# Pete Games — games.parodia.dev A web casino/arcade on Pete, authenticated by Authentik, playing for gogobee euros. Blackjack, Texas Hold'em, UNO (normal + no-mercy), Hangman, Trivia. Companion to `gogobee_mischief_plan.md`, which already established the web↔game seam. This plan reuses that seam wholesale and does not invent a second one. --- ## 0. Progress — last updated 2026-07-14 A multi-session build. This section is the handover; read it before anything else. ### Decisions taken (these close §9's open questions) - **Chips are 1:1 with euros.** No second denomination. - **Session buy-in cap: €10,000**, enforced against chips held *plus* buy-ins still in flight, so it can't be cleared by firing several requests at once. - **A house rake**, 5% in blackjack's `DefaultRules`, taken from *winnings only* — never the stake. A push returns the bet untouched; a loss is never charged a fee. - **The site shares Pete's design, not Pete's shell.** *(Revised 2026-07-13 — this replaces the earlier "the site must look like Pete", which meant `layout.html` itself.)* The casino is its own place. It takes the design language — Fredoka/ Nunito, the four palette vars, `rounded-3xl`, `shadow-pete`, the bubbly weight of everything — and takes none of the furniture: no Pete avatar, no channel nav, no search, no reader, no settings, no weather canvas, no PWA. It has its own layout (`games_layout.html`), its own header, its own footer, its own scripts. Still not an SPA; still server-rendered `html/template`. - **It has two names, on a clock.** Casinopolis by day, Casino Night Zone from six in the evening — palette, felt and the sign over the door all change together. This is the news app's phase system pointed at a joke: one `data-room` attribute, two palette blocks, and a rule shared between `roomAt()` in Go (first paint) and the same rule in JS (the player's own clock, so a player abroad gets their own evening). - **Dealing is animated.** Cards visibly dealt and flipped, chips that move. This is a requirement, not polish to drop when the clock runs out. ### Done - **Phase 0 — euro idempotency (gogobee).** `euro_transactions.external_id` + a partial unique index, and `CreditIdem`/`DebitIdem` in `internal/plugin/euro.go`: balance mutation and transaction log in one tx, keyed by the escrow GUID. A replay reports success without moving money again; a rejection writes nothing, so the same GUID stays retryable once the player is good for it. Six tests, including eight goroutines racing one GUID. *(gogobee `ab2bcf0`)* - **`pete/internal/games/cards`** — the shared deck gogobee never had. RNG is threaded, never the package global, so a hand is reproducible from its seed. *(pete `8310b30`)* - **`pete/internal/games/blackjack`** — pure reducer, `ApplyMove(state, move) (state, []Event, error)`, where an error means the move was illegal and nothing else. State is a plain value: it serializes, so a hand survives a redeploy, and it replays. Six decks, 3:2, dealer hits soft 17, plus the rake. *(pete `8310b30`)* - **`pete/internal/storage/games.go`** — the euro/chip border. `game_chips`, `game_escrow`, `game_hands`. Chips appear only once gogobee confirms it took the euros; chips are destroyed the moment a cash-out opens (so they can't be bet while their euros are in flight) and come back if the credit fails. Table cap, 30-minute reaper, per-hand audit log with seeds. 17 tests. *(pete `f9a98f7`)* - **The wire protocol.** Pete serves `GET /api/games/escrow/pending`, `POST …/claim`, `POST …/settled` (`internal/web/games.go`), bearer-authed on the adventure ingest token. gogobee polls every 3s (`internal/plugin/pete_games.go`), claims a row, calls `DebitIdem`/`CreditIdem` against the escrow GUID, and pushes the verdict back through `pete_emit_queue` — which grew a `path` column so escrow verdicts ride the same durable queue as adventure facts rather than getting a second one. `peteclient.Flush` sends the verdict immediately instead of waiting out the 15s sender tick, because a player is watching a spinner. A row re-offered after a gogobee crash replays as a no-op: 13 tests across both repos, including a fake Pete that offers the same row three times and a player who is charged once. - **Identity.