over phrases CI / changes (pull_request) Successful in 2s Details CI / unit (pull_request) Failing after 9s Details CI / integration (pull_request) Successful in 14s Details CI / ui (pull_request) Successful in 50s Details CI / gate (pull_request) Failing after 0s Details CI / deploy (pull_request) Has been skipped Details	2026-06-17 18:04:48 +02:00
Ilia Denisov	8b7ddb9df0	chore: new.searchHint label (ru) CI / changes (pull_request) Successful in 2s Details CI / unit (pull_request) Successful in 9s Details CI / integration (pull_request) Successful in 14s Details CI / ui (pull_request) Successful in 50s Details CI / gate (pull_request) Successful in 0s Details CI / deploy (pull_request) Successful in 2m17s Details	2026-06-17 17:40:53 +02:00
Ilia Denisov	68972375f9	chore: chat.awaitingReply label CI / changes (pull_request) Successful in 2s Details CI / unit (pull_request) Successful in 9s Details CI / integration (pull_request) Successful in 13s Details CI / ui (pull_request) Successful in 51s Details CI / gate (pull_request) Successful in 0s Details CI / deploy (pull_request) Successful in 1m10s Details	2026-06-17 17:37:07 +02:00
Ilia Denisov	5b0f608bb2	chore: stats tab label and ru-caption CI / changes (pull_request) Successful in 2s Details CI / unit (pull_request) Successful in 9s Details CI / integration (pull_request) Successful in 14s Details CI / ui (pull_request) Successful in 50s Details CI / gate (pull_request) Successful in 0s Details CI / deploy (pull_request) Successful in 1m9s Details	2026-06-17 17:18:09 +02:00
Ilia Denisov	f9faebfa91	fix(hint): stop the hint count going stale across games CI / changes (pull_request) Successful in 2s Details CI / unit (pull_request) Successful in 10s Details CI / integration (pull_request) Successful in 13s Details CI / ui (pull_request) Successful in 51s Details CI / gate (pull_request) Successful in 0s Details CI / deploy (pull_request) Successful in 2m20s Details The in-game hint badge re-fetched on entry and, for a game where it was the player's turn, showed a too-high count that "reset" (e.g. back to 11) — the wallet hint spent in another game was not reflected. Root cause: the server sends one hints_remaining = per-game allowance + global wallet, and the client cached that combined number per game. The wallet is global, so spending a wallet hint in one game left every other game's cached count stale (a my-turn game holds the stalest value: the opponent-moved delta preserves the old number, whereas a game you just moved in re-cached a fresh one). The backend allowance-then-wallet spend order was already correct. Fix: split the two. StateView/HintResult gain a trailing wallet_balance field (the global wallet alone); the client derives the per-game allowance as hints_remaining - wallet_balance (stable, cacheable) and reads the wallet live from the profile, refreshing it from every state/hint response. The badge is allowance + live wallet, so a wallet hint anywhere updates every game at once. - wire: scrabble.fbs StateView/HintResult + pkg/wire.BuildStateView (the single encoder for both the gateway transcode and the backend's event StateView), gateway encode + resp structs, regen. - backend: game StateView/HintResult + service (GameState/Hint) + eventwire + notify PlayerState/encode + server DTOs. - ui: lib/hints.ts (pure hintsLeft), Game.svelte (badge + syncWallet on load/hint, carry wallet_balance through applyMoveResult), codec/model, mock. - docs: ARCHITECTURE §Hint. Tests: hints.ts unit (incl. the staleness case), TestHintPolicy extended (wallet_balance + allowance-first), gateway state/hint round-trips.	2026-06-17 16:50:16 +02:00
Ilia Denisov	cbb485ebd6	feat(stats): show the best move word per game variant CI / changes (pull_request) Successful in 2s Details CI / unit (pull_request) Successful in 9s Details CI / integration (pull_request) Successful in 14s Details CI / ui (pull_request) Successful in 51s Details CI / gate (pull_request) Successful in 0s Details CI / deploy (pull_request) Successful in 1m11s Details Replace the single "best move" number on the statistics screen with a full-width per-variant breakdown: the highest-scoring play in each variant the player has played, drawn as game tiles (a wildcard shows its letter but no value), with the words and scores right-aligned to shared edges. - backend: new account_best_move table (PK account_id+variant) keeping the main word as JSON tiles {letter,value,blank}; captured at game finish in buildStats (blank flags taken from every placed blank — equivalent to the final board), upserted in the finish transaction and replaced only by a strictly higher-scoring play. Guest/honest-AI games still record nothing. GetStats + statsDTO expose best_moves. - wire: StatsView gains best_moves:[BestMoveView{variant,score,word:[BestMoveTile]}] (trailing, backward-compatible); gateway encodeStats + UI codec updated. - ui: new WordTiles component (board's tile look, fixed px size); Stats.svelte drops the maxWord card and adds the full-width best-move card (catalogue order, empty variants omitted). - docs: ARCHITECTURE §9 + schema, FUNCTIONAL (+ru), UI_DESIGN. Tests: mainWordTiles unit + buildStats end-to-end (inttest) + gateway and UI codec round-trips (incl. a blank tile) + e2e.	2026-06-17 15:29:55 +02:00