wip(core): preserve local broad Core refactor + inventory service

Divergent development line off origin/main (11a811d): a broad refactor across routes/services/models/app + a large integration_test expansion (+1000), plus an untracked game-independent inventory query service and Docker files. Preserved verbatim before moving the canonical Core checkout to the committed migration trunk (66c88fb). Reconciling this refactor with the migration trunk is a separate user decision; nothing here is lost.
squad: transactional replace_squad + a game-rules boundary for evaluation
2026-08-13 18:34:00 +00:00 · 2026-08-11 18:56:33 +00:00
92 changed files with 743 additions and 13740 deletions
@@ -0,0 +1,12 @@
 target/
 **/target/
 *.db
 *.db-shm
 *.db-wal
 .env
 .env.local
 Dockerfile
 .dockerignore
 .git
 .gitignore
 openfut.db
@@ -90,4 +90,4 @@ migrations/       SQLite migration SQL files
 - **No copyrighted assets.** All card data in `data/` must be original.
 - **No real EA services.** Do not hardcode or reverse-engineer EA endpoints.
 - **Game-independent core.** `openfut-core` must stay game-agnostic;
-  FIFA-specific logic belongs in `openfut-bridge`.
+  FIFA-specific logic belongs in the emulation layer (`fifa17-recon/`).
@@ -5,7 +5,7 @@ edition = "2021"
 authors = ["OpenFUT Contributors"]
 description = "Offline Ultimate Team backend — game-independent core"
 license = "MIT"
-repository = "https://github.com/openfut/openfut-core"
+repository = "https://git.aleshym.co/funman300/OpenFUT-Core.git"
 [lib]
 name = "openfut_core"
@@ -37,4 +37,3 @@ axum-macros = "0.4"
 axum-test = "14"
 tokio = { version = "1", features = ["full"] }
 tower = { version = "0.5", features = ["util"] }
 tempfile = "3"
@@ -0,0 +1,56 @@
 # syntax=docker/dockerfile:1
 # ---- OpenFUT Core: offline FUT backend (Axum + bundled SQLite) ----
 # Multi-stage: build with the Rust toolchain, ship a slim Debian runtime.
 # rustls + bundled SQLite mean no OpenSSL/system-sqlite at runtime.
 FROM rust:1-bookworm AS builder
 WORKDIR /build
 # Cache dependency compilation: copy manifests first, build a stub, then the
 # real sources. sqlx migrations are compiled in via sqlx::migrate!, so the
 # migrations/ dir must be present at build time.
 COPY Cargo.toml Cargo.lock* ./
 RUN mkdir -p src \
    && echo 'fn main() {}' > src/main.rs \
    && echo '' > src/lib.rs \
    && cargo build --release --bin openfut-core 2>/dev/null || true
 RUN rm -rf src
 COPY src ./src
 COPY migrations ./migrations
 # Touch so cargo rebuilds against the real sources rather than the stub.
 RUN touch src/main.rs src/lib.rs \
    && cargo build --release --bin openfut-core
 # ---- Runtime ----
 FROM debian:bookworm-slim AS runtime
 # curl is used by the compose/Docker healthcheck to hit /health.
 RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl \
    && rm -rf /var/lib/apt/lists/*
 # Run unprivileged.
 RUN useradd --system --uid 10001 --create-home --home-dir /app openfut
 WORKDIR /app
 COPY --from=builder /build/target/release/openfut-core /usr/local/bin/openfut-core
 # data/ is read at runtime from DATA_DIR (moddable JSON content) — bundle it.
 COPY --chown=openfut:openfut data ./data
 # Persist the SQLite database on a named volume.
 RUN mkdir -p /app/db && chown openfut:openfut /app/db
 USER openfut
 ENV LISTEN_ADDR=0.0.0.0:8080 \
    DATABASE_URL=sqlite:///app/db/openfut.db \
    DATA_DIR=/app/data \
    RUST_LOG=openfut_core=info,tower_http=info
 EXPOSE 8080
 VOLUME ["/app/db"]
 HEALTHCHECK --interval=15s --timeout=4s --start-period=10s --retries=5 \
    CMD curl -fsS http://127.0.0.1:8080/health || exit 1
 ENTRYPOINT ["openfut-core"]
@@ -2,7 +2,11 @@
 **Offline Ultimate Team backend — game-independent.**
-OpenFUT Core is the heart of the OpenFUT project: a fully offline, single-player FUT-style backend written in Rust. It is deliberately decoupled from any specific game, though it is designed to power a FIFA 23 offline experience.
+OpenFUT Core is the heart of the OpenFUT project: a fully offline, single-player FUT-style backend
 written in Rust. It is deliberately decoupled from any specific game; it is designed to power the
 offline FUT economy behind the project's FIFA 17 emulation layer (and, eventually, a FIFA 23 port).
 The emulation layer and Core are **not yet wired together** — see the OpenFUT Vault
 (`../OpenFUT-Vault/`) for canonical project state.
 ---
@@ -70,7 +74,7 @@ DATABASE_URL=sqlite://./myclub.db LISTEN_ADDR=127.0.0.1:8080 ./target/release/op
 | `GET` | `/squad` | Get active squad |
 | `POST` | `/squad` | Save squad |
 | `GET` | `/objectives` | List objectives with progress |
-| `POST` | `/matches/complete` | Complete a match exactly once + receive rewards |
+| `POST` | `/matches/result` | Submit match result + receive rewards |
 | `GET` | `/sbc` | List SBC definitions |
 | `POST` | `/sbc/submit` | Submit SBC solution |
 | `GET` | `/market` | Browse NPC transfer market |
@@ -95,11 +99,10 @@ curl http://localhost:8080/club
 # Open your starter pack
 curl -X POST http://localhost:8080/packs/open/<pack_id>
-# Submit a match win. `match_identity` keys exactly-once economy: resubmitting the
+# Submit a match win
-# same identity echoes the first result and grants nothing twice.
+curl -X POST http://localhost:8080/matches/result \
 curl -X POST http://localhost:8080/matches/complete \
  -H 'Content-Type: application/json' \
-  -d '{"match_identity":"match-1","result":"win","squad_id":"any","opponent_name":"Beginner AI","goals_for":3,"goals_against":0,"mode":"squad_battles"}'
+  -d '{"squad_id":"any","opponent_name":"Beginner AI","goals_for":3,"goals_against":0,"mode":"squad_battles"}'
 ```
 ---
@@ -1,546 +0,0 @@
 [
  {
    "id": "fifa17_101490",
    "name": "Conor Casey",
    "overall": 64,
    "position": "ST",
    "nation": "United States",
    "league": "MLS",
    "club": "Columbus Crew SC",
    "pace": 43,
    "shooting": 65,
    "passing": 52,
    "dribbling": 60,
    "defending": 33,
    "physical": 72,
    "rarity": "bronze",
    "image_path": null
  },
  {
    "id": "fifa17_101880",
    "name": "Rob Green",
    "overall": 74,
    "position": "GK",
    "nation": "England",
    "league": "EFL Championship",
    "club": "Leeds United",
    "pace": 78,
    "shooting": 70,
    "passing": 62,
    "dribbling": 77,
    "defending": 47,
    "physical": 71,
    "rarity": "silver",
    "image_path": null
  },
  {
    "id": "fifa17_102356",
    "name": "Markus Feulner",
    "overall": 74,
    "position": "CM",
    "nation": "Germany",
    "league": "Bundesliga",
    "club": "Augsburg",
    "pace": 58,
    "shooting": 70,
    "passing": 75,
    "dribbling": 71,
    "defending": 66,
    "physical": 71,
    "rarity": "silver",
    "image_path": null
  },
  {
    "id": "fifa17_102593",
    "name": "Craig Woodman",
    "overall": 64,
    "position": "LB",
    "nation": "England",
    "league": "EFL League Two",
    "club": "Exeter City",
    "pace": 66,
    "shooting": 45,
    "passing": 58,
    "dribbling": 60,
    "defending": 62,
    "physical": 65,
    "rarity": "bronze",
    "image_path": null
  },
  {
    "id": "fifa17_105046",
    "name": "Anders Østli",
    "overall": 64,
    "position": "CB",
    "nation": "Norway",
    "league": "Tippeligaen",
    "club": "Sarpsborg 08 FF",
    "pace": 54,
    "shooting": 46,
    "passing": 54,
    "dribbling": 52,
    "defending": 62,
    "physical": 75,
    "rarity": "bronze",
    "image_path": null
  },
  {
    "id": "fifa17_107298",
    "name": "Yohann Pelé",
    "overall": 74,
    "position": "GK",
    "nation": "France",
    "league": "Ligue 1",
    "club": "O. de Marseille",
    "pace": 75,
    "shooting": 74,
    "passing": 72,
    "dribbling": 70,
    "defending": 49,
    "physical": 76,
    "rarity": "silver",
    "image_path": null
  },
  {
    "id": "fifa17_107713",
    "name": "Tom Starke",
    "overall": 74,
    "position": "GK",
    "nation": "Germany",
    "league": "Bundesliga",
    "club": "Bayern",
    "pace": 76,
    "shooting": 73,
    "passing": 59,
    "dribbling": 72,
    "defending": 39,
    "physical": 76,
    "rarity": "silver",
    "image_path": null
  },
  {
    "id": "fifa17_110020",
    "name": "Sergio Pelegrín",
    "overall": 74,
    "position": "CB",
    "nation": "Spain",
    "league": "LaLiga 1 I 2 I 3",
    "club": "Elche CF",
    "pace": 45,
    "shooting": 32,
    "passing": 52,
    "dribbling": 49,
    "defending": 75,
    "physical": 76,
    "rarity": "silver",
    "image_path": null
  },
  {
    "id": "fifa17_110026",
    "name": "Cani",
    "overall": 74,
    "position": "LM",
    "nation": "Spain",
    "league": "LaLiga 1 I 2 I 3",
    "club": "Real Zaragoza",
    "pace": 67,
    "shooting": 72,
    "passing": 73,
    "dribbling": 78,
    "defending": 45,
    "physical": 61,
    "rarity": "silver",
    "image_path": null
  },
  {
    "id": "fifa17_11811",
    "name": "Paul Green",
    "overall": 64,
    "position": "CM",
    "nation": "Republic of Ireland",
    "league": "EFL League One",
    "club": "Oldham Athletic",
    "pace": 65,
    "shooting": 58,
    "passing": 62,
    "dribbling": 63,
    "defending": 62,
    "physical": 68,
    "rarity": "bronze",
    "image_path": null
  },
  {
    "id": "fifa17_139720",
    "name": "Vincent Kompany",
    "overall": 86,
    "position": "CB",
    "nation": "Belgium",
    "league": "Premier League",
    "club": "Manchester City",
    "pace": 69,
    "shooting": 54,
    "passing": 62,
    "dribbling": 65,
    "defending": 86,
    "physical": 81,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_146562",
    "name": "Santi Cazorla",
    "overall": 86,
    "position": "CAM",
    "nation": "Spain",
    "league": "Premier League",
    "club": "Arsenal",
    "pace": 71,
    "shooting": 78,
    "passing": 85,
    "dribbling": 86,
    "defending": 57,
    "physical": 64,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_153079",
    "name": "Sergio Agüero",
    "overall": 89,
    "position": "ST",
    "nation": "Argentina",
    "league": "Premier League",
    "club": "Manchester City",
    "pace": 89,
    "shooting": 88,
    "passing": 75,
    "dribbling": 89,
    "defending": 23,
    "physical": 70,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_158023",
    "name": "Lionel Messi",
    "overall": 93,
    "position": "RW",
    "nation": "Argentina",
    "league": "LaLiga Santander",
    "club": "FC Barcelona",
    "pace": 89,
    "shooting": 90,
    "passing": 86,
    "dribbling": 96,
    "defending": 26,
    "physical": 61,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_162895",
    "name": "Cesc Fàbregas",
    "overall": 86,
    "position": "CM",
    "nation": "Spain",
    "league": "Premier League",
    "club": "Chelsea",
    "pace": 63,
    "shooting": 77,
    "passing": 89,
    "dribbling": 81,
    "defending": 61,
    "physical": 64,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_163705",
    "name": "Steve Mandanda",
    "overall": 85,
    "position": "GK",
    "nation": "France",
    "league": "Premier League",
    "club": "Crystal Palace",
    "pace": 86,
    "shooting": 80,
    "passing": 79,
    "dribbling": 85,
    "defending": 49,
    "physical": 81,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_165229",
    "name": "Laurent Koscielny",
    "overall": 85,
    "position": "CB",
    "nation": "France",
    "league": "Premier League",
    "club": "Arsenal",
    "pace": 78,
    "shooting": 40,
    "passing": 62,
    "dribbling": 65,
    "defending": 85,
    "physical": 78,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_167948",
    "name": "Hugo Lloris",
    "overall": 88,
    "position": "GK",
    "nation": "France",
    "league": "Premier League",
    "club": "Spurs",
    "pace": 87,
    "shooting": 87,
    "passing": 68,
    "dribbling": 90,
    "defending": 64,
    "physical": 82,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_168542",
    "name": "David Silva",
    "overall": 87,
    "position": "CAM",
    "nation": "Spain",
    "league": "Premier League",
    "club": "Manchester City",
    "pace": 68,
    "shooting": 72,
    "passing": 87,
    "dribbling": 87,
    "defending": 32,
    "physical": 58,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_176580",
    "name": "Luis Suárez",
    "overall": 92,
    "position": "ST",
    "nation": "Uruguay",
    "league": "LaLiga Santander",
    "club": "FC Barcelona",
    "pace": 82,
    "shooting": 90,
    "passing": 79,
    "dribbling": 87,
    "defending": 42,
    "physical": 79,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_176635",
    "name": "Mesut Özil",
    "overall": 89,
    "position": "CAM",
    "nation": "Germany",
    "league": "Premier League",
    "club": "Arsenal",
    "pace": 72,
    "shooting": 74,
    "passing": 86,
    "dribbling": 86,
    "defending": 24,
    "physical": 58,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_177388",
    "name": "Dimitri Payet",
    "overall": 86,
    "position": "LM",
    "nation": "France",
    "league": "Premier League",
    "club": "West Ham",
    "pace": 77,
    "shooting": 78,
    "passing": 87,
    "dribbling": 87,
    "defending": 42,
    "physical": 70,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_183277",
    "name": "Eden Hazard",
    "overall": 88,
    "position": "LM",
    "nation": "Belgium",
    "league": "Premier League",
    "club": "Chelsea",
    "pace": 90,
    "shooting": 81,
    "passing": 82,
    "dribbling": 91,
    "defending": 32,
    "physical": 64,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_184941",
    "name": "Alexis Sánchez",
    "overall": 87,
    "position": "LW",
    "nation": "Chile",
    "league": "Premier League",
    "club": "Arsenal",
    "pace": 86,
    "shooting": 82,
    "passing": 79,
    "dribbling": 88,
    "defending": 39,
    "physical": 74,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_190871",
    "name": "Neymar",
    "overall": 92,
    "position": "LW",
    "nation": "Brazil",
    "league": "LaLiga Santander",
    "club": "FC Barcelona",
    "pace": 91,
    "shooting": 84,
    "passing": 78,
    "dribbling": 95,
    "defending": 30,
    "physical": 56,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_192119",
    "name": "Thibaut Courtois",
    "overall": 89,
    "position": "GK",
    "nation": "Belgium",
    "league": "Premier League",
    "club": "Chelsea",
    "pace": 84,
    "shooting": 91,
    "passing": 69,
    "dribbling": 89,
    "defending": 48,
    "physical": 86,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_192985",
    "name": "Kevin De Bruyne",
    "overall": 88,
    "position": "CAM",
    "nation": "Belgium",
    "league": "Premier League",
    "club": "Manchester City",
    "pace": 77,
    "shooting": 83,
    "passing": 86,
    "dribbling": 84,
    "defending": 40,
    "physical": 75,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_193080",
    "name": "David De Gea",
    "overall": 90,
    "position": "GK",
    "nation": "Spain",
    "league": "Premier League",
    "club": "Manchester Utd",
    "pace": 88,
    "shooting": 85,
    "passing": 87,
    "dribbling": 90,
    "defending": 56,
    "physical": 85,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_195864",
    "name": "Paul Pogba",
    "overall": 88,
    "position": "CM",
    "nation": "France",
    "league": "Premier League",
    "club": "Manchester Utd",
    "pace": 77,
    "shooting": 80,
    "passing": 83,
    "dribbling": 87,
    "defending": 72,
    "physical": 87,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_20801",
    "name": "Cristiano Ronaldo",
    "overall": 94,
    "position": "LW",
    "nation": "Portugal",
    "league": "LaLiga Santander",
    "club": "Real Madrid",
    "pace": 92,
    "shooting": 92,
    "passing": 81,
    "dribbling": 91,
    "defending": 33,
    "physical": 80,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_41236",
    "name": "Zlatan Ibrahimović",
    "overall": 90,
    "position": "ST",
    "nation": "Sweden",
    "league": "Premier League",
    "club": "Manchester Utd",
    "pace": 72,
    "shooting": 90,
    "passing": 81,
    "dribbling": 85,
    "defending": 31,
    "physical": 86,
    "rarity": "gold",
    "image_path": null
  },
  {
    "id": "fifa17_48940",
    "name": "Petr Čech",
    "overall": 88,
    "position": "GK",
    "nation": "Czech Republic",
    "league": "Premier League",
    "club": "Arsenal",
    "pace": 83,
    "shooting": 90,
    "passing": 77,
    "dribbling": 85,
    "defending": 48,
    "physical": 85,
    "rarity": "gold",
    "image_path": null
  }
 ]
@@ -71,33 +71,17 @@ All game-content data is loaded at startup from `data/` into `Arc`-wrapped colle
 8. Increment pack stats + objective progress
 9. Return `PackOpenResult { pack_id, cards }`
-## Data Flow: Match Completion
+## Data Flow: Match Result
-1. `POST /matches/complete` → `routes::matches::post_match_complete`
+1. `POST /matches/result` → `routes::matches::post_match_result`
 2. Fetch profile + club
-3. `services::match_service::complete_match(...)` — everything below runs in ONE
+3. `services::match_service::process_match(...)`
-   transaction and either commits together or rolls back whole
+4. Determine outcome (win/draw/loss), compute coins + XP
-4. Insert the match-history row (also takes SQLite's writer lock, serializing
+5. Insert match record
-   overlapping completions)
+6. `club::add_coins`, `profile::add_xp`
-5. Insert the `match_completions` guard row. `UNIQUE(profile_id, match_identity)`
+7. `statistics::record_match`
-   makes the economy exactly-once: a duplicate — sequential, concurrent, after a
+8. `objective::increment_metric` for matches_played, matches_won, goals_scored, coins_earned
-   restart, or a conflicting re-report — collides here and the whole attempt
+9. Return `MatchRewardResult`
   rolls back, then echoes the persisted result with `applied = false`
 6. Coins, XP + level-ups, W/D/L/DNF statistics, objective metrics, achievements
 7. Opt-in only: `expire_loans` (loan tick-down/removal) and `advance_season`
   (Core's own division model, which grants coins and a pack at season end).
   Both default OFF so a game with its own loan/season model — FIFA 17 — is
   unaffected
 8. Commit, then the route emits player notifications for what landed (never
   inside the transaction, and only when `applied`)
 9. Return `MatchCompletionResult`
 `POST /matches/result` was REMOVED as an economy path. It performed the same
 grants across a dozen separate writes with no transaction and no idempotency
 key, which made it a second economy authority that re-credited on every call and
 could half-apply on any mid-way failure. It now rejects and names
 `/matches/complete`. Exactly-once requires a caller-supplied match identity,
 which its request shape did not carry and could not derive.
 ## Single-Profile Design
@@ -1,5 +0,0 @@
 -- Distinguish NPC-generated listings from player-posted ones so that the
 -- periodic NPC refresh does not accidentally wipe player listings.
 ALTER TABLE market_listings ADD COLUMN is_npc INTEGER NOT NULL DEFAULT 0;
 CREATE INDEX IF NOT EXISTS idx_market_npc ON market_listings(is_npc, sold);
@@ -1,3 +0,0 @@
 -- Track when the player last claimed their rivals weekly reward to enforce a
 -- 24-hour cooldown between claims.
 ALTER TABLE seasons ADD COLUMN rivals_last_claimed_at TEXT;
@@ -1,14 +0,0 @@
 -- Multi-game support. Every profile (and therefore all of its downstream state,
 -- which hangs off profiles(id) via profile_id / club_id foreign keys) is scoped to
 -- a game. Bridges identify their game with the X-OpenFUT-Game request header.
 --
 -- Default 'fifa23' preserves the existing single-game behaviour: the current bridge
 -- and the integration tests send no game header, so they keep operating on the same
 -- (now fifa23-tagged) profile with zero behaviour change. The FIFA 17 bridge sends
 -- X-OpenFUT-Game: fifa17 and therefore gets its own isolated profile/club/state.
 --
 -- Only profiles needs the column: get_active_profile becomes game-scoped, and because
 -- all other tables reference a profile (directly via profile_id or via
 -- club_id -> clubs.profile_id), scoping the active profile isolates the whole tree.
 ALTER TABLE profiles ADD COLUMN game_id TEXT NOT NULL DEFAULT 'fifa23';
 CREATE INDEX IF NOT EXISTS idx_profiles_game ON profiles(game_id);
@@ -1,23 +0,0 @@
 -- Generic, game-scoped OPAQUE extension storage.
 --
 -- Core persists, versions, associates (to a canonical entity + a server-computed
 -- fingerprint), and enforces generic safety bounds on these bytes — but NEVER
 -- interprets them. A game adapter owns the payload's schema and meaning. This is
 -- how a game keeps wire-only round-trip state (e.g. FIFA 17 squad custom[]/
 -- kicktakers/kitNumber) durable and atomic with its canonical entity without
 -- leaking game-specific columns into generic Core.
 --
 -- Scope key: (game_id, entity_kind, entity_id, namespace). `namespace` is an
 -- opaque adapter key (e.g. "fifa17.squad.v1"); `schema_version` is the adapter's
 -- payload version (distinct from this table's storage schema).
 CREATE TABLE IF NOT EXISTS game_entity_ext (
    game_id               TEXT    NOT NULL,
    entity_kind           TEXT    NOT NULL,
    entity_id             TEXT    NOT NULL,
    namespace             TEXT    NOT NULL,
    schema_version        INTEGER NOT NULL,
    canonical_fingerprint TEXT    NOT NULL,
    payload               TEXT    NOT NULL,
    updated_at            TEXT    NOT NULL,
    PRIMARY KEY (game_id, entity_kind, entity_id, namespace)
 );
@@ -1,10 +0,0 @@
 -- Generic provenance/rerun-identity token for a transactionally imported profile.
 --
 -- Set by the generic profile-import path (services::import). A NULL value means
 -- the profile was created by normal gameplay / dev seeding, not an import, and
 -- MUST NOT be silently clobbered by an import targeting the same game. A
 -- matching token on a re-run is an idempotent no-op; a differing token against
 -- an already-imported game fails until an explicit update mode exists.
 --
 -- Core never interprets the token's structure; the importer adapter chooses it.
 ALTER TABLE profiles ADD COLUMN import_fingerprint TEXT;
@@ -1,11 +0,0 @@
 -- Issue 1: sbc_submissions was created (0001_initial.sql) without a club_id column,
 -- but the MY CLUB milestone query (routes/club.rs get_milestones) counts
 --   SELECT COUNT(*) FROM sbc_submissions WHERE club_id = ? AND passed = 1
 -- so SQLite errored on the unknown column and the error was swallowed by
 -- `.unwrap_or(0)` -> the `sbcs_completed` milestone always read 0. Add the column
 -- and backfill it from the profile's club so historical submissions count.
 ALTER TABLE sbc_submissions ADD COLUMN club_id TEXT;
 UPDATE sbc_submissions
 SET club_id = (SELECT c.id FROM clubs c WHERE c.profile_id = sbc_submissions.profile_id)
 WHERE club_id IS NULL;
@@ -1,14 +0,0 @@
 -- Durable replay and non-repeatable-completion guards for atomic SBC submissions.
 -- Existing successful rows are treated as non-repeatable; if historical data already
 -- violates that invariant the migration fails rather than silently discarding history.
 ALTER TABLE sbc_submissions ADD COLUMN repeatable INTEGER NOT NULL DEFAULT 0;
 CREATE UNIQUE INDEX idx_sbc_nonrepeatable_completion
 ON sbc_submissions(profile_id, sbc_id)
 WHERE passed = 1 AND repeatable = 0;
 -- submitted_card_ids is stored in canonical sorted order by the writer. This rejects
 -- stale retries of the same card set even for explicitly repeatable challenges.
 CREATE UNIQUE INDEX idx_sbc_submission_replay
 ON sbc_submissions(profile_id, sbc_id, submitted_card_ids)
 WHERE passed = 1;
@@ -1,9 +0,0 @@
 -- Core owns durable per-profile working squads for SBC challenges. The FIFA17
 -- adapter maps its numeric challenge id to the opaque generic sbc_id.
 CREATE TABLE sbc_challenge_squads (
    profile_id TEXT NOT NULL REFERENCES profiles(id),
    sbc_id TEXT NOT NULL,
    owned_card_ids TEXT NOT NULL,
    updated_at TEXT NOT NULL,
    PRIMARY KEY (profile_id, sbc_id)
 );
@@ -1,29 +0,0 @@
 -- Durable economic idempotency for match completion.
 --
 -- One economic effect per (profile_id, match_identity), independent of any HTTP
 -- receipt idempotency the game host/adapter layers on top. A sequential replay,
 -- a restart replay, a concurrent duplicate, or a conflicting re-report of the
 -- same match all collide on this UNIQUE and are refused BEFORE any coins, XP,
 -- statistics, objectives, or achievements are applied — the first completion is
 -- the one canonical result, the rest are idempotent no-ops.
 --
 -- `match_identity` is opaque to Core: the game adapter/host derives a stable
 -- per-match token (e.g. the FIFA17 match-create id). Core never parses it.
 CREATE TABLE match_completions (
    id             TEXT PRIMARY KEY NOT NULL,
    profile_id     TEXT NOT NULL REFERENCES profiles(id),
    match_identity TEXT NOT NULL,
    result         TEXT NOT NULL,            -- canonical: win | draw | loss | dnf | no_contest
    coins_awarded  INTEGER NOT NULL DEFAULT 0,
    xp_awarded     INTEGER NOT NULL DEFAULT 0,
    match_id       TEXT NOT NULL REFERENCES matches(id),
    completed_at   TEXT NOT NULL,
    UNIQUE(profile_id, match_identity)
 );
 CREATE INDEX idx_match_completions_profile ON match_completions(profile_id);
 -- W/D/L already live on `statistics`; add the DNF (abandon/quit) bucket so the
 -- four match outcomes are mutually-exclusive counters. A did-not-finish is
 -- economically a loss but is tallied here, not in `matches_lost`.
 ALTER TABLE statistics ADD COLUMN matches_dnf INTEGER NOT NULL DEFAULT 0;
@@ -1,25 +0,0 @@
 -- Squad manager assignment: an owned item assigned as a squad's manager.
 --
 -- Generic, game-neutral canonical state. Core does not know what a "manager"
 -- means to any game; it only records that one owned item (`owned_card_id`) is
 -- assigned to a squad in the manager role. The FIFA 17 adapter owns the wire
 -- meaning (itemType "manager", contract, chemistry) exactly as it owns player
 -- item shaping — Core just persists the ownership-backed assignment durably and
 -- atomically, so a manager survives squad save / reload / server restart.
 --
 -- One manager per squad: `squad_id` is the primary key, so a re-assignment
 -- REPLACEs rather than accumulating (no duplicate-manager rows).
 --
 -- `owned_card_id` references `owned_cards(id)` with ON DELETE CASCADE: quick
 -- selling / discarding the manager card (a DELETE on owned_cards) removes the
 -- assignment automatically, so a sold manager is never resurrected on the next
 -- squad read. Reads additionally re-check the manager still belongs to the club
 -- (see `club::get_squad_manager`), defending against a stale row left by a
 -- market transfer (which UPDATEs owner rather than deleting).
 CREATE TABLE IF NOT EXISTS squad_managers (
    squad_id      TEXT PRIMARY KEY NOT NULL REFERENCES squads(id) ON DELETE CASCADE,
    owned_card_id TEXT NOT NULL REFERENCES owned_cards(id) ON DELETE CASCADE,
    updated_at    TEXT NOT NULL
 );
 CREATE INDEX IF NOT EXISTS idx_squad_managers_owned ON squad_managers(owned_card_id);
@@ -1,23 +0,0 @@
 -- Active home/away kits for a club. Ownership remains the generic owned_cards
 -- inventory; this table only records which owned instances occupy the two kit
 -- roles. FIFA-specific resource ids and wire shapes stay in the FIFA17 adapter.
 CREATE TABLE IF NOT EXISTS club_kit_assignments (
    club_id      TEXT NOT NULL REFERENCES clubs(id) ON DELETE CASCADE,
    slot         TEXT NOT NULL CHECK (slot IN ('home', 'away')),
    owned_card_id TEXT NOT NULL UNIQUE REFERENCES owned_cards(id) ON DELETE CASCADE,
    updated_at   TEXT NOT NULL,
    PRIMARY KEY (club_id, slot)
 );
 CREATE INDEX IF NOT EXISTS idx_club_kit_assignments_owned
    ON club_kit_assignments(owned_card_id);
 -- Market transfers change owned_cards.club_id by UPDATE rather than DELETE.
 -- Remove any old-club active designation before ownership moves so a stale row
 -- cannot hide or block the item for its new owner.
 CREATE TRIGGER IF NOT EXISTS clear_club_kit_assignment_before_transfer
 BEFORE UPDATE OF club_id ON owned_cards
 WHEN OLD.club_id <> NEW.club_id
 BEGIN
    DELETE FROM club_kit_assignments WHERE owned_card_id = OLD.id;
 END;
@@ -1,39 +0,0 @@
 -- Generic owned-content classification on the EXISTING ownership table.
 --
 -- Core owns ONE instance-based ownership model for every kind of owned content.
 -- There is deliberately no parallel "items" table: a manager, a consumable, a
 -- kit and a player are all rows in `owned_cards`, differing only by
 -- `content_kind`. Two copies of one definition remain TWO rows (instance-based
 -- ownership: `card_id` is the definition, `id` is the instance).
 --
 -- `content_kind` is a game-INDEPENDENT vocabulary. Game adapters translate their
 -- own taxonomy (e.g. FIFA 17 `cardsubtypeid` / resource ranges) into one of these
 -- tokens before ownership reaches Core; a game's numeric ids NEVER land here.
 --
 -- BACKFILL: none needed — every pre-existing row is a player card, which is
 -- exactly the column DEFAULT, so the ALTER backfills all existing ownership as
 -- 'player' in place. (Verified against a real populated club snapshot: 1986
 -- owned rows, all players.)
 ALTER TABLE owned_cards ADD COLUMN content_kind TEXT NOT NULL DEFAULT 'player'
    CHECK (content_kind IN (
        'player', 'manager', 'staff', 'consumable',
        'kit', 'badge', 'ball', 'stadium', 'misc'
    ));
 -- Optional stack count for content that is owned as an instance CARRYING a
 -- count rather than as a bare instance.
 --
 -- Evidence (real profile, 1995 owned items): consumables are instance-based with
 -- an OPTIONAL count — some carry a wire `amount` (observed 1,2,4,5,10,15), some
 -- omit the key entirely, and two copies of one definition exist as two distinct
 -- instances. So a count is a per-instance ATTRIBUTE, never a replacement for the
 -- instance: NULL means "not a stack", a positive integer is the stack size.
 -- Collapsing instances into counts is forbidden by the ownership model above.
 ALTER TABLE owned_cards ADD COLUMN quantity INTEGER
    CHECK (quantity IS NULL OR quantity >= 1);
 -- Every club projection reads one kind at a time (players for the squad, kits
 -- for the club room, consumables for the item list), so the club+kind pair is
 -- the hot access path.
 CREATE INDEX IF NOT EXISTS idx_owned_cards_club_kind
    ON owned_cards(club_id, content_kind);
@@ -1,55 +0,0 @@
 -- Generalise the two-slot kit designation (migration 0024) into the full set of
 -- active club designations.
 --
 -- Ownership still lives ONLY in `owned_cards`; this table records which owned
 -- INSTANCE currently occupies each club-scoped role. A row here is a pointer,
 -- never a second ownership authority.
 --
 -- Lifecycle invariants enforced by the schema, not by convention:
 --   * `PRIMARY KEY (club_id, slot)` — at most one active item per role.
 --   * `owned_card_id ... UNIQUE` — one owned instance can occupy at most ONE
 --     slot, so "the same card is both the home and the away kit" is unstorable.
 --   * `REFERENCES owned_cards(id) ON DELETE CASCADE` — quick-selling/consuming
 --     the item removes the designation, so a sold item can never be projected
 --     back to the client as active.
 --   * the BEFORE UPDATE trigger below — a market transfer moves ownership by
 --     UPDATE (the row id survives), which no FK action can see, so the
 --     designation is dropped explicitly before the owner changes.
 --
 -- `squad_managers` (migration 0023) is squad-scoped, not club-scoped, and is
 -- deliberately NOT folded in here.
 CREATE TABLE IF NOT EXISTS club_active_items (
    club_id       TEXT NOT NULL REFERENCES clubs(id) ON DELETE CASCADE,
    slot          TEXT NOT NULL CHECK (slot IN (
                      'home_kit', 'away_kit', 'badge', 'ball', 'stadium'
                  )),
    owned_card_id TEXT NOT NULL UNIQUE REFERENCES owned_cards(id) ON DELETE CASCADE,
    updated_at    TEXT NOT NULL,
    PRIMARY KEY (club_id, slot)
 );
 CREATE INDEX IF NOT EXISTS idx_club_active_items_owned
    ON club_active_items(owned_card_id);
 -- Carry every existing kit designation over: 'home' -> 'home_kit',
 -- 'away' -> 'away_kit'. No designation is lost and none is invented.
 INSERT INTO club_active_items (club_id, slot, owned_card_id, updated_at)
 SELECT club_id,
       CASE slot WHEN 'home' THEN 'home_kit' ELSE 'away_kit' END,
       owned_card_id,
       updated_at
 FROM club_kit_assignments
 WHERE slot IN ('home', 'away');
 -- 0024's trigger lives ON owned_cards, so DROP TABLE would NOT remove it and
 -- every subsequent ownership transfer would fail on a missing table. Drop it
 -- explicitly first, then replace it with the generalised one.
 DROP TRIGGER IF EXISTS clear_club_kit_assignment_before_transfer;
 DROP TABLE club_kit_assignments;
 CREATE TRIGGER IF NOT EXISTS clear_club_active_item_before_transfer
 BEFORE UPDATE OF club_id ON owned_cards
 WHEN OLD.club_id <> NEW.club_id
 BEGIN
    DELETE FROM club_active_items WHERE owned_card_id = OLD.id;
 END;
@@ -1,40 +0,0 @@
 -- Durable idempotency for applying a consumable to a target.
 --
 -- Same discipline as `match_completions` (migration 0022): ONE effect per
 -- (profile_id, action_identity). A sequential replay, a restart replay, a
 -- concurrent duplicate, or a retried HTTP request all collide on this UNIQUE and
 -- are refused BEFORE the target is mutated and BEFORE the source is consumed —
 -- so a consumable can never be spent twice, and its effect can never be applied
 -- twice from one spend.
 --
 -- `action_identity` is opaque to Core: the game adapter/host derives a stable
 -- per-application token from its own wire request. Core never parses it.
 --
 -- `source_owned_card_id` / `target_owned_card_id` are deliberately NOT foreign
 -- keys: the source row is DELETEd (or decremented to zero and deleted) by the
 -- very transaction that writes this record, and the target may later be sold.
 -- This table is an audit + replay record, not an ownership reference.
 --
 -- `effect` is the caller-supplied outcome summary stored verbatim as JSON text.
 -- Core defines NO per-category formula: what a given consumable does to its
 -- target is the calling game adapter's reversed behaviour, and an unreversed
 -- behaviour must not be invented here.
 CREATE TABLE consumable_applications (
    id                    TEXT PRIMARY KEY NOT NULL,
    profile_id            TEXT NOT NULL REFERENCES profiles(id),
    action_identity       TEXT NOT NULL,
    source_owned_card_id  TEXT NOT NULL,
    source_card_id        TEXT NOT NULL,
    source_content_kind   TEXT NOT NULL,
    -- 1 = the source instance was destroyed; 0 = a stack was decremented.
    source_consumed       INTEGER NOT NULL,
    -- Remaining stack size after a decrement, NULL when the instance was destroyed.
    source_quantity_after INTEGER,
    target_owned_card_id  TEXT,
    effect                TEXT NOT NULL,
    applied_at            TEXT NOT NULL,
    UNIQUE(profile_id, action_identity)
 );
 CREATE INDEX idx_consumable_applications_profile
    ON consumable_applications(profile_id);
@@ -1,19 +0,0 @@
 -- Per-instance match-contract counter on an owned instance.
 --
 -- NULLABLE ON PURPOSE. NULL means "Core tracks no contract for this instance",
 -- which is NOT the same as zero: a game whose contracts start at a pack-fresh
 -- default (FIFA 17 hands out 7) must supply that default itself, so the number
 -- stays in the game adapter and never becomes a Core constant. Every row that
 -- pre-dates this migration therefore reads back NULL and keeps its exact prior
 -- meaning — the migration is a pure widening, not a backfill.
 --
 -- `>= 0` only: the cap is a per-application input (the caller's game rule), not
 -- a schema invariant, so the CHECK refuses the one value that is nonsense in
 -- every game rather than pinning someone else's ceiling.
 --
 -- ALTER TABLE ADD COLUMN, NEVER a table rebuild: `owned_cards` carries the
 -- `clear_club_active_item_before_transfer` trigger installed by 0026, and a
 -- DROP/recreate would silently take it with it — exactly the failure 0026:44-46
 -- documents for 0024's trigger.