** `preferred_username` now rides in the signed session, and `SessionUser.MatrixUser(server)` maps it to `@user:parodia.dev`. The session cookie takes an opt-in `web.auth.cookie_domain`, so a sign-in on news is a sign-in on games; the OAuth round-trip cookie deliberately stays host-only, and the redirect_uri is derived per-request so a login that starts on games comes back to games. A Host we don't own is never echoed into a redirect. *(pete `cb84e1d`)* - **Blackjack, playable end to end.** `game_live_hands` (the hand in progress, engine state and all, so a redeploy mid-hand is survivable), the session-authed play surface (`internal/web/games_play.go`), the lobby and table pages, and the dealing animation. Driven in a real browser: chips staked before the deal, hole card withheld from the payload until the reveal, payout settled back into the stack. - **The casino moved out.** Its own layout (`games_layout.html`), parsed as its own template set alongside the news one; `gamesPage` no longer embeds the news `pageData`, which is what stops the old furniture drifting back one convenient field at a time. Two rooms on a clock (above), the felt reupholstered from the room's vars, and a house mark that is a honeycomb chip rather than a face. - **The cards are cards.** Corner indices in both corners (the bottom one upside down, as printed), pips laid out on the three-by-seven grid a real deck uses, bottom-half pips inverted, courts as a letter with the suit over each shoulder, and a screen-reader label that says "Queen of hearts" instead of "Q♥". - **The money moves.** The felt grew the two things it was missing: a **bet spot** in front of you and the **house's rack** beside the shoe, so every chip on the table is always travelling between one of those and the other. A bet is *built* by throwing chips onto the spot (the chip you clicked is the chip that flies); the stake sits there through the hand; the house pays out of its rack into the spot; the whole pile is then swept back to your pile. A loss goes to the rack and doesn't come back. `casino-fx.js` is the shared engine — `fly`/`flyMany` (WAAPI, on an arc, out of a fixed overlay so nothing clips them), `chipsFor` (an amount broken into the fewest chips, capped at what's worth watching), `burst`, `count`. Two rules hold it together, and both are load-bearing: 1. **The number under the pile is a readout of the pile**, never the other way round. So the bet starts at zero rather than at a default nobody put down, and a settled hand puts your stake *back on the spot* as a standing bet — otherwise the panel prints "your bet: 300" over an empty circle. 2. **The chip bar does not move until the chips that justify it have landed.** On a live hand the money applies immediately (your stake left your pile and is visibly on the spot); on a settling hand `play()` holds the apply until the payout has swept home. A counter that pays you before the dealer turns over is a counter that has told you the ending. Also: cards land with weight (overshoot, a shadow that takes the hit, a degree or two of resting tilt each), the dealer takes a beat before drawing out, and a natural gets confetti — the only thing in the room that does. - **A way to actually look at it.** `internal/web/devcasino_test.go` is the casino on a port with one signed-in, funded player: `PETE_DEV_CASINO=:7788 go test ./internal/web -run TestDevCasino -timeout 0`. Skipped without the env var. It wires its own routes because `New()` decides whether the casino exists at the moment it builds the mux, and the test rig signs the player in afterwards. **Drive the table in a real browser before believing anything about it** — this pass found a white-on-white verdict pill, a rack that collided with the dealer, and Hit still being offered over a table that was being paid out, none of which a Go test can see. - **Deployed, 2026-07-14.** https://games.parodia.dev is live. What that took, since the shape of it was not quite what this plan guessed: - The edge is **Traefik**, not Caddy (`/mash/traefik/config/provider.yml`, root-owned, file provider so it hot-reloads). The casino needed no router of its own — the existing `pete` router's rule grew a second host: ``Host(`news.parodia.dev`) || Host(`games.parodia.dev`)``, and ACME issued the cert on its own. DNS for the games host already pointed at the box. - Authentik lives at **auth.parodia.dev**, and the app's OAuth2 provider is "Pete News" (pk 12). It now holds both callbacks, strict: news and games. The provider's `redirect_uris` is a list of objects, not strings. - Server config gained `[web.games]` (enabled, host, `matrix_server = "parodia.dev"`) and `web.auth.cookie_domain = ".parodia.dev"`, which is what makes a news sign-in a games sign-in. Old host-only session cookies don't carry over — a signed-in user signs in once more, and after that the session spans both. - **gogobee is not on that box.