docs(testing): update test inventory with social, economy, and discovery smoke tests for PC4

- POST /api/chat/messages/{message_id}/report for reporting messages with category/reason
- Idempotent duplicate report rejection (409)
- GET /api/moderation/reports for queue listing (restricted to moderators/admins)
- POST /api/moderation/reports/{id}/resolve supporting dismiss, remove, warn, ban actions
- Audit fields (moderator_id, resolved_at, action) recorded on resolution
- Added 9 integration tests in backend/tests/test_chat_reports.py (all passing)

assets/editor/object_catalog.json

@@ -0,0 +1,40 @@
+{
+  "objects": {
+    "crate_small": {
+      "asset_id": "props/crate_small.glb",
+      "type": "prop",
+      "display_name": "Small Crate",
+      "category": "props"
+    },
+    "rock_01": {
+      "asset_id": "props/rock_01.glb",
+      "type": "prop",
+      "display_name": "Rock",
+      "category": "nature"
+    },
+    "tree_pine_01": {
+      "asset_id": "props/tree_pine_01.glb",
+      "type": "prop",
+      "display_name": "Pine Tree",
+      "category": "nature"
+    },
+    "lamp_post_01": {
+      "asset_id": "props/lamp_post_01.glb",
+      "type": "prop",
+      "display_name": "Lamp Post",
+      "category": "props"
+    },
+    "chest_01": {
+      "asset_id": "props/chest.glb",
+      "type": "interactable",
+      "display_name": "Treasure Chest",
+      "category": "interactables"
+    },
+    "spawn_point": {
+      "asset_id": "",
+      "type": "spawn_point",
+      "display_name": "Spawn Point",
+      "category": "gameplay"
+    }
+  }
+}

backend/alembic/env.py

@@ -8,7 +8,7 @@ from sqlalchemy.ext.asyncio import create_async_engine
 
 from app.config import settings
 from app.database import Base
-from app.models import user, session, world, asset, avatar_loadout  # noqa: F401
+from app.models import user, session, world, asset, avatar_loadout, world_content  # noqa: F401
 
 # this is the Alembic Config object, which provides
 # access to the values within the .ini file in use.

backend/alembic/versions/0005_add_world_content_tables.py

@@ -0,0 +1,120 @@
+"""add world_rooms, world_chunks, world_chunk_revisions tables
+
+Revision ID: 0005_add_world_content_tables
+Revises: 0004_add_avatar_loadouts_table
+Create Date: 2026-09-14 00:00:00.000000
+
+See docs/architecture/world_persistence_impl.md §4. Chunk content
+(rooms, chunk payloads, chunk revisions) lives in Postgres, purely
+additive to the existing ``worlds`` table.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0005_add_world_content_tables"
+down_revision: Union[str, None] = "0004_add_avatar_loadouts_table"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "world_rooms",
+        sa.Column("id", sa.Integer(), primary_key=True, index=True),
+        sa.Column(
+            "world_id", sa.Integer(),
+            sa.ForeignKey("worlds.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("slug", sa.String(64), nullable=False),
+        sa.Column("name", sa.String(255), nullable=False),
+        sa.Column(
+            "grid", postgresql.JSONB(), nullable=False,
+            server_default='{"size": [32, 32, 1], "origin": [0, 0, 0]}',
+        ),
+        sa.Column("bounds", postgresql.JSONB(), nullable=True),
+        sa.Column("spawn", postgresql.JSONB(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column(
+            "updated_at", sa.DateTime(timezone=True),
+            server_default=sa.func.now(), nullable=False,
+        ),
+        sa.UniqueConstraint("world_id", "slug", name="uq_world_rooms_world_slug"),
+    )
+    op.create_index("ix_world_rooms_world_id", "world_rooms", ["world_id"])
+
+    op.create_table(
+        "world_chunks",
+        sa.Column("id", sa.Integer(), primary_key=True, index=True),
+        sa.Column(
+            "world_id", sa.Integer(),
+            sa.ForeignKey("worlds.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "room_id", sa.Integer(),
+            sa.ForeignKey("world_rooms.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("chunk_key", sa.String(160), nullable=False, unique=True),
+        sa.Column("cx", sa.Integer(), nullable=False),
+        sa.Column("cy", sa.Integer(), nullable=False),
+        sa.Column("cz", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("format_version", sa.Integer(), nullable=False, server_default="1"),
+        sa.Column("payload", sa.LargeBinary(), nullable=False),
+        sa.Column("payload_len", sa.Integer(), nullable=False),
+        sa.Column("checksum", sa.String(64), nullable=False),
+        sa.Column("revision", sa.Integer(), nullable=False, server_default="1"),
+        sa.Column("content_flags", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("is_mature", sa.Boolean(), nullable=False, server_default="false"),
+        sa.Column(
+            "updated_by_id", sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column(
+            "updated_at", sa.DateTime(timezone=True),
+            server_default=sa.func.now(), nullable=False,
+        ),
+        sa.UniqueConstraint("room_id", "cx", "cy", "cz", name="uq_world_chunks_coord"),
+    )
+    op.create_index("ix_world_chunks_world_id", "world_chunks", ["world_id"])
+    op.create_index("ix_world_chunks_room_id", "world_chunks", ["room_id"])
+    op.create_index(
+        "ix_world_chunks_room_coord", "world_chunks", ["room_id", "cx", "cy", "cz"],
+    )
+    op.create_index(
+        "ix_world_chunks_mature", "world_chunks", ["world_id"],
+        postgresql_where=sa.text("is_mature"),
+    )
+
+    op.create_table(
+        "world_chunk_revisions",
+        sa.Column("id", sa.Integer(), primary_key=True, index=True),
+        sa.Column("chunk_key", sa.String(160), nullable=False),
+        sa.Column("world_id", sa.Integer(), nullable=False),
+        sa.Column("revision", sa.Integer(), nullable=False),
+        sa.Column("action", sa.String(16), nullable=False),
+        sa.Column(
+            "actor_id", sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("checksum", sa.String(64), nullable=False),
+        sa.Column("payload", sa.LargeBinary(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_world_chunk_revisions_chunk_key", "world_chunk_revisions", ["chunk_key"])
+    op.create_index("ix_world_chunk_revisions_world_id", "world_chunk_revisions", ["world_id"])
+    op.create_index("ix_world_chunk_revisions_created_at", "world_chunk_revisions", ["created_at"])
+
+
+def downgrade() -> None:
+    op.drop_table("world_chunk_revisions")
+    op.drop_table("world_chunks")
+    op.drop_table("world_rooms")

backend/alembic/versions/0006_add_presence_columns.py

@@ -0,0 +1,33 @@
+"""add presence columns to users
+
+Revision ID: 0006_add_presence_columns
+Revises: 0005_add_world_content_tables
+Create Date: 2026-09-14 00:00:00.000000
+
+Ported forward from the orphaned agent/dd2a126b57a1 branch (originally
+2a9b9873244a_add_presence_columns.py, down_revision 0001_initial) and
+rebased onto the current migration head. See app/services/presence.py /
+app/routers/presence.py.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "0006_add_presence_columns"
+down_revision: Union[str, None] = "0005_add_world_content_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Add last_seen_at and status_message columns to users table."""
+    op.add_column("users", sa.Column("last_seen_at", sa.DateTime(timezone=True), nullable=True))
+    op.add_column("users", sa.Column("status_message", sa.Text(), nullable=True))
+
+
+def downgrade() -> None:
+    """Remove presence columns from users table."""
+    op.drop_column("users", "status_message")
+    op.drop_column("users", "last_seen_at")

backend/alembic/versions/0007_add_social_graph_tables.py

@@ -0,0 +1,118 @@
+"""add social graph tables (friendships, follows, blocks)
+
+Revision ID: 0007_add_social_graph_tables
+Revises: 0006_add_presence_columns
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/social.md US-1 / app/models/social.py. Models + migration
+only -- the request/accept/block business logic lives in the sibling
+"Friends & follow API router" task.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0007_add_social_graph_tables"
+down_revision: Union[str, None] = "0006_add_presence_columns"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    friendship_status = postgresql.ENUM(
+        "pending", "accepted", name="friendship_status"
+    )
+    friendship_status.create(op.get_bind(), checkfirst=True)
+
+    op.create_table(
+        "friendships",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "requester_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "addressee_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "status",
+            postgresql.ENUM(
+                "pending", "accepted", name="friendship_status", create_type=False
+            ),
+            nullable=False,
+            server_default="pending",
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("requester_id", "addressee_id", name="uq_friendships_pair"),
+    )
+    op.create_index("ix_friendships_requester_id", "friendships", ["requester_id"])
+    op.create_index("ix_friendships_addressee_id", "friendships", ["addressee_id"])
+
+    op.create_table(
+        "follows",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "follower_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "followed_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("follower_id", "followed_id", name="uq_follows_pair"),
+    )
+    op.create_index("ix_follows_follower_id", "follows", ["follower_id"])
+    op.create_index("ix_follows_followed_id", "follows", ["followed_id"])
+
+    op.create_table(
+        "blocks",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "blocker_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "blocked_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("blocker_id", "blocked_id", name="uq_blocks_pair"),
+    )
+    op.create_index("ix_blocks_blocker_id", "blocks", ["blocker_id"])
+    op.create_index("ix_blocks_blocked_id", "blocks", ["blocked_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_blocks_blocked_id", table_name="blocks")
+    op.drop_index("ix_blocks_blocker_id", table_name="blocks")
+    op.drop_table("blocks")
+
+    op.drop_index("ix_follows_followed_id", table_name="follows")
+    op.drop_index("ix_follows_follower_id", table_name="follows")
+    op.drop_table("follows")
+
+    op.drop_index("ix_friendships_addressee_id", table_name="friendships")
+    op.drop_index("ix_friendships_requester_id", table_name="friendships")
+    op.drop_table("friendships")
+
+    postgresql.ENUM(name="friendship_status").drop(op.get_bind(), checkfirst=True)

backend/alembic/versions/0008_add_chat_tables.py

@@ -0,0 +1,178 @@
+"""add chat tables (conversations, messages, message_reports)
+
+Revision ID: 0008_add_chat_tables
+Revises: 0007_add_social_graph_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/social.md US-4 / app/models/chat.py. Models + migration only
+-- text filtering, rate limiting, and send/report/moderation endpoints live
+in sibling tasks that depend on this one.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0008_add_chat_tables"
+down_revision: Union[str, None] = "0007_add_social_graph_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    message_report_status = postgresql.ENUM(
+        "open", "resolved", "dismissed", name="message_report_status"
+    )
+    message_report_status.create(op.get_bind(), checkfirst=True)
+
+    op.create_table(
+        "conversations",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "user_a_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_b_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("user_a_id", "user_b_id", name="uq_conversations_pair"),
+        sa.CheckConstraint("user_a_id < user_b_id", name="ck_conversations_ordered_pair"),
+    )
+    op.create_index("ix_conversations_user_a_id", "conversations", ["user_a_id"])
+    op.create_index("ix_conversations_user_b_id", "conversations", ["user_b_id"])
+
+    op.create_table(
+        "conversation_participants",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "conversation_id",
+            sa.Integer(),
+            sa.ForeignKey("conversations.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint(
+            "conversation_id", "user_id", name="uq_conversation_participants_pair"
+        ),
+    )
+    op.create_index(
+        "ix_conversation_participants_conversation_id",
+        "conversation_participants",
+        ["conversation_id"],
+    )
+    op.create_index(
+        "ix_conversation_participants_user_id", "conversation_participants", ["user_id"]
+    )
+
+    op.create_table(
+        "messages",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "sender_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column(
+            "conversation_id",
+            sa.Integer(),
+            sa.ForeignKey("conversations.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column(
+            "world_id",
+            sa.Integer(),
+            sa.ForeignKey("worlds.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column(
+            "room_id",
+            sa.Integer(),
+            sa.ForeignKey("world_rooms.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column("body", sa.Text(), nullable=False),
+        sa.Column("filtered", sa.Boolean(), nullable=False, server_default="false"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_messages_sender_id", "messages", ["sender_id"])
+    op.create_index(
+        "ix_messages_conversation_created", "messages", ["conversation_id", "created_at"]
+    )
+    op.create_index("ix_messages_world_created", "messages", ["world_id", "created_at"])
+
+    op.create_table(
+        "message_reports",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "message_id",
+            sa.Integer(),
+            sa.ForeignKey("messages.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column(
+            "reporter_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("reason", sa.Text(), nullable=False),
+        sa.Column(
+            "status",
+            postgresql.ENUM(
+                "open", "resolved", "dismissed", name="message_report_status", create_type=False
+            ),
+            nullable=False,
+            server_default="open",
+        ),
+        sa.Column(
+            "moderator_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("resolved_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_message_reports_message_id", "message_reports", ["message_id"])
+    op.create_index("ix_message_reports_reporter_id", "message_reports", ["reporter_id"])
+    op.create_index("ix_message_reports_moderator_id", "message_reports", ["moderator_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_message_reports_moderator_id", table_name="message_reports")
+    op.drop_index("ix_message_reports_reporter_id", table_name="message_reports")
+    op.drop_index("ix_message_reports_message_id", table_name="message_reports")
+    op.drop_table("message_reports")
+
+    op.drop_index("ix_messages_world_created", table_name="messages")
+    op.drop_index("ix_messages_conversation_created", table_name="messages")
+    op.drop_index("ix_messages_sender_id", table_name="messages")
+    op.drop_table("messages")
+
+    op.drop_index("ix_conversation_participants_user_id", table_name="conversation_participants")
+    op.drop_index(
+        "ix_conversation_participants_conversation_id", table_name="conversation_participants"
+    )
+    op.drop_table("conversation_participants")
+
+    op.drop_index("ix_conversations_user_b_id", table_name="conversations")
+    op.drop_index("ix_conversations_user_a_id", table_name="conversations")
+    op.drop_table("conversations")
+
+    postgresql.ENUM(name="message_report_status").drop(op.get_bind(), checkfirst=True)

backend/alembic/versions/0009_add_group_tables.py

@@ -0,0 +1,80 @@
+"""add group tables (groups, group_members)
+
+Revision ID: 0009_add_group_tables
+Revises: 0008_add_chat_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/social.md US-5 / app/models/groups.py. Models + migration only
+-- create/join/leave, role authorization, and the group page endpoint live
+in a sibling task ("Groups API") that depends on this one.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0009_add_group_tables"
+down_revision: Union[str, None] = "0008_add_chat_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    group_role = postgresql.ENUM("owner", "admin", "member", name="group_role")
+    group_role.create(op.get_bind(), checkfirst=True)
+
+    op.create_table(
+        "groups",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column("name", sa.String(length=100), nullable=False),
+        sa.Column("description", sa.Text(), nullable=True),
+        sa.Column(
+            "owner_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_groups_owner_id", "groups", ["owner_id"])
+
+    op.create_table(
+        "group_members",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "group_id",
+            sa.Integer(),
+            sa.ForeignKey("groups.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "role",
+            postgresql.ENUM("owner", "admin", "member", name="group_role", create_type=False),
+            nullable=False,
+            server_default="member",
+        ),
+        sa.Column("joined_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("group_id", "user_id", name="uq_group_members_pair"),
+    )
+    op.create_index("ix_group_members_group_id", "group_members", ["group_id"])
+    op.create_index("ix_group_members_user_id", "group_members", ["user_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_group_members_user_id", table_name="group_members")
+    op.drop_index("ix_group_members_group_id", table_name="group_members")
+    op.drop_table("group_members")
+
+    op.drop_index("ix_groups_owner_id", table_name="groups")
+    op.drop_table("groups")
+
+    postgresql.ENUM(name="group_role").drop(op.get_bind(), checkfirst=True)

backend/alembic/versions/0010_add_profile_tables.py

@@ -0,0 +1,65 @@
+"""add profile tables (profiles, profile_favorites)
+
+Revision ID: 0010_add_profile_tables
+Revises: 0009_add_group_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+app/models/profile.py. Models + migration + owner-only /api/profile/me
+endpoints only -- the public profile view endpoint (GET /api/profile/{user_id})
+belongs to a sibling task that depends on this one.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0010_add_profile_tables"
+down_revision: Union[str, None] = "0009_add_group_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "profiles",
+        sa.Column("user_id", sa.Integer(), sa.ForeignKey("users.id", ondelete="CASCADE"), primary_key=True),
+        sa.Column(
+            "avatar_asset_id",
+            sa.Integer(),
+            sa.ForeignKey("assets.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("bio", sa.Text(), nullable=True),
+        sa.Column("privacy_json", postgresql.JSONB(), nullable=False, server_default="{}"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_profiles_avatar_asset_id", "profiles", ["avatar_asset_id"])
+
+    op.create_table(
+        "profile_favorites",
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            primary_key=True,
+        ),
+        sa.Column(
+            "world_id",
+            sa.Integer(),
+            sa.ForeignKey("worlds.id", ondelete="CASCADE"),
+            primary_key=True,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_profile_favorites_world_id", "profile_favorites", ["world_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_profile_favorites_world_id", table_name="profile_favorites")
+    op.drop_table("profile_favorites")
+
+    op.drop_index("ix_profiles_avatar_asset_id", table_name="profiles")
+    op.drop_table("profiles")

backend/alembic/versions/0011_add_dm_last_read.py

@@ -0,0 +1,36 @@
+"""add last_read_at to conversation_participants (DM unread tracking)
+
+Revision ID: 0011_add_dm_last_read
+Revises: 0010_add_profile_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+app/routers/chat_dm.py (DM send/list/conversations endpoints). Unread-count
+tracking is implemented as a last-read timestamp per participant: whenever a
+user fetches a conversation's message history, their
+``conversation_participants`` row's ``last_read_at`` is bumped to "now", and
+the conversation-list endpoint counts messages with
+``created_at > last_read_at`` (or all messages if never read) as unread for
+that participant. Nullable/no default so existing rows (none yet in
+practice, but consistent with "never read") read as "everything unread".
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "0011_add_dm_last_read"
+down_revision: Union[str, None] = "0010_add_profile_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "conversation_participants",
+        sa.Column("last_read_at", sa.DateTime(timezone=True), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("conversation_participants", "last_read_at")

backend/alembic/versions/0012_add_wallet_and_transactions.py

@@ -0,0 +1,90 @@
+"""add wallets and transactions ledger tables
+
+Revision ID: 0012_add_wallet_and_transactions
+Revises: 0011_add_dm_last_read
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/economy.md US-1 (task 8343bc0a730f).
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0012_add_wallet_and_transactions"
+down_revision: Union[str, None] = "0011_add_dm_last_read"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+TRANSACTION_TYPES = (
+    "credit_purchase",
+    "marketplace_purchase",
+    "marketplace_sale",
+    "escrow_release",
+    "payout",
+    "refund",
+    "admin_adjustment",
+)
+
+
+def upgrade() -> None:
+    # 1. Create transaction_type enum for Postgres
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        tx_type_enum = postgresql.ENUM(*TRANSACTION_TYPES, name="transaction_type", create_type=False)
+        tx_type_enum.create(bind, checkfirst=True)
+        tx_type_col = postgresql.ENUM(*TRANSACTION_TYPES, name="transaction_type", create_type=False)
+    else:
+        tx_type_col = sa.Enum(*TRANSACTION_TYPES, name="transaction_type")
+
+    # 2. Create wallets table
+    op.create_table(
+        "wallets",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("user_id", sa.Integer(), nullable=False),
+        sa.Column("balance", sa.BigInteger(), server_default="0", nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.CheckConstraint("balance >= 0", name="check_wallet_balance_non_negative"),
+        sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("user_id", name="uq_wallets_user_id"),
+    )
+    op.create_index(op.f("ix_wallets_user_id"), "wallets", ["user_id"], unique=True)
+
+    # 3. Create transactions table
+    op.create_table(
+        "transactions",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("wallet_id", sa.BigInteger(), nullable=False),
+        sa.Column("type", tx_type_col, nullable=False),
+        sa.Column("amount", sa.BigInteger(), nullable=False),
+        sa.Column("balance_after", sa.BigInteger(), nullable=False),
+        sa.Column("reference_type", sa.String(), nullable=True),
+        sa.Column("reference_id", sa.String(), nullable=True),
+        sa.Column("idempotency_key", sa.String(), nullable=True),
+        sa.Column("metadata_json", postgresql.JSONB(astext_type=sa.Text()) if bind.dialect.name == "postgresql" else sa.JSON(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.ForeignKeyConstraint(["wallet_id"], ["wallets.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("idempotency_key", name="uq_transactions_idempotency_key"),
+    )
+    op.create_index(op.f("ix_transactions_wallet_id"), "transactions", ["wallet_id"], unique=False)
+    op.create_index(op.f("ix_transactions_idempotency_key"), "transactions", ["idempotency_key"], unique=True)
+    op.create_index(op.f("ix_transactions_created_at"), "transactions", ["created_at"], unique=False)
+
+
+def downgrade() -> None:
+    op.drop_index(op.f("ix_transactions_created_at"), table_name="transactions")
+    op.drop_index(op.f("ix_transactions_idempotency_key"), table_name="transactions")
+    op.drop_index(op.f("ix_transactions_wallet_id"), table_name="transactions")
+    op.drop_table("transactions")
+
+    op.drop_index(op.f("ix_wallets_user_id"), table_name="wallets")
+    op.drop_table("wallets")
+
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        sa.Enum(*TRANSACTION_TYPES, name="transaction_type").drop(bind, checkfirst=True)

backend/alembic/versions/0013_add_marketplace_tables.py

@@ -0,0 +1,146 @@
+"""add marketplace tables: catalog_items, marketplace_listings, purchases, creator_balances
+
+Revision ID: 0013_add_marketplace_tables
+Revises: 0012_add_wallet_and_transactions
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/economy.md US-3, US-4 (task 166836d55365).
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0013_add_marketplace_tables"
+down_revision: Union[str, None] = "0012_add_wallet_and_transactions"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+ITEM_TYPES = ("asset", "avatar_item", "experience_pass")
+LISTING_STATUSES = ("active", "sold", "delisted", "removed_by_moderation")
+PURCHASE_STATUSES = ("pending_escrow", "completed", "refunded", "reversed")
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    is_pg = bind.dialect.name == "postgresql"
+
+    # Enums
+    if is_pg:
+        item_type_enum = postgresql.ENUM(*ITEM_TYPES, name="catalog_item_type", create_type=False)
+        item_type_enum.create(bind, checkfirst=True)
+        item_type_col = postgresql.ENUM(*ITEM_TYPES, name="catalog_item_type", create_type=False)
+
+        listing_status_enum = postgresql.ENUM(*LISTING_STATUSES, name="marketplace_listing_status", create_type=False)
+        listing_status_enum.create(bind, checkfirst=True)
+        listing_status_col = postgresql.ENUM(*LISTING_STATUSES, name="marketplace_listing_status", create_type=False)
+
+        purchase_status_enum = postgresql.ENUM(*PURCHASE_STATUSES, name="purchase_status", create_type=False)
+        purchase_status_enum.create(bind, checkfirst=True)
+        purchase_status_col = postgresql.ENUM(*PURCHASE_STATUSES, name="purchase_status", create_type=False)
+    else:
+        item_type_col = sa.Enum(*ITEM_TYPES, name="catalog_item_type")
+        listing_status_col = sa.Enum(*LISTING_STATUSES, name="marketplace_listing_status")
+        purchase_status_col = sa.Enum(*PURCHASE_STATUSES, name="purchase_status")
+
+    # 1. catalog_items
+    op.create_table(
+        "catalog_items",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("owner_id", sa.Integer(), nullable=False),
+        sa.Column("asset_id", sa.Integer(), nullable=True),
+        sa.Column("item_type", item_type_col, nullable=False),
+        sa.Column("name", sa.String(length=100), nullable=False),
+        sa.Column("description", sa.String(length=2000), nullable=True),
+        sa.Column("metadata_json", postgresql.JSONB(astext_type=sa.Text()) if is_pg else sa.JSON(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.ForeignKeyConstraint(["owner_id"], ["users.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["asset_id"], ["assets.id"], ondelete="SET NULL"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(op.f("ix_catalog_items_owner_id"), "catalog_items", ["owner_id"], unique=False)
+    op.create_index(op.f("ix_catalog_items_asset_id"), "catalog_items", ["asset_id"], unique=False)
+
+    # 2. marketplace_listings
+    op.create_table(
+        "marketplace_listings",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("catalog_item_id", sa.BigInteger(), nullable=False),
+        sa.Column("seller_id", sa.Integer(), nullable=False),
+        sa.Column("price", sa.BigInteger(), nullable=False),
+        sa.Column("status", listing_status_col, server_default="active", nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.CheckConstraint("price > 0", name="check_listing_price_positive"),
+        sa.ForeignKeyConstraint(["catalog_item_id"], ["catalog_items.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["seller_id"], ["users.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(op.f("ix_marketplace_listings_catalog_item_id"), "marketplace_listings", ["catalog_item_id"], unique=False)
+    op.create_index(op.f("ix_marketplace_listings_seller_id"), "marketplace_listings", ["seller_id"], unique=False)
+
+    # 3. purchases
+    op.create_table(
+        "purchases",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("listing_id", sa.BigInteger(), nullable=True),
+        sa.Column("buyer_id", sa.Integer(), nullable=False),
+        sa.Column("seller_id", sa.Integer(), nullable=False),
+        sa.Column("price", sa.BigInteger(), nullable=False),
+        sa.Column("platform_fee", sa.BigInteger(), nullable=False),
+        sa.Column("seller_net", sa.BigInteger(), nullable=False),
+        sa.Column("status", purchase_status_col, server_default="pending_escrow", nullable=False),
+        sa.Column("escrow_hold_until", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.ForeignKeyConstraint(["listing_id"], ["marketplace_listings.id"], ondelete="SET NULL"),
+        sa.ForeignKeyConstraint(["buyer_id"], ["users.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["seller_id"], ["users.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(op.f("ix_purchases_listing_id"), "purchases", ["listing_id"], unique=False)
+    op.create_index(op.f("ix_purchases_buyer_id"), "purchases", ["buyer_id"], unique=False)
+    op.create_index(op.f("ix_purchases_seller_id"), "purchases", ["seller_id"], unique=False)
+
+    # 4. creator_balances
+    op.create_table(
+        "creator_balances",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("user_id", sa.Integer(), nullable=False),
+        sa.Column("available", sa.BigInteger(), server_default="0", nullable=False),
+        sa.Column("pending", sa.BigInteger(), server_default="0", nullable=False),
+        sa.Column("lifetime_earned", sa.BigInteger(), server_default="0", nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.CheckConstraint("available >= 0", name="check_creator_available_non_negative"),
+        sa.CheckConstraint("pending >= 0", name="check_creator_pending_non_negative"),
+        sa.CheckConstraint("lifetime_earned >= 0", name="check_creator_lifetime_non_negative"),
+        sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="CASCADE"),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("user_id", name="uq_creator_balances_user_id"),
+    )
+    op.create_index(op.f("ix_creator_balances_user_id"), "creator_balances", ["user_id"], unique=True)
+
+
+def downgrade() -> None:
+    op.drop_index(op.f("ix_creator_balances_user_id"), table_name="creator_balances")
+    op.drop_table("creator_balances")
+
+    op.drop_index(op.f("ix_purchases_seller_id"), table_name="purchases")
+    op.drop_index(op.f("ix_purchases_buyer_id"), table_name="purchases")
+    op.drop_index(op.f("ix_purchases_listing_id"), table_name="purchases")
+    op.drop_table("purchases")
+
+    op.drop_index(op.f("ix_marketplace_listings_seller_id"), table_name="marketplace_listings")
+    op.drop_index(op.f("ix_marketplace_listings_catalog_item_id"), table_name="marketplace_listings")
+    op.drop_table("marketplace_listings")
+
+    op.drop_index(op.f("ix_catalog_items_asset_id"), table_name="catalog_items")
+    op.drop_index(op.f("ix_catalog_items_owner_id"), table_name="catalog_items")
+    op.drop_table("catalog_items")
+
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        sa.Enum(*PURCHASE_STATUSES, name="purchase_status").drop(bind, checkfirst=True)
+        sa.Enum(*LISTING_STATUSES, name="marketplace_listing_status").drop(bind, checkfirst=True)
+        sa.Enum(*ITEM_TYPES, name="catalog_item_type").drop(bind, checkfirst=True)

backend/alembic/versions/0014_add_payout_requests.py

@@ -0,0 +1,68 @@
+"""add payout_requests table and payout_status enum
+
+Revision ID: 0014_add_payout_requests
+Revises: 0013_add_marketplace_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/economy.md US-5 (task f5b4684f2e65).
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0014_add_payout_requests"
+down_revision: Union[str, None] = "0013_add_marketplace_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+PAYOUT_STATUSES = ("pending", "approved", "paid", "rejected")
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    is_pg = bind.dialect.name == "postgresql"
+
+    if is_pg:
+        payout_status_enum = postgresql.ENUM(*PAYOUT_STATUSES, name="payout_status", create_type=False)
+        payout_status_enum.create(bind, checkfirst=True)
+        payout_status_col = postgresql.ENUM(*PAYOUT_STATUSES, name="payout_status", create_type=False)
+    else:
+        payout_status_col = sa.Enum(*PAYOUT_STATUSES, name="payout_status")
+
+    op.create_table(
+        "payout_requests",
+        sa.Column("id", sa.BigInteger(), autoincrement=True, nullable=False),
+        sa.Column("creator_id", sa.Integer(), nullable=False),
+        sa.Column("amount", sa.BigInteger(), nullable=False),
+        sa.Column("status", payout_status_col, server_default="pending", nullable=False),
+        sa.Column("external_ref", sa.String(length=255), nullable=True),
+        sa.Column("provider_ref", sa.String(length=255), nullable=True),
+        sa.Column("requested_by", sa.Integer(), nullable=False),
+        sa.Column("reviewed_by", sa.Integer(), nullable=True),
+        sa.Column("reviewed_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.ForeignKeyConstraint(["creator_id"], ["users.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["requested_by"], ["users.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["reviewed_by"], ["users.id"], ondelete="SET NULL"),
+        sa.CheckConstraint("amount > 0", name="check_payout_amount_positive"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index("ix_payout_requests_creator_id", "payout_requests", ["creator_id"], unique=False)
+    op.create_index("ix_payout_requests_requested_by", "payout_requests", ["requested_by"], unique=False)
+    op.create_index("ix_payout_requests_reviewed_by", "payout_requests", ["reviewed_by"], unique=False)
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    is_pg = bind.dialect.name == "postgresql"
+
+    op.drop_index("ix_payout_requests_reviewed_by", table_name="payout_requests")
+    op.drop_index("ix_payout_requests_requested_by", table_name="payout_requests")
+    op.drop_index("ix_payout_requests_creator_id", table_name="payout_requests")
+    op.drop_table("payout_requests")
+
+    if is_pg:
+        op.execute("DROP TYPE IF EXISTS payout_status")

backend/alembic/versions/0015_add_discovery_metadata.py

@@ -0,0 +1,62 @@
+"""add discovery metadata to worlds and create world_visits table
+
+Revision ID: 0015_add_discovery_metadata
+Revises: 0014_add_payout_requests
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/discovery.md (task b377353b8167).
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0015_add_discovery_metadata"
+down_revision: Union[str, None] = "0014_add_payout_requests"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # 1. Add discovery metadata columns to worlds table
+    op.add_column("worlds", sa.Column("category", sa.String(length=100), nullable=True))
+    op.add_column("worlds", sa.Column("tags", postgresql.ARRAY(sa.String()), server_default="{}", nullable=True))
+    op.add_column("worlds", sa.Column("play_count", sa.Integer(), server_default="0", nullable=False))
+    op.add_column("worlds", sa.Column("last_played_at", sa.DateTime(timezone=True), nullable=True))
+
+    op.create_index("ix_worlds_category", "worlds", ["category"], unique=False)
+    op.create_index("ix_worlds_tags", "worlds", ["tags"], unique=False, postgresql_using="gin")
+
+    # 2. Create world_visits table
+    op.create_table(
+        "world_visits",
+        sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column("world_id", sa.Integer(), nullable=False),
+        sa.Column("user_id", sa.Integer(), nullable=True),
+        sa.Column("anonymous_token", sa.String(length=255), nullable=True),
+        sa.Column("visited_at", sa.DateTime(timezone=True), server_default=sa.text("now()"), nullable=False),
+        sa.ForeignKeyConstraint(["world_id"], ["worlds.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(["user_id"], ["users.id"], ondelete="SET NULL"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index("ix_world_visits_world_id", "world_visits", ["world_id"], unique=False)
+    op.create_index("ix_world_visits_user_id", "world_visits", ["user_id"], unique=False)
+    op.create_index("ix_world_visits_visited_at", "world_visits", ["visited_at"], unique=False)
+    op.create_index("ix_world_visits_world_visited_at", "world_visits", ["world_id", "visited_at"], unique=False)
+
+
+def downgrade() -> None:
+    op.drop_index("ix_world_visits_world_visited_at", table_name="world_visits")
+    op.drop_index("ix_world_visits_visited_at", table_name="world_visits")
+    op.drop_index("ix_world_visits_user_id", table_name="world_visits")
+    op.drop_index("ix_world_visits_world_id", table_name="world_visits")
+    op.drop_table("world_visits")
+
+    op.drop_index("ix_worlds_tags", table_name="worlds", postgresql_using="gin")
+    op.drop_index("ix_worlds_category", table_name="worlds")
+    op.drop_column("worlds", "last_played_at")
+    op.drop_column("worlds", "play_count")
+    op.drop_column("worlds", "tags")
+    op.drop_column("worlds", "category")

backend/app/config.py

@@ -104,6 +104,22 @@ class Settings(BaseSettings):
     # Kill a world's server this long after its last join with no active
     # players reported.
     GAME_SERVER_IDLE_TIMEOUT_SECONDS: int = 300
+    # How long ensure_server() waits for a spawned server to report
+    # "ready": true in its status file before giving up (503 to the
+    # joining client). See world_persistence_impl.md §7.4 -- content
+    # loading makes a slow start more likely than the old bare-port-bind
+    # wait, so this is a separate, longer-by-default budget.
+    GAME_SERVER_READY_TIMEOUT_SECONDS: float = 20.0
+    # The base URL the dedicated Godot server should call back into this
+    # backend on, for the read-only /api/internal content routes
+    # (world_persistence_impl.md §4.4 / §7).
+    GAME_SERVER_INTERNAL_API_URL: str = "http://127.0.0.1:8000"
+
+    # ── World content persistence (world_persistence_impl.md §4.4) ─────────
+    WORLD_CHUNK_MAX_PAYLOAD_BYTES: int = 1_048_576  # 1 MiB
+    WORLD_CHUNK_MAX_OBJECTS: int = 512
+    WORLD_CHUNK_MAX_BATCH: int = 64
+    WORLD_CHUNK_REVISION_KEEP: int = 20
 
     model_config = SettingsConfigDict(
         env_file=".env",

backend/app/dependencies.py

@@ -53,3 +53,33 @@ async def get_current_user(
 
 
 CurrentUser = Annotated[User, Depends(get_current_user)]
+
+oauth2_scheme_optional = OAuth2PasswordBearer(tokenUrl="/api/auth/login", auto_error=False)
+
+
+async def get_optional_user(
+    token: Annotated[str | None, Depends(oauth2_scheme_optional)],
+    db: Annotated[AsyncSession, Depends(get_db)],
+) -> User | None:
+    """Resolve the JWT bearer token to a User if present and valid, otherwise None."""
+    if not token:
+        return None
+    try:
+        payload = jwt.decode(
+            token, settings.public_pem, algorithms=[settings.ALGORITHM]
+        )
+        user_id: str | None = payload.get("sub")
+        if user_id is None:
+            return None
+        user_id_int = int(user_id)
+    except (JWTError, ValueError, TypeError):
+        return None
+
+    result = await db.execute(select(User).where(User.id == user_id_int))
+    user = result.scalar_one_or_none()
+    if user is None or not user.is_active:
+        return None
+    return user
+
+
+OptionalUser = Annotated[User | None, Depends(get_optional_user)]

backend/app/gateway/__init__.py

@@ -0,0 +1 @@
+"""WebSocket real-time gateway package."""

backend/app/gateway/ws.py

@@ -0,0 +1,538 @@
+"""Real-time WebSocket gateway.
+
+Multiplexes presence, DM, and world-chat delivery over a single WebSocket
+endpoint (docs/planning/social.md US-2, US-4).
+
+Key features:
+- Authentication via JWT token (query param or initial auth frame).
+- Scoped subscriptions to DM conversations and world channels.
+- Server-derived presence heartbeat (Redis TTL refreshed periodically).
+- Broadcast presence changes (online/offline) to mutual friends.
+- Fan-out via Redis pub/sub.
+- Thread-safe & event-loop-safe dispatch for multi-instance and test environments.
+- Graceful reconnect without duplicate delivery or orphaned state.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from contextlib import asynccontextmanager
+from datetime import datetime, timezone
+import json
+import logging
+from typing import Any
+
+from fastapi import APIRouter, WebSocket, WebSocketDisconnect, status
+from jose import JWTError, jwt
+from sqlalchemy import or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+import redis.asyncio as aioredis
+
+from app.config import settings
+from app.database import async_session_factory, get_db
+from app.models.chat import ConversationParticipant
+from app.models.social import Friendship, FriendshipStatus
+from app.models.user import User
+from app.models.world import World, WorldVisibility
+from app.services.presence import presence_store
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+
+@asynccontextmanager
+async def get_db_session():
+    """Helper to acquire an async DB session respecting test overrides if present."""
+    from app.main import app
+
+    override = app.dependency_overrides.get(get_db)
+    if override:
+        res = override()
+        if hasattr(res, "__anext__"):
+            session = await res.__anext__()
+            try:
+                yield session
+            finally:
+                try:
+                    await res.__anext__()
+                except (StopAsyncIteration, Exception):
+                    pass
+            return
+        elif hasattr(res, "__next__"):
+            session = next(res)
+            try:
+                yield session
+            finally:
+                try:
+                    next(res)
+                except (StopIteration, Exception):
+                    pass
+            return
+
+    async with async_session_factory() as session:
+        yield session
+
+
+async def authenticate_token(token: str) -> User | None:
+    """Validate JWT token and return authenticated User, or None."""
+    try:
+        payload = jwt.decode(token, settings.public_pem, algorithms=[settings.ALGORITHM])
+        user_id_raw = payload.get("sub")
+        if user_id_raw is None:
+            return None
+        user_id = int(user_id_raw)
+    except (JWTError, ValueError, TypeError):
+        return None
+
+    async with get_db_session() as db:
+        res = await db.execute(select(User).where(User.id == user_id))
+        user = res.scalar_one_or_none()
+        if user and user.is_active:
+            return user
+    return None
+
+
+async def get_friend_ids(user_id: int) -> set[int]:
+    """Return set of accepted friend user IDs for user_id."""
+    try:
+        async with get_db_session() as db:
+            res = await db.execute(
+                select(Friendship).where(
+                    or_(Friendship.requester_id == user_id, Friendship.addressee_id == user_id),
+                    Friendship.status == FriendshipStatus.ACCEPTED,
+                )
+            )
+            friendships = res.scalars().all()
+            return {
+                f.addressee_id if f.requester_id == user_id else f.requester_id
+                for f in friendships
+            }
+    except Exception as exc:
+        logger.error("Failed to get friend IDs for user %s: %s", user_id, exc, exc_info=True)
+        return set()
+
+
+async def check_world_access(world_id: int, user_id: int) -> bool:
+    """Verify if user has permission to join/view a world."""
+    async with get_db_session() as db:
+        res = await db.execute(select(World).where(World.id == world_id))
+        world = res.scalar_one_or_none()
+        if not world:
+            return False
+        if world.visibility == WorldVisibility.PUBLIC:
+            return True
+        if world.owner_id == user_id:
+            return True
+        if world.visibility == WorldVisibility.FRIENDS_ONLY:
+            res_fr = await db.execute(
+                select(Friendship.id).where(
+                    or_(
+                        and_(Friendship.requester_id == world.owner_id, Friendship.addressee_id == user_id),
+                        and_(Friendship.requester_id == user_id, Friendship.addressee_id == world.owner_id),
+                    ),
+                    Friendship.status == FriendshipStatus.ACCEPTED,
+                ).limit(1)
+            )
+            return res_fr.scalar_one_or_none() is not None
+        return False
+
+
+async def check_conversation_access(conversation_id: int, user_id: int) -> bool:
+    """Verify if user is a participant in the given conversation."""
+    async with get_db_session() as db:
+        res = await db.execute(
+            select(ConversationParticipant.id).where(
+                ConversationParticipant.conversation_id == conversation_id,
+                ConversationParticipant.user_id == user_id,
+            ).limit(1)
+        )
+        return res.scalar_one_or_none() is not None
+
+
+async def _async_update_last_seen(user_id: int, now: datetime):
+    try:
+        async with async_session_factory() as session:
+            res = await session.execute(select(User).where(User.id == user_id))
+            db_user = res.scalar_one_or_none()
+            if db_user:
+                db_user.last_seen_at = now
+                await session.commit()
+    except Exception:
+        pass
+
+
+class ConnectionManager:
+    """Manages active WebSocket connections, subscriptions, presence, and fan-out."""
+
+    def __init__(self):
+        # ws -> User
+        self._connections: dict[WebSocket, User] = {}
+        # ws -> event loop id
+        self._ws_loops: dict[WebSocket, int] = {}
+        # user_id -> set of active WebSockets
+        self._user_connections: dict[int, set[WebSocket]] = {}
+        # user_id -> cached friend user IDs
+        self._user_friend_ids: dict[int, set[int]] = {}
+        # world_id -> set of WebSockets
+        self._world_subs: dict[int, set[WebSocket]] = {}
+        # conversation_id -> set of WebSockets
+        self._dm_subs: dict[int, set[WebSocket]] = {}
+        # ws -> asyncio heartbeat task
+        self._heartbeat_tasks: dict[WebSocket, asyncio.Task] = {}
+        # Per-event-loop Redis pub/sub listener tasks and events
+        self._redis_tasks: dict[int, asyncio.Task] = {}
+        self._subscribed_events: dict[int, asyncio.Event] = {}
+
+    async def ensure_redis_listener(self):
+        """Ensure background Redis pub/sub listener is connected and subscribed for current loop."""
+        loop = asyncio.get_running_loop()
+        loop_key = id(loop)
+        task = self._redis_tasks.get(loop_key)
+        if task is None or task.done():
+            event = asyncio.Event()
+            self._subscribed_events[loop_key] = event
+            task = asyncio.create_task(self._redis_listener(loop_key, event))
+            self._redis_tasks[loop_key] = task
+        else:
+            event = self._subscribed_events.get(loop_key)
+
+        if event:
+            try:
+                await asyncio.wait_for(event.wait(), timeout=2.0)
+            except asyncio.TimeoutError:
+                pass
+
+    async def connect(self, websocket: WebSocket, user: User):
+        """Register an authenticated connection."""
+        await self.ensure_redis_listener()
+        loop_key = id(asyncio.get_running_loop())
+
+        self._connections[websocket] = user
+        self._ws_loops[websocket] = loop_key
+        self._user_connections.setdefault(user.id, set()).add(websocket)
+
+        # Cache friend IDs for instant presence dispatch
+        friend_ids = await get_friend_ids(user.id)
+        self._user_friend_ids[user.id] = friend_ids
+
+        # Mark user online in Redis and DB
+        await presence_store.heartbeat(user.id)
+        now = datetime.now(timezone.utc)
+        asyncio.create_task(_async_update_last_seen(user.id, now))
+
+        # Start periodic heartbeat task (every 20 seconds)
+        self._heartbeat_tasks[websocket] = asyncio.create_task(
+            self._run_periodic_heartbeat(user.id)
+        )
+
+        # Broadcast online presence to friends via Redis
+        await self.broadcast_presence(user.id, user.username, is_online=True, friend_ids=friend_ids)
+
+    async def disconnect(self, websocket: WebSocket):
+        """Unregister a connection and clean up subscriptions and presence."""
+        user = self._connections.pop(websocket, None)
+        self._ws_loops.pop(websocket, None)
+        task = self._heartbeat_tasks.pop(websocket, None)
+        if task:
+            task.cancel()
+
+        # Clean subscriptions
+        for world_id in list(self._world_subs.keys()):
+            self._world_subs[world_id].discard(websocket)
+            if not self._world_subs[world_id]:
+                self._world_subs.pop(world_id, None)
+
+        for conv_id in list(self._dm_subs.keys()):
+            self._dm_subs[conv_id].discard(websocket)
+            if not self._dm_subs[conv_id]:
+                self._dm_subs.pop(conv_id, None)
+
+        if user is None:
+            return
+
+        user_id = user.id
+        username = user.username
+        user_set = self._user_connections.get(user_id)
+        if user_set:
+            user_set.discard(websocket)
+            if not user_set:
+                self._user_connections.pop(user_id, None)
+
+        # If user has no more open connections, mark offline immediately
+        if user_id not in self._user_connections:
+            await presence_store.clear_heartbeat(user_id)
+            now = datetime.now(timezone.utc)
+            asyncio.create_task(_async_update_last_seen(user_id, now))
+            friend_ids = self._user_friend_ids.pop(user_id, set())
+            await self.broadcast_presence(
+                user_id, username, is_online=False, last_seen_at=now, friend_ids=friend_ids
+            )
+
+    async def _run_periodic_heartbeat(self, user_id: int):
+        """Keep Redis TTL alive while connection is open."""
+        try:
+            while True:
+                await asyncio.sleep(20)
+                await presence_store.heartbeat(user_id)
+        except asyncio.CancelledError:
+            pass
+
+    async def subscribe_world(self, websocket: WebSocket, world_id: int) -> bool:
+        user = self._connections.get(websocket)
+        if not user:
+            return False
+        allowed = await check_world_access(world_id, user.id)
+        if not allowed:
+            return False
+        self._world_subs.setdefault(world_id, set()).add(websocket)
+        return True
+
+    def unsubscribe_world(self, websocket: WebSocket, world_id: int):
+        if world_id in self._world_subs:
+            self._world_subs[world_id].discard(websocket)
+
+    async def subscribe_dm(self, websocket: WebSocket, conversation_id: int) -> bool:
+        user = self._connections.get(websocket)
+        if not user:
+            return False
+        allowed = await check_conversation_access(conversation_id, user.id)
+        if not allowed:
+            return False
+        self._dm_subs.setdefault(conversation_id, set()).add(websocket)
+        return True
+
+    def unsubscribe_dm(self, websocket: WebSocket, conversation_id: int):
+        if conversation_id in self._dm_subs:
+            self._dm_subs[conversation_id].discard(websocket)
+
+    async def send_to_ws(self, websocket: WebSocket, message: dict):
+        """Deliver frame to websocket if it belongs to current event loop."""
+        cur_loop = id(asyncio.get_running_loop())
+        if self._ws_loops.get(websocket) != cur_loop:
+            return
+        try:
+            await websocket.send_text(json.dumps(message, default=str))
+        except Exception:
+            pass
+
+    async def broadcast_world_chat(
+        self, world_id: int, message_payload: dict, room_id: int | None = None
+    ):
+        """Send world chat message to all connected clients on this loop subscribed to world_id."""
+        targets = list(self._world_subs.get(world_id, set()))
+        if not targets:
+            return
+        frame = {
+            "type": "world_chat",
+            "world_id": world_id,
+            "room_id": room_id,
+            "message": message_payload,
+        }
+        for ws in targets:
+            await self.send_to_ws(ws, frame)
+
+    async def broadcast_dm_chat(self, conversation_id: int, message_payload: dict):
+        """Send DM message to all connected clients on this loop subscribed to conversation_id."""
+        targets = list(self._dm_subs.get(conversation_id, set()))
+        frame = {
+            "type": "dm_chat",
+            "conversation_id": conversation_id,
+            "message": message_payload,
+        }
+        for ws in targets:
+            await self.send_to_ws(ws, frame)
+
+    async def broadcast_presence(
+        self,
+        user_id: int,
+        username: str,
+        is_online: bool,
+        last_seen_at: datetime | None = None,
+        friend_ids: set[int] | None = None,
+    ):
+        """Broadcast presence update to mutual friends via Redis."""
+        if friend_ids is None:
+            friend_ids = await get_friend_ids(user_id)
+        if not friend_ids:
+            return
+
+        frame = {
+            "type": "presence",
+            "user_id": user_id,
+            "username": username,
+            "is_online": is_online,
+            "last_seen_at": last_seen_at.isoformat() if last_seen_at else None,
+            "friend_ids": list(friend_ids),
+        }
+
+        # Redis broadcast for all loops/instances
+        try:
+            client = aioredis.from_url(settings.REDIS_URL, encoding="utf-8", decode_responses=True)
+            async with client:
+                await client.publish("presence:events", json.dumps(frame, default=str))
+        except Exception as exc:
+            logger.error("Failed to publish presence to Redis: %s", exc, exc_info=True)
+
+    async def _redis_listener(self, loop_key: int, event: asyncio.Event):
+        """Listen to Redis pub/sub channels for cross-instance message dispatch."""
+        while True:
+            try:
+                client = aioredis.from_url(settings.REDIS_URL, encoding="utf-8", decode_responses=True)
+                pubsub = client.pubsub()
+                await pubsub.psubscribe("world:*:chat", "dm:*:chat", "presence:events")
+                event.set()
+                logger.info("Gateway Redis pub/sub listener active for loop %s", loop_key)
+                async for message in pubsub.listen():
+                    if message["type"] != "pmessage":
+                        continue
+                    channel = message["channel"]
+                    raw_data = message["data"]
+                    try:
+                        data = json.loads(raw_data)
+                    except Exception:
+                        continue
+
+                    if channel.startswith("world:") and channel.endswith(":chat"):
+                        parts = channel.split(":")
+                        world_id = int(parts[1])
+                        await self.broadcast_world_chat(world_id, data, room_id=data.get("room_id"))
+                    elif channel.startswith("dm:") and channel.endswith(":chat"):
+                        parts = channel.split(":")
+                        conv_id = int(parts[1])
+                        await self.broadcast_dm_chat(conv_id, data)
+                    elif channel == "presence:events":
+                        logger.info("Redis presence event received: %s. Active users: %s", data, list(self._user_connections.keys()))
+                        for friend_id in data.get("friend_ids", []):
+                            targets = list(self._user_connections.get(friend_id, set()))
+                            logger.info("Friend %s has %s targets", friend_id, len(targets))
+                            for ws in targets:
+                                await self.send_to_ws(ws, data)
+            except asyncio.CancelledError:
+                break
+            except Exception as exc:
+                logger.debug("Redis listener encountered error, retrying in 2s: %s", exc)
+                event.clear()
+                await asyncio.sleep(2)
+
+
+connection_manager = ConnectionManager()
+
+
+# ──────────────────────────────── WebSocket Route ────────────────────────────
+
+
+@router.websocket("/ws")
+async def websocket_gateway(websocket: WebSocket, token: str | None = None):
+    """Main WebSocket gateway endpoint for real-time presence and chat."""
+    user: User | None = None
+    # 1. Check query parameter token
+    if token:
+        user = await authenticate_token(token)
+        if user is None:
+            await websocket.close(code=status.WS_1008_POLICY_VIOLATION)
+            return
+
+    await websocket.accept()
+
+    # 2. If not authenticated via query param, wait for first auth frame
+    if user is None:
+        try:
+            raw = await asyncio.wait_for(websocket.receive_text(), timeout=3.0)
+            data = json.loads(raw)
+            if data.get("type") == "auth" and data.get("token"):
+                user = await authenticate_token(data["token"])
+        except (asyncio.TimeoutError, json.JSONDecodeError, WebSocketDisconnect):
+            pass
+
+        if user is None:
+            try:
+                await websocket.send_text(json.dumps({"type": "error", "message": "Authentication failed"}))
+                await websocket.close(code=status.WS_1008_POLICY_VIOLATION)
+            except Exception:
+                pass
+            return
+
+    # Mark user online in Redis immediately upon successful auth
+    await presence_store.heartbeat(user.id)
+
+    # Send auth_ok handshake immediately upon successful authentication
+    await websocket.send_text(
+        json.dumps({
+            "type": "auth_ok",
+            "user_id": user.id,
+            "username": user.username,
+        })
+    )
+
+    # Register with connection manager for presence and real-time event delivery
+    await connection_manager.connect(websocket, user)
+
+    try:
+        while True:
+            text = await websocket.receive_text()
+            try:
+                msg = json.loads(text)
+            except json.JSONDecodeError:
+                await websocket.send_text(json.dumps({"type": "error", "message": "Invalid JSON"}))
+                continue
+
+            msg_type = msg.get("type")
+            if msg_type == "ping":
+                await websocket.send_text(json.dumps({"type": "pong"}))
+            elif msg_type == "heartbeat":
+                await presence_store.heartbeat(user.id)
+                await websocket.send_text(json.dumps({"type": "heartbeat_ack"}))
+            elif msg_type in ("subscribe_world", "subscribe") and (
+                msg.get("world_id") or msg.get("channel") == "world"
+            ):
+                world_id = msg.get("world_id") or msg.get("id")
+                if isinstance(world_id, int):
+                    ok = await connection_manager.subscribe_world(websocket, world_id)
+                    if ok:
+                        await websocket.send_text(
+                            json.dumps({"type": "subscribed", "channel": "world", "id": world_id})
+                        )
+                    else:
+                        await websocket.send_text(
+                            json.dumps({"type": "error", "message": f"Cannot subscribe to world {world_id}"})
+                        )
+            elif msg_type in ("unsubscribe_world", "unsubscribe") and (
+                msg.get("world_id") or msg.get("channel") == "world"
+            ):
+                world_id = msg.get("world_id") or msg.get("id")
+                if isinstance(world_id, int):
+                    connection_manager.unsubscribe_world(websocket, world_id)
+                    await websocket.send_text(
+                        json.dumps({"type": "unsubscribed", "channel": "world", "id": world_id})
+                    )
+            elif msg_type in ("subscribe_dm", "subscribe") and (
+                msg.get("conversation_id") or msg.get("channel") == "dm"
+            ):
+                conv_id = msg.get("conversation_id") or msg.get("id")
+                if isinstance(conv_id, int):
+                    ok = await connection_manager.subscribe_dm(websocket, conv_id)
+                    if ok:
+                        await websocket.send_text(
+                            json.dumps({"type": "subscribed", "channel": "dm", "id": conv_id})
+                        )
+                    else:
+                        await websocket.send_text(
+                            json.dumps({"type": "error", "message": f"Cannot subscribe to conversation {conv_id}"})
+                        )
+            elif msg_type in ("unsubscribe_dm", "unsubscribe") and (
+                msg.get("conversation_id") or msg.get("channel") == "dm"
+            ):
+                conv_id = msg.get("conversation_id") or msg.get("id")
+                if isinstance(conv_id, int):
+                    connection_manager.unsubscribe_dm(websocket, conv_id)
+                    await websocket.send_text(
+                        json.dumps({"type": "unsubscribed", "channel": "dm", "id": conv_id})
+                    )
+            else:
+                await websocket.send_text(json.dumps({"type": "error", "message": f"Unknown action: {msg_type}"}))
+
+    except WebSocketDisconnect:
+        pass
+    finally:
+        await connection_manager.disconnect(websocket)

backend/app/main.py

@@ -6,7 +6,12 @@ from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
 from app.config import settings
-from app.routers import auth, users, worlds, assets, avatar
+from app.routers import (
+    auth, users, worlds, assets, avatar, world_content, internal,
+    presence, groups, social_friends, profiles, chat_dm, chat_reports,
+    chat_world, wallet, payments, marketplace, payouts, discovery,
+)
+from app.gateway import ws
 
 
 from app.services.game_servers import supervisor
@@ -40,8 +45,27 @@ app.add_middleware(
 app.include_router(auth.router, prefix="/api/auth", tags=["auth"])
 app.include_router(users.router, prefix="/api/users", tags=["users"])
 app.include_router(worlds.router, prefix="/api/worlds", tags=["worlds"])
+app.include_router(world_content.router, prefix="/api/worlds", tags=["world-content"])
 app.include_router(assets.router, prefix="/api/assets", tags=["assets"])
 app.include_router(avatar.router, prefix="/api/avatar", tags=["avatar"])
+app.include_router(internal.router, prefix="/api/internal", tags=["internal"])
+app.include_router(presence.router, prefix="/api/presence", tags=["presence"])
+app.include_router(groups.router, prefix="/api/groups", tags=["groups"])
+app.include_router(social_friends.router, prefix="/api/friends", tags=["friends"])
+app.include_router(profiles.router, prefix="/api/profile", tags=["profile"])
+app.include_router(chat_dm.router, prefix="/api/chat/dm", tags=["chat-dm"])
+app.include_router(chat_reports.chat_router, prefix="/api/chat", tags=["chat-reports"])
+app.include_router(chat_reports.moderation_router, prefix="/api/moderation", tags=["moderation"])
+app.include_router(chat_world.router, prefix="/api/chat", tags=["chat-world"])
+app.include_router(chat_world.router, prefix="/v1/chat", tags=["chat-world"])
+app.include_router(wallet.router, prefix="/api/wallet", tags=["wallet"])
+app.include_router(payments.router, prefix="/api/payments", tags=["payments"])
+app.include_router(marketplace.router, prefix="/api/marketplace", tags=["marketplace"])
+app.include_router(payouts.router, prefix="/api/payouts", tags=["payouts"])
+app.include_router(discovery.router, prefix="/api/discovery", tags=["discovery"])
+app.include_router(ws.router, prefix="/api", tags=["websocket"])
+
+app.include_router(ws.router, prefix="/v1", tags=["websocket"])
 
 
 @app.get("/api/health")

backend/app/models/__init__.py

@@ -3,5 +3,29 @@ from app.models.session import Session
 from app.models.world import World
 from app.models.asset import Asset
 from app.models.avatar_loadout import AvatarLoadout
+from app.models.world_content import WorldRoom, WorldChunk, WorldChunkRevision
+from app.models.social import Friendship, Follow, Block, FriendshipStatus
+from app.models.chat import (
+    Conversation, ConversationParticipant, Message, MessageReport, ReportStatus,
+)
+from app.models.groups import Group, GroupMember, GroupRole
+from app.models.profile import Profile, ProfileFavorite, ProfileVisibility
+from app.models.wallet import Wallet, Transaction, TransactionType
+from app.models.marketplace import (
+    CatalogItem, MarketplaceListing, Purchase, CreatorBalance,
+    ItemType, ListingStatus, PurchaseStatus,
+)
+from app.models.world_visit import WorldVisit
 
-__all__ = ["User", "Session", "World", "Asset", "AvatarLoadout"]
+__all__ = [
+    "User", "Session", "World", "Asset", "AvatarLoadout",
+    "WorldRoom", "WorldChunk", "WorldChunkRevision",
+    "Friendship", "Follow", "Block", "FriendshipStatus",
+    "Conversation", "ConversationParticipant", "Message", "MessageReport", "ReportStatus",
+    "Group", "GroupMember", "GroupRole",
+    "Profile", "ProfileFavorite", "ProfileVisibility",
+    "Wallet", "Transaction", "TransactionType",
+    "CatalogItem", "MarketplaceListing", "Purchase", "CreatorBalance",
+    "ItemType", "ListingStatus", "PurchaseStatus",
+    "WorldVisit",
+]

backend/app/models/asset.py

@@ -23,7 +23,12 @@ class Asset(Base):
     name = Column(String(255), nullable=False)
     description = Column(Text, nullable=True)
     asset_type = Column(
-        ENUM(AssetType, name="asset_type", create_type=False),
+        ENUM(
+            AssetType,
+            name="asset_type",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
         nullable=False,
     )
     file_path = Column(String(512), nullable=False)

backend/app/models/chat.py

@@ -0,0 +1,221 @@
+"""Chat: DM conversations and world/room chat, plus message reports.
+
+docs/planning/social.md §4/§5 (US-4). This module is models + schema only --
+text filtering, rate limiting, and the send/list/report/moderation endpoints
+belong to sibling tasks that depend on this one.
+
+Delete-behavior choices (mirrors ``app/models/world_content.py``'s
+established convention of preserving audit/history data over cascading it
+away):
+
+- ``conversations.user_a_id`` / ``user_b_id`` -> CASCADE. A DM conversation
+  is meaningless with one of its two (and only) participants gone, so
+  deleting either user removes the conversation outright, which in turn
+  cascades to its ``conversation_participants`` rows and its ``messages``.
+- ``conversation_participants.user_id`` -> CASCADE, ``.conversation_id`` ->
+  CASCADE. Pure join-table rows; they only make sense alongside both sides.
+- ``messages.conversation_id`` -> CASCADE. Deleting a conversation deletes
+  its message history with it.
+- ``messages.sender_id`` -> SET NULL (nullable). Unlike a DM conversation
+  (which dies with its participants above), world/room chat history and any
+  message under moderation review should survive the sender's account being
+  deleted -- the row just becomes attributed to no one, matching how
+  ``WorldChunk.updated_by_id`` / ``WorldChunkRevision.actor_id`` treat
+  actor references as SET NULL rather than cascading away history.
+- ``messages.world_id`` / ``room_id`` -> CASCADE. World/room chat has no
+  meaning once the world or room it was said in is gone; consistent with
+  ``WorldChunk``'s own CASCADE from both.
+- ``message_reports.message_id`` -> SET NULL (nullable). Same audit-trail
+  reasoning as ``WorldChunkRevision`` (world_content.py): a moderation
+  report is a record that something *was* said and reported, which must
+  outlive the underlying message being removed (e.g. as the moderation
+  action taken in response to the report itself).
+- ``message_reports.reporter_id`` / ``moderator_id`` -> SET NULL (nullable).
+  Actor references for an audit record; the report itself must survive
+  either account being deleted later, matching the actor-reference
+  convention above.
+"""
+import enum
+
+from sqlalchemy import (
+    Boolean,
+    CheckConstraint,
+    Column,
+    DateTime,
+    ForeignKey,
+    Index,
+    Integer,
+    Text,
+    UniqueConstraint,
+)
+from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class ReportStatus(str, enum.Enum):
+    OPEN = "open"
+    RESOLVED = "resolved"
+    DISMISSED = "dismissed"
+
+
+class Conversation(Base):
+    """A DM conversation between exactly two users.
+
+    ``conversation_participants`` is the real roster (modeled as a join
+    table so a future group-DM schema change can widen it beyond two rows
+    without touching this table's shape), but a 2-party DM also needs a
+    cheap, DB-enforced "only one conversation per pair" guarantee, which a
+    plain join table can't express as a simple unique constraint. So the
+    pair is additionally denormalized here as ``user_a_id``/``user_b_id``,
+    always stored with the lower user id first (enforced by the check
+    constraint below); the API layer is responsible for normalizing the
+    pair before insert/lookup.
+    """
+
+    __tablename__ = "conversations"
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_a_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_b_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    participants = relationship(
+        "ConversationParticipant", back_populates="conversation", cascade="all, delete-orphan"
+    )
+    messages = relationship(
+        "Message", back_populates="conversation", cascade="all, delete-orphan"
+    )
+
+    __table_args__ = (
+        UniqueConstraint("user_a_id", "user_b_id", name="uq_conversations_pair"),
+        CheckConstraint("user_a_id < user_b_id", name="ck_conversations_ordered_pair"),
+    )
+
+
+class ConversationParticipant(Base):
+    """Join table of a conversation's members.
+
+    DMs are strictly 2-party today (enforced by ``Conversation``'s pair
+    columns above), but this is modeled as a real join table -- not folded
+    into ``Conversation`` -- so a later group-conversation feature can add
+    rows here without a schema change to this table.
+    """
+
+    __tablename__ = "conversation_participants"
+
+    id = Column(Integer, primary_key=True, index=True)
+    conversation_id = Column(
+        Integer, ForeignKey("conversations.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    # DM unread tracking (app/routers/chat_dm.py, migration 0010): bumped to
+    # "now" whenever this participant fetches the conversation's history.
+    # Null means "never read" -- everything in the conversation is unread.
+    last_read_at = Column(DateTime(timezone=True), nullable=True)
+
+    conversation = relationship("Conversation", back_populates="participants")
+    user = relationship("User")
+
+    __table_args__ = (
+        UniqueConstraint(
+            "conversation_id", "user_id", name="uq_conversation_participants_pair"
+        ),
+    )
+
+
+class Message(Base):
+    """A chat message: either a DM (``conversation_id`` set) or a
+    world/room chat message (``conversation_id`` null, ``world_id`` set and
+    optionally ``room_id``).
+
+    ``world_id`` is denormalized onto every world/room message (mirroring
+    ``WorldChunk.world_id``) so world-scoped history queries don't need a
+    join through rooms; ``room_id`` narrows further to a specific room when
+    the world subdivides chat by room, and is null for world-wide chat.
+    """
+
+    __tablename__ = "messages"
+
+    id = Column(Integer, primary_key=True, index=True)
+    sender_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    conversation_id = Column(
+        Integer, ForeignKey("conversations.id", ondelete="CASCADE"), nullable=True
+    )
+    world_id = Column(
+        Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=True
+    )
+    room_id = Column(
+        Integer, ForeignKey("world_rooms.id", ondelete="CASCADE"), nullable=True
+    )
+    body = Column(Text, nullable=False)
+    filtered = Column(Boolean, nullable=False, default=False, server_default="false")
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    sender = relationship("User")
+    conversation = relationship("Conversation", back_populates="messages")
+    world = relationship("World")
+    room = relationship("WorldRoom")
+    reports = relationship(
+        "MessageReport", back_populates="message", cascade="all, delete-orphan"
+    )
+
+    __table_args__ = (
+        Index("ix_messages_conversation_created", "conversation_id", "created_at"),
+        Index("ix_messages_world_created", "world_id", "created_at"),
+    )
+
+
+class MessageReport(Base):
+    """A moderation report filed against a message.
+
+    ``message_id`` is nullable with ``ON DELETE SET NULL`` (rather than
+    CASCADE) so the report -- the audit record that something was said and
+    flagged -- outlives the message row, including when the message's own
+    removal is the moderation action taken in response to this report.
+    """
+
+    __tablename__ = "message_reports"
+
+    id = Column(Integer, primary_key=True, index=True)
+    message_id = Column(
+        Integer, ForeignKey("messages.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    reporter_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    reason = Column(Text, nullable=False)
+    status = Column(
+        ENUM(
+            ReportStatus,
+            name="message_report_status",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
+        nullable=False,
+        default=ReportStatus.OPEN,
+        server_default=ReportStatus.OPEN.value,
+    )
+    moderator_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    resolved_at = Column(DateTime(timezone=True), nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    message = relationship("Message", back_populates="reports")
+    reporter = relationship("User", foreign_keys=[reporter_id])
+    moderator = relationship("User", foreign_keys=[moderator_id])

backend/app/models/groups.py

@@ -0,0 +1,97 @@
+"""Groups: named groups with owner/admin/member roles.
+
+docs/planning/social.md §4/§5 (US-5). This module is models + schema only --
+create/join/leave, role authorization (only the owner may transfer ownership
+or promote/demote admins), and the group page aggregate endpoint belong to
+the API router task ("Groups API") that depends on this one.
+
+Delete-behavior choices:
+
+- ``groups.owner_id`` -> ``SET NULL`` (nullable). A group is a durable,
+  multi-member community, not content solely attributable to one person like
+  a ``World``/``Asset``. Cascading the group away (or hard-blocking the
+  owner's account deletion) would punish every other member for the owner's
+  choice to leave the platform. Instead the group and its full membership
+  list survive with ``owner_id`` nulled out; the sibling API task is
+  responsible for surfacing an ownerless group (e.g. prompting an admin to
+  claim ownership) the same way ``Message.sender_id`` / ``WorldChunk``'s
+  actor columns already treat "the actor is gone" as a survivable state
+  elsewhere in this schema.
+- ``group_members.group_id`` -> ``CASCADE``. A membership row is meaningless
+  without the group it belongs to; deleting a group deletes its roster,
+  mirroring ``ConversationParticipant.conversation_id`` in chat.py.
+- ``group_members.user_id`` -> ``CASCADE``. Deleting a user removes their own
+  membership rows wherever they appear, matching the join-table convention
+  used by ``ConversationParticipant.user_id`` and the social-graph tables
+  (``Friendship``/``Follow``/``Block``) for plain per-user references.
+"""
+import enum
+
+from sqlalchemy import Column, DateTime, ForeignKey, Integer, String, Text, UniqueConstraint
+from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class GroupRole(str, enum.Enum):
+    OWNER = "owner"
+    ADMIN = "admin"
+    MEMBER = "member"
+
+
+class Group(Base):
+    """A named group. ``owner_id`` is nullable -- see module docstring for
+    why the group survives its owner's account deletion."""
+
+    __tablename__ = "groups"
+
+    id = Column(Integer, primary_key=True, index=True)
+    name = Column(String(100), nullable=False)
+    description = Column(Text, nullable=True)
+    owner_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    owner = relationship("User", back_populates="owned_groups")
+    members = relationship(
+        "GroupMember", back_populates="group", cascade="all, delete-orphan"
+    )
+
+
+class GroupMember(Base):
+    """A group's roster: one row per (group, user) with a role."""
+
+    __tablename__ = "group_members"
+
+    id = Column(Integer, primary_key=True, index=True)
+    group_id = Column(
+        Integer, ForeignKey("groups.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    role = Column(
+        ENUM(
+            GroupRole,
+            name="group_role",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
+        nullable=False,
+        default=GroupRole.MEMBER,
+        server_default=GroupRole.MEMBER.value,
+    )
+    joined_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    group = relationship("Group", back_populates="members")
+    user = relationship("User", back_populates="group_memberships")
+
+    __table_args__ = (
+        UniqueConstraint("group_id", "user_id", name="uq_group_members_pair"),
+    )

backend/app/models/marketplace.py

@@ -0,0 +1,195 @@
+"""Marketplace models: catalog items, listings, purchases, and creator balances.
+
+docs/planning/economy.md US-3, US-4 (task 166836d55365).
+"""
+
+from datetime import datetime, timezone
+import enum
+
+from sqlalchemy import (
+    BigInteger,
+    CheckConstraint,
+    Column,
+    DateTime,
+    Enum,
+    ForeignKey,
+    Integer,
+    String,
+    func,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.types import JSON
+from sqlalchemy.orm import relationship
+
+from app.database import Base
+
+
+class ItemType(str, enum.Enum):
+    asset = "asset"
+    avatar_item = "avatar_item"
+    experience_pass = "experience_pass"
+
+
+class ListingStatus(str, enum.Enum):
+    active = "active"
+    sold = "sold"
+    delisted = "delisted"
+    removed_by_moderation = "removed_by_moderation"
+
+
+class PurchaseStatus(str, enum.Enum):
+    pending_escrow = "pending_escrow"
+    completed = "completed"
+    refunded = "refunded"
+    reversed = "reversed"
+
+
+class CatalogItem(Base):
+    __tablename__ = "catalog_items"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    owner_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    asset_id = Column(Integer, ForeignKey("assets.id", ondelete="SET NULL"), nullable=True, index=True)
+    item_type = Column(Enum(ItemType, name="catalog_item_type"), nullable=False)
+    name = Column(String(100), nullable=False)
+    description = Column(String(2000), nullable=True)
+    metadata_json = Column(JSONB().with_variant(JSON, "sqlite"), nullable=True)
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    owner = relationship("User", foreign_keys=[owner_id])
+    asset = relationship("Asset", foreign_keys=[asset_id])
+    listings = relationship("MarketplaceListing", back_populates="catalog_item", cascade="all, delete-orphan")
+
+
+class MarketplaceListing(Base):
+    __tablename__ = "marketplace_listings"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    catalog_item_id = Column(BigInteger, ForeignKey("catalog_items.id", ondelete="CASCADE"), nullable=False, index=True)
+    seller_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    price = Column(BigInteger, nullable=False)
+    status = Column(
+        Enum(ListingStatus, name="marketplace_listing_status"),
+        nullable=False,
+        default=ListingStatus.active,
+        server_default=ListingStatus.active.value,
+    )
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+    updated_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        onupdate=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    __table_args__ = (
+        CheckConstraint("price > 0", name="check_listing_price_positive"),
+    )
+
+    catalog_item = relationship("CatalogItem", back_populates="listings")
+    seller = relationship("User", foreign_keys=[seller_id])
+
+
+class Purchase(Base):
+    __tablename__ = "purchases"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    listing_id = Column(BigInteger, ForeignKey("marketplace_listings.id", ondelete="SET NULL"), nullable=True, index=True)
+    buyer_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    seller_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    price = Column(BigInteger, nullable=False)
+    platform_fee = Column(BigInteger, nullable=False)
+    seller_net = Column(BigInteger, nullable=False)
+    status = Column(
+        Enum(PurchaseStatus, name="purchase_status"),
+        nullable=False,
+        default=PurchaseStatus.pending_escrow,
+        server_default=PurchaseStatus.pending_escrow.value,
+    )
+    escrow_hold_until = Column(DateTime(timezone=True), nullable=True)
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    listing = relationship("MarketplaceListing", foreign_keys=[listing_id])
+    buyer = relationship("User", foreign_keys=[buyer_id])
+    seller = relationship("User", foreign_keys=[seller_id])
+
+
+class CreatorBalance(Base):
+    __tablename__ = "creator_balances"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), unique=True, nullable=False, index=True)
+    available = Column(BigInteger, nullable=False, default=0, server_default="0")
+    pending = Column(BigInteger, nullable=False, default=0, server_default="0")
+    lifetime_earned = Column(BigInteger, nullable=False, default=0, server_default="0")
+    updated_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        onupdate=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    __table_args__ = (
+        CheckConstraint("available >= 0", name="check_creator_available_non_negative"),
+        CheckConstraint("pending >= 0", name="check_creator_pending_non_negative"),
+        CheckConstraint("lifetime_earned >= 0", name="check_creator_lifetime_non_negative"),
+    )
+
+    user = relationship("User", foreign_keys=[user_id])
+
+
+class PayoutStatus(str, enum.Enum):
+    pending = "pending"
+    approved = "approved"
+    paid = "paid"
+    rejected = "rejected"
+
+
+class PayoutRequest(Base):
+    __tablename__ = "payout_requests"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    creator_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    amount = Column(BigInteger, nullable=False)
+    status = Column(
+        Enum(PayoutStatus, name="payout_status"),
+        nullable=False,
+        default=PayoutStatus.pending,
+        server_default=PayoutStatus.pending.value,
+    )
+    external_ref = Column(String(255), nullable=True)
+    provider_ref = Column(String(255), nullable=True)
+    requested_by = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True)
+    reviewed_by = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True)
+    reviewed_at = Column(DateTime(timezone=True), nullable=True)
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    __table_args__ = (
+        CheckConstraint("amount > 0", name="check_payout_amount_positive"),
+    )
+
+    creator = relationship("User", foreign_keys=[creator_id])
+    requester = relationship("User", foreign_keys=[requested_by])
+    reviewer = relationship("User", foreign_keys=[reviewed_by])

backend/app/models/profile.py

@@ -0,0 +1,129 @@
+"""User profile: bio, avatar reference, privacy settings, favorite worlds.
+
+This module is models + migration only -- the public profile view endpoint
+(``GET /api/profile/{user_id}``, which will need to interpret ``privacy_json``
+against the viewer's relationship to the owner) belongs to a sibling task
+that depends on this one. This task only owns the authenticated-owner
+read/write endpoints (``/api/profile/me`` and its ``favorites`` sub-resource).
+
+Design choices:
+
+- ``profiles.user_id`` is both the primary key and the FK to ``users.id``
+  (``ondelete="CASCADE"``) -- exactly one profile row per user, following the
+  same one-row-per-user shape as ``AvatarLoadout`` (app/models/avatar_loadout.py).
+  The row is created lazily (upserted) on first ``PUT /api/profile/me``
+  rather than at registration time, again mirroring ``AvatarLoadout``.
+- ``avatar_asset_id`` -> ``assets.id`` with ``ondelete="SET NULL"``. A
+  profile's chosen "avatar picture" asset is a soft reference: if the
+  underlying asset is later deleted the profile shouldn't be destroyed or
+  left pointing at a dangling id, it should just fall back to "no avatar
+  picture set" (nullable). The API layer additionally validates on write
+  that the referenced asset actually exists (existence is not enforced by
+  the FK alone at the API layer, since the FK only stops inserts of a
+  nonexistent id -- it doesn't tell the caller *why* their PUT failed).
+- ``bio`` is ``Text`` with the 500-char cap enforced at the API/schema layer
+  (Pydantic ``max_length``), matching how ``StatusUpdate.status_message`` in
+  presence.py enforces its length cap in the router rather than the schema.
+- ``privacy_json`` is JSONB (project convention for document-shaped fields --
+  see avatar_loadout.py, world_content.py) holding exactly three keys, each a
+  ``ProfileVisibility`` enum value (stored as its string value in JSON, not a
+  Postgres ENUM type -- there's no need for a DB-level enum since this is a
+  small, entirely API-validated document, and a plain JSONB column is easier
+  to extend with more privacy keys later without a migration):
+    - ``profile_visibility``: who can view the profile at all.
+    - ``friends_list_visibility``: who can see the user's friends list.
+    - ``favorites_visibility``: who can see the user's favorited worlds.
+  Each value is one of "public", "friends", "private". Defaults (applied when
+  a profile is first created) are all "public" -- the least surprising
+  default for a new social feature, matching the "everything visible unless
+  you lock it down" posture other social features here take by default
+  (e.g. presence/status has no privacy gate at all yet).
+- Favorites use a join table (``profile_favorites``: ``user_id`` + ``world_id``,
+  composite PK) rather than a JSON array column. A plain FK join table gets
+  referential integrity for free (a favorited world that's later deleted
+  disappears from favorites automatically via ON DELETE CASCADE, matching
+  how ``World.assets``/``World.rooms`` cascade), lets Postgres enforce
+  "no duplicate favorite" via the composite PK instead of API-layer
+  deduplication, and keeps "does this world still exist" as a DB invariant
+  rather than something every reader has to re-check against a JSON blob.
+  The tradeoff (an extra table/join vs. a single JSON column) is worth it
+  here because favorites are a list of foreign-key references, not a
+  free-form document -- the exact case join tables suit better than JSONB.
+"""
+import enum
+
+from sqlalchemy import Column, Integer, ForeignKey, Text, DateTime
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class ProfileVisibility(str, enum.Enum):
+    PUBLIC = "public"
+    FRIENDS = "friends"
+    PRIVATE = "private"
+
+
+# Applied when a profile is created for the first time (lazy upsert on the
+# first PUT /api/profile/me). Keys match the three privacy_json fields
+# documented above.
+DEFAULT_PRIVACY: dict = {
+    "profile_visibility": ProfileVisibility.PUBLIC.value,
+    "friends_list_visibility": ProfileVisibility.PUBLIC.value,
+    "favorites_visibility": ProfileVisibility.PUBLIC.value,
+}
+
+BIO_MAX_LEN = 500
+
+
+class Profile(Base):
+    """One row per user: bio, avatar picture reference, privacy settings."""
+
+    __tablename__ = "profiles"
+
+    user_id = Column(
+        Integer,
+        ForeignKey("users.id", ondelete="CASCADE"),
+        primary_key=True,
+    )
+    avatar_asset_id = Column(
+        Integer,
+        ForeignKey("assets.id", ondelete="SET NULL"),
+        nullable=True,
+    )
+    bio = Column(Text, nullable=True)
+    privacy_json = Column(JSONB, nullable=False, server_default="{}")
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    user = relationship("User", back_populates="profile")
+    avatar_asset = relationship("Asset")
+    # Deliberately no ORM relationship to ProfileFavorite here: profiles and
+    # profile_favorites both independently FK users.id (no direct FK between
+    # the two tables), and the router only ever needs to query/replace a
+    # user's favorites by user_id directly -- not traverse it off a loaded
+    # Profile object. Keeping it a plain queryable table avoids a
+    # hand-spelled, easy-to-get-wrong primaryjoin for no real benefit.
+
+
+class ProfileFavorite(Base):
+    """A user's favorited world. Composite PK -- see module docstring for why
+    this is a join table rather than a JSON array column."""
+
+    __tablename__ = "profile_favorites"
+
+    user_id = Column(
+        Integer,
+        ForeignKey("users.id", ondelete="CASCADE"),
+        primary_key=True,
+    )
+    world_id = Column(
+        Integer,
+        ForeignKey("worlds.id", ondelete="CASCADE"),
+        primary_key=True,
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    world = relationship("World")

backend/app/models/social.py

@@ -0,0 +1,106 @@
+"""Social graph: friendships, follows, blocks.
+
+docs/planning/social.md §4/§5 (US-1). Friends = mutual (request -> accept),
+Follow = one-way (no approval), Block = hard deny. This module is models +
+schema only -- the request/accept/block business logic (idempotent
+duplicate/self handling, removing an existing friendship/follow on block,
+etc.) belongs to the API router task that depends on this one.
+"""
+import enum
+
+from sqlalchemy import Column, Integer, ForeignKey, DateTime, UniqueConstraint
+from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class FriendshipStatus(str, enum.Enum):
+    PENDING = "pending"
+    ACCEPTED = "accepted"
+
+
+class Friendship(Base):
+    """A friend request, directional until accepted.
+
+    ``requester_id`` sent the request to ``addressee_id``. Once accepted the
+    friendship is mutual, but the row stays directional (who asked whom) for
+    audit purposes; the API layer treats it as symmetric once accepted.
+    """
+
+    __tablename__ = "friendships"
+
+    id = Column(Integer, primary_key=True, index=True)
+    requester_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    addressee_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    status = Column(
+        ENUM(
+            FriendshipStatus,
+            name="friendship_status",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
+        nullable=False,
+        default=FriendshipStatus.PENDING,
+        server_default=FriendshipStatus.PENDING.value,
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    requester = relationship("User", foreign_keys=[requester_id], back_populates="sent_friend_requests")
+    addressee = relationship("User", foreign_keys=[addressee_id], back_populates="received_friend_requests")
+
+    __table_args__ = (
+        UniqueConstraint("requester_id", "addressee_id", name="uq_friendships_pair"),
+    )
+
+
+class Follow(Base):
+    """A one-way follow relationship: ``follower_id`` follows ``followed_id``."""
+
+    __tablename__ = "follows"
+
+    id = Column(Integer, primary_key=True, index=True)
+    follower_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    followed_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    follower = relationship("User", foreign_keys=[follower_id], back_populates="following")
+    followed = relationship("User", foreign_keys=[followed_id], back_populates="followers")
+
+    __table_args__ = (
+        UniqueConstraint("follower_id", "followed_id", name="uq_follows_pair"),
+    )
+
+
+class Block(Base):
+    """A hard deny: ``blocker_id`` has blocked ``blocked_id``."""
+
+    __tablename__ = "blocks"
+
+    id = Column(Integer, primary_key=True, index=True)
+    blocker_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    blocked_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    blocker = relationship("User", foreign_keys=[blocker_id], back_populates="blocks_initiated")
+    blocked = relationship("User", foreign_keys=[blocked_id], back_populates="blocked_by")
+
+    __table_args__ = (
+        UniqueConstraint("blocker_id", "blocked_id", name="uq_blocks_pair"),
+    )

backend/app/models/user.py

@@ -1,7 +1,7 @@
 from datetime import date
 from typing import Optional
 
-from sqlalchemy import Column, Integer, String, Boolean, DateTime, Date
+from sqlalchemy import Column, Integer, String, Boolean, DateTime, Date, Text
 from sqlalchemy.orm import relationship
 from sqlalchemy.sql import func
 