 ALTER TABLE owned_cards ADD COLUMN contract_matches INTEGER
    CHECK (contract_matches IS NULL OR contract_matches >= 0);
@@ -1,49 +0,0 @@
 -- Per-instance attribute training on an owned instance.
 --
 -- WHY A TABLE AND NOT COLUMNS. A training effect is (attribute slot, amount),
 -- and a game may author one per slot. Six nullable columns would encode the
 -- slot in the schema and force a migration to add a seventh; a row per slot
 -- keeps the slot a value. It is also the smallest shape that lets the PRIMARY
 -- KEY do the work described below.
 --
 -- WHY THE PRIMARY KEY IS (owned_card_id, attribute_index). Whether FIFA 17
 -- REPLACES, STACKS, MERGES or REFUSES a second training on an attribute that
 -- already carries one is UNKNOWN: no shipped table encodes it, and the client
 -- holds no consumable-effect logic at all to reverse (no binary in the install
 -- reads `fcc_trainingcards`, so effects are server-authoritative). Rather than
 -- pick one of those behaviours and ship a guess as though it were recovered,
 -- the key makes a second application to the SAME slot a constraint violation,
 -- which the apply path turns into an explicit refusal that consumes nothing.
 -- The unknown is therefore enforced by the schema instead of being papered over.
 -- When the behaviour is proven, the change is a deliberate one-line relaxation
 -- plus the arithmetic it implies — not an unpicking of accumulated bad state.
 --
 -- `attribute_index` is a slot in CORE's own six-attribute card model, in the
 -- declaration order of `CardDefinition` (0 pace, 1 shooting, 2 passing,
 -- 3 dribbling, 4 defending, 5 physical). It is deliberately NOT a FIFA
 -- attribute name: mapping "GK speed" onto slot 4 is the FIFA 17 adapter's
 -- reversed knowledge, and Core stays game-neutral by only ever indexing its own
 -- model. The CHECK pins the slot to that model's width.
 --
 -- `amount` is bounded at 99 because it is added to an attribute whose domain is
 -- 1..=99; a larger stored value could not mean anything. The tighter, per-game
 -- ceiling (FIFA 17 authors only 5/10/15) is validated at apply time, where the
 -- game's table is in scope, not here.
 --
 -- ON DELETE CASCADE is load-bearing: the pool enables `foreign_keys`
 -- (`db.rs:20`), so quick-selling or otherwise destroying a trained instance
 -- takes its training with it and cannot leave a row pointing at a dead item.
 CREATE TABLE owned_card_training (
    owned_card_id   TEXT    NOT NULL REFERENCES owned_cards(id) ON DELETE CASCADE,
    attribute_index INTEGER NOT NULL CHECK (attribute_index BETWEEN 0 AND 5),
    amount          INTEGER NOT NULL CHECK (amount >= 1 AND amount <= 99),
    -- The definition that granted it, kept for audit and for the eventual
    -- lifecycle work; Core never interprets it.
    source_card_id  TEXT    NOT NULL,
    applied_at      TEXT    NOT NULL,
    PRIMARY KEY (owned_card_id, attribute_index)
 );
 -- The projection reads every effect for a set of instances on each /collection
 -- call, so the lookup is by instance.
 CREATE INDEX idx_owned_card_training_owned ON owned_card_training(owned_card_id);
@@ -1,66 +0,0 @@
 -- Reshape attribute training to AT MOST ONE effect per instance, replaceable.
 --
 -- WHY THIS SUPERSEDES 0029'S SHAPE. 0029 keyed on (owned_card_id,
 -- attribute_index) and recorded that same-slot behaviour was UNKNOWN, enforcing
 -- the unknown as a refusal. That was the honest shape while the semantics were
 -- unrecovered. They are now recovered, and BOTH halves of 0029's shape are
 -- wrong:
 --
 --   * "You can only boost one attribute or all six. You can not do it with 2, 3,
 --     4 or 5 attributes." -- so two effects must never coexist on one instance,
 --     which the old composite key permitted (and which staging demonstrated by
 --     holding a slot-4 and a slot-1 effect at once).
 --   * "When you apply a new training card to a player, he loses the improved
 --     attributes of previous training cards. It does not accumulate, it
 --     replaces." -- so a second apply REPLACES, it does not refuse.
 --
 -- Both quotes are from the contemporaneous FIFA 17-specific training guide
 -- (fifauteam, published 2016-09-08), corroborated by the shipped table: each
 -- family has exactly 21 rows = 7 card types x 3 levels, and the 7th type in each
 -- family (subtypes 57 and 67) is the only one flagged `weightrare = 2` with
 -- amounts 3/6/10, matching the documented RARE "ALL" card at +3/+6/+10.
 -- DOCUMENTED, corroborated TABLE_PROVEN. It is NOT LIVE_PROVEN against EA.
 --
 -- 0029 is left intact rather than rewritten: it is already applied to the
 -- supervised staging environment, so migration history matters there.
 --
 -- NEW SHAPE. One row per instance, so "one attribute or all six" is a
 -- representable invariant instead of a convention:
 --   attribute_index INTEGER NULL -- a slot in Core's six-attribute model, or
 --                                   NULL meaning ALL SIX slots (the rare card).
 -- The PRIMARY KEY on owned_card_id alone is what makes a second application a
 -- REPLACE (delete-then-insert inside the one apply transaction) rather than an
 -- accumulation.
 --
 -- The 1..=15 amount bound is NOT tightened here: 15 is the single-attribute
 -- ceiling while the all-six card authors at most 10, and which ceiling applies
 -- depends on the card family -- a per-game rule that belongs at apply time where
 -- the game's table is in scope, not in the schema.
 --
 -- DATA CARRIED FORWARD: where an instance somehow holds several effects (only
 -- reachable on staging under 0029's shape), the MOST RECENT survives, which is
 -- exactly the "replaces" rule applied retroactively.
 CREATE TABLE owned_card_training_new (
    owned_card_id   TEXT    NOT NULL PRIMARY KEY REFERENCES owned_cards(id) ON DELETE CASCADE,
    attribute_index INTEGER          CHECK (attribute_index IS NULL OR attribute_index BETWEEN 0 AND 5),
    amount          INTEGER NOT NULL CHECK (amount >= 1 AND amount <= 99),
    source_card_id  TEXT    NOT NULL,
    applied_at      TEXT    NOT NULL
 );
 INSERT INTO owned_card_training_new
    (owned_card_id, attribute_index, amount, source_card_id, applied_at)
 SELECT t.owned_card_id, t.attribute_index, t.amount, t.source_card_id, t.applied_at
  FROM owned_card_training t
  JOIN (
        SELECT owned_card_id, MAX(applied_at) AS newest
          FROM owned_card_training
         GROUP BY owned_card_id
       ) pick
    ON pick.owned_card_id = t.owned_card_id
   AND pick.newest        = t.applied_at
 GROUP BY t.owned_card_id;
 DROP TABLE owned_card_training;
 ALTER TABLE owned_card_training_new RENAME TO owned_card_training;
@@ -42,38 +42,7 @@ pub struct AppState {
 }
 pub async fn build(pool: Pool, cfg: Config) -> Result<Router> {
-    let mut card_db = CardDb::load(&cfg.data_dir)?;
+    let card_db = Arc::new(CardDb::load(&cfg.data_dir)?);
    for game in &cfg.dev_content_games {
        card_db.load_game_dev(&cfg.data_dir, game)?;
    }
    for pack in &cfg.content_packs {
        card_db.load_pack(pack)?;
    }
    let card_db = Arc::new(card_db);
    // Content preflight: every owned card MUST reference a loaded CardDefinition.
    // A real profile with owned players but missing definitions fails LOUDLY here
    // rather than silently serving an empty /collection. Empty owned_cards (fresh
    // DB, tests) passes. A SINGLE missing definition is caught, not only the
    // zero-loaded case.
    {
        let referenced: Vec<String> =
            sqlx::query_scalar("SELECT DISTINCT card_id FROM owned_cards")
                .fetch_all(&pool)
                .await?;
        let missing: Vec<String> = referenced
            .into_iter()
            .filter(|id| card_db.get(id).is_none())
            .collect();
        if !missing.is_empty() {
            let sample: Vec<&String> = missing.iter().take(5).collect();
            anyhow::bail!(
                "content preflight failed: {} owned card(s) reference CardDefinitionId(s) not loaded (e.g. {:?}). Load the production content pack via OPENFUT_CONTENT_PACKS.",
                missing.len(),
                sample
            );
        }
    }
    let pack_defs = Arc::new(load_pack_definitions(&cfg.data_dir)?);
    let obj_defs = Arc::new(load_objective_definitions(&cfg.data_dir)?);
    let sbc_defs = Arc::new(load_sbc_definitions(&cfg.data_dir)?);
@@ -169,49 +138,9 @@ pub async fn build(pool: Pool, cfg: Config) -> Result<Router> {
        .route("/club/checkin", get(routes::club::get_checkin_status))
        .route("/club/checkin", post(routes::club::post_checkin))
        .route("/club/milestones", get(routes::club::get_milestones))
        // ClubB: squad manager assignment (append-only; own lines).
        .route("/club/manager", get(routes::club::get_squad_manager))
        .route("/club/manager", put(routes::club::put_squad_manager))
        // Active club-item designations (home/away kit, badge, ball, stadium).
        .route("/club/active-items", get(routes::club::get_active_items))
        .route("/club/active-items", put(routes::club::put_active_item))
        .route("/cards", get(routes::cards::get_cards))
        .route("/cards/:card_id", get(routes::cards::get_card))
        .route("/collection", get(routes::cards::get_collection))
        .route("/economy/balance", get(routes::economy::get_balance))
        .route(
            "/economy/entitlements",
            get(routes::economy::get_entitlements),
        )
        .route(
            "/economy/purchase-entitlement",
            post(routes::economy::post_purchase_entitlement),
        )
        .route(
            "/economy/redeem-entitlement",
            post(routes::economy::post_redeem_entitlement),
        )
        .route("/economy/sell-item", post(routes::economy::post_sell_item))
        .route(
            "/consumables/apply",
            post(routes::consumables::post_apply_consumable),
        )
        .route(
            "/economy/grant-reward",
            post(routes::economy::post_grant_reward),
        )
        .route(
            "/economy/purchase-item",
            post(routes::economy::post_purchase_item),
        )
        .route(
            "/economy/purchase-items",
            post(routes::economy::post_purchase_items),
        )
        .route(
            "/economy/settle-sale",
            post(routes::economy::post_settle_sale),
        )
        .route(
            "/collection/:owned_card_id",
            delete(routes::cards::delete_owned_card),
@@ -239,8 +168,6 @@ pub async fn build(pool: Pool, cfg: Config) -> Result<Router> {
        .route("/packs/open/:pack_id", post(routes::packs::post_open_pack))
        .route("/squad", get(routes::squad::get_squad))
        .route("/squad", post(routes::squad::post_squad))
        .route("/squad/ext", get(routes::squad::get_squad_ext))
        .route("/squad/replace", put(routes::squad::put_squad_replace))
        .route("/squads", get(routes::squad::get_squads))
        .route("/squads/:squad_id", get(routes::squad::get_squad_by_id))
        .route("/squads/:squad_id", delete(routes::squad::delete_squad))
@@ -260,18 +187,9 @@ pub async fn build(pool: Pool, cfg: Config) -> Result<Router> {
        .route("/matches", get(routes::matches::get_matches))
        .route("/matches/opponent", get(routes::matches::get_opponent))
        .route("/matches/result", post(routes::matches::post_match_result))
        .route(
            "/matches/complete",
            post(routes::matches::post_match_complete),
        )
        .route("/sbc", get(routes::sbc::get_sbcs))
        .route("/sbc/status", get(routes::sbc::get_sbc_status))
        .route("/sbc/submit", post(routes::sbc::post_sbc_submit))
        .route("/sbc/:sbc_id", get(routes::sbc::get_sbc))
        .route(
            "/sbc/:sbc_id/squad",
            get(routes::sbc::get_sbc_squad).put(routes::sbc::put_sbc_squad),
        )
        .route("/market", get(routes::market::get_market))
        .route("/market/buy", post(routes::market::post_market_buy))
        .route("/market/sell", post(routes::market::post_market_sell))
@@ -1,21 +1,12 @@
 use anyhow::Result;
 use std::path::PathBuf;
 #[derive(Debug, Clone)]
 pub struct Config {
    pub listen_addr: String,
    pub database_url: String,
    pub data_dir: String,
    #[allow(dead_code)]
    pub max_connections: u32,
    /// Games whose opt-in development content pack (`data/games/<game>/dev/`) is
    /// loaded IN ADDITION to the default `data/cards` catalog. Empty by default —
    /// default/test content is never affected unless a game is named here.
    pub dev_content_games: Vec<String>,
    /// Explicit PRODUCTION content pack file paths (each a `CardDefinition[]`
    /// JSON), loaded IN ADDITION to `data/cards` and any dev pack. This is the
    /// production real-profile content path — deliberately NOT gated behind the
    /// dev-only `dev_content_games`.
    pub content_packs: Vec<PathBuf>,
 }
 impl Config {
@@ -29,26 +20,6 @@ impl Config {
                .ok()
                .and_then(|v| v.parse().ok())
                .unwrap_or(5),
            dev_content_games: std::env::var("OPENFUT_DEV_CONTENT_GAMES")
                .ok()
                .map(|v| {
                    v.split(',')
                        .map(str::trim)
                        .filter(|s| !s.is_empty())
                        .map(String::from)
                        .collect()
                })
                .unwrap_or_default(),
            content_packs: std::env::var("OPENFUT_CONTENT_PACKS")
                .ok()
                .map(|v| {
                    v.split(',')
                        .map(str::trim)
                        .filter(|s| !s.is_empty())
                        .map(PathBuf::from)
                        .collect()
                })
                .unwrap_or_default(),
        })
    }
 }
@@ -1,40 +1,24 @@
 use anyhow::Result;
 use sqlx::{
-    sqlite::{SqliteConnectOptions, SqliteJournalMode, SqlitePoolOptions},
+    sqlite::{SqliteConnectOptions, SqlitePoolOptions},
-    ConnectOptions, Connection, SqlitePool,
+    SqlitePool,
 };
 use std::str::FromStr;
 use std::time::Duration;
 use tracing::info;
 pub type Pool = SqlitePool;
-pub async fn init_pool(database_url: &str, max_connections: u32) -> Result<Pool> {
+pub async fn init_pool(database_url: &str) -> Result<Pool> {
    info!("Connecting to database: {}", database_url);
-    // Per-connection options so EVERY pooled connection gets them: WAL for
+    let opts = SqliteConnectOptions::from_str(database_url)?.create_if_missing(true);
    // reader/writer concurrency, foreign keys on, and a busy_timeout so a
    // transient SQLITE_BUSY under concurrent access waits-and-retries.
    let opts = SqliteConnectOptions::from_str(database_url)?
        .create_if_missing(true)
        .journal_mode(SqliteJournalMode::Wal)
        .foreign_keys(true)
        .busy_timeout(Duration::from_secs(5));
    // Establish WAL on the file via ONE connection BEFORE the pool opens.
    // Switching a fresh DB to WAL is a one-time file-level change; letting
    // several pooled connections do it concurrently at warm-up races that
    // switch and can surface a spurious lock. Serialize it here so every
    // pooled connection thereafter only re-asserts an already-WAL file.
    {
        let mut conn = opts.clone().connect().await?;
        sqlx::query("PRAGMA journal_mode=WAL")
            .execute(&mut conn)
            .await?;
        conn.close().await?;
    }
    let pool = SqlitePoolOptions::new()
-        .max_connections(max_connections)
+        .max_connections(5)
        .connect_with(opts)
        .await?;
    sqlx::query("PRAGMA journal_mode=WAL")
        .execute(&pool)
        .await?;
    sqlx::query("PRAGMA foreign_keys=ON").execute(&pool).await?;
    Ok(pool)
 }
@@ -1,51 +0,0 @@
 //! Request extractors shared across routes.
 use axum::{
    async_trait,
    extract::FromRequestParts,
    http::{request::Parts, HeaderName},
 };
 use std::convert::Infallible;
 /// The game a request belongs to, read from the `X-OpenFUT-Game` header.
 ///
 /// Multi-game support: each game bridge tags its requests with its own id
 /// (e.g. `fifa17`, `fifa23`) so core can scope the active profile - and thus all
 /// downstream club/card/squad/market state - to that game. Defaults to `fifa23`
 /// when the header is absent, so the existing FIFA 23 bridge and the integration
 /// tests (which send no header) keep operating on their game unchanged.
 ///
 /// Extraction never fails: a missing or malformed header falls back to the default.
 #[derive(Debug, Clone)]
 pub struct GameId(pub String);
 /// The game assumed when no `X-OpenFUT-Game` header is present.
 pub const DEFAULT_GAME: &str = "fifa23";
 static HEADER: HeaderName = HeaderName::from_static("x-openfut-game");
 impl GameId {
    pub fn as_str(&self) -> &str {
        &self.0
    }
 }
 #[async_trait]
 impl<S> FromRequestParts<S> for GameId
 where
    S: Send + Sync,
 {
    type Rejection = Infallible;
    async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self, Self::Rejection> {
        let game = parts
            .headers
            .get(&HEADER)
            .and_then(|v| v.to_str().ok())
            .map(|s| s.trim())
            .filter(|s| !s.is_empty())
            .unwrap_or(DEFAULT_GAME)
            .to_string();
        Ok(GameId(game))
    }
 }
@@ -2,7 +2,6 @@ pub mod app;
 pub mod config;
 pub mod db;
 pub mod error;
 pub mod extractors;
 pub mod middleware;
 pub mod modding;
 pub mod models;
@@ -21,8 +20,6 @@ pub async fn build_app(pool: db::Pool, data_dir: &str) -> Result<Router> {
        database_url: "sqlite::memory:".into(),
        data_dir: data_dir.to_string(),
        max_connections: 1,
        dev_content_games: Vec::new(),
        content_packs: Vec::new(),
    };
    app::build(pool, cfg).await
 }
@@ -1,4 +1,4 @@
-use anyhow::{Context, Result};
+use anyhow::Result;
 use openfut_core::{config, db, seed};
 use tracing::info;
 use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt, EnvFilter};
@@ -12,77 +12,13 @@ async fn main() -> Result<()> {
            EnvFilter::try_from_default_env()
                .unwrap_or_else(|_| "openfut_core=debug,tower_http=debug".into()),
        )
-        // Diagnostics on stderr so stdout carries only machine output (the
+        .with(tracing_subscriber::fmt::layer())
        // `import`/`seed-dev` subcommands print a clean JSON result there).
        .with(tracing_subscriber::fmt::layer().with_writer(std::io::stderr))
        .init();
    let cfg = config::Config::from_env()?;
    // Opt-in dev subcommand: `openfut-core seed-dev` seeds the FIFA 17 dev
    // profile/club from the dev content pack, prints a coverage report, and
    // exits. Normal server startup NEVER seeds dev inventory.
    if std::env::args().nth(1).as_deref() == Some("seed-dev") {
        let pool = db::init_pool(&cfg.database_url, cfg.max_connections).await?;
        db::run_migrations(&pool).await?;
        let mut card_db = openfut_core::services::card_db::CardDb::load(&cfg.data_dir)?;
        card_db.load_game_dev(&cfg.data_dir, seed::FIFA17_GAME)?;
        let report = seed::seed_fifa17_dev(&pool, &card_db).await?;
        println!("{}", serde_json::to_string_pretty(&report)?);
        return Ok(());
    }
    // Opt-in generic import subcommand: `openfut-core import <request.json>`.
    // Reads a GAME-AGNOSTIC ProfileImportRequest (the importer adapter translates
    // FIFA17 source data into it), loads production content packs, runs preflight,
    // and applies one all-or-nothing transaction. FIFA17 semantics live entirely
    // in the adapter; Core only sees opaque ids + opaque extension bytes.
    if std::env::args().nth(1).as_deref() == Some("import") {
        let path = std::env::args()
            .nth(2)
            .context("usage: openfut-core import <request.json>")?;
        let pool = db::init_pool(&cfg.database_url, cfg.max_connections).await?;
        db::run_migrations(&pool).await?;
        let mut card_db = openfut_core::services::card_db::CardDb::load(&cfg.data_dir)?;
        for pack in &cfg.content_packs {
            card_db.load_pack(pack)?;
        }
        let raw = std::fs::read_to_string(&path)
            .with_context(|| format!("read import request {path}"))?;
        let req: openfut_core::services::import::ProfileImportRequest =
            serde_json::from_str(&raw).context("parse import request JSON")?;
        let outcome =
            openfut_core::services::import::apply_profile_import(&pool, &card_db, &req).await?;
        println!("{}", serde_json::to_string_pretty(&outcome)?);
        return Ok(());
    }
    // `openfut-core reclassify <request.json> [--dry-run]` — correct the
    // content_kind of already-imported owned rows. A profile import is
    // once-only, so a taxonomy fix cannot arrive by re-importing; the adapter
    // supplies card_id -> kind because only it can map its own taxonomy.
    // Idempotent. `--dry-run` runs the same statements and rolls back, so an
    // operator can see what a production run would touch before it touches it.
    if std::env::args().nth(1).as_deref() == Some("reclassify") {
        let path = std::env::args()
            .nth(2)
            .context("usage: openfut-core reclassify <request.json> [--dry-run]")?;
        let dry_run = std::env::args().any(|a| a == "--dry-run");
        let pool = db::init_pool(&cfg.database_url, cfg.max_connections).await?;
        db::run_migrations(&pool).await?;
        let raw = std::fs::read_to_string(&path)
            .with_context(|| format!("read reclassify request {path}"))?;
        let mut req: openfut_core::services::import::ReclassifyRequest =
            serde_json::from_str(&raw).context("parse reclassify request JSON")?;
        req.dry_run |= dry_run;
        let outcome = openfut_core::services::import::reclassify_owned_content(&pool, &req).await?;
        println!("{}", serde_json::to_string_pretty(&outcome)?);
        return Ok(());
    }
    info!("OpenFUT Core starting on {}", cfg.listen_addr);
-    let pool = db::init_pool(&cfg.database_url, cfg.max_connections).await?;
+    let pool = db::init_pool(&cfg.database_url).await?;
    db::run_migrations(&pool).await?;
    seed::maybe_seed(&pool).await?;
@@ -1 +1,24 @@
-// Reserved for future modding loader utilities.
+use anyhow::{Context, Result};
 use serde::de::DeserializeOwned;
 use std::path::Path;
 #[allow(dead_code)]
 /// Generic loader for JSON arrays from a directory.
 pub fn load_json_dir<T: DeserializeOwned>(dir: &Path) -> Result<Vec<T>> {
    let mut items = Vec::new();
    if !dir.exists() {
        return Ok(items);
    }
    for entry in std::fs::read_dir(dir).with_context(|| format!("reading dir {dir:?}"))? {
        let entry = entry?;
        let path = entry.path();
        if path.extension().map(|e| e == "json").unwrap_or(false) {
            let content =
                std::fs::read_to_string(&path).with_context(|| format!("reading {path:?}"))?;
            let batch: Vec<T> =
                serde_json::from_str(&content).with_context(|| format!("parsing {path:?}"))?;
            items.extend(batch);
        }
    }
    Ok(items)
 }
@@ -1,2 +1,4 @@
 //! Modding support: load JSON data files from the data/ directory.
 //! All game content (cards, packs, objectives, SBCs) is data-driven.
 pub mod loader;
@@ -13,20 +13,6 @@ pub enum Rarity {
    Icon,
 }
 impl Rarity {
    pub fn as_str(&self) -> &'static str {
        match self {
            Rarity::Bronze => "bronze",
            Rarity::Silver => "silver",
            Rarity::Gold => "gold",
            Rarity::RareGold => "raregold",
            Rarity::Totw => "totw",
            Rarity::Hero => "hero",
            Rarity::Icon => "icon",
        }
    }
 }
 /// Visual card quality tier (gold/silver/bronze).
 ///
 /// Game-independent semantic dimension, kept distinct from `Rarity` (which also
@@ -54,165 +40,6 @@ impl Quality {
    }
 }
 /// What KIND of content one owned instance is.
 ///
 /// The game-independent ownership vocabulary: Core has exactly one instance-based
 /// ownership model (`owned_cards`) and this enum is the only thing that
 /// distinguishes a manager from a player from a chemistry style. It carries NO
 /// game numerics — a game adapter translates its own taxonomy (FIFA 17
 /// `cardsubtypeid`, resource ranges, …) into these tokens before ownership
 /// reaches Core, and translates them back on the way out.
 ///
 /// The tokens are the persisted values of `owned_cards.content_kind` and are
 /// pinned by that column's CHECK constraint (migration 0025).
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize, sqlx::Type)]
 #[serde(rename_all = "lowercase")]
 #[sqlx(rename_all = "lowercase")]
 pub enum ContentKind {
    /// A playable footballer card.
    #[default]
    Player,
    /// A squad manager.
    Manager,
    /// Non-manager club staff (fitness/goalkeeping/… coaches, physios, scouts).
    Staff,
    /// A single-use item applied to a target (contract, fitness, healing,
    /// chemistry style, position modifier, training).
    Consumable,
    /// A club kit (occupies the home or away designation).
    Kit,
    /// A club badge/crest.
    Badge,
    /// A match ball.
    Ball,
    /// A club stadium.
    Stadium,
    /// Owned content that is legitimately none of the above.
    Misc,
 }
 impl ContentKind {
    /// The canonical persisted token.
    pub fn as_str(self) -> &'static str {
        match self {
            ContentKind::Player => "player",
            ContentKind::Manager => "manager",
            ContentKind::Staff => "staff",
            ContentKind::Consumable => "consumable",
            ContentKind::Kit => "kit",
            ContentKind::Badge => "badge",
            ContentKind::Ball => "ball",
            ContentKind::Stadium => "stadium",
            ContentKind::Misc => "misc",
        }
    }
    /// Every kind, in declaration order (for exhaustive round-trip checks).
    pub const ALL: [ContentKind; 9] = [
        ContentKind::Player,
        ContentKind::Manager,
        ContentKind::Staff,
        ContentKind::Consumable,
        ContentKind::Kit,
        ContentKind::Badge,
        ContentKind::Ball,
        ContentKind::Stadium,
        ContentKind::Misc,
    ];
 }
 impl std::fmt::Display for ContentKind {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(self.as_str())
    }
 }
 impl std::str::FromStr for ContentKind {
    type Err = String;
    fn from_str(s: &str) -> Result<Self, Self::Err> {
        match s {
            "player" => Ok(ContentKind::Player),
            "manager" => Ok(ContentKind::Manager),
            "staff" => Ok(ContentKind::Staff),
            "consumable" => Ok(ContentKind::Consumable),
            "kit" => Ok(ContentKind::Kit),
            "badge" => Ok(ContentKind::Badge),
            "ball" => Ok(ContentKind::Ball),
            "stadium" => Ok(ContentKind::Stadium),
            "misc" => Ok(ContentKind::Misc),
            other => Err(format!("unknown content kind '{other}'")),
        }
    }
 }
 /// A club-scoped "active item" designation slot.
 ///
 /// One owned instance may occupy at most one slot and each slot holds at most one
 /// instance (migration 0026 `club_active_items`). Each slot admits exactly one
 /// [`ContentKind`], so a badge can never be installed as a kit.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum ActiveSlot {
    HomeKit,
    AwayKit,
    Badge,
    Ball,
    Stadium,
 }
 impl ActiveSlot {
    /// The canonical persisted token (`club_active_items.slot`).
    pub fn as_str(self) -> &'static str {
        match self {
            ActiveSlot::HomeKit => "home_kit",
            ActiveSlot::AwayKit => "away_kit",
            ActiveSlot::Badge => "badge",
            ActiveSlot::Ball => "ball",
            ActiveSlot::Stadium => "stadium",
        }
    }
    /// The one content kind this slot accepts.
    pub fn required_kind(self) -> ContentKind {
        match self {
            ActiveSlot::HomeKit | ActiveSlot::AwayKit => ContentKind::Kit,
            ActiveSlot::Badge => ContentKind::Badge,
            ActiveSlot::Ball => ContentKind::Ball,
            ActiveSlot::Stadium => ContentKind::Stadium,
        }
    }
    pub const ALL: [ActiveSlot; 5] = [
        ActiveSlot::HomeKit,
        ActiveSlot::AwayKit,
        ActiveSlot::Badge,
        ActiveSlot::Ball,
        ActiveSlot::Stadium,
    ];
 }
 impl std::fmt::Display for ActiveSlot {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(self.as_str())
    }
 }
 impl std::str::FromStr for ActiveSlot {
    type Err = String;
    fn from_str(s: &str) -> Result<Self, Self::Err> {
        match s {
            "home_kit" => Ok(ActiveSlot::HomeKit),
            "away_kit" => Ok(ActiveSlot::AwayKit),
            "badge" => Ok(ActiveSlot::Badge),
            "ball" => Ok(ActiveSlot::Ball),
            "stadium" => Ok(ActiveSlot::Stadium),
            other => Err(format!("unknown active-item slot '{other}'")),
        }
    }
 }
 /// A card definition loaded from JSON data files.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct CardDefinition {
@@ -231,28 +58,9 @@ pub struct CardDefinition {
    pub physical: u8,
    pub rarity: Rarity,
    pub image_path: Option<String>,
    /// EA's authored definition rating for a NON-PLAYER: a staff card's `value`
    /// from its shipped family table, or a consumable's own rating.
    ///
    /// This is deliberately NOT `overall`. `overall` feeds pricing and squad
    /// projection, so it stays 0 for every non-player; `source_rating` is the
    /// separate authoritative number the game's own tier rules read (bronze
    /// `<65`, silver `65..=74`, gold `>=75`). `None` for players, whose rating
    /// IS `overall`, and `None` whenever Core tracks no authored value — a
    /// caller MUST fail closed rather than substitute a tier.
    ///
    /// MUST stay `Option`: `CardDefinition` has no `#[serde(default)]`, so a
    /// required field would reject every already-shipped content pack, whereas
    /// a missing `Option` deserializes to `None`.
    pub source_rating: Option<u8>,
 }
-/// One owned content INSTANCE (stored in DB).
+/// A card instance owned by a club (stored in DB).
 ///
 /// Instance-based: `id` is the instance, `card_id` the definition, so two copies
 /// of one definition are two rows. `content_kind` says what the instance IS;
 /// `quantity` is an optional per-instance stack size (`None` = not a stack) and
 /// never a substitute for an instance.
 #[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
 pub struct OwnedCard {
    pub id: String,
@@ -264,88 +72,4 @@ pub struct OwnedCard {
    pub chemistry_style: String,
    pub position_override: Option<String>,
    pub training_bonus: i64,
    pub content_kind: ContentKind,
    pub quantity: Option<i64>,
    /// Match-contracts remaining on this instance, or `None` when Core tracks
    /// no contract for it. `None` is not zero: the pack-fresh starting value is
    /// a per-game rule the caller supplies, never a Core default.
    pub contract_matches: Option<i64>,
 }
 /// The ONE canonical column list for reading an [`OwnedCard`].
 ///
 /// `sqlx::FromRow` needs every field present in the row, so a hand-written
 /// partial column list decodes into a runtime `ColumnNotFound` rather than a
 /// compile error. Every read goes through this const so adding a column can
 /// never leave a stale SELECT behind; append `WHERE …` to it.
 pub const OWNED_CARD_SELECT: &str = "SELECT id, club_id, card_id, is_loan, \
     loan_matches_remaining, acquired_at, chemistry_style, position_override, \
     training_bonus, content_kind, quantity, contract_matches FROM owned_cards";
 #[cfg(test)]
 mod tests {
    use super::*;
    use std::str::FromStr;
    /// The persisted token, the serde token and the parser MUST agree for every
    /// kind: the DB CHECK, the HTTP body and the adapter all read the same
    /// vocabulary, so a divergence would silently mis-classify ownership.
    #[test]
    fn content_kind_round_trips_token_serde_and_parse() {
        for kind in ContentKind::ALL {
            let token = kind.as_str();
            assert_eq!(
                serde_json::to_string(&kind).unwrap(),
                format!("\"{token}\""),
                "serde token must equal the persisted token"
            );
            assert_eq!(
                serde_json::from_str::<ContentKind>(&format!("\"{token}\"")).unwrap(),
                kind
            );
            assert_eq!(ContentKind::from_str(token).unwrap(), kind);
            assert_eq!(kind.to_string(), token);
        }
    }
    /// The vocabulary is closed and pinned to migration 0025's CHECK list.
    #[test]
    fn content_kind_vocabulary_is_exactly_the_contract() {
        let tokens: Vec<&str> = ContentKind::ALL.iter().map(|k| k.as_str()).collect();
        assert_eq!(
            tokens,
            vec![
                "player",
                "manager",
                "staff",
                "consumable",
                "kit",
                "badge",
                "ball",
                "stadium",
                "misc"
            ]
        );
        assert!(ContentKind::from_str("Player").is_err(), "case-sensitive");
        assert!(ContentKind::from_str("coach").is_err());
        assert_eq!(ContentKind::default(), ContentKind::Player);
    }
    #[test]
    fn active_slot_round_trips_and_pins_its_required_kind() {
        for slot in ActiveSlot::ALL {
            let token = slot.as_str();
            assert_eq!(ActiveSlot::from_str(token).unwrap(), slot);
            assert_eq!(
                serde_json::to_string(&slot).unwrap(),
                format!("\"{token}\"")
            );
        }
        assert_eq!(ActiveSlot::HomeKit.required_kind(), ContentKind::Kit);
        assert_eq!(ActiveSlot::AwayKit.required_kind(), ContentKind::Kit);
        assert_eq!(ActiveSlot::Badge.required_kind(), ContentKind::Badge);
        assert_eq!(ActiveSlot::Ball.required_kind(), ContentKind::Ball);
        assert_eq!(ActiveSlot::Stadium.required_kind(), ContentKind::Stadium);
        assert!(ActiveSlot::from_str("home").is_err(), "0024's old token");
    }
 }
@@ -1,60 +0,0 @@
 //! Generic, game-scoped **opaque** extension state.
 //!
 //! Core stores and versions these bytes and associates them with a canonical
 //! entity + a server-computed fingerprint, but never interprets them. A game
 //! adapter owns the payload schema/meaning. This keeps game-only wire round-trip
 //! state (e.g. a FIFA 17 squad's `custom[]`/`kicktakers`/`kitNumber`) durable and
 //! atomic with its canonical entity without leaking game concepts into Core.
 use serde::{Deserialize, Serialize};
 /// Generic safety bounds Core enforces without interpreting the payload.
 pub const MAX_EXT_PAYLOAD_BYTES: usize = 64 * 1024;
 pub const MAX_EXT_NAMESPACE_LEN: usize = 64;
 /// An opaque extension payload a game adapter asks Core to persist atomically
 /// alongside a canonical entity. `payload` is uninterpreted bytes-as-text.
 #[derive(Debug, Clone, Deserialize)]
 pub struct OpaqueExtensionWrite {
    /// Opaque adapter key, e.g. `"fifa17.squad.v1"`. Core treats it as a string.
    pub namespace: String,
    /// Adapter's payload schema version (distinct from the DB storage schema).
    pub schema_version: i64,
    /// Uninterpreted payload (the adapter's serialized game-only state).
    pub payload: String,
 }
 impl OpaqueExtensionWrite {
    /// Generic bounds check — namespace non-empty/length, payload size. Semantic
    /// validation of the payload is the adapter's job; Core only guards size.
    pub fn validate(&self) -> Result<(), String> {
        if self.namespace.is_empty() || self.namespace.len() > MAX_EXT_NAMESPACE_LEN {
            return Err(format!(
                "namespace length {} out of bounds (1..={MAX_EXT_NAMESPACE_LEN})",
                self.namespace.len()
            ));
        }
        if self.payload.len() > MAX_EXT_PAYLOAD_BYTES {
            return Err(format!(
                "extension payload {} bytes exceeds max {MAX_EXT_PAYLOAD_BYTES}",
                self.payload.len()
            ));
        }
        Ok(())
    }
 }
 /// A stored opaque extension row (read side). `canonical_fingerprint` is the
 /// server-computed fingerprint of the canonical entity at write time; a reader
 /// compares it against the entity's *current* fingerprint to detect staleness.
 #[derive(Debug, Clone, Serialize, sqlx::FromRow)]
 pub struct GameEntityExt {
    pub game_id: String,
    pub entity_kind: String,
    pub entity_id: String,
    pub namespace: String,
    pub schema_version: i64,
    pub canonical_fingerprint: String,
    pub payload: String,
    pub updated_at: String,
 }
@@ -11,43 +11,14 @@ pub enum MatchOutcome {
    Loss,
 }
-/// Canonical, game-independent economic result of a completed match. The game
+#[derive(Debug, Deserialize)]
-/// adapter maps its own wire (FIFA17 `endReason`, score, …) onto this — Core
+pub struct SubmitMatchRequest {
-/// never sees a game-specific reason string.
+    pub squad_id: String,
-///
+    pub opponent_name: String,
-/// * `Win` / `Draw` / `Loss` — a finished match; standard reward tiers.
+    pub goals_for: i64,
-/// * `Dnf` — did-not-finish (abandon/quit). Economically a loss, but tallied in
+    pub goals_against: i64,
-///   its own statistics bucket and never in `matches_lost`.
+    pub mode: String,
-/// * `NoContest` — a voided match. Zero economic effect: no coins, XP, or
+    pub goal_positions: Option<Vec<String>>,
 ///   W/D/L/DNF change; recorded only for history + idempotency.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum MatchResultKind {
    Win,
    Draw,
    Loss,
    Dnf,
    NoContest,
 }
 impl MatchResultKind {
    /// The canonical lowercase token persisted in `matches.outcome` and
    /// `match_completions.result`.
    pub fn as_str(self) -> &'static str {
        match self {
            MatchResultKind::Win => "win",
            MatchResultKind::Draw => "draw",
            MatchResultKind::Loss => "loss",
            MatchResultKind::Dnf => "dnf",
            MatchResultKind::NoContest => "no_contest",
        }
    }
    /// Whether this result applies any economic effect (coins / XP / statistics /
    /// objectives / achievements). `NoContest` is the only non-economic result.
    pub fn is_economic(self) -> bool {
        !matches!(self, MatchResultKind::NoContest)
    }
 }
 #[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
@@ -101,86 +72,18 @@ impl Match {
    }
 }
 /// Request to atomically complete a match exactly once. `match_identity` is the
 /// opaque, host-supplied per-match token that keys durable economic idempotency
 /// (persona/profile + match_identity). `result` is the canonical outcome the
 /// game adapter derived from its wire; `goals_for`/`goals_against` are recorded
 /// for history and statistics (0-0 is normal for a DNF/no-contest).
