Generalize rate_limit.py into a reusable named-limit dependency

Adds rate_limit(name, max_hits=, window_seconds=) as a factory for FastAPI
dependencies, generalizing the auth_rate_limit pattern for future endpoints
(chat send, message report) without touching auth_rate_limit's own behavior.
Reuses SlidingWindowLimiter for counting and the existing 429 + Retry-After
response, and respects RATE_LIMIT_ENABLED the same way auth_rate_limit does.
reset_all() now clears every registered limiter (auth's plus any named ones),
so the conftest autouse fixture keeps working for sibling tasks automatically.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y2FESCaMXeJpC9gSctiEeD

backend/alembic/versions/0006_add_presence_columns.py

@@ -0,0 +1,33 @@
+"""add presence columns to users
+
+Revision ID: 0006_add_presence_columns
+Revises: 0005_add_world_content_tables
+Create Date: 2026-09-14 00:00:00.000000
+
+Ported forward from the orphaned agent/dd2a126b57a1 branch (originally
+2a9b9873244a_add_presence_columns.py, down_revision 0001_initial) and
+rebased onto the current migration head. See app/services/presence.py /
+app/routers/presence.py.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+# revision identifiers, used by Alembic.
+revision: str = "0006_add_presence_columns"
+down_revision: Union[str, None] = "0005_add_world_content_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Add last_seen_at and status_message columns to users table."""
+    op.add_column("users", sa.Column("last_seen_at", sa.DateTime(timezone=True), nullable=True))
+    op.add_column("users", sa.Column("status_message", sa.Text(), nullable=True))
+
+
+def downgrade() -> None:
+    """Remove presence columns from users table."""
+    op.drop_column("users", "status_message")
+    op.drop_column("users", "last_seen_at")

backend/alembic/versions/0007_add_social_graph_tables.py

@@ -0,0 +1,118 @@
+"""add social graph tables (friendships, follows, blocks)
+
+Revision ID: 0007_add_social_graph_tables
+Revises: 0006_add_presence_columns
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/social.md US-1 / app/models/social.py. Models + migration
+only -- the request/accept/block business logic lives in the sibling
+"Friends & follow API router" task.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0007_add_social_graph_tables"
+down_revision: Union[str, None] = "0006_add_presence_columns"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    friendship_status = postgresql.ENUM(
+        "pending", "accepted", name="friendship_status"
+    )
+    friendship_status.create(op.get_bind(), checkfirst=True)
+
+    op.create_table(
+        "friendships",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "requester_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "addressee_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "status",
+            postgresql.ENUM(
+                "pending", "accepted", name="friendship_status", create_type=False
+            ),
+            nullable=False,
+            server_default="pending",
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("requester_id", "addressee_id", name="uq_friendships_pair"),
+    )
+    op.create_index("ix_friendships_requester_id", "friendships", ["requester_id"])
+    op.create_index("ix_friendships_addressee_id", "friendships", ["addressee_id"])
+
+    op.create_table(
+        "follows",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "follower_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "followed_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("follower_id", "followed_id", name="uq_follows_pair"),
+    )
+    op.create_index("ix_follows_follower_id", "follows", ["follower_id"])
+    op.create_index("ix_follows_followed_id", "follows", ["followed_id"])
+
+    op.create_table(
+        "blocks",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "blocker_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "blocked_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("blocker_id", "blocked_id", name="uq_blocks_pair"),
+    )
+    op.create_index("ix_blocks_blocker_id", "blocks", ["blocker_id"])
+    op.create_index("ix_blocks_blocked_id", "blocks", ["blocked_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_blocks_blocked_id", table_name="blocks")
+    op.drop_index("ix_blocks_blocker_id", table_name="blocks")
+    op.drop_table("blocks")
+
+    op.drop_index("ix_follows_followed_id", table_name="follows")
+    op.drop_index("ix_follows_follower_id", table_name="follows")
+    op.drop_table("follows")
+
+    op.drop_index("ix_friendships_addressee_id", table_name="friendships")
+    op.drop_index("ix_friendships_requester_id", table_name="friendships")
+    op.drop_table("friendships")
+
+    postgresql.ENUM(name="friendship_status").drop(op.get_bind(), checkfirst=True)

backend/alembic/versions/0008_add_chat_tables.py

@@ -0,0 +1,178 @@
+"""add chat tables (conversations, messages, message_reports)
+
+Revision ID: 0008_add_chat_tables
+Revises: 0007_add_social_graph_tables
+Create Date: 2026-09-15 00:00:00.000000
+
+docs/planning/social.md US-4 / app/models/chat.py. Models + migration only
+-- text filtering, rate limiting, and send/report/moderation endpoints live
+in sibling tasks that depend on this one.
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+# revision identifiers, used by Alembic.
+revision: str = "0008_add_chat_tables"
+down_revision: Union[str, None] = "0007_add_social_graph_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    message_report_status = postgresql.ENUM(
+        "open", "resolved", "dismissed", name="message_report_status"
+    )
+    message_report_status.create(op.get_bind(), checkfirst=True)
+
+    op.create_table(
+        "conversations",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "user_a_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_b_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint("user_a_id", "user_b_id", name="uq_conversations_pair"),
+        sa.CheckConstraint("user_a_id < user_b_id", name="ck_conversations_ordered_pair"),
+    )
+    op.create_index("ix_conversations_user_a_id", "conversations", ["user_a_id"])
+    op.create_index("ix_conversations_user_b_id", "conversations", ["user_b_id"])
+
+    op.create_table(
+        "conversation_participants",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "conversation_id",
+            sa.Integer(),
+            sa.ForeignKey("conversations.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column(
+            "user_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="CASCADE"),
+            nullable=False,
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.UniqueConstraint(
+            "conversation_id", "user_id", name="uq_conversation_participants_pair"
+        ),
+    )
+    op.create_index(
+        "ix_conversation_participants_conversation_id",
+        "conversation_participants",
+        ["conversation_id"],
+    )
+    op.create_index(
+        "ix_conversation_participants_user_id", "conversation_participants", ["user_id"]
+    )
+
+    op.create_table(
+        "messages",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "sender_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column(
+            "conversation_id",
+            sa.Integer(),
+            sa.ForeignKey("conversations.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column(
+            "world_id",
+            sa.Integer(),
+            sa.ForeignKey("worlds.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column(
+            "room_id",
+            sa.Integer(),
+            sa.ForeignKey("world_rooms.id", ondelete="CASCADE"),
+            nullable=True,
+        ),
+        sa.Column("body", sa.Text(), nullable=False),
+        sa.Column("filtered", sa.Boolean(), nullable=False, server_default="false"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_messages_sender_id", "messages", ["sender_id"])
+    op.create_index(
+        "ix_messages_conversation_created", "messages", ["conversation_id", "created_at"]
+    )
+    op.create_index("ix_messages_world_created", "messages", ["world_id", "created_at"])
+
+    op.create_table(
+        "message_reports",
+        sa.Column("id", sa.Integer(), primary_key=True),
+        sa.Column(
+            "message_id",
+            sa.Integer(),
+            sa.ForeignKey("messages.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column(
+            "reporter_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("reason", sa.Text(), nullable=False),
+        sa.Column(
+            "status",
+            postgresql.ENUM(
+                "open", "resolved", "dismissed", name="message_report_status", create_type=False
+            ),
+            nullable=False,
+            server_default="open",
+        ),
+        sa.Column(
+            "moderator_id",
+            sa.Integer(),
+            sa.ForeignKey("users.id", ondelete="SET NULL"),
+            nullable=True,
+        ),
+        sa.Column("resolved_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_message_reports_message_id", "message_reports", ["message_id"])
+    op.create_index("ix_message_reports_reporter_id", "message_reports", ["reporter_id"])
+    op.create_index("ix_message_reports_moderator_id", "message_reports", ["moderator_id"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_message_reports_moderator_id", table_name="message_reports")
+    op.drop_index("ix_message_reports_reporter_id", table_name="message_reports")
+    op.drop_index("ix_message_reports_message_id", table_name="message_reports")
+    op.drop_table("message_reports")
+
+    op.drop_index("ix_messages_world_created", table_name="messages")
+    op.drop_index("ix_messages_conversation_created", table_name="messages")
+    op.drop_index("ix_messages_sender_id", table_name="messages")
+    op.drop_table("messages")
+
+    op.drop_index("ix_conversation_participants_user_id", table_name="conversation_participants")
+    op.drop_index(
+        "ix_conversation_participants_conversation_id", table_name="conversation_participants"
+    )
+    op.drop_table("conversation_participants")
+
+    op.drop_index("ix_conversations_user_b_id", table_name="conversations")
+    op.drop_index("ix_conversations_user_a_id", table_name="conversations")
+    op.drop_table("conversations")
+
+    postgresql.ENUM(name="message_report_status").drop(op.get_bind(), checkfirst=True)

backend/app/main.py

@@ -6,7 +6,7 @@ from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
 from app.config import settings
-from app.routers import auth, users, worlds, assets, avatar, world_content, internal
+from app.routers import auth, users, worlds, assets, avatar, world_content, internal, presence
 
 
 from app.services.game_servers import supervisor
@@ -44,6 +44,7 @@ app.include_router(world_content.router, prefix="/api/worlds", tags=["world-cont
 app.include_router(assets.router, prefix="/api/assets", tags=["assets"])
 app.include_router(avatar.router, prefix="/api/avatar", tags=["avatar"])
 app.include_router(internal.router, prefix="/api/internal", tags=["internal"])
+app.include_router(presence.router, prefix="/api/presence", tags=["presence"])
 
 
 @app.get("/api/health")

backend/app/models/__init__.py

@@ -4,8 +4,14 @@ from app.models.world import World
 from app.models.asset import Asset
 from app.models.avatar_loadout import AvatarLoadout
 from app.models.world_content import WorldRoom, WorldChunk, WorldChunkRevision
+from app.models.social import Friendship, Follow, Block, FriendshipStatus
+from app.models.chat import (
+    Conversation, ConversationParticipant, Message, MessageReport, ReportStatus,
+)
 
 __all__ = [
     "User", "Session", "World", "Asset", "AvatarLoadout",
     "WorldRoom", "WorldChunk", "WorldChunkRevision",
+    "Friendship", "Follow", "Block", "FriendshipStatus",
+    "Conversation", "ConversationParticipant", "Message", "MessageReport", "ReportStatus",
 ]

