games: widen foley pitch variance so takes are actually distinct

vary was a per-step multiplier of ~0.05, capping the swing at a barely
audible +/-0.10. Redefine vary as the max deviation itself (chips +/-0.22,
cards +/-0.20) and spread it over seven pitch steps; give the single-take
shuffle a wobble too.

.gitignore

@@ -5,3 +5,4 @@ pete
 config.yaml
 config.toml
 node_modules/
+holdem-train

internal/games/holdem/eval.go

@@ -180,14 +180,19 @@ func (s *State) payPot(pot Pot, live []ranked, evs *[]Event) {
 			amount -= rake
 			s.Rake += rake // every chip of it, so the table still balances
 
-			// But only the part that came out of *your* winnings is money the house
-			// actually made, and it is the only part the felt should quote you. The
-			// bots' chips are not real — the only real money at this table is yours —
-			// so raking a pot a bot won costs you nothing, and a counter that climbed
-			// while you folded would be telling you it had.
+			// But only the part that came out of a *human's* winnings is money the
+			// house actually made, and it is the only part worth quoting. The bots'
+			// chips are not real — the only real money at the table is the players' —
+			// so raking a pot a bot won costs nobody anything, and a counter that
+			// climbed while every human folded would be telling them it had.
 			for _, w := range winners {
-				if w.seat == You {
+				if !s.Seats[w.seat].Bot {
+					// The table total (for the audit's delta) and the winner's own
+					// running tally (for the ledger line the felt shows them). At a
+					// table with two humans these are different numbers: each player is
+					// only ever quoted the rake that came out of a pot they won.
 					s.Paid += rake / int64(len(winners))
+					s.Seats[w.seat].Paid += rake / int64(len(winners))
 				}
 			}
 			*evs = append(*evs, Event{Kind: "rake", Seat: -1, Amount: rake})

internal/games/holdem/holdem.go

@@ -49,11 +49,9 @@ var (
 	ErrUnknownTier   = errors.New("holdem: no such table")
 	ErrBadBuyIn      = errors.New("holdem: that isn't a legal buy-in")
 	ErrTableFull     = errors.New("holdem: too many seats")
+	ErrSeatTaken     = errors.New("holdem: that seat is taken")
 )
 
-// You are always seat zero. The bots are the seats after you.
-const You = 0
-
 // rakeCapBB caps the rake on any one pot at three big blinds, which is what a
 // cardroom does. Without a cap, five percent of a big pot is a lot of money to
 // take off a player for winning it.
@@ -103,6 +101,7 @@ type Seat struct {
 	Bet   int64         `json:"bet"`   // put in on this street
 	Total int64         `json:"total"` // put in across this hand
 	Won   int64         `json:"won"`   // taken out of the pot this hand
+	Paid  int64         `json:"paid"`  // rake lifted from pots this seat has won, all session
 	State SeatState     `json:"state"`
 	Acted bool          `json:"acted"` // has chosen to do something this street
 }
@@ -264,46 +263,171 @@ type Move struct {
 // botNames are the regulars. Six of them so a full table never has two.
 var botNames = []string{"Dice", "Marjorie", "Ox", "Sunny", "Pinch", "The Reverend"}
 
-// New sits you down. The buy-in is chips the caller has already taken off the
-// player's stack; this engine only ever gives them back through Leave.
-//
-// No hand is dealt yet — the table opens on PhaseHandOver, which is the state a
-// table between hands is in, and the first Deal move starts the first hand.
-func New(t Tier, bots int, buyIn int64, rakePct float64, seed1, seed2 uint64) (State, []Event, error) {
-	if bots < 1 || bots > MaxBots {
-		return State{}, nil, ErrTableFull
+// SeatConfig is one chair the table opens with. A shared table is seated by the
+// runtime: humans in the chairs people have taken, bots in the rest. Solo play is
+// just the case where exactly one chair is human, which is why there is no longer
+// a separate solo constructor and no seat-zero-is-you convention — a table is a
+// list of seats, and who is human is a property of each seat, not of its index.
+type SeatConfig struct {
+	Name string
+	Bot  bool
+	// Stack is the starting chips: a human's buy-in (already taken off their chip
+	// stack by the caller), or a bot's stake from the house.
+	Stack int64
 }
-	if buyIn < t.MinBuy || buyIn > t.MaxBuy {
-		return State{}, nil, ErrBadBuyIn
+
+// New opens a table and seats it. No hand is dealt yet — the table opens on
+// PhaseHandOver, the state a table between hands is in, and the first Deal starts
+// the first hand.
+//
+// The engine gives a human's chips back only by the runtime reading their stack
+// when they leave; it never credits a chip stack itself. Bot stacks are house
+// chips and not real money — the only real money at the table is the humans'.
+func New(t Tier, seats []SeatConfig, rakePct float64, seed1, seed2 uint64) (State, []Event, error) {
+	if len(seats) < 2 || len(seats) > MaxBots+1 {
+		return State{}, nil, ErrTableFull
 	}
 	t.RakePct = rakePct
 
 	s := State{
 		Tier:  t,
-		Button:   0,
 		Phase: PhaseHandOver,
-		BoughtIn: buyIn,
 		Seed1: seed1,
 		Seed2: seed2,
 	}
-	s.Seats = append(s.Seats, Seat{Name: "You", Stack: buyIn})
-	for i := 0; i < bots; i++ {
-		s.Seats = append(s.Seats, Seat{Name: botNames[i], Bot: true, Stack: t.MaxBuy})
+	var evs []Event
+	for _, sc := range seats {
+		if !sc.Bot && (sc.Stack < t.MinBuy || sc.Stack > t.MaxBuy) {
+			return State{}, nil, ErrBadBuyIn
+		}
+		i := len(s.Seats)
+		s.Seats = append(s.Seats, Seat{Name: sc.Name, Bot: sc.Bot, Stack: sc.Stack})
+		if !sc.Bot {
+			// BoughtIn is the sum of what the humans brought — the audit's idea of the
+			// stake. Per-seat border accounting lives in storage (game_seats.staked),
+			// not here; the engine only ever moves chips within the table.
+			s.BoughtIn += sc.Stack
+			evs = append(evs, Event{Kind: "sit", Seat: i, Amount: sc.Stack, Text: t.Name})
+		}
 	}
 
-	// The button starts to your right, so the first hand deals you the small blind
-	// heads-up and the button on a full table — either way you are in the action
-	// from the first card rather than folding your way in.
+	// The button starts at the last seat, so deal() moves it to the first: a full
+	// table puts the earliest seat on the button, and heads-up puts it on the small
+	// blind, in the action from the first card either way.
 	s.Button = len(s.Seats) - 1
-
-	evs := []Event{{Kind: "sit", Seat: You, Amount: buyIn, Text: t.Name}}
 	return s, evs, nil
 }
 
-// ApplyMove is the whole engine. It plays your move, then every bot behind you,
-// deals whatever streets that finishes, and stops either when it is your turn
-// again or when the hand is over.
-func ApplyMove(s State, m Move) (State, []Event, error) {
+// soloSeats builds the seat list for a table of one human and n bots — the shape
+// every table had before multiplayer, and the one the solo handler still opens.
+// The human is seat zero and takes buyIn; the bots take the table maximum.
+// SoloSeats is exported for the handler that still opens a solo table. See New.
+func SoloSeats(t Tier, bots int, buyIn int64) []SeatConfig {
+	return TableSeats(t, "You", bots, buyIn)
+}
+
+// TableSeats builds a table of one named human and n bots. It is what a player
+// opening their own table gets: a chair with their name on it, and the rest of
+// the felt filled with the house's regulars so the table is never empty. The
+// human takes seat zero and their buy-in; each bot takes the table maximum in
+// house chips, which are not real money and get rebought when a bot runs dry.
+func TableSeats(t Tier, human string, bots int, buyIn int64) []SeatConfig {
+	seats := []SeatConfig{{Name: human, Stack: buyIn}}
+	for i := 0; i < bots && i < len(botNames); i++ {
+		seats = append(seats, SeatConfig{Name: botNames[i], Bot: true, Stack: t.MaxBuy})
+	}
+	return seats
+}
+
+// freeBotName picks a regular not already sitting at the table, so vacating a
+// seat never puts two Marjories on the felt. It falls back to a generic name if
+// every regular is somehow taken, which a six-max table cannot actually manage.
+func (s *State) freeBotName() string {
+	used := make(map[string]bool, len(s.Seats))
+	for i := range s.Seats {
+		used[s.Seats[i].Name] = true
+	}
+	for _, n := range botNames {
+		if !used[n] {
+			return n
+		}
+	}
+	return "The House"
+}
+
+// Vacate turns a human's chair back into the house's and returns the stack that
+// goes home with them. It is how a shared table survives a player getting up: the
+// seat keeps its place and its chips — which become house money, rebought like
+// any bot's when they run low — so the others play on without a hole in the ring.
+//
+// The chips left in the seat are not a leak. The only real money at the table is
+// in the human seats; the moment a seat is a bot's, its stack is house chips that
+// nobody's balance is counting. What the player actually takes home is the
+// returned stack, credited by the runtime in the same transaction that saves this
+// state — see storage.LeaveTable.
+//
+// It refuses while a hand is live, because a seat with chips in the pot cannot be
+// emptied without stranding them. PhaseHandOver is the only phase Leave was ever
+// legal from.
+func (s *State) Vacate(seat int) (int64, error) {
+	if seat < 0 || seat >= len(s.Seats) {
+		return 0, ErrUnknownMove
+	}
+	if s.Phase == PhaseBetting {
+		return 0, ErrHandLive
+	}
+	p := &s.Seats[seat]
+	if p.Bot {
+		return 0, ErrUnknownMove
+	}
+	home := p.Stack
+	p.Bot = true
+	p.Name = s.freeBotName()
+	return home, nil
+}
+
+// Occupy seats a human in a chair a bot was keeping warm, with the buy-in they
+// brought. It is the join half of Vacate: a player sitting down at somebody
+// else's table takes an open seat rather than opening a felt of their own.
+//
+// Like Vacate it is a between-hands move — you cannot sit into a live hand — and
+// the buy-in has to be legal for the table, because the chips are already off the
+// player's stack by the time this runs and an illegal seat would strand them.
+func (s *State) Occupy(seat int, name string, buyIn int64) error {
+	if seat < 0 || seat >= len(s.Seats) {
+		return ErrUnknownMove
+	}
+	if s.Phase == PhaseBetting {
+		return ErrHandLive
+	}
+	if !s.Seats[seat].Bot {
+		return ErrSeatTaken
+	}
+	if buyIn < s.Tier.MinBuy || buyIn > s.Tier.MaxBuy {
+		return ErrBadBuyIn
+	}
+	p := &s.Seats[seat]
+	p.Bot = false
+	p.Name = name
+	p.Stack = buyIn
+	p.State = Out // between hands; the next deal brings them in
+	s.BoughtIn += buyIn
+	return nil
+}
+
+// ApplyMove is the whole engine. It plays the acting seat's move, then every bot
+// behind them, deals whatever streets that finishes, and stops when the action
+// reaches a human — the same one again, or another at the table — or when the
+// hand is over.
+//
+// seat is who is acting. A betting move is legal only from the seat whose turn it
+// is; the session moves (Deal, TopUp, Leave) belong to the seat that sent them.
+// This is the one place seat identity enters the engine — everything below works
+// on seat indices already.
+func ApplyMove(s State, seat int, m Move) (State, []Event, error) {
+	if seat < 0 || seat >= len(s.Seats) {
+		return s, nil, ErrUnknownMove
+	}
 	if s.Phase == PhaseDone {
 		return s, nil, ErrOver
 	}
@@ -322,32 +446,36 @@ func ApplyMove(s State, m Move) (State, []Event, error) {
 		if s.Phase != PhaseHandOver {
 			return s, nil, ErrHandLive
 		}
-		if m.Amount <= 0 || s.Seats[You].Stack+m.Amount > s.Tier.MaxBuy {
+		if m.Amount <= 0 || s.Seats[seat].Stack+m.Amount > s.Tier.MaxBuy {
 			return s, nil, ErrBadBuyIn
 		}
-		s.Seats[You].Stack += m.Amount
+		s.Seats[seat].Stack += m.Amount
 		s.BoughtIn += m.Amount
-		evs = append(evs, Event{Kind: "topup", Seat: You, Amount: m.Amount})
+		evs = append(evs, Event{Kind: "topup", Seat: seat, Amount: m.Amount})
 
 	case Leave:
 		if s.Phase != PhaseHandOver {
 			return s, nil, ErrHandLive
 		}
+		// Getting up at a solo table ends the session and pays the stack out; the
+		// runtime reads Payout and crosses the border. At a shared table leaving is a
+		// storage operation (LeaveTable swaps the seat for a bot in the settle tx),
+		// and this branch is not the path taken — see the handler.
 		s.Phase = PhaseDone
-		s.Payout = s.Seats[You].Stack
-		evs = append(evs, Event{Kind: "leave", Seat: You, Amount: s.Payout})
+		s.Payout = s.Seats[seat].Stack
+		evs = append(evs, Event{Kind: "leave", Seat: seat, Amount: s.Payout})
 
 	case Fold, Check, Call, Raise, Shove:
 		if s.Phase != PhaseBetting {
 			return s, nil, ErrNoHand
 		}
-		if s.ToAct != You {
+		if s.ToAct != seat {
 			return s, nil, ErrNotYourTurn
 		}
-		if err := s.act(You, m, &evs); err != nil {
+		if err := s.act(seat, m, &evs); err != nil {
 			return s, nil, err // nothing happened; the caller keeps the old state
 		}
-		s.ToAct = s.nextCanAct(You)
+		s.ToAct = s.nextCanAct(seat)
 		s.advance(&evs, rng, true)
 
 	default:
@@ -485,8 +613,8 @@ func (s *State) advance(evs *[]Event, rng *rand.Rand, bots bool) {
 			continue
 		}
 
-		if s.ToAct == You || !bots {
-			return // a decision that isn't ours to make
+		if !s.Seats[s.ToAct].Bot || !bots {
+			return // a decision a human has to make, or the trainer wants to
 		}
 
 		s.botActs(s.ToAct, evs, rng)
@@ -546,10 +674,19 @@ func (s *State) deal(evs *[]Event, rng *rand.Rand) {
 			p.Hole[round] = c
 		}
 	}
-	// Only your cards go into the script. The bots' are in the state, on this side
-	// of the wire, and the only thing that ever turns them over is a showdown.
-	*evs = append(*evs, Event{Kind: "hole", Seat: You,
-		Cards: []cards.Card{s.Seats[You].Hole[0], s.Seats[You].Hole[1]}})
+	// A hole event per dealt seat, each carrying that seat's cards. The engine no
+	// longer decides who may see what — it cannot, now that a table has more than
+	// one human — so it emits every hand and the view layer redacts per viewer,
+	// nulling the cards of every seat but the one watching. That per-seat redaction
+	// is the whole security boundary once these events fan out over SSE, and it has
+	// a test that renders each seat's view and greps for anybody else's cards.
+	for i := range s.Seats {
+		if s.Seats[i].State == Out {
+			continue
+		}
+		*evs = append(*evs, Event{Kind: "hole", Seat: i,
+			Cards: []cards.Card{s.Seats[i].Hole[0], s.Seats[i].Hole[1]}})
+	}
 
 	s.ToAct = s.firstPreFlop(bb)
 }
@@ -627,18 +764,34 @@ func (s *State) endHand(evs *[]Event) {
 	s.Pot = 0
 	s.Side = nil
 	s.Phase = PhaseHandOver
-	*evs = append(*evs, Event{Kind: "end", Seat: -1, Amount: s.Seats[You].Stack})
+	*evs = append(*evs, Event{Kind: "end", Seat: -1})
 
-	// Busting is the end of the session, not the end of a hand. There is nothing
-	// to deal you and nothing to give back, so the table closes and you sit down
-	// again — which is a buy-in, and a buy-in is a decision worth making on purpose.
-	if s.Seats[You].Stack <= 0 {
+	// Busting is the end of a session, not of a hand. At a solo table there is
+	// nothing to deal the one human and nothing to give back, so the table closes
+	// and they sit down again — a buy-in, and a buy-in is a decision worth making
+	// on purpose. At a shared table one human busting is not everyone's business:
+	// their seat simply goes Out and the runtime offers the rebuy while the table
+	// plays on. So the whole-session bust only fires when there is a single human.
+	humans := s.humanSeats()
+	if len(humans) == 1 && s.Seats[humans[0]].Stack <= 0 {
 		s.Phase = PhaseDone
 		s.Payout = 0
-		*evs = append(*evs, Event{Kind: "bust", Seat: You})
+		*evs = append(*evs, Event{Kind: "bust", Seat: humans[0]})
 	}
 }
 
+// humanSeats lists the seats a person is sitting in. Bots are the house; the only
+// real money at the table is in these.
+func (s State) humanSeats() []int {
+	var out []int
+	for i := range s.Seats {
+		if !s.Seats[i].Bot {
+			out = append(out, i)
+		}
+	}
+	return out
+}
+
 // ---- the small stuff -------------------------------------------------------
 
 // next derives this step's generator and advances the step count.

internal/games/holdem/holdem_test.go

@@ -21,7 +21,7 @@ func TestChipsAreConserved(t *testing.T) {
 		bots := 1 + game%MaxBots
 		tier := Tiers[game%len(Tiers)]
 
-		s, _, err := New(tier, bots, tier.MaxBuy, tier.RakePct, uint64(game), 7)
+		s, _, err := New(tier, SoloSeats(tier, bots, tier.MaxBuy), tier.RakePct, uint64(game), 7)
 		if err != nil {
 			t.Fatalf("new table: %v", err)
 		}
@@ -30,7 +30,7 @@ func TestChipsAreConserved(t *testing.T) {
 
 		for hand := 0; hand < 8 && s.Phase != PhaseDone; hand++ {
 			var evs []Event
-			s, evs, err = ApplyMove(s, Move{Kind: Deal})
+			s, evs, err = apply(s, Move{Kind: Deal})
 			if err != nil {
 				t.Fatalf("game %d hand %d: deal: %v", game, hand, err)
 			}
@@ -41,7 +41,7 @@ func TestChipsAreConserved(t *testing.T) {
 				if step > 200 {
 					t.Fatalf("game %d hand %d: the hand will not end", game, hand)
 				}
-				s, _, err = ApplyMove(s, randomMove(s, rng))
+				s, _, err = apply(s, randomMove(s, rng))
 				if err != nil {
 					t.Fatalf("game %d hand %d: %v", game, hand, err)
 				}
@@ -98,6 +98,21 @@ func stacks(s State) []int64 {
 	return out
 }
 
+// You is seat zero — the shape every test in this file is written against. The
+// engine no longer has this constant: a table is a list of seats and which are
+// human is a per-seat property, not a fixed index. But these tests all seat one
+// human at zero (the pre-multiplayer solo shape), so a test-local alias keeps
+// them readable as the regression guard they are. The multiway behaviour has its
+// own tests, which do not assume it.
+const You = 0
+
+// apply plays a move as the seat whose turn it is at a solo table — always the
+// human at seat zero. It wraps the seat-parameterized ApplyMove so the solo tests
+// read as they did before the reshape.
+func apply(s State, m Move) (State, []Event, error) {
+	return ApplyMove(s, You, m)
+}
+
 // randomMove picks something legal for the player, without any thought at all.
 // A bad player is exactly what this test wants: it gets into all-ins, folds,
 // short stacks and split pots far faster than a good one would.
@@ -122,7 +137,7 @@ func randomMove(s State, rng *rand.Rand) Move {
 
 func TestHeadsUpButtonIsTheSmallBlindAndActsFirst(t *testing.T) {
 	s := table(t, Tiers[0], 1, 200)
-	s, evs, err := ApplyMove(s, Move{Kind: Deal})
+	s, evs, err := apply(s, Move{Kind: Deal})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -154,13 +169,13 @@ func TestTheBigBlindGetsTheirOption(t *testing.T) {
 	// A table where everyone just calls: the big blind has the bet matched without
 	// ever having chosen anything, and the street must not end until they speak.
 	s := table(t, Tiers[0], 1, 200)
-	s, _, _ = ApplyMove(s, Move{Kind: Deal})
+	s, _, _ = apply(s, Move{Kind: Deal})
 
 	// Find a hand where the player is the big blind. The button alternates, so at
 	// most a couple of deals.
 	for i := 0; i < 6 && s.Position(You) != "BB"; i++ {
 		s = playOut(t, s)
-		s, _, _ = ApplyMove(s, Move{Kind: Deal})
+		s, _, _ = apply(s, Move{Kind: Deal})
 	}
 	if s.Position(You) != "BB" {
 		t.Skip("never dealt the big blind")
@@ -170,7 +185,7 @@ func TestTheBigBlindGetsTheirOption(t *testing.T) {
 	}
 	if s.ToAct == You && s.Owed(You) == 0 {
 		// This is the option: nothing to call, but the hand is still ours to act on.
-		if _, _, err := ApplyMove(s, Move{Kind: Check}); err != nil {
+		if _, _, err := apply(s, Move{Kind: Check}); err != nil {
 			t.Errorf("the big blind cannot check their option: %v", err)
 		}
 	}
@@ -388,7 +403,7 @@ func TestTheRakeIsFivePercentUnderTheCap(t *testing.T) {
 // house quietly took nothing from every pot for an afternoon.
 func TestTheRakeSurvivesTheConstructor(t *testing.T) {
 	tier := Tiers[1] // 5/10, so the cap is 30
-	s, _, err := New(tier, 1, tier.MaxBuy, 0.05, 1, 2)
+	s, _, err := New(tier, SoloSeats(tier, 1, tier.MaxBuy), 0.05, 1, 2)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -443,6 +458,40 @@ func TestYouOnlyPayRakeOnPotsYouWin(t *testing.T) {
 	}
 }
 
+// At a table with two humans the session-rake line each is shown is their own,
+// not the table's: the house took it out of a pot one of them won, and quoting it
+// to the other says the house has taken money off them that it has not. So the
+// per-seat tally only ever moves on the seat that won the pot.
+func TestRakeIsChargedToTheSeatThatWonIt(t *testing.T) {
+	s := State{Tier: Tiers[1], Flopped: true,
+		Seats: []Seat{{Name: "Reala"}, {Name: "Bob"}}}
+	var evs []Event
+
+	// Reala wins a 400 pot. The rake on it (5%, 20) is Reala's to have paid.
+	s.payPot(Pot{Amount: 400, Eligible: []int{0}}, []ranked{{seat: 0}}, &evs)
+	if s.Seats[0].Paid != 20 {
+		t.Errorf("the seat that won the pot paid %d in rake, want 20", s.Seats[0].Paid)
+	}
+	if s.Seats[1].Paid != 0 {
+		t.Errorf("the other player was charged %d in rake for a pot they were not in", s.Seats[1].Paid)
+	}
+	if s.Paid != 20 {
+		t.Errorf("the table total is %d, want 20 — it is still the sum for the audit", s.Paid)
+	}
+
+	// Bob wins the next one. His tally moves; Reala's stays where it was.
+	s.payPot(Pot{Amount: 200, Eligible: []int{1}}, []ranked{{seat: 1}}, &evs)
+	if s.Seats[0].Paid != 20 {
+		t.Errorf("Reala's tally moved on a pot Bob won: %d, want 20", s.Seats[0].Paid)
+	}
+	if s.Seats[1].Paid != 10 {
+		t.Errorf("Bob paid %d in rake on a 200 pot he won, want 10", s.Seats[1].Paid)
+	}
+	if s.Paid != 30 {
+		t.Errorf("the table total is %d, want 30", s.Paid)
+	}
+}
+
 func TestASplitPotSplits(t *testing.T) {
 	s := State{Tier: Tiers[1], Seats: []Seat{{Name: "You"}, {Name: "A", Bot: true}}}
 	var evs []Event
@@ -462,25 +511,25 @@ func TestASplitPotSplits(t *testing.T) {
 
 func TestYouCannotWalkOutOfALiveHand(t *testing.T) {
 	s := table(t, Tiers[0], 2, 200)
-	s, _, _ = ApplyMove(s, Move{Kind: Deal})
+	s, _, _ = apply(s, Move{Kind: Deal})
 	if s.Phase != PhaseBetting {
 		t.Skip("the hand ended before the player could act")
 	}
-	if _, _, err := ApplyMove(s, Move{Kind: Leave}); err != ErrHandLive {
+	if _, _, err := apply(s, Move{Kind: Leave}); err != ErrHandLive {
 		t.Errorf("leaving mid-hand gave %v, want ErrHandLive", err)
 	}
-	if _, _, err := ApplyMove(s, Move{Kind: TopUp, Amount: 10}); err != ErrHandLive {
+	if _, _, err := apply(s, Move{Kind: TopUp, Amount: 10}); err != ErrHandLive {
 		t.Errorf("topping up mid-hand gave %v, want ErrHandLive", err)
 	}
 }
 
 func TestLeavingTakesTheStackHome(t *testing.T) {
 	s := table(t, Tiers[0], 1, 200)
-	s, _, _ = ApplyMove(s, Move{Kind: Deal})
+	s, _, _ = apply(s, Move{Kind: Deal})
 	s = playOut(t, s)
 
 	stack := s.Seats[You].Stack
-	s, _, err := ApplyMove(s, Move{Kind: Leave})
+	s, _, err := apply(s, Move{Kind: Leave})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -490,7 +539,7 @@ func TestLeavingTakesTheStackHome(t *testing.T) {
 	if s.Payout != stack {
 		t.Errorf("payout %d, want the %d that was in front of us", s.Payout, stack)
 	}
-	if _, _, err := ApplyMove(s, Move{Kind: Deal}); err != ErrOver {
+	if _, _, err := apply(s, Move{Kind: Deal}); err != ErrOver {
 		t.Errorf("dealt a hand at a table we got up from: %v", err)
 	}
 }
@@ -514,12 +563,12 @@ func TestBustingEndsTheSession(t *testing.T) {
 
 func TestATopUpCannotGoOverTheTableMax(t *testing.T) {
 	s := table(t, Tiers[0], 1, 200) // max buy is 200, and we're at it
-	if _, _, err := ApplyMove(s, Move{Kind: TopUp, Amount: 1}); err != ErrBadBuyIn {
+	if _, _, err := apply(s, Move{Kind: TopUp, Amount: 1}); err != ErrBadBuyIn {
 		t.Errorf("topped up over the table maximum: %v", err)
 	}
 
 	s = table(t, Tiers[0], 1, 100)
-	s, _, err := ApplyMove(s, Move{Kind: TopUp, Amount: 50})
+	s, _, err := apply(s, Move{Kind: TopUp, Amount: 50})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -534,47 +583,45 @@ func TestATopUpCannotGoOverTheTableMax(t *testing.T) {
 func TestABuyInHasToBeInRange(t *testing.T) {
 	tier := Tiers[0]
 	for _, amount := range []int64{0, tier.MinBuy - 1, tier.MaxBuy + 1} {
-		if _, _, err := New(tier, 1, amount, 5, 1, 2); err != ErrBadBuyIn {
+		if _, _, err := New(tier, SoloSeats(tier, 1, amount), 5, 1, 2); err != ErrBadBuyIn {
 			t.Errorf("buy-in of %d at a %d–%d table: %v", amount, tier.MinBuy, tier.MaxBuy, err)
 		}
 	}
 }
 
-// ---- what the player is allowed to know ------------------------------------
+// ---- what the raw script carries ------------------------------------------
 
-func TestTheScriptNeverCarriesABotsCards(t *testing.T) {
-	rng := rand.New(rand.NewPCG(4, 4))
-	s := table(t, Tiers[0], 3, 200)
-
-	for hand := 0; hand < 20 && s.Phase != PhaseDone; hand++ {
-		s, evs, err := ApplyMove(s, Move{Kind: Deal})
+// The engine no longer redacts the event stream, and this pins why: a shared
+// table has more than one human, so the engine cannot know who a stream is for.
+// It emits every seat's hole cards, and the *view* layer builds each viewer's
+// redacted copy — that per-seat redaction is the security boundary now, and it
+// has its own test in the web package (TestHoldemViewNeverLeaksAnotherSeatsCards).
+//
+// So the engine-level contract flipped: the deal must carry a hole event for
+// every dealt seat, or a viewer would have no cards of their own to be shown.
+func TestTheDealScriptCarriesEverySeatsHole(t *testing.T) {
+	s := table(t, Tiers[0], 3, 200) // four seats: one human, three bots
+	s, evs, err := apply(s, Move{Kind: Deal})
 	if err != nil {
 		t.Fatal(err)
 	}
-		noBotCards(t, s, evs)
 
-		for s.Phase == PhaseBetting {
-			var next []Event
-			s, next, err = ApplyMove(s, randomMove(s, rng))
-			if err != nil {
-				t.Fatal(err)
-			}
-			noBotCards(t, s, next)
-		}
-	}
-}
-
-// A bot's cards may appear in exactly one kind of event: the showdown that turns
-// them face up, which is the moment they stop being secret.
-func noBotCards(t *testing.T, s State, evs []Event) {
-	t.Helper()
+	holes := map[int][]cards.Card{}
 	for _, e := range evs {
-		if len(e.Cards) == 0 || e.Seat < 0 || e.Kind == "show" {
+		if e.Kind == "hole" {
+			holes[e.Seat] = e.Cards
+		}
+	}
+	for i := range s.Seats {
+		if s.Seats[i].State == Out {
 			continue
 		}
-		if e.Seat != You && s.Seats[e.Seat].Bot {
-			t.Fatalf("a %q event carries seat %d's cards (%v) — that's a bot's hand",
-				e.Kind, e.Seat, e.Cards)
+		got := holes[i]
+		if len(got) != 2 {
+			t.Fatalf("seat %d got no hole event; the view has nothing to redact from", i)
+		}
+		if got[0] != s.Seats[i].Hole[0] || got[1] != s.Seats[i].Hole[1] {
+			t.Errorf("seat %d hole event %v disagrees with state %v", i, got, s.Seats[i].Hole)
 		}
 	}
 }
@@ -655,17 +702,17 @@ func TestTheBotsAreActuallyTrained(t *testing.T) {
 	rng := rand.New(rand.NewPCG(11, 12))
 	for game := 0; game < 40; game++ {
 		tier := Tiers[1]
-		s, _, err := New(tier, 1, tier.MaxBuy, tier.RakePct, uint64(game), 5)
+		s, _, err := New(tier, SoloSeats(tier, 1, tier.MaxBuy), tier.RakePct, uint64(game), 5)
 		if err != nil {
 			t.Fatal(err)
 		}
 		for hand := 0; hand < 6 && s.Phase != PhaseDone; hand++ {
-			s, _, err = ApplyMove(s, Move{Kind: Deal})
+			s, _, err = apply(s, Move{Kind: Deal})
 			if err != nil {
 				t.Fatal(err)
 			}
 			for s.Phase == PhaseBetting {
-				s, _, err = ApplyMove(s, randomMove(s, rng))
+				s, _, err = apply(s, randomMove(s, rng))
 				if err != nil {
 					t.Fatal(err)
 				}
@@ -691,7 +738,7 @@ func TestTheBotsAreActuallyTrained(t *testing.T) {
 
 func table(t *testing.T, tier Tier, bots int, buyIn int64) State {
 	t.Helper()
-	s, _, err := New(tier, bots, buyIn, tier.RakePct, 1, 2)
+	s, _, err := New(tier, SoloSeats(tier, bots, buyIn), tier.RakePct, 1, 2)
 	if err != nil {
 		t.Fatalf("new table: %v", err)
 	}
@@ -710,7 +757,7 @@ func playOut(t *testing.T, s State) State {
 			move = Move{Kind: Check}
 		}
 		var err error
-		s, _, err = ApplyMove(s, move)
+		s, _, err = apply(s, move)
 		if err != nil {
 			t.Fatalf("playing out: %v", err)
 		}
@@ -734,7 +781,7 @@ func has(evs []Event, kind string) bool {
 // the only thing that reads this, which is exactly why nothing caught it.
 func TestPositionsDoNotMoveWhenSeatsFold(t *testing.T) {
 	s := table(t, Tiers[0], 5, 200) // six-handed
-	s, _, _ = ApplyMove(s, Move{Kind: Deal})
+	s, _, _ = apply(s, Move{Kind: Deal})
 
 	before := make([]string, len(s.Seats))
 	for i := range s.Seats {

internal/games/holdem/multiway_test.go

@@ -0,0 +1,112 @@
+package holdem
+
+import (
+	"math/rand/v2"
+	"testing"
+)
+
+// The reshape's own guard: a table with more than one human actually plays, and
+// the chips still conserve when the person to act is not always seat zero.
+//
+// The solo suite proves the engine still behaves as it did; this proves the thing
+// that changed. Two humans and two bots sit down, and the driver plays whichever
+// human the action stops on — which is the whole point of the multiway advance:
+// it runs the bots itself and hands control back at every *human* seat, not just
+// at seat zero.
+
+// randomMoveFor picks a legal move for a specific seat, the multiway sibling of
+// randomMove. It never folds when it can check, so hands actually develop.
+func randomMoveFor(s State, seat int, rng *rand.Rand) Move {
+	owed := s.Owed(seat)
+	var legal []Move
+	if owed > 0 {
+		legal = append(legal, Move{Kind: Fold}, Move{Kind: Call})
+	} else {
+		legal = append(legal, Move{Kind: Check})
+	}
+	if s.Seats[seat].Stack > owed && s.canBet() {
+		if to := s.MinRaiseTo(seat); to < s.MaxRaiseTo(seat) {
+			legal = append(legal, Move{Kind: Raise, To: to})
+		}
+	}
+	return legal[rng.IntN(len(legal))]
+}
+
+func TestMultiwayChipsAreConserved(t *testing.T) {
+	for game := 0; game < 100; game++ {
+		rng := rand.New(rand.NewPCG(uint64(game), 71))
+		tier := Tiers[game%len(Tiers)]
+
+		// Two humans, two bots. The humans sit at 0 and 2 so the action genuinely
+		// lands on a non-zero human seat, which is the case the old engine could not
+		// have reached.
+		seats := []SeatConfig{
+			{Name: "Ana", Stack: tier.MaxBuy},
+			{Name: "Bot A", Bot: true, Stack: tier.MaxBuy},
+			{Name: "Bo", Stack: tier.MaxBuy},
+			{Name: "Bot B", Bot: true, Stack: tier.MaxBuy},
+		}
+		s, _, err := New(tier, seats, tier.RakePct, uint64(game), 7)
+		if err != nil {
+			t.Fatalf("new table: %v", err)
+		}
+		want := chipsAt(s)
+
+		for hand := 0; hand < 8 && s.Phase == PhaseHandOver; hand++ {
+			var evs []Event
+			s, evs, err = ApplyMove(s, 0, Move{Kind: Deal})
+			if err != nil {
+				t.Fatalf("game %d hand %d: deal: %v", game, hand, err)
+			}
+			want += reloaded(evs)
+			check(t, s, want, game, hand, "deal")
+
+			for step := 0; s.Phase == PhaseBetting; step++ {
+				if step > 400 {
+					t.Fatalf("game %d hand %d: the hand will not end", game, hand)
+				}
+				seat := s.ToAct
+				if s.Seats[seat].Bot {
+					t.Fatalf("game %d: advance stopped on bot seat %d — it should run bots itself", game, seat)
+				}
+				s, _, err = ApplyMove(s, seat, randomMoveFor(s, seat, rng))
+				if err != nil {
+					t.Fatalf("game %d hand %d seat %d: %v", game, hand, seat, err)
+				}
+				check(t, s, want, game, hand, "move")
+			}
+		}
+	}
+}
+
+// TestMultiwayRejectsOutOfTurnMoves pins that a human cannot act when it is
+// another human's turn — the betting move is legal only from the seat to act.
+func TestMultiwayRejectsOutOfTurnMoves(t *testing.T) {
+	tier := Tiers[0]
+	seats := []SeatConfig{
+		{Name: "Ana", Stack: tier.MaxBuy},
+		{Name: "Bo", Stack: tier.MaxBuy},
+	}
+	s, _, err := New(tier, seats, tier.RakePct, 3, 9)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s, _, err = ApplyMove(s, 0, Move{Kind: Deal})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.Phase != PhaseBetting {
+		t.Fatalf("want a live hand, got phase %s", s.Phase)
+	}
+
+	// Whoever is not to act tries to move. It must be refused, and nothing must
+	// change.
+	other := 1 - s.ToAct
+	before := chipsAt(s)
+	if _, _, err := ApplyMove(s, other, Move{Kind: Call}); err != ErrNotYourTurn {
+		t.Fatalf("want ErrNotYourTurn from the seat not to act, got %v", err)
+	}
+	if got := chipsAt(s); got != before {
+		t.Errorf("a refused move moved chips: %d -> %d", before, got)
+	}
+}

internal/games/uno/bot.go

@@ -173,17 +173,9 @@ func botColor(hand []Card, rng *rand.Rand) Color {
 	return best
 }
 
-// botNames deals the bots their names. Flavour, and load-bearing flavour: "Kiwi
-// played a +4" is a table, "Bot 2 played a +4" is a test fixture.
-func botNames(n int, rng *rand.Rand) []string {
-	pool := append([]string(nil), botPool...)
-	rng.Shuffle(len(pool), func(i, j int) { pool[i], pool[j] = pool[j], pool[i] })
-	if n > len(pool) {
-		n = len(pool)
-	}
-	return pool[:n]
-}
-
+// botPool are the regulars a bot seat is named from. Flavour, and load-bearing
+// flavour: "Kiwi played a +4" is a table, "Bot 2 played a +4" is a test fixture.
+// More names than a full table, so no two chairs ever share one.
 var botPool = []string{
 	"Kiwi", "Mochi", "Bramble", "Pixel", "Gus", "Nori", "Waffle", "Marzipan",
 	"Tuck", "Bebop", "Olive", "Rascal", "Peaches", "Dot", "Sable", "Clementine",

internal/games/uno/call.go

@@ -49,7 +49,7 @@ func botForgets(rng *rand.Rand) bool { return rng.Float64() < botForget }
 // — announces it. A seat on any other number of cards owes nothing and this does
 // nothing, which is what makes it safe to call after every play.
 func (s *State) declare(seat int, called bool, evs *[]Event) {
-	if s.Phase == PhaseDone || len(s.Hands[seat]) != 1 {
+	if !s.playing() || len(s.Hands[seat]) != 1 {
 		return
 	}
 	s.ensureCalled()
@@ -59,43 +59,45 @@ func (s *State) declare(seat int, called bool, evs *[]Event) {
 	}
 }
 
-// botsCatch is the window. You have just played, you are holding one card, and
-// you didn't say the word — so every bot still in the game gets one look, in seat
-// order, and the first to see it takes you for two.
+// botsCatch is the window. The seat that just played is holding one card and
+// didn't say the word — so every bot still in the hand gets one look, in seat
+// order, and the first to see it takes them for two.
 //
 // It runs before runBots on purpose. The catch has to land while the table is
-// still looking at the card you played, not three turns later.
-func (s *State) botsCatch(evs *[]Event, rng *rand.Rand) {
-	if s.Phase == PhaseDone || len(s.Hands[You]) != 1 || s.called(You) {
+// still looking at the card that was played, not three turns later. Only the bots
+// catch on a roll here; a human polices the table with the catch button, which is
+// the asymmetry the whole rule turns on — attention is the player's edge.
+func (s *State) botsCatch(actor int, evs *[]Event, rng *rand.Rand) {
+	if !s.playing() || len(s.Hands[actor]) != 1 || s.called(actor) {
 		return
 	}
 	for _, seat := range s.alive() {
-		if seat == You {
-			continue
+		if seat == actor || !s.Seats[seat].Bot {
+			continue // a human catches with the button, not on a roll
 		}
 		if rng.Float64() >= botAlert {
 			continue // this one wasn't looking
 		}
-		s.penalise(You, seat, EvCaught, evs, rng)
+		s.penalise(actor, seat, EvCaught, evs, rng)
 		return // caught once is caught. They don't queue up to take turns at you
 	}
 }
 
-// playerCatches calls out a seat you think is holding one card in silence.
+// seatCatches calls out a seat the caller thinks is holding one card in silence.
 //
-// It is not a turn: right or wrong, the turn stays where it was, which is with
-// you. What it costs is the risk — a seat that did call, or isn't on one card at
-// all, is a seat you have just accused of nothing, and that is two cards to you.
-func (s *State) playerCatches(m Move, rng *rand.Rand) ([]Event, error) {
+// It is not a turn: right or wrong, the turn stays where it was. What it costs is
+// the risk — a seat that did call, or isn't on one card at all, is a seat the
+// caller has accused of nothing, and that is two cards to them.
+func (s *State) seatCatches(caller int, m Move, rng *rand.Rand) ([]Event, error) {
 	seat := m.Seat
-	if seat == You || seat < 0 || seat >= len(s.Hands) || !s.live(seat) {
+	if seat == caller || seat < 0 || seat >= len(s.Hands) || !s.live(seat) {
 		return nil, ErrNoCatch
 	}
 	var evs []Event
 	if len(s.Hands[seat]) == 1 && !s.called(seat) {
-		s.penalise(seat, You, EvCaught, &evs, rng) // got them
+		s.penalise(seat, caller, EvCaught, &evs, rng) // got them
 	} else {
-		s.penalise(You, seat, EvMiscall, &evs, rng) // they were clean, and you weren't looking
+		s.penalise(caller, seat, EvMiscall, &evs, rng) // they were clean, and you weren't looking
 	}
 	return evs, nil
 }
@@ -127,11 +129,11 @@ func (s *State) penalise(victim, by int, kind string, evs *[]Event, rng *rand.Ra
 //
 // It answers for every card, legal or not. The table only ever asks about a card
 // you were allowed to play anyway.
-func (s State) UnoAt() []int {
-	if s.Phase == PhaseDone || s.Turn != You {
+func (s State) UnoAt(seat int) []int {
+	if !s.playing() || s.Turn != seat {
 		return nil
 	}
-	hand := s.Hands[You]
+	hand := s.Hands[seat]
 	var out []int
 	for i, c := range hand {
 		left := len(hand) - 1
@@ -156,13 +158,13 @@ func (s State) UnoAt() []int {
 // already isn't — this is the same two facts, subtracted, and doing that
 // subtraction on the server is only so that the rule for what counts as catchable
 // lives in one place instead of two.
-func (s State) Catchable() []int {
-	if s.Phase == PhaseDone || s.Turn != You {
+func (s State) Catchable(viewer int) []int {
+	if !s.playing() || s.Turn != viewer {
 		return nil // you can only catch a seat on your own turn
 	}
 	var out []int
 	for _, seat := range s.alive() {
-		if seat != You && len(s.Hands[seat]) == 1 && !s.called(seat) {
+		if seat != viewer && len(s.Hands[seat]) == 1 && !s.called(seat) {
 			out = append(out, seat)
 		}
 	}

internal/games/uno/call_test.go

@@ -14,7 +14,7 @@ import "testing"
 // a +2.
 func oneCardAway(t *testing.T, seed uint64) State {
 	t.Helper()
-	s := deal(t, duel(), 100, seed)
+	s := deal(t, duel(), seed)
 	s.Color = Red
 	s.Discard = []Card{{Red, Five}}
 	s.Hands[You] = []Card{{Red, One}, {Red, Two}}
@@ -33,7 +33,7 @@ func oneCardAway(t *testing.T, seed uint64) State {
 func TestCallingUnoKeepsYouSafe(t *testing.T) {
 	for seed := uint64(0); seed < 200; seed++ {
 		s := oneCardAway(t, seed)
-		next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0, Uno: true})
+		next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0, Uno: true})
 		if err != nil {
 			t.Fatalf("seed %d: play: %v", seed, err)
 		}
@@ -56,7 +56,7 @@ func TestForgettingUnoGetsYouCaught(t *testing.T) {
 	caught, games := 0, 400
 	for seed := uint64(0); seed < uint64(games); seed++ {
 		s := oneCardAway(t, seed)
-		next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+		next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 		if err != nil {
 			t.Fatalf("seed %d: play: %v", seed, err)
 		}
@@ -83,13 +83,13 @@ func TestForgettingUnoGetsYouCaught(t *testing.T) {
 // forgetting at a full table is very nearly always punished.
 func TestMoreBotsMeansLessGettingAwayWithIt(t *testing.T) {
 	away := func(tier Tier, seed uint64) bool {
-		s := deal(t, tier, 100, seed)
+		s := deal(t, tier, seed)
 		s.Color = Red
 		s.Discard = []Card{{Red, Five}}
 		s.Hands[You] = []Card{{Red, One}, {Red, Two}}
 		s.Turn = You
 		s.Phase = PhasePlay
-		_, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+		_, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 		if err != nil {
 			t.Fatalf("play: %v", err)
 		}
@@ -114,7 +114,7 @@ func TestMoreBotsMeansLessGettingAwayWithIt(t *testing.T) {
 // quietBot puts a bot on one card it never called, with the turn back on you.
 func quietBot(t *testing.T, called bool) State {
 	t.Helper()
-	s := deal(t, duel(), 100, 21)
+	s := deal(t, duel(), 21)
 	s.Color = Red
 	s.Discard = []Card{{Red, Five}}
 	s.Hands[You] = []Card{{Red, One}, {Blue, Two}, {Green, Three}}
@@ -131,7 +131,7 @@ func TestCatchingAQuietBot(t *testing.T) {
 	s := quietBot(t, false)
 	before := total(census(s))
 
-	next, evs, err := ApplyMove(s, Move{Kind: MoveCatch, Seat: 1})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MoveCatch, Seat: 1})
 	if err != nil {
 		t.Fatalf("catch: %v", err)
 	}
@@ -167,7 +167,7 @@ func TestCatchingACleanBotCostsYou(t *testing.T) {
 		}()},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			next, evs, err := ApplyMove(tc.state, Move{Kind: MoveCatch, Seat: 1})
+			next, evs, err := ApplyMove(tc.state, You, Move{Kind: MoveCatch, Seat: 1})
 			if err != nil {
 				t.Fatalf("catch: %v", err)
 			}
@@ -188,7 +188,7 @@ func TestCatchingACleanBotCostsYou(t *testing.T) {
 func TestYouCannotCatchYourself(t *testing.T) {
 	s := quietBot(t, false)
 	for _, seat := range []int{You, -1, 9} {
-		if _, _, err := ApplyMove(s, Move{Kind: MoveCatch, Seat: seat}); err != ErrNoCatch {
+		if _, _, err := ApplyMove(s, You, Move{Kind: MoveCatch, Seat: seat}); err != ErrNoCatch {
 			t.Errorf("catching seat %d: got %v, want ErrNoCatch", seat, err)
 		}
 	}
@@ -198,7 +198,7 @@ func TestYouCannotCatchYourself(t *testing.T) {
 // your way back down to one: that is a new call you owe, not the old one still
 // standing. Without this a seat could be caught out once and never again.
 func TestACallIsSpentWhenTheHandGrows(t *testing.T) {
-	s := deal(t, duel(), 100, 5)
+	s := deal(t, duel(), 5)
 	s.Color = Red
 	s.Discard = []Card{{Red, Five}}
 	s.Hands[You] = []Card{{Red, One}}
@@ -208,7 +208,7 @@ func TestACallIsSpentWhenTheHandGrows(t *testing.T) {
 
 	// Draw, and the hand is two: the word you said was about a card you no longer
 	// hold on its own.
-	next, _, err := ApplyMove(s, Move{Kind: MoveDraw})
+	next, _, err := ApplyMove(s, You, Move{Kind: MoveDraw})
 	if err != nil {
 		t.Fatalf("draw: %v", err)
 	}
@@ -220,17 +220,17 @@ func TestACallIsSpentWhenTheHandGrows(t *testing.T) {
 // TestCatchableIsWhatTheTableCanSee — a quiet bot on one card, and nobody else.
 func TestCatchable(t *testing.T) {
 	s := quietBot(t, false)
-	if got := s.Catchable(); len(got) != 1 || got[0] != 1 {
+	if got := s.Catchable(You); len(got) != 1 || got[0] != 1 {
 		t.Errorf("Catchable() = %v, want [1]", got)
 	}
 	clean := quietBot(t, true)
-	if got := clean.Catchable(); len(got) != 0 {
+	if got := clean.Catchable(You); len(got) != 0 {
 		t.Errorf("Catchable() = %v on a bot that called, want none", got)
 	}
 	// And not on somebody else's turn: you can only call it out when it's on you.
 	off := quietBot(t, false)
 	off.Turn = 1
-	if got := off.Catchable(); len(got) != 0 {
+	if got := off.Catchable(You); len(got) != 0 {
 		t.Errorf("Catchable() = %v off-turn, want none", got)
 	}
 }
@@ -240,7 +240,7 @@ func TestCatchable(t *testing.T) {
 // all" takes every card of its colour with it, so a six-card hand can land on
 // one, and a browser subtracting one from six gets a player caught.
 func TestUnoAtSeesThroughDiscardAll(t *testing.T) {
-	s := deal(t, nmDuel(), 100, 3)
+	s := deal(t, nmDuel(), 3)
 	s.Color = Red
 	s.Discard = []Card{{Red, Five}}
 	s.Hands[You] = []Card{{Red, DiscardAll}, {Red, One}, {Red, Nine}, {Red, Seven}, {Blue, Two}}
@@ -249,7 +249,7 @@ func TestUnoAtSeesThroughDiscardAll(t *testing.T) {
 
 	// Index 0 dumps itself and the three other reds: five cards become one.
 	// Index 4 is an ordinary play: five become four.
-	got := s.UnoAt()
+	got := s.UnoAt(You)
 	if len(got) != 1 || got[0] != 0 {
 		t.Errorf("UnoAt() = %v, want [0]: only the discard-all lands you on one card", got)
 	}
@@ -258,7 +258,7 @@ func TestUnoAtSeesThroughDiscardAll(t *testing.T) {
 // TestUnoAtIsTheOrdinaryCaseToo — two cards in hand, and either of them is a call.
 func TestUnoAtIsTheOrdinaryCaseToo(t *testing.T) {
 	s := oneCardAway(t, 1)
-	got := s.UnoAt()
+	got := s.UnoAt(You)
 	if len(got) != 2 {
 		t.Errorf("UnoAt() = %v, want both cards: either one leaves you holding one", got)
 	}
@@ -267,19 +267,19 @@ func TestUnoAtIsTheOrdinaryCaseToo(t *testing.T) {
 // TestGoingOutNeedsNoCall — your last card is not one card, it's none. Nobody
 // owes the table a word for winning.
 func TestGoingOutNeedsNoCall(t *testing.T) {
-	s := deal(t, duel(), 100, 9)
+	s := deal(t, duel(), 9)
 	s.Color = Red
 	s.Discard = []Card{{Red, Five}}
 	s.Hands[You] = []Card{{Red, One}}
 	s.Turn = You
 	s.Phase = PhasePlay
 
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 	if err != nil {
 		t.Fatalf("play the last card: %v", err)
 	}
-	if !next.Outcome.Won() {
-		t.Fatalf("outcome %q, want a win", next.Outcome)
+	if next.Winner != You {
+		t.Fatalf("winner %d outcome %q, want a win for you", next.Winner, next.Outcome)
 	}
 	if hasKind(evs, EvCaught) {
 		t.Error("caught for not calling UNO on the card that won the game")
@@ -292,7 +292,7 @@ func TestGoingOutNeedsNoCall(t *testing.T) {
 func TestABotThatForgetsSaysNothing(t *testing.T) {
 	quiet := 0
 	for seed := uint64(0); seed < 300 && quiet < 1; seed++ {
-		s := deal(t, duel(), 100, seed)
+		s := deal(t, duel(), seed)
 		s.Color = Red
 		s.Discard = []Card{{Red, Five}}
 		s.Hands[You] = []Card{{Blue, Two}, {Blue, Three}, {Blue, Four}}
@@ -302,7 +302,7 @@ func TestABotThatForgetsSaysNothing(t *testing.T) {
 		s.Turn = You // the bot plays on the back of your move
 
 		// Draw, handing the turn over: the bot plays a red and lands on one card.
-		next, evs, err := ApplyMove(s, Move{Kind: MoveDraw})
+		next, evs, err := ApplyMove(s, You, Move{Kind: MoveDraw})
 		if err != nil {
 			t.Fatalf("draw: %v", err)
 		}
@@ -313,7 +313,7 @@ func TestABotThatForgetsSaysNothing(t *testing.T) {
 		if hasKind(evs, EvUno) {
 			t.Error("a bot that forgot to call still announced it")
 		}
-		if len(next.Catchable()) != 1 {
+		if len(next.Catchable(You)) != 1 {
 			t.Error("a quiet bot on one card isn't catchable")
 		}
 	}

internal/games/uno/nomercy.go

@@ -109,10 +109,10 @@ func (s *State) absorb(seat int, evs *[]Event, rng *rand.Rand) {
 	s.Pending = 0
 	s.deal(seat, n, true, evs, rng)
 
-	// The seat can die paying the bill, and a mercy kill can end the whole game —
-	// the player dying, or the last bot dying and leaving you alone at the table.
-	// So the phase is only reset if there is still a game to have a phase.
-	if s.mercy(seat, evs, rng) && s.Phase == PhaseDone {
+	// The seat can die paying the bill, and a mercy kill can end the hand — the last
+	// seat but one dying leaves somebody alone to take the pot. So the phase is only
+	// reset if there is still a hand to have a phase.
+	if s.mercy(seat, evs, rng) && !s.playing() {
 		return
 	}
 	if !s.live(seat) {
@@ -188,13 +188,13 @@ func (s *State) discardAll(seat int, color Color, evs *[]Event) int {
 }
 
 // mercy checks a seat against the limit and, if it has crossed it, takes it out
-// of the game: its cards go back into the deck and it never plays again. It
+// of the hand: its cards go back into the deck and it plays no more this hand. It
 // reports whether the seat died.
 //
-// What that *means* depends on who it was. You dying is the game over — the
-// stake is gone whatever the bots do next. A bot dying leaves a table with one
-// fewer seat, and if it leaves you alone at it, you have won: everybody who could
-// have beaten you to the last card is dead.
+// A mercy kill is no longer game over for anyone — it is one seat out of the
+// current hand, human or bot alike, and the hand plays on among the living. When
+// it leaves exactly one seat alive, that seat has outlived the table and takes the
+// pot; whoever it is, they win it the same way going out first would.
 func (s *State) mercy(seat int, evs *[]Event, rng *rand.Rand) bool {
 	if !s.Tier.NoMercy || !s.live(seat) || len(s.Hands[seat]) < MercyLimit {
 		return false
@@ -207,12 +207,8 @@ func (s *State) mercy(seat int, evs *[]Event, rng *rand.Rand) bool {
 	s.Pending = 0 // a dead seat pays no bill, and leaves none behind
 	*evs = append(*evs, s.mine(Event{Kind: EvMercy, Seat: seat, N: n, Left: 0}))
 
-	if seat == You {
-		s.lose(evs)
-		return true
-	}
 	if alive := s.alive(); len(alive) == 1 {
-		s.settle(alive[0], evs) // you outlived the table
+		s.settle(alive[0], OutcomeWon, evs) // the last one standing takes the pot
 	}
 	return true
 }
@@ -233,17 +229,9 @@ func (s State) alive() []int {
 	return out
 }
 
-// live reports whether a seat is still playing. Out is empty in a normal game and
-// in any game saved before No Mercy existed, so a missing entry is a living seat.
+// live reports whether a seat is still in the current hand. Out is empty between
+// hands and in any game saved before No Mercy existed, so a missing entry is a
+// living seat.
 func (s State) live(seat int) bool {
 	return seat >= len(s.Out) || !s.Out[seat]
 }
-
-// lose ends the game against the player without anybody having gone out — which
-// is what a mercy kill on seat zero is.
-func (s *State) lose(evs *[]Event) {
-	s.Phase = PhaseDone
-	s.Outcome = OutcomeLost
-	s.Payout = 0
-	*evs = append(*evs, Event{Kind: EvSettle, Seat: You, Text: string(OutcomeLost)})
-}

internal/games/uno/nomercy_test.go

@@ -33,32 +33,23 @@ func TestNoMercyDeckIsADeck(t *testing.T) {
 			t.Errorf("%v %v: got %d, want %d", c.Color, c.Value, m[c], n)
 		}
 	}
-	// The normal deck's wilds are not in this one, and its coloured +4 is not in
-	// the normal one. They are different cards that print the same thing.
 	if m[Card{Wild, WildCard}] != 0 || m[Card{Wild, WildDrawFour}] != 0 {
 		t.Error("the No Mercy deck should print none of the normal wilds")
 	}
 }
 
-// TestNoMercyCensus is the load-bearing one, and the same one the normal game
-// has: 168 cards, each in exactly one place, checked after every move of a
-// hundred games played to the end.
-//
-// It is what would catch the two new ways this deck can lose a card. Discard All
-// buries a whole colour under the pile, and a mercy kill shovels a
-// twenty-five-card hand back into the deck — either of those dropping a card on
-// the floor is a deck that quietly shrinks until the table can't be dealt.
+// TestNoMercyCensus is the load-bearing one: 168 cards, each in exactly one place,
+// checked after every move of a hundred hands played to the end.
 func TestNoMercyCensus(t *testing.T) {
 	for _, tier := range []Tier{nmDuel(), nmTable(), nmFull()} {
 		for seed := uint64(0); seed < 100; seed++ {
-			s := deal(t, tier, 100, seed)
-			start := census(s)
-			if got := total(start); got != 168 {
+			s := deal(t, tier, seed)
+			if got := total(census(s)); got != 168 {
 				t.Fatalf("%s seed %d: dealt %d cards, want 168", tier.Slug, seed, got)
 			}
 			rng := rand.New(rand.NewPCG(seed, 99))
-			for moves := 0; s.Phase != PhaseDone && moves < 800; moves++ {
-				next, _, err := ApplyMove(s, naive(s, rng))
+			for moves := 0; s.playing() && moves < 800; moves++ {
+				next, _, err := ApplyMove(s, You, naive(s, rng))
 				if err != nil {
 					t.Fatalf("%s seed %d: %v (phase %s)", tier.Slug, seed, err, s.Phase)
 				}
@@ -68,38 +59,31 @@ func TestNoMercyCensus(t *testing.T) {
 						tier.Slug, seed, total(got))
 				}
 			}
-			if s.Phase != PhaseDone {
-				t.Fatalf("%s seed %d: game never ended", tier.Slug, seed)
+			if s.playing() {
+				t.Fatalf("%s seed %d: hand never ended", tier.Slug, seed)
 			}
 		}
 	}
 }
 
