feat: add NFT usernames and bot verification (#22)

Implements collectible usernames, official verification workflows, and third-party bot verification after maintainer protocol and migration review. The composite activity/moderation rating remains an admin-only read model; Telegram Stars Rating wire fields stay unset pending a dedicated official-semantics implementation. Reviewed-Head: 2796345775ea0f908fb7734601e5e1dee4b653b9 Original-Head: fa082b892fd5180c9c9bc53c81c21cf5d250a75b Co-authored-by: Egor Egorov <business.egor.sg@gmail.com>
2026-07-27 20:18:00 +03:00 · 2026-07-27 20:18:00 +03:00 · fff8de783a
commit fff8de783a
parent b0fd3976f1
169 changed files with 55769 additions and 282 deletions
--- a/internal/app/bots/botfather.go
+++ b/internal/app/bots/botfather.go
@ -74,15 +74,26 @@ You can control me by sending these commands:
 /cancel - cancel the current operation
 /help - show this message`

-// botReply 是 BotFather 的一条回复。
+// botReply 是内置 service bot 的一条回复。ReplyMarkup 为可选 inline keyboard
+// 快照（@verifybot 的按钮式对话使用）；落库前经 domain.ValidateReplyMarkup 校验。
 type botReply struct {
-	Text     string
-	Entities []domain.MessageEntity
+	Text        string
+	Entities    []domain.MessageEntity
+	ReplyMarkup *domain.MessageReplyMarkup
 }

 // HandlesBot 报告该收件人是否为内置应答 bot（messages.BotResponder 实现）。
 func (s *Service) HandlesBot(botUserID int64) bool {
-	return s != nil && (botUserID == domain.BotFatherUserID || botUserID == domain.StickersBotUserID || botUserID == domain.ChatBotUserID)
+	if s == nil {
+		return false
+	}
+	switch botUserID {
+	case domain.BotFatherUserID, domain.StickersBotUserID, domain.ChatBotUserID,
+		domain.VerifyBotUserID, domain.VerifierBotUserID:
+		return true
+	default:
+		return false
+	}
 }

 // OnPrivateMessage 处理投递给内置 bot 的私聊消息（messages.BotResponder 实现）。
@ -103,6 +114,10 @@ func (s *Service) OnPrivateMessage(ctx context.Context, botUserID int64, msg dom
 		go s.respondAsStickers(userID, msg)
 	case domain.ChatBotUserID:
 		go s.respondAsChatBot(userID, msg)
+	case domain.VerifyBotUserID:
+		go s.respondAsVerify(userID, msg)
+	case domain.VerifierBotUserID:
+		go s.respondAsVerifier(userID, msg)
 	}
 }

@ -145,12 +160,24 @@ func (s *Service) sendServiceBotReplyResult(ctx context.Context, botUserID, user
 	if s == nil || s.messages == nil || reply.Text == "" {
 		return domain.SendPrivateTextResult{}, false
 	}
+	markup := reply.ReplyMarkup
+	if err := domain.ValidateReplyMarkup(markup); err != nil {
+		// 键盘校验必须先于落库（I9）：结构非法的 markup 绝不写库，但正文仍然发出
+		// ——用户至少收到提示文本，不会因为一颗坏按钮而完全失联。
+		s.log.Error("service bot: invalid reply markup",
+			zap.Int64("bot_user_id", botUserID), zap.Int64("user_id", userID), zap.Error(err))
+		markup = nil
+	}
+	if markup.IsZero() {
+		markup = nil
+	}
 	res, err := s.messages.SendPrivateText(ctx, domain.SendPrivateTextRequest{
 		SenderUserID:     botUserID,
 		RecipientUserID:  userID,
 		RandomID:         s.botReplyRandomID(),
 		Message:          reply.Text,
 		Entities:         serviceBotReplyEntities(reply.Text, reply.Entities),
+		ReplyMarkup:      markup,
 		Date:             int(s.now().Unix()),
 		RecipientBlocked: s.serviceBotRecipientBlocked(ctx, botUserID, userID),
 	})
--- a/internal/app/bots/service.go
+++ b/internal/app/bots/service.go
@ -48,6 +48,30 @@ type aiChatGenerator interface {
 	GenerateTextStream(ctx context.Context, req domain.AITextGenerationRequest, emit func(domain.AIComposeText) error) (domain.AIComposeText, error)
 }