 #[derive(Debug, Clone, Deserialize)]
 pub struct CompleteMatchRequest {
    pub match_identity: String,
    pub result: MatchResultKind,
    pub squad_id: String,
    pub opponent_name: String,
    pub goals_for: i64,
    pub goals_against: i64,
    pub mode: String,
    #[serde(default)]
    pub goal_positions: Option<Vec<String>>,
    /// Tick down `loan_matches_remaining` for this squad's starters and remove
    /// the cards whose loan ran out.
    ///
    /// OFF by default so a game whose loan model is its own (FIFA 17 does not
    /// route loans through Core) is unaffected. Callers of Core's own match
    /// modes opt in.
    #[serde(default)]
    pub expire_loans: bool,
    /// Advance Core's OWN season model (division progress, and its end-of-season
    /// coin/pack award).
    ///
    /// OFF by default: this grants economy, and it is NOT the same thing as a
    /// game's native seasons (FIFA 17 offline Seasons are the adapter's, keyed by
    /// its own wire). Only a caller using Core's season model opts in.
    #[serde(default)]
    pub advance_season: bool,
    /// Owned-card instances that TOOK THE FIELD in this match, whose one-match
    /// training effects it consumes.
    ///
    /// Supplied by the caller rather than derived here, and deliberately so.
    /// FIFA 17's training rule keys on the player PLAYING, and who played is
    /// game-specific knowledge Core does not have: its match wire carries no
    /// lineup at all (LIVE_PROVEN over 36,149 captured requests). Core must also
    /// not resolve it from the squad at completion time, because the squad at
    /// end is provably not the squad that started — a captured match began at
    /// 20:33:20 and the next squad save landed 12 minutes later with no
    /// `/match/end` in between. The adapter therefore snapshots at kickoff and
    /// passes the result here.
    ///
    /// Empty expires nothing, so a caller that cannot identify participants is
    /// simply inert instead of clearing a whole club.
    #[serde(default)]
    pub participants: Vec<String>,
 }
 /// Outcome of [`crate::services::match_service::complete_match`].
 #[derive(Debug, Serialize)]
-pub struct MatchCompletionResult {
+pub struct MatchRewardResult {
-    /// `true` when THIS call applied the economic effect; `false` on an
+    pub match_record: Match,
    /// idempotent replay of an already-completed match (the persisted canonical
    /// result is echoed unchanged).
    pub applied: bool,
    pub match_identity: String,
    pub result: MatchResultKind,
    pub coins_awarded: i64,
    pub xp_awarded: i64,
    /// Club balance after completion — echoed so the host can render the wire
    /// reward body without a second round-trip.
    pub coins_balance: i64,
    /// Objectives completed by this match (empty on a replay).
    pub objectives_updated: Vec<String>,
-    /// Level-ups gained from this match's XP (empty on a replay).
+    /// Owned card IDs removed because the loan expired this match.
    pub level_ups: Vec<LevelUpEvent>,
    /// Achievements unlocked by this match (empty on a replay).
    pub achievements_unlocked: Vec<AchievementDefinition>,
    /// Owned card ids removed because their loan expired on this match. Empty
    /// unless the caller set `expire_loans`, and empty on a replay.
    pub expired_loans: Vec<String>,
-    /// Owned card instances whose one-match training effect this match consumed.
+    /// Present when this match completed the current season.
    /// Empty when the caller passed no participants, and empty on a replay —
    /// the effect is consumed exactly once, by the first completion.
    pub expired_training: Vec<String>,
    /// Present when this match ended a Core season. `None` unless the caller set
    /// `advance_season`, and `None` on a replay.
    pub season_end: Option<crate::models::season::SeasonEndSummary>,
-    pub match_record: Match,
+    /// Non-empty when the player levelled up one or more times from this match's XP.
    pub level_ups: Vec<LevelUpEvent>,
    /// Achievements unlocked as a result of this match.
    pub achievements_unlocked: Vec<AchievementDefinition>,
 }
@@ -5,7 +5,6 @@ pub mod club;
 pub mod draft;
 pub mod event;
 pub mod fut_champs;
 pub mod game_ext;
 pub mod market;
 pub mod match_result;
 pub mod notification;
@@ -21,19 +21,6 @@ pub enum ObjectiveMetric {
    CoinsEarned,
 }
 impl ObjectiveMetric {
    pub fn as_str(&self) -> &'static str {
        match self {
            ObjectiveMetric::MatchesWon => "matcheswon",
            ObjectiveMetric::MatchesPlayed => "matchesplayed",
            ObjectiveMetric::GoalsScored => "goalsscored",
            ObjectiveMetric::PacksOpened => "packsopened",
            ObjectiveMetric::SbcsCompleted => "sbcscompleted",
            ObjectiveMetric::CoinsEarned => "coinsearned",
        }
    }
 }
 /// Objective definition from data/objectives/*.json
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ObjectiveDefinition {
@@ -8,22 +8,18 @@ pub struct Profile {
    pub username: String,
    pub level: i64,
    pub xp: i64,
    /// The game this profile belongs to (e.g. "fifa17", "fifa23"). Scopes all of
    /// this profile's downstream state so multiple games share one core + DB.
    pub game_id: String,
    pub created_at: DateTime<Utc>,
    pub updated_at: DateTime<Utc>,
 }
 impl Profile {
-    pub fn new(username: impl Into<String>, game_id: impl Into<String>) -> Self {
+    pub fn new(username: impl Into<String>) -> Self {
        let now = Utc::now();
        Self {
            id: Uuid::new_v4().to_string(),
            username: username.into(),
            level: 1,
            xp: 0,
            game_id: game_id.into(),
            created_at: now,
            updated_at: now,
        }
@@ -33,17 +33,16 @@ pub struct SbcReward {
    pub pack_id: Option<String>,
 }
-/// DB record of a completed submission.
+/// DB record of a completed submission
 #[allow(dead_code)]
 #[derive(Debug, Clone, Serialize, Deserialize, sqlx::FromRow)]
 pub struct SbcSubmission {
    pub id: String,
    pub profile_id: String,
    pub club_id: Option<String>,
    pub sbc_id: String,
    pub submitted_card_ids: String,
    pub passed: bool,
    pub submitted_at: String,
    pub repeatable: bool,
 }
 #[derive(Debug, Deserialize)]
@@ -52,17 +51,6 @@ pub struct SubmitSbcRequest {
    pub owned_card_ids: Vec<String>,
 }
 #[derive(Debug, Deserialize)]
 pub struct SaveSbcSquadRequest {
    pub owned_card_ids: Vec<String>,
 }
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct SbcSquadState {
    pub sbc_id: String,
    pub owned_card_ids: Vec<String>,
 }
 #[derive(Debug, Serialize)]
 pub struct SbcResult {
    pub passed: bool,
@@ -96,7 +96,4 @@ pub struct SquadReplaced {
    pub slots_written: usize,
    pub evaluation: crate::services::squad_rules::SquadEvaluation,
    pub client_disagreements: Vec<crate::services::squad_rules::EvaluationComparison>,
    /// Server-computed deterministic fingerprint of the committed canonical squad
    /// (anchors any opaque game extension against stale projection).
    pub canonical_fingerprint: String,
 }
@@ -7,7 +7,6 @@ pub struct Statistics {
    pub matches_won: i64,
    pub matches_drawn: i64,
    pub matches_lost: i64,
    pub matches_dnf: i64,
    pub goals_scored: i64,
    pub goals_conceded: i64,
    pub packs_opened: i64,
@@ -26,7 +25,6 @@ impl Statistics {
            matches_won: 0,
            matches_drawn: 0,
            matches_lost: 0,
            matches_dnf: 0,
            goals_scored: 0,
            goals_conceded: 0,
            packs_opened: 0,
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{extract::State, Json};
 use serde_json::{json, Value};
@@ -8,11 +7,8 @@ use crate::{
    services::{achievement as ach_svc, club as club_svc, profile as profile_svc},
 };
-pub async fn get_achievements(
+pub async fn get_achievements(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let _ = ach_svc::check_and_unlock(&state.pool, &state.achievement_defs, &profile.id, &club.id)
        .await;
@@ -1,11 +1,9 @@
 use axum::{extract::State, Json};
 use serde::Deserialize;
 use serde_json::{json, Value};
 use crate::{
    app::AppState,
-    error::{AppError, AppResult},
+    error::AppResult,
    extractors::GameId,
    models::{club::Club, profile::CreateProfileRequest},
    seed,
    services::{club as club_svc, profile as profile_svc},
@@ -13,12 +11,11 @@ use crate::{
 pub async fn post_auth_local(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<CreateProfileRequest>,
 ) -> AppResult<Json<Value>> {
    let username = req.username.unwrap_or_else(|| "Player 1".into());
-    let profile = profile_svc::create_profile(&state.pool, &username, game.as_str()).await?;
+    let profile = profile_svc::create_profile(&state.pool, &username).await?;
    let club = Club::new(&profile.id, "OpenFUT FC", 5000);
    club_svc::create_club(&state.pool, &club).await?;
@@ -34,113 +31,51 @@ pub async fn post_auth_local(
 /// GET /auth/status — lightweight check: does a profile exist?
 /// Returns 200 `{ "has_profile": true/false }` without erroring.
-pub async fn get_auth_status(
+pub async fn get_auth_status(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM profiles")
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let count: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM profiles WHERE game_id = ?")
        .bind(game.as_str())
        .fetch_one(&state.pool)
        .await?;
    Ok(Json(json!({ "has_profile": count > 0 })))
 }
 #[derive(Deserialize)]
 pub struct ResetRequest {
    pub confirm: Option<String>,
 }
 /// POST /auth/reset — wipe all game data and start fresh.
-/// Requires `{"confirm":"reset"}` in the request body as a safeguard against
+/// Deletes every user-data table in dependency order. The schema tables
-/// accidental or unauthenticated calls. Deletes every user-data table in
+/// (migrations) are left intact; calling POST /auth/local afterwards
-/// dependency order; schema (migrations) is preserved.
+/// creates a new profile.
-pub async fn post_auth_reset(
+pub async fn post_auth_reset(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    // Delete in reverse-dependency order to satisfy FK constraints
-    game: GameId,
+    // (SQLite FK enforcement is opt-in, but we follow the order anyway)
-    Json(req): Json<ResetRequest>,
+    let tables = [
-) -> AppResult<Json<Value>> {
+        "player_achievements",
-    if req.confirm.as_deref() != Some("reset") {
+        "notifications",
        return Err(AppError::BadRequest(
            r#"include {"confirm":"reset"} in the request body to confirm data wipe"#.into(),
        ));
    }
    // Multi-game: reset ONLY this game's profile subtree so a FIFA 17 reset never
    // wipes FIFA 23 (and vice versa). Resolve the game's profile + its clubs, then
    // delete their dependent rows in reverse-dependency order.
    let profile_id: Option<String> = sqlx::query_scalar(
        "SELECT id FROM profiles WHERE game_id = ? ORDER BY created_at ASC LIMIT 1",
    )
    .bind(game.as_str())
    .fetch_optional(&state.pool)
    .await?;
    let Some(profile_id) = profile_id else {
        return Ok(Json(json!({
            "reset": true,
            "message": "nothing to reset for this game"
        })));
    };
    let club_ids: Vec<String> = sqlx::query_scalar("SELECT id FROM clubs WHERE profile_id = ?")
        .bind(&profile_id)
        .fetch_all(&state.pool)
        .await?;
    for club_id in &club_ids {
        sqlx::query(
            "DELETE FROM squad_players WHERE squad_id IN (SELECT id FROM squads WHERE club_id = ?)",
        )
        .bind(club_id)
        .execute(&state.pool)
        .await?;
        for table in ["squads", "owned_cards", "packs", "market_history"] {
            sqlx::query(&format!("DELETE FROM {table} WHERE club_id = ?"))
                .bind(club_id)
                .execute(&state.pool)
                .await?;
        }
    }
    // Order matters: `match_completions` carries un-cascaded foreign keys to BOTH
    // `matches` and `profiles`, so it has to go before either of them or the
    // reset fails with a constraint error. Any profile that completed a match
    // through /matches/complete has rows here.
    for table in [
        "match_completions",
        "fut_champs_sessions",
        "sbc_submissions",
        "objective_progress",
        "position_goals",
        "statistics",
        "seasons",
        "season_history",
        "matches",
        "market_listings",
        "squad_players",
        "squads",
        "owned_cards",
        "packs",
        "events",
        "draft_sessions",
-        "daily_checkins",
+        "settings",
-    ] {
+        "clubs",
-        sqlx::query(&format!("DELETE FROM {table} WHERE profile_id = ?"))
+        "profiles",
-            .bind(&profile_id)
+    ];
    for table in &tables {
        sqlx::query(&format!("DELETE FROM {table}"))
            .execute(&state.pool)
            .await?;
    }
-    sqlx::query("DELETE FROM clubs WHERE profile_id = ?")
+    tracing::info!("Full game reset performed");
        .bind(&profile_id)
        .execute(&state.pool)
        .await?;
    sqlx::query("DELETE FROM profiles WHERE id = ?")
        .bind(&profile_id)
        .execute(&state.pool)
        .await?;
    // NOTE (follow-up): settings (global key/value), events (shared content),
    // market_listings (keyed by seller_name, includes the shared NPC market),
    // notifications and player_achievements are not yet game-scoped and are left
    // intact. They need a game/profile key before a per-game reset can cover them.
    tracing::info!(game = %game.as_str(), "Per-game reset performed");
    Ok(Json(json!({
        "reset": true,
-        "message": "All progress for this game has been wiped. Call POST /auth/local to start a new club."
+        "message": "All progress has been wiped. Call POST /auth/local to start a new club."
    })))
 }
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{
    extract::{Path, Query, State},
    Json,
@@ -9,11 +8,11 @@ use serde_json::{json, Value};
 use crate::{
    app::AppState,
    error::{AppError, AppResult},
-    models::card::{OwnedCard, OWNED_CARD_SELECT},
+    models::card::OwnedCard,
    services::{
-        club as club_svc, economy as economy_svc,
+        club as club_svc,
        inventory::{self, OwnedItemQuery, OwnedItemView},
-        profile as profile_svc, training as training_svc,
+        profile as profile_svc,
    },
 };
@@ -67,7 +66,7 @@ pub async fn get_cards(
            let rarity_ok = query
                .rarity
                .as_ref()
-                .map(|r| c.rarity.as_str().eq_ignore_ascii_case(r))
+                .map(|r| format!("{:?}", c.rarity).to_lowercase() == r.to_lowercase())
                .unwrap_or(true);
            let pos_ok = query
                .position
@@ -108,97 +107,50 @@ pub async fn get_cards(
 pub async fn get_collection(
    State(state): State<AppState>,
    game: GameId,
    Query(query): Query<OwnedItemQuery>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
-    let owned = sqlx::query_as::<_, OwnedCard>(&format!("{OWNED_CARD_SELECT} WHERE club_id = ?"))
+    let owned = sqlx::query_as::<_, OwnedCard>(
-        .bind(&club.id)
+        "SELECT id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at, chemistry_style, position_override, training_bonus FROM owned_cards WHERE club_id = ?"
-        .fetch_all(&state.pool)
+    )
-        .await?;
+    .bind(&club.id)
    .fetch_all(&state.pool)
    .await?;
-    // One query for the whole club, not one per item: this projection walks
+    let views: Vec<OwnedItemView> = owned
-    // every owned row, and a per-item lookup here is the N+1 it has suffered
+        .iter()
-    // before.
+        .filter_map(|o| {
-    let training = training_svc::load_for_club(&state.pool, &club.id).await?;
+            state.card_db.get(&o.card_id).map(|def| {
                let effective_overall = def.overall as i64 + o.training_bonus;
                let effective_position = o.position_override.as_deref().unwrap_or(&def.position);
                let body = json!({
                    "owned_card_id": o.id,
                    "is_loan": o.is_loan,
                    "loan_matches_remaining": o.loan_matches_remaining,
                    "acquired_at": o.acquired_at,
                    "chemistry_style": o.chemistry_style,
                    "position_override": o.position_override,
                    "training_bonus": o.training_bonus,
                    "effective_overall": effective_overall,
                    "effective_position": effective_position,
                    "card": def,
                });
                OwnedItemView {
                    owned_card_id: o.id.clone(),
                    base_overall: def.overall,
                    effective_overall,
                    position: effective_position.to_string(),
                    nation: def.nation.clone(),
                    league: def.league.clone(),
                    club: def.club.clone(),
                    body,
                }
            })
        })
        .collect();
    // An owned row whose definition is absent from the loaded content CANNOT be
    // projected (there is nothing to project), but it must never vanish in
    // silence: that silent `filter_map` drop is how a real club once served
    // `total: 0` while 1986 owned rows sat in the DB. So: keep the drop (a
    // missing definition is not a 500), but LOG each one and report the count in
    // the envelope so a caller and an operator both see it.
    let mut unresolved: Vec<&str> = Vec::new();
    let mut views: Vec<OwnedItemView> = Vec::with_capacity(owned.len());
    for o in &owned {
        let Some(def) = state.card_db.get(&o.card_id) else {
            tracing::warn!(
                owned_card_id = %o.id,
                card_id = %o.card_id,
                content_kind = %o.content_kind,
                club_id = %club.id,
                "owned item dropped from /collection: no card definition loaded"
            );
            unresolved.push(o.card_id.as_str());
            continue;
        };
        let effective_overall = def.overall as i64 + o.training_bonus;
        let effective_position = o.position_override.as_deref().unwrap_or(&def.position);
        // Attribute training is per-instance state, so the finished attributes
        // belong in the envelope beside the finished rating. The raw effect goes
        // out too: a caller that needs to show WHICH attribute was trained
        // cannot recover that by differencing against a definition it may not
        // have. At most ONE effect per instance -- FIFA 17 replaces rather than
        // accumulates, so this is an Option, not a list.
        let effect = training.get(&o.id);
        let body = json!({
            "owned_card_id": o.id,
            "content_kind": o.content_kind,
            "quantity": o.quantity,
            "is_loan": o.is_loan,
            "loan_matches_remaining": o.loan_matches_remaining,
            "acquired_at": o.acquired_at,
            "chemistry_style": o.chemistry_style,
            "position_override": o.position_override,
            "training_bonus": o.training_bonus,
            // Core's stored value verbatim: `null` means Core tracks no contract
            // for this instance, which is NOT zero. Substituting a default here
            // would bake one game's pack-fresh number into every game's envelope.
            "contract_matches": o.contract_matches,
            "effective_overall": effective_overall,
            "effective_position": effective_position,
            "effective_attributes": training_svc::effective_attributes_json(def, effect),
            "training": effect,
            "card": def,
        });
        views.push(OwnedItemView {
            owned_card_id: o.id.clone(),
            content_kind: o.content_kind,
            base_overall: def.overall,
            effective_overall,
            position: effective_position.to_string(),
            nation: def.nation.clone(),
            league: def.league.clone(),
            club: def.club.clone(),
            body,
        });
    }
    if !unresolved.is_empty() {
        unresolved.sort_unstable();
        unresolved.dedup();
        tracing::warn!(
            club_id = %club.id,
            owned_rows = owned.len(),
            dropped = owned.len() - views.len(),
            definitions = ?unresolved,
            "/collection dropped owned items with missing definitions"
        );
    }
    let owned_rows = owned.len();
    let unresolved_items = owned_rows - views.len();
    let page = inventory::apply_query(views, &query);
    let returned = page.items.len();
    Ok(Json(json!({
@@ -207,27 +159,22 @@ pub async fn get_collection(
        "returned": returned,
        "offset": page.offset,
        "limit": page.limit,
        // Ownership truth vs. what could be projected. `owned_rows` counts every
        // row Core actually owns for this club; `unresolved_items` counts those
        // dropped for want of a definition. Both zero-cost when nothing is wrong.
        "owned_rows": owned_rows,
        "unresolved_items": unresolved_items,
        "unresolved_definitions": unresolved,
    })))
 }
 /// Quick-sell an owned card for instant coins. The card is removed from the collection.
 pub async fn delete_owned_card(
    State(state): State<AppState>,
    game: GameId,
    Path(owned_card_id): Path<String>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
-    let owned = sqlx::query_as::<_, OwnedCard>(&format!(
+    let owned = sqlx::query_as::<_, OwnedCard>(
-        "{OWNED_CARD_SELECT} WHERE id = ? AND club_id = ?"
+        "SELECT id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at, \
-    ))
+         chemistry_style, position_override, training_bonus \
         FROM owned_cards WHERE id = ? AND club_id = ?",
    )
    .bind(&owned_card_id)
    .bind(&club.id)
    .fetch_optional(&state.pool)
@@ -240,11 +187,12 @@ pub async fn delete_owned_card(
    let coins = quick_sell_coins(card.overall);
-    // Delegate to the economy authority rather than hand-rolling DELETE + add_coins:
+    sqlx::query("DELETE FROM owned_cards WHERE id = ?")
-    // that pair ran on the pool with NO transaction (a failed credit left the card
+        .bind(&owned_card_id)
-    // destroyed for nothing) and it skipped `squad_players`, whose FK onto
+        .execute(&state.pool)
-    // `owned_cards(id)` made quick-selling a squadded card fail with SQLite 787.
+        .await?;
-    economy_svc::sell_item(&state.pool, &club.id, &owned_card_id, coins).await?;
+
    club_svc::add_coins(&state.pool, &club.id, coins).await?;
    Ok(Json(json!({
        "quick_sold": owned_card_id,
@@ -1,8 +1,7 @@
 use crate::extractors::GameId;
 use crate::{
    app::AppState,
-    error::{AppError, AppResult},
+    error::AppResult,
-    models::{card::ActiveSlot, club::Club},
+    models::club::Club,
    services::{
        checkin as checkin_svc, club as club_svc, profile as profile_svc, statistics as stats_svc,
    },
@@ -10,10 +9,9 @@ use crate::{
 use axum::{extract::State, Json};
 use serde::Deserialize;
 use serde_json::{json, Value};
 use std::str::FromStr;
-pub async fn get_club(State(state): State<AppState>, game: GameId) -> AppResult<Json<Club>> {
+pub async fn get_club(State(state): State<AppState>) -> AppResult<Json<Club>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    Ok(Json(club))
 }
@@ -26,10 +24,9 @@ pub struct UpdateClubRequest {
 pub async fn put_club(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<UpdateClubRequest>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let updated = club_svc::update_club(
        &state.pool,
@@ -41,11 +38,8 @@ pub async fn put_club(
    Ok(Json(json!({ "club": updated })))
 }
-pub async fn get_checkin_status(
+pub async fn get_checkin_status(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let status = checkin_svc::get_status(&state.pool, &profile.id).await?;
    Ok(Json(json!({
        "available": status.available,
@@ -56,8 +50,8 @@ pub async fn get_checkin_status(
    })))
 }
-pub async fn post_checkin(State(state): State<AppState>, game: GameId) -> AppResult<Json<Value>> {
+pub async fn post_checkin(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let r = checkin_svc::claim(&state.pool, &profile.id, &club.id).await?;
    Ok(Json(json!({
@@ -68,8 +62,8 @@ pub async fn post_checkin(State(state): State<AppState>, game: GameId) -> AppRes
    })))
 }
-pub async fn get_milestones(State(state): State<AppState>, game: GameId) -> AppResult<Json<Value>> {
+pub async fn get_milestones(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let stats = stats_svc::get_or_create(&state.pool, &profile.id).await?;
@@ -125,101 +119,3 @@ pub async fn get_milestones(State(state): State<AppState>, game: GameId) -> AppR
        "club_level": club.level,
    })))
 }
 /// The owned card assigned as the active squad's manager, or `null`. Generic:
 /// Core returns the ownership-backed assignment; the FIFA 17 adapter shapes the
 /// manager wire item from it (itemType/contract/chemistry are adapter concerns).
 pub async fn get_squad_manager(
    State(state): State<AppState>,
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let manager = club_svc::get_squad_manager(&state.pool, &club.id).await?;
    Ok(Json(json!({ "manager": manager })))
 }
 #[derive(Deserialize)]
 pub struct SetManagerRequest {
    /// The owned card to assign as manager, or `null`/absent to clear it.
    pub owned_card_id: Option<String>,
 }
 /// Assign (or, with a null/absent `owned_card_id`, clear) the active squad's
 /// manager. Fail-closed: the card must be owned by this club and the club must
 /// have a squad. Returns the resulting assignment.
 pub async fn put_squad_manager(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<SetManagerRequest>,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    match req.owned_card_id {
        Some(owned_card_id) => {
            club_svc::set_squad_manager(&state.pool, &club.id, &owned_card_id).await?
        }
        None => club_svc::clear_squad_manager(&state.pool, &club.id).await?,
    }
    let manager = club_svc::get_squad_manager(&state.pool, &club.id).await?;
    Ok(Json(json!({ "manager": manager })))
 }
 /// Every active club-item designation, slot-keyed and EXPLICIT: all five slots
 /// are always present, an empty slot being `null`. A caller therefore never has
 /// to guess whether a missing key means "no item" or "unsupported slot".
 fn active_items_body(items: &club_svc::ActiveClubItems) -> AppResult<Value> {
    let mut body = serde_json::Map::new();
    for slot in ActiveSlot::ALL {
        body.insert(
            slot.as_str().to_string(),
            serde_json::to_value(items.get(slot))?,
        );
    }
    Ok(Value::Object(body))
 }
 /// Return the club's ownership-backed active item designations.
 pub async fn get_active_items(
    State(state): State<AppState>,
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let items = club_svc::get_active_club_items(&state.pool, &club.id).await?;
    Ok(Json(json!({ "active_items": active_items_body(&items)? })))
 }
 #[derive(Deserialize)]
 pub struct SetActiveItemRequest {
    /// Which club role to write: home_kit | away_kit | badge | ball | stadium.
    ///
    /// Taken as a string and parsed here so an unknown slot comes back as this
    /// crate's `400 {"error": …}` envelope, like every other bad request, rather
    /// than axum's plain-text deserialization rejection.
    pub slot: String,
    /// The owned instance to designate, or `null`/absent to clear the slot.
    #[serde(default)]
    pub owned_card_id: Option<String>,
 }
 /// Write ONE active club-item designation. Core enforces ownership and that the
 /// slot admits the item's `content_kind`; game adapters own their own mapping
 /// from a wire item onto that generic kind.
 pub async fn put_active_item(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<SetActiveItemRequest>,
 ) -> AppResult<Json<Value>> {
    let slot = ActiveSlot::from_str(&req.slot).map_err(AppError::BadRequest)?;
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    match req.owned_card_id {
        Some(owned_card_id) => {
            club_svc::set_active_club_item(&state.pool, &club.id, slot, &owned_card_id).await?
        }
        None => club_svc::clear_active_club_item(&state.pool, &club.id, slot).await?,
    }
    let items = club_svc::get_active_club_items(&state.pool, &club.id).await?;
    Ok(Json(json!({ "active_items": active_items_body(&items)? })))
 }
@@ -1,82 +0,0 @@
 //! `POST /consumables/apply` — the HTTP boundary for Core's atomic
 //! apply-one-consumable transaction.
 //!
 //! Game-neutral like the rest of Core's surface: the caller names an owned source
 //! instance, an owned target and a described [`InstanceEffect`]; Core resolves the
 //! game-scoped active profile and its club from the `X-OpenFUT-Game` header, so no
 //! caller can reach across clubs. Everything after that is one durable SQLite
 //! transaction in [`consume::consume_item`], guarded by
 //! `UNIQUE(profile_id, action_identity)`.
 //!
 //! The effect vocabulary is closed and validated by Core — see
 //! [`crate::services::instance_effect`] for why the host describes an effect
 //! instead of supplying one.
 use axum::{extract::State, Json};
 use serde::Deserialize;
 use crate::{
    app::AppState,
    error::AppResult,
    extractors::GameId,
    models::card::ContentKind,
    services::{
        club as club_svc,
        consume::{self, ConsumeOutcome, ConsumeRequest, ConsumeTarget, SourceConsumption},
        instance_effect::InstanceEffect,
        profile as profile_svc,
    },
 };
 #[derive(Deserialize)]
 pub struct ApplyConsumableRequest {
    /// Opaque, stable per-application token. Core never parses it; it only
    /// enforces uniqueness, so a retried HTTP request replays instead of
    /// applying twice.
    pub action_identity: String,
    pub source_owned_card_id: String,
    pub target_owned_card_id: String,
    /// The kind the target MUST be. The caller states it because only the caller
    /// knows which family its consumable belongs to; a mismatch is refused rather
    /// than applied to whatever happens to be there.
    pub target_kind: ContentKind,
    pub effect: InstanceEffect,
 }
 /// `POST /consumables/apply` — atomic validate + apply + consume-once.
 ///
 /// `applied: false` in the response means the `action_identity` was already
 /// recorded: nothing was mutated and the recorded outcome is echoed.
 pub async fn post_apply_consumable(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<ApplyConsumableRequest>,
 ) -> AppResult<Json<ConsumeOutcome>> {
    // Both ids are needed: the profile scopes the replay guard, the club scopes
    // ownership. Same resolution pair as `cards::get_collection`.
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let outcome = consume::consume_item(
        &state.pool,
        &profile.id,
        &club.id,
        &ConsumeRequest {
            action_identity: &req.action_identity,
            source_owned_card_id: &req.source_owned_card_id,
            // A consumable is the only thing that can be applied, and it is spent
            // whole: FIFA-style stacking is the adapter's projection, not an
            // ownership model Core has for these instances.
            expected_source_kind: ContentKind::Consumable,
            consumption: SourceConsumption::DestroyInstance,
            target: ConsumeTarget::OwnedCard {
                owned_card_id: &req.target_owned_card_id,
                expected_kind: req.target_kind,
            },
        },
        &req.effect,
    )
    .await?;
    Ok(Json(outcome))
 }
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{extract::State, Json};
 use rand::{Rng, SeedableRng};
 use serde_json::{json, Value};
@@ -10,8 +9,8 @@ use crate::{
    services::{club as club_svc, profile as profile_svc, season as season_svc},
 };
-pub async fn get_division(State(state): State<AppState>, game: GameId) -> AppResult<Json<Value>> {
+pub async fn get_division(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let _club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let season = season_svc::get_or_create(&state.pool, &profile.id).await?;
@@ -37,20 +36,14 @@ pub async fn get_division(State(state): State<AppState>, game: GameId) -> AppRes
    })))
 }
-pub async fn get_division_history(
+pub async fn get_division_history(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let history = season_svc::get_history(&state.pool, &profile.id).await?;
    Ok(Json(json!({ "history": history, "total": history.len() })))
 }
-pub async fn get_division_leaderboard(
+pub async fn get_division_leaderboard(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let season = season_svc::get_or_create(&state.pool, &profile.id).await?;
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{
    extract::{Path, Query, State},
    Json,
@@ -40,10 +39,9 @@ pub async fn get_draft_squad(
 /// until all 11 slots are filled.
 pub async fn post_draft_start(
    State(state): State<AppState>,
    game: GameId,
    Query(query): Query<DraftQuery>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let difficulty = query.difficulty.as_deref().unwrap_or("professional");
    let session =
        draft_svc::start_draft(&state.pool, &state.card_db, &profile.id, difficulty).await?;
@@ -53,10 +51,9 @@ pub async fn post_draft_start(
 /// Get the current state of a draft session.
 pub async fn get_draft_session(
    State(state): State<AppState>,
    game: GameId,
    Path(session_id): Path<String>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let session =
        draft_svc::get_draft(&state.pool, &state.card_db, &profile.id, &session_id).await?;
    Ok(Json(session))
@@ -74,11 +71,10 @@ pub struct PickRequest {
 /// and rewards (coins + optional pack) are granted automatically.
 pub async fn post_draft_pick(
    State(state): State<AppState>,
    game: GameId,
    Path(session_id): Path<String>,
    Json(req): Json<PickRequest>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let session = draft_svc::pick_card(
        &state.pool,
@@ -95,10 +91,9 @@ pub async fn post_draft_pick(
 /// Abandon an active draft session. No rewards are granted.
 pub async fn post_draft_abandon(
    State(state): State<AppState>,
    game: GameId,
    Path(session_id): Path<String>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let result = draft_svc::abandon_draft(&state.pool, &profile.id, &session_id).await?;
    Ok(Json(result))
 }
@@ -1,220 +0,0 @@
 //! Generic economy HTTP boundary.
 //!
 //! Exposes [`crate::services::economy`] over the same game-scoped active-profile
 //! resolution every other Core route uses ([`GameId`] header → active profile →
 //! club). The caller (a game host) never supplies a club id; Core maps the game
 //! to its authoritative club, so there is no cross-club economy access. Every
 //! op is a single durable SQLite transaction in the service layer.
 //!
 //! This surface is deliberately game-neutral: no currency names, pack ids, or
 //! wire semantics — those live in the game host/adapter.
 use axum::{extract::State, Json};
 use serde::{Deserialize, Serialize};
 use crate::{
    app::AppState,
    error::AppResult,
    extractors::GameId,
    services::{club as club_svc, economy, economy::GrantedItem, profile as profile_svc},
 };
 /// Resolve the game-scoped active profile's club id.
 async fn resolve_club(state: &AppState, game: &GameId) -> AppResult<String> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    Ok(club.id)
 }
 #[derive(Serialize)]
 pub struct BalanceResponse {
    pub balance: i64,
 }
 /// `GET /economy/balance` — the club's currency balance.
 pub async fn get_balance(
    State(state): State<AppState>,
    game: GameId,
 ) -> AppResult<Json<BalanceResponse>> {
    let club = resolve_club(&state, &game).await?;
    let balance = economy::balance(&state.pool, &club).await?;
    Ok(Json(BalanceResponse { balance }))
 }
 /// `GET /economy/entitlements` — the club's unconsumed entitlements.
 pub async fn get_entitlements(
    State(state): State<AppState>,
    game: GameId,
 ) -> AppResult<Json<Vec<economy::Entitlement>>> {
    let club = resolve_club(&state, &game).await?;
    Ok(Json(
        economy::list_unopened_entitlements(&state.pool, &club).await?,
    ))
 }
 #[derive(Deserialize)]
 pub struct PurchaseEntitlementRequest {
    pub cost: i64,
    pub definition_id: String,
 }
 /// `POST /economy/purchase-entitlement` — atomic debit + grant.
 pub async fn post_purchase_entitlement(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<PurchaseEntitlementRequest>,
 ) -> AppResult<Json<economy::PurchaseReceipt>> {
    let club = resolve_club(&state, &game).await?;
    Ok(Json(
        economy::purchase_entitlement(&state.pool, &club, req.cost, &req.definition_id).await?,
    ))
 }
 #[derive(Deserialize)]
 pub struct RedeemEntitlementRequest {
    pub entitlement_id: String,
    pub items: Vec<GrantedItem>,
 }
 #[derive(Serialize)]
 pub struct RedeemEntitlementResponse {
    pub definition_id: String,
 }
 /// `POST /economy/redeem-entitlement` — atomic consume-once + add items.
 pub async fn post_redeem_entitlement(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<RedeemEntitlementRequest>,
 ) -> AppResult<Json<RedeemEntitlementResponse>> {
    let club = resolve_club(&state, &game).await?;
    let definition_id =
        economy::redeem_entitlement(&state.pool, &club, &req.entitlement_id, &req.items).await?;
    Ok(Json(RedeemEntitlementResponse { definition_id }))
 }
 #[derive(Deserialize)]
 pub struct SellItemRequest {
    pub item_id: String,
    pub price: i64,
 }
 /// `POST /economy/sell-item` — atomic remove + credit.
 pub async fn post_sell_item(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<SellItemRequest>,
 ) -> AppResult<Json<BalanceResponse>> {
    let club = resolve_club(&state, &game).await?;
    let balance = economy::sell_item(&state.pool, &club, &req.item_id, req.price).await?;
    Ok(Json(BalanceResponse { balance }))
 }
 #[derive(Deserialize)]
 pub struct GrantRewardRequest {
    pub amount: i64,
 }
 /// `POST /economy/grant-reward` — atomic credit.
 pub async fn post_grant_reward(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<GrantRewardRequest>,
 ) -> AppResult<Json<BalanceResponse>> {
    let club = resolve_club(&state, &game).await?;
    let balance = economy::grant_reward(&state.pool, &club, req.amount).await?;
    Ok(Json(BalanceResponse { balance }))
 }
 #[derive(Deserialize)]
 pub struct PurchaseItemRequest {
    pub cost: i64,
    pub item_id: String,
    pub card_id: String,
 }
 /// `POST /economy/purchase-item` — atomic debit + mint item.
 pub async fn post_purchase_item(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<PurchaseItemRequest>,
 ) -> AppResult<Json<BalanceResponse>> {
    let club = resolve_club(&state, &game).await?;
    let balance =
        economy::purchase_item(&state.pool, &club, req.cost, &req.item_id, &req.card_id).await?;
    Ok(Json(BalanceResponse { balance }))
 }
 #[derive(Deserialize)]
 pub struct PurchaseItemsRequest {
    pub cost: i64,
    pub items: Vec<GrantedItem>,
 }
 /// `POST /economy/purchase-items` — atomic debit + mint several items.
 pub async fn post_purchase_items(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<PurchaseItemsRequest>,
 ) -> AppResult<Json<BalanceResponse>> {
    let club = resolve_club(&state, &game).await?;
    let balance = economy::purchase_items(&state.pool, &club, req.cost, &req.items).await?;
    Ok(Json(BalanceResponse { balance }))
 }
 /// `POST /economy/settle-sale` request.