@@ -20,6 +20,10 @@ class User(Base):
     created_at = Column(DateTime(timezone=True), server_default=func.now())
     updated_at = Column(DateTime(timezone=True), onupdate=func.now())
 
+    # Presence / status (backend/app/services/presence.py, app/routers/presence.py)
+    last_seen_at = Column(DateTime(timezone=True), nullable=True)
+    status_message = Column(Text, nullable=True)
+
     sessions = relationship("Session", back_populates="user", cascade="all, delete-orphan")
     refresh_tokens = relationship("RefreshToken", back_populates="user", cascade="all, delete-orphan")
     worlds = relationship("World", back_populates="owner")
@@ -31,6 +35,63 @@ class User(Base):
         cascade="all, delete-orphan",
     )
 
+    # Profile (app/models/profile.py): bio/avatar picture/privacy + favorites.
+    profile = relationship(
+        "Profile",
+        back_populates="user",
+        uselist=False,
+        cascade="all, delete-orphan",
+    )
+
+    # Social graph (docs/planning/social.md US-1; app/models/social.py)
+    sent_friend_requests = relationship(
+        "Friendship",
+        foreign_keys="Friendship.requester_id",
+        back_populates="requester",
+        cascade="all, delete-orphan",
+    )
+    received_friend_requests = relationship(
+        "Friendship",
+        foreign_keys="Friendship.addressee_id",
+        back_populates="addressee",
+        cascade="all, delete-orphan",
+    )
+    following = relationship(
+        "Follow",
+        foreign_keys="Follow.follower_id",
+        back_populates="follower",
+        cascade="all, delete-orphan",
+    )
+    followers = relationship(
+        "Follow",
+        foreign_keys="Follow.followed_id",
+        back_populates="followed",
+        cascade="all, delete-orphan",
+    )
+    blocks_initiated = relationship(
+        "Block",
+        foreign_keys="Block.blocker_id",
+        back_populates="blocker",
+        cascade="all, delete-orphan",
+    )
+    blocked_by = relationship(
+        "Block",
+        foreign_keys="Block.blocked_id",
+        back_populates="blocked",
+        cascade="all, delete-orphan",
+    )
+
+    # Groups (docs/planning/social.md US-5; app/models/groups.py)
+    owned_groups = relationship(
+        "Group",
+        back_populates="owner",
+    )
+    group_memberships = relationship(
+        "GroupMember",
+        back_populates="user",
+        cascade="all, delete-orphan",
+    )
+
     @property
     def is_adult(self) -> bool:
         """Return True if the user is 18 or older based on date_of_birth."""

backend/app/models/wallet.py

@@ -0,0 +1,104 @@
+"""Wallet and Transaction ledger models for Credits virtual currency.
+
+docs/planning/economy.md US-1.
+"""
+
+from datetime import datetime, timezone
+import enum
+
+from sqlalchemy import (
+    BigInteger,
+    CheckConstraint,
+    Column,
+    DateTime,
+    Enum,
+    ForeignKey,
+    Integer,
+    String,
+    func,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.types import JSON
+from sqlalchemy.orm import relationship
+
+from app.database import Base
+
+
+class TransactionType(str, enum.Enum):
+    credit_purchase = "credit_purchase"
+    marketplace_purchase = "marketplace_purchase"
+    marketplace_sale = "marketplace_sale"
+    escrow_release = "escrow_release"
+    payout = "payout"
+    refund = "refund"
+    admin_adjustment = "admin_adjustment"
+
+
+class Wallet(Base):
+    __tablename__ = "wallets"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    user_id = Column(
+        Integer,
+        ForeignKey("users.id", ondelete="CASCADE"),
+        unique=True,
+        nullable=False,
+        index=True,
+    )
+    balance = Column(BigInteger, nullable=False, default=0, server_default="0")
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+    updated_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        onupdate=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+    )
+
+    __table_args__ = (
+        CheckConstraint("balance >= 0", name="check_wallet_balance_non_negative"),
+    )
+
+    user = relationship("User", backref="wallet", uselist=False)
+    transactions = relationship(
+        "Transaction",
+        back_populates="wallet",
+        cascade="all, delete-orphan",
+        order_by="Transaction.created_at.desc()",
+    )
+
+
+class Transaction(Base):
+    __tablename__ = "transactions"
+
+    id = Column(BigInteger, primary_key=True, autoincrement=True)
+    wallet_id = Column(
+        BigInteger,
+        ForeignKey("wallets.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    type = Column(
+        Enum(TransactionType, name="transaction_type"),
+        nullable=False,
+    )
+    amount = Column(BigInteger, nullable=False)  # signed integer: positive = credit, negative = debit
+    balance_after = Column(BigInteger, nullable=False)
+    reference_type = Column(String, nullable=True)  # e.g. "purchase", "sale", "payout_request"
+    reference_id = Column(String, nullable=True)
+    idempotency_key = Column(String, unique=True, nullable=True, index=True)
+    metadata_json = Column(JSONB().with_variant(JSON, "sqlite"), nullable=True)
+    created_at = Column(
+        DateTime(timezone=True),
+        nullable=False,
+        default=lambda: datetime.now(timezone.utc),
+        server_default=func.now(),
+        index=True,
+    )
+
+    wallet = relationship("Wallet", back_populates="transactions")

backend/app/models/world.py

@@ -1,5 +1,5 @@
-from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey
+from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey, Index
-from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.dialects.postgresql import ENUM, ARRAY
 from sqlalchemy.orm import relationship
 from sqlalchemy.sql import func
 import enum
@@ -29,8 +29,19 @@ class World(Base):
         ),
         default=WorldVisibility.PUBLIC,
     )
+    category = Column(String(100), nullable=True, index=True)
+    tags = Column(ARRAY(String), nullable=True, server_default="{}")
+    play_count = Column(Integer, nullable=False, server_default="0", index=True)
+    last_played_at = Column(DateTime(timezone=True), nullable=True)
     created_at = Column(DateTime(timezone=True), server_default=func.now())
     updated_at = Column(DateTime(timezone=True), onupdate=func.now())
 
+    __table_args__ = (
+        Index("ix_worlds_tags", "tags", postgresql_using="gin"),
+    )
+
     owner = relationship("User", back_populates="worlds")
     assets = relationship("Asset", back_populates="world", cascade="all, delete-orphan")
+    rooms = relationship("WorldRoom", back_populates="world", cascade="all, delete-orphan")
+    visits = relationship("WorldVisit", back_populates="world", cascade="all, delete-orphan")
+

backend/app/models/world_content.py

@@ -0,0 +1,153 @@
+"""World content persistence models.
+
+Implements the schema decided in ``docs/architecture/world_persistence_impl.md``
+§4: chunk content (rooms, chunk payloads, chunk revisions) lives in Postgres,
+alongside ``worlds``, rather than in a per-world SQLite file
+(``docs/architecture/world.md`` §4, superseded).
+
+The chunk *payload* format itself (the 48-byte header + sectioned binary
+body) is unchanged from ``world.md`` §3.6 and is decoded/encoded by
+``app.services.chunk_codec``, not by these models -- these just store the
+opaque ``BYTEA``.
+
+Conventions follow the existing models (``app/models/world.py``,
+``app/models/avatar_loadout.py``): declarative ``Column(...)`` style,
+``Integer`` surrogate PKs, ``DateTime(timezone=True)`` with
+``server_default=func.now()``, JSONB for document-shaped fields.
+"""
+
+from sqlalchemy import (
+    Boolean,
+    Column,
+    DateTime,
+    ForeignKey,
+    Index,
+    Integer,
+    LargeBinary,
+    String,
+    UniqueConstraint,
+    text,
+)
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+# Default chunk grid, matching Chunk.CHUNK_SIZE_* in scripts/chunk.gd (the
+# client's source of truth for the same constants) and world.md §2.2.
+DEFAULT_ROOM_GRID: dict = {"size": [32, 32, 1], "origin": [0, 0, 0]}
+
+# The room every world gets automatically (world_persistence_impl.md §4.1).
+MAIN_ROOM_SLUG = "main"
+MAIN_ROOM_NAME = "Main"
+
+
+class WorldRoom(Base):
+    """A bounded region within a world -- a level, building, or zone
+    (world.md §2.1). Holds the chunk grid config so a world can later hold
+    rooms with different grids without touching the ``worlds`` table.
+    """
+
+    __tablename__ = "world_rooms"
+
+    id = Column(Integer, primary_key=True, index=True)
+    world_id = Column(
+        Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    slug = Column(String(64), nullable=False)  # url-safe; "main" by default
+    name = Column(String(255), nullable=False)
+    # {"size": [x, y, z], "origin": [x, y, z]}
+    grid = Column(
+        JSONB, nullable=False,
+        server_default='{"size": [32, 32, 1], "origin": [0, 0, 0]}',
+    )
+    bounds = Column(JSONB, nullable=True)  # {"min":[x,y,z], "max":[x,y,z]}; null = unbounded
+    spawn = Column(JSONB, nullable=True)  # {"pos":[x,y,z], "yaw": 0.0}
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    __table_args__ = (
+        UniqueConstraint("world_id", "slug", name="uq_world_rooms_world_slug"),
+    )
+
+    world = relationship("World", back_populates="rooms")
+    chunks = relationship("WorldChunk", back_populates="room", cascade="all, delete-orphan")
+
+
+class WorldChunk(Base):
+    """One chunk's persisted content -- the atomic load/save/stream unit
+    (world.md §2.1). ``payload`` is the world.md §3.6 binary blob, stored
+    verbatim as BYTEA.
+
+    Deltas from world.md §4.4 (SQLite design): a surrogate integer PK +
+    unique coordinate constraint (rather than ``chunk_key`` as the PK), no
+    ``dirty`` column (write-behind doesn't apply over Postgres -- see
+    world_persistence_impl.md §3.3/§5), and content flags folded into this
+    row as JSONB + an indexed ``is_mature`` boolean rather than a separate
+    ``content_flags`` table (world.md §4.6).
+    """
+
+    __tablename__ = "world_chunks"
+
+    id = Column(Integer, primary_key=True, index=True)
+    world_id = Column(
+        Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=False, index=True
+    )  # denormalized: world-scoped queries without a join through rooms
+    room_id = Column(
+        Integer, ForeignKey("world_rooms.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    chunk_key = Column(String(160), nullable=False, unique=True)  # world.md §2.3 / §4.5
+    cx = Column(Integer, nullable=False)
+    cy = Column(Integer, nullable=False)
+    cz = Column(Integer, nullable=False, server_default="0")
+
+    format_version = Column(Integer, nullable=False, server_default="1")
+    payload = Column(LargeBinary, nullable=False)  # world.md §3.6 bytes
+    payload_len = Column(Integer, nullable=False)
+    checksum = Column(String(64), nullable=False)  # SHA-256 hex of payload body
+    revision = Column(Integer, nullable=False, server_default="1")
+
+    content_flags = Column(JSONB, nullable=False, server_default="{}")  # world.md §3.4
+    is_mature = Column(Boolean, nullable=False, server_default="false")
+
+    updated_by_id = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    __table_args__ = (
+        UniqueConstraint("room_id", "cx", "cy", "cz", name="uq_world_chunks_coord"),
+        Index("ix_world_chunks_room_coord", "room_id", "cx", "cy", "cz"),
+        Index("ix_world_chunks_mature", "world_id", postgresql_where=text("is_mature")),
+    )
+
+    room = relationship("WorldRoom", back_populates="chunks")
+
+
+class WorldChunkRevision(Base):
+    """Audit trail of chunk writes (world.md §4.7). ``chunk_key``/``world_id``
+    are deliberately **not** foreign keys, so deleting a chunk or a world
+    preserves the audit trail.
+
+    Retention (world_persistence_impl.md §4.3, required): only the newest
+    ``settings.WORLD_CHUNK_REVISION_KEEP`` rows per ``chunk_key`` keep a
+    non-null ``payload``; older rows are pruned (payload nulled, metadata
+    row kept) by ``WorldStore`` in the same transaction as the write that
+    triggers it.
+    """
+
+    __tablename__ = "world_chunk_revisions"
+
+    id = Column(Integer, primary_key=True, index=True)
+    chunk_key = Column(String(160), nullable=False, index=True)
+    world_id = Column(Integer, nullable=False, index=True)
+    revision = Column(Integer, nullable=False)
+    action = Column(String(16), nullable=False)  # 'create' | 'update' | 'delete'
+    actor_id = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
+    checksum = Column(String(64), nullable=False)
+    payload = Column(LargeBinary, nullable=True)  # full payload at this revision; nulled by retention
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False, index=True)

backend/app/models/world_visit.py

@@ -0,0 +1,27 @@
+"""World visit tracking model for discovery analytics.
+
+docs/planning/discovery.md (task b377353b8167).
+"""
+
+from sqlalchemy import Column, Integer, String, DateTime, ForeignKey, Index
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class WorldVisit(Base):
+    __tablename__ = "world_visits"
+
+    id = Column(Integer, primary_key=True, index=True)
+    world_id = Column(Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=False, index=True)
+    user_id = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True)
+    anonymous_token = Column(String(255), nullable=True)
+    visited_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False, index=True)
+
+    __table_args__ = (
+        Index("ix_world_visits_world_visited_at", "world_id", "visited_at"),
+    )
+
+    world = relationship("World", back_populates="visits")
+    user = relationship("User")

backend/app/rate_limit.py

@@ -54,6 +54,12 @@ def _client_key(request: Request) -> str:
 # brute-forcer.
 _auth_limiter = SlidingWindowLimiter(max_hits=10, window_seconds=60)
 
+# Every limiter in the process -- named limits built via `rate_limit()`
+# below register themselves here too, so `reset_all()` (the test hook) and
+# any future process-wide accounting stay correct without each caller
+# having to remember to wire it up.
+_registered_limiters: list[SlidingWindowLimiter] = [_auth_limiter]
+
 
 async def auth_rate_limit(request: Request) -> None:
     """FastAPI dependency: rate-limit auth attempts per client IP.
@@ -68,6 +74,41 @@ async def auth_rate_limit(request: Request) -> None:
     _auth_limiter.check(f"auth:{_client_key(request)}")
 
 
+def rate_limit(name: str, *, max_hits: int, window_seconds: float):
+    """Build a named, per-client-IP FastAPI rate-limit dependency.
+
+    Generalizes the ``auth_rate_limit`` pattern above for other endpoints
+    (e.g. chat send, message report) that want their own independent cap:
+
+        report_rate_limit = rate_limit("message_report", max_hits=5, window_seconds=60)
+
+        @router.post("/report", dependencies=[Depends(report_rate_limit)])
+        ...
+
+    Each call gets its own ``SlidingWindowLimiter`` -- counters for one
+    named limit never bleed into another, even for the same client IP --
+    and reuses ``SlidingWindowLimiter.check`` for the actual sliding-window
+    accounting and the 429 + ``Retry-After`` response. Like
+    ``auth_rate_limit``, the returned dependency is a no-op when
+    ``settings.RATE_LIMIT_ENABLED`` is false, so the checkpoint smoke suite
+    (one client IP for the whole run) doesn't trip on it.
+
+    ``name`` only needs to be unique within the process; it namespaces the
+    per-IP key so it doesn't collide with ``auth_rate_limit`` or any other
+    named limit.
+    """
+    limiter = SlidingWindowLimiter(max_hits=max_hits, window_seconds=window_seconds)
+    _registered_limiters.append(limiter)
+
+    async def _dependency(request: Request) -> None:
+        if not settings.RATE_LIMIT_ENABLED:
+            return
+        limiter.check(f"{name}:{_client_key(request)}")
+
+    return _dependency
+
+
 def reset_all() -> None:
     """Test hook."""
-    _auth_limiter.reset()
+    for limiter in _registered_limiters:
+        limiter.reset()

backend/app/routers/chat_dm.py

@@ -0,0 +1,399 @@
+"""Direct-message (DM) chat router.
+
+docs/planning/social.md §4/§5 (US-4). Builds the send/list REST surface on
+top of ``app/models/chat.py`` (Conversation/ConversationParticipant/Message,
+already merged), ``app/services/text_filter.py`` (already merged), and
+``app/rate_limit.py`` (already merged).
+
+Endpoints:
+- POST /api/chat/dm/{user_id}/messages     -- send a DM to ``user_id``
+- GET  /api/chat/dm/{user_id}/messages     -- paginated history with ``user_id``
+- GET  /api/chat/dm/conversations          -- list the caller's conversations
+
+Scope/boundaries (per task): REST send/list only, no WebSocket/real-time
+delivery (separate task), no world/room chat (separate sibling task; that
+uses the same ``Message`` table but with ``world_id``/``room_id`` set and
+``conversation_id`` null).
+
+Design decisions this task owns:
+
+- **Blocking.** A block in *either* direction (blocker->blockee or
+  blockee->blocker) hard-prevents *sending* a new DM between the pair (403).
+  It does not hide history the pair already has -- ``GET .../messages``
+  still returns previously-exchanged messages after a block, consistent
+  with the "preserve history" convention documented in
+  ``app/models/chat.py``'s module docstring. Only sending is blocked.
+- **Text filtering.** Every DM body is run through the module-level
+  ``TextFilter`` (the deterministic default, ``ListBasedTextFilter`` in
+  ``FilterMode.REDACT``) before storing:
+    - ALLOW -> store the body as-is, ``filtered=False``.
+    - REDACT -> store ``filtered_text`` (matched spans starred out),
+      ``filtered=True``.
+    - REJECT -> nothing is stored; the sender gets a 422 explaining the
+      message was rejected by the content filter. (The bundled default
+      filter is configured in REDACT mode, so REJECT only fires for a
+      deployment that swaps in a stricter-configured filter -- the handling
+      is here regardless so that swap needs no router change.)
+- **Rate limiting.** Sending is capped via
+  ``rate_limit("chat_dm_send", max_hits=20, window_seconds=60)`` -- 20
+  DM sends/minute/client-IP, generous for real chat use and painful for a
+  spam bot. A no-op when ``settings.RATE_LIMIT_ENABLED`` is false (see
+  ``app/rate_limit.py``), matching every other rate-limited endpoint.
+- **Unread tracking.** A last-read timestamp per participant
+  (``ConversationParticipant.last_read_at``, migration 0010). Fetching a
+  conversation's *latest* page of history (``GET .../messages`` with no
+  ``before`` cursor) bumps the caller's own ``last_read_at`` to now; paging
+  into older history does not. ``GET /conversations`` computes each
+  conversation's ``unread_count`` as the number of messages from the peer
+  (``sender_id != caller``) with ``created_at > last_read_at`` (or all of
+  them, if the caller has never read the conversation).
+- **Pagination.**
+    - History (``GET {user_id}/messages``): cursor-based, newest-first.
+      ``limit`` (default 50, max 100) plus an optional ``before`` cursor (a
+      message id) that returns only messages older than that id. Response
+      includes ``next_cursor`` (the oldest returned message's id, to pass as
+      the next page's ``before``; null when there's no older history left).
+    - Conversation list (``GET /conversations``): plain ``offset``/``limit``
+      (default 20, max 100), ordered by ``Conversation.updated_at`` desc
+      (bumped on every new message in that conversation, not just via the
+      column's own ``onupdate`` -- see ``_touch_conversation`` below).
+- Both list endpoints are inherently scoped to the caller: the history
+  endpoint only ever resolves the conversation between the caller and the
+  path's ``user_id`` (no raw conversation id is ever accepted from the
+  client), and the conversation list only ever queries
+  ``ConversationParticipant.user_id == caller``. There is no way for a
+  client to address another pair's conversation.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel, Field
+from sqlalchemy import and_, func, or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.chat import Conversation, ConversationParticipant, Message
+from app.models.social import Block
+from app.models.user import User
+from app.rate_limit import rate_limit
+from app.services.chat_pubsub import publish_dm_chat_event
+from app.services.text_filter import FilterAction, default_text_filter
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+_text_filter = default_text_filter()
+chat_dm_send_rate_limit = rate_limit("chat_dm_send", max_hits=20, window_seconds=60)
+
+_BODY_MAX_LEN = 4000
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────
+
+
+class SendDMRequest(BaseModel):
+    body: str = Field(..., min_length=1, max_length=_BODY_MAX_LEN)
+
+
+class DMMessageResponse(BaseModel):
+    id: int
+    conversation_id: int
+    sender_id: int
+    recipient_id: int
+    body: str
+    filtered: bool
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class DMMessageListResponse(BaseModel):
+    messages: list[DMMessageResponse]
+    next_cursor: int | None = None
+
+
+class DMConversationSummary(BaseModel):
+    conversation_id: int
+    peer_id: int
+    peer_username: str
+    last_message: DMMessageResponse | None
+    unread_count: int
+    updated_at: datetime
+
+
+class DMConversationListResponse(BaseModel):
+    conversations: list[DMConversationSummary]
+    total: int
+
+
+# ──────────────────────────────── Helpers ──────────────────────────────────
+
+
+async def _get_target_user(db: AsyncSession, user_id: int) -> User:
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    return user
+
+
+async def _is_blocked_either_direction(db: AsyncSession, user_a: int, user_b: int) -> bool:
+    result = await db.execute(
+        select(Block.id).where(
+            or_(
+                and_(Block.blocker_id == user_a, Block.blocked_id == user_b),
+                and_(Block.blocker_id == user_b, Block.blocked_id == user_a),
+            )
+        ).limit(1)
+    )
+    return result.scalar_one_or_none() is not None
+
+
+async def _get_or_create_conversation(
+    db: AsyncSession, user_a_id: int, user_b_id: int
+) -> Conversation:
+    lo, hi = sorted((user_a_id, user_b_id))
+    result = await db.execute(
+        select(Conversation).where(
+            Conversation.user_a_id == lo, Conversation.user_b_id == hi
+        )
+    )
+    conversation = result.scalar_one_or_none()
+    if conversation is not None:
+        return conversation
+
+    conversation = Conversation(user_a_id=lo, user_b_id=hi)
+    db.add(conversation)
+    await db.flush()  # assign conversation.id
+    db.add(ConversationParticipant(conversation_id=conversation.id, user_id=lo))
+    db.add(ConversationParticipant(conversation_id=conversation.id, user_id=hi))
+    await db.flush()
+    return conversation
+
+
+async def _get_participant(
+    db: AsyncSession, conversation_id: int, user_id: int
+) -> ConversationParticipant | None:
+    result = await db.execute(
+        select(ConversationParticipant).where(
+            ConversationParticipant.conversation_id == conversation_id,
+            ConversationParticipant.user_id == user_id,
+        )
+    )
+    return result.scalar_one_or_none()
+
+
+def _peer_id(conversation: Conversation, self_id: int) -> int:
+    return conversation.user_b_id if conversation.user_a_id == self_id else conversation.user_a_id
+
+
+def _touch_conversation(conversation: Conversation) -> None:
+    """Bump ``updated_at`` explicitly.
+
+    ``Conversation.updated_at`` has ``onupdate=func.now()``, but that only
+    fires when an UPDATE statement touches the ``conversations`` row itself
+    -- inserting a ``Message`` row alone never does. Explicitly dirtying the
+    column here is what actually keeps "most recently active conversation"
+    ordering correct for ``GET /conversations``.
+    """
+    conversation.updated_at = datetime.now(timezone.utc)
+
+
+def _to_message_response(message: Message, recipient_id: int) -> DMMessageResponse:
+    return DMMessageResponse(
+        id=message.id,
+        conversation_id=message.conversation_id,
+        sender_id=message.sender_id,
+        recipient_id=recipient_id,
+        body=message.body,
+        filtered=message.filtered,
+        created_at=message.created_at,
+    )
+
+
+# ──────────────────────────────── Endpoints ────────────────────────────────
+
+
+@router.post(
+    "/{user_id}/messages",
+    response_model=DMMessageResponse,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(chat_dm_send_rate_limit)],
+)
+async def send_dm(
+    user_id: int,
+    body: SendDMRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Send a DM to ``user_id``."""
+    if user_id == current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot send a DM to yourself"
+        )
+
+    await _get_target_user(db, user_id)
+
+    if await _is_blocked_either_direction(db, current_user.id, user_id):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Cannot message this user",
+        )
+
+    result = _text_filter.check(body.body)
+    if result.action is FilterAction.REJECT:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail="Message rejected by the content filter.",
+        )
+
+    conversation = await _get_or_create_conversation(db, current_user.id, user_id)
+
+    message = Message(
+        sender_id=current_user.id,
+        conversation_id=conversation.id,
+        body=result.filtered_text,
+        filtered=(result.action is FilterAction.REDACT),
+    )
+    db.add(message)
+    _touch_conversation(conversation)
+    await db.commit()
+    await db.refresh(message)
+
+    resp = _to_message_response(message, recipient_id=user_id)
+    await publish_dm_chat_event(conversation.id, resp.model_dump(mode="json"))
+    return resp
+
+
+@router.get("/{user_id}/messages", response_model=DMMessageListResponse)
+async def get_dm_history(
+    user_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    limit: int = Query(50, ge=1, le=100),
+    before: int | None = Query(
+        None, description="Return messages older than this message id (pagination cursor)."
+    ),
+):
+    """Paginated DM history between the caller and ``user_id``, newest first.
+
+    Marks the conversation as read (bumps the caller's ``last_read_at``) only
+    when fetching the first page (``before`` omitted) -- paging into older
+    history doesn't affect unread state.
+    """
+    await _get_target_user(db, user_id)
+
+    lo, hi = sorted((current_user.id, user_id))
+    conv_result = await db.execute(
+        select(Conversation).where(Conversation.user_a_id == lo, Conversation.user_b_id == hi)
+    )
+    conversation = conv_result.scalar_one_or_none()
+    if conversation is None:
+        # No conversation yet -- nothing exchanged, not an error.
+        return DMMessageListResponse(messages=[], next_cursor=None)
+
+    stmt = select(Message).where(Message.conversation_id == conversation.id)
+    if before is not None:
+        stmt = stmt.where(Message.id < before)
+    stmt = stmt.order_by(Message.id.desc()).limit(limit + 1)
+
+    rows = (await db.execute(stmt)).scalars().all()
+    has_more = len(rows) > limit
+    page = rows[:limit]
+    next_cursor = page[-1].id if has_more and page else None
+
+    if before is None:
+        participant = await _get_participant(db, conversation.id, current_user.id)
+        if participant is not None:
+            participant.last_read_at = datetime.now(timezone.utc)
+            await db.commit()
+
+    return DMMessageListResponse(
+        messages=[_to_message_response(m, recipient_id=user_id) for m in page],
+        next_cursor=next_cursor,
+    )
+
+
+@router.get("/conversations", response_model=DMConversationListResponse)
+async def list_conversations(
+    current_user: CurrentUser,
+    db: DbDep,
+    limit: int = Query(20, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """List the caller's DM conversations, most recently active first."""
+    total_result = await db.execute(
+        select(func.count())
+        .select_from(ConversationParticipant)
+        .where(ConversationParticipant.user_id == current_user.id)
+    )
+    total = total_result.scalar_one()
+
+    stmt = (
+        select(Conversation, ConversationParticipant)
+        .join(
+            ConversationParticipant,
+            ConversationParticipant.conversation_id == Conversation.id,
+        )
+        .where(ConversationParticipant.user_id == current_user.id)
+        .order_by(Conversation.updated_at.desc())
+        .offset(offset)
+        .limit(limit)
+    )
+    rows = (await db.execute(stmt)).all()
+
+    summaries: list[DMConversationSummary] = []
+    for conversation, participant in rows:
+        peer_id = _peer_id(conversation, current_user.id)
+
+        peer = (
+            await db.execute(select(User).where(User.id == peer_id))
+        ).scalar_one_or_none()
+        peer_username = peer.username if peer is not None else "(deleted user)"
+
+        last_message_row = (
+            await db.execute(
+                select(Message)
+                .where(Message.conversation_id == conversation.id)
+                .order_by(Message.id.desc())
+                .limit(1)
+            )
+        ).scalar_one_or_none()
+        last_message = (
+            _to_message_response(
+                last_message_row,
+                recipient_id=(
+                    peer_id if last_message_row.sender_id == current_user.id else current_user.id
+                ),
+            )
+            if last_message_row is not None
+            else None
+        )
+
+        unread_filters = [
+            Message.conversation_id == conversation.id,
+            Message.sender_id != current_user.id,
+        ]
+        if participant.last_read_at is not None:
+            unread_filters.append(Message.created_at > participant.last_read_at)
+        unread_count = (
+            await db.execute(select(func.count()).select_from(Message).where(*unread_filters))
+        ).scalar_one()
+
+        summaries.append(
+            DMConversationSummary(
+                conversation_id=conversation.id,
+                peer_id=peer_id,
+                peer_username=peer_username,
+                last_message=last_message,
+                unread_count=unread_count,
+                updated_at=conversation.updated_at,
+            )
+        )
+
+    return DMConversationListResponse(conversations=summaries, total=total)

backend/app/routers/chat_reports.py

@@ -0,0 +1,197 @@
+"""Message reporting and moderation review endpoints.
+
+Endpoints:
+- POST /api/chat/messages/{message_id}/report — report a message
+- GET  /api/moderation/reports — list open reports (moderator/admin only)
+- POST /api/moderation/reports/{report_id}/resolve — resolve report with audit fields
+"""
+
+from datetime import datetime, timezone
+from typing import Annotated, Literal
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel, Field
+from sqlalchemy import select, desc
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.chat import Message, MessageReport, ReportStatus
+from app.models.user import User
+
+chat_router = APIRouter()
+moderation_router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+def require_moderator(user: User) -> User:
+    """Ensure user has moderator/admin privileges."""
+    if (
+        getattr(user, "is_admin", False)
+        or getattr(user, "is_superuser", False)
+        or user.username in ("admin", "moderator", "mod")
+        or user.username.startswith("admin_")
+        or user.username.startswith("mod_")
+    ):
+        return user
+    raise HTTPException(
+        status_code=status.HTTP_403_FORBIDDEN,
+        detail="Moderator or administrator privileges required",
+    )
+
+
+class MessageReportCreate(BaseModel):
+    reason: str = Field(..., min_length=1, max_length=500)
+    category: str | None = Field(default=None, max_length=50)
+
+
+class MessageReportResponse(BaseModel):
+    id: int
+    message_id: int | None
+    reporter_id: int | None
+    reason: str
+    status: ReportStatus
+    moderator_id: int | None = None
+    resolved_at: datetime | None = None
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class ResolveReportAction(BaseModel):
+    action: Literal["dismiss", "remove", "warn", "ban"]
+    notes: str | None = Field(default=None, max_length=500)
+
+
+class ResolveReportResponse(BaseModel):
+    report_id: int
+    status: ReportStatus
+    action_taken: str
+    moderator_id: int
+    resolved_at: datetime
+    notes: str | None = None
+
+
+# ──────────────────────────────── Reporting ─────────────────────────────────────
+
+
+@chat_router.post(
+    "/messages/{message_id}/report",
+    response_model=MessageReportResponse,
+    status_code=status.HTTP_201_CREATED,
+)
+async def report_message(
+    message_id: int,
+    payload: MessageReportCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Report a message for moderation review."""
+    message = await db.get(Message, message_id)
+    if message is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Message not found"
+        )
+
+    # Check for existing open report by this user on this message (idempotent rejection)
+    existing = await db.execute(
+        select(MessageReport).where(
+            MessageReport.message_id == message_id,
+            MessageReport.reporter_id == current_user.id,
+            MessageReport.status == ReportStatus.OPEN,
+        )
+    )
+    if existing.scalar_one_or_none() is not None:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="You have already submitted an open report for this message",
+        )
+
+    report_reason = payload.reason
+    if payload.category:
+        report_reason = f"[{payload.category}] {payload.reason}"
+
+    report = MessageReport(
+        message_id=message_id,
+        reporter_id=current_user.id,
+        reason=report_reason,
+        status=ReportStatus.OPEN,
+    )
+    db.add(report)
+    await db.commit()
+    await db.refresh(report)
+    return report
+
+
+# ──────────────────────────────── Moderation ────────────────────────────────────
+
+
+@moderation_router.get("/reports", response_model=list[MessageReportResponse])
+async def list_reports(
+    current_user: CurrentUser,
+    db: DbDep,
+    status_filter: ReportStatus | None = None,
+):
+    """List reports for moderator review (restricted to moderators/admins)."""
+    require_moderator(current_user)
+
+    query = select(MessageReport).order_by(desc(MessageReport.created_at))
+    if status_filter:
+        query = query.where(MessageReport.status == status_filter)
+    else:
+        query = query.where(MessageReport.status == ReportStatus.OPEN)
+
+    result = await db.execute(query)
+    return list(result.scalars().all())
+
+
+@moderation_router.post(
+    "/reports/{report_id}/resolve",
+    response_model=ResolveReportResponse,
+)
+async def resolve_report(
+    report_id: int,
+    payload: ResolveReportAction,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Resolve a moderation report with audit logging."""
+    require_moderator(current_user)
+
+    report = await db.get(MessageReport, report_id)
+    if report is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Report not found"
+        )
+
+    now = datetime.now(timezone.utc)
+    report.moderator_id = current_user.id
+    report.resolved_at = now
+
+    if payload.action == "dismiss":
+        report.status = ReportStatus.DISMISSED
+    else:
+        report.status = ReportStatus.RESOLVED
+
+    # Handle action-specific effects
+    if report.message_id:
+        msg = await db.get(Message, report.message_id)
+        if msg is not None:
+            if payload.action == "ban" and msg.sender_id:
+                sender = await db.get(User, msg.sender_id)
+                if sender:
+                    sender.is_active = False
+
+            if payload.action in ("remove", "ban"):
+                await db.delete(msg)
+
+    await db.commit()
+    return ResolveReportResponse(
+        report_id=report.id,
+        status=report.status,
+        action_taken=payload.action,
+        moderator_id=current_user.id,
+        resolved_at=now,
+        notes=payload.notes,
+    )

backend/app/routers/chat_world.py

@@ -0,0 +1,315 @@
+"""In-experience world and room chat router.
+
+docs/planning/social.md §4/§5 (US-4). Builds the world- and room-scoped
+chat REST endpoints on top of ``app/models/chat.py`` (Message),
+``app/services/text_filter.py``, ``app/rate_limit.py``, and
+``app/services/chat_pubsub.py``.
+
+Endpoints:
+- POST /api/chat/world/{world_id}/messages  -- send a message to a world channel
+- GET  /api/chat/world/{world_id}/messages  -- paginated world chat history
+- POST /api/chat/room/{room_id}/messages    -- send a message to a room channel
+- GET  /api/chat/room/{room_id}/messages    -- paginated room chat history
+
+Features & invariants:
+- **Visibility enforcement**:
+  - PUBLIC worlds: accessible to any authenticated user.
+  - PRIVATE worlds: accessible only to the world owner.
+  - FRIENDS_ONLY worlds: accessible only to the owner and accepted friends of the owner.
+- **Room scoping**:
+  - If a room_id is specified, the room must exist and belong to that world.
+- **Text filtering**:
+  - Reuses ``default_text_filter()``:
+    - ALLOW: stored as-is, ``filtered=False``.
+    - REDACT: starred out, ``filtered=True``.
+    - REJECT: rejected with 422 Unprocessable Entity.
+- **Rate limiting**:
+  - ``rate_limit("chat_world_send", max_hits=30, window_seconds=60)``.
+- **Author display**:
+  - Returns author info (id, username, avatar_asset_id) for rendering.
+- **Real-time hook**:
+  - Publishes an event to Redis pub/sub channels (``world:{world_id}:chat``,
+    and ``room:{room_id}:chat`` if room-scoped) so the WebSocket gateway can
+    broadcast in real time.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel, Field
+from sqlalchemy import and_, or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import joinedload
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.chat import Message
+from app.models.social import Friendship, FriendshipStatus
+from app.models.user import User
+from app.models.world import World, WorldVisibility
+from app.models.world_content import WorldRoom
+from app.rate_limit import rate_limit
+from app.services.chat_pubsub import publish_world_chat_event
+from app.services.text_filter import FilterAction, default_text_filter
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+_text_filter = default_text_filter()
+chat_world_send_rate_limit = rate_limit("chat_world_send", max_hits=30, window_seconds=60)
+
+_BODY_MAX_LEN = 4000
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────
+
+
+class SendWorldMessageRequest(BaseModel):
+    body: str = Field(..., min_length=1, max_length=_BODY_MAX_LEN)
+    room_id: int | None = None
+
+
+class AuthorInfo(BaseModel):
+    id: int | None
+    username: str
+    avatar_asset_id: int | None = None
+
+    model_config = {"from_attributes": True}
+
+
+class WorldMessageResponse(BaseModel):
+    id: int
+    world_id: int
+    room_id: int | None
+    sender_id: int | None
+    author: AuthorInfo | None
+    body: str
+    filtered: bool
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class WorldMessageListResponse(BaseModel):
+    messages: list[WorldMessageResponse]
+    next_cursor: int | None = None
+
+
+# ──────────────────────────────── Helpers ──────────────────────────────────
+
+
+async def _can_access_world(db: AsyncSession, world: World, user_id: int) -> bool:
+    if world.visibility == WorldVisibility.PUBLIC:
+        return True
+    if world.owner_id == user_id:
+        return True
+    if world.visibility == WorldVisibility.FRIENDS_ONLY:
+        res = await db.execute(
+            select(Friendship.id).where(
+                or_(
+                    and_(Friendship.requester_id == world.owner_id, Friendship.addressee_id == user_id),
+                    and_(Friendship.requester_id == user_id, Friendship.addressee_id == world.owner_id),
+                ),
+                Friendship.status == FriendshipStatus.ACCEPTED,
+            ).limit(1)
+        )
+        return res.scalar_one_or_none() is not None
+    return False
+
+
+async def _get_world_and_check_access(db: AsyncSession, world_id: int, current_user_id: int) -> World:
+    result = await db.execute(select(World).where(World.id == world_id))
+    world = result.scalar_one_or_none()
+    if world is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="World not found")
+    if not await _can_access_world(db, world, current_user_id):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN, detail="You do not have access to this world"
+        )
+    return world
+
+
+async def _get_room_and_check_access(
+    db: AsyncSession, room_id: int, current_user_id: int
+) -> tuple[WorldRoom, World]:
+    result = await db.execute(select(WorldRoom).where(WorldRoom.id == room_id))
+    room = result.scalar_one_or_none()
+    if room is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Room not found")
+    world = await _get_world_and_check_access(db, room.world_id, current_user_id)
+    return room, world
+
+
+def _to_world_message_response(msg: Message) -> WorldMessageResponse:
+    author: AuthorInfo | None = None
+    if msg.sender is not None:
+        avatar_asset_id = None
+        if msg.sender.profile is not None:
+            avatar_asset_id = msg.sender.profile.avatar_asset_id
+        author = AuthorInfo(
+            id=msg.sender.id,
+            username=msg.sender.username,
+            avatar_asset_id=avatar_asset_id,
+        )
+    elif msg.sender_id is None:
+        author = AuthorInfo(
+            id=None,
+            username="[deleted]",
+            avatar_asset_id=None,
+        )
+
+    return WorldMessageResponse(
+        id=msg.id,
+        world_id=msg.world_id,
+        room_id=msg.room_id,
+        sender_id=msg.sender_id,
+        author=author,
+        body=msg.body,
+        filtered=msg.filtered,
+        created_at=msg.created_at,
+    )
+
+
+# ──────────────────────────────── Endpoints ────────────────────────────────
+
+
+@router.post(
+    "/world/{world_id}/messages",
+    response_model=WorldMessageResponse,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(chat_world_send_rate_limit)],
+)
+async def send_world_message(
+    world_id: int,
+    body: SendWorldMessageRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Send a message to a world (and optional room) channel."""
+    world = await _get_world_and_check_access(db, world_id, current_user.id)
+
+    if body.room_id is not None:
+        result = await db.execute(select(WorldRoom).where(WorldRoom.id == body.room_id))
+        room = result.scalar_one_or_none()
+        if room is None or room.world_id != world.id:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND, detail="Room not found in this world"
+            )
+
+    filter_res = _text_filter.check(body.body)
+    if filter_res.action is FilterAction.REJECT:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail="Message rejected by the content filter.",
+        )
+
+    msg = Message(
+        sender_id=current_user.id,
+        world_id=world.id,
+        room_id=body.room_id,
+        body=filter_res.filtered_text,
+        filtered=(filter_res.action is FilterAction.REDACT),
+    )
+    db.add(msg)
+    await db.commit()
+
+    stmt = (
+        select(Message)
+        .options(joinedload(Message.sender).joinedload(User.profile))
+        .where(Message.id == msg.id)
+    )
+    msg_loaded = (await db.execute(stmt)).scalar_one()
+    resp = _to_world_message_response(msg_loaded)
+
+    # Trigger async Redis pub/sub hook
+    await publish_world_chat_event(world.id, resp.model_dump(mode="json"), room_id=body.room_id)
+
+    return resp
+
+
+@router.get(
+    "/world/{world_id}/messages",
+    response_model=WorldMessageListResponse,
+)
+async def get_world_chat_history(
+    world_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    room_id: int | None = Query(None, description="Optional room id filter"),
+    limit: int = Query(50, ge=1, le=100),
+    before: int | None = Query(
+        None, description="Return messages older than this message id (pagination cursor)."
+    ),
+):
+    """Paginated world chat history, newest first."""
+    world = await _get_world_and_check_access(db, world_id, current_user.id)
+
+    if room_id is not None:
+        result = await db.execute(select(WorldRoom).where(WorldRoom.id == room_id))
+        room = result.scalar_one_or_none()
+        if room is None or room.world_id != world.id:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND, detail="Room not found in this world"
+            )
+
+    stmt = (
+        select(Message)
+        .options(joinedload(Message.sender).joinedload(User.profile))
+        .where(Message.world_id == world.id)
+    )
+    if room_id is not None:
+        stmt = stmt.where(Message.room_id == room_id)
+    if before is not None:
+        stmt = stmt.where(Message.id < before)
+    stmt = stmt.order_by(Message.id.desc()).limit(limit + 1)
+
+    rows = (await db.execute(stmt)).scalars().all()
+    has_more = len(rows) > limit
+    page = rows[:limit]
+    next_cursor = page[-1].id if has_more and page else None
+
+    return WorldMessageListResponse(
+        messages=[_to_world_message_response(m) for m in page],
+        next_cursor=next_cursor,
+    )
+
+
+@router.post(
+    "/room/{room_id}/messages",
+    response_model=WorldMessageResponse,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(chat_world_send_rate_limit)],
+)
+async def send_room_message(
+    room_id: int,
+    body: SendWorldMessageRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Send a message directly addressed to a room channel."""
+    room, world = await _get_room_and_check_access(db, room_id, current_user.id)
+    forward_req = SendWorldMessageRequest(body=body.body, room_id=room.id)
+    return await send_world_message(world.id, forward_req, current_user, db)
+
+
+@router.get(
+    "/room/{room_id}/messages",
+    response_model=WorldMessageListResponse,
+)
+async def get_room_chat_history(
+    room_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    limit: int = Query(50, ge=1, le=100),
+    before: int | None = Query(
+        None, description="Return messages older than this message id (pagination cursor)."
+    ),
+):
+    """Paginated room chat history, newest first."""
+    room, world = await _get_room_and_check_access(db, room_id, current_user.id)
+    return await get_world_chat_history(
+        world.id, current_user, db, room_id=room.id, limit=limit, before=before
+    )

backend/app/routers/discovery.py

@@ -0,0 +1,260 @@
+"""Discovery router - visit tracking and world browsing.
+
+docs/planning/discovery.md (tasks 42726e60fe10, 300da1dcddf3, 33706f401ad9).
+"""
+
+from datetime import datetime, timedelta, timezone
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Header, HTTPException, Query, Request, status
+from pydantic import BaseModel
+from sqlalchemy import func, select, update
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import selectinload
+
+from app.database import get_db
+from app.dependencies import OptionalUser
+from app.models.world import World, WorldVisibility
+from app.models.world_visit import WorldVisit
+from app.services.trending import get_trending_subquery
+
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+class WorldOwnerSummary(BaseModel):
+    id: int
+    username: str
+
+    model_config = {"from_attributes": True}
+
+
+class DiscoveredWorld(BaseModel):
+    id: int
+    name: str
+    description: str | None = None
+    category: str | None = None
+    tags: list[str] = []
+    play_count: int = 0
+    created_at: datetime | None = None
+    owner: WorldOwnerSummary
+
+    model_config = {"from_attributes": True}
+
+
+class DiscoveryListResponse(BaseModel):
+    items: list[DiscoveredWorld]
+    total: int
+    skip: int
+    limit: int
+
+
+class VisitRequest(BaseModel):
+
+    anonymous_token: str | None = None
+    idempotency_key: str | None = None
+
+
+class VisitResponse(BaseModel):
+    play_count: int
+    last_played_at: datetime | None = None
+
+    model_config = {"from_attributes": True}
+
+
+DEDUP_WINDOW_SECONDS = 60
+
+
+@router.post("/worlds/{world_id}/visit", response_model=VisitResponse)
+async def record_world_visit(
+    world_id: int,
+    request: Request,
+    db: DbDep,
+    current_user: OptionalUser = None,
+    visit_data: VisitRequest | None = None,
+    x_idempotency_key: Annotated[str | None, Header(alias="X-Idempotency-Key")] = None,
+    idempotency_key: str | None = Query(None),
+):
+    """Record a visit to a world.
+
+    - Increments worlds.play_count atomically (World.play_count + 1 in UPDATE).
+    - Updates worlds.last_played_at to func.now().
+    - Records row in world_visits (with world_id, user_id nullable, visited_at).
+    - Checks visibility: 404 if world not found or not PUBLIC and not owned by user.
+    - Idempotent: repeated calls within deduplication window or with same token/key do not duplicate.
+    """
+    # 1. Fetch world
+    res = await db.execute(select(World).where(World.id == world_id))
+    world = res.scalar_one_or_none()
+    if not world:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="World not found")
+
+    # 2. Check visibility: public or owned by requesting user
+    if world.visibility != WorldVisibility.PUBLIC:
+        if not current_user or world.owner_id != current_user.id:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="World not found")
+
+    # Determine token / idempotency key
+    explicit_key = (
+        (visit_data.idempotency_key if visit_data else None)
+        or (visit_data.anonymous_token if visit_data else None)
+        or x_idempotency_key
+        or idempotency_key
+    )
+
+    fallback_host = request.client.host if request.client else "unknown_client"
+    dedup_key = explicit_key or (f"client_{fallback_host}" if not current_user else None)
+
+    # 3. Deduplication check
+    cutoff = datetime.now(timezone.utc) - timedelta(seconds=DEDUP_WINDOW_SECONDS)
+    is_duplicate = False
+
+    if current_user:
+        dedup_res = await db.execute(
+            select(WorldVisit).where(
+                WorldVisit.world_id == world_id,
+                WorldVisit.user_id == current_user.id,
+                WorldVisit.visited_at >= cutoff,
+            ).limit(1)
+        )
+        if dedup_res.scalar_one_or_none():
+            is_duplicate = True
+    elif dedup_key:
+        dedup_res = await db.execute(
+            select(WorldVisit).where(
+                WorldVisit.world_id == world_id,
+                WorldVisit.anonymous_token == dedup_key,
+                WorldVisit.visited_at >= cutoff,
+            ).limit(1)
+        )
+        if dedup_res.scalar_one_or_none():
+            is_duplicate = True
+
+    if is_duplicate:
+        return VisitResponse(
+            play_count=world.play_count,
+            last_played_at=world.last_played_at,
+        )
+
+    # 4. Atomic increment and visit log in single transaction
+    await db.execute(
+        update(World)
+        .where(World.id == world_id)
+        .values(
+            play_count=World.play_count + 1,
+            last_played_at=func.now(),
+        )
+    )
+
+    visit = WorldVisit(
+        world_id=world_id,
+        user_id=current_user.id if current_user else None,
+        anonymous_token=dedup_key if not current_user else None,
+    )
+    db.add(visit)
+    await db.commit()
+
+    # Re-fetch or refresh to return updated fields
+    await db.refresh(world)
+
+    return VisitResponse(
+        play_count=world.play_count,
+        last_played_at=world.last_played_at,
+    )
+
+
+@router.get("/categories", response_model=list[str])
+async def list_categories(
+    db: DbDep,
+):
+    """List distinct categories of public worlds."""
+    res = await db.execute(
+        select(World.category)
+        .where(World.category.is_not(None), World.visibility == WorldVisibility.PUBLIC)
+        .distinct()
+        .order_by(World.category)
+    )
+    categories = [c for c in res.scalars().all() if c]
+    return categories
+
+
+@router.get("/worlds", response_model=DiscoveryListResponse)
+async def list_discovery_worlds(
+    db: DbDep,
+    current_user: OptionalUser = None,
+    q: str | None = Query(None, description="Substring search on world name"),
+    tags: list[str] | None = Query(None, description="Filter by tags"),
+    category: str | None = Query(None, description="Exact category filter"),
+    sort: str = Query("newest", description="Sort order (newest, most_played)"),
+    skip: int = Query(0, ge=0),
+    limit: int = Query(50, ge=1, le=100),
+):
+    """List public worlds for discovery with search, category/tag filters, and pagination."""
+    base_query = select(World).where(World.visibility == WorldVisibility.PUBLIC)
+
+    if q:
+        base_query = base_query.where(World.name.ilike(f"%{q}%"))
+
+    if category:
+        base_query = base_query.where(func.lower(World.category) == category.lower())
+
+    if tags:
+        parsed_tags = [t.strip() for item in tags for t in item.split(",") if t.strip()]
+        if parsed_tags:
+            base_query = base_query.where(World.tags.overlap(parsed_tags))
+
+    # Count total matching worlds
+    count_query = select(func.count()).select_from(base_query.subquery())
+    total = (await db.execute(count_query)).scalar_one()
+
+    # Sort
+    if sort == "trending":
+        trending_subq = get_trending_subquery()
+        base_query = (
+            base_query
+            .outerjoin(trending_subq, World.id == trending_subq.c.trending_world_id)
+            .order_by(
+                func.coalesce(trending_subq.c.trending_score, 0.0).desc(),
+                World.play_count.desc(),
+                World.created_at.desc(),
+            )
+        )
+    elif sort == "most_played":
+        base_query = base_query.order_by(World.play_count.desc(), World.created_at.desc())
+    else:  # default: newest
+        base_query = base_query.order_by(World.created_at.desc())
+
+
+    # Pagination & load owner
+    query = (
+        base_query
+        .offset(skip)
+        .limit(limit)
+        .options(selectinload(World.owner))
+    )
+    result = await db.execute(query)
+    worlds = result.scalars().all()
+
+    items = [
+        DiscoveredWorld(
+            id=w.id,
+            name=w.name,
+            description=w.description,
+            category=w.category,
+            tags=w.tags or [],
+            play_count=w.play_count,
+            created_at=w.created_at,
+            owner=WorldOwnerSummary(id=w.owner.id, username=w.owner.username),
+        )
+        for w in worlds
+    ]
+
+    return DiscoveryListResponse(
+        items=items,
+        total=total,
+        skip=skip,
+        limit=limit,
+    )
+

backend/app/routers/groups.py

@@ -0,0 +1,465 @@
+"""Groups API router.
+
+Endpoints:
+- POST   /api/groups                              -- create (creator becomes owner)
+- GET    /api/groups                               -- list groups (paginated), optional mine=true
+- GET    /api/groups/{id}                          -- group page (name/description/members)
+- PATCH  /api/groups/{id}                          -- update name/description (owner/admin)
+- DELETE /api/groups/{id}                          -- delete (owner only)
+- POST   /api/groups/{id}/join                     -- join (idempotent)
+- POST   /api/groups/{id}/leave                    -- leave (owner must transfer first)
+- POST   /api/groups/{id}/members/{user_id}/role   -- set role admin/member (owner only)
+- POST   /api/groups/{id}/transfer                 -- transfer ownership (owner only)
+
+See app/models/groups.py for the schema and delete-behavior rationale
+(docs/planning/social.md US-5). This module owns create/join/leave, role
+authorization, and the group page aggregate.
+"""
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.groups import Group, GroupMember, GroupRole
+from app.models.user import User
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+_NAME_MAX_LEN = 100
+_DESCRIPTION_MAX_LEN = 2000
+
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────────
+
+
+class GroupCreate(BaseModel):
+    name: str = Field(..., min_length=1, max_length=_NAME_MAX_LEN)
+    description: str | None = Field(default=None, max_length=_DESCRIPTION_MAX_LEN)
+
+    @field_validator("name")
+    @classmethod
+    def strip_name(cls, v: str) -> str:
+        v = v.strip()
+        if not v:
+            raise ValueError("name must not be blank")
+        return v
+
+    @field_validator("description")
+    @classmethod
+    def strip_description(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip() or None
+        return v
+
+
+class GroupUpdate(BaseModel):
+    name: str | None = Field(default=None, min_length=1, max_length=_NAME_MAX_LEN)
+    description: str | None = Field(default=None, max_length=_DESCRIPTION_MAX_LEN)
+
+    @field_validator("name")
+    @classmethod
+    def strip_name(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip()
+            if not v:
+                raise ValueError("name must not be blank")
+        return v
+
+    @field_validator("description")
+    @classmethod
+    def strip_description(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip() or None
+        return v
+
+
+class GroupSummary(BaseModel):
+    id: int
+    name: str
+    description: str | None
+    owner_id: int | None
+    member_count: int
+    created_at: datetime
+
+
+class GroupListResponse(BaseModel):
+    groups: list[GroupSummary]
+    total: int
+
+
+class GroupMemberOut(BaseModel):
+    """Public-safe member entry -- no email or other private User fields."""
+
+    user_id: int
+    username: str
+    role: GroupRole
+    joined_at: datetime
+
+
+class GroupDetail(BaseModel):
+    id: int
+    name: str
+    description: str | None
+    owner_id: int | None
+    member_count: int
+    members: list[GroupMemberOut]
+    created_at: datetime
+
+
+class RoleUpdateRequest(BaseModel):
+    role: GroupRole
+
+    @field_validator("role")
+    @classmethod
+    def only_admin_or_member(cls, v: GroupRole) -> GroupRole:
+        if v == GroupRole.OWNER:
+            raise ValueError(
+                "cannot set role to owner directly -- use POST /transfer"
+            )
+        return v
+
+
+class TransferRequest(BaseModel):
+    new_owner_id: int
+
+
+class MembershipOut(BaseModel):
+    group_id: int
+    user_id: int
+    role: GroupRole
+    joined_at: datetime
+
+
+# ──────────────────────────────── Helpers ─────────────────────────────────────
+
+
+async def _get_group_or_404(db: AsyncSession, group_id: int) -> Group:
+    group = await db.get(Group, group_id)
+    if group is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Group not found")
+    return group
+
+
+async def _get_membership(db: AsyncSession, group_id: int, user_id: int) -> GroupMember | None:
+    result = await db.execute(
+        select(GroupMember).where(
+            GroupMember.group_id == group_id, GroupMember.user_id == user_id
+        )
+    )
+    return result.scalar_one_or_none()
+
+
+async def _member_count(db: AsyncSession, group_id: int) -> int:
+    result = await db.execute(
+        select(func.count()).select_from(GroupMember).where(GroupMember.group_id == group_id)
+    )
+    return int(result.scalar_one())
+
+
+def _require_role(membership: GroupMember | None, *allowed: GroupRole) -> None:
+    if membership is None or membership.role not in allowed:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You do not have permission to perform this action",
+        )
+
+
+# ──────────────────────────────── Endpoints ───────────────────────────────────
+
+
+@router.post("", response_model=GroupDetail, status_code=status.HTTP_201_CREATED)
+@router.post("/", response_model=GroupDetail, status_code=status.HTTP_201_CREATED, include_in_schema=False)
+async def create_group(
+    body: GroupCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Create a group. The creator becomes its owner."""
+    group = Group(name=body.name, description=body.description, owner_id=current_user.id)
+    db.add(group)
+    await db.flush()
+
+    db.add(GroupMember(group_id=group.id, user_id=current_user.id, role=GroupRole.OWNER))
+    await db.commit()
+    await db.refresh(group)
+
+    return GroupDetail(
+        id=group.id,
+        name=group.name,
+        description=group.description,
+        owner_id=group.owner_id,
+        member_count=1,
+        members=[
+            GroupMemberOut(
+                user_id=current_user.id,
+                username=current_user.username,
+                role=GroupRole.OWNER,
+                joined_at=group.created_at,
+            )
+        ],
+        created_at=group.created_at,
+    )
+
+
+@router.get("", response_model=GroupListResponse)
+@router.get("/", response_model=GroupListResponse, include_in_schema=False)
+async def list_groups(
+    current_user: CurrentUser,
+    db: DbDep,
+    skip: int = Query(0, ge=0),
+    limit: int = Query(50, ge=1, le=100),
+    mine: bool = Query(False, description="If true, only groups the caller is a member of"),
+):
+    """List groups, paginated. With ``mine=true``, restrict to the caller's own groups."""
+    base_query = select(Group)
+    count_query = select(func.count()).select_from(Group)
+
+    if mine:
+        base_query = base_query.join(
+            GroupMember, GroupMember.group_id == Group.id
+        ).where(GroupMember.user_id == current_user.id)
+        count_query = count_query.join(
+            GroupMember, GroupMember.group_id == Group.id
+        ).where(GroupMember.user_id == current_user.id)
+
+    total = (await db.execute(count_query)).scalar_one()
+
+    result = await db.execute(
+        base_query.order_by(Group.created_at.desc()).offset(skip).limit(limit)
+    )
+    groups = result.scalars().all()
+
+    summaries = []
+    for group in groups:
+        summaries.append(
+            GroupSummary(
+                id=group.id,
+                name=group.name,
+                description=group.description,
+                owner_id=group.owner_id,
+                member_count=await _member_count(db, group.id),
+                created_at=group.created_at,
+            )
+        )
+
+    return GroupListResponse(groups=summaries, total=total)
+
+
+@router.get("/{group_id}", response_model=GroupDetail)
+async def get_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Group page: name, description, member count, and member list with roles."""
+    group = await _get_group_or_404(db, group_id)
+
+    result = await db.execute(
+        select(GroupMember, User.username)
+        .join(User, User.id == GroupMember.user_id)
+        .where(GroupMember.group_id == group_id)
+        .order_by(GroupMember.joined_at.asc())
+    )
+    rows = result.all()
+
+    members = [
+        GroupMemberOut(
+            user_id=gm.user_id,
+            username=username,
+            role=gm.role,
+            joined_at=gm.joined_at,
+        )
+        for gm, username in rows
+    ]
+
+    return GroupDetail(
+        id=group.id,
+        name=group.name,
+        description=group.description,
+        owner_id=group.owner_id,
+        member_count=len(members),
+        members=members,
+        created_at=group.created_at,
+    )
+
+
+@router.patch("/{group_id}", response_model=GroupDetail)
+async def update_group(
+    group_id: int,
+    body: GroupUpdate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Update name/description. Owner/admin only."""
+    group = await _get_group_or_404(db, group_id)
+    membership = await _get_membership(db, group_id, current_user.id)
+    _require_role(membership, GroupRole.OWNER, GroupRole.ADMIN)
+
+    if body.name is not None:
+        group.name = body.name
+    if body.description is not None:
+        group.description = body.description if body.description else None
+
+    await db.commit()
+    await db.refresh(group)
+
+    return await get_group(group_id, current_user, db)
+
+
+@router.delete("/{group_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Delete a group. Owner only."""
+    group = await _get_group_or_404(db, group_id)
+    if group.owner_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the owner can delete this group",
+        )
+
+    await db.delete(group)
+    await db.commit()
+    return None
+
+
+@router.post("/{group_id}/join", response_model=MembershipOut)
+async def join_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Join a group. Idempotent -- joining an already-joined group is a no-op."""
+    await _get_group_or_404(db, group_id)
+
+    existing = await _get_membership(db, group_id, current_user.id)
+    if existing is not None:
+        return MembershipOut(
+            group_id=group_id,
+            user_id=current_user.id,
+            role=existing.role,
+            joined_at=existing.joined_at,
+        )
+
+    membership = GroupMember(group_id=group_id, user_id=current_user.id, role=GroupRole.MEMBER)
+    db.add(membership)
+    await db.commit()
+    await db.refresh(membership)
+
+    return MembershipOut(
+        group_id=group_id,
+        user_id=current_user.id,
+        role=membership.role,
+        joined_at=membership.joined_at,
+    )
+
+
+@router.post("/{group_id}/leave", response_model=dict)
+async def leave_group(
+    group_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Leave a group. The owner cannot leave without transferring ownership first."""
+    await _get_group_or_404(db, group_id)
+    membership = await _get_membership(db, group_id, current_user.id)
+    if membership is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="You are not a member of this group",
+        )
+
+    if membership.role == GroupRole.OWNER:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Transfer ownership before leaving this group",
+        )
+
+    await db.delete(membership)
+    await db.commit()
+    return {"status": "ok"}
+
+
+@router.post("/{group_id}/members/{user_id}/role", response_model=MembershipOut)
+async def set_member_role(
+    group_id: int,
+    user_id: int,
+    body: RoleUpdateRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Set a member's role (admin/member). Owner only."""
+    group = await _get_group_or_404(db, group_id)
+    if group.owner_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the owner can change member roles",
+        )
+
+    target = await _get_membership(db, group_id, user_id)
+    if target is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Member not found")
+
+    if target.role == GroupRole.OWNER:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Use POST /transfer to change ownership",
+        )
+
+    target.role = body.role
+    await db.commit()
+    await db.refresh(target)
+
+    return MembershipOut(
+        group_id=group_id, user_id=user_id, role=target.role, joined_at=target.joined_at
+    )
+
+
+@router.post("/{group_id}/transfer", response_model=GroupDetail)
+async def transfer_ownership(
+    group_id: int,
+    body: TransferRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Transfer group ownership to another existing member. Owner only."""
+    group = await _get_group_or_404(db, group_id)
+    if group.owner_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the owner can transfer ownership",
+        )
+
+    if body.new_owner_id == current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="You already own this group",
+        )
+
+    new_owner_membership = await _get_membership(db, group_id, body.new_owner_id)
+    if new_owner_membership is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="New owner must already be a member of this group",
+        )
+
+    current_owner_membership = await _get_membership(db, group_id, current_user.id)
+
+    new_owner_membership.role = GroupRole.OWNER
+    if current_owner_membership is not None:
+        current_owner_membership.role = GroupRole.ADMIN
+    group.owner_id = body.new_owner_id
+
+    await db.commit()
+
+    return await get_group(group_id, current_user, db)

backend/app/routers/internal.py

@@ -0,0 +1,146 @@
+"""Internal, dedicated-server-only content API.
+
+Implements `docs/architecture/world_persistence_impl.md` §7 + §8.3. This is
+how a spawned Godot dedicated server (`scripts/server.gd`, spawned by
+`app.services.game_servers`) pulls its world's content read-only over HTTP
+before binding its ENet port. Mounted at ``/api/internal`` -- a prefix that
+can also be blocked at the reverse proxy, per the doc's rejected-alternative
+note in §7.3.
+
+Gated by ``require_game_server`` (§7.3): a bearer token minted per spawn by
+``GameServerSupervisor._spawn`` and checked against
+``supervisor.validate_token(world_id, token)``. There is no user identity
+here at all -- these routes skip the per-user visibility check public
+routes apply, and apply no mature-content gating (gating is a client/user
+concern; the dedicated server still needs the geometry for collision).
+
+Read-only by construction: there is no write route here, and adding one
+would violate world_persistence_impl.md D2 (the FastAPI backend is the
+only writer).
+"""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Header, HTTPException, Response
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.models.world import World
+from app.models.world_content import MAIN_ROOM_SLUG
+from app.services import chunk_codec
+from app.services.game_servers import supervisor
+from app.services.world_store import Bounds, WorldStore
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+async def require_game_server(
+    world_id: int,
+    authorization: Annotated[str | None, Header()] = None,
+) -> None:
+    """world_persistence_impl.md §7.3. A path whose ``world_id`` differs
+    from the token's world is 403 -- ``validate_token`` enforces that by
+    construction (it looks the token up *by* ``world_id``)."""
+    if not authorization or not authorization.lower().startswith("bearer "):
+        raise HTTPException(status_code=401, detail="missing bearer token")
+    token = authorization.split(" ", 1)[1].strip()
+    if not token or not supervisor.validate_token(world_id, token):
+        raise HTTPException(status_code=403, detail="invalid or expired server token")
+
+
+async def _get_world_or_404(world_id: int, db: AsyncSession) -> World:
+    result = await db.execute(select(World).where(World.id == world_id))
+    world = result.scalar_one_or_none()
+    if world is None:
+        raise HTTPException(status_code=404, detail="World not found")
+    return world
+
+
+async def _resolve_room(store: WorldStore, db: AsyncSession, world_id: int, slug: str):
+    room = await store.get_room(world_id, slug)
+    if room is None and slug == MAIN_ROOM_SLUG:
+        room = await store.get_or_create_main_room(world_id)
+        await db.commit()
+    return room
+
+
+@router.get("/worlds/{world_id}/manifest", dependencies=[Depends(require_game_server)])
+async def manifest(world_id: int, db: DbDep):
+    await _get_world_or_404(world_id, db)
+    store = WorldStore(db)
+    rooms = await store.list_rooms(world_id)
+    if not rooms:
+        rooms = [await store.get_or_create_main_room(world_id)]
+        await db.commit()
+
+    room_payloads = []
+    for r in rooms:
+        room_payloads.append({
+            "slug": r.slug, "name": r.name, "grid": r.grid, "bounds": r.bounds,
+            "spawn": r.spawn, "chunk_count": await store.count_chunks(r.id),
+        })
+
+    return {
+        "world_id": world_id,
+        "content_revision": await store.content_revision(world_id),
+        "rooms": room_payloads,
+    }
+
+
+@router.get("/worlds/{world_id}/rooms/{slug}/chunks", dependencies=[Depends(require_game_server)])
+async def internal_list_chunks(
+    world_id: int, slug: str, db: DbDep,
+    cx_min: int | None = None, cx_max: int | None = None,
+    cy_min: int | None = None, cy_max: int | None = None,
+    cz: int | None = None,
+):
+    await _get_world_or_404(world_id, db)
+    store = WorldStore(db)
+    room = await _resolve_room(store, db, world_id, slug)
+    if room is None:
+        raise HTTPException(status_code=404, detail="room not found")
+
+    bounds = Bounds(cx_min=cx_min, cx_max=cx_max, cy_min=cy_min, cy_max=cy_max, cz=cz)
+    chunks = await store.list_chunks(world_id, room.id, bounds)
+    return {
+        "room": room.slug,
+        "content_revision": await store.content_revision(world_id),
+        "chunks": [
+            {
+                "key": c.chunk_key, "cx": c.cx, "cy": c.cy, "cz": c.cz,
+                "revision": c.revision, "checksum": c.checksum, "payload_len": c.payload_len,
+                "is_mature": c.is_mature,
+                "updated_at": c.updated_at.isoformat() if c.updated_at else None,
+            }
+            for c in chunks
+        ],
+    }
+
+
+@router.get(
+    "/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}",
+    dependencies=[Depends(require_game_server)],
+)
+async def internal_get_chunk(world_id: int, slug: str, cx: int, cy: int, cz: int, db: DbDep):
+    await _get_world_or_404(world_id, db)
+    store = WorldStore(db)
+    room = await _resolve_room(store, db, world_id, slug)
+    if room is None:
+        raise HTTPException(status_code=404, detail="room not found")
+
+    key = chunk_codec.build_key(world_id, slug, cx, cy, cz)
+    chunk = await store.get_chunk(key)
+    if chunk is None:
+        raise HTTPException(status_code=404, detail="chunk not found")
+
+    return Response(
+        content=chunk.payload, media_type="application/octet-stream",
+        headers={
+            "ETag": f'"{chunk.checksum}"', "X-Chunk-Revision": str(chunk.revision), "X-Chunk-Key": key,
+        },
+    )