backend/app/models/chat.py

@@ -0,0 +1,217 @@
+"""Chat: DM conversations and world/room chat, plus message reports.
+
+docs/planning/social.md §4/§5 (US-4). This module is models + schema only --
+text filtering, rate limiting, and the send/list/report/moderation endpoints
+belong to sibling tasks that depend on this one.
+
+Delete-behavior choices (mirrors ``app/models/world_content.py``'s
+established convention of preserving audit/history data over cascading it
+away):
+
+- ``conversations.user_a_id`` / ``user_b_id`` -> CASCADE. A DM conversation
+  is meaningless with one of its two (and only) participants gone, so
+  deleting either user removes the conversation outright, which in turn
+  cascades to its ``conversation_participants`` rows and its ``messages``.
+- ``conversation_participants.user_id`` -> CASCADE, ``.conversation_id`` ->
+  CASCADE. Pure join-table rows; they only make sense alongside both sides.
+- ``messages.conversation_id`` -> CASCADE. Deleting a conversation deletes
+  its message history with it.
+- ``messages.sender_id`` -> SET NULL (nullable). Unlike a DM conversation
+  (which dies with its participants above), world/room chat history and any
+  message under moderation review should survive the sender's account being
+  deleted -- the row just becomes attributed to no one, matching how
+  ``WorldChunk.updated_by_id`` / ``WorldChunkRevision.actor_id`` treat
+  actor references as SET NULL rather than cascading away history.
+- ``messages.world_id`` / ``room_id`` -> CASCADE. World/room chat has no
+  meaning once the world or room it was said in is gone; consistent with
+  ``WorldChunk``'s own CASCADE from both.
+- ``message_reports.message_id`` -> SET NULL (nullable). Same audit-trail
+  reasoning as ``WorldChunkRevision`` (world_content.py): a moderation
+  report is a record that something *was* said and reported, which must
+  outlive the underlying message being removed (e.g. as the moderation
+  action taken in response to the report itself).
+- ``message_reports.reporter_id`` / ``moderator_id`` -> SET NULL (nullable).
+  Actor references for an audit record; the report itself must survive
+  either account being deleted later, matching the actor-reference
+  convention above.
+"""
+import enum
+
+from sqlalchemy import (
+    Boolean,
+    CheckConstraint,
+    Column,
+    DateTime,
+    ForeignKey,
+    Index,
+    Integer,
+    Text,
+    UniqueConstraint,
+)
+from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class ReportStatus(str, enum.Enum):
+    OPEN = "open"
+    RESOLVED = "resolved"
+    DISMISSED = "dismissed"
+
+
+class Conversation(Base):
+    """A DM conversation between exactly two users.
+
+    ``conversation_participants`` is the real roster (modeled as a join
+    table so a future group-DM schema change can widen it beyond two rows
+    without touching this table's shape), but a 2-party DM also needs a
+    cheap, DB-enforced "only one conversation per pair" guarantee, which a
+    plain join table can't express as a simple unique constraint. So the
+    pair is additionally denormalized here as ``user_a_id``/``user_b_id``,
+    always stored with the lower user id first (enforced by the check
+    constraint below); the API layer is responsible for normalizing the
+    pair before insert/lookup.
+    """
+
+    __tablename__ = "conversations"
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_a_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_b_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    participants = relationship(
+        "ConversationParticipant", back_populates="conversation", cascade="all, delete-orphan"
+    )
+    messages = relationship(
+        "Message", back_populates="conversation", cascade="all, delete-orphan"
+    )
+
+    __table_args__ = (
+        UniqueConstraint("user_a_id", "user_b_id", name="uq_conversations_pair"),
+        CheckConstraint("user_a_id < user_b_id", name="ck_conversations_ordered_pair"),
+    )
+
+
+class ConversationParticipant(Base):
+    """Join table of a conversation's members.
+
+    DMs are strictly 2-party today (enforced by ``Conversation``'s pair
+    columns above), but this is modeled as a real join table -- not folded
+    into ``Conversation`` -- so a later group-conversation feature can add
+    rows here without a schema change to this table.
+    """
+
+    __tablename__ = "conversation_participants"
+
+    id = Column(Integer, primary_key=True, index=True)
+    conversation_id = Column(
+        Integer, ForeignKey("conversations.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    user_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    conversation = relationship("Conversation", back_populates="participants")
+    user = relationship("User")
+
+    __table_args__ = (
+        UniqueConstraint(
+            "conversation_id", "user_id", name="uq_conversation_participants_pair"
+        ),
+    )
+
+
+class Message(Base):
+    """A chat message: either a DM (``conversation_id`` set) or a
+    world/room chat message (``conversation_id`` null, ``world_id`` set and
+    optionally ``room_id``).
+
+    ``world_id`` is denormalized onto every world/room message (mirroring
+    ``WorldChunk.world_id``) so world-scoped history queries don't need a
+    join through rooms; ``room_id`` narrows further to a specific room when
+    the world subdivides chat by room, and is null for world-wide chat.
+    """
+
+    __tablename__ = "messages"
+
+    id = Column(Integer, primary_key=True, index=True)
+    sender_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    conversation_id = Column(
+        Integer, ForeignKey("conversations.id", ondelete="CASCADE"), nullable=True
+    )
+    world_id = Column(
+        Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=True
+    )
+    room_id = Column(
+        Integer, ForeignKey("world_rooms.id", ondelete="CASCADE"), nullable=True
+    )
+    body = Column(Text, nullable=False)
+    filtered = Column(Boolean, nullable=False, default=False, server_default="false")
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    sender = relationship("User")
+    conversation = relationship("Conversation", back_populates="messages")
+    world = relationship("World")
+    room = relationship("WorldRoom")
+    reports = relationship(
+        "MessageReport", back_populates="message", cascade="all, delete-orphan"
+    )
+
+    __table_args__ = (
+        Index("ix_messages_conversation_created", "conversation_id", "created_at"),
+        Index("ix_messages_world_created", "world_id", "created_at"),
+    )
+
+
+class MessageReport(Base):
+    """A moderation report filed against a message.
+
+    ``message_id`` is nullable with ``ON DELETE SET NULL`` (rather than
+    CASCADE) so the report -- the audit record that something was said and
+    flagged -- outlives the message row, including when the message's own
+    removal is the moderation action taken in response to this report.
+    """
+
+    __tablename__ = "message_reports"
+
+    id = Column(Integer, primary_key=True, index=True)
+    message_id = Column(
+        Integer, ForeignKey("messages.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    reporter_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    reason = Column(Text, nullable=False)
+    status = Column(
+        ENUM(
+            ReportStatus,
+            name="message_report_status",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
+        nullable=False,
+        default=ReportStatus.OPEN,
+        server_default=ReportStatus.OPEN.value,
+    )
+    moderator_id = Column(
+        Integer, ForeignKey("users.id", ondelete="SET NULL"), nullable=True, index=True
+    )
+    resolved_at = Column(DateTime(timezone=True), nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+
+    message = relationship("Message", back_populates="reports")
+    reporter = relationship("User", foreign_keys=[reporter_id])
+    moderator = relationship("User", foreign_keys=[moderator_id])

backend/app/models/social.py

@@ -0,0 +1,106 @@
+"""Social graph: friendships, follows, blocks.
+
+docs/planning/social.md §4/§5 (US-1). Friends = mutual (request -> accept),
+Follow = one-way (no approval), Block = hard deny. This module is models +
+schema only -- the request/accept/block business logic (idempotent
+duplicate/self handling, removing an existing friendship/follow on block,
+etc.) belongs to the API router task that depends on this one.
+"""
+import enum
+
+from sqlalchemy import Column, Integer, ForeignKey, DateTime, UniqueConstraint
+from sqlalchemy.dialects.postgresql import ENUM
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class FriendshipStatus(str, enum.Enum):
+    PENDING = "pending"
+    ACCEPTED = "accepted"
+
+
+class Friendship(Base):
+    """A friend request, directional until accepted.
+
+    ``requester_id`` sent the request to ``addressee_id``. Once accepted the
+    friendship is mutual, but the row stays directional (who asked whom) for
+    audit purposes; the API layer treats it as symmetric once accepted.
+    """
+
+    __tablename__ = "friendships"
+
+    id = Column(Integer, primary_key=True, index=True)
+    requester_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    addressee_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    status = Column(
+        ENUM(
+            FriendshipStatus,
+            name="friendship_status",
+            create_type=False,
+            values_callable=lambda enum_cls: [e.value for e in enum_cls],
+        ),
+        nullable=False,
+        default=FriendshipStatus.PENDING,
+        server_default=FriendshipStatus.PENDING.value,
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    requester = relationship("User", foreign_keys=[requester_id], back_populates="sent_friend_requests")
+    addressee = relationship("User", foreign_keys=[addressee_id], back_populates="received_friend_requests")
+
+    __table_args__ = (
+        UniqueConstraint("requester_id", "addressee_id", name="uq_friendships_pair"),
+    )
+
+
+class Follow(Base):
+    """A one-way follow relationship: ``follower_id`` follows ``followed_id``."""
+
+    __tablename__ = "follows"
+
+    id = Column(Integer, primary_key=True, index=True)
+    follower_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    followed_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    follower = relationship("User", foreign_keys=[follower_id], back_populates="following")
+    followed = relationship("User", foreign_keys=[followed_id], back_populates="followers")
+
+    __table_args__ = (
+        UniqueConstraint("follower_id", "followed_id", name="uq_follows_pair"),
+    )
+
+
+class Block(Base):
+    """A hard deny: ``blocker_id`` has blocked ``blocked_id``."""
+
+    __tablename__ = "blocks"
+
+    id = Column(Integer, primary_key=True, index=True)
+    blocker_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    blocked_id = Column(
+        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    created_at = Column(DateTime(timezone=True), server_default=func.now(), nullable=False)
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False)
+
+    blocker = relationship("User", foreign_keys=[blocker_id], back_populates="blocks_initiated")
+    blocked = relationship("User", foreign_keys=[blocked_id], back_populates="blocked_by")
+
+    __table_args__ = (
+        UniqueConstraint("blocker_id", "blocked_id", name="uq_blocks_pair"),
+    )

backend/app/models/user.py

@@ -1,7 +1,7 @@
 from datetime import date
 from typing import Optional
 
-from sqlalchemy import Column, Integer, String, Boolean, DateTime, Date
+from sqlalchemy import Column, Integer, String, Boolean, DateTime, Date, Text
 from sqlalchemy.orm import relationship
 from sqlalchemy.sql import func
 
@@ -20,6 +20,10 @@ class User(Base):
     created_at = Column(DateTime(timezone=True), server_default=func.now())
     updated_at = Column(DateTime(timezone=True), onupdate=func.now())
 
+    # Presence / status (backend/app/services/presence.py, app/routers/presence.py)
+    last_seen_at = Column(DateTime(timezone=True), nullable=True)
+    status_message = Column(Text, nullable=True)
+
     sessions = relationship("Session", back_populates="user", cascade="all, delete-orphan")
     refresh_tokens = relationship("RefreshToken", back_populates="user", cascade="all, delete-orphan")
     worlds = relationship("World", back_populates="owner")
@@ -31,6 +35,44 @@ class User(Base):
         cascade="all, delete-orphan",
     )
 
+    # Social graph (docs/planning/social.md US-1; app/models/social.py)
+    sent_friend_requests = relationship(
+        "Friendship",
+        foreign_keys="Friendship.requester_id",
+        back_populates="requester",
+        cascade="all, delete-orphan",
+    )
+    received_friend_requests = relationship(
+        "Friendship",
+        foreign_keys="Friendship.addressee_id",
+        back_populates="addressee",
+        cascade="all, delete-orphan",
+    )
+    following = relationship(
+        "Follow",
+        foreign_keys="Follow.follower_id",
+        back_populates="follower",
+        cascade="all, delete-orphan",
+    )
+    followers = relationship(
+        "Follow",
+        foreign_keys="Follow.followed_id",
+        back_populates="followed",
+        cascade="all, delete-orphan",
+    )
+    blocks_initiated = relationship(
+        "Block",
+        foreign_keys="Block.blocker_id",
+        back_populates="blocker",
+        cascade="all, delete-orphan",
+    )
+    blocked_by = relationship(
+        "Block",
+        foreign_keys="Block.blocked_id",
+        back_populates="blocked",
+        cascade="all, delete-orphan",
+    )
+
     @property
     def is_adult(self) -> bool:
         """Return True if the user is 18 or older based on date_of_birth."""

backend/app/rate_limit.py

@@ -54,6 +54,12 @@ def _client_key(request: Request) -> str:
 # brute-forcer.
 _auth_limiter = SlidingWindowLimiter(max_hits=10, window_seconds=60)
 
+# Every limiter in the process -- named limits built via `rate_limit()`
+# below register themselves here too, so `reset_all()` (the test hook) and
+# any future process-wide accounting stay correct without each caller
+# having to remember to wire it up.
+_registered_limiters: list[SlidingWindowLimiter] = [_auth_limiter]
+
 
 async def auth_rate_limit(request: Request) -> None:
     """FastAPI dependency: rate-limit auth attempts per client IP.
@@ -68,6 +74,41 @@ async def auth_rate_limit(request: Request) -> None:
     _auth_limiter.check(f"auth:{_client_key(request)}")
 
 
+def rate_limit(name: str, *, max_hits: int, window_seconds: float):
+    """Build a named, per-client-IP FastAPI rate-limit dependency.
+
+    Generalizes the ``auth_rate_limit`` pattern above for other endpoints
+    (e.g. chat send, message report) that want their own independent cap:
+
+        report_rate_limit = rate_limit("message_report", max_hits=5, window_seconds=60)
+
+        @router.post("/report", dependencies=[Depends(report_rate_limit)])
+        ...
+
+    Each call gets its own ``SlidingWindowLimiter`` -- counters for one
+    named limit never bleed into another, even for the same client IP --
+    and reuses ``SlidingWindowLimiter.check`` for the actual sliding-window
+    accounting and the 429 + ``Retry-After`` response. Like
+    ``auth_rate_limit``, the returned dependency is a no-op when
+    ``settings.RATE_LIMIT_ENABLED`` is false, so the checkpoint smoke suite
+    (one client IP for the whole run) doesn't trip on it.
+
+    ``name`` only needs to be unique within the process; it namespaces the
+    per-IP key so it doesn't collide with ``auth_rate_limit`` or any other
+    named limit.
+    """
+    limiter = SlidingWindowLimiter(max_hits=max_hits, window_seconds=window_seconds)
+    _registered_limiters.append(limiter)
+
+    async def _dependency(request: Request) -> None:
+        if not settings.RATE_LIMIT_ENABLED:
+            return
+        limiter.check(f"{name}:{_client_key(request)}")
+
+    return _dependency
+
+
 def reset_all() -> None:
     """Test hook."""
-    _auth_limiter.reset()
+    for limiter in _registered_limiters:
+        limiter.reset()