 ///
 /// This is the ONE economy route that names clubs explicitly, and it has to: a
 /// market sale has two sides, and the module's active-profile resolution can only
 /// ever describe one. Both are optional and default to the game-scoped active
 /// club, so the single-player case stays as terse as every other route:
 ///
 ///   * `seller_club_id` omitted -> the active club is the seller (it listed the
 ///     item), which is the production shape.
 ///   * `buyer_club_id` omitted -> the counterparty is OUTSIDE the modelled
 ///     economy: no balance is debited and the item leaves the inventory. It does
 ///     NOT silently fall back to the active club, because that would settle a sale
 ///     between a club and itself.
 #[derive(Deserialize)]
 pub struct SettleSaleRequest {
    /// The authoritative owned-item instance changing hands.
    pub item_id: String,
    /// What the buyer pays. The fee is withheld from this, never added to it.
    pub gross: i64,
    /// Withheld from the seller and destroyed. The RATE is a per-game policy the
    /// caller owns; Core only checks `0 <= fee <= gross`.
    pub fee: i64,
    #[serde(default)]
    pub seller_club_id: Option<String>,
    #[serde(default)]
    pub buyer_club_id: Option<String>,
 }
 /// `POST /economy/settle-sale` — atomically debit the buyer, transfer the existing
 /// item, credit the seller net of the fee, and destroy the fee.
 pub async fn post_settle_sale(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<SettleSaleRequest>,
 ) -> AppResult<Json<economy::SaleReceipt>> {
    let seller = match req.seller_club_id {
        Some(id) => id,
        None => resolve_club(&state, &game).await?,
    };
    let buyer = match req.buyer_club_id.as_deref() {
        Some(id) => economy::SaleBuyer::Club(id),
        None => economy::SaleBuyer::Outside,
    };
    let receipt = economy::settle_sale(
        &state.pool,
        &req.item_id,
        &seller,
        buyer,
        economy::SaleTerms {
            gross: req.gross,
            fee: req.fee,
        },
    )
    .await?;
    Ok(Json(receipt))
 }
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{
    extract::{Path, State},
    Json,
@@ -15,8 +14,8 @@ use crate::{
 };
 /// GET /fut-champs — current active session, or null if none.
-pub async fn get_fut_champs(State(state): State<AppState>, game: GameId) -> AppResult<Json<Value>> {
+pub async fn get_fut_champs(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let session = champs_svc::get_active_session(&state.pool, &profile.id).await?;
    Ok(Json(json!({
@@ -26,11 +25,8 @@ pub async fn get_fut_champs(State(state): State<AppState>, game: GameId) -> AppR
 }
 /// POST /fut-champs/start — open a new FUT Champions week.
-pub async fn post_start_fut_champs(
+pub async fn post_start_fut_champs(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let session = champs_svc::start_session(&state.pool, &profile.id).await?;
    Ok(Json(json!({
@@ -48,11 +44,10 @@ pub struct ChampsMatchRequest {
 /// POST /fut-champs/:session_id/result — record a match in this session.
 pub async fn post_champs_result(
    State(state): State<AppState>,
    game: GameId,
    Path(session_id): Path<String>,
    Json(req): Json<ChampsMatchRequest>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let session = champs_svc::record_match(
        &state.pool,
@@ -82,10 +77,9 @@ pub async fn post_champs_result(
 /// POST /fut-champs/:session_id/claim — claim end-of-week rewards.
 pub async fn post_claim_champs_rewards(
    State(state): State<AppState>,
    game: GameId,
    Path(session_id): Path<String>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let result = champs_svc::claim_rewards(
@@ -101,11 +95,8 @@ pub async fn post_claim_champs_rewards(
 }
 /// GET /fut-champs/history — past sessions, newest first.
-pub async fn get_champs_history(
+pub async fn get_champs_history(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let history = champs_svc::get_history(&state.pool, &profile.id).await?;
    Ok(Json(json!({
@@ -115,11 +106,8 @@ pub async fn get_champs_history(
 }
 /// POST /rivals/claim-weekly — claim weekly Division Rivals reward.
-pub async fn post_claim_rivals_reward(
+pub async fn post_claim_rivals_reward(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    // Ensure a season row exists
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{
    extract::{Path, Query, State},
    Json,
@@ -13,11 +12,8 @@ use crate::{
    services::{club as club_svc, market as market_svc, profile as profile_svc},
 };
-pub async fn get_trade_history(
+pub async fn get_trade_history(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let trades = market_svc::get_trade_history(&state.pool, &club.id).await?;
    Ok(Json(json!({ "trades": trades, "total": trades.len() })))
@@ -55,10 +51,9 @@ pub async fn get_market(
 pub async fn post_market_buy(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<BuyListingRequest>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let card = market_svc::buy_listing(&state.pool, &state.card_db, &club.id, &req).await?;
@@ -69,10 +64,9 @@ pub async fn post_market_buy(
 pub async fn post_market_sell(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<SellCardRequest>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let new_balance = market_svc::sell_card(&state.pool, &state.card_db, &club.id, &req).await?;
@@ -88,11 +82,8 @@ pub async fn post_market_refresh(State(state): State<AppState>) -> AppResult<Jso
 }
 /// Return all active market listings posted by the current player's club.
-pub async fn get_my_listings(
+pub async fn get_my_listings(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let listings =
        market_svc::get_listings_by_seller(&state.pool, &state.card_db, &club.id).await?;
@@ -104,10 +95,9 @@ pub async fn get_my_listings(
 /// Cancel a player-posted listing and return the card to the collection.
 pub async fn delete_market_listing(
    State(state): State<AppState>,
    game: GameId,
    Path(listing_id): Path<String>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    market_svc::cancel_listing(&state.pool, &club.id, &listing_id).await?;
    Ok(Json(json!({ "cancelled": listing_id })))
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{
    extract::{Query, State},
    Json,
@@ -8,9 +7,9 @@ use serde_json::{json, Value};
 use crate::{
    app::AppState,
-    error::{AppError, AppResult},
+    error::AppResult,
-    models::match_result::{CompleteMatchRequest, Match, MatchCompletionResult},
+    models::match_result::{Match, MatchRewardResult, SubmitMatchRequest},
-    services::{club as club_svc, match_service, notification, profile as profile_svc},
+    services::{club as club_svc, match_service, profile as profile_svc},
 };
 #[derive(Deserialize)]
@@ -21,10 +20,9 @@ pub struct MatchHistoryQuery {
 pub async fn get_matches(
    State(state): State<AppState>,
    game: GameId,
    Query(query): Query<MatchHistoryQuery>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let limit = query.limit.unwrap_or(20).clamp(1, 100);
    let matches = if let Some(mode) = &query.mode {
@@ -63,43 +61,14 @@ pub async fn get_opponent(
    Ok(Json(opponent))
 }
-/// `POST /matches/result` — REMOVED as an economy path, and deliberately kept as
+pub async fn post_match_result(
 /// an explicit rejection rather than a 404.
 ///
 /// It used to grant coins, XP, level-ups, statistics, objectives, loan expiry,
 /// season progression and achievements across a dozen separate writes with NO
 /// transaction and NO idempotency key, which made it a second economy authority
 /// that could re-credit the same match on every call and could half-apply on any
 /// mid-way failure. Exactly-once needs a caller-supplied match identity, which
 /// this request shape does not carry and cannot derive (a body fingerprint would
 /// collapse two legitimate matches with the same scoreline into one).
 ///
 /// Callers submit to `/matches/complete` with a `match_identity`; the loan and
 /// season behaviour this route used to trigger is available there via
 /// `expire_loans` / `advance_season`.
 pub async fn post_match_result() -> AppResult<Json<Value>> {
    Err(AppError::BadRequest(
        "POST /matches/result is no longer an economy path: it had no transaction \
         and no idempotency key. Submit to POST /matches/complete with a \
         match_identity (and expire_loans / advance_season if you need Core's loan \
         and season progression)."
            .into(),
    ))
 }
 /// `POST /matches/complete` — the authoritative, atomic, exactly-once match
 /// economy entry point (the game host routes a finished match here). Idempotent
 /// on `(profile, match_identity)`: a replay returns the persisted canonical
 /// result with `applied = false` and grants nothing twice.
 pub async fn post_match_complete(
    State(state): State<AppState>,
-    game: GameId,
+    Json(req): Json<SubmitMatchRequest>,
-    Json(req): Json<CompleteMatchRequest>,
+) -> AppResult<Json<MatchRewardResult>> {
-) -> AppResult<Json<MatchCompletionResult>> {
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
-    let result = match_service::complete_match(
+    let result = match_service::process_match(
        &state.pool,
        &profile.id,
        &club.id,
@@ -109,79 +78,5 @@ pub async fn post_match_complete(
    )
    .await?;
    // Player-visible notifications are non-durable side effects, so they are
    // emitted AFTER the economy transaction commits, never inside it — a failed
    // notification must not roll back a completed match. Gated on `applied`, so
    // an idempotent replay does not re-notify (the pooled path this replaced had
    // no such guard). Achievement notifications are written in-transaction by
    // `check_and_unlock_tx` and are deliberately not repeated here.
    if result.applied {
        emit_match_notifications(&state, &result).await;
    }
    Ok(Json(result))
 }
 async fn emit_match_notifications(state: &AppState, result: &MatchCompletionResult) {
    for ev in &result.level_ups {
        let body = match &ev.pack_granted {
            Some(pack) => format!(
                "You reached level {}! Reward: {} coins + {pack}.",
                ev.new_level, ev.coins_granted
            ),
            None => format!(
                "You reached level {}! Reward: {} coins.",
                ev.new_level, ev.coins_granted
            ),
        };
        let _ = notification::create(
            &state.pool,
            "level_up",
            &format!("Level {}!", ev.new_level),
            &body,
        )
        .await;
    }
    for obj_id in &result.objectives_updated {
        let display_name = state
            .obj_defs
            .iter()
            .find(|d| &d.id == obj_id)
            .map(|d| d.title.as_str())
            .unwrap_or(obj_id.as_str());
        let body = format!("\"{display_name}\" is now complete. Claim your reward in Objectives.");
        let _ = notification::create(
            &state.pool,
            "objective_complete",
            "Objective complete!",
            &body,
        )
        .await;
    }
    for owned_id in &result.expired_loans {
        let body =
            format!("Loan card (id: {owned_id}) has expired and been removed from your club.");
        let _ = notification::create(&state.pool, "loan_expired", "Loan card expired", &body).await;
    }
    if let Some(se) = &result.season_end {
        use crate::models::season::SeasonResult;
        let direction = match se.result {
            SeasonResult::Promoted => "Promoted",
            SeasonResult::Relegated => "Relegated",
            SeasonResult::Maintained => "Maintained",
        };
        let body = format!(
            "{direction} — now in Division {}. Rewards: {} coins{}.",
            se.new_division,
            se.coins_awarded,
            se.pack_awarded
                .as_deref()
                .map(|p| format!(" + {p}"))
                .unwrap_or_default()
        );
        let _ = notification::create(&state.pool, "season_end", "Season complete!", &body).await;
    }
 }
@@ -2,10 +2,8 @@ pub mod achievements;
 pub mod auth;
 pub mod cards;
 pub mod club;
 pub mod consumables;
 pub mod division;
 pub mod draft;
 pub mod economy;
 pub mod events;
 pub mod fut_champs;
 pub mod health;
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{
    extract::{Path, State},
    Json,
@@ -19,11 +18,8 @@ use crate::{
 /// notifications (unclaimed objectives, expiring loans, season ending soon).
 /// Persistent notifications carry an `id` and `is_read` flag; dynamic ones
 /// have `id: null` and are always considered unread.
-pub async fn get_notifications(
+pub async fn get_notifications(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    // ── Persistent notifications ─────────────────────────────────────────────
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{
    extract::{Path, State},
    Json,
@@ -12,8 +11,8 @@ use crate::{
    services::{club as club_svc, objective as obj_svc, profile as profile_svc},
 };
-pub async fn get_objectives(State(state): State<AppState>, game: GameId) -> AppResult<Json<Value>> {
+pub async fn get_objectives(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let objectives =
        obj_svc::get_objectives_with_progress(&state.pool, &profile.id, &state.obj_defs).await?;
    Ok(Json(json!({ "objectives": objectives })))
@@ -21,10 +20,9 @@ pub async fn get_objectives(State(state): State<AppState>, game: GameId) -> AppR
 pub async fn get_objective(
    State(state): State<AppState>,
    game: GameId,
    Path(objective_id): Path<String>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let all =
        obj_svc::get_objectives_with_progress(&state.pool, &profile.id, &state.obj_defs).await?;
    let obj = all
@@ -36,10 +34,9 @@ pub async fn get_objective(
 pub async fn post_claim_objective_by_id(
    State(state): State<AppState>,
    game: GameId,
    Path(objective_id): Path<String>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let reward = obj_svc::claim_objective(
        &state.pool,
@@ -59,10 +56,9 @@ pub struct ClaimRequest {
 pub async fn post_claim_objective(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<ClaimRequest>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let reward = obj_svc::claim_objective(
        &state.pool,
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{
    extract::{Path, State},
    Json,
@@ -20,10 +19,9 @@ pub struct BuyPackRequest {
 pub async fn post_buy_pack(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<BuyPackRequest>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let pack = pack_svc::buy_pack(
        &state.pool,
@@ -56,8 +54,8 @@ pub async fn get_pack_store(State(state): State<AppState>) -> AppResult<Json<Val
    Ok(Json(json!({ "packs": store })))
 }
-pub async fn get_packs(State(state): State<AppState>, game: GameId) -> AppResult<Json<Value>> {
+pub async fn get_packs(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let packs = pack_svc::get_unopened_packs(&state.pool, &club.id).await?;
@@ -79,11 +77,8 @@ pub async fn get_packs(State(state): State<AppState>, game: GameId) -> AppResult
 }
 /// Return recently opened packs with the card IDs they contained.
-pub async fn get_pack_history(
+pub async fn get_pack_history(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    State(state): State<AppState>,
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    game: GameId,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let opened = sqlx::query_as::<_, crate::models::pack::Pack>(
@@ -127,10 +122,9 @@ pub async fn get_pack_history(
 pub async fn post_open_pack(
    State(state): State<AppState>,
    game: GameId,
    Path(pack_id): Path<String>,
 ) -> AppResult<Json<PackOpenResult>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let result = pack_svc::open_pack(
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use crate::{
    app::AppState,
    error::AppResult,
@@ -8,8 +7,8 @@ use crate::{
 use axum::{extract::State, Json};
 use serde_json::{json, Value};
-pub async fn get_profile(State(state): State<AppState>, game: GameId) -> AppResult<Json<Value>> {
+pub async fn get_profile(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let computed_level = level_for_xp(profile.xp);
    let next_level = computed_level + 1;
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{
    extract::{Path, State},
    Json,
@@ -8,7 +7,7 @@ use serde_json::{json, Value};
 use crate::{
    app::AppState,
    error::{AppError, AppResult},
-    models::sbc::{SaveSbcSquadRequest, SbcResult, SubmitSbcRequest},
+    models::sbc::{SbcResult, SubmitSbcRequest},
    services::{club as club_svc, profile as profile_svc, sbc as sbc_svc},
 };
@@ -28,70 +27,33 @@ pub async fn get_sbc(
    Ok(Json(json!({ "sbc": sbc })))
 }
 pub async fn get_sbc_status(State(state): State<AppState>, game: GameId) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let completions = sbc_svc::completion_counts(&state.pool, &profile.id).await?;
    Ok(Json(json!({ "completions": completions })))
 }
 pub async fn get_sbc_squad(
    State(state): State<AppState>,
    game: GameId,
    Path(sbc_id): Path<String>,
 ) -> AppResult<Json<Value>> {
    if !state
        .sbc_defs
        .iter()
        .any(|definition| definition.id == sbc_id)
    {
        return Err(AppError::NotFound(format!("SBC '{sbc_id}' not found")));
    }
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let squad = sbc_svc::load_sbc_squad(&state.pool, &profile.id, &sbc_id).await?;
    Ok(Json(json!({ "squad": squad })))
 }
 pub async fn put_sbc_squad(
    State(state): State<AppState>,
    game: GameId,
    Path(sbc_id): Path<String>,
    Json(req): Json<SaveSbcSquadRequest>,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let squad = sbc_svc::save_sbc_squad(
        &state.pool,
        &state.sbc_defs,
        &profile.id,
        &club.id,
        &sbc_id,
        &req.owned_card_ids,
    )
    .await?;
    Ok(Json(json!({ "squad": squad })))
 }
 pub async fn post_sbc_submit(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<SubmitSbcRequest>,
 ) -> AppResult<Json<SbcResult>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let result = sbc_svc::submit_sbc(
        &state.pool,
-        sbc_svc::SbcSubmissionContext {
+        &state.card_db,
-            card_db: &state.card_db,
+        &state.sbc_defs,
-            sbc_defs: &state.sbc_defs,
+        &state.obj_defs,
-            objective_defs: &state.obj_defs,
+        &profile.id,
-            achievement_defs: &state.achievement_defs,
+        &club.id,
            profile_id: &profile.id,
            club_id: &club.id,
        },
        &req,
    )
    .await?;
    if result.passed {
        let _ = crate::services::achievement::check_and_unlock(
            &state.pool,
            &state.achievement_defs,
            &profile.id,
            &club.id,
        )
        .await;
    }
    Ok(Json(result))
 }
@@ -1,25 +1,18 @@
 use crate::extractors::GameId;
 use axum::{
-    extract::{Path, Query, State},
+    extract::{Path, State},
    Json,
 };
 use serde::Deserialize;
 use serde_json::{json, Value};
 use crate::{
    app::AppState,
-    error::{AppError, AppResult},
+    error::AppResult,
-    models::game_ext::OpaqueExtensionWrite,
+    models::squad::SaveSquadRequest,
-    models::squad::{SaveSquadRequest, SlotAssignment, SquadReplacement},
+    services::{club as club_svc, profile as profile_svc, squad as squad_svc},
    services::{
        club as club_svc, profile as profile_svc, squad as squad_svc,
        squad::SquadExtState,
        squad_rules::{ClientReportedEvaluation, DefaultSquadRules},
    },
 };
-pub async fn get_squad(State(state): State<AppState>, game: GameId) -> AppResult<Json<Value>> {
+pub async fn get_squad(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let (squad, players) = squad_svc::get_squad(&state.pool, &club.id).await?;
@@ -28,8 +21,8 @@ pub async fn get_squad(State(state): State<AppState>, game: GameId) -> AppResult
    Ok(Json(squad_response(&squad, &players, chemistry)))
 }
-pub async fn get_squads(State(state): State<AppState>, game: GameId) -> AppResult<Json<Value>> {
+pub async fn get_squads(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let squads = squad_svc::list_squads(&state.pool, &club.id).await?;
    Ok(Json(json!({ "squads": squads })))
@@ -37,10 +30,9 @@ pub async fn get_squads(State(state): State<AppState>, game: GameId) -> AppResul
 pub async fn get_squad_by_id(
    State(state): State<AppState>,
    game: GameId,
    Path(squad_id): Path<String>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let (squad, players) = squad_svc::get_squad_by_id(&state.pool, &club.id, &squad_id).await?;
@@ -51,14 +43,13 @@ pub async fn get_squad_by_id(
 pub async fn post_squad(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<SaveSquadRequest>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    if !req.players.is_empty() {
-        squad_svc::validate_formation(&state.pool, &state.card_db, &club.id, &req.players).await?;
+        squad_svc::validate_formation(&state.pool, &state.card_db, &req.players).await?;
    }
    let squad = squad_svc::save_squad(&state.pool, &state.card_db, &club.id, &req).await?;
@@ -67,10 +58,9 @@ pub async fn post_squad(
 pub async fn delete_squad(
    State(state): State<AppState>,
    game: GameId,
    Path(squad_id): Path<String>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    squad_svc::delete_squad(&state.pool, &club.id, &squad_id).await?;
    Ok(Json(json!({ "deleted": squad_id })))
@@ -104,134 +94,3 @@ fn squad_response(
        "chemistry": chemistry,
    })
 }
 // ─────────── Game-extension-aware squad transport (host composition) ─────────
 //
 // These two routes expose the already-existing extension services
 // (`read_squad_with_ext` / `replace_squad_with_extension`) over HTTP so a game
 // host can read/write the canonical squad AND its opaque game extension in one
 // Core round-trip. They add no domain logic — Core still owns validation,
 // ownership, the atomic transaction, the server fingerprint, and staleness; it
 // never interprets the extension payload.
 #[derive(Deserialize)]
 pub struct ExtQuery {
    /// Opaque adapter namespace, e.g. `"fifa17.squad"`.
    pub namespace: String,
 }
 /// `GET /squad/ext?namespace=…` — the active squad, its players, and its opaque
 /// extension with an explicit Fresh/Stale/Missing verdict. Never projects a
 /// stale blob; the caller decides policy.
 pub async fn get_squad_ext(
    State(state): State<AppState>,
    game: GameId,
    Query(q): Query<ExtQuery>,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let (squad, players, state_ext) =
        squad_svc::read_squad_with_ext(&state.pool, game.as_str(), &club.id, &q.namespace).await?;
    let extension = match state_ext {
        SquadExtState::Fresh(row) => json!({
            "state": "fresh",
            "schema_version": row.schema_version,
            "payload": row.payload,
            "stored_fingerprint": row.canonical_fingerprint,
        }),
        SquadExtState::Stale {
            stored,
            current_fingerprint,
        } => json!({
            "state": "stale",
            "schema_version": stored.schema_version,
            "payload": stored.payload,
            "stored_fingerprint": stored.canonical_fingerprint,
            "current_fingerprint": current_fingerprint,
        }),
        SquadExtState::Missing => json!({ "state": "missing" }),
    };
    Ok(Json(json!({
        "squad": squad,
        "players": players,
        "extension": extension,
    })))
 }
 #[derive(Deserialize)]
 pub struct SlotReq {
    pub owned_card_id: String,
    pub slot: i64,
    #[serde(default)]
    pub is_captain: bool,
    #[serde(default)]
    pub is_on_bench: bool,
 }
 #[derive(Deserialize)]
 pub struct ReplaceReq {
    #[serde(default)]
    pub name: Option<String>,
    #[serde(default)]
    pub formation: Option<String>,
    pub slots: Vec<SlotReq>,
    #[serde(default)]
    pub client_reported: ClientReportedEvaluation,
    pub extension: OpaqueExtensionWrite,
 }
 /// `PUT /squad/replace` — full-replacement of the active squad's canonical slots
 /// plus its opaque game extension, in ONE Core transaction. Resolves the active
 /// squad in place (creates one if none exists). Ownership, duplicate, and size
 /// validation happen inside the service before any write.
 pub async fn put_squad_replace(
    State(state): State<AppState>,
    game: GameId,
    Json(req): Json<ReplaceReq>,
 ) -> AppResult<Json<Value>> {
    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    // Replace the club's active squad in place; if there is none yet, create it.
    let squad_id = match squad_svc::get_squad(&state.pool, &club.id).await {
        Ok((s, _)) => Some(s.id),
        Err(AppError::NotFound(_)) => None,
        Err(e) => return Err(e),
    };
    let replacement = SquadReplacement {
        name: req.name,
        formation: req.formation,
        slots: req
            .slots
            .into_iter()
            .map(|s| SlotAssignment {
                owned_card_id: s.owned_card_id,
                slot: s.slot,
                is_captain: s.is_captain,
                is_on_bench: s.is_on_bench,
            })
            .collect(),
    };
    let out = squad_svc::replace_squad_with_extension(
        &state.pool,
        &state.card_db,
        &DefaultSquadRules,
        game.as_str(),
        &club.id,
        squad_id.as_deref(),
        &replacement,
        &req.client_reported,
        &req.extension,
    )
    .await?;
    Ok(Json(json!({
        "squad_id": out.squad.id,
        "canonical_fingerprint": out.canonical_fingerprint,
        "slots_written": out.slots_written,
    })))
 }
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{
    extract::{Query, State},
    Json,
@@ -13,8 +12,8 @@ use crate::{
    services::{profile as profile_svc, statistics as stats_svc},
 };
-pub async fn get_statistics(State(state): State<AppState>, game: GameId) -> AppResult<Json<Value>> {
+pub async fn get_statistics(State(state): State<AppState>) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let stats = stats_svc::get_or_create(&state.pool, &profile.id).await?;
    let pos_goals = stats_svc::get_position_goals(&state.pool, &profile.id).await?;
@@ -37,10 +36,9 @@ pub struct HistoryQuery {
 pub async fn get_statistics_history(
    State(state): State<AppState>,
    game: GameId,
    Query(query): Query<HistoryQuery>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let limit = query.limit.unwrap_or(20).clamp(1, 100);
    let matches = sqlx::query_as::<_, Match>(
@@ -1,4 +1,3 @@
 use crate::extractors::GameId;
 use axum::{
    extract::{Path, State},
    Json,
@@ -28,11 +27,10 @@ pub struct ApplyChemStyleRequest {
 /// POST /collection/:owned_card_id/chemistry-style
 pub async fn post_apply_chemistry_style(
    State(state): State<AppState>,
    game: GameId,
    Path(owned_card_id): Path<String>,
    Json(req): Json<ApplyChemStyleRequest>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let updated = upgrade_svc::apply_chemistry_style(
@@ -65,11 +63,10 @@ pub struct ChangePositionRequest {
 /// POST /collection/:owned_card_id/position — costs 500 coins.
 pub async fn post_change_position(
    State(state): State<AppState>,
    game: GameId,
    Path(owned_card_id): Path<String>,
    Json(req): Json<ChangePositionRequest>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let updated =
@@ -95,11 +92,10 @@ pub struct ApplyTrainingRequest {
 /// POST /collection/:owned_card_id/training — applies a training boost (up to +3 OVR total).
 pub async fn post_apply_training(
    State(state): State<AppState>,
    game: GameId,
    Path(owned_card_id): Path<String>,
    Json(req): Json<ApplyTrainingRequest>,
 ) -> AppResult<Json<Value>> {
-    let profile = profile_svc::get_active_profile(&state.pool, game.as_str()).await?;
+    let profile = profile_svc::get_active_profile(&state.pool).await?;
    let club = club_svc::get_club_by_profile(&state.pool, &profile.id).await?;
    let updated =
@@ -1,23 +1,6 @@
-use crate::{
+use crate::{db::Pool, error::AppResult, models::pack::PackDefinition, services::pack as pack_svc};
    db::Pool,
    error::AppResult,
    models::{card::Quality, club::Club, pack::PackDefinition},
    services::{card_db::CardDb, club as club_svc, pack as pack_svc, profile as profile_svc},
 };
 use serde::Serialize;
 use std::collections::BTreeMap;
 use tracing::info;
 /// The game whose dev content + inventory this seeds.
 pub const FIFA17_GAME: &str = "fifa17";
 /// Deterministic owned-instance id prefix, so re-running the seed is idempotent
 /// (INSERT OR IGNORE on a stable id) rather than minting duplicate ownership.
 const DEV_OWNED_PREFIX: &str = "fdev-";
 /// Fixed grant timestamp — the seed is deterministic, not wall-clock dependent.
 const DEV_ACQUIRED_AT: &str = "2026-08-11T00:00:00Z";
 /// The client's My Squad page size (evidence: request `count=11`).
 const MY_SQUAD_PAGE: usize = 11;
 /// Seeds the market with NPC listings if empty.
 pub async fn maybe_seed(_pool: &Pool) -> AppResult<()> {
    // Any one-time startup seeds go here.
@@ -46,171 +29,3 @@ pub async fn grant_starter_pack(
    Ok(())
 }
 // ───────────────────────────── FIFA 17 dev seed ─────────────────────────────
 /// Coverage of the seeded FIFA 17 development inventory. Game-independent: it
 /// counts quality tiers, positions and distinct entities, and whether the Gold
 /// filter spans more than one page — everything the retail `/club` UI must
 /// exercise. It carries NO FIFA wire ids (those are the adapter/host's runtime
 /// concern; the seed never allocates them).
 #[derive(Debug, Serialize)]
 pub struct DevSeedReport {
    pub game_id: String,
    /// True if the fifa17 club already owned dev cards (no new grants made).
    pub already_seeded: bool,
    pub definitions_available: usize,
    pub owned_total: usize,
    pub unique_definitions: usize,
    pub gold: usize,
    pub silver: usize,
    pub bronze: usize,
    pub positions: BTreeMap<String, usize>,
    pub distinct_nations: usize,
    pub distinct_leagues: usize,
    pub distinct_clubs: usize,
    pub max_same_club: usize,
    /// Gold owned items exceed one page → the client must request a 2nd page.
    pub gold_over_one_page: bool,
 }
 /// Opt-in development seed: create (if absent) a `game_id=fifa17` profile + club
 /// and grant Core-owned instances of every dev-pack `CardDefinition` (ids
 /// `fifa17_*`), plus one deliberate duplicate of a single definition (to exercise
 /// two-copies-of-one-card identity later).
 ///
 /// **Ownership only — no FIFA wire ids.** The FIFA 17 integer item id is minted
 /// lazily by `Fifa17IdentityResolver` at request time, never here. This keeps the
 /// boundary clean: Core owns "this profile owns this card"; the adapter owns
 /// "this owned item is wire id N".
 ///
 /// Idempotent: owned ids are deterministic (`fdev-<card_id>`), inserted with
 /// `INSERT OR IGNORE`, so re-running grants nothing new. The default profile
 /// (`fifa23`/no-header) and any existing synthetic inventory are never touched.
 pub async fn seed_fifa17_dev(pool: &Pool, card_db: &CardDb) -> AppResult<DevSeedReport> {
    // The dev definitions are exactly the game-namespaced ids in the catalog.
    let mut defs: Vec<&crate::models::card::CardDefinition> = card_db
        .cards
        .values()
        .filter(|c| c.id.starts_with("fifa17_"))
        .collect();
    defs.sort_by(|a, b| a.id.cmp(&b.id));
    // Ensure the fifa17-scoped profile + club exist (single-profile-per-game).
    let profile = match profile_svc::get_active_profile(pool, FIFA17_GAME).await {
        Ok(p) => p,
        Err(_) => profile_svc::create_profile(pool, "OpenFUT Dev (FIFA17)", FIFA17_GAME).await?,
    };
    let club = match club_svc::get_club_by_profile(pool, &profile.id).await {
        Ok(c) => c,
        Err(_) => {
            let c = Club::new(&profile.id, "OpenFUT Dev FC", 100_000);
            club_svc::create_club(pool, &c).await?;
            c
        }
    };
    let prior: i64 = sqlx::query_scalar(
        "SELECT COUNT(*) FROM owned_cards WHERE club_id = ? AND card_id LIKE 'fifa17_%'",
    )
    .bind(&club.id)
    .fetch_one(pool)
    .await?;
    let already_seeded = prior > 0;
    // Grant one instance per definition; INSERT OR IGNORE keeps reruns idempotent.
    for def in &defs {
        grant_owned(
            pool,
            &format!("{DEV_OWNED_PREFIX}{}", def.id),
            &club.id,
            &def.id,
        )
        .await?;
    }
    // One deliberate duplicate of the first (lexicographic) definition → two
    // owned copies of one card sharing a definition but distinct owned ids.
    if let Some(first) = defs.first() {
        grant_owned(
            pool,
            &format!("{DEV_OWNED_PREFIX}{}-b", first.id),
            &club.id,
            &first.id,
        )
        .await?;
    }
    let report = dev_coverage(pool, card_db, &club.id, already_seeded, defs.len()).await?;
    info!(
        "seeded fifa17 dev inventory: {} owned ({} gold) over club {}",
        report.owned_total, report.gold, club.id
    );
    Ok(report)
 }
 async fn grant_owned(pool: &Pool, owned_id: &str, club_id: &str, card_id: &str) -> AppResult<()> {
    sqlx::query(
        "INSERT OR IGNORE INTO owned_cards \
         (id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at) \
         VALUES (?, ?, ?, 0, NULL, ?)",
    )
    .bind(owned_id)
    .bind(club_id)
    .bind(card_id)
    .bind(DEV_ACQUIRED_AT)
    .execute(pool)
    .await?;
    Ok(())
 }
 /// Build the coverage report from the club's owned dev cards joined to `card_db`.
 async fn dev_coverage(
    pool: &Pool,
    card_db: &CardDb,
    club_id: &str,
    already_seeded: bool,
    definitions_available: usize,
 ) -> AppResult<DevSeedReport> {
    let card_ids: Vec<String> = sqlx::query_scalar(
        "SELECT card_id FROM owned_cards WHERE club_id = ? AND card_id LIKE 'fifa17_%'",
    )
    .bind(club_id)
    .fetch_all(pool)
    .await?;
    let (mut gold, mut silver, mut bronze) = (0usize, 0usize, 0usize);
    let mut positions: BTreeMap<String, usize> = BTreeMap::new();
    let mut nations = std::collections::BTreeSet::new();
    let mut leagues = std::collections::BTreeSet::new();
    let mut club_counts: BTreeMap<String, usize> = BTreeMap::new();
    let mut unique = std::collections::BTreeSet::new();
    for card_id in &card_ids {
        unique.insert(card_id.clone());
        if let Some(def) = card_db.get(card_id) {
            match Quality::from_overall(def.overall) {
                Quality::Gold => gold += 1,
                Quality::Silver => silver += 1,
                Quality::Bronze => bronze += 1,
            }
            *positions.entry(def.position.clone()).or_default() += 1;
            nations.insert(def.nation.clone());
            leagues.insert(def.league.clone());
            *club_counts.entry(def.club.clone()).or_default() += 1;
        }
    }
    Ok(DevSeedReport {
        game_id: FIFA17_GAME.to_string(),
        already_seeded,
        definitions_available,
        owned_total: card_ids.len(),
        unique_definitions: unique.len(),
        gold,
        silver,
        bronze,
        positions,
        distinct_nations: nations.len(),
        distinct_leagues: leagues.len(),
        distinct_clubs: club_counts.len(),
        max_same_club: club_counts.values().copied().max().unwrap_or(0),
        gold_over_one_page: gold > MY_SQUAD_PAGE,
    })
 }
@@ -1,12 +1,10 @@
 use crate::{
    db::Pool,
-    error::{AppError, AppResult},
+    error::AppResult,
    models::achievement::{AchievementDefinition, PlayerAchievement},
    services::{club as club_svc, notification},
 };
 use anyhow::Context;
 use sqlx::{Sqlite, Transaction};
 use std::collections::{HashMap, HashSet};
 use std::path::Path;
 use uuid::Uuid;
@@ -187,172 +185,6 @@ pub async fn check_and_unlock(
    Ok(newly_unlocked)
 }
 /// Transaction-scoped [`metric_value`] — identical reads, run inside the
 /// caller's transaction so achievement checks see the same uncommitted state the
 /// rest of the match-completion transaction just wrote.
 async fn metric_value_tx(
    tx: &mut Transaction<'_, Sqlite>,
    profile_id: &str,
    club_id: &str,
    trigger: &str,
 ) -> AppResult<i64> {
    let v: i64 =
        match trigger {
            "matches_played" => {
                sqlx::query_scalar("SELECT matches_played FROM statistics WHERE profile_id = ?")
                    .bind(profile_id)
                    .fetch_optional(&mut **tx)
                    .await?
                    .unwrap_or(0)
            }
            "matches_won" => {
                sqlx::query_scalar("SELECT matches_won FROM statistics WHERE profile_id = ?")
                    .bind(profile_id)
                    .fetch_optional(&mut **tx)
                    .await?
                    .unwrap_or(0)
            }
            "goals_scored" => {
                sqlx::query_scalar("SELECT goals_scored FROM statistics WHERE profile_id = ?")
                    .bind(profile_id)
                    .fetch_optional(&mut **tx)
                    .await?
                    .unwrap_or(0)
            }
            "packs_opened" => {
                sqlx::query_scalar("SELECT packs_opened FROM statistics WHERE profile_id = ?")
                    .bind(profile_id)
                    .fetch_optional(&mut **tx)
                    .await?
                    .unwrap_or(0)
            }
            "sbcs_completed" => {
                sqlx::query_scalar("SELECT sbcs_completed FROM statistics WHERE profile_id = ?")
                    .bind(profile_id)
                    .fetch_optional(&mut **tx)
                    .await?
                    .unwrap_or(0)
            }
            "cards_owned" => {
                sqlx::query_scalar("SELECT COUNT(*) FROM owned_cards WHERE club_id = ?")
                    .bind(club_id)
                    .fetch_one(&mut **tx)
                    .await?
            }
            "level" => sqlx::query_scalar("SELECT level FROM profiles WHERE id = ?")
                .bind(profile_id)
                .fetch_optional(&mut **tx)
                .await?
                .unwrap_or(1),
            "objectives_completed" => sqlx::query_scalar(
                "SELECT COUNT(*) FROM objective_progress WHERE profile_id = ? AND completed = 1",
            )
            .bind(profile_id)
            .fetch_one(&mut **tx)
            .await?,
            "drafts_completed" => sqlx::query_scalar(
                "SELECT COUNT(*) FROM draft_sessions WHERE profile_id = ? AND status = 'completed'",
            )
            .bind(profile_id)
            .fetch_one(&mut **tx)
            .await?,
            _ => 0,
        };
    Ok(v)
 }
 /// Transaction-scoped [`check_and_unlock`] for the atomic match-completion path.