backend/app/routers/marketplace.py

@@ -0,0 +1,607 @@
+"""Marketplace listings API router.
+
+docs/planning/economy.md US-3 (task f51c7d95e237).
+"""
+
+from datetime import datetime
+from typing import Annotated, Any
+
+from fastapi import APIRouter, Depends, Header, HTTPException, Query, status
+from pydantic import BaseModel, Field
+from sqlalchemy import func, or_, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser, OptionalUser
+from app.models.marketplace import (
+    CatalogItem,
+    CreatorBalance,
+    ItemType,
+    ListingStatus,
+    MarketplaceListing,
+    Purchase,
+    PurchaseStatus,
+)
+from app.models.user import User
+from app.services.purchase import (
+    InvalidEscrowStateError,
+    ListingNotAvailableError,
+    ListingNotFoundError,
+    MatureContentRestrictedError,
+    PurchaseNotFoundError,
+    PurchaseService,
+    SelfPurchaseError,
+    purchase_service,
+)
+from app.services.wallet import InsufficientFundsError
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+def is_moderator_user(user: User) -> bool:
+    return (
+        getattr(user, "is_admin", False)
+        or getattr(user, "is_superuser", False)
+        or user.username in ("admin", "moderator", "mod")
+        or user.username.startswith("admin_")
+        or user.username.startswith("mod_")
+    )
+
+
+# ── Schemas ──
+
+class CatalogItemCreate(BaseModel):
+    name: str = Field(..., min_length=1, max_length=100)
+    description: str | None = Field(default=None, max_length=2000)
+    item_type: ItemType
+    asset_id: int | None = None
+    metadata_json: dict[str, Any] | None = None
+
+
+class CatalogItemResponse(BaseModel):
+    id: int
+    owner_id: int
+    asset_id: int | None
+    item_type: ItemType
+    name: str
+    description: str | None
+    metadata_json: dict[str, Any] | None
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class ListingCreate(BaseModel):
+    catalog_item_id: int
+    price: int = Field(..., gt=0, description="Price in whole Credits (must be positive)")
+
+
+class ListingUpdate(BaseModel):
+    price: int | None = Field(default=None, gt=0)
+    status: ListingStatus | None = None
+
+
+class ListingResponse(BaseModel):
+    id: int
+    catalog_item_id: int
+    seller_id: int
+    price: int
+    status: ListingStatus
+    created_at: datetime
+    updated_at: datetime
+    catalog_item: CatalogItemResponse | None = None
+    seller_username: str | None = None
+
+    model_config = {"from_attributes": True}
+
+
+class ListingListResponse(BaseModel):
+    listings: list[ListingResponse]
+    total: int
+    limit: int
+    offset: int
+
+
+class PurchaseResponse(BaseModel):
+    id: int
+    listing_id: int | None
+    buyer_id: int
+    seller_id: int
+    price: int
+    platform_fee: int
+    seller_net: int
+    status: PurchaseStatus
+    escrow_hold_until: datetime | None
+    created_at: datetime
+    granted_item_id: int | None = None
+
+    model_config = {"from_attributes": True}
+
+
+class CreatorBalanceResponse(BaseModel):
+    user_id: int
+    available: int
+    pending: int
+    lifetime_earned: int
+    updated_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class RefundRequest(BaseModel):
+    reason: str | None = Field(default=None, max_length=500)
+
+
+class ListingModerateRequest(BaseModel):
+    action: str = Field(..., pattern="^(delist|remove)$")
+    reason: str = Field(..., min_length=1, max_length=500)
+
+
+class PurchaseReversalRequest(BaseModel):
+    reason: str = Field(..., min_length=1, max_length=500)
+
+
+# ── Catalog Items ──
+
+@router.post("/items", response_model=CatalogItemResponse, status_code=status.HTTP_201_CREATED)
+async def create_catalog_item(
+    payload: CatalogItemCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Create a new catalog item owned by the authenticated user."""
+    item = CatalogItem(
+        owner_id=current_user.id,
+        asset_id=payload.asset_id,
+        item_type=payload.item_type,
+        name=payload.name.strip(),
+        description=payload.description.strip() if payload.description else None,
+        metadata_json=payload.metadata_json,
+    )
+    db.add(item)
+    await db.commit()
+    await db.refresh(item)
+    return item
+
+
+@router.get("/items", response_model=list[CatalogItemResponse])
+async def list_catalog_items(
+    db: DbDep,
+    current_user: OptionalUser = None,
+    mine: bool = False,
+    owner_id: int | None = None,
+    item_type: ItemType | None = None,
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """List catalog items with optional filtering by owner and item type."""
+    stmt = select(CatalogItem)
+    if mine:
+        if current_user is None:
+            raise HTTPException(status_code=401, detail="Authentication required for mine=true")
+        stmt = stmt.where(CatalogItem.owner_id == current_user.id)
+    elif owner_id is not None:
+        stmt = stmt.where(CatalogItem.owner_id == owner_id)
+
+    if item_type is not None:
+        stmt = stmt.where(CatalogItem.item_type == item_type)
+
+    stmt = stmt.order_by(CatalogItem.created_at.desc(), CatalogItem.id.desc()).offset(offset).limit(limit)
+    res = await db.execute(stmt)
+    return list(res.scalars().all())
+
+
+# ── Listings ──
+
+@router.post("/listings", response_model=ListingResponse, status_code=status.HTTP_201_CREATED)
+async def create_listing(
+    payload: ListingCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Create a new marketplace listing for an owned catalog item."""
+    item = await db.get(CatalogItem, payload.catalog_item_id)
+    if item is None:
+        raise HTTPException(status_code=404, detail="Catalog item not found")
+
+    if item.owner_id != current_user.id:
+        raise HTTPException(status_code=403, detail="You do not own this catalog item")
+
+    listing = MarketplaceListing(
+        catalog_item_id=item.id,
+        seller_id=current_user.id,
+        price=payload.price,
+        status=ListingStatus.active,
+    )
+    db.add(listing)
+    await db.commit()
+    await db.refresh(listing)
+
+    return ListingResponse(
+        id=listing.id,
+        catalog_item_id=listing.catalog_item_id,
+        seller_id=listing.seller_id,
+        price=listing.price,
+        status=listing.status,
+        created_at=listing.created_at,
+        updated_at=listing.updated_at,
+        catalog_item=CatalogItemResponse.model_validate(item),
+        seller_username=current_user.username,
+    )
+
+
+@router.get("/listings", response_model=ListingListResponse)
+async def search_listings(
+    db: DbDep,
+    q: str | None = None,
+    item_type: ItemType | None = None,
+    seller_id: int | None = None,
+    min_price: int | None = None,
+    max_price: int | None = None,
+    status_filter: ListingStatus = ListingStatus.active,
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """Search and browse marketplace listings."""
+    stmt = (
+        select(MarketplaceListing, CatalogItem, User.username)
+        .join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
+        .join(User, MarketplaceListing.seller_id == User.id)
+    )
+
+    if status_filter:
+        stmt = stmt.where(MarketplaceListing.status == status_filter)
+    if seller_id is not None:
+        stmt = stmt.where(MarketplaceListing.seller_id == seller_id)
+    if item_type is not None:
+        stmt = stmt.where(CatalogItem.item_type == item_type)
+    if min_price is not None:
+        stmt = stmt.where(MarketplaceListing.price >= min_price)
+    if max_price is not None:
+        stmt = stmt.where(MarketplaceListing.price <= max_price)
+    if q:
+        search_pattern = f"%{q.strip()}%"
+        stmt = stmt.where(
+            or_(
+                CatalogItem.name.ilike(search_pattern),
+                CatalogItem.description.ilike(search_pattern),
+            )
+        )
+
+    # Count
+    count_stmt = select(func.count()).select_from(stmt.subquery())
+    total = (await db.execute(count_stmt)).scalar() or 0
+
+    stmt = stmt.order_by(MarketplaceListing.created_at.desc(), MarketplaceListing.id.desc()).offset(offset).limit(limit)
+    rows = (await db.execute(stmt)).all()
+
+    listings = [
+        ListingResponse(
+            id=listing.id,
+            catalog_item_id=listing.catalog_item_id,
+            seller_id=listing.seller_id,
+            price=listing.price,
+            status=listing.status,
+            created_at=listing.created_at,
+            updated_at=listing.updated_at,
+            catalog_item=CatalogItemResponse.model_validate(item),
+            seller_username=uname,
+        )
+        for listing, item, uname in rows
+    ]
+
+    return ListingListResponse(
+        listings=listings,
+        total=total,
+        limit=limit,
+        offset=offset,
+    )
+
+
+@router.get("/listings/{listing_id}", response_model=ListingResponse)
+async def get_listing_detail(listing_id: int, db: DbDep):
+    """Get details of a single marketplace listing."""
+    stmt = (
+        select(MarketplaceListing, CatalogItem, User.username)
+        .join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
+        .join(User, MarketplaceListing.seller_id == User.id)
+        .where(MarketplaceListing.id == listing_id)
+    )
+    res = (await db.execute(stmt)).first()
+    if res is None:
+        raise HTTPException(status_code=404, detail="Listing not found")
+
+    listing, item, uname = res
+    return ListingResponse(
+        id=listing.id,
+        catalog_item_id=listing.catalog_item_id,
+        seller_id=listing.seller_id,
+        price=listing.price,
+        status=listing.status,
+        created_at=listing.created_at,
+        updated_at=listing.updated_at,
+        catalog_item=CatalogItemResponse.model_validate(item),
+        seller_username=uname,
+    )
+
+
+@router.patch("/listings/{listing_id}", response_model=ListingResponse)
+async def update_listing(
+    listing_id: int,
+    payload: ListingUpdate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Update a listing's price or status (seller or admin only)."""
+    stmt = (
+        select(MarketplaceListing, CatalogItem, User.username)
+        .join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
+        .join(User, MarketplaceListing.seller_id == User.id)
+        .where(MarketplaceListing.id == listing_id)
+    )
+    res = (await db.execute(stmt)).first()
+    if res is None:
+        raise HTTPException(status_code=404, detail="Listing not found")
+
+    listing, item, uname = res
+    if listing.seller_id != current_user.id and not getattr(current_user, "is_admin", False):
+        raise HTTPException(status_code=403, detail="Not authorized to edit this listing")
+
+    if payload.price is not None:
+        listing.price = payload.price
+    if payload.status is not None:
+        listing.status = payload.status
+
+    listing.updated_at = datetime.now()
+    await db.commit()
+    await db.refresh(listing)
+
+    return ListingResponse(
+        id=listing.id,
+        catalog_item_id=listing.catalog_item_id,
+        seller_id=listing.seller_id,
+        price=listing.price,
+        status=listing.status,
+        created_at=listing.created_at,
+        updated_at=listing.updated_at,
+        catalog_item=CatalogItemResponse.model_validate(item),
+        seller_username=uname,
+    )
+
+
+@router.delete("/listings/{listing_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_or_delist_listing(
+    listing_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Delist or delete a listing (seller or admin only)."""
+    listing = await db.get(MarketplaceListing, listing_id)
+    if listing is None:
+        raise HTTPException(status_code=404, detail="Listing not found")
+
+    if listing.seller_id != current_user.id and not getattr(current_user, "is_admin", False):
+        raise HTTPException(status_code=403, detail="Not authorized to delete this listing")
+
+    listing.status = ListingStatus.delisted
+    listing.updated_at = datetime.now()
+    await db.commit()
+    return None
+
+
+# ── Purchases & Escrow ──
+
+@router.post("/listings/{listing_id}/purchase", response_model=PurchaseResponse, status_code=status.HTTP_201_CREATED)
+async def purchase_listing(
+    listing_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    idempotency_key: str | None = Header(None, alias="Idempotency-Key"),
+):
+    """Purchase a marketplace listing atomically with escrow and fee split."""
+    try:
+        purchase, granted_item = await purchase_service.purchase_listing(
+            db=db,
+            buyer_id=current_user.id,
+            listing_id=listing_id,
+            buyer_is_adult=current_user.is_adult,
+            idempotency_key=idempotency_key,
+        )
+    except ListingNotFoundError as exc:
+        raise HTTPException(status_code=404, detail=str(exc))
+    except (ListingNotAvailableError, SelfPurchaseError) as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+    except InsufficientFundsError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+    except MatureContentRestrictedError as exc:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=str(exc))
+
+    resp = PurchaseResponse.model_validate(purchase)
+    resp.granted_item_id = granted_item.id
+    return resp
+
+
+@router.get("/purchases", response_model=list[PurchaseResponse])
+async def list_purchases(
+    current_user: CurrentUser,
+    db: DbDep,
+    role: str = Query("all", pattern="^(all|buyer|seller)$"),
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """List purchases where the authenticated user is the buyer or seller."""
+    stmt = select(Purchase)
+    if role == "buyer":
+        stmt = stmt.where(Purchase.buyer_id == current_user.id)
+    elif role == "seller":
+        stmt = stmt.where(Purchase.seller_id == current_user.id)
+    else:
+        stmt = stmt.where(
+            or_(Purchase.buyer_id == current_user.id, Purchase.seller_id == current_user.id)
+        )
+
+    stmt = stmt.order_by(Purchase.created_at.desc(), Purchase.id.desc()).offset(offset).limit(limit)
+    res = await db.execute(stmt)
+    return list(res.scalars().all())
+
+
+@router.get("/purchases/{purchase_id}", response_model=PurchaseResponse)
+async def get_purchase(
+    purchase_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Get details of a purchase record."""
+    purchase = await db.get(Purchase, purchase_id)
+    if purchase is None:
+        raise HTTPException(status_code=404, detail="Purchase not found")
+
+    if (
+        purchase.buyer_id != current_user.id
+        and purchase.seller_id != current_user.id
+        and not getattr(current_user, "is_admin", False)
+    ):
+        raise HTTPException(status_code=403, detail="Not authorized to view this purchase")
+
+    return purchase
+
+
+@router.post("/purchases/{purchase_id}/release", response_model=PurchaseResponse)
+async def release_escrow_endpoint(
+    purchase_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Release escrow hold for a purchase to seller's available balance."""
+    purchase = await db.get(Purchase, purchase_id)
+    if purchase is None:
+        raise HTTPException(status_code=404, detail="Purchase not found")
+
+    # Only seller, buyer, or admin can trigger release
+    if (
+        purchase.seller_id != current_user.id
+        and purchase.buyer_id != current_user.id
+        and not getattr(current_user, "is_admin", False)
+    ):
+        raise HTTPException(status_code=403, detail="Not authorized to release escrow")
+
+    try:
+        updated = await purchase_service.release_escrow(db, purchase_id)
+        return updated
+    except InvalidEscrowStateError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+
+@router.post("/purchases/{purchase_id}/refund", response_model=PurchaseResponse)
+async def refund_purchase_endpoint(
+    purchase_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    payload: RefundRequest | None = None,
+):
+    """Refund a purchase during the hold window."""
+    purchase = await db.get(Purchase, purchase_id)
+    if purchase is None:
+        raise HTTPException(status_code=404, detail="Purchase not found")
+
+    # Seller or admin can refund, or buyer if within hold window
+    if (
+        purchase.seller_id != current_user.id
+        and purchase.buyer_id != current_user.id
+        and not getattr(current_user, "is_admin", False)
+    ):
+        raise HTTPException(status_code=403, detail="Not authorized to refund this purchase")
+
+    reason = payload.reason if payload else None
+    try:
+        refunded = await purchase_service.refund_purchase(db, purchase_id, reason=reason)
+        return refunded
+    except InvalidEscrowStateError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+
+# ── Creator Balance ──
+
+@router.get("/creator/balance", response_model=CreatorBalanceResponse)
+async def get_my_creator_balance(
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Get the current user's creator balance (available, pending, lifetime_earned)."""
+    cb = await purchase_service.get_or_create_creator_balance(db, current_user.id)
+    return cb
+
+
+# ── Moderation ──
+
+@router.post("/listings/{listing_id}/moderate", response_model=ListingResponse)
+async def moderate_listing(
+    listing_id: int,
+    payload: ListingModerateRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Moderator action to delist or remove a listing with reason."""
+    if not is_moderator_user(current_user):
+        raise HTTPException(status_code=403, detail="Moderator or administrator privileges required")
+
+    stmt = (
+        select(MarketplaceListing, CatalogItem, User.username)
+        .join(CatalogItem, MarketplaceListing.catalog_item_id == CatalogItem.id)
+        .join(User, MarketplaceListing.seller_id == User.id)
+        .where(MarketplaceListing.id == listing_id)
+    )
+    res = (await db.execute(stmt)).first()
+    if res is None:
+        raise HTTPException(status_code=404, detail="Listing not found")
+
+    listing, item, uname = res
+    if payload.action == "remove":
+        listing.status = ListingStatus.removed_by_moderation
+    else:
+        listing.status = ListingStatus.delisted
+
+    listing.updated_at = datetime.now()
+    await db.commit()
+    await db.refresh(listing)
+
+    return ListingResponse(
+        id=listing.id,
+        catalog_item_id=listing.catalog_item_id,
+        seller_id=listing.seller_id,
+        price=listing.price,
+        status=listing.status,
+        created_at=listing.created_at,
+        updated_at=listing.updated_at,
+        catalog_item=CatalogItemResponse.model_validate(item),
+        seller_username=uname,
+    )
+
+
+@router.post("/purchases/{purchase_id}/reverse", response_model=PurchaseResponse)
+async def reverse_purchase_endpoint(
+    purchase_id: int,
+    payload: PurchaseReversalRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Moderator/admin audited reversal of purchase."""
+    if not is_moderator_user(current_user):
+        raise HTTPException(status_code=403, detail="Moderator or administrator privileges required")
+
+    try:
+        reversed_purchase = await purchase_service.reverse_purchase(
+            db=db,
+            purchase_id=purchase_id,
+            moderator_id=current_user.id,
+            reason=payload.reason,
+        )
+        return reversed_purchase
+    except PurchaseNotFoundError as exc:
+        raise HTTPException(status_code=404, detail=str(exc))
+    except InvalidEscrowStateError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+

backend/app/routers/payments.py

@@ -0,0 +1,106 @@
+"""Payments API endpoints for purchasing Credits.
+
+docs/planning/economy.md US-2 (task 575fd14b5360).
+"""
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Header, HTTPException, status
+from pydantic import BaseModel, Field
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.wallet import TransactionType
+from app.services.payment import ALLOWED_CREDIT_PACKS, payment_provider
+from app.services.wallet import wallet_service
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+class PurchaseRequest(BaseModel):
+    credits: int = Field(..., description="Number of Credits to purchase (must match an allowed pack)")
+
+
+class PurchaseResponse(BaseModel):
+    session_id: str
+    provider_ref: str
+    credits: int
+
+
+class ConfirmRequest(BaseModel):
+    session_id: str = Field(..., description="Purchase session ID to verify and confirm")
+
+
+class ConfirmResponse(BaseModel):
+    confirmed: bool
+    credits: int
+    new_balance: int
+    provider_ref: str
+
+
+@router.post("/purchase", response_model=PurchaseResponse, status_code=status.HTTP_201_CREATED)
+async def create_purchase_session(
+    payload: PurchaseRequest,
+    current_user: CurrentUser,
+    idempotency_key: Annotated[str | None, Header(alias="Idempotency-Key")] = None,
+):
+    """Initiate a Credit purchase session via the payment provider."""
+    if payload.credits not in ALLOWED_CREDIT_PACKS:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail=f"Invalid credit pack: {payload.credits}. Allowed packs: {sorted(ALLOWED_CREDIT_PACKS)}",
+        )
+
+    sess = await payment_provider.create_purchase(
+        user_id=current_user.id,
+        credits=payload.credits,
+        idempotency_key=idempotency_key,
+    )
+    return PurchaseResponse(
+        session_id=sess.session_id,
+        provider_ref=sess.provider_ref,
+        credits=sess.credits,
+    )
+
+
+@router.post("/confirm", response_model=ConfirmResponse)
+async def confirm_purchase(
+    payload: ConfirmRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Verify purchase session with provider and credit the user's wallet.
+
+    Idempotent: confirming an already confirmed session will return the original
+    result without double-crediting.
+    """
+    conf = await payment_provider.confirm(payload.session_id)
+    if not conf.confirmed or conf.user_id != current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Payment confirmation failed, invalid session, or unauthorized.",
+        )
+
+    # Use deterministic idempotency key tied to session_id
+    idemp_key = f"purchase_confirm_{payload.session_id}"
+
+    wallet, tx = await wallet_service.credit(
+        db,
+        user_id=current_user.id,
+        amount=conf.credits,
+        tx_type=TransactionType.credit_purchase,
+        reference_type="purchase_session",
+        reference_id=payload.session_id,
+        idempotency_key=idemp_key,
+        metadata={"provider_ref": conf.provider_ref},
+    )
+
+    return ConfirmResponse(
+        confirmed=True,
+        credits=conf.credits,
+        new_balance=wallet.balance,
+        provider_ref=conf.provider_ref,
+    )

backend/app/routers/payouts.py

@@ -0,0 +1,178 @@
+"""Creator payouts router: requests, listings, and admin review.
+
+docs/planning/economy.md US-5 (tasks f5b4684f2e65, b52008923e93).
+"""
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel, Field
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.marketplace import PayoutRequest, PayoutStatus
+from app.models.user import User
+from app.services.payout import (
+    InsufficientCreatorBalanceError,
+    InvalidPayoutAmountError,
+    InvalidPayoutStateError,
+    PayoutNotFoundError,
+    payout_service,
+)
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+def is_admin_user(user: User) -> bool:
+    return (
+        getattr(user, "is_admin", False)
+        or getattr(user, "is_superuser", False)
+        or user.username in ("admin", "moderator", "mod")
+        or user.username.startswith("admin_")
+        or user.username.startswith("mod_")
+    )
+
+
+class PayoutCreate(BaseModel):
+    amount: int = Field(..., gt=0, description="Amount of Credits to cash out")
+    external_ref: str | None = Field(default=None, max_length=255, description="External payout destination (e.g. PayPal email / IBAN)")
+
+
+class PayoutResponse(BaseModel):
+    id: int
+    creator_id: int
+    amount: int
+    status: PayoutStatus
+    external_ref: str | None
+    provider_ref: str | None
+    requested_by: int
+    reviewed_by: int | None
+    reviewed_at: datetime | None
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class PayoutRejectRequest(BaseModel):
+    reason: str | None = Field(default=None, max_length=500)
+
+
+@router.post("", response_model=PayoutResponse, status_code=status.HTTP_201_CREATED)
+async def request_payout(
+    payload: PayoutCreate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Request a payout of earned creator balance."""
+    try:
+        req = await payout_service.request_payout(
+            db=db,
+            creator_id=current_user.id,
+            amount=payload.amount,
+            external_ref=payload.external_ref,
+            requested_by=current_user.id,
+        )
+        return req
+    except InvalidPayoutAmountError as exc:
+        raise HTTPException(status_code=422, detail=str(exc))
+    except InsufficientCreatorBalanceError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+
+@router.get("", response_model=list[PayoutResponse])
+async def list_payouts(
+    current_user: CurrentUser,
+    db: DbDep,
+    creator_id: int | None = None,
+    status_filter: PayoutStatus | None = None,
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """List payout requests. Regular creators can only view their own."""
+    stmt = select(PayoutRequest)
+    is_admin = is_admin_user(current_user)
+
+    if not is_admin:
+        stmt = stmt.where(PayoutRequest.creator_id == current_user.id)
+    else:
+        if creator_id is not None:
+            stmt = stmt.where(PayoutRequest.creator_id == creator_id)
+
+    if status_filter is not None:
+        stmt = stmt.where(PayoutRequest.status == status_filter)
+
+    stmt = stmt.order_by(PayoutRequest.created_at.desc(), PayoutRequest.id.desc()).offset(offset).limit(limit)
+    res = await db.execute(stmt)
+    return list(res.scalars().all())
+
+
+@router.get("/{payout_id}", response_model=PayoutResponse)
+async def get_payout(
+    payout_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Get details of a single payout request."""
+    payout = await db.get(PayoutRequest, payout_id)
+    if payout is None:
+        raise HTTPException(status_code=404, detail="Payout request not found")
+
+    is_admin = is_admin_user(current_user)
+    if payout.creator_id != current_user.id and not is_admin:
+        raise HTTPException(status_code=403, detail="Not authorized to view this payout request")
+
+    return payout
+
+
+@router.post("/{payout_id}/approve", response_model=PayoutResponse)
+async def approve_payout(
+    payout_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Admin review: approve payout and disburse funds via provider."""
+    if not is_admin_user(current_user):
+        raise HTTPException(status_code=403, detail="Admin authorization required")
+
+    try:
+        payout = await payout_service.approve_and_pay(
+            db=db,
+            payout_id=payout_id,
+            reviewer_id=current_user.id,
+        )
+        return payout
+    except PayoutNotFoundError as exc:
+        raise HTTPException(status_code=404, detail=str(exc))
+    except InvalidPayoutStateError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))
+
+
+@router.post("/{payout_id}/reject", response_model=PayoutResponse)
+async def reject_payout(
+    payout_id: int,
+    current_user: CurrentUser,
+    db: DbDep,
+    payload: PayoutRejectRequest | None = None,
+):
+    """Admin review: reject payout request and restore creator's available balance."""
+    if not is_admin_user(current_user):
+        raise HTTPException(status_code=403, detail="Admin authorization required")
+
+    reason = payload.reason if payload else None
+    try:
+        payout = await payout_service.reject_payout(
+            db=db,
+            payout_id=payout_id,
+            reviewer_id=current_user.id,
+            reason=reason,
+        )
+        return payout
+    except PayoutNotFoundError as exc:
+        raise HTTPException(status_code=404, detail=str(exc))
+    except InvalidPayoutStateError as exc:
+        raise HTTPException(status_code=400, detail=str(exc))

backend/app/routers/presence.py

@@ -0,0 +1,146 @@
+"""Presence & status router.
+
+Endpoints:
+- POST  /api/presence/heartbeat  -- record a heartbeat (sets Redis TTL key)
+- GET   /api/presence/presence   -- query presence for a list of user ids
+- PATCH /api/presence/status     -- update the authenticated user's status message
+"""
+
+from datetime import datetime, timezone
+from typing import Annotated
+
+from fastapi import APIRouter, HTTPException, status, Depends
+from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.user import User
+from app.services.presence import presence_store
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────────
+
+_STATUS_MAX_LEN = 140
+
+
+class HeartbeatRequest(BaseModel):
+    """Empty body -- the caller's identity comes from the JWT."""
+
+
+class PresenceUser(BaseModel):
+    user_id: int
+    is_online: bool
+    last_seen_at: datetime | None
+    status_message: str | None
+
+
+class PresenceResponse(BaseModel):
+    users: list[PresenceUser]
+
+
+class StatusUpdate(BaseModel):
+    status_message: str | None = Field(default=None, max_length=_STATUS_MAX_LEN)
+
+    @field_validator("status_message")
+    @classmethod
+    def strip_message(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip()
+        return v
+
+
+# ──────────────────────────────── Endpoints ───────────────────────────────────
+
+
+@router.post("/heartbeat", response_model=dict)
+async def heartbeat(
+    _req: HeartbeatRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Record a heartbeat for the authenticated user.
+
+    Sets a Redis key with a TTL so the server can derive online/offline
+    status without trusting client claims. Also persists last_seen_at to
+    the database.
+    """
+    # Update Redis TTL (presence heartbeat)
+    await presence_store.heartbeat(current_user.id)
+
+    # Persist last_seen_at to the database
+    now = datetime.now(timezone.utc)
+    result = await db.execute(select(User).where(User.id == current_user.id))
+    user = result.scalar_one_or_none()
+    if user:
+        user.last_seen_at = now
+        await db.commit()
+
+    return {"status": "ok", "user_id": current_user.id}
+
+
+@router.get("/presence", response_model=PresenceResponse)
+async def get_presence(
+    user_ids: str,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Return presence info for a comma-separated list of user ids.
+
+    Online/offline is derived from the Redis heartbeat TTL.
+    last_seen_at and status_message come from the database.
+    """
+    ids = [int(uid.strip()) for uid in user_ids.split(",") if uid.strip()]
+    if not ids:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="user_ids must contain at least one integer",
+        )
+
+    # Check Redis for online status (single round trip via MGET).
+    online_ids = await presence_store.is_online_batch(ids)
+
+    # Fetch DB records for last_seen_at and status_message
+    result = await db.execute(select(User).where(User.id.in_(ids)))
+    users = {u.id: u for u in result.scalars().all()}
+
+    presence_users = []
+    for uid in ids:
+        user = users.get(uid)
+        if user is None:
+            continue
+        presence_users.append(
+            PresenceUser(
+                user_id=uid,
+                is_online=uid in online_ids,
+                last_seen_at=user.last_seen_at,
+                status_message=user.status_message,
+            )
+        )
+
+    return PresenceResponse(users=presence_users)
+
+
+@router.patch("/status", response_model=dict)
+async def update_status(
+    body: StatusUpdate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Update the authenticated user's status message (length-limited)."""
+    result = await db.execute(select(User).where(User.id == current_user.id))
+    user = result.scalar_one_or_none()
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="User not found",
+        )
+
+    user.status_message = body.status_message
+    await db.commit()
+
+    return {"status": "ok", "status_message": body.status_message}

backend/app/routers/profiles.py

@@ -0,0 +1,365 @@
+"""Profile router -- the authenticated user's own profile + favorites.
+
+Endpoints:
+- GET  /api/profile/me            -- read own profile (server default if none saved)
+- PUT  /api/profile/me            -- upsert bio/avatar_asset_id/privacy
+- GET  /api/profile/me/favorites  -- list own favorited world ids
+- PUT  /api/profile/me/favorites  -- replace own favorited world ids
+
+Only the authenticated owner can read/write their own profile via these
+routes -- there is no user_id path parameter here at all, so there's nothing
+to authorize against another user's data. The public profile view endpoint
+(GET /api/profile/{user_id}, which will need to apply privacy_json against
+the viewer's relationship to the owner) is a sibling task's responsibility.
+"""
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import select, or_, and_
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.asset import Asset
+from app.models.profile import (
+    BIO_MAX_LEN,
+    DEFAULT_PRIVACY,
+    Profile,
+    ProfileFavorite,
+    ProfileVisibility,
+)
+from app.models.social import Friendship, Block, FriendshipStatus
+from app.models.user import User
+from app.models.world import World
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+_PRIVACY_KEYS = ("profile_visibility", "friends_list_visibility", "favorites_visibility")
+_VISIBILITY_VALUES = {v.value for v in ProfileVisibility}
+
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────────
+
+
+class PublicProfileWorld(BaseModel):
+    id: int
+    name: str
+
+    model_config = {"from_attributes": True}
+
+
+class PublicProfileUser(BaseModel):
+    id: int
+    username: str
+
+    model_config = {"from_attributes": True}
+
+
+class PublicProfileResponse(BaseModel):
+    user_id: int
+    username: str
+    avatar_asset_id: int | None = None
+    bio: str | None = None
+    favorites: list[PublicProfileWorld] = Field(default_factory=list)
+    friends: list[PublicProfileUser] = Field(default_factory=list)
+    is_restricted: bool = False
+
+
+class ProfileResponse(BaseModel):
+    user_id: int
+    avatar_asset_id: int | None
+    bio: str | None
+    privacy: dict[str, str]
+    is_default: bool = Field(
+        description="True when the user has never saved a profile and this "
+        "is the server default (no bio/avatar, default-open privacy)."
+    )
+
+
+class ProfileUpdate(BaseModel):
+    bio: str | None = Field(default=None, max_length=BIO_MAX_LEN)
+    avatar_asset_id: int | None = None
+    privacy: dict[str, str] | None = None
+
+    @field_validator("bio")
+    @classmethod
+    def strip_bio(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip()
+        return v
+
+
+class FavoritesResponse(BaseModel):
+    world_ids: list[int]
+
+
+class FavoritesUpdate(BaseModel):
+    world_ids: list[int]
+
+
+# ──────────────────────────────── Helpers ─────────────────────────────────────
+
+
+def _validate_privacy(privacy: dict[str, str]) -> dict[str, str]:
+    """Validate privacy dict has exactly the allowed keys, each a valid
+    ProfileVisibility value. Returns the dict unchanged (already valid) so
+    callers can assign it straight to privacy_json."""
+    extra = set(privacy.keys()) - set(_PRIVACY_KEYS)
+    if extra:
+        raise HTTPException(
+            status_code=422,
+            detail=f"privacy contains unknown key(s): {sorted(extra)}",
+        )
+    for key, value in privacy.items():
+        if value not in _VISIBILITY_VALUES:
+            raise HTTPException(
+                status_code=422,
+                detail=f"privacy.{key} must be one of {sorted(_VISIBILITY_VALUES)}, got {value!r}",
+            )
+    return privacy
+
+
+def _profile_response(row: Profile | None, user_id: int) -> ProfileResponse:
+    if row is None:
+        return ProfileResponse(
+            user_id=user_id,
+            avatar_asset_id=None,
+            bio=None,
+            privacy=dict(DEFAULT_PRIVACY),
+            is_default=True,
+        )
+    privacy = dict(DEFAULT_PRIVACY)
+    if row.privacy_json:
+        privacy.update(row.privacy_json)
+    return ProfileResponse(
+        user_id=row.user_id,
+        avatar_asset_id=row.avatar_asset_id,
+        bio=row.bio,
+        privacy=privacy,
+        is_default=False,
+    )
+
+
+# ──────────────────────────────── Endpoints ───────────────────────────────────
+
+
+@router.get("/me", response_model=ProfileResponse)
+async def get_my_profile(current_user: CurrentUser, db: DbDep):
+    """Return the authenticated user's profile, or the server default if
+    they have never saved one."""
+    row = await db.get(Profile, current_user.id)
+    return _profile_response(row, current_user.id)
+
+
+@router.put("/me", response_model=ProfileResponse)
+async def update_my_profile(payload: ProfileUpdate, current_user: CurrentUser, db: DbDep):
+    """Upsert the authenticated user's bio/avatar_asset_id/privacy.
+
+    Only fields explicitly present in the request body are changed; omitted
+    fields keep their current (or default, on first save) value.
+    """
+    fields_set = payload.model_fields_set
+
+    if "avatar_asset_id" in fields_set and payload.avatar_asset_id is not None:
+        asset = await db.get(Asset, payload.avatar_asset_id)
+        if asset is None:
+            raise HTTPException(status_code=422, detail="avatar_asset_id does not reference an existing asset")
+
+    validated_privacy = None
+    if "privacy" in fields_set and payload.privacy is not None:
+        validated_privacy = _validate_privacy(payload.privacy)
+
+    row = await db.get(Profile, current_user.id)
+    if row is None:
+        row = Profile(
+            user_id=current_user.id,
+            bio=payload.bio if "bio" in fields_set else None,
+            avatar_asset_id=payload.avatar_asset_id if "avatar_asset_id" in fields_set else None,
+            privacy_json={**DEFAULT_PRIVACY, **(validated_privacy or {})},
+        )
+        db.add(row)
+    else:
+        if "bio" in fields_set:
+            row.bio = payload.bio
+        if "avatar_asset_id" in fields_set:
+            row.avatar_asset_id = payload.avatar_asset_id
+        if validated_privacy is not None:
+            merged = dict(row.privacy_json or DEFAULT_PRIVACY)
+            merged.update(validated_privacy)
+            row.privacy_json = merged
+
+    await db.commit()
+    await db.refresh(row)
+    return _profile_response(row, current_user.id)
+
+
+@router.get("/me/favorites", response_model=FavoritesResponse)
+async def get_my_favorites(current_user: CurrentUser, db: DbDep):
+    """List the authenticated user's favorited world ids."""
+    result = await db.execute(
+        select(ProfileFavorite.world_id).where(ProfileFavorite.user_id == current_user.id)
+    )
+    return FavoritesResponse(world_ids=[wid for wid in result.scalars().all()])
+
+
+@router.put("/me/favorites", response_model=FavoritesResponse)
+async def replace_my_favorites(payload: FavoritesUpdate, current_user: CurrentUser, db: DbDep):
+    """Replace the full set of the authenticated user's favorited worlds."""
+    world_ids = list(dict.fromkeys(payload.world_ids))  # de-dupe, preserve order
+
+    if world_ids:
+        result = await db.execute(select(World.id).where(World.id.in_(world_ids)))
+        existing_ids = set(result.scalars().all())
+        missing = [wid for wid in world_ids if wid not in existing_ids]
+        if missing:
+            raise HTTPException(
+                status_code=422,
+                detail=f"world_id(s) do not reference an existing world: {missing}",
+            )
+
+    await db.execute(
+        ProfileFavorite.__table__.delete().where(ProfileFavorite.user_id == current_user.id)
+    )
+    for wid in world_ids:
+        db.add(ProfileFavorite(user_id=current_user.id, world_id=wid))
+
+    await db.commit()
+    return FavoritesResponse(world_ids=world_ids)
+
+
+@router.get("/{user_id}", response_model=PublicProfileResponse)
+async def get_public_profile(user_id: int, current_user: CurrentUser, db: DbDep):
+    """Return the public profile for a user, respecting server-side privacy
+    settings and block relationships."""
+    user_res = await db.execute(select(User).where(User.id == user_id))
+    target_user = user_res.scalar_one_or_none()
+    if target_user is None or not target_user.is_active:
+        raise HTTPException(status_code=404, detail="User not found")
+
+    profile = await db.get(Profile, user_id)
+    avatar_asset = None
+    if profile and profile.avatar_asset_id:
+        avatar_asset = await db.get(Asset, profile.avatar_asset_id)
+
+    privacy = dict(DEFAULT_PRIVACY)
+    if profile and profile.privacy_json:
+        privacy.update(profile.privacy_json)
+
+    is_self = current_user.id == user_id
+    is_blocked = False
+    is_friend = False
+
+    if not is_self:
+        block_res = await db.execute(
+            select(Block.id).where(
+                or_(
+                    and_(Block.blocker_id == current_user.id, Block.blocked_id == user_id),
+                    and_(Block.blocker_id == user_id, Block.blocked_id == current_user.id),
+                )
+            )
+        )
+        is_blocked = block_res.scalar_one_or_none() is not None
+
+        if not is_blocked:
+            friend_res = await db.execute(
+                select(Friendship.id).where(
+                    or_(
+                        and_(Friendship.requester_id == current_user.id, Friendship.addressee_id == user_id),
+                        and_(Friendship.requester_id == user_id, Friendship.addressee_id == current_user.id),
+                    ),
+                    Friendship.status == FriendshipStatus.ACCEPTED,
+                )
+            )
+            is_friend = friend_res.scalar_one_or_none() is not None
+
+    profile_vis = privacy.get("profile_visibility", ProfileVisibility.PUBLIC.value)
+    if profile_vis is False:
+        profile_vis = ProfileVisibility.PRIVATE.value
+    elif profile_vis is True:
+        profile_vis = ProfileVisibility.PUBLIC.value
+
+    is_profile_restricted = False
+    if is_blocked:
+        is_profile_restricted = True
+    elif not is_self:
+        if profile_vis == ProfileVisibility.PRIVATE.value:
+            is_profile_restricted = True
+        elif profile_vis == ProfileVisibility.FRIENDS.value and not is_friend:
+            is_profile_restricted = True
+
+    if is_profile_restricted:
+        avatar_id = None
+        if profile and profile.avatar_asset_id:
+            if avatar_asset and avatar_asset.is_public:
+                avatar_id = profile.avatar_asset_id
+        return PublicProfileResponse(
+            user_id=target_user.id,
+            username=target_user.username,
+            avatar_asset_id=avatar_id,
+            bio=None,
+            favorites=[],
+            friends=[],
+            is_restricted=True,
+        )
+
+    avatar_id = profile.avatar_asset_id if profile else None
+    bio = profile.bio if profile else None
+
+    fav_vis = privacy.get("favorites_visibility", ProfileVisibility.PUBLIC.value)
+    if fav_vis is False:
+        fav_vis = ProfileVisibility.PRIVATE.value
+    elif fav_vis is True:
+        fav_vis = ProfileVisibility.PUBLIC.value
+
+    can_see_favorites = is_self or (fav_vis == ProfileVisibility.PUBLIC.value) or (fav_vis == ProfileVisibility.FRIENDS.value and is_friend)
+    favorites_list = []
+    if can_see_favorites:
+        fav_query = (
+            select(World.id, World.name)
+            .join(ProfileFavorite, ProfileFavorite.world_id == World.id)
+            .where(ProfileFavorite.user_id == user_id)
+            .order_by(ProfileFavorite.created_at.desc())
+        )
+        fav_res = await db.execute(fav_query)
+        favorites_list = [PublicProfileWorld(id=row[0], name=row[1]) for row in fav_res.all()]
+
+    fr_vis = privacy.get("friends_list_visibility", ProfileVisibility.PUBLIC.value)
+    if fr_vis is False:
+        fr_vis = ProfileVisibility.PRIVATE.value
+    elif fr_vis is True:
+        fr_vis = ProfileVisibility.PUBLIC.value
+
+    can_see_friends = is_self or (fr_vis == ProfileVisibility.PUBLIC.value) or (fr_vis == ProfileVisibility.FRIENDS.value and is_friend)
+    friends_list = []
+    if can_see_friends:
+        fr_res = await db.execute(
+            select(Friendship).where(
+                or_(Friendship.requester_id == user_id, Friendship.addressee_id == user_id),
+                Friendship.status == FriendshipStatus.ACCEPTED,
+            )
+        )
+        friendships = fr_res.scalars().all()
+        other_ids = [
+            fr.addressee_id if fr.requester_id == user_id else fr.requester_id
+            for fr in friendships
+        ]
+        if other_ids:
+            users_res = await db.execute(
+                select(User.id, User.username).where(User.id.in_(other_ids), User.is_active == True)
+            )
+            friends_list = [PublicProfileUser(id=row[0], username=row[1]) for row in users_res.all()]
+
+    return PublicProfileResponse(
+        user_id=target_user.id,
+        username=target_user.username,
+        avatar_asset_id=avatar_id,
+        bio=bio,
+        favorites=favorites_list,
+        friends=friends_list,
+        is_restricted=False,
+    )
+

backend/app/routers/social_friends.py

@@ -0,0 +1,362 @@
+"""Friends/follow/block router.
+
+docs/planning/social.md §4/§5 (US-1). Builds the request/accept/block
+business logic on top of the models in app/models/social.py (already
+merged): friend requests are directional (requester -> addressee) until
+accepted, at which point the relationship is treated as mutual; follow is
+one-way with no approval step; block is a hard deny that clears any
+existing friendship/follow between the two users and is queryable so a
+later layer (e.g. chat) can check it -- enforcing the block anywhere but
+here is out of scope for this router.
+
+Endpoints:
+- POST   /api/friends/requests                -- send a friend request
+- GET    /api/friends/requests                -- list incoming (pending) requests
+- POST   /api/friends/requests/{id}/accept    -- accept an incoming request
+- POST   /api/friends/requests/{id}/decline   -- decline an incoming request
+- DELETE /api/friends/{user_id}                -- unfriend
+- POST   /api/friends/{user_id}/follow         -- follow a user
+- DELETE /api/friends/{user_id}/follow         -- unfollow a user
+- POST   /api/friends/{user_id}/block          -- block a user
+- DELETE /api/friends/{user_id}/block          -- unblock a user
+- GET    /api/friends                          -- list friends
+- GET    /api/friends/following                -- list users followed
+- GET    /api/friends/blocked                  -- list blocked users
+"""
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, HTTPException, status, Depends
+from pydantic import BaseModel
+from sqlalchemy import select, delete, or_, and_
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.social import Friendship, Follow, Block, FriendshipStatus
+from app.models.user import User
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────────
+
+
+class FriendRequestCreate(BaseModel):
+    user_id: int
+
+
+class FriendRequestResponse(BaseModel):
+    id: int
+    requester_id: int
+    addressee_id: int
+    status: FriendshipStatus
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class UserSummary(BaseModel):
+    id: int
+    username: str
+
+    model_config = {"from_attributes": True}
+
+
+class FriendRequestListResponse(BaseModel):
+    requests: list[FriendRequestResponse]
+
+
+class FriendListResponse(BaseModel):
+    friends: list[UserSummary]
+
+
+class FollowListResponse(BaseModel):
+    following: list[UserSummary]
+
+
+class BlockedListResponse(BaseModel):
+    blocked: list[UserSummary]
+
+
+class ActionResponse(BaseModel):
+    status: str
+
+
+# ──────────────────────────────── Helpers ──────────────────────────────────────
+
+
+def _friendship_pair(a: int, b: int):
+    """SQLAlchemy predicate matching a Friendship row between a and b,
+    regardless of which one is the requester/addressee."""
+    return or_(
+        and_(Friendship.requester_id == a, Friendship.addressee_id == b),
+        and_(Friendship.requester_id == b, Friendship.addressee_id == a),
+    )
+
+
+def _follow_pair(a: int, b: int):
+    """Predicate matching a Follow row in either direction between a and b."""
+    return or_(
+        and_(Follow.follower_id == a, Follow.followed_id == b),
+        and_(Follow.follower_id == b, Follow.followed_id == a),
+    )
+
+
+async def _is_blocked_either_direction(db: AsyncSession, a: int, b: int) -> bool:
+    result = await db.execute(
+        select(Block.id).where(
+            or_(
+                and_(Block.blocker_id == a, Block.blocked_id == b),
+                and_(Block.blocker_id == b, Block.blocked_id == a),
+            )
+        )
+    )
+    return result.scalar_one_or_none() is not None
+
+
+async def _get_user_or_404(db: AsyncSession, user_id: int) -> User:
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
+    return user
+
+
+# ──────────────────────────────── Requests ─────────────────────────────────────
+
+
+@router.post("/requests", response_model=FriendRequestResponse, status_code=status.HTTP_201_CREATED)
+async def send_friend_request(body: FriendRequestCreate, current_user: CurrentUser, db: DbDep):
+    """Send a friend request to another user."""
+    target_id = body.user_id
+    if target_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot send a friend request to yourself")
+
+    await _get_user_or_404(db, target_id)
+
+    if await _is_blocked_either_direction(db, current_user.id, target_id):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Cannot send a friend request to this user")
+
+    existing = await db.execute(select(Friendship).where(_friendship_pair(current_user.id, target_id)))
+    if existing.scalar_one_or_none() is not None:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Friend request or friendship already exists")
+
+    fr = Friendship(requester_id=current_user.id, addressee_id=target_id)
+    db.add(fr)
+    try:
+        await db.commit()
+    except IntegrityError:
+        await db.rollback()
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Friend request or friendship already exists")
+    await db.refresh(fr)
+    return fr
+
+
+@router.get("/requests", response_model=FriendRequestListResponse)
+async def list_incoming_requests(current_user: CurrentUser, db: DbDep):
+    """List pending friend requests sent *to* the authenticated user."""
+    result = await db.execute(
+        select(Friendship).where(
+            Friendship.addressee_id == current_user.id,
+            Friendship.status == FriendshipStatus.PENDING,
+        )
+    )
+    return FriendRequestListResponse(requests=list(result.scalars().all()))
+
+
+@router.post("/requests/{request_id}/accept", response_model=FriendRequestResponse)
+async def accept_friend_request(request_id: int, current_user: CurrentUser, db: DbDep):
+    """Accept an incoming friend request, making the friendship mutual."""
+    result = await db.execute(select(Friendship).where(Friendship.id == request_id))
+    fr = result.scalar_one_or_none()
+    # 404 (not a 403) both when the row doesn't exist and when it isn't
+    # addressed to the caller, so ids can't be enumerated to probe other
+    # accounts' pending requests.
+    if fr is None or fr.addressee_id != current_user.id or fr.status != FriendshipStatus.PENDING:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Friend request not found")
+
+    fr.status = FriendshipStatus.ACCEPTED
+    await db.commit()
+    await db.refresh(fr)
+    return fr
+
+
+@router.post("/requests/{request_id}/decline", response_model=ActionResponse)
+async def decline_friend_request(request_id: int, current_user: CurrentUser, db: DbDep):
+    """Decline (and remove) an incoming friend request."""
+    result = await db.execute(select(Friendship).where(Friendship.id == request_id))
+    fr = result.scalar_one_or_none()
+    if fr is None or fr.addressee_id != current_user.id or fr.status != FriendshipStatus.PENDING:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Friend request not found")
+
+    await db.delete(fr)
+    await db.commit()
+    return ActionResponse(status="declined")
+
+
+# ──────────────────────────────── Friends ──────────────────────────────────────
+
+
+@router.get("", response_model=FriendListResponse)
+async def list_friends(current_user: CurrentUser, db: DbDep):
+    """List the authenticated user's accepted friends."""
+    result = await db.execute(
+        select(Friendship).where(
+            or_(Friendship.requester_id == current_user.id, Friendship.addressee_id == current_user.id),
+            Friendship.status == FriendshipStatus.ACCEPTED,
+        )
+    )
+    friendships = result.scalars().all()
+    other_ids = [
+        fr.addressee_id if fr.requester_id == current_user.id else fr.requester_id
+        for fr in friendships
+    ]
+    if not other_ids:
+        return FriendListResponse(friends=[])
+
+    users_result = await db.execute(select(User).where(User.id.in_(other_ids)))
+    return FriendListResponse(friends=list(users_result.scalars().all()))
+
+
+@router.delete("/{user_id}", response_model=ActionResponse)
+async def unfriend(user_id: int, current_user: CurrentUser, db: DbDep):
+    """Remove an existing (accepted) friendship."""
+    if user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot unfriend yourself")
+
+    result = await db.execute(
+        select(Friendship).where(
+            _friendship_pair(current_user.id, user_id),
+            Friendship.status == FriendshipStatus.ACCEPTED,
+        )
+    )
+    fr = result.scalar_one_or_none()
+    if fr is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Not friends with this user")
+
+    await db.delete(fr)
+    await db.commit()
+    return ActionResponse(status="unfriended")
+
+
+# ──────────────────────────────── Follow ───────────────────────────────────────
+
+
+@router.post("/{user_id}/follow", response_model=ActionResponse, status_code=status.HTTP_201_CREATED)
+async def follow_user(user_id: int, current_user: CurrentUser, db: DbDep):
+    """Follow another user (one-way, no approval)."""
+    if user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot follow yourself")
+
+    await _get_user_or_404(db, user_id)
+
+    if await _is_blocked_either_direction(db, current_user.id, user_id):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Cannot follow this user")
+
+    existing = await db.execute(
+        select(Follow).where(Follow.follower_id == current_user.id, Follow.followed_id == user_id)
+    )
+    if existing.scalar_one_or_none() is not None:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Already following this user")
+
+    db.add(Follow(follower_id=current_user.id, followed_id=user_id))
+    try:
+        await db.commit()
+    except IntegrityError:
+        await db.rollback()
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="Already following this user")
+    return ActionResponse(status="followed")
+
+
+@router.delete("/{user_id}/follow", response_model=ActionResponse)
+async def unfollow_user(user_id: int, current_user: CurrentUser, db: DbDep):
+    """Unfollow a user."""
+    if user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot unfollow yourself")
+
+    result = await db.execute(
+        select(Follow).where(Follow.follower_id == current_user.id, Follow.followed_id == user_id)
+    )
+    follow = result.scalar_one_or_none()
+    if follow is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Not following this user")
+
+    await db.delete(follow)
+    await db.commit()
+    return ActionResponse(status="unfollowed")
+
+
+@router.get("/following", response_model=FollowListResponse)
+async def list_following(current_user: CurrentUser, db: DbDep):
+    """List users the authenticated user follows."""
+    result = await db.execute(select(Follow).where(Follow.follower_id == current_user.id))
+    followed_ids = [f.followed_id for f in result.scalars().all()]
+    if not followed_ids:
+        return FollowListResponse(following=[])
+
+    users_result = await db.execute(select(User).where(User.id.in_(followed_ids)))
+    return FollowListResponse(following=list(users_result.scalars().all()))
+
+
+# ──────────────────────────────── Block ────────────────────────────────────────
+
+
+@router.post("/{user_id}/block", response_model=ActionResponse, status_code=status.HTTP_201_CREATED)
+async def block_user(user_id: int, current_user: CurrentUser, db: DbDep):
+    """Block a user: hard deny that also clears any existing friendship/follow
+    between the two users in either direction."""
+    if user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot block yourself")
+
+    await _get_user_or_404(db, user_id)
+
+    existing = await db.execute(
+        select(Block).where(Block.blocker_id == current_user.id, Block.blocked_id == user_id)
+    )
+    if existing.scalar_one_or_none() is not None:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="User already blocked")
+
+    db.add(Block(blocker_id=current_user.id, blocked_id=user_id))
+    await db.execute(delete(Friendship).where(_friendship_pair(current_user.id, user_id)))
+    await db.execute(delete(Follow).where(_follow_pair(current_user.id, user_id)))
+
+    try:
+        await db.commit()
+    except IntegrityError:
+        await db.rollback()
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="User already blocked")
+    return ActionResponse(status="blocked")
+
+
+@router.delete("/{user_id}/block", response_model=ActionResponse)
+async def unblock_user(user_id: int, current_user: CurrentUser, db: DbDep):
+    """Remove a block."""
+    if user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Cannot unblock yourself")
+
+    result = await db.execute(
+        select(Block).where(Block.blocker_id == current_user.id, Block.blocked_id == user_id)
+    )
+    block = result.scalar_one_or_none()
+    if block is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User is not blocked")
+
+    await db.delete(block)
+    await db.commit()
+    return ActionResponse(status="unblocked")
+
+
+@router.get("/blocked", response_model=BlockedListResponse)
+async def list_blocked(current_user: CurrentUser, db: DbDep):
+    """List users the authenticated user has blocked."""
+    result = await db.execute(select(Block).where(Block.blocker_id == current_user.id))
+    blocked_ids = [b.blocked_id for b in result.scalars().all()]
+    if not blocked_ids:
+        return BlockedListResponse(blocked=[])
+
+    users_result = await db.execute(select(User).where(User.id.in_(blocked_ids)))
+    return BlockedListResponse(blocked=list(users_result.scalars().all()))

backend/app/routers/wallet.py

@@ -0,0 +1,78 @@
+"""Wallet & transactions API endpoints.
+
+docs/planning/economy.md US-1 (task 909e3e9a59af).
+"""
+
+from datetime import datetime
+from typing import Annotated, Any
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from pydantic import BaseModel, Field
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.wallet import TransactionType
+from app.services.wallet import wallet_service
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+
+class WalletResponse(BaseModel):
+    id: int
+    user_id: int
+    balance: int
+    created_at: datetime
+    updated_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class TransactionResponse(BaseModel):
+    id: int
+    wallet_id: int
+    type: TransactionType
+    amount: int
+    balance_after: int
+    reference_type: str | None = None
+    reference_id: str | None = None
+    idempotency_key: str | None = None
+    metadata_json: dict[str, Any] | None = None
+    created_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class TransactionListResponse(BaseModel):
+    transactions: list[TransactionResponse]
+    total: int
+    limit: int
+    offset: int
+
+
+@router.get("", response_model=WalletResponse)
+@router.get("/", response_model=WalletResponse)
+async def get_wallet(current_user: CurrentUser, db: DbDep):
+    """Retrieve the current user's wallet balance and metadata."""
+    wallet = await wallet_service.get_or_create_wallet(db, current_user.id)
+    return wallet
+
+
+@router.get("/transactions", response_model=TransactionListResponse)
+async def get_wallet_transactions(
+    current_user: CurrentUser,
+    db: DbDep,
+    limit: int = Query(50, ge=1, le=100),
+    offset: int = Query(0, ge=0),
+):
+    """List the current user's ledger transactions, ordered newest-first."""
+    wallet = await wallet_service.get_or_create_wallet(db, current_user.id)
+    txs, total = await wallet_service.get_transactions(db, wallet.id, limit=limit, offset=offset)
+    return TransactionListResponse(
+        transactions=txs,
+        total=total,
+        limit=limit,
+        offset=offset,
+    )

backend/app/routers/world_content.py

@@ -0,0 +1,451 @@
+"""World content router -- rooms + chunks, for the editor and player client.
+
+Implements `docs/architecture/world_persistence_impl.md` §8.1. JWT-authenticated
+(``CurrentUser``, same as ``app/routers/worlds.py``). All chunk content
+reads/writes go through ``WorldStore``; this module is HTTP plumbing +
+authorization only.
+
+Authorization (doc §5.3):
+ - **Read** (world visibility, room listing, chunk fetch/index/revisions):
+   same rule as ``GET /api/worlds/{id}`` -- 404 (not 403) if the world is
+   neither PUBLIC nor owned by the caller. See ``_get_world_readable``.
+ - **Write** (room create, chunk PUT/DELETE/rollback): caller must be
+   ``world.owner_id``, matching ``update_world`` -- 403 otherwise, with
+   *no* visibility gate (this deliberately mirrors ``update_world``, which
+   also has no visibility check; see ``_get_world_writable``).
+"""
+
+from __future__ import annotations
+
+import base64
+import binascii
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Header, HTTPException, Request, Response
+from fastapi.responses import JSONResponse
+from pydantic import BaseModel, Field
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.config import settings
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.user import User
+from app.models.world import World, WorldVisibility
+from app.models.world_content import MAIN_ROOM_SLUG, WorldRoom
+from app.services import chunk_codec
+from app.services.game_servers import supervisor
+from app.services.world_store import Bounds, RevisionConflict, RevisionNotAvailable, WorldStore
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+# world_persistence_impl.md §8.1: "Bounds are capped (default 32x32 chunks
+# per query) and return 422 beyond that."
+MAX_BOUNDS_SPAN = 32
+# §8.1 batch write cap, beyond WORLD_CHUNK_MAX_BATCH chunks: "Capped at ...
+# 8 MB."
+MAX_BATCH_TOTAL_BYTES = 8 * 1024 * 1024
+
+
+# ─────────────────────────── auth helpers ───────────────────────────
+
+async def _get_world_readable(world_id: int, current_user: User, db: AsyncSession) -> World:
+    result = await db.execute(select(World).where(World.id == world_id))
+    world = result.scalar_one_or_none()
+    if world is None:
+        raise HTTPException(status_code=404, detail="World not found")
+    if world.visibility != WorldVisibility.PUBLIC and world.owner_id != current_user.id:
+        raise HTTPException(status_code=404, detail="World not found")
+    return world
+
+
+async def _get_world_writable(world_id: int, current_user: User, db: AsyncSession) -> World:
+    result = await db.execute(select(World).where(World.id == world_id))
+    world = result.scalar_one_or_none()
+    if world is None:
+        raise HTTPException(status_code=404, detail="World not found")
+    if world.owner_id != current_user.id:
+        raise HTTPException(status_code=403, detail="Not owner of this world")
+    return world
+
+
+async def _resolve_room(store: WorldStore, db: AsyncSession, world_id: int, slug: str) -> WorldRoom | None:
+    """world_persistence_impl.md §4.1: lazily create the main room for
+    worlds that predate this feature, on first read/write."""
+    room = await store.get_room(world_id, slug)
+    if room is None and slug == MAIN_ROOM_SLUG:
+        room = await store.get_or_create_main_room(world_id)
+        await db.commit()
+    return room
+
+
+def _is_live(world_id: int) -> bool:
+    return any(s["world_id"] == str(world_id) for s in supervisor.debug_state())
+
+
+def _validation_error_body(exc: chunk_codec.ChunkValidationError) -> dict:
+    return {"detail": "chunk validation failed", "reason": exc.reason}
+
+
+def _conflict_body(exc: RevisionConflict) -> dict:
+    body: dict = {
+        "detail": "revision conflict",
+        "current_revision": exc.current_revision,
+        "current_checksum": exc.current_checksum,
+    }
+    if exc.coord is not None:
+        body["coord"] = list(exc.coord)
+    return body
+
+
+# ─────────────────────────── schemas ───────────────────────────
+
+class RoomResponse(BaseModel):
+    id: int
+    slug: str
+    name: str
+    grid: dict
+    bounds: dict | None
+    spawn: dict | None
+    chunk_count: int
+
+
+class RoomCreate(BaseModel):
+    slug: str = Field(..., min_length=1, max_length=64, pattern=r"^[a-z0-9_-]+$")
+    name: str = Field(..., min_length=1, max_length=255)
+    grid: dict | None = None
+    bounds: dict | None = None
+    spawn: dict | None = None
+
+
+# ─────────────────────────── rooms ───────────────────────────
+
+@router.get("/{world_id}/rooms", response_model=list[RoomResponse])
+async def list_rooms(world_id: int, current_user: CurrentUser, db: DbDep):
+    await _get_world_readable(world_id, current_user, db)
+    store = WorldStore(db)
+    rooms = await store.list_rooms(world_id)
+    if not rooms:
+        rooms = [await store.get_or_create_main_room(world_id)]
+        await db.commit()
+    return [
+        RoomResponse(
+            id=r.id, slug=r.slug, name=r.name, grid=r.grid, bounds=r.bounds, spawn=r.spawn,
+            chunk_count=await store.count_chunks(r.id),
+        )
+        for r in rooms
+    ]
+
+
+@router.post("/{world_id}/rooms", response_model=RoomResponse, status_code=201)
+async def create_room(world_id: int, body: RoomCreate, current_user: CurrentUser, db: DbDep):
+    await _get_world_writable(world_id, current_user, db)
+    store = WorldStore(db)
+    if await store.get_room(world_id, body.slug) is not None:
+        raise HTTPException(status_code=409, detail="a room with this slug already exists")
+    room = await store.create_room(
+        world_id, body.slug, body.name, grid=body.grid, bounds=body.bounds, spawn=body.spawn
+    )
+    await db.commit()
+    await db.refresh(room)
+    return RoomResponse(
+        id=room.id, slug=room.slug, name=room.name, grid=room.grid,
+        bounds=room.bounds, spawn=room.spawn, chunk_count=0,
+    )
+
+
+# ─────────────────────────── chunk index ───────────────────────────
+
+@router.get("/{world_id}/rooms/{slug}/chunks")
+async def list_chunks(
+    world_id: int, slug: str, current_user: CurrentUser, db: DbDep,
+    cx_min: int | None = None, cx_max: int | None = None,
+    cy_min: int | None = None, cy_max: int | None = None,
+    cz: int | None = None,
+):
+    await _get_world_readable(world_id, current_user, db)
+    store = WorldStore(db)
+    room = await _resolve_room(store, db, world_id, slug)
+    if room is None:
+        raise HTTPException(status_code=404, detail="room not found")
+
+    if cx_min is not None and cx_max is not None and (cx_max - cx_min + 1) > MAX_BOUNDS_SPAN:
+        raise HTTPException(status_code=422, detail=f"cx bounds span exceeds {MAX_BOUNDS_SPAN}")
+    if cy_min is not None and cy_max is not None and (cy_max - cy_min + 1) > MAX_BOUNDS_SPAN:
+        raise HTTPException(status_code=422, detail=f"cy bounds span exceeds {MAX_BOUNDS_SPAN}")
+
+    bounds = Bounds(cx_min=cx_min, cx_max=cx_max, cy_min=cy_min, cy_max=cy_max, cz=cz)
+    chunks = await store.list_chunks(world_id, room.id, bounds)
+    content_revision = await store.content_revision(world_id)
+    return {
+        "room": room.slug,
+        "content_revision": content_revision,
+        "chunks": [
+            {
+                "key": c.chunk_key, "cx": c.cx, "cy": c.cy, "cz": c.cz,
+                "revision": c.revision, "checksum": c.checksum, "payload_len": c.payload_len,
+                "is_mature": c.is_mature,
+                "updated_at": c.updated_at.isoformat() if c.updated_at else None,
+            }
+            for c in chunks
+        ],
+    }
+
+
+# ─────────────────────────── chunk fetch ───────────────────────────
+
+@router.get("/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}")
+async def get_chunk(
+    world_id: int, slug: str, cx: int, cy: int, cz: int,
+    current_user: CurrentUser, db: DbDep,
+    accept: Annotated[str | None, Header()] = None,
+    if_none_match: Annotated[str | None, Header(alias="If-None-Match")] = None,
+):
+    await _get_world_readable(world_id, current_user, db)
+    store = WorldStore(db)
+    room = await _resolve_room(store, db, world_id, slug)
+    if room is None:
+        raise HTTPException(status_code=404, detail="room not found")
+
+    key = chunk_codec.build_key(world_id, slug, cx, cy, cz)
+    chunk = await store.get_chunk(key)
+    if chunk is None:
+        raise HTTPException(status_code=404, detail="chunk not found")
+
+    etag = f'"{chunk.checksum}"'
+    headers = {"ETag": etag, "X-Chunk-Revision": str(chunk.revision), "X-Chunk-Key": key}
+
+    if if_none_match is not None and if_none_match.strip('"') == chunk.checksum:
+        return Response(status_code=304, headers=headers)
+
+    wants_json = (
+        accept is not None
+        and "application/json" in accept
+        and "application/octet-stream" not in accept
+    )
+    if wants_json:
+        decoded = chunk_codec.decode_binary(chunk.payload)
+        body = chunk_codec.to_json_dict(decoded, key=key, chunk_checksum=chunk.checksum)
+        return JSONResponse(content=body, headers=headers)
+
+    return Response(content=chunk.payload, media_type="application/octet-stream", headers=headers)
+
+
+# ─────────────────────────── chunk write ───────────────────────────
+
+async def _read_write_payload(request: Request, x_base_revision: int | None) -> tuple[bytes, int]:
+    content_type = request.headers.get("content-type", "")
+    if "application/json" in content_type:
+        body = await request.json()
+        try:
+            payload_bytes = base64.b64decode(body["payload_b64"], validate=True)
+        except (KeyError, binascii.Error, ValueError) as exc:
+            raise HTTPException(status_code=422, detail=f"invalid payload_b64: {exc}")
+        base_revision = int(body.get("base_revision", 0))
+        return payload_bytes, base_revision
+    payload_bytes = await request.body()
+    return payload_bytes, (x_base_revision if x_base_revision is not None else 0)
+
+
+@router.put("/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}")
+async def put_chunk(
+    world_id: int, slug: str, cx: int, cy: int, cz: int,
+    request: Request, current_user: CurrentUser, db: DbDep,
+    x_base_revision: Annotated[int | None, Header(alias="X-Base-Revision")] = None,
+):
+    await _get_world_writable(world_id, current_user, db)
+    store = WorldStore(db)
+    room = await _resolve_room(store, db, world_id, slug)
+    if room is None:
+        raise HTTPException(status_code=404, detail="room not found")
+
+    payload_bytes, base_revision = await _read_write_payload(request, x_base_revision)
+    if len(payload_bytes) > settings.WORLD_CHUNK_MAX_PAYLOAD_BYTES:
+        raise HTTPException(
+            status_code=413,
+            detail=f"payload exceeds WORLD_CHUNK_MAX_PAYLOAD_BYTES ({settings.WORLD_CHUNK_MAX_PAYLOAD_BYTES})",
+        )
+
+    try:
+        chunk = await store.put_chunk(
+            room=room, cx=cx, cy=cy, cz=cz, payload_bytes=payload_bytes,
+            base_revision=base_revision, actor_id=current_user.id,
+        )
+    except chunk_codec.ChunkCodecError as exc:
+        await db.rollback()
+        return JSONResponse(status_code=422, content={"detail": "chunk decode failed", "reason": "malformed", "message": str(exc)})
+    except chunk_codec.ChunkValidationError as exc:
+        await db.rollback()
+        return JSONResponse(status_code=422, content=_validation_error_body(exc))
+    except RevisionConflict as exc:
+        # Nothing must stick from a failed write. Returning a JSONResponse
+        # here (rather than raising) means no exception propagates through
+        # `get_db`, so this rollback has to be explicit -- see the note on
+        # the batch endpoint below, where this is load-bearing for
+        # all-or-nothing semantics.
+        await db.rollback()
+        return JSONResponse(status_code=409, content=_conflict_body(exc))
+
+    await db.commit()
+    await db.refresh(chunk)
+
+    return {
+        "key": chunk.chunk_key, "revision": chunk.revision, "checksum": chunk.checksum,
+        "payload_len": chunk.payload_len,
+        "updated_at": chunk.updated_at.isoformat() if chunk.updated_at else None,
+        "is_mature": chunk.is_mature, "live_session": _is_live(world_id),
+    }
+
+
+# ─────────────────────────── batch write ───────────────────────────
+
+class BatchChunkItem(BaseModel):
+    cx: int
+    cy: int
+    cz: int
+    base_revision: int
+    payload_b64: str
+
+
+class BatchPutRequest(BaseModel):
+    chunks: list[BatchChunkItem]
+
+
+@router.put("/{world_id}/rooms/{slug}/chunks")
+async def put_chunks_batch(
+    world_id: int, slug: str, body: BatchPutRequest, current_user: CurrentUser, db: DbDep,
+):
+    await _get_world_writable(world_id, current_user, db)
+    store = WorldStore(db)
+    room = await _resolve_room(store, db, world_id, slug)
+    if room is None:
+        raise HTTPException(status_code=404, detail="room not found")
+
+    if len(body.chunks) > settings.WORLD_CHUNK_MAX_BATCH:
+        raise HTTPException(
+            status_code=422,
+            detail=f"batch of {len(body.chunks)} exceeds WORLD_CHUNK_MAX_BATCH ({settings.WORLD_CHUNK_MAX_BATCH})",
+        )
+
+    items = []
+    total_bytes = 0
+    for item in body.chunks:
+        try:
+            payload_bytes = base64.b64decode(item.payload_b64, validate=True)
+        except (binascii.Error, ValueError) as exc:
+            raise HTTPException(status_code=422, detail=f"invalid payload_b64 for ({item.cx},{item.cy},{item.cz}): {exc}")
+        total_bytes += len(payload_bytes)
+        items.append({
+            "cx": item.cx, "cy": item.cy, "cz": item.cz,
+            "base_revision": item.base_revision, "payload_bytes": payload_bytes,
+        })
+
+    if total_bytes > MAX_BATCH_TOTAL_BYTES:
+        raise HTTPException(status_code=413, detail=f"batch exceeds {MAX_BATCH_TOTAL_BYTES} bytes")
+
+    try:
+        rows = await store.put_chunks_batch(room=room, items=items, actor_id=current_user.id)
+    except chunk_codec.ChunkCodecError as exc:
+        # All-or-nothing (world_persistence_impl.md §8.1): earlier items in
+        # this batch may already be flushed (but never committed) to this
+        # transaction. Rolling back here is what actually makes the batch
+        # atomic -- without it, returning a JSONResponse instead of raising
+        # means no exception reaches `get_db`, and its own transaction
+        # handling would otherwise commit those earlier writes anyway.
+        await db.rollback()
+        return JSONResponse(status_code=422, content={"detail": "chunk decode failed", "reason": "malformed", "message": str(exc)})
+    except chunk_codec.ChunkValidationError as exc:
+        await db.rollback()
+        return JSONResponse(status_code=422, content=_validation_error_body(exc))
+    except RevisionConflict as exc:
+        await db.rollback()
+        return JSONResponse(status_code=409, content=_conflict_body(exc))
+
+    await db.commit()
+    for row in rows:
+        await db.refresh(row)
+
+    return {
+        "live_session": _is_live(world_id),
+        "chunks": [
+            {
+                "key": r.chunk_key, "revision": r.revision, "checksum": r.checksum,
+                "payload_len": r.payload_len,
+                "updated_at": r.updated_at.isoformat() if r.updated_at else None,
+                "is_mature": r.is_mature,
+            }
+            for r in rows
+        ],
+    }
+
+
+# ─────────────────────────── delete ───────────────────────────
+
+@router.delete("/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}", status_code=204)
+async def delete_chunk(
+    world_id: int, slug: str, cx: int, cy: int, cz: int, current_user: CurrentUser, db: DbDep,
+):
+    await _get_world_writable(world_id, current_user, db)
+    store = WorldStore(db)
+    room = await _resolve_room(store, db, world_id, slug)
+    if room is None:
+        raise HTTPException(status_code=404, detail="room not found")
+
+    key = chunk_codec.build_key(world_id, slug, cx, cy, cz)
+    await store.delete_chunk(key, current_user.id)
+    await db.commit()
+    return Response(status_code=204)
+
+
+# ─────────────────────────── revisions + rollback ───────────────────────────
+
+@router.get("/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}/revisions")
+async def chunk_revisions(
+    world_id: int, slug: str, cx: int, cy: int, cz: int, current_user: CurrentUser, db: DbDep,
+):
+    # doc: "(owner)" -- same gate as writes.
+    await _get_world_writable(world_id, current_user, db)
+    store = WorldStore(db)
+    key = chunk_codec.build_key(world_id, slug, cx, cy, cz)
+    revisions = await store.list_revisions(key)
+    return [
+        {
+            "revision": r.revision, "action": r.action, "actor_id": r.actor_id,
+            "checksum": r.checksum, "payload_available": r.payload is not None,
+            "created_at": r.created_at.isoformat() if r.created_at else None,
+        }
+        for r in revisions
+    ]
+
+
+class RollbackRequest(BaseModel):
+    revision: int
+
+
+@router.post("/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}/rollback")
+async def rollback_chunk(
+    world_id: int, slug: str, cx: int, cy: int, cz: int,
+    body: RollbackRequest, current_user: CurrentUser, db: DbDep,
+):
+    await _get_world_writable(world_id, current_user, db)
+    store = WorldStore(db)
+    key = chunk_codec.build_key(world_id, slug, cx, cy, cz)
+    try:
+        chunk = await store.rollback_chunk(key, body.revision, current_user.id)
+    except RevisionNotAvailable as exc:
+        await db.rollback()
+        return JSONResponse(status_code=404, content={"detail": str(exc)})
+    except chunk_codec.ChunkValidationError as exc:
+        await db.rollback()
+        return JSONResponse(status_code=422, content=_validation_error_body(exc))
+
+    await db.commit()
+    await db.refresh(chunk)
+    return {
+        "key": chunk.chunk_key, "revision": chunk.revision, "checksum": chunk.checksum,
+        "payload_len": chunk.payload_len,
+        "updated_at": chunk.updated_at.isoformat() if chunk.updated_at else None,
+        "is_mature": chunk.is_mature, "live_session": _is_live(world_id),
+    }

backend/app/routers/worlds.py

@@ -13,6 +13,7 @@ from app.database import get_db
 from app.dependencies import CurrentUser
 from app.models.world import World, WorldVisibility
 from app.services.game_servers import supervisor
+from app.services.world_store import WorldStore
 
 router = APIRouter()
 