+// verificationApplications is the applicant-side surface of official platform
+// verification used by the built-in @verifybot (app/verification.Service
+// satisfies it as-is).
+//
+// It is declared as a narrow port rather than taken as a concrete service for the
+// usual reason plus one specific to this feature: every verification rule --
+// ownership, public username, restrictions, already-verified, cooldown, rate
+// limit, the status machine -- belongs to that service, and the bot must not be
+// able to reach past it. Nothing here can write a peer's verified flag.
+type verificationApplications interface {
+	EligibleTargets(ctx context.Context, applicantUserID int64) ([]domain.VerificationTarget, error)
+	StartDraft(ctx context.Context, req domain.SubmitVerificationApplicationRequest) (domain.VerificationApplication, bool, error)
+	SaveDraft(ctx context.Context, applicantUserID, applicationID, version int64, draft domain.VerificationDraftInput) (domain.VerificationApplication, error)
+	Submit(ctx context.Context, applicantUserID, applicationID, version int64) (domain.VerificationApplication, error)
+	Cancel(ctx context.Context, applicantUserID, applicationID, version int64, reason string) (domain.VerificationApplication, error)
+	Draft(ctx context.Context, applicantUserID int64) (domain.VerificationApplication, error)
+	ApplicantApplications(ctx context.Context, applicantUserID int64, limit int) ([]domain.VerificationApplication, error)
+	Application(ctx context.Context, applicationID int64) (domain.VerificationApplication, error)
+}
+
+// The third-party verification ports live in verifierbot.go
+// (customVerifications, verifierBotTargets): they are the built-in @verifierbot's
+// only way to reach the feature, and are kept next to the dialog that uses them.
+
 // RouterHooks 是 rpc 层回调（router 创建后经 SetRouterHooks 延迟注入，打破
 // router↔bots 的构造循环；这些能力都依赖 TL/连接层边界，不能在 app 层实现）：
 //   - RevokeBotSessions：token revoke 后撤销 bot 的全部已登录 session（删
@ -83,6 +107,9 @@ type Service struct {
 	stickers              stickerSetCreator
 	installer             userStickerSetInstaller
 	aiChat                aiChatGenerator
+	verification          verificationApplications
+	customVerification    customVerifications
+	verifierTargets       verifierBotTargets
 	telegramLogin         *telegramloginapp.Service
 	hooks                 RouterHooks
 	textDrafts            TextDraftPusher
@ -92,6 +119,13 @@ type Service struct {
 	now                   func() time.Time
 	chatBotStreamThrottle time.Duration
 	publicBaseURL         string
+	// dialogLimiter bounds how often one applicant can drive a service-bot dialog.
+	// The verification service already rate-limits application creation; this is the
+	// separate bound on dialog traffic itself, so a script cannot spin the state
+	// machine (and its writes) even without ever submitting anything.
+	dialogLimiter    store.RateLimiter
+	dialogRateLimit  int
+	dialogRateWindow time.Duration
 	// replySeq 是回复 randomID 在 crypto/rand 失败时的兜底单调序列。
 	replySeq   atomic.Int64
 	replyLocks [replyLockStripes]sync.Mutex
@ -177,6 +211,56 @@ func WithAIChatGenerator(g aiChatGenerator) Option {
 	}
 }

+// WithVerification injects the official verification service used by the
+// built-in @verifybot. Without it the bot still answers, but every command
+// reports that verification is unavailable rather than half-running the dialog.
+func WithVerification(v verificationApplications) Option {
+	return func(s *Service) {
+		if v != nil {
+			s.verification = v
+		}
+	}
+}
+
+// WithCustomVerification injects the third-party verification service used by the
+// built-in @verifierbot. Without it the bot still answers, but every command
+// reports that third-party verification is unavailable rather than half-running the
+// dialog.
+func WithCustomVerification(v customVerifications) Option {
+	return func(s *Service) {
+		if v != nil {
+			s.customVerification = v
+		}
+	}
+}
+
+// WithVerifierTargets injects the directory of an applicant's own peers used by
+// @verifierbot's subject picker. It is optional: with nothing injected the bot
+// falls back to the official verification service's EligibleTargets, which
+// enumerates exactly the same peers (only its eligibility verdicts, which answer a
+// different question, are ignored).
+func WithVerifierTargets(t verifierBotTargets) Option {
+	return func(s *Service) {
+		if t != nil {
+			s.verifierTargets = t
+		}
+	}
+}
+
+// WithDialogRateLimiter bounds service-bot dialog traffic per user. A zero limit
+// or a nil limiter disables the bound, which is what a deployment without Redis
+// gets.
+func WithDialogRateLimiter(limiter store.RateLimiter, limit int, window time.Duration) Option {
+	return func(s *Service) {
+		if limiter == nil || limit <= 0 || window <= 0 {
+			return
+		}
+		s.dialogLimiter = limiter
+		s.dialogRateLimit = limit
+		s.dialogRateWindow = window
+	}
+}
+
 // WithTelegramLogin injects the OIDC application service used by BotFather.
 // BotFather never writes the login tables directly.
 func WithTelegramLogin(login *telegramloginapp.Service) Option {
@ -262,6 +346,33 @@ func (s *Service) SetAIChatGenerator(g aiChatGenerator) {
 	}
 }