-// naive is the strategy the multiples are priced against: play the first legal
-// card you hold, take a stack you can't answer, and draw when you have nothing.
-// It is a real way to play and a bad one, which is exactly what a house edge is
-// measured against.
+// naive is a bad-but-real strategy: play the first legal card, take a stack you
+// can't answer, and draw when you have nothing. Always played from the human seat.
 func naive(s State, rng *rand.Rand) Move {
 	if s.Phase == PhaseStack {
-		if p := s.Playable(); len(p) > 0 {
+		if p := s.Playable(You); len(p) > 0 {
 			return playMove(s, p[0], rng)
 		}
 		return Move{Kind: MoveTake}
 	}
-	if p := s.Playable(); len(p) > 0 {
+	if p := s.Playable(You); len(p) > 0 {
 		return playMove(s, p[0], rng)
 	}
 	return Move{Kind: MoveDraw}
 }
 
 // stack loads a seat's hand up to n cards by taking them off the deck, so the
-// table still holds 168 of them. Every card it moves is one that can't be played
-// on the pile, which is what a hand on its way to the mercy limit looks like.
+// table still holds 168 of them.
 func stack(s *State, seat, n int) {
-	// Every card the seat was holding goes back in the deck first, so the table is
-	// whole before we take n out of it again. The pile keeps whatever the deal
-	// turned over — replacing it with a card of our choosing would quietly destroy
-	// one, and the census below would blame the engine for it.
 	s.Deck = append(s.Deck, s.Hands[seat]...)
 	s.Hands[seat] = nil
 	s.Color = s.top().Color
@@ -120,15 +104,7 @@ func playMove(s State, idx int, rng *rand.Rand) Move {
 	if s.Hands[You][idx].IsWild() {
 		m.Color = Red + Color(rng.IntN(4))
 	}
-	// It calls UNO. That is not a strategy, it is a button — the table puts it in
-	// front of you and waits — and what these multiples price is *bad card play*,
-	// not a player who ignores the felt shouting at them.
-	//
-	// A player who genuinely never calls loses far more than this one does, and
-	// nothing here is priced for them. That is the rule having teeth, which is the
-	// point of it. Naive is the floor for someone playing the game badly, not for
-	// someone not playing it.
-	for _, at := range s.UnoAt() {
+	for _, at := range s.UnoAt(You) {
 		if at == idx {
 			m.Uno = true
 		}
@@ -136,13 +112,10 @@ func playMove(s State, idx int, rng *rand.Rand) Move {
 	return m
 }
 
-// TestAStackIsPassedOnAndPaidOnce walks the one rule the whole mode turns on: a
-// draw card doesn't land on you, it *opens a bill*, and the seat that can't
-// answer pays the whole thing.
+// TestAStackIsPassedOnAndPaid walks the rule the whole mode turns on: a draw card
+// opens a bill, and the seat that can't answer pays the whole thing.
 func TestAStackIsPassedOnAndPaid(t *testing.T) {
-	s := deal(t, nmDuel(), 100, 7)
-	// Rig it: you hold a +2 on a red pile, the bot holds one card that can answer
-	// and one that can't.
+	s := deal(t, nmDuel(), 7)
 	s.Color = Red
 	s.Discard = []Card{{Red, Five}}
 	s.Hands[You] = []Card{{Red, DrawTwo}, {Blue, One}}
@@ -150,9 +123,7 @@ func TestAStackIsPassedOnAndPaid(t *testing.T) {
 	s.Turn = You
 	s.Phase = PhasePlay
 
-	// You play the +2. The bot answers with its own, so the bill comes back to you
-	// at four — and you have nothing to answer with, so you pay it.
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 	if err != nil {
 		t.Fatalf("play +2: %v", err)
 	}
@@ -168,22 +139,15 @@ func TestAStackIsPassedOnAndPaid(t *testing.T) {
 	if !hasKind(evs, EvStack) {
 		t.Error("no stack event: the felt has nothing to show the player")
 	}
-	// You cannot draw your way out of it, and you cannot play a card that isn't a
-	// draw card.
-	if _, _, err := ApplyMove(next, Move{Kind: MoveDraw}); err != ErrMustStack {
+	if _, _, err := ApplyMove(next, You, Move{Kind: MoveDraw}); err != ErrMustStack {
 		t.Errorf("drawing out of a stack: %v, want ErrMustStack", err)
 	}
-	if _, _, err := ApplyMove(next, Move{Kind: MovePlay, Index: 0}); err != ErrMustStack {
+	if _, _, err := ApplyMove(next, You, Move{Kind: MovePlay, Index: 0}); err != ErrMustStack {
 		t.Errorf("playing a plain card under a stack: %v, want ErrMustStack", err)
 	}
 
-	// Pay it. The bot is left holding one card it cannot play, and — because No
-	// Mercy makes it draw until it can — it will draw into a fresh hand and may
-	// well open a *new* stack on the way. That's the game working, not a leak, so
-	// what's asserted here is the bill this seat paid, not the state of the table
-	// afterwards: four cards into the hand, and the bill discharged.
 	before := len(next.Hands[You])
-	paid, evs, err := ApplyMove(next, Move{Kind: MoveTake})
+	paid, evs, err := ApplyMove(next, You, Move{Kind: MoveTake})
 	if err != nil {
 		t.Fatalf("take: %v", err)
 	}
@@ -199,54 +163,49 @@ func TestAStackIsPassedOnAndPaid(t *testing.T) {
 	if len(paid.Hands[You]) < before+4 {
 		t.Errorf("hand went %d → %d, want at least four more", before, len(paid.Hands[You]))
 	}
-	// The bill you paid is gone. Anything pending now is a new stack the bot
-	// opened after yours was settled, and it is never the one you just paid.
 	if paid.Pending == 4 && paid.Phase == PhaseStack {
 		t.Error("the bill you just paid is still standing")
 	}
 }
 
-// TestTwentyFiveCardsKillsYou is the mercy rule, from the player's side: the
-// stake is gone the moment the hand hits the limit, whoever else is still playing.
-func TestTwentyFiveCardsKillsYou(t *testing.T) {
-	s := deal(t, nmFull(), 100, 3)
-	// Twenty-four cards in your hand, and a stack of ten pointed at you.
-	//
-	// The cards are *moved* from the deck, not invented: a fixture that conjures
-	// a hand out of nothing breaks the census before the engine gets a chance to,
-	// and then the census assertion below is testing the fixture instead of the
-	// mercy rule.
+// TestMercyKillsThePlayerButNotTheSession: the mercy limit takes the human out of
+// the *hand* — the pot goes to whoever is left, and the table plays on. It is no
+// longer game over.
+func TestMercyKillsThePlayerButNotTheSession(t *testing.T) {
+	s := deal(t, nmDuel(), 3)
 	stack(&s, You, 24)
 	s.Turn = You
 	s.Phase = PhaseStack
 	s.Pending = 10
 
-	next, evs, err := ApplyMove(s, Move{Kind: MoveTake})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MoveTake})
 	if err != nil {
 		t.Fatalf("take: %v", err)
 	}
 	if !hasKind(evs, EvMercy) {
 		t.Fatal("no mercy event: twenty-five cards should have killed the seat")
 	}
-	if next.Phase != PhaseDone || next.Outcome != OutcomeLost {
-		t.Fatalf("phase %s outcome %q, want done/lost", next.Phase, next.Outcome)
+	if next.playing() {
+		t.Fatalf("the hand should be over once one seat is left: phase %s", next.Phase)
 	}
-	if next.Payout != 0 {
-		t.Errorf("a mercy kill paid out %d, want nothing", next.Payout)
+	if next.live(You) || len(next.Hands[You]) != 0 {
+		t.Error("a dead seat should hold no cards and be out of the hand")
 	}
-	if len(next.Hands[You]) != 0 || next.live(You) {
-		t.Error("a dead seat should hold no cards and be out of the game")
+	// Heads-up, killing the human leaves the bot alone: it takes the pot.
+	if next.Winner != 1 {
+		t.Errorf("winner is seat %d, want the surviving bot", next.Winner)
 	}
 	if got := total(census(next)); got != 168 {
 		t.Errorf("%d cards after a mercy kill, want 168 — the hand goes back in the deck", got)
 	}
 }
 
-// TestOutlivingTheTableWins is the other side of the mercy rule, and the one
-// that makes No Mercy pay less than it looks like it should: the deck buries bots
-// too, and a table with every bot dead is a table you have won.
+// TestOutlivingTheTableWins: the deck buries bots too, and a table with every bot
+// dead is a pot you have taken.
 func TestOutlivingTheTableWins(t *testing.T) {
-	s := deal(t, nmDuel(), 100, 11)
+	s := deal(t, nmDuel(), 11)
+	pot := s.Pot
+	before := s.Seats[You].Stack
 	s.Color = Red
 	s.Discard = []Card{{Red, Five}}
 	s.Hands[You] = []Card{{Red, DrawTwo}, {Blue, One}}
@@ -257,63 +216,56 @@ func TestOutlivingTheTableWins(t *testing.T) {
 	s.Turn = You
 	s.Phase = PhasePlay
 
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 	if err != nil {
 		t.Fatalf("play +2: %v", err)
 	}
 	if !hasKind(evs, EvMercy) {
 		t.Fatal("the bot should have died taking the stack")
 	}
-	if next.Phase != PhaseDone || next.Outcome != OutcomeWon {
-		t.Fatalf("phase %s outcome %q, want done/won: the last seat standing wins",
-			next.Phase, next.Outcome)
+	if next.playing() || next.Winner != You {
+		t.Fatalf("phase %s winner %d, want a finished hand won by you", next.Phase, next.Winner)
 	}
-	if next.Payout != next.Pays() {
-		t.Errorf("paid %d, quoted %d — settle and the felt must agree", next.Payout, next.Pays())
+	profit := pot - s.Tier.Ante
+	wantWon := pot - int64(float64(profit)*rake)
+	if next.Seats[You].Stack != before+wantWon {
+		t.Errorf("your stack is %d, want %d", next.Seats[You].Stack, before+wantWon)
 	}
 }
 
-// TestYouDrawUntilYouCanPlay: no drawing one card and shrugging. The turn only
-// moves on when the deck itself has nothing left.
 func TestYouDrawUntilYouCanPlay(t *testing.T) {
-	s := deal(t, nmDuel(), 100, 5)
+	s := deal(t, nmDuel(), 5)
 	s.Color = Red
 	s.Discard = []Card{{Red, Five}}
 	s.Hands[You] = []Card{{Blue, One}} // nothing playable
-	// A deck whose first two cards are dead and whose third plays.
 	s.Deck = []Card{{Green, Two}, {Yellow, Three}, {Red, Nine}, {Blue, Four}}
 	s.Turn = You
 	s.Phase = PhasePlay
 
-	next, _, err := ApplyMove(s, Move{Kind: MoveDraw})
+	next, _, err := ApplyMove(s, You, Move{Kind: MoveDraw})
 	if err != nil {
 		t.Fatalf("draw: %v", err)
 	}
 	if len(next.Hands[You]) != 4 {
-		t.Fatalf("hand is %d, want 4: you draw until something plays",
-			len(next.Hands[You]))
+		t.Fatalf("hand is %d, want 4: you draw until something plays", len(next.Hands[You]))
 	}
 	if next.Phase != PhaseDrawn {
-		t.Fatalf("phase %s, want drawn: the card you stopped on is one you must play",
-			next.Phase)
+		t.Fatalf("phase %s, want drawn: the card you stopped on is one you must play", next.Phase)
 	}
-	// And you may not pass on it: you drew for it, you play it.
-	if _, _, err := ApplyMove(next, Move{Kind: MovePass}); err != ErrMustPlayNow {
+	if _, _, err := ApplyMove(next, You, Move{Kind: MovePass}); err != ErrMustPlayNow {
 		t.Errorf("passing in No Mercy: %v, want ErrMustPlayNow", err)
 	}
 }
 
-// TestSkipAllComesBackToYou — everyone else loses their turn, so the turn never
-// actually leaves the seat that played it.
 func TestSkipAllComesBackToYou(t *testing.T) {
-	s := deal(t, nmFull(), 100, 13)
+	s := deal(t, nmFull(), 13)
 	s.Color = Red
 	s.Discard = []Card{{Red, Five}}
 	s.Hands[You] = []Card{{Red, SkipAll}, {Blue, One}}
 	s.Turn = You
 	s.Phase = PhasePlay
 
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 	if err != nil {
 		t.Fatalf("play skip-all: %v", err)
 	}
@@ -325,10 +277,8 @@ func TestSkipAllComesBackToYou(t *testing.T) {
 	}
 }
 
-// TestDiscardAllTakesTheColourWithIt, and the cards it takes are still in the
-// game — buried under the pile, not deleted.
 func TestDiscardAllTakesTheColourWithIt(t *testing.T) {
-	s := deal(t, nmDuel(), 100, 17)
+	s := deal(t, nmDuel(), 17)
 	s.Color = Red
 	s.Discard = []Card{{Red, Five}}
 	s.Hands[You] = []Card{{Red, DiscardAll}, {Red, One}, {Red, Nine}, {Blue, Two}}
@@ -336,22 +286,26 @@ func TestDiscardAllTakesTheColourWithIt(t *testing.T) {
 	s.Phase = PhasePlay
 	before := total(census(s))
 
-	// With the call, because this play takes three reds out of the hand at once and
-	// lands on exactly one card — which is precisely the case a browser counting
-	// "hand length minus one" would miss, and the reason UnoAt is the engine's job.
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0, Uno: true})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0, Uno: true})
 	if err != nil {
 		t.Fatalf("play discard-all: %v", err)
 	}
 	if len(next.Hands[You]) != 1 {
-		t.Fatalf("hand is %d, want 1: every red should have gone with it",
-			len(next.Hands[You]))
+		t.Fatalf("hand is %d, want 1: every red should have gone with it", len(next.Hands[You]))
 	}
 	if next.Hands[You][0] != (Card{Blue, Two}) {
 		t.Errorf("kept %v, want the blue two", next.Hands[You][0])
 	}
-	if top := next.Top(); top.Value != DiscardAll {
-		t.Errorf("the card in play is %v, want the discard-all that was played", top.Value)
+	// The discard-all was played, so it is on the pile — the bot may have played over
+	// it since, which is why this looks for it rather than at the very top.
+	found := false
+	for _, c := range next.Discard {
+		if c.Value == DiscardAll {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("the discard-all isn't on the pile")
 	}
 	if !hasKind(evs, EvDiscardAll) {
 		t.Error("no discard event")
@@ -361,9 +315,8 @@ func TestDiscardAllTakesTheColourWithIt(t *testing.T) {
 	}
 }
 
-// TestRouletteFlipsUntilTheColour — and the victim keeps every card it turned.
 func TestRouletteFlipsUntilTheColour(t *testing.T) {
-	s := deal(t, nmDuel(), 100, 19)
+	s := deal(t, nmDuel(), 19)
 	s.Color = Blue
 	s.Discard = []Card{{Blue, Five}}
 	s.Hands[You] = []Card{{Wild, WildRoulette}, {Blue, One}}
@@ -372,8 +325,7 @@ func TestRouletteFlipsUntilTheColour(t *testing.T) {
 	s.Turn = You
 	s.Phase = PhasePlay
 
-	// Name red: the bot flips blue, green, yellow, red — four cards — and keeps them.
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0, Color: Red})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0, Color: Red})
 	if err != nil {
 		t.Fatalf("play roulette: %v", err)
 	}
@@ -386,8 +338,6 @@ func TestRouletteFlipsUntilTheColour(t *testing.T) {
 	if got != 4 {
 		t.Errorf("flipped %d, want 4 — up to and including the first red", got)
 	}
-	// One card it started with, plus the four it turned. (The bot is then skipped,
-	// so the turn is back with you and it never played any of them.)
 	if n := len(next.Hands[1]); n != 5 {
 		t.Errorf("the bot holds %d, want 5", n)
 	}
@@ -395,43 +345,3 @@ func TestRouletteFlipsUntilTheColour(t *testing.T) {
 		t.Error("the roulette lost a card")
 	}
 }
-
-// TestTheMultiplesAreStillPriced measures the naive strategy against the bots and
-// checks each tier still charges roughly the house's edge for it.
-//
-// This is the test that fails when somebody changes the bots, the deck, or a
-// rule, and it is *supposed* to: the tier and the game it prices are a pair. If
-// this goes red, re-measure and move the number, don't loosen the bound.
-func TestTheMultiplesAreStillPriced(t *testing.T) {
-	if testing.Short() {
-		t.Skip("slow: plays thousands of games")
-	}
-	for _, tier := range AllTiers() {
-		wins, games := 0, 3000
-		for seed := 0; seed < games; seed++ {
-			s := deal(t, tier, 100, uint64(seed)+7777)
-			rng := rand.New(rand.NewPCG(uint64(seed), 4242))
-			for moves := 0; s.Phase != PhaseDone && moves < 800; moves++ {
-				next, _, err := ApplyMove(s, naive(s, rng))
-				if err != nil {
-					t.Fatalf("%s: %v", tier.Slug, err)
-				}
-				s = next
-			}
-			if s.Outcome.Won() {
-				wins++
-			}
-		}
-		p := float64(wins) / float64(games)
-		// What a staked chip comes back as, playing badly: you win p of the time and
-		// keep the multiple less the rake on the profit, and lose the stake the rest.
-		ev := p*(1+(tier.Base-1)*(1-rake)) - 1
-		t.Logf("%-8s bots=%d base=%.2f  naive win rate %.1f%%  house edge %.1f%%",
-			tier.Slug, tier.Bots, tier.Base, p*100, -ev*100)
-		if ev < -0.14 || ev > -0.02 {
-			t.Errorf("%s: the house edge on naive play is %.1f%%, which is outside the 2–14%% "+
-				"band the tiers are priced to. Re-measure Base: %.2f would put it near 8%%.",
-				tier.Slug, -ev*100, (0.92/p-1)/(1-rake)+1)
-		}
-	}
-}

internal/games/uno/uno_test.go

@@ -8,19 +8,38 @@ import (
 
 const rake = 0.05
 
+// You is the human's seat in the solo tests, a test-local alias for what the
+// engine no longer hardcodes: a table is a list of seats, and seat zero being the
+// human is a convention only these fixtures keep.
+const You = 0
+
 func duel() Tier  { t, _ := TierBySlug("duel"); return t }
 func full() Tier  { t, _ := TierBySlug("full"); return t }
 func table() Tier { t, _ := TierBySlug("table"); return t }
 
-// deal starts a game, failing the test if it can't.
-func deal(t *testing.T, tier Tier, bet int64, seed uint64) State {
+// openSolo opens a solo table (one human, the tier's bots) without dealing.
+func openSolo(t *testing.T, tier Tier, seed uint64) State {
 	t.Helper()
-	s, evs, err := New(bet, tier, rake, seed, 0xC0FFEE)
+	s, _, err := New(tier, SoloSeats(tier, tier.Bots, 1000), rake, seed, 0xC0FFEE)
 	if err != nil {
 		t.Fatalf("New: %v", err)
 	}
-	if len(evs) != 1 || evs[0].Kind != EvDeal {
-		t.Fatalf("New should deal exactly one event, got %+v", evs)
+	return s
+}
+
+// deal opens a solo table and deals the first hand, so the human is to act.
+func deal(t *testing.T, tier Tier, seed uint64) State {
+	t.Helper()
+	s := openSolo(t, tier, seed)
+	s, evs, err := ApplyMove(s, You, Move{Kind: MoveDeal})
+	if err != nil {
+		t.Fatalf("deal: %v", err)
+	}
+	if !hasKind(evs, EvDeal) {
+		t.Fatalf("the deal emitted no deal event: %+v", evs)
+	}
+	if s.Turn != You {
+		t.Fatalf("the human should act first at a solo table, turn is %d", s.Turn)
 	}
 	return s
 }
@@ -38,11 +57,6 @@ func census(s State) map[Card]int {
 		m[c]++
 	}
 	for _, c := range s.Discard {
-		// A wild is stamped with the colour it was played as while it sits on the
-		// pile, so it counts as the wild it really is. This asks the face, rather
-		// than listing the wilds: No Mercy prints four more of them, and a census
-		// that didn't know about them would count a played roulette as a red card
-		// and report a deck that balances while the cards don't.
 		if c.Value.Wild() {
 			c.Color = Wild
 		}
@@ -76,7 +90,7 @@ func TestNewDeckIsADeck(t *testing.T) {
 }
 
 func TestNewDeals(t *testing.T) {
-	s := deal(t, full(), 100, 7)
+	s := deal(t, full(), 7)
 	if len(s.Hands) != 4 {
 		t.Fatalf("full house is four seats, got %d", len(s.Hands))
 	}
@@ -85,21 +99,31 @@ func TestNewDeals(t *testing.T) {
 			t.Errorf("seat %d holds %d cards, want %d", i, len(h), HandSize)
 		}
 	}
-	if len(s.Bots) != 3 {
-		t.Fatalf("want three bot names, got %v", s.Bots)
+	bots := 0
+	for _, seat := range s.Seats {
+		if seat.Bot {
+			bots++
+			if seat.Name == "" {
+				t.Error("a bot seat has no name")
 			}
-	if s.Turn != You {
-		t.Errorf("you play first, turn is %d", s.Turn)
+		}
+	}
+	if bots != 3 {
+		t.Fatalf("want three bots, got %d", bots)
 	}
 	if got := total(census(s)); got != 108 {
 		t.Fatalf("the deal lost cards: %d of 108", got)
 	}
+	// Every seat anted, so the pot is one ante per seat.
+	if want := s.Tier.Ante * int64(len(s.Seats)); s.Pot != want {
+		t.Errorf("pot is %d, want %d (one ante each)", s.Pot, want)
+	}
 }
 
-// The card turned over to start is never an action card — see New.
+// The card turned over to start is never an action card — see dealHand.
 func TestOpeningCardIsANumber(t *testing.T) {
 	for seed := uint64(0); seed < 300; seed++ {
-		s := deal(t, table(), 50, seed)
+		s := deal(t, table(), seed)
 		if s.Top().Value.Action() {
 			t.Fatalf("seed %d opened on %v", seed, s.Top())
 		}
@@ -111,12 +135,9 @@ func TestOpeningCardIsANumber(t *testing.T) {
 
 // ---- the rules ------------------------------------------------------------
 
-// rig builds a state by hand, so a rule can be tested without hunting a seed
-// that happens to deal it.
-//
-// The deck is the rest of the deck: every card not in a hand and not the one in
-// play. So a rigged game still holds 108 cards, and the census invariant means
-// something in these tests too.
+// rig builds a live hand by hand, so a rule can be tested without hunting a seed
+// that happens to deal it. Every seat has anted, so the pot is set and a win
+// settles for real.
 func rig(hands [][]Card, top Card, color Color) State {
 	left := map[Card]int{}
 	for _, c := range NewDeck() {
@@ -137,30 +158,38 @@ func rig(hands [][]Card, top Card, color Color) State {
 
 	var deck []Card
 	for _, c := range NewDeck() {
-		key := c
-		if left[key] > 0 {
-			left[key]--
+		if left[c] > 0 {
+			left[c]--
 			deck = append(deck, c)
 		}
 	}
+	ante := full().Ante
+	seats := make([]Seat, len(hands))
+	for i := range seats {
+		// The stack is what is left after this seat anted: a real deal moves the ante
+		// out of the stack and into the pot, so a refund or a win returns it here.
+		seats[i] = Seat{Name: botPool[i], Bot: i != You, Stack: 1000 - ante, Ante: ante}
+	}
+	seats[You].Name = "You"
 	return State{
-		Tier: full(), Hands: hands, Discard: []Card{top}, Color: color,
-		Deck: deck, Dir: 1, Turn: You, Phase: PhasePlay,
-		Bet: 100, RakePct: rake, Seed1: 1, Seed2: 2,
+		Tier: full(), Seats: seats, Hands: hands, Discard: []Card{top}, Color: color,
+		Deck: deck, Dir: 1, Turn: You, Dealer: len(hands) - 1, Phase: PhasePlay,
+		Pot: ante * int64(len(hands)), Winner: -1,
+		Out: make([]bool, len(hands)), Called: make([]bool, len(hands)),
+		RakePct: rake, Seed1: 1, Seed2: 2,
 	}
 }
 
 func TestPlayMustMatch(t *testing.T) {
 	s := rig([][]Card{{{Blue, Three}}, {{Red, Five}}}, Card{Red, Nine}, Red)
-	if _, _, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0}); err != ErrCantPlay {
+	if _, _, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0}); err != ErrCantPlay {
 		t.Fatalf("a blue 3 on a red 9 should be refused, got %v", err)
 	}
 }
 
 func TestPlayMatchesFaceOrColor(t *testing.T) {
-	// Same face, different colour: legal.
 	s := rig([][]Card{{{Blue, Nine}, {Red, Two}}, {{Green, Five}}}, Card{Red, Nine}, Red)
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 	if err != nil {
 		t.Fatalf("a blue 9 on a red 9 is legal: %v", err)
 	}
@@ -174,22 +203,20 @@ func TestPlayMatchesFaceOrColor(t *testing.T) {
 
 func TestWildNeedsAColor(t *testing.T) {
 	s := rig([][]Card{{{Wild, WildCard}}, {{Green, Five}}}, Card{Red, Nine}, Red)
-	if _, _, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0}); err != ErrNeedColor {
+	if _, _, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0}); err != ErrNeedColor {
 		t.Fatalf("a wild with no colour should be refused, got %v", err)
 	}
-	if _, _, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0, Color: Wild}); err != ErrNeedColor {
+	if _, _, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0, Color: Wild}); err != ErrNeedColor {
 		t.Fatalf("naming 'wild' is not naming a colour, got %v", err)
 	}
 }
 
 func TestWildNamesTheColor(t *testing.T) {
 	s := rig([][]Card{{{Wild, WildCard}, {Green, One}}, {{Green, Five}}}, Card{Red, Nine}, Red)
-	next, _, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0, Color: Green})
+	next, _, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0, Color: Green})
 	if err != nil {
 		t.Fatalf("play wild: %v", err)
 	}
-	// The bot moved after us, so the colour in play is whatever it left behind —
-	// what we can check is that the wild itself went down as green.
 	top := next.Discard
 	if len(top) < 2 {
 		t.Fatalf("expected the wild and the bot's card on the pile: %v", top)
@@ -200,10 +227,9 @@ func TestWildNamesTheColor(t *testing.T) {
 }
 
 func TestDrawTwoHitsTheNextSeat(t *testing.T) {
-	// Two seats, so the +2 lands on the bot and the turn comes straight back.
 	s := rig([][]Card{{{Red, DrawTwo}, {Red, One}}, {{Blue, Five}, {Blue, Six}}}, Card{Red, Nine}, Red)
 	s.Tier = duel()
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 	if err != nil {
 		t.Fatalf("play +2: %v", err)
 	}
@@ -224,7 +250,7 @@ func TestDrawTwoHitsTheNextSeat(t *testing.T) {
 func TestReverseIsASkipHeadsUp(t *testing.T) {
 	s := rig([][]Card{{{Red, Reverse}, {Red, One}}, {{Blue, Five}}}, Card{Red, Nine}, Red)
 	s.Tier = duel()
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 	if err != nil {
 		t.Fatalf("play reverse: %v", err)
 	}
@@ -243,15 +269,13 @@ func TestReverseIsASkipHeadsUp(t *testing.T) {
 }
 
 func TestReverseTurnsTheTableAround(t *testing.T) {
-	// Every bot holds a red card, so each of them can play the moment the turn
-	// reaches it — which is what makes the *order* they play in observable.
 	s := rig([][]Card{
 		{{Red, Reverse}, {Red, One}},
 		{{Red, Five}, {Blue, Six}},
 		{{Red, Six}, {Green, Six}},
 		{{Red, Seven}, {Yellow, Six}},
 	}, Card{Red, Nine}, Red)
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 	if err != nil {
 		t.Fatalf("play reverse: %v", err)
 	}
@@ -264,7 +288,6 @@ func TestReverseTurnsTheTableAround(t *testing.T) {
 	if next.Turn != You {
 		t.Errorf("the bots should have played round to you, turn is %d", next.Turn)
 	}
-	// The table now runs anticlockwise: seat 3 plays, then 2, then 1.
 	var order []int
 	for _, e := range evs {
 		if e.Kind == EvPlay && e.Seat != You {
@@ -277,15 +300,13 @@ func TestReverseTurnsTheTableAround(t *testing.T) {
 }
 
 func TestSkipSkips(t *testing.T) {
-	// Both bots hold a playable red, so the only reason either of them doesn't
-	// play is that it wasn't asked to.
 	s := rig([][]Card{
 		{{Red, Skip}, {Red, One}},
 		{{Red, Five}, {Blue, Six}},
 		{{Red, Six}, {Green, Six}},
 	}, Card{Red, Nine}, Red)
 	s.Tier = table()
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 	if err != nil {
 		t.Fatalf("play skip: %v", err)
 	}
@@ -310,7 +331,7 @@ func TestSkipSkips(t *testing.T) {
 func TestDrawnPlayableWaitsForYou(t *testing.T) {
 	s := rig([][]Card{{{Blue, Three}}, {{Green, Five}}}, Card{Red, Nine}, Red)
 	s.Deck = []Card{{Red, Four}} // exactly what you'll draw, and it plays
-	next, evs, err := ApplyMove(s, Move{Kind: MoveDraw})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MoveDraw})
 	if err != nil {
 		t.Fatalf("draw: %v", err)
 	}
@@ -323,18 +344,16 @@ func TestDrawnPlayableWaitsForYou(t *testing.T) {
 	if evs[0].Kind != EvDraw || evs[0].Card == nil || *evs[0].Card != (Card{Red, Four}) {
 		t.Fatalf("your own drawn card comes face up: %+v", evs[0])
 	}
-	if got := next.Playable(); len(got) != 1 || got[0] != 1 {
+	if got := next.Playable(You); len(got) != 1 || got[0] != 1 {
 		t.Errorf("the drawn card, and only it, is playable: %v", got)
 	}
-	// You may not play the *other* card instead — drawing would otherwise be a
-	// free look with no cost.
-	if _, _, err := ApplyMove(next, Move{Kind: MovePlay, Index: 0}); err != ErrMustPlayNow {
+	if _, _, err := ApplyMove(next, You, Move{Kind: MovePlay, Index: 0}); err != ErrMustPlayNow {
 		t.Fatalf("only the drawn card may be played, got %v", err)
 	}
-	if _, _, err := ApplyMove(next, Move{Kind: MoveDraw}); err != ErrMustPlayNow {
+	if _, _, err := ApplyMove(next, You, Move{Kind: MoveDraw}); err != ErrMustPlayNow {
 		t.Fatalf("you can't draw twice, got %v", err)
 	}
-	after, _, err := ApplyMove(next, Move{Kind: MovePass})
+	after, _, err := ApplyMove(next, You, Move{Kind: MovePass})
 	if err != nil {
 		t.Fatalf("pass: %v", err)
 	}
@@ -349,7 +368,7 @@ func TestDrawnPlayableWaitsForYou(t *testing.T) {
 func TestUnplayableDrawPassesTheTurn(t *testing.T) {
 	s := rig([][]Card{{{Blue, Three}}, {{Green, Five}}}, Card{Red, Nine}, Red)
 	s.Deck = []Card{{Blue, Four}, {Red, Two}} // draw a blue 4: it doesn't go on a red 9
-	next, evs, err := ApplyMove(s, Move{Kind: MoveDraw})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MoveDraw})
 	if err != nil {
 		t.Fatalf("draw: %v", err)
 	}
@@ -363,69 +382,78 @@ func TestUnplayableDrawPassesTheTurn(t *testing.T) {
 
 func TestPassOnlyAfterADraw(t *testing.T) {
 	s := rig([][]Card{{{Red, Three}}, {{Green, Five}}}, Card{Red, Nine}, Red)
-	if _, _, err := ApplyMove(s, Move{Kind: MovePass}); err != ErrCantPass {
+	if _, _, err := ApplyMove(s, You, Move{Kind: MovePass}); err != ErrCantPass {
 		t.Fatalf("you can't pass a turn you haven't drawn on, got %v", err)
 	}
 }
 
 // dead is a table nobody can move at: the deck is spent, the discard is one card
-// deep so there is nothing to reshuffle out of, and not a seat holds a card that
-// goes on the pile. Every seat can only pass, forever.
+// deep, and not a seat holds a card that goes on the pile.
 func dead(hands [][]Card) State {
 	s := rig(hands, Card{Red, Nine}, Red)
 	s.Deck = nil
 	return s
 }
 
-// The game has to end here. It used to not: the stuck guard counted how many
-// bots had passed in a row and asked for more of them than there are seats, so
-// it never fired once, and a dead table just handed the turn round and round.
-// That is a game the player cannot finish — and a game they cannot finish is
-// chips they cannot cash out, because the cage won't let them leave a live hand.
+// A dead table ends the hand rather than passing the turn round forever. It no
+// longer ends the *session* — a shared table plays another hand — so it lands on
+// PhaseHandOver, not PhaseDone.
 func TestDeadTableEnds(t *testing.T) {
-	s := dead([][]Card{{{Blue, Three}}, {{Green, Five}}})
+	s := dead([][]Card{{{Blue, Three}}, {{Green, Five}}}) // level: one card each
 
-	next, evs, err := ApplyMove(s, Move{Kind: MoveDraw})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MoveDraw})
 	if err != nil {
 		t.Fatalf("draw: %v", err)
 	}
-	if next.Phase != PhaseDone {
-		t.Fatalf("nobody can move and there is nothing to draw: the game is over, not %q", next.Phase)
+	if next.playing() {
+		t.Fatalf("nobody can move and there is nothing to draw: the hand is over, not %q", next.Phase)
 	}
-	if next.Outcome != OutcomeStuck {
-		t.Errorf("a tie on the shortest hand is nobody going out: %q", next.Outcome)
+	if next.Phase != PhaseHandOver {
+		t.Fatalf("a dead hand at a shared table returns to handover, not %q", next.Phase)
+	}
+	if next.Outcome != OutcomeTie {
+		t.Errorf("level on the shortest hand is a tie, got %q", next.Outcome)
+	}
+	// A tie hands the antes back: every seat is whole again.
+	for i := range next.Seats {
+		if next.Seats[i].Stack != 1000 {
+			t.Errorf("seat %d wasn't refunded: stack %d, want 1000", i, next.Seats[i].Stack)
 		}
-	if next.Payout != 0 {
-		t.Errorf("a stuck game pays nothing, not %d", next.Payout)
 	}
 	if !hasKind(evs, EvSettle) {
-		t.Errorf("the table has to be told it's over: %+v", evs)
+		t.Errorf("the table has to be told the hand is over: %+v", evs)
 	}
 }
 
-// And the shortest hand takes it, which is the one way a stuck table still pays.
+// And the shortest hand takes the pot, which is the one way a stuck table pays.
 func TestDeadTablePaysTheShortestHand(t *testing.T) {
 	s := dead([][]Card{{{Blue, Three}}, {{Green, Five}, {Green, Six}}})
+	pot := s.Pot
+	before := s.Seats[You].Stack
 
-	next, _, err := ApplyMove(s, Move{Kind: MoveDraw})
+	next, _, err := ApplyMove(s, You, Move{Kind: MoveDraw})
 	if err != nil {
 		t.Fatalf("draw: %v", err)
 	}
-	if next.Outcome != OutcomeWon {
-		t.Fatalf("one card against two is a win: %q", next.Outcome)
+	if next.Outcome != OutcomeStuck || next.Winner != You {
+		t.Fatalf("one card against two is a win for you: outcome %q winner %d", next.Outcome, next.Winner)
 	}
-	if next.Payout != s.Pays() {
-		t.Errorf("payout %d, quoted %d — the felt has to honour what it advertised", next.Payout, s.Pays())
+	profit := pot - s.Tier.Ante
+	wantRake := int64(float64(profit) * rake)
+	wantWon := pot - wantRake
+	if next.Seats[You].Won != wantWon {
+		t.Errorf("you took %d, want %d (pot %d less rake %d)", next.Seats[You].Won, wantWon, pot, wantRake)
+	}
+	if next.Seats[You].Stack != before+wantWon {
+		t.Errorf("your stack is %d, want %d", next.Seats[You].Stack, before+wantWon)
 	}
 }
 
 func TestReshuffleRebuildsTheDeck(t *testing.T) {
 	s := rig([][]Card{{{Blue, Three}}, {{Green, Five}}}, Card{Red, Nine}, Red)
-	// An empty deck, and a discard with something under the top card to become one.
-	// The buried wild went down as green; it has to come back as a wild.
 	s.Deck = nil
 	s.Discard = []Card{{Green, WildCard}, {Red, Two}, {Red, Nine}}
-	next, evs, err := ApplyMove(s, Move{Kind: MoveDraw})
+	next, evs, err := ApplyMove(s, You, Move{Kind: MoveDraw})
 	if err != nil {
 		t.Fatalf("draw on an empty deck: %v", err)
 	}
@@ -449,89 +477,64 @@ func TestReshuffleRebuildsTheDeck(t *testing.T) {
 	}
 }
 
-// ---- the money ------------------------------------------------------------
+// ---- the pot --------------------------------------------------------------
 
-// The rule every game in this casino has had to be taught: the number the felt
-// quotes and the number the settle lands on are one function, not two.
-func TestQuoteIsThePayout(t *testing.T) {
-	for _, tier := range Tiers {
-		s := rig([][]Card{{{Red, Three}}, {{Green, Five}}}, Card{Red, Nine}, Red)
-		s.Tier = tier
-		s.Hands = make([][]Card, tier.Bots+1)
-		s.Hands[You] = []Card{{Red, Three}}
-		for i := 1; i <= tier.Bots; i++ {
-			s.Hands[i] = []Card{{Green, Five}, {Green, Six}}
-		}
-		quoted := s.Pays()
+// The winner takes the pot, and the house's rake comes out of the winnings, never
+// out of a seat's own ante.
+func TestWinnerTakesThePotLessRake(t *testing.T) {
+	s := rig([][]Card{{{Red, Three}}, {{Green, Five}, {Green, Six}}, {{Blue, One}, {Blue, Two}}}, Card{Red, Nine}, Red)
+	pot := s.Pot
+	before := s.Seats[You].Stack
 
-		next, _, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0}) // your last card
-		if err != nil {
-			t.Fatalf("%s: go out: %v", tier.Slug, err)
-		}
-		if next.Outcome != OutcomeWon {
-			t.Fatalf("%s: playing your last card wins, got %q", tier.Slug, next.Outcome)
-		}
-		if next.Payout != quoted {
-			t.Errorf("%s: the felt quoted %d, the house paid %d", tier.Slug, quoted, next.Payout)
-		}
-		if next.Net() != quoted-s.Bet {
-			t.Errorf("%s: net is %d, want %d", tier.Slug, next.Net(), quoted-s.Bet)
-		}
-	}
-}
-
-// The rake comes out of the winnings, never the stake.
-//
-// The arithmetic is derived from the tier rather than written down. It used to be
-// written down — payout 214, rake 6 — and those numbers were the 2.2× duel. When
-// the tiers were re-measured and repriced, this test failed on a rake that was
-// perfectly correct, which is a test asserting a *price* while claiming to assert
-// a *rule*. The rule is: the house takes its cut of the profit and never touches
-// the stake. That holds at any multiple.
-func TestRakeIsOnWinningsOnly(t *testing.T) {
-	s := rig([][]Card{{{Red, Three}}, {{Green, Five}, {Green, Six}}}, Card{Red, Nine}, Red)
-	s.Tier = duel()
-	s.Bet = 100
-
-	gross := int64(float64(s.Bet) * s.Tier.Base) // what the tier pays back, before the house
-	profit := gross - s.Bet
-	wantRake := int64(float64(profit) * rake)
-	wantPayout := s.Bet + profit - wantRake
-
-	next, _, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	next, _, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0}) // your last card
 	if err != nil {
 		t.Fatalf("go out: %v", err)
 	}
-	if next.Payout != wantPayout {
-		t.Errorf("payout %d, want %d (%d stake + %d winnings - %d rake)",
-			next.Payout, wantPayout, s.Bet, profit, wantRake)
+	if next.Outcome != OutcomeWon || next.Winner != You {
+		t.Fatalf("playing your last card wins: outcome %q winner %d", next.Outcome, next.Winner)
 	}
+	profit := pot - s.Tier.Ante
+	wantRake := int64(float64(profit) * rake)
+	wantWon := pot - wantRake
 	if next.Rake != wantRake {
-		t.Errorf("rake %d, want %d — and never a penny of the %d stake",
-			next.Rake, wantRake, s.Bet)
+		t.Errorf("rake %d, want %d — and never a penny of an ante", next.Rake, wantRake)
 	}
-	if next.Net() != wantPayout-s.Bet {
-		t.Errorf("net %d, want %d", next.Net(), wantPayout-s.Bet)
+	if next.LastPot != pot {
+		t.Errorf("last pot %d, want %d", next.LastPot, pot)
+	}
+	if next.Seats[You].Stack != before+wantWon {
+		t.Errorf("your stack is %d, want %d (+%d)", next.Seats[You].Stack, before+wantWon, wantWon)
+	}
+	if next.Paid != wantRake {
+		t.Errorf("the session rake tally is %d, want %d", next.Paid, wantRake)
 	}
 }
 
-func TestLosingPaysNothingAndIsNotCharged(t *testing.T) {
-	// The bot holds one card that plays on the pile, so it goes out the moment the
-	// turn reaches it.
+// A bot winning rakes nothing: the house already keeps the whole pot when its own
+// seat takes it, so there is nothing to charge.
+func TestABotWinningRakesNothing(t *testing.T) {
+	// The bot at seat 1 holds one card that plays; it goes out the moment the turn
+	// reaches it.
 	s := rig([][]Card{{{Red, Three}, {Red, Four}}, {{Red, Five}}}, Card{Red, Nine}, Red)
 	s.Tier = duel()
-	next, evs, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	pot := s.Pot
+
+	next, evs, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 	if err != nil {
 		t.Fatalf("play: %v", err)
 	}
-	if next.Outcome != OutcomeLost {
-		t.Fatalf("the bot went out, so you lost: %q", next.Outcome)
+	if next.Outcome != OutcomeWon || next.Winner != 1 {
+		t.Fatalf("the bot went out: outcome %q winner %d", next.Outcome, next.Winner)
 	}
-	if next.Payout != 0 || next.Rake != 0 {
-		t.Errorf("a loss pays nothing and is charged nothing: payout %d rake %d", next.Payout, next.Rake)
+	if next.Rake != 0 {
+		t.Errorf("a bot winning rakes nothing, got %d", next.Rake)
 	}
-	if next.Net() != -s.Bet {
-		t.Errorf("a loss costs the stake and no more: %d", next.Net())
+	if next.Seats[1].Won != pot {
+		t.Errorf("the bot took %d, want the whole pot %d", next.Seats[1].Won, pot)
+	}
+	// You anted and lost it: your stack is down exactly one ante.
+	if next.Seats[You].Stack != 1000-s.Tier.Ante {
+		t.Errorf("your stack is %d, want %d (one ante gone)", next.Seats[You].Stack, 1000-s.Tier.Ante)
 	}
 	last := evs[len(evs)-1]
 	if last.Kind != EvSettle || last.Seat != 1 {
@@ -539,51 +542,81 @@ func TestLosingPaysNothingAndIsNotCharged(t *testing.T) {
 	}
 }
 
-func TestNoMoveAfterItIsOver(t *testing.T) {
+// A hand ending returns the table to handover, ready to deal again — it does not
+// take a hand move.
+func TestNoHandMoveBetweenHands(t *testing.T) {
 	s := rig([][]Card{{{Red, Three}}, {{Green, Five}, {Green, Six}}}, Card{Red, Nine}, Red)
 	s.Tier = duel()
-	done, _, err := ApplyMove(s, Move{Kind: MovePlay, Index: 0})
+	over, _, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
 	if err != nil {
 		t.Fatalf("go out: %v", err)
 	}
-	if _, _, err := ApplyMove(done, Move{Kind: MoveDraw}); err != ErrGameOver {
-		t.Fatalf("a finished game takes no more moves, got %v", err)
+	if over.Phase != PhaseHandOver {
+		t.Fatalf("a finished hand returns to handover, got %q", over.Phase)
+	}
+	if _, _, err := ApplyMove(over, You, Move{Kind: MoveDraw}); err != ErrNoHand {
+		t.Fatalf("no hand is in progress between hands, got %v", err)
 	}
 }
 
-func TestBadBet(t *testing.T) {
-	if _, _, err := New(0, duel(), rake, 1, 2); err != ErrBadBet {
-		t.Fatalf("want ErrBadBet, got %v", err)
+// You can deal the next hand, ante again, and play on — the session shape.
+func TestDealTheNextHand(t *testing.T) {
+	s := rig([][]Card{{{Red, Three}}, {{Green, Five}, {Green, Six}}}, Card{Red, Nine}, Red)
+	s.Tier = duel()
+	over, _, err := ApplyMove(s, You, Move{Kind: MovePlay, Index: 0})
+	if err != nil {
+		t.Fatalf("go out: %v", err)
+	}
+	again, evs, err := ApplyMove(over, You, Move{Kind: MoveDeal})
+	if err != nil {
+		t.Fatalf("deal the next hand: %v", err)
+	}
+	if again.HandNo != over.HandNo+1 {
+		t.Errorf("hand number didn't advance: %d then %d", over.HandNo, again.HandNo)
+	}
+	if !again.playing() {
+		t.Fatalf("the next hand should be live, phase %q", again.Phase)
+	}
+	if !hasKind(evs, EvAnte) || !hasKind(evs, EvDeal) {
+		t.Errorf("the deal antes and turns a card: %+v", evs)
+	}
+}
+
+func TestBadBuyIn(t *testing.T) {
+	if _, _, err := New(duel(), SoloSeats(duel(), 1, 10), rake, 1, 2); err != ErrBadBuyIn {
+		t.Fatalf("a buy-in under the minimum should be refused, got %v", err)
 	}
 }
 
 // ---- the whole game -------------------------------------------------------
 
-// playOut plays a game to its end with a simple strategy: play the first legal
-// card, otherwise draw, otherwise pass. It asserts the invariants at every step.
+// playOut plays one hand to its end with a simple strategy: play the first legal
+// card, take a stack you can't answer, otherwise draw, otherwise pass.
 func playOut(t *testing.T, s State, maxTurns int) State {
 	t.Helper()
-	for turn := 0; s.Phase != PhaseDone; turn++ {
+	for turn := 0; s.playing(); turn++ {
 		if turn > maxTurns {
-			t.Fatalf("the game never ended in %d turns", maxTurns)
+			t.Fatalf("the hand never ended in %d turns", maxTurns)
 		}
 		if s.Turn != You {
 			t.Fatalf("ApplyMove left the turn with seat %d — the bots should always run out", s.Turn)
 		}
 
 		var m Move
-		if p := s.Playable(); len(p) > 0 {
+		if p := s.Playable(You); len(p) > 0 {
 			m = Move{Kind: MovePlay, Index: p[0]}
 			if s.Hands[You][p[0]].IsWild() {
 				m.Color = Green
 			}
+		} else if s.Phase == PhaseStack {
+			m = Move{Kind: MoveTake}
 		} else if s.Phase == PhaseDrawn {
 			m = Move{Kind: MovePass}
 		} else {
 			m = Move{Kind: MoveDraw}
 		}
 
-		next, evs, err := ApplyMove(s, m)
+		next, evs, err := ApplyMove(s, You, m)
 		if err != nil {
 			t.Fatalf("turn %d: %v (move %+v, phase %v)", turn, err, m, s.Phase)
 		}
@@ -598,13 +631,6 @@ func playOut(t *testing.T, s State, maxTurns int) State {
 				t.Fatalf("turn %d: %d of %v, want %d — a card was duplicated", turn, n, c, want)
 			}
 		}
-		// No event ever names a bot's card. That is the hole card of this game, and
-		// it is most of the deck.
-		for _, e := range evs {
-			if (e.Kind == EvDraw || e.Kind == EvForced) && e.Seat != You && e.Card != nil {
-				t.Fatalf("turn %d: a bot's drawn card crossed the wire: %+v", turn, e)
-			}
-		}
 		s = next
 	}
 	return s
@@ -622,72 +648,54 @@ func deckCount(c Card) int {
 	}
 }
 
-// A hundred games, played out, with the invariants checked at every step. This
-// is the test that would have caught a deck that leaks cards through the
-// reshuffle, a turn the bots don't hand back, or a game that can't end.
+// A hundred hands, played out, with the invariants checked at every step.
 func TestGamesPlayOut(t *testing.T) {
-	wins, losses, stuck := 0, 0, 0
+	yous, others, ties := 0, 0, 0
 	for seed := uint64(0); seed < 100; seed++ {
 		tier := Tiers[seed%3]
-		end := playOut(t, deal(t, tier, 100, seed), 500)
-		switch end.Outcome {
-		case OutcomeWon:
-			wins++
-			if end.Payout != end.Pays() {
-				t.Fatalf("seed %d: paid %d, quoted %d", seed, end.Payout, end.Pays())
+		end := playOut(t, deal(t, tier, seed), 500)
+		if end.Phase != PhaseHandOver {
+			t.Fatalf("seed %d ended in phase %q", seed, end.Phase)
 		}
-		case OutcomeLost:
-			losses++
-		case OutcomeStuck:
-			stuck++
+		switch {
+		case end.Winner == You:
+			yous++
+		case end.Winner >= 0:
+			others++
+		case end.Outcome == OutcomeTie:
+			ties++
 		default:
-			t.Fatalf("seed %d ended as %q", seed, end.Outcome)
+			t.Fatalf("seed %d ended with winner %d outcome %q", seed, end.Winner, end.Outcome)
 		}
-		if len(end.Hands[end.winnerSeat()]) != 0 && end.Outcome != OutcomeStuck {
+		if end.Winner >= 0 && end.Outcome == OutcomeWon && len(end.Hands[end.Winner]) != 0 {
 			t.Fatalf("seed %d: the winner is still holding cards", seed)
 		}
 	}
-	// Playing the first legal card is a poor strategy against bots that hold their
-	// +4s back, so this is not a fairness assertion — it's a check that both
-	// outcomes actually happen. A table that never pays is a bug in the bots.
-	if wins == 0 || losses == 0 {
-		t.Fatalf("100 games gave %d wins, %d losses, %d stuck — one side never happens", wins, losses, stuck)
+	if yous == 0 || others == 0 {
+		t.Fatalf("100 hands gave %d to you, %d to others, %d tied — one side never happens", yous, others, ties)
 	}
-	t.Logf("100 games: %d won, %d lost, %d stuck", wins, losses, stuck)
+	t.Logf("100 hands: %d to you, %d to others, %d tied", yous, others, ties)
 }
 
-// winnerSeat is the seat the settle event named — only used by the tests.
-func (s State) winnerSeat() int {
-	best := 0
-	for i := range s.Hands {
-		if len(s.Hands[i]) < len(s.Hands[best]) {
-			best = i
-		}
-	}
-	return best
-}
-
-// The same seed deals the same game and the bots make the same choices — which
-// is what lets a disputed game be replayed exactly as it fell.
+// The same seed deals the same hand and the bots make the same choices.
 func TestReplaysFromTheSeed(t *testing.T) {
-	a := playOut(t, deal(t, full(), 250, 42), 500)
-	b := playOut(t, deal(t, full(), 250, 42), 500)
+	a := playOut(t, deal(t, full(), 42), 500)
+	b := playOut(t, deal(t, full(), 42), 500)
 
 	ja, _ := json.Marshal(a)
 	jb, _ := json.Marshal(b)
 	if string(ja) != string(jb) {
 		t.Fatal("the same seed played the same way gave two different games")
 	}
-	if a.Outcome == "" {
+	if a.Winner < 0 && a.Outcome != OutcomeTie {
 		t.Fatal("the replay didn't finish")
 	}
 }
 
-// A game in progress survives a redeploy: it is a plain value, so it round-trips
-// through the JSON it is stored as.
+// A game in progress survives a redeploy: it round-trips through its JSON.
 func TestStateSurvivesStorage(t *testing.T) {
-	s := deal(t, table(), 100, 9)
-	s, _, err := ApplyMove(s, Move{Kind: MoveDraw})
+	s := deal(t, table(), 9)
+	s, _, err := ApplyMove(s, You, Move{Kind: MoveDraw})
 	if err != nil {
 		t.Fatalf("draw: %v", err)
 	}
@@ -704,12 +712,10 @@ func TestStateSurvivesStorage(t *testing.T) {
 	if string(again) != string(blob) {
 		t.Fatal("a stored game came back different")
 	}
-	// And it plays on from there.
 	playOut(t, back, 500)
 }
 
-// A move the engine refuses leaves the caller's state exactly as it was — no
-// card half-played, no turn half-passed.
+// A move the engine refuses leaves the caller's state exactly as it was.
 func TestARefusedMoveChangesNothing(t *testing.T) {
 	s := rig([][]Card{{{Blue, Three}, {Wild, WildCard}}, {{Green, Five}}}, Card{Red, Nine}, Red)
 	before, _ := json.Marshal(s)
@@ -721,7 +727,7 @@ func TestARefusedMoveChangesNothing(t *testing.T) {
 		{Kind: MovePass},                        // nothing drawn
 		{Kind: "shuffle-the-deck-in-my-favour"}, // no
 	} {
-		if _, _, err := ApplyMove(s, m); err == nil {
+		if _, _, err := ApplyMove(s, You, m); err == nil {
 			t.Fatalf("%+v should have been refused", m)
 		}
 	}
@@ -731,13 +737,12 @@ func TestARefusedMoveChangesNothing(t *testing.T) {
 	}
 }
 
-// The bots choose. Two different seeds should not play the same bot game, or the
-// bot is a lookup table you can memorise.
+// The bots choose. Two different seeds should not play the same game.
 func TestBotsAreNotDeterministicAcrossSeeds(t *testing.T) {
 	same := 0
 	for seed := uint64(0); seed < 20; seed++ {
-		a := playOut(t, deal(t, duel(), 100, seed), 500)
-		b := playOut(t, deal(t, duel(), 100, seed+1000), 500)
+		a := playOut(t, deal(t, duel(), seed), 500)
+		b := playOut(t, deal(t, duel(), seed+1000), 500)
 		if len(a.Discard) == len(b.Discard) {
 			same++
 		}
@@ -747,8 +752,6 @@ func TestBotsAreNotDeterministicAcrossSeeds(t *testing.T) {
 	}
 }
 
-// botPick holds its +4 back while it's comfortable, and reaches for it when
-// somebody is about to go out.
 func TestBotSavesTheDrawFour(t *testing.T) {
 	hand := []Card{{Wild, WildDrawFour}, {Red, Five}}
 	top, color := Card{Red, Nine}, Red
@@ -781,7 +784,6 @@ func TestBotPicksItsBestColor(t *testing.T) {
 	if got := botColor(hand, rng); got != Blue {
 		t.Errorf("the bot holds two blues: it should call blue, got %v", got)
 	}
-	// A hand of nothing but wilds still has to name something.
 	for i := 0; i < 20; i++ {
 		if got := botColor([]Card{{Wild, WildCard}}, rng); !got.Playable() {
 			t.Fatalf("botColor named %v, which is not a colour", got)

internal/storage/db.go

@@ -94,6 +94,13 @@ func runMigrations(d *sql.DB) error {
 	addColumnIfMissing(d, "post_log", "url_canonical", "TEXT")
 	addColumnIfMissing(d, "post_log", "forced", "INTEGER NOT NULL DEFAULT 0")
 	addColumnIfMissing(d, "round_robin_state", "last_channel", "TEXT")
+	// Occupancy of a shared table. Rows written before the casino went multiplayer
+	// are solo games and read as NULL, which is exactly what they are.
+	addColumnIfMissing(d, "game_live_hands", "table_id", "TEXT")
+	// The public detail sheet (stats + equipped gear) for an adventurer's
+	// click-through page. Rides the roster snapshot; NULL on rows pushed by a
+	// gogobee build that predates the detail page.
+	addColumnIfMissing(d, "adventure_roster", "detail_json", "TEXT")
 
 	// FTS5 virtual tables don't support IF NOT EXISTS reliably.
 	// Check sqlite_master before creating.