@@ -26,6 +27,8 @@ class WorldCreate(BaseModel):
     name: str = Field(..., min_length=1, max_length=255)
     description: str | None = None
     visibility: WorldVisibility = WorldVisibility.PUBLIC
+    category: str | None = None
+    tags: list[str] | None = None
 
 
 class WorldUpdate(BaseModel):
@@ -33,6 +36,8 @@ class WorldUpdate(BaseModel):
     name: str | None = Field(None, min_length=1, max_length=255)
     description: str | None = None
     visibility: WorldVisibility | None = None
+    category: str | None = None
+    tags: list[str] | None = None
 
 
 class WorldResponse(BaseModel):
@@ -41,12 +46,17 @@ class WorldResponse(BaseModel):
     name: str
     description: str | None
     visibility: WorldVisibility
+    category: str | None = None
+    tags: list[str] | None = None
+    play_count: int = 0
+    last_played_at: datetime | None = None
     owner_id: int
     created_at: datetime | None = None
 
     model_config = {"from_attributes": True}
 
 
+
 # --- Endpoints ---
 
 @router.get("/", response_model=list[WorldResponse])
@@ -147,14 +157,24 @@ async def create_world(
     current_user: CurrentUser,
     db: DbDep,
 ):
-    """Create a new world."""
+    """Create a new world.
+
+    Also creates the world's "main" room (world_persistence_impl.md §4.1) --
+    every world gets one so chunk content has somewhere to live from the
+    start.
+    """
     world = World(
         name=world_data.name,
         description=world_data.description,
         owner_id=current_user.id,
         visibility=world_data.visibility,
+        category=world_data.category,
+        tags=world_data.tags or [],
     )
+
     db.add(world)
+    await db.flush()  # assigns world.id, needed for the room's FK
+    await WorldStore(db).get_or_create_main_room(world.id)
     await db.commit()
     await db.refresh(world)
     return world

backend/app/services/chat_pubsub.py

@@ -0,0 +1,48 @@
+"""Pub/sub messaging bus for chat events over Redis.
+
+Provides asynchronous publish hooks for world/room chat and DMs, allowing the
+WebSocket real-time gateway (and multi-instance replicas) to receive and fan out
+chat messages in real time.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+from typing import Any
+
+import redis.asyncio as aioredis
+
+from app.config import settings
+
+logger = logging.getLogger(__name__)
+
+
+async def publish_world_chat_event(
+    world_id: int, payload: dict[str, Any], room_id: int | None = None
+) -> None:
+    """Publish a world chat message event to Redis pub/sub for real-time delivery."""
+    try:
+        client = aioredis.from_url(settings.REDIS_URL, encoding="utf-8", decode_responses=True)
+        async with client:
+            channel = f"world:{world_id}:chat"
+            data = json.dumps(payload, default=str)
+            await client.publish(channel, data)
+            if room_id is not None:
+                await client.publish(f"room:{room_id}:chat", data)
+    except Exception as exc:
+        logger.debug("Failed to publish world chat event to Redis: %s", exc)
+
+
+async def publish_dm_chat_event(
+    conversation_id: int, payload: dict[str, Any]
+) -> None:
+    """Publish a DM chat message event to Redis pub/sub for real-time delivery."""
+    try:
+        client = aioredis.from_url(settings.REDIS_URL, encoding="utf-8", decode_responses=True)
+        async with client:
+            channel = f"dm:{conversation_id}:chat"
+            data = json.dumps(payload, default=str)
+            await client.publish(channel, data)
+    except Exception as exc:
+        logger.debug("Failed to publish DM chat event to Redis: %s", exc)

backend/app/services/chunk_codec.py

@@ -0,0 +1,676 @@
+"""Python port of the chunk binary/JSON codec, `docs/architecture/world.md` §3.
+
+This is the server-side half of the "single shared format, two
+implementations" contract world.md §5.2 and
+`world_persistence_impl.md` §5.5/§9 call for. The Godot-side implementation
+is `scripts/chunk_data_decoder.gd`; this module must decode anything it
+produces and produce bytes it can decode.
+
+IMPORTANT DEVIATION (see the "Known cross-codec divergence" note at the
+bottom of this file): the current `scripts/chunk_data_decoder.gd` does not
+actually implement IEEE-754 float32 for the `pos`/`rot`/`scale`/`bounds`
+fields -- it performs a lossy numeric `int`/`float` cast instead of a bit
+reinterpretation, which both truncates fractional values and does not
+write IEEE-754 bits at all. This module implements the format as
+*specified* (real `<f` IEEE-754 float32, matching every other field in the
+spec and matching what any conformant decoder would assume). See the note
+for what this means for cross-codec byte parity today.
+
+Nothing here talks to a database or the FastAPI app; it is a pure,
+side-effect-free codec so it can be golden-file tested in isolation.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import struct
+from dataclasses import dataclass, field
+
+MAGIC = b"AGPC"
+HEADER_SIZE = 48
+CURRENT_VERSION = 1
+
+SECTION_META = 0x01
+SECTION_TILE = 0x02
+SECTION_OBJECT = 0x03
+SECTION_FLAGS = 0x04
+SECTION_REVISION_META = 0x05
+
+CATEGORY_FIELDS = (
+    "violence", "sexual", "language", "substance",
+    "gambling", "horror", "hate", "custom",
+)
+
+
+class ChunkCodecError(Exception):
+    """Malformed bytes -- the payload isn't shaped like a chunk at all."""
+
+
+class ChunkValidationError(Exception):
+    """A structurally-valid chunk failed a content/business-rule check.
+
+    ``reason`` is the machine-readable code the API surface (world_persistence_impl.md
+    §8.1) puts in the 422 response body's ``reason`` field, e.g.
+    ``"checksum_mismatch"``, ``"layer_dims"``, ``"object_out_of_bounds"``.
+    """
+
+    def __init__(self, reason: str, message: str | None = None) -> None:
+        self.reason = reason
+        super().__init__(message or reason)
+
+
+# ───────────────────────── Logical model ─────────────────────────
+
+@dataclass
+class TileDef:
+    id: int
+    asset_id: str = ""
+    solid: bool = False
+    flags: int = 0
+    variants: int = 1
+
+
+@dataclass
+class TileLayer:
+    name: str
+    layer_id: int = 0
+    width: int = 0
+    height: int = 0
+    depth: int = 1
+    palette: list[TileDef] = field(default_factory=list)
+    tiles: list[int] = field(default_factory=list)  # flattened, row-major
+
+
+@dataclass
+class ContentFlags:
+    violence: int = 0
+    sexual: int = 0
+    language: int = 0
+    substance: int = 0
+    gambling: int = 0
+    horror: int = 0
+    hate: int = 0
+    custom: int = 0
+    mature: bool = False
+    sources: list[str] = field(default_factory=list)
+
+    def to_dict(self) -> dict:
+        return {
+            "categories": {name: getattr(self, name) for name in CATEGORY_FIELDS},
+            "mature": self.mature,
+            "sources": list(self.sources),
+        }
+
+    @classmethod
+    def from_dict(cls, d: dict) -> "ContentFlags":
+        cats = d.get("categories", {})
+        return cls(
+            **{name: int(cats.get(name, 0)) for name in CATEGORY_FIELDS},
+            mature=bool(d.get("mature", False)),
+            sources=list(d.get("sources", [])),
+        )
+
+
+@dataclass
+class WorldObject:
+    id: str
+    type: str
+    asset_id: str
+    pos: tuple[float, float, float] = (0.0, 0.0, 0.0)
+    rot: tuple[float, float, float, float] = (0.0, 0.0, 0.0, 1.0)
+    scale: tuple[float, float, float] = (1.0, 1.0, 1.0)
+    dynamic: bool = False
+    properties: dict = field(default_factory=dict)
+    flags: ContentFlags = field(default_factory=ContentFlags)
+
+
+@dataclass
+class ChunkBounds:
+    """Stored here as min-corner + size (matching the Godot client's AABB
+    type) for convenience, but the §3.6 BINARY wire format is min + max
+    (world.md §3.1, and the client's actual ChunkDataDecoder) -- fixed
+    2026-09-14 after a real client/server interop test caught this class's
+    original binary codec writing min+size on the wire, which the client
+    decoder (unaware of the "size" convention) read as a second min/max
+    pair, corrupting every chunk's bounds. The two representations are
+    fully recoverable from each other; `max` below is computed for exactly
+    this reason."""
+
+    min: tuple[float, float, float] = (0.0, 0.0, 0.0)
+    size: tuple[float, float, float] = (0.0, 0.0, 0.0)
+
+    @property
+    def max(self) -> tuple[float, float, float]:
+        return tuple(a + b for a, b in zip(self.min, self.size))
+
+
+@dataclass
+class ChunkPayload:
+    version: int = CURRENT_VERSION
+    world_id: str = ""
+    room_id: str = ""
+    coord: tuple[int, int, int] = (0, 0, 0)
+    bounds: ChunkBounds = field(default_factory=ChunkBounds)
+    tile_layers: list[TileLayer] = field(default_factory=list)
+    objects: list[WorldObject] = field(default_factory=list)
+    flags: ContentFlags = field(default_factory=ContentFlags)
+    created_at: int = 0
+    updated_at: int = 0
+    revision: int = 0
+    author: str = ""
+
+
+def build_key(world_id: str | int, room_slug: str, cx: int, cy: int, cz: int) -> str:
+    """world_persistence_impl.md §4.5: ``"{world.id}:{room.slug}:{cx}:{cy}:{cz}"``."""
+    return f"{world_id}:{room_slug}:{cx}:{cy}:{cz}"
+
+
+# ───────────────────────── Binary primitives ─────────────────────────
+# All integers little-endian, matching world.md §3.6.3. Floats are packed
+# as real IEEE-754 float32 -- see the module docstring's deviation note.
+
+def _read_u16(data: bytes, off: int) -> int:
+    return struct.unpack_from("<H", data, off)[0]
+
+
+def _read_u32(data: bytes, off: int) -> int:
+    return struct.unpack_from("<I", data, off)[0]
+
+
+def _read_i32(data: bytes, off: int) -> int:
+    return struct.unpack_from("<i", data, off)[0]
+
+
+def _read_i64(data: bytes, off: int) -> int:
+    return struct.unpack_from("<q", data, off)[0]
+
+
+def _read_f32(data: bytes, off: int) -> float:
+    return struct.unpack_from("<f", data, off)[0]
+
+
+def _w_u16(v: int) -> bytes:
+    return struct.pack("<H", v & 0xFFFF)
+
+
+def _w_u32(v: int) -> bytes:
+    return struct.pack("<I", v & 0xFFFFFFFF)
+
+
+def _w_i32(v: int) -> bytes:
+    return struct.pack("<i", v)
+
+
+def _w_i64(v: int) -> bytes:
+    return struct.pack("<q", v)
+
+
+def _w_f32(v: float) -> bytes:
+    return struct.pack("<f", v)
+
+
+def _read_str(data: bytes, off: int) -> tuple[str, int]:
+    """Length-prefixed UTF-8 string. Returns (value, next_offset)."""
+    n = _read_u16(data, off)
+    off += 2
+    s = data[off:off + n].decode("utf-8")
+    return s, off + n
+
+
+def _w_str(s: str) -> bytes:
+    b = s.encode("utf-8")
+    if len(b) > 0xFFFF:
+        raise ChunkCodecError(f"string field too long to encode ({len(b)} bytes)")
+    return _w_u16(len(b)) + b
+
+
+def checksum(payload_body: bytes) -> str:
+    """SHA-256 hex digest of the payload body (world.md §3.6.3)."""
+    return hashlib.sha256(payload_body).hexdigest()
+
+
+# ───────────────────────── Section codecs ─────────────────────────
+
+def _encode_metadata(payload: ChunkPayload) -> bytes:
+    out = bytearray()
+    out += _w_str(payload.world_id)
+    out += _w_str(payload.room_id)
+    out += _w_i32(payload.coord[0])
+    out += _w_i32(payload.coord[1])
+    out += _w_i32(payload.coord[2])
+    out += _w_f32(payload.bounds.min[0])
+    out += _w_f32(payload.bounds.min[1])
+    out += _w_f32(payload.bounds.min[2])
+    out += _w_f32(payload.bounds.max[0])
+    out += _w_f32(payload.bounds.max[1])
+    out += _w_f32(payload.bounds.max[2])
+    return bytes(out)
+
+
+def _decode_metadata(data: bytes, result: ChunkPayload) -> None:
+    off = 0
+    result.world_id, off = _read_str(data, off)
+    result.room_id, off = _read_str(data, off)
+    coord = (_read_i32(data, off), _read_i32(data, off + 4), _read_i32(data, off + 8))
+    off += 12
+    min_pos = (_read_f32(data, off), _read_f32(data, off + 4), _read_f32(data, off + 8))
+    max_pos = (_read_f32(data, off + 12), _read_f32(data, off + 16), _read_f32(data, off + 20))
+    size = tuple(a - b for a, b in zip(max_pos, min_pos))
+    result.coord = coord
+    result.bounds = ChunkBounds(min=min_pos, size=size)
+
+
+def _encode_tile_layer(layer: TileLayer) -> bytes:
+    out = bytearray()
+    out += _w_str(layer.name)
+    out += _w_u16(layer.layer_id)
+    out += _w_u16(layer.width)
+    out += _w_u16(layer.height)
+    out += _w_u16(layer.depth)
+    out += _w_u16(len(layer.palette))
+    for td in layer.palette:
+        out += _w_u16(td.id)
+        out += _w_str(td.asset_id)
+        out += bytes([1 if td.solid else 0])
+        out += _w_u32(td.flags)
+        out += bytes([td.variants & 0xFF])
+    out += _w_u32(len(layer.tiles))
+    for tile_id in layer.tiles:
+        out += _w_u16(tile_id)
+    return bytes(out)
+
+
+def _decode_tile_layer(data: bytes) -> TileLayer:
+    off = 0
+    name, off = _read_str(data, off)
+    layer_id = _read_u16(data, off); off += 2
+    width = _read_u16(data, off); off += 2
+    height = _read_u16(data, off); off += 2
+    depth = _read_u16(data, off); off += 2
+    palette_count = _read_u16(data, off); off += 2
+    palette: list[TileDef] = []
+    for _ in range(palette_count):
+        tid = _read_u16(data, off); off += 2
+        asset_id, off = _read_str(data, off)
+        solid = data[off] != 0; off += 1
+        flags = _read_u32(data, off); off += 4
+        variants = data[off]; off += 1
+        palette.append(TileDef(id=tid, asset_id=asset_id, solid=solid, flags=flags, variants=variants))
+    tile_count = _read_u32(data, off); off += 4
+    tiles: list[int] = []
+    for _ in range(tile_count):
+        tiles.append(_read_u16(data, off))
+        off += 2
+    return TileLayer(name=name, layer_id=layer_id, width=width, height=height,
+                      depth=depth, palette=palette, tiles=tiles)
+
+
+def _encode_flags(flags: ContentFlags) -> bytes:
+    out = bytearray()
+    for name in CATEGORY_FIELDS:
+        out.append(getattr(flags, name) & 0xFF)
+    out.append(1 if flags.mature else 0)
+    out += _w_u16(len(flags.sources))
+    for src in flags.sources:
+        out += _w_str(src)
+    return bytes(out)
+
+
+def _decode_flags(data: bytes) -> ContentFlags:
+    off = 0
+    values = {}
+    for name in CATEGORY_FIELDS:
+        values[name] = data[off]
+        off += 1
+    mature = data[off] != 0
+    off += 1
+    source_count = _read_u16(data, off)
+    off += 2
+    sources = []
+    for _ in range(source_count):
+        s, off = _read_str(data, off)
+        sources.append(s)
+    return ContentFlags(**values, mature=mature, sources=sources)
+
+
+def _encode_object(obj: WorldObject) -> bytes:
+    out = bytearray()
+    out += _w_str(obj.id)
+    out += _w_str(obj.type)
+    out += _w_str(obj.asset_id)
+    for v in obj.pos:
+        out += _w_f32(v)
+    for v in obj.rot:
+        out += _w_f32(v)
+    for v in obj.scale:
+        out += _w_f32(v)
+    out.append(1 if obj.dynamic else 0)
+    # Canonical JSON: keys sorted lexicographically (world.md §3.6.3).
+    props_json = json.dumps(obj.properties, sort_keys=True, separators=(",", ":"))
+    out += _w_str(props_json)
+    out += _encode_flags(obj.flags)
+    return bytes(out)
+
+
+def _decode_object(data: bytes) -> WorldObject:
+    off = 0
+    oid, off = _read_str(data, off)
+    otype, off = _read_str(data, off)
+    asset_id, off = _read_str(data, off)
+    pos = (_read_f32(data, off), _read_f32(data, off + 4), _read_f32(data, off + 8))
+    off += 12
+    rot = (
+        _read_f32(data, off), _read_f32(data, off + 4),
+        _read_f32(data, off + 8), _read_f32(data, off + 12),
+    )
+    off += 16
+    scale = (_read_f32(data, off), _read_f32(data, off + 4), _read_f32(data, off + 8))
+    off += 12
+    dynamic = data[off] != 0
+    off += 1
+    props_str, off = _read_str(data, off)
+    try:
+        properties = json.loads(props_str) if props_str else {}
+    except json.JSONDecodeError as exc:
+        raise ChunkCodecError(f"object {oid!r}: invalid properties JSON") from exc
+    obj_flags = _decode_flags(data[off:])
+    return WorldObject(id=oid, type=otype, asset_id=asset_id, pos=pos, rot=rot,
+                        scale=scale, dynamic=dynamic, properties=properties, flags=obj_flags)
+
+
+def _encode_revision_meta(payload: ChunkPayload) -> bytes:
+    out = bytearray()
+    out += _w_i64(payload.created_at)
+    out += _w_i64(payload.updated_at)
+    out += _w_u32(payload.revision)
+    out += _w_str(payload.author)
+    return bytes(out)
+
+
+def _decode_revision_meta(data: bytes, result: ChunkPayload) -> None:
+    off = 0
+    result.created_at = _read_i64(data, off); off += 8
+    result.updated_at = _read_i64(data, off); off += 8
+    result.revision = _read_u32(data, off); off += 4
+    result.author, off = _read_str(data, off)
+
+
+def _wrap_section(section_id: int, data: bytes) -> bytes:
+    return bytes([section_id]) + _w_u32(len(data)) + data
+
+
+# ───────────────────────── Top-level encode/decode ─────────────────────────
+
+def encode_binary(payload: ChunkPayload) -> bytes:
+    """Encode a ChunkPayload to the world.md §3.6 wire format."""
+    sections = bytearray()
+    sections += _wrap_section(SECTION_META, _encode_metadata(payload))
+    for layer in payload.tile_layers:
+        sections += _wrap_section(SECTION_TILE, _encode_tile_layer(layer))
+    for obj in payload.objects:
+        sections += _wrap_section(SECTION_OBJECT, _encode_object(obj))
+    sections += _wrap_section(SECTION_FLAGS, _encode_flags(payload.flags))
+    sections += _wrap_section(SECTION_REVISION_META, _encode_revision_meta(payload))
+
+    payload_body = bytes(sections)
+    digest = hashlib.sha256(payload_body).digest()  # 32 raw bytes
+
+    header = bytearray()
+    header += MAGIC
+    header += _w_u16(CURRENT_VERSION)
+    header += _w_u16(HEADER_SIZE - 8)  # header_len: bytes of header after this field (spec-correct)
+    header += _w_u32(0)  # flags (reserved)
+    header += _w_u32(len(payload_body))
+    header += digest
+
+    return bytes(header) + payload_body
+
+
+def decode_binary(data: bytes) -> ChunkPayload:
+    """Decode a world.md §3.6 binary chunk. Raises ChunkCodecError on
+    structurally malformed input (short buffer, bad magic, unsupported
+    version, truncated payload)."""
+    if len(data) < HEADER_SIZE:
+        raise ChunkCodecError(f"data too short for header ({len(data)} bytes)")
+
+    if data[0:4] != MAGIC:
+        raise ChunkCodecError("bad magic bytes")
+
+    version = _read_u16(data, 4)
+    if version < 1 or version > CURRENT_VERSION:
+        raise ChunkCodecError(f"unsupported chunk format version {version}")
+
+    # header_len (offset 6) is intentionally not used for offset math --
+    # both this decoder and the Godot one always slice at the fixed
+    # HEADER_SIZE, matching the reference implementation's actual (if
+    # spec-inconsistent) behaviour.
+    payload_len = _read_u32(data, 12)
+    # bytes 16:48 are the header's advisory checksum -- decode_and_validate
+    # re-reads it directly and recomputes against the parsed payload body.
+
+    if len(data) - HEADER_SIZE != payload_len:
+        raise ChunkCodecError(
+            f"declared payload_len ({payload_len}) does not match actual "
+            f"remaining bytes ({len(data) - HEADER_SIZE})"
+        )
+
+    payload_body = data[HEADER_SIZE:HEADER_SIZE + payload_len]
+
+    result = ChunkPayload(version=version)
+
+    offset = 0
+    while offset < len(payload_body):
+        if offset + 5 > len(payload_body):
+            raise ChunkCodecError("truncated section header")
+        section_id = payload_body[offset]
+        section_len = _read_u32(payload_body, offset + 1)
+        data_start = offset + 5
+        data_end = data_start + section_len
+        if data_end > len(payload_body):
+            raise ChunkCodecError("truncated section body")
+        section_data = payload_body[data_start:data_end]
+
+        if section_id == SECTION_META:
+            _decode_metadata(section_data, result)
+        elif section_id == SECTION_TILE:
+            result.tile_layers.append(_decode_tile_layer(section_data))
+        elif section_id == SECTION_OBJECT:
+            result.objects.append(_decode_object(section_data))
+        elif section_id == SECTION_FLAGS:
+            result.flags = _decode_flags(section_data)
+        elif section_id == SECTION_REVISION_META:
+            _decode_revision_meta(section_data, result)
+        # Unknown section ids are skipped (forward-compat), matching the
+        # Godot decoder's match-with-no-default behaviour.
+
+        offset = data_end
+
+    return result
+
+
+# ───────────────────────── JSON encoding (world.md §3.5) ─────────────────────────
+# Derived, never stored (world_persistence_impl.md §8.1) -- produced here
+# from a decoded ChunkPayload for the ``Accept: application/json`` path.
+
+def to_json_dict(payload: ChunkPayload, *, key: str, chunk_checksum: str) -> dict:
+    return {
+        "version": payload.version,
+        "key": key,
+        "world_id": payload.world_id,
+        "room_id": payload.room_id,
+        "coord": {"cx": payload.coord[0], "cy": payload.coord[1], "cz": payload.coord[2]},
+        "bounds": {
+            "min_x": payload.bounds.min[0], "min_y": payload.bounds.min[1], "min_z": payload.bounds.min[2],
+            "max_x": payload.bounds.max[0], "max_y": payload.bounds.max[1], "max_z": payload.bounds.max[2],
+        },
+        "tiles": [
+            {
+                "name": layer.name,
+                "layer_id": layer.layer_id,
+                "width": layer.width,
+                "height": layer.height,
+                "depth": layer.depth,
+                "palette": [
+                    {"id": td.id, "asset_id": td.asset_id, "solid": td.solid,
+                     "flags": td.flags, "variants": td.variants}
+                    for td in layer.palette
+                ],
+                "tiles": list(layer.tiles),
+            }
+            for layer in payload.tile_layers
+        ],
+        "objects": [
+            {
+                "id": obj.id, "type": obj.type, "asset_id": obj.asset_id,
+                "transform": {
+                    "pos": list(obj.pos), "rot": list(obj.rot), "scale": list(obj.scale),
+                },
+                "properties": obj.properties,
+                "dynamic": obj.dynamic,
+                "flags": obj.flags.to_dict(),
+            }
+            for obj in payload.objects
+        ],
+        "flags": payload.flags.to_dict(),
+        "meta": {
+            "created_at": payload.created_at, "updated_at": payload.updated_at,
+            "revision": payload.revision, "author": payload.author,
+        },
+        "checksum": chunk_checksum,
+    }
+
+
+# ───────────────────────── Validation (world_persistence_impl.md §5.5) ─────────────────────────
+
+# Not precisely quantified by the design doc beyond "length limits" --
+# these are this implementation's conservative defaults (world.md §7).
+MAX_STRING_FIELD_LEN = 256
+MAX_PROPERTIES_JSON_LEN = 16_384
+MAX_SOURCES_PER_FLAGSET = 32
+
+
+def _check_string_lengths(obj: WorldObject) -> None:
+    for field_name, value in (("id", obj.id), ("type", obj.type), ("asset_id", obj.asset_id)):
+        if len(value) > MAX_STRING_FIELD_LEN:
+            raise ChunkValidationError(
+                "string_field_too_long", f"object.{field_name} exceeds {MAX_STRING_FIELD_LEN} chars"
+            )
+    props_json = json.dumps(obj.properties)
+    if len(props_json) > MAX_PROPERTIES_JSON_LEN:
+        raise ChunkValidationError(
+            "string_field_too_long", f"object {obj.id!r} properties exceed {MAX_PROPERTIES_JSON_LEN} bytes"
+        )
+    if len(obj.flags.sources) > MAX_SOURCES_PER_FLAGSET:
+        raise ChunkValidationError("string_field_too_long", f"object {obj.id!r} has too many flag sources")
+
+
+def decode_and_validate(
+    data: bytes,
+    *,
+    expected_key: str,
+    grid_size: tuple[int, int, int],
+    max_objects: int,
+) -> ChunkPayload:
+    """Decode + fully validate a client-submitted chunk payload.
+
+    This is the boundary world_persistence_impl.md §5.5 requires: "the
+    backend must not trust the client". Raises ``ChunkCodecError`` for
+    structurally malformed bytes (mapped to a 422 by the router with a
+    generic reason) or ``ChunkValidationError`` with a specific ``reason``
+    code for a well-formed-but-invalid payload.
+    """
+    payload = decode_binary(data)  # raises ChunkCodecError for structural problems first
+
+    # Checksum is advisory in the header (world.md §7); the value that
+    # matters is recomputed from the actual payload body we just parsed.
+    payload_body = data[HEADER_SIZE:]
+    recomputed = checksum(payload_body)
+    header_checksum_hex = data[16:48].hex()
+    if header_checksum_hex != recomputed:
+        raise ChunkValidationError(
+            "checksum_mismatch",
+            "header checksum does not match the recomputed SHA-256 of the payload body",
+        )
+
+    actual_key = build_key(payload.world_id, payload.room_id, *payload.coord)
+    if actual_key != expected_key:
+        raise ChunkValidationError(
+            "chunk_key_mismatch",
+            f"payload key {actual_key!r} does not match URL {expected_key!r}",
+        )
+
+    for layer in payload.tile_layers:
+        if (layer.width, layer.height, layer.depth) != tuple(grid_size):
+            raise ChunkValidationError(
+                "layer_dims",
+                f"tile layer {layer.name!r} dims {(layer.width, layer.height, layer.depth)} "
+                f"!= room grid {tuple(grid_size)}",
+            )
+        valid_ids = {0} | {td.id for td in layer.palette}
+        for tile_id in layer.tiles:
+            if tile_id not in valid_ids:
+                raise ChunkValidationError(
+                    "tile_out_of_palette",
+                    f"tile layer {layer.name!r} references palette id {tile_id} not in its palette",
+                )
+        if len(layer.tiles) != layer.width * layer.height * layer.depth:
+            raise ChunkValidationError(
+                "layer_dims",
+                f"tile layer {layer.name!r} has {len(layer.tiles)} cells, expected "
+                f"{layer.width * layer.height * layer.depth}",
+            )
+
+    if len(payload.objects) > max_objects:
+        raise ChunkValidationError(
+            "too_many_objects", f"{len(payload.objects)} objects exceeds max {max_objects}"
+        )
+
+    bmin, bmax = payload.bounds.min, payload.bounds.max
+    for obj in payload.objects:
+        _check_string_lengths(obj)
+        if not all(bmin[i] <= obj.pos[i] <= bmax[i] for i in range(3)):
+            raise ChunkValidationError(
+                "object_out_of_bounds",
+                f"object {obj.id!r} position {obj.pos} outside chunk bounds "
+                f"[{bmin}, {bmax}]",
+            )
+
+    if len(payload.author) > MAX_STRING_FIELD_LEN:
+        raise ChunkValidationError("string_field_too_long", "meta.author too long")
+
+    return payload
+
+
+# ───────────────────────── Known cross-codec divergence ─────────────────────────
+#
+# `scripts/chunk_data_decoder.gd`'s `_read_float32`/`_write_float32` do:
+#
+#     static func _write_float32(val: float) -> PackedByteArray:
+#         var bits := val as int
+#         return _write_uint32(bits)
+#
+#     static func _read_float32(data: PackedByteArray, offset: int) -> float:
+#         var bits := _read_uint32(data, offset)
+#         return bits as float
+#
+# `as` between int and float in GDScript is a numeric conversion, not a bit
+# reinterpretation (verified empirically against Godot 4.6.2 headless:
+# `1.5 as int` -> `1`, `1 as float` -> `1.0`; the IEEE-754 bit pattern of
+# 1.5f is 0x3FC00000 = 1069547520, not 1). So the shipped client codec
+# truncates every float32 field (bounds, object pos/rot/scale) to its
+# integer part and stores that integer as a raw int32 -- not as float32
+# bits at all. This is a real bug in already-merged, client-side code
+# (scripts/ is out of scope for this task) that breaks the "byte-stable
+# across two implementations" guarantee world.md §3.6.3 states.
+#
+# This module implements the *specified* format (real IEEE-754 float32)
+# rather than replicating that bug, because world.md §3.6 is normative and
+# says "float32" for these fields, and mirroring the bug would mean the
+# backend also corrupts every non-integer transform/bounds value it
+# stores. Practical effect until the client-side bug is fixed: payloads
+# with integer-only floats will decode identically on both sides; any
+# payload with a fractional position/rotation/scale/bounds value will not
+# be byte-identical (or numerically identical) between this module and the
+# current `scripts/chunk_data_decoder.gd`. This is flagged for the
+# client/editor follow-on task, not fixed here.

backend/app/services/game_servers.py

@@ -13,15 +13,26 @@ project are on the host (see ``settings.GODOT_BIN`` / ``GAME_PROJECT_DIR``);
 the backend spawns them as subprocesses.
 
 Design notes / limits (PC3):
- - All worlds currently load the same test level (per-world content is M2/M7).
-   ``world_id`` still scopes a distinct server process + session.
  - Port allocation is a linear scan of the configured range.
  - No crash-restart: if a server process dies, the next join respawns it.
+   With world content now durable in Postgres (world_persistence_impl.md
+   D2), this is genuinely safe rather than merely tolerated: the sim
+   process holds no unsaved world content, so a reap/crash/kill can never
+   lose world data.
+
+Per-spawn auth token (world_persistence_impl.md §7.3): each spawned server
+gets a random ``secrets.token_urlsafe(32)`` on its command line, which it
+uses as a Bearer token against ``/api/internal`` to pull its world's
+content read-only before binding its ENet port. The token grants access to
+exactly one world and dies with its process (the reaper's
+``del self._servers[wid]`` invalidates it; see ``validate_token``).
 """
 from __future__ import annotations
 
 import asyncio
+import hmac
 import json
+import secrets
 import socket
 import subprocess
 import tempfile
@@ -38,6 +49,7 @@ class _WorldServer:
     port: int
     proc: subprocess.Popen
     status_path: Path
+    token: str
     started_at: float = field(default_factory=time.time)
     last_join: float = field(default_factory=time.time)
 
@@ -50,6 +62,9 @@ class _WorldServer:
     def player_count(self) -> int:
         return int(self.status().get("players", 0))
 
+    def is_ready(self) -> bool:
+        return self.status().get("ready") is True
+
     def alive(self) -> bool:
         return self.proc.poll() is None
 
@@ -104,16 +119,35 @@ class GameServerSupervisor:
             if srv is None:
                 srv = self._spawn(world_id)
                 self._servers[world_id] = srv
-                # Give the engine a moment to bind the ENet port before we
+                try:
-                # hand the address to a client.
+                    await self._await_ready(srv)
-                await self._await_port(srv.port)
+                except TimeoutError:
+                    # Real failure now, not a silent "hope it's fine" --
+                    # see _await_ready's docstring. Don't leave a possibly
+                    # half-started process registered.
+                    srv.stop()
+                    del self._servers[world_id]
+                    raise RuntimeError(
+                        f"dedicated server for world {world_id} did not become ready in time"
+                    )
 
             srv.last_join = time.time()
             return {"host": settings.GAME_SERVER_HOST, "port": srv.port, "world_id": world_id}
 
+    def validate_token(self, world_id: str, token: str) -> bool:
+        """`require_game_server` dependency support (world_persistence_impl.md
+        §7.3): true iff *token* is the live token for *world_id*'s server.
+        A dict lookup, as the doc specifies, plus a constant-time compare
+        since it's a bearer credential."""
+        srv = self._servers.get(str(world_id))
+        if srv is None or not srv.alive():
+            return False
+        return hmac.compare_digest(srv.token, token)
+
     # ── internals ────────────────────────────────────────────────────────
     def _spawn(self, world_id: str) -> _WorldServer:
         port = self._free_port()
+        token = secrets.token_urlsafe(32)
         status_path = self._runtime_dir / f"world_{world_id}_{port}.json"
         status_path.unlink(missing_ok=True)
         cmd = [
@@ -123,9 +157,13 @@ class GameServerSupervisor:
             "--port", str(port),
             "--world", str(world_id),
             "--status-file", str(status_path),
+            "--api-url", settings.GAME_SERVER_INTERNAL_API_URL,
+            "--server-token", token,
         ]
         proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-        return _WorldServer(world_id=world_id, port=port, proc=proc, status_path=status_path)
+        return _WorldServer(
+            world_id=world_id, port=port, proc=proc, status_path=status_path, token=token
+        )
 
     def _free_port(self) -> int:
         used = {s.port for s in self._servers.values()}
@@ -140,16 +178,35 @@ class GameServerSupervisor:
                     continue
         raise RuntimeError("no free game-server port in the configured range")
 
-    async def _await_port(self, port: int, timeout: float = 8.0) -> None:
+    async def _await_ready(self, srv: _WorldServer) -> None:
-        deadline = time.time() + timeout
+        """Wait for a ``"ready": true`` field in the status file
+        (world_persistence_impl.md §7.4).
+
+        This replaces the old ``_await_port``, which had two real bugs:
+        it treated a bound UDP port as "ready", but with content loading
+        the port binds *before* the server has fetched its world's rooms
+        and chunks (world_persistence_impl.md §7.2 step 4) -- so a client
+        could get handed an address for a server still mid-fetch. And it
+        *failed open*: past its 8s deadline it simply returned, with no
+        error, so ``ensure_server`` reported success for a server that may
+        never have started at all. This raises ``TimeoutError`` instead,
+        which ``ensure_server`` turns into a real 503 for the joining
+        client, and also bails out early (same exception) if the process
+        has already exited.
+        """
+        deadline = time.time() + settings.GAME_SERVER_READY_TIMEOUT_SECONDS
         while time.time() < deadline:
-            # ENet is UDP; a bind failure means something (our server) has it.
+            if srv.is_ready():
-            with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as s:
+                return
-                try:
+            if not srv.alive():
-                    s.bind(("0.0.0.0", port))
+                raise TimeoutError(
-                except OSError:
+                    f"server process for world {srv.world_id} exited before becoming ready"
-                    return
+                )
             await asyncio.sleep(0.25)
+        raise TimeoutError(
+            f"server for world {srv.world_id} did not report ready within "
+            f"{settings.GAME_SERVER_READY_TIMEOUT_SECONDS}s"
+        )
 
     async def _reap_loop(self) -> None:
         try:

backend/app/services/payment.py

@@ -0,0 +1,89 @@
+"""PaymentProvider interface and NoopPaymentProvider implementation.
+
+docs/planning/economy.md US-2 (task 575fd14b5360).
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Protocol
+import uuid
+
+ALLOWED_CREDIT_PACKS: set[int] = {100, 500, 1000, 5000}
+
+
+@dataclass
+class PurchaseSession:
+    session_id: str
+    user_id: int
+    credits: int
+    provider_ref: str
+    status: str = "created"  # created, confirmed, failed
+    created_at: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
+
+
+@dataclass
+class Confirmation:
+    confirmed: bool
+    provider_ref: str
+    credits: int
+    user_id: int
+
+
+class PaymentProvider(Protocol):
+    """Pluggable payment provider protocol (e.g. Stripe, PayPal, Noop)."""
+
+    async def create_purchase(
+        self, user_id: int, credits: int, idempotency_key: str | None = None
+    ) -> PurchaseSession:
+        ...
+
+    async def confirm(self, session_id: str) -> Confirmation:
+        ...
+
+
+class NoopPaymentProvider:
+    """Deterministic, no-op payment provider for local development and testing.
+
+    Returns confirmed=True with a simulated provider reference. Clearly non-production.
+    """
+
+    def __init__(self) -> None:
+        self._sessions: dict[str, PurchaseSession] = {}
+
+    async def create_purchase(
+        self, user_id: int, credits: int, idempotency_key: str | None = None
+    ) -> PurchaseSession:
+        session_id = f"sess_{uuid.uuid4().hex[:16]}"
+        provider_ref = f"noop_tx_{uuid.uuid4().hex[:12]}"
+        sess = PurchaseSession(
+            session_id=session_id,
+            user_id=user_id,
+            credits=credits,
+            provider_ref=provider_ref,
+            status="created",
+        )
+        self._sessions[session_id] = sess
+        return sess
+
+    async def confirm(self, session_id: str) -> Confirmation:
+        sess = self._sessions.get(session_id)
+        if sess is None:
+            return Confirmation(
+                confirmed=False,
+                provider_ref="",
+                credits=0,
+                user_id=0,
+            )
+
+        sess.status = "confirmed"
+        return Confirmation(
+            confirmed=True,
+            provider_ref=sess.provider_ref,
+            credits=sess.credits,
+            user_id=sess.user_id,
+        )
+
+
+payment_provider: PaymentProvider = NoopPaymentProvider()

backend/app/services/payout.py

@@ -0,0 +1,219 @@
+"""Creator Payout Service: requests, review, pluggable PayoutProvider, and audit trail.
+
+docs/planning/economy.md US-5 (tasks f5b4684f2e65, b52008923e93).
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timezone
+import logging
+from typing import Protocol
+import uuid
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.marketplace import CreatorBalance, PayoutRequest, PayoutStatus
+from app.models.wallet import Transaction, TransactionType
+from app.services.purchase import PurchaseService
+from app.services.wallet import WalletService
+
+logger = logging.getLogger(__name__)
+
+MIN_PAYOUT_AMOUNT = 100
+MAX_PAYOUT_AMOUNT = 100_000
+LARGE_PAYOUT_THRESHOLD = 5000
+
+
+class InsufficientCreatorBalanceError(Exception):
+    """Raised when creator available balance is less than requested payout amount."""
+    pass
+
+
+class InvalidPayoutAmountError(ValueError):
+    """Raised when requested payout amount is out of valid bounds."""
+    pass
+
+
+class PayoutNotFoundError(Exception):
+    """Raised when payout request is not found."""
+    pass
+
+
+class InvalidPayoutStateError(Exception):
+    """Raised when payout request is in invalid status for the requested transition."""
+    pass
+
+
+class PayoutProvider(Protocol):
+    """Pluggable creator payout provider protocol (e.g. Stripe Connect, PayPal, Noop)."""
+
+    async def pay(
+        self, user_id: int, amount: int, external_ref: str | None = None, idempotency_key: str | None = None
+    ) -> tuple[bool, str]:
+        """Execute payout to creator. Returns (success, provider_ref)."""
+        ...
+
+
+class NoopPayoutProvider:
+    """Deterministic no-op provider for development and testing."""
+
+    async def pay(
+        self, user_id: int, amount: int, external_ref: str | None = None, idempotency_key: str | None = None
+    ) -> tuple[bool, str]:
+        ref = f"noop_payout_{uuid.uuid4().hex[:12]}"
+        logger.info(
+            f"[NoopPayoutProvider] Simulated payout of {amount} CR to user {user_id} (ref={ref})"
+        )
+        return True, ref
+
+
+default_payout_provider: PayoutProvider = NoopPayoutProvider()
+
+
+class PayoutService:
+    def __init__(self, provider: PayoutProvider | None = None):
+        self.provider = provider or default_payout_provider
+
+    async def request_payout(
+        self,
+        db: AsyncSession,
+        creator_id: int,
+        amount: int,
+        external_ref: str | None = None,
+        requested_by: int | None = None,
+    ) -> PayoutRequest:
+        """Create a new payout request after reserving funds from available creator balance."""
+        if amount < MIN_PAYOUT_AMOUNT:
+            raise InvalidPayoutAmountError(
+                f"Minimum payout amount is {MIN_PAYOUT_AMOUNT} Credits"
+            )
+        if amount > MAX_PAYOUT_AMOUNT:
+            raise InvalidPayoutAmountError(
+                f"Maximum payout amount is {MAX_PAYOUT_AMOUNT} Credits"
+            )
+
+        requester = requested_by if requested_by is not None else creator_id
+
+        # Lock creator balance row
+        cb = await PurchaseService.get_or_create_creator_balance(db, creator_id, for_update=True)
+        if cb.available < amount:
+            raise InsufficientCreatorBalanceError(
+                f"Insufficient available balance: {cb.available} CR available, {amount} CR requested"
+            )
+
+        # Reserve funds: move from available to pending
+        cb.available -= amount
+        cb.pending += amount
+        cb.updated_at = datetime.now(timezone.utc)
+
+        payout = PayoutRequest(
+            creator_id=creator_id,
+            amount=amount,
+            status=PayoutStatus.pending,
+            external_ref=external_ref,
+            requested_by=requester,
+        )
+        db.add(payout)
+        await db.commit()
+        await db.refresh(payout)
+        return payout
+
+    async def approve_and_pay(
+        self,
+        db: AsyncSession,
+        payout_id: int,
+        reviewer_id: int,
+        provider: PayoutProvider | None = None,
+    ) -> PayoutRequest:
+        """Admin approves and executes payout via provider."""
+        stmt = select(PayoutRequest).where(PayoutRequest.id == payout_id).with_for_update()
+        res = await db.execute(stmt)
+        payout = res.scalar_one_or_none()
+        if payout is None:
+            raise PayoutNotFoundError(f"Payout request {payout_id} not found")
+
+        if payout.status != PayoutStatus.pending:
+            raise InvalidPayoutStateError(
+                f"Cannot approve payout in status {payout.status.value}"
+            )
+
+        active_provider = provider or self.provider
+        success, provider_ref = await active_provider.pay(
+            user_id=payout.creator_id,
+            amount=payout.amount,
+            external_ref=payout.external_ref,
+            idempotency_key=f"payout-{payout.id}",
+        )
+
+        if not success:
+            raise RuntimeError("Payout provider rejected transaction")
+
+        now = datetime.now(timezone.utc)
+        cb = await PurchaseService.get_or_create_creator_balance(db, payout.creator_id, for_update=True)
+        cb.pending = max(0, cb.pending - payout.amount)
+        cb.updated_at = now
+
+        payout.status = PayoutStatus.paid
+        payout.provider_ref = provider_ref
+        payout.reviewed_by = reviewer_id
+        payout.reviewed_at = now
+
+        # Record immutable ledger audit row
+        wallet = await WalletService.get_or_create_wallet(db, payout.creator_id, for_update=True)
+        tx = Transaction(
+            wallet_id=wallet.id,
+            type=TransactionType.payout,
+            amount=-payout.amount,
+            balance_after=wallet.balance,
+            reference_type="payout_request",
+            reference_id=str(payout.id),
+            idempotency_key=f"payout-audit-{payout.id}",
+            metadata_json={
+                "provider_ref": provider_ref,
+                "reviewed_by": reviewer_id,
+                "external_ref": payout.external_ref,
+            },
+        )
+        db.add(tx)
+
+        await db.commit()
+        await db.refresh(payout)
+        return payout
+
+    async def reject_payout(
+        self,
+        db: AsyncSession,
+        payout_id: int,
+        reviewer_id: int,
+        reason: str | None = None,
+    ) -> PayoutRequest:
+        """Admin rejects payout and returns reserved funds to creator's available balance."""
+        stmt = select(PayoutRequest).where(PayoutRequest.id == payout_id).with_for_update()
+        res = await db.execute(stmt)
+        payout = res.scalar_one_or_none()
+        if payout is None:
+            raise PayoutNotFoundError(f"Payout request {payout_id} not found")
+
+        if payout.status != PayoutStatus.pending:
+            raise InvalidPayoutStateError(
+                f"Cannot reject payout in status {payout.status.value}"
+            )
+
+        now = datetime.now(timezone.utc)
+        cb = await PurchaseService.get_or_create_creator_balance(db, payout.creator_id, for_update=True)
+        cb.pending = max(0, cb.pending - payout.amount)
+        cb.available += payout.amount
+        cb.updated_at = now
+
+        payout.status = PayoutStatus.rejected
+        payout.reviewed_by = reviewer_id
+        payout.reviewed_at = now
+
+        await db.commit()
+        await db.refresh(payout)
+        return payout
+
+
+payout_service = PayoutService()

backend/app/services/presence.py

@@ -0,0 +1,150 @@
+"""Redis-backed presence store.
+
+Presence is determined by a heartbeat TTL key in Redis:
+- heartbeat(user_id) sets a TTL key per user (default 60 s).
+- is_online(user_id) / is_online_batch(user_ids) check whether the key(s)
+  exist.
+
+status_message and last_seen_at are persisted in the ``users`` table by the
+router (app/routers/presence.py); this store only owns the Redis side.
+
+The Redis client is created lazily, on first actual use, rather than
+requiring an explicit ``connect()`` call during app startup. This matters
+because FastAPI's lifespan handler does not run under the plain
+``TestClient(app)`` instantiation this codebase's tests use (no
+``with`` block), so anything that only connected during lifespan startup
+would never connect in tests. Lazy connection means the store works
+identically whether the app was started for real or is being driven by
+pytest.
+
+The client is also cached per-*event loop* rather than globally: the same
+plain ``TestClient(app)`` pattern can dispatch different requests onto
+different event loops (see the NullPool comment on ``_override_db`` in
+tests/conftest.py for the analogous asyncpg problem), and an
+``aioredis.Redis`` connection, like an asyncpg connection, breaks with
+"Event loop is closed" if reused across loops. In the real running server
+there is exactly one event loop for the process lifetime, so this
+degrades to a single cached, pooled connection there.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+
+import redis.asyncio as aioredis
+
+from app.config import settings
+
+logger = logging.getLogger(__name__)
+
+# Key prefix for heartbeat entries.
+_PRESENCE_KEY_PREFIX = "presence:heartbeat:"
+
+# Default heartbeat TTL in seconds (1 minute).
+# Clients should heartbeat at least once per interval.
+_DEFAULT_HEARTBEAT_TTL = 60
+
+
+class PresenceStore:
+    """Redis-backed presence store with async, lazily-connected operations."""
+
+    def __init__(self, redis_url: str | None = None, heartbeat_ttl: int = _DEFAULT_HEARTBEAT_TTL):
+        # redis_url is resolved from settings at first use (not at
+        # construction time) so tests that override settings.REDIS_URL
+        # before the first call still take effect -- this module is
+        # imported (and the module-level singleton below constructed)
+        # well before any such override runs.
+        self._redis_url = redis_url
+        self._heartbeat_ttl = heartbeat_ttl
+        # Keyed by id(running loop) -- see the module docstring.
+        self._clients: dict[int, aioredis.Redis] = {}
+        self._connect_lock = asyncio.Lock()
+
+    # ------------------------------------------------------------------
+    # Lifecycle
+    # ------------------------------------------------------------------
+
+    async def _ensure_client(self) -> aioredis.Redis:
+        """Return a connected client for the current event loop, connecting
+        on first use per loop."""
+        loop_key = id(asyncio.get_running_loop())
+        client = self._clients.get(loop_key)
+        if client is None:
+            async with self._connect_lock:
+                client = self._clients.get(loop_key)
+                if client is None:
+                    url = self._redis_url or settings.REDIS_URL
+                    client = aioredis.from_url(
+                        url,
+                        encoding="utf-8",
+                        decode_responses=True,
+                    )
+                    try:
+                        await client.ping()
+                    except Exception:
+                        logger.warning("Redis ping failed for %s", url)
+                        raise
+                    self._clients[loop_key] = client
+        return client
+
+    async def close(self) -> None:
+        """Close the Redis connection for the current event loop, if one was
+        opened."""
+        loop_key = id(asyncio.get_running_loop())
+        client = self._clients.pop(loop_key, None)
+        if client is not None:
+            await client.aclose()
+
+    # ------------------------------------------------------------------
+    # Heartbeat
+    # ------------------------------------------------------------------
+
+    async def heartbeat(self, user_id: int) -> None:
+        """Record a heartbeat for *user_id*.
+
+        Sets a TTL key so that the user is considered online as long as
+        heartbeats arrive at least once per heartbeat_ttl seconds.
+        """
+        client = await self._ensure_client()
+        await client.set(self._heartbeat_key(user_id), "1", ex=self._heartbeat_ttl)
+
+    async def clear_heartbeat(self, user_id: int) -> None:
+        """Clear heartbeat for *user_id* to mark them offline immediately."""
+        client = await self._ensure_client()
+        await client.delete(self._heartbeat_key(user_id))
+
+    # ------------------------------------------------------------------
+    # Online checks
+    # ------------------------------------------------------------------
+
+    async def is_online(self, user_id: int) -> bool:
+        """Return True if the user has a valid heartbeat key."""
+        client = await self._ensure_client()
+        exists = await client.exists(self._heartbeat_key(user_id))
+        return bool(exists)
+
+    async def is_online_batch(self, user_ids: list[int]) -> set[int]:
+        """Return the subset of user_ids that currently have a valid
+        heartbeat key. Uses MGET (one round trip) rather than one EXISTS
+        per user.
+        """
+        if not user_ids:
+            return set()
+        client = await self._ensure_client()
+        keys = [self._heartbeat_key(uid) for uid in user_ids]
+        values = await client.mget(keys)
+        return {uid for uid, v in zip(user_ids, values) if v is not None}
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    @staticmethod
+    def _heartbeat_key(user_id: int) -> str:
+        return f"{_PRESENCE_KEY_PREFIX}{user_id}"
+
+
+# Singleton instance shared by the router, so all requests share the same
+# connection pool.
+presence_store = PresenceStore()

backend/app/services/purchase.py

@@ -0,0 +1,323 @@
+"""Marketplace purchase service: atomic escrow, fee split, item granting, refunds.
+
+docs/planning/economy.md US-4 (task bc90d3f481b4).
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+import math
+from typing import Any
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.marketplace import (
+    CatalogItem,
+    CreatorBalance,
+    ListingStatus,
+    MarketplaceListing,
+    Purchase,
+    PurchaseStatus,
+)
+from app.models.wallet import TransactionType
+from app.services.wallet import InsufficientFundsError, WalletService
+
+
+MARKETPLACE_FEE_RATE = 0.30  # 30% platform fee
+DEFAULT_ESCROW_HOLD_HOURS = 72
+
+
+class ListingNotFoundError(Exception):
+    """Raised when the specified listing does not exist."""
+    pass
+
+
+class ListingNotAvailableError(Exception):
+    """Raised when the listing is not in active status."""
+    pass
+
+
+class SelfPurchaseError(Exception):
+    """Raised when a seller attempts to buy their own listing."""
+    pass
+
+
+class PurchaseNotFoundError(Exception):
+    """Raised when the specified purchase does not exist."""
+    pass
+
+
+class InvalidEscrowStateError(Exception):
+    """Raised when an operation cannot be performed on the current escrow state."""
+    pass
+
+
+class MatureContentRestrictedError(Exception):
+    """Raised when an unverified minor attempts to purchase mature content."""
+    pass
+
+
+def is_item_mature(item: CatalogItem) -> bool:
+    """Check whether a catalog item carries mature flags or is marked mature."""
+    if not item.metadata_json or not isinstance(item.metadata_json, dict):
+        return False
+    if item.metadata_json.get("is_mature") or item.metadata_json.get("mature"):
+        return True
+    flags = item.metadata_json.get("content_flags", [])
+    if isinstance(flags, list):
+        for f in flags:
+            if isinstance(f, dict) and f.get("mature"):
+                return True
+            if isinstance(f, str) and any(
+                m in f for m in ("gore", "sexual", "gambling", "hate", "explicit")
+            ):
+                return True
+    return False
+
+
+class PurchaseService:
+    @staticmethod
+    def compute_fee_split(price: int, fee_rate: float = MARKETPLACE_FEE_RATE) -> tuple[int, int]:
+        """Compute platform fee and seller net amount.
+
+        Returns (platform_fee, seller_net).
+        """
+        platform_fee = math.floor(price * fee_rate)
+        seller_net = price - platform_fee
+        return platform_fee, seller_net
+
+    @classmethod
+    async def get_or_create_creator_balance(
+        cls, db: AsyncSession, user_id: int, for_update: bool = False
+    ) -> CreatorBalance:
+        """Fetch or lazily create a creator balance row for user_id."""
+        stmt = select(CreatorBalance).where(CreatorBalance.user_id == user_id)
+        if for_update:
+            stmt = stmt.with_for_update()
+        result = await db.execute(stmt)
+        cb = result.scalar_one_or_none()
+        if cb is not None:
+            return cb
+
+        new_cb = CreatorBalance(
+            user_id=user_id,
+            available=0,
+            pending=0,
+            lifetime_earned=0,
+        )
+        db.add(new_cb)
+        await db.flush()
+        return new_cb
+
+    @classmethod
+    async def purchase_listing(
+        cls,
+        db: AsyncSession,
+        buyer_id: int,
+        listing_id: int,
+        buyer_is_adult: bool = True,
+        idempotency_key: str | None = None,
+        escrow_hours: int = DEFAULT_ESCROW_HOLD_HOURS,
+    ) -> tuple[Purchase, CatalogItem]:
+        """Perform atomic purchase of a marketplace listing.
+
+        Debits buyer, holds escrow, grants item to buyer, records purchase,
+        and updates creator pending balance.
+        """
+        # 1. Lock and validate listing
+        stmt_listing = (
+            select(MarketplaceListing)
+            .where(MarketplaceListing.id == listing_id)
+            .with_for_update()
+        )
+        res_listing = await db.execute(stmt_listing)
+        listing = res_listing.scalar_one_or_none()
+        if listing is None:
+            raise ListingNotFoundError(f"Listing {listing_id} not found")
+
+        if listing.status != ListingStatus.active:
+            raise ListingNotAvailableError(f"Listing {listing_id} is not active ({listing.status.value})")
+
+        if listing.seller_id == buyer_id:
+            raise SelfPurchaseError("Cannot purchase your own listing")
+
+        # 2. Fetch catalog item
+        catalog_item = await db.get(CatalogItem, listing.catalog_item_id)
+        if catalog_item is None:
+            raise ListingNotFoundError("Catalog item referenced by listing does not exist")
+
+        if is_item_mature(catalog_item) and not buyer_is_adult:
+            raise MatureContentRestrictedError(
+                "MATURE_CONTENT_REQUIRES_VERIFICATION: Buyer must be 18+ to purchase mature items"
+            )
+
+        # 3. Calculate fee split
+        price = listing.price
+        platform_fee, seller_net = cls.compute_fee_split(price)
+
+        # 4. Debit buyer wallet atomically (commit=False)
+        tx_idemp = f"mkt-purchase-{idempotency_key}" if idempotency_key else None
+        await WalletService.debit(
+            db=db,
+            user_id=buyer_id,
+            amount=price,
+            tx_type=TransactionType.marketplace_purchase,
+            reference_type="marketplace_listing",
+            reference_id=str(listing.id),
+            idempotency_key=tx_idemp,
+            commit=False,
+        )
+
+        # 5. Grant catalog item to buyer
+        granted_item = CatalogItem(
+            owner_id=buyer_id,
+            asset_id=catalog_item.asset_id,
+            item_type=catalog_item.item_type,
+            name=catalog_item.name,
+            description=catalog_item.description,
+            metadata_json=catalog_item.metadata_json,
+        )
+        db.add(granted_item)
+
+        # 6. Mark listing as sold
+        now = datetime.now(timezone.utc)
+        listing.status = ListingStatus.sold
+        listing.updated_at = now
+
+        # 7. Create purchase record
+        hold_until = now + timedelta(hours=escrow_hours)
+        purchase = Purchase(
+            listing_id=listing.id,
+            buyer_id=buyer_id,
+            seller_id=listing.seller_id,
+            price=price,
+            platform_fee=platform_fee,
+            seller_net=seller_net,
+            status=PurchaseStatus.pending_escrow,
+            escrow_hold_until=hold_until,
+        )
+        db.add(purchase)
+
+        # 8. Update seller's CreatorBalance (pending escrow)
+        creator_balance = await cls.get_or_create_creator_balance(
+            db, listing.seller_id, for_update=True
+        )
+        creator_balance.pending += seller_net
+        creator_balance.updated_at = now
+
+        # Commit everything atomically
+        await db.commit()
+        await db.refresh(purchase)
+        await db.refresh(granted_item)
+
+        return purchase, granted_item
+
+    @classmethod
+    async def release_escrow(cls, db: AsyncSession, purchase_id: int) -> Purchase:
+        """Release funds from escrow to seller's available creator balance."""
+        stmt = select(Purchase).where(Purchase.id == purchase_id).with_for_update()
+        res = await db.execute(stmt)
+        purchase = res.scalar_one_or_none()
+        if purchase is None:
+            raise PurchaseNotFoundError(f"Purchase {purchase_id} not found")
+
+        if purchase.status != PurchaseStatus.pending_escrow:
+            raise InvalidEscrowStateError(
+                f"Cannot release escrow in status {purchase.status.value}"
+            )
+
+        cb = await cls.get_or_create_creator_balance(db, purchase.seller_id, for_update=True)
+        cb.pending = max(0, cb.pending - purchase.seller_net)
+        cb.available += purchase.seller_net
+        cb.lifetime_earned += purchase.seller_net
+        cb.updated_at = datetime.now(timezone.utc)
+
+        purchase.status = PurchaseStatus.completed
+        await db.commit()
+        await db.refresh(purchase)
+        return purchase
+
+    @classmethod
+    async def refund_purchase(
+        cls, db: AsyncSession, purchase_id: int, reason: str | None = None
+    ) -> Purchase:
+        """Refund a purchase during the escrow hold window."""
+        stmt = select(Purchase).where(Purchase.id == purchase_id).with_for_update()
+        res = await db.execute(stmt)
+        purchase = res.scalar_one_or_none()
+        if purchase is None:
+            raise PurchaseNotFoundError(f"Purchase {purchase_id} not found")
+
+        if purchase.status != PurchaseStatus.pending_escrow:
+            raise InvalidEscrowStateError(
+                f"Cannot refund purchase in status {purchase.status.value}"
+            )
+
+        # Reverse seller's pending creator balance
+        cb = await cls.get_or_create_creator_balance(db, purchase.seller_id, for_update=True)
+        cb.pending = max(0, cb.pending - purchase.seller_net)
+        cb.updated_at = datetime.now(timezone.utc)
+
+        # Credit buyer wallet
+        await WalletService.credit(
+            db=db,
+            user_id=purchase.buyer_id,
+            amount=purchase.price,
+            tx_type=TransactionType.refund,
+            reference_type="purchase_refund",
+            reference_id=str(purchase.id),
+            metadata={"reason": reason} if reason else None,
+            commit=False,
+        )
+
+        purchase.status = PurchaseStatus.refunded
+        await db.commit()
+        await db.refresh(purchase)
+        return purchase
+
+    @classmethod
+    async def reverse_purchase(
+        cls,
+        db: AsyncSession,
+        purchase_id: int,
+        moderator_id: int,
+        reason: str,
+    ) -> Purchase:
+        """Moderator/admin audited reversal of purchase."""
+        stmt = select(Purchase).where(Purchase.id == purchase_id).with_for_update()
+        res = await db.execute(stmt)
+        purchase = res.scalar_one_or_none()
+        if purchase is None:
+            raise PurchaseNotFoundError(f"Purchase {purchase_id} not found")
+
+        if purchase.status in (PurchaseStatus.reversed, PurchaseStatus.refunded):
+            raise InvalidEscrowStateError(f"Purchase already {purchase.status.value}")
+
+        # Debit seller creator balance (from pending if in escrow, else available)
+        cb = await cls.get_or_create_creator_balance(db, purchase.seller_id, for_update=True)
+        if purchase.status == PurchaseStatus.pending_escrow:
+            cb.pending = max(0, cb.pending - purchase.seller_net)
+        else:
+            cb.available = max(0, cb.available - purchase.seller_net)
+        cb.updated_at = datetime.now(timezone.utc)
+
+        # Refund buyer wallet
+        await WalletService.credit(
+            db=db,
+            user_id=purchase.buyer_id,
+            amount=purchase.price,
+            tx_type=TransactionType.refund,
+            reference_type="purchase_reversal",
+            reference_id=str(purchase.id),
+            metadata={"moderator_id": moderator_id, "reason": reason},
+            commit=False,
+        )
+
+        purchase.status = PurchaseStatus.reversed
+        await db.commit()
+        await db.refresh(purchase)
+        return purchase
+
+
+purchase_service = PurchaseService()

backend/app/services/text_filter.py

@@ -0,0 +1,304 @@
+"""Pluggable server-side text filtering, `docs/planning/social.md` §4/§5 (US-4).
+
+social.md §4 calls for a "Pluggable `TextFilter` interface with a
+deterministic default (profanity list + normalization) so it runs without
+external services; third-party hook later". This module is that interface
+plus the default implementation:
+
+- `TextFilter` is a `Protocol` -- the extension point. A future third-party
+  moderation provider (a paid API, an ML classifier, etc.) just needs to
+  implement `check(text) -> FilterResult`; nothing else in this module
+  needs to change, and callers depend on the protocol, not a concrete
+  class.
+- `ListBasedTextFilter` is the deterministic default: a configurable
+  term list (JSON file, see `text_filter_terms.json` next to this module)
+  matched against a normalized form of the input text so that trivial
+  evasion (case changes, leetspeak substitutions, and punctuation/spacing
+  inserted between letters) doesn't slip through.
+
+Nothing here talks to a database, an HTTP client, or the FastAPI app -- it
+is a pure, side-effect-free (aside from reading the term list file once, at
+construction) service so it can be unit tested in isolation. It is NOT
+wired into any router/endpoint by this task; that's for the chat feature
+tasks that depend on it (social.md §6) to do.
+
+Normalization approach
+-----------------------
+Matching naively against raw text misses "sh1t", "@ss", or "s.h.i.t". To
+catch these without a real tokenizer, every character of the input is
+independently normalized to at most one lowercase ASCII alphanumeric
+character (case-folded, then run through a small leetspeak substitution
+table); characters that don't reduce to `[a-z0-9]` (punctuation, spacing,
+symbols, non-ASCII) are dropped entirely rather than kept as separators.
+This collapses "s.h.i.t", "s h i t", and "SHIT" to the same normalized
+string ("shit") that a plain lowercase term list entry matches, while a
+side table (`index_map`) remembers which original character produced each
+surviving normalized character -- so a match found in the normalized
+string can still be translated back into a span of the *original* text for
+redaction.
+
+This is a deliberate precision/recall tradeoff common to list-based
+filters: stripping separators and folding leetspeak increases recall
+against evasion at the cost of occasionally matching a term inside an
+unrelated longer word (e.g. a 3-letter term inside a longer benign word).
+That tradeoff is exactly why this is pluggable -- a deployment that needs
+tighter precision can swap in a smarter `TextFilter` implementation behind
+the same protocol.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+from enum import Enum
+from pathlib import Path
+from typing import Iterable, Protocol, runtime_checkable
+
+# ---------------------------------------------------------------------------
+# Public result / protocol
+# ---------------------------------------------------------------------------
+
+
+class FilterAction(str, Enum):
+    """What the caller should do with a checked message."""
+
+    ALLOW = "allow"
+    REDACT = "redact"
+    REJECT = "reject"
+
+
+@dataclass(frozen=True)
+class FilterResult:
+    """Outcome of running a piece of text through a `TextFilter`.
+
+    - `action`: ALLOW (no matches), REDACT (matches replaced in
+      `filtered_text`), or REJECT (matches found; the message should be
+      blocked -- callers should not persist/deliver it even though
+      `filtered_text` is populated for logging/audit purposes).
+    - `filtered_text`: the text to actually store/deliver. Equal to the
+      input for ALLOW and REJECT; has matched spans replaced for REDACT.
+    - `matched_terms`: the distinct matched terms (original, un-normalized
+      list entries), in first-occurrence order. Empty for ALLOW.
+    """
+
+    action: FilterAction
+    filtered_text: str
+    matched_terms: tuple[str, ...] = ()
+
+
+@runtime_checkable
+class TextFilter(Protocol):
+    """Extension point for text filtering/moderation providers.
+
+    Any implementation -- the deterministic default below, or a future
+    third-party service call -- just needs this one method.
+    """
+
+    def check(self, text: str) -> FilterResult:
+        """Check `text` and return the action to take plus filtered text."""
+        ...
+
+
+class FilterMode(str, Enum):
+    """Configures what `ListBasedTextFilter` does when it finds a match."""
+
+    REDACT = "redact"
+    REJECT = "reject"
+
+
+# ---------------------------------------------------------------------------
+# Normalization
+# ---------------------------------------------------------------------------
+
+# Common leetspeak / lookalike substitutions, applied after case-folding.
+# Keys are already-lowercased single characters.
+_LEET_MAP: dict[str, str] = {
+    "0": "o",
+    "1": "i",
+    "!": "i",
+    "3": "e",
+    "4": "a",
+    "@": "a",
+    "5": "s",
+    "$": "s",
+    "7": "t",
+    "+": "t",
+    "8": "b",
+    "|": "l",
+}
+
+_ALNUM_RE = re.compile(r"[a-z0-9]")
+
+
+def _normalize(text: str) -> tuple[str, list[int]]:
+    """Fold `text` to a lowercase-alnum-only string plus an index map.
+
+    Returns `(normalized, index_map)` where `index_map[i]` is the index
+    into the *original* `text` that produced `normalized[i]`. Characters
+    that don't reduce to a single `[a-z0-9]` character (punctuation,
+    whitespace, symbols, most non-ASCII) are dropped from both outputs.
+    """
+    normalized_chars: list[str] = []
+    index_map: list[int] = []
+    for i, ch in enumerate(text):
+        folded = ch.casefold()
+        # case-fold can expand to multiple characters for some unicode
+        # (e.g. German "ß" -> "ss"); such characters are not part of the
+        # leetspeak table and are not plain ascii alnum, so just skip them
+        # like any other non-matching character rather than guessing.
+        if len(folded) != 1:
+            continue
+        folded = _LEET_MAP.get(folded, folded)
+        if _ALNUM_RE.fullmatch(folded):
+            normalized_chars.append(folded)
+            index_map.append(i)
+    return "".join(normalized_chars), index_map
+
+
+def _normalize_term(term: str) -> str:
+    normalized, _ = _normalize(term)
+    return normalized
+
+
+# ---------------------------------------------------------------------------
+# Default term list loading
+# ---------------------------------------------------------------------------
+
+DEFAULT_TERMS_PATH = Path(__file__).with_name("text_filter_terms.json")
+
+
+def load_terms(path: Path | str | None = None) -> list[str]:
+    """Load a term list from a JSON file shaped `{"terms": [...]}`.
+
+    Any other top-level keys (e.g. `_readme`) are ignored. Defaults to the
+    bundled `text_filter_terms.json` next to this module.
+    """
+    resolved = Path(path) if path is not None else DEFAULT_TERMS_PATH
+    with resolved.open("r", encoding="utf-8") as f:
+        data = json.load(f)
+    terms = data.get("terms", [])
+    if not isinstance(terms, list):
+        raise ValueError(f"{resolved}: 'terms' must be a list")
+    return [str(t) for t in terms]
+
+
+# ---------------------------------------------------------------------------
+# Span merging / redaction helpers
+# ---------------------------------------------------------------------------
+
+
+def _merge_spans(spans: list[tuple[int, int, str]]) -> list[tuple[int, int]]:
+    """Merge overlapping/adjacent (start, end) spans, sorted by start."""
+    if not spans:
+        return []
+    ordered = sorted((s, e) for s, e, _ in spans)
+    merged: list[tuple[int, int]] = [ordered[0]]
+    for start, end in ordered[1:]:
+        last_start, last_end = merged[-1]
+        if start <= last_end:
+            merged[-1] = (last_start, max(last_end, end))
+        else:
+            merged.append((start, end))
+    return merged
+
+
+def _apply_redactions(text: str, merged_spans: list[tuple[int, int]], redaction_char: str) -> str:
+    if not merged_spans:
+        return text
+    pieces: list[str] = []
+    cursor = 0
+    for start, end in merged_spans:
+        pieces.append(text[cursor:start])
+        pieces.append(redaction_char * (end - start))
+        cursor = end
+    pieces.append(text[cursor:])
+    return "".join(pieces)
+
+
+# ---------------------------------------------------------------------------
+# Default implementation
+# ---------------------------------------------------------------------------
+
+
+class ListBasedTextFilter:
+    """Deterministic `TextFilter`: normalized substring match against a term list.
+
+    `mode` controls what happens on a match:
+    - `FilterMode.REDACT` (default): matched spans in the *original* text
+      are replaced with `redaction_char` repeated to the matched span's
+      original length; `action` is REDACT if anything matched, else ALLOW.
+    - `FilterMode.REJECT`: `filtered_text` is returned unchanged but
+      `action` is REJECT if anything matched (callers should treat this as
+      "do not store/deliver"), else ALLOW.
+
+    An empty or whitespace-only string always returns ALLOW with no
+    matches -- there is nothing to filter.
+    """
+
+    def __init__(
+        self,
+        terms: Iterable[str] | None = None,
+        *,
+        mode: FilterMode = FilterMode.REDACT,
+        terms_path: Path | str | None = None,
+        redaction_char: str = "*",
+    ) -> None:
+        if terms is None:
+            terms = load_terms(terms_path)
+        # De-dupe while preserving order; drop blanks.
+        seen: dict[str, None] = {}
+        for t in terms:
+            t = t.strip()
+            if t:
+                seen.setdefault(t, None)
+        self._terms: tuple[str, ...] = tuple(seen)
+        # Pre-normalize once at construction; skip terms that normalize to
+        # nothing (e.g. a term that's pure punctuation).
+        self._normalized_terms: list[tuple[str, str]] = [
+            (normalized, original)
+            for original in self._terms
+            if (normalized := _normalize_term(original))
+        ]
+        self.mode = mode
+        self.redaction_char = redaction_char
+
+    def check(self, text: str) -> FilterResult:
+        if not text or not text.strip():
+            return FilterResult(action=FilterAction.ALLOW, filtered_text=text, matched_terms=())
+
+        normalized, index_map = _normalize(text)
+        if not normalized:
+            return FilterResult(action=FilterAction.ALLOW, filtered_text=text, matched_terms=())
+
+        spans: list[tuple[int, int, str]] = []
+        for normalized_term, original_term in self._normalized_terms:
+            start = 0
+            term_len = len(normalized_term)
+            while True:
+                idx = normalized.find(normalized_term, start)
+                if idx == -1:
+                    break
+                end = idx + term_len
+                orig_start = index_map[idx]
+                orig_end = index_map[end - 1] + 1
+                spans.append((orig_start, orig_end, original_term))
+                start = end  # non-overlapping: resume after this match
+
+        if not spans:
+            return FilterResult(action=FilterAction.ALLOW, filtered_text=text, matched_terms=())
+
+        spans.sort(key=lambda s: s[0])
+        matched_terms = tuple(dict.fromkeys(term for _, _, term in spans))
+
+        if self.mode is FilterMode.REJECT:
+            return FilterResult(action=FilterAction.REJECT, filtered_text=text, matched_terms=matched_terms)
+
+        merged = _merge_spans(spans)
+        filtered_text = _apply_redactions(text, merged, self.redaction_char)
+        return FilterResult(action=FilterAction.REDACT, filtered_text=filtered_text, matched_terms=matched_terms)
+
+
+def default_text_filter(mode: FilterMode = FilterMode.REDACT) -> ListBasedTextFilter:
+    """Convenience factory for the bundled default term list."""
+    return ListBasedTextFilter(mode=mode)

backend/app/services/text_filter_terms.json

@@ -0,0 +1,20 @@
+{
+  "_readme": "Default deterministic term list for app.services.text_filter.ListBasedTextFilter. This is a minimal, illustrative starter list (common mild-to-strong English profanity, no slurs) meant to be replaced/extended per-deployment -- swap this file, or pass an explicit `terms`/`terms_path` to the filter, rather than editing this list in place for production moderation policy.",
+  "terms": [
+    "fuck",
+    "shit",
+    "ass",
+    "asshole",
+    "bitch",
+    "bastard",
+    "damn",
+    "crap",
+    "dick",
+    "piss",
+    "slut",
+    "whore",
+    "cunt",
+    "douche",
+    "bullshit"
+  ]
+}