** It runs on the LAN at `reala@192.168.1.212`, in a screen session, out of `~/gogobee`, and it has no key for its own GitHub remote — deploy it with `ssh -A` so the pull rides your agent. Its escrow loop needs no new config: it is gated on the `FEATURE_PETE_NEWS` / `PETE_INGEST_*` env in `~/.env` that adventure news already set. Restarted, it logs `pete games: escrow loop started interval=3s`. - **Hangman, and it plays for chips.** *(2026-07-14. This revises §7's "Phase 2 — no escrow": the decision was that a free game in a casino reads as a demo, so hangman stakes chips like everything else and reuses the money path whole.)* - **The gallows is the payout meter.** You pick a tier, stake, and get six lives. Every wrong guess draws a limb *and* takes a tenth off the base multiple — one event, shown as one event. Short phrases pay 2.6×, medium 2.0×, long 1.6× (short is hardest: fewer letters, less to go on). Floored at 1×, so a win never hands back less than the stake, and the rake still comes out of winnings only. - `internal/games/hangman` — the same pure reducer as blackjack, phrases embedded (`phrases.txt`, 205 of them, video-game flavoured, lifted from gogobee). `State.Pays()` is the number the felt quotes *and* the number settle() lands on: they were briefly two sums and the table advertised a pre-rake payout it didn't honour. One function now, and a test that walks a game asserting the quote equals the payout at every step. - **The browser never sees the phrase.** Cells carry the letter or an empty string — not the letter with a hidden flag — and the phrase itself is only added to the payload once the game is over and it decides nothing. - Two things the storage layer already gave us for free, and one it didn't: `game_live_hands` is keyed on the *player*, so "one game at a time" holds across games with no new code (a live hangman 409s a blackjack deal). But `table()` used to unmarshal any live row as a blackjack hand — which does not *fail* on a hangman row, it just silently yields an empty hand. It now dispatches on `live.Game`. - `commit()` in games_play.go is the shared settle path (seat → pay → audit → clear → touch). Both games go through it so neither re-derives an ordering that took a while to get right. `casinoRoutes()` is likewise the single route list, because devcasino_test.go has to wire its own mux and a second copy is a copy that stops including the newest game. - Driven in a real browser, win and loss: a 200 stake at 2.34× paid 455 and the bar landed on it; six wrong took the stake and nothing more; a reload mid-phrase brought back the board, the limbs, the multiple, the spent keys and the stake on the spot. Two layout bugs only the browser could show: the lives counter ran under the house rack, and the board wrapped a word early because the rack's clearance padding was on the whole column instead of the one row level with it. - **Solitaire, and it plays for chips.** *(2026-07-14, jumping the queue ahead of trivia because the user asked for it.)* - **Vegas scoring**, which is the only way solitaire has ever actually been a gambling game. You do not win or lose the deal — you **buy the deck** for your stake, and every card you get home to a foundation pays a fifty-second of the tier's multiple back. Cash the board whenever you like and keep what you've banked; a board that has gone dead is therefore a decision, not a wall. There is no undo, because the stake is spent the moment the deck is bought and an undo would be a way to walk a losing board backwards until it wins. - Three deals, and the two dials are the whole difficulty of Klondike: **Patient** (draw 1, unlimited passes, 1.4×, square at 38 cards), **Vegas** (draw 3, three passes, 2.2×, square at 24), **Cutthroat** (draw 3, one pass, 3.4×, square at 16). `Tier.BreakEven()` is what the felt quotes, because "2.2×" tells a player nothing about a game where the multiple is paid a card at a time. - `internal/games/klondike` — the same pure reducer. `Pays()` is one function for the same reason hangman's is. Two fuzzers hold the deck together: no card is ever lost or duplicated by any sequence of moves, and the board stays well-formed (every face-up run is a run, no column has cards face-down under nothing). The first thing a test caught was a **recycle that reversed the waste** — it flips as a block, so the card drawn first comes out first, and reversing would have dealt a different game on every pass and broken the seed. - **The browser never sees the stock or a face-down card.