+// SetVerification injects the official verification service after construction.
+// The bots service is built before the peer directories that service depends on,
+// so in the shipped process this is the wiring order that actually exists (same
+// deferred-injection pattern as SetRouterHooks).
+func (s *Service) SetVerification(v verificationApplications) {
+	if s != nil && v != nil {
+		s.verification = v
+	}
+}
+
+// SetCustomVerification injects the third-party verification service after
+// construction. The bots service is built before the stores and directories that
+// service depends on, so in the shipped process this is the wiring order that
+// actually exists (same deferred-injection pattern as SetVerification).
+func (s *Service) SetCustomVerification(v customVerifications) {
+	if s != nil && v != nil {
+		s.customVerification = v
+	}
+}
+
+// SetVerifierTargets injects @verifierbot's subject directory after construction.
+func (s *Service) SetVerifierTargets(t verifierBotTargets) {
+	if s != nil && t != nil {
+		s.verifierTargets = t
+	}
+}
+
 // NewService 创建 bots 服务。
 func NewService(users store.UserStore, bots store.BotStore, messages store.MessageStore, opts ...Option) *Service {
 	s := &Service{
--- a/internal/app/bots/verifierbot.go
+++ b/internal/app/bots/verifierbot.go
--- a/internal/app/bots/verifierbot_test.go
+++ b/internal/app/bots/verifierbot_test.go
--- a/internal/app/bots/verifybot.go
+++ b/internal/app/bots/verifybot.go
--- a/internal/app/bots/verifybot_test.go
+++ b/internal/app/bots/verifybot_test.go
@ -0,0 +1,984 @@
+package bots
+
+import (
+	"context"
+	"errors"
+	"sort"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	verificationapp "telesrv/internal/app/verification"
+	"telesrv/internal/domain"
+	"telesrv/internal/store/memory"
+)
+
+// ---------------------------------------------------------------------------
+// Fake verification service
+// ---------------------------------------------------------------------------
+
+// fakeVerification is an in-memory stand-in for app/verification.Service. It
+// keeps the properties the bot dialog actually leans on: one draft per applicant,
+// StartDraft resuming instead of duplicating, optimistic-locking versions, and
+// the domain validation of the payload.
+type fakeVerification struct {
+	targets    []domain.VerificationTarget
+	apps       map[int64]domain.VerificationApplication
+	nextID     int64
+	starts     int
+	submits    int
+	targetsErr error
+	startErr   error
+}
+
+func newFakeVerification(targets ...domain.VerificationTarget) *fakeVerification {
+	return &fakeVerification{
+		targets: targets,
+		apps:    make(map[int64]domain.VerificationApplication),
+		nextID:  100,
+	}
+}
+
+func (f *fakeVerification) EligibleTargets(_ context.Context, applicantUserID int64) ([]domain.VerificationTarget, error) {
+	if f.targetsErr != nil {
+		return nil, f.targetsErr
+	}
+	if applicantUserID <= 0 {
+		return nil, domain.ErrVerificationApplicationInvalid
+	}
+	return append([]domain.VerificationTarget(nil), f.targets...), nil
+}
+
+func (f *fakeVerification) draftFor(applicantUserID int64) (domain.VerificationApplication, bool) {
+	for _, app := range f.apps {
+		if app.ApplicantUserID == applicantUserID && app.Status == domain.VerificationStatusDraft {
+			return app, true
+		}
+	}
+	return domain.VerificationApplication{}, false
+}
+
+func (f *fakeVerification) StartDraft(_ context.Context, req domain.SubmitVerificationApplicationRequest) (domain.VerificationApplication, bool, error) {
+	f.starts++
+	if app, found := f.draftFor(req.ApplicantUserID); found {
+		return app, false, nil
+	}
+	if f.startErr != nil {
+		return domain.VerificationApplication{}, false, f.startErr
+	}
+	var target domain.VerificationTarget
+	for _, candidate := range f.targets {
+		if candidate.Type == req.TargetType && candidate.ID == req.TargetID {
+			target = candidate
+		}
+	}
+	if target.ID == 0 {
+		return domain.VerificationApplication{}, false, domain.ErrVerificationTargetInvalid
+	}
+	if !target.Eligible {
+		return domain.VerificationApplication{}, false, domain.ErrVerificationTargetAlreadyVerified
+	}
+	f.nextID++
+	app := domain.VerificationApplication{
+		ID:              f.nextID,
+		ApplicantUserID: req.ApplicantUserID,
+		TargetType:      target.Type,
+		TargetID:        target.ID,