backend/app/routers/presence.py

@@ -0,0 +1,146 @@
+"""Presence & status router.
+
+Endpoints:
+- POST  /api/presence/heartbeat  -- record a heartbeat (sets Redis TTL key)
+- GET   /api/presence/presence   -- query presence for a list of user ids
+- PATCH /api/presence/status     -- update the authenticated user's status message
+"""
+
+from datetime import datetime, timezone
+from typing import Annotated
+
+from fastapi import APIRouter, HTTPException, status, Depends
+from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.dependencies import CurrentUser
+from app.models.user import User
+from app.services.presence import presence_store
+
+router = APIRouter()
+
+DbDep = Annotated[AsyncSession, Depends(get_db)]
+
+# ──────────────────────────── Pydantic schemas ────────────────────────────────
+
+_STATUS_MAX_LEN = 140
+
+
+class HeartbeatRequest(BaseModel):
+    """Empty body -- the caller's identity comes from the JWT."""
+
+
+class PresenceUser(BaseModel):
+    user_id: int
+    is_online: bool
+    last_seen_at: datetime | None
+    status_message: str | None
+
+
+class PresenceResponse(BaseModel):
+    users: list[PresenceUser]
+
+
+class StatusUpdate(BaseModel):
+    status_message: str | None = Field(default=None, max_length=_STATUS_MAX_LEN)
+
+    @field_validator("status_message")
+    @classmethod
+    def strip_message(cls, v: str | None) -> str | None:
+        if v is not None:
+            v = v.strip()
+        return v
+
+
+# ──────────────────────────────── Endpoints ───────────────────────────────────
+
+
+@router.post("/heartbeat", response_model=dict)
+async def heartbeat(
+    _req: HeartbeatRequest,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Record a heartbeat for the authenticated user.
+
+    Sets a Redis key with a TTL so the server can derive online/offline
+    status without trusting client claims. Also persists last_seen_at to
+    the database.
+    """
+    # Update Redis TTL (presence heartbeat)
+    await presence_store.heartbeat(current_user.id)
+
+    # Persist last_seen_at to the database
+    now = datetime.now(timezone.utc)
+    result = await db.execute(select(User).where(User.id == current_user.id))
+    user = result.scalar_one_or_none()
+    if user:
+        user.last_seen_at = now
+        await db.commit()
+
+    return {"status": "ok", "user_id": current_user.id}
+
+
+@router.get("/presence", response_model=PresenceResponse)
+async def get_presence(
+    user_ids: str,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Return presence info for a comma-separated list of user ids.
+
+    Online/offline is derived from the Redis heartbeat TTL.
+    last_seen_at and status_message come from the database.
+    """
+    ids = [int(uid.strip()) for uid in user_ids.split(",") if uid.strip()]
+    if not ids:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="user_ids must contain at least one integer",
+        )
+
+    # Check Redis for online status (single round trip via MGET).
+    online_ids = await presence_store.is_online_batch(ids)
+
+    # Fetch DB records for last_seen_at and status_message
+    result = await db.execute(select(User).where(User.id.in_(ids)))
+    users = {u.id: u for u in result.scalars().all()}
+
+    presence_users = []
+    for uid in ids:
+        user = users.get(uid)
+        if user is None:
+            continue
+        presence_users.append(
+            PresenceUser(
+                user_id=uid,
+                is_online=uid in online_ids,
+                last_seen_at=user.last_seen_at,
+                status_message=user.status_message,
+            )
+        )
+
+    return PresenceResponse(users=presence_users)
+
+
+@router.patch("/status", response_model=dict)
+async def update_status(
+    body: StatusUpdate,
+    current_user: CurrentUser,
+    db: DbDep,
+):
+    """Update the authenticated user's status message (length-limited)."""
+    result = await db.execute(select(User).where(User.id == current_user.id))
+    user = result.scalar_one_or_none()
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="User not found",
+        )
+
+    user.status_message = body.status_message
+    await db.commit()
+
+    return {"status": "ok", "status_message": body.status_message}

backend/app/services/presence.py

@@ -0,0 +1,145 @@
+"""Redis-backed presence store.
+
+Presence is determined by a heartbeat TTL key in Redis:
+- heartbeat(user_id) sets a TTL key per user (default 60 s).
+- is_online(user_id) / is_online_batch(user_ids) check whether the key(s)
+  exist.
+
+status_message and last_seen_at are persisted in the ``users`` table by the
+router (app/routers/presence.py); this store only owns the Redis side.
+
+The Redis client is created lazily, on first actual use, rather than
+requiring an explicit ``connect()`` call during app startup. This matters
+because FastAPI's lifespan handler does not run under the plain
+``TestClient(app)`` instantiation this codebase's tests use (no
+``with`` block), so anything that only connected during lifespan startup
+would never connect in tests. Lazy connection means the store works
+identically whether the app was started for real or is being driven by
+pytest.
+
+The client is also cached per-*event loop* rather than globally: the same
+plain ``TestClient(app)`` pattern can dispatch different requests onto
+different event loops (see the NullPool comment on ``_override_db`` in
+tests/conftest.py for the analogous asyncpg problem), and an
+``aioredis.Redis`` connection, like an asyncpg connection, breaks with
+"Event loop is closed" if reused across loops. In the real running server
+there is exactly one event loop for the process lifetime, so this
+degrades to a single cached, pooled connection there.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+
+import redis.asyncio as aioredis
+
+from app.config import settings
+
+logger = logging.getLogger(__name__)
+
+# Key prefix for heartbeat entries.
+_PRESENCE_KEY_PREFIX = "presence:heartbeat:"
+
+# Default heartbeat TTL in seconds (1 minute).
+# Clients should heartbeat at least once per interval.
+_DEFAULT_HEARTBEAT_TTL = 60
+
+
+class PresenceStore:
+    """Redis-backed presence store with async, lazily-connected operations."""
+
+    def __init__(self, redis_url: str | None = None, heartbeat_ttl: int = _DEFAULT_HEARTBEAT_TTL):
+        # redis_url is resolved from settings at first use (not at
+        # construction time) so tests that override settings.REDIS_URL
+        # before the first call still take effect -- this module is
+        # imported (and the module-level singleton below constructed)
+        # well before any such override runs.
+        self._redis_url = redis_url
+        self._heartbeat_ttl = heartbeat_ttl
+        # Keyed by id(running loop) -- see the module docstring.
+        self._clients: dict[int, aioredis.Redis] = {}
+        self._connect_lock = asyncio.Lock()
+
+    # ------------------------------------------------------------------
+    # Lifecycle
+    # ------------------------------------------------------------------
+
+    async def _ensure_client(self) -> aioredis.Redis:
+        """Return a connected client for the current event loop, connecting
+        on first use per loop."""
+        loop_key = id(asyncio.get_running_loop())
+        client = self._clients.get(loop_key)
+        if client is None:
+            async with self._connect_lock:
+                client = self._clients.get(loop_key)
+                if client is None:
+                    url = self._redis_url or settings.REDIS_URL
+                    client = aioredis.from_url(
+                        url,
+                        encoding="utf-8",
+                        decode_responses=True,
+                    )
+                    try:
+                        await client.ping()
+                    except Exception:
+                        logger.warning("Redis ping failed for %s", url)
+                        raise
+                    self._clients[loop_key] = client
+        return client
+
+    async def close(self) -> None:
+        """Close the Redis connection for the current event loop, if one was
+        opened."""
+        loop_key = id(asyncio.get_running_loop())
+        client = self._clients.pop(loop_key, None)
+        if client is not None:
+            await client.aclose()
+
+    # ------------------------------------------------------------------
+    # Heartbeat
+    # ------------------------------------------------------------------
+
+    async def heartbeat(self, user_id: int) -> None:
+        """Record a heartbeat for *user_id*.
+
+        Sets a TTL key so that the user is considered online as long as
+        heartbeats arrive at least once per heartbeat_ttl seconds.
+        """
+        client = await self._ensure_client()
+        await client.set(self._heartbeat_key(user_id), "1", ex=self._heartbeat_ttl)
+
+    # ------------------------------------------------------------------
+    # Online checks
+    # ------------------------------------------------------------------
+
+    async def is_online(self, user_id: int) -> bool:
+        """Return True if the user has a valid heartbeat key."""
+        client = await self._ensure_client()
+        exists = await client.exists(self._heartbeat_key(user_id))
+        return bool(exists)
+
+    async def is_online_batch(self, user_ids: list[int]) -> set[int]:
+        """Return the subset of user_ids that currently have a valid
+        heartbeat key. Uses MGET (one round trip) rather than one EXISTS
+        per user.
+        """
+        if not user_ids:
+            return set()
+        client = await self._ensure_client()
+        keys = [self._heartbeat_key(uid) for uid in user_ids]
+        values = await client.mget(keys)
+        return {uid for uid, v in zip(user_ids, values) if v is not None}
+
+    # ------------------------------------------------------------------
+    # Helpers
+    # ------------------------------------------------------------------
+
+    @staticmethod
+    def _heartbeat_key(user_id: int) -> str:
+        return f"{_PRESENCE_KEY_PREFIX}{user_id}"
+
+
+# Singleton instance shared by the router, so all requests share the same
+# connection pool.
+presence_store = PresenceStore()

backend/tests/conftest.py

@@ -1,15 +1,18 @@
-"""Shared pytest fixtures + hermetic-DB bootstrap.
+"""Shared pytest fixtures + hermetic-DB/Redis bootstrap.
 
 The integration tests hit a real Postgres (Postgres-specific types: JSONB,
-native ENUMs). To make ``cd backend && pytest`` work from a clean checkout
+native ENUMs) and, for presence tests, a real Redis (TTL semantics aren't
-with no manual setup, ``pytest_configure`` below brings up an ephemeral
+worth faking). To make ``cd backend && pytest`` work from a clean checkout
-Postgres via docker compose and runs the migrations IF ``DATABASE_URL`` is
+with no manual setup, ``pytest_configure`` below brings up ephemeral
-not already pointing at a reachable database. When it is (dev loop, or the
+Postgres/Redis containers via docker compose and runs the migrations IF
-checkpoint runner which stands the DB up itself), that path is skipped and
+``DATABASE_URL``/``REDIS_URL`` aren't already pointing at something
-the existing database is reused.
+reachable. When they are (dev loop, or the checkpoint runner which stands
+these up itself), that path is skipped and the existing services are
+reused.
 
-If Docker isn't available and no DB is reachable, the whole DB-backed suite
+If Docker isn't available and nothing is reachable, the whole
-is skipped with a clear message rather than erroring out 60+ times.
+DB/Redis-backed suite is skipped with a clear message rather than erroring
+out dozens of times.
 """
 
 import asyncio
@@ -38,14 +41,24 @@ TEST_TABLES = (
     # `worlds` the way world_rooms/world_chunks would be. List all three
     # explicitly rather than rely on cascade for some of them.
     "world_chunk_revisions", "world_chunks", "world_rooms",
-    "worlds", "sessions", "refresh_tokens", "users",
+    "worlds",
+    # Social graph (app/models/social.py) -- all three FK users with
+    # ON DELETE CASCADE, but list explicitly for clarity/consistency.
+    "friendships", "follows", "blocks",
+    # Chat (app/models/chat.py). message_reports.message_id is ON DELETE SET
+    # NULL (not CASCADE, deliberately -- see chat.py), so it wouldn't be
+    # reached by cascading a truncate of messages/conversations; list it
+    # explicitly along with the rest for clarity/consistency.
+    "message_reports", "messages", "conversation_participants", "conversations",
+    "sessions", "refresh_tokens", "users",
 )
 
 BACKEND_DIR = Path(__file__).resolve().parents[1]
 _COMPOSE_PROJECT = "agp-pytest"
 _EPHEMERAL_PG_PORT = 25432
+_EPHEMERAL_REDIS_PORT = 26379
 
-# Set by _ensure_database() when it starts a container it owns; torn down in
+# Set by pytest_configure() when it starts container(s) it owns; torn down in
 # pytest_unconfigure.
 _started_container = False
 _db_unavailable_reason: str | None = None
@@ -64,6 +77,11 @@ def _db_reachable(url: str) -> bool:
     return _port_open(parts.hostname or "localhost", parts.port or 5432)
 
 
+def _redis_reachable(url: str) -> bool:
+    parts = urlsplit(url)
+    return _port_open(parts.hostname or "localhost", parts.port or 6379)
+
+
 def _run(cmd: list[str], **kw) -> subprocess.CompletedProcess:
     return subprocess.run(cmd, cwd=BACKEND_DIR, capture_output=True, text=True, **kw)
 
@@ -71,14 +89,17 @@ def _run(cmd: list[str], **kw) -> subprocess.CompletedProcess:
 def pytest_configure(config):
     global _started_container, _db_unavailable_reason
 
-    if _db_reachable(settings.DATABASE_URL):
+    need_db = not _db_reachable(settings.DATABASE_URL)
-        return  # dev loop / checkpoint runner already provided one
+    need_redis = not _redis_reachable(settings.REDIS_URL)
+
+    if not need_db and not need_redis:
+        return  # dev loop / checkpoint runner already provided both
 
     if not _run(["docker", "--version"]).returncode == 0:
         _db_unavailable_reason = (
-            "no reachable DATABASE_URL and docker is unavailable -- run the "
+            "no reachable DATABASE_URL/REDIS_URL and docker is unavailable -- run "
-            "checkpoint suite (scripts/run_checkpoint_tests.py) or start Postgres "
+            "the checkpoint suite (scripts/run_checkpoint_tests.py) or start "
-            "manually"
+            "Postgres/Redis manually"
         )
         return
 
@@ -86,33 +107,55 @@ def pytest_configure(config):
     env["COMPOSE_PROJECT_NAME"] = _COMPOSE_PROJECT
     env["POSTGRES_HOST_PORT"] = str(_EPHEMERAL_PG_PORT)
     env["POSTGRES_PORT"] = str(_EPHEMERAL_PG_PORT)
-    up = _run(["docker", "compose", "up", "-d", "postgres"], env=env)
+    env["REDIS_HOST_PORT"] = str(_EPHEMERAL_REDIS_PORT)
+
+    services = [s for s, need in (("postgres", need_db), ("redis", need_redis)) if need]
+    up = _run(["docker", "compose", "up", "-d", *services], env=env)
     if up.returncode != 0:
-        _db_unavailable_reason = f"docker compose up postgres failed:\n{up.stderr[-800:]}"
+        _db_unavailable_reason = f"docker compose up {' '.join(services)} failed:\n{up.stderr[-800:]}"
         return
     _started_container = True
 
-    for _ in range(30):
+    if need_db:
-        r = _run(
+        for _ in range(30):
-            ["docker", "compose", "exec", "-T", "postgres",
+            r = _run(
-             "pg_isready", "-U", "agp_user", "-d", "agp_db"],
+                ["docker", "compose", "exec", "-T", "postgres",
-            env=env,
+                 "pg_isready", "-U", "agp_user", "-d", "agp_db"],
-        )
+                env=env,
-        if r.returncode == 0:
+            )
-            break
+            if r.returncode == 0:
-        time.sleep(1)
+                break
-    else:
+            time.sleep(1)
-        _db_unavailable_reason = "ephemeral Postgres never became ready"
+        else:
-        return
+            _db_unavailable_reason = "ephemeral Postgres never became ready"
+            return
 