** Bigger than blackjack's hole card: that's most of the deck. Columns send a face-down *count*, never the cards. The events, unlike blackjack's, need no filtering — every card they carry is one the move just turned face up. - **The table re-renders and animates the difference (FLIP).** Blackjack plays back a script because a hand only grows at one end; solitaire moves runs from anywhere to anywhere and an auto-finish moves eleven cards at once. So `solitaire.js` measures where every card is, re-renders the board the server sent, and plays each card from its old place to its new one. The board on screen is therefore always exactly the board the server says exists. The events supply only what a diff can't: where a *newly revealed* card came from (the stock, or a flip in place) and what the board is now worth. - **The rules are mirrored in JS**, deliberately, and only to light up the columns a held card can go to. The server still decides every move; a disagreement snaps the board back to whatever it says. Being shown where a card goes is the game teaching you; being told no after you commit is the game scolding you. - Two things got extracted rather than copied, which is the rule this room runs on: **`casino-cards.js`** (the deck — faces, pips, the flip; was inside blackjack.js) and **`PeteFX.spot()`** (the pile of chips and the number under it, which owns the "the number is a readout of the pile" rule so no table can break it). Blackjack now uses both. - **NOT YET DRIVEN IN A BROWSER.** Everything compiles and every Go test passes, but per this plan's own hard-won rule, *that means nothing about the table*. Next session: `PETE_DEV_CASINO=:7788 go test ./internal/web -run TestDevCasino -timeout 0` and play it. Watch especially: the seven columns fitting on a phone (`--card-w` is a clamp on vw), the FLIP not jumping on a re-render, the rail not colliding with anything, and **blackjack still settling correctly** — its money was rewired onto the shared spot and it is the thing most likely to have broken. ### Next, in order 1. **Drive solitaire in a browser** (see above) — it has never been played. 2. Phase 2's other half: **trivia**. Decided but not built: the question bank is **prefetched from OpenTDB into a local table** (a per-question fetch in a web game loop is a latency and rate-limit problem gogobee never had), through `internal/safehttp`. It stakes chips too. The shape that fits the room is a **ladder**: stake once, answer a run of questions, each right answer compounds the multiple and a wrong one loses the lot, with the option to walk. Note the real risk — trivia answers are googlable, so a tight per-question clock is the only thing making a slow-but-correct answer worth less than a fast one. Score the clock server-side; the browser's countdown is decoration. 2. Phase 3 (UNO), Phase 4 (hold'em) as below. Still open on the table itself, none of it blocking: **split** isn't implemented (the engine has no move for it), the felt is roomy at desktop widths with only one seat on it, and the chip animations are tuned for one player — a second seat would need the spot to be per-seat rather than the singleton it is now. ### How the browser half fits together - `GET /games` (lobby), `GET /games/blackjack` (table) — signed-in only. On the games host, the mux prefixes `/games` onto the path, so the lobby is that host's `/`. Shared paths (`/api/`, `/auth/`, `/static/`) mean the same thing on every host and are left alone. - `GET /api/games/table`, `POST /api/games/{buyin,cashout}`, `POST /api/games/blackjack/{deal,move}` — session-authed, JSON, all returning the same `tableView` so the money and the felt can never disagree. - **The browser never sees the shoe.** The dealer's hole card is *absent* from the payload — not flagged hidden — until the reveal, and the deck lives only in `game_live_hands`. The response carries the engine's events (one per card off the shoe), which is what the table plays back as an animation. - Money order-of-operations: stake leaves the stack *before* the hand is dealt, in the same statement that checks it's there; the hand is *seated* (a plain INSERT on the primary key) before it can settle, which is what makes a double-clicked Deal a 409 with the stake refunded rather than a silently overwritten hand. ### Notes for whoever picks this up - SQLite runs at `MaxOpenConns(1)` in *both* repos. Any `db.Get().Exec` inside an open transaction deadlocks against itself. Do the pre-work before `Begin`. - **A buy-in can currently take a player into debt.