internal/storage/detail.go

@@ -0,0 +1,131 @@
+package storage
+
+import (
+	"database/sql"
+	"encoding/json"
+)
+
+// PlayerDetail is one player's private, owner-only expansion — inventory, vault,
+// house, pets — pushed by gogobee keyed by localpart. Pete stores it in its own
+// keyspace (player_self_detail) and only ever serves it back to the one
+// authenticated user it belongs to. Token rides along so the detail page can
+// prove owner↔page without ever reversing the anonymous roster token.
+type PlayerDetail struct {
+	Localpart string     `json:"localpart"`
+	Token     string     `json:"token"`
+	Inventory []ItemView `json:"inventory,omitempty"`
+	Vault     []ItemView `json:"vault,omitempty"`
+	House     HouseView  `json:"house"`
+	Pets      []PetView  `json:"pets,omitempty"`
+}
+
+// ItemView is one backpack or vault item.
+type ItemView struct {
+	Name   string `json:"name"`
+	Type   string `json:"type"`
+	Tier   int    `json:"tier"`
+	Value  int64  `json:"value"`
+	Temper int    `json:"temper,omitempty"`
+}
+
+// HouseView is the owner's housing summary.
+type HouseView struct {
+	Tier        int     `json:"tier"`
+	LoanBalance int     `json:"loan_balance,omitempty"`
+	Autopay     bool    `json:"autopay,omitempty"`
+	Rate        float64 `json:"rate,omitempty"`
+}
+
+// PetView is one pet slot.
+type PetView struct {
+	Type      string `json:"type"`
+	Name      string `json:"name"`
+	Level     int    `json:"level"`
+	XP        int    `json:"xp,omitempty"`
+	ArmorTier int    `json:"armor_tier,omitempty"`
+}
+
+// ReplacePlayerDetail swaps the whole private-detail set in one transaction —
+// replace, never merge, the same contract as the roster: a player who dropped
+// out of gogobee's push must lose their stale self-view rather than have it
+// linger. localpart is lowercased upstream to match how a session Username reads.
+func ReplacePlayerDetail(players []PlayerDetail, snapshotAt int64) error {
+	tx, err := Get().Begin()
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	if _, err := tx.Exec(`DELETE FROM player_self_detail`); err != nil {
+		return err
+	}
+	stmt, err := tx.Prepare(`
+		INSERT INTO player_self_detail (localpart, token, detail_json, snapshot_at)
+		VALUES (?, ?, ?, ?)`)
+	if err != nil {
+		return err
+	}
+	defer stmt.Close()
+
+	for _, p := range players {
+		if p.Localpart == "" || p.Token == "" {
+			continue // a self-view with no owner or no page to hang on is unusable
+		}
+		body, err := json.Marshal(p)
+		if err != nil {
+			return err
+		}
+		if _, err := stmt.Exec(p.Localpart, p.Token, string(body), snapshotAt); err != nil {
+			return err
+		}
+	}
+	return tx.Commit()
+}
+
+// PlayerDetailByOwner returns the private detail for localpart, but only when it
+// owns the given page token. This is the ownership join the detail page needs:
+// the signed-in user's localpart is trusted (it comes from their verified
+// session), and a row exists only if gogobee pushed that same (localpart, token)
+// pair — so a viewer can only ever unlock the self extras on their own page, and
+// Pete never has to turn a token back into a handle to decide it.
+func PlayerDetailByOwner(localpart, token string) (PlayerDetail, bool, error) {
+	if localpart == "" || token == "" {
+		return PlayerDetail{}, false, nil
+	}
+	var storedToken, detailJSON string
+	err := Get().QueryRow(
+		`SELECT token, detail_json FROM player_self_detail WHERE localpart = ?`, localpart).
+		Scan(&storedToken, &detailJSON)
+	if err == sql.ErrNoRows {
+		return PlayerDetail{}, false, nil
+	}
+	if err != nil {
+		return PlayerDetail{}, false, err
+	}
+	if storedToken != token {
+		return PlayerDetail{}, false, nil // signed in, but not the owner of this page
+	}
+	var pd PlayerDetail
+	if err := json.Unmarshal([]byte(detailJSON), &pd); err != nil {
+		return PlayerDetail{}, false, err
+	}
+	pd.Localpart = localpart
+	pd.Token = storedToken
+	return pd, true, nil
+}
+
+// SelfToken returns the roster token owned by localpart, if gogobee's last push
+// carried one. Lets the board mark "your adventurer" without exposing the
+// localpart↔token map anywhere public.
+func SelfToken(localpart string) (string, bool) {
+	if localpart == "" {
+		return "", false
+	}
+	var token string
+	err := Get().QueryRow(
+		`SELECT token FROM player_self_detail WHERE localpart = ?`, localpart).Scan(&token)
+	if err != nil {
+		return "", false
+	}
+	return token, true
+}

internal/storage/detail_test.go

@@ -0,0 +1,126 @@
+package storage
+
+import "testing"
+
+// The private self-detail set is the one place Pete holds a localpart↔token
+// association. These tests pin the security contract of that store: the
+// ownership join only ever unlocks a page for the localpart that owns it, and a
+// replace wipes a departed player's stale self-view rather than leaving it to
+// linger.
+
+func seedSelfDetail(t *testing.T, localpart, token string) PlayerDetail {
+	t.Helper()
+	return PlayerDetail{
+		Localpart: localpart,
+		Token:     token,
+		Inventory: []ItemView{{Name: "Iron Ore", Type: "ore", Tier: 1, Value: 10}},
+		Vault:     []ItemView{{Name: "Jeweled Crown", Type: "treasure", Tier: 4, Value: 5000}},
+		House:     HouseView{Tier: 2, LoanBalance: 1500},
+		Pets:      []PetView{{Type: "cat", Name: "Mittens", Level: 3}},
+	}
+}
+
+// TestPlayerDetailByOwnerMatrix is the ownership matrix: the self-view unlocks
+// only when the signed-in localpart owns the exact page token. A different
+// localpart, or the owner viewing someone else's page, gets nothing.
+func TestPlayerDetailByOwnerMatrix(t *testing.T) {
+	setupTestDB(t)
+	if err := ReplacePlayerDetail([]PlayerDetail{
+		seedSelfDetail(t, "josie", "tok-josie"),
+		seedSelfDetail(t, "quack", "tok-quack"),
+	}, 1000); err != nil {
+		t.Fatalf("ReplacePlayerDetail: %v", err)
+	}
+
+	// The owner, on their own page: unlocked, and the private goods come through.
+	pd, ok, err := PlayerDetailByOwner("josie", "tok-josie")
+	if err != nil || !ok {
+		t.Fatalf("owner on own page: ok=%v err=%v, want unlocked", ok, err)
+	}
+	if len(pd.Inventory) != 1 || pd.House.Tier != 2 || len(pd.Pets) != 1 {
+		t.Errorf("owner detail = %+v, want inventory+house+pet carried", pd)
+	}
+
+	// Josie signed in, looking at Quack's page: her localpart doesn't own that
+	// token, so the join must refuse — no peeking at another player's private set.
+	if _, ok, _ := PlayerDetailByOwner("josie", "tok-quack"); ok {
+		t.Error("owner unlocked ANOTHER player's page — the token guard failed")
+	}
+
+	// A signed-in stranger with no self-detail row at all.
+	if _, ok, _ := PlayerDetailByOwner("nobody", "tok-josie"); ok {
+		t.Error("a stranger unlocked a page they have no row for")
+	}
+
+	// Empty inputs never unlock.
+	if _, ok, _ := PlayerDetailByOwner("", "tok-josie"); ok {
+		t.Error("empty localpart unlocked a page")
+	}
+	if _, ok, _ := PlayerDetailByOwner("josie", ""); ok {
+		t.Error("empty token unlocked a page")
+	}
+}
+
+// TestReplacePlayerDetailReplaces: the set is swapped whole, never merged — a
+// player gogobee stops pushing (deleted character, dropped out) must lose their
+// stale self-view, the same complete-snapshot contract as the board.
+func TestReplacePlayerDetailReplaces(t *testing.T) {
+	setupTestDB(t)
+	if err := ReplacePlayerDetail([]PlayerDetail{
+		seedSelfDetail(t, "josie", "tok-josie"),
+		seedSelfDetail(t, "quack", "tok-quack"),
+	}, 1000); err != nil {
+		t.Fatal(err)
+	}
+	// Next push carries only Josie; Quack has left.
+	if err := ReplacePlayerDetail([]PlayerDetail{
+		seedSelfDetail(t, "josie", "tok-josie"),
+	}, 1060); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok, _ := PlayerDetailByOwner("quack", "tok-quack"); ok {
+		t.Error("a dropped player's self-view survived the replace")
+	}
+	if _, ok, _ := PlayerDetailByOwner("josie", "tok-josie"); !ok {
+		t.Error("the surviving player lost their self-view")
+	}
+}
+
+// TestReplacePlayerDetailTokenFollows: when a player's board token rotates
+// (re-derived each push), the ownership check must follow it. The stale token no
+// longer unlocks; the current one does.
+func TestReplacePlayerDetailTokenFollows(t *testing.T) {
+	setupTestDB(t)
+	if err := ReplacePlayerDetail([]PlayerDetail{seedSelfDetail(t, "josie", "tok-old")}, 1000); err != nil {
+		t.Fatal(err)
+	}
+	if err := ReplacePlayerDetail([]PlayerDetail{seedSelfDetail(t, "josie", "tok-new")}, 1060); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok, _ := PlayerDetailByOwner("josie", "tok-old"); ok {
+		t.Error("the stale token still unlocked the page after a rotation")
+	}
+	if _, ok, _ := PlayerDetailByOwner("josie", "tok-new"); !ok {
+		t.Error("the current token failed to unlock the page")
+	}
+}
+
+// TestReplacePlayerDetailSkipsUnusable: a row with no owner or no page to hang
+// on is dropped at write time — it could never be served and would only be dead
+// weight.
+func TestReplacePlayerDetailSkipsUnusable(t *testing.T) {
+	setupTestDB(t)
+	if err := ReplacePlayerDetail([]PlayerDetail{
+		{Localpart: "", Token: "tok-orphan"},
+		{Localpart: "ghost", Token: ""},
+		seedSelfDetail(t, "josie", "tok-josie"),
+	}, 1000); err != nil {
+		t.Fatal(err)
+	}
+	if tok, ok := SelfToken("josie"); !ok || tok != "tok-josie" {
+		t.Errorf("SelfToken(josie) = %q,%v, want tok-josie", tok, ok)
+	}
+	if _, ok := SelfToken("ghost"); ok {
+		t.Error("a tokenless row was stored")
+	}
+}

internal/storage/games.go

@@ -563,6 +563,12 @@ type LiveHand struct {
 	State []byte
 	Seed1 uint64
 	Seed2 uint64
+	// TableID is set when the player is sitting at a shared table instead of playing
+	// alone. The cards are then in game_tables and State here is empty: this row is
+	// the occupancy claim and nothing else. One row per player either way, which is
+	// the point — the primary key that stops a second solo hand is the same one that
+	// stops a second seat.
+	TableID string
 }
 
 // StartLiveHand seats a *new* hand, and refuses if the player is already in one.
@@ -609,16 +615,17 @@ func LoadLiveHand(user string) (LiveHand, error) {
 	var h LiveHand
 	var state string
 	var s1, s2 int64
+	var tableID sql.NullString
 	err := Get().QueryRow(
-		`SELECT game, state, seed1, seed2 FROM game_live_hands WHERE matrix_user = ?`, user,
-	).Scan(&h.Game, &state, &s1, &s2)
+		`SELECT game, state, seed1, seed2, table_id FROM game_live_hands WHERE matrix_user = ?`, user,
+	).Scan(&h.Game, &state, &s1, &s2, &tableID)
 	if errors.Is(err, sql.ErrNoRows) {
 		return LiveHand{}, ErrNoLiveHand
 	}
 	if err != nil {
 		return LiveHand{}, fmt.Errorf("games: load live hand: %w", err)
 	}
-	h.State, h.Seed1, h.Seed2 = []byte(state), uint64(s1), uint64(s2)
+	h.State, h.Seed1, h.Seed2, h.TableID = []byte(state), uint64(s1), uint64(s2), tableID.String
 	return h, nil
 }
 

internal/storage/mischief.go

@@ -0,0 +1,335 @@
+package storage
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+)
+
+// The mischief storefront's half of the euro border.
+//
+// A buyer signs in, picks a mark off the anonymous roster board, and places a
+// hit. Pete records only the *intent*: it never moves money and never runs a
+// single game rule. gogobee's poll loop reads the pending orders, does the real
+// work against its own ledger (debit, eligibility, open the contract), and hands
+// back a verdict Pete files against the order. The guid is the idempotency key
+// end to end — gogobee passes it to DebitIdem and stamps it on the contract — so
+// a verdict whose ack is lost on the wire can be retried without the buyer paying
+// twice or the mark catching two hits for one order.
+
+// MischiefOrder is one storefront order and its current standing.
+type MischiefOrder struct {
+	GUID          string `json:"guid"`
+	BuyerSub      string `json:"-"`             // OIDC subject; keys "my orders", never sent to gogobee
+	BuyerUsername string `json:"buyer_username"` // localpart gogobee turns into @username:server
+	TargetToken   string `json:"target_token"`
+	TargetName    string `json:"target_name"`
+	Tier          string `json:"tier"`
+	Signed        bool   `json:"signed"`
+	Status        string `json:"status"`
+	Detail        string `json:"detail,omitempty"`
+	CreatedAt     int64  `json:"created_at"`
+	UpdatedAt     int64  `json:"updated_at,omitempty"`
+}
+
+// Order states. These strings cross the wire to gogobee (it POSTs the verdict),
+// so they are part of the contract — see the schema and gogobee_mischief_plan.md.
+const (
+	MischiefPending           = "pending"            // placed; gogobee hasn't acted yet
+	MischiefPlaced            = "placed"             // gogobee debited the buyer and opened a contract
+	MischiefBouncedFunds      = "bounced_funds"      // buyer couldn't afford it after all
+	MischiefBouncedIneligible = "bounced_ineligible" // target no longer a valid mark
+)
+
+// validMischiefVerdict is the set of terminal states gogobee is allowed to hand
+// back. An unknown verdict is a contract mismatch, not something to file blindly.
+func validMischiefVerdict(status string) bool {
+	switch status {
+	case MischiefPlaced, MischiefBouncedFunds, MischiefBouncedIneligible:
+		return true
+	}
+	return false
+}
+
+var ErrNoSuchOrder = errors.New("mischief: no such order")
+
+// InsertMischiefOrder records a fresh, pending order and returns it with a new
+// guid. Money and eligibility are gogobee's problem; all Pete asserts here is
+// that the buyer is signed in and the form was well formed (checked by the
+// caller). The guid is minted here so the buyer sees a stable reference the
+// instant they submit, before gogobee has ever heard of it.
+func InsertMischiefOrder(buyerSub, buyerUsername, targetToken, targetName, tier string, signed bool) (MischiefOrder, error) {
+	guid, err := newGUID()
+	if err != nil {
+		return MischiefOrder{}, err
+	}
+	now := nowUnix()
+	sig := 0
+	if signed {
+		sig = 1
+	}
+	if _, err := Get().Exec(
+		`INSERT INTO mischief_orders
+		    (guid, buyer_sub, buyer_username, target_token, target_name, tier, signed, status, created_at, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		guid, buyerSub, buyerUsername, targetToken, targetName, tier, sig, MischiefPending, now, now,
+	); err != nil {
+		return MischiefOrder{}, fmt.Errorf("mischief: insert order: %w", err)
+	}
+	return MischiefOrder{
+		GUID: guid, BuyerSub: buyerSub, BuyerUsername: buyerUsername,
+		TargetToken: targetToken, TargetName: targetName, Tier: tier,
+		Signed: signed, Status: MischiefPending, CreatedAt: now, UpdatedAt: now,
+	}, nil
+}
+
+// PendingMischiefOrders is what gogobee's poll loop reads: every order still
+// waiting to be acted on. There is no claimed-but-stale window like escrow has,
+// because a pending order carries no intermediate state — if gogobee dies partway
+// through, the order simply stays pending and is offered again next poll, and the
+// guid makes the replay a no-op.
+func PendingMischiefOrders(limit int) ([]MischiefOrder, error) {
+	if limit <= 0 {
+		limit = 100
+	}
+	rows, err := Get().Query(
+		`SELECT guid, buyer_sub, buyer_username, target_token, target_name, tier, signed, status, COALESCE(detail, ''), created_at, updated_at
+		   FROM mischief_orders
+		  WHERE status = ?
+		  ORDER BY created_at
+		  LIMIT ?`,
+		MischiefPending, limit,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("mischief: pending orders: %w", err)
+	}
+	defer rows.Close()
+	return scanMischiefOrders(rows)
+}
+
+// ResolveMischiefOrder files gogobee's verdict against a pending order. It is
+// idempotent: gogobee's poll loop can re-offer and re-resolve the same order, so
+// a verdict that arrives twice is a no-op the second time. Only a pending order
+// moves; an order already in a terminal state reports what it already decided,
+// which is what stops a retried verdict from overwriting the first one.
+func ResolveMischiefOrder(guid, status, detail string) (MischiefOrder, error) {
+	if !validMischiefVerdict(status) {
+		return MischiefOrder{}, fmt.Errorf("mischief: bad verdict %q", status)
+	}
+	now := nowUnix()
+	if _, err := Get().Exec(
+		`UPDATE mischief_orders SET status = ?, detail = ?, updated_at = ?
+		  WHERE guid = ? AND status = ?`,
+		status, detail, now, guid, MischiefPending,
+	); err != nil {
+		return MischiefOrder{}, fmt.Errorf("mischief: resolve order: %w", err)
+	}
+	// Whether the update moved a pending order or matched nothing (missing, or
+	// already terminal from an earlier verdict), the current row is the
+	// authoritative answer — reading it back is the single path either way, and
+	// MischiefOrderByGUID turns a missing row into ErrNoSuchOrder for the caller.
+	return MischiefOrderByGUID(guid)
+}
+
+// MischiefOrderByGUID reads one order.
+func MischiefOrderByGUID(guid string) (MischiefOrder, error) {
+	rows, err := Get().Query(
+		`SELECT guid, buyer_sub, buyer_username, target_token, target_name, tier, signed, status, COALESCE(detail, ''), created_at, updated_at
+		   FROM mischief_orders WHERE guid = ?`, guid,
+	)
+	if err != nil {
+		return MischiefOrder{}, fmt.Errorf("mischief: read order: %w", err)
+	}
+	defer rows.Close()
+	out, err := scanMischiefOrders(rows)
+	if err != nil {
+		return MischiefOrder{}, err
+	}
+	if len(out) == 0 {
+		return MischiefOrder{}, ErrNoSuchOrder
+	}
+	return out[0], nil
+}
+
+// MischiefOrdersByBuyer returns a buyer's own recent orders, newest first, for
+// the storefront status panel. Keyed on the OIDC subject so a username change
+// doesn't strand a buyer's history.
+func MischiefOrdersByBuyer(buyerSub string, limit int) ([]MischiefOrder, error) {
+	if limit <= 0 {
+		limit = 20
+	}
+	rows, err := Get().Query(
+		`SELECT guid, buyer_sub, buyer_username, target_token, target_name, tier, signed, status, COALESCE(detail, ''), created_at, updated_at
+		   FROM mischief_orders
+		  WHERE buyer_sub = ?
+		  ORDER BY created_at DESC
+		  LIMIT ?`,
+		buyerSub, limit,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("mischief: orders by buyer: %w", err)
+	}
+	defer rows.Close()
+	return scanMischiefOrders(rows)
+}
+
+// CountMischiefOrdersSince counts how many orders a buyer has placed since a unix
+// cutoff. It backs the storefront's burst guard — the real economic caps (per
+// day, per target, boss weekly) live on gogobee, this only blunts form-spam.
+func CountMischiefOrdersSince(buyerSub string, since int64) (int, error) {
+	var n int
+	err := Get().QueryRow(
+		`SELECT COUNT(*) FROM mischief_orders WHERE buyer_sub = ? AND created_at >= ?`,
+		buyerSub, since,
+	).Scan(&n)
+	if err != nil {
+		return 0, fmt.Errorf("mischief: count recent orders: %w", err)
+	}
+	return n, nil
+}
+
+func scanMischiefOrders(rows *sql.Rows) ([]MischiefOrder, error) {
+	var out []MischiefOrder
+	for rows.Next() {
+		var o MischiefOrder
+		var sig int
+		if err := rows.Scan(&o.GUID, &o.BuyerSub, &o.BuyerUsername, &o.TargetToken,
+			&o.TargetName, &o.Tier, &sig, &o.Status, &o.Detail, &o.CreatedAt, &o.UpdatedAt); err != nil {
+			return nil, fmt.Errorf("mischief: scan order: %w", err)
+		}
+		o.Signed = sig != 0
+		out = append(out, o)
+	}
+	return out, rows.Err()
+}
+
+// ---- user_euro: the buyer's own advisory balance -------------------------------
+
+// ReplaceUserEuro swaps the whole balance table for a new snapshot, in one
+// transaction, mirroring the roster: a buyer gogobee stopped reporting (opted
+// out, deleted character) must drop out rather than keep a frozen number forever.
+// Replace — never merge.
+func ReplaceUserEuro(balances []MischiefBalance, snapshotAt int64) error {
+	tx, err := Get().Begin()
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	if _, err := tx.Exec(`DELETE FROM user_euro`); err != nil {
+		return err
+	}
+	stmt, err := tx.Prepare(`INSERT INTO user_euro (username, euro, snapshot_at) VALUES (?, ?, ?)`)
+	if err != nil {
+		return err
+	}
+	defer stmt.Close()
+	for _, b := range balances {
+		if b.Username == "" {
+			continue
+		}
+		if _, err := stmt.Exec(b.Username, b.Euro, snapshotAt); err != nil {
+			return err
+		}
+	}
+	return tx.Commit()
+}
+
+// MischiefBalance is one buyer's advisory euro balance in the roster push.
+type MischiefBalance struct {
+	Username string  `json:"username"`
+	Euro     float64 `json:"euro"`
+}
+
+// ---- mischief_tiers: the price catalog, pushed by gogobee -----------------------
+
+// MischiefTier is one rung of the storefront's price list. gogobee is the sole
+// authority on prices — it pushes the whole catalog on the roster tick so a fee
+// retune reaches the storefront within a snapshot and Pete never hardcodes a
+// number that can silently drift. Pete uses it only to render and to validate a
+// submitted tier key; the real debit is always gogobee's, at its own price.
+type MischiefTier struct {
+	Key       string `json:"key"`
+	Display   string `json:"display"`
+	Fee       int    `json:"fee"`
+	SignedFee int    `json:"signed_fee"`
+	Blurb     string `json:"blurb,omitempty"`
+}
+
+// ReplaceMischiefTiers swaps the whole catalog for gogobee's latest, preserving
+// the push order (grunt→boss) via an ordinal column. Replace, never merge — a
+// tier gogobee dropped must disappear from the storefront.
+func ReplaceMischiefTiers(tiers []MischiefTier) error {
+	tx, err := Get().Begin()
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	if _, err := tx.Exec(`DELETE FROM mischief_tiers`); err != nil {
+		return err
+	}
+	stmt, err := tx.Prepare(`INSERT INTO mischief_tiers (key, display, fee, signed_fee, blurb, ordinal) VALUES (?, ?, ?, ?, ?, ?)`)
+	if err != nil {
+		return err
+	}
+	defer stmt.Close()
+	for i, t := range tiers {
+		if t.Key == "" {
+			continue
+		}
+		if _, err := stmt.Exec(t.Key, t.Display, t.Fee, t.SignedFee, t.Blurb, i); err != nil {
+			return err
+		}
+	}
+	return tx.Commit()
+}
+
+// MischiefTiers returns the catalog in push order. Empty (not an error) until
+// gogobee has pushed one — the storefront treats that as "catalog not ready yet".
+func MischiefTiers() ([]MischiefTier, error) {
+	rows, err := Get().Query(
+		`SELECT key, display, fee, signed_fee, COALESCE(blurb, '') FROM mischief_tiers ORDER BY ordinal`)
+	if err != nil {
+		return nil, fmt.Errorf("mischief: read tiers: %w", err)
+	}
+	defer rows.Close()
+	var out []MischiefTier
+	for rows.Next() {
+		var t MischiefTier
+		if err := rows.Scan(&t.Key, &t.Display, &t.Fee, &t.SignedFee, &t.Blurb); err != nil {
+			return nil, fmt.Errorf("mischief: scan tier: %w", err)
+		}
+		out = append(out, t)
+	}
+	return out, rows.Err()
+}
+
+// MischiefTierByKey looks up one tier for validating a submitted order.
+func MischiefTierByKey(key string) (MischiefTier, bool, error) {
+	tiers, err := MischiefTiers()
+	if err != nil {
+		return MischiefTier{}, false, err
+	}
+	for _, t := range tiers {
+		if t.Key == key {
+			return t, true, nil
+		}
+	}
+	return MischiefTier{}, false, nil
+}
+
+// UserEuro reads one buyer's advisory balance. The bool is false when gogobee has
+// never reported a balance for them (never played, opted out) — the storefront
+// then shows tiers without an affordability hint rather than a misleading €0.
+func UserEuro(username string) (float64, bool, error) {
+	var euro float64
+	err := Get().QueryRow(`SELECT euro FROM user_euro WHERE username = ?`, username).Scan(&euro)
+	if errors.Is(err, sql.ErrNoRows) {
+		return 0, false, nil
+	}
+	if err != nil {
+		return 0, false, fmt.Errorf("mischief: read user euro: %w", err)
+	}
+	return euro, true, nil
+}

internal/storage/mischief_test.go

@@ -0,0 +1,178 @@
+package storage
+
+import (
+	"errors"
+	"testing"
+	"time"
+)
+
+func TestMischiefOrderLifecycle(t *testing.T) {
+	setupTestDB(t)
+
+	o, err := InsertMischiefOrder("sub-1", "reala", "tok-josie", "Josie", "elite", true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if o.Status != MischiefPending {
+		t.Fatalf("fresh order status = %q, want pending", o.Status)
+	}
+	if !o.Signed {
+		t.Error("signed flag lost through insert")
+	}
+
+	pending, err := PendingMischiefOrders(10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(pending) != 1 || pending[0].GUID != o.GUID {
+		t.Fatalf("pending = %+v, want the one order we just placed", pending)
+	}
+
+	// gogobee places the contract.
+	got, err := ResolveMischiefOrder(o.GUID, MischiefPlaced, "the word is out")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Status != MischiefPlaced || got.Detail != "the word is out" {
+		t.Fatalf("resolved order = %+v, want placed with detail", got)
+	}
+
+	// It must leave the pending set.
+	if pending, _ := PendingMischiefOrders(10); len(pending) != 0 {
+		t.Fatalf("placed order still pending: %+v", pending)
+	}
+}
+
+// TestMischiefResolveIsIdempotent is the whole reason the guid is an end-to-end
+// key: gogobee's poll loop retries, so a verdict can arrive twice, and the second
+// arrival must not overwrite the first or error.
+func TestMischiefResolveIsIdempotent(t *testing.T) {
+	setupTestDB(t)
+
+	o, err := InsertMischiefOrder("sub-1", "reala", "tok", "Josie", "grunt", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ResolveMischiefOrder(o.GUID, MischiefPlaced, "first"); err != nil {
+		t.Fatal(err)
+	}
+	// A second, *different* verdict arrives. First one wins.
+	got, err := ResolveMischiefOrder(o.GUID, MischiefBouncedFunds, "second")
+	if err != nil {
+		t.Fatalf("re-resolve errored: %v", err)
+	}
+	if got.Status != MischiefPlaced || got.Detail != "first" {
+		t.Fatalf("idempotency broken: order became %+v", got)
+	}
+}
+
+func TestMischiefResolveUnknownAndBadVerdict(t *testing.T) {
+	setupTestDB(t)
+
+	if _, err := ResolveMischiefOrder("nope", MischiefPlaced, ""); !errors.Is(err, ErrNoSuchOrder) {
+		t.Fatalf("unknown guid err = %v, want ErrNoSuchOrder", err)
+	}
+
+	o, _ := InsertMischiefOrder("sub-1", "reala", "tok", "Josie", "grunt", false)
+	if _, err := ResolveMischiefOrder(o.GUID, "exploded", ""); err == nil {
+		t.Error("a bogus verdict status was accepted")
+	}
+	// The order must survive a rejected verdict as still-pending.
+	if got, _ := MischiefOrderByGUID(o.GUID); got.Status != MischiefPending {
+		t.Fatalf("order moved off pending on a bad verdict: %q", got.Status)
+	}
+}
+
+func TestMischiefOrdersByBuyerAndCount(t *testing.T) {
+	setupTestDB(t)
+
+	for i := 0; i < 3; i++ {
+		if _, err := InsertMischiefOrder("sub-A", "alice", "tok", "Josie", "grunt", false); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := InsertMischiefOrder("sub-B", "bob", "tok", "Josie", "grunt", false); err != nil {
+		t.Fatal(err)
+	}
+
+	mine, err := MischiefOrdersByBuyer("sub-A", 20)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(mine) != 3 {
+		t.Fatalf("alice sees %d orders, want 3 (and none of bob's)", len(mine))
+	}
+
+	n, err := CountMischiefOrdersSince("sub-A", time.Now().Add(-time.Hour).Unix())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n != 3 {
+		t.Fatalf("count since an hour ago = %d, want 3", n)
+	}
+	if n, _ := CountMischiefOrdersSince("sub-A", time.Now().Add(time.Hour).Unix()); n != 0 {
+		t.Fatalf("count since the future = %d, want 0", n)
+	}
+}
+
+func TestMischiefTiersReplaceAndLookup(t *testing.T) {
+	setupTestDB(t)
+
+	tiers := []MischiefTier{
+		{Key: "grunt", Display: "Grunt", Fee: 40, SignedFee: 50, Blurb: "theatre"},
+		{Key: "boss", Display: "Boss", Fee: 1200, SignedFee: 1500},
+	}
+	if err := ReplaceMischiefTiers(tiers); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := MischiefTiers()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 || got[0].Key != "grunt" || got[1].Key != "boss" {
+		t.Fatalf("catalog order not preserved: %+v", got)
+	}
+
+	tier, ok, err := MischiefTierByKey("boss")
+	if err != nil || !ok || tier.SignedFee != 1500 {
+		t.Fatalf("lookup boss = %+v ok=%v err=%v", tier, ok, err)
+	}
+	if _, ok, _ := MischiefTierByKey("dragon"); ok {
+		t.Error("lookup invented a tier that was never pushed")
+	}
+
+	// Replace, never merge: a dropped tier vanishes.
+	if err := ReplaceMischiefTiers([]MischiefTier{{Key: "grunt", Display: "Grunt", Fee: 40, SignedFee: 50}}); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok, _ := MischiefTierByKey("boss"); ok {
+		t.Error("a tier dropped from the push survived the replace")
+	}
+}
+
+func TestUserEuroReplaceAndRead(t *testing.T) {
+	setupTestDB(t)
+
+	if err := ReplaceUserEuro([]MischiefBalance{{Username: "reala", Euro: 820.5}}, time.Now().Unix()); err != nil {
+		t.Fatal(err)
+	}
+	euro, has, err := UserEuro("reala")
+	if err != nil || !has || euro != 820.5 {
+		t.Fatalf("UserEuro(reala) = %v has=%v err=%v", euro, has, err)
+	}
+
+	// A user gogobee has never reported reads as "unknown", not €0 — the
+	// storefront shows no hint rather than a discouraging, wrong zero.
+	if _, has, _ := UserEuro("stranger"); has {
+		t.Error("UserEuro claimed to know a stranger's balance")
+	}
+
+	// Replace drops anyone the new snapshot omits.
+	if err := ReplaceUserEuro([]MischiefBalance{{Username: "bob", Euro: 10}}, time.Now().Unix()); err != nil {
+		t.Fatal(err)
+	}
+	if _, has, _ := UserEuro("reala"); has {
+		t.Error("a balance that fell out of the snapshot survived the replace")
+	}
+}

internal/storage/roster.go

@@ -2,6 +2,7 @@ package storage
 
 import (
 	"database/sql"
+	"encoding/json"
 	"log/slog"
 )
 
@@ -18,6 +19,10 @@ type RosterEntry struct {
 	Day        int    `json:"day,omitempty"`
 	IdleHours  int    `json:"idle_hours,omitempty"`
 	SnapshotAt int64  `json:"snapshot_at"`
+	// Detail is the public expanded sheet (stats + gear), carried as raw JSON so
+	// the board path never has to model or touch it — only the detail page decodes
+	// it. Empty when a snapshot predates the detail push.
+	Detail json.RawMessage `json:"detail,omitempty"`
 }
 
 // ReplaceRoster swaps the whole board for a new snapshot, in one transaction.
@@ -38,16 +43,20 @@ func ReplaceRoster(entries []RosterEntry, snapshotAt int64) error {
 	}
 	stmt, err := tx.Prepare(`
 		INSERT INTO adventure_roster
-		    (token, name, level, class_race, status, zone, region, day, idle_hours, snapshot_at)
-		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+		    (token, name, level, class_race, status, zone, region, day, idle_hours, snapshot_at, detail_json)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
 	if err != nil {
 		return err
 	}
 	defer stmt.Close()
 
 	for _, e := range entries {
+		var detail any // NULL when absent, so the column reads as "no detail", not "{}"
+		if len(e.Detail) > 0 {
+			detail = string(e.Detail)
+		}
 		if _, err := stmt.Exec(e.Token, e.Name, e.Level, e.ClassRace, e.Status,
-			e.Zone, e.Region, e.Day, e.IdleHours, snapshotAt); err != nil {
+			e.Zone, e.Region, e.Day, e.IdleHours, snapshotAt, detail); err != nil {
 			return err
 		}
 	}
@@ -91,6 +100,31 @@ func LoadRoster() ([]RosterEntry, int64, error) {
 	return out, RosterSnapshotAt(), nil
 }
 
+// RosterEntryByToken looks up one adventurer by their roster token. The bool is
+// false when no such token is on the current board — which is exactly the check
+// the storefront needs: a buyer may only order a hit on a mark the live board is
+// actually showing, never a stale or guessed token.
+func RosterEntryByToken(token string) (RosterEntry, bool, error) {
+	var e RosterEntry
+	var detail sql.NullString
+	err := Get().QueryRow(`
+		SELECT token, name, level, COALESCE(class_race, ''), status,
+		       COALESCE(zone, ''), COALESCE(region, ''), day, idle_hours, snapshot_at, detail_json
+		  FROM adventure_roster WHERE token = ?`, token).Scan(
+		&e.Token, &e.Name, &e.Level, &e.ClassRace, &e.Status,
+		&e.Zone, &e.Region, &e.Day, &e.IdleHours, &e.SnapshotAt, &detail)
+	if err == sql.ErrNoRows {
+		return RosterEntry{}, false, nil
+	}
+	if err != nil {
+		return RosterEntry{}, false, err
+	}
+	if detail.Valid && detail.String != "" {
+		e.Detail = json.RawMessage(detail.String)
+	}
+	return e, true, nil
+}
+
 // RosterSnapshotAt reports when the board was last refreshed, 0 if gogobee has
 // never pushed one. Read from the meta row, not the entries, so a snapshot that
 // legitimately carried nobody still counts as a snapshot.

internal/storage/schema.go

@@ -52,6 +52,83 @@ CREATE TABLE IF NOT EXISTS adventure_roster_meta (
     snapshot_at INTEGER NOT NULL DEFAULT 0
 );
 
+-- A signed-in buyer's own euro balance, as of the last snapshot gogobee pushed.
+-- Keyed by localpart (== Authentik preferred_username == the session's Username),
+-- a *separate keyspace* from the anonymous roster tokens on purpose: it is only
+-- ever read for the one authenticated user asking about themselves, so the board
+-- stays anonymous and no endpoint hands out anyone else's number. Advisory only —
+-- the storefront greys out tiers it thinks you can't afford, but the real debit
+-- happens on gogobee at claim time and a stale balance just bounces an order.
+CREATE TABLE IF NOT EXISTS user_euro (
+    username    TEXT PRIMARY KEY,          -- Matrix localpart == session Username
+    euro        REAL NOT NULL DEFAULT 0,
+    snapshot_at INTEGER NOT NULL DEFAULT 0
+);
+
+-- A mischief contract a buyer placed from the web storefront, on its way to
+-- gogobee. Pete never touches money and never runs the game rules — it only
+-- records the *intent* and later the verdict gogobee hands back. The status
+-- ladder:
+--
+--   pending -> placed              (gogobee debited the buyer and opened a contract)
+--           -> bounced_funds       (buyer couldn't actually afford it)
+--           -> bounced_ineligible  (target no longer a valid mark: no expedition,
+--                                    a live contract already, cooldown, cap, ...)
+--
+-- guid is the idempotency key end to end: gogobee passes it to DebitIdem and
+-- stamps it on the contract, so a claim whose ack is lost on the wire can be
+-- retried without charging the buyer twice or opening two contracts. buyer_sub
+-- is the OIDC subject (stable across username changes) and keys "my orders";
+-- buyer_username is what gogobee turns into @username:server. target_token is
+-- the roster token of the mark — the same anonymous token the board renders, so
+-- ordering a hit never needs the victim's real handle.
+CREATE TABLE IF NOT EXISTS mischief_orders (
+    guid           TEXT PRIMARY KEY,
+    buyer_sub      TEXT NOT NULL,
+    buyer_username TEXT NOT NULL,
+    target_token   TEXT NOT NULL,
+    target_name    TEXT NOT NULL,           -- display copy, frozen at order time
+    tier           TEXT NOT NULL,
+    signed         INTEGER NOT NULL DEFAULT 0, -- 1 = sign openly (+25%), 0 = anonymous
+    status         TEXT NOT NULL,           -- see the ladder above
+    detail         TEXT,                    -- gogobee's human note on the verdict
+    created_at     INTEGER NOT NULL,
+    updated_at     INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_mischief_orders_pending ON mischief_orders(status, created_at);
+CREATE INDEX IF NOT EXISTS idx_mischief_orders_buyer ON mischief_orders(buyer_sub, created_at DESC);
+
+-- The storefront price list. gogobee is the sole authority on prices and pushes
+-- the whole catalog on the roster tick, so a fee retune reaches the storefront
+-- within a snapshot and Pete never hardcodes a number that can drift. ordinal
+-- preserves the grunt->boss order the push arrived in.
+CREATE TABLE IF NOT EXISTS mischief_tiers (
+    key        TEXT PRIMARY KEY,
+    display    TEXT NOT NULL,
+    fee        INTEGER NOT NULL,
+    signed_fee INTEGER NOT NULL,
+    blurb      TEXT,
+    ordinal    INTEGER NOT NULL DEFAULT 0
+);
+
+-- A player's private, owner-only expansion — inventory, vault, house, pets —
+-- pushed whole by gogobee on the roster tick. Keyed by localpart (== session
+-- Username), a *separate keyspace* from the anonymous roster tokens on purpose:
+-- like user_euro, it is only ever served back to the one authenticated user it
+-- belongs to, never on the public board. token is that player's current roster
+-- token, kept here so the detail page can prove owner↔page by a join without
+-- ever reversing the one-way token — the association lives only in this
+-- owner-private table and never reaches any public response. detail_json is the
+-- {inventory, vault, house, pets} body; it is replaced wholesale each tick, so a
+-- player who drops out of gogobee's push loses their stale self-view.
+CREATE TABLE IF NOT EXISTS player_self_detail (
+    localpart   TEXT PRIMARY KEY,
+    token       TEXT NOT NULL,
+    detail_json TEXT NOT NULL,
+    snapshot_at INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_player_self_detail_token ON player_self_detail(token);
+
 CREATE TABLE IF NOT EXISTS post_log (
     id            INTEGER PRIMARY KEY AUTOINCREMENT,
     guid          TEXT NOT NULL,
@@ -239,9 +316,103 @@ CREATE TABLE IF NOT EXISTS game_live_hands (
     state       TEXT NOT NULL,               -- JSON: the engine's State
     seed1       INTEGER NOT NULL,            -- carried to the audit log when it settles
     seed2       INTEGER NOT NULL,
+    -- Set when the player is sitting at a shared table rather than playing alone.
+    -- The engine state then lives in game_tables.state, not here, and this row is
+    -- purely the occupancy claim: its PRIMARY KEY is what stops one player being
+    -- in two games at once, and it is the row the cash-out check reads. Making
+    -- game_seats a second uniqueness domain instead would be a split brain — see
+    -- the comment on game_seats.
+    table_id    TEXT,
     updated_at  INTEGER NOT NULL
 );
 
+-- ---------------------------------------------------------------------------
+-- Shared tables: the casino with more than one person at it.
+-- ---------------------------------------------------------------------------
+
+-- A table other people can sit at. The state column is the engine's State,
+-- exactly as game_live_hands holds it for a solo game — one blob for the whole
+-- felt, because a pot is not divisible into per-player rows.
+--
+-- version is the concurrency authority, and the mutex in the web layer is only
+-- an optimisation on top of it. Every state write is a conditional UPDATE
+-- against the version the writer read; zero rows affected means somebody moved
+-- first. This has to live in the database rather than in a mutex map because a
+-- mutex does not survive a redeploy — during a drain, two processes hold two
+-- different mutexes over the same row and both believe they are alone.
+CREATE TABLE IF NOT EXISTS game_tables (
+    id         TEXT PRIMARY KEY,
+    game       TEXT NOT NULL,                -- 'holdem' | 'uno' | 'blackjack'
+    tier       TEXT NOT NULL,                -- the stake, as that game names it
+    state      TEXT NOT NULL,                -- JSON: the engine's State
+    seed1      INTEGER NOT NULL,
+    seed2      INTEGER NOT NULL,
+    phase      TEXT NOT NULL,                -- the engine's phase, lifted out so the lobby can read it
+    hand_no    INTEGER NOT NULL DEFAULT 0,   -- with id, the identity of one hand: the payout key
+    version    INTEGER NOT NULL DEFAULT 0,
+    -- Unix seconds by which the seat to act must act, or 0 for no clock. The turn
+    -- clock scans this. It is set only when the turn lands on a human: bots resolve
+    -- inside ApplyMove and are never waited for.
+    deadline   INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_game_tables_due ON game_tables(deadline) WHERE deadline > 0;
+CREATE INDEX IF NOT EXISTS idx_game_tables_lobby ON game_tables(game, updated_at DESC);
+
+-- Who is sitting where. A seat with no matrix_user is a bot.
+--
+-- This is deliberately *not* a uniqueness domain for players: there is no unique
+-- index on matrix_user, and there must not be one. Occupancy is decided by
+-- game_live_hands' primary key, which already stops a player being in two games,
+-- already makes a double-clicked join a 409, and is already what the cash-out
+-- check reads. A second domain that could disagree with the first would silently
+-- switch all three off — the worst of them being a player who cashes out to zero
+-- while sitting at a poker table with chips in the pot.
+--
+-- staked is what the player brought to the table and has not yet taken home. It
+-- is the chip-conservation anchor: the chips are off their game_chips stack and
+-- inside the table blob, where the idle reaper cannot see them.
+CREATE TABLE IF NOT EXISTS game_seats (
+    table_id    TEXT NOT NULL,
+    seat        INTEGER NOT NULL,
+    matrix_user TEXT,                        -- NULL for a bot
+    name        TEXT NOT NULL,
+    staked      INTEGER NOT NULL DEFAULT 0,
+    -- Set once a human's clock has run out on them. An absent human is not a bot,
+    -- but the bot loop has to be allowed past their seat or a table with three
+    -- ghosts spends a minute an orbit folding air. They come back the moment they act.
+    away        INTEGER NOT NULL DEFAULT 0,
+    last_seen   INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY (table_id, seat)
+);
+CREATE INDEX IF NOT EXISTS idx_game_seats_user ON game_seats(matrix_user) WHERE matrix_user IS NOT NULL;
+
+-- There is no payout ledger here, and its absence is deliberate — the design
+-- called for one and the money model made it unnecessary. Chips cross into a
+-- table when a player sits down and back out when they get up; a hand ending
+-- moves the pot *within* the state blob and credits nobody's game_chips row. So
+-- there is no money write to make idempotent: a settle is a state write,
+-- conditional on the version, and a replayed one affects zero rows and rolls
+-- back. See the header of internal/storage/tables.go.
+
+-- Chat on the felt. Messages only — no typing indicators, which is the one thing
+-- that would have justified a socket. It does not mirror into Matrix.
+--
+-- hand_no is kept against every line for a reason: at a table of real people,
+-- collusion looks like chat, and the only way to ever answer that question is to
+-- be able to read what was said during the hand it was said in.
+CREATE TABLE IF NOT EXISTS game_chat (
+    id          INTEGER PRIMARY KEY AUTOINCREMENT,
+    table_id    TEXT NOT NULL,
+    hand_no     INTEGER NOT NULL,
+    matrix_user TEXT,                        -- NULL when the house is talking
+    name        TEXT NOT NULL,
+    body        TEXT NOT NULL,
+    said_at     INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_game_chat_table ON game_chat(table_id, id);
+
 -- The trivia bank: questions pulled from the Open Trivia Database ahead of time,
 -- so that asking one is a local read.
 --