-    url = f"postgresql+asyncpg://agp_user:agp_password@localhost:{_EPHEMERAL_PG_PORT}/agp_db"
+        url = f"postgresql+asyncpg://agp_user:agp_password@localhost:{_EPHEMERAL_PG_PORT}/agp_db"
-    os.environ["DATABASE_URL"] = url
+        os.environ["DATABASE_URL"] = url
-    settings.DATABASE_URL = url
+        settings.DATABASE_URL = url
 
-    mig = _run([sys.executable, "-m", "alembic", "upgrade", "head"],
+        mig = _run([sys.executable, "-m", "alembic", "upgrade", "head"],
-               env={**os.environ, "DATABASE_URL": url})
+                   env={**os.environ, "DATABASE_URL": url})
-    if mig.returncode != 0:
+        if mig.returncode != 0:
-        _db_unavailable_reason = f"alembic upgrade head failed:\n{mig.stderr[-800:]}"
+            _db_unavailable_reason = f"alembic upgrade head failed:\n{mig.stderr[-800:]}"
+            return
+
+    if need_redis:
+        for _ in range(30):
+            r = _run(
+                ["docker", "compose", "exec", "-T", "redis", "redis-cli", "ping"],
+                env=env,
+            )
+            if r.returncode == 0 and "PONG" in r.stdout:
+                break
+            time.sleep(1)
+        else:
+            _db_unavailable_reason = "ephemeral Redis never became ready"
+            return
+
+        redis_url = f"redis://localhost:{_EPHEMERAL_REDIS_PORT}/0"
+        os.environ["REDIS_URL"] = redis_url
+        settings.REDIS_URL = redis_url
 
 
 def pytest_unconfigure(config):
@@ -122,6 +165,7 @@ def pytest_unconfigure(config):
     env["COMPOSE_PROJECT_NAME"] = _COMPOSE_PROJECT
     env["POSTGRES_HOST_PORT"] = str(_EPHEMERAL_PG_PORT)
     env["POSTGRES_PORT"] = str(_EPHEMERAL_PG_PORT)
+    env["REDIS_HOST_PORT"] = str(_EPHEMERAL_REDIS_PORT)
     _run(["docker", "compose", "down", "-v"], env=env)
 
 

backend/tests/test_chat_models.py

@@ -0,0 +1,344 @@
+"""Model-level tests for chat: conversations, messages, message reports.
+
+app/models/chat.py / alembic/versions/0008_add_chat_tables.py
+(docs/planning/social.md US-4). This is the models+migration task only --
+there are no API endpoints yet (sibling tasks own filtering, rate limiting,
+and the routers), so these tests exercise the ORM models and the real
+Postgres constraints directly rather than going through HTTP.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import delete, select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.chat import (
+    Conversation,
+    ConversationParticipant,
+    Message,
+    MessageReport,
+    ReportStatus,
+)
+from app.models.user import User
+from app.models.world import World
+
+
+def _register(client: TestClient, username: str) -> int:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    headers = {"Authorization": f"Bearer {resp.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+class TestConversationCreation:
+    async def test_create_conversation_with_participants_and_messages(self):
+        client = TestClient(app)
+        a = _register(client, "chat_conv_a")
+        b = _register(client, "chat_conv_b")
+
+        engine, factory = _session_factory()
+        try:
+            lo, hi = sorted((a, b))
+            async with factory() as session:
+                convo = Conversation(user_a_id=lo, user_b_id=hi)
+                session.add(convo)
+                await session.flush()
+                session.add_all(
+                    [
+                        ConversationParticipant(conversation_id=convo.id, user_id=a),
+                        ConversationParticipant(conversation_id=convo.id, user_id=b),
+                    ]
+                )
+                session.add(
+                    Message(sender_id=a, conversation_id=convo.id, body="hi there")
+                )
+                await session.commit()
+                convo_id = convo.id
+
+            async with factory() as session:
+                participants = (
+                    await session.execute(
+                        select(ConversationParticipant).where(
+                            ConversationParticipant.conversation_id == convo_id
+                        )
+                    )
+                ).scalars().all()
+                messages = (
+                    await session.execute(
+                        select(Message).where(Message.conversation_id == convo_id)
+                    )
+                ).scalars().all()
+                assert len(participants) == 2
+                assert len(messages) == 1
+                assert messages[0].sender_id == a
+                assert messages[0].filtered is False
+        finally:
+            await engine.dispose()
+
+    async def test_duplicate_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "chat_uq_a")
+        b = _register(client, "chat_uq_b")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Conversation(user_a_id=lo, user_b_id=hi))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Conversation(user_a_id=lo, user_b_id=hi))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+    async def test_unordered_pair_rejected_by_check_constraint(self):
+        client = TestClient(app)
+        a = _register(client, "chat_ck_a")
+        b = _register(client, "chat_ck_b")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                # Reversed order violates ck_conversations_ordered_pair.
+                session.add(Conversation(user_a_id=hi, user_b_id=lo))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+
+class TestWorldRoomChat:
+    async def test_world_message_has_null_conversation(self):
+        client = TestClient(app)
+        owner = _register(client, "chat_world_owner")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                world = World(name="Chat Test World", owner_id=owner)
+                session.add(world)
+                await session.flush()
+                msg = Message(sender_id=owner, world_id=world.id, body="hello world")
+                session.add(msg)
+                await session.commit()
+                world_id = world.id
+
+            async with factory() as session:
+                rows = (
+                    await session.execute(
+                        select(Message).where(Message.world_id == world_id)
+                    )
+                ).scalars().all()
+                assert len(rows) == 1
+                assert rows[0].conversation_id is None
+                assert rows[0].room_id is None
+        finally:
+            await engine.dispose()
+
+
+class TestMessageReports:
+    async def test_create_report_defaults_to_open(self):
+        client = TestClient(app)
+        sender = _register(client, "chat_rpt_sender")
+        reporter = _register(client, "chat_rpt_reporter")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                world = World(name="Report World", owner_id=sender)
+                session.add(world)
+                await session.flush()
+                msg = Message(sender_id=sender, world_id=world.id, body="bad words")
+                session.add(msg)
+                await session.flush()
+                report = MessageReport(
+                    message_id=msg.id, reporter_id=reporter, reason="spam"
+                )
+                session.add(report)
+                await session.commit()
+                report_id = report.id
+
+            async with factory() as session:
+                report = await session.get(MessageReport, report_id)
+                assert report.status == ReportStatus.OPEN
+                assert report.moderator_id is None
+                assert report.resolved_at is None
+        finally:
+            await engine.dispose()
+
+
+class TestCascadeDelete:
+    async def test_deleting_conversation_deletes_participants_and_messages(self):
+        client = TestClient(app)
+        a = _register(client, "chat_cd_conv_a")
+        b = _register(client, "chat_cd_conv_b")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                convo = Conversation(user_a_id=lo, user_b_id=hi)
+                session.add(convo)
+                await session.flush()
+                session.add_all(
+                    [
+                        ConversationParticipant(conversation_id=convo.id, user_id=a),
+                        ConversationParticipant(conversation_id=convo.id, user_id=b),
+                    ]
+                )
+                session.add(Message(sender_id=a, conversation_id=convo.id, body="bye"))
+                await session.commit()
+                convo_id = convo.id
+
+            async with factory() as session:
+                # Core delete against the conversations table directly, so
+                # the real ON DELETE CASCADE does the work (not the ORM).
+                await session.execute(
+                    delete(Conversation).where(Conversation.id == convo_id)
+                )
+                await session.commit()
+
+            async with factory() as session:
+                participants = (
+                    await session.execute(
+                        select(ConversationParticipant).where(
+                            ConversationParticipant.conversation_id == convo_id
+                        )
+                    )
+                ).scalars().all()
+                messages = (
+                    await session.execute(
+                        select(Message).where(Message.conversation_id == convo_id)
+                    )
+                ).scalars().all()
+                assert participants == []
+                assert messages == []
+        finally:
+            await engine.dispose()
+
+    async def test_deleting_user_removes_conversation_but_keeps_report_and_message_id_null(self):
+        """Deleting a conversation participant cascades away the whole DM
+        (conversation + participants + messages -- there's no third party
+        left to care about the history). Deleting the sender of a
+        world-chat message, by contrast, must NOT delete the message or its
+        report -- sender_id is SET NULL and message_reports.message_id
+        follows the message (also SET NULL, never CASCADE) so the audit
+        trail survives account deletion."""
+        client = TestClient(app)
+        a = _register(client, "chat_cd_user_a")
+        b = _register(client, "chat_cd_user_b")
+        reporter = _register(client, "chat_cd_user_reporter")
+        lo, hi = sorted((a, b))
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                convo = Conversation(user_a_id=lo, user_b_id=hi)
+                session.add(convo)
+                await session.flush()
+                session.add_all(
+                    [
+                        ConversationParticipant(conversation_id=convo.id, user_id=a),
+                        ConversationParticipant(conversation_id=convo.id, user_id=b),
+                    ]
+                )
+                session.add(Message(sender_id=a, conversation_id=convo.id, body="dm"))
+
+                world = World(name="Sender Delete World", owner_id=b)
+                session.add(world)
+                await session.flush()
+                world_msg = Message(sender_id=a, world_id=world.id, body="world chat")
+                session.add(world_msg)
+                await session.flush()
+                report = MessageReport(
+                    message_id=world_msg.id, reporter_id=reporter, reason="rude"
+                )
+                session.add(report)
+                await session.commit()
+                convo_id = convo.id
+                world_msg_id = world_msg.id
+                report_id = report.id
+
+            async with factory() as session:
+                # Delete `a`: participant in the DM (cascades the whole
+                # conversation) and sender of the world message (SET NULL).
+                await session.execute(delete(User).where(User.id == a))
+                await session.commit()
+
+            async with factory() as session:
+                convo_row = await session.get(Conversation, convo_id)
+                dm_messages = (
+                    await session.execute(
+                        select(Message).where(Message.conversation_id == convo_id)
+                    )
+                ).scalars().all()
+                world_msg = await session.get(Message, world_msg_id)
+                report = await session.get(MessageReport, report_id)
+
+                assert convo_row is None
+                assert dm_messages == []
+                # World message survives with sender_id nulled out.
+                assert world_msg is not None
+                assert world_msg.sender_id is None
+                assert world_msg.body == "world chat"
+                # Report still points at the surviving message.
+                assert report is not None
+                assert report.message_id == world_msg_id
+        finally:
+            await engine.dispose()
+
+    async def test_deleting_message_nulls_report_message_id(self):
+        client = TestClient(app)
+        sender = _register(client, "chat_cd_msg_sender")
+        reporter = _register(client, "chat_cd_msg_reporter")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                world = World(name="Msg Delete World", owner_id=sender)
+                session.add(world)
+                await session.flush()
+                msg = Message(sender_id=sender, world_id=world.id, body="to be removed")
+                session.add(msg)
+                await session.flush()
+                report = MessageReport(
+                    message_id=msg.id, reporter_id=reporter, reason="spam"
+                )
+                session.add(report)
+                await session.commit()
+                msg_id = msg.id
+                report_id = report.id
+
+            async with factory() as session:
+                await session.execute(delete(Message).where(Message.id == msg_id))
+                await session.commit()
+
+            async with factory() as session:
+                report = await session.get(MessageReport, report_id)
+                assert report is not None
+                assert report.message_id is None
+        finally:
+            await engine.dispose()