** `DebitIdem` inherits `BLACKJACK_DEBT_LIMIT` (default −1000), so someone with an empty wallet can buy €1,000 of chips, win, and cash out while still €1,000 down. That is exactly what gogobee's Matrix blackjack already allows, so it is consistent rather than a bug — but a web casino runs far more hands, and this is the knob to turn if the economy starts leaking. A buy-in-specific floor of 0 is a two-line change. - gogobee's blackjack taxes 5% of the *gross* payout into a community pot (`communityTax`). Pete's rake takes 5% of the *profit*. Deliberately different, and gentler; don't "fix" one to match the other without deciding which is right. --- ## 1. The three constraints everything else follows from **gogobee owns the euros.** The ledger is `euro_balances` / `euro_transactions` (gogobee `internal/db/db.go:1316,1324`), tied to the wider economy — adventure, shop, lottery, mischief. Pete does not get a second wallet. Pete never writes a balance. **gogobee has no inbound API and isn't getting one.** The only listening socket in the whole repo is the Matrix appservice transaction endpoint (`internal/bot/appservice.go:255`). Pete's own source says it plainly (`internal/web/roster.go:23`): > Direction of travel is gogobee → Pete ... Pete has no route back into the game box's > network and we are not opening one. So gogobee stays the only initiator. It **polls** Pete for work and **pushes** results back through the existing durable queue. Same as mischief (`gogobee_mischief_plan.md:191-197`). **One binary.** Games live in the Pete process. gogobee already runs ~50 plugins and six games in one process with in-memory table state and it's fine. Caddy points `games.parodia.dev` at the same port; the mux branches on Host. --- ## 2. Identity — free, no link codes MAS imports the Authentik `preferred_username` as the Matrix localpart (`gogobee_mischief_plan.md:176-186`). So an Authentik session on Pete maps to a Matrix user deterministically: ``` OIDC preferred_username -> strings.ToLower(u) -> @:parodia.dev ``` Pete's `SessionUser` (`internal/web/auth.go`) carries `Sub`/`Name`/`Email` today. Add `PreferredUsername` to the claims struct and the signed cookie payload. That is the whole identity story. Note the existing precedent: `email_nag.go:52` already asserts "Authentik usernames == Matrix localparts". --- ## 3. Money — session escrow, not per-hand settlement ### Why not settle each hand Mischief is fire-and-forget: place an order, gogobee claims it within 30s, nobody cares. A blackjack hand cannot work that way. If every bet round-trips through a poll loop you wait half a minute to be dealt, and again for the payout. ### The model Borrow the semantics hold'em already uses — `euro.Debit(..., "holdem_buyin")` (`holdem.go:319`), `euro.Credit(..., "holdem_cashout")` (`holdem.go:371`) — and apply it to the whole web casino: 1. **Buy in.** You convert euros to *chips* for a games session. One debit. Tolerates poll latency. 2. **Play.** Blackjack, UNO, hold'em, all at full speed against chips held in Pete's SQLite. Zero economy calls in the hot path. 3. **Cash out.** Chips convert back to euros. One credit. Tolerates the same latency. Two economy touches per *session* instead of two per *hand*. Poll latency stops mattering. ### The invariant > A euro is either in gogobee's `euro_balances` or in Pete's chip escrow. Never both. > It moves between them only via a GUID-idempotent claim. Pete's balance display is advisory only, sourced from the roster push and up to 2 minutes stale. The authoritative check is `euro.Debit` at claim time. This preserves `gogobee_mischief_plan.md:198-202` — *"Pete never writes a balance, so no double-spend surface."