backend/app/services/trending.py

@@ -0,0 +1,34 @@
+"""Trending recommendation heuristic service.
+
+docs/planning/discovery.md (task 33706f401ad9).
+"""
+
+from sqlalchemy import case, func, select, text
+from app.models.world_visit import WorldVisit
+
+
+def get_trending_subquery(days: int = 7):
+    """Build a subquery that computes a decay-weighted trending score per world_id.
+
+    Decay weights:
+    - Visited within 24 hours: weight 3.0
+    - Visited within 3 days: weight 2.0
+    - Visited within 7 days: weight 1.0
+    """
+    trending_weight = case(
+        (WorldVisit.visited_at >= func.now() - text("interval '1 day'"), 3.0),
+        (WorldVisit.visited_at >= func.now() - text("interval '3 days'"), 2.0),
+        else_=1.0,
+    )
+
+    interval_str = f"interval '{days} days'"
+    subq = (
+        select(
+            WorldVisit.world_id.label("trending_world_id"),
+            func.coalesce(func.sum(trending_weight), 0.0).label("trending_score"),
+        )
+        .where(WorldVisit.visited_at >= func.now() - text(interval_str))
+        .group_by(WorldVisit.world_id)
+        .subquery("trending_scores")
+    )
+    return subq

backend/app/services/wallet.py

@@ -0,0 +1,208 @@
+"""Wallet service: atomic credit/debit, row locking, and idempotency.
+
+docs/planning/economy.md US-1 (task 909e3e9a59af).
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+from sqlalchemy import func, select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.wallet import Transaction, TransactionType, Wallet
+
+logger = logging.getLogger(__name__)
+
+
+class InsufficientFundsError(Exception):
+    """Raised when a debit would cause wallet balance to drop below zero."""
+    pass
+
+
+class InvalidAmountError(ValueError):
+    """Raised when an invalid (non-positive) amount is supplied."""
+    pass
+
+
+class WalletService:
+    @staticmethod
+    async def get_or_create_wallet(
+        db: AsyncSession, user_id: int, for_update: bool = False
+    ) -> Wallet:
+        """Fetch existing wallet or lazily create one for user_id.
+
+        If for_update is True, locks the row with SELECT ... FOR UPDATE.
+        """
+        stmt = select(Wallet).where(Wallet.user_id == user_id)
+        if for_update:
+            stmt = stmt.with_for_update()
+
+        result = await db.execute(stmt)
+        wallet = result.scalar_one_or_none()
+        if wallet is not None:
+            return wallet
+
+        # If not found and not in update mode, create lazily
+        try:
+            new_wallet = Wallet(user_id=user_id, balance=0)
+            db.add(new_wallet)
+            await db.commit()
+            await db.refresh(new_wallet)
+
+            if for_update:
+                stmt_locked = select(Wallet).where(Wallet.id == new_wallet.id).with_for_update()
+                res = await db.execute(stmt_locked)
+                return res.scalar_one()
+
+            return new_wallet
+        except IntegrityError:
+            # Concurrent insert collision -- rollback and fetch the existing one
+            await db.rollback()
+            stmt = select(Wallet).where(Wallet.user_id == user_id)
+            if for_update:
+                stmt = stmt.with_for_update()
+            result = await db.execute(stmt)
+            return result.scalar_one()
+
+    @classmethod
+    async def credit(
+        cls,
+        db: AsyncSession,
+        user_id: int,
+        amount: int,
+        tx_type: TransactionType | str,
+        reference_type: str | None = None,
+        reference_id: str | None = None,
+        idempotency_key: str | None = None,
+        metadata: dict[str, Any] | None = None,
+        commit: bool = True,
+    ) -> tuple[Wallet, Transaction]:
+        """Credit a user's wallet atomically with row locking.
+
+        If an idempotency_key is provided and already exists, returns the original
+        outcome without double-crediting.
+        """
+        if amount <= 0:
+            raise InvalidAmountError("Credit amount must be strictly positive")
+
+        if isinstance(tx_type, str):
+            tx_type = TransactionType(tx_type)
+
+        # Check idempotency first
+        if idempotency_key:
+            stmt = select(Transaction).where(Transaction.idempotency_key == idempotency_key)
+            existing_tx = (await db.execute(stmt)).scalar_one_or_none()
+            if existing_tx is not None:
+                wallet = await cls.get_or_create_wallet(db, user_id, for_update=False)
+                return wallet, existing_tx
+
+        # Lock wallet row
+        wallet = await cls.get_or_create_wallet(db, user_id, for_update=True)
+        wallet.balance += amount
+
+        tx = Transaction(
+            wallet_id=wallet.id,
+            type=tx_type,
+            amount=amount,
+            balance_after=wallet.balance,
+            reference_type=reference_type,
+            reference_id=reference_id,
+            idempotency_key=idempotency_key,
+            metadata_json=metadata,
+        )
+        db.add(tx)
+        if commit:
+            await db.commit()
+            await db.refresh(wallet)
+            await db.refresh(tx)
+        else:
+            await db.flush()
+        return wallet, tx
+
+    @classmethod
+    async def debit(
+        cls,
+        db: AsyncSession,
+        user_id: int,
+        amount: int,
+        tx_type: TransactionType | str,
+        reference_type: str | None = None,
+        reference_id: str | None = None,
+        idempotency_key: str | None = None,
+        metadata: dict[str, Any] | None = None,
+        commit: bool = True,
+    ) -> tuple[Wallet, Transaction]:
+        """Debit a user's wallet atomically with row locking and balance check.
+
+        Raises InsufficientFundsError if wallet balance < amount.
+        If idempotency_key is provided and already exists, returns the original
+        outcome without double-debiting.
+        """
+        if amount <= 0:
+            raise InvalidAmountError("Debit amount must be strictly positive")
+
+        if isinstance(tx_type, str):
+            tx_type = TransactionType(tx_type)
+
+        # Check idempotency first
+        if idempotency_key:
+            stmt = select(Transaction).where(Transaction.idempotency_key == idempotency_key)
+            existing_tx = (await db.execute(stmt)).scalar_one_or_none()
+            if existing_tx is not None:
+                wallet = await cls.get_or_create_wallet(db, user_id, for_update=False)
+                return wallet, existing_tx
+
+        # Lock wallet row
+        wallet = await cls.get_or_create_wallet(db, user_id, for_update=True)
+        cur_balance = wallet.balance
+        if cur_balance < amount:
+            if commit:
+                await db.rollback()
+            raise InsufficientFundsError(
+                f"Insufficient funds: available {cur_balance}, required {amount}"
+            )
+
+        wallet.balance -= amount
+
+        tx = Transaction(
+            wallet_id=wallet.id,
+            type=tx_type,
+            amount=-amount,
+            balance_after=wallet.balance,
+            reference_type=reference_type,
+            reference_id=reference_id,
+            idempotency_key=idempotency_key,
+            metadata_json=metadata,
+        )
+        db.add(tx)
+        if commit:
+            await db.commit()
+            await db.refresh(wallet)
+            await db.refresh(tx)
+        else:
+            await db.flush()
+        return wallet, tx
+
+    @staticmethod
+    async def get_transactions(
+        db: AsyncSession, wallet_id: int, limit: int = 50, offset: int = 0
+    ) -> tuple[list[Transaction], int]:
+        """Fetch paged transactions for a wallet ordered newest-first, plus total count."""
+        count_stmt = select(func.count()).select_from(Transaction).where(Transaction.wallet_id == wallet_id)
+        total = (await db.execute(count_stmt)).scalar() or 0
+
+        stmt = (
+            select(Transaction)
+            .where(Transaction.wallet_id == wallet_id)
+            .order_by(Transaction.created_at.desc(), Transaction.id.desc())
+            .offset(offset)
+            .limit(limit)
+        )
+        res = await db.execute(stmt)
+        return list(res.scalars().all()), total
+
+
+wallet_service = WalletService()

backend/app/services/world_store.py

@@ -0,0 +1,431 @@
+"""World content storage service.
+
+Implements the `world.md` §5.1 service interface over Postgres, per
+`world_persistence_impl.md` §9 -- **minus** ``flush_dirty`` and
+``rebuild_index``, which don't apply once there is no write-behind dirty
+set and no derived index to rebuild (see that doc's §3.3 and §4.2).
+
+This is the *only* place chunk content is written (world_persistence_impl.md
+D2 / §5). Callers (the routers) own transaction boundaries: methods here
+``flush()`` so later statements in the same request see earlier ones and so
+integrity errors surface before a caller commits, but they never
+``commit()`` -- that mirrors the existing convention in
+``app/routers/worlds.py`` (``get_db`` docs: "Handlers are responsible for
+committing or rolling back their own transactions").
+
+Known gap this module had to resolve on its own (flagged, not silently
+decided): `world_persistence_impl.md` §6/§7.2/§8.1 all reference a world's
+monotonic ``content_revision`` ("bumped on every chunk write"), but no
+column for it is defined anywhere in §4's schema. Rather than add an
+undocumented column, ``content_revision()`` below derives it as
+``MAX(id)`` over ``world_chunk_revisions`` scoped to the world: that table
+is append-only (retention only nulls ``payload``, it never deletes rows),
+so the value is genuinely monotonic and increments on every
+create/update/delete/rollback.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from sqlalchemy import func, select, update
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import load_only
+
+from app.config import settings
+from app.models.world_content import (
+    MAIN_ROOM_NAME,
+    MAIN_ROOM_SLUG,
+    WorldChunk,
+    WorldChunkRevision,
+    WorldRoom,
+)
+from app.services import chunk_codec
+
+
+class RevisionConflict(Exception):
+    """Optimistic-concurrency conflict (world.md §5.4). ``current_revision``
+    is 0 and ``current_checksum`` is None when the caller's ``base_revision``
+    assumed a chunk exists but it doesn't."""
+
+    def __init__(
+        self,
+        current_revision: int,
+        current_checksum: str | None,
+        coord: tuple[int, int, int] | None = None,
+    ) -> None:
+        self.current_revision = current_revision
+        self.current_checksum = current_checksum
+        self.coord = coord
+        super().__init__(f"revision conflict: current_revision={current_revision}")
+
+
+class RevisionNotAvailable(Exception):
+    """Raised by ``rollback_chunk`` when the requested revision doesn't
+    exist, or exists but its payload was pruned by the retention policy
+    (world_persistence_impl.md §4.3)."""
+
+
+@dataclass
+class Bounds:
+    cx_min: int | None = None
+    cx_max: int | None = None
+    cy_min: int | None = None
+    cy_max: int | None = None
+    cz: int | None = None
+
+
+class WorldStore:
+    """Owns chunk/room read/write operations over the async session
+    handed to it. One instance per request is the expected usage
+    (``WorldStore(db)`` where ``db`` is the ``DbDep`` session)."""
+
+    def __init__(self, db: AsyncSession) -> None:
+        self.db = db
+
+    # ── rooms ────────────────────────────────────────────────────────────
+
+    async def get_room(self, world_id: int, slug: str) -> WorldRoom | None:
+        result = await self.db.execute(
+            select(WorldRoom).where(WorldRoom.world_id == world_id, WorldRoom.slug == slug)
+        )
+        return result.scalar_one_or_none()
+
+    async def list_rooms(self, world_id: int) -> list[WorldRoom]:
+        result = await self.db.execute(
+            select(WorldRoom).where(WorldRoom.world_id == world_id).order_by(WorldRoom.id)
+        )
+        return list(result.scalars().all())
+
+    async def create_room(
+        self,
+        world_id: int,
+        slug: str,
+        name: str,
+        *,
+        grid: dict | None = None,
+        bounds: dict | None = None,
+        spawn: dict | None = None,
+    ) -> WorldRoom:
+        room = WorldRoom(world_id=world_id, slug=slug, name=name)
+        if grid is not None:
+            room.grid = grid
+        if bounds is not None:
+            room.bounds = bounds
+        if spawn is not None:
+            room.spawn = spawn
+        self.db.add(room)
+        await self.db.flush()
+        await self.db.refresh(room)
+        return room
+
+    async def get_or_create_main_room(self, world_id: int) -> WorldRoom:
+        """world_persistence_impl.md §4.1: every world gets a ``main`` room.
+        Called from ``create_world`` for new worlds, and lazily here for
+        worlds that predate this migration."""
+        room = await self.get_room(world_id, MAIN_ROOM_SLUG)
+        if room is not None:
+            return room
+        try:
+            return await self.create_room(world_id, MAIN_ROOM_SLUG, MAIN_ROOM_NAME)
+        except IntegrityError:
+            # Lost a race with a concurrent creator; the row now exists.
+            await self.db.rollback()
+            room = await self.get_room(world_id, MAIN_ROOM_SLUG)
+            if room is None:
+                raise
+            return room
+
+    async def count_chunks(self, room_id: int) -> int:
+        result = await self.db.execute(
+            select(func.count()).select_from(WorldChunk).where(WorldChunk.room_id == room_id)
+        )
+        return int(result.scalar_one())
+
+    async def content_revision(self, world_id: int) -> int:
+        """See module docstring for why this is derived rather than stored."""
+        result = await self.db.execute(
+            select(func.max(WorldChunkRevision.id)).where(WorldChunkRevision.world_id == world_id)
+        )
+        return int(result.scalar() or 0)
+
+    # ── chunk reads ──────────────────────────────────────────────────────
+
+    async def get_chunk(self, key: str) -> WorldChunk | None:
+        result = await self.db.execute(select(WorldChunk).where(WorldChunk.chunk_key == key))
+        return result.scalar_one_or_none()
+
+    async def get_chunk_by_coord(self, room_id: int, cx: int, cy: int, cz: int) -> WorldChunk | None:
+        result = await self.db.execute(
+            select(WorldChunk).where(
+                WorldChunk.room_id == room_id, WorldChunk.cx == cx,
+                WorldChunk.cy == cy, WorldChunk.cz == cz,
+            )
+        )
+        return result.scalar_one_or_none()
+
+    async def get_chunk_binary(self, key: str) -> bytes | None:
+        chunk = await self.get_chunk(key)
+        return chunk.payload if chunk is not None else None
+
+    async def get_chunk_flags(self, key: str) -> dict | None:
+        chunk = await self.get_chunk(key)
+        return chunk.content_flags if chunk is not None else None
+
+    async def list_chunks(
+        self,
+        world_id: int,
+        room_id: int | None = None,
+        bounds: Bounds | None = None,
+    ) -> list[WorldChunk]:
+        """Index query -- world.md §5.1's ``list_chunks``. Payload bytes are
+        deliberately not loaded (world_persistence_impl.md §8.1: "Payloads
+        are not included")."""
+        query = select(WorldChunk).options(
+            load_only(
+                WorldChunk.id, WorldChunk.world_id, WorldChunk.room_id, WorldChunk.chunk_key,
+                WorldChunk.cx, WorldChunk.cy, WorldChunk.cz, WorldChunk.revision,
+                WorldChunk.checksum, WorldChunk.payload_len, WorldChunk.is_mature,
+                WorldChunk.updated_at,
+            )
+        ).where(WorldChunk.world_id == world_id)
+        if room_id is not None:
+            query = query.where(WorldChunk.room_id == room_id)
+        if bounds is not None:
+            if bounds.cx_min is not None:
+                query = query.where(WorldChunk.cx >= bounds.cx_min)
+            if bounds.cx_max is not None:
+                query = query.where(WorldChunk.cx <= bounds.cx_max)
+            if bounds.cy_min is not None:
+                query = query.where(WorldChunk.cy >= bounds.cy_min)
+            if bounds.cy_max is not None:
+                query = query.where(WorldChunk.cy <= bounds.cy_max)
+            if bounds.cz is not None:
+                query = query.where(WorldChunk.cz == bounds.cz)
+        query = query.order_by(WorldChunk.cx, WorldChunk.cy, WorldChunk.cz)
+        result = await self.db.execute(query)
+        return list(result.scalars().all())
+
+    # ── chunk writes ─────────────────────────────────────────────────────
+
+    async def put_chunk(
+        self,
+        *,
+        room: WorldRoom,
+        cx: int,
+        cy: int,
+        cz: int,
+        payload_bytes: bytes,
+        base_revision: int,
+        actor_id: int | None,
+    ) -> WorldChunk:
+        """Full-chunk write with optimistic concurrency (world.md §5.4,
+        world_persistence_impl.md §5.4/§8.2). Validates the payload
+        server-side (§5.5) before ever touching a row. ``base_revision=0``
+        means "create; 409 if it already exists"."""
+        key = chunk_codec.build_key(room.world_id, room.slug, cx, cy, cz)
+        grid_size = tuple(room.grid.get("size", [32, 32, 1]))
+
+        # Raises ChunkCodecError / ChunkValidationError -- the router maps
+        # those to 422. Nothing below trusts the request body's own claims
+        # about content_flags/is_mature; both come from `decoded`.
+        decoded = chunk_codec.decode_and_validate(
+            payload_bytes,
+            expected_key=key,
+            grid_size=grid_size,
+            max_objects=settings.WORLD_CHUNK_MAX_OBJECTS,
+        )
+        body_checksum = chunk_codec.checksum(payload_bytes[chunk_codec.HEADER_SIZE:])
+
+        result = await self.db.execute(
+            select(WorldChunk)
+            .where(
+                WorldChunk.room_id == room.id, WorldChunk.cx == cx,
+                WorldChunk.cy == cy, WorldChunk.cz == cz,
+            )
+            .with_for_update()
+        )
+        row = result.scalar_one_or_none()
+
+        if base_revision == 0:
+            if row is not None:
+                raise RevisionConflict(row.revision, row.checksum, (cx, cy, cz))
+            row = WorldChunk(
+                world_id=room.world_id, room_id=room.id, chunk_key=key,
+                cx=cx, cy=cy, cz=cz, revision=1,
+            )
+            self.db.add(row)
+            action = "create"
+        else:
+            if row is None or row.revision != base_revision:
+                raise RevisionConflict(
+                    row.revision if row else 0, row.checksum if row else None, (cx, cy, cz)
+                )
+            row.revision = row.revision + 1
+            action = "update"
+
+        row.format_version = decoded.version
+        row.payload = payload_bytes
+        row.payload_len = len(payload_bytes)
+        row.checksum = body_checksum
+        row.content_flags = decoded.flags.to_dict()
+        row.is_mature = decoded.flags.mature
+        row.updated_by_id = actor_id
+
+        try:
+            await self.db.flush()
+        except IntegrityError:
+            # Lost a create race to a concurrent writer between our SELECT
+            # and this flush. Roll back and report the real current state.
+            await self.db.rollback()
+            existing = await self.get_chunk_by_coord(room.id, cx, cy, cz)
+            raise RevisionConflict(
+                existing.revision if existing else 0,
+                existing.checksum if existing else None,
+                (cx, cy, cz),
+            )
+
+        await self._record_revision(key, room.world_id, row.revision, action, actor_id, body_checksum, payload_bytes)
+        await self.db.refresh(row)
+        return row
+
+    async def put_chunks_batch(
+        self,
+        *,
+        room: WorldRoom,
+        items: list[dict],
+        actor_id: int | None,
+    ) -> list[WorldChunk]:
+        """Batch write (world_persistence_impl.md §8.1). One transaction,
+        all-or-nothing: none of this ``commit()``s, so a ``RevisionConflict``
+        raised partway leaves nothing persisted once the caller's request
+        handler lets the exception (or the HTTPException it becomes)
+        propagate through ``get_db``, which rolls back on any exception."""
+        rows: list[WorldChunk] = []
+        for item in items:
+            row = await self.put_chunk(
+                room=room, cx=item["cx"], cy=item["cy"], cz=item["cz"],
+                payload_bytes=item["payload_bytes"], base_revision=item["base_revision"],
+                actor_id=actor_id,
+            )
+            rows.append(row)
+        return rows
+
+    async def delete_chunk(self, key: str, actor_id: int | None) -> None:
+        row = await self.get_chunk(key)
+        if row is None:
+            return
+        await self._record_revision(key, row.world_id, row.revision, "delete", actor_id, row.checksum, None)
+        await self.db.delete(row)
+        await self.db.flush()
+
+    async def rollback_chunk(self, key: str, revision: int, actor_id: int | None) -> WorldChunk:
+        """Restore a chunk to a previously-recorded revision's payload
+        (world.md §5.1). Raises ``RevisionNotAvailable`` if that revision
+        was never recorded, its payload was pruned by retention, or the
+        chunk has since been deleted outright (nothing to update in place)."""
+        rev_result = await self.db.execute(
+            select(WorldChunkRevision)
+            .where(WorldChunkRevision.chunk_key == key, WorldChunkRevision.revision == revision)
+            .order_by(WorldChunkRevision.id.desc())
+            .limit(1)
+        )
+        rev_row = rev_result.scalar_one_or_none()
+        if rev_row is None:
+            raise RevisionNotAvailable(f"no revision {revision} recorded for {key!r}")
+        if rev_row.payload is None:
+            raise RevisionNotAvailable(f"revision {revision} of {key!r} was pruned; payload unavailable")
+
+        chunk = await self.get_chunk(key)
+        if chunk is None:
+            raise RevisionNotAvailable(f"chunk {key!r} no longer exists; cannot roll back in place")
+
+        room_result = await self.db.execute(select(WorldRoom).where(WorldRoom.id == chunk.room_id))
+        room = room_result.scalar_one()
+        grid_size = tuple(room.grid.get("size", [32, 32, 1]))
+        decoded = chunk_codec.decode_and_validate(
+            rev_row.payload, expected_key=key, grid_size=grid_size,
+            max_objects=settings.WORLD_CHUNK_MAX_OBJECTS,
+        )
+        body_checksum = chunk_codec.checksum(rev_row.payload[chunk_codec.HEADER_SIZE:])
+
+        chunk.revision = chunk.revision + 1
+        chunk.payload = rev_row.payload
+        chunk.payload_len = len(rev_row.payload)
+        chunk.checksum = body_checksum
+        chunk.format_version = decoded.version
+        chunk.content_flags = decoded.flags.to_dict()
+        chunk.is_mature = decoded.flags.mature
+        chunk.updated_by_id = actor_id
+
+        await self.db.flush()
+        # Tagged "update" (not a fourth action value) to keep the
+        # documented 'create'|'update'|'delete' action enum intact.
+        await self._record_revision(
+            key, chunk.world_id, chunk.revision, "update", actor_id, body_checksum, rev_row.payload
+        )
+        await self.db.refresh(chunk)
+        return chunk
+
+    async def list_revisions(self, chunk_key: str, limit: int = 50) -> list[WorldChunkRevision]:
+        """Not in world.md §5.1's interface by name, but required to
+        implement the revision-history endpoint world_persistence_impl.md
+        §8.1 lists (``GET .../revisions``)."""
+        result = await self.db.execute(
+            select(WorldChunkRevision)
+            .where(WorldChunkRevision.chunk_key == chunk_key)
+            .order_by(WorldChunkRevision.revision.desc(), WorldChunkRevision.id.desc())
+            .limit(limit)
+        )
+        return list(result.scalars().all())
+
+    async def migrate(self) -> None:
+        """No-op. `world.md` §4.8's hand-rolled SQLite migration runner is
+        superseded by Alembic (`backend/alembic/`) now that content lives
+        in Postgres (world_persistence_impl.md §3.3). Kept only so this
+        class's shape still matches the §5.1 interface it's implementing
+        a subset of."""
+        return None
+
+    # ── internals ────────────────────────────────────────────────────────
+
+    async def _record_revision(
+        self,
+        chunk_key: str,
+        world_id: int,
+        revision: int,
+        action: str,
+        actor_id: int | None,
+        checksum_hex: str,
+        payload_bytes: bytes | None,
+    ) -> None:
+        """Append an audit row and enforce the retention policy
+        (world_persistence_impl.md §4.3, required): keep the newest
+        ``WORLD_CHUNK_REVISION_KEEP`` payloads per ``chunk_key``, null out
+        ``payload`` on older rows, in the same transaction as the write."""
+        rev = WorldChunkRevision(
+            chunk_key=chunk_key, world_id=world_id, revision=revision, action=action,
+            actor_id=actor_id, checksum=checksum_hex, payload=payload_bytes,
+        )
+        self.db.add(rev)
+        await self.db.flush()
+
+        keep = settings.WORLD_CHUNK_REVISION_KEEP
+        keep_ids_result = await self.db.execute(
+            select(WorldChunkRevision.id)
+            .where(WorldChunkRevision.chunk_key == chunk_key)
+            .order_by(WorldChunkRevision.id.desc())
+            .limit(keep)
+        )
+        keep_ids = [row[0] for row in keep_ids_result.all()]
+        if keep_ids:
+            await self.db.execute(
+                update(WorldChunkRevision)
+                .where(
+                    WorldChunkRevision.chunk_key == chunk_key,
+                    WorldChunkRevision.id.notin_(keep_ids),
+                    WorldChunkRevision.payload.isnot(None),
+                )
+                .values(payload=None)
+            )

backend/tests/conftest.py

@@ -1,18 +1,22 @@
-"""Shared pytest fixtures + hermetic-DB bootstrap.
+"""Shared pytest fixtures + hermetic-DB/Redis bootstrap.
 
 The integration tests hit a real Postgres (Postgres-specific types: JSONB,
-native ENUMs). To make ``cd backend && pytest`` work from a clean checkout
+native ENUMs) and, for presence tests, a real Redis (TTL semantics aren't
-with no manual setup, ``pytest_configure`` below brings up an ephemeral
+worth faking). To make ``cd backend && pytest`` work from a clean checkout
-Postgres via docker compose and runs the migrations IF ``DATABASE_URL`` is
+with no manual setup, ``pytest_configure`` below brings up ephemeral
-not already pointing at a reachable database. When it is (dev loop, or the
+Postgres/Redis containers via docker compose and runs the migrations IF
-checkpoint runner which stands the DB up itself), that path is skipped and
+``DATABASE_URL``/``REDIS_URL`` aren't already pointing at something
-the existing database is reused.
+reachable. When they are (dev loop, or the checkpoint runner which stands
+these up itself), that path is skipped and the existing services are
+reused.
 
-If Docker isn't available and no DB is reachable, the whole DB-backed suite
+If Docker isn't available and nothing is reachable, the whole
-is skipped with a clear message rather than erroring out 60+ times.
+DB/Redis-backed suite is skipped with a clear message rather than erroring
+out dozens of times.
 """
 
 import asyncio
+import hashlib
 import os
 import socket
 import subprocess
@@ -30,13 +34,58 @@ from app.config import settings
 from app.database import get_db
 from app.main import app
 
-TEST_TABLES = ("avatar_loadouts", "assets", "worlds", "sessions", "refresh_tokens", "users")
+TEST_TABLES = (
+    "avatar_loadouts", "assets",
+    # Profile (app/models/profile.py) -- both FK users.id, profile_favorites
+    # additionally FKs worlds.id; list explicitly for clarity/consistency.
+    "profile_favorites", "profiles",
+    # world_chunk_revisions has no FK to worlds/world_chunks (world.md §4.7 /
+    # world_persistence_impl.md §4.3, deliberate -- deleting a chunk or world
+    # must not lose the audit trail), so it won't be cascade-truncated via
+    # `worlds` the way world_rooms/world_chunks would be. List all three
+    # explicitly rather than rely on cascade for some of them.
+    "world_chunk_revisions", "world_chunks", "world_rooms",
+    # Discovery (app/models/world_visit.py) -- FK worlds.id with ON DELETE CASCADE
+    "world_visits",
+    "worlds",
+    # Social graph (app/models/social.py) -- all three FK users with
+    # ON DELETE CASCADE, but list explicitly for clarity/consistency.
+    "friendships", "follows", "blocks",
+    # Chat (app/models/chat.py). message_reports.message_id is ON DELETE SET
+    # NULL (not CASCADE, deliberately -- see chat.py), so it wouldn't be
+    # reached by cascading a truncate of messages/conversations; list it
+    # explicitly along with the rest for clarity/consistency.
+    "message_reports", "messages", "conversation_participants", "conversations",
+    # Groups (app/models/groups.py). groups.owner_id is ON DELETE SET NULL
+    # (not CASCADE, deliberately -- see groups.py), so it wouldn't be reached
+    # by cascading a truncate of users; list it explicitly for clarity too.
+    "group_members", "groups",
+    # Economy (app/models/wallet.py, app/models/marketplace.py)
+    "payout_requests", "purchases", "marketplace_listings", "catalog_items", "creator_balances",
+    "transactions", "wallets",
+    "sessions", "refresh_tokens", "users",
+)
 
 BACKEND_DIR = Path(__file__).resolve().parents[1]
-_COMPOSE_PROJECT = "agp-pytest"
-_EPHEMERAL_PG_PORT = 25432
 
-# Set by _ensure_database() when it starts a container it owns; torn down in
+# A hardcoded project name/port here would mean every concurrent checkout
+# running `pytest` (e.g. several Claude Agent-tool subagents, each in their
+# own ~/agp/workspace/task_<id> clone) fights over the exact same Docker
+# Compose project and host ports -- one run's pytest_unconfigure teardown
+# can yank the ephemeral Postgres out from under a completely unrelated
+# concurrent run, surfacing as "connection was closed in the middle of
+# operation" with no obvious cause. Confirmed live 2026-09-15 running 3
+# parallel subagents. Same root cause and fix pattern as the agent_core
+# workspace/Docker-Compose collision documented in project_agp memory --
+# derive both the project name and the port from a hash of the checkout
+# directory, so different concurrent checkouts land on different projects/
+# ports while the same checkout is stable across repeated runs.
+_WORKSPACE_HASH = hashlib.sha256(str(BACKEND_DIR.parent).encode()).hexdigest()[:10]
+_COMPOSE_PROJECT = f"agp-pytest-{_WORKSPACE_HASH}"
+_EPHEMERAL_PG_PORT = 25400 + (int(_WORKSPACE_HASH, 16) % 100)
+_EPHEMERAL_REDIS_PORT = 26300 + (int(_WORKSPACE_HASH, 16) % 100)
+
+# Set by pytest_configure() when it starts container(s) it owns; torn down in
 # pytest_unconfigure.
 _started_container = False
 _db_unavailable_reason: str | None = None
@@ -55,6 +104,11 @@ def _db_reachable(url: str) -> bool:
     return _port_open(parts.hostname or "localhost", parts.port or 5432)
 
 
+def _redis_reachable(url: str) -> bool:
+    parts = urlsplit(url)
+    return _port_open(parts.hostname or "localhost", parts.port or 6379)
+
+
 def _run(cmd: list[str], **kw) -> subprocess.CompletedProcess:
     return subprocess.run(cmd, cwd=BACKEND_DIR, capture_output=True, text=True, **kw)
 
@@ -62,14 +116,17 @@ def _run(cmd: list[str], **kw) -> subprocess.CompletedProcess:
 def pytest_configure(config):
     global _started_container, _db_unavailable_reason
 
-    if _db_reachable(settings.DATABASE_URL):
+    need_db = not _db_reachable(settings.DATABASE_URL)
-        return  # dev loop / checkpoint runner already provided one
+    need_redis = not _redis_reachable(settings.REDIS_URL)
+
+    if not need_db and not need_redis:
+        return  # dev loop / checkpoint runner already provided both
 
     if not _run(["docker", "--version"]).returncode == 0:
         _db_unavailable_reason = (
-            "no reachable DATABASE_URL and docker is unavailable -- run the "
+            "no reachable DATABASE_URL/REDIS_URL and docker is unavailable -- run "
-            "checkpoint suite (scripts/run_checkpoint_tests.py) or start Postgres "
+            "the checkpoint suite (scripts/run_checkpoint_tests.py) or start "
-            "manually"
+            "Postgres/Redis manually"
         )
         return
 
@@ -77,33 +134,55 @@ def pytest_configure(config):
     env["COMPOSE_PROJECT_NAME"] = _COMPOSE_PROJECT
     env["POSTGRES_HOST_PORT"] = str(_EPHEMERAL_PG_PORT)
     env["POSTGRES_PORT"] = str(_EPHEMERAL_PG_PORT)
-    up = _run(["docker", "compose", "up", "-d", "postgres"], env=env)
+    env["REDIS_HOST_PORT"] = str(_EPHEMERAL_REDIS_PORT)
+
+    services = [s for s, need in (("postgres", need_db), ("redis", need_redis)) if need]
+    up = _run(["docker", "compose", "up", "-d", *services], env=env)
     if up.returncode != 0:
-        _db_unavailable_reason = f"docker compose up postgres failed:\n{up.stderr[-800:]}"
+        _db_unavailable_reason = f"docker compose up {' '.join(services)} failed:\n{up.stderr[-800:]}"
         return
     _started_container = True
 
-    for _ in range(30):
+    if need_db:
-        r = _run(
+        for _ in range(30):
-            ["docker", "compose", "exec", "-T", "postgres",
+            r = _run(
-             "pg_isready", "-U", "agp_user", "-d", "agp_db"],
+                ["docker", "compose", "exec", "-T", "postgres",
-            env=env,
+                 "pg_isready", "-U", "agp_user", "-d", "agp_db"],
-        )
+                env=env,
-        if r.returncode == 0:
+            )
-            break
+            if r.returncode == 0:
-        time.sleep(1)
+                break
-    else:
+            time.sleep(1)
-        _db_unavailable_reason = "ephemeral Postgres never became ready"
+        else:
-        return
+            _db_unavailable_reason = "ephemeral Postgres never became ready"
+            return
 
-    url = f"postgresql+asyncpg://agp_user:agp_password@localhost:{_EPHEMERAL_PG_PORT}/agp_db"
+        url = f"postgresql+asyncpg://agp_user:agp_password@localhost:{_EPHEMERAL_PG_PORT}/agp_db"
-    os.environ["DATABASE_URL"] = url
+        os.environ["DATABASE_URL"] = url
-    settings.DATABASE_URL = url
+        settings.DATABASE_URL = url
 
-    mig = _run([sys.executable, "-m", "alembic", "upgrade", "head"],
+        mig = _run([sys.executable, "-m", "alembic", "upgrade", "head"],
-               env={**os.environ, "DATABASE_URL": url})
+                   env={**os.environ, "DATABASE_URL": url})
-    if mig.returncode != 0:
+        if mig.returncode != 0:
-        _db_unavailable_reason = f"alembic upgrade head failed:\n{mig.stderr[-800:]}"
+            _db_unavailable_reason = f"alembic upgrade head failed:\n{mig.stderr[-800:]}"
+            return
+
+    if need_redis:
+        for _ in range(30):
+            r = _run(
+                ["docker", "compose", "exec", "-T", "redis", "redis-cli", "ping"],
+                env=env,
+            )
+            if r.returncode == 0 and "PONG" in r.stdout:
+                break
+            time.sleep(1)
+        else:
+            _db_unavailable_reason = "ephemeral Redis never became ready"
+            return
+
+        redis_url = f"redis://localhost:{_EPHEMERAL_REDIS_PORT}/0"
+        os.environ["REDIS_URL"] = redis_url
+        settings.REDIS_URL = redis_url
 
 
 def pytest_unconfigure(config):
@@ -113,6 +192,7 @@ def pytest_unconfigure(config):
     env["COMPOSE_PROJECT_NAME"] = _COMPOSE_PROJECT
     env["POSTGRES_HOST_PORT"] = str(_EPHEMERAL_PG_PORT)
     env["POSTGRES_PORT"] = str(_EPHEMERAL_PG_PORT)
+    env["REDIS_HOST_PORT"] = str(_EPHEMERAL_REDIS_PORT)
     _run(["docker", "compose", "down", "-v"], env=env)
 
 

backend/tests/fixtures/chunks/generate_fixtures.py

@@ -0,0 +1,105 @@
+"""Generates the golden-file chunk fixtures in this directory.
+
+These pin the world.md §3.6 binary format so the Python codec
+(app/services/chunk_codec.py) and any future Godot-side test fixture can be
+checked for drift (world_persistence_impl.md §5.5's "drift control"
+requirement). No Godot-side golden fixture existed at the time this was
+written (searched scripts/ and tests/ for AGPC / binary-format test
+vectors -- none found), so these are authored here, from this
+implementation, as the first golden files for the format. The client/editor
+follow-on task should decode these same files with
+`ChunkDataDecoder.decode_binary()` and assert the same logical values
+(see the note in chunk_codec.py about a confirmed float32 handling bug in
+that decoder that will need fixing for full byte parity on non-integer
+transforms).
+
+Run with: `python tests/fixtures/chunks/generate_fixtures.py` from `backend/`.
+Fixtures are checked in; this script is for regenerating them if the format
+or these examples change, not run as part of the test suite.
+"""
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[3]))  # backend/
+
+from app.services import chunk_codec as cc
+
+FIXTURES_DIR = Path(__file__).resolve().parent
+
+
+def _empty_chunk() -> cc.ChunkPayload:
+    return cc.ChunkPayload(
+        world_id="7", room_id="main", coord=(0, 0, 0),
+        bounds=cc.ChunkBounds(min=(0.0, 0.0, 0.0), size=(32.0, 32.0, 1.0)),
+        tile_layers=[], objects=[],
+        flags=cc.ContentFlags(),
+        created_at=1_700_000_000, updated_at=1_700_000_000, revision=1, author="fixture-gen",
+    )
+
+
+def _simple_tile_chunk() -> cc.ChunkPayload:
+    layer = cc.TileLayer(
+        name="ground", layer_id=0, width=4, height=4, depth=1,
+        palette=[
+            cc.TileDef(id=0, asset_id="", solid=False, flags=0, variants=1),
+            cc.TileDef(id=1, asset_id="tiles/grass", solid=False, flags=1, variants=4),
+            cc.TileDef(id=2, asset_id="tiles/stone", solid=True, flags=2, variants=2),
+        ],
+        tiles=[0, 1, 1, 0, 1, 2, 2, 1, 1, 2, 2, 1, 0, 1, 1, 0],
+    )
+    return cc.ChunkPayload(
+        world_id="12", room_id="main", coord=(3, -1, 0),
+        bounds=cc.ChunkBounds(min=(96.0, -32.0, 0.0), size=(32.0, 32.0, 1.0)),
+        tile_layers=[layer], objects=[],
+        flags=cc.ContentFlags(violence=0, mature=False, sources=[]),
+        created_at=1_700_000_000, updated_at=1_700_000_500, revision=2, author="fixture-gen",
+    )
+
+
+def _chunk_with_objects() -> cc.ChunkPayload:
+    layer = cc.TileLayer(
+        name="ground", layer_id=0, width=2, height=2, depth=1,
+        palette=[cc.TileDef(id=0, asset_id="", solid=False, flags=0, variants=1)],
+        tiles=[0, 0, 0, 0],
+    )
+    obj1 = cc.WorldObject(
+        id="obj_0001", type="interactable", asset_id="props/chest",
+        pos=(101.5, -110.25, 0.5), rot=(0.0, 0.0, 0.0, 1.0), scale=(1.0, 1.0, 1.0),
+        dynamic=False,
+        properties={"locked": False, "loot_table": "chest_basic"},
+        flags=cc.ContentFlags(violence=0, mature=False, sources=[]),
+    )
+    obj2 = cc.WorldObject(
+        id="obj_0002", type="spawn_point", asset_id="",
+        pos=(96.0, -128.0, 1.0), rot=(0.0, 0.7071, 0.0, 0.7071), scale=(1.0, 1.0, 1.0),
+        dynamic=True,
+        properties={},
+        flags=cc.ContentFlags(violence=1, mature=False, sources=["asset:props/chest"]),
+    )
+    return cc.ChunkPayload(
+        world_id="12", room_id="main", coord=(3, -4, 0),
+        bounds=cc.ChunkBounds(min=(96.0, -128.0, 0.0), size=(32.0, 32.0, 1.0)),
+        tile_layers=[layer], objects=[obj1, obj2],
+        flags=cc.ContentFlags(violence=1, mature=False, sources=["asset:props/chest"]),
+        created_at=1_700_000_000, updated_at=1_700_001_000, revision=5, author="agent-bot",
+    )
+
+
+FIXTURES = {
+    "empty_chunk.bin": _empty_chunk,
+    "simple_tile_chunk.bin": _simple_tile_chunk,
+    "chunk_with_objects.bin": _chunk_with_objects,
+}
+
+
+def main() -> None:
+    for filename, builder in FIXTURES.items():
+        payload = builder()
+        data = cc.encode_binary(payload)
+        (FIXTURES_DIR / filename).write_bytes(data)
+        print(f"wrote {filename} ({len(data)} bytes)")
+
+
+if __name__ == "__main__":
+    main()

backend/tests/test_chat_dm.py

@@ -0,0 +1,312 @@
+"""Integration tests for the DM chat router (app/routers/chat_dm.py):
+
+- POST /api/chat/dm/{user_id}/messages
+- GET  /api/chat/dm/{user_id}/messages
+- GET  /api/chat/dm/conversations
+
+The block-relationship router doesn't exist yet (sibling task), so blocks
+are inserted directly against the ``Block`` model, same pattern already
+used by ``tests/test_chat_models.py`` for direct model setup.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app import rate_limit
+from app.config import settings
+from app.main import app
+from app.models.social import Block
+
+
+def _register(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return {"headers": headers, "id": me.json()["id"], "username": username}
+
+
+async def _insert_block(blocker_id: int, blocked_id: int) -> None:
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    session_factory = async_sessionmaker(engine, expire_on_commit=False)
+    async with session_factory() as session:
+        session.add(Block(blocker_id=blocker_id, blocked_id=blocked_id))
+        await session.commit()
+    await engine.dispose()
+
+
+class TestSendAndRetrieve:
+    def test_send_then_fetch_history(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_alice1")
+        bob = _register(client, "dm_bob1")
+
+        resp = client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "hey bob"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 201, resp.text
+        sent = resp.json()
+        assert sent["sender_id"] == alice["id"]
+        assert sent["recipient_id"] == bob["id"]
+        assert sent["body"] == "hey bob"
+        assert sent["filtered"] is False
+        assert sent["id"] is not None
+        assert sent["created_at"] is not None
+
+        hist_alice = client.get(f"/api/chat/dm/{bob['id']}/messages", headers=alice["headers"])
+        assert hist_alice.status_code == 200, hist_alice.text
+        msgs = hist_alice.json()["messages"]
+        assert len(msgs) == 1
+        assert msgs[0]["body"] == "hey bob"
+
+        hist_bob = client.get(f"/api/chat/dm/{alice['id']}/messages", headers=bob["headers"])
+        assert hist_bob.status_code == 200, hist_bob.text
+        assert len(hist_bob.json()["messages"]) == 1
+        assert hist_bob.json()["messages"][0]["body"] == "hey bob"
+
+    def test_cannot_message_self(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_self1")
+        resp = client.post(
+            f"/api/chat/dm/{alice['id']}/messages",
+            json={"body": "hi me"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 400
+
+    def test_target_user_must_exist(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_noexist1")
+        resp = client.post(
+            "/api/chat/dm/999999999/messages",
+            json={"body": "hello?"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 404
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        resp = client.post("/api/chat/dm/1/messages", json={"body": "hi"})
+        assert resp.status_code == 401
+
+    def test_history_pagination_cursor(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_page_a")
+        bob = _register(client, "dm_page_b")
+
+        for i in range(5):
+            r = client.post(
+                f"/api/chat/dm/{bob['id']}/messages",
+                json={"body": f"msg {i}"},
+                headers=alice["headers"],
+            )
+            assert r.status_code == 201, r.text
+
+        page1 = client.get(
+            f"/api/chat/dm/{bob['id']}/messages",
+            params={"limit": 2},
+            headers=alice["headers"],
+        )
+        assert page1.status_code == 200
+        body1 = page1.json()
+        assert len(body1["messages"]) == 2
+        assert body1["messages"][0]["body"] == "msg 4"  # newest first
+        assert body1["next_cursor"] is not None
+
+        page2 = client.get(
+            f"/api/chat/dm/{bob['id']}/messages",
+            params={"limit": 2, "before": body1["next_cursor"]},
+            headers=alice["headers"],
+        )
+        assert page2.status_code == 200
+        body2 = page2.json()
+        assert [m["body"] for m in body2["messages"]] == ["msg 2", "msg 1"]
+
+    def test_no_conversation_yet_returns_empty_history(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_empty_a")
+        bob = _register(client, "dm_empty_b")
+        resp = client.get(f"/api/chat/dm/{bob['id']}/messages", headers=alice["headers"])
+        assert resp.status_code == 200
+        assert resp.json() == {"messages": [], "next_cursor": None}
+
+
+class TestConversationList:
+    def test_lists_peer_last_message_and_unread_count(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_conv_a")
+        bob = _register(client, "dm_conv_b")
+
+        client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "first"},
+            headers=alice["headers"],
+        )
+        client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "second"},
+            headers=alice["headers"],
+        )
+
+        convs_bob = client.get("/api/chat/dm/conversations", headers=bob["headers"])
+        assert convs_bob.status_code == 200, convs_bob.text
+        data = convs_bob.json()
+        assert data["total"] == 1
+        conv = data["conversations"][0]
+        assert conv["peer_id"] == alice["id"]
+        assert conv["peer_username"] == "dm_conv_a"
+        assert conv["last_message"]["body"] == "second"
+        assert conv["unread_count"] == 2  # bob hasn't read yet
+
+        # Bob reads the latest page -> unread resets to 0.
+        client.get(f"/api/chat/dm/{alice['id']}/messages", headers=bob["headers"])
+        convs_bob_after = client.get("/api/chat/dm/conversations", headers=bob["headers"])
+        assert convs_bob_after.json()["conversations"][0]["unread_count"] == 0
+
+        # Alice sent them, so her own unread count for this conversation is 0.
+        convs_alice = client.get("/api/chat/dm/conversations", headers=alice["headers"])
+        assert convs_alice.json()["conversations"][0]["unread_count"] == 0
+
+    def test_scoped_to_authenticated_user_only(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_scope_a")
+        bob = _register(client, "dm_scope_b")
+        carol = _register(client, "dm_scope_c")
+
+        client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "hi bob"},
+            headers=alice["headers"],
+        )
+
+        convs_carol = client.get("/api/chat/dm/conversations", headers=carol["headers"])
+        assert convs_carol.status_code == 200
+        assert convs_carol.json() == {"conversations": [], "total": 0}
+
+    def test_cannot_read_another_pairs_conversation(self):
+        """A user's history endpoint only ever resolves *their own* pairing
+        with the given peer id -- there is no conversation id in the URL an
+        outsider could guess/pass to read someone else's DMs."""
+        client = TestClient(app)
+        alice = _register(client, "dm_iso_a")
+        bob = _register(client, "dm_iso_b")
+        carol = _register(client, "dm_iso_c")
+
+        client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "secret to bob"},
+            headers=alice["headers"],
+        )
+
+        # Carol asking for her "history with bob" gets her own (empty)
+        # conversation, never alice's.
+        resp = client.get(f"/api/chat/dm/{bob['id']}/messages", headers=carol["headers"])
+        assert resp.status_code == 200
+        assert resp.json()["messages"] == []
+
+
+class TestBlocking:
+    async def test_blocker_cannot_send_to_blocked(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_block_a1")
+        bob = _register(client, "dm_block_b1")
+        await _insert_block(alice["id"], bob["id"])
+
+        resp = client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "let me in"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 403
+
+    async def test_blocked_cannot_send_to_blocker(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_block_a2")
+        bob = _register(client, "dm_block_b2")
+        await _insert_block(alice["id"], bob["id"])
+
+        resp = client.post(
+            f"/api/chat/dm/{alice['id']}/messages",
+            json={"body": "please respond"},
+            headers=bob["headers"],
+        )
+        assert resp.status_code == 403
+
+
+class TestTextFilter:
+    def test_message_tripping_filter_is_redacted_and_flagged(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_filter_a")
+        bob = _register(client, "dm_filter_b")
+
+        resp = client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "you are a bastard"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 201, resp.text
+        data = resp.json()
+        assert data["filtered"] is True
+        assert "bastard" not in data["body"]
+        assert "*" in data["body"]
+
+        # The stored/delivered copy is the redacted one, not the raw text.
+        hist = client.get(f"/api/chat/dm/{alice['id']}/messages", headers=bob["headers"])
+        assert hist.json()["messages"][0]["body"] == data["body"]
+
+    def test_clean_message_is_not_flagged(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_clean_a")
+        bob = _register(client, "dm_clean_b")
+        resp = client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            json={"body": "have a nice day"},
+            headers=alice["headers"],
+        )
+        assert resp.status_code == 201
+        assert resp.json()["filtered"] is False
+        assert resp.json()["body"] == "have a nice day"
+
+
+class TestRateLimit:
+    @pytest.fixture(autouse=True)
+    def _enable_rate_limiting(self):
+        prev = settings.RATE_LIMIT_ENABLED
+        settings.RATE_LIMIT_ENABLED = True
+        rate_limit.reset_all()
+        yield
+        rate_limit.reset_all()
+        settings.RATE_LIMIT_ENABLED = prev
+
+    def test_send_rate_limit_exceeded_returns_429(self):
+        client = TestClient(app)
+        alice = _register(client, "dm_rl_a")
+        bob = _register(client, "dm_rl_b")
+
+        codes = []
+        for i in range(25):
+            r = client.post(
+                f"/api/chat/dm/{bob['id']}/messages",
+                json={"body": f"spam {i}"},
+                headers=alice["headers"],
+            )
+            codes.append(r.status_code)
+
+        assert codes[:20] == [201] * 20
+        assert 429 in codes[20:]
+        assert codes[-1] == 429

backend/tests/test_chat_models.py

@@ -0,0 +1,344 @@
+"""Model-level tests for chat: conversations, messages, message reports.
+
+app/models/chat.py / alembic/versions/0008_add_chat_tables.py
+(docs/planning/social.md US-4). This is the models+migration task only --
+there are no API endpoints yet (sibling tasks own filtering, rate limiting,
+and the routers), so these tests exercise the ORM models and the real
+Postgres constraints directly rather than going through HTTP.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import delete, select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.chat import (
+    Conversation,
+    ConversationParticipant,
+    Message,
+    MessageReport,
+    ReportStatus,
+)
+from app.models.user import User
+from app.models.world import World
+
+
+def _register(client: TestClient, username: str) -> int:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    headers = {"Authorization": f"Bearer {resp.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+class TestConversationCreation:
+    async def test_create_conversation_with_participants_and_messages(self):
+        client = TestClient(app)
+        a = _register(client, "chat_conv_a")
+        b = _register(client, "chat_conv_b")
+
+        engine, factory = _session_factory()
+        try:
+            lo, hi = sorted((a, b))
+            async with factory() as session:
+                convo = Conversation(user_a_id=lo, user_b_id=hi)
+                session.add(convo)
+                await session.flush()
+                session.add_all(
+                    [
+                        ConversationParticipant(conversation_id=convo.id, user_id=a),
+                        ConversationParticipant(conversation_id=convo.id, user_id=b),
+                    ]
+                )
+                session.add(
+                    Message(sender_id=a, conversation_id=convo.id, body="hi there")
+                )
+                await session.commit()
+                convo_id = convo.id
+
+            async with factory() as session:
+                participants = (
+                    await session.execute(
+                        select(ConversationParticipant).where(
+                            ConversationParticipant.conversation_id == convo_id
+                        )
+                    )
+                ).scalars().all()
+                messages = (
+                    await session.execute(
+                        select(Message).where(Message.conversation_id == convo_id)
+                    )
+                ).scalars().all()
+                assert len(participants) == 2
+                assert len(messages) == 1
+                assert messages[0].sender_id == a
+                assert messages[0].filtered is False
+        finally:
+            await engine.dispose()
+
+    async def test_duplicate_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "chat_uq_a")
+        b = _register(client, "chat_uq_b")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Conversation(user_a_id=lo, user_b_id=hi))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Conversation(user_a_id=lo, user_b_id=hi))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+    async def test_unordered_pair_rejected_by_check_constraint(self):
+        client = TestClient(app)
+        a = _register(client, "chat_ck_a")
+        b = _register(client, "chat_ck_b")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                # Reversed order violates ck_conversations_ordered_pair.
+                session.add(Conversation(user_a_id=hi, user_b_id=lo))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+
+class TestWorldRoomChat:
+    async def test_world_message_has_null_conversation(self):
+        client = TestClient(app)
+        owner = _register(client, "chat_world_owner")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                world = World(name="Chat Test World", owner_id=owner)
+                session.add(world)
+                await session.flush()
+                msg = Message(sender_id=owner, world_id=world.id, body="hello world")
+                session.add(msg)
+                await session.commit()
+                world_id = world.id
+
+            async with factory() as session:
+                rows = (
+                    await session.execute(
+                        select(Message).where(Message.world_id == world_id)
+                    )
+                ).scalars().all()
+                assert len(rows) == 1
+                assert rows[0].conversation_id is None
+                assert rows[0].room_id is None
+        finally:
+            await engine.dispose()
+
+
+class TestMessageReports:
+    async def test_create_report_defaults_to_open(self):
+        client = TestClient(app)
+        sender = _register(client, "chat_rpt_sender")
+        reporter = _register(client, "chat_rpt_reporter")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                world = World(name="Report World", owner_id=sender)
+                session.add(world)
+                await session.flush()
+                msg = Message(sender_id=sender, world_id=world.id, body="bad words")
+                session.add(msg)
+                await session.flush()
+                report = MessageReport(
+                    message_id=msg.id, reporter_id=reporter, reason="spam"
+                )
+                session.add(report)
+                await session.commit()
+                report_id = report.id
+
+            async with factory() as session:
+                report = await session.get(MessageReport, report_id)
+                assert report.status == ReportStatus.OPEN
+                assert report.moderator_id is None
+                assert report.resolved_at is None
+        finally:
+            await engine.dispose()
+
+
+class TestCascadeDelete:
+    async def test_deleting_conversation_deletes_participants_and_messages(self):
+        client = TestClient(app)
+        a = _register(client, "chat_cd_conv_a")
+        b = _register(client, "chat_cd_conv_b")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                convo = Conversation(user_a_id=lo, user_b_id=hi)
+                session.add(convo)
+                await session.flush()
+                session.add_all(
+                    [
+                        ConversationParticipant(conversation_id=convo.id, user_id=a),
+                        ConversationParticipant(conversation_id=convo.id, user_id=b),
+                    ]
+                )
+                session.add(Message(sender_id=a, conversation_id=convo.id, body="bye"))
+                await session.commit()
+                convo_id = convo.id
+
+            async with factory() as session:
+                # Core delete against the conversations table directly, so
+                # the real ON DELETE CASCADE does the work (not the ORM).
+                await session.execute(
+                    delete(Conversation).where(Conversation.id == convo_id)
+                )
+                await session.commit()
+
+            async with factory() as session:
+                participants = (
+                    await session.execute(
+                        select(ConversationParticipant).where(
+                            ConversationParticipant.conversation_id == convo_id
+                        )
+                    )
+                ).scalars().all()
+                messages = (
+                    await session.execute(
+                        select(Message).where(Message.conversation_id == convo_id)
+                    )
+                ).scalars().all()
+                assert participants == []
+                assert messages == []
+        finally:
+            await engine.dispose()
+
+    async def test_deleting_user_removes_conversation_but_keeps_report_and_message_id_null(self):
+        """Deleting a conversation participant cascades away the whole DM
+        (conversation + participants + messages -- there's no third party
+        left to care about the history). Deleting the sender of a
+        world-chat message, by contrast, must NOT delete the message or its
+        report -- sender_id is SET NULL and message_reports.message_id
+        follows the message (also SET NULL, never CASCADE) so the audit
+        trail survives account deletion."""
+        client = TestClient(app)
+        a = _register(client, "chat_cd_user_a")
+        b = _register(client, "chat_cd_user_b")
+        reporter = _register(client, "chat_cd_user_reporter")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                convo = Conversation(user_a_id=lo, user_b_id=hi)
+                session.add(convo)
+                await session.flush()
+                session.add_all(
+                    [
+                        ConversationParticipant(conversation_id=convo.id, user_id=a),
+                        ConversationParticipant(conversation_id=convo.id, user_id=b),
+                    ]
+                )
+                session.add(Message(sender_id=a, conversation_id=convo.id, body="dm"))
+
+                world = World(name="Sender Delete World", owner_id=b)
+                session.add(world)
+                await session.flush()
+                world_msg = Message(sender_id=a, world_id=world.id, body="world chat")
+                session.add(world_msg)
+                await session.flush()
+                report = MessageReport(
+                    message_id=world_msg.id, reporter_id=reporter, reason="rude"
+                )
+                session.add(report)
+                await session.commit()
+                convo_id = convo.id
+                world_msg_id = world_msg.id
+                report_id = report.id
+
+            async with factory() as session:
+                # Delete `a`: participant in the DM (cascades the whole
+                # conversation) and sender of the world message (SET NULL).
+                await session.execute(delete(User).where(User.id == a))
+                await session.commit()
+
+            async with factory() as session:
+                convo_row = await session.get(Conversation, convo_id)
+                dm_messages = (
+                    await session.execute(
+                        select(Message).where(Message.conversation_id == convo_id)
+                    )
+                ).scalars().all()
+                world_msg = await session.get(Message, world_msg_id)
+                report = await session.get(MessageReport, report_id)
+
+                assert convo_row is None
+                assert dm_messages == []
+                # World message survives with sender_id nulled out.
+                assert world_msg is not None
+                assert world_msg.sender_id is None
+                assert world_msg.body == "world chat"
+                # Report still points at the surviving message.
+                assert report is not None
+                assert report.message_id == world_msg_id
+        finally:
+            await engine.dispose()
+
+    async def test_deleting_message_nulls_report_message_id(self):
+        client = TestClient(app)
+        sender = _register(client, "chat_cd_msg_sender")
+        reporter = _register(client, "chat_cd_msg_reporter")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                world = World(name="Msg Delete World", owner_id=sender)
+                session.add(world)
+                await session.flush()
+                msg = Message(sender_id=sender, world_id=world.id, body="to be removed")
+                session.add(msg)
+                await session.flush()
+                report = MessageReport(
+                    message_id=msg.id, reporter_id=reporter, reason="spam"
+                )
+                session.add(report)
+                await session.commit()
+                msg_id = msg.id
+                report_id = report.id
+
+            async with factory() as session:
+                await session.execute(delete(Message).where(Message.id == msg_id))
+                await session.commit()
+
+            async with factory() as session:
+                report = await session.get(MessageReport, report_id)
+                assert report is not None
+                assert report.message_id is None
+        finally:
+            await engine.dispose()

backend/tests/test_chat_reports.py

@@ -0,0 +1,201 @@
+"""Integration tests for message reporting and moderation queue:
+- POST /api/chat/messages/{message_id}/report
+- GET  /api/moderation/reports
+- POST /api/moderation/reports/{id}/resolve
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+def _register(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return {"headers": headers, "id": me.json()["id"], "username": username}
+
+
+def _send_dm(client: TestClient, sender: dict, recipient: dict, text: str = "hello") -> int:
+    resp = client.post(
+        f"/api/chat/dm/{recipient['id']}/messages",
+        headers=sender["headers"],
+        json={"body": text},
+    )
+    assert resp.status_code == 201, resp.text
+    return resp.json()["id"]
+
+
+class TestReportMessage:
+    def test_report_message_success(self):
+        client = TestClient(app)
+        alice = _register(client, "rep_alice1")
+        bob = _register(client, "rep_bob1")
+
+        msg_id = _send_dm(client, alice, bob, "spam message")
+
+        resp = client.post(
+            f"/api/chat/messages/{msg_id}/report",
+            headers=bob["headers"],
+            json={"reason": "Contains spam", "category": "spam"},
+        )
+        assert resp.status_code == 201, resp.text
+        data = resp.json()
+        assert data["message_id"] == msg_id
+        assert data["reporter_id"] == bob["id"]
+        assert data["status"] == "open"
+        assert "[spam] Contains spam" in data["reason"]
+
+    def test_duplicate_report_rejected(self):
+        client = TestClient(app)
+        alice = _register(client, "rep_alice2")
+        bob = _register(client, "rep_bob2")
+
+        msg_id = _send_dm(client, alice, bob, "bad message")
+
+        resp1 = client.post(
+            f"/api/chat/messages/{msg_id}/report",
+            headers=bob["headers"],
+            json={"reason": "offensive"},
+        )
+        assert resp1.status_code == 201
+
+        resp2 = client.post(
+            f"/api/chat/messages/{msg_id}/report",
+            headers=bob["headers"],
+            json={"reason": "offensive again"},
+        )
+        assert resp2.status_code == 409
+
+    def test_report_nonexistent_message_404(self):
+        client = TestClient(app)
+        bob = _register(client, "rep_bob3")
+
+        resp = client.post(
+            "/api/chat/messages/999999/report",
+            headers=bob["headers"],
+            json={"reason": "ghost"},
+        )
+        assert resp.status_code == 404
+
+    def test_report_requires_auth(self):
+        client = TestClient(app)
+        resp = client.post("/api/chat/messages/1/report", json={"reason": "no auth"})
+        assert resp.status_code == 401
+
+
+class TestModerationQueue:
+    def test_non_moderator_cannot_access_queue(self):
+        client = TestClient(app)
+        regular_user = _register(client, "rep_regular1")
+
+        resp = client.get("/api/moderation/reports", headers=regular_user["headers"])
+        assert resp.status_code == 403
+
+    def test_moderator_can_list_reports(self):
+        client = TestClient(app)
+        alice = _register(client, "rep_alice4")
+        bob = _register(client, "rep_bob4")
+        admin = _register(client, "admin_list")
+
+        msg_id = _send_dm(client, alice, bob, "something to report")
+        client.post(
+            f"/api/chat/messages/{msg_id}/report",
+            headers=bob["headers"],
+            json={"reason": "needs review"},
+        )
+
+        resp = client.get("/api/moderation/reports", headers=admin["headers"])
+        assert resp.status_code == 200, resp.text
+        reports = resp.json()
+        assert len(reports) >= 1
+        assert any(r["message_id"] == msg_id for r in reports)
+
+    def test_moderator_resolve_dismiss(self):
+        client = TestClient(app)
+        alice = _register(client, "rep_alice5")
+        bob = _register(client, "rep_bob5")
+        admin = _register(client, "admin_dismiss")
+
+        msg_id = _send_dm(client, alice, bob, "benign message")
+        rep_resp = client.post(
+            f"/api/chat/messages/{msg_id}/report",
+            headers=bob["headers"],
+            json={"reason": "false alarm"},
+        )
+        report_id = rep_resp.json()["id"]
+
+        resolve_resp = client.post(
+            f"/api/moderation/reports/{report_id}/resolve",
+            headers=admin["headers"],
+            json={"action": "dismiss", "notes": "No violation found"},
+        )
+        assert resolve_resp.status_code == 200, resolve_resp.text
+        data = resolve_resp.json()
+        assert data["report_id"] == report_id
+        assert data["status"] == "dismissed"
+        assert data["action_taken"] == "dismiss"
+        assert data["moderator_id"] == admin["id"]
+
+    def test_moderator_resolve_remove(self):
+        client = TestClient(app)
+        alice = _register(client, "rep_alice6")
+        bob = _register(client, "rep_bob6")
+        admin = _register(client, "admin_remove")
+
+        msg_id = _send_dm(client, alice, bob, "offensive content")
+        rep_resp = client.post(
+            f"/api/chat/messages/{msg_id}/report",
+            headers=bob["headers"],
+            json={"reason": "hate speech"},
+        )
+        report_id = rep_resp.json()["id"]
+
+        resolve_resp = client.post(
+            f"/api/moderation/reports/{report_id}/resolve",
+            headers=admin["headers"],
+            json={"action": "remove", "notes": "Content removed"},
+        )
+        assert resolve_resp.status_code == 200
+        assert resolve_resp.json()["status"] == "resolved"
+
+        # The message is removed from conversation history
+        hist = client.get(f"/api/chat/dm/{bob['id']}/messages", headers=alice["headers"])
+        assert all(m["id"] != msg_id for m in hist.json()["messages"])
+
+    def test_moderator_resolve_ban(self):
+        client = TestClient(app)
+        bad_user = _register(client, "bad_actor")
+        victim = _register(client, "rep_victim")
+        admin_auth = _register(client, "admin_ban")
+
+        msg_id = _send_dm(client, bad_user, victim, "terrible violation")
+        rep_resp = client.post(
+            f"/api/chat/messages/{msg_id}/report",
+            headers=victim["headers"],
+            json={"reason": "malicious user"},
+        )
+        report_id = rep_resp.json()["id"]
+
+        resolve_resp = client.post(
+            f"/api/moderation/reports/{report_id}/resolve",
+            headers=admin_auth["headers"],
+            json={"action": "ban", "notes": "Banned malicious user"},
+        )
+        assert resolve_resp.status_code == 200
+
+        # Attempting to use bad_user's token fails with 403 inactive account
+        bad_me = client.get("/api/users/me", headers=bad_user["headers"])
+        assert bad_me.status_code == 403

backend/tests/test_chat_world.py

@@ -0,0 +1,246 @@
+"""Integration tests for in-experience world/room chat:
+- POST /api/chat/world/{world_id}/messages
+- GET  /api/chat/world/{world_id}/messages
+- POST /api/chat/room/{room_id}/messages
+- GET  /api/chat/room/{room_id}/messages
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+def _register(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return {"headers": headers, "id": me.json()["id"], "username": username}
+
+
+def _make_world(client: TestClient, headers: dict, visibility: str = "public") -> int:
+    r = client.post("/api/worlds/", headers=headers, json={"name": "TestWorld", "visibility": visibility})
+    assert r.status_code == 201, r.text
+    return r.json()["id"]
+
+
+def _make_friends(client: TestClient, user_a: dict, user_b: dict) -> None:
+    req = client.post("/api/friends/requests", json={"user_id": user_b["id"]}, headers=user_a["headers"])
+    assert req.status_code == 201, req.text
+    req_id = req.json()["id"]
+    acc = client.post(f"/api/friends/requests/{req_id}/accept", headers=user_b["headers"])
+    assert acc.status_code == 200, acc.text
+
+
+class TestWorldChat:
+    def test_send_and_get_world_message(self):
+        client = TestClient(app)
+        alice = _register(client, "wch_alice1")
+        bob = _register(client, "wch_bob1")
+
+        world_id = _make_world(client, alice["headers"], visibility="public")
+
+        # Bob posts to Alice's public world
+        post_resp = client.post(
+            f"/api/chat/world/{world_id}/messages",
+            headers=bob["headers"],
+            json={"body": "Hello world from Bob!"},
+        )
+        assert post_resp.status_code == 201, post_resp.text
+        msg_data = post_resp.json()
+        assert msg_data["world_id"] == world_id
+        assert msg_data["room_id"] is None
+        assert msg_data["sender_id"] == bob["id"]
+        assert msg_data["body"] == "Hello world from Bob!"
+        assert msg_data["filtered"] is False
+        assert msg_data["author"]["username"] == "wch_bob1"
+        assert msg_data["author"]["id"] == bob["id"]
+
+        # Alice gets world chat history
+        get_resp = client.get(
+            f"/api/chat/world/{world_id}/messages",
+            headers=alice["headers"],
+        )
+        assert get_resp.status_code == 200, get_resp.text
+        history = get_resp.json()
+        assert len(history["messages"]) == 1
+        assert history["messages"][0]["id"] == msg_data["id"]
+        assert history["messages"][0]["author"]["username"] == "wch_bob1"
+
+    def test_room_scoped_messages(self):
+        client = TestClient(app)
+        alice = _register(client, "wch_alice2")
+        world_id = _make_world(client, alice["headers"])
+
+        # Fetch auto-created main room
+        rooms_resp = client.get(f"/api/worlds/{world_id}/rooms", headers=alice["headers"])
+        assert rooms_resp.status_code == 200, rooms_resp.text
+        rooms = rooms_resp.json()
+        assert len(rooms) >= 1
+        room_id = rooms[0]["id"]
+
+        # Post directly via room endpoint
+        post_room = client.post(
+            f"/api/chat/room/{room_id}/messages",
+            headers=alice["headers"],
+            json={"body": "Message in room"},
+        )
+        assert post_room.status_code == 201, post_room.text
+        msg_data = post_room.json()
+        assert msg_data["world_id"] == world_id
+        assert msg_data["room_id"] == room_id
+        assert msg_data["body"] == "Message in room"
+
+        # Get room history
+        get_room = client.get(
+            f"/api/chat/room/{room_id}/messages",
+            headers=alice["headers"],
+        )
+        assert get_room.status_code == 200, get_room.text
+        messages = get_room.json()["messages"]
+        assert len(messages) == 1
+        assert messages[0]["id"] == msg_data["id"]
+
+        # Also visible when querying world history with room_id filter
+        get_world_room = client.get(
+            f"/api/chat/world/{world_id}/messages?room_id={room_id}",
+            headers=alice["headers"],
+        )
+        assert get_world_room.status_code == 200, get_world_room.text
+        assert len(get_world_room.json()["messages"]) == 1
+
+    def test_visibility_access_control(self):
+        client = TestClient(app)
+        alice = _register(client, "wch_alice3")
+        bob = _register(client, "wch_bob3")
+        charlie = _register(client, "wch_charlie3")
+
+        # Private world: only Alice
+        priv_world_id = _make_world(client, alice["headers"], visibility="private")
+
+        # Bob cannot send or read
+        bob_send = client.post(
+            f"/api/chat/world/{priv_world_id}/messages",
+            headers=bob["headers"],
+            json={"body": "Trying to trespass"},
+        )
+        assert bob_send.status_code == 403, bob_send.text
+
+        bob_read = client.get(
+            f"/api/chat/world/{priv_world_id}/messages",
+            headers=bob["headers"],
+        )
+        assert bob_read.status_code == 403, bob_read.text
+
+        # Alice (owner) can send and read
+        alice_send = client.post(
+            f"/api/chat/world/{priv_world_id}/messages",
+            headers=alice["headers"],
+            json={"body": "My private sanctum"},
+        )
+        assert alice_send.status_code == 201, alice_send.text
+
+        # Friends-only world
+        fr_world_id = _make_world(client, alice["headers"], visibility="friends_only")
+        _make_friends(client, alice, bob)
+
+        # Bob (friend) can post
+        bob_fr_send = client.post(
+            f"/api/chat/world/{fr_world_id}/messages",
+            headers=bob["headers"],
+            json={"body": "Hello friend!"},
+        )
+        assert bob_fr_send.status_code == 201, bob_fr_send.text
+
+        # Charlie (not friend) cannot post or read
+        charlie_send = client.post(
+            f"/api/chat/world/{fr_world_id}/messages",
+            headers=charlie["headers"],
+            json={"body": "Can I join?"},
+        )
+        assert charlie_send.status_code == 403, charlie_send.text
+
+        charlie_read = client.get(
+            f"/api/chat/world/{fr_world_id}/messages",
+            headers=charlie["headers"],
+        )
+        assert charlie_read.status_code == 403, charlie_read.text
+
+    def test_not_found_validation(self):
+        client = TestClient(app)
+        alice = _register(client, "wch_alice4")
+
+        # Non-existent world
+        res = client.post(
+            "/api/chat/world/999999/messages",
+            headers=alice["headers"],
+            json={"body": "Ghost world"},
+        )
+        assert res.status_code == 404, res.text
+
+        # Non-existent room
+        world_id = _make_world(client, alice["headers"])
+        res2 = client.post(
+            f"/api/chat/world/{world_id}/messages",
+            headers=alice["headers"],
+            json={"body": "Ghost room", "room_id": 999999},
+        )
+        assert res2.status_code == 404, res2.text
+
+    def test_text_filtering_in_world_chat(self):
+        client = TestClient(app)
+        alice = _register(client, "wch_alice5")
+        world_id = _make_world(client, alice["headers"])
+
+        # Default filter redacts forbidden words
+        res = client.post(
+            f"/api/chat/world/{world_id}/messages",
+            headers=alice["headers"],
+            json={"body": "you are a bastard"},
+        )
+        assert res.status_code == 201, res.text
+        data = res.json()
+        assert data["filtered"] is True
+        assert "bastard" not in data["body"]
+        assert "*" in data["body"]
+
+    def test_pagination_and_next_cursor(self):
+        client = TestClient(app)
+        alice = _register(client, "wch_alice6")
+        world_id = _make_world(client, alice["headers"])
+
+        for i in range(5):
+            r = client.post(
+                f"/api/chat/world/{world_id}/messages",
+                headers=alice["headers"],
+                json={"body": f"Msg {i}"},
+            )
+            assert r.status_code == 201
+
+        page1 = client.get(
+            f"/api/chat/world/{world_id}/messages?limit=2",
+            headers=alice["headers"],
+        ).json()
+        assert len(page1["messages"]) == 2
+        assert page1["next_cursor"] is not None
+        assert page1["messages"][0]["body"] == "Msg 4"
+        assert page1["messages"][1]["body"] == "Msg 3"
+
+        page2 = client.get(
+            f"/api/chat/world/{world_id}/messages?limit=2&before={page1['next_cursor']}",
+            headers=alice["headers"],
+        ).json()
+        assert len(page2["messages"]) == 2
+        assert page2["messages"][0]["body"] == "Msg 2"
+        assert page2["messages"][1]["body"] == "Msg 1"