backend/tests/test_presence.py

@@ -0,0 +1,221 @@
+"""Integration tests for the presence feature:
+
+- POST  /api/presence/heartbeat
+- GET   /api/presence/presence
+- PATCH /api/presence/status
+
+Hits the real app against the configured Postgres *and* a real Redis
+(conftest.py brings up an ephemeral instance of each when neither is
+already reachable) -- presence is fundamentally "does a TTL key exist in
+Redis", which isn't worth faking with a mock.
+
+Also covers the regression fixed in 47ab492 ("Fix StatusUpdate field
+annotation and is_online batch-call mismatch"): the router used to call
+``PresenceStore.is_online(ids)`` with a *list* of ids and then evaluate
+``uid in online_ids`` against the returned bool, which raised a TypeError
+on the first real multi-id batch call, and ``StatusUpdate.status_message``
+used the invalid annotation ``str | Field(...)``. Both are exercised below.
+"""
+
+import asyncio
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.main import app
+from app.services.presence import PresenceStore
+
+
+def _register(client: TestClient, username: str) -> dict:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    token = resp.json()["access_token"]
+    headers = {"Authorization": f"Bearer {token}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return {"headers": headers, "id": me.json()["id"]}
+
+
+class TestHeartbeat:
+    def test_heartbeat_sets_online(self):
+        client = TestClient(app)
+        user = _register(client, "presence_hb1")
+
+        resp = client.post("/api/presence/heartbeat", json={}, headers=user["headers"])
+        assert resp.status_code == 200, resp.text
+        assert resp.json() == {"status": "ok", "user_id": user["id"]}
+
+        presence = client.get(
+            "/api/presence/presence",
+            params={"user_ids": str(user["id"])},
+            headers=user["headers"],
+        )
+        assert presence.status_code == 200, presence.text
+        body = presence.json()["users"]
+        assert len(body) == 1
+        assert body[0]["user_id"] == user["id"]
+        assert body[0]["is_online"] is True
+        assert body[0]["last_seen_at"] is not None
+
+    def test_requires_auth(self):
+        client = TestClient(app)
+        resp = client.post("/api/presence/heartbeat", json={})
+        assert resp.status_code == 401
+
+    def test_never_seen_user_is_offline_with_null_last_seen(self):
+        client = TestClient(app)
+        user = _register(client, "presence_never_hb")
+
+        presence = client.get(
+            "/api/presence/presence",
+            params={"user_ids": str(user["id"])},
+            headers=user["headers"],
+        )
+        assert presence.status_code == 200
+        body = presence.json()["users"][0]
+        assert body["is_online"] is False
+        assert body["last_seen_at"] is None
+
+
+class TestBatchPresence:
+    """Covers the batch-call path fixed in 47ab492 (is_online_batch via MGET)."""
+
+    def test_batch_query_mixes_online_offline_and_unknown_ids(self):
+        client = TestClient(app)
+        online_user = _register(client, "presence_batch_online")
+        offline_user = _register(client, "presence_batch_offline")
+
+        client.post("/api/presence/heartbeat", json={}, headers=online_user["headers"])
+
+        unknown_id = max(online_user["id"], offline_user["id"]) + 999_999
+        ids = f"{online_user['id']},{offline_user['id']},{unknown_id}"
+
+        resp = client.get(
+            "/api/presence/presence",
+            params={"user_ids": ids},
+            headers=online_user["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+        by_id = {u["user_id"]: u for u in resp.json()["users"]}
+
+        # Unknown id is silently dropped (not in the DB), not a 500 or 404.
+        assert unknown_id not in by_id
+        assert by_id[online_user["id"]]["is_online"] is True
+        assert by_id[offline_user["id"]]["is_online"] is False
+
+    def test_empty_user_ids_is_a_400(self):
+        client = TestClient(app)
+        user = _register(client, "presence_empty_ids")
+        resp = client.get(
+            "/api/presence/presence",
+            params={"user_ids": ""},
+            headers=user["headers"],
+        )
+        assert resp.status_code == 400
+
+
+class TestStatusMessage:
+    def test_update_and_read_back_status_message(self):
+        client = TestClient(app)
+        user = _register(client, "presence_status1")
+
+        resp = client.patch(
+            "/api/presence/status",
+            json={"status_message": "  brb, making coffee  "},
+            headers=user["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+        # The router strips whitespace (StatusUpdate.strip_message).
+        assert resp.json()["status_message"] == "brb, making coffee"
+
+        presence = client.get(
+            "/api/presence/presence",
+            params={"user_ids": str(user["id"])},
+            headers=user["headers"],
+        )
+        assert presence.json()["users"][0]["status_message"] == "brb, making coffee"
+
+    def test_status_message_over_max_length_is_rejected(self):
+        client = TestClient(app)
+        user = _register(client, "presence_status_toolong")
+        resp = client.patch(
+            "/api/presence/status",
+            json={"status_message": "x" * 141},
+            headers=user["headers"],
+        )
+        # StatusUpdate.status_message: str | None = Field(..., max_length=140)
+        # This is exactly the annotation 47ab492 fixed (it used to be the
+        # invalid `str | Field(...)`, which breaks model construction
+        # entirely rather than validating length).
+        assert resp.status_code == 422
+
+    def test_status_message_at_max_length_is_accepted(self):
+        client = TestClient(app)
+        user = _register(client, "presence_status_maxlen")
+        resp = client.patch(
+            "/api/presence/status",
+            json={"status_message": "x" * 140},
+            headers=user["headers"],
+        )
+        assert resp.status_code == 200, resp.text
+
+    def test_null_status_message_clears_it(self):
+        client = TestClient(app)
+        user = _register(client, "presence_status_clear")
+        client.patch("/api/presence/status", json={"status_message": "hi"}, headers=user["headers"])
+        resp = client.patch("/api/presence/status", json={"status_message": None}, headers=user["headers"])
+        assert resp.status_code == 200
+        assert resp.json()["status_message"] is None
+
+
+class TestPresenceStoreTTL:
+    """Exercises the real Redis TTL semantics directly against the service,
+    with a short heartbeat_ttl so the test doesn't need to sleep for the
+    real 60s default used in production. This is the cheap, real proxy for
+    "TTL expiry means offline" the task asked for -- same code path
+    (real Redis SET ... EX / EXISTS / MGET), just a much shorter window.
+    """
+
+    async def test_ttl_expiry_flips_online_to_offline(self):
+        store = PresenceStore(heartbeat_ttl=1)
+        try:
+            uid = 987654321  # doesn't need to exist in Postgres; Redis-only check
+            assert await store.is_online(uid) is False
+
+            await store.heartbeat(uid)
+            assert await store.is_online(uid) is True
+
+            await asyncio.sleep(1.5)
+            assert await store.is_online(uid) is False
+        finally:
+            await store.close()
+
+    async def test_is_online_batch_matches_is_online_semantics(self):
+        """Regression coverage for 47ab492: is_online_batch must return a
+        set of ids usable with `in`, not a bool."""
+        store = PresenceStore(heartbeat_ttl=30)
+        try:
+            online_uid, offline_uid = 111222333, 444555666
+            await store.heartbeat(online_uid)
+
+            result = await store.is_online_batch([online_uid, offline_uid])
+            assert isinstance(result, set)
+            assert online_uid in result
+            assert offline_uid not in result
+        finally:
+            await store.close()
+
+    async def test_is_online_batch_empty_list(self):
+        store = PresenceStore()
+        try:
+            assert await store.is_online_batch([]) == set()
+        finally:
+            await store.close()

backend/tests/test_rate_limit.py

@@ -1,6 +1,7 @@
 """The auth endpoints are rate-limited per client IP."""
 
 import pytest
+from fastapi import Depends, FastAPI
 from fastapi.testclient import TestClient
 
 from app import rate_limit
@@ -54,3 +55,70 @@ def test_limiter_window_is_per_key():
     with pytest.raises(Exception):
         limiter.check("a")
     limiter.check("b")  # different key, unaffected
+
+
+def _make_named_limit_app():
+    """A tiny standalone app exercising two independent named limits, so
+    these tests don't depend on any sibling endpoint existing yet."""
+    limit_a = rate_limit.rate_limit("test_named_a", max_hits=2, window_seconds=60)
+    limit_b = rate_limit.rate_limit("test_named_b", max_hits=2, window_seconds=60)
+
+    app = FastAPI()
+
+    @app.post("/a", dependencies=[Depends(limit_a)])
+    def _a():
+        return {"ok": True}
+
+    @app.post("/b", dependencies=[Depends(limit_b)])
+    def _b():
+        return {"ok": True}
+
+    return TestClient(app)
+
+
+def test_named_limits_do_not_share_counters():
+    client = _make_named_limit_app()
+
+    # Burn out limit "a" entirely.
+    assert client.post("/a").status_code == 200
+    assert client.post("/a").status_code == 200
+    r = client.post("/a")
+    assert r.status_code == 429
+    assert "Retry-After" in r.headers
+
+    # Limit "b" is untouched -- same process, same client IP, different name.
+    assert client.post("/b").status_code == 200
+    assert client.post("/b").status_code == 200
+    assert client.post("/b").status_code == 429
+
+
+def test_named_limit_returns_429_with_retry_after_once_exhausted():
+    client = _make_named_limit_app()
+    client.post("/a")
+    client.post("/a")
+    r = client.post("/a")
+    assert r.status_code == 429
+    retry_after = r.headers["Retry-After"]
+    assert int(retry_after) >= 1
+
+
+def test_named_limit_is_a_noop_when_rate_limiting_disabled():
+    prev = settings.RATE_LIMIT_ENABLED
+    settings.RATE_LIMIT_ENABLED = False
+    try:
+        client = _make_named_limit_app()
+        codes = [client.post("/a").status_code for _ in range(10)]
+        assert codes == [200] * 10
+    finally:
+        settings.RATE_LIMIT_ENABLED = prev
+
+
+def test_reset_all_clears_named_limiters_too():
+    client = _make_named_limit_app()
+    client.post("/a")
+    client.post("/a")
+    assert client.post("/a").status_code == 429
+
+    rate_limit.reset_all()
+
+    assert client.post("/a").status_code == 200

backend/tests/test_social_models.py

@@ -0,0 +1,240 @@
+"""Model-level tests for the social graph: friendships, follows, blocks.
+
+app/models/social.py / alembic/versions/0007_add_social_graph_tables.py
+(docs/planning/social.md US-1). This is the models+migration task only --
+there are no API endpoints yet (a sibling task owns the router), so these
+tests exercise the ORM models and the real Postgres constraints directly
+rather than going through HTTP.
+"""
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import delete, select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import settings
+from app.main import app
+from app.models.social import Friendship, Follow, Block, FriendshipStatus
+from app.models.user import User
+
+
+def _register(client: TestClient, username: str) -> int:
+    resp = client.post(
+        "/api/auth/register",
+        json={
+            "username": username,
+            "email": f"{username}@example.com",
+            "password": "secret123",
+            "date_of_birth": "1990-01-01",
+        },
+    )
+    assert resp.status_code == 201, resp.text
+    headers = {"Authorization": f"Bearer {resp.json()['access_token']}"}
+    me = client.get("/api/users/me", headers=headers)
+    assert me.status_code == 200, me.text
+    return me.json()["id"]
+
+
+def _session_factory():
+    engine = create_async_engine(settings.DATABASE_URL, poolclass=NullPool)
+    return engine, async_sessionmaker(engine, expire_on_commit=False)
+
+
+class TestFriendshipRequestAccept:
+    async def test_request_defaults_to_pending(self):
+        client = TestClient(app)
+        a = _register(client, "sg_fr_a1")
+        b = _register(client, "sg_fr_b1")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                fr = Friendship(requester_id=a, addressee_id=b)
+                session.add(fr)
+                await session.commit()
+                await session.refresh(fr)
+                assert fr.status == FriendshipStatus.PENDING
+                assert fr.requester_id == a
+                assert fr.addressee_id == b
+        finally:
+            await engine.dispose()
+
+    async def test_accept_updates_status(self):
+        client = TestClient(app)
+        a = _register(client, "sg_fr_a2")
+        b = _register(client, "sg_fr_b2")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                fr = Friendship(requester_id=a, addressee_id=b)
+                session.add(fr)
+                await session.commit()
+                fr_id = fr.id
+
+            async with factory() as session:
+                fr = await session.get(Friendship, fr_id)
+                fr.status = FriendshipStatus.ACCEPTED
+                await session.commit()
+
+            async with factory() as session:
+                fr = await session.get(Friendship, fr_id)
+                assert fr.status == FriendshipStatus.ACCEPTED
+        finally:
+            await engine.dispose()
+
+
+class TestUniquePairConstraints:
+    async def test_duplicate_friendship_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "sg_uq_fr_a")
+        b = _register(client, "sg_uq_fr_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Friendship(requester_id=a, addressee_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Friendship(requester_id=a, addressee_id=b))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+    async def test_duplicate_follow_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "sg_uq_fw_a")
+        b = _register(client, "sg_uq_fw_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Follow(follower_id=a, followed_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Follow(follower_id=a, followed_id=b))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+    async def test_duplicate_block_pair_rejected(self):
+        client = TestClient(app)
+        a = _register(client, "sg_uq_bl_a")
+        b = _register(client, "sg_uq_bl_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Block(blocker_id=a, blocked_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                session.add(Block(blocker_id=a, blocked_id=b))
+                with pytest.raises(IntegrityError):
+                    await session.commit()
+        finally:
+            await engine.dispose()
+
+
+class TestFollow:
+    async def test_create_follow(self):
+        client = TestClient(app)
+        a = _register(client, "sg_follow_a")
+        b = _register(client, "sg_follow_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Follow(follower_id=a, followed_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                rows = (await session.execute(
+                    select(Follow).where(Follow.follower_id == a, Follow.followed_id == b)
+                )).scalars().all()
+                assert len(rows) == 1
+        finally:
+            await engine.dispose()
+
+
+class TestBlock:
+    async def test_create_block(self):
+        client = TestClient(app)
+        a = _register(client, "sg_block_a")
+        b = _register(client, "sg_block_b")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                session.add(Block(blocker_id=a, blocked_id=b))
+                await session.commit()
+
+            async with factory() as session:
+                rows = (await session.execute(
+                    select(Block).where(Block.blocker_id == a, Block.blocked_id == b)
+                )).scalars().all()
+                assert len(rows) == 1
+        finally:
+            await engine.dispose()
+
+
+class TestCascadeDelete:
+    async def test_deleting_user_removes_rows_in_all_three_tables(self):
+        """Deleting a user removes friendships/follows/blocks referencing them
+        in *either* FK column, via the real DB ON DELETE CASCADE (deleted with
+        a Core statement, bypassing any ORM-level cascade, to prove the
+        database constraint itself does the job)."""
+        client = TestClient(app)
+        a = _register(client, "sg_cascade_a")
+        b = _register(client, "sg_cascade_b")
+        c = _register(client, "sg_cascade_c")
+
+        engine, factory = _session_factory()
+        try:
+            async with factory() as session:
+                # a as requester/follower/blocker, and also as addressee (c -> a)
+                session.add(Friendship(requester_id=a, addressee_id=b))
+                session.add(Friendship(requester_id=c, addressee_id=a))
+                session.add(Follow(follower_id=a, followed_id=b))
+                session.add(Follow(follower_id=c, followed_id=a))
+                session.add(Block(blocker_id=a, blocked_id=b))
+                session.add(Block(blocker_id=c, blocked_id=a))
+                await session.commit()
+
+            async with factory() as session:
+                await session.execute(delete(User).where(User.id == a))
+                await session.commit()
+
+            async with factory() as session:
+                friendships = (await session.execute(
+                    select(Friendship).where(
+                        (Friendship.requester_id == a) | (Friendship.addressee_id == a)
+                    )
+                )).scalars().all()
+                follows = (await session.execute(
+                    select(Follow).where(
+                        (Follow.follower_id == a) | (Follow.followed_id == a)
+                    )
+                )).scalars().all()
+                blocks = (await session.execute(
+                    select(Block).where(
+                        (Block.blocker_id == a) | (Block.blocked_id == a)
+                    )
+                )).scalars().all()
+                assert friendships == []
+                assert follows == []
+                assert blocks == []
+
+                # Unrelated rows (b, c only) survive.
+                remaining_users = (await session.execute(
+                    select(User.id).where(User.id.in_([b, c]))
+                )).scalars().all()
+                assert set(remaining_users) == {b, c}
+        finally:
+            await engine.dispose()