 /// Unlocks are inserted, coins credited, and notifications written inside the
 /// caller's transaction (mirroring the inline economy writes elsewhere), so a
 /// later failure rolls back the whole match — no half-granted achievement.
 pub async fn check_and_unlock_tx(
    tx: &mut Transaction<'_, Sqlite>,
    defs: &[AchievementDefinition],
    profile_id: &str,
    club_id: &str,
    now: &str,
 ) -> AppResult<Vec<AchievementDefinition>> {
    if defs.is_empty() {
        return Ok(vec![]);
    }
    let unlocked_ids: Vec<String> =
        sqlx::query_scalar("SELECT achievement_id FROM player_achievements")
            .fetch_all(&mut **tx)
            .await?;
    let unlocked_set: HashSet<&str> = unlocked_ids.iter().map(|s| s.as_str()).collect();
    let candidates: Vec<&AchievementDefinition> = defs
        .iter()
        .filter(|d| !unlocked_set.contains(d.id.as_str()))
        .collect();
    if candidates.is_empty() {
        return Ok(vec![]);
    }
    let mut trigger_cache: HashMap<String, i64> = Default::default();
    let mut newly_unlocked: Vec<AchievementDefinition> = Vec::new();
    for def in candidates {
        let value = match trigger_cache.get(&def.trigger) {
            Some(&v) => v,
            None => {
                let v = metric_value_tx(tx, profile_id, club_id, &def.trigger).await?;
                trigger_cache.insert(def.trigger.clone(), v);
                v
            }
        };
        if value >= def.threshold {
            if def.reward_coins < 0 {
                return Err(AppError::Internal(anyhow::anyhow!(
                    "achievement {} has a negative reward",
                    def.id
                )));
            }
            let inserted = sqlx::query(
                "INSERT OR IGNORE INTO player_achievements (id, achievement_id, unlocked_at) VALUES (?, ?, ?)",
            )
            .bind(Uuid::new_v4().to_string())
            .bind(&def.id)
            .bind(now)
            .execute(&mut **tx)
            .await?;
            if inserted.rows_affected() == 0 {
                continue;
            }
            if def.reward_coins > 0 {
                let credited =
                    sqlx::query("UPDATE clubs SET coins = coins + ?, updated_at = ? WHERE id = ?")
                        .bind(def.reward_coins)
                        .bind(now)
                        .bind(club_id)
                        .execute(&mut **tx)
                        .await?;
                if credited.rows_affected() != 1 {
                    return Err(AppError::NotFound("club not found".into()));
                }
            }
            let body = format!("{} Reward: {} coins.", def.description, def.reward_coins);
            sqlx::query(
                "INSERT INTO notifications (id, kind, title, body, is_read, created_at) VALUES (?, 'achievement', ?, ?, 0, ?)",
            )
            .bind(Uuid::new_v4().to_string())
            .bind(format!("Achievement: {}", def.title))
            .bind(body)
            .bind(now)
            .execute(&mut **tx)
            .await?;
            newly_unlocked.push(def.clone());
        }
    }
    Ok(newly_unlocked)
 }
 /// Return all achievement definitions annotated with unlock status.
 pub async fn list_with_status(
    pool: &Pool,
@@ -38,51 +38,21 @@ impl CardDb {
        Ok(Self { cards })
    }
    /// Merge a game's **opt-in development content pack** from
    /// `{data_dir}/games/{game}/dev/cards.json` (a single `CardDefinition[]`).
    /// This is NOT read by [`CardDb::load`]; it is loaded only when a game is
    /// explicitly named in `Config::dev_content_games`, so default content stays
    /// untouched. Returns the number of definitions merged. A missing file is an
    /// error (opt-in means the pack is expected to exist).
    pub fn load_game_dev(&mut self, data_dir: &str, game: &str) -> Result<usize> {
        let path = Path::new(data_dir)
            .join("games")
            .join(game)
            .join("dev")
            .join("cards.json");
        let content = std::fs::read_to_string(&path)
            .with_context(|| format!("reading dev content pack {path:?}"))?;
        let batch: Vec<CardDefinition> =
            serde_json::from_str(&content).with_context(|| format!("parsing {path:?}"))?;
        let n = batch.len();
        for card in batch {
            self.cards.insert(card.id.clone(), card);
        }
        tracing::info!("Loaded {} dev card definitions for game '{}'", n, game);
        Ok(n)
    }
    /// Merge an explicit PRODUCTION content pack file (a single
    /// `CardDefinition[]`). Unlike [`CardDb::load_game_dev`] this takes a direct
    /// path (the real-profile import emits one) and is the production content
    /// path — not gated behind dev content. Returns the number merged.
    pub fn load_pack(&mut self, path: &Path) -> Result<usize> {
        let content = std::fs::read_to_string(path)
            .with_context(|| format!("reading content pack {path:?}"))?;
        let batch: Vec<CardDefinition> =
            serde_json::from_str(&content).with_context(|| format!("parsing {path:?}"))?;
        let n = batch.len();
        for card in batch {
            self.cards.insert(card.id.clone(), card);
        }
        tracing::info!("Loaded {} production card definitions from {:?}", n, path);
        Ok(n)
    }
    pub fn get(&self, id: &str) -> Option<&CardDefinition> {
        self.cards.get(id)
    }
    #[allow(dead_code)]
    pub fn by_rarity(&self, rarity: &str) -> Vec<&CardDefinition> {
        self.cards
            .values()
            .filter(|c| {
                let r = format!("{:?}", c.rarity).to_lowercase();
                r == rarity || rarity == "any"
            })
            .collect()
    }
    pub fn all(&self) -> Vec<&CardDefinition> {
        self.cards.values().collect()
    }
@@ -48,7 +48,7 @@ pub async fn get_status(pool: &Pool, profile_id: &str) -> AppResult<CheckinStatu
            let last_day = &last_at[..10]; // YYYY-MM-DD
            let available = last_day != today.as_str();
            let next_streak = compute_next_streak(last_streak, &last_at);
-            let idx = (next_streak - 1).rem_euclid(7) as usize;
+            let idx = ((next_streak - 1) % 7) as usize;
            Ok(CheckinStatus {
                available,
                streak_day: if available { next_streak } else { last_streak },
@@ -86,17 +86,19 @@ pub async fn claim(pool: &Pool, profile_id: &str, club_id: &str) -> AppResult<Ch
        .as_ref()
        .map(|(s, last_at)| compute_next_streak(*s, last_at))
        .unwrap_or(1);
-    let idx = (last_streak - 1).rem_euclid(7) as usize;
+    let idx = ((last_streak - 1) % 7) as usize;
    let coins = STREAK_COINS[idx];
    let pack_def = if idx == 6 { Some(STREAK_7_PACK) } else { None };
-    // Atomically claim today's check-in: the INSERT lands only if no row exists for
+    club::add_coins(pool, club_id, coins).await?;
-    // today, so two concurrent claims cannot both pay out (was a check-then-act race).
+    if let Some(def) = pack_def {
        let _ = pack::grant_pack(pool, club_id, def).await;
    }
    let now = chrono::Utc::now().to_rfc3339();
-    let inserted = sqlx::query(
+    sqlx::query(
        "INSERT INTO daily_checkins (id, profile_id, club_id, streak_day, coins_awarded, pack_granted, checked_in_at) \
-         SELECT ?, ?, ?, ?, ?, ?, ? \
+         VALUES (?, ?, ?, ?, ?, ?, ?)",
         WHERE NOT EXISTS (SELECT 1 FROM daily_checkins WHERE profile_id = ? AND substr(checked_in_at, 1, 10) = ?)",
    )
    .bind(Uuid::new_v4().to_string())
    .bind(profile_id)
@@ -105,26 +107,8 @@ pub async fn claim(pool: &Pool, profile_id: &str, club_id: &str) -> AppResult<Ch
    .bind(coins)
    .bind(pack_def)
    .bind(&now)
    .bind(profile_id)
    .bind(&today)
    .execute(pool)
-    .await?
+    .await?;
    .rows_affected();
    if inserted == 0 {
        // A concurrent claim already recorded today's check-in — do not pay out again.
        return Ok(CheckinResult {
            coins_awarded: 0,
            pack_awarded: None,
            new_streak: last_streak,
            already_claimed: true,
        });
    }
    club::add_coins(pool, club_id, coins).await?;
    if let Some(def) = pack_def {
        let _ = pack::grant_pack(pool, club_id, def).await;
    }
    Ok(CheckinResult {
        coins_awarded: coins,
@@ -1,10 +1,7 @@
 use crate::{
    db::Pool,
    error::{AppError, AppResult},
-    models::{
+    models::club::Club,
        card::{ActiveSlot, ContentKind, OwnedCard, OWNED_CARD_SELECT},
        club::Club,
    },
 };
 use chrono::Utc;
@@ -89,631 +86,24 @@ pub async fn add_coins(pool: &Pool, club_id: &str, amount: i64) -> AppResult<i64
 }
 pub async fn spend_coins(pool: &Pool, club_id: &str, amount: i64) -> AppResult<i64> {
-    if amount < 0 {
+    let balance = sqlx::query_scalar::<_, i64>("SELECT coins FROM clubs WHERE id = ?")
-        return Err(AppError::BadRequest(format!(
+        .bind(club_id)
-            "cannot spend a negative amount: {amount}"
+        .fetch_one(pool)
-        )));
+        .await?;
    }
-    let now = Utc::now();
+    if balance < amount {
    // Atomic compare-and-swap: the `coins >= ?` guard makes the debit conditional in a
    // single statement, so two concurrent spends can never both pass a stale balance
    // check and drive coins negative (the old SELECT-then-UPDATE was a TOCTOU race).
    let affected = sqlx::query(
        "UPDATE clubs SET coins = coins - ?, updated_at = ? WHERE id = ? AND coins >= ?",
    )
    .bind(amount)
    .bind(now)
    .bind(club_id)
    .bind(amount)
    .execute(pool)
    .await?
    .rows_affected();
    if affected == 0 {
        // No row updated: the club is missing, or it could not afford the debit.
        // Disambiguate so callers keep the NotFound vs BadRequest distinction.
        let balance = sqlx::query_scalar::<_, i64>("SELECT coins FROM clubs WHERE id = ?")
            .bind(club_id)
            .fetch_optional(pool)
            .await?
            .ok_or_else(|| AppError::NotFound(format!("club not found: {club_id}")))?;
        return Err(AppError::BadRequest(format!(
            "insufficient coins: have {balance}, need {amount}"
        )));
    }
-    let new_balance = sqlx::query_scalar::<_, i64>("SELECT coins FROM clubs WHERE id = ?")
+    let now = Utc::now();
    sqlx::query("UPDATE clubs SET coins = coins - ?, updated_at = ? WHERE id = ?")
        .bind(amount)
        .bind(now)
        .bind(club_id)
        .fetch_one(pool)
        .await?;
    Ok(new_balance)
 }
 // ─────────────────────── squad manager assignment ───────────────────────────
 //
 // Generic, ownership-backed canonical state: one owned item assigned as a
 // squad's manager (migration 0023 `squad_managers`). Core stores the assignment
 // durably and re-validates ownership on read; the FIFA 17 adapter owns the wire
 // meaning of "manager" (itemType/contract/chemistry), never Core.
 /// The club's most-recently-updated squad id (its "active" squad), matching the
 /// selection `squad::get_squad` uses, or `None` when the club has no squad yet.
 pub async fn active_squad_id(pool: &Pool, club_id: &str) -> AppResult<Option<String>> {
    Ok(sqlx::query_scalar::<_, String>(
        "SELECT id FROM squads WHERE club_id = ? ORDER BY updated_at DESC LIMIT 1",
    )
    .bind(club_id)
    .fetch_optional(pool)
    .await?)
 }
 /// The owned card assigned as the manager of `club_id`'s active squad, if any.
 pub async fn get_squad_manager(pool: &Pool, club_id: &str) -> AppResult<Option<OwnedCard>> {
    let Some(squad_id) = active_squad_id(pool, club_id).await? else {
        return Ok(None);
    };
    get_squad_manager_for_squad(pool, &squad_id, club_id).await
 }
 /// The owned card assigned as `squad_id`'s manager, re-validated to still belong
 /// to `club_id`. The club-ownership re-check means a stale assignment left by a
 /// market transfer (which moves ownership by UPDATE, bypassing ON DELETE
 /// CASCADE) never surfaces a manager the club no longer owns.
 pub async fn get_squad_manager_for_squad(
    pool: &Pool,
    squad_id: &str,
    club_id: &str,
 ) -> AppResult<Option<OwnedCard>> {
    Ok(sqlx::query_as::<_, OwnedCard>(&format!(
        "{OWNED_CARD_SELECT} \
         WHERE id = (SELECT owned_card_id FROM squad_managers WHERE squad_id = ?) \
         AND club_id = ?"
    ))
    .bind(squad_id)
    .bind(club_id)
    .fetch_optional(pool)
    .await?)
 }
 /// Assign `owned_card_id` as the manager of `club_id`'s active squad, replacing
 /// any existing assignment. Fail-closed: both the squad and the owned card MUST
 /// belong to `club_id`, so a client can neither manage another club's squad nor
 /// assign a card it does not own. One manager per squad (the PK REPLACE), so a
 /// re-assignment never accumulates duplicate rows.
 pub async fn set_squad_manager(pool: &Pool, club_id: &str, owned_card_id: &str) -> AppResult<()> {
    let squad_id = active_squad_id(pool, club_id)
        .await?
        .ok_or_else(|| AppError::NotFound("club has no squad to assign a manager to".into()))?;
    set_squad_manager_for_squad(pool, club_id, &squad_id, owned_card_id).await
 }
 /// Squad-scoped variant of [`set_squad_manager`].
 pub async fn set_squad_manager_for_squad(
    pool: &Pool,
    club_id: &str,
    squad_id: &str,
    owned_card_id: &str,
 ) -> AppResult<()> {
    let squad_ok =
        sqlx::query_scalar::<_, String>("SELECT id FROM squads WHERE id = ? AND club_id = ?")
            .bind(squad_id)
            .bind(club_id)
            .fetch_optional(pool)
            .await?;
    if squad_ok.is_none() {
        return Err(AppError::NotFound(format!("squad '{squad_id}' not found")));
    }
    let card_ok =
        sqlx::query_scalar::<_, String>("SELECT id FROM owned_cards WHERE id = ? AND club_id = ?")
            .bind(owned_card_id)
            .bind(club_id)
            .fetch_optional(pool)
            .await?;
    if card_ok.is_none() {
        return Err(AppError::NotFound(format!(
            "owned card '{owned_card_id}' not found"
        )));
    }
    let now = Utc::now().to_rfc3339();
    sqlx::query(
        "INSERT OR REPLACE INTO squad_managers (squad_id, owned_card_id, updated_at) \
         VALUES (?, ?, ?)",
    )
    .bind(squad_id)
    .bind(owned_card_id)
    .bind(&now)
    .execute(pool)
    .await?;
    Ok(())
 }
 /// Remove the manager assignment from `club_id`'s active squad (idempotent — a
 /// club with no squad or no manager is a successful no-op).
 pub async fn clear_squad_manager(pool: &Pool, club_id: &str) -> AppResult<()> {
    sqlx::query(
        "DELETE FROM squad_managers WHERE squad_id IN \
         (SELECT id FROM squads WHERE club_id = ?)",
    )
    .bind(club_id)
    .execute(pool)
    .await?;
    Ok(())
 }
 // ─────────────────────── active club item designations ──────────────────────
 //
 // Generic, ownership-backed club state (migration 0026 `club_active_items`):
 // which owned INSTANCE currently occupies each club-scoped role (home/away kit,
 // badge, ball, stadium). Ownership itself never lives here — a designation is a
 // pointer into `owned_cards`, revalidated against current ownership on every
 // read, so a stale row can never project an item the club does not own.
 //
 // Core enforces the generic invariants (ownership, one instance per slot, slot
 // admits exactly one `ContentKind`); a game adapter maps its own taxonomy onto
 // `ContentKind` before it gets here.
 /// Every active club-item designation, keyed by slot.
 ///
 /// Slots with no designation are simply absent. Held as a `Vec` rather than a
 /// map so the projection order is the canonical [`ActiveSlot::ALL`] order.
 #[derive(Debug, Clone, Default)]
 pub struct ActiveClubItems {
    pub items: Vec<(ActiveSlot, OwnedCard)>,
 }
 impl ActiveClubItems {
    /// The owned instance occupying `slot`, if any.
    pub fn get(&self, slot: ActiveSlot) -> Option<&OwnedCard> {
        self.items
            .iter()
            .find(|(s, _)| *s == slot)
            .map(|(_, card)| card)
    }
 }
 /// Read one slot's designation, revalidated against current club ownership.
 async fn get_active_club_item(
    pool: &Pool,
    club_id: &str,
    slot: ActiveSlot,
 ) -> AppResult<Option<OwnedCard>> {
    Ok(sqlx::query_as::<_, OwnedCard>(&format!(
        "{OWNED_CARD_SELECT} WHERE id = ( \
         SELECT owned_card_id FROM club_active_items WHERE club_id = ? AND slot = ? \
         ) AND club_id = ?"
    ))
    .bind(club_id)
    .bind(slot.as_str())
    .bind(club_id)
    .fetch_optional(pool)
    .await?)
 }
 /// Read every active club-item designation. Each is revalidated against current
 /// ownership, so a stale/corrupt row never surfaces another club's item.
 pub async fn get_active_club_items(pool: &Pool, club_id: &str) -> AppResult<ActiveClubItems> {
    let mut items = Vec::new();
    for slot in ActiveSlot::ALL {
        if let Some(card) = get_active_club_item(pool, club_id, slot).await? {
            items.push((slot, card));
        }
    }
    Ok(ActiveClubItems { items })
 }
 /// Designate `owned_card_id` as `club_id`'s active item for `slot`, replacing any
 /// existing designation for that slot.
 ///
 /// Fail-closed, in one transaction:
 ///   * the instance MUST be owned by `club_id` (so a client cannot install
 ///     another club's item, nor an id that does not exist);
 ///   * its `content_kind` MUST be the kind the slot admits (a badge in
 ///     `home_kit` is rejected, not silently accepted);
 ///   * an instance already designated for a DIFFERENT slot is released first, so
 ///     the `owned_card_id UNIQUE` invariant is upheld by an explicit move rather
 ///     than a constraint error.
 pub async fn set_active_club_item(
    pool: &Pool,
    club_id: &str,
    slot: ActiveSlot,
    owned_card_id: &str,
 ) -> AppResult<()> {
    let mut tx = pool.begin().await?;
    let owned = sqlx::query_as::<_, (String, ContentKind)>(
        "SELECT id, content_kind FROM owned_cards WHERE id = ? AND club_id = ?",
    )
    .bind(owned_card_id)
    .bind(club_id)
    .fetch_optional(&mut *tx)
    .await?;
    let Some((_, kind)) = owned else {
        return Err(AppError::NotFound(format!(
            "owned card '{owned_card_id}' not found"
        )));
    };
    let required = slot.required_kind();
    if kind != required {
        return Err(AppError::BadRequest(format!(
            "slot '{slot}' requires content kind '{required}', but owned card \
             '{owned_card_id}' is '{kind}'"
        )));
    }
    // Release this instance from any other slot, then take the target slot.
    sqlx::query("DELETE FROM club_active_items WHERE owned_card_id = ?")
        .bind(owned_card_id)
        .execute(&mut *tx)
        .await?;
    let now = Utc::now().to_rfc3339();
    sqlx::query(
        "INSERT OR REPLACE INTO club_active_items \
         (club_id, slot, owned_card_id, updated_at) VALUES (?, ?, ?, ?)",
    )
    .bind(club_id)
    .bind(slot.as_str())
    .bind(owned_card_id)
    .bind(&now)
    .execute(&mut *tx)
    .await?;
    tx.commit().await?;
    Ok(())
 }
 /// Clear `club_id`'s designation for `slot` (idempotent — an already-empty slot
 /// is a successful no-op).
 pub async fn clear_active_club_item(pool: &Pool, club_id: &str, slot: ActiveSlot) -> AppResult<()> {
    sqlx::query("DELETE FROM club_active_items WHERE club_id = ? AND slot = ?")
        .bind(club_id)
        .bind(slot.as_str())
        .execute(pool)
        .await?;
-    Ok(())
+
-}
+    Ok(balance - amount)
 #[cfg(test)]
 mod tests {
    use super::*;
    use crate::db;
    const TS: &str = "2026-01-01T00:00:00Z";
    /// A file-backed pool (so a "restart" can reopen the same DB) with two clubs.
    async fn fixture() -> (tempfile::TempDir, String, db::Pool) {
        let dir = tempfile::tempdir().expect("tempdir");
        let url = format!("sqlite://{}", dir.path().join("core.db").display());
        let pool = db::init_pool(&url, 5).await.expect("init pool");
        db::run_migrations(&pool).await.expect("migrations");
        for (profile, club) in [("prof-a", "club-a"), ("prof-b", "club-b")] {
            sqlx::query(
                "INSERT INTO profiles (id, username, created_at, updated_at) VALUES (?, ?, ?, ?)",
            )
            .bind(profile)
            .bind(profile)
            .bind(TS)
            .bind(TS)
            .execute(&pool)
            .await
            .expect("profile");
            sqlx::query("INSERT INTO clubs (id, profile_id, name, coins, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)")
                .bind(club).bind(profile).bind(club).bind(1000i64).bind(TS).bind(TS)
                .execute(&pool).await.expect("club");
        }
        for (id, club, definition, kind) in [
            ("mgr", "club-a", "def-mgr", ContentKind::Manager),
            ("mgr2", "club-a", "def-mgr", ContentKind::Manager),
            ("player", "club-a", "def-player", ContentKind::Player),
            ("kit-home", "club-a", "def-kit-home", ContentKind::Kit),
            ("kit-away", "club-a", "def-kit-away", ContentKind::Kit),
            ("kit-away-2", "club-a", "def-kit-away-2", ContentKind::Kit),
            ("badge", "club-a", "def-badge", ContentKind::Badge),
            ("ball", "club-a", "def-ball", ContentKind::Ball),
            ("stadium", "club-a", "def-stadium", ContentKind::Stadium),
            ("foreign", "club-b", "def-kit-foreign", ContentKind::Kit),
        ] {
            sqlx::query(
                "INSERT INTO owned_cards (id, club_id, card_id, is_loan, acquired_at, content_kind) \
                 VALUES (?, ?, ?, 0, ?, ?)",
            )
            .bind(id)
            .bind(club)
            .bind(definition)
            .bind(TS)
            .bind(kind.as_str())
            .execute(&pool)
            .await
            .expect("owned card");
        }
        // club-a has one squad.
        sqlx::query("INSERT INTO squads (id, club_id, name, formation, created_at, updated_at) VALUES ('sq-a', 'club-a', 'S', '4-4-2', ?, ?)")
            .bind(TS).bind(TS).execute(&pool).await.expect("squad");
        (dir, url, pool)
    }
    async fn manager_rows(pool: &db::Pool) -> i64 {
        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM squad_managers")
            .fetch_one(pool)
            .await
            .unwrap()
    }
    async fn active_item_rows(pool: &db::Pool) -> i64 {
        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM club_active_items")
            .fetch_one(pool)
            .await
            .unwrap()
    }
    #[tokio::test]
    async fn manager_persists_across_reload_and_restart() {
        let (dir, url, pool) = fixture().await;
        // SAVE.
        set_squad_manager(&pool, "club-a", "mgr")
            .await
            .expect("assign");
        // RELOAD (same pool).
        let got = get_squad_manager(&pool, "club-a").await.unwrap();
        assert_eq!(got.as_ref().map(|c| c.id.as_str()), Some("mgr"));
        // RESTART: close the pool and reopen the same DB file.
        pool.close().await;
        let reopened = db::init_pool(&url, 5).await.expect("reopen");
        db::run_migrations(&reopened).await.expect("migrations");
        let after = get_squad_manager(&reopened, "club-a").await.unwrap();
        assert_eq!(
            after.as_ref().map(|c| c.id.as_str()),
            Some("mgr"),
            "manager assignment must survive a server restart"
        );
        drop(dir);
    }
    #[tokio::test]
    async fn reassignment_replaces_and_never_duplicates() {
        let (_dir, _url, pool) = fixture().await;
        set_squad_manager(&pool, "club-a", "mgr").await.unwrap();
        set_squad_manager(&pool, "club-a", "mgr2").await.unwrap();
        assert_eq!(manager_rows(&pool).await, 1, "one manager per squad");
        let got = get_squad_manager(&pool, "club-a").await.unwrap();
        assert_eq!(got.map(|c| c.id), Some("mgr2".to_string()));
    }
    #[tokio::test]
    async fn clear_removes_and_no_resurrection() {
        let (_dir, _url, pool) = fixture().await;
        set_squad_manager(&pool, "club-a", "mgr").await.unwrap();
        clear_squad_manager(&pool, "club-a").await.unwrap();
        assert!(get_squad_manager(&pool, "club-a").await.unwrap().is_none());
        assert_eq!(manager_rows(&pool).await, 0);
        // Clearing again is an idempotent no-op.
        clear_squad_manager(&pool, "club-a").await.unwrap();
    }
    #[tokio::test]
    async fn rejects_card_the_club_does_not_own() {
        let (_dir, _url, pool) = fixture().await;
        let err = set_squad_manager(&pool, "club-a", "foreign").await;
        assert!(err.is_err(), "cannot assign a card owned by another club");
        assert_eq!(manager_rows(&pool).await, 0);
    }
    #[tokio::test]
    async fn quick_sell_of_manager_cascades_the_assignment_away() {
        let (_dir, _url, pool) = fixture().await;
        set_squad_manager(&pool, "club-a", "mgr").await.unwrap();
        // A quick-sell/discard DELETEs the owned row; ON DELETE CASCADE must
        // remove the assignment so the sold manager is never resurrected.
        sqlx::query("DELETE FROM owned_cards WHERE id = 'mgr'")
            .execute(&pool)
            .await
            .expect("delete owned card");
        assert_eq!(manager_rows(&pool).await, 0);
        assert!(get_squad_manager(&pool, "club-a").await.unwrap().is_none());
    }
    #[tokio::test]
    async fn no_manager_when_none_assigned() {
        let (_dir, _url, pool) = fixture().await;
        assert!(get_squad_manager(&pool, "club-a").await.unwrap().is_none());
    }
    // ── active club item designations ──
    #[tokio::test]
    async fn active_items_persist_across_reload_and_restart() {
        let (dir, url, pool) = fixture().await;
        for (slot, id) in [
            (ActiveSlot::HomeKit, "kit-home"),
            (ActiveSlot::AwayKit, "kit-away"),
            (ActiveSlot::Badge, "badge"),
            (ActiveSlot::Ball, "ball"),
            (ActiveSlot::Stadium, "stadium"),
        ] {
            set_active_club_item(&pool, "club-a", slot, id)
                .await
                .expect("designate");
        }
        let current = get_active_club_items(&pool, "club-a").await.unwrap();
        assert_eq!(current.items.len(), 5, "every slot filled");
        // Projection order is the canonical slot order, not DB insertion order.
        assert_eq!(
            current.items.iter().map(|(s, _)| *s).collect::<Vec<_>>(),
            ActiveSlot::ALL.to_vec()
        );
        pool.close().await;
        let reopened = db::init_pool(&url, 5).await.expect("reopen");
        db::run_migrations(&reopened).await.expect("migrations");
        let persisted = get_active_club_items(&reopened, "club-a").await.unwrap();
        assert_eq!(
            persisted.get(ActiveSlot::Stadium).map(|c| c.id.as_str()),
            Some("stadium"),
            "designations must survive a server restart"
        );
        drop(dir);
    }
    #[tokio::test]
    async fn active_item_replace_and_clear_never_duplicate() {
        let (_dir, _url, pool) = fixture().await;
        set_active_club_item(&pool, "club-a", ActiveSlot::AwayKit, "kit-away")
            .await
            .unwrap();
        set_active_club_item(&pool, "club-a", ActiveSlot::AwayKit, "kit-away-2")
            .await
            .unwrap();
        assert_eq!(active_item_rows(&pool).await, 1, "one item per slot");
        let current = get_active_club_items(&pool, "club-a").await.unwrap();
        assert_eq!(
            current.get(ActiveSlot::AwayKit).map(|c| c.id.as_str()),
            Some("kit-away-2")
        );
        clear_active_club_item(&pool, "club-a", ActiveSlot::AwayKit)
            .await
            .unwrap();
        assert_eq!(active_item_rows(&pool).await, 0);
        // Clearing an empty slot is an idempotent no-op.
        clear_active_club_item(&pool, "club-a", ActiveSlot::AwayKit)
            .await
            .unwrap();
    }
    #[tokio::test]
    async fn active_item_rejects_unowned_card_and_leaves_state_intact() {
        let (_dir, _url, pool) = fixture().await;
        set_active_club_item(&pool, "club-a", ActiveSlot::HomeKit, "kit-home")
            .await
            .unwrap();
        assert!(
            set_active_club_item(&pool, "club-a", ActiveSlot::AwayKit, "foreign")
                .await
                .is_err(),
            "another club's item cannot be designated"
        );
        assert!(
            set_active_club_item(&pool, "club-a", ActiveSlot::AwayKit, "nope")
                .await
                .is_err(),
            "a non-existent instance cannot be designated"
        );
        let unchanged = get_active_club_items(&pool, "club-a").await.unwrap();
        assert_eq!(
            unchanged.get(ActiveSlot::HomeKit).map(|c| c.id.as_str()),
            Some("kit-home")
        );
        assert_eq!(active_item_rows(&pool).await, 1);
    }
    #[tokio::test]
    async fn active_item_rejects_slot_kind_mismatch() {
        let (_dir, _url, pool) = fixture().await;
        // A badge is not a kit; a player is not a stadium.
        for (slot, id) in [
            (ActiveSlot::HomeKit, "badge"),
            (ActiveSlot::Stadium, "player"),
            (ActiveSlot::Ball, "kit-home"),
        ] {
            let err = set_active_club_item(&pool, "club-a", slot, id)
                .await
                .expect_err("slot/kind mismatch must be refused");
            assert!(
                matches!(err, AppError::BadRequest(_)),
                "expected a bad-request, got {err:?}"
            );
        }
        assert_eq!(active_item_rows(&pool).await, 0);
    }
    /// Lifecycle invariant: one owned instance can occupy at most ONE slot.
    /// Re-designating it moves it rather than duplicating it.
    #[tokio::test]
    async fn one_instance_cannot_occupy_two_slots() {
        let (_dir, _url, pool) = fixture().await;
        set_active_club_item(&pool, "club-a", ActiveSlot::HomeKit, "kit-home")
            .await
            .unwrap();
        set_active_club_item(&pool, "club-a", ActiveSlot::AwayKit, "kit-home")
            .await
            .unwrap();
        assert_eq!(active_item_rows(&pool).await, 1);
        let current = get_active_club_items(&pool, "club-a").await.unwrap();
        assert!(current.get(ActiveSlot::HomeKit).is_none());
        assert_eq!(
            current.get(ActiveSlot::AwayKit).map(|c| c.id.as_str()),
            Some("kit-home")
        );
        // The schema itself refuses the impossible state, not just the service.
        let raw = sqlx::query(
            "INSERT INTO club_active_items (club_id, slot, owned_card_id, updated_at) \
             VALUES ('club-a', 'home_kit', 'kit-home', ?)",
        )
        .bind(TS)
        .execute(&pool)
        .await;
        assert!(
            raw.is_err(),
            "owned_card_id UNIQUE must reject a second slot"
        );
    }
    /// Lifecycle invariant: a designation can never point at an item the club
    /// does not own — neither after a quick sell (DELETE) nor after a transfer
    /// (UPDATE of club_id, which no FK action can observe).
    #[tokio::test]
    async fn delete_and_transfer_clear_active_designations() {
        let (_dir, _url, pool) = fixture().await;
        set_active_club_item(&pool, "club-a", ActiveSlot::HomeKit, "kit-home")
            .await
            .unwrap();
        set_active_club_item(&pool, "club-a", ActiveSlot::AwayKit, "kit-away")
            .await
            .unwrap();
        sqlx::query("DELETE FROM owned_cards WHERE id = 'kit-home'")
            .execute(&pool)
            .await
            .expect("quick sell kit");
        let after_delete = get_active_club_items(&pool, "club-a").await.unwrap();
        assert!(after_delete.get(ActiveSlot::HomeKit).is_none());
        assert_eq!(
            after_delete.get(ActiveSlot::AwayKit).map(|c| c.id.as_str()),
            Some("kit-away")
        );
        assert_eq!(active_item_rows(&pool).await, 1);
        sqlx::query("UPDATE owned_cards SET club_id = 'club-b' WHERE id = 'kit-away'")
            .execute(&pool)
            .await
            .expect("transfer kit");
        assert_eq!(active_item_rows(&pool).await, 0, "transfer clears the slot");
        let after_transfer = get_active_club_items(&pool, "club-a").await.unwrap();
        assert!(after_transfer.items.is_empty());
    }
    /// A designation whose owned row is forced out of the club WITHOUT the
    /// trigger firing (raw row surgery mimicking corruption) must still never
    /// project: reads revalidate ownership.
    #[tokio::test]
    async fn read_revalidates_ownership_of_a_stale_designation() {
        let (_dir, _url, pool) = fixture().await;
        set_active_club_item(&pool, "club-a", ActiveSlot::Badge, "badge")
            .await
            .unwrap();
        sqlx::query("UPDATE club_active_items SET owned_card_id = 'foreign' WHERE slot = 'badge'")
            .execute(&pool)
            .await
            .expect("corrupt the designation");
        let items = get_active_club_items(&pool, "club-a").await.unwrap();
        assert!(
            items.get(ActiveSlot::Badge).is_none(),
            "another club's item must never be projected"
        );
    }
 }
@@ -88,18 +88,13 @@ pub async fn start_draft(
    let first_position = &pick_order[0];
    let candidates = pick_candidates(card_db, first_position, min_overall, CANDIDATES_PER_SLOT);
    let pick_order_json = serde_json::to_string(&pick_order)
        .map_err(|e| AppError::Internal(anyhow::anyhow!("serialization failed: {e}")))?;
    let candidates_json = serde_json::to_string(&candidates)
        .map_err(|e| AppError::Internal(anyhow::anyhow!("serialization failed: {e}")))?;
    let session = DraftSession {
        id: Uuid::new_v4().to_string(),
        profile_id: profile_id.to_string(),
        difficulty: difficulty.to_string(),
-        pick_order: pick_order_json,
+        pick_order: serde_json::to_string(&pick_order).unwrap(),
        picks: "[]".to_string(),
-        current_candidates: Some(candidates_json),
+        current_candidates: Some(serde_json::to_string(&candidates).unwrap()),
        status: "active".to_string(),
        reward_coins: 0,
        reward_pack_id: None,
@@ -197,23 +192,17 @@ pub async fn pick_card(
            let next_pos = &pick_order[next_index];
            let next_candidates =
                pick_candidates(card_db, next_pos, min_overall, CANDIDATES_PER_SLOT);
-            {
+            (
-                let candidates_json = serde_json::to_string(&next_candidates).map_err(|e| {
+                Some(serde_json::to_string(&next_candidates).unwrap()),
-                    AppError::Internal(anyhow::anyhow!("serialization failed: {e}"))
+                "active".to_string(),
-                })?;
+                0,
-                (
+                None,
-                    Some(candidates_json),
+                0,
-                    "active".to_string(),
+                None,
-                    0,
+            )
                    None,
                    0,
                    None,
                )
            }
        };
-    let picks_json = serde_json::to_string(&picks)
+    let picks_json = serde_json::to_string(&picks).unwrap();
        .map_err(|e| AppError::Internal(anyhow::anyhow!("serialization failed: {e}")))?;
    sqlx::query(
        "UPDATE draft_sessions SET picks = ?, current_candidates = ?, status = ?, \
@@ -243,30 +243,16 @@ pub async fn claim_rivals_reward(
    pack_defs: &[PackDefinition],
 ) -> AppResult<serde_json::Value> {
    // Fetch current season row (must exist)
-    let row: Option<(i64, i64, i64, Option<String>)> = sqlx::query_as(
+    let row: Option<(i64, i64, i64)> = sqlx::query_as(
-        "SELECT division, rivals_week_claimed, rivals_total_points, rivals_last_claimed_at \
+        "SELECT division, rivals_week_claimed, rivals_total_points FROM seasons WHERE profile_id = ?",
         FROM seasons WHERE profile_id = ?",
    )
    .bind(profile_id)
    .fetch_optional(pool)
    .await?;
-    let (division, week_claimed, total_pts, last_claimed_at) =
+    let (division, week_claimed, total_pts) =
        row.ok_or_else(|| AppError::NotFound("no season found — play a match first".into()))?;
    // Enforce 24-hour cooldown between weekly reward claims
    if let Some(ref last_claimed) = last_claimed_at {
        if let Ok(last_time) = chrono::DateTime::parse_from_rfc3339(last_claimed) {
            let elapsed = chrono::Utc::now() - last_time.with_timezone(&chrono::Utc);
            if elapsed < chrono::Duration::hours(24) {
                let hours_remaining = 24 - elapsed.num_hours();
                return Err(AppError::Conflict(format!(
                    "rivals weekly reward already claimed; try again in ~{hours_remaining}h"
                )));
            }
        }
    }
    let next_week = week_claimed + 1;
    let coins = rivals_weekly_coins(division);
    let new_balance = club_svc::add_coins(pool, club_id, coins).await?;
@@ -289,13 +275,11 @@ pub async fn claim_rivals_reward(
        None
    };
    let now = chrono::Utc::now().to_rfc3339();
    sqlx::query(
-        "UPDATE seasons SET rivals_week_claimed = ?, rivals_total_points = rivals_total_points + 100, \
+        "UPDATE seasons SET rivals_week_claimed = ?, rivals_total_points = rivals_total_points + 100 \
-         rivals_last_claimed_at = ? WHERE profile_id = ?",
+         WHERE profile_id = ?",
    )
    .bind(next_week)
    .bind(&now)
    .bind(profile_id)
    .execute(pool)
    .await?;
@@ -1,34 +0,0 @@
 //! Generic read/write for [`crate::models::game_ext`] opaque state.
 //!
 //! Core never interprets the payload. Writes happen INSIDE the owning entity's
 //! transaction (see `squad::replace_squad_with_extension`) so the canonical
 //! entity and its opaque extension commit atomically — there is deliberately no
 //! standalone "write extension" entry point that could desync the two.
 use crate::db::Pool;
 use crate::error::AppResult;
 use crate::models::game_ext::GameEntityExt;
 /// Fetch the stored opaque extension for a scoped entity, or `None`. The caller
 /// compares `canonical_fingerprint` against the entity's *current* fingerprint to
 /// decide freshness — this layer does not know how to fingerprint any entity.
 pub async fn get_ext(
    pool: &Pool,
    game_id: &str,
    entity_kind: &str,
    entity_id: &str,
    namespace: &str,
 ) -> AppResult<Option<GameEntityExt>> {
    let row = sqlx::query_as::<_, GameEntityExt>(
        "SELECT game_id, entity_kind, entity_id, namespace, schema_version, \
         canonical_fingerprint, payload, updated_at FROM game_entity_ext \
         WHERE game_id = ? AND entity_kind = ? AND entity_id = ? AND namespace = ?",
    )
    .bind(game_id)
    .bind(entity_kind)
    .bind(entity_id)
    .bind(namespace)
    .fetch_optional(pool)
    .await?;
    Ok(row)
 }
@@ -1,489 +0,0 @@
 //! Generic, game-agnostic transactional profile import.