internal/storage/tables.go

@@ -0,0 +1,907 @@
+package storage
+
+import (
+	"crypto/rand"
+	"database/sql"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// Shared tables: the casino with more than one person at it.
+//
+// The money model is the thing to understand first, because everything else
+// follows from it, and it is *not* the one the plan sketched.
+//
+// **Chips cross into a table when you sit down, and back out when you get up.
+// Nothing in between touches game_chips at all.** Your buy-in leaves your stack
+// and becomes a stack inside the engine's own state; antes, bets, pots and
+// payouts are all moves within that blob; and getting up is the single write
+// that turns what is in front of you back into chips.
+//
+// This is how hold'em already worked as a solo session, and generalising it is
+// what makes a pot safe. The obvious alternative — settle each hand by crediting
+// every winner's game_chips row — puts a real money write on the end of every
+// hand, and a crash between the credit and the state write pays the winner twice.
+// Here a settle credits nobody: it is a state write, conditional on the version,
+// and a replay of it affects zero rows and rolls back. The pot cannot be paid
+// twice because it is never *paid* at all, only moved.
+//
+// So the money invariant across a table's whole life is:
+//
+//	sum(seat stacks in the blob) + pot == sum(game_seats.staked) - rake taken
+//
+// and the only two statements that move chips across the border are the stake in
+// SitDown and the award in LeaveTable — each of them one transaction, each of
+// them carrying the state write that justifies it.
+//
+// The other half is concurrency. A table has two writers where a solo game had
+// one: an HTTP move, and a turn clock acting for whoever walked away. The version
+// column is the authority — every state write is conditional on the version its
+// writer read — and the striped mutex in the web layer is only an optimisation on
+// top. Correctness has to live in the database, because a mutex does not survive
+// a redeploy: during a drain, two processes hold two different mutexes over the
+// same row and both of them believe they are alone.
+
+var (
+	// ErrStaleTable means somebody else wrote the table first. The caller's read is
+	// out of date; it must reload and decide again. This is not an error condition
+	// so much as the normal outcome of a race, and it is what a 409 is made of.
+	ErrStaleTable = errors.New("games: the table moved on")
+	// ErrNoSuchTable means there is no table with that id.
+	ErrNoSuchTable = errors.New("games: no such table")
+	// ErrSeatTaken means somebody sat down there between the read and the write.
+	ErrSeatTaken = errors.New("games: that seat is taken")
+)
+
+// Table is a felt other people can sit at.
+//
+// State is the engine's State, serialized whole — the same blob game_live_hands
+// holds for a solo game, and for the same reason: the deck is in it, so it never
+// leaves the server, and a hand survives a redeploy.
+type Table struct {
+	ID    string
+	Game  string
+	Tier  string
+	State []byte
+	Seed1 uint64
+	Seed2 uint64
+	Phase string
+	// HandNo, with the id, is the identity of one hand. It is what the audit trail
+	// keys on now that a seed no longer reproduces a hand: at a shared table the
+	// cards fall the way they do because of the order the others acted, not just
+	// the seed, so "deal it again from seed1/seed2" stopped being a true story the
+	// moment there was a second player.
+	HandNo int64
+	// Version is the concurrency authority. Read it, write against it, and a write
+	// that finds it moved is a write that lost the race.
+	Version int64
+	// Deadline is the unix second by which the seat to act has to act, or 0 for no
+	// clock at all. Only a *human* to act sets one: bots resolve inside ApplyMove
+	// and there is nobody to wait for.
+	Deadline  int64
+	CreatedAt int64
+	UpdatedAt int64
+}
+
+// Seat is one chair. A seat with no MatrixUser is a bot, which is what makes solo
+// play just "a table nobody else has joined yet" rather than a second mode.
+type Seat struct {
+	Seat       int
+	MatrixUser string // "" for a bot
+	Name       string
+	// Staked is what this player brought and has not yet taken home. The chips are
+	// off their game_chips stack and inside the table blob, where the idle reaper
+	// cannot see them — so this is the row that says they exist.
+	Staked   int64
+	Away     bool
+	LastSeen int64
+}
+
+// Bot reports whether nobody is sitting here.
+func (s Seat) Bot() bool { return s.MatrixUser == "" }
+
+// NewTableID mints a table id. Short enough to put in a URL, random enough that
+// nobody guesses their way onto somebody else's felt.
+func NewTableID() (string, error) {
+	b := make([]byte, 9)
+	if _, err := rand.Read(b); err != nil {
+		return "", fmt.Errorf("games: mint table id: %w", err)
+	}
+	return base64.RawURLEncoding.EncodeToString(b), nil
+}
+
+// OpenTable creates a table and seats it — bots in every chair nobody has taken.
+func OpenTable(t Table, seats []Seat) error {
+	now := nowUnix()
+	tx, err := Get().Begin()
+	if err != nil {
+		return fmt.Errorf("games: begin open table: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck // no-op once committed
+
+	if _, err := tx.Exec(
+		`INSERT INTO game_tables (id, game, tier, state, seed1, seed2, phase, hand_no, version, deadline, created_at, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`,
+		t.ID, t.Game, t.Tier, string(t.State), int64(t.Seed1), int64(t.Seed2),
+		t.Phase, t.HandNo, t.Deadline, now, now,
+	); err != nil {
+		return fmt.Errorf("games: open table: %w", err)
+	}
+	for _, s := range seats {
+		if err := upsertSeat(tx, t.ID, s, now); err != nil {
+			return err
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("games: commit open table: %w", err)
+	}
+	return nil
+}
+
+// OpenSoloTable opens a table with the player already sitting at it — the "solo
+// is just a table nobody else has joined yet" path. It is SitDown and OpenTable
+// fused into one transaction: stake the buy-in, claim the occupancy row, create
+// the table, and seat everyone (the human, and the bots filling the rest of the
+// ring). Any step failing rolls the buy-in back with it, so a crash never leaves
+// a player charged for a felt that does not exist.
+//
+// The occupancy claim is the same primary key that stops a second solo hand, so a
+// player already at a table (or in another game) is refused here with
+// ErrHandInProgress and their buy-in returned untouched.
+func OpenSoloTable(t Table, seats []Seat, buyIn int64) error {
+	if buyIn <= 0 {
+		return ErrBadAmount
+	}
+	// The human seat is the one row that is not a bot; its player claims the table.
+	var user, name string
+	for _, s := range seats {
+		if !s.Bot() {
+			user, name = s.MatrixUser, s.Name
+			break
+		}
+	}
+	if user == "" {
+		return ErrBadAmount // a solo table with no human is a bug, not a table
+	}
+	now := nowUnix()
+
+	tx, err := Get().Begin()
+	if err != nil {
+		return fmt.Errorf("games: begin open solo: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck // no-op once committed
+
+	res, err := tx.Exec(
+		`UPDATE game_chips SET chips = chips - ?, last_played = ?, updated_at = ?
+		  WHERE matrix_user = ? AND chips >= ?`,
+		buyIn, now, now, user, buyIn,
+	)
+	if err != nil {
+		return fmt.Errorf("games: stake solo buy-in: %w", err)
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrInsufficientChips
+	}
+
+	res, err = tx.Exec(
+		`INSERT INTO game_live_hands (matrix_user, game, state, seed1, seed2, table_id, updated_at)
+		 VALUES (?, ?, '', 0, 0, ?, ?)
+		 ON CONFLICT(matrix_user) DO NOTHING`,
+		user, t.Game, t.ID, now,
+	)
+	if err != nil {
+		return fmt.Errorf("games: claim solo seat: %w", err)
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrHandInProgress
+	}
+	_ = name
+
+	if _, err := tx.Exec(
+		`INSERT INTO game_tables (id, game, tier, state, seed1, seed2, phase, hand_no, version, deadline, created_at, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?)`,
+		t.ID, t.Game, t.Tier, string(t.State), int64(t.Seed1), int64(t.Seed2),
+		t.Phase, t.HandNo, t.Deadline, now, now,
+	); err != nil {
+		return fmt.Errorf("games: open solo table: %w", err)
+	}
+	for _, sc := range seats {
+		if err := upsertSeat(tx, t.ID, sc, now); err != nil {
+			return err
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("games: commit open solo: %w", err)
+	}
+	return nil
+}
+
+// upsertSeat writes a seat row inside an open transaction, bots included.
+//
+// last_seen is the caller's if they set one, and only falls back to now when they
+// did not. That distinction is load-bearing: the turn clock rewrites a seat to
+// mark it away, and it must carry the seat's *existing* last_seen through
+// unchanged — otherwise every auto-fold refreshes the away player's clock, and
+// the abandoned-table reaper (which keys on how long ago a human last acted for
+// themselves) could never fire.
+func upsertSeat(tx *sql.Tx, tableID string, s Seat, now int64) error {
+	var user any
+	if s.MatrixUser != "" {
+		user = s.MatrixUser
+	}
+	seen := s.LastSeen
+	if seen == 0 {
+		seen = now
+	}
+	if _, err := tx.Exec(
+		`INSERT INTO game_seats (table_id, seat, matrix_user, name, staked, away, last_seen)
+		 VALUES (?, ?, ?, ?, ?, ?, ?)
+		 ON CONFLICT(table_id, seat) DO UPDATE SET
+		   matrix_user = excluded.matrix_user, name = excluded.name,
+		   staked = excluded.staked, away = excluded.away, last_seen = excluded.last_seen`,
+		tableID, s.Seat, user, s.Name, s.Staked, boolInt(s.Away), seen,
+	); err != nil {
+		return fmt.Errorf("games: seat: %w", err)
+	}
+	return nil
+}
+
+func boolInt(b bool) int64 {
+	if b {
+		return 1
+	}
+	return 0
+}
+
+// LoadTable reads a table and everyone at it.
+func LoadTable(id string) (Table, []Seat, error) {
+	var t Table
+	var state string
+	var s1, s2 int64
+	err := Get().QueryRow(
+		`SELECT id, game, tier, state, seed1, seed2, phase, hand_no, version, deadline, created_at, updated_at
+		   FROM game_tables WHERE id = ?`, id,
+	).Scan(&t.ID, &t.Game, &t.Tier, &state, &s1, &s2, &t.Phase, &t.HandNo, &t.Version, &t.Deadline, &t.CreatedAt, &t.UpdatedAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Table{}, nil, ErrNoSuchTable
+	}
+	if err != nil {
+		return Table{}, nil, fmt.Errorf("games: load table: %w", err)
+	}
+	t.State, t.Seed1, t.Seed2 = []byte(state), uint64(s1), uint64(s2)
+
+	seats, err := tableSeats(id)
+	if err != nil {
+		return Table{}, nil, err
+	}
+	return t, seats, nil
+}
+
+// tableSeats reads the chairs, in seat order.
+func tableSeats(id string) ([]Seat, error) {
+	rows, err := Get().Query(
+		`SELECT seat, matrix_user, name, staked, away, last_seen
+		   FROM game_seats WHERE table_id = ? ORDER BY seat`, id)
+	if err != nil {
+		return nil, fmt.Errorf("games: table seats: %w", err)
+	}
+	defer rows.Close()
+
+	var out []Seat
+	for rows.Next() {
+		var s Seat
+		var user sql.NullString
+		var away int64
+		if err := rows.Scan(&s.Seat, &user, &s.Name, &s.Staked, &away, &s.LastSeen); err != nil {
+			return nil, fmt.Errorf("games: scan seat: %w", err)
+		}
+		s.MatrixUser, s.Away = user.String, away != 0
+		out = append(out, s)
+	}
+	return out, rows.Err()
+}
+
+// TableSummary is a table as the lobby lists it: enough to decide whether to sit
+// down, and nothing that would give away a card.
+type TableSummary struct {
+	ID        string `json:"id"`
+	Game      string `json:"game"`
+	Tier      string `json:"tier"`
+	Phase     string `json:"phase"`
+	Humans    int    `json:"humans"`
+	Seats     int    `json:"seats"`
+	UpdatedAt int64  `json:"updated_at"`
+}
+
+// LobbyTables lists the live tables, most recently played first. A game of "" is
+// all of them.
+func LobbyTables(game string, limit int) ([]TableSummary, error) {
+	if limit <= 0 {
+		limit = 50
+	}
+	q := `SELECT t.id, t.game, t.tier, t.phase, t.updated_at,
+	             COUNT(s.seat),
+	             COUNT(s.matrix_user)
+	        FROM game_tables t
+	        LEFT JOIN game_seats s ON s.table_id = t.id`
+	args := []any{}
+	if game != "" {
+		q += ` WHERE t.game = ?`
+		args = append(args, game)
+	}
+	q += ` GROUP BY t.id ORDER BY t.updated_at DESC LIMIT ?`
+	args = append(args, limit)
+
+	rows, err := Get().Query(q, args...)
+	if err != nil {
+		return nil, fmt.Errorf("games: lobby: %w", err)
+	}
+	defer rows.Close()
+
+	var out []TableSummary
+	for rows.Next() {
+		var s TableSummary
+		if err := rows.Scan(&s.ID, &s.Game, &s.Tier, &s.Phase, &s.UpdatedAt, &s.Seats, &s.Humans); err != nil {
+			return nil, fmt.Errorf("games: scan lobby row: %w", err)
+		}
+		out = append(out, s)
+	}
+	return out, rows.Err()
+}
+
+// ---- writing a table back --------------------------------------------------
+
+// TableCommit is one write-back of a shared table.
+//
+// There is no payout field, and its absence is the design. A hand ending at a
+// shared table moves chips *within* the blob — the pot becomes somebody's stack —
+// so settling one credits nobody and mints nothing. What it writes is the state,
+// the audit rows, and whatever the seats now look like. The version makes it
+// exactly-once: a settle that runs twice loses the race with itself.
+type TableCommit struct {
+	// Table carries the new state and the version that was *read*. The write is
+	// conditional on that version and bumps it.
+	Table Table
+	// Seats to rewrite — a stack that changed hands, a seat that came back from
+	// away. Seats not named here are left alone.
+	Seats []Seat
+	// Audit is the per-seat record of a hand that just ended. Empty mid-hand.
+	Audit []Hand
+}
+
+// CommitTable writes a table back, and the hand it just finished with it, in one
+// transaction.
+//
+// The version check is the whole safety property, and it is why this can be
+// called by the turn clock and an HTTP move at the same instant without either
+// having to trust the other. Whoever gets there first bumps the version; the
+// loser's UPDATE matches zero rows, the transaction rolls back, and it comes back
+// ErrStaleTable with nothing written — no half-settled hand, no audit row for a
+// hand that did not happen.
+//
+// Nothing in here may call Get().Exec. The pool runs at MaxOpenConns(1), so a
+// bare Exec inside an open transaction waits forever for the connection that this
+// transaction is holding — and takes the news app down with it. See CommitHand.
+func CommitTable(c TableCommit) error {
+	now := nowUnix()
+
+	tx, err := Get().Begin()
+	if err != nil {
+		return fmt.Errorf("games: begin commit table: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck // no-op once committed
+
+	if err := saveTable(tx, c.Table, now); err != nil {
+		return err
+	}
+	for _, s := range c.Seats {
+		if err := upsertSeat(tx, c.Table.ID, s, now); err != nil {
+			return err
+		}
+	}
+	for _, h := range c.Audit {
+		if err := recordHand(tx, h, now); err != nil {
+			return err
+		}
+		// Playing a hand is the most deliberate thing a player does. Keep the reaper
+		// off them — their chips are inside the table blob, where it cannot see them
+		// anyway, but their game_chips row is what it reads.
+		if h.MatrixUser == "" {
+			continue
+		}
+		if _, err := tx.Exec(
+			`UPDATE game_chips SET last_played = ?, updated_at = ? WHERE matrix_user = ?`,
+			now, now, h.MatrixUser,
+		); err != nil {
+			return fmt.Errorf("games: touch session: %w", err)
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("games: commit table: %w", err)
+	}
+	return nil
+}
+
+// saveTable is the conditional state write: it lands only if the version is still
+// the one the caller read.
+func saveTable(tx *sql.Tx, t Table, now int64) error {
+	res, err := tx.Exec(
+		`UPDATE game_tables SET state = ?, phase = ?, hand_no = ?, seed1 = ?, seed2 = ?,
+		        deadline = ?, version = version + 1, updated_at = ?
+		  WHERE id = ? AND version = ?`,
+		string(t.State), t.Phase, t.HandNo, int64(t.Seed1), int64(t.Seed2),
+		t.Deadline, now, t.ID, t.Version,
+	)
+	if err != nil {
+		return fmt.Errorf("games: save table: %w", err)
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrStaleTable
+	}
+	return nil
+}
+
+// ---- sitting down and getting up -------------------------------------------
+
+// Sit is one player taking one chair, with the table state that has them in it.
+type Sit struct {
+	Table Table // the new state, and the version that was read
+	Seat  Seat  // MatrixUser, Name and the chair; Staked is the buy-in
+	BuyIn int64
+}
+
+// SitDown moves a player's chips onto a table and puts them in a seat — the first
+// of the only two statements in the casino that cross the chip/table border.
+//
+// It is one transaction and every step of it can refuse:
+//
+//   - the chips leave in the same statement that checks they are there, so two
+//     joins fired at once cannot spend the same chip;
+//   - the occupancy claim is game_live_hands' primary key, exactly as it is for a
+//     solo hand, so a player cannot be at two tables (or at a table and in a solo
+//     game) at once, and a double-clicked Join is a 409;
+//   - the seat is taken only if a bot is sitting in it, so two players racing for
+//     the last chair cannot both win;
+//   - and the state write is conditional on the version, so the engine's idea of
+//     who is at the table cannot drift from the seat rows.
+//
+// Any of those failing rolls back the buy-in with it.
+func SitDown(s Sit) error {
+	if s.BuyIn <= 0 {
+		return ErrBadAmount
+	}
+	now := nowUnix()
+
+	tx, err := Get().Begin()
+	if err != nil {
+		return fmt.Errorf("games: begin sit: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck // no-op once committed
+
+	res, err := tx.Exec(
+		`UPDATE game_chips SET chips = chips - ?, last_played = ?, updated_at = ?
+		  WHERE matrix_user = ? AND chips >= ?`,
+		s.BuyIn, now, now, s.Seat.MatrixUser, s.BuyIn,
+	)
+	if err != nil {
+		return fmt.Errorf("games: stake buy-in: %w", err)
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrInsufficientChips
+	}
+
+	// The occupancy claim. The state column is empty on purpose: the cards live in
+	// game_tables, and this row exists to be a primary key.
+	res, err = tx.Exec(
+		`INSERT INTO game_live_hands (matrix_user, game, state, seed1, seed2, table_id, updated_at)
+		 VALUES (?, ?, '', 0, 0, ?, ?)
+		 ON CONFLICT(matrix_user) DO NOTHING`,
+		s.Seat.MatrixUser, s.Table.Game, s.Table.ID, now,
+	)
+	if err != nil {
+		return fmt.Errorf("games: claim seat: %w", err)
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrHandInProgress
+	}
+
+	// Take the chair, but only out of a bot's hands.
+	res, err = tx.Exec(
+		`UPDATE game_seats SET matrix_user = ?, name = ?, staked = ?, away = 0, last_seen = ?
+		  WHERE table_id = ? AND seat = ? AND matrix_user IS NULL`,
+		s.Seat.MatrixUser, s.Seat.Name, s.BuyIn, now, s.Table.ID, s.Seat.Seat,
+	)
+	if err != nil {
+		return fmt.Errorf("games: take seat: %w", err)
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrSeatTaken
+	}
+
+	if err := saveTable(tx, s.Table, now); err != nil {
+		return err
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("games: commit sit: %w", err)
+	}
+	return nil
+}
+
+// Leave is one player getting up, with the table state that no longer has them.
+type Leave struct {
+	Table      Table // the new state, and the version that was read
+	Seat       int
+	MatrixUser string
+	// Bot is who takes the chair over. A table always has a full complement, so
+	// getting up hands the seat back to the house rather than leaving a hole.
+	Bot string
+	// Amount is what is in front of them: everything they are taking home. It may
+	// be more than they brought, or nothing at all.
+	Amount int64
+	// Audit, if the leaving itself settles something worth recording.
+	Audit []Hand
+}
+
+// LeaveTable turns what is in front of a player back into chips — the second and
+// last statement that crosses the chip/table border.
+//
+// One transaction, and the state write is in it. As two statements this is a
+// double-pay waiting to happen: award 1,240 chips, fail the state write, and the
+// player reloads to find their seat still there with 1,240 in front of it. They
+// get up again, and again.
+func LeaveTable(l Leave) error {
+	now := nowUnix()
+
+	tx, err := Get().Begin()
+	if err != nil {
+		return fmt.Errorf("games: begin leave: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck // no-op once committed
+
+	if err := saveTable(tx, l.Table, now); err != nil {
+		return err
+	}
+	if err := upsertSeat(tx, l.Table.ID, Seat{Seat: l.Seat, Name: l.Bot}, now); err != nil {
+		return err
+	}
+	if _, err := tx.Exec(
+		`DELETE FROM game_live_hands WHERE matrix_user = ? AND table_id = ?`,
+		l.MatrixUser, l.Table.ID,
+	); err != nil {
+		return fmt.Errorf("games: release seat claim: %w", err)
+	}
+	if err := award(tx, l.MatrixUser, l.Amount, now); err != nil {
+		return err
+	}
+	for _, h := range l.Audit {
+		if err := recordHand(tx, h, now); err != nil {
+			return err
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("games: commit leave: %w", err)
+	}
+	return nil
+}
+
+// PlayerSeat reports the table and chair a player is sitting at. It reads the
+// seat row, which sit and leave keep in lockstep with the occupancy claim in one
+// transaction, so a row here means a live-hand row there and vice versa.
+func PlayerSeat(user string) (tableID string, seat int, err error) {
+	err = Get().QueryRow(
+		`SELECT table_id, seat FROM game_seats WHERE matrix_user = ?`, user,
+	).Scan(&tableID, &seat)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", 0, ErrNoLiveHand
+	}
+	if err != nil {
+		return "", 0, fmt.Errorf("games: player seat: %w", err)
+	}
+	return tableID, seat, nil
+}
+
+// TableOf reports which table a player is sitting at, if any. Read off the
+// occupancy claim, so it agrees with the cash-out check by construction.
+func TableOf(user string) (string, error) {
+	var id sql.NullString
+	err := Get().QueryRow(
+		`SELECT table_id FROM game_live_hands WHERE matrix_user = ?`, user,
+	).Scan(&id)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", ErrNoLiveHand
+	}
+	if err != nil {
+		return "", fmt.Errorf("games: table of: %w", err)
+	}
+	return id.String, nil
+}
+
+// CloseTable deletes a table nobody is sitting at. Called when the last human
+// gets up: a felt with six bots on it and nobody watching is not a game, it is a
+// row that the lobby would advertise forever.
+func CloseTable(id string) error {
+	tx, err := Get().Begin()
+	if err != nil {
+		return fmt.Errorf("games: begin close table: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck // no-op once committed
+
+	var humans int
+	if err := tx.QueryRow(
+		`SELECT COUNT(*) FROM game_seats WHERE table_id = ? AND matrix_user IS NOT NULL`, id,
+	).Scan(&humans); err != nil {
+		return fmt.Errorf("games: count humans: %w", err)
+	}
+	if humans > 0 {
+		return nil // somebody is still playing; the table stays
+	}
+	for _, q := range []string{
+		`DELETE FROM game_seats WHERE table_id = ?`,
+		`DELETE FROM game_chat WHERE table_id = ?`,
+		`DELETE FROM game_tables WHERE id = ?`,
+	} {
+		if _, err := tx.Exec(q, id); err != nil {
+			return fmt.Errorf("games: close table: %w", err)
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("games: commit close table: %w", err)
+	}
+	return nil
+}
+
+// AbandonedTables lists tables everyone walked away from: every human seat is
+// away, and the most recent one acted for themselves longer ago than the cutoff.
+//
+// It is the seated-player half of the reaper. The session reaper cashes out loose
+// chips on a game_chips stack; it cannot see a player whose chips are inside a
+// table blob, and those are exactly the chips a walked-away poker player has. So
+// this finds the tables where nobody is coming back and hands them to ReapTable.
+//
+// A table with a live hand is never abandoned in this sense — the turn clock is
+// still folding it forward — so only tables parked between hands qualify. Like
+// DueTables it closes its rows before returning, because the caller is about to
+// take a lock and open a transaction against the one connection.
+func AbandonedTables(cutoff int64) ([]TableRef, error) {
+	rows, err := Get().Query(
+		`SELECT t.id, t.version FROM game_tables t
+		  WHERE t.phase = 'handover'
+		    AND EXISTS (SELECT 1 FROM game_seats s
+		                 WHERE s.table_id = t.id AND s.matrix_user IS NOT NULL)
+		    AND NOT EXISTS (SELECT 1 FROM game_seats s
+		                     WHERE s.table_id = t.id AND s.matrix_user IS NOT NULL
+		                       AND (s.away = 0 OR s.last_seen >= ?))`,
+		cutoff,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("games: abandoned tables: %w", err)
+	}
+	defer rows.Close()
+
+	var out []TableRef
+	for rows.Next() {
+		var r TableRef
+		if err := rows.Scan(&r.ID, &r.Version); err != nil {
+			return nil, fmt.Errorf("games: scan abandoned table: %w", err)
+		}
+		out = append(out, r)
+	}
+	return out, rows.Err()
+}
+
+// Reap is one abandoned table being cashed out and closed. Stacks is what each
+// human seat has in front of it, read from the engine blob by the caller — the
+// only game-specific fact the reaper needs, since the chips-home number lives
+// inside a state only the engine can decode.
+type Reap struct {
+	TableID string
+	Version int64
+	// Humans is the seats to cash out, each paired with the stack going home. A
+	// seat's Amount may be zero (they busted and never got up), which still has to
+	// close their occupancy row so they can play again.
+	Humans []ReapSeat
+}
+
+// ReapSeat is one human being sent home from an abandoned table.
+type ReapSeat struct {
+	Seat       int
+	MatrixUser string
+	Amount     int64
+}
+
+// ReapTable cashes out every human at an abandoned table and deletes it, in one
+// transaction, conditional on the version so it cannot race a player who came
+// back to the felt in the same instant.
+//
+// It is LeaveTable and CloseTable fused: award each stack, release each occupancy
+// claim, then drop the seats, chat and table. The version guard is what makes it
+// safe against a returning player — if their sit or move bumped the version
+// between the scan and here, every row matches zero and the whole thing rolls
+// back, leaving the table exactly as the returning player left it.
+func ReapTable(r Reap) error {
+	now := nowUnix()
+
+	tx, err := Get().Begin()
+	if err != nil {
+		return fmt.Errorf("games: begin reap: %w", err)
+	}
+	defer tx.Rollback() //nolint:errcheck // no-op once committed
+
+	// Bump the version first, and refuse if it moved. Nothing below is conditional,
+	// so this one check has to stand for the whole reap.
+	res, err := tx.Exec(
+		`UPDATE game_tables SET version = version + 1, updated_at = ? WHERE id = ? AND version = ?`,
+		now, r.TableID, r.Version,
+	)
+	if err != nil {
+		return fmt.Errorf("games: reap bump version: %w", err)
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrStaleTable
+	}
+
+	for _, h := range r.Humans {
+		if h.Amount > 0 {
+			if err := award(tx, h.MatrixUser, h.Amount, now); err != nil {
+				return err
+			}
+		}
+		if _, err := tx.Exec(
+			`DELETE FROM game_live_hands WHERE matrix_user = ? AND table_id = ?`,
+			h.MatrixUser, r.TableID,
+		); err != nil {
+			return fmt.Errorf("games: reap release claim: %w", err)
+		}
+	}
+	for _, q := range []string{
+		`DELETE FROM game_seats WHERE table_id = ?`,
+		`DELETE FROM game_chat WHERE table_id = ?`,
+		`DELETE FROM game_tables WHERE id = ?`,
+	} {
+		if _, err := tx.Exec(q, r.TableID); err != nil {
+			return fmt.Errorf("games: reap close: %w", err)
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("games: commit reap: %w", err)
+	}
+	return nil
+}
+
+// ---- the turn clock --------------------------------------------------------
+
+// TableRef is a table the clock has found expired: which one, and at what version
+// it was seen.
+//
+// The version is the point. The clock acts only if it is *still* that version by
+// the time it takes the lock, because otherwise: Bob's raise lands in the same
+// second his clock expires, the action passes to Cara, and the clock — still
+// holding its scan-time belief that the seat to act has run out of time — folds
+// Cara, who had twenty-five seconds left. That is a one-second window that recurs
+// on every single turn of every hand.
+type TableRef struct {
+	ID      string
+	Version int64
+}
+
+// DueTables lists the tables whose clock has run out.
+//
+// It closes the rows before returning, and it must: the caller is about to take a
+// table lock and open a transaction, and holding a *sql.Rows across that means
+// holding the only connection in the pool while waiting for it. That is not a
+// slow query, it is a deadlock.
+func DueTables(now int64) ([]TableRef, error) {
+	rows, err := Get().Query(
+		`SELECT id, version FROM game_tables WHERE deadline > 0 AND deadline <= ?`, now)
+	if err != nil {
+		return nil, fmt.Errorf("games: due tables: %w", err)
+	}
+	defer rows.Close()
+
+	var out []TableRef
+	for rows.Next() {
+		var r TableRef
+		if err := rows.Scan(&r.ID, &r.Version); err != nil {
+			return nil, fmt.Errorf("games: scan due table: %w", err)
+		}
+		out = append(out, r)
+	}
+	return out, rows.Err()
+}
+
+// PushDeadlines shoves every live clock out by a grace period. Called once on
+// boot: a deploy takes a table's clock with it, and without this the first tick
+// after a restart wakes up to find every deadline in the casino already expired
+// and auto-folds all of them at once.
+func PushDeadlines(grace int64) error {
+	if _, err := Get().Exec(
+		`UPDATE game_tables SET deadline = ? WHERE deadline > 0 AND deadline < ?`,
+		nowUnix()+grace, nowUnix()+grace,
+	); err != nil {
+		return fmt.Errorf("games: push deadlines: %w", err)
+	}
+	return nil
+}
+
+// ---- chat ------------------------------------------------------------------
+
+// ChatLine is one thing somebody said at the felt.
+type ChatLine struct {
+	ID     int64  `json:"id"`
+	HandNo int64  `json:"hand_no"`
+	Name   string `json:"name"`
+	Body   string `json:"body"`
+	SaidAt int64  `json:"said_at"`
+	// Mine is filled in by the web layer, per reader. It is not in the database.
+	Mine bool `json:"mine,omitempty"`
+}
+
+// MaxChatLen is where a message stops. Long enough for a table read, short enough
+// that nobody pastes a novel onto the felt.
+const MaxChatLen = 240
+
+// Say records a line of chat and returns it. Its hand_no is stamped from the
+// table, which is what makes the log answer the only question chat at a money
+// table ever really raises: what was said, during which hand.
+func Say(tableID, user, name, body string) (ChatLine, error) {
+	body = strings.TrimSpace(body)
+	if body == "" {
+		return ChatLine{}, ErrBadAmount
+	}
+	if len(body) > MaxChatLen {
+		body = body[:MaxChatLen]
+	}
+	var handNo int64
+	if err := Get().QueryRow(`SELECT hand_no FROM game_tables WHERE id = ?`, tableID).Scan(&handNo); errors.Is(err, sql.ErrNoRows) {
+		return ChatLine{}, ErrNoSuchTable
+	} else if err != nil {
+		return ChatLine{}, fmt.Errorf("games: chat hand no: %w", err)
+	}
+
+	now := nowUnix()
+	res, err := Get().Exec(
+		`INSERT INTO game_chat (table_id, hand_no, matrix_user, name, body, said_at)
+		 VALUES (?, ?, ?, ?, ?, ?)`,
+		tableID, handNo, user, name, body, now,
+	)
+	if err != nil {
+		return ChatLine{}, fmt.Errorf("games: say: %w", err)
+	}
+	id, _ := res.LastInsertId()
+	return ChatLine{ID: id, HandNo: handNo, Name: name, Body: body, SaidAt: now}, nil
+}
+
+// Chat reads the last few lines said at a table, oldest first.
+func Chat(tableID string, limit int) ([]ChatLine, error) {
+	if limit <= 0 || limit > 200 {
+		limit = 50
+	}
+	rows, err := Get().Query(
+		`SELECT id, hand_no, name, body, said_at FROM game_chat
+		  WHERE table_id = ? ORDER BY id DESC LIMIT ?`, tableID, limit)
+	if err != nil {
+		return nil, fmt.Errorf("games: chat: %w", err)
+	}
+	defer rows.Close()
+
+	var out []ChatLine
+	for rows.Next() {
+		var c ChatLine
+		if err := rows.Scan(&c.ID, &c.HandNo, &c.Name, &c.Body, &c.SaidAt); err != nil {
+			return nil, fmt.Errorf("games: scan chat: %w", err)
+		}
+		out = append(out, c)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	// Read newest-first so the LIMIT takes the right end; hand them back in the
+	// order they were said.
+	for i, j := 0, len(out)-1; i < j; i, j = i+1, j-1 {
+		out[i], out[j] = out[j], out[i]
+	}
+	return out, nil
+}

internal/storage/tables_test.go

@@ -0,0 +1,271 @@
+package storage
+
+import (
+	"errors"
+	"testing"
+)
+
+// openTestTable stands up a table with a full ring of bots and returns it. Six
+// seats, because that is hold'em's ring and the most seats any game here has.
+func openTestTable(t *testing.T, id, game string) Table {
+	t.Helper()
+	tbl := Table{
+		ID: id, Game: game, Tier: "1-2", State: []byte(`{}`),
+		Seed1: 1, Seed2: 2, Phase: "betting", HandNo: 1,
+	}
+	seats := make([]Seat, 6)
+	for i := range seats {
+		seats[i] = Seat{Seat: i, Name: "bot"}
+	}
+	if err := OpenTable(tbl, seats); err != nil {
+		t.Fatal(err)
+	}
+	return tbl
+}
+
+// reload reads a table back and fails the test if it is gone.
+func reload(t *testing.T, id string) (Table, []Seat) {
+	t.Helper()
+	tbl, seats, err := LoadTable(id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return tbl, seats
+}
+
+func TestOpenTable_SeatsAreAllBots(t *testing.T) {
+	setupTestDB(t)
+	openTestTable(t, "t1", "holdem")
+
+	_, seats := reload(t, "t1")
+	if len(seats) != 6 {
+		t.Fatalf("want 6 seats, got %d", len(seats))
+	}
+	for _, s := range seats {
+		if !s.Bot() {
+			t.Errorf("seat %d should be a bot", s.Seat)
+		}
+	}
+}
+
+func TestSitDown_MovesChipsOntoTheTable(t *testing.T) {
+	setupTestDB(t)
+	tbl := openTestTable(t, "t1", "holdem")
+	fund(t, player, 5000)
+
+	if err := SitDown(Sit{
+		Table: tbl,
+		Seat:  Seat{Seat: 2, MatrixUser: player, Name: "reala"},
+		BuyIn: 1000,
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// The chips are off the stack...
+	if got := chipsOf(t, player); got != 4000 {
+		t.Errorf("stack: want 4000, got %d", got)
+	}
+	// ...and onto the seat.
+	_, seats := reload(t, "t1")
+	seat := seats[2]
+	if seat.MatrixUser != player || seat.Staked != 1000 {
+		t.Errorf("seat 2: want reala staked 1000, got %q staked %d", seat.MatrixUser, seat.Staked)
+	}
+	// The occupancy claim points at the table.
+	id, err := TableOf(player)
+	if err != nil || id != "t1" {
+		t.Errorf("TableOf: want t1, got %q err %v", id, err)
+	}
+}
+
+func TestSitDown_CannotTakeATakenSeat(t *testing.T) {
+	setupTestDB(t)
+	tbl := openTestTable(t, "t1", "holdem")
+	fund(t, player, 5000)
+	fund(t, "@bob:parodia.dev", 5000)
+
+	if err := SitDown(Sit{Table: tbl, Seat: Seat{Seat: 2, MatrixUser: player, Name: "reala"}, BuyIn: 1000}); err != nil {
+		t.Fatal(err)
+	}
+	tbl2, _ := reload(t, "t1")
+	err := SitDown(Sit{Table: tbl2, Seat: Seat{Seat: 2, MatrixUser: "@bob:parodia.dev", Name: "bob"}, BuyIn: 1000})
+	if !errors.Is(err, ErrSeatTaken) {
+		t.Fatalf("want ErrSeatTaken, got %v", err)
+	}
+	// Bob's chips did not move.
+	if got := chipsOf(t, "@bob:parodia.dev"); got != 5000 {
+		t.Errorf("bob's stack should be untouched, got %d", got)
+	}
+}
+
+func TestSitDown_CannotSitAtTwoTables(t *testing.T) {
+	setupTestDB(t)
+	tbl1 := openTestTable(t, "t1", "holdem")
+	tbl2 := openTestTable(t, "t2", "holdem")
+	fund(t, player, 5000)
+
+	if err := SitDown(Sit{Table: tbl1, Seat: Seat{Seat: 0, MatrixUser: player, Name: "reala"}, BuyIn: 1000}); err != nil {
+		t.Fatal(err)
+	}
+	err := SitDown(Sit{Table: tbl2, Seat: Seat{Seat: 0, MatrixUser: player, Name: "reala"}, BuyIn: 1000})
+	if !errors.Is(err, ErrHandInProgress) {
+		t.Fatalf("want ErrHandInProgress, got %v", err)
+	}
+	// The buy-in for the second table rolled back.
+	if got := chipsOf(t, player); got != 4000 {
+		t.Errorf("only the first buy-in should have left the stack, got %d", got)
+	}
+}
+
+func TestSitDown_InsufficientChipsRollsBack(t *testing.T) {
+	setupTestDB(t)
+	tbl := openTestTable(t, "t1", "holdem")
+	fund(t, player, 500)
+
+	err := SitDown(Sit{Table: tbl, Seat: Seat{Seat: 0, MatrixUser: player, Name: "reala"}, BuyIn: 1000})
+	if !errors.Is(err, ErrInsufficientChips) {
+		t.Fatalf("want ErrInsufficientChips, got %v", err)
+	}
+	if _, err := TableOf(player); !errors.Is(err, ErrNoLiveHand) {
+		t.Errorf("no seat should have been claimed, got %v", err)
+	}
+	_, seats := reload(t, "t1")
+	if seats[0].MatrixUser != "" {
+		t.Errorf("seat should still be a bot")
+	}
+}
+
+func TestLeaveTable_BringsChipsHome(t *testing.T) {
+	setupTestDB(t)
+	tbl := openTestTable(t, "t1", "holdem")
+	fund(t, player, 5000)
+	if err := SitDown(Sit{Table: tbl, Seat: Seat{Seat: 0, MatrixUser: player, Name: "reala"}, BuyIn: 1000}); err != nil {
+		t.Fatal(err)
+	}
+
+	tbl2, _ := reload(t, "t1")
+	// Got up with 1,240 — up on the session.
+	if err := LeaveTable(Leave{Table: tbl2, Seat: 0, MatrixUser: player, Bot: "bot", Amount: 1240}); err != nil {
+		t.Fatal(err)
+	}
+	if got := chipsOf(t, player); got != 5240 {
+		t.Errorf("want 5240 back on the stack, got %d", got)
+	}
+	if _, err := TableOf(player); !errors.Is(err, ErrNoLiveHand) {
+		t.Errorf("seat claim should be gone, got %v", err)
+	}
+	_, seats := reload(t, "t1")
+	if seats[0].MatrixUser != "" {
+		t.Errorf("a bot should have taken the empty chair")
+	}
+}
+
+func TestSaveTable_VersionGuardsTheWrite(t *testing.T) {
+	setupTestDB(t)
+	openTestTable(t, "t1", "holdem")
+
+	a, _ := reload(t, "t1") // both read version 0
+	b, _ := reload(t, "t1")
+
+	a.State = []byte(`{"a":1}`)
+	if err := CommitTable(TableCommit{Table: a}); err != nil {
+		t.Fatalf("first write should win: %v", err)
+	}
+	b.State = []byte(`{"b":2}`)
+	if err := CommitTable(TableCommit{Table: b}); !errors.Is(err, ErrStaleTable) {
+		t.Fatalf("second write should be stale, got %v", err)
+	}
+
+	after, _ := reload(t, "t1")
+	if string(after.State) != `{"a":1}` {
+		t.Errorf("the winning write should stand, got %s", after.State)
+	}
+	if after.Version != 1 {
+		t.Errorf("version should have bumped once, got %d", after.Version)
+	}
+}
+
+func TestDueTables_OnlyExpiredClocks(t *testing.T) {
+	setupTestDB(t)
+	now := nowUnix()
+
+	past := openTestTable(t, "past", "holdem")
+	past.Deadline = now - 5
+	if err := CommitTable(TableCommit{Table: past}); err != nil {
+		t.Fatal(err)
+	}
+	future := openTestTable(t, "future", "holdem")
+	future.Deadline = now + 60
+	if err := CommitTable(TableCommit{Table: future}); err != nil {
+		t.Fatal(err)
+	}
+	openTestTable(t, "noclock", "holdem") // deadline 0
+
+	due, err := DueTables(now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(due) != 1 || due[0].ID != "past" {
+		t.Fatalf("only the past-due table should show, got %+v", due)
+	}
+}
+
+func TestChat_KeepsTheHandItWasSaidDuring(t *testing.T) {
+	setupTestDB(t)
+	openTestTable(t, "t1", "holdem") // hand_no 1
+
+	if _, err := Say("t1", player, "reala", "nice hand"); err != nil {
+		t.Fatal(err)
+	}
+	// The table moves to the next hand.
+	tbl2, _ := reload(t, "t1")
+	tbl2.HandNo = 2
+	if err := CommitTable(TableCommit{Table: tbl2}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Say("t1", player, "reala", "and another"); err != nil {
+		t.Fatal(err)
+	}
+
+	lines, err := Chat("t1", 50)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(lines) != 2 {
+		t.Fatalf("want 2 lines, got %d", len(lines))
+	}
+	if lines[0].Body != "nice hand" || lines[0].HandNo != 1 {
+		t.Errorf("first line should be hand 1: %+v", lines[0])
+	}
+	if lines[1].HandNo != 2 {
+		t.Errorf("second line should be hand 2: %+v", lines[1])
+	}
+}
+
+func TestCloseTable_KeepsATableWithAHumanAtIt(t *testing.T) {
+	setupTestDB(t)
+	tbl := openTestTable(t, "t1", "holdem")
+	fund(t, player, 5000)
+	if err := SitDown(Sit{Table: tbl, Seat: Seat{Seat: 0, MatrixUser: player, Name: "reala"}, BuyIn: 1000}); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := CloseTable("t1"); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := LoadTable("t1"); err != nil {
+		t.Errorf("a table with a human should survive close, got %v", err)
+	}
+
+	// Everyone leaves; now it goes.
+	tbl2, _ := reload(t, "t1")
+	if err := LeaveTable(Leave{Table: tbl2, Seat: 0, MatrixUser: player, Bot: "bot", Amount: 1000}); err != nil {
+		t.Fatal(err)
+	}
+	if err := CloseTable("t1"); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := LoadTable("t1"); !errors.Is(err, ErrNoSuchTable) {
+		t.Errorf("an all-bot table should close, got %v", err)
+	}
+}

internal/web/devcasino_test.go

@@ -35,13 +35,18 @@ func TestDevCasino(t *testing.T) {
 
 	s := newCasino(t)
 	fund(t, 5000)
+	fundUser(t, bobPlayer, 5000)
 	seedTriviaBank(t)
 
-	payload, _ := json.Marshal(SessionUser{
-		Sub: "sub-1", Username: "reala", Name: "Reala",
-		Exp: time.Now().Add(24 * time.Hour).Unix(),
-	})
-	cookie := s.auth.sign(payload)
+	// The full table runtime, so the turn clock and the reaper are live under the
+	// browser exactly as in production.
+	s.StartTableClock(context.Background())
+
+	cookie := devCookie(s, "reala", "Reala")
+	// A second player, so a shared table can be reviewed — hold'em is multiplayer
+	// now, and one browser cannot see two people at the felt. Plant this cookie in
+	// a second browser profile (or a private window) to sit down as Bob.
+	bobCookie := devCookie(s, "bob", "Bob")
 
 	staticSub, err := fs.Sub(staticFS, "static")
 	if err != nil {
@@ -57,19 +62,31 @@ func TestDevCasino(t *testing.T) {
 		t.Fatal(err)
 	}
 	// Written to a file, not printed: `go test` buffers stdout, and the browser
-	// driver needs the cookie while the server is still running.
+	// driver needs the cookie while the server is still running. The second cookie
+	// rides alongside it, newline-separated, for the second browser.
 	if out := os.Getenv("PETE_DEV_COOKIE_FILE"); out != "" {
-		if err := os.WriteFile(out, []byte(cookie), 0o600); err != nil {
+		if err := os.WriteFile(out, []byte(cookie+"\n"+bobCookie), 0o600); err != nil {
 			t.Fatal(err)
 		}
 	}
-	fmt.Printf("\nCASINO  http://localhost%s/games\nCOOKIE  %s=%s\n\n", addr, sessionCookie, cookie)
+	fmt.Printf("\nCASINO  http://localhost%s/games\nCOOKIE  %s=%s\nBOB     %s=%s\n\n",
+		addr, sessionCookie, cookie, sessionCookie, bobCookie)
 
 	srv := &http.Server{Handler: mux, ReadHeaderTimeout: 5 * time.Second}
 	t.Cleanup(func() { _ = srv.Close() })
 	_ = srv.Serve(ln)
 }
 
+// devCookie mints a signed session for a player the rig has funded, so the felt
+// can be driven as them.
+func devCookie(s *Server, username, name string) string {
+	payload, _ := json.Marshal(SessionUser{
+		Sub: "sub-" + username, Username: username, Name: name,
+		Exp: time.Now().Add(24 * time.Hour).Unix(),
+	})
+	return s.auth.sign(payload)
+}
+
 // seedTriviaBank puts enough questions in the bank to deal a ladder of each
 // difficulty.
 //

internal/web/games_clock.go

@@ -0,0 +1,214 @@
+package web
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"time"
+
+	"pete/internal/storage"
+)
+
+// The turn clock: the first goroutine in Pete that has ever mutated game state.
+//
+// Every other background loop here reads, refills or prunes. This one plays. When
+// a human sits at a felt and walks away mid-hand, three other people are waiting
+// on a decision that is never coming, and something has to make it for them. That
+// something is this.
+//
+// It is built on one discipline and one guard.
+//
+// The discipline is rule 1: **collect the due tables and close the rows before
+// taking any lock.** The scan reads *sql.Rows from the one-connection pool; a lock
+// taken while those rows are open would hold the connection the rows need, and the
+// process would wedge. So DueTables returns a plain slice and the connection is
+// free before the first table is touched.
+//
+// The guard is the version. The scan records each table's version; the clock acts
+// on a table only if it is *still* that version by the time it holds the lock and
+// has reloaded. Without that check the clock and a real move race and both land:
+// Bob raises in the same second his clock expires, the action moves to Cara, and
+// the clock — still believing the seat that ran out of time is to act — folds
+// Cara, who had twenty-five seconds left. The version check turns that into a
+// no-op: Bob's move bumped the version, the reload shows the new one, and the
+// clock steps aside.
+
+// clockInterval is how often the clock looks for expired turns. Sub-second
+// precision buys nothing at a card table and would only spin the CPU.
+const clockInterval = time.Second
+
+// reaperInterval is how often idle sessions are cashed out. The reaper is a
+// slow-moving safety net — a player who wandered off half an hour ago is not in a
+// hurry — so it runs far less often than the clock.
+const reaperInterval = time.Minute
+
+// games returns the multiplayer engines by their storage key. It is the registry
+// the clock and the handlers both dispatch through. Empty until an engine is
+// wired; a clock over no games is a loop that finds nothing, which is correct.
+func (s *Server) games() map[string]tableGame {
+	out := make(map[string]tableGame)
+	for _, g := range s.tableGames {
+		out[g.name()] = g
+	}
+	return out
+}
+
+// StartTableClock launches the turn clock and the session reaper if the casino is
+// on. Safe to call unconditionally.
+func (s *Server) StartTableClock(ctx context.Context) {
+	if !s.gamesReady() {
+		return
+	}
+	// A deploy just took every table's clock down with it. Shove the live deadlines
+	// out so the first tick does not auto-act the whole room at once.
+	if err := storage.PushDeadlines(bootGrace); err != nil {
+		slog.Error("games: push deadlines on boot", "err", err)
+	}
+	go s.runTableClock(ctx)
+	go s.runSessionReaper(ctx)
+	go s.runTableReaper(ctx)
+}
+
+func (s *Server) runTableClock(ctx context.Context) {
+	slog.Info("games: turn clock started", "interval", clockInterval)
+	ticker := time.NewTicker(clockInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			s.tickClock()
+		}
+	}
+}
+
+// tickClock finds the tables whose turn has expired and acts on each. The scan is
+// done and the connection released before any table is locked — rule 1.
+func (s *Server) tickClock() {
+	due, err := storage.DueTables(time.Now().Unix())
+	if err != nil {
+		slog.Error("games: due tables", "err", err)
+		return
+	}
+	for _, ref := range due {
+		s.runClockTable(ref)
+	}
+}
+
+// runClockTable acts for the walked-away player at one table, but only if the
+// table is still at the version the scan saw.
+//
+// The whole read-modify-write is done under the table's stripe, which is what
+// keeps the clock from racing a second copy of itself — but the stripe is only an
+// optimisation. The version check inside CommitTable is the real thing: even
+// across a redeploy, when two processes hold two different stripes over this row,
+// the one whose write lands first bumps the version and the other's write finds
+// zero rows and rolls back.
+func (s *Server) runClockTable(ref storage.TableRef) {
+	err := s.tableLocks.withTable(ref.ID, func() error {
+		t, seats, err := storage.LoadTable(ref.ID)
+		if errors.Is(err, storage.ErrNoSuchTable) {
+			return nil // closed out from under us; nothing to do
+		}
+		if err != nil {
+			return err
+		}
+		// Somebody moved between the scan and now. Their move set a fresh deadline (or
+		// cleared it), so this expiry is stale — step aside.
+		if t.Version != ref.Version {
+			return nil
+		}
+		// A deadline in the future means the scan is looking at an old view; leave it.
+		if t.Deadline == 0 || t.Deadline > time.Now().Unix() {
+			return nil
+		}
+
+		game := s.games()[t.Game]
+		if game == nil {
+			slog.Error("games: clock over unknown game", "game", t.Game, "table", t.ID)
+			return nil
+		}
+
+		st, newSeats, err := game.timeout(t.State, seats)
+		if errors.Is(err, errNotDue) {
+			return nil // the race resolved without us; nothing to act on
+		}
+		if err != nil {
+			slog.Error("games: clock timeout", "table", t.ID, "err", err)
+			return nil
+		}
+
+		t.State, t.Phase, t.HandNo, t.Deadline = st.State, st.Phase, st.HandNo, st.Deadline
+		if err := storage.CommitTable(storage.TableCommit{Table: t, Seats: newSeats, Audit: st.Audit}); err != nil {
+			if errors.Is(err, storage.ErrStaleTable) {
+				return nil // lost the race after all; the winner handled it
+			}
+			return err
+		}
+		s.publishTable(ref.ID)
+		return nil
+	})
+	if err != nil {
+		slog.Error("games: clock table", "table", ref.ID, "err", err)
+	}
+}
+
+// publishTable pushes the current table view to everyone watching it. It reads
+// the table fresh (the authoritative state) and fans an opaque frame out through
+// the hub. Called after every committed write, under no lock the hub cares about
+// — the hub's sends are non-blocking, so this never stalls a caller.
+//
+// A view here is deliberately seat-blind: it carries only what every seat may see
+// (the version and the public table shape), and each subscriber's own stream
+// redacts and re-renders for the seat that is watching. That keeps a hole card
+// from ever entering a frame that fans to the whole table.
+func (s *Server) publishTable(tableID string) {
+	if s.hub.watchers(tableID) == 0 {
+		return
+	}
+	t, _, err := storage.LoadTable(tableID)
+	if errors.Is(err, storage.ErrNoSuchTable) {
+		return
+	}
+	if err != nil {
+		slog.Error("games: publish table load", "table", tableID, "err", err)
+		return
+	}
+	// The frame is just a nudge carrying the version: a subscriber that sees a gap
+	// refetches the authoritative, per-seat table. So the payload can be minimal.
+	// The type tells the browser a table changed (come and look) from a chat line
+	// (render it in place) — both ride the one stream.
+	data, _ := json.Marshal(map[string]any{"type": "table", "version": t.Version, "phase": t.Phase})
+	s.hub.publish(tableID, hubFrame{Version: t.Version, Data: data})
+}
+
+// runSessionReaper cashes out players who wandered off, on a timer. This is the
+// loop the plan noted never existed: ReapIdleSessions has always been safe to run
+// and nothing ever ran it, so chips in abandoned *solo* sessions sat in limbo.
+//
+// A seated player is invisible to it — their chips are inside a table blob, not on
+// their game_chips stack — so it only ever reaps a player who is genuinely idle
+// with loose chips. Getting up from a table returns them to the stack, and then
+// this is what eventually sends them home.
+func (s *Server) runSessionReaper(ctx context.Context) {
+	slog.Info("games: session reaper started", "interval", reaperInterval, "idle", storage.SessionIdleAfter)
+	ticker := time.NewTicker(reaperInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			n, err := storage.ReapIdleSessions(storage.SessionIdleAfter)
+			if err != nil {
+				slog.Error("games: reap idle sessions", "err", err)
+				continue
+			}
+			if n > 0 {
+				slog.Info("games: reaped idle sessions", "count", n)
+			}
+		}
+	}
+}

internal/web/games_clock_test.go

@@ -0,0 +1,142 @@
+package web
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"pete/internal/storage"
+)
+
+// fakeGame is a tableGame that records whether its clock ever fired. It lets the
+// runtime tests exercise the lock discipline and the version guard without a real
+// engine — the thing under test is the clock, not the cards.
+type fakeGame struct {
+	fired int
+}
+
+func (g *fakeGame) name() string { return "fake" }
+
+func (g *fakeGame) timeout(state []byte, seats []storage.Seat) (step, []storage.Seat, error) {
+	g.fired++
+	// Act: clear the deadline and bump the hand, as a real settle would.
+	return step{State: []byte(`{"acted":true}`), Phase: "handover", HandNo: 2, Deadline: 0}, seats, nil
+}
+
+func (g *fakeGame) stacks(state []byte) ([]int64, error) { return []int64{0, 0}, nil }
+
+// clockTestServer stands up a Server with just the table machinery wired and a
+// fresh DB. Enough to drive the clock, nothing else.
+func clockTestServer(t *testing.T, g tableGame) *Server {
+	t.Helper()
+	// Reset the storage singleton onto a temp DB.
+	if err := storage.Init(filepath.Join(t.TempDir(), "clock.db")); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { storage.Close() })
+
+	s := &Server{hub: newGamesHub(), tableLocks: newStripedLocks(), tableGames: []tableGame{g}}
+	return s
+}
+
+func openClockTable(t *testing.T, id string, deadline int64) storage.Table {
+	t.Helper()
+	tbl := storage.Table{
+		ID: id, Game: "fake", Tier: "1-2", State: []byte(`{}`),
+		Seed1: 1, Seed2: 2, Phase: "betting", HandNo: 1, Deadline: deadline,
+	}
+	seats := []storage.Seat{{Seat: 0, MatrixUser: "@reala:parodia.dev", Name: "reala"}, {Seat: 1, Name: "bot"}}
+	if err := storage.OpenTable(tbl, seats); err != nil {
+		t.Fatal(err)
+	}
+	return tbl
+}
+
+func TestClock_ActsOnExpiredTable(t *testing.T) {
+	g := &fakeGame{}
+	s := clockTestServer(t, g)
+	openClockTable(t, "t1", time.Now().Unix()-5) // already expired
+
+	s.tickClock()
+
+	if g.fired != 1 {
+		t.Fatalf("clock should have fired once, got %d", g.fired)
+	}
+	after, _, err := storage.LoadTable("t1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if after.Phase != "handover" || after.Deadline != 0 {
+		t.Errorf("table should have advanced: %+v", after)
+	}
+}
+
+func TestClock_IgnoresFutureDeadlines(t *testing.T) {
+	g := &fakeGame{}
+	s := clockTestServer(t, g)
+	openClockTable(t, "t1", time.Now().Unix()+60)
+
+	s.tickClock()
+
+	if g.fired != 0 {
+		t.Fatalf("clock should not have fired on a future deadline, got %d", g.fired)
+	}
+}
+
+// TestClock_VersionGuardStopsTheDoubleMove is the scenario the whole design turns
+// on. A move lands in the same tick the clock's scan found the table expired. The
+// move bumps the version; the clock, acting on its stale scan, must see the new
+// version and step aside rather than acting a second time.
+func TestClock_VersionGuardStopsTheDoubleMove(t *testing.T) {
+	g := &fakeGame{}
+	s := clockTestServer(t, g)
+	tbl := openClockTable(t, "t1", time.Now().Unix()-5)
+
+	// The scan saw version 0.
+	due, err := storage.DueTables(time.Now().Unix())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(due) != 1 {
+		t.Fatalf("want 1 due table, got %d", len(due))
+	}
+
+	// A real move lands first, bumping the version and setting a fresh deadline for
+	// the next player.
+	tbl.State = []byte(`{"moved":true}`)
+	tbl.Deadline = time.Now().Unix() + 30
+	if err := storage.CommitTable(storage.TableCommit{Table: tbl}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Now the clock acts on its stale scan (version 0). It must not fire.
+	s.runClockTable(due[0])
+
+	if g.fired != 0 {
+		t.Fatalf("the version guard should have stopped the clock, but it fired %d time(s)", g.fired)
+	}
+	after, _, _ := storage.LoadTable("t1")
+	if string(after.State) != `{"moved":true}` {
+		t.Errorf("the real move should stand, got %s", after.State)
+	}
+}
+
+func TestClock_PublishesToWatchers(t *testing.T) {
+	g := &fakeGame{}
+	s := clockTestServer(t, g)
+	openClockTable(t, "t1", time.Now().Unix()-5)
+
+	ch, done := s.hub.subscribe("t1")
+	defer done()
+
+	s.tickClock()
+
+	select {
+	case f := <-ch:
+		if f.Version == 0 {
+			t.Errorf("frame should carry the bumped version, got %d", f.Version)
+		}
+	default:
+		t.Fatal("a watcher should have received a frame after the clock acted")
+	}
+}

internal/web/games_holdem.go

@@ -5,6 +5,8 @@ import (
 	"errors"
 	"log/slog"
 	"net/http"
+	"strings"
+	"time"
 
 	"pete/internal/games/blackjack"
 	"pete/internal/games/holdem"
@@ -54,6 +56,11 @@ var seatStates = map[holdem.SeatState]string{
 // holdemView is the table as its player may see it.
 type holdemView struct {
 	Tier holdem.Tier `json:"tier"`
+	// YourSeat is which chair in Seats is the viewer's. It used to be a convention
+	// (seat zero is you) that the felt hardcoded; at a shared table it is whatever
+	// chair you took, so it rides in the view and the browser reads it rather than
+	// assuming it.
+	YourSeat int              `json:"your_seat"`
 	Seats    []holdemSeatView `json:"seats"`
 	Button   int              `json:"button"`
 	HandNo   int              `json:"hand_no"`
@@ -81,18 +88,29 @@ type holdemView struct {
 	Payout   int64 `json:"payout,omitempty"`
 }
 
-func viewHoldem(g holdem.State) holdemView {
+// viewHoldem renders the table as one seat may see it. viewer is which seat is
+// looking — their cards are the only hole cards it will ever put in the payload
+// (until a showdown turns the rest over), and the action panel is filled in only
+// when it is that seat's turn.
+//
+// This is the security boundary. Before SSE a missed check here leaked one bot's
+// cards to one player through a bug in one handler; now the same view fans to
+// every subscriber's stream, so a seat that renders anyone else's hole card fans
+// it to the whole table. TestHoldemViewNeverLeaksAnotherSeatsCards renders every
+// seat's view at every street and greps for cards that are not theirs.
+func viewHoldem(g holdem.State, viewer int) holdemView {
 	v := holdemView{
 		Tier:     g.Tier,
+		YourSeat: viewer,
 		Button:   g.Button,
 		HandNo:   g.HandNo,
 		Street:   g.Street.String(),
 		Pot:      g.Total(),
 		ToAct:    g.ToAct,
 		Phase:    string(g.Phase),
-		Stack:    g.Seats[holdem.You].Stack,
-		BoughtIn: g.BoughtIn,
-		Rake:     g.Paid, // the part you actually paid, not the part the table lifted
+		Stack:    g.Seats[viewer].Stack,
+		BoughtIn: g.BoughtIn, // a table total; the caller overrides it with this seat's own stake
+		Rake:     g.Seats[viewer].Paid, // this seat's rake alone, not the table's — see the ledger line on the felt
 		Payout:   g.Payout,
 	}
 	for _, p := range g.Side {
@@ -106,22 +124,22 @@ func viewHoldem(g holdem.State) holdemView {
 		v.Board = append(v.Board, viewCard(c))
 	}
 
-	// The wall. A bot's hand crosses the wire in exactly one situation — the hand
-	// was shown down and they did not fold — because that is the only situation in
-	// which a player at a real table would be looking at it.
+	// The wall. Another seat's hand crosses the wire in exactly one situation — the
+	// hand was shown down and they did not fold — because that is the only situation
+	// in which a player at a real table would be looking at it.
 	shown := g.Street == holdem.Showdown
 	for i, p := range g.Seats {
 		seat := holdemSeatView{
 			Name:  p.Name,
 			Bot:   p.Bot,
-			You:   i == holdem.You,
+			You:   i == viewer,
 			Stack: p.Stack,
 			Bet:   p.Bet,
 			State: seatStates[p.State],
 			Pos:   g.Position(i),
 			Won:   p.Won,
 		}
-		mine := i == holdem.You
+		mine := i == viewer
 		dealt := p.State != holdem.Out && p.Hole[0].Rank != 0
 		if dealt && (mine || (shown && p.State != holdem.Folded)) {
 			seat.Cards = []cardView{viewCard(p.Hole[0]), viewCard(p.Hole[1])}
@@ -129,14 +147,14 @@ func viewHoldem(g holdem.State) holdemView {
 		v.Seats = append(v.Seats, seat)
 	}
 
-	if g.Phase == holdem.PhaseBetting && g.ToAct == holdem.You {
-		v.Owed = g.Owed(holdem.You)
+	if g.Phase == holdem.PhaseBetting && g.ToAct == viewer {
+		v.Owed = g.Owed(viewer)
 		v.CanCheck = v.Owed == 0
-		v.CanRaise = g.CanRaise(holdem.You)
-		v.MinRaise = g.MinRaiseTo(holdem.You)
-		v.MaxRaise = g.MaxRaiseTo(holdem.You)
+		v.CanRaise = g.CanRaise(viewer)
+		v.MinRaise = g.MinRaiseTo(viewer)
+		v.MaxRaise = g.MaxRaiseTo(viewer)
 	}
-	if top := g.Tier.MaxBuy - g.Seats[holdem.You].Stack; top > 0 {
+	if top := g.Tier.MaxBuy - g.Seats[viewer].Stack; top > 0 {
 		v.MaxTopUp = top
 	}
 	return v
@@ -154,26 +172,71 @@ type holdemEventView struct {
 	Text   string     `json:"text,omitempty"`
 }
 
-func viewHoldemEvents(evs []holdem.Event) []holdemEventView {
+// viewHoldemEvents redacts the engine's script for one viewer. The engine emits
+// every seat's hole cards now (it cannot know who a shared stream is for), so
+// this is where the cards that are not the viewer's are stripped — turning a
+// "deal seat 3 these two cards" beat into "deal seat 3 two face-down cards".
+//
+// A card may ride an event only if it is a board card (Seat < 0), the viewer's
+// own, or a hand being shown down. Everything else is nulled here, and a missed
+// case is the leak that fans one seat's hole card to every subscriber.
+func viewHoldemEvents(evs []holdem.Event, viewer int) []holdemEventView {
 	out := make([]holdemEventView, 0, len(evs))
 	for _, e := range evs {
 		v := holdemEventView{Kind: e.Kind, Seat: e.Seat, Amount: e.Amount, Total: e.Total, Text: e.Text}
 		for _, c := range e.Cards {
 			v.Cards = append(v.Cards, viewCard(c))
 		}
-		// A card may ride an event only if it is the board, your own hand, or a hand
-		// being shown down. Anything else is a bot's business.
-		if len(v.Cards) > 0 && e.Seat >= 0 && e.Seat != holdem.You && e.Kind != "show" {
+		if len(v.Cards) > 0 && e.Seat >= 0 && e.Seat != viewer && e.Kind != "show" {
 			v.Cards = nil
 		}
 		out = append(out, v)
 	}
 	return out
 }
+// ---- sitting down: a table of your own, or somebody else's -----------------
 
-// handleHoldemSit buys chips onto a table. The chips are staked first, in the
-// same statement that checks they exist, so two sit-downs fired at once cannot
-// buy in with the same chip.
+// displayName is what goes on the felt. It is the player's session name if they
+// have one, the local part of their Matrix id otherwise — never empty, which
+// would sit a nameless chair at the table.
+func (s *Server) displayName(r *http.Request, user string) string {
+	if u := s.auth.userFromRequest(r); u != nil {
+		if u.Name != "" {
+			return u.Name
+		}
+		if u.Username != "" {
+			return u.Username
+		}
+	}
+	name := strings.TrimPrefix(user, "@")
+	if i := strings.IndexByte(name, ':'); i > 0 {
+		name = name[:i]
+	}
+	return name
+}
+
+// seatRows mirrors the engine's seats into the storage rows that shadow them,
+// index for index — seat i in the blob is seat i in game_seats — which is the
+// alignment the view redacts by and the audit attributes by. A human's staked is
+// the buy-in that actually crossed the border; a bot's is zero, because the only
+// real money at the table is in the human seats and staked is where the border
+// accounting lives.
+func seatRows(g holdem.State, human string, buyIn int64) []storage.Seat {
+	rows := make([]storage.Seat, len(g.Seats))
+	for i := range g.Seats {
+		p := g.Seats[i]
+		row := storage.Seat{Seat: i, Name: p.Name}
+		if !p.Bot {
+			row.MatrixUser = human
+			row.Staked = buyIn
+		}
+		rows[i] = row
+	}
+	return rows
+}
+
+// handleHoldemSit seats a player: at a fresh table of their own (solo is just a
+// table nobody else has joined yet), or at an open chair on somebody else's.
 func (s *Server) handleHoldemSit(w http.ResponseWriter, r *http.Request) {
 	user, ok := s.player(w, r)
 	if !ok {
@@ -183,50 +246,207 @@ func (s *Server) handleHoldemSit(w http.ResponseWriter, r *http.Request) {
 		Tier  string `json:"tier"`
 		Bots  int    `json:"bots"`
 		BuyIn int64  `json:"buyin"`
+		Table string `json:"table"` // set to join an existing table rather than open one
+		Seat  *int   `json:"seat"`  // which chair to take when joining; optional
 	}
 	if err := decodeJSON(r, &req); err != nil {
 		http.Error(w, "bad json", http.StatusBadRequest)
 		return
 	}
-	tier, err := holdem.TierBySlug(req.Tier)
+	if req.Table != "" {
+		s.joinHoldem(w, r, user, req.Table, req.Seat, req.BuyIn)
+		return
+	}
+	s.openHoldem(w, r, user, req.Tier, req.Bots, req.BuyIn)
+}
+
+// openHoldem opens a fresh table with the player in seat zero and bots in the
+// rest. It is the old solo flow, now a real shared table that simply has no other
+// humans on it yet.
+func (s *Server) openHoldem(w http.ResponseWriter, r *http.Request, user, tierSlug string, bots int, buyIn int64) {
+	tier, err := holdem.TierBySlug(tierSlug)
 	if err != nil {
 		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "pick a table"})
 		return
 	}
-	if req.BuyIn < tier.MinBuy || req.BuyIn > tier.MaxBuy {
-		writeJSONStatus(w, http.StatusBadRequest, map[string]string{
-			"error": "that isn't a legal buy-in for this table",
-		})
+	if buyIn < tier.MinBuy || buyIn > tier.MaxBuy {
+		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "that isn't a legal buy-in for this table"})
 		return
 	}
-	if req.Bots < 1 || req.Bots > holdem.MaxBots {
+	if bots < 1 || bots > holdem.MaxBots {
 		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "pick some opponents"})
 		return
 	}
 
-	if err := storage.Stake(user, req.BuyIn); err != nil {
-		if errors.Is(err, storage.ErrInsufficientChips) || errors.Is(err, storage.ErrBadAmount) {
+	name := s.displayName(r, user)
+	seed1, seed2 := newSeeds()
+	g, _, err := holdem.New(tier, holdem.TableSeats(tier, name, bots, buyIn), blackjack.DefaultRules().RakePct, seed1, seed2)
+	if err != nil {
+		slog.Error("games: holdem open", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	blob, err := json.Marshal(g)
+	if err != nil {
+		slog.Error("games: marshal new holdem", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	id, err := storage.NewTableID()
+	if err != nil {
+		slog.Error("games: mint table id", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+
+	t := storage.Table{
+		ID: id, Game: gameHoldem, Tier: tier.Slug, State: blob,
+		Seed1: seed1, Seed2: seed2, Phase: string(g.Phase), HandNo: int64(g.HandNo),
+	}
+	err = storage.OpenSoloTable(t, seatRows(g, user, buyIn), buyIn)
+	switch {
+	case errors.Is(err, storage.ErrInsufficientChips), errors.Is(err, storage.ErrBadAmount):
 		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "not enough chips to sit down"})
 		return
-		}
-		slog.Error("games: holdem buy-in", "user", user, "err", err)
+	case errors.Is(err, storage.ErrHandInProgress):
+		writeJSONStatus(w, http.StatusConflict, map[string]string{"error": "finish the game you're in first"})
+		return
+	case err != nil:
+		slog.Error("games: open solo table", "user", user, "err", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
+	s.writeHoldemTable(w, user, nil)
+}
 
-	seed1, seed2 := newSeeds()
-	g, evs, err := holdem.New(tier, req.Bots, req.BuyIn, blackjack.DefaultRules().RakePct, seed1, seed2)
+// pickOpenSeat chooses a chair to join: the one the caller asked for if it is a
+// bot's, otherwise the first bot seat. Returns -1 if there is nowhere to sit.
+func pickOpenSeat(g holdem.State, want *int) int {
+	if want != nil {
+		i := *want
+		if i >= 0 && i < len(g.Seats) && g.Seats[i].Bot {
+			return i
+		}
+		return -1
+	}
+	for i := range g.Seats {
+		if g.Seats[i].Bot {
+			return i
+		}
+	}
+	return -1
+}
+
+// joinHoldem sits a player down at an open chair on an existing table. It runs
+// under the table lock, and every step of the sit-down is one transaction in
+// SitDown — stake, claim, take the chair out of a bot's hands, save the state —
+// so two people racing for the last seat cannot both win it.
+func (s *Server) joinHoldem(w http.ResponseWriter, r *http.Request, user, tableID string, wantSeat *int, buyIn int64) {
+	name := s.displayName(r, user)
+	var respErr error
+	err := s.tableLocks.withTable(tableID, func() error {
+		t, _, err := storage.LoadTable(tableID)
+		if errors.Is(err, storage.ErrNoSuchTable) {
+			respErr = storage.ErrNoSuchTable
+			return nil
+		}
 		if err != nil {
-		_ = storage.Award(user, req.BuyIn) // nobody sat down, so nothing was bought
-		slog.Error("games: holdem sit", "user", user, "err", err)
+			return err
+		}
+		if t.Game != gameHoldem {
+			respErr = holdem.ErrUnknownMove
+			return nil
+		}
+		var g holdem.State
+		if err := json.Unmarshal(t.State, &g); err != nil {
+			return err
+		}
+		if g.Phase == holdem.PhaseBetting {
+			respErr = holdem.ErrHandLive // you join between hands, not into one
+			return nil
+		}
+		seat := pickOpenSeat(g, wantSeat)
+		if seat < 0 {
+			respErr = holdem.ErrTableFull
+			return nil
+		}
+		if err := g.Occupy(seat, name, buyIn); err != nil {
+			respErr = err
+			return nil
+		}
+		blob, err := json.Marshal(g)
+		if err != nil {
+			return err
+		}
+		t.State, t.Phase, t.HandNo = blob, string(g.Phase), int64(g.HandNo)
+		err = storage.SitDown(storage.Sit{
+			Table: t,
+			Seat:  storage.Seat{Seat: seat, MatrixUser: user, Name: name, Staked: buyIn},
+			BuyIn: buyIn,
+		})
+		switch {
+		case errors.Is(err, storage.ErrInsufficientChips), errors.Is(err, storage.ErrBadAmount):
+			respErr = storage.ErrInsufficientChips
+			return nil
+		case errors.Is(err, storage.ErrHandInProgress):
+			respErr = storage.ErrHandInProgress
+			return nil
+		case errors.Is(err, storage.ErrSeatTaken), errors.Is(err, storage.ErrStaleTable):
+			respErr = storage.ErrSeatTaken
+			return nil
+		case err != nil:
+			return err
+		}
+		s.publishTable(tableID)
+		return nil
+	})
+	if err != nil {
+		slog.Error("games: join holdem", "user", user, "table", tableID, "err", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	s.persistHoldem(w, user, g, evs, seed1, seed2, true)
+	if respErr != nil {
+		writeJSONStatus(w, joinStatus(respErr), map[string]string{"error": joinMessage(respErr)})
+		return
+	}
+	s.writeHoldemTable(w, user, nil)
 }
 