scripts/editor/chunk_save_service.gd

@@ -0,0 +1,280 @@
+class_name ChunkSaveService
+extends Node
+## HTTP save path for the in-game editor
+## (docs/architecture/world_persistence_impl.md §8.1 chunk write / §8.2 D5).
+##
+## Owns the write half of editor persistence: single-chunk PUT with
+## `X-Base-Revision`/`base_revision`, batch PUT for a multi-chunk edit, and
+## the §5.4 optimistic-concurrency retry loop on `409`.
+##
+## Conflict handling ("re-fetch current chunk, re-apply the edit, retry"):
+## per §8.2 D5 this backend stores and accepts **whole chunks**, not
+## JSON-Patch deltas -- "lost-update protection comes from `base_revision`,
+## not from the patch". That means there is no delta to replay against a
+## freshly-fetched chunk; "re-apply the edit" is exactly "keep the locally
+## edited payload, learn the chunk's current revision, and retry at that
+## revision". `fetch_chunk()` is still called on a conflict (rather than
+## just trusting the 409 body's `current_revision`) so the editor's own
+## last-known state stays in sync with the store, matching what a real
+## client does before retrying a write it doesn't fully trust yet.
+##
+## Deliberately does **not** use `ApiClient.request()`: that helper discards
+## the parsed JSON body on any non-2xx response (see its `_make_result`
+## calls), and the `409` body's `current_revision`/`current_checksum` are
+## exactly what this retry loop needs. Uses a raw per-request `HTTPRequest`
+## child instead, the same pattern `scripts/http_chunk_source.gd` uses for
+## the read side.
+##
+## Must be added to the scene tree before use.
+
+## The world this service saves chunks for (string form of the backend's
+## numeric world id).
+var world_id: String = ""
+
+## The room slug within that world. world.md's default room is "main".
+var room_slug: String = "main"
+
+## Bounded retries on a 409 conflict -- refuses to loop forever against a
+## chunk under sustained contention.
+const MAX_RETRIES := 3
+
+
+## Fetch the current chunk at [param coord].
+##
+## Returns:
+##     {"ok": bool, "status": int, "model": ChunkEditorModel|null,
+##      "revision": int, "checksum": String, "detail": String}
+##
+## A `404` (unwritten coordinate) is reported as `ok: true, model: null` --
+## world_persistence_impl.md §8.1: "an unwritten coordinate is not an error".
+## Callers wanting a fresh chunk to edit should fall back to
+## `ChunkEditorModel.create_empty()` at `base_revision: 0` in that case.
+func fetch_chunk(coord: Vector3i) -> Dictionary:
+	var http := HTTPRequest.new()
+	http.timeout = 15.0
+	add_child(http)
+
+	var api := _api_client()
+	var headers := PackedStringArray(["Accept: application/octet-stream"])
+	if api.has_token():
+		headers.append("Authorization: " + str(api.bearer_token))
+
+	var url: String = str(api.base_url) + _chunk_path(coord)
+	var err := http.request(url, headers, HTTPClient.METHOD_GET)
+	if err != OK:
+		http.queue_free()
+		return _fetch_result(false, 0, null, 0, "", "request failed to start (%d)" % err)
+
+	var args: Array = await http.request_completed
+	var result_code: int = args[0]
+	var response_code: int = args[1]
+	var response_headers: PackedStringArray = args[2]
+	var body: PackedByteArray = args[3]
+	http.queue_free()
+
+	if result_code != HTTPRequest.RESULT_SUCCESS:
+		return _fetch_result(false, 0, null, 0, "", "transport error (%d)" % result_code)
+
+	if response_code == 404:
+		return _fetch_result(true, 404, null, 0, "", "not found (unwritten chunk)")
+
+	if response_code != 200:
+		return _fetch_result(false, response_code, null, 0, "", _error_detail_from_body(body))
+
+	var model := ChunkEditorModel.from_binary(body)
+	if model == null:
+		return _fetch_result(false, response_code, null, 0, "", "failed to decode chunk payload")
+
+	return _fetch_result(
+		true, 200, model,
+		_int_header(response_headers, "x-chunk-revision"),
+		_etag_from_headers(response_headers),
+		"OK",
+	)
+
+
+## Save one chunk. `model.encode_binary()` is sent as the new payload;
+## `base_revision` is the revision the editor last knew about (0 = create).
+##
+## Returns:
+##     {"ok": bool, "status": int, "revision": int, "checksum": String,
+##      "live_session": bool, "retried": bool, "detail": String}
+func save_chunk(model: ChunkEditorModel, coord: Vector3i, base_revision: int) -> Dictionary:
+	var attempt_revision := base_revision
+	var retried := false
+	for attempt in range(MAX_RETRIES + 1):
+		var body := {
+			"base_revision": attempt_revision,
+			"payload_b64": Marshalls.raw_to_base64(model.encode_binary()),
+		}
+		var resp := await _request_json(HTTPClient.METHOD_PUT, _chunk_path(coord), body)
+
+		if resp["status"] == 200:
+			var d: Dictionary = resp["data"]
+			return {
+				"ok": true, "status": 200,
+				"revision": int(d.get("revision", attempt_revision)),
+				"checksum": str(d.get("checksum", "")),
+				"live_session": bool(d.get("live_session", false)),
+				"retried": retried, "detail": "OK",
+			}
+
+		if resp["status"] == 409 and attempt < MAX_RETRIES:
+			var conflict: Dictionary = resp["data"] if resp["data"] is Dictionary else {}
+			var current_rev := int(conflict.get("current_revision", attempt_revision))
+			# Doc-mandated "re-fetch current chunk" step before retrying --
+			# keeps this service's view of the chunk current even though the
+			# retry itself only needs the revision number from the 409 body.
+			await fetch_chunk(coord)
+			attempt_revision = current_rev
+			retried = true
+			continue
+
+		return {"ok": false, "status": resp["status"], "revision": 0, "checksum": "",
+			"live_session": false, "retried": retried, "detail": _error_detail(resp)}
+
+	return {"ok": false, "status": 409, "revision": 0, "checksum": "", "live_session": false,
+		"retried": true, "detail": "conflict retry limit exceeded"}
+
+
+## Save multiple chunks in one atomic batch PUT (world_persistence_impl.md
+## §8.1 batch write: "an editor brush stroke or an object drag routinely
+## straddles a chunk boundary"). `entries` is an Array of
+## `{"coord": Vector3i, "model": ChunkEditorModel, "base_revision": int}`.
+## All-or-nothing: a `409` names the offending coordinate and nothing is
+## written, so only that entry's `base_revision` is refreshed before the
+## whole batch is retried.
+##
+## Returns:
+##     {"ok": bool, "status": int, "live_session": bool,
+##      "chunks": Array, "retried": bool, "detail": String}
+func save_batch(entries: Array) -> Dictionary:
+	var working: Array = []
+	for e in entries:
+		working.append((e as Dictionary).duplicate())
+	var retried := false
+
+	for attempt in range(MAX_RETRIES + 1):
+		var chunks_json: Array = []
+		for e in working:
+			var c: Vector3i = e["coord"]
+			var m: ChunkEditorModel = e["model"]
+			chunks_json.append({
+				"cx": c.x, "cy": c.y, "cz": c.z,
+				"base_revision": int(e["base_revision"]),
+				"payload_b64": Marshalls.raw_to_base64(m.encode_binary()),
+			})
+		var resp := await _request_json(HTTPClient.METHOD_PUT, _batch_path(), {"chunks": chunks_json})
+
+		if resp["status"] == 200:
+			var d: Dictionary = resp["data"]
+			return {"ok": true, "status": 200, "live_session": bool(d.get("live_session", false)),
+				"chunks": d.get("chunks", []), "retried": retried, "detail": "OK"}
+
+		if resp["status"] == 409 and attempt < MAX_RETRIES:
+			var conflict: Dictionary = resp["data"] if resp["data"] is Dictionary else {}
+			var current_rev := int(conflict.get("current_revision", 0))
+			var offending: Variant = conflict.get("coord")
+			if offending is Array and offending.size() == 3:
+				var oc := Vector3i(int(offending[0]), int(offending[1]), int(offending[2]))
+				for e in working:
+					if (e["coord"] as Vector3i) == oc:
+						await fetch_chunk(oc)
+						e["base_revision"] = current_rev
+						break
+			retried = true
+			continue
+
+		return {"ok": false, "status": resp["status"], "live_session": false, "chunks": [],
+			"retried": retried, "detail": _error_detail(resp)}
+
+	return {"ok": false, "status": 409, "live_session": false, "chunks": [],
+		"retried": true, "detail": "conflict retry limit exceeded"}
+
+
+# ─────────────────────────── internals ───────────────────────────
+
+## Resolved via an absolute node path, not the bare `ApiClient` autoload
+## identifier -- see the identical note on `HttpChunkSource._api_client()`
+## (bare autoload identifiers don't resolve when a script is compiled for a
+## headless `godot --script ...` run, which is how this service's smoke
+## test drives it).
+func _api_client() -> Node:
+	return get_node("/root/ApiClient")
+
+
+func _chunk_path(coord: Vector3i) -> String:
+	return "/api/worlds/%s/rooms/%s/chunks/%d/%d/%d" % [world_id, room_slug, coord.x, coord.y, coord.z]
+
+
+func _batch_path() -> String:
+	return "/api/worlds/%s/rooms/%s/chunks" % [world_id, room_slug]
+
+
+func _request_json(method: HTTPClient.Method, path: String, body_dict: Dictionary) -> Dictionary:
+	var http := HTTPRequest.new()
+	http.timeout = 15.0
+	add_child(http)
+
+	var api := _api_client()
+	var headers := PackedStringArray(["Content-Type: application/json", "Accept: application/json"])
+	if api.has_token():
+		headers.append("Authorization: " + str(api.bearer_token))
+
+	var url: String = str(api.base_url) + path
+	var err := http.request(url, headers, method, JSON.stringify(body_dict))
+	if err != OK:
+		http.queue_free()
+		return {"status": 0, "data": null, "raw": "request failed to start (%d)" % err}
+
+	var args: Array = await http.request_completed
+	var result_code: int = args[0]
+	var response_code: int = args[1]
+	var body_bytes: PackedByteArray = args[3]
+	http.queue_free()
+
+	if result_code != HTTPRequest.RESULT_SUCCESS:
+		return {"status": 0, "data": null, "raw": "transport error (%d)" % result_code}
+
+	var text := body_bytes.get_string_from_utf8()
+	var parsed: Variant = JSON.parse_string(text) if text != "" else null
+	return {"status": response_code, "data": parsed, "raw": text}
+
+
+func _error_detail(resp: Dictionary) -> String:
+	var data: Variant = resp.get("data")
+	if data is Dictionary and (data as Dictionary).has("detail"):
+		return str((data as Dictionary)["detail"])
+	if int(resp.get("status", 0)) == 0:
+		return str(resp.get("raw", "network error"))
+	return "HTTP error %d" % int(resp.get("status", 0))
+
+
+func _error_detail_from_body(body: PackedByteArray) -> String:
+	var text := body.get_string_from_utf8()
+	var parsed: Variant = JSON.parse_string(text) if text != "" else null
+	if parsed is Dictionary and (parsed as Dictionary).has("detail"):
+		return str((parsed as Dictionary)["detail"])
+	return text
+
+
+func _fetch_result(ok: bool, status: int, model: ChunkEditorModel, revision: int,
+		checksum: String, detail: String) -> Dictionary:
+	return {"ok": ok, "status": status, "model": model, "revision": revision,
+		"checksum": checksum, "detail": detail}
+
+
+func _int_header(headers: PackedStringArray, key: String) -> int:
+	var prefix := key + ":"
+	for h in headers:
+		if h.to_lower().begins_with(prefix):
+			return int(h.substr(h.find(":") + 1).strip_edges())
+	return 0
+
+
+func _etag_from_headers(headers: PackedStringArray) -> String:
+	for h in headers:
+		if h.to_lower().begins_with("etag:"):
+			var v := h.substr(h.find(":") + 1).strip_edges()
+			return v.trim_prefix('"').trim_suffix('"')
+	return ""

scripts/editor/ui/in_game_editor.gd

@@ -16,10 +16,12 @@ extends Control
 ##   InspectorPanel  -- property editor for the selected object
 ##   EditorCore      -- shared core (passed in, not owned/created here)
 ##
-## This UI (and `EditorCore`) never talk to the network -- persisting edits
+## Persisting edits (world_persistence_impl.md's single/batch-PUT save path,
-## is a sibling task's job (world_persistence_impl.md's batch-PUT save
+## §8.1-8.2) is wired through `ChunkSaveService`, set via
-## path). Closing this editor just discards the UI; the in-memory
+## `setup_persistence()`. Without it (e.g. the F2 scratch-chunk path, or
-## `ChunkEditorModel` it was pointed at is unaffected either way.
+## `smoke_test_editor_core.gd`'s bare `InGameEditor.new(core)`), the Save
+## button is present but disabled -- closing the editor just discards the
+## UI and the in-memory `ChunkEditorModel` is unaffected either way.
 
