games: a blackjack table you can actually sit down at

The engine, the escrow and the wire were all in place; nothing had a browser on
the end of it. This is that end: a lobby, a table, and the five endpoints between
them.

The browser holds no game. It sends intents and gets back a view — the cards it
is entitled to see, and the script of how they arrived, one event per card off
the shoe. The dealer's hole card is not in the payload at all until the reveal,
because a field the client is told to ignore is a field somebody reads in
devtools. The shoe lives in game_live_hands, which also means a redeploy
mid-hand no longer costs a player their stake: the hand is still there when they
come back.

The money is ordered so nothing can be spent twice. The stake leaves the stack in
the same statement that checks it exists, before a card is dealt. Every new hand
is seated with a plain INSERT, so a double-clicked Deal is decided by the primary
key rather than by a read that raced — it loses, gets its chips back, and the
hand in progress is untouched. A double takes its raise up front and hands it
straight back if the engine refuses the move.

Cards are dealt rather than swapped in — they fly out of the shoe and turn over,
which was a requirement and not a flourish. The faces and the chips are still
plain; that's next.

internal/storage/games.go

@@ -503,6 +503,91 @@ func Touch(user string) {
 		nowUnix(), nowUnix(), user)
 }
 
+// ---- the hand in progress -------------------------------------------------
+
+var (
+	// ErrNoLiveHand means the player isn't in a hand right now.
+	ErrNoLiveHand = errors.New("games: no hand in progress")
+	// ErrHandInProgress means they already are, and may not be dealt another.
+	ErrHandInProgress = errors.New("games: already in a hand")
+)
+
+// LiveHand is a hand a player is in the middle of. State is the engine's own
+// State, serialized whole — the shoe is in there, which is exactly why this row
+// never leaves the server.
+type LiveHand struct {
+	Game  string
+	State []byte
+	Seed1 uint64
+	Seed2 uint64
+}
+
+// StartLiveHand seats a *new* hand, and refuses if the player is already in one.
+// The plain INSERT is the point: it is the primary key, not a prior read, that
+// decides. Two Deal clicks racing each other would otherwise both see an empty
+// felt, both take a stake, and the second would overwrite the first — taking the
+// player's chips for a hand that no longer exists anywhere.
+func StartLiveHand(user string, h LiveHand) error {
+	res, err := Get().Exec(
+		`INSERT INTO game_live_hands (matrix_user, game, state, seed1, seed2, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(matrix_user) DO NOTHING`,
+		user, h.Game, string(h.State), int64(h.Seed1), int64(h.Seed2), nowUnix(),
+	)
+	if err != nil {
+		return fmt.Errorf("games: start live hand: %w", err)
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrHandInProgress
+	}
+	return nil
+}
+
+// SaveLiveHand stores the hand a player is in, replacing any earlier one. The
+// player's stake has already left their stack by the time this is called, so
+// the write is what makes the hand recoverable if Pete restarts mid-deal.
+func SaveLiveHand(user string, h LiveHand) error {
+	now := nowUnix()
+	if _, err := Get().Exec(
+		`INSERT INTO game_live_hands (matrix_user, game, state, seed1, seed2, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(matrix_user) DO UPDATE SET
+		   game = excluded.game, state = excluded.state,
+		   seed1 = excluded.seed1, seed2 = excluded.seed2, updated_at = excluded.updated_at`,
+		user, h.Game, string(h.State), int64(h.Seed1), int64(h.Seed2), now,
+	); err != nil {
+		return fmt.Errorf("games: save live hand: %w", err)
+	}
+	return nil
+}
+
+// LoadLiveHand returns the hand a player is in, or ErrNoLiveHand.
+func LoadLiveHand(user string) (LiveHand, error) {
+	var h LiveHand
+	var state string
+	var s1, s2 int64
+	err := Get().QueryRow(
+		`SELECT game, state, seed1, seed2 FROM game_live_hands WHERE matrix_user = ?`, user,
+	).Scan(&h.Game, &state, &s1, &s2)
+	if errors.Is(err, sql.ErrNoRows) {
+		return LiveHand{}, ErrNoLiveHand
+	}
+	if err != nil {
+		return LiveHand{}, fmt.Errorf("games: load live hand: %w", err)
+	}
+	h.State, h.Seed1, h.Seed2 = []byte(state), uint64(s1), uint64(s2)
+	return h, nil
+}
+
+// ClearLiveHand ends a hand. Called when it settles — the audit log in
+// game_hands is what survives it.
+func ClearLiveHand(user string) error {
+	if _, err := Get().Exec(`DELETE FROM game_live_hands WHERE matrix_user = ?`, user); err != nil {
+		return fmt.Errorf("games: clear live hand: %w", err)
+	}
+	return nil
+}
+
 // HouseTake is the total rake collected since a given time — the number that
 // answers "is this economy inflating".
 func HouseTake(since int64) (int64, error) {

internal/storage/schema.go

@@ -225,6 +225,23 @@ CREATE TABLE IF NOT EXISTS game_hands (
 CREATE INDEX IF NOT EXISTS idx_game_hands_user ON game_hands(matrix_user, played_at DESC);
 CREATE INDEX IF NOT EXISTS idx_game_hands_played ON game_hands(played_at);
 
+-- The hand a player is in the middle of. One per player: you cannot be dealt a
+-- second hand while chips are riding on the first.
+--
+-- The state column is the engine's State, serialized whole — shoe included. It
+-- lives here rather than in memory because Pete redeploys often, and a player
+-- whose stake has already been taken must find their cards where they left them
+-- rather than a table that has forgotten them. It is also why the deck never
+-- goes to the browser: the authoritative shoe is this row, on the server.
+CREATE TABLE IF NOT EXISTS game_live_hands (
+    matrix_user TEXT PRIMARY KEY,
+    game        TEXT NOT NULL,               -- 'blackjack'
+    state       TEXT NOT NULL,               -- JSON: the engine's State
+    seed1       INTEGER NOT NULL,            -- carried to the audit log when it settles
+    seed2       INTEGER NOT NULL,
+    updated_at  INTEGER NOT NULL
+);
+
 CREATE UNIQUE INDEX IF NOT EXISTS idx_post_log_guid_channel ON post_log(guid, channel);
 CREATE INDEX IF NOT EXISTS idx_post_log_event_id ON post_log(event_id);
 CREATE INDEX IF NOT EXISTS idx_post_log_channel_posted ON post_log(channel, posted_at);