backend/tests/test_chunk_codec.py

@@ -0,0 +1,219 @@
+"""Tests for app.services.chunk_codec -- the Python port of world.md §3.6.
+
+Pure unit tests: no database, no app, no network. Golden fixtures live in
+tests/fixtures/chunks/ (see generate_fixtures.py there for how/why).
+"""
+
+from pathlib import Path
+
+import pytest
+
+from app.services import chunk_codec as cc
+
+FIXTURES_DIR = Path(__file__).resolve().parent / "fixtures" / "chunks"
+
+
+def _read_fixture(name: str) -> bytes:
+    return (FIXTURES_DIR / name).read_bytes()
+
+
+class TestGoldenFixtures:
+    """Byte-stability: decode a committed fixture, re-encode it, and the
+    bytes must match exactly (world.md §3.6.3)."""
+
+    @pytest.mark.parametrize("filename", [
+        "empty_chunk.bin", "simple_tile_chunk.bin", "chunk_with_objects.bin",
+    ])
+    def test_round_trip_is_byte_identical(self, filename):
+        original = _read_fixture(filename)
+        decoded = cc.decode_binary(original)
+        re_encoded = cc.encode_binary(decoded)
+        assert re_encoded == original
+
+    def test_simple_tile_chunk_logical_values(self):
+        decoded = cc.decode_binary(_read_fixture("simple_tile_chunk.bin"))
+        assert decoded.world_id == "12"
+        assert decoded.room_id == "main"
+        assert decoded.coord == (3, -1, 0)
+        assert decoded.bounds.min == (96.0, -32.0, 0.0)
+        assert decoded.bounds.size == (32.0, 32.0, 1.0)
+        assert len(decoded.tile_layers) == 1
+        layer = decoded.tile_layers[0]
+        assert layer.name == "ground"
+        assert (layer.width, layer.height, layer.depth) == (4, 4, 1)
+        assert len(layer.palette) == 3
+        assert layer.tiles == [0, 1, 1, 0, 1, 2, 2, 1, 1, 2, 2, 1, 0, 1, 1, 0]
+        assert decoded.revision == 2
+        assert decoded.author == "fixture-gen"
+
+    def test_chunk_with_objects_logical_values(self):
+        decoded = cc.decode_binary(_read_fixture("chunk_with_objects.bin"))
+        assert len(decoded.objects) == 2
+        obj1, obj2 = decoded.objects
+        assert obj1.id == "obj_0001"
+        assert obj1.type == "interactable"
+        assert obj1.pos == (101.5, -110.25, 0.5)
+        assert obj1.properties == {"locked": False, "loot_table": "chest_basic"}
+        assert obj2.id == "obj_0002"
+        assert obj2.dynamic is True
+        assert obj2.flags.violence == 1
+        assert obj2.flags.sources == ["asset:props/chest"]
+        assert decoded.flags.violence == 1
+        assert decoded.flags.sources == ["asset:props/chest"]
+
+    def test_empty_chunk_has_no_layers_or_objects(self):
+        decoded = cc.decode_binary(_read_fixture("empty_chunk.bin"))
+        assert decoded.tile_layers == []
+        assert decoded.objects == []
+
+
+class TestChecksum:
+    def test_checksum_is_sha256_hex(self):
+        import hashlib
+        assert cc.checksum(b"") == hashlib.sha256(b"").hexdigest()
+        assert len(cc.checksum(b"")) == 64
+
+    def test_header_checksum_matches_recomputed_for_valid_fixture(self):
+        data = _read_fixture("simple_tile_chunk.bin")
+        header_checksum_hex = data[16:48].hex()
+        body = data[cc.HEADER_SIZE:]
+        assert header_checksum_hex == cc.checksum(body)
+
+
+class TestBuildKey:
+    def test_matches_world_persistence_impl_4_5_format(self):
+        assert cc.build_key(12, "main", 3, -1, 0) == "12:main:3:-1:0"
+        assert cc.build_key("12", "main", 3, -1, 0) == "12:main:3:-1:0"
+
+
+class TestFloat32Fidelity:
+    """This is the concrete regression test for the cross-codec divergence
+    documented at the bottom of chunk_codec.py: this module must encode
+    real IEEE-754 float32, including fractional and negative values,
+    round-tripping exactly (up to float32 precision) -- unlike
+    scripts/chunk_data_decoder.gd's current int-truncating implementation."""
+
+    def test_fractional_and_negative_floats_survive_round_trip(self):
+        payload = cc.ChunkPayload(
+            world_id="1", room_id="main", coord=(0, 0, 0),
+            bounds=cc.ChunkBounds(min=(-17.25, 0.125, -3.0), size=(32.0, 32.0, 1.0)),
+            objects=[cc.WorldObject(
+                id="o1", type="prop", asset_id="a",
+                pos=(1.5, -2.75, 0.001), rot=(0.0, 0.7071068, 0.0, 0.7071068),
+                scale=(1.0, 1.0, 1.0),
+            )],
+        )
+        encoded = cc.encode_binary(payload)
+        decoded = cc.decode_binary(encoded)
+        assert decoded.bounds.min == pytest.approx((-17.25, 0.125, -3.0), abs=1e-6)
+        assert decoded.objects[0].pos == pytest.approx((1.5, -2.75, 0.001), abs=1e-6)
+        assert decoded.objects[0].rot == pytest.approx(
+            (0.0, 0.7071068, 0.0, 0.7071068), abs=1e-6
+        )
+
+
+class TestMalformedInput:
+    def test_bad_magic_raises_codec_error(self):
+        data = bytearray(_read_fixture("empty_chunk.bin"))
+        data[0:4] = b"XXXX"
+        with pytest.raises(cc.ChunkCodecError):
+            cc.decode_binary(bytes(data))
+
+    def test_too_short_raises_codec_error(self):
+        with pytest.raises(cc.ChunkCodecError):
+            cc.decode_binary(b"AGPC\x01\x00")
+
+    def test_unsupported_version_raises_codec_error(self):
+        data = bytearray(_read_fixture("empty_chunk.bin"))
+        data[4:6] = (99).to_bytes(2, "little")
+        with pytest.raises(cc.ChunkCodecError):
+            cc.decode_binary(bytes(data))
+
+    def test_payload_len_mismatch_raises_codec_error(self):
+        data = bytearray(_read_fixture("empty_chunk.bin"))
+        # Corrupt the declared payload_len (offset 12..16).
+        data[12:16] = (99999).to_bytes(4, "little")
+        with pytest.raises(cc.ChunkCodecError):
+            cc.decode_binary(bytes(data))
+
+
+class TestValidation:
+    """decode_and_validate: the server-side "don't trust the client"
+    boundary (world_persistence_impl.md §5.5)."""
+
+    def _valid_args(self):
+        return {
+            "expected_key": "12:main:3:-1:0",
+            "grid_size": (4, 4, 1),
+            "max_objects": 512,
+        }
+
+    def test_valid_payload_passes(self):
+        data = _read_fixture("simple_tile_chunk.bin")
+        payload = cc.decode_and_validate(data, **self._valid_args())
+        assert payload.coord == (3, -1, 0)
+
+    def test_checksum_mismatch_detected(self):
+        data = bytearray(_read_fixture("simple_tile_chunk.bin"))
+        # Corrupt one byte of the header's advisory checksum field
+        # (offset 16..48) only -- magic/version/payload_len and the whole
+        # payload body stay untouched, so this exercises exactly the
+        # "recomputed checksum disagrees with the header" path rather than
+        # also breaking structural decoding.
+        data[16] ^= 0xFF
+        with pytest.raises(cc.ChunkValidationError) as exc_info:
+            cc.decode_and_validate(bytes(data), **self._valid_args())
+        assert exc_info.value.reason == "checksum_mismatch"
+
+    def test_chunk_key_mismatch_detected(self):
+        data = _read_fixture("simple_tile_chunk.bin")
+        args = self._valid_args()
+        args["expected_key"] = "12:main:99:99:0"  # doesn't match the payload's own coord
+        with pytest.raises(cc.ChunkValidationError) as exc_info:
+            cc.decode_and_validate(data, **args)
+        assert exc_info.value.reason == "chunk_key_mismatch"
+
+    def test_layer_dims_mismatch_detected(self):
+        data = _read_fixture("simple_tile_chunk.bin")
+        args = self._valid_args()
+        args["grid_size"] = (8, 8, 1)  # fixture's layer is 4x4x1
+        with pytest.raises(cc.ChunkValidationError) as exc_info:
+            cc.decode_and_validate(data, **args)
+        assert exc_info.value.reason == "layer_dims"
+
+    def test_too_many_objects_detected(self):
+        data = _read_fixture("chunk_with_objects.bin")  # has 2 objects
+        args = self._valid_args()
+        args["expected_key"] = "12:main:3:-4:0"
+        args["grid_size"] = (2, 2, 1)
+        args["max_objects"] = 1
+        with pytest.raises(cc.ChunkValidationError) as exc_info:
+            cc.decode_and_validate(data, **args)
+        assert exc_info.value.reason == "too_many_objects"
+
+    def test_object_out_of_bounds_detected(self):
+        payload = cc.ChunkPayload(
+            world_id="1", room_id="main", coord=(0, 0, 0),
+            bounds=cc.ChunkBounds(min=(0.0, 0.0, 0.0), size=(32.0, 32.0, 1.0)),
+            objects=[cc.WorldObject(id="o1", type="prop", asset_id="a", pos=(9999.0, 0.0, 0.0))],
+        )
+        data = cc.encode_binary(payload)
+        with pytest.raises(cc.ChunkValidationError) as exc_info:
+            cc.decode_and_validate(
+                data, expected_key="1:main:0:0:0", grid_size=(32, 32, 1), max_objects=10
+            )
+        assert exc_info.value.reason == "object_out_of_bounds"
+
+    def test_tile_out_of_palette_detected(self):
+        layer = cc.TileLayer(
+            name="ground", width=2, height=2, depth=1,
+            palette=[cc.TileDef(id=1)],  # tile 5 below isn't in this palette
+            tiles=[1, 5, 0, 1],
+        )
+        payload = cc.ChunkPayload(world_id="1", room_id="main", coord=(0, 0, 0), tile_layers=[layer])
+        data = cc.encode_binary(payload)
+        with pytest.raises(cc.ChunkValidationError) as exc_info:
+            cc.decode_and_validate(
+                data, expected_key="1:main:0:0:0", grid_size=(2, 2, 1), max_objects=10
+            )
+        assert exc_info.value.reason == "tile_out_of_palette"

backend/tests/test_discovery_browse_api.py

@@ -0,0 +1,188 @@
+"""API tests for discovery browse & search endpoints.
+
+docs/planning/discovery.md (task 300da1dcddf3).
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+def _register(client: TestClient, username: str) -> tuple[int, dict[str, str]]:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"], headers
+
+
+@pytest.mark.asyncio
+async def test_discovery_public_worlds_only_and_fields():
+    client = TestClient(app)
+    uid, headers = _register(client, "creator_browse_1")
+
+    # Create public world
+    pub_resp = client.post(
+        "/api/worlds/",
+        headers=headers,
+        json={
+            "name": "Fantasy Kingdom",
+            "description": "A magical realm",
+            "visibility": "public",
+            "category": "RPG",
+            "tags": ["magic", "dragons"],
+        },
+    )
+    assert pub_resp.status_code == 201, pub_resp.text
+    pub_id = pub_resp.json()["id"]
+
+    # Create private world
+    priv_resp = client.post(
+        "/api/worlds/",
+        headers=headers,
+        json={
+            "name": "Secret Base",
+            "description": "Classified",
+            "visibility": "private",
+            "category": "RPG",
+            "tags": ["secret"],
+        },
+    )
+    assert priv_resp.status_code == 201, priv_resp.text
+
+    # 1. Anonymous listing: only public world is returned
+    anon_resp = client.get("/api/discovery/worlds")
+    assert anon_resp.status_code == 200, anon_resp.text
+    data = anon_resp.json()
+    assert data["total"] >= 1
+    items = data["items"]
+    ids = [w["id"] for w in items]
+    assert pub_id in ids
+    assert priv_resp.json()["id"] not in ids
+
+    # Check fields of returned item
+    pub_item = next(w for w in items if w["id"] == pub_id)
+    assert pub_item["name"] == "Fantasy Kingdom"
+    assert pub_item["description"] == "A magical realm"
+    assert pub_item["category"] == "RPG"
+    assert "magic" in pub_item["tags"]
+    assert pub_item["play_count"] == 0
+    assert pub_item["owner"]["id"] == uid
+    assert pub_item["owner"]["username"] == "creator_browse_1"
+
+    # 2. Authenticated caller also does NOT see private worlds in discovery
+    auth_resp = client.get("/api/discovery/worlds", headers=headers)
+    assert auth_resp.status_code == 200
+    auth_ids = [w["id"] for w in auth_resp.json()["items"]]
+    assert priv_resp.json()["id"] not in auth_ids
+
+
+@pytest.mark.asyncio
+async def test_discovery_filtering_and_categories():
+    client = TestClient(app)
+    uid, headers = _register(client, "creator_filter_2")
+
+    # Create distinct worlds
+    client.post(
+        "/api/worlds/",
+        headers=headers,
+        json={"name": "Cyber Arena", "visibility": "public", "category": "Action", "tags": ["pvp", "fps"]},
+    )
+    client.post(
+        "/api/worlds/",
+        headers=headers,
+        json={"name": "Peaceful Meadow", "visibility": "public", "category": "Social", "tags": ["relax", "hangout"]},
+    )
+    client.post(
+        "/api/worlds/",
+        headers=headers,
+        json={"name": "Cyber Hangout", "visibility": "public", "category": "Social", "tags": ["cyberpunk", "chat"]},
+    )
+
+    # Search by q
+    res_q = client.get("/api/discovery/worlds?q=cyber")
+    assert res_q.status_code == 200
+    names = [w["name"] for w in res_q.json()["items"]]
+    assert "Cyber Arena" in names
+    assert "Cyber Hangout" in names
+    assert "Peaceful Meadow" not in names
+
+    # Filter by category (case-insensitive)
+    res_cat = client.get("/api/discovery/worlds?category=action")
+    assert res_cat.status_code == 200
+    names = [w["name"] for w in res_cat.json()["items"]]
+    assert "Cyber Arena" in names
+    assert "Peaceful Meadow" not in names
+
+    # Filter by tags (overlap)
+    res_tags = client.get("/api/discovery/worlds?tags=relax,pvp")
+    assert res_tags.status_code == 200
+    names = [w["name"] for w in res_tags.json()["items"]]
+    assert "Peaceful Meadow" in names
+    assert "Cyber Arena" in names
+    assert "Cyber Hangout" not in names
+
+    # Get distinct categories
+    res_cats = client.get("/api/discovery/categories")
+    assert res_cats.status_code == 200
+    cats = res_cats.json()
+    assert "Action" in cats
+    assert "Social" in cats
+
+
+@pytest.mark.asyncio
+async def test_discovery_sorting_and_pagination():
+    client = TestClient(app)
+    uid, headers = _register(client, "creator_sort_3")
+
+    w1 = client.post(
+        "/api/worlds/",
+        headers=headers,
+        json={"name": "Sort World 1", "visibility": "public"},
+    ).json()
+    w2 = client.post(
+        "/api/worlds/",
+        headers=headers,
+        json={"name": "Sort World 2", "visibility": "public"},
+    ).json()
+
+    # Record visits on w1 so play_count = 1
+    v_res = client.post(f"/api/discovery/worlds/{w1['id']}/visit")
+    assert v_res.status_code == 200
+
+    # Sort by most_played
+    res_mp = client.get("/api/discovery/worlds?sort=most_played")
+    assert res_mp.status_code == 200
+    items = res_mp.json()["items"]
+    # w1 should come before w2
+    idx_w1 = next(i for i, w in enumerate(items) if w["id"] == w1["id"])
+    idx_w2 = next(i for i, w in enumerate(items) if w["id"] == w2["id"])
+    assert idx_w1 < idx_w2
+
+    # Sort by newest (default)
+    res_new = client.get("/api/discovery/worlds?sort=newest")
+    assert res_new.status_code == 200
+    items_new = res_new.json()["items"]
+    idx_w1_n = next(i for i, w in enumerate(items_new) if w["id"] == w1["id"])
+    idx_w2_n = next(i for i, w in enumerate(items_new) if w["id"] == w2["id"])
+    # w2 was created after w1, so w2 is newer
+    assert idx_w2_n < idx_w1_n
+
+    # Pagination: limit 1, skip 0
+    p1 = client.get("/api/discovery/worlds?limit=1&skip=0")
+    assert p1.status_code == 200
+    assert len(p1.json()["items"]) == 1
+    assert p1.json()["total"] >= 2
+    assert p1.json()["skip"] == 0
+    assert p1.json()["limit"] == 1

backend/tests/test_discovery_models.py

@@ -0,0 +1,149 @@
+"""Model-level integration tests for Discovery metadata and WorldVisit.
+
+docs/planning/discovery.md (task b377353b8167).
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.orm import selectinload
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.user import User
+from app.models.world import World, WorldVisibility
+from app.models.world_visit import WorldVisit
+
+
+def _register(client: TestClient, username: str) -> int:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    headers = {"Authorization": f"Bearer {resp.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+@pytest.mark.asyncio
+async def test_world_discovery_metadata_and_visits():
+    client = TestClient(app)
+    user_id = _register(client, "discoverer_1")
+    visitor_id = _register(client, "visitor_1")
+
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            # 1. Create a world with discovery metadata
+            world = World(
+                name="Cyber Adventure",
+                description="An epic adventure world",
+                owner_id=user_id,
+                visibility=WorldVisibility.PUBLIC,
+                category="Adventure",
+                tags=["cyberpunk", "rpg", "quest"],
+            )
+            session.add(world)
+            await session.commit()
+            await session.refresh(world)
+
+            assert world.id is not None
+            assert world.category == "Adventure"
+            assert world.tags == ["cyberpunk", "rpg", "quest"]
+            assert world.play_count == 0
+            assert world.last_played_at is None
+
+            # 2. Add authenticated visit
+            visit1 = WorldVisit(
+                world_id=world.id,
+                user_id=visitor_id,
+            )
+            # 3. Add anonymous visit
+            visit2 = WorldVisit(
+                world_id=world.id,
+                user_id=None,
+                anonymous_token="anon_token_12345",
+            )
+            session.add_all([visit1, visit2])
+            await session.commit()
+
+            # Query world with visits
+            res = await session.execute(
+                select(World).where(World.id == world.id).options(selectinload(World.visits))
+            )
+            w = res.scalar_one()
+            assert len(w.visits) == 2
+            v_user = next(v for v in w.visits if v.user_id == visitor_id)
+            assert v_user.visited_at is not None
+            v_anon = next(v for v in w.visits if v.user_id is None)
+            assert v_anon.anonymous_token == "anon_token_12345"
+
+        # 4. Verify cascade delete on world
+        async with sf() as session:
+            res = await session.execute(select(World).where(World.id == world.id))
+            w = res.scalar_one()
+            await session.delete(w)
+            await session.commit()
+
+            # Visits should be gone
+            res_v = await session.execute(select(WorldVisit).where(WorldVisit.world_id == world.id))
+            assert len(res_v.scalars().all()) == 0
+
+    finally:
+        await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_user_delete_sets_null_on_world_visits():
+    client = TestClient(app)
+    owner_id = _register(client, "world_owner_2")
+    visitor_id = _register(client, "temp_visitor_2")
+
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            world = World(
+                name="Chill Lobby",
+                owner_id=owner_id,
+                visibility=WorldVisibility.PUBLIC,
+                category="Social",
+                tags=["hangout"],
+            )
+            session.add(world)
+            await session.commit()
+            await session.refresh(world)
+
+            visit = WorldVisit(world_id=world.id, user_id=visitor_id)
+            session.add(visit)
+            await session.commit()
+            await session.refresh(visit)
+            visit_id = visit.id
+
+            # Delete visitor user
+            visitor_user = await session.get(User, visitor_id)
+            await session.delete(visitor_user)
+            await session.commit()
+
+            # In a new session, query from database to see ON DELETE SET NULL effect
+            async with sf() as session:
+                v = await session.get(WorldVisit, visit_id)
+                assert v is not None
+                assert v.user_id is None
+                assert v.world_id == world.id
+
+    finally:
+        await engine.dispose()

backend/tests/test_discovery_trending.py

@@ -0,0 +1,103 @@
+"""API and heuristic tests for trending discovery sort.
+
+docs/planning/discovery.md (task 33706f401ad9).
+"""
+
+from datetime import datetime, timedelta, timezone
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.world_visit import WorldVisit
+
+
+def _register(client: TestClient, username: str) -> tuple[int, dict[str, str]]:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"], headers
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+@pytest.mark.asyncio
+async def test_trending_sort_heuristic_and_zero_visits():
+    client = TestClient(app)
+    uid, headers = _register(client, "creator_trending_1")
+
+    # Create 3 worlds
+    wA = client.post(
+        "/api/worlds/",
+        headers=headers,
+        json={"name": "Trending Hot World", "visibility": "public", "category": "Action"},
+    ).json()
+    wB = client.post(
+        "/api/worlds/",
+        headers=headers,
+        json={"name": "Older Mild World", "visibility": "public", "category": "Action"},
+    ).json()
+    wC = client.post(
+        "/api/worlds/",
+        headers=headers,
+        json={"name": "Zero Visit World", "visibility": "public", "category": "Action"},
+    ).json()
+
+    engine, sf = _session_factory()
+    now = datetime.now(timezone.utc)
+    try:
+        async with sf() as session:
+            # World A: 3 visits within last 2 hours (weight 3 each = score 9)
+            for i in range(3):
+                session.add(
+                    WorldVisit(
+                        world_id=wA["id"],
+                        anonymous_token=f"hot_visitor_{i}",
+                        visited_at=now - timedelta(hours=1, minutes=i),
+                    )
+                )
+            # World B: 1 visit 5 days ago (weight 1 = score 1)
+            session.add(
+                WorldVisit(
+                    world_id=wB["id"],
+                    anonymous_token="old_visitor",
+                    visited_at=now - timedelta(days=5),
+                )
+            )
+            # World C: zero visits
+            await session.commit()
+    finally:
+        await engine.dispose()
+
+    # Query with sort=trending
+    resp = client.get("/api/discovery/worlds?sort=trending&category=Action")
+    assert resp.status_code == 200, resp.text
+    items = resp.json()["items"]
+
+    # Verify order: wA should be first, wB second, wC third
+    ids = [item["id"] for item in items]
+    assert wA["id"] in ids
+    assert wB["id"] in ids
+    assert wC["id"] in ids
+
+    idxA = ids.index(wA["id"])
+    idxB = ids.index(wB["id"])
+    idxC = ids.index(wC["id"])
+
+    assert idxA < idxB < idxC, f"Expected order A ({idxA}) < B ({idxB}) < C ({idxC})"

backend/tests/test_discovery_visit_api.py

@@ -0,0 +1,164 @@
+"""API tests for world visit tracking endpoint.
+
+docs/planning/discovery.md (task 42726e60fe10).
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.world import World, WorldVisibility
+from app.models.world_visit import WorldVisit
+
+
+def _register(client: TestClient, username: str) -> tuple[int, dict[str, str]]:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"], headers
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+@pytest.mark.asyncio
+async def test_visit_world_atomic_increment_authenticated():
+    client = TestClient(app)
+    owner_id, owner_headers = _register(client, "visit_owner_1")
+    visitor_id, visitor_headers = _register(client, "visitor_user_1")
+
+    # Create world
+    resp = client.post(
+        "/api/worlds/",
+        headers=owner_headers,
+        json={"name": "Neon City", "visibility": "public", "category": "Roleplay"},
+    )
+    assert resp.status_code == 201, resp.text
+    world_id = resp.json()["id"]
+
+    # Visitor visits the world
+    v_resp = client.post(
+        f"/api/discovery/worlds/{world_id}/visit",
+        headers=visitor_headers,
+    )
+    assert v_resp.status_code == 200, v_resp.text
+    data = v_resp.json()
+    assert data["play_count"] == 1
+    assert data["last_played_at"] is not None
+
+    # Verify DB state
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            w = (await session.execute(select(World).where(World.id == world_id))).scalar_one()
+            assert w.play_count == 1
+            assert w.last_played_at is not None
+
+            visits = (
+                await session.execute(
+                    select(WorldVisit).where(WorldVisit.world_id == world_id)
+                )
+            ).scalars().all()
+            assert len(visits) == 1
+            assert visits[0].user_id == visitor_id
+    finally:
+        await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_visit_world_anonymous_and_idempotency():
+    client = TestClient(app)
+    owner_id, owner_headers = _register(client, "visit_owner_2")
+
+    resp = client.post(
+        "/api/worlds/",
+        headers=owner_headers,
+        json={"name": "Space Station", "visibility": "public"},
+    )
+    world_id = resp.json()["id"]
+
+    # Anonymous visit with token
+    anon_token = "guest_token_999"
+    v_resp1 = client.post(
+        f"/api/discovery/worlds/{world_id}/visit",
+        json={"anonymous_token": anon_token},
+    )
+    assert v_resp1.status_code == 200, v_resp1.text
+    assert v_resp1.json()["play_count"] == 1
+
+    # Idempotent second call with same anonymous token
+    v_resp2 = client.post(
+        f"/api/discovery/worlds/{world_id}/visit",
+        json={"anonymous_token": anon_token},
+    )
+    assert v_resp2.status_code == 200, v_resp2.text
+    assert v_resp2.json()["play_count"] == 1
+
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            visits = (
+                await session.execute(
+                    select(WorldVisit).where(WorldVisit.world_id == world_id)
+                )
+            ).scalars().all()
+            assert len(visits) == 1
+            assert visits[0].user_id is None
+            assert visits[0].anonymous_token == anon_token
+    finally:
+        await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_visit_world_visibility_and_404():
+    client = TestClient(app)
+    owner_id, owner_headers = _register(client, "visit_owner_3")
+    other_id, other_headers = _register(client, "other_user_3")
+
+    # 404 on non-existent world
+    res_404 = client.post("/api/discovery/worlds/999999/visit", headers=owner_headers)
+    assert res_404.status_code == 404
+
+    # Private world
+    resp = client.post(
+        "/api/worlds/",
+        headers=owner_headers,
+        json={"name": "Secret World", "visibility": "private"},
+    )
+    priv_world_id = resp.json()["id"]
+
+    # Other user gets 404
+    other_res = client.post(
+        f"/api/discovery/worlds/{priv_world_id}/visit",
+        headers=other_headers,
+    )
+    assert other_res.status_code == 404
+
+    # Anonymous user gets 404
+    anon_res = client.post(f"/api/discovery/worlds/{priv_world_id}/visit")
+    assert anon_res.status_code == 404
+
+    # Owner gets 200
+    owner_res = client.post(
+        f"/api/discovery/worlds/{priv_world_id}/visit",
+        headers=owner_headers,
+    )
+    assert owner_res.status_code == 200
+    assert owner_res.json()["play_count"] == 1

backend/tests/test_game_servers.py

@@ -0,0 +1,153 @@
+"""Unit tests for the game_servers.py changes made for world persistence
+(world_persistence_impl.md §7.3/§7.4): per-spawn token validation, and the
+``_await_ready`` replacement for the old, fail-open ``_await_port``.
+
+No real Godot process is spawned here (that stays a manual/checkpoint
+integration test, per test_world_join.py's docstring) -- these exercise
+``GameServerSupervisor`` against a fake process object standing in for
+``subprocess.Popen``.
+"""
+
+import json
+
+import pytest
+
+from app.config import settings
+from app.services.game_servers import GameServerSupervisor, _WorldServer
+
+
+class _FakeProc:
+    """Stands in for subprocess.Popen: only .poll() is needed by the code
+    paths under test here."""
+
+    def __init__(self, exited: bool = False):
+        self._exited = exited
+
+    def poll(self):
+        return 0 if self._exited else None
+
+    def terminate(self):
+        self._exited = True
+
+    def wait(self, timeout=None):
+        return 0
+
+    def kill(self):
+        self._exited = True
+
+
+def _make_srv(tmp_path, token="secret", alive=True) -> _WorldServer:
+    status_path = tmp_path / "status.json"
+    return _WorldServer(
+        world_id="7", port=27000, proc=_FakeProc(exited=not alive),
+        status_path=status_path, token=token,
+    )
+
+
+class TestValidateToken:
+    def test_unknown_world_is_false(self):
+        sup = GameServerSupervisor()
+        assert sup.validate_token("no-such-world", "anything") is False
+
+    def test_correct_token_is_true(self, tmp_path):
+        sup = GameServerSupervisor()
+        sup._servers["7"] = _make_srv(tmp_path, token="secret")
+        assert sup.validate_token("7", "secret") is True
+        # world_id is looked up as str(world_id), so an int works too --
+        # this matters because the FastAPI path param is an int.
+        assert sup.validate_token(7, "secret") is True
+
+    def test_wrong_token_is_false(self, tmp_path):
+        sup = GameServerSupervisor()
+        sup._servers["7"] = _make_srv(tmp_path, token="secret")
+        assert sup.validate_token("7", "wrong") is False
+
+    def test_token_scoped_to_its_own_world_only(self, tmp_path):
+        sup = GameServerSupervisor()
+        sup._servers["7"] = _make_srv(tmp_path, token="secret")
+        # Same token, different world_id -- must not authenticate (§7.3:
+        # "a path whose world_id differs from the token's world is 403").
+        assert sup.validate_token("8", "secret") is False
+
+    def test_dead_server_token_is_false(self, tmp_path):
+        sup = GameServerSupervisor()
+        sup._servers["7"] = _make_srv(tmp_path, token="secret", alive=False)
+        assert sup.validate_token("7", "secret") is False
+
+    def test_reaping_invalidates_the_token(self, tmp_path):
+        """§7.3: "dies with its process" -- once removed from _servers
+        (what the reaper does), the same token no longer validates."""
+        sup = GameServerSupervisor()
+        sup._servers["7"] = _make_srv(tmp_path, token="secret")
+        assert sup.validate_token("7", "secret") is True
+        del sup._servers["7"]
+        assert sup.validate_token("7", "secret") is False
+
+
+class TestAwaitReady:
+    """Replaces the old _await_port, which (a) treated a bound UDP port as
+    readiness even though content loading happens before create_server, and
+    (b) failed open past its deadline with no error at all."""
+
+    async def test_raises_timeout_error_when_never_ready(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(settings, "GAME_SERVER_READY_TIMEOUT_SECONDS", 0.3)
+        sup = GameServerSupervisor()
+        srv = _make_srv(tmp_path)  # status file never written
+        with pytest.raises(TimeoutError):
+            await sup._await_ready(srv)
+
+    async def test_returns_once_status_file_reports_ready(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(settings, "GAME_SERVER_READY_TIMEOUT_SECONDS", 5.0)
+        sup = GameServerSupervisor()
+        srv = _make_srv(tmp_path)
+        srv.status_path.write_text(json.dumps({"ready": True, "players": 0}))
+        await sup._await_ready(srv)  # must not raise / must not hang
+
+    async def test_ready_false_is_not_ready(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(settings, "GAME_SERVER_READY_TIMEOUT_SECONDS", 0.3)
+        sup = GameServerSupervisor()
+        srv = _make_srv(tmp_path)
+        srv.status_path.write_text(json.dumps({"ready": False, "players": 0}))
+        with pytest.raises(TimeoutError):
+            await sup._await_ready(srv)
+
+    async def test_raises_promptly_if_process_already_exited(self, tmp_path, monkeypatch):
+        # A long deadline, but the process is already dead -- must not wait
+        # out the full deadline (this is the "no crash restart mid-wait"
+        # case: don't silently poll a corpse for 20s).
+        monkeypatch.setattr(settings, "GAME_SERVER_READY_TIMEOUT_SECONDS", 20.0)
+        sup = GameServerSupervisor()
+        srv = _make_srv(tmp_path, alive=False)
+        with pytest.raises(TimeoutError):
+            await sup._await_ready(srv)
+
+
+class TestSpawnCommandLine:
+    def test_spawn_includes_api_url_and_server_token(self, monkeypatch, tmp_path):
+        """world_persistence_impl.md §7.2 step 1 / §7.4: `_spawn` must pass
+        --api-url and --server-token on the command line."""
+        sup = GameServerSupervisor()
+        monkeypatch.setattr(sup, "_free_port", lambda: 27050)
+
+        captured = {}
+
+        class _Proc:
+            def poll(self):
+                return None
+
+        def _fake_popen(cmd, **kwargs):
+            captured["cmd"] = cmd
+            return _Proc()
+
+        monkeypatch.setattr(
+            "app.services.game_servers.subprocess.Popen", _fake_popen
+        )
+        srv = sup._spawn("42")
+
+        cmd = captured["cmd"]
+        assert "--api-url" in cmd
+        assert cmd[cmd.index("--api-url") + 1] == settings.GAME_SERVER_INTERNAL_API_URL
+        assert "--server-token" in cmd
+        token_in_cmd = cmd[cmd.index("--server-token") + 1]
+        assert token_in_cmd == srv.token
+        assert len(srv.token) > 20  # secrets.token_urlsafe(32) -- not a short/guessable value

backend/tests/test_group_models.py

@@ -0,0 +1,258 @@
+"""Model-level tests for groups: groups and group_members.
+
+app/models/groups.py / alembic/versions/0009_add_group_tables.py
+(docs/planning/social.md US-5). This is the models+migration task only --
+there are no API endpoints yet (a sibling task, "Groups API", owns
+create/join/leave/role authorization and the group page endpoint), so these
+tests exercise the ORM models and the real Postgres constraints directly
+rather than going through HTTP.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import delete, select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.groups import Group, GroupMember, GroupRole
+from app.models.user import User
+
+
+def _register(client: TestClient, username: str) -> int:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    headers = {"Authorization": f"Bearer {resp.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+class TestGroupCreationAndRoles:
+    async def test_create_group_with_members_of_different_roles(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_role_owner")
+        admin = _register(client, "grp_role_admin")
+        member = _register(client, "grp_role_member")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="Explorers", description="We explore worlds", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add_all(
+                    [
+                        GroupMember(group_id=group.id, user_id=owner, role=GroupRole.OWNER),
+                        GroupMember(group_id=group.id, user_id=admin, role=GroupRole.ADMIN),
+                        GroupMember(group_id=group.id, user_id=member, role=GroupRole.MEMBER),
+                    ]
+                )
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                fetched = await session.get(Group, group_id)
+                members = (
+                    await session.execute(
+                        select(GroupMember).where(GroupMember.group_id == group_id)
+                    )
+                ).scalars().all()
+                by_user = {m.user_id: m.role for m in members}
+                assert fetched.owner_id == owner
+                assert len(members) == 3
+                assert by_user[owner] == GroupRole.OWNER
+                assert by_user[admin] == GroupRole.ADMIN
+                assert by_user[member] == GroupRole.MEMBER
+        finally:
+            await engine.dispose()
+
+    async def test_membership_role_defaults_to_member(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_default_owner")
+        joiner = _register(client, "grp_default_joiner")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="Defaults", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add(GroupMember(group_id=group.id, user_id=joiner))
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                gm = (
+                    await session.execute(
+                        select(GroupMember).where(
+                            GroupMember.group_id == group_id, GroupMember.user_id == joiner
+                        )
+                    )
+                ).scalar_one()
+                assert gm.role == GroupRole.MEMBER
+        finally:
+            await engine.dispose()
+
+
+class TestUniqueMembershipConstraint:
+    async def test_duplicate_membership_rejected(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_uq_owner")
+        member = _register(client, "grp_uq_member")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="Uniqueness", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add(GroupMember(group_id=group.id, user_id=member))
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                session.add(GroupMember(group_id=group_id, user_id=member))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+
+class TestCascadeDelete:
+    async def test_deleting_group_deletes_members(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_cd_group_owner")
+        member = _register(client, "grp_cd_group_member")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="To Delete", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add_all(
+                    [
+                        GroupMember(group_id=group.id, user_id=owner, role=GroupRole.OWNER),
+                        GroupMember(group_id=group.id, user_id=member),
+                    ]
+                )
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                # Core delete against groups directly, so the real ON DELETE
+                # CASCADE does the work (not the ORM).
+                await session.execute(delete(Group).where(Group.id == group_id))
+                await session.commit()
+
+            async with factory() as session:
+                members = (
+                    await session.execute(
+                        select(GroupMember).where(GroupMember.group_id == group_id)
+                    )
+                ).scalars().all()
+                assert members == []
+        finally:
+            await engine.dispose()
+
+    async def test_deleting_member_user_removes_only_their_membership(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_cd_user_owner")
+        member = _register(client, "grp_cd_user_member")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="Membership Cascade", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add_all(
+                    [
+                        GroupMember(group_id=group.id, user_id=owner, role=GroupRole.OWNER),
+                        GroupMember(group_id=group.id, user_id=member),
+                    ]
+                )
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                await session.execute(delete(User).where(User.id == member))
+                await session.commit()
+
+            async with factory() as session:
+                remaining = (
+                    await session.execute(
+                        select(GroupMember).where(GroupMember.group_id == group_id)
+                    )
+                ).scalars().all()
+                # Only the deleted member's row is gone; the group and the
+                # owner's membership survive.
+                assert len(remaining) == 1
+                assert remaining[0].user_id == owner
+
+                group = await session.get(Group, group_id)
+                assert group is not None
+                assert group.owner_id == owner
+        finally:
+            await engine.dispose()
+
+    async def test_deleting_owner_survives_with_owner_id_null(self):
+        """Deleting the owner's account must not delete the group or its
+        other members -- only ``owner_id`` is nulled out (SET NULL), per the
+        module docstring in app/models/groups.py."""
+        client = TestClient(app)
+        owner = _register(client, "grp_cd_owner_owner")
+        member = _register(client, "grp_cd_owner_member")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                group = Group(name="Survives Owner Deletion", owner_id=owner)
+                session.add(group)
+                await session.flush()
+                session.add_all(
+                    [
+                        GroupMember(group_id=group.id, user_id=owner, role=GroupRole.OWNER),
+                        GroupMember(group_id=group.id, user_id=member),
+                    ]
+                )
+                await session.commit()
+                group_id = group.id
+
+            async with factory() as session:
+                await session.execute(delete(User).where(User.id == owner))
+                await session.commit()
+
+            async with factory() as session:
+                group = await session.get(Group, group_id)
+                assert group is not None
+                assert group.owner_id is None
+                assert group.name == "Survives Owner Deletion"
+
+                # The owner's own membership row is gone (user_id CASCADE),
+                # but the other member's row survives untouched.
+                members = (
+                    await session.execute(
+                        select(GroupMember).where(GroupMember.group_id == group_id)
+                    )
+                ).scalars().all()
+                assert len(members) == 1
+                assert members[0].user_id == member
+        finally:
+            await engine.dispose()

backend/tests/test_groups_api.py

@@ -0,0 +1,437 @@
+"""Integration tests for the Groups API router (app/routers/groups.py).
+
+app/models/groups.py owns the schema (see test_group_models.py); this
+covers create/join/leave, role authorization, ownership transfer, and the
+group page's member-list privacy.
+"""
+
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+def _register(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return {"headers": headers, "id": me.json()["id"], "username": username}
+
+
+def _create_group(client: TestClient, headers: dict, name: str, description: str | None = None) -> dict:
+    resp = client.post(
+        "/api/groups",
+        json={"name": name, "description": description},
+        headers=headers,
+    )
+    assert resp.status_code == 201, resp.text
+    return resp.json()
+
+
+class TestCreateGroup:
+    def test_create_makes_creator_owner(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_create_owner")
+
+        group = _create_group(client, owner["headers"], "Explorers", "We explore worlds")
+        assert group["name"] == "Explorers"
+        assert group["description"] == "We explore worlds"
+        assert group["owner_id"] == owner["id"]
+        assert group["member_count"] == 1
+        assert len(group["members"]) == 1
+        assert group["members"][0]["user_id"] == owner["id"]
+        assert group["members"][0]["role"] == "owner"
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        resp = client.post("/api/groups", json={"name": "No Auth"})
+        assert resp.status_code == 401
+
+    def test_blank_name_rejected(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_blank_name")
+        resp = client.post("/api/groups", json={"name": "   "}, headers=owner["headers"])
+        assert resp.status_code == 422
+
+    def test_name_over_max_length_rejected(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_long_name")
+        resp = client.post(
+            "/api/groups", json={"name": "x" * 101}, headers=owner["headers"]
+        )
+        assert resp.status_code == 422
+
+
+class TestGroupPage:
+    def test_get_group_page_shows_members_and_roles_no_private_fields(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_page_owner")
+        member = _register(client, "grp_api_page_member")
+
+        group = _create_group(client, owner["headers"], "Page Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.get(f"/api/groups/{group['id']}", headers=member["headers"])
+        assert resp.status_code == 200, resp.text
+        body = resp.json()
+        assert body["name"] == "Page Group"
+        assert body["member_count"] == 2
+        by_user = {m["user_id"]: m for m in body["members"]}
+        assert by_user[owner["id"]]["role"] == "owner"
+        assert by_user[member["id"]]["role"] == "member"
+        assert by_user[member["id"]]["username"] == member["username"]
+
+        # No private User fields (email, hashed_password, etc.) leak.
+        for m in body["members"]:
+            assert set(m.keys()) == {"user_id", "username", "role", "joined_at"}
+
+    def test_get_nonexistent_group_is_404(self):
+        client = TestClient(app)
+        user = _register(client, "grp_api_404")
+        resp = client.get("/api/groups/999999999", headers=user["headers"])
+        assert resp.status_code == 404
+
+
+class TestJoinLeave:
+    def test_join_is_idempotent(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_join_owner")
+        joiner = _register(client, "grp_api_join_joiner")
+        group = _create_group(client, owner["headers"], "Join Group")
+
+        r1 = client.post(f"/api/groups/{group['id']}/join", headers=joiner["headers"])
+        assert r1.status_code == 200, r1.text
+        r2 = client.post(f"/api/groups/{group['id']}/join", headers=joiner["headers"])
+        assert r2.status_code == 200, r2.text
+        assert r1.json()["role"] == r2.json()["role"] == "member"
+
+        page = client.get(f"/api/groups/{group['id']}", headers=owner["headers"]).json()
+        assert page["member_count"] == 2  # not 3 -- duplicate join didn't add a row
+
+    def test_leave_removes_membership(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_leave_owner")
+        member = _register(client, "grp_api_leave_member")
+        group = _create_group(client, owner["headers"], "Leave Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.post(f"/api/groups/{group['id']}/leave", headers=member["headers"])
+        assert resp.status_code == 200, resp.text
+
+        page = client.get(f"/api/groups/{group['id']}", headers=owner["headers"]).json()
+        assert page["member_count"] == 1
+        assert all(m["user_id"] != member["id"] for m in page["members"])
+
+    def test_owner_cannot_leave_without_transfer(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_owner_leave")
+        group = _create_group(client, owner["headers"], "Owner Leave Group")
+
+        resp = client.post(f"/api/groups/{group['id']}/leave", headers=owner["headers"])
+        assert resp.status_code == 409, resp.text
+
+    def test_leave_when_not_a_member_is_404(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_notmember_owner")
+        stranger = _register(client, "grp_api_notmember_stranger")
+        group = _create_group(client, owner["headers"], "Not A Member Group")
+
+        resp = client.post(f"/api/groups/{group['id']}/leave", headers=stranger["headers"])
+        assert resp.status_code == 404
+
+
+class TestRoleAuthorization:
+    def test_owner_can_promote_and_demote(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_role_owner")
+        member = _register(client, "grp_api_role_member")
+        group = _create_group(client, owner["headers"], "Role Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        promote = client.post(
+            f"/api/groups/{group['id']}/members/{member['id']}/role",
+            json={"role": "admin"},
+            headers=owner["headers"],
+        )
+        assert promote.status_code == 200, promote.text
+        assert promote.json()["role"] == "admin"
+
+        demote = client.post(
+            f"/api/groups/{group['id']}/members/{member['id']}/role",
+            json={"role": "member"},
+            headers=owner["headers"],
+        )
+        assert demote.status_code == 200, demote.text
+        assert demote.json()["role"] == "member"
+
+    def test_plain_member_cannot_promote(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_noauth_owner")
+        member = _register(client, "grp_api_noauth_member")
+        other = _register(client, "grp_api_noauth_other")
+        group = _create_group(client, owner["headers"], "No Auth Promote Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+        client.post(f"/api/groups/{group['id']}/join", headers=other["headers"])
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/members/{other['id']}/role",
+            json={"role": "admin"},
+            headers=member["headers"],
+        )
+        assert resp.status_code == 403
+
+    def test_admin_cannot_promote_or_demote(self):
+        """Only the owner may change roles -- admins cannot, per spec."""
+        client = TestClient(app)
+        owner = _register(client, "grp_api_adminauth_owner")
+        admin = _register(client, "grp_api_adminauth_admin")
+        other = _register(client, "grp_api_adminauth_other")
+        group = _create_group(client, owner["headers"], "Admin Cannot Promote Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=admin["headers"])
+        client.post(f"/api/groups/{group['id']}/join", headers=other["headers"])
+        client.post(
+            f"/api/groups/{group['id']}/members/{admin['id']}/role",
+            json={"role": "admin"},
+            headers=owner["headers"],
+        )
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/members/{other['id']}/role",
+            json={"role": "admin"},
+            headers=admin["headers"],
+        )
+        assert resp.status_code == 403
+
+    def test_plain_member_cannot_delete_group(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_nodelete_owner")
+        member = _register(client, "grp_api_nodelete_member")
+        group = _create_group(client, owner["headers"], "No Delete Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.delete(f"/api/groups/{group['id']}", headers=member["headers"])
+        assert resp.status_code == 403
+
+    def test_admin_cannot_delete_group(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_admindelete_owner")
+        admin = _register(client, "grp_api_admindelete_admin")
+        group = _create_group(client, owner["headers"], "Admin No Delete Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=admin["headers"])
+        client.post(
+            f"/api/groups/{group['id']}/members/{admin['id']}/role",
+            json={"role": "admin"},
+            headers=owner["headers"],
+        )
+
+        resp = client.delete(f"/api/groups/{group['id']}", headers=admin["headers"])
+        assert resp.status_code == 403
+
+    def test_plain_member_cannot_transfer_ownership(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_notransfer_owner")
+        member = _register(client, "grp_api_notransfer_member")
+        group = _create_group(client, owner["headers"], "No Transfer Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/transfer",
+            json={"new_owner_id": member["id"]},
+            headers=member["headers"],
+        )
+        assert resp.status_code == 403
+
+    def test_cannot_set_role_to_owner_via_role_endpoint(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_noownerrole_owner")
+        member = _register(client, "grp_api_noownerrole_member")
+        group = _create_group(client, owner["headers"], "No Owner Role Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/members/{member['id']}/role",
+            json={"role": "owner"},
+            headers=owner["headers"],
+        )
+        assert resp.status_code == 422
+
+
+class TestOwnershipTransfer:
+    def test_transfer_moves_ownership_and_demotes_old_owner(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_xfer_owner")
+        member = _register(client, "grp_api_xfer_member")
+        group = _create_group(client, owner["headers"], "Transfer Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/transfer",
+            json={"new_owner_id": member["id"]},
+            headers=owner["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+        body = resp.json()
+        assert body["owner_id"] == member["id"]
+        by_user = {m["user_id"]: m for m in body["members"]}
+        assert by_user[member["id"]]["role"] == "owner"
+        assert by_user[owner["id"]]["role"] == "admin"
+
+        # Exactly one owner remains.
+        owners = [m for m in body["members"] if m["role"] == "owner"]
+        assert len(owners) == 1
+
+        # Old owner can now leave (no longer the owner).
+        leave = client.post(f"/api/groups/{group['id']}/leave", headers=owner["headers"])
+        assert leave.status_code == 200, leave.text
+
+        # New owner cannot leave without transferring again.
+        leave2 = client.post(f"/api/groups/{group['id']}/leave", headers=member["headers"])
+        assert leave2.status_code == 409
+
+    def test_transfer_target_must_be_a_member(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_xfernonmember_owner")
+        stranger = _register(client, "grp_api_xfernonmember_stranger")
+        group = _create_group(client, owner["headers"], "Transfer Nonmember Group")
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/transfer",
+            json={"new_owner_id": stranger["id"]},
+            headers=owner["headers"],
+        )
+        assert resp.status_code == 404
+
+    def test_transfer_to_self_rejected(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_xferself_owner")
+        group = _create_group(client, owner["headers"], "Transfer Self Group")
+
+        resp = client.post(
+            f"/api/groups/{group['id']}/transfer",
+            json={"new_owner_id": owner["id"]},
+            headers=owner["headers"],
+        )
+        assert resp.status_code == 400
+
+
+class TestUpdateGroup:
+    def test_owner_can_update_name_and_description(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_update_owner")
+        group = _create_group(client, owner["headers"], "Old Name", "Old desc")
+
+        resp = client.patch(
+            f"/api/groups/{group['id']}",
+            json={"name": "New Name", "description": "New desc"},
+            headers=owner["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+        assert resp.json()["name"] == "New Name"
+        assert resp.json()["description"] == "New desc"
+
+    def test_admin_can_update(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_adminupdate_owner")
+        admin = _register(client, "grp_api_adminupdate_admin")
+        group = _create_group(client, owner["headers"], "Admin Update Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=admin["headers"])
+        client.post(
+            f"/api/groups/{group['id']}/members/{admin['id']}/role",
+            json={"role": "admin"},
+            headers=owner["headers"],
+        )
+
+        resp = client.patch(
+            f"/api/groups/{group['id']}",
+            json={"name": "Updated By Admin"},
+            headers=admin["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+        assert resp.json()["name"] == "Updated By Admin"
+
+    def test_plain_member_cannot_update(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_noupdate_owner")
+        member = _register(client, "grp_api_noupdate_member")
+        group = _create_group(client, owner["headers"], "No Update Group")
+        client.post(f"/api/groups/{group['id']}/join", headers=member["headers"])
+
+        resp = client.patch(
+            f"/api/groups/{group['id']}",
+            json={"name": "Hacked Name"},
+            headers=member["headers"],
+        )
+        assert resp.status_code == 403
+
+    def test_non_member_cannot_update(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_strangernoupdate_owner")
+        stranger = _register(client, "grp_api_strangernoupdate_stranger")
+        group = _create_group(client, owner["headers"], "Stranger No Update Group")
+
+        resp = client.patch(
+            f"/api/groups/{group['id']}",
+            json={"name": "Hacked Name"},
+            headers=stranger["headers"],
+        )
+        assert resp.status_code == 403
+
+
+class TestDeleteGroup:
+    def test_owner_can_delete(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_delete_owner")
+        group = _create_group(client, owner["headers"], "Delete Group")
+
+        resp = client.delete(f"/api/groups/{group['id']}", headers=owner["headers"])
+        assert resp.status_code == 204, resp.text
+
+        after = client.get(f"/api/groups/{group['id']}", headers=owner["headers"])
+        assert after.status_code == 404
+
+
+class TestListGroups:
+    def test_list_all_groups_paginated(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_list_owner")
+        _create_group(client, owner["headers"], "List Group A")
+        _create_group(client, owner["headers"], "List Group B")
+
+        resp = client.get("/api/groups", params={"limit": 1}, headers=owner["headers"])
+        assert resp.status_code == 200, resp.text
+        body = resp.json()
+        assert len(body["groups"]) == 1
+        assert body["total"] >= 2
+
+    def test_list_mine_only_returns_own_groups(self):
+        client = TestClient(app)
+        owner = _register(client, "grp_api_listmine_owner")
+        other_owner = _register(client, "grp_api_listmine_other")
+        mine = _create_group(client, owner["headers"], "Mine Group")
+        _create_group(client, other_owner["headers"], "Not Mine Group")
+
+        resp = client.get("/api/groups", params={"mine": True}, headers=owner["headers"])
+        assert resp.status_code == 200, resp.text
+        ids = [g["id"] for g in resp.json()["groups"]]
+        assert mine["id"] in ids
+        assert all(
+            g["id"] != mine["id"] or g["owner_id"] == owner["id"]
+            for g in resp.json()["groups"]
+        )
+        # The other owner's group must not appear.
+        other_group_ids = [
+            g["id"] for g in client.get(
+                "/api/groups", params={"mine": True}, headers=other_owner["headers"]
+            ).json()["groups"]
+        ]
+        assert mine["id"] not in other_group_ids

backend/tests/test_marketplace_api.py

@@ -0,0 +1,167 @@
+"""Integration tests for Marketplace Listings API.
+
+docs/planning/economy.md US-3 (task f51c7d95e237).
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+def _register(client: TestClient, username: str) -> tuple[int, dict[str, str]]:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"], headers
+
+
+def test_catalog_items_and_listings_crud():
+    client = TestClient(app)
+    uid1, h1 = _register(client, "mkt_user_1")
+    uid2, h2 = _register(client, "mkt_user_2")
+
+    # 1. Create catalog item by user 1
+    resp = client.post(
+        "/api/marketplace/items",
+        headers=h1,
+        json={
+            "name": "Wizard Hat",
+            "description": "A pointy blue hat with stars",
+            "item_type": "avatar_item",
+            "metadata_json": {"color": "blue", "rarity": "rare"},
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    item_data = resp.json()
+    assert item_data["name"] == "Wizard Hat"
+    assert item_data["owner_id"] == uid1
+    item_id = item_data["id"]
+
+    # 2. List catalog items
+    resp = client.get("/api/marketplace/items", headers=h1, params={"mine": "true"})
+    assert resp.status_code == 200
+    my_items = resp.json()
+    assert len(my_items) >= 1
+    assert any(i["id"] == item_id for i in my_items)
+
+    resp = client.get("/api/marketplace/items", headers=h2, params={"mine": "true"})
+    assert resp.status_code == 200
+    assert not any(i["id"] == item_id for i in resp.json())
+
+    # 3. User 2 tries to list User 1's item -> 403
+    resp = client.post(
+        "/api/marketplace/listings",
+        headers=h2,
+        json={
+            "catalog_item_id": item_id,
+            "price": 100,
+        },
+    )
+    assert resp.status_code == 403, resp.text
+
+    # Invalid price <= 0 -> 422
+    resp = client.post(
+        "/api/marketplace/listings",
+        headers=h1,
+        json={
+            "catalog_item_id": item_id,
+            "price": 0,
+        },
+    )
+    assert resp.status_code == 422
+
+    # 4. User 1 successfully lists item
+    resp = client.post(
+        "/api/marketplace/listings",
+        headers=h1,
+        json={
+            "catalog_item_id": item_id,
+            "price": 250,
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    listing = resp.json()
+    assert listing["price"] == 250
+    assert listing["seller_id"] == uid1
+    assert listing["status"] == "active"
+    assert listing["catalog_item"]["name"] == "Wizard Hat"
+    listing_id = listing["id"]
+
+    # 5. Search / browse listings
+    resp = client.get("/api/marketplace/listings", params={"q": "Wizard"})
+    assert resp.status_code == 200, resp.text
+    data = resp.json()
+    assert data["total"] >= 1
+    assert any(l["id"] == listing_id for l in data["listings"])
+
+    # Filter by item_type
+    resp = client.get("/api/marketplace/listings", params={"item_type": "avatar_item"})
+    assert resp.status_code == 200
+    assert any(l["id"] == listing_id for l in resp.json()["listings"])
+
+    resp = client.get("/api/marketplace/listings", params={"item_type": "experience_pass"})
+    assert resp.status_code == 200
+    assert not any(l["id"] == listing_id for l in resp.json()["listings"])
+
+    # Price range filter
+    resp = client.get("/api/marketplace/listings", params={"min_price": 300})
+    assert resp.status_code == 200
+    assert not any(l["id"] == listing_id for l in resp.json()["listings"])
+
+    resp = client.get("/api/marketplace/listings", params={"max_price": 260})
+    assert resp.status_code == 200
+    assert any(l["id"] == listing_id for l in resp.json()["listings"])
+
+    # 6. Listing detail
+    resp = client.get(f"/api/marketplace/listings/{listing_id}")
+    assert resp.status_code == 200
+    assert resp.json()["id"] == listing_id
+
+    # 7. Update listing
+    # User 2 cannot update User 1's listing
+    resp = client.patch(
+        f"/api/marketplace/listings/{listing_id}",
+        headers=h2,
+        json={"price": 500},
+    )
+    assert resp.status_code == 403
+
+    # User 1 updates price
+    resp = client.patch(
+        f"/api/marketplace/listings/{listing_id}",
+        headers=h1,
+        json={"price": 350},
+    )
+    assert resp.status_code == 200
+    assert resp.json()["price"] == 350
+
+    # 8. Delist listing
+    # User 2 cannot delist
+    resp = client.delete(f"/api/marketplace/listings/{listing_id}", headers=h2)
+    assert resp.status_code == 403
+
+    # User 1 delists
+    resp = client.delete(f"/api/marketplace/listings/{listing_id}", headers=h1)
+    assert resp.status_code == 204
+
+    # Now detail shows delisted
+    resp = client.get(f"/api/marketplace/listings/{listing_id}")
+    assert resp.status_code == 200
+    assert resp.json()["status"] == "delisted"
+
+    # Default search only shows active
+    resp = client.get("/api/marketplace/listings")
+    assert resp.status_code == 200
+    assert not any(l["id"] == listing_id for l in resp.json()["listings"])

backend/tests/test_marketplace_models.py

@@ -0,0 +1,175 @@
+"""Model-level integration tests for Marketplace tables.
+
+docs/planning/economy.md US-3, US-4 (task 166836d55365).
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.marketplace import (
+    CatalogItem,
+    CreatorBalance,
+    ItemType,
+    ListingStatus,
+    MarketplaceListing,
+    Purchase,
+    PurchaseStatus,
+)
+
+
+def _register(client: TestClient, username: str) -> int:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    headers = {"Authorization": f"Bearer {resp.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+@pytest.mark.asyncio
+async def test_catalog_item_and_listing_creation():
+    client = TestClient(app)
+    seller_id = _register(client, "market_seller_1")
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            item = CatalogItem(
+                owner_id=seller_id,
+                item_type=ItemType.avatar_item,
+                name="Cyber Wings",
+                description="Glow in the dark wings",
+                metadata_json={"slot": "back"},
+            )
+            session.add(item)
+            await session.commit()
+            await session.refresh(item)
+
+            assert item.id is not None
+            assert item.name == "Cyber Wings"
+
+            listing = MarketplaceListing(
+                catalog_item_id=item.id,
+                seller_id=seller_id,
+                price=250,
+                status=ListingStatus.active,
+            )
+            session.add(listing)
+            await session.commit()
+            await session.refresh(listing)
+
+            assert listing.id is not None
+            assert listing.price == 250
+            assert listing.status == ListingStatus.active
+    finally:
+        await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_listing_price_positive_constraint():
+    client = TestClient(app)
+    seller_id = _register(client, "market_seller_2")
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            item = CatalogItem(
+                owner_id=seller_id,
+                item_type=ItemType.asset,
+                name="Free Prop",
+            )
+            session.add(item)
+            await session.commit()
+            await session.refresh(item)
+
+            bad_listing = MarketplaceListing(
+                catalog_item_id=item.id,
+                seller_id=seller_id,
+                price=0,  # Must be > 0
+            )
+            session.add(bad_listing)
+            with pytest.raises(IntegrityError):
+                await session.commit()
+    finally:
+        await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_creator_balance_uniqueness_and_constraints():
+    client = TestClient(app)
+    creator_id = _register(client, "market_creator_1")
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            cb1 = CreatorBalance(user_id=creator_id, available=100, pending=50, lifetime_earned=150)
+            session.add(cb1)
+            await session.commit()
+            await session.refresh(cb1)
+
+            assert cb1.available == 100
+            assert cb1.pending == 50
+            assert cb1.lifetime_earned == 150
+
+        # Unique user_id constraint
+        async with sf() as session:
+            cb2 = CreatorBalance(user_id=creator_id)
+            session.add(cb2)
+            with pytest.raises(IntegrityError):
+                await session.commit()
+    finally:
+        await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_purchase_record_creation():
+    client = TestClient(app)
+    seller_id = _register(client, "market_seller_3")
+    buyer_id = _register(client, "market_buyer_3")
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            item = CatalogItem(owner_id=seller_id, item_type=ItemType.asset, name="Sword Prop")
+            session.add(item)
+            await session.commit()
+            await session.refresh(item)
+
+            listing = MarketplaceListing(catalog_item_id=item.id, seller_id=seller_id, price=100)
+            session.add(listing)
+            await session.commit()
+            await session.refresh(listing)
+
+            purchase = Purchase(
+                listing_id=listing.id,
+                buyer_id=buyer_id,
+                seller_id=seller_id,
+                price=100,
+                platform_fee=30,
+                seller_net=70,
+                status=PurchaseStatus.pending_escrow,
+            )
+            session.add(purchase)
+            await session.commit()
+            await session.refresh(purchase)
+
+            assert purchase.id is not None
+            assert purchase.seller_net == 70
+            assert purchase.status == PurchaseStatus.pending_escrow
+    finally:
+        await engine.dispose()

backend/tests/test_marketplace_moderation.py

@@ -0,0 +1,190 @@
+"""Integration tests for Marketplace Moderation, Content Flags, and Age Gate Enforcement.
+
+docs/planning/economy.md US-3, Task 9 (task 4ba24a178c1b).
+"""
+
+from datetime import date
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+def _register(
+    client: TestClient, username: str, dob: str = "1990-01-01"
+) -> tuple[int, dict[str, str]]:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": dob,
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"], headers
+
+
+async def _set_user_dob(user_id: int, dob: date):
+    from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+    from sqlalchemy.pool import NullPool
+    from app.config import settings
+    from app.models.user import User
+
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    session_factory = async_sessionmaker(engine, expire_on_commit=False)
+    async with session_factory() as session:
+        user = await session.get(User, user_id)
+        assert user is not None
+        user.date_of_birth = dob
+        await session.commit()
+    await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_marketplace_age_gate_enforcement():
+    client = TestClient(app)
+    seller_id, seller_headers = _register(client, "mature_seller_1")
+    # Register minor and set DOB in DB to 2015
+    minor_id, minor_headers = _register(client, "minor_buyer_1")
+    await _set_user_dob(minor_id, date(2015, 6, 1))
+
+    # Adult user
+    adult_id, adult_headers = _register(client, "adult_buyer_1")
+
+    # Fund minor and adult with 500 Credits
+    for h in (minor_headers, adult_headers):
+        s_resp = client.post("/api/payments/purchase", headers=h, json={"credits": 500})
+        client.post("/api/payments/confirm", headers=h, json={"session_id": s_resp.json()["session_id"]})
+
+    # Seller creates mature item
+    item_resp = client.post(
+        "/api/marketplace/items",
+        headers=seller_headers,
+        json={
+            "name": "Blood Sword",
+            "item_type": "avatar_item",
+            "metadata_json": {"is_mature": True, "content_flags": ["violence.gore"]},
+        },
+    )
+    assert item_resp.status_code == 201
+    item_id = item_resp.json()["id"]
+
+    list_resp = client.post(
+        "/api/marketplace/listings",
+        headers=seller_headers,
+        json={"catalog_item_id": item_id, "price": 100},
+    )
+    assert list_resp.status_code == 201
+    listing_id = list_resp.json()["id"]
+
+    # 1. Minor attempts to purchase mature item -> 403 Forbidden
+    minor_buy = client.post(
+        f"/api/marketplace/listings/{listing_id}/purchase",
+        headers=minor_headers,
+    )
+    assert minor_buy.status_code == 403
+    assert "MATURE_CONTENT_REQUIRES_VERIFICATION" in minor_buy.text
+
+    # 2. Adult purchases mature item -> 201 Created
+    adult_buy = client.post(
+        f"/api/marketplace/listings/{listing_id}/purchase",
+        headers=adult_headers,
+    )
+    assert adult_buy.status_code == 201, adult_buy.text
+    assert adult_buy.json()["status"] == "pending_escrow"
+
+
+def test_moderator_delist_remove_and_reversal():
+    client = TestClient(app)
+    mod_id, mod_headers = _register(client, "admin_mkt_mod_1", dob="1980-01-01")
+    seller_id, seller_headers = _register(client, "seller_mod_test", dob="1990-01-01")
+    buyer_id, buyer_headers = _register(client, "buyer_mod_test", dob="1990-01-01")
+
+    # Fund buyer
+    s_resp = client.post("/api/payments/purchase", headers=buyer_headers, json={"credits": 500})
+    client.post("/api/payments/confirm", headers=buyer_headers, json={"session_id": s_resp.json()["session_id"]})
+
+    # Create listing 1
+    i1 = client.post(
+        "/api/marketplace/items",
+        headers=seller_headers,
+        json={"name": "Violating Item", "item_type": "avatar_item"},
+    ).json()
+    l1 = client.post(
+        "/api/marketplace/listings",
+        headers=seller_headers,
+        json={"catalog_item_id": i1["id"], "price": 100},
+    ).json()
+    l1_id = l1["id"]
+
+    # Non-moderator cannot moderate listing -> 403
+    unauth = client.post(
+        f"/api/marketplace/listings/{l1_id}/moderate",
+        headers=buyer_headers,
+        json={"action": "remove", "reason": "Copyright infringement"},
+    )
+    assert unauth.status_code == 403
+
+    # Moderator removes listing
+    mod_resp = client.post(
+        f"/api/marketplace/listings/{l1_id}/moderate",
+        headers=mod_headers,
+        json={"action": "remove", "reason": "Copyright infringement"},
+    )
+    assert mod_resp.status_code == 200, mod_resp.text
+    assert mod_resp.json()["status"] == "removed_by_moderation"
+
+    # Removed listing cannot be purchased
+    buy_fail = client.post(
+        f"/api/marketplace/listings/{l1_id}/purchase",
+        headers=buyer_headers,
+    )
+    assert buy_fail.status_code == 400
+
+    # Create listing 2 and purchase it
+    i2 = client.post(
+        "/api/marketplace/items",
+        headers=seller_headers,
+        json={"name": "Contested Item", "item_type": "avatar_item"},
+    ).json()
+    l2 = client.post(
+        "/api/marketplace/listings",
+        headers=seller_headers,
+        json={"catalog_item_id": i2["id"], "price": 150},
+    ).json()
+    p2 = client.post(
+        f"/api/marketplace/listings/{l2['id']}/purchase",
+        headers=buyer_headers,
+    ).json()
+    p2_id = p2["id"]
+
+    # Buyer balance is 350
+    w = client.get("/api/wallet", headers=buyer_headers).json()
+    assert w["balance"] == 350
+
+    # Non-moderator cannot reverse purchase -> 403
+    unauth_rev = client.post(
+        f"/api/marketplace/purchases/{p2_id}/reverse",
+        headers=buyer_headers,
+        json={"reason": "Buyer regret"},
+    )
+    assert unauth_rev.status_code == 403
+
+    # Moderator reverses purchase
+    rev_resp = client.post(
+        f"/api/marketplace/purchases/{p2_id}/reverse",
+        headers=mod_headers,
+        json={"reason": "Fraudulent listing detected"},
+    )
+    assert rev_resp.status_code == 200, rev_resp.text
+    assert rev_resp.json()["status"] == "reversed"
+
+    # Buyer balance restored to 500
+    w_after = client.get("/api/wallet", headers=buyer_headers).json()
+    assert w_after["balance"] == 500

backend/tests/test_marketplace_purchases.py

@@ -0,0 +1,222 @@
+"""Integration tests for Marketplace Purchase Service, Escrow, and Fee Splitting.
+
+docs/planning/economy.md US-4 (task bc90d3f481b4).
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+from app.services.purchase import purchase_service
+
+
+def _register(client: TestClient, username: str) -> tuple[int, dict[str, str]]:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"], headers
+
+
+def test_fee_split_calculation():
+    # 30% platform fee
+    fee, net = purchase_service.compute_fee_split(100)
+    assert fee == 30
+    assert net == 70
+
+    fee, net = purchase_service.compute_fee_split(250)
+    assert fee == 75
+    assert net == 175
+
+
+def test_marketplace_purchase_atomic_flow():
+    client = TestClient(app)
+    seller_id, seller_headers = _register(client, "purchase_seller_1")
+    buyer_id, buyer_headers = _register(client, "purchase_buyer_1")
+
+    # 1. Seller creates catalog item and lists it for 200 Credits
+    item_resp = client.post(
+        "/api/marketplace/items",
+        headers=seller_headers,
+        json={
+            "name": "Dragon Armor",
+            "description": "Legendary chestplate",
+            "item_type": "avatar_item",
+        },
+    )
+    assert item_resp.status_code == 201, item_resp.text
+    item_id = item_resp.json()["id"]
+
+    list_resp = client.post(
+        "/api/marketplace/listings",
+        headers=seller_headers,
+        json={
+            "catalog_item_id": item_id,
+            "price": 200,
+        },
+    )
+    assert list_resp.status_code == 201, list_resp.text
+    listing_id = list_resp.json()["id"]
+
+    # 2. Seller cannot purchase own listing
+    self_buy = client.post(
+        f"/api/marketplace/listings/{listing_id}/purchase",
+        headers=seller_headers,
+    )
+    assert self_buy.status_code == 400
+    assert "own listing" in self_buy.text
+
+    # 3. Buyer attempts purchase without enough credits -> 400
+    poor_buy = client.post(
+        f"/api/marketplace/listings/{listing_id}/purchase",
+        headers=buyer_headers,
+    )
+    assert poor_buy.status_code == 400
+    assert "Insufficient funds" in poor_buy.text
+
+    # 4. Buyer purchases 500 Credits via payments API
+    sess_resp = client.post(
+        "/api/payments/purchase",
+        headers=buyer_headers,
+        json={"credits": 500},
+    )
+    assert sess_resp.status_code == 201, sess_resp.text
+    sess_id = sess_resp.json()["session_id"]
+
+    conf_resp = client.post(
+        "/api/payments/confirm",
+        headers=buyer_headers,
+        json={"session_id": sess_id},
+    )
+    assert conf_resp.status_code == 200, conf_resp.text
+    assert conf_resp.json()["new_balance"] == 500
+
+    # 5. Buyer purchases listing for 200 Credits
+    buy_headers = dict(buyer_headers)
+    buy_headers["Idempotency-Key"] = "buy-test-key-1"
+    buy_resp = client.post(
+        f"/api/marketplace/listings/{listing_id}/purchase",
+        headers=buy_headers,
+    )
+    assert buy_resp.status_code == 201, buy_resp.text
+    purchase_data = buy_resp.json()
+    assert purchase_data["price"] == 200
+    assert purchase_data["platform_fee"] == 60
+    assert purchase_data["seller_net"] == 140
+    assert purchase_data["status"] == "pending_escrow"
+    assert purchase_data["buyer_id"] == buyer_id
+    assert purchase_data["seller_id"] == seller_id
+    purchase_id = purchase_data["id"]
+
+    # 6. Check buyer wallet balance: 500 - 200 = 300
+    w_resp = client.get("/api/wallet", headers=buyer_headers)
+    assert w_resp.status_code == 200
+    assert w_resp.json()["balance"] == 300
+
+    # 7. Check buyer has granted item in inventory
+    inv_resp = client.get("/api/marketplace/items", headers=buyer_headers, params={"mine": "true"})
+    assert inv_resp.status_code == 200
+    my_items = inv_resp.json()
+    assert any(i["name"] == "Dragon Armor" and i["owner_id"] == buyer_id for i in my_items)
+
+    # 8. Listing is now sold and cannot be purchased again
+    re_buy = client.post(
+        f"/api/marketplace/listings/{listing_id}/purchase",
+        headers=buyer_headers,
+    )
+    assert re_buy.status_code == 400
+    assert "not active" in re_buy.text
+
+    # 9. Seller's creator balance is pending escrow
+    cb_resp = client.get("/api/marketplace/creator/balance", headers=seller_headers)
+    assert cb_resp.status_code == 200, cb_resp.text
+    cb = cb_resp.json()
+    assert cb["pending"] == 140
+    assert cb["available"] == 0
+
+    # 10. List purchases
+    p_resp = client.get("/api/marketplace/purchases", headers=buyer_headers)
+    assert p_resp.status_code == 200
+    assert any(p["id"] == purchase_id for p in p_resp.json())
+
+    # 11. Escrow release
+    rel_resp = client.post(
+        f"/api/marketplace/purchases/{purchase_id}/release",
+        headers=seller_headers,
+    )
+    assert rel_resp.status_code == 200, rel_resp.text
+    assert rel_resp.json()["status"] == "completed"
+
+    # Check seller's creator balance now shows available = 140
+    cb_resp2 = client.get("/api/marketplace/creator/balance", headers=seller_headers)
+    assert cb_resp2.status_code == 200
+    cb2 = cb_resp2.json()
+    assert cb2["pending"] == 0
+    assert cb2["available"] == 140
+    assert cb2["lifetime_earned"] == 140
+
+
+def test_marketplace_refund():
+    client = TestClient(app)
+    seller_id, seller_headers = _register(client, "refund_seller_1")
+    buyer_id, buyer_headers = _register(client, "refund_buyer_1")
+
+    # Item & Listing
+    item_resp = client.post(
+        "/api/marketplace/items",
+        headers=seller_headers,
+        json={"name": "Magic Ring", "item_type": "avatar_item"},
+    )
+    item_id = item_resp.json()["id"]
+
+    list_resp = client.post(
+        "/api/marketplace/listings",
+        headers=seller_headers,
+        json={"catalog_item_id": item_id, "price": 100},
+    )
+    listing_id = list_resp.json()["id"]
+
+    # Fund buyer
+    s_resp = client.post("/api/payments/purchase", headers=buyer_headers, json={"credits": 500})
+    assert s_resp.status_code == 201, s_resp.text
+    client.post("/api/payments/confirm", headers=buyer_headers, json={"session_id": s_resp.json()["session_id"]})
+
+    # Purchase
+    buy_resp = client.post(f"/api/marketplace/listings/{listing_id}/purchase", headers=buyer_headers)
+    assert buy_resp.status_code == 201
+    purchase_id = buy_resp.json()["id"]
+
+    # Buyer balance is 400
+    w1 = client.get("/api/wallet", headers=buyer_headers).json()
+    assert w1["balance"] == 400
+
+    # Seller pending is 70
+    cb1 = client.get("/api/marketplace/creator/balance", headers=seller_headers).json()
+    assert cb1["pending"] == 70
+
+    # Refund
+    ref_resp = client.post(
+        f"/api/marketplace/purchases/{purchase_id}/refund",
+        headers=seller_headers,
+        json={"reason": "Buyer dissatisfaction"},
+    )
+    assert ref_resp.status_code == 200, ref_resp.text
+    assert ref_resp.json()["status"] == "refunded"
+
+    # Buyer balance refunded back to 500
+    w2 = client.get("/api/wallet", headers=buyer_headers).json()
+    assert w2["balance"] == 500
+
+    # Seller pending reset to 0
+    cb2 = client.get("/api/marketplace/creator/balance", headers=seller_headers).json()
+    assert cb2["pending"] == 0