-// handleHoldemMove plays one move: an action in a hand, or the three that are
-// about the session — deal the next hand, put more chips on the table, get up.
+func joinStatus(err error) int {
+	switch {
+	case errors.Is(err, storage.ErrNoSuchTable), errors.Is(err, holdem.ErrTableFull),
+		errors.Is(err, storage.ErrSeatTaken), errors.Is(err, holdem.ErrHandLive):
+		return http.StatusConflict
+	default:
+		return http.StatusBadRequest
+	}
+}
+
+func joinMessage(err error) string {
+	switch {
+	case errors.Is(err, storage.ErrNoSuchTable):
+		return "that table has closed"
+	case errors.Is(err, holdem.ErrTableFull), errors.Is(err, storage.ErrSeatTaken):
+		return "that seat is taken"
+	case errors.Is(err, holdem.ErrHandLive):
+		return "a hand is in play — sit down when it's over"
+	case errors.Is(err, holdem.ErrBadBuyIn):
+		return "that isn't a legal buy-in for this table"
+	case errors.Is(err, storage.ErrInsufficientChips):
+		return "not enough chips to sit down"
+	case errors.Is(err, storage.ErrHandInProgress):
+		return "finish the game you're in first"
+	default:
+		return "you can't sit there"
+	}
+}
+
+// ---- playing a hand --------------------------------------------------------
+
+// handleHoldemMove plays one move at the player's table: a betting action, or the
+// two session moves that are not leaving (deal the next hand, top up between
+// them). Leaving is its own endpoint, because it is a storage operation rather
+// than an engine one.
 func (s *Server) handleHoldemMove(w http.ResponseWriter, r *http.Request) {
 	user, ok := s.player(w, r)
 	if !ok {
@@ -237,113 +457,275 @@ func (s *Server) handleHoldemMove(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "bad json", http.StatusBadRequest)
 		return
 	}
+	if move.Kind == holdem.Leave {
+		s.leaveHoldem(w, user)
+		return
+	}
 
-	live, err := storage.LoadLiveHand(user)
+	tableID, seat, err := storage.PlayerSeat(user)
 	if errors.Is(err, storage.ErrNoLiveHand) {
 		writeJSONStatus(w, http.StatusConflict, map[string]string{"error": "you're not at a table"})
 		return
 	}
 	if err != nil {
-		slog.Error("games: holdem load", "user", user, "err", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	if live.Game != gameHoldem {
-		writeJSONStatus(w, http.StatusConflict, map[string]string{"error": "finish the game you're in first"})
-		return
-	}
-	var g holdem.State
-	if err := json.Unmarshal(live.State, &g); err != nil {
-		slog.Error("games: unreadable holdem table", "user", user, "err", err)
+		slog.Error("games: holdem move seat", "user", user, "err", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 
-	// A top-up is real money crossing the border, so the chips come off the stack
-	// before the engine is asked — and go straight back if it says no. Same order,
-	// and the same reason, as doubling down at blackjack.
+	var respErr error
+	var respEvents []holdem.Event
+	err = s.tableLocks.withTable(tableID, func() error {
+		t, seats, err := storage.LoadTable(tableID)
+		if errors.Is(err, storage.ErrNoSuchTable) {
+			respErr = storage.ErrNoSuchTable
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		var g holdem.State
+		if err := json.Unmarshal(t.State, &g); err != nil {
+			return err
+		}
+
+		// A top-up is real chips crossing the border, so it comes off the stack
+		// before the engine is asked, and goes straight back if the engine says no —
+		// the same order, and the same reason, as doubling down at blackjack.
 		topped := int64(0)
 		if move.Kind == holdem.TopUp {
 			if err := storage.Stake(user, move.Amount); err != nil {
 				if errors.Is(err, storage.ErrInsufficientChips) || errors.Is(err, storage.ErrBadAmount) {
-				writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "you don't have those chips"})
-				return
+					respErr = holdem.ErrTooBig
+					return nil
 				}
-			slog.Error("games: holdem top-up", "user", user, "err", err)
-			http.Error(w, "internal error", http.StatusInternalServerError)
-			return
+				return err
 			}
 			topped = move.Amount
 		}
 
-	next, evs, err := holdem.ApplyMove(g, move)
-	if err != nil {
+		next, evs, aerr := holdem.ApplyMove(g, seat, move)
+		if aerr != nil {
 			if topped > 0 {
 				_ = storage.Award(user, topped) // the top-up didn't happen
 			}
-		msg := "that move isn't legal here"
-		switch {
-		case errors.Is(err, holdem.ErrHandLive):
-			msg = "finish the hand first"
-		case errors.Is(err, holdem.ErrNotYourTurn):
-			msg = "it isn't your turn"
-		case errors.Is(err, holdem.ErrCantCheck):
-			msg = "there's a bet to you"
-		case errors.Is(err, holdem.ErrTooSmall):
-			msg = "that's under the minimum raise"
-		case errors.Is(err, holdem.ErrTooBig):
-			msg = "you don't have that many chips"
-		case errors.Is(err, holdem.ErrBadBuyIn):
-			msg = "that would put you over the table maximum"
-		}
-		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": msg})
-		return
-	}
-	s.persistHoldem(w, user, next, evs, live.Seed1, live.Seed2, false)
+			respErr = aerr
+			return nil
 		}
 
-// persistHoldem writes the table back and answers the browser.
-//
-// The session settles exactly once — when the player gets up, or when they have
-// nothing left to get up with. Until then Done is false and `commit` moves no
-// chips at all, which is what makes a hundred hands of poker a single trip across
-// the border rather than a hundred.
-func (s *Server) persistHoldem(w http.ResponseWriter, user string, g holdem.State, evs []holdem.Event, seed1, seed2 uint64, fresh bool) {
-	blob, err := json.Marshal(g)
+		// A solo session that just ended (the one human busted) is not a table any
+		// more: cash the seat out — for nothing, but the claim still has to be
+		// released — and close the felt. Only a one-human bust reaches PhaseDone; a
+		// shared table sits the busted seat Out and plays on.
+		if next.Phase == holdem.PhaseDone {
+			if err := s.settleLeave(t, next, seat, user); err != nil {
+				if topped > 0 {
+					_ = storage.Award(user, topped)
+				}
+				if errors.Is(err, storage.ErrStaleTable) {
+					respErr = storage.ErrStaleTable
+					return nil
+				}
+				return err
+			}
+			respEvents = evs
+			s.publishTable(tableID)
+			return nil
+		}
+
+		st, err := holdemStep(g, next, evs, seats)
 		if err != nil {
-		slog.Error("games: marshal holdem", "user", user, "err", err)
+			if topped > 0 {
+				_ = storage.Award(user, topped)
+			}
+			return err
+		}
+		acting := seats[seat]
+		acting.Away = false
+		acting.LastSeen = time.Now().Unix()
+		// A top-up is more real money crossing the border, so the seat's staked row —
+		// the record of what they brought and can still take home — has to grow with
+		// it. Without this the storage invariant (stacks + pot == staked - rake) drifts
+		// by every top-up, and the felt under-reports what they bought in for.
+		acting.Staked += topped
+
+		t.State, t.Phase, t.HandNo, t.Deadline = st.State, st.Phase, st.HandNo, st.Deadline
+		if err := storage.CommitTable(storage.TableCommit{
+			Table: t, Seats: []storage.Seat{acting}, Audit: st.Audit,
+		}); err != nil {
+			if errors.Is(err, storage.ErrStaleTable) {
+				if topped > 0 {
+					_ = storage.Award(user, topped)
+				}
+				respErr = storage.ErrStaleTable
+				return nil
+			}
+			return err
+		}
+		respEvents = evs
+		s.publishTable(tableID)
+		return nil
+	})
+	if err != nil {
+		slog.Error("games: holdem move", "user", user, "table", tableID, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if respErr != nil {
+		writeJSONStatus(w, moveStatus(respErr), map[string]string{"error": moveMessage(respErr)})
+		return
+	}
+	s.writeHoldemTable(w, user, respEvents)
+}
+
+func moveStatus(err error) int {
+	// A 409 is a concurrency verdict: the table is not where the caller thought, so
+	// reload and look again. Everything else — an illegal move for this state — is
+	// the caller's mistake, a 400. Leaving mid-hand or acting out of turn is a 400:
+	// the request was simply not allowed, not raced.
+	switch {
+	case errors.Is(err, storage.ErrStaleTable), errors.Is(err, storage.ErrNoSuchTable):
+		return http.StatusConflict
+	default:
+		return http.StatusBadRequest
+	}
+}
+
+func moveMessage(err error) string {
+	switch {
+	case errors.Is(err, storage.ErrStaleTable):
+		return "the table moved on — take another look"
+	case errors.Is(err, storage.ErrNoSuchTable):
+		return "that table has closed"
+	case errors.Is(err, holdem.ErrHandLive):
+		return "finish the hand first"
+	case errors.Is(err, holdem.ErrNotYourTurn):
+		return "it isn't your turn"
+	case errors.Is(err, holdem.ErrCantCheck):
+		return "there's a bet to you"
+	case errors.Is(err, holdem.ErrTooSmall):
+		return "that's under the minimum raise"
+	case errors.Is(err, holdem.ErrTooBig):
+		return "you don't have that many chips"
+	case errors.Is(err, holdem.ErrBadBuyIn):
+		return "that would put you over the table maximum"
+	default:
+		return "that move isn't legal here"
+	}
+}
+
+// ---- getting up ------------------------------------------------------------
+
+// handleHoldemLeave is the get-up endpoint. Leaving is its own route because it
+// is a storage operation, not an engine move — the chips cross the border and the
+// felt may close — even though the felt also lets you send it as a "leave" move.
+func (s *Server) handleHoldemLeave(w http.ResponseWriter, r *http.Request) {
+	user, ok := s.player(w, r)
+	if !ok {
+		return
+	}
+	s.leaveHoldem(w, user)
+}
+
+// leaveHoldem gets a player up from their table, turning what is in front of them
+// back into chips. It refuses mid-hand — you cannot walk out on chips you have in
+// the pot — and closes the felt behind the last human to leave.
+func (s *Server) leaveHoldem(w http.ResponseWriter, user string) {
+	tableID, seat, err := storage.PlayerSeat(user)
+	if errors.Is(err, storage.ErrNoLiveHand) {
+		writeJSONStatus(w, http.StatusConflict, map[string]string{"error": "you're not at a table"})
+		return
+	}
+	if err != nil {
+		slog.Error("games: holdem leave seat", "user", user, "err", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 
-	done := g.Phase == holdem.PhaseDone
-	outcome := "left"
-	switch {
-	case done && g.Payout == 0:
-		outcome = "busted"
-	case done && g.Payout > g.BoughtIn:
-		outcome = "up"
-	case done && g.Payout < g.BoughtIn:
-		outcome = "down"
+	var respErr error
+	err = s.tableLocks.withTable(tableID, func() error {
+		t, _, err := storage.LoadTable(tableID)
+		if errors.Is(err, storage.ErrNoSuchTable) {
+			respErr = storage.ErrNoSuchTable
+			return nil
 		}
-
-	v, ok := s.commit(w, user, finished{
-		Game: gameHoldem, Blob: blob,
-		// Paid, not Rake: the audit log is the house's income, and the house only
-		// makes money off the player. What it lifts off a bot's pot is not income.
-		Bet: g.BoughtIn, Payout: g.Payout, Rake: g.Paid,
-		Outcome: outcome, Done: done,
-		Seed1: seed1, Seed2: seed2, Fresh: fresh,
+		if err != nil {
+			return err
+		}
+		var g holdem.State
+		if err := json.Unmarshal(t.State, &g); err != nil {
+			return err
+		}
+		if g.Phase == holdem.PhaseBetting {
+			respErr = holdem.ErrHandLive
+			return nil
+		}
+		if err := s.settleLeave(t, g, seat, user); err != nil {
+			if errors.Is(err, storage.ErrStaleTable) {
+				respErr = storage.ErrStaleTable
+				return nil
+			}
+			return err
+		}
+		s.publishTable(tableID)
+		return nil
 	})
-	if !ok {
+	if err != nil {
+		slog.Error("games: holdem leave", "user", user, "table", tableID, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	// A closed session is gone from storage, so the table view has none to show —
-	// but the browser still needs the last board to land the verdict on.
-	if done {
-		hv := viewHoldem(g)
-		v.Holdem = &hv
+	if respErr != nil {
+		writeJSONStatus(w, moveStatus(respErr), map[string]string{"error": moveMessage(respErr)})
+		return
+	}
+	s.writeHoldemTable(w, user, nil)
+}
+
+// settleLeave vacates a seat, credits the stack home, and closes the table if
+// nobody human is left — all inside the caller's lock. The engine's Vacate turns
+// the chair back into the house's (its chips become house money, rebought like
+// any bot's), and storage.LeaveTable does the border crossing in one transaction
+// with the state write, so a crash can never pay a player and then leave their
+// seat sitting there to be cashed out again.
+func (s *Server) settleLeave(t storage.Table, g holdem.State, seat int, user string) error {
+	home, err := g.Vacate(seat)
+	if err != nil {
+		return err
+	}
+	blob, err := json.Marshal(g)
+	if err != nil {
+		return err
+	}
+	t.State, t.Phase, t.HandNo, t.Deadline = blob, string(g.Phase), int64(g.HandNo), 0
+	if err := storage.LeaveTable(storage.Leave{
+		Table: t, Seat: seat, MatrixUser: user, Bot: g.Seats[seat].Name, Amount: home,
+	}); err != nil {
+		return err
+	}
+	if err := storage.CloseTable(t.ID); err != nil {
+		return err
+	}
+	return nil
+}
+
+// ---- the response ----------------------------------------------------------
+
+// writeHoldemTable answers with the whole page state — the money and the table as
+// the player's own seat may see it — plus, when a move produced one, the redacted
+// event script for that seat to animate. A player who has just got up has no seat
+// and no table; the money view carries the leftover verdict and the felt clears.
+func (s *Server) writeHoldemTable(w http.ResponseWriter, user string, evs []holdem.Event) {
+	v, err := s.table(user)
+	if err != nil {
+		slog.Error("games: holdem table", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if len(evs) > 0 {
+		if _, seat, serr := storage.PlayerSeat(user); serr == nil {
+			v.HoldemEvents = viewHoldemEvents(evs, seat)
+		}
 	}
-	v.HoldemEvents = viewHoldemEvents(evs)
 	writeJSON(w, v)
 }

internal/web/games_holdem_multiplayer_test.go

@@ -0,0 +1,230 @@
+package web
+
+import (
+	"testing"
+	"time"
+
+	"pete/internal/storage"
+)
+
+const bobPlayer = "@bob:parodia.dev"
+
+// fundUser puts chips in front of a named player the way the border really does.
+func fundUser(t *testing.T, user string, chips int64) {
+	t.Helper()
+	e, err := storage.RequestBuyIn(user, chips)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := storage.ClaimEscrow(e.GUID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := storage.SettleEscrow(e.GUID, true, "", 0); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func chipsOf(t *testing.T, user string) int64 {
+	t.Helper()
+	st, err := storage.Chips(user)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return st.Chips
+}
+
+// A second person can sit down at a table somebody else opened, taking a chair a
+// bot was keeping warm — which is the whole point of the thing being multiplayer.
+func TestHoldemJoinTakesAnOpenSeat(t *testing.T) {
+	s := newCasino(t)
+	fund(t, 5000) // reala
+	fundUser(t, bobPlayer, 5000)
+
+	if _, code := call(t, s, s.handleHoldemSit, as(t, s, "reala", "POST", "/api/games/holdem/sit",
+		map[string]any{"tier": "low", "bots": 2, "buyin": 500})); code != 200 {
+		t.Fatalf("reala sit = %d, want 200", code)
+	}
+	tableID, err := storage.TableOf(testPlayer)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	v, code := call(t, s, s.handleHoldemSit, as(t, s, "bob", "POST", "/api/games/holdem/sit",
+		map[string]any{"table": tableID, "buyin": 500}))
+	if code != 200 {
+		t.Fatalf("bob join = %d, want 200", code)
+	}
+	if v.Chips != 4500 {
+		t.Errorf("bob's chips after a 500 buy-in = %d, want 4500", v.Chips)
+	}
+	if v.Holdem == nil {
+		t.Fatal("join returned no table")
+	}
+
+	_, bobSeat, err := storage.PlayerSeat(bobPlayer)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bobSeat == 0 {
+		t.Errorf("bob took reala's seat %d", bobSeat)
+	}
+	if v.Holdem.YourSeat != bobSeat {
+		t.Errorf("the view says bob is at seat %d, storage says %d", v.Holdem.YourSeat, bobSeat)
+	}
+
+	_, seats, err := storage.LoadTable(tableID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	humans := 0
+	for _, seat := range seats {
+		if seat.MatrixUser != "" {
+			humans++
+		}
+	}
+	if humans != 2 {
+		t.Errorf("two people at the table, storage says %d humans", humans)
+	}
+}
+
+// The felt tells each player "you bought in for X" — their own stake, not the
+// table's. The engine's BoughtIn is the sum across every human (the audit wants
+// that), so a two-human table would quote both of them the pair's total if the
+// view read it straight. It reads each seat's own staked row from storage instead.
+func TestBoughtInIsPerPlayerNotTheTableTotal(t *testing.T) {
+	s := newCasino(t)
+	fund(t, 5000) // reala
+	fundUser(t, bobPlayer, 5000)
+
+	call(t, s, s.handleHoldemSit, as(t, s, "reala", "POST", "/api/games/holdem/sit",
+		map[string]any{"tier": "low", "bots": 2, "buyin": 500}))
+	tableID, _ := storage.TableOf(testPlayer)
+	call(t, s, s.handleHoldemSit, as(t, s, "bob", "POST", "/api/games/holdem/sit",
+		map[string]any{"table": tableID, "buyin": 500}))
+
+	for _, who := range []string{testPlayer, bobPlayer} {
+		v, err := s.table(who)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if v.Holdem == nil {
+			t.Fatalf("%s has no table", who)
+		}
+		if v.Holdem.BoughtIn != 500 {
+			t.Errorf("%s is shown bought-in %d, want their own 500 — not the table's 1000",
+				who, v.Holdem.BoughtIn)
+		}
+	}
+}
+
+// Leaving a shared table gives you your stack and hands your chair back to the
+// house; the table stays open for the people still on it. Only the last human out
+// closes the felt.
+func TestHoldemLeavingSharedTableKeepsItOpen(t *testing.T) {
+	s := newCasino(t)
+	fund(t, 5000)
+	fundUser(t, bobPlayer, 5000)
+
+	call(t, s, s.handleHoldemSit, as(t, s, "reala", "POST", "/api/games/holdem/sit",
+		map[string]any{"tier": "low", "bots": 2, "buyin": 500}))
+	tableID, _ := storage.TableOf(testPlayer)
+	call(t, s, s.handleHoldemSit, as(t, s, "bob", "POST", "/api/games/holdem/sit",
+		map[string]any{"table": tableID, "buyin": 500}))
+
+	// Bob gets up. His 500 comes home and his chair goes back to a bot.
+	if _, code := call(t, s, s.handleHoldemLeave, as(t, s, "bob", "POST", "/api/games/holdem/leave", nil)); code != 200 {
+		t.Fatalf("bob leave = %d, want 200", code)
+	}
+	if got := chipsOf(t, bobPlayer); got != 5000 {
+		t.Errorf("bob left with %d, want his 5000 back", got)
+	}
+	if _, _, err := storage.PlayerSeat(bobPlayer); err != storage.ErrNoLiveHand {
+		t.Errorf("bob still holds a seat after leaving: %v", err)
+	}
+	if _, _, err := storage.LoadTable(tableID); err != nil {
+		t.Errorf("the table closed under reala when bob left: %v", err)
+	}
+
+	// Reala is the last one out, so the felt closes behind them.
+	if _, code := call(t, s, s.handleHoldemLeave, as(t, s, "reala", "POST", "/api/games/holdem/leave", nil)); code != 200 {
+		t.Fatalf("reala leave = %d, want 200", code)
+	}
+	if _, _, err := storage.LoadTable(tableID); err != storage.ErrNoSuchTable {
+		t.Errorf("an empty table survived the last human: %v", err)
+	}
+}
+
+// A table everyone has walked away from is cashed out and closed by the reaper —
+// the chips inside a walked-away poker session are not left in limbo.
+func TestHoldemReaperCashesOutAbandonedTable(t *testing.T) {
+	s := newCasino(t)
+	fund(t, 5000)
+
+	call(t, s, s.handleHoldemSit, as(t, s, "reala", "POST", "/api/games/holdem/sit",
+		map[string]any{"tier": "low", "bots": 2, "buyin": 500}))
+	tableID, _ := storage.TableOf(testPlayer)
+
+	// The seat has been away, and last acted for itself longer ago than the idle
+	// cutoff — the state the reaper is meant to find.
+	tbl, seats, err := storage.LoadTable(tableID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	seats[0].Away = true
+	seats[0].LastSeen = time.Now().Unix() - int64(storage.SessionIdleAfter.Seconds()) - 60
+	if err := storage.CommitTable(storage.TableCommit{Table: tbl, Seats: []storage.Seat{seats[0]}}); err != nil {
+		t.Fatal(err)
+	}
+
+	s.reapAbandonedTables()
+
+	if got := chipsOf(t, testPlayer); got != 5000 {
+		t.Errorf("the reaper sent home %d, want the whole 5000 back (buy-in and all)", got)
+	}
+	if _, _, err := storage.LoadTable(tableID); err != storage.ErrNoSuchTable {
+		t.Errorf("the reaper left the table standing: %v", err)
+	}
+	if _, err := storage.TableOf(testPlayer); err != storage.ErrNoLiveHand {
+		t.Errorf("the reaper left the occupancy claim behind: %v", err)
+	}
+}
+
+// A fresh table is not abandoned, and the reaper leaves it alone.
+func TestHoldemReaperSparesALiveTable(t *testing.T) {
+	s := newCasino(t)
+	fund(t, 5000)
+
+	call(t, s, s.handleHoldemSit, as(t, s, "reala", "POST", "/api/games/holdem/sit",
+		map[string]any{"tier": "low", "bots": 2, "buyin": 500}))
+	tableID, _ := storage.TableOf(testPlayer)
+
+	s.reapAbandonedTables()
+
+	if _, _, err := storage.LoadTable(tableID); err != nil {
+		t.Errorf("the reaper closed a table someone is sitting at: %v", err)
+	}
+	if got := chipsOf(t, testPlayer); got != 4500 {
+		t.Errorf("chips = %d — the reaper should not have moved a live table's money", got)
+	}
+}
+
+// The lobby lists a table with a seat going spare, and drops it once it is full.
+func TestHoldemLobbyListsJoinableTables(t *testing.T) {
+	s := newCasino(t)
+	fund(t, 5000)
+
+	// A one-bot table: two seats, one human, one open.
+	call(t, s, s.handleHoldemSit, as(t, s, "reala", "POST", "/api/games/holdem/sit",
+		map[string]any{"tier": "low", "bots": 1, "buyin": 500}))
+
+	tables, err := storage.LobbyTables(gameHoldem, 50)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(tables) != 1 {
+		t.Fatalf("lobby has %d tables, want 1", len(tables))
+	}
+	if tables[0].Humans != 1 || tables[0].Seats != 2 {
+		t.Errorf("lobby table = %d/%d humans/seats, want 1/2", tables[0].Humans, tables[0].Seats)
+	}
+}

internal/web/games_holdem_redact_test.go

@@ -0,0 +1,143 @@
+package web
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"pete/internal/games/holdem"
+)
+
+// The security boundary of the whole multiplayer table, tested the way the plan
+// insists it must be: render every seat's view at every street, and string-search
+// the JSON for any card that belongs to another seat. Zero hits, for every seat,
+// at every point before a showdown turns cards over.
+//
+// This is not belt-and-braces. After SSE the view a seat renders fans to that
+// seat's stream, so a single missed redaction does not leak one card to one
+// player through one handler bug — it broadcasts a hole card to the whole felt,
+// continuously. The engine deliberately emits every seat's cards now (it cannot
+// know who a shared stream is for), which makes this function the only thing
+// standing between the deck and the network tab.
+
+// holeLabel is a seat's two cards as they would be rendered — the exact strings a
+// leak would put in the JSON.
+func holeLabels(g holdem.State, seat int) []string {
+	h := g.Seats[seat].Hole
+	return []string{viewCard(h[0]).Label, viewCard(h[1]).Label}
+}
+
+func TestHoldemViewNeverLeaksAnotherSeatsCards(t *testing.T) {
+	tier := holdem.Tiers[0]
+	// Two humans (0, 2) and two bots (1, 3), so the test covers a seat seeing both
+	// another human and a bot, and a human sitting at a non-zero index.
+	seats := []holdem.SeatConfig{
+		{Name: "Ana", Stack: tier.MaxBuy},
+		{Name: "Bot A", Bot: true, Stack: tier.MaxBuy},
+		{Name: "Bo", Stack: tier.MaxBuy},
+		{Name: "Bot B", Bot: true, Stack: tier.MaxBuy},
+	}
+	g, _, err := holdem.New(tier, seats, tier.RakePct, 5, 6)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Deal, then walk the hand to the river without anyone folding — every seat
+	// stays in, so every seat has cards that must not leak to the others. Checking
+	// and calling keeps everyone live; the redaction is checked after every step.
+	g, dealEvs, err := holdem.ApplyMove(g, 0, holdem.Move{Kind: holdem.Deal})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// The deal script carries every hole, so it is the sharpest test of event
+	// redaction: for each viewer, no other seat's cards may survive.
+	assertEventsRedacted(t, g, dealEvs)
+	assertViewsRedacted(t, g)
+
+	for step := 0; g.Phase == holdem.PhaseBetting && step < 80; step++ {
+		seat := g.ToAct
+		if g.Seats[seat].Bot {
+			t.Fatalf("advance stopped on a bot at seat %d", seat)
+		}
+		move := holdem.Move{Kind: holdem.Check}
+		if g.Owed(seat) > 0 {
+			move = holdem.Move{Kind: holdem.Call}
+		}
+		var evs []holdem.Event
+		g, evs, err = holdem.ApplyMove(g, seat, move)
+		if err != nil {
+			t.Fatalf("seat %d %s: %v", seat, move.Kind, err)
+		}
+		assertEventsRedacted(t, g, evs)
+		assertViewsRedacted(t, g)
+	}
+}
+
+// assertViewsRedacted renders every seat's table view and fails if any of them
+// carries a card belonging to a seat that is still hiding it.
+func assertViewsRedacted(t *testing.T, g holdem.State) {
+	t.Helper()
+	shown := g.Street == holdem.Showdown
+	for viewer := range g.Seats {
+		blob, err := json.Marshal(viewHoldem(g, viewer))
+		if err != nil {
+			t.Fatal(err)
+		}
+		payload := string(blob)
+		for other := range g.Seats {
+			if other == viewer {
+				continue // your own cards are yours to see
+			}
+			// A seat's cards are legitimately visible only at a showdown, and then only
+			// if they did not fold. Everywhere else, a hit is a leak.
+			if shown && g.Seats[other].State != holdem.Folded {
+				continue
+			}
+			if g.Seats[other].State == holdem.Out {
+				continue
+			}
+			for _, label := range holeLabels(g, other) {
+				if strings.Contains(payload, label) {
+					t.Fatalf("seat %d's view (%s street) leaks seat %d's card %q",
+						viewer, g.Street, other, label)
+				}
+			}
+		}
+	}
+}
+
+// assertEventsRedacted renders the event script for every viewer and fails if a
+// beat carries another seat's card outside a showdown "show".
+func assertEventsRedacted(t *testing.T, g holdem.State, evs []holdem.Event) {
+	t.Helper()
+	for viewer := range g.Seats {
+		blob, err := json.Marshal(viewHoldemEvents(evs, viewer))
+		if err != nil {
+			t.Fatal(err)
+		}
+		payload := string(blob)
+		// The engine only puts a non-viewer's cards in a "show" beat and in the hole
+		// beats it emits for everyone. If any card label of another seat survives the
+		// redaction *and* there is no show event in this batch, it leaked.
+		hasShow := false
+		for _, e := range evs {
+			if e.Kind == "show" {
+				hasShow = true
+			}
+		}
+		if hasShow {
+			continue // a showdown legitimately turns cards over
+		}
+		for other := range g.Seats {
+			if other == viewer || g.Seats[other].State == holdem.Out {
+				continue
+			}
+			for _, label := range holeLabels(g, other) {
+				if strings.Contains(payload, label) {
+					t.Fatalf("seat %d's event stream leaks seat %d's card %q", viewer, other, label)
+				}
+			}
+		}
+	}
+}

internal/web/games_holdem_table.go

@@ -0,0 +1,209 @@
+package web
+
+import (
+	"encoding/json"
+	"time"
+
+	"pete/internal/games/holdem"
+	"pete/internal/storage"
+)
+
+// Hold'em as a shared table: the seam the runtime drives it through, and the two
+// facts about a hand that only the engine can tell the runtime — when the clock
+// must next act, and what a finished hand owes the audit trail.
+//
+// Everything about *playing* poker is still in the engine. This file is the
+// translation layer between a holdem.State and the game-agnostic table runtime:
+// it decodes the blob, asks the engine to act, and re-derives the deadline and
+// the audit from the state that comes back.
+
+// holdemTable is the tableGame for poker. It holds no state — the table's state
+// is the blob in game_tables — so a single value in s.tableGames serves every
+// felt in the room.
+type holdemTable struct{}
+
+func (holdemTable) name() string { return gameHoldem }
+
+// timeout acts for the human whose clock ran out. At a card table the standing
+// courtesy is check if you can, fold if you cannot: a walked-away player never
+// puts more chips in, and folding keeps the hand moving for everyone still there.
+//
+// It marks the seat away so the runtime stops waiting a full clock on it next
+// time — an absent human auto-folds on sight after this, rather than holding three
+// other people hostage for thirty seconds an orbit.
+//
+// If, on decode, the seat to act is not a waiting human, the scan raced a real
+// move that had not yet bumped the version: errNotDue, and the clock steps aside.
+func (holdemTable) timeout(state []byte, seats []storage.Seat) (step, []storage.Seat, error) {
+	var g holdem.State
+	if err := json.Unmarshal(state, &g); err != nil {
+		return step{}, nil, err
+	}
+	if g.Phase != holdem.PhaseBetting {
+		return step{}, seats, errNotDue
+	}
+	seat := g.ToAct
+	if seat < 0 || seat >= len(g.Seats) || g.Seats[seat].Bot {
+		return step{}, seats, errNotDue
+	}
+
+	move := holdem.Move{Kind: holdem.Fold}
+	if g.Owed(seat) == 0 {
+		move.Kind = holdem.Check
+	}
+	next, evs, err := holdem.ApplyMove(g, seat, move)
+	if err != nil {
+		return step{}, nil, err
+	}
+
+	changed := markAway(seats, seat)
+	st, err := holdemStep(g, next, evs, seats)
+	return st, changed, err
+}
+
+// stacks reports the chips in front of each seat, index-aligned with the table's
+// seat rows. The abandoned-table reaper reads it to know what to send each
+// walked-away human home with, without having to understand poker.
+func (holdemTable) stacks(state []byte) ([]int64, error) {
+	var g holdem.State
+	if err := json.Unmarshal(state, &g); err != nil {
+		return nil, err
+	}
+	out := make([]int64, len(g.Seats))
+	for i := range g.Seats {
+		out[i] = g.Seats[i].Stack
+	}
+	return out, nil
+}
+
+// holdemStep packages a played-out state for the runtime: the blob to persist,
+// the deadline the clock must honour next, and the audit of any hand that just
+// ended. prev is the state before the move, which is what lets it work out how
+// much rake this one hand took.
+func holdemStep(prev, next holdem.State, evs []holdem.Event, seats []storage.Seat) (step, error) {
+	blob, err := json.Marshal(next)
+	if err != nil {
+		return step{}, err
+	}
+	st := step{
+		State:    blob,
+		Phase:    string(next.Phase),
+		HandNo:   int64(next.HandNo),
+		Deadline: holdemDeadline(next, seats),
+		Audit:    holdemAudit(prev, next, evs, seats),
+	}
+	return st, nil
+}
+
+// holdemDeadline is when the clock must next act, or 0 for never. A clock is only
+// ever set on a *present* human whose turn it is: a bot resolves inside the move
+// and never waits, and an away human is auto-acted the moment the clock sees them
+// rather than waited on. Between hands there is no per-seat clock at all — an
+// abandoned table is the reaper's job, not the turn clock's.
+func holdemDeadline(g holdem.State, seats []storage.Seat) int64 {
+	if g.Phase != holdem.PhaseBetting {
+		return 0
+	}
+	seat := g.ToAct
+	if seat < 0 || seat >= len(g.Seats) || g.Seats[seat].Bot {
+		return 0
+	}
+	if seatAway(seats, seat) {
+		return 0 // an away human doesn't get waited on; the clock acts next tick
+	}
+	return time.Now().Unix() + turnSeconds
+}
+
+// holdemAudit is the per-hand record of a finished hand — one row per human who
+// was in it. Empty until a hand actually ends, which is exactly when the engine
+// emits an "end" beat.
+//
+// The rake is the trap the plan flagged. game_hands.rake is summed into the
+// house's income (HouseTake), so a pot's rake must be recorded once and once
+// only. It rides on the winner's row alone; every other seat carries zero. And it
+// is this hand's rake, not the session's: next.Paid is cumulative, so the hand's
+// take is the amount it climbed by since prev — the part of *this* pot that came
+// out of a human's winnings.
+func holdemAudit(prev, next holdem.State, evs []holdem.Event, seats []storage.Seat) []storage.Hand {
+	if !handEnded(evs) {
+		return nil
+	}
+	handRake := next.Paid - prev.Paid
+
+	// The human who won the most is who the rake is attributed to: rake only ever
+	// comes out of a pot a human won, so when handRake is positive there is one.
+	winner, best := -1, int64(0)
+	for i := range next.Seats {
+		if next.Seats[i].Bot {
+			continue
+		}
+		if next.Seats[i].Won > best {
+			winner, best = i, next.Seats[i].Won
+		}
+	}
+
+	var audit []storage.Hand
+	for i := range next.Seats {
+		p := next.Seats[i]
+		if p.Bot || i >= len(seats) || seats[i].MatrixUser == "" {
+			continue
+		}
+		if p.Total == 0 && p.Won == 0 {
+			continue // dealt out, or never in the hand — nothing to record
+		}
+		outcome := "lost"
+		switch {
+		case p.Won > p.Total:
+			outcome = "won"
+		case p.Won == p.Total:
+			outcome = "push"
+		}
+		rake := int64(0)
+		if i == winner {
+			rake = handRake
+		}
+		audit = append(audit, storage.Hand{
+			MatrixUser: seats[i].MatrixUser,
+			Game:       gameHoldem,
+			Bet:        p.Total,
+			Payout:     p.Won,
+			Rake:       rake,
+			Outcome:    outcome,
+			Seed1:      next.Seed1,
+			Seed2:      next.Seed2,
+		})
+	}
+	return audit
+}
+
+// handEnded reports whether a hand finished in this batch of events. endHand is
+// the only thing that emits "end", and it emits exactly one, so this is the clean
+// signal that Won and Total on the seats are this hand's final numbers.
+func handEnded(evs []holdem.Event) bool {
+	for _, e := range evs {
+		if e.Kind == "end" {
+			return true
+		}
+	}
+	return false
+}
+
+// ---- seat bookkeeping ------------------------------------------------------
+
+// seatAway reports whether the seat at an index is a human who has walked away.
+func seatAway(seats []storage.Seat, seat int) bool {
+	return seat >= 0 && seat < len(seats) && seats[seat].Away
+}
+
+// markAway returns the one seat row the clock needs to write back: the timed-out
+// seat, flagged away, with its last_seen left exactly as it was. Preserving
+// last_seen is the whole point — the reaper measures abandonment from when a
+// human last acted *for themselves*, and an auto-fold is not that.
+func markAway(seats []storage.Seat, seat int) []storage.Seat {
+	if seat < 0 || seat >= len(seats) {
+		return nil
+	}
+	s := seats[seat]
+	s.Away = true
+	return []storage.Seat{s}
+}

internal/web/games_hub.go

@@ -0,0 +1,117 @@
+package web
+
+import (
+	"sync"
+	"sync/atomic"
+)
+
+// The SSE hub: how a move one player makes reaches the phones of everyone else
+// at the felt.
+//
+// It is in-memory and it is intentionally dumb. It holds no game state and makes
+// no decisions — it is a fan-out of opaque byte frames, keyed by table id. The
+// authority is always the database; a frame is a nudge that says "the table at
+// this version changed, come and look", and a subscriber that misses one (a
+// dropped send, a reconnect) refetches the table, which is authoritative anyway.
+// So a lost frame is a cosmetic hiccup, never a wrong balance.
+//
+// Two rules hold it together, and both are load-bearing:
+//
+//  1. **Sends are non-blocking.** A subscriber's channel is buffered, and a send
+//     that would block is dropped, not waited on. The publish happens under the
+//     table lock (which is what orders frames correctly for free), so a blocking
+//     send would hold that lock while one phone on a train stalls — and the turn
+//     clock behind that lock stalls with it, for the whole casino. A dropped frame
+//     costs that one subscriber a refetch; a held lock costs everyone the room.
+//
+//  2. **The publisher never touches the database.** The hub is reached only after
+//     the DB work is done and the connection released. Holding a *sql.Rows or a tx
+//     open for the life of a stream would hold the one connection in the pool
+//     forever, and a single subscriber would brick the whole application.
+
+// hubFrame is what goes down the wire: an opaque payload the browser knows how to
+// read (a JSON table view), tagged with the version it represents so a subscriber
+// can tell a frame it already has from one it missed.
+type hubFrame struct {
+	Version int64
+	Data    []byte
+}
+
+// tableSub is one open EventSource: a buffered channel and the id that lets the
+// subscriber unregister itself when the stream closes.
+type tableSub struct {
+	id int64
+	ch chan hubFrame
+}
+
+// gamesHub fans table frames out to whoever is watching each table.
+type gamesHub struct {
+	mu     sync.Mutex
+	tables map[string]map[int64]*tableSub
+	nextID atomic.Int64
+}
+
+func newGamesHub() *gamesHub {
+	return &gamesHub{tables: make(map[string]map[int64]*tableSub)}
+}
+
+// subChanBuffer is how many frames a slow subscriber can fall behind before the
+// hub starts dropping theirs. A few is plenty: a subscriber that far behind is
+// going to refetch the authoritative table anyway, so buffering more just delays
+// that with staler frames.
+const subChanBuffer = 8
+
+// subscribe registers a new watcher of a table and returns its channel plus the
+// unsubscribe to defer. The channel is buffered so a publish never blocks on a
+// reader that is mid-write to its socket.
+func (h *gamesHub) subscribe(tableID string) (<-chan hubFrame, func()) {
+	sub := &tableSub{id: h.nextID.Add(1), ch: make(chan hubFrame, subChanBuffer)}
+
+	h.mu.Lock()
+	subs := h.tables[tableID]
+	if subs == nil {
+		subs = make(map[int64]*tableSub)
+		h.tables[tableID] = subs
+	}
+	subs[sub.id] = sub
+	h.mu.Unlock()
+
+	return sub.ch, func() { h.unsubscribe(tableID, sub.id) }
+}
+
+func (h *gamesHub) unsubscribe(tableID string, id int64) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	subs := h.tables[tableID]
+	if subs == nil {
+		return
+	}
+	delete(subs, id)
+	if len(subs) == 0 {
+		delete(h.tables, tableID)
+	}
+}
+
+// publish pushes a frame to everyone watching a table, dropping it for any
+// subscriber whose buffer is full rather than waiting on them. See rule 1: this
+// is called under the table lock, so it must never block.
+func (h *gamesHub) publish(tableID string, f hubFrame) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	for _, sub := range h.tables[tableID] {
+		select {
+		case sub.ch <- f:
+		default:
+			// Full buffer: this subscriber is behind. Dropping is correct — they will
+			// refetch the authoritative table when they next read a version gap.
+		}
+	}
+}
+
+// watchers reports how many streams are open on a table. Used by the caller that
+// decides whether a frame is worth rendering at all.
+func (h *gamesHub) watchers(tableID string) int {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return len(h.tables[tableID])
+}

internal/web/games_hub_test.go

@@ -0,0 +1,94 @@
+package web
+
+import (
+	"sync"
+	"testing"
+)
+
+func TestHub_DeliversToSubscribers(t *testing.T) {
+	h := newGamesHub()
+	ch, done := h.subscribe("t1")
+	defer done()
+
+	h.publish("t1", hubFrame{Version: 3, Data: []byte("hi")})
+	f := <-ch
+	if f.Version != 3 || string(f.Data) != "hi" {
+		t.Fatalf("got %+v", f)
+	}
+}
+
+func TestHub_OnlyToTheRightTable(t *testing.T) {
+	h := newGamesHub()
+	ch1, d1 := h.subscribe("t1")
+	defer d1()
+	ch2, d2 := h.subscribe("t2")
+	defer d2()
+
+	h.publish("t1", hubFrame{Version: 1})
+	select {
+	case <-ch2:
+		t.Fatal("t2 should not have received t1's frame")
+	default:
+	}
+	if f := <-ch1; f.Version != 1 {
+		t.Fatalf("t1 got %+v", f)
+	}
+}
+
+// TestHub_PublishNeverBlocks is the load-bearing property: a subscriber that
+// never reads must not be able to hold up a publish, because publish happens
+// under the table lock and a blocked publish stalls the turn clock for everyone.
+func TestHub_PublishNeverBlocks(t *testing.T) {
+	h := newGamesHub()
+	_, done := h.subscribe("t1") // never read from
+	defer done()
+
+	// Far more than the buffer. If any of these blocked, the test would hang.
+	blocked := make(chan struct{})
+	go func() {
+		for i := 0; i < subChanBuffer*10; i++ {
+			h.publish("t1", hubFrame{Version: int64(i)})
+		}
+		close(blocked)
+	}()
+	<-blocked
+}
+
+func TestHub_UnsubscribeStopsDelivery(t *testing.T) {
+	h := newGamesHub()
+	ch, done := h.subscribe("t1")
+	done()
+
+	if h.watchers("t1") != 0 {
+		t.Fatalf("watchers should be 0 after unsubscribe, got %d", h.watchers("t1"))
+	}
+	h.publish("t1", hubFrame{Version: 1})
+	select {
+	case _, ok := <-ch:
+		if ok {
+			t.Fatal("a frame arrived after unsubscribe")
+		}
+	default:
+	}
+}
+
+func TestHub_ConcurrentSubscribers(t *testing.T) {
+	h := newGamesHub()
+	var wg sync.WaitGroup
+	for i := 0; i < 50; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			ch, done := h.subscribe("t1")
+			defer done()
+			<-ch
+		}()
+	}
+	// Let them all register, then flood so every one of them reads at least one.
+	for h.watchers("t1") < 50 {
+	}
+	for i := 0; i < subChanBuffer; i++ {
+		h.publish("t1", hubFrame{Version: int64(i)})
+	}
+	wg.Wait()
+}

internal/web/games_lock.go

@@ -0,0 +1,58 @@
+package web
+
+import (
+	"hash/fnv"
+	"sync"
+)
+
+// The striped table lock, and why it is only ever an optimisation.
+//
+// The database's version column is the real concurrency authority: every write
+// to a table is conditional on the version the writer read, so two writers that
+// race produce one winner and one ErrStaleTable no matter what happens in
+// memory. This lock exists purely to make the loser lose *before* it does the
+// work, rather than after — it serialises the read-modify-write on a table so the
+// common case doesn't burn an engine step and a marshal only to be told it was
+// stale.
+//
+// It is a fixed array hashed on table id, never a map you can delete from, and
+// that is deliberate. A map of mutexes keyed by table id, cleaned up when a table
+// empties, will hand two goroutines two different mutex objects for the same
+// table across a delete-and-recreate — which is no lock at all. A fixed array has
+// no lifecycle: the same id always hashes to the same mutex, forever. The only
+// cost is that two unrelated tables can collide onto one stripe and briefly wait
+// on each other, which is harmless.
+//
+// A redeploy is the case that proves the version column has to be the authority:
+// during a drain two processes are running, each with its own array, so a table
+// is "locked" by two mutexes that know nothing about each other. The version
+// column is the only thing both processes share, and it is what keeps them
+// correct while the mutexes are useless.
+
+// lockStripes is how many mutexes the array holds. A power of two so the mask is
+// clean; large enough that collisions between live tables are rare.
+const lockStripes = 256
+
+type stripedLocks struct {
+	m [lockStripes]sync.Mutex
+}
+
+func newStripedLocks() *stripedLocks { return &stripedLocks{} }
+
+// forTable returns the mutex a given table hashes onto. The same id always
+// returns the same mutex.
+func (s *stripedLocks) forTable(id string) *sync.Mutex {
+	h := fnv.New32a()
+	_, _ = h.Write([]byte(id))
+	return &s.m[h.Sum32()&(lockStripes-1)]
+}
+
+// withTable runs fn while holding the table's stripe. The lock is released when
+// fn returns — it never spans a network read or an SSE send, only the
+// read-modify-write against the database.
+func (s *stripedLocks) withTable(id string, fn func() error) error {
+	mu := s.forTable(id)
+	mu.Lock()
+	defer mu.Unlock()
+	return fn()
+}

internal/web/games_pages.go

@@ -124,11 +124,21 @@ func (s *Server) casinoRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("POST /api/games/trivia/start", s.handleTriviaStart)
 	mux.HandleFunc("POST /api/games/trivia/answer", s.handleTriviaAnswer)
 
-	mux.HandleFunc("POST /api/games/uno/start", s.handleUnoStart)
+	mux.HandleFunc("POST /api/games/uno/sit", s.handleUnoSit)
 	mux.HandleFunc("POST /api/games/uno/move", s.handleUnoMove)
+	mux.HandleFunc("POST /api/games/uno/leave", s.handleUnoLeave)
+	mux.HandleFunc("GET /api/games/uno/tables", s.handleUnoLobby)
+	mux.HandleFunc("GET /api/games/uno/stream", s.handleTableStream)
+	mux.HandleFunc("GET /api/games/uno/chat", s.handleTableChat)
+	mux.HandleFunc("POST /api/games/uno/say", s.handleTableSay)
 
 	mux.HandleFunc("POST /api/games/holdem/sit", s.handleHoldemSit)
 	mux.HandleFunc("POST /api/games/holdem/move", s.handleHoldemMove)
+	mux.HandleFunc("POST /api/games/holdem/leave", s.handleHoldemLeave)
+	mux.HandleFunc("GET /api/games/holdem/tables", s.handleHoldemLobby)
+	mux.HandleFunc("GET /api/games/holdem/stream", s.handleTableStream)
+	mux.HandleFunc("GET /api/games/holdem/chat", s.handleTableChat)
+	mux.HandleFunc("POST /api/games/holdem/say", s.handleTableSay)
 }
 
 // requirePlayer sends an anonymous visitor to sign in and comes back here after.

internal/web/games_play.go

@@ -290,18 +290,68 @@ func (s *Server) table(user string) (tableView, error) {
 		tv := viewTrivia(g, time.Now())
 		v.Trivia = &tv
 	case gameUno:
+		// A seated UNO player's cards are in game_tables, not here — this row is only
+		// their occupancy claim. Load the table and render it as their own seat sees it.
+		if live.TableID == "" {
+			return s.dropUnreadable(user, v, fmt.Errorf("uno row with no table"))
+		}
+		t, tableSeats, err := storage.LoadTable(live.TableID)
+		if errors.Is(err, storage.ErrNoSuchTable) {
+			return s.dropUnreadable(user, v, fmt.Errorf("uno table %s gone", live.TableID))
+		}
+		if err != nil {
+			return tableView{}, err
+		}
+		_, seat, err := storage.PlayerSeat(user)
+		if err != nil {
+			return tableView{}, err
+		}
 		var g uno.State
-		if err := json.Unmarshal(live.State, &g); err != nil {
+		if err := json.Unmarshal(t.State, &g); err != nil {
 			return s.dropUnreadable(user, v, err)
 		}
-		uv := viewUno(g)
+		uv := viewUno(g, seat)
+		for _, ts := range tableSeats {
+			if ts.Seat == seat {
+				uv.BoughtIn = ts.Staked
+				break
+			}
+		}
 		v.Uno = &uv
 	case gameHoldem:
+		// A seated hold'em player's cards are in game_tables, not here — this row is
+		// only their occupancy claim, so its state is empty. Load the table and render
+		// it as their own seat sees it.
+		if live.TableID == "" {
+			return s.dropUnreadable(user, v, fmt.Errorf("holdem row with no table"))
+		}
+		t, tableSeats, err := storage.LoadTable(live.TableID)
+		if errors.Is(err, storage.ErrNoSuchTable) {
+			// The table closed under them (reaped, or the last hand cashed them out).
+			// Their claim is stale; clear it so they can sit down again.
+			return s.dropUnreadable(user, v, fmt.Errorf("holdem table %s gone", live.TableID))
+		}
+		if err != nil {
+			return tableView{}, err
+		}
+		_, seat, err := storage.PlayerSeat(user)
+		if err != nil {
+			return tableView{}, err
+		}
 		var g holdem.State
-		if err := json.Unmarshal(live.State, &g); err != nil {
+		if err := json.Unmarshal(t.State, &g); err != nil {
 			return s.dropUnreadable(user, v, err)
 		}
-		hv := viewHoldem(g)
+		hv := viewHoldem(g, seat)
+		// bought_in is a per-player figure — "you bought in for X" — but the engine's
+		// BoughtIn is the table's total across every human. The player's own stake is
+		// border accounting, which lives in storage; take it from their seat row.
+		for _, ts := range tableSeats {
+			if ts.Seat == seat {
+				hv.BoughtIn = ts.Staked
+				break
+			}
+		}
 		v.Holdem = &hv
 	default:
 		return s.dropUnreadable(user, v, fmt.Errorf("unknown game %q", live.Game))

internal/web/games_runtime.go

@@ -0,0 +1,89 @@
+package web
+
+import (
+	"errors"
+
+	"pete/internal/storage"
+)
+
+// errNotDue is a timeout that turned out to have nothing to do. The clock scanned
+// a table as expired, took the lock, and found — on decoding the state — that the
+// seat to act is not in fact a waiting human: a real move landed in the instant
+// between the scan and the lock and had not yet bumped the version the clock
+// checked. It is not an error, it is the race resolving the right way, so the
+// clock swallows it silently rather than logging.
+var errNotDue = errors.New("games: nothing to time out")
+
+// The table runtime: the game-agnostic half of a shared table.
+//
+// A shared table has two writers where a solo game had one — an HTTP move, and a
+// turn clock acting for whoever walked away — and the whole job of this layer is
+// to let those two coexist without either trusting the other. The rule that makes
+// that work is the database's version column: every write is conditional on the
+// version its writer read, so the two can race freely and exactly one wins.
+//
+// Everything specific to a game — how a move advances it, whose turn it is now,
+// what a settled hand pays — lives behind the tableGame interface. The clock, the
+// lock discipline and the SSE publish do not know whether they are driving poker
+// or UNO, and that is what lets Phase B ship before any engine is multiway.
+
+// turnSeconds is how long a human has to act before the clock acts for them. Long
+// enough to read the table and think, short enough that a walked-away player does
+// not hold three others hostage.
+const turnSeconds = 30
+
+// bootGrace is how far the turn clock shoves every live deadline out on boot. A
+// deploy takes the in-memory clock with it, so without this the first tick after
+// a restart would find every deadline in the casino already past and auto-act the
+// whole room at once.
+const bootGrace = 30
+
+// step is what a game hands back after a move or a timeout: the new state, ready
+// to persist, plus everything the runtime needs to settle and to schedule.
+//
+// The chips are inside State — a hand ending moves the pot within the blob and
+// credits nobody — so there is no payout field. What comes out is the state, the
+// audit of any hand that just ended, and the clock's next deadline.
+type step struct {
+	// State is the engine's whole state, marshalled, ready for the table blob.
+	State []byte
+	// Phase is lifted out of the state so the lobby can read it without decoding.
+	Phase string
+	// HandNo is the hand this state is on. It advances when a new hand is dealt,
+	// and it is the audit key now that a seed no longer reproduces a shared hand.
+	HandNo int64
+	// Deadline is when the clock must next act, or 0 for none. It is nonzero only
+	// when the turn has landed on a *present* human: a bot resolves inside the move
+	// and an away human is auto-acted on sight, so neither is ever waited for.
+	Deadline int64
+	// Audit is the per-seat record of a hand that ended in this step. Empty if no
+	// hand settled.
+	Audit []storage.Hand
+	// Events is the script the felt plays back — the same shape every solo game
+	// already returns. It is what the SSE frame and the acting player both animate.
+	Events any
+}
+
+// tableGame is everything the runtime needs from an engine to run it at a shared
+// table. Each multiplayer game implements it; the clock and the handlers hold it
+// as an interface so they stay game-agnostic.
+type tableGame interface {
+	// name is the storage key and the lobby label: "holdem", "uno", "blackjack".
+	name() string
+
+	// timeout acts for the human whose clock has expired — check if the rules
+	// allow it, fold otherwise — and advances the table as far as the next
+	// decision, exactly as a real move would. seats is the current roster, so the
+	// engine can mark the timed-out player away.
+	//
+	// It returns ErrNotDue (via a nil step, see runClockTable) if, on decode, the
+	// seat to act is not in fact a waiting human — which happens when a real move
+	// landed in the same instant the clock fired and the version had not yet been
+	// bumped when the clock scanned.
+	timeout(state []byte, seats []storage.Seat) (step, []storage.Seat, error)
+
+	// stacks reports the chips in front of each seat, index-aligned with the
+	// table's seat rows, so the abandoned-table reaper can cash out a walked-away
+	// player without knowing how their game is played.
+	stacks(state []byte) ([]int64, error)
+}

internal/web/games_table.go

@@ -0,0 +1,299 @@
+package web
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"pete/internal/storage"
+)
+
+// The runtime's public surface: the lobby a player finds a table in, the stream
+// that keeps their felt live while other people play on it, and the chat that
+// runs along the rail. None of this knows poker from UNO — it is keyed on table
+// id and moves opaque frames — which is what lets it serve every shared table.
+
+// ---- the lobby -------------------------------------------------------------
+
+// handleHoldemLobby and handleUnoLobby list the tables of their game with a seat
+// going spare. A table with every chair taken is not shown, because a lobby you
+// cannot join from is just a list; bots keep every open table populated, so there
+// is always something to sit down at.
+func (s *Server) handleHoldemLobby(w http.ResponseWriter, r *http.Request) {
+	s.lobby(w, r, gameHoldem)
+}
+
+func (s *Server) handleUnoLobby(w http.ResponseWriter, r *http.Request) {
+	s.lobby(w, r, gameUno)
+}
+
+func (s *Server) lobby(w http.ResponseWriter, r *http.Request, game string) {
+	if _, ok := s.player(w, r); !ok {
+		return
+	}
+	tables, err := storage.LobbyTables(game, 50)
+	if err != nil {
+		slog.Error("games: lobby", "game", game, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	open := make([]storage.TableSummary, 0, len(tables))
+	for _, t := range tables {
+		if t.Humans < t.Seats {
+			open = append(open, t)
+		}
+	}
+	writeJSON(w, map[string]any{"tables": open})
+}
+
+// ---- the live stream -------------------------------------------------------
+
+// streamPing is how often the stream sends a comment down an idle connection.
+// EventSource reconnects itself, but a proxy will hang up a stream that has gone
+// quiet, and a heartbeat well under the usual idle timeout keeps it open.
+const streamPing = 25 * time.Second
+
+// handleHoldemStream is the player's live view of their table: a Server-Sent
+// Events stream that carries a nudge every time the table changes and every line
+// of chat as it is said.
+//
+// It obeys the one rule that keeps a stream from bricking the app (rule from
+// games_hub.go): it touches the database exactly once, at the top, to find which
+// table the player is at. After that it only ever reads its channel. Holding a
+// query open for the life of a stream would hold the single pooled connection for
+// the life of a stream, and one idle subscriber would take the whole site down.
+func (s *Server) handleTableStream(w http.ResponseWriter, r *http.Request) {
+	user, ok := s.player(w, r)
+	if !ok {
+		return
+	}
+	tableID, err := storage.TableOf(user)
+	if errors.Is(err, storage.ErrNoLiveHand) {
+		writeJSONStatus(w, http.StatusConflict, map[string]string{"error": "you're not at a table"})
+		return
+	}
+	if err != nil {
+		slog.Error("games: stream table of", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		http.Error(w, "streaming unsupported", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("X-Accel-Buffering", "no") // tell nginx-likes not to buffer us
+	w.WriteHeader(http.StatusOK)
+
+	ch, unsubscribe := s.hub.subscribe(tableID)
+	defer unsubscribe()
+
+	// Nudge the client to fetch straight away, so a stream that opens after a change
+	// already missed does not sit blank until the next one.
+	fmt.Fprint(w, "event: sync\ndata: {}\n\n")
+	flusher.Flush()
+
+	ping := time.NewTicker(streamPing)
+	defer ping.Stop()
+	ctx := r.Context()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ping.C:
+			fmt.Fprint(w, ": ping\n\n")
+			flusher.Flush()
+		case f, open := <-ch:
+			if !open {
+				return
+			}
+			fmt.Fprintf(w, "data: %s\n\n", f.Data)
+			flusher.Flush()
+		}
+	}
+}
+
+// ---- chat ------------------------------------------------------------------
+
+// handleHoldemChat reads the recent rail of a player's table, oldest first, with
+// their own lines flagged so the felt can lay them out on the right.
+func (s *Server) handleTableChat(w http.ResponseWriter, r *http.Request) {
+	user, ok := s.player(w, r)
+	if !ok {
+		return
+	}
+	tableID, err := storage.TableOf(user)
+	if errors.Is(err, storage.ErrNoLiveHand) {
+		writeJSON(w, map[string]any{"chat": []storage.ChatLine{}})
+		return
+	}
+	if err != nil {
+		slog.Error("games: chat table of", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	lines, err := storage.Chat(tableID, 50)
+	if err != nil {
+		slog.Error("games: chat", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	for i := range lines {
+		lines[i].Mine = false // filled below; the DB does not know who is asking
+	}
+	name := s.displayName(r, user)
+	for i := range lines {
+		lines[i].Mine = lines[i].Name == name
+	}
+	writeJSON(w, map[string]any{"chat": lines})
+}
+
+// handleHoldemSay records a line of chat and fans it to the table. The line is
+// stamped with the hand it was said during — the one question chat at a money
+// table ever really raises — and pushed to every open stream so it lands on the
+// rail in real time.
+func (s *Server) handleTableSay(w http.ResponseWriter, r *http.Request) {
+	user, ok := s.player(w, r)
+	if !ok {
+		return
+	}
+	var req struct {
+		Body string `json:"body"`
+	}
+	if err := decodeJSON(r, &req); err != nil {
+		http.Error(w, "bad json", http.StatusBadRequest)
+		return
+	}
+	tableID, err := storage.TableOf(user)
+	if errors.Is(err, storage.ErrNoLiveHand) {
+		writeJSONStatus(w, http.StatusConflict, map[string]string{"error": "you're not at a table"})
+		return
+	}
+	if err != nil {
+		slog.Error("games: say table of", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	name := s.displayName(r, user)
+	line, err := storage.Say(tableID, user, name, req.Body)
+	if errors.Is(err, storage.ErrBadAmount) {
+		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "say something"})
+		return
+	}
+	if err != nil {
+		slog.Error("games: say", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	s.publishChat(tableID, line)
+	line.Mine = true
+	writeJSON(w, line)
+}
+
+// publishChat fans a chat line to everyone watching a table. Like publishTable it
+// is a non-blocking send after the database work is done — the line is already
+// saved, this only delivers it — so a slow subscriber costs itself a missed line
+// (which its next chat fetch recovers), never the lock.
+func (s *Server) publishChat(tableID string, line storage.ChatLine) {
+	if s.hub.watchers(tableID) == 0 {
+		return
+	}
+	data, err := json.Marshal(map[string]any{"type": "chat", "line": line})
+	if err != nil {
+		return
+	}
+	s.hub.publish(tableID, hubFrame{Data: data})
+}
+
+// ---- the abandoned-table reaper --------------------------------------------
+
+// runTableReaper cashes out tables that everyone has walked away from, on the
+// same slow timer as the session reaper. It is the seated-player counterpart to
+// that loop: a walked-away poker player's chips are inside a table blob, where
+// the session reaper (which reads the game_chips stack) cannot see them, so
+// without this they would sit in limbo until the player happened to come back.
+func (s *Server) runTableReaper(ctx context.Context) {
+	ticker := time.NewTicker(reaperInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			s.reapAbandonedTables()
+		}
+	}
+}
+
+// reapAbandonedTables finds the tables nobody is coming back to and closes each,
+// sending every seated human home with whatever is in front of them.
+func (s *Server) reapAbandonedTables() {
+	cutoff := time.Now().Unix() - int64(storage.SessionIdleAfter.Seconds())
+	refs, err := storage.AbandonedTables(cutoff)
+	if err != nil {
+		slog.Error("games: abandoned tables", "err", err)
+		return
+	}
+	for _, ref := range refs {
+		s.reapTable(ref)
+	}
+}
+
+// reapTable cashes out and closes one abandoned table, under its lock and only if
+// it is still the version the scan saw — so a player who wandered back to the
+// felt in the same instant keeps their seat and their chips.
+func (s *Server) reapTable(ref storage.TableRef) {
+	err := s.tableLocks.withTable(ref.ID, func() error {
+		t, seats, err := storage.LoadTable(ref.ID)
+		if errors.Is(err, storage.ErrNoSuchTable) {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		if t.Version != ref.Version {
+			return nil // somebody came back between the scan and here
+		}
+		game := s.games()[t.Game]
+		if game == nil {
+			slog.Error("games: reaper over unknown game", "game", t.Game, "table", t.ID)
+			return nil
+		}
+		stacks, err := game.stacks(t.State)
+		if err != nil {
+			return err
+		}
+		var humans []storage.ReapSeat
+		for _, seat := range seats {
+			if seat.MatrixUser == "" {
+				continue
+			}
+			amount := int64(0)
+			if seat.Seat >= 0 && seat.Seat < len(stacks) {
+				amount = stacks[seat.Seat]
+			}
+			humans = append(humans, storage.ReapSeat{
+				Seat: seat.Seat, MatrixUser: seat.MatrixUser, Amount: amount,
+			})
+		}
+		if err := storage.ReapTable(storage.Reap{TableID: t.ID, Version: t.Version, Humans: humans}); err != nil {
+			if errors.Is(err, storage.ErrStaleTable) {
+				return nil
+			}
+			return err
+		}
+		slog.Info("games: reaped abandoned table", "table", t.ID, "humans", len(humans))
+		return nil
+	})
+	if err != nil {
+		slog.Error("games: reap table", "table", ref.ID, "err", err)
+	}
+}

internal/web/games_uno.go

@@ -5,57 +5,58 @@ import (
 	"errors"
 	"log/slog"
 	"net/http"
+	"time"
 
 	"pete/internal/games/blackjack"
 	"pete/internal/games/uno"
 	"pete/internal/storage"
 )
 
-// UNO, played for chips against bots.
+// UNO, played for chips at a shared table.
 //
-// The seam is the same as every other table, but there is one thing here that no
-// other table has: opponents. The obvious way to give a browser opponents is a
-// socket, and the plan says solo UNO must not need one — so it doesn't. A move
-// goes up, and what comes back is the player's move *plus every bot turn it
-// handed off to*, as a script of events. One request, one round of the table.
+// Like hold'em, this is a session: you sit down with a stack, ante into a pot each
+// hand, and leave with what is in front of you. Chips cross the border twice —
+// sit-down and get-up — and every ante and pot in between moves inside the state
+// blob. Solo play is just a table nobody else has joined.
 //
-// What the browser is allowed to see: its own hand, the card in play, the colour
-// in play, and how many cards each bot is holding. Not the deck, not a bot's
-// hand, not even the face of a card a bot drew. That last one is most of the
-// deck, and it is the thing that would turn a game of counting cards into a game
-// of reading the network tab.
+// The seam is the same as hold'em: one request plays a human's move plus every
+// bot turn it hands off to, returned as a script the felt animates. What a viewer
+// is allowed to see is their own hand, the card and colour in play, the pot, and
+// how many cards each other seat holds — never the deck, another seat's hand, or
+// the face of a card a bot drew. The engine emits every seat's hand (a shared
+// stream cannot know who is watching); the redaction that keeps a hand private is
+// here, and a missed case fans it to every subscriber.
 