 //!
 //! Core installs a profile + club + owned cards + canonical squad + one opaque
 //! game extension in a SINGLE all-or-nothing SQLite transaction, stamped with a
 //! generic `source_fingerprint` provenance token. Core NEVER interprets FIFA17
 //! wire ids, resourceIds, `nextItemId`, or the extension payload — the
 //! `openfut-import-fifa17` adapter reads the Python profile, chooses every
 //! `CardDefinitionId` and every opaque `OwnedItemId`, builds the squad
 //! extension bytes, and hands Core this generic request.
 //!
 //! Invariants enforced here:
 //! - Definition preflight: every incoming `card_id` MUST already resolve in the
 //!   loaded production content, so the transaction never creates ownership
 //!   pointing at absent content.
 //! - Squad all-or-nothing: every active-squad `owned_item_id` MUST be among the
 //!   imported ownership set before the transaction begins.
 //! - Rerun identity: identical `source_fingerprint` against an already-imported
 //!   game is an idempotent no-op; a differing token fails; a pre-existing
 //!   non-imported profile is never clobbered.
 //! - The whole thing commits together or not at all.
 use std::collections::BTreeMap;
 use crate::db::Pool;
 use crate::models::card::ContentKind;
 use crate::models::game_ext::{MAX_EXT_NAMESPACE_LEN, MAX_EXT_PAYLOAD_BYTES};
 use crate::services::card_db::CardDb;
 use crate::services::squad::squad_fingerprint;
 use anyhow::{bail, Context, Result};
 use chrono::Utc;
 use serde::{Deserialize, Serialize};
 use std::collections::HashSet;
 use uuid::Uuid;
 #[derive(Debug, Deserialize)]
 pub struct ImportProfile {
    pub username: String,
    pub game_id: String,
 }
 #[derive(Debug, Deserialize)]
 pub struct ImportClub {
    pub name: String,
    #[serde(default)]
    pub coins: i64,
 }
 #[derive(Debug, Deserialize)]
 pub struct ImportOwnedCard {
    /// Opaque, stable Core OwnedItemId chosen by the adapter. Core never parses
    /// why it is stable — it is a primary key, nothing more.
    pub owned_item_id: String,
    /// CardDefinitionId that MUST resolve in loaded production content.
    pub card_id: String,
    /// Generic content classification. Absent = `player`, which is what every
    /// pre-taxonomy import produced; the adapter maps its own taxonomy (FIFA 17
    /// `cardsubtypeid`, resource ranges, …) onto this before calling Core.
    #[serde(default)]
    pub content_kind: ContentKind,
    /// Optional per-instance stack size. Absent / `null` means "not a stack"; it
    /// never collapses two instances into one row.
    ///
    /// NOT a consumable's wire `amount`: in FIFA 17 that field is the
    /// definition's effect magnitude (a "+15 training" card), and every copy is
    /// its own instance carrying the same value, so storing it here would claim
    /// the club owns fifteen of them.
    #[serde(default)]
    pub quantity: Option<i64>,
 }
 #[derive(Debug, Deserialize)]
 pub struct ImportEntitlement {
    /// Opaque definition reference for one unconsumed entitlement (e.g. a pack
    /// id as text). Core stores it verbatim; it never interprets the value.
    pub definition_id: String,
 }
 #[derive(Debug, Deserialize)]
 pub struct ImportSlot {
    pub owned_item_id: String,
    pub position_index: i64,
    #[serde(default)]
    pub is_captain: bool,
    #[serde(default)]
    pub is_on_bench: bool,
 }
 #[derive(Debug, Deserialize)]
 pub struct ImportExtension {
    /// Opaque adapter key, e.g. "fifa17.squad.v1".
    pub namespace: String,
    /// Adapter payload version (distinct from DB storage schema).
    pub schema_version: i64,
    /// Uninterpreted bytes-as-text. Core enforces only generic size bounds.
    pub payload: String,
 }
 #[derive(Debug, Deserialize)]
 pub struct ImportSquad {
    pub formation: String,
    #[serde(default = "default_squad_name")]
    pub name: String,
    pub slots: Vec<ImportSlot>,
    pub extension: ImportExtension,
 }
 fn default_squad_name() -> String {
    "My Squad".to_string()
 }
 #[derive(Debug, Deserialize)]
 pub struct ProfileImportRequest {
    /// Generic provenance/rerun-identity token. Core stores it verbatim.
    pub source_fingerprint: String,
    pub profile: ImportProfile,
    pub club: ImportClub,
    pub owned: Vec<ImportOwnedCard>,
    #[serde(default)]
    pub squad: Option<ImportSquad>,
    /// Unconsumed entitlements to seed (e.g. from a source's unopened packs).
    #[serde(default)]
    pub entitlements: Vec<ImportEntitlement>,
 }
 #[derive(Debug, Serialize, PartialEq, Eq)]
 #[serde(tag = "outcome", rename_all = "snake_case")]
 pub enum ImportOutcome {
    /// A fresh import committed.
    Imported { owned: usize, squad_slots: usize },
    /// The same fingerprint was already imported for this game — no-op.
    AlreadyImported,
 }
 /// Apply a generic transactional profile import. See module docs for invariants.
 pub async fn apply_profile_import(
    pool: &Pool,
    card_db: &CardDb,
    req: &ProfileImportRequest,
 ) -> Result<ImportOutcome> {
    // ── 0. generic input validation (no writes) ──
    if req.source_fingerprint.trim().is_empty() {
        bail!("source_fingerprint must be non-empty");
    }
    if req.owned.is_empty() {
        bail!("import request has zero owned cards; refusing to import an empty profile");
    }
    // A stack size is either absent ("not a stack") or a real positive count.
    // Reject an explicit 0/negative up front rather than letting the column
    // CHECK surface it as an opaque constraint failure mid-transaction.
    for o in &req.owned {
        if let Some(q) = o.quantity {
            if q < 1 {
                bail!(
                    "owned card {} has quantity {q}; a stack size must be omitted or >= 1",
                    o.owned_item_id
                );
            }
        }
    }
    // ── 1. rerun identity / single-profile-per-game ──
    let existing: Option<(String, Option<String>)> = sqlx::query_as(
        "SELECT id, import_fingerprint FROM profiles \
         WHERE game_id = ? ORDER BY created_at ASC LIMIT 1",
    )
    .bind(&req.profile.game_id)
    .fetch_optional(pool)
    .await?;
    if let Some((_id, fp)) = existing {
        match fp {
            Some(fp) if fp == req.source_fingerprint => return Ok(ImportOutcome::AlreadyImported),
            Some(fp) => bail!(
                "game '{}' already imported from a different source (stored fingerprint {fp}, \
                 incoming {}); refusing to overwrite without an explicit update mode",
                req.profile.game_id,
                req.source_fingerprint
            ),
            None => bail!(
                "game '{}' already has a non-imported profile; refusing to clobber it",
                req.profile.game_id
            ),
        }
    }
    // ── 2. definition preflight: every card_id MUST resolve in loaded content ──
    let mut missing: Vec<&str> = req
        .owned
        .iter()
        .filter(|o| card_db.get(&o.card_id).is_none())
        .map(|o| o.card_id.as_str())
        .collect();
    if !missing.is_empty() {
        missing.sort_unstable();
        missing.dedup();
        let sample = &missing[..missing.len().min(5)];
        bail!(
            "definition preflight failed: {} owned card(s) reference CardDefinitionId(s) not in \
             loaded content (e.g. {sample:?}); refusing to create ownership pointing at absent content",
            missing.len()
        );
    }
    // ── 3. owned-item-id uniqueness ──
    let mut owned_ids: HashSet<&str> = HashSet::with_capacity(req.owned.len());
    for o in &req.owned {
        if !owned_ids.insert(o.owned_item_id.as_str()) {
            bail!(
                "duplicate OwnedItemId in import request: {}",
                o.owned_item_id
            );
        }
    }
    // ── 4. squad all-or-nothing + generic extension bounds (no writes) ──
    if let Some(sq) = &req.squad {
        let ns_len = sq.extension.namespace.len();
        if ns_len == 0 || ns_len > MAX_EXT_NAMESPACE_LEN {
            bail!(
                "extension namespace length {ns_len} out of bounds (1..={MAX_EXT_NAMESPACE_LEN})"
            );
        }
        if sq.extension.payload.len() > MAX_EXT_PAYLOAD_BYTES {
            bail!(
                "extension payload {} bytes exceeds MAX_EXT_PAYLOAD_BYTES ({MAX_EXT_PAYLOAD_BYTES})",
                sq.extension.payload.len()
            );
        }
        for slot in &sq.slots {
            if !owned_ids.contains(slot.owned_item_id.as_str()) {
                bail!(
                    "active squad references OwnedItemId {} not present in imported ownership set; \
                     squad import is all-or-nothing",
                    slot.owned_item_id
                );
            }
        }
    }
    // ── 5. single transaction: everything commits together or not at all ──
    let now = Utc::now().to_rfc3339();
    let profile_id = Uuid::new_v4().to_string();
    let club_id = Uuid::new_v4().to_string();
    let mut tx = pool.begin().await?;
    sqlx::query(
        "INSERT INTO profiles (id, username, level, xp, game_id, created_at, updated_at, import_fingerprint) \
         VALUES (?, ?, 1, 0, ?, ?, ?, ?)",
    )
    .bind(&profile_id)
    .bind(&req.profile.username)
    .bind(&req.profile.game_id)
    .bind(&now)
    .bind(&now)
    .bind(&req.source_fingerprint)
    .execute(&mut *tx)
    .await
    .context("insert profile")?;
    sqlx::query(
        "INSERT INTO clubs (id, profile_id, name, coins, level, created_at, updated_at) \
         VALUES (?, ?, ?, ?, 1, ?, ?)",
    )
    .bind(&club_id)
    .bind(&profile_id)
    .bind(&req.club.name)
    .bind(req.club.coins)
    .bind(&now)
    .bind(&now)
    .execute(&mut *tx)
    .await
    .context("insert club")?;
    for o in &req.owned {
        sqlx::query(
            "INSERT INTO owned_cards \
             (id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at, \
              content_kind, quantity) \
             VALUES (?, ?, ?, 0, NULL, ?, ?, ?)",
        )
        .bind(&o.owned_item_id)
        .bind(&club_id)
        .bind(&o.card_id)
        .bind(&now)
        .bind(o.content_kind.as_str())
        .bind(o.quantity)
        .execute(&mut *tx)
        .await
        .with_context(|| format!("insert owned_card {}", o.owned_item_id))?;
    }
    for e in &req.entitlements {
        sqlx::query(
            "INSERT INTO packs (id, club_id, definition_id, opened, created_at) VALUES (?, ?, ?, 0, ?)",
        )
        .bind(Uuid::new_v4().to_string())
        .bind(&club_id)
        .bind(&e.definition_id)
        .bind(&now)
        .execute(&mut *tx)
        .await
        .with_context(|| format!("insert entitlement {}", e.definition_id))?;
    }
    let mut squad_slots = 0usize;
    if let Some(sq) = &req.squad {
        let squad_id = Uuid::new_v4().to_string();
        sqlx::query(
            "INSERT INTO squads (id, club_id, name, formation, created_at, updated_at) \
             VALUES (?, ?, ?, ?, ?, ?)",
        )
        .bind(&squad_id)
        .bind(&club_id)
        .bind(&sq.name)
        .bind(&sq.formation)
        .bind(&now)
        .bind(&now)
        .execute(&mut *tx)
        .await
        .context("insert squad")?;
        for slot in &sq.slots {
            sqlx::query(
                "INSERT INTO squad_players (id, squad_id, owned_card_id, position_index, is_captain, is_on_bench) \
                 VALUES (?, ?, ?, ?, ?, ?)",
            )
            .bind(Uuid::new_v4().to_string())
            .bind(&squad_id)
            .bind(&slot.owned_item_id)
            .bind(slot.position_index)
            .bind(slot.is_captain)
            .bind(slot.is_on_bench)
            .execute(&mut *tx)
            .await
            .context("insert squad_player")?;
        }
        squad_slots = sq.slots.len();
        // Core computes the canonical fingerprint over the COMMITTED squad — never
        // an adapter-supplied value — and persists the opaque extension atomically
        // in the same tx, exactly as the live squad-write path does.
        let canonical_fingerprint = squad_fingerprint(
            &squad_id,
            &sq.formation,
            sq.slots.iter().map(|s| {
                (
                    s.position_index,
                    s.owned_item_id.as_str(),
                    s.is_captain,
                    s.is_on_bench,
                )
            }),
        );
        sqlx::query(
            "INSERT OR REPLACE INTO game_entity_ext \
             (game_id, entity_kind, entity_id, namespace, schema_version, canonical_fingerprint, payload, updated_at) \
             VALUES (?, 'squad', ?, ?, ?, ?, ?, ?)",
        )
        .bind(&req.profile.game_id)
        .bind(&squad_id)
        .bind(&sq.extension.namespace)
        .bind(sq.extension.schema_version)
        .bind(&canonical_fingerprint)
        .bind(&sq.extension.payload)
        .bind(&now)
        .execute(&mut *tx)
        .await
        .context("insert game_entity_ext")?;
    }
    tx.commit().await?;
    Ok(ImportOutcome::Imported {
        owned: req.owned.len(),
        squad_slots,
    })
 }
 /// One adapter-supplied classification: "every owned row of this definition is
 /// really this kind of content".
 #[derive(Debug, Clone, Deserialize)]
 pub struct ContentKindAssignment {
    pub card_id: String,
    pub content_kind: ContentKind,
 }
 /// Request for [`reclassify_owned_content`].
 #[derive(Debug, Clone, Deserialize)]
 pub struct ReclassifyRequest {
    pub game_id: String,
    pub assignments: Vec<ContentKindAssignment>,
    /// Compute the outcome and roll back instead of committing. Lets an operator
    /// see exactly what a production run would touch before it touches it.
    #[serde(default)]
    pub dry_run: bool,
 }
 #[derive(Debug, Serialize, PartialEq, Eq)]
 pub struct ReclassifyOutcome {
    /// Rows whose `content_kind` actually changed. On a dry run, the rows that
    /// WOULD change; nothing is committed.
    pub updated: usize,
    /// Rows already carrying the requested kind (a rerun updates nothing).
    pub unchanged: usize,
    /// Assignments naming a definition this game owns no copy of.
    pub unmatched_definitions: Vec<String>,
    /// True when the transaction was rolled back rather than committed.
    pub dry_run: bool,
    /// Per-kind tally of the rows that changed, so an operator can sanity-check
    /// the shape of the change ("3 staff, 17 consumable") before committing.
    pub updated_by_kind: BTreeMap<String, usize>,
 }
 /// Correct the `content_kind` of ALREADY-IMPORTED owned rows, in one transaction.
 ///
 /// A profile import is once-only (same fingerprint no-ops, a different one is
 /// refused), so a taxonomy fix cannot arrive by re-importing. Core defaults an
 /// unstated row to `player`, which means every pre-taxonomy import durably
 /// recorded coaches, kits and consumables as players — wrong in the ownership
 /// authority even where a catalog-driven wire looked right.
 ///
 /// Core stays generic: the caller supplies `card_id -> kind`, because only the
 /// game adapter can map its own taxonomy. Idempotent, and scoped to one game's
 /// clubs so a shared database cannot be reclassified across games.
 pub async fn reclassify_owned_content(
    pool: &Pool,
    req: &ReclassifyRequest,
 ) -> Result<ReclassifyOutcome> {
    if req.assignments.is_empty() {
        bail!("reclassify request has zero assignments");
    }
    let mut tx = pool.begin().await?;
    let mut updated = 0usize;
    let mut unchanged = 0usize;
    let mut unmatched = Vec::new();
    let mut by_kind: BTreeMap<String, usize> = BTreeMap::new();
    for a in &req.assignments {
        // Scope by game through the owning club, so the same definition id in
        // another game is never touched.
        let present: i64 = sqlx::query_scalar(
            "SELECT COUNT(*) FROM owned_cards o JOIN clubs c ON c.id = o.club_id \
             JOIN profiles p ON p.id = c.profile_id \
             WHERE p.game_id = ? AND o.card_id = ?",
        )
        .bind(&req.game_id)
        .bind(&a.card_id)
        .fetch_one(&mut *tx)
        .await
        .context("count owned rows for definition")?;
        if present == 0 {
            unmatched.push(a.card_id.clone());
            continue;
        }
        let changed = sqlx::query(
            "UPDATE owned_cards SET content_kind = ? \
             WHERE card_id = ? AND content_kind != ? AND club_id IN \
             (SELECT c.id FROM clubs c JOIN profiles p ON p.id = c.profile_id \
              WHERE p.game_id = ?)",
        )
        .bind(a.content_kind.as_str())
        .bind(&a.card_id)
        .bind(a.content_kind.as_str())
        .bind(&req.game_id)
        .execute(&mut *tx)
        .await
        .context("update owned content_kind")?
        .rows_affected() as usize;
        updated += changed;
        unchanged += present as usize - changed;
        if changed > 0 {
            *by_kind
                .entry(a.content_kind.as_str().to_string())
                .or_default() += changed;
        }
    }
    // A dry run does the real UPDATEs and then throws them away, so the counts
    // it reports are measured rather than predicted — the same statements, the
    // same WHERE clauses, just no commit.
    if req.dry_run {
        tx.rollback().await?;
    } else {
        tx.commit().await?;
    }
    Ok(ReclassifyOutcome {
        updated,
        unchanged,
        unmatched_definitions: unmatched,
        dry_run: req.dry_run,
        updated_by_kind: by_kind,
    })
 }
@@ -15,7 +15,7 @@
 use serde::Deserialize;
-use crate::models::card::{ContentKind, Quality};
+use crate::models::card::Quality;
 /// Semantic owned-inventory query. All values are game-independent: a quality
 /// tier, entity **names** (not ids), and semantic offset/limit. Every filter is
@@ -25,9 +25,6 @@ pub struct OwnedItemQuery {
    /// Quality tier (gold/silver/bronze). Serialized lowercase.
    #[serde(default)]
    pub quality: Option<Quality>,
    /// Owned-content kind (player/consumable/kit/…). Serialized lowercase.
    #[serde(default)]
    pub content_kind: Option<ContentKind>,
    /// Playing position, e.g. "ST" (matched case-insensitively).
    #[serde(default)]
    pub position: Option<String>,
@@ -50,12 +47,8 @@ pub struct OwnedItemQuery {
 /// One owned item projected to the attributes needed for querying, plus the
 /// response body to hand back verbatim once it survives the filter+page.
 #[derive(Clone)]
 pub struct OwnedItemView {
    pub owned_card_id: String,
    /// What kind of content this instance is; lets a caller filter without
    /// re-deriving the taxonomy from definition fields.
    pub content_kind: ContentKind,
    /// Base card overall (drives quality tier).
    pub base_overall: u8,
    /// Effective overall (base + training bonus); drives ordering.
@@ -85,10 +78,6 @@ pub struct QueryPage {
 /// Does an item satisfy every present filter (AND semantics)?
 fn matches(item: &OwnedItemView, q: &OwnedItemQuery) -> bool {
    let quality_ok = q.quality.map(|want| item.quality() == want).unwrap_or(true);
    let kind_ok = q
        .content_kind
        .map(|want| item.content_kind == want)
        .unwrap_or(true);
    let pos_ok = q
        .position
        .as_ref()
@@ -109,7 +98,7 @@ fn matches(item: &OwnedItemView, q: &OwnedItemQuery) -> bool {
        .as_ref()
        .map(|c| item.club.eq_ignore_ascii_case(c))
        .unwrap_or(true);
-    quality_ok && kind_ok && pos_ok && nation_ok && league_ok && club_ok
+    quality_ok && pos_ok && nation_ok && league_ok && club_ok
 }
 /// Apply the query: filter (AND) → deterministic order → paginate.
@@ -163,7 +152,6 @@ mod tests {
    ) -> OwnedItemView {
        OwnedItemView {
            owned_card_id: id.to_string(),
            content_kind: ContentKind::Player,
            base_overall: overall,
            effective_overall: overall as i64,
            position: position.to_string(),
@@ -191,52 +179,6 @@ mod tests {
        ]
    }
    /// A club holds mixed content; a caller asking for one kind must get exactly
    /// that kind, and the unfiltered read must still return everything.
    #[test]
    fn content_kind_filters_mixed_inventory() {
        let mut items = fixture();
        let mut kit = view("k", 0, "", "", "", "");
        kit.content_kind = ContentKind::Kit;
        let mut style = view("s", 0, "", "", "", "");
        style.content_kind = ContentKind::Consumable;
        items.push(kit);
        items.push(style);
        let all = apply_query(items.clone(), &OwnedItemQuery::default());
        assert_eq!(all.total, 7, "no filter returns every kind");
        let kits = apply_query(
            items.clone(),
            &OwnedItemQuery {
                content_kind: Some(ContentKind::Kit),
                ..Default::default()
            },
        );
        assert_eq!(ids(&kits), ["k"]);
        let players = apply_query(
            items.clone(),
            &OwnedItemQuery {
                content_kind: Some(ContentKind::Player),
                ..Default::default()
            },
        );
        assert_eq!(players.total, 5);
        let none = apply_query(
            items,
            &OwnedItemQuery {
                content_kind: Some(ContentKind::Stadium),
                ..Default::default()
            },
        );
        assert_eq!(
            none.total, 0,
            "a kind the club owns none of is empty, not everything"
        );
    }
    #[test]
    fn no_filter_returns_all_in_overall_desc_order() {
        let p = apply_query(fixture(), &OwnedItemQuery::default());
@@ -43,12 +43,11 @@ pub async fn refresh_npc_listings(
    card_db: &CardDb,
    event_defs: &[EventDefinition],
 ) -> AppResult<usize> {
-    // Clean up expired listings and previous NPC listings.
+    // Clean up expired and unsold listings
    // Player-posted listings (is_npc = 0) are intentionally preserved.
    sqlx::query("DELETE FROM market_listings WHERE expires_at < datetime('now')")
        .execute(pool)
        .await?;
-    sqlx::query("DELETE FROM market_listings WHERE sold = 0 AND is_npc = 1")
+    sqlx::query("DELETE FROM market_listings WHERE sold = 0")
        .execute(pool)
        .await?;
@@ -108,8 +107,8 @@ pub async fn refresh_npc_listings(
    for listing in &listings_to_insert {
        sqlx::query(
            "INSERT INTO market_listings \
-             (id, card_id, seller_name, price, listed_at, expires_at, sold, is_npc) \
+             (id, card_id, seller_name, price, listed_at, expires_at, sold) \
-             VALUES (?, ?, ?, ?, ?, ?, 0, 1)",
+             VALUES (?, ?, ?, ?, ?, ?, 0)",
        )
        .bind(&listing.id)
        .bind(&listing.card_id)
@@ -141,25 +140,12 @@ pub async fn buy_listing(
    .await?
    .ok_or_else(|| AppError::NotFound("listing not found or already sold".into()))?;
-    // Atomically claim the listing (flip sold 0->1) before charging, so two concurrent
+    club::spend_coins(pool, club_id, listing.price).await?;
-    // buyers cannot both mint the same card. If the debit then fails, release the claim.
+
-    let claimed = sqlx::query("UPDATE market_listings SET sold = 1 WHERE id = ? AND sold = 0")
+    sqlx::query("UPDATE market_listings SET sold = 1 WHERE id = ?")
        .bind(&listing.id)
        .execute(pool)
-        .await?
+        .await?;
        .rows_affected();
    if claimed == 0 {
        return Err(AppError::NotFound(
            "listing not found or already sold".into(),
        ));
    }
    if let Err(e) = club::spend_coins(pool, club_id, listing.price).await {
        let _ = sqlx::query("UPDATE market_listings SET sold = 0 WHERE id = ?")
            .bind(&listing.id)
            .execute(pool)
            .await;
        return Err(e);
    }
    let owned_id = Uuid::new_v4().to_string();
    sqlx::query(
@@ -204,31 +190,21 @@ pub async fn sell_card(
    club_id: &str,
    req: &SellCardRequest,
 ) -> AppResult<i64> {
-    if req.price < 0 {
+    let owned = sqlx::query_as::<_, crate::models::card::OwnedCard>(
-        return Err(AppError::BadRequest("price must be non-negative".into()));
+        "SELECT id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at, \
-    }
+         chemistry_style, position_override, training_bonus \
-
+         FROM owned_cards WHERE id = ? AND club_id = ?",
-    let owned = sqlx::query_as::<_, crate::models::card::OwnedCard>(&format!(
+    )
        "{} WHERE id = ? AND club_id = ?",
        crate::models::card::OWNED_CARD_SELECT
    ))
    .bind(&req.owned_card_id)
    .bind(club_id)
    .fetch_optional(pool)
    .await?
    .ok_or_else(|| AppError::NotFound("owned card not found".into()))?;
-    // Atomically claim the card: guard the DELETE with the owner + rows_affected so two
+    sqlx::query("DELETE FROM owned_cards WHERE id = ?")
    // concurrent sells of the same card cannot both credit (double payout).
    let deleted = sqlx::query("DELETE FROM owned_cards WHERE id = ? AND club_id = ?")
        .bind(&req.owned_card_id)
        .bind(club_id)
        .execute(pool)
-        .await?
+        .await?;
        .rows_affected();
    if deleted == 0 {
        return Err(AppError::NotFound("owned card not found".into()));
    }
    let coins = (req.price as f64 * 0.4) as i64;
    let new_balance = club::add_coins(pool, club_id, coins).await?;
@@ -2,14 +2,9 @@ pub mod achievement;
 pub mod card_db;
 pub mod checkin;
 pub mod club;
 pub mod consume;
 pub mod draft;
 pub mod economy;
 pub mod event;
 pub mod fut_champs;
 pub mod game_ext;
 pub mod import;
 pub mod instance_effect;
 pub mod inventory;
 pub mod market;
 pub mod match_service;
@@ -23,5 +18,4 @@ pub mod settings;
 pub mod squad;
 pub mod squad_rules;
 pub mod statistics;
 pub mod training;
 pub mod upgrades;
@@ -6,7 +6,6 @@ use crate::{
    },
 };
 use anyhow::Context;
 use sqlx::{Sqlite, Transaction};
 use std::path::Path;
 use uuid::Uuid;
@@ -68,7 +67,10 @@ pub async fn increment_metric(
 ) -> AppResult<Vec<String>> {
    let mut completed_ids = Vec::new();
-    for def in defs.iter().filter(|d| d.metric.as_str() == metric) {
+    for def in defs
        .iter()
        .filter(|d| format!("{:?}", d.metric).to_lowercase() == metric)
    {
        let existing = sqlx::query_as::<_, ObjectiveProgress>(
            "SELECT id, profile_id, objective_id, current, completed, claimed, updated_at FROM objective_progress WHERE profile_id = ? AND objective_id = ?"
        )
@@ -121,72 +123,6 @@ pub async fn increment_metric(
    Ok(completed_ids)
 }
 /// Transaction-scoped [`increment_metric`] for the atomic match-completion path.
 /// Same semantics, but every read/write runs inside the caller's transaction so
 /// objective progress commits (or rolls back) together with the coins, XP, and
 /// statistics of the same match. `now` is threaded so one match stamps a single
 /// timestamp.
 pub async fn increment_metric_tx(
    tx: &mut Transaction<'_, Sqlite>,
    profile_id: &str,
    defs: &[ObjectiveDefinition],
    metric: &str,
    amount: i64,
    now: &str,
 ) -> AppResult<Vec<String>> {
    let mut completed_ids = Vec::new();
    for def in defs.iter().filter(|d| d.metric.as_str() == metric) {
        let existing = sqlx::query_as::<_, ObjectiveProgress>(
            "SELECT id, profile_id, objective_id, current, completed, claimed, updated_at FROM objective_progress WHERE profile_id = ? AND objective_id = ?"
        )
        .bind(profile_id)
        .bind(&def.id)
        .fetch_optional(&mut **tx)
        .await?;
        if let Some(prog) = existing {
            if prog.completed {
                continue;
            }
            let new_val = (prog.current + amount).min(def.target);
            let now_complete = new_val >= def.target;
            sqlx::query(
                "UPDATE objective_progress SET current = ?, completed = ?, updated_at = ? WHERE id = ?"
            )
            .bind(new_val)
            .bind(now_complete)
            .bind(now)
            .bind(&prog.id)
            .execute(&mut **tx)
            .await?;
            if now_complete {
                completed_ids.push(def.id.clone());
            }
        } else {
            let new_val = amount.min(def.target);
            let now_complete = new_val >= def.target;
            let id = Uuid::new_v4().to_string();
            sqlx::query(
                "INSERT INTO objective_progress (id, profile_id, objective_id, current, completed, claimed, updated_at) VALUES (?, ?, ?, ?, ?, 0, ?)"
            )
            .bind(&id)
            .bind(profile_id)
            .bind(&def.id)
            .bind(new_val)
            .bind(now_complete)
            .bind(now)
            .execute(&mut **tx)
            .await?;
            if now_complete {
                completed_ids.push(def.id.clone());
            }
        }
    }
    Ok(completed_ids)
 }
 pub async fn claim_objective(
    pool: &Pool,
    profile_id: &str,
@@ -71,16 +71,7 @@ pub async fn open_pack(
    .await?
    .ok_or_else(|| AppError::NotFound(format!("pack {pack_id} not found")))?;
-    // Atomically claim the pack before minting any cards: only one concurrent opener
+    if pack.opened {
    // flips opened 0->1, so a double-open cannot mint the reward twice (duplication).
    let claimed =
        sqlx::query("UPDATE packs SET opened = 1 WHERE id = ? AND club_id = ? AND opened = 0")
            .bind(pack_id)
            .bind(club_id)
            .execute(pool)
            .await?
            .rows_affected();
    if claimed == 0 {
        return Err(AppError::BadRequest("pack already opened".into()));
    }
@@ -99,8 +90,8 @@ pub async fn open_pack(
                .all()
                .into_iter()
                .filter(|c| {
-                    let r = c.rarity.as_str();
+                    let r = format!("{:?}", c.rarity).to_lowercase();
-                    rarities.contains(&r.to_string())
+                    rarities.contains(&r)
                })
                .cloned()
                .collect()
@@ -137,7 +128,7 @@ pub async fn open_pack(
        serde_json::to_string(&cards.iter().map(|c| &c.id).collect::<Vec<_>>()).unwrap_or_default();
    let now = chrono::Utc::now().to_rfc3339();
-    sqlx::query("UPDATE packs SET opened_cards = ?, opened_at = ? WHERE id = ?")
+    sqlx::query("UPDATE packs SET opened = 1, opened_cards = ?, opened_at = ? WHERE id = ?")
        .bind(&card_ids_json)
        .bind(&now)
        .bind(pack_id)
@@ -5,41 +5,33 @@ use crate::{
 };
 use chrono::Utc;
-/// Fetch the active profile for a game. Single-profile-per-game: there is exactly
+pub async fn get_active_profile(pool: &Pool) -> AppResult<Profile> {
 /// one profile row per `game_id`, so we take the earliest for that game.
 pub async fn get_active_profile(pool: &Pool, game_id: &str) -> AppResult<Profile> {
    sqlx::query_as::<_, Profile>(
-        "SELECT id, username, level, xp, game_id, created_at, updated_at \
+        "SELECT id, username, level, xp, created_at, updated_at FROM profiles ORDER BY created_at ASC LIMIT 1"
         FROM profiles WHERE game_id = ? ORDER BY created_at ASC LIMIT 1",
    )
    .bind(game_id)
    .fetch_optional(pool)
    .await?
    .ok_or_else(|| AppError::NotFound("no profile exists; call POST /auth/local first".into()))
 }
-pub async fn create_profile(pool: &Pool, username: &str, game_id: &str) -> AppResult<Profile> {
+pub async fn create_profile(pool: &Pool, username: &str) -> AppResult<Profile> {
-    // Single-player per game: one profile per game_id, not one globally.
+    let existing = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM profiles")
    let existing = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM profiles WHERE game_id = ?")
        .bind(game_id)
        .fetch_one(pool)
        .await?;
    if existing > 0 {
        return Err(AppError::Conflict(
-            "a profile already exists for this game; OpenFUT is single-player per game".into(),
+            "a profile already exists; OpenFUT is single-player only".into(),
        ));
    }
-    let profile = Profile::new(username, game_id);
+    let profile = Profile::new(username);
    sqlx::query(
-        "INSERT INTO profiles (id, username, level, xp, game_id, created_at, updated_at) \
+        "INSERT INTO profiles (id, username, level, xp, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)"
         VALUES (?, ?, ?, ?, ?, ?, ?)",
    )
    .bind(&profile.id)
    .bind(&profile.username)
    .bind(profile.level)
    .bind(profile.xp)
    .bind(&profile.game_id)
    .bind(profile.created_at)
    .bind(profile.updated_at)
    .execute(pool)
@@ -67,13 +59,7 @@ pub async fn add_xp_with_levelup(
    club_id: &str,
    xp_to_add: i64,
 ) -> AppResult<Vec<LevelUpEvent>> {
-    let profile = sqlx::query_as::<_, Profile>(
+    let profile = get_active_profile(pool).await?;
        "SELECT id, username, level, xp, game_id, created_at, updated_at FROM profiles WHERE id = ?",
    )
    .bind(profile_id)
    .fetch_optional(pool)
    .await?
    .ok_or_else(|| AppError::NotFound(format!("profile '{profile_id}' not found")))?;
    let old_level = level_for_xp(profile.xp);
    let new_total_xp = profile.xp + xp_to_add;
    let new_level = level_for_xp(new_total_xp);
@@ -1,9 +1,9 @@
 use crate::{
    db::Pool,
-    error::{AppError, AppResult},
+    error::AppResult,
    models::season::{Season, SeasonEndSummary, SeasonHistoryEntry, SeasonResult},
    services::{club, pack},
 };
 use sqlx::{Sqlite, Transaction};
 use uuid::Uuid;
 /// Get the current season for a profile, creating it if it doesn't exist.
@@ -20,11 +20,7 @@ pub async fn get_or_create(pool: &Pool, profile_id: &str) -> AppResult<Season> {
    .bind(&now)
    .execute(pool)
    .await?;
-    fetch(pool, profile_id).await?.ok_or_else(|| {
+    Ok(fetch(pool, profile_id).await?.expect("just inserted"))
        AppError::Internal(anyhow::anyhow!(
            "season row missing immediately after insert"
        ))
    })
 }
 async fn fetch(pool: &Pool, profile_id: &str) -> AppResult<Option<Season>> {
@@ -38,34 +34,21 @@ async fn fetch(pool: &Pool, profile_id: &str) -> AppResult<Option<Season>> {
    Ok(s)
 }
-/// Record a match in Core's season model inside the caller's transaction,
+/// Record a match result in the season; end the season if the quota is met.
 /// ending the season when the quota is met.
 ///
-/// Mirrors [`record_match`] but every write — the season row, the rollover, the
+/// Returns the updated season and an optional end-of-season summary.
-/// end-of-season coin and pack award, and the history entry — commits or rolls
+pub async fn record_match(
-/// back with the match that caused it. Creates the season row if absent, so a
+    pool: &Pool,
 /// first match does not need a separate call.
 pub async fn record_match_tx(
    tx: &mut Transaction<'_, Sqlite>,
    club_id: &str,
    profile_id: &str,
    outcome: &str,
-    now: &str,
+) -> AppResult<(Season, Option<SeasonEndSummary>)> {
 ) -> AppResult<Option<SeasonEndSummary>> {
    sqlx::query(
        "INSERT OR IGNORE INTO seasons (profile_id, division, season_number, season_points, \
         matches_played, wins, draws, losses, started_at) VALUES (?, 5, 1, 0, 0, 0, 0, 0, ?)",
    )
    .bind(profile_id)
    .bind(now)
    .execute(&mut **tx)
    .await?;
    let points = match outcome {
        "win" => 3,
        "draw" => 1,
        _ => 0,
    };
    sqlx::query(
        "UPDATE seasons SET \
            season_points  = season_points + ?, \
@@ -80,28 +63,28 @@ pub async fn record_match_tx(
    .bind(outcome)
    .bind(outcome)
    .bind(profile_id)
-    .execute(&mut **tx)
+    .execute(pool)
    .await?;
-    let season = fetch_tx(tx, profile_id).await?.ok_or_else(|| {
+    let season = fetch(pool, profile_id).await?.expect("season must exist");
-        AppError::Internal(anyhow::anyhow!(
+
            "season row missing after record_match_tx update"
        ))
    })?;
    if !season.is_complete() {
-        return Ok(None);
+        return Ok((season, None));
    }
    // Season complete — calculate result and start next
    let result = season.end_result();
    let old_div = season.division;
    let coins = season.season_reward_coins();
    let pack_id = season.season_reward_pack();
    let new_div = match result {
        SeasonResult::Promoted => (old_div - 1).max(1),
        SeasonResult::Relegated => (old_div + 1).min(10),
        SeasonResult::Maintained => old_div,
    };
    let new_season = season.season_number + 1;
    let now = chrono::Utc::now().to_rfc3339();
    sqlx::query(
        "UPDATE seasons SET division = ?, season_number = ?, season_points = 0, \
@@ -110,46 +93,33 @@ pub async fn record_match_tx(
    )
    .bind(new_div)
    .bind(new_season)
-    .bind(now)
+    .bind(&now)
    .bind(profile_id)
-    .execute(&mut **tx)
+    .execute(pool)
    .await?;
-    if coins > 0 {
+    // Grant rewards
-        let credited =
+    club::add_coins(pool, club_id, coins).await?;
            sqlx::query("UPDATE clubs SET coins = coins + ?, updated_at = ? WHERE id = ?")