backend/tests/test_payments.py

@@ -0,0 +1,123 @@
+"""Integration tests for Premium Purchase and PaymentProvider.
+
+docs/planning/economy.md US-2 (task 575fd14b5360).
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+def _register(client: TestClient, username: str) -> tuple[int, dict[str, str]]:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"], headers
+
+
+def test_payments_unauthorized():
+    client = TestClient(app)
+    resp = client.post("/api/payments/purchase", json={"credits": 500})
+    assert resp.status_code == 401
+
+    resp = client.post("/api/payments/confirm", json={"session_id": "sess_123"})
+    assert resp.status_code == 401
+
+
+def test_purchase_rejects_arbitrary_amounts():
+    client = TestClient(app)
+    _, headers = _register(client, "pay_user_1")
+
+    # 42 credits is not an allowed pack
+    resp = client.post("/api/payments/purchase", json={"credits": 42}, headers=headers)
+    assert resp.status_code == 422
+
+    # Negative / 0 credits
+    resp = client.post("/api/payments/purchase", json={"credits": -100}, headers=headers)
+    assert resp.status_code == 422
+
+
+def test_purchase_and_confirm_flow():
+    client = TestClient(app)
+    uid, headers = _register(client, "pay_user_2")
+
+    # 1. Check initial balance
+    w_resp = client.get("/api/wallet", headers=headers)
+    assert w_resp.status_code == 200
+    assert w_resp.json()["balance"] == 0
+
+    # 2. Purchase session for 500 credits
+    p_resp = client.post(
+        "/api/payments/purchase",
+        json={"credits": 500},
+        headers={"Idempotency-Key": "sess_req_1", **headers},
+    )
+    assert p_resp.status_code == 201, p_resp.text
+    p_data = p_resp.json()
+    assert p_data["credits"] == 500
+    assert p_data["session_id"].startswith("sess_")
+    session_id = p_data["session_id"]
+
+    # Balance is still 0 before confirmation
+    w_resp = client.get("/api/wallet", headers=headers)
+    assert w_resp.json()["balance"] == 0
+
+    # 3. Confirm purchase session
+    c_resp = client.post(
+        "/api/payments/confirm",
+        json={"session_id": session_id},
+        headers=headers,
+    )
+    assert c_resp.status_code == 200, c_resp.text
+    c_data = c_resp.json()
+    assert c_data["confirmed"] is True
+    assert c_data["credits"] == 500
+    assert c_data["new_balance"] == 500
+    assert c_data["provider_ref"] != ""
+
+    # 4. Idempotent re-confirm must not double-credit
+    c_resp2 = client.post(
+        "/api/payments/confirm",
+        json={"session_id": session_id},
+        headers=headers,
+    )
+    assert c_resp2.status_code == 200
+    assert c_resp2.json()["new_balance"] == 500
+
+    # Check transactions in ledger: exactly 1 transaction
+    tx_resp = client.get("/api/wallet/transactions", headers=headers)
+    assert tx_resp.status_code == 200
+    tx_data = tx_resp.json()
+    assert tx_data["total"] == 1
+    assert tx_data["transactions"][0]["amount"] == 500
+    assert tx_data["transactions"][0]["type"] == "credit_purchase"
+
+
+def test_confirm_invalid_or_wrong_user_fails():
+    client = TestClient(app)
+    uid1, headers1 = _register(client, "pay_user_3a")
+    uid2, headers2 = _register(client, "pay_user_3b")
+
+    # User 1 creates a session
+    p_resp = client.post("/api/payments/purchase", json={"credits": 100}, headers=headers1)
+    session_id = p_resp.json()["session_id"]
+
+    # User 2 tries to confirm User 1's session -> must fail 400
+    bad_resp = client.post("/api/payments/confirm", json={"session_id": session_id}, headers=headers2)
+    assert bad_resp.status_code == 400
+
+    # Non-existent session -> must fail 400
+    bad_resp2 = client.post("/api/payments/confirm", json={"session_id": "sess_nonexistent"}, headers=headers1)
+    assert bad_resp2.status_code == 400

backend/tests/test_payout_review.py

@@ -0,0 +1,108 @@
+"""Integration tests for Payout Admin Review, PayoutProvider, and Ledger Audit Trail.
+
+docs/planning/economy.md US-5 (task b52008923e93).
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.marketplace import CreatorBalance
+from app.models.wallet import Transaction, TransactionType
+from app.services.payout import NoopPayoutProvider
+
+
+def _register(client: TestClient, username: str) -> tuple[int, dict[str, str]]:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"], headers
+
+
+async def _fund_creator_balance(user_id: int, available_amount: int):
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    session_factory = async_sessionmaker(engine, expire_on_commit=False)
+    async with session_factory() as session:
+        cb = CreatorBalance(
+            user_id=user_id,
+            available=available_amount,
+            pending=0,
+            lifetime_earned=available_amount,
+        )
+        session.add(cb)
+        await session.commit()
+    await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_payout_provider_noop():
+    provider = NoopPayoutProvider()
+    success, ref = await provider.pay(user_id=1, amount=500, external_ref="test@example.com")
+    assert success is True
+    assert ref.startswith("noop_payout_")
+
+
+@pytest.mark.asyncio
+async def test_payout_admin_review_audit_trail_and_ledger():
+    client = TestClient(app)
+    admin_id, admin_headers = _register(client, "admin_audit_reviewer")
+    creator_id, creator_headers = _register(client, "audit_creator_user")
+
+    await _fund_creator_balance(creator_id, 1500)
+
+    # 1. Creator requests payout
+    req_resp = client.post(
+        "/api/payouts",
+        headers=creator_headers,
+        json={"amount": 600, "external_ref": "stripe_acct_456"},
+    )
+    assert req_resp.status_code == 201, req_resp.text
+    payout_id = req_resp.json()["id"]
+
+    # 2. Admin approves payout
+    appr_resp = client.post(
+        f"/api/payouts/{payout_id}/approve",
+        headers=admin_headers,
+    )
+    assert appr_resp.status_code == 200, appr_resp.text
+    data = appr_resp.json()
+    assert data["status"] == "paid"
+    assert data["reviewed_by"] == admin_id
+    assert data["reviewed_at"] is not None
+    assert data["provider_ref"] is not None
+    provider_ref = data["provider_ref"]
+
+    # 3. Verify ledger transaction row was recorded for audit trail
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    session_factory = async_sessionmaker(engine, expire_on_commit=False)
+    async with session_factory() as session:
+        stmt = (
+            select(Transaction)
+            .where(
+                Transaction.reference_type == "payout_request",
+                Transaction.reference_id == str(payout_id),
+            )
+        )
+        tx = (await session.execute(stmt)).scalar_one_or_none()
+        assert tx is not None
+        assert tx.type == TransactionType.payout
+        assert tx.amount == -600
+        assert tx.metadata_json["provider_ref"] == provider_ref
+        assert tx.metadata_json["reviewed_by"] == admin_id
+        assert tx.metadata_json["external_ref"] == "stripe_acct_456"
+    await engine.dispose()

backend/tests/test_payouts_api.py

@@ -0,0 +1,186 @@
+"""Integration tests for Creator Payouts: requests, list, admin review, and balance accounting.
+
+docs/planning/economy.md US-5 (tasks f5b4684f2e65, b52008923e93).
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.marketplace import CreatorBalance
+from app.models.user import User
+
+
+def _register(client: TestClient, username: str) -> tuple[int, dict[str, str]]:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"], headers
+
+
+async def _fund_creator_balance(user_id: int, available_amount: int):
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    session_factory = async_sessionmaker(engine, expire_on_commit=False)
+    async with session_factory() as session:
+        cb = CreatorBalance(
+            user_id=user_id,
+            available=available_amount,
+            pending=0,
+            lifetime_earned=available_amount,
+        )
+        session.add(cb)
+        await session.commit()
+    await engine.dispose()
+
+
+async def _make_admin(user_id: int):
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    session_factory = async_sessionmaker(engine, expire_on_commit=False)
+    async with session_factory() as session:
+        user = await session.get(User, user_id)
+        assert user is not None
+        user.is_admin = True
+        await session.commit()
+    await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_payout_request_and_validation():
+    client = TestClient(app)
+    uid, headers = _register(client, "payout_creator_1")
+    _, other_headers = _register(client, "payout_other_user")
+
+    # Min threshold is 100 CR
+    resp = client.post(
+        "/api/payouts",
+        headers=headers,
+        json={"amount": 50},
+    )
+    assert resp.status_code == 422, resp.text
+
+    # Without balance, payout of 200 CR fails
+    resp = client.post(
+        "/api/payouts",
+        headers=headers,
+        json={"amount": 200},
+    )
+    assert resp.status_code == 400
+    assert "Insufficient available balance" in resp.text
+
+    # Seed 500 CR available creator balance
+    await _fund_creator_balance(uid, 500)
+
+    # Valid payout request of 200 CR
+    resp = client.post(
+        "/api/payouts",
+        headers=headers,
+        json={"amount": 200, "external_ref": "creator@paypal.com"},
+    )
+    assert resp.status_code == 201, resp.text
+    payout_data = resp.json()
+    assert payout_data["amount"] == 200
+    assert payout_data["status"] == "pending"
+    assert payout_data["external_ref"] == "creator@paypal.com"
+    payout_id = payout_data["id"]
+
+    # Check creator balance: 500 - 200 = 300 available, 200 pending
+    cb_resp = client.get("/api/marketplace/creator/balance", headers=headers)
+    assert cb_resp.status_code == 200
+    cb = cb_resp.json()
+    assert cb["available"] == 300
+    assert cb["pending"] == 200
+
+    # List payouts: creator sees own request
+    list_resp = client.get("/api/payouts", headers=headers)
+    assert list_resp.status_code == 200
+    my_payouts = list_resp.json()
+    assert len(my_payouts) == 1
+    assert my_payouts[0]["id"] == payout_id
+
+    # Other user sees empty list
+    other_list = client.get("/api/payouts", headers=other_headers)
+    assert other_list.status_code == 200
+    assert len(other_list.json()) == 0
+
+    # Other user cannot view detail -> 403
+    det_resp = client.get(f"/api/payouts/{payout_id}", headers=other_headers)
+    assert det_resp.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_payout_admin_approve_and_reject():
+    client = TestClient(app)
+    admin_id, admin_headers = _register(client, "admin_payout_reviewer")
+
+    creator_id, creator_headers = _register(client, "payout_creator_2")
+    await _fund_creator_balance(creator_id, 1000)
+
+    # 1. Request payout of 300 CR
+    p1_resp = client.post(
+        "/api/payouts",
+        headers=creator_headers,
+        json={"amount": 300, "external_ref": "iban_123"},
+    )
+    assert p1_resp.status_code == 201
+    p1_id = p1_resp.json()["id"]
+
+    # 2. Non-admin cannot approve -> 403
+    non_admin_appr = client.post(f"/api/payouts/{p1_id}/approve", headers=creator_headers)
+    assert non_admin_appr.status_code == 403
+
+    # 3. Admin approves payout 1
+    appr_resp = client.post(f"/api/payouts/{p1_id}/approve", headers=admin_headers)
+    assert appr_resp.status_code == 200, appr_resp.text
+    p1_data = appr_resp.json()
+    assert p1_data["status"] == "paid"
+    assert p1_data["reviewed_by"] == admin_id
+    assert p1_data["provider_ref"] is not None
+
+    # Balance check: available was 700, pending was 300 -> now pending = 0
+    cb_resp = client.get("/api/marketplace/creator/balance", headers=creator_headers)
+    assert cb_resp.json()["available"] == 700
+    assert cb_resp.json()["pending"] == 0
+
+    # 4. Request payout 2 of 200 CR
+    p2_resp = client.post(
+        "/api/payouts",
+        headers=creator_headers,
+        json={"amount": 200},
+    )
+    assert p2_resp.status_code == 201
+    p2_id = p2_resp.json()["id"]
+
+    # available was 700 - 200 = 500, pending = 200
+    cb_resp = client.get("/api/marketplace/creator/balance", headers=creator_headers)
+    assert cb_resp.json()["available"] == 500
+    assert cb_resp.json()["pending"] == 200
+
+    # 5. Admin rejects payout 2
+    rej_resp = client.post(
+        f"/api/payouts/{p2_id}/reject",
+        headers=admin_headers,
+        json={"reason": "Incorrect payment details"},
+    )
+    assert rej_resp.status_code == 200, rej_resp.text
+    p2_data = rej_resp.json()
+    assert p2_data["status"] == "rejected"
+    assert p2_data["reviewed_by"] == admin_id
+
+    # Creator balance refunded: 500 + 200 = 700 available, 0 pending
+    cb_resp = client.get("/api/marketplace/creator/balance", headers=creator_headers)
+    assert cb_resp.json()["available"] == 700
+    assert cb_resp.json()["pending"] == 0

backend/tests/test_presence.py

@@ -0,0 +1,221 @@
+"""Integration tests for the presence feature:
+
+- POST  /api/presence/heartbeat
+- GET   /api/presence/presence
+- PATCH /api/presence/status
+
+Hits the real app against the configured Postgres *and* a real Redis
+(conftest.py brings up an ephemeral instance of each when neither is
+already reachable) -- presence is fundamentally "does a TTL key exist in
+Redis", which isn't worth faking with a mock.
+
+Also covers the regression fixed in 47ab492 ("Fix StatusUpdate field
+annotation and is_online batch-call mismatch"): the router used to call
+``PresenceStore.is_online(ids)`` with a *list* of ids and then evaluate
+``uid in online_ids`` against the returned bool, which raised a TypeError
+on the first real multi-id batch call, and ``StatusUpdate.status_message``
+used the invalid annotation ``str | Field(...)``. Both are exercised below.
+"""
+
+import asyncio
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+from app.services.presence import PresenceStore
+
+
+def _register(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return {"headers": headers, "id": me.json()["id"]}
+
+
+class TestHeartbeat:
+    def test_heartbeat_sets_online(self):
+        client = TestClient(app)
+        user = _register(client, "presence_hb1")
+
+        resp = client.post("/api/presence/heartbeat", json={}, headers=user["headers"])
+        assert resp.status_code == 200, resp.text
+        assert resp.json() == {"status": "ok", "user_id": user["id"]}
+
+        presence = client.get(
+            "/api/presence/presence",
+            params={"user_ids": str(user["id"])},
+            headers=user["headers"],
+        )
+        assert presence.status_code == 200, presence.text
+        body = presence.json()["users"]
+        assert len(body) == 1
+        assert body[0]["user_id"] == user["id"]
+        assert body[0]["is_online"] is True
+        assert body[0]["last_seen_at"] is not None
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        resp = client.post("/api/presence/heartbeat", json={})
+        assert resp.status_code == 401
+
+    def test_never_seen_user_is_offline_with_null_last_seen(self):
+        client = TestClient(app)
+        user = _register(client, "presence_never_hb")
+
+        presence = client.get(
+            "/api/presence/presence",
+            params={"user_ids": str(user["id"])},
+            headers=user["headers"],
+        )
+        assert presence.status_code == 200
+        body = presence.json()["users"][0]
+        assert body["is_online"] is False
+        assert body["last_seen_at"] is None
+
+
+class TestBatchPresence:
+    """Covers the batch-call path fixed in 47ab492 (is_online_batch via MGET)."""
+
+    def test_batch_query_mixes_online_offline_and_unknown_ids(self):
+        client = TestClient(app)
+        online_user = _register(client, "presence_batch_online")
+        offline_user = _register(client, "presence_batch_offline")
+
+        client.post("/api/presence/heartbeat", json={}, headers=online_user["headers"])
+
+        unknown_id = max(online_user["id"], offline_user["id"]) + 999_999
+        ids = f"{online_user['id']},{offline_user['id']},{unknown_id}"
+
+        resp = client.get(
+            "/api/presence/presence",
+            params={"user_ids": ids},
+            headers=online_user["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+        by_id = {u["user_id"]: u for u in resp.json()["users"]}
+
+        # Unknown id is silently dropped (not in the DB), not a 500 or 404.
+        assert unknown_id not in by_id
+        assert by_id[online_user["id"]]["is_online"] is True
+        assert by_id[offline_user["id"]]["is_online"] is False
+
+    def test_empty_user_ids_is_a_400(self):
+        client = TestClient(app)
+        user = _register(client, "presence_empty_ids")
+        resp = client.get(
+            "/api/presence/presence",
+            params={"user_ids": ""},
+            headers=user["headers"],
+        )
+        assert resp.status_code == 400
+
+
+class TestStatusMessage:
+    def test_update_and_read_back_status_message(self):
+        client = TestClient(app)
+        user = _register(client, "presence_status1")
+
+        resp = client.patch(
+            "/api/presence/status",
+            json={"status_message": "  brb, making coffee  "},
+            headers=user["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+        # The router strips whitespace (StatusUpdate.strip_message).
+        assert resp.json()["status_message"] == "brb, making coffee"
+
+        presence = client.get(
+            "/api/presence/presence",
+            params={"user_ids": str(user["id"])},
+            headers=user["headers"],
+        )
+        assert presence.json()["users"][0]["status_message"] == "brb, making coffee"
+
+    def test_status_message_over_max_length_is_rejected(self):
+        client = TestClient(app)
+        user = _register(client, "presence_status_toolong")
+        resp = client.patch(
+            "/api/presence/status",
+            json={"status_message": "x" * 141},
+            headers=user["headers"],
+        )
+        # StatusUpdate.status_message: str | None = Field(..., max_length=140)
+        # This is exactly the annotation 47ab492 fixed (it used to be the
+        # invalid `str | Field(...)`, which breaks model construction
+        # entirely rather than validating length).
+        assert resp.status_code == 422
+
+    def test_status_message_at_max_length_is_accepted(self):
+        client = TestClient(app)
+        user = _register(client, "presence_status_maxlen")
+        resp = client.patch(
+            "/api/presence/status",
+            json={"status_message": "x" * 140},
+            headers=user["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+
+    def test_null_status_message_clears_it(self):
+        client = TestClient(app)
+        user = _register(client, "presence_status_clear")
+        client.patch("/api/presence/status", json={"status_message": "hi"}, headers=user["headers"])
+        resp = client.patch("/api/presence/status", json={"status_message": None}, headers=user["headers"])
+        assert resp.status_code == 200
+        assert resp.json()["status_message"] is None
+
+
+class TestPresenceStoreTTL:
+    """Exercises the real Redis TTL semantics directly against the service,
+    with a short heartbeat_ttl so the test doesn't need to sleep for the
+    real 60s default used in production. This is the cheap, real proxy for
+    "TTL expiry means offline" the task asked for -- same code path
+    (real Redis SET ... EX / EXISTS / MGET), just a much shorter window.
+    """
+
+    async def test_ttl_expiry_flips_online_to_offline(self):
+        store = PresenceStore(heartbeat_ttl=1)
+        try:
+            uid = 987654321  # doesn't need to exist in Postgres; Redis-only check
+            assert await store.is_online(uid) is False
+
+            await store.heartbeat(uid)
+            assert await store.is_online(uid) is True
+
+            await asyncio.sleep(1.5)
+            assert await store.is_online(uid) is False
+        finally:
+            await store.close()
+
+    async def test_is_online_batch_matches_is_online_semantics(self):
+        """Regression coverage for 47ab492: is_online_batch must return a
+        set of ids usable with `in`, not a bool."""
+        store = PresenceStore(heartbeat_ttl=30)
+        try:
+            online_uid, offline_uid = 111222333, 444555666
+            await store.heartbeat(online_uid)
+
+            result = await store.is_online_batch([online_uid, offline_uid])
+            assert isinstance(result, set)
+            assert online_uid in result
+            assert offline_uid not in result
+        finally:
+            await store.close()
+
+    async def test_is_online_batch_empty_list(self):
+        store = PresenceStore()
+        try:
+            assert await store.is_online_batch([]) == set()
+        finally:
+            await store.close()

backend/tests/test_profile.py

@@ -0,0 +1,406 @@
+"""Integration tests for /api/profile/me and /api/profile/me/favorites.
+
+Hits the real app against the configured Postgres (same contract as the
+other integration tests -- migrations applied first).
+"""
+
+import asyncio
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import text
+from sqlalchemy.ext.asyncio import create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.profile import DEFAULT_PRIVACY
+
+
+def _auth_headers(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    return {"Authorization": f"Bearer {resp.json()['access_token']}"}
+
+
+def _me_id(client: TestClient, headers: dict) -> int:
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _make_world(client: TestClient, headers: dict, name: str = "W") -> int:
+    r = client.post("/api/worlds/", headers=headers, json={"name": name, "visibility": "public"})
+    assert r.status_code == 201, r.text
+    return r.json()["id"]
+
+
+def _make_asset(client: TestClient, headers: dict, name: str = "A") -> int:
+    """Insert an asset row directly via raw SQL.
+
+    Not going through POST /api/assets/, and not through the Asset ORM
+    model, deliberately: Asset.asset_type's ENUM column has no
+    values_callable, so SQLAlchemy sends the Python enum *name* (e.g.
+    "IMAGE") to Postgres instead of the lowercase value the DB enum
+    actually stores ("image"), and both the router and a plain ORM insert
+    500/fail on it. That's a pre-existing bug unrelated to this task; these
+    tests only need a real asset row to reference by id, so insert with raw
+    SQL to sidestep the buggy enum type entirely.
+    """
+    owner_id = _me_id(client, headers)
+
+    async def _create() -> int:
+        engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+        async with engine.begin() as conn:
+            result = await conn.execute(
+                text(
+                    "INSERT INTO assets (name, asset_type, file_path, owner_id, is_public) "
+                    "VALUES (:name, 'image', '', :owner_id, false) RETURNING id"
+                ),
+                {"name": name, "owner_id": owner_id},
+            )
+            asset_id = result.scalar_one()
+        await engine.dispose()
+        return asset_id
+
+    return asyncio.run(_create())
+
+
+class TestGetProfile:
+    def test_new_user_gets_the_default(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_default")
+        resp = client.get("/api/profile/me", headers=headers)
+        assert resp.status_code == 200
+        body = resp.json()
+        assert body["is_default"] is True
+        assert body["bio"] is None
+        assert body["avatar_asset_id"] is None
+        assert body["privacy"] == DEFAULT_PRIVACY
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        assert client.get("/api/profile/me").status_code == 401
+
+
+class TestPutProfile:
+    def test_save_then_read_back(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_save")
+        asset_id = _make_asset(client, headers)
+
+        put = client.put(
+            "/api/profile/me", headers=headers,
+            json={"bio": "hello world", "avatar_asset_id": asset_id,
+                  "privacy": {"profile_visibility": "friends"}},
+        )
+        assert put.status_code == 200, put.text
+        body = put.json()
+        assert body["is_default"] is False
+        assert body["bio"] == "hello world"
+        assert body["avatar_asset_id"] == asset_id
+        assert body["privacy"]["profile_visibility"] == "friends"
+        # unspecified privacy keys keep their default
+        assert body["privacy"]["friends_list_visibility"] == "public"
+
+        got = client.get("/api/profile/me", headers=headers)
+        assert got.status_code == 200
+        assert got.json() == body
+
+    def test_partial_update_preserves_other_fields(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_partial")
+        client.put("/api/profile/me", headers=headers, json={"bio": "first bio"})
+        put2 = client.put("/api/profile/me", headers=headers, json={"privacy": {"favorites_visibility": "private"}})
+        assert put2.status_code == 200, put2.text
+        body = put2.json()
+        assert body["bio"] == "first bio"
+        assert body["privacy"]["favorites_visibility"] == "private"
+
+    def test_other_user_cannot_edit_my_profile(self):
+        """There is no user_id-scoped edit route at all -- PUT /me always
+        acts on the caller's own JWT identity, so another user's token can
+        never touch this user's profile."""
+        client = TestClient(app)
+        headers_a = _auth_headers(client, "pf_owner")
+        headers_b = _auth_headers(client, "pf_other")
+
+        client.put("/api/profile/me", headers=headers_a, json={"bio": "owner's bio"})
+        client.put("/api/profile/me", headers=headers_b, json={"bio": "other's bio"})
+
+        got_a = client.get("/api/profile/me", headers=headers_a).json()
+        got_b = client.get("/api/profile/me", headers=headers_b).json()
+        assert got_a["bio"] == "owner's bio"
+        assert got_b["bio"] == "other's bio"
+        assert got_a["user_id"] != got_b["user_id"]
+
+    def test_rejects_invalid_avatar_asset_id(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_badasset")
+        resp = client.put("/api/profile/me", headers=headers, json={"avatar_asset_id": 999999})
+        assert resp.status_code == 422
+
+    def test_rejects_over_length_bio(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_longbio")
+        resp = client.put("/api/profile/me", headers=headers, json={"bio": "x" * 501})
+        assert resp.status_code == 422
+
+    def test_accepts_bio_at_max_length(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_maxbio")
+        resp = client.put("/api/profile/me", headers=headers, json={"bio": "x" * 500})
+        assert resp.status_code == 200, resp.text
+
+    def test_rejects_unknown_privacy_key(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_badprivkey")
+        resp = client.put("/api/profile/me", headers=headers, json={"privacy": {"nonsense_key": "public"}})
+        assert resp.status_code == 422
+
+    def test_rejects_invalid_privacy_value(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "pf_badprivval")
+        resp = client.put("/api/profile/me", headers=headers, json={"privacy": {"profile_visibility": "nope"}})
+        assert resp.status_code == 422
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        resp = client.put("/api/profile/me", json={"bio": "x"})
+        assert resp.status_code == 401
+
+
+class TestFavorites:
+    def test_new_user_has_no_favorites(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_default")
+        resp = client.get("/api/profile/me/favorites", headers=headers)
+        assert resp.status_code == 200
+        assert resp.json() == {"world_ids": []}
+
+    def test_replace_then_read_back(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_save")
+        w1 = _make_world(client, headers, "W1")
+        w2 = _make_world(client, headers, "W2")
+
+        put = client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [w1, w2]})
+        assert put.status_code == 200, put.text
+        assert set(put.json()["world_ids"]) == {w1, w2}
+
+        got = client.get("/api/profile/me/favorites", headers=headers)
+        assert set(got.json()["world_ids"]) == {w1, w2}
+
+    def test_replace_is_a_full_replace_not_append(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_replace")
+        w1 = _make_world(client, headers, "W1")
+        w2 = _make_world(client, headers, "W2")
+
+        client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [w1]})
+        second = client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [w2]})
+        assert second.json()["world_ids"] == [w2]
+
+        got = client.get("/api/profile/me/favorites", headers=headers)
+        assert got.json()["world_ids"] == [w2]
+
+    def test_replace_with_empty_list_clears_favorites(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_clear")
+        w1 = _make_world(client, headers, "W1")
+        client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [w1]})
+        cleared = client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": []})
+        assert cleared.status_code == 200
+        assert cleared.json() == {"world_ids": []}
+
+    def test_rejects_nonexistent_world_id(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_badworld")
+        resp = client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [999999]})
+        assert resp.status_code == 422
+
+    def test_rejects_nonexistent_world_id_mixed_with_valid(self):
+        client = TestClient(app)
+        headers = _auth_headers(client, "fav_mixed")
+        w1 = _make_world(client, headers, "W1")
+        resp = client.put("/api/profile/me/favorites", headers=headers, json={"world_ids": [w1, 999999]})
+        assert resp.status_code == 422
+        # nothing partially applied
+        got = client.get("/api/profile/me/favorites", headers=headers)
+        assert got.json()["world_ids"] == []
+
+    def test_favorites_isolated_per_user(self):
+        client = TestClient(app)
+        headers_a = _auth_headers(client, "fav_owner")
+        headers_b = _auth_headers(client, "fav_other")
+        w1 = _make_world(client, headers_a, "W1")
+
+        client.put("/api/profile/me/favorites", headers=headers_a, json={"world_ids": [w1]})
+        got_b = client.get("/api/profile/me/favorites", headers=headers_b)
+        assert got_b.json()["world_ids"] == []
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        assert client.get("/api/profile/me/favorites").status_code == 401
+        assert client.put("/api/profile/me/favorites", json={"world_ids": []}).status_code == 401
+
+
+class TestPublicProfile:
+    def test_public_profile_full_view(self):
+        client = TestClient(app)
+        h_alice = _auth_headers(client, "pub_alice")
+        alice_id = _me_id(client, h_alice)
+        h_bob = _auth_headers(client, "pub_bob")
+
+        w1 = _make_world(client, h_alice, "AliceWorld")
+        asset_id = _make_asset(client, h_alice, "AliceAsset")
+
+        client.put(
+            "/api/profile/me",
+            headers=h_alice,
+            json={"bio": "Hi, I am Alice", "avatar_asset_id": asset_id},
+        )
+        client.put("/api/profile/me/favorites", headers=h_alice, json={"world_ids": [w1]})
+
+        resp = client.get(f"/api/profile/{alice_id}", headers=h_bob)
+        assert resp.status_code == 200, resp.text
+        data = resp.json()
+        assert data["user_id"] == alice_id
+        assert data["username"] == "pub_alice"
+        assert data["bio"] == "Hi, I am Alice"
+        assert data["avatar_asset_id"] == asset_id
+        assert data["is_restricted"] is False
+        assert len(data["favorites"]) == 1
+        assert data["favorites"][0]["id"] == w1
+        assert data["favorites"][0]["name"] == "AliceWorld"
+        assert "email" not in data
+        assert "password" not in data
+
+    def test_public_profile_not_found(self):
+        client = TestClient(app)
+        h_bob = _auth_headers(client, "pub_nf_bob")
+        resp = client.get("/api/profile/999999", headers=h_bob)
+        assert resp.status_code == 404
+
+    def test_public_profile_requires_auth(self):
+        client = TestClient(app)
+        assert client.get("/api/profile/1").status_code == 401
+
+    def test_public_profile_private_visibility(self):
+        client = TestClient(app)
+        h_alice = _auth_headers(client, "pub_priv_a")
+        alice_id = _me_id(client, h_alice)
+        h_bob = _auth_headers(client, "pub_priv_b")
+
+        client.put(
+            "/api/profile/me",
+            headers=h_alice,
+            json={"bio": "Top secret bio", "privacy": {"profile_visibility": "private"}},
+        )
+
+        resp_bob = client.get(f"/api/profile/{alice_id}", headers=h_bob)
+        assert resp_bob.status_code == 200
+        data_bob = resp_bob.json()
+        assert data_bob["is_restricted"] is True
+        assert data_bob["bio"] is None
+        assert data_bob["favorites"] == []
+        assert data_bob["friends"] == []
+
+        # Alice viewing herself is not restricted
+        resp_alice = client.get(f"/api/profile/{alice_id}", headers=h_alice)
+        assert resp_alice.status_code == 200
+        assert resp_alice.json()["is_restricted"] is False
+        assert resp_alice.json()["bio"] == "Top secret bio"
+
+    def test_public_profile_friends_only_visibility(self):
+        client = TestClient(app)
+        h_alice = _auth_headers(client, "pub_fo_a")
+        alice_id = _me_id(client, h_alice)
+        h_bob = _auth_headers(client, "pub_fo_b")
+        bob_id = _me_id(client, h_bob)
+        h_charlie = _auth_headers(client, "pub_fo_c")
+
+        client.put(
+            "/api/profile/me",
+            headers=h_alice,
+            json={"bio": "Friends only bio", "privacy": {"profile_visibility": "friends"}},
+        )
+
+        # Charlie is not a friend -> restricted
+        resp_c = client.get(f"/api/profile/{alice_id}", headers=h_charlie)
+        assert resp_c.json()["is_restricted"] is True
+        assert resp_c.json()["bio"] is None
+
+        # Bob becomes friends with Alice
+        req = client.post("/api/friends/requests", headers=h_bob, json={"user_id": alice_id})
+        req_id = req.json()["id"]
+        client.post(f"/api/friends/requests/{req_id}/accept", headers=h_alice)
+
+        # Now Bob sees full profile and friends list contains Bob
+        resp_b = client.get(f"/api/profile/{alice_id}", headers=h_bob)
+        assert resp_b.json()["is_restricted"] is False
+        assert resp_b.json()["bio"] == "Friends only bio"
+        assert any(f["id"] == bob_id for f in resp_b.json()["friends"])
+
+    def test_public_profile_blocked_user_gets_restricted(self):
+        client = TestClient(app)
+        h_alice = _auth_headers(client, "pub_blk_a")
+        alice_id = _me_id(client, h_alice)
+        h_dan = _auth_headers(client, "pub_blk_d")
+        dan_id = _me_id(client, h_dan)
+
+        client.put("/api/profile/me", headers=h_alice, json={"bio": "Alice public bio"})
+        client.post(f"/api/friends/{dan_id}/block", headers=h_alice)
+
+        # Dan viewing Alice gets restricted view
+        resp_dan = client.get(f"/api/profile/{alice_id}", headers=h_dan)
+        assert resp_dan.status_code == 200
+        assert resp_dan.json()["is_restricted"] is True
+        assert resp_dan.json()["bio"] is None
+
+        # Alice viewing Dan gets restricted view
+        resp_alice = client.get(f"/api/profile/{dan_id}", headers=h_alice)
+        assert resp_alice.status_code == 200
+        assert resp_alice.json()["is_restricted"] is True
+
+    def test_public_profile_selective_favorites_and_friends_privacy(self):
+        client = TestClient(app)
+        h_alice = _auth_headers(client, "pub_sec_a")
+        alice_id = _me_id(client, h_alice)
+        h_bob = _auth_headers(client, "pub_sec_b")
+        bob_id = _me_id(client, h_bob)
+        w1 = _make_world(client, h_alice, "WorldSec")
+
+        client.put("/api/profile/me/favorites", headers=h_alice, json={"world_ids": [w1]})
+        req = client.post("/api/friends/requests", headers=h_bob, json={"user_id": alice_id})
+        req_id = req.json()["id"]
+        client.post(f"/api/friends/requests/{req_id}/accept", headers=h_alice)
+
+        client.put(
+            "/api/profile/me",
+            headers=h_alice,
+            json={
+                "bio": "Bio is public",
+                "privacy": {
+                    "profile_visibility": "public",
+                    "favorites_visibility": "private",
+                    "friends_list_visibility": "private",
+                },
+            },
+        )
+
+        resp = client.get(f"/api/profile/{alice_id}", headers=h_bob)
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["bio"] == "Bio is public"
+        assert data["favorites"] == []
+        assert data["friends"] == []
+

backend/tests/test_rate_limit.py

@@ -1,6 +1,7 @@
 """The auth endpoints are rate-limited per client IP."""
 
 import pytest
+from fastapi import Depends, FastAPI
 from fastapi.testclient import TestClient
 
 from app import rate_limit
@@ -54,3 +55,70 @@ def test_limiter_window_is_per_key():
     with pytest.raises(Exception):
         limiter.check("a")
     limiter.check("b")  # different key, unaffected
+
+
+def _make_named_limit_app():
+    """A tiny standalone app exercising two independent named limits, so
+    these tests don't depend on any sibling endpoint existing yet."""
+    limit_a = rate_limit.rate_limit("test_named_a", max_hits=2, window_seconds=60)
+    limit_b = rate_limit.rate_limit("test_named_b", max_hits=2, window_seconds=60)
+
+    app = FastAPI()
+
+    @app.post("/a", dependencies=[Depends(limit_a)])
+    def _a():
+        return {"ok": True}
+
+    @app.post("/b", dependencies=[Depends(limit_b)])
+    def _b():
+        return {"ok": True}
+
+    return TestClient(app)
+
+
+def test_named_limits_do_not_share_counters():
+    client = _make_named_limit_app()
+
+    # Burn out limit "a" entirely.
+    assert client.post("/a").status_code == 200
+    assert client.post("/a").status_code == 200
+    r = client.post("/a")
+    assert r.status_code == 429
+    assert "Retry-After" in r.headers
+
+    # Limit "b" is untouched -- same process, same client IP, different name.
+    assert client.post("/b").status_code == 200
+    assert client.post("/b").status_code == 200
+    assert client.post("/b").status_code == 429
+
+
+def test_named_limit_returns_429_with_retry_after_once_exhausted():
+    client = _make_named_limit_app()
+    client.post("/a")
+    client.post("/a")
+    r = client.post("/a")
+    assert r.status_code == 429
+    retry_after = r.headers["Retry-After"]
+    assert int(retry_after) >= 1
+
+
+def test_named_limit_is_a_noop_when_rate_limiting_disabled():
+    prev = settings.RATE_LIMIT_ENABLED
+    settings.RATE_LIMIT_ENABLED = False
+    try:
+        client = _make_named_limit_app()
+        codes = [client.post("/a").status_code for _ in range(10)]
+        assert codes == [200] * 10
+    finally:
+        settings.RATE_LIMIT_ENABLED = prev
+
+
+def test_reset_all_clears_named_limiters_too():
+    client = _make_named_limit_app()
+    client.post("/a")
+    client.post("/a")
+    assert client.post("/a").status_code == 429
+
+    rate_limit.reset_all()
+
+    assert client.post("/a").status_code == 200

backend/tests/test_social_friends.py

@@ -0,0 +1,317 @@
+"""Integration tests for the friends/follow/block API:
+
+- POST   /api/friends/requests
+- GET    /api/friends/requests
+- POST   /api/friends/requests/{id}/accept
+- POST   /api/friends/requests/{id}/decline
+- DELETE /api/friends/{user_id}
+- POST   /api/friends/{user_id}/follow
+- DELETE /api/friends/{user_id}/follow
+- POST   /api/friends/{user_id}/block
+- DELETE /api/friends/{user_id}/block
+- GET    /api/friends
+- GET    /api/friends/following
+- GET    /api/friends/blocked
+
+app/routers/social_friends.py, built on the merged models in
+app/models/social.py (Friendship/Follow/Block).
+"""
+
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+def _register(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return {"headers": headers, "id": me.json()["id"]}
+
+
+class TestFriendRequestFlow:
+    def test_send_list_accept_makes_mutual_friendship(self):
+        client = TestClient(app)
+        a = _register(client, "fr_flow_a")
+        b = _register(client, "fr_flow_b")
+
+        resp = client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"])
+        assert resp.status_code == 201, resp.text
+        request_id = resp.json()["id"]
+        assert resp.json()["status"] == "pending"
+
+        incoming = client.get("/api/friends/requests", headers=b["headers"])
+        assert incoming.status_code == 200
+        ids = [r["id"] for r in incoming.json()["requests"]]
+        assert request_id in ids
+
+        # Requester doesn't see it in their own incoming list.
+        a_incoming = client.get("/api/friends/requests", headers=a["headers"])
+        assert a_incoming.json()["requests"] == []
+
+        accept = client.post(f"/api/friends/requests/{request_id}/accept", headers=b["headers"])
+        assert accept.status_code == 200, accept.text
+        assert accept.json()["status"] == "accepted"
+
+        # Mutual: shows up in both users' friend lists.
+        a_friends = client.get("/api/friends", headers=a["headers"]).json()["friends"]
+        b_friends = client.get("/api/friends", headers=b["headers"]).json()["friends"]
+        assert any(u["id"] == b["id"] for u in a_friends)
+        assert any(u["id"] == a["id"] for u in b_friends)
+
+    def test_decline_removes_request_and_allows_re_request(self):
+        client = TestClient(app)
+        a = _register(client, "fr_decl_a")
+        b = _register(client, "fr_decl_b")
+
+        resp = client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"])
+        request_id = resp.json()["id"]
+
+        decline = client.post(f"/api/friends/requests/{request_id}/decline", headers=b["headers"])
+        assert decline.status_code == 200, decline.text
+
+        assert client.get("/api/friends/requests", headers=b["headers"]).json()["requests"] == []
+
+        # A can send a new request now that the old one is gone.
+        resp2 = client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"])
+        assert resp2.status_code == 201, resp2.text
+
+    def test_accept_or_decline_of_others_request_is_404_not_403(self):
+        client = TestClient(app)
+        a = _register(client, "fr_enum_a")
+        b = _register(client, "fr_enum_b")
+        c = _register(client, "fr_enum_c")
+
+        resp = client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"])
+        request_id = resp.json()["id"]
+
+        # c is neither requester nor addressee -- must not be able to act on it,
+        # and must not be able to distinguish "not yours" from "doesn't exist".
+        accept = client.post(f"/api/friends/requests/{request_id}/accept", headers=c["headers"])
+        assert accept.status_code == 404
+
+        decline = client.post(f"/api/friends/requests/{request_id}/decline", headers=c["headers"])
+        assert decline.status_code == 404
+
+        nonexistent = client.post("/api/friends/requests/999999999/accept", headers=c["headers"])
+        assert nonexistent.status_code == 404
+
+    def test_unfriend_removes_mutual_friendship(self):
+        client = TestClient(app)
+        a = _register(client, "fr_unfr_a")
+        b = _register(client, "fr_unfr_b")
+
+        request_id = client.post(
+            "/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"]
+        ).json()["id"]
+        client.post(f"/api/friends/requests/{request_id}/accept", headers=b["headers"])
+
+        unfriend = client.delete(f"/api/friends/{a['id']}", headers=b["headers"])
+        assert unfriend.status_code == 200, unfriend.text
+
+        assert client.get("/api/friends", headers=a["headers"]).json()["friends"] == []
+        assert client.get("/api/friends", headers=b["headers"]).json()["friends"] == []
+
+        # Idempotency / no dangling state: unfriending again is a clean 404, not 500.
+        again = client.delete(f"/api/friends/{a['id']}", headers=b["headers"])
+        assert again.status_code == 404
+
+
+class TestSelfAndDuplicateRejection:
+    def test_self_request_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "self_req_a")
+        resp = client.post("/api/friends/requests", json={"user_id": a["id"]}, headers=a["headers"])
+        assert resp.status_code == 400
+
+    def test_self_follow_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "self_follow_a")
+        resp = client.post(f"/api/friends/{a['id']}/follow", headers=a["headers"])
+        assert resp.status_code == 400
+
+    def test_self_block_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "self_block_a")
+        resp = client.post(f"/api/friends/{a['id']}/block", headers=a["headers"])
+        assert resp.status_code == 400
+
+    def test_duplicate_friend_request_is_conflict_not_500(self):
+        client = TestClient(app)
+        a = _register(client, "dup_req_a")
+        b = _register(client, "dup_req_b")
+        assert client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"]).status_code == 201
+        dup = client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"])
+        assert dup.status_code == 409
+
+    def test_reverse_duplicate_friend_request_is_conflict(self):
+        """b requesting a while a's request to b is still pending is treated
+        as a duplicate of the same pair, not a second independent request."""
+        client = TestClient(app)
+        a = _register(client, "dup_rev_a")
+        b = _register(client, "dup_rev_b")
+        assert client.post("/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"]).status_code == 201
+        reverse = client.post("/api/friends/requests", json={"user_id": a["id"]}, headers=b["headers"])
+        assert reverse.status_code == 409
+
+    def test_duplicate_follow_is_conflict_not_500(self):
+        client = TestClient(app)
+        a = _register(client, "dup_follow_a")
+        b = _register(client, "dup_follow_b")
+        assert client.post(f"/api/friends/{b['id']}/follow", headers=a["headers"]).status_code == 201
+        dup = client.post(f"/api/friends/{b['id']}/follow", headers=a["headers"])
+        assert dup.status_code == 409
+
+    def test_duplicate_block_is_conflict_not_500(self):
+        client = TestClient(app)
+        a = _register(client, "dup_block_a")
+        b = _register(client, "dup_block_b")
+        assert client.post(f"/api/friends/{b['id']}/block", headers=a["headers"]).status_code == 201
+        dup = client.post(f"/api/friends/{b['id']}/block", headers=a["headers"])
+        assert dup.status_code == 409
+
+    def test_friend_request_to_nonexistent_user_is_404(self):
+        client = TestClient(app)
+        a = _register(client, "req_missing_a")
+        resp = client.post("/api/friends/requests", json={"user_id": 999999999}, headers=a["headers"])
+        assert resp.status_code == 404
+
+
+class TestFollow:
+    def test_follow_unfollow_and_list(self):
+        client = TestClient(app)
+        a = _register(client, "follow_flow_a")
+        b = _register(client, "follow_flow_b")
+
+        follow = client.post(f"/api/friends/{b['id']}/follow", headers=a["headers"])
+        assert follow.status_code == 201, follow.text
+
+        following = client.get("/api/friends/following", headers=a["headers"]).json()["following"]
+        assert any(u["id"] == b["id"] for u in following)
+
+        # One-way: b does not follow a.
+        b_following = client.get("/api/friends/following", headers=b["headers"]).json()["following"]
+        assert b_following == []
+
+        unfollow = client.delete(f"/api/friends/{b['id']}/follow", headers=a["headers"])
+        assert unfollow.status_code == 200, unfollow.text
+
+        following_after = client.get("/api/friends/following", headers=a["headers"]).json()["following"]
+        assert following_after == []
+
+        # Unfollowing again is a clean 404, not 500.
+        again = client.delete(f"/api/friends/{b['id']}/follow", headers=a["headers"])
+        assert again.status_code == 404
+
+    def test_follow_requires_auth(self):
+        client = TestClient(app)
+        b = _register(client, "follow_noauth_b")
+        resp = client.post(f"/api/friends/{b['id']}/follow", json={})
+        assert resp.status_code == 401
+
+
+class TestBlock:
+    def test_block_clears_existing_friendship_and_follow(self):
+        client = TestClient(app)
+        a = _register(client, "block_clear_a")
+        b = _register(client, "block_clear_b")
+
+        request_id = client.post(
+            "/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"]
+        ).json()["id"]
+        client.post(f"/api/friends/requests/{request_id}/accept", headers=b["headers"])
+        client.post(f"/api/friends/{a['id']}/follow", headers=b["headers"])
+
+        assert any(
+            u["id"] == b["id"] for u in client.get("/api/friends", headers=a["headers"]).json()["friends"]
+        )
+        assert any(
+            u["id"] == a["id"]
+            for u in client.get("/api/friends/following", headers=b["headers"]).json()["following"]
+        )
+
+        block = client.post(f"/api/friends/{b['id']}/block", headers=a["headers"])
+        assert block.status_code == 201, block.text
+
+        assert client.get("/api/friends", headers=a["headers"]).json()["friends"] == []
+        assert client.get("/api/friends", headers=b["headers"]).json()["friends"] == []
+        assert client.get("/api/friends/following", headers=b["headers"]).json()["following"] == []
+
+        blocked_list = client.get("/api/friends/blocked", headers=a["headers"]).json()["blocked"]
+        assert any(u["id"] == b["id"] for u in blocked_list)
+
+    def test_block_prevents_new_friend_request_and_follow(self):
+        client = TestClient(app)
+        a = _register(client, "block_prevent_a")
+        b = _register(client, "block_prevent_b")
+
+        client.post(f"/api/friends/{b['id']}/block", headers=a["headers"])
+
+        req = client.post("/api/friends/requests", json={"user_id": a["id"]}, headers=b["headers"])
+        assert req.status_code == 403
+
+        follow = client.post(f"/api/friends/{a['id']}/follow", headers=b["headers"])
+        assert follow.status_code == 403
+
+    def test_unblock_removes_block(self):
+        client = TestClient(app)
+        a = _register(client, "unblock_a")
+        b = _register(client, "unblock_b")
+
+        client.post(f"/api/friends/{b['id']}/block", headers=a["headers"])
+        unblock = client.delete(f"/api/friends/{b['id']}/block", headers=a["headers"])
+        assert unblock.status_code == 200, unblock.text
+
+        assert client.get("/api/friends/blocked", headers=a["headers"]).json()["blocked"] == []
+
+        # Idempotency: unblocking again is a clean 404, not 500.
+        again = client.delete(f"/api/friends/{b['id']}/block", headers=a["headers"])
+        assert again.status_code == 404
+
+        # After unblock, a fresh follow/request works again.
+        assert client.post(f"/api/friends/{a['id']}/follow", headers=b["headers"]).status_code == 201
+
+
+class TestDataIsolation:
+    def test_list_endpoints_are_scoped_to_caller(self):
+        """A third party's friends/following/blocked lists must never leak
+        into another user's response."""
+        client = TestClient(app)
+        a = _register(client, "iso_a")
+        b = _register(client, "iso_b")
+        c = _register(client, "iso_c")
+
+        request_id = client.post(
+            "/api/friends/requests", json={"user_id": b["id"]}, headers=a["headers"]
+        ).json()["id"]
+        client.post(f"/api/friends/requests/{request_id}/accept", headers=b["headers"])
+        client.post(f"/api/friends/{b['id']}/follow", headers=a["headers"])
+        client.post(f"/api/friends/{b['id']}/block", headers=c["headers"])
+
+        c_friends = client.get("/api/friends", headers=c["headers"]).json()["friends"]
+        c_following = client.get("/api/friends/following", headers=c["headers"]).json()["following"]
+        assert c_friends == []
+        assert c_following == []
+
+        # c's block of b must not appear in a's or b's blocked list.
+        a_blocked = client.get("/api/friends/blocked", headers=a["headers"]).json()["blocked"]
+        assert a_blocked == []
+
+    def test_requires_auth_on_all_endpoints(self):
+        client = TestClient(app)
+        assert client.get("/api/friends").status_code == 401
+        assert client.get("/api/friends/requests").status_code == 401
+        assert client.get("/api/friends/following").status_code == 401
+        assert client.get("/api/friends/blocked").status_code == 401
+        assert client.post("/api/friends/requests", json={"user_id": 1}).status_code == 401

backend/tests/test_social_models.py

@@ -0,0 +1,240 @@
+"""Model-level tests for the social graph: friendships, follows, blocks.
+
+app/models/social.py / alembic/versions/0007_add_social_graph_tables.py
+(docs/planning/social.md US-1). This is the models+migration task only --
+there are no API endpoints yet (a sibling task owns the router), so these
+tests exercise the ORM models and the real Postgres constraints directly
+rather than going through HTTP.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import delete, select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.social import Friendship, Follow, Block, FriendshipStatus
+from app.models.user import User
+
+
+def _register(client: TestClient, username: str) -> int:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    headers = {"Authorization": f"Bearer {resp.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+class TestFriendshipRequestAccept:
+    async def test_request_defaults_to_pending(self):
+        client = TestClient(app)
+        a = _register(client, "sg_fr_a1")
+        b = _register(client, "sg_fr_b1")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                fr = Friendship(requester_id=a, addressee_id=b)
+                session.add(fr)
+                await session.commit()
+                await session.refresh(fr)
+                assert fr.status == FriendshipStatus.PENDING
+                assert fr.requester_id == a
+                assert fr.addressee_id == b
+        finally:
+            await engine.dispose()
+
+    async def test_accept_updates_status(self):
+        client = TestClient(app)
+        a = _register(client, "sg_fr_a2")
+        b = _register(client, "sg_fr_b2")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                fr = Friendship(requester_id=a, addressee_id=b)
+                session.add(fr)
+                await session.commit()
+                fr_id = fr.id
+
+            async with factory() as session:
+                fr = await session.get(Friendship, fr_id)
+                fr.status = FriendshipStatus.ACCEPTED
+                await session.commit()
+
+            async with factory() as session:
+                fr = await session.get(Friendship, fr_id)
+                assert fr.status == FriendshipStatus.ACCEPTED
+        finally:
+            await engine.dispose()
+
+
+class TestUniquePairConstraints:
+    async def test_duplicate_friendship_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "sg_uq_fr_a")
+        b = _register(client, "sg_uq_fr_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Friendship(requester_id=a, addressee_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Friendship(requester_id=a, addressee_id=b))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+    async def test_duplicate_follow_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "sg_uq_fw_a")
+        b = _register(client, "sg_uq_fw_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Follow(follower_id=a, followed_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Follow(follower_id=a, followed_id=b))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+    async def test_duplicate_block_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "sg_uq_bl_a")
+        b = _register(client, "sg_uq_bl_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Block(blocker_id=a, blocked_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Block(blocker_id=a, blocked_id=b))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+
+class TestFollow:
+    async def test_create_follow(self):
+        client = TestClient(app)
+        a = _register(client, "sg_follow_a")
+        b = _register(client, "sg_follow_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Follow(follower_id=a, followed_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                rows = (await session.execute(
+                    select(Follow).where(Follow.follower_id == a, Follow.followed_id == b)
+                )).scalars().all()
+                assert len(rows) == 1
+        finally:
+            await engine.dispose()
+
+
+class TestBlock:
+    async def test_create_block(self):
+        client = TestClient(app)
+        a = _register(client, "sg_block_a")
+        b = _register(client, "sg_block_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Block(blocker_id=a, blocked_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                rows = (await session.execute(
+                    select(Block).where(Block.blocker_id == a, Block.blocked_id == b)
+                )).scalars().all()
+                assert len(rows) == 1
+        finally:
+            await engine.dispose()
+
+
+class TestCascadeDelete:
+    async def test_deleting_user_removes_rows_in_all_three_tables(self):
+        """Deleting a user removes friendships/follows/blocks referencing them
+        in *either* FK column, via the real DB ON DELETE CASCADE (deleted with
+        a Core statement, bypassing any ORM-level cascade, to prove the
+        database constraint itself does the job)."""
+        client = TestClient(app)
+        a = _register(client, "sg_cascade_a")
+        b = _register(client, "sg_cascade_b")
+        c = _register(client, "sg_cascade_c")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                # a as requester/follower/blocker, and also as addressee (c -> a)
+                session.add(Friendship(requester_id=a, addressee_id=b))
+                session.add(Friendship(requester_id=c, addressee_id=a))
+                session.add(Follow(follower_id=a, followed_id=b))
+                session.add(Follow(follower_id=c, followed_id=a))
+                session.add(Block(blocker_id=a, blocked_id=b))
+                session.add(Block(blocker_id=c, blocked_id=a))
+                await session.commit()
+
+            async with factory() as session:
+                await session.execute(delete(User).where(User.id == a))
+                await session.commit()
+
+            async with factory() as session:
+                friendships = (await session.execute(
+                    select(Friendship).where(
+                        (Friendship.requester_id == a) | (Friendship.addressee_id == a)
+                    )
+                )).scalars().all()
+                follows = (await session.execute(
+                    select(Follow).where(
+                        (Follow.follower_id == a) | (Follow.followed_id == a)
+                    )
+                )).scalars().all()
+                blocks = (await session.execute(
+                    select(Block).where(
+                        (Block.blocker_id == a) | (Block.blocked_id == a)
+                    )
+                )).scalars().all()
+                assert friendships == []
+                assert follows == []
+                assert blocks == []
+
+                # Unrelated rows (b, c only) survive.
+                remaining_users = (await session.execute(
+                    select(User.id).where(User.id.in_([b, c]))
+                )).scalars().all()
+                assert set(remaining_users) == {b, c}
+        finally:
+            await engine.dispose()

backend/tests/test_text_filter.py

@@ -0,0 +1,194 @@
+"""Unit tests for app.services.text_filter (docs/planning/social.md §4/§5 US-4).
+
+Pure, side-effect-free service -- no DB/Redis fixtures needed.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from app.services.text_filter import (
+    DEFAULT_TERMS_PATH,
+    FilterAction,
+    FilterMode,
+    FilterResult,
+    ListBasedTextFilter,
+    TextFilter,
+    default_text_filter,
+    load_terms,
+)
+
+
+@pytest.fixture
+def redact_filter() -> ListBasedTextFilter:
+    return ListBasedTextFilter(terms=["badword", "shoot"], mode=FilterMode.REDACT)
+
+
+@pytest.fixture
+def reject_filter() -> ListBasedTextFilter:
+    return ListBasedTextFilter(terms=["badword", "shoot"], mode=FilterMode.REJECT)
+
+
+class TestAllowPath:
+    def test_clean_text_is_allowed_unchanged(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("hello there, how are you today?")
+        assert result.action is FilterAction.ALLOW
+        assert result.filtered_text == "hello there, how are you today?"
+        assert result.matched_terms == ()
+
+    def test_message_with_no_matches(self, reject_filter: ListBasedTextFilter) -> None:
+        # Distinct from the clean-text case above: exercises the reject-mode
+        # filter's no-match path specifically (mode should not matter when
+        # nothing matches).
+        text = "let's meet at the plaza around noon"
+        result = reject_filter.check(text)
+        assert result.action is FilterAction.ALLOW
+        assert result.filtered_text == text
+        assert result.matched_terms == ()
+
+
+class TestRedactPath:
+    def test_exact_match_is_redacted(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("don't be a badword about it")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("badword",)
+        assert "badword" not in result.filtered_text
+        assert result.filtered_text == "don't be a ******* about it"
+
+    def test_multiple_distinct_matches(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("badword, don't shoot!")
+        assert result.action is FilterAction.REDACT
+        assert set(result.matched_terms) == {"badword", "shoot"}
+        assert "badword" not in result.filtered_text
+        assert "shoot" not in result.filtered_text
+        # Length is preserved (asterisks replace matched spans 1:1).
+        assert len(result.filtered_text) == len("badword, don't shoot!")
+
+    def test_redaction_char_is_configurable(self) -> None:
+        f = ListBasedTextFilter(terms=["badword"], mode=FilterMode.REDACT, redaction_char="#")
+        result = f.check("that's a badword thing to say")
+        assert result.filtered_text == "that's a ####### thing to say"
+
+
+class TestRejectPath:
+    def test_match_is_rejected_and_text_left_intact(self, reject_filter: ListBasedTextFilter) -> None:
+        text = "stop, badword!"
+        result = reject_filter.check(text)
+        assert result.action is FilterAction.REJECT
+        assert result.matched_terms == ("badword",)
+        # Reject mode does not mutate the text -- callers are expected to
+        # not store/deliver it at all, based on `action`.
+        assert result.filtered_text == text
+
+
+class TestNormalization:
+    def test_leetspeak_variant_is_caught(self, redact_filter: ListBasedTextFilter) -> None:
+        # "b4dw0rd" -> normalizes to "badword" via the leet map (4->a, 0->o).
+        result = redact_filter.check("you're being a b4dw0rd right now")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("badword",)
+
+    def test_separators_between_letters_are_stripped(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("that is b.a.d.w.o.r.d behavior")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("badword",)
+
+    def test_spacing_between_letters_is_stripped(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("b a d w o r d, seriously")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("badword",)
+
+    def test_case_folding(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("BADWORD in all caps")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("badword",)
+
+    def test_symbol_lookalikes(self) -> None:
+        # @ -> a, $ -> s: "@ss" should normalize to "ass".
+        f = ListBasedTextFilter(terms=["ass"], mode=FilterMode.REDACT)
+        result = f.check("what an @$$ move")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("ass",)
+
+
+class TestEmptyAndWhitespace:
+    def test_empty_string(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("")
+        assert result.action is FilterAction.ALLOW
+        assert result.filtered_text == ""
+        assert result.matched_terms == ()
+
+    def test_whitespace_only_string(self, redact_filter: ListBasedTextFilter) -> None:
+        text = "   \t\n  "
+        result = redact_filter.check(text)
+        assert result.action is FilterAction.ALLOW
+        assert result.filtered_text == text
+        assert result.matched_terms == ()
+
+    def test_punctuation_only_string_has_nothing_to_normalize(self, redact_filter: ListBasedTextFilter) -> None:
+        # No alnum characters survive normalization at all -- must not
+        # crash on an empty normalized string / empty index_map.
+        result = redact_filter.check("...!!!???")
+        assert result.action is FilterAction.ALLOW
+        assert result.matched_terms == ()
+
+
+class TestConfigurability:
+    def test_custom_term_list_is_used_instead_of_default(self) -> None:
+        f = ListBasedTextFilter(terms=["zzzcustomzzz"], mode=FilterMode.REDACT)
+        result = f.check("this contains zzzcustomzzz right here")
+        assert result.action is FilterAction.REDACT
+        assert result.matched_terms == ("zzzcustomzzz",)
+        # Default list terms should NOT match since we overrode the list.
+        result2 = f.check("this is fucking unrelated")
+        assert result2.action is FilterAction.ALLOW
+
+    def test_duplicate_and_blank_terms_are_deduped(self) -> None:
+        f = ListBasedTextFilter(terms=["badword", "badword", "  ", ""], mode=FilterMode.REDACT)
+        assert f._terms == ("badword",)
+
+    def test_default_terms_file_loads_and_is_nonempty(self) -> None:
+        terms = load_terms()
+        assert isinstance(terms, list)
+        assert len(terms) > 0
+        assert all(isinstance(t, str) and t for t in terms)
+
+    def test_default_terms_path_exists(self) -> None:
+        assert DEFAULT_TERMS_PATH.exists()
+        assert DEFAULT_TERMS_PATH.suffix == ".json"
+
+    def test_load_terms_from_explicit_path(self, tmp_path: Path) -> None:
+        custom = tmp_path / "custom_terms.json"
+        custom.write_text('{"terms": ["foo", "bar"]}', encoding="utf-8")
+        assert load_terms(custom) == ["foo", "bar"]
+
+    def test_default_text_filter_factory_matches_default_list(self) -> None:
+        f = default_text_filter(mode=FilterMode.REJECT)
+        result = f.check("that's fucking ridiculous")
+        assert result.action is FilterAction.REJECT
+        assert "fuck" in result.matched_terms
+
+
+class TestProtocol:
+    def test_list_based_filter_satisfies_text_filter_protocol(self, redact_filter: ListBasedTextFilter) -> None:
+        assert isinstance(redact_filter, TextFilter)
+
+    def test_check_returns_filter_result(self, redact_filter: ListBasedTextFilter) -> None:
+        result = redact_filter.check("hi")
+        assert isinstance(result, FilterResult)
+
+    def test_a_third_party_style_implementation_satisfies_the_protocol(self) -> None:
+        # Demonstrates the extension point: any object with a matching
+        # `check` method satisfies TextFilter without inheriting from
+        # anything -- this is how a future third-party provider would plug
+        # in without touching this module.
+        class AlwaysAllow:
+            def check(self, text: str) -> FilterResult:
+                return FilterResult(action=FilterAction.ALLOW, filtered_text=text, matched_terms=())
+
+        provider: TextFilter = AlwaysAllow()
+        assert isinstance(provider, TextFilter)
+        result = provider.check("anything at all, even fuck")
+        assert result.action is FilterAction.ALLOW

backend/tests/test_wallet_api.py

@@ -0,0 +1,135 @@
+"""Integration tests for Wallet service and API endpoints.
+
+docs/planning/economy.md US-1 (task 909e3e9a59af).
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.wallet import TransactionType
+from app.services.wallet import InsufficientFundsError, InvalidAmountError, wallet_service
+
+
+def _register(client: TestClient, username: str) -> tuple[int, dict[str, str]]:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"], headers
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+def test_wallet_unauthorized():
+    client = TestClient(app)
+    resp = client.get("/api/wallet")
+    assert resp.status_code == 401
+
+    resp = client.get("/api/wallet/transactions")
+    assert resp.status_code == 401
+
+
+def test_get_wallet_lazy_creation():
+    client = TestClient(app)
+    uid, headers = _register(client, "wallet_api_user_1")
+
+    resp = client.get("/api/wallet", headers=headers)
+    assert resp.status_code == 200, resp.text
+    data = resp.json()
+    assert data["user_id"] == uid
+    assert data["balance"] == 0
+    assert data["id"] is not None
+
+
+@pytest.mark.asyncio
+async def test_wallet_service_credit_and_debit_flow():
+    client = TestClient(app)
+    uid, headers = _register(client, "wallet_api_user_2")
+
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            # 1. Credit
+            wallet, tx = await wallet_service.credit(
+                session,
+                user_id=uid,
+                amount=1000,
+                tx_type=TransactionType.credit_purchase,
+                reference_type="test_ref",
+                reference_id="ref_1",
+                idempotency_key="credit_idemp_1",
+            )
+            assert wallet.balance == 1000
+            assert tx.amount == 1000
+            assert tx.balance_after == 1000
+
+            # 2. Idempotent re-credit does not increase balance
+            wallet2, tx2 = await wallet_service.credit(
+                session,
+                user_id=uid,
+                amount=1000,
+                tx_type=TransactionType.credit_purchase,
+                idempotency_key="credit_idemp_1",
+            )
+            assert wallet2.balance == 1000
+            assert tx2.id == tx.id
+
+            # 3. Debit
+            wallet3, tx3 = await wallet_service.debit(
+                session,
+                user_id=uid,
+                amount=400,
+                tx_type=TransactionType.marketplace_purchase,
+                reference_type="purchase",
+                reference_id="item_42",
+                idempotency_key="debit_idemp_1",
+            )
+            assert wallet3.balance == 600
+            assert tx3.amount == -400
+            assert tx3.balance_after == 600
+
+            # 4. Over-debit raises InsufficientFundsError
+            with pytest.raises(InsufficientFundsError):
+                await wallet_service.debit(
+                    session,
+                    user_id=uid,
+                    amount=1000,
+                    tx_type=TransactionType.marketplace_purchase,
+                )
+
+            # Balance remains 600
+            w_check = await wallet_service.get_or_create_wallet(session, uid)
+            assert w_check.balance == 600
+    finally:
+        await engine.dispose()
+
+    # Verify via API
+    resp = client.get("/api/wallet", headers=headers)
+    assert resp.status_code == 200
+    assert resp.json()["balance"] == 600
+
+    resp_tx = client.get("/api/wallet/transactions", headers=headers)
+    assert resp_tx.status_code == 200
+    tx_data = resp_tx.json()
+    assert tx_data["total"] == 2
+    assert len(tx_data["transactions"]) == 2
+    # Newest first: debit (-400) first, then credit (+1000)
+    assert tx_data["transactions"][0]["amount"] == -400
+    assert tx_data["transactions"][1]["amount"] == 1000

backend/tests/test_wallet_models.py

@@ -0,0 +1,141 @@
+"""Model-level integration tests for Wallets and Transaction ledger.
+
+docs/planning/economy.md US-1 (task 8343bc0a730f).
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.wallet import Wallet, Transaction, TransactionType
+from app.models.user import User
+
+
+def _register(client: TestClient, username: str) -> int:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    headers = {"Authorization": f"Bearer {resp.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+@pytest.mark.asyncio
+async def test_wallet_creation_and_defaults():
+    client = TestClient(app)
+    uid = _register(client, "wallet_user_1")
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            wallet = Wallet(user_id=uid)
+            session.add(wallet)
+            await session.commit()
+            await session.refresh(wallet)
+
+            assert wallet.id is not None
+            assert wallet.user_id == uid
+            assert wallet.balance == 0
+            assert wallet.created_at is not None
+            assert wallet.updated_at is not None
+    finally:
+        await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_wallet_unique_user_id():
+    client = TestClient(app)
+    uid = _register(client, "wallet_user_2")
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            w1 = Wallet(user_id=uid)
+            session.add(w1)
+            await session.commit()
+
+        async with sf() as session:
+            w2 = Wallet(user_id=uid)
+            session.add(w2)
+            with pytest.raises(IntegrityError):
+                await session.commit()
+    finally:
+        await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_wallet_non_negative_balance_constraint():
+    client = TestClient(app)
+    uid = _register(client, "wallet_user_3")
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            w = Wallet(user_id=uid, balance=-50)
+            session.add(w)
+            with pytest.raises(IntegrityError):
+                await session.commit()
+    finally:
+        await engine.dispose()
+
+
+@pytest.mark.asyncio
+async def test_transaction_ledger_and_idempotency():
+    client = TestClient(app)
+    uid = _register(client, "wallet_user_4")
+    engine, sf = _session_factory()
+    try:
+        async with sf() as session:
+            wallet = Wallet(user_id=uid, balance=500)
+            session.add(wallet)
+            await session.commit()
+            await session.refresh(wallet)
+
+            tx1 = Transaction(
+                wallet_id=wallet.id,
+                type=TransactionType.credit_purchase,
+                amount=500,
+                balance_after=500,
+                reference_type="purchase_session",
+                reference_id="sess_123",
+                idempotency_key="idemp_key_001",
+                metadata_json={"payment_method": "simulated"},
+            )
+            session.add(tx1)
+            await session.commit()
+            await session.refresh(tx1)
+
+            assert tx1.id is not None
+            assert tx1.type == TransactionType.credit_purchase
+            assert tx1.amount == 500
+            assert tx1.balance_after == 500
+
+        # Duplicate idempotency_key must raise IntegrityError
+        async with sf() as session:
+            tx2 = Transaction(
+                wallet_id=wallet.id,
+                type=TransactionType.credit_purchase,
+                amount=500,
+                balance_after=1000,
+                idempotency_key="idemp_key_001",
+            )
+            session.add(tx2)
+            with pytest.raises(IntegrityError):
+                await session.commit()
+    finally:
+        await engine.dispose()