* ### The prerequisite: euro idempotency (BLOCKING) `euro_transactions` (`db.go:1324`) has **no external id and no unique constraint**. `Debit` is an atomic conditional UPDATE, but calling it twice debits twice. That is safe today only because every caller is a Matrix message that arrives once. A *retrying poll loop* breaks that: a claim that succeeds but whose ack is lost on the wire gets retried, and the player pays twice. **Before any of this ships:** ```sql ALTER TABLE euro_transactions ADD COLUMN external_id TEXT; CREATE UNIQUE INDEX idx_euro_tx_external ON euro_transactions(external_id) WHERE external_id IS NOT NULL; ``` plus `CreditIdem(userID, amount, reason, externalID)` / `DebitIdem(...)` in `euro.go` that do the balance mutation and the transaction insert **in one tx**, and treat a unique-violation on `external_id` as success-already-applied. Everything web-initiated goes through these. --- ## 4. The wire protocol All new Pete endpoints are bearer-authed with the existing ingest token (`internal/web/adventure.go:307` `bearerOK`). gogobee grows its first GET path in `internal/peteclient/client.go` — the poll loop the mischief plan already calls for. ### Pete serves (gogobee polls, ~3s interval) ``` GET /api/games/escrow/pending -> [{guid, matrix_user, kind: buyin|cashout, amount}] POST /api/games/escrow/claim <- {guid} idempotent, marks claimed ``` ### gogobee pushes (existing peteclient queue, guid-idempotent) ``` POST /api/games/escrow/settled -> {guid, ok: bool, reason?: "insufficient_funds", balance_after} ``` Reuse `pete_emit_queue` (`client.go:121-125`, `INSERT OR IGNORE` on `guid` PK) — it already does durability, backoff and parking. Don't build a second queue. ### State machine (Pete side, table `game_escrow`) ``` requested -> claimed -> funded (buyin ok; chips become spendable) -> rejected (insufficient funds; nothing spendable) requested -> claimed -> settled (cashout ok; chips destroyed, euros credited) ``` Poll interval 3s, not 30s: a player waiting to be dealt is watching a spinner. 3s of "buying chips…" is acceptable; 30s is not. ### The reaper Chips left in an abandoned session are euros in limbo. Auto-cash-out any session idle for 30 minutes. A crashed Pete must reconcile on boot: any `claimed` escrow with no `settled` push gets re-polled by GUID. --- ## 5. Code reuse — copy, don't share Separate modules, both mine, and the shells diverge (Matrix vs HTTP). Copy the pure cores into `pete/internal/games/`, let them drift, no shared module. ### Verdict per game | Game | Copy | Rewrite | Notes | |---|---|---|---| | **Hold'em** | ~2,700 LOC | the shell | The crown jewel. Take it all. | | **UNO** | ~1,400 LOC | the turn engine | Great primitives, unshippable engine. | | **Hangman** | ~250 LOC | loading/persistence | Clean rune-safe state machine. | | **Blackjack** | ~95 LOC | everything else | 95 lines is the entire core. | | **Trivia** | ~80 LOC | everything else | **No question bank exists.** | ### Hold'em — take almost all of it Already mautrix-free, verified by import check: - `holdem_cfr.go` (1,285) — full CFR trainer + NPC policy runtime, info-set packing into a `uint64`, regret pruning, board-texture/SPR/equity bucketing. Plus the trained `data/policy.gob` (3.4 MB) and `cmd/holdem-train`, `cmd/holdem-seed`. **This is the single highest-value asset in either repo.** - `holdem_equity.go` + `holdem_equity_range.go` (548) — Monte-Carlo equity, equity-vs-range, draw/out detection. 100% pure, well tested. - `holdem_betting.go` (383) — side pots, min-raise, all-in, street completion. The fiddly poker rules you do not want to rewrite. **Untested in gogobee — write tests as you port.** - `holdem_game.go`, `holdem_eval.go`, `holdem_render.go`. Entanglements to break (mechanical): 1. `id.UserID` → `PlayerID string` (`holdem_betting.go:283,314`; `holdem_eval.go` winnings maps). 2. Delete `RoomID`/`DMRoomID` from `HoldemGame` — table identity belongs to the shell. 3. Hoist the four `*time.Timer` fields out of `HoldemGame` (`holdem_game.go:92-95`). 4. `LoadPolicy(path)` does `os.Open` → `LoadPolicyFrom(io.Reader)`, so the policy can be `embed.FS`'d. Hand evaluation is **not** homegrown — `holdem_eval.go:12` wraps `poker.Evaluate`. Just take the `github.com/chehsunliu/poker` dependency. ### UNO — lift the primitives, rewrite the engine Copy verbatim (already unit-tested in `uno_test.go`): - `unoCard`/`unoColor`/`unoValue`, `canPlayOn`, `newUnoDeck`, draw/reshuffle (`uno.go:21-364`) - The bot AI as free functions: `botPickCard`, `botPickNormal`, `botPickAggressive`, `botPickColor` (`uno.go:1465-1585`) - `uno_nomercy.go` is ~90% pure: scoring, stacking rules, no-mercy deck, second bot. **Rewrite the turn engine.** In gogobee the engine *is* the message sender — `executeMultiTurn`, `applyAndAnnounce`, `handlePlayerPlay` mutate state and call `p.SendReply(...)