-// unoCardView is one card, ready to draw. The browser gets the colour and the
-// face as words, not as the engine's integers — the same bargain the blackjack
-// table makes, and for the same reason: the browser draws faces, not logic.
+// unoCardView is one card, ready to draw: colour and face as words, not the
+// engine's integers.
 type unoCardView struct {
-	Color string `json:"color"` // "red" | "blue" | "yellow" | "green" | "wild"
-	Value string `json:"value"` // "0"…"9" | "skip" | "reverse" | "+2" | "wild" | "+4"
-	Wild  bool   `json:"wild"`  // it's a wild, whatever colour it was played as
+	Color string `json:"color"`
+	Value string `json:"value"`
+	Wild  bool   `json:"wild"`
 }
 
 func viewUnoCard(c uno.Card) unoCardView {
-	return unoCardView{
-		Color: c.Color.String(),
-		Value: c.Value.String(),
-		Wild:  c.IsWild(),
-	}
+	return unoCardView{Color: c.Color.String(), Value: c.Value.String(), Wild: c.IsWild()}
 }
 
-// unoSeatView is one seat at the table: a name, and a number of cards. A bot's
-// cards are a *count*. There is no field here for what they are.
+// unoSeatView is one seat at the table: a name, a card count, and a stack. A
+// seat's cards are a *count* — there is no field here for what they are.
 type unoSeatView struct {
 	Name   string `json:"name"`
-	Cards  int    `json:"cards"`
+	Bot    bool   `json:"bot"`
 	You    bool   `json:"you"`
+	Cards  int    `json:"cards"`
+	Stack  int64  `json:"stack"`
+	Ante   int64  `json:"ante,omitempty"`
 	Uno    bool   `json:"uno"`    // down to one card
-	Called bool   `json:"called"` // …and said so. A seat where Uno is true and this isn't is a seat you can catch
-	Out    bool   `json:"out"`    // No Mercy: buried at twenty-five, and not coming back
+	Called bool   `json:"called"` // …and said so. Uno true and this false is a seat you can catch
+	Out    bool   `json:"out"`    // not in this hand — mercy-killed, or sitting one out
 }
 
-// unoView is a game as its player may see it.
+// unoView is a table as one seat may see it.
 type unoView struct {
 	Tier     uno.Tier      `json:"tier"`
+	YourSeat int           `json:"your_seat"`
 	Seats    []unoSeatView `json:"seats"`
 
 	Hand     []unoCardView `json:"hand"`     // yours, and only yours
@@ -64,138 +65,138 @@ type unoView struct {
 	Color    string        `json:"color"`    // the colour in play, which a wild renames
 	Deck     int           `json:"deck"`     // cards left to draw
 
-	// The UNO call. UnoAt is which of your cards would leave you holding exactly
-	// one if you played it — the table asks for the call on those, and it asks the
-	// engine which they are because No Mercy's "discard all" makes counting the
-	// hand the wrong answer. Catchable is which seats are sitting on one card they
-	// never announced.
-	UnoAt     []int `json:"uno_at"`
-	Catchable []int `json:"catchable"`
+	UnoAt     []int `json:"uno_at"`    // your cards that would leave you on one
+	Catchable []int `json:"catchable"` // seats sitting on one card they never called
 
 	Turn   int `json:"turn"`
 	Dir    int `json:"dir"`
+	Dealer int `json:"dealer"`
+	HandNo int `json:"hand_no"`
 
-	// No Mercy: the bill a stack of draw cards has run up. Whoever stops stacking
-	// pays it, and while it stands it is the only thing on the table that matters —
-	// so the felt has to be able to say what it is.
-	Pending int `json:"pending"`
+	Pending int `json:"pending"` // No Mercy: the bill a stack has run up
 
-	Bet     int64  `json:"bet"`
-	Pays    int64  `json:"pays"` // what going out right now would actually pay
+	Pot      int64  `json:"pot"`       // the antes riding on this hand
+	Ante     int64  `json:"ante"`      // what each seat puts in
+	Stack    int64  `json:"stack"`     // what's in front of you
+	BoughtIn int64  `json:"bought_in"` // your own buy-in, from the border ledger
 	Phase    string `json:"phase"`
-	Outcome string `json:"outcome,omitempty"`
+
+	// The last hand's verdict, so the felt can land it between hands.
 	Winner  int    `json:"winner"`
-	Payout  int64  `json:"payout,omitempty"`
+	LastPot int64  `json:"last_pot,omitempty"`
 	Rake    int64  `json:"rake,omitempty"`
-	Net     int64  `json:"net"`
+	Outcome string `json:"outcome,omitempty"`
 }
 
-func viewUno(g uno.State) unoView {
+// viewUno renders the table as one seat may see it. viewer is which seat is
+// looking — their hand is the only one it will ever put in the payload.
+//
+// This is the security boundary. The same view fans to every subscriber's stream,
+// so a seat that renders anyone else's cards fans them to the whole table.
+// TestUnoViewNeverLeaksAnotherSeatsCards renders every seat's view and greps for
+// cards that are not theirs.
+func viewUno(g uno.State, viewer int) unoView {
 	v := unoView{
 		Tier:     g.Tier,
+		YourSeat: viewer,
 		Top:      viewUnoCard(g.Top()),
 		Color:    g.Color.String(),
 		Deck:     g.Left(),
 		Turn:     g.Turn,
 		Dir:      g.Dir,
+		Dealer:   g.Dealer,
+		HandNo:   g.HandNo,
 		Pending:  g.Pending,
-		Bet:     g.Bet,
-		Pays:    g.Pays(),
+		Pot:      g.Pot,
+		Ante:     g.Tier.Ante,
+		BoughtIn: g.BoughtIn, // a table total; the caller overrides it with this seat's own stake
 		Phase:    string(g.Phase),
-		Outcome: string(g.Outcome),
-		Winner:  -1,
-		Payout:  g.Payout,
+		Winner:   g.Winner,
+		LastPot:  g.LastPot,
 		Rake:     g.Rake,
-		Net:     g.Net(),
+		Outcome:  string(g.Outcome),
 	}
-	// An empty hand is a seat that went out — *unless* the mercy rule took it, in
-	// which case an empty hand is a grave. Those two look identical from the count
-	// alone, which is why a buried seat is asked about rather than inferred.
-	for i, n := range g.Counts() {
+	if viewer >= 0 && viewer < len(g.Seats) {
+		v.Stack = g.Seats[viewer].Stack
+	}
+	counts := g.Counts()
+	for i := range g.Seats {
+		p := g.Seats[i]
 		live := g.Live(i)
 		seat := unoSeatView{
-			Cards: n, You: i == uno.You, Uno: live && n == 1, Out: !live,
+			Name:   p.Name,
+			Bot:    p.Bot,
+			You:    i == viewer,
+			Cards:  counts[i],
+			Stack:  p.Stack,
+			Ante:   p.Ante,
+			Uno:    live && counts[i] == 1,
 			Called: i < len(g.Called) && g.Called[i],
-		}
-		if i == uno.You {
-			seat.Name = "You"
-		} else if i-1 < len(g.Bots) {
-			seat.Name = g.Bots[i-1]
+			Out:    !live,
 		}
 		v.Seats = append(v.Seats, seat)
-		if live && n == 0 {
-			v.Winner = i
 	}
-	}
-	// And you can win a No Mercy table without ever going out: outlive it, and the
-	// last seat standing is you, with a hand still in it.
-	if v.Winner < 0 && g.Outcome.Won() {
-		v.Winner = uno.You
-	}
-	for _, c := range g.Hands[uno.You] {
+
+	// The wall. Only the viewer's own hand crosses the wire.
+	if viewer >= 0 && viewer < len(g.Hands) {
+		for _, c := range g.Hands[viewer] {
 			v.Hand = append(v.Hand, viewUnoCard(c))
 		}
-	v.Playable = g.Playable()
+	}
+	if v.Hand == nil {
+		v.Hand = []unoCardView{}
+	}
+	// Empty arrays, never null: the felt indexes into these.
+	v.Playable = g.Playable(viewer)
 	if v.Playable == nil {
 		v.Playable = []int{}
 	}
-	// Empty arrays, never null: the table indexes into these, and `null.indexOf`
-	// is a broken game rather than a quiet no-op.
-	v.UnoAt = g.UnoAt()
+	v.UnoAt = g.UnoAt(viewer)
 	if v.UnoAt == nil {
 		v.UnoAt = []int{}
 	}
-	v.Catchable = g.Catchable()
+	v.Catchable = g.Catchable(viewer)
 	if v.Catchable == nil {
 		v.Catchable = []int{}
 	}
 	return v
 }
 
-// unoEventView is one beat of the script the table plays back: a card going
-// down, a seat eating a +4, the turn coming round. The engine's own events carry
-// engine types, so they are re-rendered here rather than shipped raw — and this
-// is also the wall where a bot's drawn card is dropped on the floor.
+// unoEventView is one beat of the script the felt plays back. The engine attaches
+// every seat's hand and drawn cards; this is the wall where the ones the viewer
+// isn't entitled to are stripped.
 type unoEventView struct {
 	Kind  string        `json:"kind"`
 	Seat  int           `json:"seat"`
 	Card  *unoCardView  `json:"card,omitempty"`
 	Color string        `json:"color,omitempty"`
 	N     int           `json:"n,omitempty"`
-	Left  int          `json:"left"` // never omitempty: a seat that goes out leaves zero, and zero is the number the table has to draw
-	By    int          `json:"by"`   // who did the catching. Seat zero is you, and "you" is a real answer, so never omitempty either
+	Left  int           `json:"left"`
+	By    int           `json:"by"`
 	Text  string        `json:"text,omitempty"`
-
-	// Hand is your hand as it stands after this event, on the events that changed
-	// it. The table redraws your fan from this as the lap plays back — see the
-	// engine's Event.Hand for why. It is your own hand, so there is nothing here
-	// the browser wasn't already holding.
 	Hand  []unoCardView `json:"hand,omitempty"`
 }
 
-func viewUnoEvents(evs []uno.Event) []unoEventView {
+func viewUnoEvents(evs []uno.Event, viewer int) []unoEventView {
 	out := make([]unoEventView, 0, len(evs))
 	for _, e := range evs {
 		v := unoEventView{Kind: e.Kind, Seat: e.Seat, N: e.N, Left: e.Left, By: e.By, Text: e.Text}
 		if e.Color != uno.Wild {
 			v.Color = e.Color.String()
 		}
-		// The engine only stamps a hand on an event about seat zero. This is the belt
-		// to that brace: whatever the engine thinks it's doing, no hand but yours
-		// leaves this building.
-		if e.Seat == uno.You && e.Hand != nil {
+		// A hand rides an event only if it is the viewer's own. The engine stamps every
+		// seat's hand; this strips the rest.
+		if e.Seat == viewer && e.Hand != nil {
 			v.Hand = make([]unoCardView, 0, len(e.Hand))
 			for _, c := range e.Hand {
 				v.Hand = append(v.Hand, viewUnoCard(c))
 			}
 		}
+		// A card rides an event only if it is a card played face up, or one the viewer
+		// drew. A bot's (or another human's) drawn card never carries a face.
 		if e.Card != nil {
-			// The engine only ever attaches a card to an event the seat is entitled
-			// to see it in — a card played face up, or one *you* drew. This check is
-			// the belt to that pair of braces: a bot's draw never carries a face,
-			// whatever the engine thinks it's doing.
 			if e.Kind == uno.EvDraw || e.Kind == uno.EvForced {
-				if e.Seat == uno.You {
+				if e.Seat == viewer {
 					c := viewUnoCard(*e.Card)
 					v.Card = &c
 				}
@@ -209,52 +210,227 @@ func viewUnoEvents(evs []uno.Event) []unoEventView {
 	return out
 }
 
-// handleUnoStart takes the bet and deals. Same order as every other table: the
-// chips are staked first, in the same statement that checks they exist, so two
-// deals fired at once cannot bet the same chip.
-func (s *Server) handleUnoStart(w http.ResponseWriter, r *http.Request) {
+// ---- sitting down ----------------------------------------------------------
+
+// unoSeatRows mirrors the engine's seats into the storage rows that shadow them,
+// index for index. A human's staked is the buy-in that crossed the border; a
+// bot's is zero.
+func unoSeatRows(g uno.State, human string, buyIn int64) []storage.Seat {
+	rows := make([]storage.Seat, len(g.Seats))
+	for i := range g.Seats {
+		p := g.Seats[i]
+		row := storage.Seat{Seat: i, Name: p.Name}
+		if !p.Bot {
+			row.MatrixUser = human
+			row.Staked = buyIn
+		}
+		rows[i] = row
+	}
+	return rows
+}
+
+// handleUnoSit seats a player at a fresh table of their own or at an open chair on
+// somebody else's.
+func (s *Server) handleUnoSit(w http.ResponseWriter, r *http.Request) {
 	user, ok := s.player(w, r)
 	if !ok {
 		return
 	}
 	var req struct {
-		Bet  int64  `json:"bet"`
 		Tier  string `json:"tier"`
+		BuyIn int64  `json:"buyin"`
+		Table string `json:"table"`
+		Seat  *int   `json:"seat"`
 	}
-	if err := decodeJSON(r, &req); err != nil || req.Bet <= 0 {
-		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "bet something"})
+	if err := decodeJSON(r, &req); err != nil {
+		http.Error(w, "bad json", http.StatusBadRequest)
 		return
 	}
-	tier, err := uno.TierBySlug(req.Tier)
+	if req.Table != "" {
+		s.joinUno(w, r, user, req.Table, req.Seat, req.BuyIn)
+		return
+	}
+	s.openUno(w, r, user, req.Tier, req.BuyIn)
+}
+
+// openUno opens a fresh table with the player in seat zero and bots in the rest —
+// the old solo flow, now a real shared table with no other humans on it yet.
+func (s *Server) openUno(w http.ResponseWriter, r *http.Request, user, tierSlug string, buyIn int64) {
+	tier, err := uno.TierBySlug(tierSlug)
 	if err != nil {
 		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "pick a table"})
 		return
 	}
-
-	if err := storage.Stake(user, req.Bet); err != nil {
-		if errors.Is(err, storage.ErrInsufficientChips) || errors.Is(err, storage.ErrBadAmount) {
-			writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "not enough chips for that bet"})
-			return
-		}
-		slog.Error("games: uno stake", "user", user, "err", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
+	if buyIn < tier.MinBuy || buyIn > tier.MaxBuy {
+		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "that isn't a legal buy-in for this table"})
 		return
 	}
 
+	name := s.displayName(r, user)
 	seed1, seed2 := newSeeds()
-	g, evs, err := uno.New(req.Bet, tier, blackjack.DefaultRules().RakePct, seed1, seed2)
+	g, _, err := uno.New(tier, uno.TableSeats(tier, name, tier.Bots, buyIn), blackjack.DefaultRules().RakePct, seed1, seed2)
 	if err != nil {
-		// The game never happened, so the stake never should have left.
-		_ = storage.Award(user, req.Bet)
-		slog.Error("games: uno deal", "user", user, "err", err)
+		slog.Error("games: uno open", "user", user, "err", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	s.persistUno(w, user, g, evs, seed1, seed2, true)
+	blob, err := json.Marshal(g)
+	if err != nil {
+		slog.Error("games: marshal new uno", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	id, err := storage.NewTableID()
+	if err != nil {
+		slog.Error("games: mint table id", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
 	}
 
-// handleUnoMove plays one turn: a card, a draw, or passing on the card you drew.
-// The bots' turns come back with it.
+	t := storage.Table{
+		ID: id, Game: gameUno, Tier: tier.Slug, State: blob,
+		Seed1: seed1, Seed2: seed2, Phase: string(g.Phase), HandNo: int64(g.HandNo),
+	}
+	err = storage.OpenSoloTable(t, unoSeatRows(g, user, buyIn), buyIn)
+	switch {
+	case errors.Is(err, storage.ErrInsufficientChips), errors.Is(err, storage.ErrBadAmount):
+		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "not enough chips to sit down"})
+		return
+	case errors.Is(err, storage.ErrHandInProgress):
+		writeJSONStatus(w, http.StatusConflict, map[string]string{"error": "finish the game you're in first"})
+		return
+	case err != nil:
+		slog.Error("games: open solo uno table", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	s.writeUnoTable(w, user, nil)
+}
+
+// pickOpenUnoSeat chooses a chair to join: the one asked for if it is a bot's,
+// otherwise the first bot seat. Returns -1 if there is nowhere to sit.
+func pickOpenUnoSeat(g uno.State, want *int) int {
+	if want != nil {
+		i := *want
+		if i >= 0 && i < len(g.Seats) && g.Seats[i].Bot {
+			return i
+		}
+		return -1
+	}
+	for i := range g.Seats {
+		if g.Seats[i].Bot {
+			return i
+		}
+	}
+	return -1
+}
+
+// joinUno sits a player at an open chair on an existing table, one transaction
+// under the table lock, so two people racing for the last seat cannot both win it.
+func (s *Server) joinUno(w http.ResponseWriter, r *http.Request, user, tableID string, wantSeat *int, buyIn int64) {
+	name := s.displayName(r, user)
+	var respErr error
+	err := s.tableLocks.withTable(tableID, func() error {
+		t, _, err := storage.LoadTable(tableID)
+		if errors.Is(err, storage.ErrNoSuchTable) {
+			respErr = storage.ErrNoSuchTable
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		if t.Game != gameUno {
+			respErr = uno.ErrUnknownMove
+			return nil
+		}
+		var g uno.State
+		if err := json.Unmarshal(t.State, &g); err != nil {
+			return err
+		}
+		if unoPlaying(g) {
+			respErr = uno.ErrHandLive // you join between hands
+			return nil
+		}
+		seat := pickOpenUnoSeat(g, wantSeat)
+		if seat < 0 {
+			respErr = uno.ErrTableFull
+			return nil
+		}
+		if err := g.Occupy(seat, name, buyIn); err != nil {
+			respErr = err
+			return nil
+		}
+		blob, err := json.Marshal(g)
+		if err != nil {
+			return err
+		}
+		t.State, t.Phase, t.HandNo = blob, string(g.Phase), int64(g.HandNo)
+		err = storage.SitDown(storage.Sit{
+			Table: t,
+			Seat:  storage.Seat{Seat: seat, MatrixUser: user, Name: name, Staked: buyIn},
+			BuyIn: buyIn,
+		})
+		switch {
+		case errors.Is(err, storage.ErrInsufficientChips), errors.Is(err, storage.ErrBadAmount):
+			respErr = storage.ErrInsufficientChips
+			return nil
+		case errors.Is(err, storage.ErrHandInProgress):
+			respErr = storage.ErrHandInProgress
+			return nil
+		case errors.Is(err, storage.ErrSeatTaken), errors.Is(err, storage.ErrStaleTable):
+			respErr = storage.ErrSeatTaken
+			return nil
+		case err != nil:
+			return err
+		}
+		s.publishTable(tableID)
+		return nil
+	})
+	if err != nil {
+		slog.Error("games: join uno", "user", user, "table", tableID, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if respErr != nil {
+		writeJSONStatus(w, unoJoinStatus(respErr), map[string]string{"error": unoJoinMessage(respErr)})
+		return
+	}
+	s.writeUnoTable(w, user, nil)
+}
+
+func unoJoinStatus(err error) int {
+	switch {
+	case errors.Is(err, storage.ErrNoSuchTable), errors.Is(err, uno.ErrTableFull),
+		errors.Is(err, storage.ErrSeatTaken), errors.Is(err, uno.ErrHandLive):
+		return http.StatusConflict
+	default:
+		return http.StatusBadRequest
+	}
+}
+
+func unoJoinMessage(err error) string {
+	switch {
+	case errors.Is(err, storage.ErrNoSuchTable):
+		return "that table has closed"
+	case errors.Is(err, uno.ErrTableFull), errors.Is(err, storage.ErrSeatTaken):
+		return "that seat is taken"
+	case errors.Is(err, uno.ErrHandLive):
+		return "a hand is in play — sit down when it's over"
+	case errors.Is(err, uno.ErrBadBuyIn):
+		return "that isn't a legal buy-in for this table"
+	case errors.Is(err, storage.ErrInsufficientChips):
+		return "not enough chips to sit down"
+	case errors.Is(err, storage.ErrHandInProgress):
+		return "finish the game you're in first"
+	default:
+		return "you can't sit there"
+	}
+}
+
+// ---- playing a hand --------------------------------------------------------
+
+// handleUnoMove plays one move at the player's table: a hand move, or dealing the
+// next hand. Leaving is its own endpoint.
 func (s *Server) handleUnoMove(w http.ResponseWriter, r *http.Request) {
 	user, ok := s.player(w, r)
 	if !ok {
@@ -265,80 +441,237 @@ func (s *Server) handleUnoMove(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "bad json", http.StatusBadRequest)
 		return
 	}
+	if move.Kind == uno.MoveLeave {
+		s.leaveUno(w, user)
+		return
+	}
 
-	live, err := storage.LoadLiveHand(user)
+	tableID, seat, err := storage.PlayerSeat(user)
 	if errors.Is(err, storage.ErrNoLiveHand) {
-		writeJSONStatus(w, http.StatusConflict, map[string]string{"error": "no game in progress"})
+		writeJSONStatus(w, http.StatusConflict, map[string]string{"error": "you're not at a table"})
 		return
 	}
 	if err != nil {
-		slog.Error("games: uno load", "user", user, "err", err)
+		slog.Error("games: uno move seat", "user", user, "err", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	if live.Game != gameUno {
-		writeJSONStatus(w, http.StatusConflict, map[string]string{"error": "finish the game you're in first"})
-		return
+
+	var respErr error
+	var respEvents []uno.Event
+	err = s.tableLocks.withTable(tableID, func() error {
+		t, seats, err := storage.LoadTable(tableID)
+		if errors.Is(err, storage.ErrNoSuchTable) {
+			respErr = storage.ErrNoSuchTable
+			return nil
+		}
+		if err != nil {
+			return err
 		}
 		var g uno.State
-	if err := json.Unmarshal(live.State, &g); err != nil {
-		slog.Error("games: unreadable uno game", "user", user, "err", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
+		if err := json.Unmarshal(t.State, &g); err != nil {
+			return err
 		}
 
-	next, evs, err := uno.ApplyMove(g, move)
-	if err != nil {
-		// The refusals a player can actually cause, said in words rather than as
-		// "that move isn't legal here" — which, in a game with this many rules, is
-		// the table refusing to explain itself.
-		msg := "that move isn't legal here"
-		switch {
-		case errors.Is(err, uno.ErrCantPlay):
-			msg = "that card doesn't go on this one"
-		case errors.Is(err, uno.ErrNeedColor):
-			msg = "pick a colour for the wild"
-		case errors.Is(err, uno.ErrMustPlayNow):
-			msg = "play the card you drew, or pass"
-		case errors.Is(err, uno.ErrCantPass):
-			msg = "draw first, then you can pass"
-		case errors.Is(err, uno.ErrMustStack):
-			msg = "answer the stack with a draw card, or take it"
-		case errors.Is(err, uno.ErrNoStack):
-			msg = "there's nothing pointed at you to take"
-		case errors.Is(err, uno.ErrNoCatch):
-			msg = "there's nobody in that seat to catch"
-		}
-		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": msg})
-		return
-	}
-	s.persistUno(w, user, next, evs, live.Seed1, live.Seed2, false)
+		next, evs, aerr := uno.ApplyMove(g, seat, move)
+		if aerr != nil {
+			respErr = aerr
+			return nil
 		}
 
-// persistUno writes the game back and answers the browser.
-func (s *Server) persistUno(w http.ResponseWriter, user string, g uno.State, evs []uno.Event, seed1, seed2 uint64, fresh bool) {
-	blob, err := json.Marshal(g)
-	if err != nil {
-		slog.Error("games: marshal uno", "user", user, "err", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
+		// A solo session that just ended (the one human got up or busted at the deal)
+		// is not a table any more: cash the seat out and close the felt. Only a solo
+		// table reaches PhaseDone; a shared table plays on.
+		if next.Phase == uno.PhaseDone {
+			if err := s.settleUnoLeave(t, next, seat, user); err != nil {
+				if errors.Is(err, storage.ErrStaleTable) {
+					respErr = storage.ErrStaleTable
+					return nil
 				}
-	done := g.Phase == uno.PhaseDone
-	v, ok := s.commit(w, user, finished{
-		Game: gameUno, Blob: blob,
-		Bet: g.Bet, Payout: g.Payout, Rake: g.Rake,
-		Outcome: string(g.Outcome), Done: done,
-		Seed1: seed1, Seed2: seed2, Fresh: fresh,
+				return err
+			}
+			respEvents = evs
+			s.publishTable(tableID)
+			return nil
+		}
+
+		st, err := unoStep(next, evs, seats)
+		if err != nil {
+			return err
+		}
+		acting := seats[seat]
+		acting.Away = false
+		acting.LastSeen = time.Now().Unix()
+
+		t.State, t.Phase, t.HandNo, t.Deadline = st.State, st.Phase, st.HandNo, st.Deadline
+		if err := storage.CommitTable(storage.TableCommit{
+			Table: t, Seats: []storage.Seat{acting}, Audit: st.Audit,
+		}); err != nil {
+			if errors.Is(err, storage.ErrStaleTable) {
+				respErr = storage.ErrStaleTable
+				return nil
+			}
+			return err
+		}
+		respEvents = evs
+		s.publishTable(tableID)
+		return nil
 	})
+	if err != nil {
+		slog.Error("games: uno move", "user", user, "table", tableID, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if respErr != nil {
+		writeJSONStatus(w, unoMoveStatus(respErr), map[string]string{"error": unoMoveMessage(respErr)})
+		return
+	}
+	s.writeUnoTable(w, user, respEvents)
+}
+
+func unoMoveStatus(err error) int {
+	switch {
+	case errors.Is(err, storage.ErrStaleTable), errors.Is(err, storage.ErrNoSuchTable):
+		return http.StatusConflict
+	default:
+		return http.StatusBadRequest
+	}
+}
+
+func unoMoveMessage(err error) string {
+	switch {
+	case errors.Is(err, storage.ErrStaleTable):
+		return "the table moved on — take another look"
+	case errors.Is(err, storage.ErrNoSuchTable):
+		return "that table has closed"
+	case errors.Is(err, uno.ErrHandLive):
+		return "finish the hand first"
+	case errors.Is(err, uno.ErrNoHand):
+		return "there's no hand in play — deal one"
+	case errors.Is(err, uno.ErrNotYourTurn):
+		return "it isn't your turn"
+	case errors.Is(err, uno.ErrCantPlay):
+		return "that card doesn't go on this one"
+	case errors.Is(err, uno.ErrNeedColor):
+		return "pick a colour for the wild"
+	case errors.Is(err, uno.ErrMustPlayNow):
+		return "play the card you drew, or pass"
+	case errors.Is(err, uno.ErrCantPass):
+		return "draw first, then you can pass"
+	case errors.Is(err, uno.ErrMustStack):
+		return "answer the stack with a draw card, or take it"
+	case errors.Is(err, uno.ErrNoStack):
+		return "there's nothing pointed at you to take"
+	case errors.Is(err, uno.ErrNoCatch):
+		return "there's nobody in that seat to catch"
+	default:
+		return "that move isn't legal here"
+	}
+}
+
+// ---- getting up ------------------------------------------------------------
+
+// handleUnoLeave is the get-up endpoint. Leaving is its own route because it is a
+// storage operation, not an engine move — the chips cross the border and the felt
+// may close.
+func (s *Server) handleUnoLeave(w http.ResponseWriter, r *http.Request) {
+	user, ok := s.player(w, r)
 	if !ok {
 		return
 	}
-	// A finished game is gone from storage, so the table has none to show — but the
-	// browser still needs the final board to land the verdict on.
-	if done {
-		uv := viewUno(g)
-		v.Uno = &uv
+	s.leaveUno(w, user)
+}
+
+// leaveUno gets a player up from their table, turning what is in front of them
+// back into chips. It refuses mid-hand and closes the felt behind the last human.
+func (s *Server) leaveUno(w http.ResponseWriter, user string) {
+	tableID, seat, err := storage.PlayerSeat(user)
+	if errors.Is(err, storage.ErrNoLiveHand) {
+		writeJSONStatus(w, http.StatusConflict, map[string]string{"error": "you're not at a table"})
+		return
+	}
+	if err != nil {
+		slog.Error("games: uno leave seat", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+
+	var respErr error
+	err = s.tableLocks.withTable(tableID, func() error {
+		t, _, err := storage.LoadTable(tableID)
+		if errors.Is(err, storage.ErrNoSuchTable) {
+			respErr = storage.ErrNoSuchTable
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		var g uno.State
+		if err := json.Unmarshal(t.State, &g); err != nil {
+			return err
+		}
+		if unoPlaying(g) {
+			respErr = uno.ErrHandLive
+			return nil
+		}
+		if err := s.settleUnoLeave(t, g, seat, user); err != nil {
+			if errors.Is(err, storage.ErrStaleTable) {
+				respErr = storage.ErrStaleTable
+				return nil
+			}
+			return err
+		}
+		s.publishTable(tableID)
+		return nil
+	})
+	if err != nil {
+		slog.Error("games: uno leave", "user", user, "table", tableID, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if respErr != nil {
+		writeJSONStatus(w, unoMoveStatus(respErr), map[string]string{"error": unoMoveMessage(respErr)})
+		return
+	}
+	s.writeUnoTable(w, user, nil)
+}
+
+// settleUnoLeave vacates a seat, credits the stack home, and closes the table if
+// nobody human is left — all inside the caller's lock.
+func (s *Server) settleUnoLeave(t storage.Table, g uno.State, seat int, user string) error {
+	home, err := g.Vacate(seat)
+	if err != nil {
+		return err
+	}
+	blob, err := json.Marshal(g)
+	if err != nil {
+		return err
+	}
+	t.State, t.Phase, t.HandNo, t.Deadline = blob, string(g.Phase), int64(g.HandNo), 0
+	if err := storage.LeaveTable(storage.Leave{
+		Table: t, Seat: seat, MatrixUser: user, Bot: g.Seats[seat].Name, Amount: home,
+	}); err != nil {
+		return err
+	}
+	return storage.CloseTable(t.ID)
+}
+
+// ---- the response ----------------------------------------------------------
+
+// writeUnoTable answers with the whole page state — the money and the table as the
+// player's own seat may see it — plus, when a move produced one, the redacted event
+// script for that seat to animate.
+func (s *Server) writeUnoTable(w http.ResponseWriter, user string, evs []uno.Event) {
+	v, err := s.table(user)
+	if err != nil {
+		slog.Error("games: uno table", "user", user, "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if len(evs) > 0 {
+		if _, seat, serr := storage.PlayerSeat(user); serr == nil {
+			v.UnoEvents = viewUnoEvents(evs, seat)
+		}
 	}
-	v.UnoEvents = viewUnoEvents(evs)
 	writeJSON(w, v)
 }

internal/web/games_uno_table.go

@@ -0,0 +1,187 @@
+package web
+
+import (
+	"encoding/json"
+	"time"
+
+	"pete/internal/games/uno"
+	"pete/internal/storage"
+)
+
+// UNO as a shared table: the seam the runtime drives it through, and the two
+// facts about a hand only the engine can tell the runtime — when the clock must
+// next act, and what a finished hand owes the audit trail.
+//
+// Everything about *playing* UNO is still in the engine. This file is the
+// translation layer between a uno.State and the game-agnostic table runtime.
+
+// unoTable is the tableGame for UNO. It holds no state — the table's state is the
+// blob in game_tables — so a single value serves every felt in the room.
+type unoTable struct{}
+
+func (unoTable) name() string { return gameUno }
+
+// timeout plays a passive move for the human whose clock ran out and marks them
+// away, so the runtime auto-acts them on sight after this rather than waiting a
+// full clock every orbit. The move is the gentlest one that still advances the
+// turn: give in to a stack, pass a drawn card (or play it where the rules force
+// it), otherwise play a legal card if there is one, or draw.
+//
+// If, on decode, the seat to act is not a waiting human, the scan raced a real
+// move that had not yet bumped the version: errNotDue, and the clock steps aside.
+func (unoTable) timeout(state []byte, seats []storage.Seat) (step, []storage.Seat, error) {
+	var g uno.State
+	if err := json.Unmarshal(state, &g); err != nil {
+		return step{}, nil, err
+	}
+	if !unoPlaying(g) {
+		return step{}, seats, errNotDue
+	}
+	seat := g.Turn
+	if seat < 0 || seat >= len(g.Seats) || g.Seats[seat].Bot {
+		return step{}, seats, errNotDue
+	}
+
+	move := unoIdleMove(g, seat)
+	next, evs, err := uno.ApplyMove(g, seat, move)
+	if err != nil {
+		return step{}, nil, err
+	}
+
+	changed := markAway(seats, seat)
+	st, err := unoStep(next, evs, seats)
+	return st, changed, err
+}
+
+// unoIdleMove is the move the clock makes for a walked-away seat: the most passive
+// legal one that still hands the turn on.
+func unoIdleMove(g uno.State, seat int) uno.Move {
+	switch g.Phase {
+	case uno.PhaseStack:
+		return uno.Move{Kind: uno.MoveTake}
+	case uno.PhaseDrawn:
+		if g.Tier.NoMercy {
+			// No Mercy makes you play the card you drew; it is the last in the hand.
+			return uno.Move{Kind: uno.MovePlay, Index: len(g.Hands[seat]) - 1, Color: uno.Red}
+		}
+		return uno.Move{Kind: uno.MovePass}
+	default:
+		if p := g.Playable(seat); len(p) > 0 {
+			return uno.Move{Kind: uno.MovePlay, Index: p[0], Color: uno.Red}
+		}
+		return uno.Move{Kind: uno.MoveDraw}
+	}
+}
+
+// stacks reports the chips in front of each seat, index-aligned with the table's
+// seat rows, so the abandoned-table reaper can cash out a walked-away human.
+func (unoTable) stacks(state []byte) ([]int64, error) {
+	var g uno.State
+	if err := json.Unmarshal(state, &g); err != nil {
+		return nil, err
+	}
+	out := make([]int64, len(g.Seats))
+	for i := range g.Seats {
+		out[i] = g.Seats[i].Stack
+	}
+	return out, nil
+}
+
+// unoStep packages a played-out state for the runtime: the blob to persist, the
+// deadline the clock must honour next, and the audit of any hand that just ended.
+func unoStep(next uno.State, evs []uno.Event, seats []storage.Seat) (step, error) {
+	blob, err := json.Marshal(next)
+	if err != nil {
+		return step{}, err
+	}
+	st := step{
+		State:    blob,
+		Phase:    string(next.Phase),
+		HandNo:   int64(next.HandNo),
+		Deadline: unoDeadline(next, seats),
+		Audit:    unoAudit(next, evs, seats),
+	}
+	return st, nil
+}
+
+// unoPlaying reports whether a hand is in progress — the only phase a turn clock
+// has anything to do in.
+func unoPlaying(g uno.State) bool {
+	switch g.Phase {
+	case uno.PhasePlay, uno.PhaseDrawn, uno.PhaseStack:
+		return true
+	}
+	return false
+}
+
+// unoDeadline is when the clock must next act, or 0 for never. A clock is only set
+// on a *present* human whose turn it is: a bot resolves inside the move, an away
+// human is auto-acted on sight, and between hands there is no per-seat clock —
+// dealing the next hand is a seated player's call, and an abandoned table is the
+// reaper's job.
+func unoDeadline(g uno.State, seats []storage.Seat) int64 {
+	if !unoPlaying(g) {
+		return 0
+	}
+	seat := g.Turn
+	if seat < 0 || seat >= len(g.Seats) || g.Seats[seat].Bot {
+		return 0
+	}
+	if seatAway(seats, seat) {
+		return 0
+	}
+	return time.Now().Unix() + turnSeconds
+}
+
+// unoAudit is the per-hand record of a finished hand — one row per human who was
+// in it. Empty until a hand actually ends, which is exactly when a settle beat is
+// emitted.
+//
+// The rake rides on the winner's row alone, and every other seat carries zero, so
+// game_hands.rake (which HouseTake sums) records a pot's rake once and once only.
+// A seat's ante is its bet; a refunded tie pays each seat its ante straight back.
+func unoAudit(g uno.State, evs []uno.Event, seats []storage.Seat) []storage.Hand {
+	if !unoHandEnded(evs) {
+		return nil
+	}
+	var audit []storage.Hand
+	for i := range g.Seats {
+		p := g.Seats[i]
+		if p.Bot || i >= len(seats) || seats[i].MatrixUser == "" {
+			continue
+		}
+		if p.Ante == 0 {
+			continue // sat this hand out — nothing to record
+		}
+		outcome, payout, rake := "lost", int64(0), int64(0)
+		switch {
+		case i == g.Winner:
+			outcome, payout, rake = "won", p.Won, g.Rake
+		case g.Outcome == uno.OutcomeTie:
+			outcome, payout = "push", p.Ante // the ante came straight back
+		}
+		audit = append(audit, storage.Hand{
+			MatrixUser: seats[i].MatrixUser,
+			Game:       gameUno,
+			Bet:        p.Ante,
+			Payout:     payout,
+			Rake:       rake,
+			Outcome:    outcome,
+			Seed1:      g.Seed1,
+			Seed2:      g.Seed2,
+		})
+	}
+	return audit
+}
+
+// unoHandEnded reports whether a hand finished in this batch of events. A settle
+// beat is emitted exactly once, when a hand ends, so it is the clean signal that
+// the seats' Ante/Won are this hand's final numbers.
+func unoHandEnded(evs []uno.Event) bool {
+	for _, e := range evs {
+		if e.Kind == uno.EvSettle {
+			return true
+		}
+	}
+	return false
+}

internal/web/games_uno_test.go

@@ -4,57 +4,54 @@ import (
 	"testing"
 
 	"pete/internal/games/uno"
-	"pete/internal/storage"
 )
 
-// The one thing this table cannot get wrong: the stake leaves the stack, and no
-// card a player is not entitled to see leaves the server. At UNO that is not one
-// hole card — it is the deck and every bot's hand, which is most of the game.
-func TestUnoStartTakesTheStakeAndKeepsTheCards(t *testing.T) {
+// Sitting down is the only time chips leave your stack at this table, and getting
+// up is the only time they come back. The ante and the pot move inside the engine.
+func TestUnoSitTakesTheBuyIn(t *testing.T) {
 	s := newCasino(t)
-	fund(t, 1000)
+	fund(t, 5000)
 
-	v, code := call(t, s, s.handleUnoStart, as(t, s, "reala", "POST", "/api/games/uno/start",
-		map[string]any{"bet": 100, "tier": "full"}))
+	v, code := call(t, s, s.handleUnoSit, as(t, s, "reala", "POST", "/api/games/uno/sit",
+		map[string]any{"tier": "full", "buyin": 1000}))
 	if code != 200 {
-		t.Fatalf("start = %d, want 200", code)
+		t.Fatalf("sit = %d, want 200", code)
 	}
-	if v.Chips != 900 {
-		t.Fatalf("chips after a 100 bet = %d, want 900", v.Chips)
+	if v.Chips != 4000 {
+		t.Fatalf("chips after a 1000 buy-in = %d, want 4000", v.Chips)
 	}
 	if v.Game != gameUno || v.Uno == nil {
-		t.Fatalf("start returned no uno game: game=%q", v.Game)
+		t.Fatalf("sit returned no table: game=%q", v.Game)
 	}
-
 	g := v.Uno
-	if len(g.Hand) != uno.HandSize {
-		t.Errorf("you were dealt %d cards, want %d", len(g.Hand), uno.HandSize)
+	if g.Stack != 1000 {
+		t.Errorf("you sat down with %d, want the 1000 you bought in for", g.Stack)
 	}
 	if len(g.Seats) != 4 {
-		t.Fatalf("a full house is four seats, got %d", len(g.Seats))
+		t.Fatalf("three bots and you is four seats, got %d", len(g.Seats))
 	}
-	// A bot is a name and a number. There is no field here that could carry a
-	// card, which is the point — this is a compile-time guarantee, and the test
-	// exists to make deleting it loud.
-	for i, seat := range g.Seats {
-		if i == 0 {
-			if !seat.You || seat.Name != "You" {
-				t.Errorf("seat 0 should be you: %+v", seat)
+	if g.Phase != "handover" {
+		t.Errorf("phase %q — a table you just sat at has no hand on it yet", g.Phase)
 	}
-			continue
+
+	// Deal a hand: chips do not move (the ante is within the blob), and you are dealt
+	// seven cards and to act.
+	deal, code := call(t, s, s.handleUnoMove, as(t, s, "reala", "POST", "/api/games/uno/move",
+		map[string]any{"kind": "deal"}))
+	if code != 200 {
+		t.Fatalf("deal = %d, want 200", code)
 	}
-		if seat.You || seat.Name == "" {
-			t.Errorf("seat %d should be a named bot: %+v", i, seat)
+	if deal.Chips != 4000 {
+		t.Errorf("chips moved on the deal: %d, want 4000 — the ante is inside the engine", deal.Chips)
 	}
-		if seat.Cards != uno.HandSize {
-			t.Errorf("seat %d holds %d cards, want %d", i, seat.Cards, uno.HandSize)
+	if deal.Uno == nil || len(deal.Uno.Hand) != uno.HandSize {
+		t.Fatalf("you were dealt the wrong hand: %+v", deal.Uno)
 	}
+	if deal.Uno.Turn != 0 {
+		t.Errorf("you act first at your own table, turn is %d", deal.Uno.Turn)
 	}
-	if g.Top.Value == "" {
-		t.Error("no card in play")
-	}
-	if g.Turn != 0 {
-		t.Errorf("you play first, turn is %d", g.Turn)
+	if deal.Uno.Pot != deal.Uno.Ante*int64(len(deal.Uno.Seats)) {
+		t.Errorf("pot is %d, want one ante per seat", deal.Uno.Pot)
 	}
 }
 
@@ -62,16 +59,16 @@ func TestUnoStartTakesTheStakeAndKeepsTheCards(t *testing.T) {
 // back never carries a bot's drawn card.
 func TestUnoMovePlaysTheWholeLap(t *testing.T) {
 	s := newCasino(t)
-	fund(t, 1000)
+	fund(t, 5000)
 
-	v, _ := call(t, s, s.handleUnoStart, as(t, s, "reala", "POST", "/api/games/uno/start",
-		map[string]any{"bet": 100, "tier": "table"}))
-	if v.Uno == nil {
-		t.Fatal("no game")
+	call(t, s, s.handleUnoSit, as(t, s, "reala", "POST", "/api/games/uno/sit",
+		map[string]any{"tier": "table", "buyin": 1000}))
+	deal, code := call(t, s, s.handleUnoMove, as(t, s, "reala", "POST", "/api/games/uno/move",
+		map[string]any{"kind": "deal"}))
+	if code != 200 || deal.Uno == nil {
+		t.Fatalf("deal = %d", code)
 	}
 
-	// Draw, which is legal from any hand: the turn passes to the bots and comes
-	// back, unless the card drawn happens to be playable.
 	v, code := call(t, s, s.handleUnoMove, as(t, s, "reala", "POST", "/api/games/uno/move",
 		map[string]any{"kind": "draw"}))
 	if code != 200 {
@@ -93,110 +90,144 @@ func TestUnoMovePlaysTheWholeLap(t *testing.T) {
 	}
 }
 
-// You cannot play a wild without naming a colour — and the zero value of the
-// colour field is not red, so a move that simply omits it is refused rather than
-// quietly played as one.
-func TestUnoWildWithNoColourIsRefused(t *testing.T) {
-	s := newCasino(t)
-	fund(t, 1000)
-
-	// Deal until a wild lands in the opening hand: it's four cards in 108, so it
-	// doesn't take long, and this is the only way to get one without rigging the
-	// deck through a door the server doesn't have.
-	var wild = -1
-	for try := 0; try < 40 && wild < 0; try++ {
-		v, _ := call(t, s, s.handleUnoStart, as(t, s, "reala", "POST", "/api/games/uno/start",
-			map[string]any{"bet": 10, "tier": "duel"}))
-		if v.Uno == nil {
-			t.Fatal("no game")
+// TestUnoViewNeverLeaksAnotherSeatsCards is the security boundary of the whole
+// multiplayer table. There is no showdown in UNO, so the rule is absolute: no
+// seat's hand, and no card a seat drew, ever reaches another viewer. Rendered for
+// every seat, after every step of a hand played to its end.
+//
+// After SSE the view a seat renders fans to that seat's stream, so a single missed
+// redaction broadcasts a hand to the whole felt. The engine emits every seat's
+// cards (it cannot know who a shared stream is for), which makes viewUno and
+// viewUnoEvents the only thing between the deck and the network tab.
+func TestUnoViewNeverLeaksAnotherSeatsCards(t *testing.T) {
+	tier, _ := uno.TierBySlug("full")
+	// Two humans (0, 2) and two bots (1, 3), so the test covers a viewer seeing both
+	// another human and a bot, and a human at a non-zero index.
+	seats := []uno.SeatConfig{
+		{Name: "Ana", Stack: 2000},
+		{Name: "Bot A", Bot: true, Stack: 2000},
+		{Name: "Bo", Stack: 2000},
+		{Name: "Bot B", Bot: true, Stack: 2000},
 	}
-		for i, c := range v.Uno.Hand {
-			if c.Wild {
-				wild = i
-				break
-			}
-		}
-		if wild < 0 {
-			// Abandon this deal and take another. The live row is keyed on the
-			// player, so it has to go before the next start can be seated.
-			if err := storage.ClearLiveHand(testPlayer); err != nil {
+	g, _, err := uno.New(tier, seats, tier.RakePct, 5, 6)
+	if err != nil {
 		t.Fatal(err)
 	}
+	g, evs, err := uno.ApplyMove(g, 0, uno.Move{Kind: uno.MoveDeal})
+	if err != nil {
+		t.Fatal(err)
 	}
-	}
-	if wild < 0 {
-		t.Skip("40 deals and not one wild — vanishingly unlikely, but not a failure")
-	}
+	assertUnoRedacted(t, g, evs)
 
-	_, code := call(t, s, s.handleUnoMove, as(t, s, "reala", "POST", "/api/games/uno/move",
-		map[string]any{"kind": "play", "index": wild}))
-	if code != 400 {
-		t.Fatalf("a wild with no colour = %d, want 400", code)
+	for step := 0; unoPlaying(g) && step < 200; step++ {
+		seat := g.Turn
+		if g.Seats[seat].Bot {
+			t.Fatalf("advance stopped on a bot at seat %d", seat)
 		}
-
-	v, code := call(t, s, s.handleUnoMove, as(t, s, "reala", "POST", "/api/games/uno/move",
-		map[string]any{"kind": "play", "index": wild, "color": int(uno.Green)}))
-	if code != 200 {
-		t.Fatalf("a wild played as green = %d, want 200", code)
+		move := unoHumanMove(g, seat)
+		var stepEvs []uno.Event
+		g, stepEvs, err = uno.ApplyMove(g, seat, move)
+		if err != nil {
+			t.Fatalf("seat %d %s: %v", seat, move.Kind, err)
 		}
-	if v.Uno != nil && v.Uno.Phase != "done" && v.Uno.Color != "green" && v.Uno.Color != "" {
-		// The bots have played since, so the colour may have moved on — what must
-		// not happen is the wild going down as anything we didn't ask for.
-		t.Logf("colour in play after the bots: %s", v.Uno.Color)
+		assertUnoRedacted(t, g, stepEvs)
 	}
 }
 
-// A seat the mercy rule has buried holds no cards. So does a seat that has just
-// gone out and won. The view has to tell them apart, because everything it says
-// afterwards hangs off it: who won, whose fan of cards to rub out, and whether the
-// player is looking at a payout or a grave.
-//
-// This is the whole reason the view asks the engine (Live) instead of inferring it
-// from a count of zero.
-func TestABuriedSeatIsNotTheWinner(t *testing.T) {
-	g, _, err := uno.New(100, mustTier(t, "nm-full"), 0.05, 7, 9)
+// unoHumanMove picks a legal move for the human to act: play a legal card, take a
+// stack you can't answer, pass a drawn card, otherwise draw.
+func unoHumanMove(g uno.State, seat int) uno.Move {
+	if p := g.Playable(seat); len(p) > 0 {
+		m := uno.Move{Kind: uno.MovePlay, Index: p[0], Color: uno.Red}
+		for _, at := range g.UnoAt(seat) {
+			if at == p[0] {
+				m.Uno = true
+			}
+		}
+		return m
+	}
+	switch g.Phase {
+	case uno.PhaseStack:
+		return uno.Move{Kind: uno.MoveTake}
+	case uno.PhaseDrawn:
+		return uno.Move{Kind: uno.MovePass}
+	default:
+		return uno.Move{Kind: uno.MoveDraw}
+	}
+}
+
+// assertUnoRedacted renders every seat's view and event script and fails if any of
+// them carries a card belonging to another seat.
+func assertUnoRedacted(t *testing.T, g uno.State, evs []uno.Event) {
+	t.Helper()
+	for viewer := range g.Seats {
+		v := viewUno(g, viewer)
+		// The view's hand is the viewer's own, exactly — no more, no fewer.
+		if len(v.Hand) != len(g.Hands[viewer]) {
+			t.Fatalf("seat %d's view carries %d cards, but the seat holds %d",
+				viewer, len(v.Hand), len(g.Hands[viewer]))
+		}
+		// The event script: a hand rides only the viewer's own beat, and a drawn card
+		// only the viewer's own draw. (A card a bot plays is public — it lands on the
+		// pile — so only a *drawn* card is a secret, which is why this is scoped to the
+		// draw and forced beats.) Undo either guard in viewUnoEvents and this fails.
+		for _, e := range viewUnoEvents(evs, viewer) {
+			if len(e.Hand) > 0 && e.Seat != viewer {
+				t.Fatalf("seat %d's event stream carries seat %d's hand", viewer, e.Seat)
+			}
+			if e.Card != nil && (e.Kind == uno.EvDraw || e.Kind == uno.EvForced) && e.Seat != viewer {
+				t.Fatalf("seat %d's event stream carries seat %d's drawn card", viewer, e.Seat)
+			}
+		}
+	}
+}
+
+// A seat the mercy rule has buried holds no cards; so does one that just went out.
+// The view tells them apart by asking the engine (Live), not by inferring from a
+// count of zero.
+func TestABuriedSeatIsRenderedOut(t *testing.T) {
+	tier, _ := uno.TierBySlug("nm-full")
+	g, _, err := uno.New(tier, uno.SoloSeats(tier, tier.Bots, 1000), 0.05, 7, 9)
+	if err != nil {
+		t.Fatal(err)
+	}
+	g, _, err = uno.ApplyMove(g, 0, uno.Move{Kind: uno.MoveDeal})
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	// Bury seat 2, the way the engine does: no cards, and out.
+	// Bury seat 2 the way the engine does: no cards, and out.
 	g.Hands[2] = nil
 	g.Out[2] = true
 
-	v := viewUno(g)
+	v := viewUno(g, 0)
 	if !v.Seats[2].Out {
 		t.Error("a buried seat must say so; the felt draws it as a grave")
 	}
 	if v.Seats[2].Uno {
 		t.Error("a buried seat is not one card away from going out")
 	}
-	if v.Winner == 2 {
-		t.Fatal("the buried seat was reported as the winner — an empty hand is not a win")
-	}
 	if v.Winner != -1 {
-		t.Errorf("nobody has gone out yet, so there is no winner: got %d", v.Winner)
-	}
-
-	// And the other ending only this deck has: you win by outliving the table, with
-	// a hand still in front of you.
-	g.Phase, g.Outcome, g.Payout = uno.PhaseDone, uno.OutcomeWon, g.Pays()
-	if v := viewUno(g); v.Winner != uno.You {
-		t.Errorf("you outlived the table; winner = %d, want you (%d)", v.Winner, uno.You)
+		t.Errorf("nobody has taken the pot mid-hand, so there is no winner: got %d", v.Winner)
 	}
 }
 