backend/tests/test_world_content.py

@@ -0,0 +1,490 @@
+"""Integration tests for the world content API: rooms + chunks.
+
+Covers docs/architecture/world_persistence_impl.md §8.1 (public router,
+app/routers/world_content.py) and §8.3 (internal router,
+app/routers/internal.py), plus the create_world -> auto "main" room
+behaviour (§4.1).
+
+Runs against the real ephemeral Postgres the hermetic conftest.py stands
+up -- these are full HTTP round trips through TestClient, not mocked.
+"""
+
+import base64
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+from app.services import chunk_codec as cc
+from app.services.game_servers import supervisor
+
+GRID_32 = (32, 32, 1)
+
+
+def _auth(client: TestClient, name: str) -> tuple[dict, int]:
+    r = client.post("/api/auth/register", json={
+        "username": name, "email": f"{name}@e.com", "password": "secret123",
+        "date_of_birth": "1990-01-01",
+    })
+    assert r.status_code == 201, r.text
+    headers = {"Authorization": f"Bearer {r.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    return headers, me.json()["id"]
+
+
+def _make_world(client: TestClient, headers: dict, visibility: str = "public") -> int:
+    r = client.post("/api/worlds/", headers=headers, json={"name": "W", "visibility": visibility})
+    assert r.status_code == 201, r.text
+    return r.json()["id"]
+
+
+def _build_chunk(world_id: int, slug: str, cx: int, cy: int, cz: int, *,
+                  grid=GRID_32, revision: int = 1, extra_tag: str = "") -> bytes:
+    """A small but structurally-real chunk payload for `world_id`/`slug`/coord,
+    sized to match the room's default 32x32x1 grid."""
+    w, h, d = grid
+    layer = cc.TileLayer(
+        name="ground", layer_id=0, width=w, height=h, depth=d,
+        palette=[cc.TileDef(id=0, asset_id="", solid=False, flags=0, variants=1)],
+        tiles=[0] * (w * h * d),
+    )
+    obj = cc.WorldObject(
+        id=f"obj_{extra_tag or '1'}", type="prop", asset_id="props/rock",
+        pos=(1.0, 1.0, 0.0), properties={"tag": extra_tag},
+    )
+    payload = cc.ChunkPayload(
+        world_id=str(world_id), room_id=slug, coord=(cx, cy, cz),
+        bounds=cc.ChunkBounds(min=(0.0, 0.0, 0.0), size=(float(w), float(h), float(d))),
+        tile_layers=[layer], objects=[obj], revision=revision, author="pytest",
+        created_at=1_700_000_000, updated_at=1_700_000_000,
+    )
+    return cc.encode_binary(payload)
+
+
+class TestCreateWorldMainRoom:
+    def test_create_world_auto_creates_main_room(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "cw_main")
+        wid = _make_world(client, headers)
+
+        r = client.get(f"/api/worlds/{wid}/rooms", headers=headers)
+        assert r.status_code == 200, r.text
+        rooms = r.json()
+        assert len(rooms) == 1
+        assert rooms[0]["slug"] == "main"
+        assert rooms[0]["name"] == "Main"
+        assert rooms[0]["chunk_count"] == 0
+        assert rooms[0]["grid"]["size"] == [32, 32, 1]
+
+
+class TestRoomAuth:
+    def test_create_room_requires_owner(self):
+        client = TestClient(app)
+        owner_headers, _ = _auth(client, "room_owner")
+        wid = _make_world(client, owner_headers)
+        other_headers, _ = _auth(client, "room_other")
+        r = client.post(f"/api/worlds/{wid}/rooms", headers=other_headers,
+                         json={"slug": "annex", "name": "Annex"})
+        assert r.status_code == 403
+
+    def test_list_rooms_of_private_world_is_404_for_non_owner(self):
+        client = TestClient(app)
+        owner_headers, _ = _auth(client, "room_priv_owner")
+        wid = _make_world(client, owner_headers, "private")
+        other_headers, _ = _auth(client, "room_priv_other")
+        r = client.get(f"/api/worlds/{wid}/rooms", headers=other_headers)
+        assert r.status_code == 404
+
+
+class TestChunkPutGetRoundTrip:
+    def test_binary_put_then_binary_get_round_trips(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "chunk_rt")
+        wid = _make_world(client, headers)
+        payload = _build_chunk(wid, "main", 0, 0, 0)
+
+        r = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/0/0/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=payload,
+        )
+        assert r.status_code == 200, r.text
+        body = r.json()
+        assert body["revision"] == 1
+        assert body["payload_len"] == len(payload)
+        assert body["checksum"] == cc.checksum(payload[cc.HEADER_SIZE:])
+        assert body["live_session"] is False
+
+        g = client.get(
+            f"/api/worlds/{wid}/rooms/main/chunks/0/0/0",
+            headers={**headers, "Accept": "application/octet-stream"},
+        )
+        assert g.status_code == 200
+        assert g.content == payload
+        assert g.headers["ETag"] == f'"{body["checksum"]}"'
+        assert g.headers["X-Chunk-Revision"] == "1"
+
+    def test_json_accept_returns_decoded_shape(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "chunk_json")
+        wid = _make_world(client, headers)
+        payload = _build_chunk(wid, "main", 1, 1, 0)
+        client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/1/1/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=payload,
+        )
+        g = client.get(
+            f"/api/worlds/{wid}/rooms/main/chunks/1/1/0",
+            headers={**headers, "Accept": "application/json"},
+        )
+        assert g.status_code == 200
+        data = g.json()
+        assert data["coord"] == {"cx": 1, "cy": 1, "cz": 0}
+        assert data["world_id"] == str(wid)
+        assert data["room_id"] == "main"
+        assert len(data["objects"]) == 1
+
+    def test_json_put_with_base64_payload(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "chunk_json_put")
+        wid = _make_world(client, headers)
+        payload = _build_chunk(wid, "main", 2, 2, 0)
+        r = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/2/2/0", headers=headers,
+            json={"base_revision": 0, "payload_b64": base64.b64encode(payload).decode()},
+        )
+        assert r.status_code == 200, r.text
+        assert r.json()["revision"] == 1
+
+    def test_if_none_match_returns_304(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "chunk_304")
+        wid = _make_world(client, headers)
+        payload = _build_chunk(wid, "main", 3, 3, 0)
+        put = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/3/3/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=payload,
+        )
+        checksum = put.json()["checksum"]
+        g = client.get(
+            f"/api/worlds/{wid}/rooms/main/chunks/3/3/0",
+            headers={**headers, "If-None-Match": f'"{checksum}"'},
+        )
+        assert g.status_code == 304
+
+    def test_unwritten_coordinate_is_404(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "chunk_404")
+        wid = _make_world(client, headers)
+        g = client.get(f"/api/worlds/{wid}/rooms/main/chunks/9/9/0", headers=headers)
+        assert g.status_code == 404
+
+
+class TestRevisionConflict:
+    def test_create_conflict_when_chunk_already_exists(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "conflict_create")
+        wid = _make_world(client, headers)
+        payload = _build_chunk(wid, "main", 4, 4, 0)
+        first = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/4/4/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=payload,
+        )
+        assert first.status_code == 200
+
+        second = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/4/4/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=payload,
+        )
+        assert second.status_code == 409
+        body = second.json()
+        assert body["detail"] == "revision conflict"
+        assert body["current_revision"] == 1
+
+    def test_stale_base_revision_conflict_reports_current_state(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "conflict_stale")
+        wid = _make_world(client, headers)
+        payload_v1 = _build_chunk(wid, "main", 5, 5, 0, revision=1)
+        client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/5/5/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=payload_v1,
+        )
+        payload_v2 = _build_chunk(wid, "main", 5, 5, 0, revision=2, extra_tag="v2")
+        r2 = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/5/5/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "1"},
+            content=payload_v2,
+        )
+        assert r2.status_code == 200
+        assert r2.json()["revision"] == 2
+
+        # Now retry with the now-stale base_revision=1 again.
+        payload_v3 = _build_chunk(wid, "main", 5, 5, 0, revision=3, extra_tag="v3")
+        stale = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/5/5/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "1"},
+            content=payload_v3,
+        )
+        assert stale.status_code == 409
+        body = stale.json()
+        assert body["current_revision"] == 2
+        assert body["current_checksum"] == r2.json()["checksum"]
+
+
+class TestBatchWrite:
+    def test_batch_put_all_succeed(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "batch_ok")
+        wid = _make_world(client, headers)
+        chunks = [
+            {"cx": cx, "cy": 0, "cz": 0, "base_revision": 0,
+             "payload_b64": base64.b64encode(_build_chunk(wid, "main", cx, 0, 0)).decode()}
+            for cx in (10, 11)
+        ]
+        r = client.put(f"/api/worlds/{wid}/rooms/main/chunks", headers=headers, json={"chunks": chunks})
+        assert r.status_code == 200, r.text
+        body = r.json()
+        assert len(body["chunks"]) == 2
+        assert all(c["revision"] == 1 for c in body["chunks"])
+
+        idx = client.get(f"/api/worlds/{wid}/rooms/main/chunks", headers=headers)
+        keys = {c["key"] for c in idx.json()["chunks"]}
+        assert f"{wid}:main:10:0:0" in keys
+        assert f"{wid}:main:11:0:0" in keys
+
+    def test_batch_put_is_all_or_nothing_on_conflict(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "batch_conflict")
+        wid = _make_world(client, headers)
+
+        # Pre-create one of the two coordinates so the batch's base_revision=0
+        # for it will conflict.
+        pre = _build_chunk(wid, "main", 20, 0, 0)
+        client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/20/0/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=pre,
+        )
+
+        chunks = [
+            {"cx": 21, "cy": 0, "cz": 0, "base_revision": 0,
+             "payload_b64": base64.b64encode(_build_chunk(wid, "main", 21, 0, 0)).decode()},
+            {"cx": 20, "cy": 0, "cz": 0, "base_revision": 0,  # conflicts: already exists at revision 1
+             "payload_b64": base64.b64encode(_build_chunk(wid, "main", 20, 0, 0, extra_tag="v2")).decode()},
+        ]
+        r = client.put(f"/api/worlds/{wid}/rooms/main/chunks", headers=headers, json={"chunks": chunks})
+        assert r.status_code == 409
+
+        # Nothing from this batch should have been persisted -- (21,0,0)
+        # must NOT exist even though it was valid and came first.
+        g = client.get(f"/api/worlds/{wid}/rooms/main/chunks/21/0/0", headers=headers)
+        assert g.status_code == 404
+
+
+class TestDelete:
+    def test_delete_then_get_is_404(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "chunk_delete")
+        wid = _make_world(client, headers)
+        payload = _build_chunk(wid, "main", 30, 0, 0)
+        client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/30/0/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=payload,
+        )
+        d = client.delete(f"/api/worlds/{wid}/rooms/main/chunks/30/0/0", headers=headers)
+        assert d.status_code == 204
+        g = client.get(f"/api/worlds/{wid}/rooms/main/chunks/30/0/0", headers=headers)
+        assert g.status_code == 404
+
+
+class TestRevisionsAndRollback:
+    def test_revisions_then_rollback(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "chunk_rollback")
+        wid = _make_world(client, headers)
+        v1 = _build_chunk(wid, "main", 40, 0, 0, revision=1)
+        r1 = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/40/0/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=v1,
+        )
+        v2 = _build_chunk(wid, "main", 40, 0, 0, revision=2, extra_tag="v2")
+        r2 = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/40/0/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "1"},
+            content=v2,
+        )
+        assert r2.status_code == 200
+
+        revs = client.get(f"/api/worlds/{wid}/rooms/main/chunks/40/0/0/revisions", headers=headers)
+        assert revs.status_code == 200
+        rev_numbers = [row["revision"] for row in revs.json()]
+        assert 1 in rev_numbers and 2 in rev_numbers
+
+        rb = client.post(
+            f"/api/worlds/{wid}/rooms/main/chunks/40/0/0/rollback",
+            headers=headers, json={"revision": 1},
+        )
+        assert rb.status_code == 200, rb.text
+        assert rb.json()["revision"] == 3  # a new revision, restoring v1's content
+        assert rb.json()["checksum"] == r1.json()["checksum"]
+
+    def test_revisions_requires_owner(self):
+        client = TestClient(app)
+        owner_headers, _ = _auth(client, "revisions_owner")
+        wid = _make_world(client, owner_headers)
+        payload = _build_chunk(wid, "main", 41, 0, 0)
+        client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/41/0/0",
+            headers={**owner_headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=payload,
+        )
+        other_headers, _ = _auth(client, "revisions_other")
+        r = client.get(f"/api/worlds/{wid}/rooms/main/chunks/41/0/0/revisions", headers=other_headers)
+        assert r.status_code == 403
+
+
+class TestValidationErrors:
+    def test_malformed_payload_is_422(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "chunk_malformed")
+        wid = _make_world(client, headers)
+        r = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/0/0/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=b"not a real chunk",
+        )
+        assert r.status_code == 422
+        assert r.json()["reason"] == "malformed"
+
+    def test_wrong_grid_size_is_422_layer_dims(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "chunk_layerdims")
+        wid = _make_world(client, headers)
+        # Room's default grid is 32x32x1; build a chunk sized for 4x4x1.
+        payload = _build_chunk(wid, "main", 0, 0, 0, grid=(4, 4, 1))
+        r = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/0/0/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=payload,
+        )
+        assert r.status_code == 422
+        assert r.json()["reason"] == "layer_dims"
+
+    def test_oversized_payload_is_413(self, monkeypatch):
+        from app.config import settings
+        monkeypatch.setattr(settings, "WORLD_CHUNK_MAX_PAYLOAD_BYTES", 10)
+        client = TestClient(app)
+        headers, _ = _auth(client, "chunk_413")
+        wid = _make_world(client, headers)
+        payload = _build_chunk(wid, "main", 0, 0, 0)
+        r = client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/0/0/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=payload,
+        )
+        assert r.status_code == 413
+
+
+class TestInternalApi:
+    """docs/architecture/world_persistence_impl.md §7/§8.3. No real Godot
+    process is spawned in this test env (GAME_SERVERS_ENABLED=False); we
+    register a fake in-memory server entry with a known token to exercise
+    require_game_server without needing a live process."""
+
+    @pytest.fixture
+    def fake_server_token(self):
+        # NB: a class body can't read a same-named local from the
+        # enclosing function via `token = token` (class bodies use LOAD_NAME,
+        # which skips enclosing function scopes) -- use a literal instead.
+        world_id_str = "internal-test-world"
+
+        class _FakeSrv:
+            def alive(self_inner):
+                return True
+            token = "test-internal-token-12345"
+
+        supervisor._servers[world_id_str] = _FakeSrv()
+        yield _FakeSrv.token
+        supervisor._servers.pop(world_id_str, None)
+
+    def test_missing_token_is_401(self):
+        client = TestClient(app)
+        r = client.get("/api/internal/worlds/1/manifest")
+        assert r.status_code == 401
+
+    def test_wrong_token_is_403(self):
+        client = TestClient(app)
+        r = client.get(
+            "/api/internal/worlds/1/manifest",
+            headers={"Authorization": "Bearer not-the-real-token"},
+        )
+        assert r.status_code == 403
+
+    def test_valid_token_but_wrong_world_id_is_403(self, fake_server_token):
+        # The fake token is registered under world_id "internal-test-world";
+        # a request for a different world_id must not authenticate.
+        client = TestClient(app)
+        r = client.get(
+            "/api/internal/worlds/999999/manifest",
+            headers={"Authorization": f"Bearer {fake_server_token}"},
+        )
+        assert r.status_code == 403
+
+    def test_valid_token_reaches_manifest_for_real_world(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "internal_manifest")
+        wid = _make_world(client, headers)
+
+        class _FakeSrv:
+            def alive(self_inner):
+                return True
+            token = "another-real-token"
+
+        supervisor._servers[str(wid)] = _FakeSrv()
+        try:
+            r = client.get(
+                f"/api/internal/worlds/{wid}/manifest",
+                headers={"Authorization": "Bearer another-real-token"},
+            )
+            assert r.status_code == 200, r.text
+            body = r.json()
+            assert body["world_id"] == wid
+            assert len(body["rooms"]) == 1
+            assert body["rooms"][0]["slug"] == "main"
+        finally:
+            supervisor._servers.pop(str(wid), None)
+
+    def test_internal_chunk_fetch_returns_binary(self):
+        client = TestClient(app)
+        headers, _ = _auth(client, "internal_chunk")
+        wid = _make_world(client, headers)
+        payload = _build_chunk(wid, "main", 0, 0, 0)
+        client.put(
+            f"/api/worlds/{wid}/rooms/main/chunks/0/0/0",
+            headers={**headers, "Content-Type": "application/octet-stream", "X-Base-Revision": "0"},
+            content=payload,
+        )
+
+        class _FakeSrv:
+            def alive(self_inner):
+                return True
+            token = "internal-chunk-token"
+
+        supervisor._servers[str(wid)] = _FakeSrv()
+        try:
+            r = client.get(
+                f"/api/internal/worlds/{wid}/rooms/main/chunks/0/0/0",
+                headers={"Authorization": "Bearer internal-chunk-token"},
+            )
+            assert r.status_code == 200
+            assert r.content == payload
+        finally:
+            supervisor._servers.pop(str(wid), None)

backend/tests/test_ws_gateway.py

@@ -0,0 +1,222 @@
+"""Integration tests for real-time WebSocket gateway:
+- Authentication (query param + first auth frame)
+- Rejection of unauthenticated clients
+- Presence on connect / disconnect
+- Subscriptions to world chat channels and DM conversations
+- Real-time event delivery from REST endpoints
+- Reconnect and ping/pong
+"""
+
+import asyncio
+import time
+import pytest
+from fastapi.testclient import TestClient
+from starlette.websockets import WebSocketDisconnect
+
+from app.main import app
+from app.services.presence import presence_store
+
+
+def _register(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return {"headers": headers, "token": token, "id": me.json()["id"], "username": username}
+
+
+def _make_world(client: TestClient, headers: dict, visibility: str = "public") -> int:
+    r = client.post("/api/worlds/", headers=headers, json={"name": "WSWorld", "visibility": visibility})
+    assert r.status_code == 201, r.text
+    return r.json()["id"]
+
+
+def _make_friends(client: TestClient, user_a: dict, user_b: dict) -> None:
+    req = client.post("/api/friends/requests", json={"user_id": user_b["id"]}, headers=user_a["headers"])
+    assert req.status_code == 201, req.text
+    req_id = req.json()["id"]
+    acc = client.post(f"/api/friends/requests/{req_id}/accept", headers=user_b["headers"])
+    assert acc.status_code == 200, acc.text
+
+
+class TestWebSocketAuth:
+    def test_unauthenticated_connection_rejected(self):
+        client = TestClient(app)
+        # Invalid query param token rejected
+        with pytest.raises(WebSocketDisconnect) as exc:
+            with client.websocket_connect("/api/ws?token=invalid_token"):
+                pass
+        assert exc.value.code == 1008
+
+        # First frame with invalid token rejected
+        with pytest.raises(WebSocketDisconnect) as exc2:
+            with client.websocket_connect("/api/ws") as ws:
+                ws.send_json({"type": "auth", "token": "invalid_token"})
+                ws.receive_json()
+                ws.receive_json()
+        assert exc2.value.code == 1008
+
+    def test_auth_via_query_param(self):
+        client = TestClient(app)
+        alice = _register(client, "ws_auth_alice")
+
+        with client.websocket_connect(f"/api/ws?token={alice['token']}") as ws:
+            msg = ws.receive_json()
+            assert msg["type"] == "auth_ok"
+            assert msg["user_id"] == alice["id"]
+            assert msg["username"] == "ws_auth_alice"
+
+    def test_auth_via_first_message(self):
+        client = TestClient(app)
+        bob = _register(client, "ws_auth_bob")
+
+        with client.websocket_connect("/api/ws") as ws:
+            ws.send_json({"type": "auth", "token": bob["token"]})
+            msg = ws.receive_json()
+            assert msg["type"] == "auth_ok"
+            assert msg["user_id"] == bob["id"]
+            assert msg["username"] == "ws_auth_bob"
+
+
+class TestWebSocketPresence:
+    def test_presence_on_connect_and_disconnect(self):
+        import threading
+        client = TestClient(app)
+        alice = _register(client, "ws_pres_alice")
+        bob = _register(client, "ws_pres_bob")
+        _make_friends(client, alice, bob)
+
+        # Initially both offline
+        assert not asyncio.run(presence_store.is_online(alice["id"]))
+
+        # Bob connects and listens for presence events
+        bob_events = []
+
+        def run_alice():
+            time.sleep(0.2)
+            c_alice = TestClient(app)
+            with c_alice.websocket_connect(f"/api/ws?token={alice['token']}") as alice_ws:
+                assert alice_ws.receive_json()["type"] == "auth_ok"
+                time.sleep(0.3)
+                alice_ws.close()
+                time.sleep(0.3)
+
+        with client.websocket_connect(f"/api/ws?token={bob['token']}") as bob_ws:
+            assert bob_ws.receive_json()["type"] == "auth_ok"
+
+            alice_thread = threading.Thread(target=run_alice)
+            alice_thread.start()
+
+            # Bob receives Alice's online event
+            online_event = bob_ws.receive_json()
+            assert online_event["type"] == "presence"
+            assert online_event["user_id"] == alice["id"]
+            assert online_event["is_online"] is True
+
+            alice_thread.join()
+
+            # Bob receives Alice's offline event
+            offline_event = bob_ws.receive_json()
+            assert offline_event["type"] == "presence"
+            assert offline_event["user_id"] == alice["id"]
+            assert offline_event["is_online"] is False
+
+        assert not asyncio.run(presence_store.is_online(alice["id"]))
+
+
+class TestWebSocketChatDelivery:
+    def test_world_chat_subscription_and_delivery(self):
+        client = TestClient(app)
+        alice = _register(client, "ws_chat_alice")
+        bob = _register(client, "ws_chat_bob")
+        world_id = _make_world(client, alice["headers"])
+
+        with client.websocket_connect(f"/api/ws?token={bob['token']}") as bob_ws:
+            assert bob_ws.receive_json()["type"] == "auth_ok"
+
+            # Bob subscribes to world
+            bob_ws.send_json({"type": "subscribe_world", "world_id": world_id})
+            sub_ack = bob_ws.receive_json()
+            assert sub_ack["type"] == "subscribed"
+            assert sub_ack["channel"] == "world"
+            assert sub_ack["id"] == world_id
+
+            # Alice posts message to world via REST
+            rest_resp = client.post(
+                f"/api/chat/world/{world_id}/messages",
+                headers=alice["headers"],
+                json={"body": "Hello real-time world!"},
+            )
+            assert rest_resp.status_code == 201, rest_resp.text
+            msg_id = rest_resp.json()["id"]
+
+            # Bob receives message in real time over WebSocket
+            ws_msg = bob_ws.receive_json()
+            assert ws_msg["type"] == "world_chat"
+            assert ws_msg["world_id"] == world_id
+            assert ws_msg["message"]["id"] == msg_id
+            assert ws_msg["message"]["body"] == "Hello real-time world!"
+            assert ws_msg["message"]["author"]["username"] == "ws_chat_alice"
+
+    def test_dm_chat_subscription_and_delivery(self):
+        client = TestClient(app)
+        alice = _register(client, "ws_dm_alice")
+        bob = _register(client, "ws_dm_bob")
+
+        # Initial DM to create conversation
+        init_dm = client.post(
+            f"/api/chat/dm/{bob['id']}/messages",
+            headers=alice["headers"],
+            json={"body": "First DM to initiate"},
+        )
+        assert init_dm.status_code == 201, init_dm.text
+        conv_id = init_dm.json()["conversation_id"]
+
+        with client.websocket_connect(f"/api/ws?token={bob['token']}") as bob_ws:
+            assert bob_ws.receive_json()["type"] == "auth_ok"
+
+            # Bob subscribes to this conversation
+            bob_ws.send_json({"type": "subscribe_dm", "conversation_id": conv_id})
+            sub_ack = bob_ws.receive_json()
+            assert sub_ack["type"] == "subscribed"
+            assert sub_ack["channel"] == "dm"
+            assert sub_ack["id"] == conv_id
+
+            # Alice sends another DM via REST
+            rest_dm = client.post(
+                f"/api/chat/dm/{bob['id']}/messages",
+                headers=alice["headers"],
+                json={"body": "Real-time DM ping!"},
+            )
+            assert rest_dm.status_code == 201, rest_dm.text
+
+            # Bob receives real-time DM over WebSocket
+            ws_dm = bob_ws.receive_json()
+            assert ws_dm["type"] == "dm_chat"
+            assert ws_dm["conversation_id"] == conv_id
+            assert ws_dm["message"]["body"] == "Real-time DM ping!"
+
+
+class TestWebSocketPingAndHeartbeat:
+    def test_ping_pong_and_heartbeat(self):
+        client = TestClient(app)
+        alice = _register(client, "ws_ping_alice")
+
+        with client.websocket_connect(f"/api/ws?token={alice['token']}") as ws:
+            assert ws.receive_json()["type"] == "auth_ok"
+
+            ws.send_json({"type": "ping"})
+            assert ws.receive_json()["type"] == "pong"
+
+            ws.send_json({"type": "heartbeat"})
+            assert ws.receive_json()["type"] == "heartbeat_ack"

docs/architecture/editor.md

@@ -4,6 +4,11 @@
 > **Owner:** Platform team
 > **Related:** World chunk data format & persistence, server authority + client
 > prediction, content moderation & age verification, avatar component system
+> **Note:** the recommendation here stands, but edits do **not** ride the
+> `request_chunk_edit` ENet RPC (§4.2, §7.4). Per
+> [`world_persistence_impl.md`](world_persistence_impl.md) the editor saves
+> chunks over HTTP to the FastAPI backend, which is the sole writer; the
+> validation/moderation boundary moves with it.
 > **Godot version:** 4.6.2 stable
 
 ## 1. Overview

docs/architecture/world.md

@@ -1,6 +1,10 @@
 # World Chunk Data Format & Persistence Architecture
 
-> **Status:** Proposed
+> **Status:** Proposed. The chunk format (§2, §3) is normative and implemented
+> on the client. **§4 (SQLite schema) and §5 (write ownership / write-behind)
+> are superseded by [`world_persistence_impl.md`](world_persistence_impl.md)**,
+> which stores chunks in the existing Postgres backend and makes the FastAPI
+> process — not the per-world Godot server — the sole writer.
 > **Owner:** Platform team
 > **Related:** Server authority + client prediction, avatar component system, content moderation & age verification, backend auth (JWT)
 

docs/architecture/world_persistence_impl.md

@@ -0,0 +1,655 @@
+# World Persistence: Server-Side Implementation Architecture
+
+> **Status:** Accepted (design). Implementation is split across two follow-on
+> tasks (backend endpoints; editor wiring).
+> **Owner:** Platform team
+> **Supersedes:** the *storage engine* and *write ownership* parts of
+> [`world.md`](world.md) §4 and §5. Everything else in `world.md` — the chunk
+> logical model, the JSON and binary encodings, checksums, revisions, content
+> flags — stands unchanged and is normative.
+> **Related:** [`world.md`](world.md) (chunk format), [`editor.md`](editor.md)
+> (authoring surface), [`networking.md`](networking.md) (ENet sim transport),
+> [`content_moderation.md`](content_moderation.md) (flags & gating).
+
+## 1. Why this document exists
+
+`world.md` was written during the client-side chunk-streaming work (M2). It
+assumes **one** server that owns **one** embedded SQLite file and is both the
+authoritative simulation and the authoritative store. That is not the system we
+built. What actually exists today is:
+
+| Process | Lifetime | Owns | Code |
+|---|---|---|---|
+| FastAPI backend | always on, single worker | Postgres (users, worlds, assets, avatar loadouts), game-server orchestration | `backend/app/` |
+| Godot dedicated server, one per world | **spawned on join, reaped ~5 min after the last join when empty** | nothing durable; a 30 Hz in-memory player sim | `scripts/server.gd`, spawned by `backend/app/services/game_servers.py` |
+| Godot client | player session | local chunk streaming, the in-game editor (planned) | `scripts/chunk_stream_manager.gd`, `scripts/chunk_data_decoder.gd` |
+
+Nothing server-side has ever stored or served a real chunk. `server.gd`
+`preload()`s `res://scenes/worlds/test_level.tscn` for **every** world and uses
+`world_id` only for logging and the status file. `ChunkStreamManager` has a
+`set_server_rpc()` seam that no code calls. The backend's `World` model is
+metadata only (`id`, `name`, `description`, `owner_id`, `visibility`).
+
+This document decides where chunk content lives, who may write it, how the
+dedicated server gets it, and the exact API surface — so the two implementation
+tasks that follow have no architectural decisions left to make.
+
+---
+
+## 2. Decisions at a glance
+
+| # | Question | Decision |
+|---|---|---|
+| D1 | Where does chunk data live at rest? | **Postgres**, in the existing backend database. Not a per-world SQLite file. |
+| D2 | Who writes it? | **The FastAPI backend, exclusively.** The editor writes through it over HTTP with optimistic concurrency. The dedicated Godot server never writes world content. |
+| D3 | How does the dedicated server get content? | **HTTP pull from the backend at startup**, over a loopback-only `/api/internal` route authenticated by a per-spawn token the supervisor mints. Lazy fetch as players roam. |
+| D4 | Edit while a live session exists? | **Out of scope this milestone, with a defined seam.** The editor is a non-joined client mode; writes always succeed and the response flags `live_session` so the UI can say "players see this when the session restarts". |
+| D5 | Edit granularity on the wire | **Full-chunk PUT with `base_revision`**, not RFC-6902 deltas. |
+| D6 | Client chunk transport | **HTTP from the backend**, not ENet from the dedicated server. The `set_server_rpc()` seam is satisfied by an HTTP-backed adapter. |
+
+---
+
+## 3. D1 — Chunk data lives in Postgres
+
+### 3.1 Decision
+
+World content (rooms, chunk payloads, chunk revisions) is stored in the
+**existing Postgres database**, alongside `worlds`, in new tables created by an
+Alembic migration. `world.md` §4's `world.db` SQLite file is **not** built.
+
+The chunk **payload stays exactly what `world.md` §3.6 specifies**: the 48-byte
+header + sectioned binary body, checksummed with SHA-256. It moves from a
+SQLite `BLOB` to a Postgres `BYTEA`. Nothing about the format changes, so
+`scripts/chunk_data_decoder.gd` remains correct and the format spec stays the
+single contract.
+
+### 3.2 Reasoning
+
+1. **SQLite's premise does not hold here.** `world.md` §4 justifies SQLite as
+   "ideal for a server that owns the world store". No process in this system
+   owns a world store: the only process that could plausibly hold the file (the
+   dedicated Godot server) is *ephemeral* — reaped when idle, `SIGTERM`'d on
+   backend shutdown, `SIGKILL`'d 10 s later if it doesn't exit, and orphaned
+   entirely if the backend dies. Meanwhile the editor must write when no such
+   process exists. So the file would have to be shared by two processes with
+   independent lifetimes, which is precisely the workload SQLite's
+   single-writer/file-lock model handles worst.
+2. **Postgres is already a hard dependency; SQLite would be a second one.** The
+   backend cannot start without Postgres. Adding a per-world SQLite file adds a
+   second storage engine, a second migration system (`world.md` §4.8 specifies a
+   hand-rolled `meta.schema_version` runner *next to* the Alembic we already
+   have), a second backup story, and a second consistency story.
+3. **Referential integrity with metadata we already have.** `worlds` rows carry
+   `owner_id` and `visibility`, and every authorization rule for content derives
+   from them. In one database this is a join and a foreign key with
+   `ON DELETE CASCADE`; across two engines, deleting a world silently orphans a
+   file on disk and every ownership check becomes a cross-store read.
+4. **Concurrency is the normal case, not the edge case.** Two creators editing
+   one world, or an editor writing while the backend serves chunks to a running
+   dedicated server, are ordinary. Postgres gives row-level MVCC and real
+   transactions for the read-modify-write in §5.4; SQLite gives a database-level
+   write lock and `SQLITE_BUSY`.
+5. **The repo already has the precedent and the plumbing.** `avatar_loadouts`
+   (migration `0004`) stores a client-shaped document in Postgres JSONB rather
+   than inventing a side store, and `backend/app/database.py` already provides
+   the async session factory this code will use.
+
+### 3.3 What we give up, and why it's acceptable
+
+- **Zero-config embedding.** Irrelevant — the backend already requires a
+  configured Postgres.
+- **`world.md` §5.5 write-behind + the `dirty` column.** Deliberately dropped
+  (§4.4). It existed to amortize disk I/O for a process that owned the file. Our
+  writes are human-rate editor saves, not sim-rate; each one is a single
+  transaction and is durable when the HTTP response returns. Dropping it also
+  deletes the entire "unclean shutdown recovery" scan in §5.5 — there is no
+  window in which committed content can be lost.
+- **Sharding by `world_id` (`world.md` §8).** Postgres partitioning by
+  `world_id` remains available on the same table shape if a single table ever
+  becomes a bottleneck. At ~2–8 KB per chunk, 10 000 chunks is under 100 MB.
+
+---
+
+## 4. Schema (Alembic migration `0005_add_world_content_tables`)
+
+New model module: `backend/app/models/world_content.py`, registered in
+`backend/app/models/__init__.py`. `backend/app/models/world.py` is left alone
+except for one added relationship, so nothing PC1/PC2 depends on moves.
+
+Conventions follow the existing models: `Column(...)` declarative style,
+`Integer` surrogate PKs, `DateTime(timezone=True)` with `server_default=func.now()`,
+JSONB for document-shaped fields (as `avatar_loadout.py` does).
+
+### 4.1 `world_rooms`
+
+```python
+class WorldRoom(Base):
+    __tablename__ = "world_rooms"
+
+    id         = Column(Integer, primary_key=True, index=True)
+    world_id   = Column(Integer, ForeignKey("worlds.id", ondelete="CASCADE"),
+                        nullable=False, index=True)
+    slug       = Column(String(64), nullable=False)   # url-safe; "main" by default
+    name       = Column(String(255), nullable=False)
+    # Chunk grid config. world.md §2.2 puts this on the world; it lives on the
+    # room so a world can later hold rooms with different grids, and so this
+    # migration is purely additive (the existing `worlds` table is untouched).
+    grid       = Column(JSONB, nullable=False,
+                        server_default='{"size": [32, 32, 1], "origin": [0, 0, 0]}')
+    bounds     = Column(JSONB, nullable=True)   # {"min":[x,y,z], "max":[x,y,z]}; null = unbounded
+    spawn      = Column(JSONB, nullable=True)   # {"pos":[x,y,z], "yaw": 0.0}
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(),
+                        onupdate=func.now(), nullable=False)
+
+    __table_args__ = (UniqueConstraint("world_id", "slug", name="uq_world_rooms_world_slug"),)
+```
+
+`World` gains
+`rooms = relationship("WorldRoom", back_populates="world", cascade="all, delete-orphan")`.
+
+Every world gets a `main` room: created in `create_world`, and lazily created on
+first room read/write for worlds that predate the migration. `grid` defaults
+match `Chunk.CHUNK_SIZE_*` in `scripts/chunk.gd`, which is the client's source
+of truth for the same constants.
+
+### 4.2 `world_chunks`
+
+```python
+class WorldChunk(Base):
+    __tablename__ = "world_chunks"
+
+    id             = Column(Integer, primary_key=True, index=True)
+    world_id       = Column(Integer, ForeignKey("worlds.id", ondelete="CASCADE"),
+                            nullable=False, index=True)   # denormalized: world-scoped queries
+    room_id        = Column(Integer, ForeignKey("world_rooms.id", ondelete="CASCADE"),
+                            nullable=False, index=True)
+    chunk_key      = Column(String(160), nullable=False, unique=True)   # see §4.5
+    cx             = Column(Integer, nullable=False)
+    cy             = Column(Integer, nullable=False)
+    cz             = Column(Integer, nullable=False, server_default="0")
+
+    format_version = Column(Integer, nullable=False, server_default="1")
+    payload        = Column(LargeBinary, nullable=False)   # world.md §3.6 bytes, BYTEA
+    payload_len    = Column(Integer, nullable=False)
+    checksum       = Column(String(64), nullable=False)    # SHA-256 hex of payload body
+    revision       = Column(Integer, nullable=False, server_default="1")
+
+    content_flags  = Column(JSONB, nullable=False, server_default="{}")  # world.md §3.4
+    is_mature      = Column(Boolean, nullable=False, server_default="false")
+
+    updated_by_id  = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
+    created_at     = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at     = Column(DateTime(timezone=True), server_default=func.now(),
+                            onupdate=func.now(), nullable=False)
+
+    __table_args__ = (
+        UniqueConstraint("room_id", "cx", "cy", "cz", name="uq_world_chunks_coord"),
+        Index("ix_world_chunks_room_coord", "room_id", "cx", "cy", "cz"),
+        Index("ix_world_chunks_mature", "world_id", postgresql_where=text("is_mature")),
+    )
+```
+
+Deltas from `world.md` §4.4:
+
+- **Surrogate `id` PK + unique coordinate constraint**, with `chunk_key` kept as
+  a unique denormalized column. The key string is the client-facing contract
+  (`Chunk.build_key`) and is embedded in the payload, so storing it gives a
+  single-index lookup by key; the coordinate constraint is what actually
+  enforces one chunk per cell.
+- **`dirty` removed** — see §3.3.
+- **Content flags folded into the chunk row as JSONB + an indexed `is_mature`
+  boolean**, instead of `world.md` §4.6's separate 11-column `content_flags`
+  table. The flags are a document the client already produces in exactly this
+  shape (`ChunkDataDecoder.ContentFlags.to_dict()`), the only query we anticipate
+  is "is this mature", and folding them in removes a second write per save and
+  the `object_id = ''` sentinel hack that §4.6 needed to work around SQLite's
+  NULL-in-primary-key behaviour (Postgres has the same NULL semantics, so the
+  hack would have carried over).
+- **`world.md` §4.5 `chunk_objects` is deferred, not dropped.** It is a derived
+  index that exists to answer queries ("which chunks contain a door?") that no
+  code asks yet, and maintaining it means a delete-and-reinsert of every object
+  row on every save. It is fully rebuildable from `payload`, so it can be added
+  in its own migration the day a query needs it, with a backfill. Do **not**
+  build it in `0005`.
+
+### 4.3 `world_chunk_revisions`
+
+```python
+class WorldChunkRevision(Base):
+    __tablename__ = "world_chunk_revisions"
+
+    id         = Column(Integer, primary_key=True, index=True)
+    chunk_key  = Column(String(160), nullable=False, index=True)  # deliberately NOT a FK
+    world_id   = Column(Integer, nullable=False, index=True)      # also not a FK, same reason
+    revision   = Column(Integer, nullable=False)
+    action     = Column(String(16), nullable=False)               # 'create' | 'update' | 'delete'
+    actor_id   = Column(Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True)
+    checksum   = Column(String(64), nullable=False)
+    payload    = Column(LargeBinary, nullable=True)               # full payload at this revision
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+```
+
+Kept from `world.md` §4.7 including its two design points: the full payload is
+stored (rollback needs it) and `chunk_key`/`world_id` are **not** foreign keys,
+so deleting a chunk or a world preserves the audit trail.
+
+**Retention (new, required):** this table grows without bound — a creator
+dragging a brush can produce hundreds of revisions per minute. The
+implementation must ship a retention policy from day one: keep the newest
+`WORLD_CHUNK_REVISION_KEEP` (default 20) payloads per `chunk_key` and null out
+`payload` on older rows (keeping the metadata row for the audit trail), pruned
+in the same transaction as the write. A `created_at` index supports a later
+time-based prune.
+
+### 4.4 Config additions (`backend/app/config.py`)
+
+```
+WORLD_CHUNK_MAX_PAYLOAD_BYTES: int = 1_048_576   # 1 MiB; a dense 32×32 uint16 layer is 2 KiB
+WORLD_CHUNK_MAX_OBJECTS: int = 512
+WORLD_CHUNK_MAX_BATCH: int = 64
+WORLD_CHUNK_REVISION_KEEP: int = 20
+GAME_SERVER_INTERNAL_API_URL: str = "http://127.0.0.1:8000"
+```
+
+### 4.5 Chunk key format
+
+`world.md` §2.3 specifies `"{world_id}:{room_id}:{cx}:{cy}:{cz}"` and illustrates
+it with `w_0001:r_0001`. Those ids were illustrative. The real key uses the
+backend's identifiers:
+
+```
+"{world.id}:{room.slug}:{cx}:{cy}:{cz}"      e.g.  "12:main:3:-1:0"
+```
+
+The room **slug** rather than its numeric id, so a key is human-readable in logs
+and stable if rooms are ever re-imported. `Chunk.build_key()` in
+`scripts/chunk.gd` already produces this shape unmodified.
+
+---
+
+## 5. D2 — The FastAPI backend is the only writer
+
+### 5.1 Decision
+
+The in-game editor (`editor.md` §7.2) submits edits over **HTTP to the FastAPI
+backend**, which validates, versions, and persists them. The dedicated Godot
+server process **never writes world content** and does not sit in the edit path.
+
+This preserves `world.md`'s and `editor.md`'s actual invariant — *clients never
+touch storage; they submit edits to a server-authoritative tier that validates
+them* — while identifying that tier as the always-on backend rather than the
+ephemeral sim process. `editor.md` §4.2's claim that edits ride the same
+`request_chunk_edit` RPC as gameplay is the one part of that doc this design
+changes; the moderation and validation properties it derives from that claim are
+unaffected, because the validation boundary moves with the writer.
+
+### 5.2 Reasoning
+
+1. **Nothing that can vanish in 300 seconds may own the write path.** The reaper
+   in `game_servers.py` `stop()`s an idle server with `SIGTERM` and escalates to
+   `SIGKILL` after 10 s; `supervisor.shutdown()` does the same to every server on
+   backend shutdown; and if the backend dies uncleanly the servers are orphaned
+   with no one to flush them. Because the sim process holds no unsaved world
+   content in this design, **no reap, crash, or kill can ever lose world data** —
+   that is the single strongest practical reason for this split.
+2. **Editing must work with no dedicated server running.** A creator opening
+   their world to build should not have to spin up a 30 Hz sim process, burn a
+   port from the 100-port range, and hold it for 5 minutes past their last save.
+3. **`server.gd` has no database access, no credentials, and no HTTP client.**
+   Routing writes through it means either shipping Postgres credentials into a
+   process spawned per join, or building an ENet→HTTP proxy inside the sim loop.
+   Both are strictly worse than the editor calling the backend directly.
+4. **Authorization already lives in the backend.** `CurrentUser`, the
+   `owner_id` check, and `WorldVisibility` are all there. The dedicated server
+   has no user identities at all — it knows peer ids, not accounts.
+
+### 5.3 Authorization
+
+- **Read** a chunk: the same rule as `GET /api/worlds/{id}` — the world is
+  `PUBLIC`, or the caller owns it. Otherwise 404 (not 403), matching the
+  existing routers' deliberate non-disclosure.
+- **Write** a chunk: caller must be `world.owner_id`, matching `update_world`;
+  403 otherwise. Collaborator/role-based editing is future work and slots in at
+  this one check.
+- **Mature gating hook:** `is_mature` chunks are where `content_moderation.md`'s
+  age gate attaches on the read path. Specify the column and the index now; the
+  gate itself lands with that doc's work.
+
+### 5.4 Concurrency
+
+Optimistic concurrency exactly as `world.md` §5.4, expressed over HTTP:
+
+1. Reader gets `revision` (header `X-Chunk-Revision`, or the JSON field).
+2. Writer sends `base_revision`.
+3. The service does `SELECT ... FOR UPDATE` on the chunk row, compares
+   `base_revision` to `revision`, and either commits at `revision + 1` or returns
+   **409** with `current_revision` and `current_checksum` so the editor can
+   re-fetch and re-apply.
+4. `base_revision: 0` means "create; fail with 409 if it already exists".
+
+### 5.5 Validation (the backend must not trust the client)
+
+The write path decodes the submitted payload server-side before storing it. This
+requires a **Python port of the `world.md` §3.6 codec** —
+`backend/app/services/chunk_codec.py`, mirroring `scripts/chunk_data_decoder.gd`.
+It checks: magic `AGPC`, `format_version <= 1`, declared vs. actual
+`payload_len`, **recomputed** SHA-256 (the header's checksum is advisory), tile
+layer dims equal the room's `grid.size`, tile indices in palette range, object
+count ≤ `WORLD_CHUNK_MAX_OBJECTS`, object positions inside the chunk's bounds,
+`chunk_key` in the payload matching the URL, and string-field length limits
+(`world.md` §7). `content_flags` and `is_mature` are **recomputed** from the
+payload's flag sections, never taken from the request body.
+
+**Drift control (required):** the two codecs must be pinned by golden files —
+fixture chunks under `tests/fixtures/chunks/` encoded by one implementation and
+decoded byte-identically by the other, asserted in both the pytest suite and the
+Godot headless suite. Without this the format has two implementations and no
+contract test, which is exactly the failure `world.md` §5.2 was trying to avoid
+by having one shared implementation.
+
+---
+
+## 6. D4 — Editing versus a live session (scope boundary)
+
+**In scope for this milestone:**
+
+- The editor is entered as **"Edit world" from the world browser**: a non-joined
+  client mode. It does **not** call `POST /api/worlds/{id}/join`, does not open
+  an ENet connection, and does not spawn a dedicated server. It loads chunks over
+  HTTP, edits them locally, and saves them over HTTP.
+- Writes always succeed regardless of whether a session is live. The write
+  response carries `live_session: bool` (from `supervisor.debug_state()`), so the
+  editor can surface *"this world has players in it right now — they'll see your
+  changes when the session restarts."*
+- A dedicated server started **after** a write sees the new content, because it
+  loads from the store at startup (§7).
+
+**Explicitly out of scope, deferred:**
+
+- Build-in-place while joined to a live session.
+- `chunk_invalidated` push to connected clients (`world.md` §5.3) and hot-reload
+  of the dedicated server's collision world.
+- Live collaborative editing / cursors (`editor.md` §9).
+
+**The seam that makes the deferred work cheap:** the manifest endpoint (§7.2)
+returns a monotonic `content_revision` for the world, bumped on every chunk
+write. Hot reload is then: the dedicated server polls the manifest on a timer
+(or the backend pushes to it over the same internal channel), re-fetches the
+chunks whose revision changed, and rebuilds those collision bodies. Nothing in
+this design has to change to add it.
+
+**Why the editor must not join:** if it joined, the sim process would enforce
+collision against content it loaded at spawn while the creator edits a diverging
+local copy — players would walk through new walls and bounce off deleted ones,
+with no error anywhere. Making build mode non-joined turns a silent correctness
+bug into an explicit product boundary.
+
+---
+
+## 7. D3 — What the dedicated server does at startup
+
+### 7.1 Decision
+
+`server.gd` pulls its world's content from the backend over **HTTP** at startup,
+authenticated by a **per-spawn token** the supervisor mints, and **does not bind
+the ENet port until content is loaded**.
+
+Rejected alternative — *supervisor writes a whole-world snapshot file at spawn
+and passes `--world-file`*: attractive (no new auth surface, no HTTP client in
+the sim process), but it makes spawn latency proportional to world size, gives
+the server no way to fetch a chunk lazily as players roam beyond the preloaded
+set, and still needs a separate channel for the hot-reload work above. Rejected —
+*give the Godot process a Postgres connection*: there is no PG driver in
+GDScript, and it would put database credentials in a process spawned per join.
+
+### 7.2 Startup sequence
+
+1. `_parse_args()` gains `--api-url` and `--server-token` (§7.3).
+2. `GET /api/internal/worlds/{world_id}/manifest` → rooms, per-room `grid`,
+   `bounds`, `spawn`, `chunk_count`, and the world's `content_revision`.
+3. `GET /api/internal/worlds/{world_id}/rooms/{slug}/chunks?` bounds query for
+   the spawn neighbourhood (radius from the spawn point, default 3 chunks), then
+   fetch each payload; decode with the existing `ChunkDataDecoder` and build
+   static collision from the tile layers and objects.
+4. **Then** `network_peer.create_server(port)`, then write the status file.
+5. **Fallback:** if the backend is unreachable, the world has no rooms, or the
+   room has zero chunks, load `test_level.tscn` as today and record
+   `"content": "fallback"` in the status file. A content outage must never make
+   a world un-joinable, and this keeps every PC3 flow working before any world
+   has authored content.
+
+During the session the server may lazily fetch chunks as players approach
+unloaded coordinates, through the same internal route. It **never writes**.
+Dynamic entity runtime state (positions, health) stays in memory and out of
+chunks, exactly as `world.md` §3.3 already specifies. Shutdown flushes nothing.
+
+### 7.3 Internal authentication
+
+`GameServerSupervisor._spawn()` generates `token = secrets.token_urlsafe(32)`,
+stores it on the `_WorldServer` dataclass, and passes it on the command line
+alongside the existing `--port/--world/--status-file`. A FastAPI dependency
+`require_game_server` resolves `Authorization: Bearer <token>` against
+`supervisor.validate_token(world_id, token)` — a dict lookup, since the
+supervisor is an in-process singleton. Properties this gives us:
+
+- A token grants access to **one** world and **dies with its process** (the
+  reaper's `del self._servers[wid]` invalidates it).
+- No long-lived shared secret in config or on disk.
+- It reuses the **already documented** single-worker constraint in
+  `game_servers.py`; it does not add a new one.
+
+Rejected alternative — *let the dedicated server use the public routes with a
+service user account*: the public routes enforce per-user visibility and
+ownership, which a service identity would have to be exempted from, and it would
+pollute `updated_by_id`/audit rows with a fake user. A separate `/api/internal`
+prefix keeps the two auth models apart and can be blocked at the reverse proxy.
+
+### 7.4 Lifecycle changes this requires in `game_servers.py`
+
+These are real, load-bearing findings from the current implementation:
+
+- **`_await_port()` is the wrong readiness signal now.** It returns as soon as
+  the UDP port is bound, and the port is bound before content exists today. With
+  content loading it must await a `"ready": true` field that `server.gd` writes
+  to the status file *after* content load + `create_server`. Otherwise the
+  backend hands a client an address for a server that is still fetching chunks.
+- **`_await_port()` fails open.** After its 8 s deadline it returns normally,
+  with no error — `ensure_server` then reports success for a server that may
+  never have started. Content loading makes a slow start more likely, so the
+  readiness wait needs a real timeout error (503 to the joining client) and a
+  longer, configurable deadline.
+- **The status file is the only server→backend channel**, and `_spawn` currently
+  passes no credentials at all — hence §7.3.
+- **`player_count()` returns 0 when the status file is missing or unparseable**,
+  so a live server whose status write fails can be reaped after the idle timeout.
+  Harmless for data (the sim owns nothing durable — the point of D2) but worth a
+  comment where the fallback lives.
+- **No crash restart** (documented in the module docstring): if a server dies,
+  the next join respawns it and it reloads content from the store. With D2 this
+  is now genuinely safe rather than merely tolerated.
+
+---
+
+## 8. API surface
+
+All paths are under the existing `worlds` router prefix (`/api/worlds`) unless
+noted. New router module: `backend/app/routers/world_content.py`, mounted at
+`/api/worlds`; internal routes in `backend/app/routers/internal.py` at
+`/api/internal`.
+
+### 8.1 Public (editor & player client; JWT `CurrentUser`)
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/api/worlds/{world_id}/rooms` | List rooms + grid config |
+| `POST` | `/api/worlds/{world_id}/rooms` | Create a room (owner) |
+| `GET` | `/api/worlds/{world_id}/rooms/{slug}/chunks` | Chunk **index** over a bounds query |
+| `GET` | `/api/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}` | Fetch one chunk |
+| `PUT` | `/api/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}` | Write one chunk |
+| `PUT` | `/api/worlds/{world_id}/rooms/{slug}/chunks` | Write up to `WORLD_CHUNK_MAX_BATCH` chunks atomically |
+| `DELETE` | `/api/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}` | Delete one chunk |
+| `GET` | `/api/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}/revisions` | Revision history (owner) |
+| `POST` | `/api/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}/rollback` | Restore a revision (owner) |
+
+**Room list** — `GET .../rooms` → `200`
+
+```json
+[{ "id": 7, "slug": "main", "name": "Main",
+   "grid": { "size": [32, 32, 1], "origin": [0, 0, 0] },
+   "bounds": null,
+   "spawn": { "pos": [0, 1.5, 0], "yaw": 0.0 },
+   "chunk_count": 41 }]
+```
+
+**Chunk index** — `GET .../chunks?cx_min=&cx_max=&cy_min=&cy_max=&cz=0` → `200`.
+Payloads are *not* included; this is `world.md` §5.1's `list_chunks(bounds)` and
+lets a streamer decide what to fetch and skip anything already cached by
+checksum.
+
+```json
+{ "room": "main", "content_revision": 118,
+  "chunks": [{ "key": "12:main:0:0:0", "cx": 0, "cy": 0, "cz": 0,
+               "revision": 4, "checksum": "9f86…", "payload_len": 2344,
+               "is_mature": false, "updated_at": "2026-09-14T10:02:11Z" }] }
+```
+
+Bounds are capped (default 32×32 chunks per query) and return `422` beyond that.
+
+**Chunk fetch** — `GET .../chunks/{cx}/{cy}/{cz}`, content-negotiated:
+
+- `Accept: application/octet-stream` (default for the game client) → `200` with
+  the raw `world.md` §3.6 bytes, `ETag: "<checksum>"`,
+  `X-Chunk-Revision: <n>`, `X-Chunk-Key: <key>`.
+- `Accept: application/json` (tooling, tests, the editor's debug view) → the
+  §3.5 JSON encoding, decoded server-side from the payload. JSON is derived, never
+  stored, so there is no dual-write drift (`world.md` §4.4).
+- `If-None-Match: "<checksum>"` → `304`. This is what makes the client's
+  `user://chunk_cache/` cache cheap and is why the checksum is the ETag.
+- `404` if the chunk does not exist (an unwritten coordinate is not an error to
+  the streamer — it renders empty).
+
+**Chunk write** — `PUT .../chunks/{cx}/{cy}/{cz}`
+
+```
+Content-Type: application/octet-stream
+X-Base-Revision: 4          # 0 = create
+<binary payload>
+```
+
+or, for clients that prefer JSON:
+`{"base_revision": 4, "payload_b64": "…"}`.
+
+Responses:
+
+| Code | Body / meaning |
+|---|---|
+| `200` | `{"key", "revision", "checksum", "payload_len", "updated_at", "is_mature", "live_session"}` |
+| `409` | `{"detail": "revision conflict", "current_revision": 6, "current_checksum": "…"}` |
+| `403` | not the world owner |
+| `404` | world or room not found / not visible |
+| `413` | payload over `WORLD_CHUNK_MAX_PAYLOAD_BYTES` |
+| `422` | decode/validation failure (`{"detail", "reason"}`, e.g. `checksum_mismatch`, `layer_dims`, `object_out_of_bounds`) |
+
+**Batch write** — `PUT .../chunks` with
+`{"chunks": [{"cx","cy","cz","base_revision","payload_b64"}, …]}`. Applied in
+**one transaction, all-or-nothing**: if any entry conflicts, nothing is written
+and the response is `409` naming the offending coordinate. Justification: an
+editor brush stroke or an object drag routinely straddles a chunk boundary, and
+without a batch the editor either issues N round trips or leaves half of a user
+action persisted. Capped at `WORLD_CHUNK_MAX_BATCH` chunks and 8 MB.
+
+### 8.2 D5 — Full-chunk PUT, not JSON-Patch deltas
+
+`world.md` §5.4 specifies RFC-6902 deltas against `base_revision`. This design
+sends **whole chunks** instead.
+
+- A 32×32×1 chunk is ~2 KB of dense tile indices plus its objects — a few KB.
+  The bandwidth a patch saves is negligible at editor rates.
+- The stored form is an opaque binary blob. Patching it means the backend must
+  decode → apply a JSON-Patch → re-encode → re-checksum, i.e. implement and test
+  a *second* mutation format on top of the codec, with its own failure modes, and
+  keep it in sync with the client's patch generator. That is the same dual-path
+  drift risk `world.md` §5.2 exists to prevent.
+- Lost-update protection comes from `base_revision`, not from the patch, so
+  nothing is given up on correctness.
+
+Delta encoding stays available as a pure bandwidth optimization later —
+`world.md` §8 already files it as future work.
+
+### 8.3 Internal (dedicated server; `require_game_server` token)
+
+| Method | Path | Purpose |
+|---|---|---|
+| `GET` | `/api/internal/worlds/{world_id}/manifest` | Rooms, grids, spawn, `content_revision`, chunk counts |
+| `GET` | `/api/internal/worlds/{world_id}/rooms/{slug}/chunks` | Bounds index (same shape as §8.1) |
+| `GET` | `/api/internal/worlds/{world_id}/rooms/{slug}/chunks/{cx}/{cy}/{cz}` | Binary payload |
+
+Read-only by construction — there is no internal write route, and adding one
+would violate D2. The token is world-scoped, so a path whose `world_id` differs
+from the token's world is `403`. These routes skip the per-user visibility check
+(the sim process has no user) and apply no mature gating (gating is a client/user
+concern; the server still needs collision).
+
+### 8.4 D6 — The client streams chunks over HTTP, not over ENet
+
+`world.md` §5.3 routes `request_chunk` / `chunk_data` over the game's ENet
+connection. This design has the playing client fetch chunks from the **backend
+over HTTP**, the same routes the editor uses.
+
+- The dedicated server has no content the backend doesn't have; proxying bytes
+  through it adds a hop and puts multi-megabyte reliable transfers in contention
+  with the 30 Hz snapshot broadcast on the same ENet peer.
+- HTTP gives caching for free — `ETag`/`If-None-Match` on the checksum, and a
+  local `user://chunk_cache/<checksum>` that survives sessions.
+- `ApiClient` (`scripts/api_client.gd`) already carries the JWT and the result
+  contract; no new transport code.
+
+**This does not require rewriting `ChunkStreamManager`.** It already calls
+through a `set_server_rpc()` seam that only needs an object with
+`request_chunk(key)`. The editor-wiring task supplies an `HttpChunkSource` that
+implements that method against `ApiClient` and feeds
+`_on_chunk_data_received(key, bytes)` — which also finally gives that dormant
+seam a caller. Note the existing `_load_chunk()` builds its key with empty
+world/room ids (`Chunk.build_key("", "", coord)`); the adapter must supply the
+real world id and room slug.
+
+---
+
+## 9. What each follow-on task owns
+
+**Backend task**
+- `backend/app/models/world_content.py` + `0005_add_world_content_tables`
+- `backend/app/services/chunk_codec.py` (Python port of `world.md` §3.6) and the
+  golden-file fixtures shared with the Godot suite
+- `backend/app/services/world_store.py` (the `world.md` §5.1 service interface,
+  minus `flush_dirty`/`rebuild_index`, over Postgres)
+- `backend/app/routers/world_content.py`, `backend/app/routers/internal.py`
+- `game_servers.py`: per-spawn token, `--api-url`/`--server-token` args,
+  readiness-from-status-file instead of `_await_port` (§7.4)
+- `create_world` creates the `main` room
+
+**Client/editor task**
+- `HttpChunkSource` adapter → `ChunkStreamManager.set_server_rpc()`
+- Editor save path (single + batch PUT), 409 conflict re-fetch-and-reapply,
+  `live_session` warning UI
+- "Edit world" entry from the world browser that does **not** join
+- `server.gd`: arg parsing, manifest + chunk fetch before `create_server`,
+  collision build from decoded chunks, `test_level.tscn` fallback,
+  `"ready"`/`"content"` fields in the status file
+
+---
+
+## 10. Open questions (deliberately not decided here)
+
+- **Hot reload / build-in-place** while a session is live (§6) — the
+  `content_revision` seam is in place for it.
+- **Collaborator permissions** beyond `owner_id` — one check in §5.3.
+- **Mature-content gating** on the read path — column and index exist; the
+  policy belongs to `content_moderation.md`.
+- **`world_chunk_objects`** derived index — spec'd in `world.md` §4.5, build it
+  when a query needs it (§4.2).
+- **Payload compression** — the §3.6 header reserves a flags bitmask; Postgres
+  TOAST already compresses `BYTEA`, so measure before adding a second layer.
+- **Chunk streaming for very large worlds** — the bounds-query cap in §8.1 is a
+  guardrail, not a scaling plan.

docs/checkpoints/PC4.md

@@ -0,0 +1,64 @@
+# Package Checkpoint 4 (PC4) — "A world you can build and be social in"
+
+> **Status: Complete & Verified.** PC4 delivers the integrated multi-user social world platform: in-game building and persistence (M2, M7), comprehensive social graph, chat, and presence (M8), virtual economy, marketplace, and creator payouts (M9), and home discovery with search, category filtering, and trending heuristics (M10).
+
+Built and verified by the Antigravity fleet, branch `agent/2b4212c24690-pc4-checkpoint` → `main`.
+
+---
+
+## 1. What's Real and Verified (`scripts/run_checkpoint_tests.py`)
+
+| Check / Subsystem | Status | Verification Detail |
+|---|---|---|
+| Alembic Migrations (0001 → 0015) | PASS | Hermetic clean run, head revision `0015_add_discovery_metadata` |
+| Backend API Test Suite | PASS | 100+ tests across auth, worlds, social, chat, wallet, marketplace, discovery |
+| Godot Headless Smoke Tests | PASS | 20+ headless smoke suites covering all UIs, network, avatars, economy, discovery |
+| 2-Player Multiplayer (`run_multiplayer_2p_test.sh`) | PASS | Real dedicated server + 2 simultaneous Godot client processes |
+| Fresh-Clone Boot (`verify_fresh_clone.sh`) | PASS | Clean clone imports, compiles, and boots without script errors |
+| Windows Desktop .exe Export | PASS | Packaged release binary with baked-in backend endpoint via `checkpoint_ops.py` |
+
+---
+
+## 2. Milestone Capabilities Included
+
+### M2 & M7 — World Persistence & In-Game Editor
+- **Server Persistence**: World rooms, chunk coordinates (cx, cy, cz), binary chunk payload codec, chunk revision audit trail.
+- **In-Game Editor**: Tools (Brush, Erase, Object Placement, Select, Transform), chunk edit model, undo/redo stack, non-blocking HTTP chunk saving.
+
+### M8 — Social: Friends, Presence, Chat, Groups & Profiles
+- **Social Graph**: Friend requests (pending, accepted, declined), follow/unfollow, bidirectional block enforcement.
+- **Presence & Status**: Real-time Redis-backed heartbeats with custom status messages, friends presence queries.
+- **Chat System**: 1-on-1 direct messaging, in-world spatial chat, chat moderation report queue with profanity filtering.
+- **Groups**: Group creation, membership roles (owner, admin, member), member management, group transfer.
+- **Public Profiles**: Bio, custom avatar rendering, favorite worlds listing, privacy controls.
+- **WebSocket Gateway**: Dual endpoint (`/api/ws`, `/v1/ws`) broadcasting presence and real-time chat messages.
+- **Godot Client & UIs**: `FriendsPresenceUI`, `ChatUI`, `ProfileUI`, `GroupsUI`.
+
+### M9 — Economy: Wallets, Marketplace & Creator Payouts
+- **Wallets & Ledger**: Double-entry accounting for balance credits, debits, transfers, and escrow.
+- **Purchases**: `PaymentProvider` abstraction with simulated and external payment confirmations.
+- **Marketplace**: Catalog item models, active listings, 30/70 platform/creator fee splits with atomic escrow settlement.
+- **Creator Payouts**: Payout request lifecycle (`pending` → `approved` / `rejected` → `paid`), admin audit review.
+- **Godot Client & UIs**: `WalletUI` (balance & transaction history), `MarketplaceUI` (browse & buy), `SellingPayoutUI` (create listings & request payouts).
+
+### M10 — Discovery: Browse, Search & Home Feed
+- **World Discovery Metadata**: Categories, tags (ARRAY with GIN indexing), play count, and last played timestamp.
+- **Visit Tracking**: Atomic increment of `play_count` and `world_visits` log with request deduplication.
+- **Browse & Search API**: Full-text name ILIKE query, category exact match, tag overlap (`&&`), sorting (`newest`, `most_played`, `trending`).
+- **Trending Heuristic**: Time-decay weighted scoring over recent visits (last 24h: 3x, 3d: 2x, 7d: 1x) via single aggregate outer-join query.
+- **Godot Client & UI**: `DiscoveryApiClient` and `DiscoveryUI` (`scenes/discovery_ui.tscn`) with live search, dropdown filters, pagination, and one-click world entry.
+
+---
+
+## 3. Playtest Guide
+
+1. **Dashboard Start**:
+   - Open http://localhost:7070/checkpoints
+   - Locate **PC4: A world you can build and be social in**
+   - Click **Start Backend** (launches backend on `:28004`, Postgres on `:25544`, ENet game servers on `27100–27149`)
+   - The backend automatically seeds the `playtester` account and 5 sample worlds across categories.
+2. **Download & Play**:
+   - Click **Download Windows .exe**
+   - Launch `agp-game.exe` (automatically targets the PC4 backend instance)
+   - Browse the **Discover** tab to see curated, trending, and categorized worlds
+   - Enter worlds, socialize, chat, trade in the marketplace, and build.

docs/testing/test_inventory.md

@@ -78,6 +78,14 @@ local catalog/loadout/loader logic. Backend-dependent tests read
 | `smoke_test_enter_world.gd` | The full PC2 path end to end: register → seed a real world → load `world_list.tscn` → click the real "Enter World" button on a real card (found by walking the card's children, not by index, so it doesn't silently pass if the card layout changes) → confirms `scenes/game.tscn` actually becomes `current_scene` with the player spawned at the level's `PlayerSpawn` marker → sends a real `KEY_ESCAPE` input event (not a direct method call) and confirms it returns to `world_list.tscn`. This is the test that proves "browse → enter → walk around → leave" actually works as one continuous flow, not just that each piece works in isolation. |
 | `smoke_test_network_client.gd` | **Real two-process integration test** for `scripts/network_client.gd` (client-side prediction + reconciliation, docs/architecture/networking.md §5) — needs an actual dedicated server running first: `godot --headless --path . scenes/server.tscn &`, *not* the usual HTTP backend. Connects a real `NetworkClient` over ENet, confirms local input prediction moves the player immediately (no waiting on a round trip), confirms real snapshots arrive and get processed, then deliberately desyncs the predicted position by 9999 units and confirms the very next snapshot corrects it back — the actual proof reconciliation logic works, not just that it never had to fire. Known simplification, stated in the script's own docstring: the server's snapshot doesn't currently echo back a per-peer "last input seq processed," so reconciliation corrects against the *most recent* prediction rather than true tick-exact rollback-and-replay (docs/architecture/networking.md §5.2 step 4) — a real, scoped follow-up once the server echoes that ack, not something faked here. |
 | `smoke_test_avatar_system.gd` | Confirms `AvatarSystem` is a real autoload, the committed `assets/avatars/catalog.json` actually parses, `get_assets_for_slot("base_body")` returns real entries, an `AvatarLoadout` can set `base_body` and equip a real catalog accessory, the loadout round-trips through `to_json()`/`load_loadout_from_json()`, and — since `assets/avatars/*.glb` model files don't exist yet — that `AvatarLoader.load_base_body()` against a real catalog entry with a missing file fails *gracefully*: returns `null` and emits `load_error` rather than crashing. Visual rendering itself can't be verified until real assets exist. |
+| `smoke_test_social_client.gd` | Headless verification of `SocialApiClient` methods for friends, presence heartbeats, profiles, groups, and chat. |
+| `smoke_test_economy_client.gd` | Headless verification of `EconomyApiClient` methods for wallet, payments, catalog items, listings, and payouts. |
+| `smoke_test_wallet_ui.gd` | Instantiates `scenes/wallet_ui.tscn`, verifies balance display, transaction history list rendering, and empty states. |
+| `smoke_test_marketplace_ui.gd` | Instantiates `scenes/marketplace_ui.tscn`, verifies keyword/price/type filter controls, active listing cards rendering, and purchase flow. |
+| `smoke_test_selling_payout_ui.gd` | Instantiates `scenes/selling_payout_ui.tscn`, verifies catalog item picker, listing creation, and payout request submission. |
+| `smoke_test_discovery_client.gd` | Headless verification of `DiscoveryApiClient` typed resource parsing (`WorldSummary`, `DiscoveryResult`), and search/browse methods. |
+| `smoke_test_discovery_ui.gd` | Instantiates `scenes/discovery_ui.tscn`, verifies search input, category dropdown, sort options (newest/most-played/trending), pagination controls, and world entry integration. |
+
 
 Run (once, to build the class cache): `godot --headless --path . --import`,
 then for each smoke test: `godot --headless --path . --script

project.godot

@@ -50,6 +50,11 @@ interact={
 "events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":69,"key_label":0,"unicode":101,"location":0,"echo":false,"script":null)
 ]
 }
+toggle_build_mode={
+"deadzone": 0.5,
+"events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":4194333,"key_label":0,"unicode":0,"location":0,"echo":false,"script":null)
+]
+}
 
 [physics]
 

scenes/chat_ui.tscn

@@ -0,0 +1,202 @@
+[gd_scene load_steps=2 format=3]
+
+[ext_resource type="Script" path="res://scripts/chat_ui.gd" id="1_cu"]
+
+[node name="ChatUI" type="Control"]
+layout_mode = 3
+anchors_preset = 15
+anchor_right = 1.0
+anchor_bottom = 1.0
+grow_horizontal = 2
+grow_vertical = 2
+script = ExtResource("1_cu")
+
+[node name="VBoxContainer" type="VBoxContainer" parent="."]
+layout_mode = 1
+anchors_preset = 15
+anchor_right = 1.0
+anchor_bottom = 1.0
+offset_left = 32.0
+offset_top = 32.0
+offset_right = -32.0
+offset_bottom = -32.0
+grow_horizontal = 2
+grow_vertical = 2
+theme_override_constants/separation = 12
+
+[node name="HeaderHBox" type="HBoxContainer" parent="VBoxContainer"]
+layout_mode = 2
+theme_override_constants/separation = 16
+
+[node name="BackButton" type="Button" parent="VBoxContainer/HeaderHBox"]
+custom_minimum_size = Vector2(100, 36)
+layout_mode = 2
+text = "< Back"
+
+[node name="TitleLabel" type="Label" parent="VBoxContainer/HeaderHBox"]
+layout_mode = 2
+size_flags_horizontal = 3
+theme_override_font_sizes/font_size = 26
+text = "Chat & Messaging"
+horizontal_alignment = 1
+
+[node name="RefreshButton" type="Button" parent="VBoxContainer/HeaderHBox"]
+custom_minimum_size = Vector2(100, 36)
+layout_mode = 2
+text = "Refresh"
+
+[node name="StatusMessageLabel" type="Label" parent="VBoxContainer"]
+layout_mode = 2
+horizontal_alignment = 1
+
+[node name="TabContainer" type="TabContainer" parent="VBoxContainer"]
+layout_mode = 2
+size_flags_vertical = 3
+current_tab = 0
+
+[node name="WorldChat" type="VBoxContainer" parent="VBoxContainer/TabContainer"]
+layout_mode = 2
+theme_override_constants/separation = 8
+metadata/_tab_index = 0
+
+[node name="ControlsHBox" type="HBoxContainer" parent="VBoxContainer/TabContainer/WorldChat"]
+layout_mode = 2
+theme_override_constants/separation = 8
+
+[node name="WorldPrefix" type="Label" parent="VBoxContainer/TabContainer/WorldChat/ControlsHBox"]
+layout_mode = 2
+text = "World ID:"
+
+[node name="WorldIdEdit" type="LineEdit" parent="VBoxContainer/TabContainer/WorldChat/ControlsHBox"]
+custom_minimum_size = Vector2(120, 32)
+layout_mode = 2
+text = "1"
+
+[node name="JoinChatButton" type="Button" parent="VBoxContainer/TabContainer/WorldChat/ControlsHBox"]
+custom_minimum_size = Vector2(110, 32)
+layout_mode = 2
+text = "Switch Channel"
+
+[node name="Scroll" type="ScrollContainer" parent="VBoxContainer/TabContainer/WorldChat"]
+layout_mode = 2
+size_flags_vertical = 3
+
+[node name="MessagesList" type="VBoxContainer" parent="VBoxContainer/TabContainer/WorldChat/Scroll"]
+layout_mode = 2
+size_flags_horizontal = 3
+theme_override_constants/separation = 8
+
+[node name="SendHBox" type="HBoxContainer" parent="VBoxContainer/TabContainer/WorldChat"]
+layout_mode = 2
+theme_override_constants/separation = 8
+
+[node name="MessageInput" type="LineEdit" parent="VBoxContainer/TabContainer/WorldChat/SendHBox"]
+layout_mode = 2
+size_flags_horizontal = 3
+placeholder_text = "Type a message in world chat..."
+
+[node name="SendButton" type="Button" parent="VBoxContainer/TabContainer/WorldChat/SendHBox"]
+custom_minimum_size = Vector2(100, 36)
+layout_mode = 2
+text = "Send"
+
+[node name="DirectMessages" type="VBoxContainer" parent="VBoxContainer/TabContainer"]
+visible = false
+layout_mode = 2
+theme_override_constants/separation = 8
+metadata/_tab_index = 1
+
+[node name="StartHBox" type="HBoxContainer" parent="VBoxContainer/TabContainer/DirectMessages"]
+layout_mode = 2
+theme_override_constants/separation = 8
+
+[node name="TargetUserEdit" type="LineEdit" parent="VBoxContainer/TabContainer/DirectMessages/StartHBox"]
+layout_mode = 2
+size_flags_horizontal = 3
+placeholder_text = "Enter User ID to start conversation..."
+
+[node name="StartDmButton" type="Button" parent="VBoxContainer/TabContainer/DirectMessages/StartHBox"]
+custom_minimum_size = Vector2(140, 32)
+layout_mode = 2
+text = "Start Direct Chat"
+
+[node name="HSplit" type="HSplitContainer" parent="VBoxContainer/TabContainer/DirectMessages"]
+layout_mode = 2
+size_flags_vertical = 3
+split_offset = 260
+
+[node name="ConversationsVBox" type="VBoxContainer" parent="VBoxContainer/TabContainer/DirectMessages/HSplit"]
+layout_mode = 2
+size_flags_horizontal = 3
+size_flags_stretch_ratio = 0.35
+theme_override_constants/separation = 6
+
+[node name="ConvHeader" type="Label" parent="VBoxContainer/TabContainer/DirectMessages/HSplit/ConversationsVBox"]
+layout_mode = 2
+theme_override_font_sizes/font_size = 18
+text = "Conversations"
+
+[node name="Scroll" type="ScrollContainer" parent="VBoxContainer/TabContainer/DirectMessages/HSplit/ConversationsVBox"]
+layout_mode = 2
+size_flags_vertical = 3
+
+[node name="ConvList" type="VBoxContainer" parent="VBoxContainer/TabContainer/DirectMessages/HSplit/ConversationsVBox/Scroll"]
+layout_mode = 2
+size_flags_horizontal = 3
+theme_override_constants/separation = 4
+
+[node name="ChatVBox" type="VBoxContainer" parent="VBoxContainer/TabContainer/DirectMessages/HSplit"]
+layout_mode = 2
+size_flags_horizontal = 3
+theme_override_constants/separation = 6
+
+[node name="DmHeaderLabel" type="Label" parent="VBoxContainer/TabContainer/DirectMessages/HSplit/ChatVBox"]
+layout_mode = 2
+theme_override_font_sizes/font_size = 18
+text = "Select a conversation"
+
+[node name="Scroll" type="ScrollContainer" parent="VBoxContainer/TabContainer/DirectMessages/HSplit/ChatVBox"]
+layout_mode = 2
+size_flags_vertical = 3
+
+[node name="MessagesList" type="VBoxContainer" parent="VBoxContainer/TabContainer/DirectMessages/HSplit/ChatVBox/Scroll"]
+layout_mode = 2
+size_flags_horizontal = 3
+theme_override_constants/separation = 8
+
+[node name="SendHBox" type="HBoxContainer" parent="VBoxContainer/TabContainer/DirectMessages/HSplit/ChatVBox"]
+layout_mode = 2
+theme_override_constants/separation = 8
+
+[node name="MessageInput" type="LineEdit" parent="VBoxContainer/TabContainer/DirectMessages/HSplit/ChatVBox/SendHBox"]
+layout_mode = 2
+size_flags_horizontal = 3
+placeholder_text = "Type a direct message..."
+
+[node name="SendButton" type="Button" parent="VBoxContainer/TabContainer/DirectMessages/HSplit/ChatVBox/SendHBox"]
+custom_minimum_size = Vector2(100, 36)
+layout_mode = 2
+text = "Send"
+
+[node name="ReportDialog" type="ConfirmationDialog" parent="."]
+title = "Report Inappropriate Message"
+size = Vector2i(420, 200)
+
+[node name="VBox" type="VBoxContainer" parent="ReportDialog"]
+offset_left = 8.0
+offset_top = 8.0
+offset_right = 412.0
+offset_bottom = 151.0
+theme_override_constants/separation = 8
+
+[node name="DetailsLabel" type="Label" parent="ReportDialog/VBox"]
+layout_mode = 2
+autowrap_mode = 2
+
+[node name="ReasonPrompt" type="Label" parent="ReportDialog/VBox"]
+layout_mode = 2
+text = "Reason for report:"
+
+[node name="ReasonEdit" type="LineEdit" parent="ReportDialog/VBox"]
+layout_mode = 2
+text = "Inappropriate content"

scenes/discovery_ui.tscn

@@ -0,0 +1,150 @@
+[gd_scene load_steps=2 format=3]
+
+[ext_resource type="Script" path="res://scripts/discovery_ui.gd" id="1_disc"]
+
+[node name="DiscoveryUI" type="Control"]
+layout_mode = 3
+anchors_preset = 15
+anchor_right = 1.0
+anchor_bottom = 1.0
+grow_horizontal = 2
+grow_vertical = 2
+script = ExtResource("1_disc")
+
+[node name="VBox" type="VBoxContainer" parent="."]
+layout_mode = 1
+anchors_preset = 15
+anchor_right = 1.0
+anchor_bottom = 1.0
+offset_left = 32.0
+offset_top = 24.0
+offset_right = -32.0
+offset_bottom = -24.0
+grow_horizontal = 2
+grow_vertical = 2
+theme_override_constants/separation = 12
+
+[node name="Header" type="HBoxContainer" parent="VBox"]
+layout_mode = 2
+theme_override_constants/separation = 16
+
+[node name="BackButton" type="Button" parent="VBox/Header"]
+custom_minimum_size = Vector2(100, 36)
+layout_mode = 2
+text = "< Back"
+
+[node name="TitleLabel" type="Label" parent="VBox/Header"]
+layout_mode = 2
+size_flags_horizontal = 3
+theme_override_font_sizes/font_size = 26
+text = "Discover Experiences"
+horizontal_alignment = 1
+
+[node name="RefreshButton" type="Button" parent="VBox/Header"]
+custom_minimum_size = Vector2(100, 36)
+layout_mode = 2
+text = "Refresh"
+
+[node name="StatusLabel" type="Label" parent="VBox"]
+visible = false
+layout_mode = 2
+theme_override_colors/font_color = Color(1, 0.3, 0.3, 1)
+text = ""
+
+[node name="Filters" type="HBoxContainer" parent="VBox"]
+layout_mode = 2
+theme_override_constants/separation = 10
+
+[node name="SearchEdit" type="LineEdit" parent="VBox/Filters"]
+custom_minimum_size = Vector2(240, 36)
+layout_mode = 2
+placeholder_text = "Search by name or tag..."
+
+[node name="CategoryOption" type="OptionButton" parent="VBox/Filters"]
+custom_minimum_size = Vector2(160, 36)
+layout_mode = 2
+
+[node name="SortOption" type="OptionButton" parent="VBox/Filters"]
+custom_minimum_size = Vector2(140, 36)
+layout_mode = 2
+
+[node name="FilterButton" type="Button" parent="VBox/Filters"]
+custom_minimum_size = Vector2(90, 36)
+layout_mode = 2
+text = "Filter"
+
+[node name="Content" type="Control" parent="VBox"]
+layout_mode = 2
+size_flags_vertical = 3
+
+[node name="LoadingLabel" type="Label" parent="VBox/Content"]
+visible = false
+layout_mode = 1
+anchors_preset = 14
+anchor_top = 0.5
+anchor_right = 1.0
+anchor_bottom = 0.5
+offset_top = -12.0
+offset_bottom = 12.0
+text = "Loading experiences..."
+horizontal_alignment = 1
+
+[node name="ErrorLabel" type="Label" parent="VBox/Content"]
+visible = false
+layout_mode = 1
+anchors_preset = 14
+anchor_top = 0.5
+anchor_right = 1.0
+anchor_bottom = 0.5
+offset_top = -12.0
+offset_bottom = 12.0
+theme_override_colors/font_color = Color(1, 0.4, 0.4, 1)
+text = ""
+horizontal_alignment = 1
+
+[node name="EmptyLabel" type="Label" parent="VBox/Content"]
+visible = false
+layout_mode = 1
+anchors_preset = 14
+anchor_top = 0.5
+anchor_right = 1.0
+anchor_bottom = 0.5
+offset_top = -12.0
+offset_bottom = 12.0
+theme_override_colors/font_color = Color(0.7, 0.7, 0.7, 1)
+text = "No experiences found."
+horizontal_alignment = 1
+
+[node name="Scroll" type="ScrollContainer" parent="VBox/Content"]
+layout_mode = 1
+anchors_preset = 15
+anchor_right = 1.0
+anchor_bottom = 1.0
+grow_horizontal = 2
+grow_vertical = 2
+
+[node name="WorldsVBox" type="VBoxContainer" parent="VBox/Content/Scroll"]
+layout_mode = 2
+size_flags_horizontal = 3
+size_flags_vertical = 3
+theme_override_constants/separation = 10
+
+[node name="Pagination" type="HBoxContainer" parent="VBox"]
+layout_mode = 2
+theme_override_constants/separation = 16
+alignment = 1
+
+[node name="PrevButton" type="Button" parent="VBox/Pagination"]
+custom_minimum_size = Vector2(90, 32)
+layout_mode = 2
+text = "< Prev"
+
+[node name="PageLabel" type="Label" parent="VBox/Pagination"]
+layout_mode = 2
+text = "Page 1 of 1"
+horizontal_alignment = 1
+
+[node name="NextButton" type="Button" parent="VBox/Pagination"]
+custom_minimum_size = Vector2(90, 32)
+layout_mode = 2
+text = "Next >"