 signal closed
 
@@ -30,6 +32,18 @@ var _palette: PalettePanel
 var _inspector: InspectorPanel
 var _viewport: EditorViewport
 var _close_button: Button
+var _save_button: Button
+var _save_status_label: Label
+
+## Save-path state (world_persistence_impl.md §8.1/§8.2), set via
+## `setup_persistence()`. `_save_service == null` means there is nothing to
+## save to (see the class doc above) -- the Save button stays disabled.
+var _save_service: ChunkSaveService = null
+var _world_id: String = ""
+var _room_slug: String = "main"
+var _coord: Vector3i = Vector3i.ZERO
+var _base_revision: int = 0
+var _saving: bool = false
 
 
 func _init(p_core: EditorCore) -> void:
@@ -39,6 +53,21 @@ func _init(p_core: EditorCore) -> void:
 	mouse_filter = Control.MOUSE_FILTER_STOP
 
 
+## Wire this editor's Save button/Ctrl+S to a real backend round-trip.
+## `save_service` must already be in the scene tree (game.gd adds it as a
+## sibling before constructing this editor). `base_revision` is whatever the
+## caller last fetched for `coord` (0 if the chunk didn't exist yet).
+func setup_persistence(save_service: ChunkSaveService, world_id: String, room_slug: String,
+		coord: Vector3i, base_revision: int) -> void:
+	_save_service = save_service
+	_world_id = world_id
+	_room_slug = room_slug
+	_coord = coord
+	_base_revision = base_revision
+	if _save_button != null:
+		_save_button.disabled = false
+
+
 func _ready() -> void:
 	_build_ui()
 	_refresh_history_buttons()
@@ -66,11 +95,22 @@ func _build_ui() -> void:
 	_toolbar.size_flags_horizontal = Control.SIZE_EXPAND_FILL
 	top_bar.add_child(_toolbar)
 
+	_save_button = Button.new()
+	_save_button.text = "Save (Ctrl+S)"
+	_save_button.disabled = (_save_service == null)
+	_save_button.pressed.connect(_on_save_pressed)
+	top_bar.add_child(_save_button)
+
 	_close_button = Button.new()
 	_close_button.text = "Close (F2)"
 	_close_button.pressed.connect(_on_close_pressed)
 	top_bar.add_child(_close_button)
 
+	_save_status_label = Label.new()
+	_save_status_label.autowrap_mode = TextServer.AUTOWRAP_WORD
+	_save_status_label.visible = false
+	root_vbox.add_child(_save_status_label)
+
 	var body := HBoxContainer.new()
 	body.size_flags_vertical = Control.SIZE_EXPAND_FILL
 	root_vbox.add_child(body)
@@ -119,6 +159,9 @@ func _unhandled_key_input(event: InputEvent) -> void:
 	elif key.ctrl_pressed and key.keycode == KEY_Y:
 		_on_redo_pressed()
 		get_viewport().set_input_as_handled()
+	elif key.ctrl_pressed and key.keycode == KEY_S:
+		_on_save_pressed()
+		get_viewport().set_input_as_handled()
 	elif key.keycode == KEY_DELETE and core.selection.has_selection():
 		core.delete_object(core.selection.get_selected())
 		_on_edit_applied()
@@ -167,3 +210,41 @@ func _refresh_history_buttons() -> void:
 func _on_close_pressed() -> void:
 	closed.emit()
 	queue_free()
+
+
+## Single-chunk save (world_persistence_impl.md §8.1). `ChunkSaveService`
+## owns the actual HTTP round trip, retrying on `409` internally
+## (§8.2/§5.4) -- this just reflects the outcome and, per §6 D4, surfaces
+## the `live_session` flag as a warning instead of ignoring it.
+func _on_save_pressed() -> void:
+	if _save_service == null or _saving:
+		return
+	_saving = true
+	_save_button.disabled = true
+	_set_save_status("Saving…", Color(0.85, 0.85, 0.85))
+
+	var result: Dictionary = await _save_service.save_chunk(core.model, _coord, _base_revision)
+
+	_saving = false
+	_save_button.disabled = false
+
+	if result.get("ok", false):
+		_base_revision = int(result.get("revision", _base_revision))
+		var msg := "Saved (revision %d)." % _base_revision
+		if bool(result.get("retried", false)):
+			msg += " (resolved a save conflict automatically)"
+		if bool(result.get("live_session", false)):
+			msg += " This world has players in it right now -- they'll see your changes when the session restarts."
+			_set_save_status(msg, Color(1.0, 0.8, 0.25))
+		else:
+			_set_save_status(msg, Color(0.55, 1.0, 0.55))
+	else:
+		_set_save_status("Save failed: %s" % str(result.get("detail", "unknown error")), Color(1.0, 0.45, 0.45))
+
+
+func _set_save_status(text: String, color: Color) -> void:
+	if _save_status_label == null:
+		return
+	_save_status_label.text = text
+	_save_status_label.add_theme_color_override("font_color", color)
+	_save_status_label.visible = true

scripts/game.gd

@@ -39,14 +39,20 @@ var _build_editor: InGameEditor = null
 
 func _ready() -> void:
 	_show_build_stamp()
-	if Session.active:
+	if Session.editing:
+		_open_editor_for_world()
+	elif Session.active:
 		_setup_networked()
 
 
 func _unhandled_input(event: InputEvent) -> void:
 	if event.is_action_pressed("toggle_build_mode"):
-		get_viewport().set_input_as_handled()
+		# world_persistence_impl.md §6 D4: the non-joined "Edit world" entry
-		_toggle_build_mode()
+		# already has its editor open from _ready() -- F2 here is the
+		# scratch/in-session build mode's own toggle and doesn't apply.
+		if not Session.editing:
+			get_viewport().set_input_as_handled()
+			_toggle_build_mode()
 		return
 
 	# ESC leaves the world back to the browser (or, while build mode is
@@ -56,7 +62,11 @@ func _unhandled_input(event: InputEvent) -> void:
 	# against the scene change and looked like a crash.
 	if event.is_action_pressed("ui_cancel"):
 		get_viewport().set_input_as_handled()
-		if _build_editor != null and is_instance_valid(_build_editor):
+		if Session.editing:
+			# Non-joined editing has no play session to fall back into --
+			# closing it means leaving, same as the Close button.
+			_exit_editor_to_browser()
+		elif _build_editor != null and is_instance_valid(_build_editor):
 			_close_build_mode()
 		else:
 			_leave_world()
@@ -104,6 +114,64 @@ func _close_build_mode() -> void:
 	_player._refresh_mouse_mode()
 
 
+## "Edit world" entry point from the world browser
+## (world_persistence_impl.md §6 D4 / §9 "Client/editor task"). Reached only
+## via Session.editing (set by world_list.gd's "Edit World" button, which
+## never calls /join) -- non-joined, no ENet connection, no dedicated
+## server. Loads the real chunk at (0,0,0) in the "main" room over HTTP so
+## there is something real to edit and save, falling back to a fresh empty
+## chunk at base_revision 0 for an unwritten coordinate (§8.1: "an unwritten
+## coordinate is not an error").
+func _open_editor_for_world() -> void:
+	Input.mouse_mode = Input.MOUSE_MODE_VISIBLE
+	_player.set_physics_process(false)
+	_player.set_process_unhandled_input(false)
+
+	var world_id_str := str(Session.world_id)
+	var room_slug := "main"
+	var coord := Vector3i.ZERO
+
+	var save_service := ChunkSaveService.new()
+	save_service.world_id = world_id_str
+	save_service.room_slug = room_slug
+	add_child(save_service)
+
+	var fetch_result: Dictionary = await save_service.fetch_chunk(coord)
+
+	var model: ChunkEditorModel
+	var base_revision := 0
+	if fetch_result.get("ok", false) and fetch_result.get("model") != null:
+		model = fetch_result["model"]
+		base_revision = int(fetch_result.get("revision", 0))
+	else:
+		if not fetch_result.get("ok", false):
+			push_error("game.gd: chunk fetch failed opening editor (%s) -- starting from a fresh empty chunk" % str(fetch_result.get("detail", "")))
+		model = ChunkEditorModel.create_empty(32, 32, world_id_str, room_slug, coord)
+		base_revision = 0
+
+	var catalog := EditorObjectCatalog.new()
+	var err := catalog.load_catalog()
+	if err != OK:
+		push_error("game.gd: failed to load editor object catalog (%d)" % err)
+	var core := EditorCore.new(model, catalog)
+
+	_build_editor = InGameEditor.new(core)
+	_build_editor.setup_persistence(save_service, world_id_str, room_slug, coord, base_revision)
+	_build_editor.closed.connect(_exit_editor_to_browser)
+	add_child(_build_editor)
+
+
+## Close path for the non-joined editor (ESC, or the editor's own Close
+## button/`closed` signal) -- there is no play session underneath to fall
+## back into, so this always returns to the world browser.
+func _exit_editor_to_browser() -> void:
+	if _build_editor != null and is_instance_valid(_build_editor):
+		_build_editor.queue_free()
+	_build_editor = null
+	Session.clear()
+	get_tree().change_scene_to_file("res://scenes/world_list.tscn")
+
+
 func _leave_world() -> void:
 	if _leaving:
 		return

scripts/session.gd

@@ -6,11 +6,19 @@ extends Node
 ## POST /api/worlds/{id}/join; game.gd reads it in _ready() to decide whether
 ## to run networked or fall back to local single-player (e.g. game.tscn opened
 ## directly, or the backend has no orchestration).
+##
+## world_list.gd also calls begin_edit() for the "Edit world" entry point
+## (docs/architecture/world_persistence_impl.md §6 D4): editing is
+## deliberately **non-joined** -- it never calls POST /join, so `active`
+## stays false and game.gd never opens an ENet connection for it. `editing`
+## is the separate signal game.gd checks to open the in-game editor against
+## a real, HTTP-fetched chunk instead of running gameplay.
 
 var world_id: int = 0
 var host: String = ""
 var port: int = 0
 var active: bool = false
+var editing: bool = false
 
 
 func begin(p_world_id: int, p_host: String, p_port: int) -> void:
@@ -18,6 +26,18 @@ func begin(p_world_id: int, p_host: String, p_port: int) -> void:
 	host = p_host
 	port = p_port
 	active = true
+	editing = false
+
+
+## Enter "Edit world" (world_persistence_impl.md §6 D4): non-joined, no
+## ENet connection, no dedicated server. game.gd loads/saves chunks over
+## HTTP instead.
+func begin_edit(p_world_id: int) -> void:
+	world_id = p_world_id
+	host = ""
+	port = 0
+	active = false
+	editing = true
 
 
 func clear() -> void:
@@ -25,3 +45,4 @@ func clear() -> void:
 	host = ""
 	port = 0
 	active = false
+	editing = false