 // The bill a stack has run up is the only thing on the table while it stands, so it
-// has to reach the browser. It is a No Mercy field on a struct the normal game
-// shares, which is exactly the kind of field that quietly never gets copied across.
+// has to reach the browser.
 func TestTheStackBillCrossesTheWire(t *testing.T) {
-	g, _, err := uno.New(100, mustTier(t, "nm-duel"), 0.05, 3, 4)
+	tier, _ := uno.TierBySlug("nm-duel")
+	g, _, err := uno.New(tier, uno.SoloSeats(tier, tier.Bots, 1000), 0.05, 3, 4)
+	if err != nil {
+		t.Fatal(err)
+	}
+	g, _, err = uno.ApplyMove(g, 0, uno.Move{Kind: uno.MoveDeal})
 	if err != nil {
 		t.Fatal(err)
 	}
 	g.Pending = 6
 	g.Phase = uno.PhaseStack
 
-	v := viewUno(g)
+	v := viewUno(g, 0)
 	if v.Pending != 6 {
 		t.Errorf("the felt was told the bill is %d, want 6", v.Pending)
 	}
@@ -204,12 +235,3 @@ func TestTheStackBillCrossesTheWire(t *testing.T) {
 		t.Errorf("phase = %q, want %q", v.Phase, uno.PhaseStack)
 	}
 }
-
-func mustTier(t *testing.T, slug string) uno.Tier {
-	t.Helper()
-	tier, err := uno.TierBySlug(slug)
-	if err != nil {
-		t.Fatalf("no tier %q: %v", slug, err)
-	}
-	return tier
-}

internal/web/mischief.go

@@ -0,0 +1,262 @@
+package web
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"log/slog"
+	"net/http"
+	"strings"
+	"time"
+
+	"pete/internal/storage"
+)
+
+// buyerLocalpart normalises a session's Authentik username to the Matrix
+// localpart gogobee keys everything on. Matrix localparts are lowercase; an
+// Authentik display of the same name may not be, and gogobee pushes balances and
+// resolves orders under the lowercase form. Lowercasing on both sides is what
+// keeps the buyer's balance lookup and their order's identity pointing at the
+// same person.
+func buyerLocalpart(u *SessionUser) string {
+	return strings.ToLower(strings.TrimSpace(u.Username))
+}
+
+// The mischief storefront's web seam.
+//
+// Two audiences, two auth models, same file. Browsers hit the OIDC-gated buy
+// endpoints: a signed-in buyer picks a mark off the anonymous board and places a
+// hit, and reads back their own orders' standing. gogobee hits the bearer-authed
+// pair: it polls pending orders and pushes a verdict, exactly like the escrow
+// seam in games.go and under the same standing rule — Pete never calls gogobee,
+// never moves money, never runs a game rule. It records intent and files a
+// verdict; everything real happens on the game box.
+
+// mischiefBurstWindow / mischiefBurstMax are Pete's own anti-spam guard, and
+// nothing more. The real economic caps — two contracts a day, one live per mark,
+// a boss a week — are gogobee's and are enforced at claim time. This only stops a
+// signed-in buyer from spooling the orders table with a stuck mouse button.
+const (
+	mischiefBurstWindow = time.Hour
+	mischiefBurstMax    = 20
+)
+
+// mischiefOrderReq is the browser's buy request. Price and eligibility are not
+// the buyer's to assert: they send a tier key and a mark, never a number.
+type mischiefOrderReq struct {
+	TargetToken string `json:"target_token"`
+	Tier        string `json:"tier"`
+	Signed      bool   `json:"signed"`
+}
+
+// handleMischiefOrder places a pending order for the signed-in buyer. It asserts
+// only what Pete can honestly know: the buyer is signed in with a username the
+// game box can resolve, the tier is one gogobee currently offers, and the mark is
+// actually on the live board. Money and the full rulebook are gogobee's, checked
+// when it claims the order.
+func (s *Server) handleMischiefOrder(w http.ResponseWriter, r *http.Request) {
+	u := s.requireUser(w, r)
+	if u == nil {
+		return
+	}
+	// A session minted before the storefront existed carries no username, and
+	// without one gogobee can't name the buyer to its ledger. Send them back
+	// through sign-in to mint a fresh one rather than place an unfulfillable order.
+	buyer := buyerLocalpart(u)
+	if buyer == "" {
+		writeMischiefError(w, http.StatusConflict, "please sign in again")
+		return
+	}
+
+	var req mischiefOrderReq
+	if !decodeStateBody(w, r, &req) {
+		return
+	}
+	if req.TargetToken == "" {
+		writeMischiefError(w, http.StatusBadRequest, "no target")
+		return
+	}
+
+	tier, ok, err := storage.MischiefTierByKey(req.Tier)
+	if err != nil {
+		slog.Error("mischief: tier lookup", "err", err)
+		writeMischiefError(w, http.StatusInternalServerError, "internal error")
+		return
+	}
+	if !ok {
+		writeMischiefError(w, http.StatusBadRequest, "no such tier")
+		return
+	}
+
+	mark, ok, err := storage.RosterEntryByToken(req.TargetToken)
+	if err != nil {
+		slog.Error("mischief: target lookup", "err", err)
+		writeMischiefError(w, http.StatusInternalServerError, "internal error")
+		return
+	}
+	if !ok {
+		// The board moved on, or the token was never real. Either way there is no
+		// one to send trouble to.
+		writeMischiefError(w, http.StatusNotFound, "that adventurer is no longer on the board")
+		return
+	}
+
+	// Burst guard. Keyed on the OIDC subject so a username change can't reset it.
+	since := time.Now().Add(-mischiefBurstWindow).Unix()
+	if n, err := storage.CountMischiefOrdersSince(u.Sub, since); err != nil {
+		slog.Error("mischief: burst count", "err", err)
+		writeMischiefError(w, http.StatusInternalServerError, "internal error")
+		return
+	} else if n >= mischiefBurstMax {
+		writeMischiefError(w, http.StatusTooManyRequests, "slow down — too many orders in a short while")
+		return
+	}
+
+	order, err := storage.InsertMischiefOrder(u.Sub, buyer, mark.Token, mark.Name, tier.Key, req.Signed)
+	if err != nil {
+		slog.Error("mischief: insert order", "err", err)
+		writeMischiefError(w, http.StatusInternalServerError, "internal error")
+		return
+	}
+	slog.Info("mischief: order placed", "guid", order.GUID, "buyer", buyer, "tier", tier.Key, "signed", req.Signed)
+	w.Header().Set("Cache-Control", "no-store")
+	writeJSON(w, order)
+}
+
+// handleMischiefOrders returns the signed-in buyer's own orders for the status
+// panel, newest first. Scoped to their OIDC subject — a buyer sees their history
+// and no one else's.
+func (s *Server) handleMischiefOrders(w http.ResponseWriter, r *http.Request) {
+	u := s.requireUser(w, r)
+	if u == nil {
+		return
+	}
+	orders, err := storage.MischiefOrdersByBuyer(u.Sub, 20)
+	if err != nil {
+		slog.Error("mischief: orders by buyer", "err", err)
+		writeMischiefError(w, http.StatusInternalServerError, "internal error")
+		return
+	}
+	if orders == nil {
+		orders = []storage.MischiefOrder{}
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	writeJSON(w, orders)
+}
+
+// mischiefCatalogResp is what the storefront reads to draw itself: the live price
+// list plus the signed-in buyer's own advisory balance, so it can grey out tiers
+// they plainly can't afford. HasBalance distinguishes "gogobee says €0" from
+// "gogobee has never mentioned this buyer" — the latter shows no affordability
+// hint rather than a discouraging, possibly-wrong zero.
+type mischiefCatalogResp struct {
+	Tiers      []storage.MischiefTier `json:"tiers"`
+	Euro       float64                `json:"euro"`
+	HasBalance bool                   `json:"has_balance"`
+}
+
+// handleMischiefCatalog serves the price list and the buyer's balance together.
+func (s *Server) handleMischiefCatalog(w http.ResponseWriter, r *http.Request) {
+	u := s.requireUser(w, r)
+	if u == nil {
+		return
+	}
+	tiers, err := storage.MischiefTiers()
+	if err != nil {
+		slog.Error("mischief: catalog", "err", err)
+		writeMischiefError(w, http.StatusInternalServerError, "internal error")
+		return
+	}
+	if tiers == nil {
+		tiers = []storage.MischiefTier{}
+	}
+	resp := mischiefCatalogResp{Tiers: tiers}
+	if lp := buyerLocalpart(u); lp != "" {
+		euro, has, err := storage.UserEuro(lp)
+		if err != nil {
+			slog.Error("mischief: balance", "err", err)
+		} else {
+			resp.Euro, resp.HasBalance = euro, has
+		}
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	writeJSON(w, resp)
+}
+
+// ---- the gogobee wire: bearer-authed, idempotent -------------------------------
+
+// handleMischiefPending is gogobee's poll: every order still waiting to be acted
+// on. A pending order carries no intermediate state, so unlike escrow there is no
+// stale-reoffer window — a gogobee that dies mid-claim simply leaves the order
+// pending to be offered again, and the guid makes the replay a no-op.
+func (s *Server) handleMischiefPending(w http.ResponseWriter, r *http.Request) {
+	if !s.bearerOK(r) {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	orders, err := storage.PendingMischiefOrders(mischiefPollLimit)
+	if err != nil {
+		slog.Error("mischief: pending", "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if orders == nil {
+		orders = []storage.MischiefOrder{}
+	}
+	writeJSON(w, orders)
+}
+
+// mischiefPollLimit caps one poll, matching the escrow seam.
+const mischiefPollLimit = 50
+
+// mischiefVerdict is gogobee's answer on a claimed order: the terminal status and
+// a human note to render.
+type mischiefVerdict struct {
+	GUID   string `json:"guid"`
+	Status string `json:"status"`
+	Detail string `json:"detail,omitempty"`
+}
+
+// handleMischiefClaim files gogobee's verdict against a pending order. Idempotent:
+// gogobee's poll loop retries, so the same verdict can arrive more than once and
+// only the first one moves the order. An unknown guid is a 400 — by this point
+// gogobee has already debited the buyer for an order Pete has no record of, and
+// under the seam's contract a 400 parks the row for a human rather than retrying
+// forever against a row that will never exist.
+func (s *Server) handleMischiefClaim(w http.ResponseWriter, r *http.Request) {
+	if !s.bearerOK(r) {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	var v mischiefVerdict
+	if err := json.NewDecoder(io.LimitReader(r.Body, 1<<14)).Decode(&v); err != nil {
+		http.Error(w, "bad json", http.StatusBadRequest)
+		return
+	}
+	if v.GUID == "" {
+		http.Error(w, "guid is required", http.StatusBadRequest)
+		return
+	}
+
+	order, err := storage.ResolveMischiefOrder(v.GUID, v.Status, v.Detail)
+	if errors.Is(err, storage.ErrNoSuchOrder) {
+		slog.Error("mischief: verdict for an order we have never heard of — "+
+			"gogobee may have debited a buyer for it", "guid", v.GUID, "status", v.Status)
+		http.Error(w, "no such order", http.StatusBadRequest)
+		return
+	}
+	if err != nil {
+		// A malformed verdict status lands here — also a contract mismatch, so 400.
+		slog.Error("mischief: resolve", "guid", v.GUID, "status", v.Status, "err", err)
+		http.Error(w, "bad verdict", http.StatusBadRequest)
+		return
+	}
+	slog.Info("mischief: order resolved", "guid", order.GUID, "status", order.Status)
+	writeJSON(w, order)
+}
+
+func writeMischiefError(w http.ResponseWriter, code int, msg string) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(code)
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": msg})
+}

internal/web/mischief_test.go

@@ -0,0 +1,222 @@
+package web
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"pete/internal/storage"
+)
+
+// newStore is a server with the adventure seam on, a signed-in buyer, and a
+// board + catalog already pushed. Auth is built by hand for the same reason the
+// casino tests do it: the OIDC handshake is a network call and none of what's
+// under test is about it.
+func newStore(t *testing.T) *Server {
+	t.Helper()
+	s, _ := newAdvServer(t, "tok")
+	s.auth = &Authenticator{secret: []byte("test-secret-key-at-least-16")}
+
+	now := time.Now().Unix()
+	push := rosterPush{
+		SnapshotAt:  now,
+		Adventurers: []storage.RosterEntry{entry("tok-josie", "Josie", "expedition", "holymachina")},
+		Tiers: []storage.MischiefTier{
+			{Key: "grunt", Display: "Grunt", Fee: 40, SignedFee: 50},
+			{Key: "boss", Display: "Boss", Fee: 1200, SignedFee: 1500},
+		},
+		Balances: []storage.MischiefBalance{{Username: "reala", Euro: 500}},
+	}
+	if w := postRoster(t, s, "tok", push); w.Code != 200 {
+		t.Fatalf("seed roster = %d", w.Code)
+	}
+	return s
+}
+
+// jsonReq builds a bearer-authed (or unauthed, empty token) machine request.
+func jsonReq(t *testing.T, method, path, token string, body any) *http.Request {
+	t.Helper()
+	var buf bytes.Buffer
+	if body != nil {
+		if err := json.NewEncoder(&buf).Encode(body); err != nil {
+			t.Fatal(err)
+		}
+	}
+	r := httptest.NewRequest(method, path, &buf)
+	if token != "" {
+		r.Header.Set("Authorization", "Bearer "+token)
+	}
+	return r
+}
+
+func placeOrder(t *testing.T, s *Server, username string, req mischiefOrderReq) *httptest.ResponseRecorder {
+	t.Helper()
+	r := as(t, s, username, "POST", "/api/mischief/order", req)
+	w := httptest.NewRecorder()
+	s.handleMischiefOrder(w, r)
+	return w
+}
+
+// TestMischiefOrderHappyPath: a signed-in buyer names a mark on the board and a
+// tier gogobee offers, and gets a pending order back.
+func TestMischiefOrderHappyPath(t *testing.T) {
+	s := newStore(t)
+
+	w := placeOrder(t, s, "reala", mischiefOrderReq{TargetToken: "tok-josie", Tier: "grunt", Signed: false})
+	if w.Code != 200 {
+		t.Fatalf("order = %d body=%s", w.Code, w.Body.String())
+	}
+	var o storage.MischiefOrder
+	if err := json.Unmarshal(w.Body.Bytes(), &o); err != nil {
+		t.Fatal(err)
+	}
+	if o.Status != storage.MischiefPending || o.BuyerUsername != "reala" || o.TargetName != "Josie" {
+		t.Fatalf("order = %+v", o)
+	}
+	if pending, _ := storage.PendingMischiefOrders(10); len(pending) != 1 {
+		t.Fatalf("order didn't land in the pending set")
+	}
+}
+
+func TestMischiefOrderRejections(t *testing.T) {
+	s := newStore(t)
+
+	if w := placeOrder(t, s, "reala", mischiefOrderReq{TargetToken: "tok-josie", Tier: "dragon"}); w.Code != 400 {
+		t.Errorf("unknown tier = %d, want 400", w.Code)
+	}
+	if w := placeOrder(t, s, "reala", mischiefOrderReq{TargetToken: "ghost", Tier: "grunt"}); w.Code != 404 {
+		t.Errorf("off-board target = %d, want 404", w.Code)
+	}
+	if w := placeOrder(t, s, "reala", mischiefOrderReq{Tier: "grunt"}); w.Code != 400 {
+		t.Errorf("empty target = %d, want 400", w.Code)
+	}
+	// Signed in, but no username the ledger can name (a pre-storefront session).
+	if w := placeOrder(t, s, "", mischiefOrderReq{TargetToken: "tok-josie", Tier: "grunt"}); w.Code != 409 {
+		t.Errorf("usernameless session = %d, want 409", w.Code)
+	}
+}
+
+func TestMischiefOrderBurstGuard(t *testing.T) {
+	s := newStore(t)
+	for i := 0; i < mischiefBurstMax; i++ {
+		if w := placeOrder(t, s, "reala", mischiefOrderReq{TargetToken: "tok-josie", Tier: "grunt"}); w.Code != 200 {
+			t.Fatalf("order %d = %d, want 200", i, w.Code)
+		}
+	}
+	if w := placeOrder(t, s, "reala", mischiefOrderReq{TargetToken: "tok-josie", Tier: "grunt"}); w.Code != 429 {
+		t.Fatalf("over-cap order = %d, want 429", w.Code)
+	}
+}
+
+func TestMischiefOrderRequiresAuth(t *testing.T) {
+	s := newStore(t)
+	r := httptest.NewRequest("POST", "/api/mischief/order", nil)
+	w := httptest.NewRecorder()
+	s.handleMischiefOrder(w, r)
+	if w.Code != 401 {
+		t.Fatalf("anonymous order = %d, want 401", w.Code)
+	}
+}
+
+func TestMischiefCatalogCarriesBalance(t *testing.T) {
+	s := newStore(t)
+	r := as(t, s, "reala", "GET", "/api/mischief/catalog", nil)
+	w := httptest.NewRecorder()
+	s.handleMischiefCatalog(w, r)
+	if w.Code != 200 {
+		t.Fatalf("catalog = %d", w.Code)
+	}
+	var resp mischiefCatalogResp
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if len(resp.Tiers) != 2 || !resp.HasBalance || resp.Euro != 500 {
+		t.Fatalf("catalog resp = %+v", resp)
+	}
+}
+
+// ---- the bearer wire -----------------------------------------------------------
+
+func TestMischiefPendingAndClaimBearer(t *testing.T) {
+	s := newStore(t)
+	if w := placeOrder(t, s, "reala", mischiefOrderReq{TargetToken: "tok-josie", Tier: "boss", Signed: true}); w.Code != 200 {
+		t.Fatalf("seed order = %d", w.Code)
+	}
+
+	// Missing bearer is rejected.
+	{
+		w := httptest.NewRecorder()
+		s.handleMischiefPending(w, jsonReq(t, "GET", "/api/mischief/pending", "", nil))
+		if w.Code != 401 {
+			t.Fatalf("no-bearer pending = %d, want 401", w.Code)
+		}
+	}
+
+	// Poll returns the order.
+	var pending []storage.MischiefOrder
+	{
+		w := httptest.NewRecorder()
+		s.handleMischiefPending(w, jsonReq(t, "GET", "/api/mischief/pending", "tok", nil))
+		if w.Code != 200 {
+			t.Fatalf("pending = %d", w.Code)
+		}
+		if err := json.Unmarshal(w.Body.Bytes(), &pending); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if len(pending) != 1 {
+		t.Fatalf("pending count = %d, want 1", len(pending))
+	}
+	guid := pending[0].GUID
+
+	// Claim it placed.
+	{
+		w := httptest.NewRecorder()
+		s.handleMischiefClaim(w, jsonReq(t, "POST", "/api/mischief/claim", "tok",
+			mischiefVerdict{GUID: guid, Status: storage.MischiefPlaced, Detail: "out for delivery"}))
+		if w.Code != 200 {
+			t.Fatalf("claim = %d body=%s", w.Code, w.Body.String())
+		}
+	}
+	if got, _ := storage.MischiefOrderByGUID(guid); got.Status != storage.MischiefPlaced {
+		t.Fatalf("order status after claim = %q", got.Status)
+	}
+
+	// And it's gone from the pending set.
+	{
+		w := httptest.NewRecorder()
+		s.handleMischiefPending(w, jsonReq(t, "GET", "/api/mischief/pending", "tok", nil))
+		var again []storage.MischiefOrder
+		_ = json.Unmarshal(w.Body.Bytes(), &again)
+		if len(again) != 0 {
+			t.Fatalf("placed order still polled: %d", len(again))
+		}
+	}
+}
+
+func TestMischiefClaimUnknownGUIDis400(t *testing.T) {
+	s := newStore(t)
+	w := httptest.NewRecorder()
+	s.handleMischiefClaim(w, jsonReq(t, "POST", "/api/mischief/claim", "tok",
+		mischiefVerdict{GUID: "nope", Status: storage.MischiefPlaced}))
+	if w.Code != 400 {
+		t.Fatalf("unknown-guid claim = %d, want 400 (so gogobee parks it)", w.Code)
+	}
+}
+
+func TestMischiefClaimBadVerdictIs400(t *testing.T) {
+	s := newStore(t)
+	if w := placeOrder(t, s, "reala", mischiefOrderReq{TargetToken: "tok-josie", Tier: "grunt"}); w.Code != 200 {
+		t.Fatal("seed")
+	}
+	pending, _ := storage.PendingMischiefOrders(10)
+	w := httptest.NewRecorder()
+	s.handleMischiefClaim(w, jsonReq(t, "POST", "/api/mischief/claim", "tok",
+		mischiefVerdict{GUID: pending[0].GUID, Status: "exploded"}))
+	if w.Code != 400 {
+		t.Fatalf("bad-verdict claim = %d, want 400", w.Code)
+	}
+}

internal/web/roster.go

@@ -41,13 +41,26 @@ const (
 )
 
 // rosterPush is the payload gogobee POSTs to /api/ingest/roster.
+//
+// Balances ride the same tick as the board but live in a separate keyspace: they
+// are keyed by localpart (a buyer's own sign-in name), not by the anonymous
+// roster token, and Pete only ever reads one back for the authenticated user
+// asking about themselves. So the board stays anonymous while the storefront can
+// still grey out tiers a buyer plainly can't afford.
 type rosterPush struct {
 	SnapshotAt  int64                     `json:"snapshot_at"`
 	Adventurers []storage.RosterEntry     `json:"adventurers"`
+	Balances    []storage.MischiefBalance `json:"balances,omitempty"`
+	Tiers       []storage.MischiefTier    `json:"tiers,omitempty"`
 }
 
 // RosterView is one row as the page renders it.
+//
+// Token is the mark's anonymous roster token, exposed so the storefront can name
+// a target without ever knowing their real handle. It is safe on a public page by
+// design — non-reversible, stable, and already how gogobee keys the board.
 type RosterView struct {
+	Token     string
 	Name      string
 	Level     int
 	ClassRace string
@@ -103,7 +116,66 @@ func (s *Server) handleRosterIngest(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	slog.Info("roster ingest: board replaced", "adventurers", len(push.Adventurers))
+	// Advisory balances are best-effort: a board that landed is worth keeping
+	// even if the balances behind it didn't, so a failure here is logged, not
+	// fatal. Stale affordability only ever bounces an order, never miscounts money.
+	if err := storage.ReplaceUserEuro(push.Balances, push.SnapshotAt); err != nil {
+		slog.Error("roster ingest: balance replace failed", "err", err)
+	}
+	// The tier catalog is likewise best-effort and only refreshed when the push
+	// actually carried one, so a gogobee build that predates the storefront (no
+	// tiers field) can't wipe a catalog a newer one already established.
+	if len(push.Tiers) > 0 {
+		if err := storage.ReplaceMischiefTiers(push.Tiers); err != nil {
+			slog.Error("roster ingest: tier replace failed", "err", err)
+		}
+	}
+	slog.Info("roster ingest: board replaced", "adventurers", len(push.Adventurers), "balances", len(push.Balances))
+	w.WriteHeader(http.StatusOK)
+}
+
+// detailPush is the payload gogobee POSTs to /api/ingest/detail: the private,
+// owner-only expansion for every player, in its own keyspace (keyed by localpart)
+// and on its own endpoint so a fat inventory can't blow the roster push's budget.
+type detailPush struct {
+	SnapshotAt int64                  `json:"snapshot_at"`
+	Players    []storage.PlayerDetail `json:"players"`
+}
+
+// handleDetailIngest replaces the private self-detail set with gogobee's latest
+// push. Bearer-authed like the roster; the data is owner-private and only ever
+// served back to the one authenticated user it belongs to (see PlayerDetailByOwner).
+func (s *Server) handleDetailIngest(w http.ResponseWriter, r *http.Request) {
+	if !s.adv.Enabled {
+		http.NotFound(w, r)
+		return
+	}
+	if !s.bearerOK(r) {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	// A generous cap: this carries every player's inventory + vault, heavier than
+	// the board, but still a bounded realm — the ceiling only stops a runaway push.
+	var push detailPush
+	if err := json.NewDecoder(io.LimitReader(r.Body, 8<<20)).Decode(&push); err != nil {
+		http.Error(w, "bad json", http.StatusBadRequest)
+		return
+	}
+	if len(push.Players) > rosterMaxEntries {
+		http.Error(w, "detail set too large", http.StatusBadRequest)
+		return
+	}
+	if push.SnapshotAt <= 0 {
+		push.SnapshotAt = time.Now().Unix()
+	}
+
+	if err := storage.ReplacePlayerDetail(push.Players, push.SnapshotAt); err != nil {
+		slog.Error("detail ingest: replace failed", "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	slog.Info("detail ingest: self-view set replaced", "players", len(push.Players))
 	w.WriteHeader(http.StatusOK)
 }
 
@@ -142,6 +214,7 @@ func (s *Server) roster() (views []RosterView, stale bool, snapshotAt int64) {
 
 func toRosterView(e storage.RosterEntry) RosterView {
 	v := RosterView{
+		Token:     e.Token,
 		Name:      e.Name,
 		Level:     e.Level,
 		ClassRace: e.ClassRace,

internal/web/server.go

@@ -76,6 +76,14 @@ type Server struct {
 	metricsMu sync.Mutex
 	saltDay   int64
 	salt      [16]byte
+
+	// The shared-table machinery. hub fans SSE frames out to the phones at a felt;
+	// tableLocks is the striped optimisation over the DB's version column (see
+	// games_table.go). Both are nil-safe to construct always: they cost nothing
+	// until a table is opened.
+	hub        *gamesHub
+	tableLocks *stripedLocks
+	tableGames []tableGame // the multiplayer engines, dispatched through games()
 }
 
 // New builds the server. Templates are parsed once at startup. Each page gets
@@ -94,7 +102,7 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
 		shared []string
 		pages  []string
 	}{
-		{"layout", []string{"_card"}, []string{"index", "channel", "weather", "bookmarks", "for-you", "status", "story"}},
+		{"layout", []string{"_card"}, []string{"index", "channel", "weather", "bookmarks", "for-you", "status", "story", "who"}},
 		{"games_layout", []string{"_chipbar"}, []string{"games", "games_door", "blackjack", "hangman", "solitaire", "trivia", "uno", "holdem"}},
 	}
 	tpls := make(map[string]*template.Template)
@@ -136,7 +144,7 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
 		live = append(live, ch)
 	}
 
-	s := &Server{cfg: cfg, sources: infos, postingEnabled: postingEnabled, tpls: tpls, adminSubs: adminSubs, adv: adv, advPost: advPost, channels: live}
+	s := &Server{cfg: cfg, sources: infos, postingEnabled: postingEnabled, tpls: tpls, adminSubs: adminSubs, adv: adv, advPost: advPost, channels: live, hub: newGamesHub(), tableLocks: newStripedLocks(), tableGames: []tableGame{holdemTable{}, unoTable{}}}
 
 	// Optional OIDC sign-in (Authentik). Discovery is a network call; if the
 	// provider is unreachable at boot we log and serve anonymously rather than
@@ -211,6 +219,18 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
 	mux.HandleFunc("POST /api/ingest/roster", s.handleRosterIngest)
 	mux.HandleFunc("GET /api/roster", s.handleRosterAPI)
 
+	// The private, owner-only self-detail (inventory/house/pets). Bearer-authed
+	// ingest like the roster; there is no public read — it is only ever served
+	// back to its owner, inline on the detail page below.
+	mux.HandleFunc("POST /api/ingest/detail", s.handleDetailIngest)
+
+	// One adventurer's detail page and its live re-poll. Both public (stats +
+	// gear); the page adds the owner's private extras when the signed-in viewer
+	// owns it. Three path segments, so it never overlaps /adventure/{guid} (two)
+	// or /adventure/art/{type}.
+	mux.HandleFunc("GET /adventure/who/{token}", s.handleAdventureWho)
+	mux.HandleFunc("GET /api/adventure/who/{token}", s.handleAdventureWhoAPI)
+
 	// Per-dispatch permalink (the article_url every ingested story points at).
 	// Public GET; self-gates on adv.Enabled. Distinct from GET /adventure (the
 	// channel listing, registered in the channels loop above).
@@ -228,6 +248,13 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
 	mux.HandleFunc("POST /api/games/escrow/claim", s.handleEscrowClaim)
 	mux.HandleFunc("POST /api/games/escrow/settled", s.handleEscrowSettled)
 
+	// The mischief storefront's game-box wire: gogobee polls pending orders and
+	// pushes a verdict. Bearer-authed on the same ingest token, same reason as the
+	// escrow seam — the caller is a machine on the tailnet. The buyer-facing half
+	// hangs off the auth block below.
+	mux.HandleFunc("GET /api/mischief/pending", s.handleMischiefPending)
+	mux.HandleFunc("POST /api/mischief/claim", s.handleMischiefClaim)
+
 	// The casino. Signed-in only — there is money in it — so these hang off the
 	// auth block, and gamesReady() also insists on a Matrix server name: without
 	// one, no player can be named to gogobee's ledger and the tables stay shut.
@@ -246,6 +273,16 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
 		mux.HandleFunc("GET /api/state", s.handleState)
 		mux.HandleFunc("GET /bookmarks", s.handleBookmarks)
 		mux.HandleFunc("GET /for-you", s.handleForYou)
+
+		// The mischief storefront, buyer side. Signed-in only — an order names a
+		// buyer to gogobee's ledger — so like the casino it hangs off the auth
+		// block. Only registered when the adventure seam is on; otherwise there is
+		// no board to order a hit from.
+		if s.adv.Enabled {
+			mux.HandleFunc("GET /api/mischief/catalog", s.handleMischiefCatalog)
+			mux.HandleFunc("POST /api/mischief/order", s.handleMischiefOrder)
+			mux.HandleFunc("GET /api/mischief/orders", s.handleMischiefOrders)
+		}
 		if s.cfg.Push.Enabled {
 			mux.HandleFunc("POST /api/push/subscribe", s.handlePushSubscribe)
 			mux.HandleFunc("POST /api/push/unsubscribe", s.handlePushUnsubscribe)

internal/web/static/audio/casino/LICENSE.txt

@@ -0,0 +1,21 @@
+	
+
+	Casino Audio
+
+	by  Kenney Vleugels (Kenney.nl)
+
+			------------------------------
+
+	License (Creative Commons Zero, CC0)
+	http://creativecommons.org/publicdomain/zero/1.0/
+
+	You may use these assets in personal and commercial projects.
+	Credit (Kenney or www.kenney.nl) would be nice but is not mandatory.
+
+			------------------------------
+
+	Donate:   http://support.kenney.nl
+	Request:  http://request.kenney.nl
+
+	Follow on Twitter for updates:
+	@KenneyNL

internal/web/static/css/input.css

@@ -2096,22 +2096,30 @@ html[data-room] .cs-room {
     radial-gradient(120% 90% at 50% 120%, rgba(0,0,0,0.45), transparent 55%);
 }
 
-/* Casino Night is lit by bulbs, so it gets a few of them: a slow chase across
-   the top of the room. Cheap (one gradient, one transform) and it makes the
-   place feel plugged in rather than painted. */
+/* Casino Night is lit by bulbs, so it gets a row of them: a slow chase across
+   the top of the room. One radial tile repeated, one transform — each bulb is a
+   hot white core in a yellow body, and the glow is a pair of drop-shadows so it
+   actually throws light rather than being a painted dot. */
 html[data-room="casino-night"] .cs-room::before {
   content: "";
   position: absolute;
-  inset: 0 -50% auto -50%;
-  height: 0.5rem;
-  background: repeating-linear-gradient(90deg,
-    rgba(255,204,47,0.55) 0 0.5rem, transparent 0.5rem 2.25rem);
-  filter: blur(1px);
-  animation: cs-bulbs 2.4s linear infinite;
+  inset: 0.4rem -50% auto -50%;
+  height: 0.7rem;
+  background:
+    radial-gradient(circle at center,
+      #fffbe6 0 0.14rem,
+      #ffcc2f 0.14rem 0.26rem,
+      rgba(255,204,47,0.45) 0.26rem 0.42rem,
+      transparent 0.44rem)
+    0.3rem 50% / 1.9rem 100% repeat-x;
+  filter:
+    drop-shadow(0 0 3px rgba(255,214,90,0.95))
+    drop-shadow(0 0 10px rgba(255,204,47,0.6));
+  animation: cs-bulbs 1.8s linear infinite;
 }
 @keyframes cs-bulbs {
   from { transform: translateX(0); }
-  to   { transform: translateX(2.75rem); }
+  to   { transform: translateX(1.9rem); }
 }
 
 /* The house shadow, restruck for a dark room: the news app's soft brown lift is
@@ -2369,6 +2377,27 @@ html[data-room] .pete-felt {
 .pete-poker-verdict[data-tone="win"]  { background: #4caf7d; color: #fff; }
 .pete-poker-verdict[data-tone="lose"] { background: rgba(255,255,255,0.9); color: #7a5c50; }
 
+/* The rail. Chat runs along the felt — messages only, no typing indicators, and
+   it never leaves for Matrix. Your own lines lean the other way and take the
+   accent, so a glance tells you who is talking. */
+.pete-chat-line {
+  display: flex;
+  gap: 0.4rem;
+  align-items: baseline;
+  padding: 0.15rem 0.1rem;
+  line-height: 1.35;
+}
+.pete-chat-who {
+  flex-shrink: 0;
+  font-weight: 700;
+  color: var(--accent);
+}
+.pete-chat-body {
+  color: color-mix(in srgb, var(--ink) 85%, transparent);
+  word-break: break-word;
+}
+.pete-chat-mine .pete-chat-who { color: color-mix(in srgb, var(--ink) 55%, transparent); }
+
 /* The action bar. Raise is a slider, because a raise is a *size* and a text box
    makes you type a number you have not thought about. */
 .pete-raise {

internal/web/static/js/casino-sfx.js

@@ -1,12 +1,18 @@
 // The noise the room makes.
 //
-// There are no audio files here and there is nothing to download. Every sound in
-// this casino is *made* — an oscillator, a burst of filtered noise, an envelope —
-// the same bargain the weather engine takes with its clouds. A card is a short
-// slap of noise through a bandpass; a chip is two detuned sines with a click on
-// the front; a win is four notes going up. It costs about six kilobytes and no
-// round trips, and it means a sound can be pitched, stretched and detuned per
-// call instead of being the same wav 300 times.
+// The room speaks in two voices. The cards and chips are *recorded* — real clay
+// and real card stock, CC0 foley from Kenney's casino pack, sitting as small ogg
+// files under /static/audio/casino. Synthesis never quite caught the grain of a
+// chip landing on a chip, so for those we stopped trying. Everything melodic —
+// the wins, the losses, the little ticks — is still *made*: an oscillator, a
+// burst of filtered noise, an envelope, the same bargain the weather engine takes
+// with its clouds. A win is four notes going up; a chip is a recording of a chip.
+//
+// A name is a recording if it appears in SAMPLES and synthesised if it appears in
+// SOUNDS. The recordings guard against the one weakness of a sample — the same wav
+// 300 times is a machine gun — by keeping several takes per sound and rotating
+// through them, and by nudging every play a few percent off pitch. The synthesised
+// half was always immune to that; it varies itself.
 //
 // Two rules hold the whole file up.
 //
@@ -21,6 +27,10 @@
 // default-off switch for the entire file, checked before anything else happens.
 //
 // Exposed as window.PeteSFX. Nothing in here knows what blackjack is.
+//
+// If a recording hasn't finished decoding on the frame it's first needed, that one
+// call falls through to the synthesised version — so the table is never silent
+// while the ogg loads, and by the second card everything is real.
 (function () {
   "use strict";
 
@@ -108,6 +118,95 @@
     src.stop(t0 + (o.attack || 0.003) + (o.decay || 0.09) + 0.02);
   }
 
+  // ---- the recordings --------------------------------------------------------
+  //
+  // The foley. Each name maps to a handful of takes; `v` (the index of the card or
+  // chip in a run) picks which one and how far off pitch it lands, so a dealt hand
+  // is four different cards rather than one card four times. `gain` is per-sound
+  // and multiplies the master, exactly like the synthesised sounds' peak does.
+
+  var SAMPLE_BASE = "/static/audio/casino/";
+  var SAMPLES = {
+    // A card thrown down onto the table. `vary` is the largest fraction a take is
+    // ever pitched by, up or down — 0.20 means a play can land anywhere from a fifth
+    // slower (deeper) to a fifth faster (brighter).
+    card:    { files: ["cardPlace1", "cardPlace2", "cardPlace3", "cardPlace4"], gain: 0.6, vary: 0.20 },
+    // A card slid into place — softer, longer than a throw.
+    deal:    { files: ["cardSlide1", "cardSlide2", "cardSlide3", "cardSlide4", "cardSlide5", "cardSlide6"], gain: 0.5, vary: 0.20 },
+    // A card flicked over.
+    flip:    { files: ["cardFan1", "cardFan2"], gain: 0.5, vary: 0.18 },
+    // The riffle — one take, so the pitch wobble is all that keeps two shuffles apart.
+    shuffle: { files: ["cardShuffle"], gain: 0.6, vary: 0.10 },
+    // A clay chip set down on a stack.
+    chip:    { files: ["chipLay1", "chipLay2"], gain: 0.6, vary: 0.22 },
+    // Chips gathered and slid away.
+    sweep:   { files: ["chipsHandle2", "chipsHandle4", "chipsHandle6"], gain: 0.5, vary: 0.14 },
+  };
+
+  // Decoded buffers by filename. A value of null means "claimed, in flight or
+  // decoding"; false means "we tried and it failed, never bother again"; an
+  // AudioBuffer means ready.
+  var buffers = {};
+  var warmed = false;
+
+  // A rotating cursor per sound, so that even a run of identical calls walks
+  // through the takes rather than replaying the first one. Callers pass `v` to
+  // separate simultaneous sounds (the cards of one deal), but many pass the same
+  // constant every time — the cursor is what keeps a stack of chips from being the
+  // same click over and over.
+  var turn = {};
+
+  // decode fetches a file and turns it into a buffer, exactly once per filename.
+  // decodeAudioData exists in a modern promise flavour and an old callback one;
+  // this handles both so the foley works on older Safari too.
+  function decode(file) {
+    if (file in buffers) return; // ready, in flight, or known-bad
+    buffers[file] = null;
+    fetch(SAMPLE_BASE + file + ".ogg")
+      .then(function (r) { return r.ok ? r.arrayBuffer() : Promise.reject(); })
+      .then(function (ab) {
+        return new Promise(function (res, rej) {
+          var p = ctx.decodeAudioData(ab, res, rej);
+          if (p && p.then) p.then(res, rej);
+        });
+      })
+      .then(function (buf) { buffers[file] = buf; })
+      .catch(function () { buffers[file] = false; });
+  }
+
+  // warm pulls every take down once the context is awake, so that after the first
+  // click the whole set is decoded and ready and nothing has to fall back.
+  function warm() {
+    if (warmed || !ctx) return;
+    warmed = true;
+    for (var name in SAMPLES) SAMPLES[name].files.forEach(decode);
+  }
+
+  // sample plays one recorded take. It returns false — rather than making a noise —
+  // when the name isn't a recording or its buffer isn't decoded yet, which is the
+  // caller's signal to reach for the synthesised version instead.
+  function sample(name, t0, v) {
+    var cfg = SAMPLES[name];
+    if (!cfg) return false;
+    // Advance the cursor, then offset it by v. The cursor guarantees consecutive
+    // calls move to the next take; v spreads apart sounds fired together (one
+    // deal's cards) so they don't all land on the same take at once.
+    var k = (turn[name] = (turn[name] || 0) + 1) + Math.abs(Math.round(v));
+    var buf = buffers[cfg.files[k % cfg.files.length]];
+    if (!buf) return false; // not decoded yet, or failed: let synth cover it
+    var src = ctx.createBufferSource();
+    src.buffer = buf;
+    // Pitch, walking with the same cursor across seven steps between -vary and
+    // +vary, so even a single-take sound like the shuffle isn't identical twice in
+    // a row. Seven steps rather than a couple means the runs don't read as a loop.
+    if (cfg.vary) src.playbackRate.value = 1 + (((k % 7) - 3) / 3) * cfg.vary;
+    var g = ctx.createGain();
+    g.gain.value = cfg.gain == null ? 0.6 : cfg.gain;
+    src.connect(g).connect(master);
+    src.start(t0);
+    return true;
+  }
+
   // ---- the sounds ------------------------------------------------------------
   //
   // Each one takes the time it starts at, and a `v` — a small per-call variation,
@@ -217,6 +316,7 @@
   // gesture — after which play() can schedule freely.
   function wake() {
     if (ctx && ctx.state === "suspended") ctx.resume().catch(function () {});
+    warm();
   }
   ["pointerdown", "keydown", "touchstart"].forEach(function (ev) {
     window.addEventListener(ev, wake, { passive: true });
@@ -231,13 +331,18 @@
   // lands in 400ms can say so rather than sleeping.
   function play(name, opts) {
     if (muted) return;
-    var s = SOUNDS[name];
-    if (!s) return;
+    if (!SOUNDS[name] && !SAMPLES[name]) return; // known to neither voice
     if (!boot()) return;
     wake();
     if (ctx.state !== "running") return; // not yet touched: no sound, and no error
+    var t0 = ctx.currentTime + ((opts && opts.delay) || 0);
+    var v = (opts && opts.v) || 0;
     try {
-      s(ctx.currentTime + ((opts && opts.delay) || 0), ((opts && opts.v) || 0));
+      // A recording if we have one decoded; the synthesised take otherwise — both
+      // for names that are only ever synthesised, and for the first call of a
+      // recorded name while its ogg is still loading.
+      if (sample(name, t0, v)) return;
+      if (SOUNDS[name]) SOUNDS[name](t0, v);
     } catch (e) {
       /* a sound is never worth throwing over */
     }

internal/web/static/js/holdem.js

@@ -60,6 +60,14 @@
   var boughtEl  = root.querySelector("[data-bought-in]");
   var rakeEl    = root.querySelector("[data-session-rake]");
 
+  var chatSection = root.querySelector("[data-chat]");
+  var chatLog     = root.querySelector("[data-chat-log]");
+  var chatSeen    = {}; // chat line ids already on the rail, to drop echoed duplicates
+  var chatForm    = root.querySelector("[data-chat-form]");
+  var chatInput   = root.querySelector("[data-chat-input]");
+  var lobbyWrap   = root.querySelector("[data-lobby-wrap]");
+  var lobbyEl     = root.querySelector("[data-lobby]");
+
   var sitBtn    = root.querySelector("[data-sit]");
   var buySlider = root.querySelector("[data-buyin-slider]");
   var buyLabel  = root.querySelector("[data-buyin]");
@@ -70,7 +78,10 @@
   var tableMsg  = root.querySelector("[data-table-msg]");
 
   var view = null;    // the table, as the server last described it
+  var me = 0;         // which seat is yours — no longer always zero, at a shared table
   var busy = false;
+  var pendingSync = false; // a pushed frame arrived mid-animation; re-render when free
+  var stream = null;  // the open EventSource, when seated
   var seatEls = [];   // one per seat: { root, cards, plate, stack, spot }
   var shown = [];     // what each seat's stack label currently reads
   var pot = null;     // the middle pile, a PeteFX.spot
@@ -171,6 +182,7 @@
 
   function render(v) {
     view = v;
+    me = v.your_seat || 0;
 
     // The seats along the top, and you underneath.
     seatsEl.innerHTML = "";
@@ -178,7 +190,7 @@
     seatEls = [];
     shown = [];
     v.seats.forEach(function (s, i) {
-      var mine = i === 0;
+      var mine = i === me;
       var built = seat(s, i, mine);
       seatEls[i] = built;
       shown[i] = s.stack;
@@ -222,11 +234,12 @@
     // last hand, but the table you sit down at is the one that's open to you.
     var live = !!view && view.phase !== "done";
     sitting.classList.toggle("hidden", live);
-    acting.classList.toggle("hidden", !live || view.phase !== "betting" || view.to_act !== 0);
+    acting.classList.toggle("hidden", !live || view.phase !== "betting" || view.to_act !== me);
     between.classList.toggle("hidden", !live || view.phase !== "handover");
+    if (chatSection) chatSection.classList.toggle("hidden", !live);
     if (!live) return;
 
-    if (view.phase === "betting" && view.to_act === 0) {
+    if (view.phase === "betting" && view.to_act === me) {
       checkBtn.classList.toggle("hidden", !view.can_check);
       callBtn.classList.toggle("hidden", view.can_check);
       callAmt.textContent = money(view.owed);
@@ -274,18 +287,22 @@
   // happening happens here; render() is the state it settles into.
   function play(events, final) {
     var chain = Promise.resolve();
-    // No table to settle into — the session closed and storage has already cleared
-    // it. There is nothing to animate onto, and render() would walk seats that
-    // aren't there.
-    if (!final) { render0(); return Promise.resolve(); }
-    if (!events || !events.length) { render(final); return chain; }
+    if (!events || !events.length) {
+      // Nothing to animate. Either settle into the table we ended on, or — if the
+      // session closed and storage cleared it — clear the felt.
+      if (final) render(final); else render0();
+      return chain;
+    }
 
     events.forEach(function (e) {
       chain = chain.then(function () { return beat(e, final); });
     });
     return chain.then(function () {
-      render(final);
+      // A hand can be the last one — a bust closes the table, so there is no state
+      // to settle into. Play it out and say what it did anyway (the seats are still
+      // on the felt from the previous render), then clear.
       verdict(events, final);
+      if (final) render(final); else render0();
     });
   }
 
@@ -336,7 +353,7 @@
 
       case "show":
         if (!s) return;
-        paintCards(s.cards, { state: "active", cards: e.cards }, e.seat === 0);
+        paintCards(s.cards, { state: "active", cards: e.cards }, e.seat === me);
         flash(s.root);
         return wait(420);
 
@@ -353,7 +370,7 @@
         return pot.sweep(s.plate, e.amount, { gap: 55 }).then(function () {
           potTotal.textContent = money(pot.amount);
           moveStack(e.seat, e.amount);
-          if (e.seat === 0 && e.amount > 0) FX.burst(s.plate, { count: 18 });
+          if (e.seat === me && e.amount > 0) FX.burst(s.plate, { count: 18 });
           return wait(260);
         });
 
@@ -375,8 +392,8 @@
             if (s.state === "out") return;
             var built = seatEls[i];
             if (!built) return;
-            var face = (i === 0 && s.cards) ? s.cards[round] : null;
-            var card = Cards.el(face, { deal: true, tilt: i !== 0 });
+            var face = (i === me && s.cards) ? s.cards[round] : null;
+            var card = Cards.el(face, { deal: true, tilt: i !== me });
             built.cards.appendChild(card);
             FX.sfx("deal", { delay: 0.07 * i, v: i });
             beats.push(wait(70 * i));
@@ -477,25 +494,25 @@
   function verdict(events, final) {
     var won = 0, showed = false, busted = false;
     events.forEach(function (e) {
-      if (e.kind === "win" && e.seat === 0) won += e.amount;
+      if (e.kind === "win" && e.seat === me) won += e.amount;
       if (e.kind === "show") showed = true;
-      if (e.kind === "bust") busted = true;
+      if (e.kind === "bust" && e.seat === me) busted = true;
     });
     if (busted) {
       show("You're out of chips. Sit down again when you're ready.", "lose");
       FX.sfx("lose");
       return;
     }
-    if (!events.some(function (e) { return e.kind === "end"; })) return;
+    if (!final || !events.some(function (e) { return e.kind === "end"; })) return;
 
-    var me = final.seats[0];
+    var mine = final.seats[me];
     if (won > 0) {
       // The pot coming your way already burst (and so already cheered) back in
       // the "win" event. This is only the words.
       show(showed
         ? "You win " + money(won) + " with " + article(handName(events)) + "."
         : "They folded. You take " + money(won) + ".", "win");
-    } else if (me.state === "folded") {
+    } else if (mine.state === "folded") {
       show("Folded.", "lose");
     } else {
       show("No good this time.", "lose");
@@ -510,7 +527,7 @@
   }
 
   function handName(events) {
-    var mine = events.filter(function (e) { return e.kind === "show" && e.seat === 0; })[0];
+    var mine = events.filter(function (e) { return e.kind === "show" && e.seat === me; })[0];
     return mine && mine.text ? mine.text : "the best hand";
   }
 
@@ -556,26 +573,48 @@
       .post("/api/games/holdem/move", body)
       .then(function (v) {
         window.PeteGames.apply(v);
-        return play(v.holdem_events, v.holdem || null).then(function () {
-          if (!v.holdem) { render0(); return; }
-          if (v.holdem.phase === "done") {
-            var got = v.holdem.payout, put = v.holdem.bought_in;
-            say(tableMsg, got > put
-              ? "You got up " + money(got - put) + " ahead. " + money(got) + " back on your stack."
-              : got === 0
-                ? "Cleaned out. Better luck at the next table."
-                : "You got up " + money(put - got) + " down. " + money(got) + " back on your stack.");
-            setTimeout(render0, 2600);
-          }
-        });
+        // No table came back: the session ended inside this move — a bust closes a
+        // solo table. play() animates the last hand (its "bust" beat says the words)
+        // and clears the felt.
+        return play(v.holdem_events, v.holdem || null);
       })
       .catch(function (err) { say(msgEl, err.message, "bad"); })
-      .then(function () { busy = false; lock(false); });
+      .then(function () { busy = false; lock(false); flushSync(); });
+  }
+
+  // flushSync applies a table frame that arrived while a hand was animating. The
+  // felt is now settled, so the held re-render will not clobber a script.
+  function flushSync() {
+    if (pendingSync) { pendingSync = false; sync(); }
+  }
+
+  // leave gets you up from the table. It is its own endpoint, not a move: the
+  // chips cross back and the felt may close behind you, neither of which is a play
+  // in a hand. The felt clears and the stack you took is reported from what was in
+  // front of you a moment ago.
+  function leave() {
+    if (busy) return;
+    busy = true;
+    lock(true);
+    var stack = view ? view.stack : 0;
+    verdictEl.classList.add("hidden");
+    window.PeteGames
+      .post("/api/games/holdem/leave", {})
+      .then(function (v) {
+        window.PeteGames.apply(v);
+        render0();
+        say(tableMsg, stack > 0
+          ? money(stack) + " back on your stack. Sit down again when you're ready."
+          : "");
+      })
+      .catch(function (err) { say(betweenMsg, err.message, "bad"); })
+      .then(function () { busy = false; lock(false); flushSync(); });
   }
 
   // render0 is the table with nobody at it.
   function render0() {
     view = null;
+    unseated();
     seatsEl.innerHTML = "";
     youEl.innerHTML = "";
     boardEl.innerHTML = "";
@@ -584,6 +623,7 @@
     sideEl.classList.add("hidden");
     panels();
     syncSit();
+    loadLobby();
   }
 
   if (foldBtn)  foldBtn.addEventListener("click", function () { send({ move: "fold" }, gameMsg); });
@@ -612,7 +652,7 @@
   });
 
   if (dealBtn)  dealBtn.addEventListener("click", function () { send({ move: "deal" }, betweenMsg); });
-  if (leaveBtn) leaveBtn.addEventListener("click", function () { send({ move: "leave" }, betweenMsg); });
+  if (leaveBtn) leaveBtn.addEventListener("click", function () { leave(); });
   if (topupBtn) topupBtn.addEventListener("click", function () {
     send({ move: "topup", amount: Number(topupBtn.dataset.amount || 0) }, betweenMsg);
   });
@@ -668,6 +708,7 @@
       .then(function (v) {
         window.PeteGames.apply(v);
         render(v.holdem);
+        seated();
         // A table with nobody dealt in yet is a table waiting for you to say go.
         say(betweenMsg, "You're in. Deal when you're ready.");
       })
@@ -675,6 +716,171 @@
       .then(function () { busy = false; });
   });
 
+  // ---- the live table --------------------------------------------------------
+  //
+  // Poker is where the room stops being just you and the house: other people are
+  // at the felt, and what they do has to reach you without your asking. That is
+  // one EventSource. The server pushes a nudge when the table changes and a line
+  // when somebody speaks; the nudge is not the state (a hole card must never ride
+  // a frame that fans to the whole table), so on a nudge we refetch our own
+  // seat's view, which is authoritative and already redacted.
+
+  // seated opens the stream and loads the rail. Called the moment you sit down.
+  function seated() {
+    loadChat();
+    connectLive();
+  }
+
+  // unseated tears it down. Called when the felt clears — you got up, or busted.
+  function unseated() {
+    disconnectLive();
+    if (chatLog) chatLog.innerHTML = "";
+    chatSeen = {};
+  }
+
+  function connectLive() {
+    if (stream || !window.EventSource) return;
+    stream = new EventSource("/api/games/holdem/stream");
+    stream.onmessage = function (ev) {
+      var msg;
+      try { msg = JSON.parse(ev.data); } catch (e) { return; }
+      if (msg.type === "chat") addChat(msg.line);
+      else if (msg.type === "table") sync();
+    };
+    // The opening nudge (event: sync) just says "come and look".
+    stream.addEventListener("sync", function () { sync(); });
+    // EventSource reconnects itself on a dropped connection. The one case we don't
+    // want it retrying is a table that has closed (the stream 409s) — but by then
+    // we have called unseated() and closed it ourselves.
+  }
+
+  function disconnectLive() {
+    if (stream) { stream.close(); stream = null; }
+  }
+
+  // sync re-renders the felt from the authoritative table, but never mid-animation
+  // — a frame that lands while a hand is playing is held and applied once the
+  // script finishes, or it would repaint the table out from under it.
+  function sync() {
+    if (busy) { pendingSync = true; return; }
+    window.PeteGames.refresh().then(function (v) {
+      if (!v) return;
+      if (v.holdem) render(v.holdem); else { render0(); }
+    });
+  }
+
+  // ---- the rail --------------------------------------------------------------
+
+  function loadChat() {
+    fetch("/api/games/holdem/chat", { headers: { "Accept": "application/json" } })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (data) {
+        if (!data || !chatLog) return;
+        chatLog.innerHTML = "";
+        chatSeen = {};
+        (data.chat || []).forEach(addChat);
+      })
+      .catch(function () {});
+  }
+
+  function addChat(line) {
+    if (!chatLog || !line) return;
+    // Your own line comes back twice — once from the POST that sent it, once
+    // echoed over your own stream — so drop any id already on the rail.
+    if (line.id) {
+      if (chatSeen[line.id]) return;
+      chatSeen[line.id] = true;
+    }
+    var row = document.createElement("div");
+    row.className = "pete-chat-line" + (line.mine ? " pete-chat-mine" : "");
+    var who = document.createElement("span");
+    who.className = "pete-chat-who";
+    who.textContent = line.name;
+    var body = document.createElement("span");
+    body.className = "pete-chat-body";
+    body.textContent = line.body;
+    row.appendChild(who);
+    row.appendChild(body);
+    chatLog.appendChild(row);
+    chatLog.scrollTop = chatLog.scrollHeight;
+  }
+
+  if (chatForm) chatForm.addEventListener("submit", function (e) {
+    e.preventDefault();
+    var body = (chatInput.value || "").trim();
+    if (!body) return;
+    chatInput.value = "";
+    window.PeteGames
+      .post("/api/games/holdem/say", { body: body })
+      .then(function (line) { addChat(line); })
+      .catch(function () { chatInput.value = body; });
+  });
+
+  // ---- the lobby -------------------------------------------------------------
+  //
+  // The tables other people have open, each with a seat going spare. Joining
+  // takes the buy-in the slider is set to, clamped to what that table allows.
+
+  function loadLobby() {
+    if (!lobbyEl) return;
+    fetch("/api/games/holdem/tables", { headers: { "Accept": "application/json" } })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (data) {
+        var tables = (data && data.tables) || [];
+        renderLobby(tables);
+      })
+      .catch(function () {});
+  }
+
+  function renderLobby(tables) {
+    lobbyEl.innerHTML = "";
+    lobbyWrap.classList.toggle("hidden", tables.length === 0);
+    tables.forEach(function (t) {
+      var stakes = tierBtns.filter(function (b) { return b.dataset.tier === t.tier; })[0];
+      var btn = document.createElement("button");
+      btn.type = "button";
+      btn.className = "flex items-center justify-between gap-3 rounded-2xl border-2 border-[color:var(--ink)]/10 p-3 text-left hover:bg-[color:var(--ink)]/5 transition";
+      var label = document.createElement("span");
+      label.className = "font-display font-bold";
+      label.textContent = stakes ? stakes.querySelector(".font-display").textContent : t.tier;
+      var seats = document.createElement("span");
+      seats.className = "text-xs font-semibold text-[color:var(--ink)]/50 tabular-nums";
+      seats.textContent = t.humans + "/" + t.seats + " seated";
+      btn.appendChild(label);
+      btn.appendChild(seats);
+      btn.addEventListener("click", function () { join(t, stakes); });
+      lobbyEl.appendChild(btn);
+    });
+  }
+
+  function join(t, stakes) {
+    if (busy) return;
+    // Buy in for what the slider says, but only what this table allows.
+    var buyIn = buyIn0(stakes);
+    busy = true;
+    say(tableMsg, "");
+    window.PeteGames
+      .post("/api/games/holdem/sit", { table: t.id, buyin: buyIn })
+      .then(function (v) {
+        window.PeteGames.apply(v);
+        render(v.holdem);
+        seated();
+        say(betweenMsg, "You're in. The next hand deals when the table is ready.");
+      })
+      .catch(function (err) { say(tableMsg, err.message, "bad"); })
+      .then(function () { busy = false; });
+  }
+
+  // buyIn0 is a legal buy-in for a table you are joining: fifty big blinds, or as
+  // close as the table's range allows.
+  function buyIn0(stakes) {
+    if (!stakes) return Number(buySlider.value);
+    var min = Number(stakes.dataset.min), max = Number(stakes.dataset.max), bb = Number(stakes.dataset.bb);
+    var want = Number(buySlider.value);
+    if (stakes === tier) return Math.min(max, Math.max(min, want)); // same table: honour the slider
+    return Math.min(max, Math.max(min, 50 * bb));
+  }
+
   // ---- boot ------------------------------------------------------------------
 
   window.PeteGames.onUpdate(function () { if (!view) syncSit(); });
@@ -683,7 +889,7 @@
   pickBots(botBtns[1]);
 
   window.PeteGames.refresh().then(function (v) {
-    if (v && v.holdem) render(v.holdem);
-    else render0();
+    if (v && v.holdem) { render(v.holdem); seated(); }
+    else { render0(); loadLobby(); }
   });
 })();

internal/web/templates/channel.html

@@ -25,19 +25,62 @@
   <div class="rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 shadow-pete overflow-hidden {{if .RosterStale}}opacity-60{{end}}" id="roster-card">
     <ul class="divide-y divide-[color:var(--ink)]/10" id="roster-list">
       {{range .Roster}}
-      <li class="flex items-center gap-4 px-5 py-3">
+      <li class="flex items-center gap-4 px-5 py-3" data-token="{{.Token}}" data-name="{{.Name}}">
         <span class="text-lg" aria-hidden="true">{{if .OnRun}}⚔{{else}}🏠{{end}}</span>
-        <span class="font-semibold">{{.Name}}</span>
+        <a href="/adventure/who/{{.Token}}" class="font-semibold hover:text-theme-adventure hover:underline">{{.Name}}</a>
         <span class="text-sm text-[color:var(--ink)]/60">lv {{.Level}} {{.ClassRace}}</span>
         <span class="ml-auto text-sm {{if .OnRun}}font-semibold{{else}}text-[color:var(--ink)]/60{{end}}">
           {{.Where}}{{if .Idle}} <span class="text-[color:var(--ink)]/45">· {{.Idle}}</span>{{end}}
         </span>
+        {{if and $.User .OnRun}}
+        <button type="button" class="mischief-send shrink-0 rounded-full bg-[color:var(--ink)]/5 hover:bg-red-500 hover:text-white border border-[color:var(--ink)]/15 px-3 py-1 text-xs font-semibold transition" data-token="{{.Token}}" data-name="{{.Name}}">send trouble</button>
+        {{end}}
       </li>
       {{else}}
       <li class="px-5 py-8 text-center text-[color:var(--ink)]/60">Nobody's out at the moment. Quiet week in the realm.</li>
       {{end}}
     </ul>
   </div>
+
+  {{if not .User}}
+  <p class="mt-3 text-xs text-[color:var(--ink)]/50">
+    <a href="/auth/login?next={{.Path}}" class="underline hover:text-red-500">Sign in</a> to send something unpleasant their way.
+  </p>
+  {{end}}
+
+  {{if .User}}
+  <!-- Your open contracts. Rendered from filed facts, never from live game state:
+       Pete only knows what gogobee told it happened. -->
+  <div id="mischief-orders" class="mt-4 hidden">
+    <h3 class="text-xs uppercase tracking-wider text-[color:var(--ink)]/50 mb-2">Trouble you've paid for</h3>
+    <ul id="mischief-orders-list" class="space-y-2 text-sm"></ul>
+  </div>
+
+  <!-- The buy dialog. Prices are gogobee's, pulled live from /api/mischief/catalog;
+       nothing here asserts a number of its own. -->
+  <div id="mischief-modal" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/50 p-4">
+    <div class="w-full max-w-md rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 shadow-pete overflow-hidden">
+      <div class="flex items-center justify-between px-5 py-4 border-b border-[color:var(--ink)]/10">
+        <h3 class="font-display text-xl font-bold">Send trouble to <span id="mischief-target">—</span></h3>
+        <button type="button" id="mischief-close" class="text-2xl leading-none text-[color:var(--ink)]/50 hover:text-[color:var(--ink)]" aria-label="close">×</button>
+      </div>
+      <div class="px-5 py-4 space-y-3">
+        <p class="text-sm text-[color:var(--ink)]/60">Pick how bad. They won't know who sent it — unless you sign it, or they live to read the receipt.</p>
+        <div id="mischief-tiers" class="space-y-2"></div>
+        <label class="flex items-center gap-2 text-sm">
+          <input type="checkbox" id="mischief-signed" class="rounded border-[color:var(--ink)]/30">
+          <span>Sign my name to it <span class="text-[color:var(--ink)]/45">(+25%, and they'll know)</span></span>
+        </label>
+        <p id="mischief-balance" class="text-xs text-[color:var(--ink)]/50"></p>
+        <p id="mischief-result" class="text-sm hidden"></p>
+      </div>
+      <div class="flex items-center justify-end gap-2 px-5 py-4 border-t border-[color:var(--ink)]/10">
+        <button type="button" id="mischief-cancel" class="rounded-full px-4 py-2 text-sm font-semibold text-[color:var(--ink)]/60 hover:text-[color:var(--ink)]">Never mind</button>
+        <button type="button" id="mischief-confirm" class="rounded-full bg-red-500 text-white px-5 py-2 text-sm font-semibold shadow-pete hover:-translate-y-0.5 transition disabled:opacity-40 disabled:translate-y-0" disabled>Put the word out</button>
+      </div>
+    </div>
+  </div>
+  {{end}}
 </section>
 