` mid-turn, and their `error` returns mean "send failed", not "illegal move". There is no `ApplyMove(game, move) (Result, error)` seam anywhere. Disentangling that costs more than rewriting it against the (good) primitives. One near-seam worth keeping: `applyCardEffects` (`uno_multi.go:1459`) already returns a struct instead of sending. ### Hangman — take the struct `hangmanGame` + `guessLetter`/`guessSolution`/`displayPhrase` + the `gallows [7]string` ASCII art (`hangman.go:26-274`). Strip three fields (`participants`, `solvedBy`, `threadID`). Copy `hangman_phrases.txt` (237 lines) and `embed` it instead of `os.Getenv("HANGMAN_PHRASE_FILE")`. Drop the dreamclient translation path for v1. ### Blackjack — retype it `handValue` (correct soft-ace demotion), `isBlackjack`, and their tests. That's it — 95 lines. The rest is `bjTable` keyed by `id.RoomID` with timers embedded, and raw `db.Exec` SQL at `blackjack.go:867`. ### Trivia — the question bank does not exist `trivia.go:288` fetches from OpenTDB live, one question per round: ```go apiURL := "https://opentdb.com/api.php?amount=1" ``` Reuse the category map (`trivia.go:24-53`) and `calculateScore` (time-decay, `:536`). For the web version, **pre-fetch and cache a bank locally** — a per-question HTTP call in a web game loop is a latency and rate-limit problem gogobee never had to care about at Matrix pace. Route outbound fetches through Pete's `internal/safehttp` (SSRF guard). Trivia has **no euro coupling today** (points only). Keep it that way in v1 — it's the one game that can ship with zero escrow risk. ### Two things that apply to every copied engine **Thread the RNG.** Every card game uses the `math/rand/v2` package global — `blackjack.go:60`, `uno.go:186,277`, `holdem_game.go:102`, and throughout the CFR/Monte-Carlo code. Nothing is seedable, which is why `TestBotPickCard_*` can only assert weak properties. The adventure half of gogobee already does this right (`dnd_zone_combat.go:361` threads an explicit `*rand.Rand` via `rand.NewPCG`). The card games never adopted it. **Threading `rng *rand.Rand` through the deck constructors is mandatory, not optional** — ~20 call sites, and it's the difference between a testable engine and one you can only smoke-test. It also gives you a reproducible shuffle for dispute resolution. **Hoist the timers.** `bjTable.joinTimer/turnTimer/reminderTimers`, `unoGame.idleTimer/warningTimer`, `HoldemGame.actionTimer/warningTimer/idleTimer/idleWarningTimer` — all live inside the game structs today. Timers are a shell concern. Game state must be a plain value you can serialize, which is also what makes restart-mid-hand survivable. ### Build a `cards` package while you're at it There is **no shared cards package in gogobee** — blackjack has its own deck (`blackjack.go:32-75`), UNO has its own (`uno.go:130-189`), hold'em uses the third-party lib. Consolidate into `pete/internal/games/cards` during the port rather than importing the duplication. --- ## 6. Architecture in Pete ``` internal/games/ cards/ shared deck primitives (new; consolidates gogobee's duplicates) blackjack/ pure engine — ApplyMove(state, move) (state, events, error) holdem/ pure engine + cfr/ (copied) + policy.gob (embedded) uno/ pure engine (rewritten) over copied primitives + bots hangman/ pure engine (copied) + phrases.txt (embedded) trivia/ pure engine (new) + cached question bank escrow/ chip ledger, the gogobee poll/push seam table/ session, seating, turn clocks, reconnect — the shell ``` **Server-authoritative, always.** The browser sends intents and never sees the deck. Any game with money attached cannot trust a client-reported result. This is why the engines have to be Go on Pete's side rather than ported to JS. **Every engine is a pure reducer**: `ApplyMove(state, move) (newState, []Event, error)`. Timers, sockets and persistence all live in `table/`. That's the seam gogobee never had, and it's what buys testability, replay, and surviving a redeploy. ### Transport - **Blackjack, Hangman, Trivia, UNO-solo** — request/response over `fetch`. No sockets. - **Hold'em, UNO-multi** — WebSocket. Lobby, seating, presence, turn clocks, reconnect-mid-hand, spectators. This is the bulk of the total effort, and it is the only genuinely new infrastructure in the project. ### Frontend Pete has **no SPA and no bundler** today — server-rendered `html/template` + `embed.FS`, plain `