                .bind(coins)
                .bind(now)
                .bind(club_id)
                .execute(&mut **tx)
                .await?;
        if credited.rows_affected() != 1 {
            return Err(AppError::NotFound("club not found".into()));
        }
    }
    if let Some(pack_def) = pack_id {
-        sqlx::query(
+        let dummy_pack_id = Uuid::new_v4().to_string();
-            "INSERT INTO packs (id, club_id, definition_id, opened, created_at) VALUES (?, ?, ?, 0, ?)",
+        // Grant via pack system so it shows in inventory
-        )
+        let _ = dummy_pack_id; // will use grant_pack instead
-        .bind(Uuid::new_v4().to_string())
+        pack::grant_pack(pool, club_id, pack_def).await?;
        .bind(club_id)
        .bind(pack_def)
        .bind(now)
        .execute(&mut **tx)
        .await?;
    }
    // Persist history entry before rolling over
    let result_str = match result {
        SeasonResult::Promoted => "promoted",
        SeasonResult::Maintained => "maintained",
        SeasonResult::Relegated => "relegated",
    };
-    sqlx::query(
+    let history_id = Uuid::new_v4().to_string();
    let _ = sqlx::query(
        "INSERT INTO season_history (id, profile_id, season_number, division, season_points, \
         wins, draws, losses, result, new_division, coins_awarded, pack_awarded, ended_at) \
         VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)",
    )
-    .bind(Uuid::new_v4().to_string())
+    .bind(&history_id)
    .bind(profile_id)
    .bind(season.season_number)
    .bind(old_div)
@@ -161,28 +131,21 @@ pub async fn record_match_tx(
    .bind(new_div)
    .bind(coins)
    .bind(pack_id)
-    .bind(now)
+    .bind(&now)
-    .execute(&mut **tx)
+    .execute(pool)
-    .await?;
+    .await;
-    Ok(Some(SeasonEndSummary {
+    let summary = SeasonEndSummary {
        result,
        old_division: old_div,
        new_division: new_div,
        new_season_number: new_season,
        coins_awarded: coins,
        pack_awarded: pack_id.map(String::from),
-    }))
+    };
 }
-async fn fetch_tx(tx: &mut Transaction<'_, Sqlite>, profile_id: &str) -> AppResult<Option<Season>> {
+    let updated = fetch(pool, profile_id).await?.expect("season must exist");
-    Ok(sqlx::query_as::<_, Season>(
+    Ok((updated, Some(summary)))
        "SELECT profile_id, division, season_number, season_points, matches_played, \
         wins, draws, losses, started_at FROM seasons WHERE profile_id = ?",
    )
    .bind(profile_id)
    .fetch_optional(&mut **tx)
    .await?)
 }
 /// Return past seasons for a profile, newest first (max 20).
@@ -2,8 +2,7 @@ use crate::{
    db::Pool,
    error::{AppError, AppResult},
    models::{
-        card::{CardDefinition, OwnedCard, OWNED_CARD_SELECT},
+        card::{CardDefinition, OwnedCard},
        game_ext::{GameEntityExt, OpaqueExtensionWrite},
        squad::{
            SaveSquadRequest, SlotAssignment, Squad, SquadPlayer, SquadPlayerInput, SquadReplaced,
            SquadReplacement,
@@ -11,7 +10,6 @@ use crate::{
    },
    services::{
        card_db::CardDb,
        game_ext,
        squad_rules::{
            ClientReportedEvaluation, DefaultSquadRules, SquadPlayerCard, SquadRules, SquadSnapshot,
        },
@@ -74,7 +72,6 @@ async fn get_players(pool: &Pool, squad_id: &str) -> AppResult<Vec<SquadPlayer>>
 pub async fn validate_formation(
    pool: &Pool,
    card_db: &CardDb,
    club_id: &str,
    players: &[SquadPlayerInput],
 ) -> AppResult<()> {
    let starters: Vec<&SquadPlayerInput> = players.iter().filter(|p| !p.is_on_bench).collect();
@@ -88,19 +85,13 @@ pub async fn validate_formation(
    let mut gk_count = 0usize;
    for sp in &starters {
-        let owned = sqlx::query_as::<_, OwnedCard>(&format!(
+        let owned = sqlx::query_as::<_, OwnedCard>(
-            "{OWNED_CARD_SELECT} WHERE id = ? AND club_id = ?"
+            "SELECT id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at, chemistry_style, position_override, training_bonus FROM owned_cards WHERE id = ?",
-        ))
+        )
        .bind(&sp.owned_card_id)
        .bind(club_id)
        .fetch_optional(pool)
        .await?
-        .ok_or_else(|| {
+        .ok_or_else(|| AppError::NotFound(format!("owned card {} not found", sp.owned_card_id)))?;
            AppError::NotFound(format!(
                "owned card {} not found or does not belong to this club",
                sp.owned_card_id
            ))
        })?;
        if let Some(card) = card_db.get(&owned.card_id) {
            if card.position == "GK" {
@@ -142,10 +133,13 @@ pub async fn calculate_chemistry(
    // Load all starter card definitions (N separate queries, fine for 11 players)
    let mut player_cards: Vec<(String, CardDefinition)> = Vec::new();
    for sp in &starters {
-        let owned = sqlx::query_as::<_, OwnedCard>(&format!("{OWNED_CARD_SELECT} WHERE id = ?"))
+        let owned = sqlx::query_as::<_, OwnedCard>(
-            .bind(&sp.owned_card_id)
+            "SELECT id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at \
-            .fetch_optional(pool)
+             FROM owned_cards WHERE id = ?",
-            .await?;
+        )
        .bind(&sp.owned_card_id)
        .fetch_optional(pool)
        .await?;
        if let Some(o) = owned {
            if let Some(card) = card_db.get(&o.card_id) {
@@ -226,23 +220,15 @@ pub async fn calculate_chemistry(
 /// Validation happens BEFORE any write, so a rejected replacement leaves the
 /// existing squad exactly as it was. Everything that does write happens inside
 /// one transaction.
-#[allow(clippy::too_many_arguments)]
+pub async fn replace_squad(
 async fn replace_squad_inner(
    pool: &Pool,
    card_db: &CardDb,
    rules: &dyn SquadRules,
    game_id: Option<&str>,
    club_id: &str,
    squad_id: Option<&str>,
    replacement: &SquadReplacement,
    client_reported: &ClientReportedEvaluation,
    ext: Option<&OpaqueExtensionWrite>,
 ) -> AppResult<SquadReplaced> {
    // Generic bounds on the opaque extension, before any write (fail fast, no
    // partial state). Core guards size only — the adapter owns payload meaning.
    if let Some(ext) = ext {
        ext.validate().map_err(AppError::BadRequest)?;
    }
    // ── validate before touching anything ────────────────────────────────
    let mut seen: HashSet<&str> = HashSet::new();
    let mut slots_seen: HashSet<i64> = HashSet::new();
@@ -272,13 +258,13 @@ async fn replace_squad_inner(
    // though it did.
    let mut resolved: Vec<(SlotAssignmentRef, OwnedCard)> = Vec::new();
    for s in &replacement.slots {
-        let owned = sqlx::query_as::<_, OwnedCard>(&format!("{OWNED_CARD_SELECT} WHERE id = ?"))
+        let owned = sqlx::query_as::<_, OwnedCard>(
-            .bind(&s.owned_card_id)
+            "SELECT id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at, chemistry_style, position_override, training_bonus FROM owned_cards WHERE id = ?",
-            .fetch_optional(pool)
+        )
-            .await?
+        .bind(&s.owned_card_id)
-            .ok_or_else(|| {
+        .fetch_optional(pool)
-                AppError::NotFound(format!("owned card {} not found", s.owned_card_id))
+        .await?
-            })?;
+        .ok_or_else(|| AppError::NotFound(format!("owned card {} not found", s.owned_card_id)))?;
        if owned.club_id != club_id {
            // Deliberately the same message as "not found": whether a card
@@ -371,35 +357,6 @@ async fn replace_squad_inner(
    .fetch_one(&mut *tx)
    .await?;
    // Fingerprint the COMMITTED canonical state (server-computed; never a
    // client/adapter value) and, atomically in this same tx, persist the opaque
    // game extension anchored to it. Canonical squad + extension commit together
    // or not at all — no split-brain, no distributed protocol.
    let canonical_fingerprint = squad_fingerprint(
        &squad_id,
        &squad.formation,
        resolved
            .iter()
            .map(|(s, o)| (s.slot, o.id.as_str(), s.is_captain, s.is_on_bench)),
    );
    if let Some(ext) = ext {
        let gid = game_id.expect("game_id is required whenever an extension is written");
        sqlx::query(
            "INSERT OR REPLACE INTO game_entity_ext \
             (game_id, entity_kind, entity_id, namespace, schema_version, canonical_fingerprint, payload, updated_at) \
             VALUES (?, 'squad', ?, ?, ?, ?, ?, ?)",
        )
        .bind(gid)
        .bind(&squad_id)
        .bind(&ext.namespace)
        .bind(ext.schema_version)
        .bind(&canonical_fingerprint)
        .bind(&ext.payload)
        .bind(&now)
        .execute(&mut *tx)
        .await?;
    }
    tx.commit().await?;
    // ── evaluate with the game's rules, never with the client's numbers ──
@@ -431,7 +388,6 @@ async fn replace_squad_inner(
        slots_written: resolved.len(),
        evaluation,
        client_disagreements,
        canonical_fingerprint,
    })
 }
@@ -441,125 +397,6 @@ struct SlotAssignmentRef {
    is_on_bench: bool,
 }
 /// Replace a squad's slots atomically (no game extension).
 pub async fn replace_squad(
    pool: &Pool,
    card_db: &CardDb,
    rules: &dyn SquadRules,
    club_id: &str,
    squad_id: Option<&str>,
    replacement: &SquadReplacement,
    client_reported: &ClientReportedEvaluation,
 ) -> AppResult<SquadReplaced> {
    replace_squad_inner(
        pool,
        card_db,
        rules,
        None,
        club_id,
        squad_id,
        replacement,
        client_reported,
        None,
    )
    .await
 }
 /// Replace a squad AND persist an opaque game extension in ONE transaction, so
 /// the canonical squad and its game-only round-trip state can never split-brain.
 /// The extension is anchored to the committed squad by a server-computed
 /// fingerprint; Core never interprets the payload.
 #[allow(clippy::too_many_arguments)]
 pub async fn replace_squad_with_extension(
    pool: &Pool,
    card_db: &CardDb,
    rules: &dyn SquadRules,
    game_id: &str,
    club_id: &str,
    squad_id: Option<&str>,
    replacement: &SquadReplacement,
    client_reported: &ClientReportedEvaluation,
    ext: &OpaqueExtensionWrite,
 ) -> AppResult<SquadReplaced> {
    replace_squad_inner(
        pool,
        card_db,
        rules,
        Some(game_id),
        club_id,
        squad_id,
        replacement,
        client_reported,
        Some(ext),
    )
    .await
 }
 /// Deterministic, order-stable fingerprint of a squad's canonical state. Server-
 /// computed; non-cryptographic (FNV-1a-64) — a stale-extension guard, not a
 /// security boundary. The encoding is sorted + delimited so it never depends on
 /// row/iteration order.
 pub(crate) fn squad_fingerprint<'a>(
    squad_id: &str,
    formation: &str,
    slots: impl Iterator<Item = (i64, &'a str, bool, bool)>,
 ) -> String {
    let mut items: Vec<String> = slots
        .map(|(slot, owned, cap, bench)| format!("{slot}:{owned}:{}:{}", cap as u8, bench as u8))
        .collect();
    items.sort();
    let canon = format!("v1|{squad_id}|{formation}|{}", items.join(";"));
    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
    for b in canon.as_bytes() {
        h ^= *b as u64;
        h = h.wrapping_mul(0x0000_0100_0000_01b3);
    }
    format!("{h:016x}")
 }
 /// Freshness of a squad's opaque extension vs the current canonical squad.
 pub enum SquadExtState {
    Fresh(GameEntityExt),
    Stale {
        stored: GameEntityExt,
        current_fingerprint: String,
    },
    Missing,
 }
 /// Read a club's active squad, its players, and its opaque game extension for
 /// `namespace`, with an explicit freshness verdict. NEVER silently projects a
 /// stale blob — the caller decides policy on `Stale`/`Missing`.
 pub async fn read_squad_with_ext(
    pool: &Pool,
    game_id: &str,
    club_id: &str,
    namespace: &str,
 ) -> AppResult<(Squad, Vec<SquadPlayer>, SquadExtState)> {
    let (squad, players) = get_squad(pool, club_id).await?;
    let current = squad_fingerprint(
        &squad.id,
        &squad.formation,
        players.iter().map(|p| {
            (
                p.position_index,
                p.owned_card_id.as_str(),
                p.is_captain,
                p.is_on_bench,
            )
        }),
    );
    let state = match game_ext::get_ext(pool, game_id, "squad", &squad.id, namespace).await? {
        None => SquadExtState::Missing,
        Some(row) if row.canonical_fingerprint == current => SquadExtState::Fresh(row),
        Some(row) => SquadExtState::Stale {
            stored: row,
            current_fingerprint: current,
        },
    };
    Ok((squad, players, state))
 }
 /// Compatibility wrapper over [`replace_squad`].
 ///
 /// Kept so the existing Core REST route keeps working, but it no longer has its
@@ -890,253 +727,4 @@ mod tests {
        );
        assert_eq!(out.evaluation.rules, "openfut-default-v2");
    }
    // ── opaque game-extension (co-located, single-transaction) ──────────────
    const NS: &str = "fifa17.squad.v1";
    fn ext(payload: &str) -> OpaqueExtensionWrite {
        OpaqueExtensionWrite {
            namespace: NS.into(),
            schema_version: 1,
            payload: payload.into(),
        }
    }
    async fn replace_ext(
        pool: &Pool,
        db: &CardDb,
        game: &str,
        club: &str,
        id: Option<&str>,
        slots: Vec<SlotAssignment>,
        payload: &str,
    ) -> AppResult<SquadReplaced> {
        replace_squad_with_extension(
            pool,
            db,
            &DefaultSquadRules,
            game,
            club,
            id,
            &SquadReplacement {
                name: Some("S".into()),
                formation: Some("4-4-2".into()),
                slots,
            },
            &ClientReportedEvaluation::default(),
            &ext(payload),
        )
        .await
    }
    #[tokio::test]
    async fn squad_and_extension_commit_atomically_and_read_fresh() {
        let (pool, db) = fixture().await;
        let out = replace_ext(
            &pool,
            &db,
            "fifa17",
            "club-a",
            None,
            vec![slot("card-1", 0)],
            "{\"custom\":[1,2,3]}",
        )
        .await
        .unwrap();
        assert!(!out.canonical_fingerprint.is_empty());
        let (_s, _p, state) = read_squad_with_ext(&pool, "fifa17", "club-a", NS)
            .await
            .unwrap();
        match state {
            SquadExtState::Fresh(row) => {
                assert_eq!(row.payload, "{\"custom\":[1,2,3]}");
                assert_eq!(row.schema_version, 1);
                assert_eq!(row.canonical_fingerprint, out.canonical_fingerprint);
            }
            _ => panic!("expected Fresh extension"),
        }
    }
    #[tokio::test]
    async fn oversized_extension_rejected_with_no_partial_write() {
        let (pool, db) = fixture().await;
        let big = "x".repeat(crate::models::game_ext::MAX_EXT_PAYLOAD_BYTES + 1);
        let err = replace_ext(
            &pool,
            &db,
            "fifa17",
            "club-a",
            None,
            vec![slot("card-1", 0)],
            &big,
        )
        .await;
        assert!(
            matches!(err, Err(AppError::BadRequest(_))),
            "oversized payload must be rejected"
        );
        // Fail-fast before the tx: no squad was created.
        let n: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM squads WHERE club_id = 'club-a'")
            .fetch_one(&pool)
            .await
            .unwrap();
        assert_eq!(n, 0, "rejected replacement leaves no partial squad");
        let e: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM game_entity_ext")
            .fetch_one(&pool)
            .await
            .unwrap();
        assert_eq!(e, 0, "no extension row written");
    }
    #[tokio::test]
    async fn fingerprint_is_deterministic_and_placement_sensitive() {
        let (pool, db) = fixture().await;
        let a = replace_ext(
            &pool,
            &db,
            "fifa17",
            "club-a",
            None,
            vec![slot("card-1", 0), slot("card-2", 1)],
            "p",
        )
        .await
        .unwrap();
        // Same placement again → identical fingerprint (idempotent, deterministic).
        let b = replace_ext(
            &pool,
            &db,
            "fifa17",
            "club-a",
            Some(&a.squad.id),
            vec![slot("card-1", 0), slot("card-2", 1)],
            "p",
        )
        .await
        .unwrap();
        assert_eq!(a.canonical_fingerprint, b.canonical_fingerprint);
        // Different placement (swap the two slots) → different fingerprint.
        let c = replace_ext(
            &pool,
            &db,
            "fifa17",
            "club-a",
            Some(&a.squad.id),
            vec![slot("card-1", 1), slot("card-2", 0)],
            "p",
        )
        .await
        .unwrap();
        assert_ne!(a.canonical_fingerprint, c.canonical_fingerprint);
    }
    #[tokio::test]
    async fn stale_extension_is_detected_never_silently_fresh() {
        let (pool, db) = fixture().await;
        let first = replace_ext(
            &pool,
            &db,
            "fifa17",
            "club-a",
            None,
            vec![slot("card-1", 0)],
            "p1",
        )
        .await
        .unwrap();
        // A later plain replace (no extension) changes the canonical squad.
        replace(
            &pool,
            &db,
            "club-a",
            Some(&first.squad.id),
            vec![slot("card-2", 0)],
        )
        .await
        .unwrap();
        let (_s, _p, state) = read_squad_with_ext(&pool, "fifa17", "club-a", NS)
            .await
            .unwrap();
        match state {
            SquadExtState::Stale {
                stored,
                current_fingerprint,
            } => {
                assert_eq!(stored.canonical_fingerprint, first.canonical_fingerprint);
                assert_ne!(current_fingerprint, first.canonical_fingerprint);
            }
            _ => panic!("expected Stale extension after canonical squad changed"),
        }
    }
    #[tokio::test]
    async fn idempotent_repeat_does_not_duplicate_extension() {
        let (pool, db) = fixture().await;
        let a = replace_ext(
            &pool,
            &db,
            "fifa17",
            "club-a",
            None,
            vec![slot("card-1", 0)],
            "same",
        )
        .await
        .unwrap();
        replace_ext(
            &pool,
            &db,
            "fifa17",
            "club-a",
            Some(&a.squad.id),
            vec![slot("card-1", 0)],
            "same",
        )
        .await
        .unwrap();
        let rows: i64 =
            sqlx::query_scalar("SELECT COUNT(*) FROM game_entity_ext WHERE entity_id = ?")
                .bind(&a.squad.id)
                .fetch_one(&pool)
                .await
                .unwrap();
        assert_eq!(rows, 1, "identical repeat converges on one extension row");
    }
    #[tokio::test]
    async fn extension_is_scoped_by_game_and_namespace() {
        let (pool, db) = fixture().await;
        let out = replace_ext(
            &pool,
            &db,
            "fifa17",
            "club-a",
            None,
            vec![slot("card-1", 0)],
            "p",
        )
        .await
        .unwrap();
        let sid = &out.squad.id;
        assert!(game_ext::get_ext(&pool, "fifa17", "squad", sid, NS)
            .await
            .unwrap()
            .is_some());
        assert!(
            game_ext::get_ext(&pool, "fifa17", "squad", sid, "other.ns")
                .await
                .unwrap()
                .is_none(),
            "wrong namespace"
        );
        assert!(
            game_ext::get_ext(&pool, "fifa23", "squad", sid, NS)
                .await
                .unwrap()
                .is_none(),
            "wrong game"
        );
    }
 }
@@ -1,7 +1,6 @@
 use crate::{db::Pool, error::AppResult, models::statistics::Statistics};
 use sqlx::{Sqlite, Transaction};
-const SELECT_STATS: &str = "SELECT profile_id, matches_played, matches_won, matches_drawn, matches_lost, matches_dnf, goals_scored, goals_conceded, packs_opened, sbcs_completed, total_coins_earned, win_streak, best_win_streak, updated_at FROM statistics WHERE profile_id = ?";
+const SELECT_STATS: &str = "SELECT profile_id, matches_played, matches_won, matches_drawn, matches_lost, goals_scored, goals_conceded, packs_opened, sbcs_completed, total_coins_earned, win_streak, best_win_streak, updated_at FROM statistics WHERE profile_id = ?";
 pub async fn get_or_create(pool: &Pool, profile_id: &str) -> AppResult<Statistics> {
    if let Some(s) = sqlx::query_as::<_, Statistics>(SELECT_STATS)
@@ -78,77 +77,6 @@ pub async fn record_match(
    Ok(())
 }
 /// Record a completed match within an existing transaction (the atomic
 /// match-completion path). `outcome` is `win` | `draw` | `loss` | `dnf`. A DNF
 /// (abandon/quit) increments its own bucket — never `matches_lost` — and, like a
 /// loss, resets the win streak. All-or-nothing with the caller's transaction; it
 /// never commits on its own, so a later failure rolls this back with everything
 /// else.
 pub async fn record_match_tx(
    tx: &mut Transaction<'_, Sqlite>,
    profile_id: &str,
    outcome: &str,
    goals_for: i64,
    goals_against: i64,
    coins: i64,
    now: &str,
 ) -> AppResult<()> {
    sqlx::query("INSERT OR IGNORE INTO statistics (profile_id, updated_at) VALUES (?, ?)")
        .bind(profile_id)
        .bind(now)
        .execute(&mut **tx)
        .await?;
    let current_streak: i64 =
        sqlx::query_scalar("SELECT win_streak FROM statistics WHERE profile_id = ?")
            .bind(profile_id)
            .fetch_one(&mut **tx)
            .await?;
    let (w, d, l, dnf) = match outcome {
        "win" => (1i64, 0i64, 0i64, 0i64),
        "draw" => (0, 1, 0, 0),
        "dnf" => (0, 0, 0, 1),
        _ => (0, 0, 1, 0),
    };
    let new_streak = if outcome == "win" {
        current_streak + 1
    } else {
        0
    };
    sqlx::query(
        "UPDATE statistics SET
            matches_played     = matches_played + 1,
            matches_won        = matches_won + ?,
            matches_drawn      = matches_drawn + ?,
            matches_lost       = matches_lost + ?,
            matches_dnf        = matches_dnf + ?,
            goals_scored       = goals_scored + ?,
            goals_conceded     = goals_conceded + ?,
            total_coins_earned = total_coins_earned + ?,
            win_streak         = ?,
            best_win_streak    = MAX(best_win_streak, ?),
            updated_at         = ?
         WHERE profile_id = ?",
    )
    .bind(w)
    .bind(d)
    .bind(l)
    .bind(dnf)
    .bind(goals_for)
    .bind(goals_against)
    .bind(coins)
    .bind(new_streak)
    .bind(new_streak)
    .bind(now)
    .bind(profile_id)
    .execute(&mut **tx)
    .await?;
    Ok(())
 }
 pub async fn increment_packs_opened(pool: &Pool, profile_id: &str) -> AppResult<()> {
    get_or_create(pool, profile_id).await?;
    let now = chrono::Utc::now().to_rfc3339();
@@ -193,26 +121,6 @@ pub async fn record_position_goals(
    Ok(())
 }
 /// Transaction-scoped [`record_position_goals`] for the atomic match-completion
 /// path.
 pub async fn record_position_goals_tx(
    tx: &mut Transaction<'_, Sqlite>,
    profile_id: &str,
    positions: &[String],
 ) -> AppResult<()> {
    for position in positions {
        sqlx::query(
            "INSERT INTO position_goals (profile_id, position, goals) VALUES (?, ?, 1) \
             ON CONFLICT(profile_id, position) DO UPDATE SET goals = goals + 1",
        )
        .bind(profile_id)
        .bind(position)
        .execute(&mut **tx)
        .await?;
    }
    Ok(())
 }
 pub async fn get_position_goals(pool: &Pool, profile_id: &str) -> AppResult<Vec<(String, i64)>> {
    let rows: Vec<(String, i64)> = sqlx::query_as(
        "SELECT position, goals FROM position_goals WHERE profile_id = ? ORDER BY goals DESC",
@@ -1,175 +0,0 @@
 //! Reading per-instance attribute training back out for projection.
 //!
 //! Writing is [`crate::services::instance_effect::InstanceEffect::ApplyTraining`],
 //! inside the one apply transaction. This module is the read half: it loads the
 //! effects a club's instances carry and folds them onto a definition's
 //! attributes.
 //!
 //! The fold lives in Core rather than in each game host on purpose. The stored
 //! effect names a SLOT in Core's own card model, so only Core knows which field
 //! slot 4 is; a host that did the arithmetic itself would have to re-derive that
 //! mapping and could disagree with the next host. Core answers with the finished
 //! numbers and the raw effects, and the host chooses which it needs.
 use std::collections::HashMap;
 use serde::Serialize;
 use sqlx::FromRow;
 use crate::{db::Pool, error::AppResult, models::card::CardDefinition};
 /// The upper bound of a FIFA-style attribute. Training is added to a value whose
 /// domain is 1..=99, so the fold clamps there.
 ///
 /// This is a DOMAIN invariant of the six-attribute card model, not a reversed
 /// training rule: whether FIFA 17 itself refuses to train a 95-pace player past
 /// 99, or clamps like this, or wraps, is UNKNOWN. Clamping is the only behaviour
 /// that keeps the projected card inside the model it is drawn from.
 pub const ATTRIBUTE_MAX: i64 = 99;
 /// The one training effect an instance may carry.
 ///
 /// At most one per instance: FIFA 17 allows "one attribute or all six" and a new
 /// card replaces the old, so a second concurrent effect is not representable.
 #[derive(Debug, Clone, Serialize, FromRow)]
 pub struct TrainingEffect {
    /// Slot in Core's six-attribute model, `CardDefinition` declaration order,
    /// or `None` for an effect that boosts ALL SIX slots.
    pub attribute_index: Option<i64>,
    pub amount: i64,
    pub source_card_id: String,
 }
 /// Every training effect held by the given club's instances, keyed by instance.
 ///
 /// One query for the whole club rather than one per item: the projection walks
 /// up to a couple of thousand owned rows, and a per-item lookup there is the
 /// classic N+1 that has bitten this projection before.
 pub async fn load_for_club(
    pool: &Pool,
    club_id: &str,
 ) -> AppResult<HashMap<String, TrainingEffect>> {
    let rows = sqlx::query_as::<_, (String, Option<i64>, i64, String)>(
        "SELECT t.owned_card_id, t.attribute_index, t.amount, t.source_card_id \
           FROM owned_card_training t \
           JOIN owned_cards o ON o.id = t.owned_card_id \
          WHERE o.club_id = ?",
    )
    .bind(club_id)
    .fetch_all(pool)
    .await?;
    Ok(rows
        .into_iter()
        .map(|(owned_card_id, attribute_index, amount, source_card_id)| {
            (
                owned_card_id,
                TrainingEffect {
                    attribute_index,
                    amount,
                    source_card_id,
                },
            )
        })
        .collect())
 }
 /// Consume the training effects of the instances that took the field, inside a
 /// caller-supplied transaction. Returns the instances actually cleared.
 ///
 /// FIFA 17 training is a ONE-MATCH effect: it "is reflected in the following
 /// match and expires after this", and a card applied to someone who stays on the
 /// bench or in the reserves "will continue to benefit from the training effect
 /// until he plays" (DOCUMENTED — fifauteam's contemporaneous FIFA 17 guide).
 /// So the trigger is the PLAYER PLAYING, not the match merely completing, and
 /// the caller must pass the instances that played — never a whole club.
 ///
 /// `club_id` is not redundant with the ids: it scopes the delete so a caller
 /// cannot expire another club's effects by guessing an instance id.
 ///
 /// Idempotent by construction. Deleting an already-absent row is a no-op, so a
 /// replayed match cannot "expire twice"; combined with the caller's
 /// `match_completions` uniqueness guard, the mutation happens exactly once and a
 /// replay is a silent no-op rather than a second effect.
 pub async fn expire_for_instances_tx(
    tx: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
    club_id: &str,
    instance_ids: &[String],
 ) -> AppResult<Vec<String>> {
    let mut expired = Vec::new();
    for id in instance_ids {
        // DELETE .. RETURNING so the report is what the database actually
        // removed, not what we hoped it would: an id that carried no training,
        // or belongs to another club, simply does not appear.
        let hit: Option<(String,)> = sqlx::query_as(
            "DELETE FROM owned_card_training \
               WHERE owned_card_id = ? \
                 AND owned_card_id IN (SELECT id FROM owned_cards WHERE club_id = ?) \
             RETURNING owned_card_id",
        )
        .bind(id)
        .bind(club_id)
        .fetch_optional(&mut **tx)
        .await?;
        if let Some((got,)) = hit {
            expired.push(got);
        }
    }
    Ok(expired)
 }
 /// The definition's six attributes in canonical slot order.
 ///
 /// THIS ORDER IS THE CONTRACT that `attribute_index` indexes. It is
 /// `CardDefinition`'s own declaration order, and changing it would silently
 /// re-point every stored effect at a different attribute.
 pub fn base_attributes(def: &CardDefinition) -> [i64; 6] {
    [
        def.pace as i64,
        def.shooting as i64,
        def.passing as i64,
        def.dribbling as i64,
        def.defending as i64,
        def.physical as i64,
    ]
 }
 /// Base attributes with any training folded in, clamped to the model's domain.
 ///
 /// A `None` slot boosts ALL SIX attributes — FIFA 17's rare "all" training card.
 /// An out-of-range slot is ignored rather than panicking: the schema already
 /// refuses one, so reaching this would mean the row was written around Core, and
 /// dropping it degrades one attribute instead of failing every projection.
 pub fn effective_attributes(def: &CardDefinition, effect: Option<&TrainingEffect>) -> [i64; 6] {
    let mut out = base_attributes(def);
    let Some(e) = effect else { return out };
    match e.attribute_index {
        Some(slot) => {
            if let Some(v) = out.get_mut(slot as usize) {
                *v = (*v + e.amount).clamp(0, ATTRIBUTE_MAX);
            }
        }
        None => {
            for v in out.iter_mut() {
                *v = (*v + e.amount).clamp(0, ATTRIBUTE_MAX);
            }
        }
    }
    out
 }
 /// The same six values as a named object, for the projection envelope.
 pub fn effective_attributes_json(
    def: &CardDefinition,
    effect: Option<&TrainingEffect>,
 ) -> serde_json::Value {
    let a = effective_attributes(def, effect);
    serde_json::json!({
        "pace": a[0],
        "shooting": a[1],
        "passing": a[2],
        "dribbling": a[3],
        "defending": a[4],
        "physical": a[5],
    })
 }
@@ -1,10 +1,15 @@
 use crate::{
    db::Pool,
    error::{AppError, AppResult},
-    models::card::{OwnedCard, OWNED_CARD_SELECT},
+    models::card::OwnedCard,
    models::chemistry_style::ChemistryStyle,
 };
 const OWNED_CARD_SELECT: &str =
    "SELECT id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at, \
     chemistry_style, position_override, training_bonus \
     FROM owned_cards";
 pub const MAX_TRAINING_BONUS: i64 = 3;
 /// Cost in coins to change a player's position.
@@ -1,65 +0,0 @@
 //! Reproduction for the fresh-DB multi-connection warm-up write failure.
 //! Forces several pooled connections to open concurrently on a brand-new DB and
 //! captures the ACTUAL sqlx/SQLite error (not the service's generic string).
 use openfut_core::db::{init_pool, run_migrations};
 use openfut_core::services::economy;
 async fn seed_club(pool: &sqlx::SqlitePool) {
    sqlx::query(
        "INSERT INTO profiles (id, username, created_at, updated_at) VALUES ('p','p','t','t')",
    )
    .execute(pool)
    .await
    .unwrap();
    sqlx::query("INSERT INTO clubs (id, profile_id, name, coins, created_at, updated_at) VALUES ('c','p','c',100000,'t','t')")
        .execute(pool)
        .await
        .unwrap();
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 8)]
 async fn fresh_db_multiconn_concurrent_writes() {
    let base = std::env::temp_dir().join(format!("ofut-cc-{}", std::process::id()));
    std::fs::create_dir_all(&base).unwrap();
    let iters = 100usize;
    let mut failures = 0usize;
    let mut first_err = String::new();
    for i in 0..iters {
        let url = format!("sqlite://{}/db{i}.db", base.display());
        let pool = init_pool(&url, 5).await.expect("init_pool");
        run_migrations(&pool).await.expect("migrations");
        seed_club(&pool).await;
        // Fire concurrent credits to force several connections to warm up at once
        // on the brand-new DB, then a write — the harness's failing shape.
        let mut handles = Vec::new();
        for _ in 0..8 {
            let p = pool.clone();
            handles.push(tokio::spawn(async move {
                economy::grant_reward(&p, "c", 1).await
            }));
        }
        for h in handles {
            match h.await.unwrap() {
                Ok(_) => {}
                Err(e) => {
                    failures += 1;
                    if first_err.is_empty() {
                        first_err = format!("{e:?}");
                    }
                }
            }
        }
        // Serialization correctness: 8 concurrent +1 credits, no lost update.
        let bal = economy::balance(&pool, "c").await.unwrap();
        assert_eq!(bal, 100_008, "iter {i}: lost update under concurrency");
        pool.close().await;
    }
    std::fs::remove_dir_all(&base).ok();
    assert_eq!(
        failures,
        0,
        "{failures}/{} iterations had a write failure; first error: {first_err}",
        iters * 8
    );
 }
@@ -1,207 +0,0 @@
 //! Content preflight: a real profile with owned players but a missing
 //! CardDefinition must fail startup LOUDLY, never serve a silent empty club.
 use axum::{
    body::Body,
    http::{Request, StatusCode},
 };
 use openfut_core::services::card_db::CardDb;
 use tower::ServiceExt;
 async fn fresh_pool() -> sqlx::SqlitePool {
    let p = sqlx::sqlite::SqlitePoolOptions::new()
        .max_connections(1)
        .connect("sqlite::memory:")
        .await
        .expect("in-memory sqlite");
    sqlx::migrate!("./migrations")
        .run(&p)
        .await
        .expect("migrations");
    p
 }
 async fn create_profile(app: &axum::Router) {
    let resp = app
        .clone()
        .oneshot(
            Request::builder()
                .method("POST")
                .uri("/auth/local")
                .header("content-type", "application/json")
                .body(Body::from(r#"{"username":"CAGE"}"#))
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(
        resp.status(),
        StatusCode::OK,
        "auth/local should create a profile+club"
    );
 }
 async fn insert_owned(pool: &sqlx::SqlitePool, id: &str, club_id: &str, card_id: &str) {
    sqlx::query(
        "INSERT INTO owned_cards (id, club_id, card_id, is_loan, loan_matches_remaining, acquired_at) \
         VALUES (?, ?, ?, 0, NULL, ?)",
    )
    .bind(id)
    .bind(club_id)
    .bind(card_id)
    .bind("2026-01-01T00:00:00Z")
    .execute(pool)
    .await
    .unwrap();
 }
 #[tokio::test]
 async fn preflight_fails_on_owned_card_missing_definition() {
    let pool = fresh_pool().await;
    // first build is fine: no owned cards yet.
    let app = openfut_core::build_app(pool.clone(), "data").await.unwrap();
    create_profile(&app).await;
    let club: String = sqlx::query_scalar("SELECT id FROM clubs LIMIT 1")
        .fetch_one(&pool)
        .await
        .unwrap();
    insert_owned(&pool, "oc-bogus", &club, "fifa17_definitely_missing_999999").await;
    // second build must now fail preflight: one owned card references a def that
    // is not loaded — must not silently serve an empty collection.
    let err = openfut_core::build_app(pool.clone(), "data")
        .await
        .expect_err("preflight must fail on a missing definition");
    let msg = format!("{err:#}");
    assert!(
        msg.contains("content preflight failed"),
        "unexpected error: {msg}"
    );
 }
 #[tokio::test]
 async fn preflight_passes_when_owned_card_definition_is_loaded() {
    let pool = fresh_pool().await;
    // pick a definition that IS in the default data/cards catalog.
    let valid_id = CardDb::load("data")
        .unwrap()
        .all()
        .first()
        .map(|c| c.id.clone())
        .expect("data/cards must be non-empty");
    let app = openfut_core::build_app(pool.clone(), "data").await.unwrap();
    create_profile(&app).await;
    let club: String = sqlx::query_scalar("SELECT id FROM clubs LIMIT 1")
        .fetch_one(&pool)
        .await
        .unwrap();
    insert_owned(&pool, "oc-valid", &club, &valid_id).await;
    let _app = openfut_core::build_app(pool.clone(), "data")
        .await
        .expect("preflight passes when the owned card's definition is loaded");
 }
 /// The LOAD-BEARING backwards-compatibility property: `source_rating` was added
 /// to `CardDefinition` long after packs shipped, and `CardDefinition` has no
 /// `#[serde(default)]`. Every already-emitted pack omits the key, so a pack
 /// without it MUST still parse — and land as `None`, never as a fabricated 0
 /// that a tier rule would read as bronze.
 #[test]
 fn content_pack_without_source_rating_still_parses() {
    let dir = tempfile::tempdir().unwrap();
    let pack = dir.path().join("legacy-pack.json");
    std::fs::write(
        &pack,
        r#"[{"id":"legacy_1","name":"Legacy Player","overall":84,"position":"ST",
             "nation":"Nation","league":"League","club":"Club","pace":80,
             "shooting":85,"passing":70,"dribbling":82,"defending":40,
             "physical":75,"rarity":"gold","image_path":null}]"#,
    )
    .unwrap();
    let mut db = CardDb {
        cards: Default::default(),
    };
    assert_eq!(db.load_pack(&pack).expect("legacy pack must load"), 1);
    let def = db.get("legacy_1").expect("definition merged");
    assert_eq!(def.overall, 84);
    assert!(
        def.source_rating.is_none(),
        "a missing key is None, not a substituted 0"
    );
 }
 /// A pack that DOES carry `source_rating` must round-trip through `CardDb` and
 /// surface on `/collection` as `card.source_rating` — that envelope field is the
 /// only authoritative staff/manager tier source a game host has. `overall` stays
 /// 0 for the non-player because it feeds pricing and squad projection.