 <script>
@@ -49,6 +92,8 @@
   var card = document.getElementById('roster-card');
   if (!list) return;
 
+  var signedIn = {{if .User}}true{{else}}false{{end}};
+
   function esc(s) {
     var d = document.createElement('div');
     d.textContent = s == null ? '' : String(s);
@@ -57,12 +102,15 @@
 
   function row(a) {
     var idle = a.Idle ? ' <span class="text-[color:var(--ink)]/45">· ' + esc(a.Idle) + '</span>' : '';
-    return '<li class="flex items-center gap-4 px-5 py-3">' +
+    var button = (signedIn && a.OnRun)
+      ? '<button type="button" class="mischief-send shrink-0 rounded-full bg-[color:var(--ink)]/5 hover:bg-red-500 hover:text-white border border-[color:var(--ink)]/15 px-3 py-1 text-xs font-semibold transition" data-token="' + esc(a.Token) + '" data-name="' + esc(a.Name) + '">send trouble</button>'
+      : '';
+    return '<li class="flex items-center gap-4 px-5 py-3" data-token="' + esc(a.Token) + '" data-name="' + esc(a.Name) + '">' +
       '<span class="text-lg" aria-hidden="true">' + (a.OnRun ? '⚔' : '🏠') + '</span>' +
-      '<span class="font-semibold">' + esc(a.Name) + '</span>' +
+      '<a href="/adventure/who/' + esc(a.Token) + '" class="font-semibold hover:text-theme-adventure hover:underline">' + esc(a.Name) + '</a>' +
       '<span class="text-sm text-[color:var(--ink)]/60">lv ' + esc(a.Level) + ' ' + esc(a.ClassRace) + '</span>' +
       '<span class="ml-auto text-sm ' + (a.OnRun ? 'font-semibold' : 'text-[color:var(--ink)]/60') + '">' +
-      esc(a.Where) + idle + '</span></li>';
+      esc(a.Where) + idle + '</span>' + button + '</li>';
   }
 
   function refresh() {
@@ -84,7 +132,157 @@
   document.addEventListener('visibilitychange', function () {
     if (!document.hidden) refresh();
   });
+
+  if (signedIn) initMischief(list, esc);
 })();
+
+// The storefront: pick a mark, pick how bad, pay. The only thing this code is
+// authoritative about is the buyer's intent — every price, every yes/no, and the
+// buyer's actual balance are gogobee's, reached through the API.
+function initMischief(list, esc) {
+  var modal = document.getElementById('mischief-modal');
+  if (!modal) return;
+  var targetEl = document.getElementById('mischief-target');
+  var tiersEl = document.getElementById('mischief-tiers');
+  var signedEl = document.getElementById('mischief-signed');
+  var balanceEl = document.getElementById('mischief-balance');
+  var resultEl = document.getElementById('mischief-result');
+  var confirmEl = document.getElementById('mischief-confirm');
+  var ordersWrap = document.getElementById('mischief-orders');
+  var ordersList = document.getElementById('mischief-orders-list');
+
+  var catalog = null;   // {tiers, euro, has_balance}
+  var chosen = null;    // selected tier key
+  var current = null;   // {token, name}
+
+  function euros(n) { return '€' + Number(n).toLocaleString(); }
+
+  function loadCatalog() {
+    return fetch('/api/mischief/catalog', { headers: { 'Accept': 'application/json' } })
+      .then(function (r) { return r.ok ? r.json() : null; })
+      .then(function (c) { catalog = c; return c; });
+  }
+
+  function drawTiers() {
+    if (!catalog || !catalog.tiers || !catalog.tiers.length) {
+      tiersEl.innerHTML = '<p class="text-sm text-[color:var(--ink)]/50">The catalogue is between snapshots. Try again in a moment.</p>';
+      return;
+    }
+    var signed = signedEl.checked;
+    var known = catalog.has_balance;
+    var euro = catalog.euro;
+    tiersEl.innerHTML = catalog.tiers.map(function (t) {
+      var price = signed ? t.signed_fee : t.fee;
+      var tooDear = known && euro < price;
+      return '<button type="button" class="mischief-tier w-full text-left rounded-2xl border-2 px-4 py-2 transition ' +
+        (chosen === t.key ? 'border-red-500 bg-red-500/10' : 'border-[color:var(--ink)]/10 hover:border-[color:var(--ink)]/25') +
+        (tooDear ? ' opacity-40 cursor-not-allowed' : '') + '" data-key="' + esc(t.key) + '"' + (tooDear ? ' disabled' : '') + '>' +
+        '<span class="flex items-baseline justify-between"><span class="font-semibold">' + esc(t.display) + '</span>' +
+        '<span class="font-semibold">' + euros(price) + '</span></span>' +
+        (t.blurb ? '<span class="block text-xs text-[color:var(--ink)]/55 mt-0.5">' + esc(t.blurb) + '</span>' : '') +
+        '</button>';
+    }).join('');
+    balanceEl.textContent = known ? 'You have about ' + euros(euro) + ' to spend.' : '';
+    Array.prototype.forEach.call(tiersEl.querySelectorAll('.mischief-tier'), function (b) {
+      b.addEventListener('click', function () {
+        chosen = b.getAttribute('data-key');
+        confirmEl.disabled = false;
+        drawTiers();
+      });
+    });
+  }
+
+  function open(token, name) {
+    current = { token: token, name: name };
+    chosen = null;
+    confirmEl.disabled = true;
+    resultEl.classList.add('hidden');
+    resultEl.textContent = '';
+    signedEl.checked = false;
+    targetEl.textContent = name;
+    modal.classList.remove('hidden');
+    modal.classList.add('flex');
+    (catalog ? Promise.resolve() : loadCatalog()).then(drawTiers);
+  }
+
+  function close() {
+    modal.classList.add('hidden');
+    modal.classList.remove('flex');
+  }
+
+  function badge(statusText) {
+    var map = {
+      pending: ['on its way', 'bg-amber-500/15 text-amber-700'],
+      placed: ['out for delivery', 'bg-red-500/15 text-red-600'],
+      bounced_funds: ["couldn't afford it", 'bg-[color:var(--ink)]/10 text-[color:var(--ink)]/60'],
+      bounced_ineligible: ['no longer a mark', 'bg-[color:var(--ink)]/10 text-[color:var(--ink)]/60']
+    };
+    var m = map[statusText] || [statusText, 'bg-[color:var(--ink)]/10 text-[color:var(--ink)]/60'];
+    return '<span class="rounded-full px-2 py-0.5 text-xs font-semibold ' + m[1] + '">' + esc(m[0]) + '</span>';
+  }
+
+  function loadOrders() {
+    fetch('/api/mischief/orders', { headers: { 'Accept': 'application/json' } })
+      .then(function (r) { return r.ok ? r.json() : null; })
+      .then(function (orders) {
+        if (!orders || !orders.length) { ordersWrap.classList.add('hidden'); return; }
+        ordersWrap.classList.remove('hidden');
+        ordersList.innerHTML = orders.map(function (o) {
+          var detail = o.detail ? ' <span class="text-[color:var(--ink)]/45">· ' + esc(o.detail) + '</span>' : '';
+          return '<li class="flex items-center gap-3">' +
+            '<span class="font-semibold">' + esc(o.target_name) + '</span>' +
+            '<span class="text-[color:var(--ink)]/55">' + esc(o.tier) + (o.signed ? ', signed' : '') + '</span>' +
+            '<span class="ml-auto">' + badge(o.status) + '</span>' + detail + '</li>';
+        }).join('');
+      })
+      .catch(function () {});
+  }
+
+  list.addEventListener('click', function (e) {
+    var b = e.target.closest('.mischief-send');
+    if (!b) return;
+    open(b.getAttribute('data-token'), b.getAttribute('data-name'));
+  });
+  signedEl.addEventListener('change', drawTiers);
+  document.getElementById('mischief-close').addEventListener('click', close);
+  document.getElementById('mischief-cancel').addEventListener('click', close);
+  modal.addEventListener('click', function (e) { if (e.target === modal) close(); });
+
+  confirmEl.addEventListener('click', function () {
+    if (!current || !chosen) return;
+    confirmEl.disabled = true;
+    resultEl.classList.add('hidden');
+    fetch('/api/mischief/order', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ target_token: current.token, tier: chosen, signed: signedEl.checked })
+    })
+      .then(function (r) { return r.json().then(function (b) { return { ok: r.ok, body: b }; }); })
+      .then(function (res) {
+        resultEl.classList.remove('hidden');
+        if (res.ok) {
+          resultEl.className = 'text-sm text-red-600 font-semibold';
+          resultEl.textContent = 'The word is out. Watch the board.';
+          catalog = null; // balance moved; refetch next open
+          loadOrders();
+          setTimeout(close, 1200);
+        } else {
+          resultEl.className = 'text-sm text-[color:var(--ink)]/70';
+          resultEl.textContent = (res.body && res.body.error) || 'That didn\'t take. Try again.';
+          confirmEl.disabled = false;
+        }
+      })
+      .catch(function () {
+        resultEl.classList.remove('hidden');
+        resultEl.className = 'text-sm text-[color:var(--ink)]/70';
+        resultEl.textContent = 'The line dropped. Try again.';
+        confirmEl.disabled = false;
+      });
+  });
+
+  loadOrders();
+  setInterval(loadOrders, 60000);
+}
 </script>
 {{end}}
 

internal/web/templates/games_layout.html

@@ -68,7 +68,6 @@
         {{template "_comb" .}}
         <span class="min-w-0">
           <span data-room-name class="block font-display text-2xl sm:text-3xl font-bold leading-none tracking-tight">{{.Room.Name}}</span>
-          <span class="mt-1 block text-xs font-semibold uppercase tracking-[0.18em] text-[color:var(--ink)]/45">Chips are euros</span>
         </span>
       </a>
 

internal/web/templates/holdem.html

@@ -145,6 +145,21 @@
     <p data-between-msg class="hidden mt-3 rounded-2xl bg-[color:var(--ink)]/5 px-4 py-2 text-sm font-semibold"></p>
   </section>
 
+  <!-- The rail talk. Chat lives at the felt and does not leave it for Matrix;
+       every line is stamped with the hand it was said during. Shown while you're
+       seated. -->
+  <section data-chat class="hidden rounded-3xl bg-[color:var(--card)] p-4 shadow-pete border-2 border-[color:var(--ink)]/10">
+    <div data-chat-log class="flex flex-col gap-1 max-h-40 overflow-y-auto pr-1 text-sm" aria-live="polite" aria-label="Table chat"></div>
+    <form data-chat-form class="mt-3 flex items-center gap-2">
+      <input data-chat-input type="text" maxlength="240" autocomplete="off" placeholder="Say something to the table…"
+             class="flex-1 min-w-0 rounded-full border-2 border-[color:var(--ink)]/15 bg-[color:var(--bg)] px-4 py-2 text-sm focus:outline-none focus:border-[color:var(--accent)]">
+      <button type="submit"
+              class="rounded-full bg-[color:var(--accent)] px-5 py-2 font-display text-sm font-bold text-white shadow-pete hover:brightness-105 active:translate-y-px transition">
+        Say
+      </button>
+    </form>
+  </section>
+
   <!-- Sitting down: shown when you aren't at a table. -->
   <section data-sitting class="rounded-3xl bg-[color:var(--card)] p-5 sm:p-6 shadow-pete border-2 border-[color:var(--ink)]/10">
 
@@ -195,6 +210,13 @@
       Sit down
     </button>
 
+    <!-- Or pull up a chair at a table someone else has already opened. Bots keep
+         every open table full, so there is always a seat to take. -->
+    <div data-lobby-wrap class="mt-6 hidden">
+      <div class="text-xs font-semibold uppercase tracking-wider text-[color:var(--ink)]/50">Or join a table in progress</div>
+      <div data-lobby class="mt-2 grid gap-2"></div>
+    </div>
+
     <p class="mt-3 text-center text-xs text-[color:var(--ink)]/40">
       The bots are trained, not scripted. The house takes {{.RakePct}}% of a pot that sees a flop, capped at three big blinds, and nothing at all from a hand that doesn't.
     </p>

internal/web/templates/uno.html

@@ -13,23 +13,24 @@
       </a>
       <h1 class="font-display text-3xl font-bold">UNO</h1>
     </div>
-    <p class="text-sm text-[color:var(--ink)]/50">Go out first, or it was somebody else's night</p>
+    <p class="text-sm text-[color:var(--ink)]/50">Sit down, ante up, and go out first — the pot's yours</p>
   </div>
 
   {{template "_chipbar" .}}
 
-  <!-- The felt. The board takes the room and the money lives in a rail beside it:
-       there is no corner free on this table for the house rack to sit in. -->
+  <!-- The felt. Other seats along the top, the deck and the pile in the middle
+       with the pot beside them, your hand at the bottom. Every ante on this table
+       is riding in the pot until somebody goes out and takes it. -->
   <section class="pete-felt pete-uno relative overflow-hidden rounded-3xl p-4 sm:p-6 lg:p-8 shadow-pete-lg border-2 border-[color:var(--ink)]/10">
     <div class="grid gap-5 lg:grid-cols-[minmax(0,1fr),auto] lg:gap-8">
 
       <div class="min-w-0 space-y-5">
 
-        <!-- The bots. Each one is a name, a fan of backs, and a count — which is
-             all you are ever told about them, and all a real opponent shows you. -->
+        <!-- The other seats. Each one is a name, a stack, a fan of backs and a
+             count — all a real opponent shows you. -->
         <div data-seats class="flex flex-wrap items-start justify-center gap-3 sm:gap-5" aria-label="The other players"></div>
 
-        <!-- The middle: what you draw from, and what you play onto. -->
+        <!-- The middle: what you draw from, what you play onto, and the pot. -->
         <div class="flex items-center justify-center gap-5 sm:gap-8">
           <button type="button" data-deck class="pete-uno-deck" aria-label="Draw a card">
             <span class="pete-uno-back" aria-hidden="true"></span>
@@ -39,16 +40,14 @@
           <div class="flex flex-col items-center gap-2">
             <div data-discard class="pete-uno-discard" aria-label="The card in play"></div>
             <p data-colour class="pete-uno-colour" aria-live="polite"></p>
-            <!-- The bill. While a stack stands it is the only thing on the table
-                 that matters, so it is said on the felt and not only on a button.
-
-                 It is data-*bill*, not data-pending: the chip bar already owns
-                 data-pending (chips still in flight from a buy-in), the chip bar is
-                 inside this root, and it comes first in the document — so a stack
-                 was quietly writing "+10 coming your way" over the escrow readout
-                 and never showing up on the felt at all. -->
             <p data-bill class="pete-uno-pending hidden" aria-live="assertive"></p>
           </div>
+
+          <!-- The pot. Every seat's ante is in here until the hand is won. -->
+          <div class="pete-uno-pot text-center">
+            <span class="block text-xs font-bold uppercase tracking-wider text-white/50">Pot</span>
+            <span data-pot class="block font-display text-2xl font-bold tabular-nums text-white">0</span>
+          </div>
         </div>
 
         <!-- Your hand. -->
@@ -74,24 +73,17 @@
           <span data-chip="5"   style="--stack: 6"></span>
         </div>
 
-        <div class="pete-spot" data-spot>
-          <span class="pete-spot-label">Bet</span>
-          <div class="pete-stack" data-stack></div>
-          <span data-spot-total class="pete-spot-total hidden"></span>
-        </div>
-
         <div class="text-center">
           <div class="pete-meter" data-meter>
-            <span class="pete-meter-label">Pays</span>
-            <span data-pays class="pete-meter-value">—</span>
+            <span class="pete-meter-label">In front of you</span>
+            <span data-stack class="pete-meter-value">—</span>
           </div>
           <p data-table-name class="mt-1.5 text-xs font-bold uppercase tracking-wider text-white/40"></p>
         </div>
       </aside>
     </div>
 
-    <!-- Naming a colour for a wild. It sits over the felt because until it is
-         answered there is no legal move on the table underneath it. -->
+    <!-- Naming a colour for a wild. -->
     <div data-wild class="pete-uno-wild hidden" role="dialog" aria-label="Pick a colour">
       <div class="pete-uno-wild-box">
         <p class="font-display text-lg font-bold text-white">Pick a colour</p>
@@ -105,13 +97,7 @@
       </div>
     </div>
 
-    <!-- Calling UNO. The card is already on its way down — this is the word you
-         owe the table for it, and the bar underneath is how long you've got.
-         Let it run out and the bots take you for two.
-
-         There is no cancel here, and there doesn't need to be: clicking a card
-         has always played it on this table, so a gate that makes you press one
-         more thing is strictly more warning than you used to get. -->
+    <!-- Calling UNO. -->
     <div data-unogate class="pete-uno-wild hidden" role="dialog" aria-label="Call UNO">
       <div class="pete-uno-wild-box">
         <p class="font-display text-lg font-bold text-white">Down to one card</p>
@@ -122,8 +108,8 @@
     </div>
   </section>
 
-  <!-- Playing: shown while a game is live. -->
-  <section data-playing class="hidden rounded-3xl bg-[color:var(--card)] p-5 sm:p-6 shadow-pete border-2 border-[color:var(--ink)]/10">
+  <!-- Acting: shown while it's your turn. -->
+  <section data-acting class="hidden rounded-3xl bg-[color:var(--card)] p-5 sm:p-6 shadow-pete border-2 border-[color:var(--ink)]/10">
     <div class="flex flex-wrap items-center gap-3">
       <p data-hint class="text-sm text-[color:var(--ink)]/50">
         Click a card that lights up. Nothing lights up? Draw one.
@@ -134,9 +120,6 @@
                        hover:bg-[color:var(--ink)]/5 active:translate-y-px disabled:opacity-40 disabled:pointer-events-none transition">
           Draw
         </button>
-        <!-- Giving in to a stack. It is a decision, not a draw — you are paying a
-             bill somebody ran up and pointing at you — so it gets a button of its
-             own, and the button says what it costs. -->
         <button type="button" data-take
                 class="hidden rounded-full bg-[#cc3d4a] px-6 py-3 font-display text-lg font-bold text-white shadow-pete
                        hover:brightness-105 active:translate-y-px disabled:opacity-40 disabled:pointer-events-none transition">
@@ -152,15 +135,51 @@
     <p data-game-msg class="hidden mt-3 rounded-2xl bg-[color:var(--ink)]/5 px-4 py-2 text-sm font-semibold"></p>
   </section>
 
-  <!-- Betting: shown between games. -->
-  <section data-betting class="rounded-3xl bg-[color:var(--card)] p-5 sm:p-6 shadow-pete border-2 border-[color:var(--ink)]/10">
+  <!-- Between hands: deal the next one, or get up. -->
+  <section data-between class="hidden rounded-3xl bg-[color:var(--card)] p-5 sm:p-6 shadow-pete border-2 border-[color:var(--ink)]/10">
+    <div class="flex flex-wrap items-center gap-3">
+      <div class="min-w-0">
+        <div class="text-xs font-semibold uppercase tracking-wider text-[color:var(--ink)]/50">In front of you</div>
+        <div class="font-display text-3xl font-bold tabular-nums" data-table-stack>0</div>
+        <p class="mt-0.5 text-xs text-[color:var(--ink)]/40">
+          Bought in for <span data-bought-in class="tabular-nums">0</span> · <span data-ante-note class="tabular-nums">0</span> to ante
+        </p>
+      </div>
+
+      <div class="ml-auto flex flex-wrap items-center gap-2">
+        <button type="button" data-leave
+                class="rounded-full border-2 border-[color:var(--ink)]/15 bg-[color:var(--card)] px-5 py-3 font-display text-base font-bold shadow-pete
+                       hover:bg-[color:var(--ink)]/5 active:translate-y-px disabled:opacity-40 disabled:pointer-events-none transition">
+          Get up
+        </button>
+        <button type="button" data-deal
+                class="rounded-full bg-[color:var(--accent)] px-8 py-3 font-display text-lg font-bold text-white shadow-pete
+                       hover:brightness-105 active:translate-y-px disabled:opacity-40 disabled:pointer-events-none transition">
+          Next hand
+        </button>
+      </div>
+    </div>
+    <p data-between-msg class="hidden mt-3 rounded-2xl bg-[color:var(--ink)]/5 px-4 py-2 text-sm font-semibold"></p>
+  </section>
+
+  <!-- The rail talk, shown while you're seated. -->
+  <section data-chat class="hidden rounded-3xl bg-[color:var(--card)] p-4 shadow-pete border-2 border-[color:var(--ink)]/10">
+    <div data-chat-log class="flex flex-col gap-1 max-h-40 overflow-y-auto pr-1 text-sm" aria-live="polite" aria-label="Table chat"></div>
+    <form data-chat-form class="mt-3 flex items-center gap-2">
+      <input data-chat-input type="text" maxlength="240" autocomplete="off" placeholder="Say something to the table…"
+             class="flex-1 min-w-0 rounded-full border-2 border-[color:var(--ink)]/15 bg-[color:var(--bg)] px-4 py-2 text-sm focus:outline-none focus:border-[color:var(--accent)]">
+      <button type="submit"
+              class="rounded-full bg-[color:var(--accent)] px-5 py-2 font-display text-sm font-bold text-white shadow-pete hover:brightness-105 active:translate-y-px transition">
+        Say
+      </button>
+    </form>
+  </section>
+
+  <!-- Sitting down: shown when you aren't at a table. -->
+  <section data-sitting class="rounded-3xl bg-[color:var(--card)] p-5 sm:p-6 shadow-pete border-2 border-[color:var(--ink)]/10">
 
-    <!-- Two dials, and they are different dials. The table size is the tier — it is
-         what you're paid for. No Mercy is the *deck*, and it is a switch across all
-         three sizes, which is why it sits up here beside the question rather than
-         being a fourth table. -->
     <div class="flex flex-wrap items-center justify-between gap-3">
-      <div class="text-xs font-semibold uppercase tracking-wider text-[color:var(--ink)]/50">Who are you playing?</div>
+      <div class="text-xs font-semibold uppercase tracking-wider text-[color:var(--ink)]/50">Which table?</div>
       <div class="pete-seg" role="group" aria-label="Which rules">
         <button type="button" data-rules="normal" class="pete-seg-btn">UNO</button>
         <button type="button" data-rules="nomercy" class="pete-seg-btn">No Mercy</button>
@@ -170,15 +189,15 @@
     <div data-grid="normal">
       <div class="mt-2 grid gap-2 sm:grid-cols-3">
         {{range .Tables}}
-        <button type="button" data-tier="{{.Slug}}"
+        <button type="button" data-tier="{{.Slug}}" data-min="{{.MinBuy}}" data-max="{{.MaxBuy}}" data-ante="{{.Ante}}"
                 class="pete-tier rounded-2xl border-2 p-3 text-left transition">
           <div class="flex items-baseline justify-between gap-2">
             <span class="font-display text-lg font-bold">{{.Name}}</span>
-            <span class="font-display text-lg font-bold tabular-nums text-[color:var(--accent)]">{{printf "%.1f" .Base}}×</span>
+            <span class="font-display text-lg font-bold tabular-nums text-[color:var(--accent)]">{{.Ante}} ante</span>
           </div>
           <p class="mt-0.5 text-xs text-[color:var(--ink)]/50">{{.Blurb}}</p>
           <p class="mt-1.5 text-xs font-semibold text-[color:var(--ink)]/40">
-            {{.Bots}} bot{{if gt .Bots 1}}s{{end}} · seven cards each
+            {{.Bots}} bot{{if gt .Bots 1}}s{{end}} · buy in {{.MinBuy}}–{{.MaxBuy}}
           </p>
         </button>
         {{end}}
@@ -188,11 +207,11 @@
     <div data-grid="nomercy" class="hidden">
       <div class="mt-2 grid gap-2 sm:grid-cols-3">
         {{range .NoMercy}}
-        <button type="button" data-tier="{{.Slug}}"
+        <button type="button" data-tier="{{.Slug}}" data-min="{{.MinBuy}}" data-max="{{.MaxBuy}}" data-ante="{{.Ante}}"
                 class="pete-tier pete-tier-nm rounded-2xl border-2 p-3 text-left transition">
           <div class="flex items-baseline justify-between gap-2">
             <span class="font-display text-lg font-bold">{{.Name}}</span>
-            <span class="font-display text-lg font-bold tabular-nums text-[color:var(--accent)]">{{printf "%.1f" .Base}}×</span>
+            <span class="font-display text-lg font-bold tabular-nums text-[color:var(--accent)]">{{.Ante}} ante</span>
           </div>
           <p class="mt-0.5 text-xs text-[color:var(--ink)]/50">{{.Blurb}}</p>
           <p class="mt-1.5 text-xs font-semibold text-[color:var(--ink)]/40">
@@ -203,38 +222,31 @@
       </div>
     </div>
 
-    <div class="mt-5 flex flex-wrap items-center gap-x-6 gap-y-4">
-      <div>
-        <div class="text-xs font-semibold uppercase tracking-wider text-[color:var(--ink)]/50">Your bet</div>
-        <div class="font-display text-3xl font-bold tabular-nums"><span data-bet-amount>0</span></div>
+    <div class="mt-5">
+      <div class="text-xs font-semibold uppercase tracking-wider text-[color:var(--ink)]/50">Buying in for</div>
+      <div class="mt-2 flex items-center gap-3">
+        <input type="range" data-buyin-slider class="flex-1 min-w-0" aria-label="How much to buy in for">
+        <span data-buyin class="font-display text-2xl font-bold tabular-nums">0</span>
+      </div>
+      <p class="mt-1.5 text-xs text-[color:var(--ink)]/40" data-buyin-note></p>
     </div>
 
-      <div class="flex flex-wrap items-center gap-2">
-        {{range .Denominations}}
-        <button type="button" data-chip="{{.}}" aria-label="Bet {{.}} more"
-                class="pete-chip pete-disc grid h-12 w-12 place-items-center font-display text-sm font-bold text-white">
-          <span>{{.}}</span>
-        </button>
-        {{end}}
-        <button type="button" data-bet-clear
-                class="rounded-full px-3 py-2 text-sm font-semibold text-[color:var(--ink)]/50 hover:text-[color:var(--ink)] transition">Clear</button>
-      </div>
-
-      <button type="button" data-start
-              class="ml-auto rounded-full bg-[color:var(--accent)] px-8 py-3 font-display text-lg font-bold text-white shadow-pete
+    <button type="button" data-sit
+            class="mt-5 w-full rounded-full bg-[color:var(--accent)] px-8 py-3 font-display text-lg font-bold text-white shadow-pete
                    hover:brightness-105 active:translate-y-px disabled:opacity-40 disabled:pointer-events-none transition">
-        Deal
+      Sit down
     </button>
+
+    <div data-lobby-wrap class="mt-6 hidden">
+      <div class="text-xs font-semibold uppercase tracking-wider text-[color:var(--ink)]/50">Or join a table in progress</div>
+      <div data-lobby class="mt-2 grid gap-2"></div>
     </div>
-    <!-- No Mercy pays *less*, which reads like a typo until you've played one: the
-         mercy rule buries bots too, and every bot it buries is one fewer seat that
-         can beat you to the last card. Say so, rather than let it look like a bug. -->
+
     <p data-note="normal" class="mt-3 text-center text-xs text-[color:var(--ink)]/40">
-      Normal rules: no stacking a +2 on a +2, and a reverse is a skip when it's just the two of you.
+      Everyone antes, and the first one out takes the pot less {{.RakePct}}% rake. Normal rules: no stacking a +2 on a +2, and a reverse is a skip when it's just the two of you.
     </p>
     <p data-note="nomercy" class="hidden mt-3 text-center text-xs text-[color:var(--ink)]/40">
-      168 cards, +6s and +10s. Draw cards stack, you draw until you can play, and {{.MercyLimit}} cards in
-      your hand puts you out of the game. It pays less than normal UNO because it buries the bots too.
+      168 cards, +6s and +10s. Draw cards stack, you draw until you can play, and {{.MercyLimit}} cards in your hand puts you out of the hand. The pot still goes to whoever goes out first.
     </p>
     <p data-table-msg class="hidden mt-3 rounded-2xl bg-[color:var(--ink)]/5 px-4 py-2 text-sm font-semibold"></p>
   </section>

internal/web/templates/who.html

@@ -0,0 +1,207 @@
+{{define "title"}}{{.Mark.Name}} — {{.SiteTitle}}{{end}}
+
+{{define "main"}}
+<article class="mt-2 mb-10 max-w-3xl mx-auto" id="who" data-token="{{.Mark.Token}}">
+  <nav class="mb-4">
+    <a href="/adventure" class="inline-flex items-center gap-1.5 text-sm font-semibold text-[color:var(--ink)]/60 hover:text-[color:var(--ink)] transition">
+      <span aria-hidden="true">←</span> The board
+    </a>
+  </nav>
+
+  <header class="rounded-3xl bg-theme-adventure text-white p-6 sm:p-10 shadow-pete relative overflow-hidden">
+    <div class="absolute -top-6 -right-6 text-[12rem] opacity-20 select-none" aria-hidden="true">{{if .Mark.OnRun}}⚔{{else}}🏠{{end}}</div>
+    <div class="relative">
+      <p class="text-sm uppercase tracking-[0.2em] opacity-80">adventurer</p>
+      <h1 class="font-display text-3xl sm:text-4xl font-bold mt-2 leading-tight">{{.Mark.Name}}</h1>
+      <p class="mt-2 opacity-90">Level {{.Mark.Level}} {{.Mark.ClassRace}}</p>
+      <p class="mt-4 text-xs uppercase tracking-wider opacity-75" id="who-where">
+        {{if .Mark.OnRun}}{{.Mark.Where}}{{else}}In town{{if .Mark.Idle}} · {{.Mark.Idle}}{{end}}{{end}}
+      </p>
+    </div>
+  </header>
+
+  {{if .HasDetail}}
+  <!-- Stats + gear: public, the same anonymity model as the board. -->
+  <section class="mt-8 grid gap-6 sm:grid-cols-2">
+    <div class="rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
+      <h2 class="font-display text-xl font-bold mb-4">Vitals</h2>
+      <div class="flex items-baseline justify-between">
+        <span class="text-sm uppercase tracking-wider text-[color:var(--ink)]/50">Hit points</span>
+        <span class="font-semibold" id="who-hp">{{.Detail.HPCurrent}} / {{.Detail.HPMax}}{{if .Detail.TempHP}} <span class="text-theme-adventure">+{{.Detail.TempHP}}</span>{{end}}</span>
+      </div>
+      <div class="mt-2 h-2 rounded-full bg-[color:var(--ink)]/10 overflow-hidden">
+        <div class="h-full rounded-full bg-theme-adventure transition-all" id="who-hp-bar" style="width:0%"></div>
+      </div>
+      <div class="mt-4 flex items-baseline justify-between">
+        <span class="text-sm uppercase tracking-wider text-[color:var(--ink)]/50">Armor class</span>
+        <span class="font-semibold" id="who-ac">{{.Detail.ArmorClass}}</span>
+      </div>
+
+      <div class="mt-5 grid grid-cols-3 gap-2">
+        {{range .Abilities}}
+        <div class="rounded-2xl bg-[color:var(--ink)]/5 px-2 py-3 text-center">
+          <div class="text-[10px] uppercase tracking-wider text-[color:var(--ink)]/50">{{.Label}}</div>
+          <div class="font-display text-lg font-bold leading-none mt-1">{{.Score}}</div>
+          <div class="text-xs text-[color:var(--ink)]/60">{{.ModStr}}</div>
+        </div>
+        {{end}}
+      </div>
+
+      {{if .Mark.OnRun}}
+      <div class="mt-5 pt-4 border-t border-[color:var(--ink)]/10 space-y-1.5 text-sm" id="who-expedition">
+        {{if .Detail.Room}}<div class="flex justify-between"><span class="text-[color:var(--ink)]/50">Room</span><span class="font-semibold" id="who-room">{{.Detail.Room}}</span></div>{{end}}
+        <div class="flex justify-between"><span class="text-[color:var(--ink)]/50">Supplies</span><span class="font-semibold" id="who-supplies">{{.Detail.Supplies}}</span></div>
+        {{if .Detail.ThreatLevel}}<div class="flex justify-between"><span class="text-[color:var(--ink)]/50">Threat</span><span class="font-semibold" id="who-threat">{{.Detail.ThreatLevel}}</span></div>{{end}}
+      </div>
+      {{end}}
+    </div>
+
+    <div class="rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
+      <h2 class="font-display text-xl font-bold mb-4">Gear</h2>
+      {{if .Detail.Gear}}
+      <ul class="space-y-2">
+        {{range .Detail.Gear}}
+        <li class="flex items-baseline justify-between gap-3">
+          <span class="text-xs uppercase tracking-wider text-[color:var(--ink)]/45 w-16 shrink-0">{{.Slot}}</span>
+          <span class="font-semibold flex-1">{{.Name}}{{if .Masterwork}} <span title="masterwork">★</span>{{end}}</span>
+          <span class="text-xs text-[color:var(--ink)]/50 shrink-0">T{{.Tier}}{{if .Condition}} · {{.Condition}}%{{end}}</span>
+        </li>
+        {{end}}
+      </ul>
+      {{else}}
+      <p class="text-sm text-[color:var(--ink)]/50">Traveling light — nothing equipped.</p>
+      {{end}}
+    </div>
+  </section>
+  {{else}}
+  <section class="mt-8 rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
+    <p class="text-sm text-[color:var(--ink)]/60">No detailed sheet on file for this adventurer yet — check back after the next snapshot.</p>
+  </section>
+  {{end}}
+
+  {{if .HasSelf}}
+  <!-- Owner-only: this is you. Inventory, vault, house, pets — private, served
+       only because your signed-in localpart owns this page's token. -->
+  <section class="mt-8">
+    <div class="flex items-center gap-2 mb-3">
+      <span class="rounded-full bg-theme-adventure text-white text-xs font-semibold px-3 py-1">Your adventurer</span>
+      <span class="text-xs text-[color:var(--ink)]/45">only you can see the panels below</span>
+    </div>
+
+    <div class="grid gap-6 sm:grid-cols-2">
+      <div class="rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
+        <h2 class="font-display text-xl font-bold mb-4">Home</h2>
+        <div class="space-y-1.5 text-sm">
+          <div class="flex justify-between"><span class="text-[color:var(--ink)]/50">House tier</span><span class="font-semibold">{{if .Self.House.Tier}}{{.Self.House.Tier}}{{else}}no house{{end}}</span></div>
+          {{if .Self.House.LoanBalance}}<div class="flex justify-between"><span class="text-[color:var(--ink)]/50">Loan balance</span><span class="font-semibold">{{.Self.House.LoanBalance}}</span></div>{{end}}
+          {{if .Self.House.Rate}}<div class="flex justify-between"><span class="text-[color:var(--ink)]/50">Rate</span><span class="font-semibold">{{.Self.House.Rate}}</span></div>{{end}}
+          {{if .Self.House.Autopay}}<div class="flex justify-between"><span class="text-[color:var(--ink)]/50">Autopay</span><span class="font-semibold">on</span></div>{{end}}
+        </div>
+
+        <h3 class="font-display text-lg font-bold mt-6 mb-3">Pets</h3>
+        {{if .Self.Pets}}
+        <ul class="space-y-2 text-sm">
+          {{range .Self.Pets}}
+          <li class="flex items-baseline justify-between gap-3">
+            <span class="font-semibold flex-1">{{if .Name}}{{.Name}}{{else}}your {{.Type}}{{end}} <span class="text-[color:var(--ink)]/45 font-normal">{{.Type}}</span></span>
+            <span class="text-xs text-[color:var(--ink)]/50 shrink-0">lv {{.Level}}{{if .ArmorTier}} · barding T{{.ArmorTier}}{{end}}</span>
+          </li>
+          {{end}}
+        </ul>
+        {{else}}
+        <p class="text-sm text-[color:var(--ink)]/50">No pets right now.</p>
+        {{end}}
+      </div>
+
+      <div class="rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
+        <h2 class="font-display text-xl font-bold mb-4">Backpack</h2>
+        {{if .Self.Inventory}}
+        <ul class="space-y-1.5 text-sm max-h-72 overflow-y-auto pr-1">
+          {{range .Self.Inventory}}
+          <li class="flex items-baseline justify-between gap-3">
+            <span class="flex-1">{{.Name}}{{if .Temper}} <span class="text-theme-adventure">+{{.Temper}}</span>{{end}}</span>
+            <span class="text-xs text-[color:var(--ink)]/50 shrink-0">T{{.Tier}}{{if .Value}} · {{.Value}}g{{end}}</span>
+          </li>
+          {{end}}
+        </ul>
+        {{else}}
+        <p class="text-sm text-[color:var(--ink)]/50">Backpack's empty.</p>
+        {{end}}
+
+        {{if .Self.Vault}}
+        <h3 class="font-display text-lg font-bold mt-6 mb-3">Vault</h3>
+        <ul class="space-y-1.5 text-sm max-h-52 overflow-y-auto pr-1">
+          {{range .Self.Vault}}
+          <li class="flex items-baseline justify-between gap-3">
+            <span class="flex-1">{{.Name}}{{if .Temper}} <span class="text-theme-adventure">+{{.Temper}}</span>{{end}}</span>
+            <span class="text-xs text-[color:var(--ink)]/50 shrink-0">T{{.Tier}}{{if .Value}} · {{.Value}}g{{end}}</span>
+          </li>
+          {{end}}
+        </ul>
+        {{end}}
+      </div>
+    </div>
+  </section>
+  {{end}}
+</article>
+
+<script>
+// The sheet is state, like the board: keep an open tab honest without a reload.
+// Public detail only (HP, room, supplies) — the private panels stay as rendered.
+(function () {
+  var root = document.getElementById('who');
+  if (!root) return;
+  var token = root.getAttribute('data-token');
+
+  function setBar() {
+    var el = document.getElementById('who-hp-bar');
+    var hp = document.getElementById('who-hp');
+    if (!el || !hp) return;
+    var m = hp.textContent.match(/(-?\d+)\s*\/\s*(\d+)/);
+    if (!m) return;
+    var cur = parseInt(m[1], 10), max = parseInt(m[2], 10);
+    var pct = max > 0 ? Math.max(0, Math.min(100, Math.round(cur / max * 100))) : 0;
+    el.style.width = pct + '%';
+  }
+  setBar();
+
+  function txt(id, v) { var el = document.getElementById(id); if (el && v != null) el.textContent = v; }
+
+  var timer = null;
+  function refresh() {
+    fetch('/api/adventure/who/' + encodeURIComponent(token), { headers: { 'Accept': 'application/json' } })
+      .then(function (r) { return r.ok ? r.json() : null; })
+      .then(function (data) {
+        if (!data) return;
+        if (!data.live) {
+          // Off the board entirely (expedition ended, opted out): nothing more to
+          // poll for, so stop the timer rather than hammer a token that's gone.
+          txt('who-where', 'Back in town');
+          if (timer) clearInterval(timer);
+          return;
+        }
+        var d = data.detail || {};
+        var mark = data.mark || {};
+        if (data.has_detail) {
+          var temp = d.temp_hp ? ' +' + d.temp_hp : '';
+          txt('who-hp', d.hp_current + ' / ' + d.hp_max + temp);
+          txt('who-ac', d.armor_class);
+          txt('who-room', d.room);
+          txt('who-supplies', d.supplies);
+          txt('who-threat', d.threat_level);
+          setBar();
+        }
+        // Keep the location line honest in both directions: a mark that came back
+        // to town while still on the board must stop showing its old expedition.
+        if (mark.OnRun) {
+          txt('who-where', mark.Where);
+        } else {
+          txt('who-where', 'In town' + (mark.Idle ? ' · ' + mark.Idle : ''));
+        }
+      })
+      .catch(function () { /* transient — next tick will do */ });
+  }
+  timer = setInterval(refresh, 60000);
+})();
+</script>
+{{end}}

internal/web/who.go

@@ -0,0 +1,167 @@
+package web
+
+import (
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+
+	"pete/internal/storage"
+)
+
+// The adventurer detail page.
+//
+// A click-through from the live board: anyone may see a mark's current stats and
+// equipped gear (the same anonymity model as the board — a character name and a
+// sheet, never a Matrix handle). The signed-in owner sees the same page enriched
+// with their private inventory, vault, house, and pets.
+//
+// Both halves are still gogobee → Pete: the public detail rides the roster
+// snapshot, the private detail rides its own push. Pete renders what it was
+// given; it never reaches back into the game box.
+
+// whoDetail is the public sheet as gogobee pushed it (RosterEntry.Detail).
+type whoDetail struct {
+	HPCurrent   int       `json:"hp_current"`
+	HPMax       int       `json:"hp_max"`
+	TempHP      int       `json:"temp_hp"`
+	ArmorClass  int       `json:"armor_class"`
+	Abilities   [6]int    `json:"abilities"`
+	Modifiers   [6]int    `json:"modifiers"`
+	Gear        []whoGear `json:"gear"`
+	Supplies    int       `json:"supplies"`
+	ThreatLevel int       `json:"threat_level"`
+	Room        string    `json:"room"`
+}
+
+type whoGear struct {
+	Slot       string `json:"slot"`
+	Name       string `json:"name"`
+	Tier       int    `json:"tier"`
+	Condition  int    `json:"condition"`
+	Masterwork bool   `json:"masterwork"`
+}
+
+// abilityRow is one ability line, pre-formatted for the template.
+type abilityRow struct {
+	Label  string
+	Score  int
+	ModStr string // "+2", "-1"
+}
+
+var abilityLabels = [6]string{"STR", "DEX", "CON", "INT", "WIS", "CHA"}
+
+type whoPage struct {
+	pageData
+	Mark      RosterView
+	HasDetail bool
+	Detail    whoDetail
+	Abilities []abilityRow
+	HasSelf   bool
+	Self      storage.PlayerDetail
+}
+
+// handleAdventureWho serves one adventurer's detail page. Public; 404s when the
+// token isn't on the current board — the same liveness gate the storefront uses,
+// so a stale or guessed token never resolves to a page.
+func (s *Server) handleAdventureWho(w http.ResponseWriter, r *http.Request) {
+	if !s.adv.Enabled {
+		http.NotFound(w, r)
+		return
+	}
+	token := r.PathValue("token")
+	entry, ok, err := storage.RosterEntryByToken(token)
+	if err != nil {
+		slog.Error("who: roster lookup failed", "err", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	s.track(r, "adventure")
+
+	base := s.base(r)
+	base.Active = "adventure"
+	base.NoIndex = true // names a player character; keep out of search indexes
+
+	page := whoPage{
+		pageData: base,
+		Mark:     toRosterView(entry),
+	}
+	if d, abil, ok := decodeWhoDetail(entry.Detail); ok {
+		page.HasDetail = true
+		page.Detail = d
+		page.Abilities = abil
+	}
+
+	// Owner enrichment: only when the signed-in user's localpart owns this exact
+	// page token. The ownership is proven by a row gogobee pushed, never by
+	// reversing the token, so no visitor can unlock another player's self extras.
+	if s.auth != nil {
+		if u := s.auth.userFromRequest(r); u != nil {
+			if self, ok, err := storage.PlayerDetailByOwner(buyerLocalpart(u), token); err == nil && ok {
+				page.HasSelf = true
+				page.Self = self
+			}
+		}
+	}
+
+	s.render(w, "who", page)
+}
+
+// handleAdventureWhoAPI serves the public detail as JSON for the page's live
+// re-poll, so an open tab tracks HP / room / supplies as they move. Public — the
+// same exposure as the rendered page. The private self extras are not included:
+// inventory changes rarely and stays server-rendered behind the ownership check.
+func (s *Server) handleAdventureWhoAPI(w http.ResponseWriter, r *http.Request) {
+	if !s.adv.Enabled {
+		http.NotFound(w, r)
+		return
+	}
+	token := r.PathValue("token")
+	entry, ok, err := storage.RosterEntryByToken(token)
+	if err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	if !ok {
+		// Gone from the board (expedition ended, opted out): tell the poller so it
+		// can stop, rather than 404-ing an open tab into an error.
+		_ = json.NewEncoder(w).Encode(map[string]any{"live": false})
+		return
+	}
+	d, abil, hasDetail := decodeWhoDetail(entry.Detail)
+	_ = json.NewEncoder(w).Encode(map[string]any{
+		"live":       true,
+		"mark":       toRosterView(entry),
+		"has_detail": hasDetail,
+		"detail":     d,
+		"abilities":  abil,
+	})
+}
+
+// decodeWhoDetail unpacks the public detail blob and builds the ability rows.
+// Returns ok=false when there is no detail (a snapshot from before the detail
+// push), so the page can fall back to the summary the board already has.
+func decodeWhoDetail(raw json.RawMessage) (whoDetail, []abilityRow, bool) {
+	if len(raw) == 0 {
+		return whoDetail{}, nil, false
+	}
+	var d whoDetail
+	if err := json.Unmarshal(raw, &d); err != nil {
+		return whoDetail{}, nil, false
+	}
+	rows := make([]abilityRow, 0, 6)
+	for i := 0; i < 6; i++ {
+		rows = append(rows, abilityRow{
+			Label:  abilityLabels[i],
+			Score:  d.Abilities[i],
+			ModStr: fmt.Sprintf("%+d", d.Modifiers[i]),
+		})
+	}
+	return d, rows, true
+}

internal/web/who_test.go

@@ -0,0 +1,199 @@
+package web
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"pete/internal/storage"
+)
+
+// The adventurer detail page. Two contracts under test: the public sheet reaches
+// any visitor (stats + gear, never a handle), and the private self-view unlocks
+// only for the signed-in owner of that exact page — anon and other users see the
+// public page and nothing more.
+
+func postDetail(t *testing.T, s *Server, token string, push detailPush) *httptest.ResponseRecorder {
+	t.Helper()
+	body, _ := json.Marshal(push)
+	req := httptest.NewRequest("POST", "/api/ingest/detail", bytes.NewReader(body))
+	if token != "" {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+	w := httptest.NewRecorder()
+	s.handleDetailIngest(w, req)
+	return w
+}
+
+// publicDetail is the sheet gogobee hangs on a roster entry, marshalled the way
+// the roster push carries it.
+func publicDetail(t *testing.T) json.RawMessage {
+	t.Helper()
+	raw, err := json.Marshal(map[string]any{
+		"hp_current":  30,
+		"hp_max":      42,
+		"temp_hp":     5,
+		"armor_class": 17,
+		"abilities":   [6]int{16, 14, 15, 10, 12, 8},
+		"modifiers":   [6]int{3, 2, 2, 0, 1, -1},
+		"gear": []map[string]any{
+			{"slot": "weapon", "name": "Rusty Sword", "tier": 0, "condition": 100},
+			{"slot": "armor", "name": "Padded Vest", "tier": 0, "condition": 100},
+		},
+		"supplies":     8,
+		"threat_level": 2,
+		"room":         "3 / 7",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+// seedWho puts one adventurer on the board with a public detail sheet, and
+// pushes a private self-detail set owned by `owner` for that same token.
+func seedWho(t *testing.T, owner string) *Server {
+	s, _ := newAdvServer(t, "tok")
+	s.auth = &Authenticator{secret: []byte("test-secret-key-at-least-16")}
+	now := time.Now().Unix()
+
+	e := entry("tok-josie", "Josie", "expedition", "holymachina")
+	e.Level = 14
+	e.ClassRace = "human cleric"
+	e.Detail = publicDetail(t)
+	if w := postRoster(t, s, "tok", rosterPush{SnapshotAt: now, Adventurers: []storage.RosterEntry{e}}); w.Code != 200 {
+		t.Fatalf("seed roster = %d", w.Code)
+	}
+	if w := postDetail(t, s, "tok", detailPush{SnapshotAt: now, Players: []storage.PlayerDetail{{
+		Localpart: owner,
+		Token:     "tok-josie",
+		Inventory: []storage.ItemView{{Name: "Iron Ore", Type: "ore", Tier: 1, Value: 10}},
+		Vault:     []storage.ItemView{{Name: "Jeweled Crown", Type: "treasure", Tier: 4, Value: 5000}},
+		House:     storage.HouseView{Tier: 2, LoanBalance: 1500},
+		Pets:      []storage.PetView{{Type: "cat", Name: "Mittens", Level: 3}},
+	}}}); w.Code != 200 {
+		t.Fatalf("seed detail = %d", w.Code)
+	}
+	return s
+}
+
+func getWho(t *testing.T, s *Server, token, asUser string) *httptest.ResponseRecorder {
+	t.Helper()
+	var req = httptest.NewRequest("GET", "/adventure/who/"+token, nil)
+	req.SetPathValue("token", token)
+	if asUser != "" {
+		payload, _ := json.Marshal(SessionUser{Sub: "sub-1", Username: asUser, Exp: time.Now().Add(time.Hour).Unix()})
+		req.AddCookie(&http.Cookie{Name: sessionCookie, Value: s.auth.sign(payload)})
+	}
+	w := httptest.NewRecorder()
+	s.handleAdventureWho(w, req)
+	return w
+}
+
+// TestWhoPublicSheet: any visitor sees the mark's stats and gear — driven
+// through the real template, so a field slip 500s here rather than in prod.
+func TestWhoPublicSheet(t *testing.T) {
+	s := seedWho(t, "josie")
+
+	w := getWho(t, s, "tok-josie", "") // anonymous
+	if w.Code != 200 {
+		t.Fatalf("GET who = %d, want 200", w.Code)
+	}
+	body := w.Body.String()
+	for _, want := range []string{"Josie", "human cleric", "Rusty Sword", "Padded Vest"} {
+		if !strings.Contains(body, want) {
+			t.Errorf("public page missing %q", want)
+		}
+	}
+	// The private goods must NOT be on an anonymous render.
+	for _, leak := range []string{"Iron Ore", "Jeweled Crown", "Mittens"} {
+		if strings.Contains(body, leak) {
+			t.Errorf("anonymous page leaked private detail %q", leak)
+		}
+	}
+}
+
+// TestWhoSelfUnlock: the owner, signed in on their own page, sees the private
+// inventory/vault/house/pets inline.
+func TestWhoSelfUnlock(t *testing.T) {
+	s := seedWho(t, "josie")
+
+	w := getWho(t, s, "tok-josie", "josie")
+	if w.Code != 200 {
+		t.Fatalf("owner GET who = %d, want 200", w.Code)
+	}
+	body := w.Body.String()
+	for _, want := range []string{"Iron Ore", "Jeweled Crown", "Mittens"} {
+		if !strings.Contains(body, want) {
+			t.Errorf("owner page missing private detail %q", want)
+		}
+	}
+}
+
+// TestWhoSelfUnlockCaseInsensitive: Authentik may hand back a mixed-case
+// username; the localpart it maps to is lowercase. The owner must still unlock.
+func TestWhoSelfUnlockCaseInsensitive(t *testing.T) {
+	s := seedWho(t, "josie")
+
+	w := getWho(t, s, "tok-josie", "Josie") // capital-J session
+	if !strings.Contains(w.Body.String(), "Iron Ore") {
+		t.Error("a mixed-case owner username failed to unlock their own self-view")
+	}
+}
+
+// TestWhoOtherUserNoUnlock: a different signed-in player sees only the public
+// sheet on someone else's page — the ownership join must not leak across users.
+func TestWhoOtherUserNoUnlock(t *testing.T) {
+	s := seedWho(t, "josie")
+
+	w := getWho(t, s, "tok-josie", "quack") // signed in, but not the owner
+	if w.Code != 200 {
+		t.Fatalf("other-user GET who = %d, want 200", w.Code)
+	}
+	body := w.Body.String()
+	if !strings.Contains(body, "Josie") {
+		t.Error("public sheet missing for a signed-in non-owner")
+	}
+	for _, leak := range []string{"Iron Ore", "Jeweled Crown", "Mittens"} {
+		if strings.Contains(body, leak) {
+			t.Errorf("a non-owner unlocked private detail %q", leak)
+		}
+	}
+}
+
+// TestWhoOffBoardIs404: a token that isn't on the current board resolves to
+// nothing — the same liveness gate the storefront uses, so a stale or guessed
+// token never renders a page.
+func TestWhoOffBoardIs404(t *testing.T) {
+	s := seedWho(t, "josie")
+	if w := getWho(t, s, "tok-ghost", ""); w.Code != 404 {
+		t.Errorf("off-board token = %d, want 404", w.Code)
+	}
+}
+
+// TestDetailIngestReplacesAndAuth: the detail push is bearer-gated and swaps the
+// set whole, so a player dropped from a later push loses their self-view.
+func TestDetailIngestReplacesAndAuth(t *testing.T) {
+	s := seedWho(t, "josie")
+
+	if w := postDetail(t, s, "wrong", detailPush{SnapshotAt: time.Now().Unix()}); w.Code != 401 {
+		t.Errorf("bad bearer = %d, want 401", w.Code)
+	}
+
+	// A later push without Josie: her self-view must be gone, but the public
+	// board (a separate keyspace) is untouched, so her page still renders public.
+	if w := postDetail(t, s, "tok", detailPush{SnapshotAt: time.Now().Unix() + 60}); w.Code != 200 {
+		t.Fatalf("empty detail push = %d, want 200", w.Code)
+	}
+	body := getWho(t, s, "tok-josie", "josie").Body.String()
+	if strings.Contains(body, "Iron Ore") {
+		t.Error("owner still unlocked after her detail was dropped from the push")
+	}
+	if !strings.Contains(body, "Josie") {
+		t.Error("public page vanished when only the private detail was dropped")
+	}
+}

main.go

@@ -300,6 +300,7 @@ func main() {
 			ws.StartPushSender(ctx)
 			ws.StartAdventureDigest(ctx)
 			ws.StartTriviaBank(ctx)
+			ws.StartTableClock(ctx)
 		}
 	}