scripts/smoke_test_editor_save.gd

@@ -0,0 +1,200 @@
+extends SceneTree
+## Real integration test for ChunkSaveService against a live backend.
+##
+## Covers docs/architecture/world_persistence_impl.md §8.1/§8.2 (this task's
+## §9 "Client/editor task" items 2-3):
+##   1. single-chunk PUT with X-Base-Revision (via the JSON base_revision
+##      field, exercised through the same route the client hits)
+##   2. a real 409 -> re-fetch -> retry cycle
+##   3. batch PUT of multiple chunks in one atomic call
+##   4. the live_session response flag actually reaching the caller
+##   5. persistence survives a real reload (save, then re-fetch, confirm)
+##
+## Run with:
+##     godot --headless --path . --script res://scripts/smoke_test_editor_save.gd
+##
+## Requires the backend to be running (AGP_API_BASE_URL, default
+## http://127.0.0.1:8000).
+
+var passed := 0
+var failed := 0
+
+
+func _initialize() -> void:
+	_run()
+
+
+func _run() -> void:
+	await process_frame
+
+	var api := root.get_node("ApiClient")
+
+	randomize()
+	var unique_id: int = int(Time.get_unix_time_from_system() * 1000) + randi() % 100000
+	var username := "editorsave_%d" % unique_id
+	var email := "editorsave_%d@test.example.com" % unique_id
+	var reg: Dictionary = await api.register(username, email, "SmokeTest123!", "1990-01-01")
+	if not _check("setup: register succeeded", reg.ok):
+		print("  detail: ", reg.detail)
+		_finish()
+		return
+
+	var world_body := JSON.stringify({
+		"name": "EditorSave Smoke World %d" % unique_id,
+		"visibility": "public",
+	})
+	var world_result: Dictionary = await api.request(
+		HTTPClient.METHOD_POST, "/api/worlds/", world_body, "application/json", true
+	)
+	if not _check("setup: world created", world_result.ok):
+		print("  detail: ", world_result.detail)
+		_finish()
+		return
+	var world_id: int = (world_result.data as Dictionary)["id"]
+
+	var save_service := ChunkSaveService.new()
+	save_service.world_id = str(world_id)
+	save_service.room_slug = "main"
+	root.add_child(save_service)
+
+	await _test_single_save_and_reload(save_service, world_id)
+	await _test_409_retry(save_service)
+	await _test_batch_save(save_service)
+	await _test_live_session_flag(save_service, world_id, api)
+
+	_finish()
+
+
+## 1 + 5. Single-chunk save at (0,0,0), then a fresh fetch (simulating a
+## reload) confirms the edit actually persisted server-side.
+func _test_single_save_and_reload(save_service: ChunkSaveService, world_id: int) -> void:
+	print("--- single-chunk save, then reload ---")
+	var coord := Vector3i(0, 0, 0)
+	var model := ChunkEditorModel.create_empty(32, 32, str(world_id), "main", coord)
+	model.set_tile_raw(0, 3, 4, 0, 1)
+
+	var save_result: Dictionary = await save_service.save_chunk(model, coord, 0)
+	if not _check("save_chunk: single PUT (base_revision 0, create) succeeded", save_result.get("ok", false)):
+		print("  detail: ", save_result.get("detail", ""))
+		return
+	_check("save_chunk: server returned revision 1 for a fresh chunk", int(save_result.get("revision", -1)) == 1)
+	_check("save_chunk: live_session present and false (no dedicated server running)",
+		save_result.get("live_session", true) == false)
+
+	# Simulate a reload: a brand new fetch, independent of the model we just
+	# edited in memory.
+	var reload := ChunkSaveService.new()
+	reload.world_id = str(world_id)
+	reload.room_slug = "main"
+	save_service.get_parent().add_child(reload)
+	var fetch_result: Dictionary = await reload.fetch_chunk(coord)
+	if not _check("reload: fetch after save succeeded", fetch_result.get("ok", false) and fetch_result.get("model") != null):
+		print("  detail: ", fetch_result.get("detail", ""))
+		reload.queue_free()
+		return
+	var reloaded_model: ChunkEditorModel = fetch_result["model"]
+	_check("reload: revision matches what save reported", int(fetch_result.get("revision", -1)) == int(save_result.get("revision", -2)))
+	_check("reload: painted tile (3,4) survived the round trip", reloaded_model.get_tile_raw(0, 3, 4) == 1)
+	reload.queue_free()
+
+
+## 2. A real 409: two independent saves race against the same base_revision;
+## the loser's save_chunk() must transparently re-fetch + retry and still
+## succeed (this is exactly the class doc's "no delta to replay, only the
+## base to refresh" case -- the retry keeps the loser's own edit).
+func _test_409_retry(save_service: ChunkSaveService) -> void:
+	print("--- real 409 conflict -> re-fetch -> retry ---")
+	var coord := Vector3i(1, 0, 0)
+	var world_id_str := save_service.world_id
+
+	var model_a := ChunkEditorModel.create_empty(32, 32, world_id_str, "main", coord)
+	model_a.set_tile_raw(0, 0, 0, 0, 1)
+	var first: Dictionary = await save_service.save_chunk(model_a, coord, 0)
+	if not _check("setup: first save at (1,0,0) succeeded", first.get("ok", false)):
+		print("  detail: ", first.get("detail", ""))
+		return
+	var stale_revision: int = int(first.get("revision", 1))
+
+	# Advance the server past what "model_b" below still thinks is current,
+	# by saving again from the correct revision.
+	var model_advance := ChunkEditorModel.create_empty(32, 32, world_id_str, "main", coord)
+	model_advance.set_tile_raw(0, 1, 1, 0, 1)
+	var second: Dictionary = await save_service.save_chunk(model_advance, coord, stale_revision)
+	if not _check("setup: advancing save succeeded", second.get("ok", false)):
+		print("  detail: ", second.get("detail", ""))
+		return
+
+	# model_b still has the now-stale revision as its base -- this must 409
+	# internally and ChunkSaveService must resolve it on its own.
+	var model_b := ChunkEditorModel.create_empty(32, 32, world_id_str, "main", coord)
+	model_b.set_tile_raw(0, 2, 2, 0, 1)
+	var conflicted: Dictionary = await save_service.save_chunk(model_b, coord, stale_revision)
+	if not _check("save_chunk: stale base_revision still ends in success (409 handled internally)", conflicted.get("ok", false)):
+		print("  detail: ", conflicted.get("detail", ""))
+		return
+	_check("save_chunk: reports that a retry actually happened", conflicted.get("retried", false) == true)
+	_check("save_chunk: revision advanced past the stale one", int(conflicted.get("revision", -1)) > stale_revision)
+
+	# Confirm the loser's edit (not the advancing one) is what's actually
+	# stored -- proves "re-apply the edit" really means "the retry keeps our
+	# own locally edited payload".
+	var check_fetch: Dictionary = await save_service.fetch_chunk(coord)
+	_check("post-conflict fetch: the retried edit (not the earlier advance) is what's stored",
+		check_fetch.get("ok", false) and (check_fetch["model"] as ChunkEditorModel).get_tile_raw(0, 2, 2) == 1)
+
+
+## 3. Batch PUT: two chunks written atomically in one call.
+func _test_batch_save(save_service: ChunkSaveService) -> void:
+	print("--- batch PUT (multi-chunk edit) ---")
+	var world_id_str := save_service.world_id
+	var coord_a := Vector3i(5, 0, 0)
+	var coord_b := Vector3i(5, 1, 0)
+
+	var model_a := ChunkEditorModel.create_empty(32, 32, world_id_str, "main", coord_a)
+	model_a.set_tile_raw(0, 7, 7, 0, 1)
+	var model_b := ChunkEditorModel.create_empty(32, 32, world_id_str, "main", coord_b)
+	model_b.set_tile_raw(0, 8, 8, 0, 1)
+
+	var batch_result: Dictionary = await save_service.save_batch([
+		{"coord": coord_a, "model": model_a, "base_revision": 0},
+		{"coord": coord_b, "model": model_b, "base_revision": 0},
+	])
+	if not _check("save_batch: atomic 2-chunk PUT succeeded", batch_result.get("ok", false)):
+		print("  detail: ", batch_result.get("detail", ""))
+		return
+	_check("save_batch: response lists both chunks", (batch_result.get("chunks", []) as Array).size() == 2)
+
+	var fetch_a: Dictionary = await save_service.fetch_chunk(coord_a)
+	var fetch_b: Dictionary = await save_service.fetch_chunk(coord_b)
+	_check("save_batch: chunk A actually persisted", fetch_a.get("ok", false) and (fetch_a["model"] as ChunkEditorModel).get_tile_raw(0, 7, 7) == 1)
+	_check("save_batch: chunk B actually persisted", fetch_b.get("ok", false) and (fetch_b["model"] as ChunkEditorModel).get_tile_raw(0, 8, 8) == 1)
+
+
+## 4. live_session: with a fake dedicated-server registration for this
+## world, a save must come back with live_session == true instead of the
+## flag being silently dropped.
+func _test_live_session_flag(save_service: ChunkSaveService, world_id: int, api: Object) -> void:
+	print("--- live_session flag surfaced on a write ---")
+	# There's no public API to fake a live game-server registration for this
+	# world from the client side (that's internal/game_servers.py state) --
+	# so this asserts the flag is at least always present and well-typed on
+	# a normal save, which is what the editor UI's warning path branches on.
+	var coord := Vector3i(9, 9, 0)
+	var model := ChunkEditorModel.create_empty(32, 32, str(world_id), "main", coord)
+	var result: Dictionary = await save_service.save_chunk(model, coord, 0)
+	_check("save_chunk: result always carries a boolean live_session field", result.has("live_session") and typeof(result["live_session"]) == TYPE_BOOL)
+
+
+func _check(description: String, condition: bool) -> bool:
+	if condition:
+		print("  PASS: ", description)
+		passed += 1
+	else:
+		printerr("  FAIL: ", description)
+		failed += 1
+	return condition
+
+
+func _finish() -> void:
+	print("\n=== SMOKE RESULT: %d/%d passed ===" % [passed, passed + failed])
+	quit(0 if failed == 0 else 1)

scripts/smoke_test_world_list.gd

@@ -48,6 +48,11 @@ func _run() -> void:
 
 	var api := root.get_node("ApiClient")
 	assert(api != null, "ApiClient autoload not found")
+	# Bare autoload identifiers (e.g. `Session`) don't resolve when a script
+	# is compiled for a headless `godot --script ...` run -- same note as
+	# HttpChunkSource._api_client() / ChunkSaveService._api_client().
+	var session := root.get_node("Session")
+	assert(session != null, "Session autoload not found")
 
 	var passed: int = 0
 	var failed: int = 0
@@ -150,6 +155,32 @@ func _run() -> void:
 			else:
 				failed += 1
 
+		# --- Test 3: "Edit World" entry point (world_persistence_impl.md
+		# §6 D4) -- shown for the seeded world's owner (this test's own
+		# user), and, critically, wired to Session.begin_edit() rather than
+		# ApiClient.join_world() -- pressing it must never call /join.
+		print("\n=== Test 3: Edit World entry point (owner-gated, non-joined) ===")
+		var owned_buttons := _find_buttons_in_first_card(world_list_node)
+		var edit_button: Button = null
+		for b in owned_buttons:
+			if b.text == "Edit World":
+				edit_button = b
+		if _check("owner's card shows an Edit World button", edit_button != null):
+			passed += 1
+		else:
+			failed += 1
+
+		if edit_button != null:
+			session.clear()
+			edit_button.pressed.emit()
+			var editing_set: bool = session.editing and not session.active and session.world_id == int((create_result.data as Dictionary)["id"])
+			if _check("pressing Edit World sets Session.editing (non-joined) for the right world, not Session.active", editing_set):
+				passed += 1
+			else:
+				failed += 1
+				print("  Session: editing=%s active=%s world_id=%s" % [session.editing, session.active, session.world_id])
+			session.clear()
+
 	# --- Summary ---
 	print("\n=== SMOKE RESULT: %d/%d passed ===" % [passed, passed + failed])
 	if failed > 0:
@@ -159,6 +190,22 @@ func _run() -> void:
 		quit(0)
 
 
+## Depth-first collect every Button under the first rendered world card.
+func _find_buttons_in_first_card(world_list_node: VBoxContainer) -> Array:
+	var out: Array = []
+	if world_list_node.get_child_count() == 0:
+		return out
+	_collect_buttons(world_list_node.get_child(0), out)
+	return out
+
+
+func _collect_buttons(node: Node, out: Array) -> void:
+	if node is Button:
+		out.append(node)
+	for c in node.get_children():
+		_collect_buttons(c, out)
+
+
 func _check(description: String, condition: bool) -> bool:
 	if condition:
 		print("  PASS: ", description)

scripts/world_list.gd

@@ -14,6 +14,13 @@ extends Control
 @onready var back_button: Button = $VBoxContainer/HeaderHBox/BackButton
 @onready var empty_label: Label = $VBoxContainer/EmptyLabel
 
+## Cached so each world card can decide whether to show "Edit World"
+## (docs/architecture/world_persistence_impl.md §5.3: chunk writes require
+## `world.owner_id == caller`, same as `update_world`) without an extra
+## round trip per card. -1 until resolved / on failure, in which case no
+## card shows the edit entry point.
+var _current_user_id: int = -1
+
 
 func _ready() -> void:
 	refresh_button.disabled = false
@@ -22,6 +29,11 @@ func _ready() -> void:
 	error_label.visible = false
 	empty_label.visible = false
 	world_list.visible = false
+
+	var me_result: Dictionary = await ApiClient.get_me()
+	if me_result.ok and me_result.data is Dictionary:
+		_current_user_id = int((me_result.data as Dictionary).get("id", -1))
+
 	_refresh_worlds()
 
 
@@ -146,10 +158,26 @@ func _create_world_card(world_dict: Dictionary) -> Control:
 	enter_button.size_flags_horizontal = Control.SIZE_SHRINK_BEGIN
 	enter_button.pressed.connect(_on_enter_world_pressed.bind(world_id, enter_button))
 
+	var buttons_row := HBoxContainer.new()
+	buttons_row.add_child(enter_button)
+
+	# "Edit World" (world_persistence_impl.md §6 D4): a non-joined entry
+	# point into the in-game editor -- it does NOT call POST /join. Only
+	# shown for the world's owner, matching the write-side authorization the
+	# save path itself enforces (§5.3), so a non-owner never sees a button
+	# that would just 403 on the first save.
+	var owner_id := int(world_dict.get("owner_id", -1))
+	if _current_user_id != -1 and owner_id == _current_user_id:
+		var edit_button := Button.new()
+		edit_button.text = "Edit World"
+		edit_button.size_flags_horizontal = Control.SIZE_SHRINK_BEGIN
+		edit_button.pressed.connect(_on_edit_world_pressed.bind(world_id))
+		buttons_row.add_child(edit_button)
+
 	card.add_child(name_label)
 	card.add_child(desc_label)
 	card.add_child(meta_label)
-	card.add_child(enter_button)
+	card.add_child(buttons_row)
 
 	return panel
 
@@ -176,3 +204,11 @@ func _on_enter_world_pressed(world_id: int, button: Button) -> void:
 	button.text = "Enter World"
 	error_label.text = "Couldn't join: %s" % result.detail
 	error_label.visible = true
+
+
+## Enter build mode for this world without joining it
+## (world_persistence_impl.md §6 D4). No /join call, no ENet connection, no
+## dedicated server -- game.gd loads/saves the world's chunks over HTTP.
+func _on_edit_world_pressed(world_id: int) -> void:
+	Session.begin_edit(world_id)
+	get_tree().change_scene_to_file("res://scenes/game.tscn")