 #[tokio::test]
 async fn collection_surfaces_source_rating_for_a_non_player() {
    let dir = tempfile::tempdir().unwrap();
    let pack = dir.path().join("staff-pack.json");
    std::fs::write(
        &pack,
        r#"[{"id":"fifa17_3000083","name":"Manager","overall":0,"position":"",
             "nation":"","league":"","club":"","pace":0,"shooting":0,"passing":0,
             "dribbling":0,"defending":0,"physical":0,"rarity":"bronze",
             "image_path":null,"source_rating":88}]"#,
    )
    .unwrap();
    let pool = fresh_pool().await;
    let cfg = openfut_core::config::Config {
        listen_addr: "127.0.0.1:0".into(),
        database_url: "sqlite::memory:".into(),
        data_dir: "data".into(),
        max_connections: 1,
        dev_content_games: Vec::new(),
        content_packs: vec![pack.clone()],
    };
    let app = openfut_core::app::build(pool.clone(), cfg.clone())
        .await
        .expect("app build with the staff pack");
    create_profile(&app).await;
    let club: String = sqlx::query_scalar("SELECT id FROM clubs LIMIT 1")
        .fetch_one(&pool)
        .await
        .unwrap();
    insert_owned(&pool, "oc-manager", &club, "fifa17_3000083").await;
    // Rebuild so preflight sees the owned row, then read the envelope.
    let app = openfut_core::app::build(pool.clone(), cfg)
        .await
        .expect("preflight passes: the pack carries the definition");
    let resp = app
        .oneshot(
            Request::builder()
                .uri("/collection")
                .body(Body::empty())
                .unwrap(),
        )
        .await
        .unwrap();
    assert_eq!(resp.status(), StatusCode::OK);
    let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
        .await
        .unwrap();
    let coll: serde_json::Value = serde_json::from_slice(&body).unwrap();
    let entry = coll["collection"]
        .as_array()
        .unwrap()
        .iter()
        .find(|c| c["owned_card_id"] == serde_json::json!("oc-manager"))
        .expect("the owned manager must project");
    assert_eq!(entry["card"]["source_rating"], serde_json::json!(88));
    assert_eq!(
        entry["card"]["overall"],
        serde_json::json!(0),
        "overall stays 0 for a non-player: it feeds pricing and projection"
    );
    assert_eq!(
        entry["effective_overall"],
        serde_json::json!(0),
        "the tier source must NOT leak into the projected overall"
    );
 }
@@ -1,181 +0,0 @@
 //! FIFA 17 development content pack + ownership seed (Commit 5).
 //!
 //! Proves: the dev pack is opt-in and isolated from default content; the seed
 //! creates a `game_id=fifa17` profile/club and grants real Core `OwnedCard`s
 //! (never FIFA wire ids); it is idempotent and leaves the default profile alone;
 //! and the seeded inventory can exercise the retail `/club` filter + pagination.
 use openfut_core::db::Pool;
 use openfut_core::services::card_db::CardDb;
 async fn pool() -> Pool {
    let pool = sqlx::sqlite::SqlitePoolOptions::new()
        .max_connections(1)
        .connect("sqlite::memory:")
        .await
        .expect("in-memory sqlite");
    sqlx::migrate!("./migrations")
        .run(&pool)
        .await
        .expect("migrations");
    pool
 }
 fn dev_card_db() -> CardDb {
    let mut db = CardDb::load("data").expect("default cards");
    db.load_game_dev("data", "fifa17").expect("dev pack");
    db
 }
 // ── Content isolation ────────────────────────────────────────────────────────
 #[test]
 fn default_load_never_contains_dev_pack() {
    // The default global loader reads only data/cards — the dev pack under
    // data/games/fifa17/dev must be invisible unless explicitly requested.
    let default = CardDb::load("data").expect("default cards");
    let leaked: Vec<_> = default
        .cards
        .keys()
        .filter(|k| k.starts_with("fifa17_"))
        .collect();
    assert!(
        leaked.is_empty(),
        "default content must not include FIFA17 dev cards: {leaked:?}"
    );
    assert!(
        !default.cards.is_empty(),
        "default synthetic catalogue still loads"
    );
 }
 #[test]
 fn opt_in_load_adds_dev_pack_only() {
    let default_n = CardDb::load("data").unwrap().cards.len();
    let db = dev_card_db();
    let dev: Vec<_> = db
        .cards
        .keys()
        .filter(|k| k.starts_with("fifa17_"))
        .collect();
    assert_eq!(dev.len(), 32, "the curated dev pack is 32 definitions");
    assert_eq!(
        db.cards.len(),
        default_n + 32,
        "dev pack is additive; default content unchanged"
    );
 }
 #[test]
 fn dev_definitions_carry_semantic_names_not_raw_ids() {
    let db = dev_card_db();
    for c in db.cards.values().filter(|c| c.id.starts_with("fifa17_")) {
        // Semantic Core fields are names, never raw FIFA numeric entity ids.
        assert!(
            c.nation.parse::<i64>().is_err(),
            "nation must be a name, got {:?}",
            c.nation
        );
        assert!(
            c.league.parse::<i64>().is_err(),
            "league must be a name: {:?}",
            c.league
        );
        assert!(
            c.club.parse::<i64>().is_err(),
            "club must be a name: {:?}",
            c.club
        );
        assert!(!c.name.is_empty(), "every dev card has a player name");
    }
 }
 // ── Ownership seed ─────────────────────────────────────────────────────────
 #[tokio::test]
 async fn seed_grants_game_scoped_inventory_with_filter_coverage() {
    let pool = pool().await;
    let db = dev_card_db();
    let r = openfut_core::seed::seed_fifa17_dev(&pool, &db)
        .await
        .unwrap();
    assert_eq!(r.game_id, "fifa17");
    assert!(!r.already_seeded);
    assert_eq!(r.definitions_available, 32);
    assert_eq!(r.owned_total, 33, "32 defs + 1 deliberate duplicate");
    assert_eq!(r.unique_definitions, 32);
    assert!(r.gold_over_one_page, "gold spans >1 page (22 > 11)");
    assert!(r.gold > 11, "enough gold for pagination");
    assert!(r.silver >= 1 && r.bronze >= 1, "quality spread");
    assert!(r.positions.contains_key("GK"), "GK present");
    assert!(r.positions.contains_key("ST"), "ST present");
    assert!(r.distinct_leagues >= 2, "multiple leagues");
    assert!(r.distinct_nations >= 2, "multiple nations");
    assert!(r.max_same_club >= 2, "a same-club group for team filters");
    // The seed created ONLY a fifa17 profile — the default (fifa23) profile and
    // any synthetic inventory are untouched.
    let games: Vec<(String,)> = sqlx::query_as("SELECT game_id FROM profiles")
        .fetch_all(&pool)
        .await
        .unwrap();
    assert_eq!(
        games,
        vec![("fifa17".to_string(),)],
        "only the fifa17 profile exists"
    );
    // Every seeded owned card references a dev-pack definition (all renderable).
    let orphans: i64 = sqlx::query_scalar(
        "SELECT COUNT(*) FROM owned_cards o \
         WHERE o.card_id LIKE 'fifa17_%' AND o.card_id NOT IN \
         (SELECT card_id FROM owned_cards WHERE card_id LIKE 'fifa17_%')",
    )
    .fetch_one(&pool)
    .await
    .unwrap();
    assert_eq!(orphans, 0);
 }
 #[tokio::test]
 async fn seed_is_idempotent_across_reruns() {
    let pool = pool().await;
    let db = dev_card_db();
    let first = openfut_core::seed::seed_fifa17_dev(&pool, &db)
        .await
        .unwrap();
    let second = openfut_core::seed::seed_fifa17_dev(&pool, &db)
        .await
        .unwrap();
    assert!(!first.already_seeded);
    assert!(second.already_seeded, "second run sees existing ownership");
    assert_eq!(first.owned_total, second.owned_total, "no duplicate grants");
    let n: i64 =
        sqlx::query_scalar("SELECT COUNT(*) FROM owned_cards WHERE card_id LIKE 'fifa17_%'")
            .fetch_one(&pool)
            .await
            .unwrap();
    assert_eq!(n, 33, "row count stable after rerun");
 }
 #[tokio::test]
 async fn seed_creates_exactly_one_two_copy_definition() {
    let pool = pool().await;
    let db = dev_card_db();
    openfut_core::seed::seed_fifa17_dev(&pool, &db)
        .await
        .unwrap();
    // Exactly one definition is owned twice (distinct owned ids, same card_id):
    // the identity foundation for "two copies of one card" later.
    let dupes: Vec<(String, i64)> = sqlx::query_as(
        "SELECT card_id, COUNT(*) c FROM owned_cards WHERE card_id LIKE 'fifa17_%' \
         GROUP BY card_id HAVING c > 1",
    )
    .fetch_all(&pool)
    .await
    .unwrap();
    assert_eq!(dupes.len(), 1, "exactly one duplicated definition");
    assert_eq!(dupes[0].1, 2, "owned twice");
 }
@@ -1,479 +0,0 @@
 //! Generic transactional profile import (services::import). These also serve as
 //! the Core-level half of the migration mutation battery: each hostile input is
 //! rejected BEFORE any partial write, and re-runs converge instead of duplicating.
 use openfut_core::models::card::ContentKind;
 use openfut_core::services::card_db::CardDb;
 use openfut_core::services::import::{
    apply_profile_import, ImportClub, ImportEntitlement, ImportExtension, ImportOwnedCard,
    ImportProfile, ImportSlot, ImportSquad, ProfileImportRequest,
 };
 async fn fresh_pool() -> sqlx::SqlitePool {
    let p = sqlx::sqlite::SqlitePoolOptions::new()
        .max_connections(1)
        .connect("sqlite::memory:")
        .await
        .expect("in-memory sqlite");
    sqlx::migrate!("./migrations")
        .run(&p)
        .await
        .expect("migrations");
    p
 }
 fn valid_ids(n: usize) -> Vec<String> {
    let db = CardDb::load("data").expect("load data catalog");
    let ids: Vec<String> = db.all().iter().take(n).map(|c| c.id.clone()).collect();
    assert!(ids.len() >= n, "data catalog too small for test");
    ids
 }
 fn owned(ids: &[String]) -> Vec<ImportOwnedCard> {
    ids.iter()
        .enumerate()
        .map(|(i, id)| ImportOwnedCard {
            owned_item_id: format!("oc-{i}"),
            card_id: id.clone(),
            content_kind: ContentKind::Player,
            quantity: None,
        })
        .collect()
 }
 fn squad_over(owned: &[ImportOwnedCard]) -> ImportSquad {
    ImportSquad {
        formation: "f433".into(),
        name: "OpenFUT".into(),
        slots: owned
            .iter()
            .take(3)
            .enumerate()
            .map(|(i, o)| ImportSlot {
                owned_item_id: o.owned_item_id.clone(),
                position_index: i as i64,
                is_captain: i == 0,
                is_on_bench: false,
            })
            .collect(),
        extension: ImportExtension {
            namespace: "fifa17.squad.v1".into(),
            schema_version: 1,
            payload: r#"{"custom":[]}"#.into(),
        },
    }
 }
 fn request(
    game: &str,
    fp: &str,
    owned: Vec<ImportOwnedCard>,
    squad: Option<ImportSquad>,
 ) -> ProfileImportRequest {
    ProfileImportRequest {
        source_fingerprint: fp.into(),
        profile: ImportProfile {
            username: format!("CAGE-{game}"),
            game_id: game.into(),
        },
        club: ImportClub {
            name: "OpenFUT".into(),
            coins: 28_112_944,
        },
        owned,
        squad,
        entitlements: Vec::new(),
    }
 }
 async fn count(pool: &sqlx::SqlitePool, table: &str) -> i64 {
    sqlx::query_scalar(&format!("SELECT COUNT(*) FROM {table}"))
        .fetch_one(pool)
        .await
        .unwrap()
 }
 #[tokio::test]
 async fn imports_profile_club_owned_and_squad_in_one_shot() {
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    let ids = valid_ids(5);
    let ow = owned(&ids);
    let sq = squad_over(&ow);
    let req = request("g_happy", "fp-happy", ow, Some(sq));
    let out = apply_profile_import(&pool, &db, &req)
        .await
        .expect("import");
    assert!(matches!(
        out,
        openfut_core::services::import::ImportOutcome::Imported {
            owned: 5,
            squad_slots: 3
        }
    ));
    assert_eq!(count(&pool, "profiles").await, 1);
    assert_eq!(count(&pool, "clubs").await, 1);
    assert_eq!(count(&pool, "owned_cards").await, 5);
    assert_eq!(count(&pool, "squad_players").await, 3);
    // opaque extension persisted with a Core-computed fingerprint.
    let fp: String =
        sqlx::query_scalar("SELECT canonical_fingerprint FROM game_entity_ext LIMIT 1")
            .fetch_one(&pool)
            .await
            .unwrap();
    assert_eq!(fp.len(), 16, "16-hex FNV fingerprint");
    let stored_import_fp: String =
        sqlx::query_scalar("SELECT import_fingerprint FROM profiles LIMIT 1")
            .fetch_one(&pool)
            .await
            .unwrap();
    assert_eq!(stored_import_fp, "fp-happy");
 }
 #[tokio::test]
 async fn imports_entitlements_seeds_unopened_packs() {
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    let ids = valid_ids(2);
    let ow = owned(&ids);
    let mut req = request("g_ent", "fp-ent", ow, None);
    req.entitlements = vec![
        ImportEntitlement {
            definition_id: "70".into(),
        },
        ImportEntitlement {
            definition_id: "70".into(),
        },
    ];
    apply_profile_import(&pool, &db, &req)
        .await
        .expect("import");
    // Two unconsumed entitlements seeded into packs (opened = 0).
    assert_eq!(count(&pool, "packs").await, 2);
    let unopened: i64 = sqlx::query_scalar("SELECT COUNT(*) FROM packs WHERE opened = 0")
        .fetch_one(&pool)
        .await
        .unwrap();
    assert_eq!(unopened, 2);
 }
 #[tokio::test]
 async fn rerun_same_fingerprint_is_idempotent_noop() {
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    let ids = valid_ids(4);
    let mk = || {
        request(
            "g_rerun",
            "fp-x",
            owned(&ids),
            Some(squad_over(&owned(&ids))),
        )
    };
    apply_profile_import(&pool, &db, &mk())
        .await
        .expect("first");
    let out = apply_profile_import(&pool, &db, &mk())
        .await
        .expect("second");
    assert_eq!(
        out,
        openfut_core::services::import::ImportOutcome::AlreadyImported
    );
    // no duplication.
    assert_eq!(count(&pool, "profiles").await, 1);
    assert_eq!(count(&pool, "owned_cards").await, 4);
 }
 #[tokio::test]
 async fn different_fingerprint_on_imported_game_fails() {
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    let ids = valid_ids(3);
    apply_profile_import(&pool, &db, &request("g_diff", "fp-a", owned(&ids), None))
        .await
        .expect("first");
    let err = apply_profile_import(&pool, &db, &request("g_diff", "fp-b", owned(&ids), None))
        .await
        .expect_err("second, different fingerprint");
    assert!(format!("{err:#}").contains("different source"), "{err:#}");
    assert_eq!(count(&pool, "profiles").await, 1);
 }
 #[tokio::test]
 async fn missing_definition_fails_preflight_with_no_writes() {
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    let mut ow = owned(&valid_ids(2));
    ow.push(ImportOwnedCard {
        owned_item_id: "oc-bad".into(),
        card_id: "fifa17_definitely_absent_999999".into(),
        content_kind: ContentKind::Player,
        quantity: None,
    });
    let err = apply_profile_import(&pool, &db, &request("g_miss", "fp", ow, None))
        .await
        .expect_err("missing definition must fail");
    assert!(
        format!("{err:#}").contains("definition preflight failed"),
        "{err:#}"
    );
    // preflight is before the tx: nothing was written.
    assert_eq!(count(&pool, "profiles").await, 0);
    assert_eq!(count(&pool, "owned_cards").await, 0);
 }
 #[tokio::test]
 async fn squad_slot_not_in_ownership_fails() {
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    let ids = valid_ids(3);
    let ow = owned(&ids);
    let mut sq = squad_over(&ow);
    sq.slots[1].owned_item_id = "oc-not-owned".into();
    let err = apply_profile_import(&pool, &db, &request("g_sq", "fp", ow, Some(sq)))
        .await
        .expect_err("squad slot not owned must fail");
    assert!(format!("{err:#}").contains("all-or-nothing"), "{err:#}");
    assert_eq!(count(&pool, "profiles").await, 0);
 }
 #[tokio::test]
 async fn duplicate_owned_item_id_fails() {
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    let ids = valid_ids(2);
    let mut ow = owned(&ids);
    ow[1].owned_item_id = ow[0].owned_item_id.clone();
    let err = apply_profile_import(&pool, &db, &request("g_dup", "fp", ow, None))
        .await
        .expect_err("duplicate OwnedItemId must fail");
    assert!(
        format!("{err:#}").contains("duplicate OwnedItemId"),
        "{err:#}"
    );
    assert_eq!(count(&pool, "profiles").await, 0);
 }
 #[tokio::test]
 async fn non_imported_profile_is_not_clobbered() {
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    // simulate a gameplay/dev profile with NO import_fingerprint for this game.
    sqlx::query(
        "INSERT INTO profiles (id, username, level, xp, game_id, created_at, updated_at) \
         VALUES ('p0','someone',1,0,'g_clobber','2026-01-01T00:00:00Z','2026-01-01T00:00:00Z')",
    )
    .execute(&pool)
    .await
    .unwrap();
    let ids = valid_ids(2);
    let err = apply_profile_import(&pool, &db, &request("g_clobber", "fp", owned(&ids), None))
        .await
        .expect_err("must refuse to clobber a non-imported profile");
    assert!(format!("{err:#}").contains("non-imported"), "{err:#}");
    assert_eq!(count(&pool, "owned_cards").await, 0);
 }
 #[tokio::test]
 async fn empty_owned_fails() {
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    let err = apply_profile_import(&pool, &db, &request("g_empty", "fp", vec![], None))
        .await
        .expect_err("empty owned must fail");
    assert!(format!("{err:#}").contains("zero owned cards"), "{err:#}");
 }
 /// A profile import is once-only, so a taxonomy fix cannot arrive by
 /// re-importing: the same fingerprint no-ops and a different one is refused.
 /// Every pre-taxonomy import therefore left coaches, kits and consumables
 /// durably recorded as players — wrong in the ownership authority even where a
 /// catalog-driven wire still looked right.
 #[tokio::test]
 async fn reclassify_corrects_already_imported_rows_and_is_idempotent() {
    use openfut_core::services::import::{
        reclassify_owned_content, ContentKindAssignment, ReclassifyRequest,
    };
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    let ids = valid_ids(3);
    // Imported before the taxonomy existed: everything landed as `player`.
    let ow = owned(&ids);
    let req = request("g_reclass", "fp-reclass", ow, None);
    apply_profile_import(&pool, &db, &req)
        .await
        .expect("import");
    let kind_of = |card: String| {
        let pool = pool.clone();
        async move {
            sqlx::query_scalar::<_, String>(
                "SELECT content_kind FROM owned_cards WHERE card_id = ?",
            )
            .bind(card)
            .fetch_one(&pool)
            .await
            .unwrap()
        }
    };
    assert_eq!(kind_of(ids[0].clone()).await, "player");
    let rc = ReclassifyRequest {
        game_id: "g_reclass".into(),
        dry_run: false,
        assignments: vec![
            ContentKindAssignment {
                card_id: ids[0].clone(),
                content_kind: ContentKind::Staff,
            },
            ContentKindAssignment {
                card_id: ids[1].clone(),
                content_kind: ContentKind::Consumable,
            },
            ContentKindAssignment {
                card_id: "fifa17_definition_nobody_owns".into(),
                content_kind: ContentKind::Kit,
            },
        ],
    };
    let out = reclassify_owned_content(&pool, &rc)
        .await
        .expect("reclassify");
    assert_eq!(out.updated, 2);
    assert_eq!(out.unchanged, 0);
    assert_eq!(
        out.unmatched_definitions,
        vec!["fifa17_definition_nobody_owns".to_string()],
        "an assignment nobody owns is reported, never invented"
    );
    assert_eq!(kind_of(ids[0].clone()).await, "staff");
    assert_eq!(kind_of(ids[1].clone()).await, "consumable");
    // Untouched definitions keep their kind.
    assert_eq!(kind_of(ids[2].clone()).await, "player");
    // Rerunning converges: nothing left to change.
    let again = reclassify_owned_content(&pool, &rc).await.expect("rerun");
    assert_eq!(again.updated, 0);
    assert_eq!(again.unchanged, 2);
 }
 /// Reclassification is scoped to one game, so a shared database cannot have
 /// another game's identically-named definition rewritten underneath it.
 #[tokio::test]
 async fn reclassify_never_crosses_a_game_boundary() {
    use openfut_core::services::import::{
        reclassify_owned_content, ContentKindAssignment, ReclassifyRequest,
    };
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    let ids = valid_ids(2);
    apply_profile_import(&pool, &db, &request("g_a", "fp-a", owned(&ids), None))
        .await
        .expect("import a");
    // Same definitions, but owned-item ids are globally unique.
    let mut b_owned = owned(&ids);
    for o in &mut b_owned {
        o.owned_item_id = format!("b-{}", o.owned_item_id);
    }
    apply_profile_import(&pool, &db, &request("g_b", "fp-b", b_owned, None))
        .await
        .expect("import b");
    let out = reclassify_owned_content(
        &pool,
        &ReclassifyRequest {
            game_id: "g_a".into(),
            dry_run: false,
            assignments: vec![ContentKindAssignment {
                card_id: ids[0].clone(),
                content_kind: ContentKind::Kit,
            }],
        },
    )
    .await
    .expect("reclassify");
    assert_eq!(out.updated, 1, "only game A's copy");
    let kinds: Vec<String> = sqlx::query_scalar(
        "SELECT o.content_kind FROM owned_cards o \
         JOIN clubs c ON c.id = o.club_id JOIN profiles p ON p.id = c.profile_id \
         WHERE p.game_id = 'g_b' AND o.card_id = ?",
    )
    .bind(&ids[0])
    .fetch_all(&pool)
    .await
    .unwrap();
    assert_eq!(kinds, vec!["player".to_string()], "game B untouched");
 }
 /// A dry run must report the SAME counts a real run would, and leave the
 /// database byte-for-byte unchanged. It runs the real UPDATEs and rolls back, so
 /// the numbers are measured rather than predicted — which is the only reason an
 /// operator can trust them before touching a frozen production database.
 #[tokio::test]
 async fn reclassify_dry_run_reports_the_real_counts_and_commits_nothing() {
    use openfut_core::services::import::{
        reclassify_owned_content, ContentKindAssignment, ReclassifyRequest,
    };
    let pool = fresh_pool().await;
    let db = CardDb::load("data").unwrap();
    let ids = valid_ids(3);
    apply_profile_import(&pool, &db, &request("g_dry", "fp-dry", owned(&ids), None))
        .await
        .expect("import");
    let kinds = || {
        let pool = pool.clone();
        async move {
            sqlx::query_scalar::<_, String>("SELECT content_kind FROM owned_cards ORDER BY card_id")
                .fetch_all(&pool)
                .await
                .unwrap()
        }
    };
    let before = kinds().await;
    let mut rc = ReclassifyRequest {
        game_id: "g_dry".into(),
        dry_run: true,
        assignments: vec![
            ContentKindAssignment {
                card_id: ids[0].clone(),
                content_kind: ContentKind::Staff,
            },
            ContentKindAssignment {
                card_id: ids[1].clone(),
                content_kind: ContentKind::Consumable,
            },
        ],
    };
    let dry = reclassify_owned_content(&pool, &rc).await.expect("dry run");
    assert!(dry.dry_run);
    assert_eq!(dry.updated, 2);
    assert_eq!(
        dry.updated_by_kind,
        [("consumable".to_string(), 1), ("staff".to_string(), 1)]
            .into_iter()
            .collect(),
        "the per-kind shape is what an operator sanity-checks"
    );
    assert_eq!(kinds().await, before, "a dry run commits NOTHING");
    // The real run then reports exactly what the dry run promised.
    rc.dry_run = false;
    let real = reclassify_owned_content(&pool, &rc)
        .await
        .expect("real run");
    assert!(!real.dry_run);
    assert_eq!(real.updated, dry.updated);
    assert_eq!(real.updated_by_kind, dry.updated_by_kind);
    assert_ne!(kinds().await, before, "the real run DID commit");
 }
@@ -1,365 +0,0 @@
 //! Owned-content model migrations (0025 content_kind/quantity, 0026
 //! club_active_items, 0027 consumable_applications, 0028 contract_matches).
 //!
 //! Two things must hold on a DB that already contains real ownership:
 //!   * every pre-existing owned row survives and reads back as a `player` with no
 //!     stack size and no tracked contract (the band is a pure widening, never a
 //!     rewrite and never a backfill of someone else's default);
 //!   * every existing kit designation lands in `club_active_items` under its
 //!     generalised slot token, and the old table + trigger are gone.
 //!
 //! 0028 additionally must NOT be a table rebuild: `owned_cards` carries 0026's
 //! `clear_club_active_item_before_transfer` trigger, and a DROP/recreate would
 //! take it along silently. The trigger assertions below therefore run AFTER the
 //! whole band, not just after 0026.
 //!
 //! The first is proved against a COPY of a real populated club snapshot (1986
 //! owned rows) when `OPENFUT_CORE_SNAPSHOT_DB` points at one; the second is
 //! proved by staging a DB at migration 0025, writing 0024-era kit rows, and then
 //! letting the remaining migrations run.
 use std::borrow::Cow;
 use openfut_core::models::card::{ActiveSlot, ContentKind};
 use sqlx::migrate::Migrator;
 use sqlx::sqlite::SqlitePoolOptions;
 use sqlx::{Row, SqlitePool};
 const OWNED_CONTENT_MIGRATION: i64 = 25;
 async fn pool_for(path: &std::path::Path) -> SqlitePool {
    let opts = sqlx::sqlite::SqliteConnectOptions::new()
        .filename(path)
        .create_if_missing(true)
        .foreign_keys(true);
    SqlitePoolOptions::new()
        .max_connections(1)
        .connect_with(opts)
        .await
        .unwrap_or_else(|e| panic!("open {}: {e}", path.display()))
 }
 /// The full migrator, truncated after `version`. Used to stage a DB in the state
 /// it had BEFORE the migrations under test, so their data carry-over is exercised
 /// on rows that really pre-date them.
 fn migrator_upto(version: i64) -> Migrator {
    let full = sqlx::migrate!("./migrations");
    let subset: Vec<_> = full
        .iter()
        .filter(|m| m.version < version)
        .cloned()
        .collect();
    Migrator {
        migrations: Cow::Owned(subset),
        ignore_missing: true,
        locking: true,
    }
 }
 async fn table_exists(pool: &SqlitePool, name: &str) -> bool {
    sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name=?")
        .bind(name)
        .fetch_one(pool)
        .await
        .unwrap()
        > 0
 }
 async fn trigger_names(pool: &SqlitePool) -> Vec<String> {
    sqlx::query_scalar::<_, String>(
        "SELECT name FROM sqlite_master WHERE type='trigger' ORDER BY name",
    )
    .fetch_all(pool)
    .await
    .unwrap()
 }
 /// Stage a DB at pre-0025 state with two 0024-era kit designations, then run the
 /// rest of the migrations: the designations MUST be carried over, not dropped.
 #[tokio::test]
 async fn kit_assignments_migrate_into_club_active_items() {
    let dir = tempfile::tempdir().expect("tempdir");
    let db = dir.path().join("staged.db");
    let pool = pool_for(&db).await;
    migrator_upto(OWNED_CONTENT_MIGRATION)
        .run(&pool)
        .await
        .expect("migrate to pre-0025");
    assert!(
        table_exists(&pool, "club_kit_assignments").await,
        "staging must actually be at the 0024 schema"
    );
    let ts = "2026-01-01T00:00:00Z";
    sqlx::query("INSERT INTO profiles (id, username, created_at, updated_at) VALUES ('p','p',?,?)")
        .bind(ts)
        .bind(ts)
        .execute(&pool)
        .await
        .unwrap();
    sqlx::query(
        "INSERT INTO clubs (id, profile_id, name, coins, created_at, updated_at) \
         VALUES ('c','p','c',0,?,?)",
    )
    .bind(ts)
    .bind(ts)
    .execute(&pool)
    .await
    .unwrap();
    for id in ["kit-h", "kit-a", "spare"] {
        sqlx::query(
            "INSERT INTO owned_cards (id, club_id, card_id, is_loan, acquired_at) \
             VALUES (?, 'c', ?, 0, ?)",
        )
        .bind(id)
        .bind(format!("def-{id}"))
        .bind(ts)
        .execute(&pool)
        .await
        .unwrap();
    }
    for (slot, owned) in [("home", "kit-h"), ("away", "kit-a")] {
        sqlx::query(
            "INSERT INTO club_kit_assignments (club_id, slot, owned_card_id, updated_at) \
             VALUES ('c', ?, ?, ?)",
        )
        .bind(slot)
        .bind(owned)
        .bind(ts)
        .execute(&pool)
        .await
        .unwrap();
    }
    // Now the migrations under test.
    sqlx::migrate!("./migrations")
        .run(&pool)
        .await
        .expect("migrate to head");
    assert!(
        !table_exists(&pool, "club_kit_assignments").await,
        "the old kit table must be gone"
    );
    assert!(table_exists(&pool, "club_active_items").await);
    assert!(table_exists(&pool, "consumable_applications").await);
    let rows =
        sqlx::query("SELECT slot, owned_card_id, updated_at FROM club_active_items ORDER BY slot")
            .fetch_all(&pool)
            .await
            .unwrap();
    let carried: Vec<(String, String, String)> = rows
        .iter()
        .map(|r| (r.get(0), r.get(1), r.get(2)))
        .collect();
    assert_eq!(
        carried,
        vec![
            (
                ActiveSlot::AwayKit.as_str().into(),
                "kit-a".to_string(),
                ts.to_string()
            ),
            (
                ActiveSlot::HomeKit.as_str().into(),
                "kit-h".to_string(),
                ts.to_string()
            ),
        ],
        "home -> home_kit, away -> away_kit, timestamps preserved"
    );
    // 0024's trigger is replaced, never merely orphaned: an ownership transfer
    // must still clear the designation (and must not fail on a missing table).
    let names = trigger_names(&pool).await;
    assert!(
        !names.contains(&"clear_club_kit_assignment_before_transfer".to_string()),
        "the old trigger must be dropped, got {names:?}"
    );
    assert!(
        names.contains(&"clear_club_active_item_before_transfer".to_string()),
        "the generalised trigger must exist, got {names:?}"
    );
    sqlx::query(
        "INSERT INTO clubs (id, profile_id, name, coins, created_at, updated_at) \
         VALUES ('c2','p','c2',0,?,?)",
    )
    .bind(ts)
    .bind(ts)
    .execute(&pool)
    .await
    .unwrap();
    sqlx::query("UPDATE owned_cards SET club_id = 'c2' WHERE id = 'kit-h'")
        .execute(&pool)
        .await
        .expect("transfer must succeed after the trigger swap");
    let remaining =
        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM club_active_items WHERE club_id='c'")
            .fetch_one(&pool)
            .await
            .unwrap();
    assert_eq!(remaining, 1, "the transferred kit's designation is cleared");
    // Backfilled ownership reads back as the default kind with no stack size.
    let (kind, quantity) = sqlx::query_as::<_, (ContentKind, Option<i64>)>(
        "SELECT content_kind, quantity FROM owned_cards WHERE id = 'spare'",
    )
    .fetch_one(&pool)
    .await
    .unwrap();
    assert_eq!(kind, ContentKind::Player);
    assert_eq!(quantity, None);
    // 0028: the column exists and every row that pre-dates it reads back NULL.
    // NULL is not zero — it means Core tracks no contract for the instance, so a
    // backfill here would have invented one game's pack-fresh number for all of
    // them.
    let contract = sqlx::query_scalar::<_, Option<i64>>(
        "SELECT contract_matches FROM owned_cards WHERE id = 'spare'",
    )
    .fetch_one(&pool)
    .await
    .expect("0028 must have added contract_matches");
    assert_eq!(contract, None, "a pre-existing row tracks no contract");
    assert!(
        sqlx::query("UPDATE owned_cards SET contract_matches = -1 WHERE id = 'spare'")
            .execute(&pool)
            .await
            .is_err(),
        "contract_matches CHECK must reject a negative count"
    );
    // And the new column constraints are real, not documentation.
    assert!(
        sqlx::query("UPDATE owned_cards SET content_kind = 'coach' WHERE id = 'spare'")
            .execute(&pool)
            .await
            .is_err(),
        "content_kind CHECK must reject a token outside the vocabulary"
    );
    assert!(
        sqlx::query("UPDATE owned_cards SET quantity = 0 WHERE id = 'spare'")
            .execute(&pool)
            .await
            .is_err(),
        "quantity CHECK must reject a non-positive stack"
    );
    assert!(
        sqlx::query(
            "INSERT INTO club_active_items (club_id, slot, owned_card_id, updated_at) \
             VALUES ('c', 'league_logo', 'spare', ?)"
        )
        .bind(ts)
        .execute(&pool)
        .await
        .is_err(),
        "slot CHECK must reject a token outside the recovered equipped-state set"
    );
    drop(dir);
 }
 /// The migrations must apply cleanly to a COPY of a REAL populated club DB,
 /// leave every owned row intact, and carry a real kit designation over.
 ///
 /// The snapshot predates migration 0024, so the copy is first brought up to the
 /// 0024 schema and given two kit designations pointing at REAL owned instances;
 /// only then do the migrations under test run. That way the carry-over is proved
 /// on production ownership, not on synthetic rows.
 ///
 /// Point `OPENFUT_CORE_SNAPSHOT_DB` at a real `core.db` to run it; without that
 /// the test reports the skip rather than passing silently on nothing.
 #[tokio::test]
 async fn migrations_apply_to_a_real_populated_snapshot() {
    let Ok(source) = std::env::var("OPENFUT_CORE_SNAPSHOT_DB") else {
        eprintln!(
            "SKIPPED migrations_apply_to_a_real_populated_snapshot: set \
             OPENFUT_CORE_SNAPSHOT_DB=/path/to/core.db to run it"
        );
        return;
    };
    let dir = tempfile::tempdir().expect("tempdir");
    let copy = dir.path().join("core.db");
    // Copy, never open the source: the snapshot is read-only evidence.
    std::fs::copy(&source, &copy).unwrap_or_else(|e| panic!("copy {source}: {e}"));
    let pool = pool_for(&copy).await;
    let before = sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM owned_cards")
        .fetch_one(&pool)
        .await
        .expect("snapshot must already hold ownership");
    assert!(
        before > 0,
        "the snapshot must be populated to prove anything"
    );
    // Bring the copy to the 0024 schema and designate two REAL owned instances
    // as this club's kits, exactly as the pre-generalisation server would have.
    migrator_upto(OWNED_CONTENT_MIGRATION)
        .run(&pool)
        .await
        .expect("migrate the snapshot to pre-0025");
    let real: Vec<(String, String)> =
        sqlx::query_as("SELECT id, club_id FROM owned_cards ORDER BY id LIMIT 2")
            .fetch_all(&pool)
            .await
            .unwrap();
    assert_eq!(real.len(), 2, "need two real owned instances");
    let ts = "2026-01-01T00:00:00Z";
    for (slot, (owned_id, club_id)) in ["home", "away"].into_iter().zip(&real) {
        sqlx::query(
            "INSERT INTO club_kit_assignments (club_id, slot, owned_card_id, updated_at) \
             VALUES (?, ?, ?, ?)",
        )
        .bind(club_id)
        .bind(slot)
        .bind(owned_id)
        .bind(ts)
        .execute(&pool)
        .await
        .expect("stage a real kit designation");
    }
    sqlx::migrate!("./migrations")
        .run(&pool)
        .await
        .expect("migrations must apply to real populated data");
    let (after, players, stacked, contracted) = sqlx::query_as::<_, (i64, i64, i64, i64)>(
        "SELECT COUNT(*), \
         SUM(CASE WHEN content_kind = 'player' THEN 1 ELSE 0 END), \
         SUM(CASE WHEN quantity IS NOT NULL THEN 1 ELSE 0 END), \
         SUM(CASE WHEN contract_matches IS NOT NULL THEN 1 ELSE 0 END) \
         FROM owned_cards",
    )
    .fetch_one(&pool)
    .await
    .unwrap();
    assert_eq!(after, before, "no owned row may be lost or duplicated");
    assert_eq!(players, before, "every backfilled row is a player");
    assert_eq!(stacked, 0, "no pre-existing row gains a stack size");
    assert_eq!(contracted, 0, "no pre-existing row gains a contract count");
    assert!(table_exists(&pool, "club_active_items").await);
    assert!(!table_exists(&pool, "club_kit_assignments").await);
    assert!(table_exists(&pool, "consumable_applications").await);
    let carried: Vec<(String, String)> =
        sqlx::query_as("SELECT slot, owned_card_id FROM club_active_items ORDER BY slot")
            .fetch_all(&pool)
            .await
            .unwrap();
    assert_eq!(
        carried,
        vec![
            (ActiveSlot::AwayKit.as_str().into(), real[1].0.clone()),
            (ActiveSlot::HomeKit.as_str().into(), real[0].0.clone()),
        ],
        "real kit designations must land in club_active_items"
    );
    eprintln!(
        "snapshot: {after} owned rows survive as content_kind='player'; \
         designations carried over: {carried:?}"
    );
    drop(dir);
 }