+		TargetTitle:     target.Title,
+		TargetUsername:  target.Username,
+		Status:          domain.VerificationStatusDraft,
+		CreatedAt:       time.Date(2026, 7, 26, 10, 0, 0, 0, time.UTC),
+		Version:         1,
+	}
+	f.apps[app.ID] = app
+	return app, true, nil
+}
+
+func (f *fakeVerification) SaveDraft(_ context.Context, applicantUserID, applicationID, version int64, draft domain.VerificationDraftInput) (domain.VerificationApplication, error) {
+	app, found := f.apps[applicationID]
+	if !found || app.ApplicantUserID != applicantUserID {
+		return domain.VerificationApplication{}, domain.ErrVerificationApplicationNotFound
+	}
+	if app.Version != version {
+		return domain.VerificationApplication{}, domain.ErrVerificationVersionConflict
+	}
+	if app.Status != domain.VerificationStatusDraft {
+		return domain.VerificationApplication{}, domain.ErrVerificationStatusInvalid
+	}
+	if err := draft.ValidateDraft(); err != nil {
+		return domain.VerificationApplication{}, err
+	}
+	draft = draft.Normalize()
+	app.Category = draft.Category
+	app.Description = draft.Description
+	app.OfficialWebsite = draft.OfficialWebsite
+	app.SocialLinks = draft.SocialLinks
+	app.PressLinks = draft.PressLinks
+	app.AdditionalNote = draft.AdditionalNote
+	app.Version++
+	f.apps[applicationID] = app
+	return app, nil
+}
+
+func (f *fakeVerification) Submit(_ context.Context, applicantUserID, applicationID, version int64) (domain.VerificationApplication, error) {
+	app, found := f.apps[applicationID]
+	if !found || app.ApplicantUserID != applicantUserID {
+		return domain.VerificationApplication{}, domain.ErrVerificationApplicationNotFound
+	}
+	if app.Version != version {
+		return domain.VerificationApplication{}, domain.ErrVerificationVersionConflict
+	}
+	if !domain.CanTransitionVerificationStatus(app.Status, domain.VerificationStatusSubmitted) {
+		return domain.VerificationApplication{}, domain.ErrVerificationStatusInvalid
+	}
+	if err := (domain.VerificationDraftInput{
+		Category:        app.Category,
+		Description:     app.Description,
+		OfficialWebsite: app.OfficialWebsite,
+		SocialLinks:     app.SocialLinks,
+		PressLinks:      app.PressLinks,
+		AdditionalNote:  app.AdditionalNote,
+	}).ValidateForSubmission(); err != nil {
+		return domain.VerificationApplication{}, err
+	}
+	f.submits++
+	app.Status = domain.VerificationStatusSubmitted
+	app.SubmittedAt = time.Date(2026, 7, 26, 12, 0, 0, 0, time.UTC)
+	app.Version++
+	f.apps[applicationID] = app
+	return app, nil
+}
+
+func (f *fakeVerification) Cancel(_ context.Context, applicantUserID, applicationID, version int64, reason string) (domain.VerificationApplication, error) {
+	app, found := f.apps[applicationID]
+	if !found || app.ApplicantUserID != applicantUserID {
+		return domain.VerificationApplication{}, domain.ErrVerificationApplicationNotFound
+	}
+	if app.Version != version {
+		return domain.VerificationApplication{}, domain.ErrVerificationVersionConflict
+	}
+	if !domain.CanTransitionVerificationStatus(app.Status, domain.VerificationStatusCancelled) {
+		return domain.VerificationApplication{}, domain.ErrVerificationStatusInvalid
+	}
+	app.Status = domain.VerificationStatusCancelled
+	app.DecisionReason = reason
+	app.Version++
+	f.apps[applicationID] = app
+	return app, nil
+}
+
+func (f *fakeVerification) Draft(_ context.Context, applicantUserID int64) (domain.VerificationApplication, error) {
+	if app, found := f.draftFor(applicantUserID); found {
+		return app, nil
+	}
+	return domain.VerificationApplication{}, domain.ErrVerificationApplicationNotFound
+}
+
+func (f *fakeVerification) ApplicantApplications(_ context.Context, applicantUserID int64, limit int) ([]domain.VerificationApplication, error) {
+	out := make([]domain.VerificationApplication, 0, len(f.apps))
+	for _, app := range f.apps {
+		if app.ApplicantUserID == applicantUserID {
+			out = append(out, app)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].ID > out[j].ID })
+	if limit > 0 && len(out) > limit {
+		out = out[:limit]
+	}
+	return out, nil
+}
+
+func (f *fakeVerification) Application(_ context.Context, applicationID int64) (domain.VerificationApplication, error) {
+	if app, found := f.apps[applicationID]; found {
+		return app, nil
+	}
+	return domain.VerificationApplication{}, domain.ErrVerificationApplicationNotFound
+}
+
+var _ verificationApplications = (*fakeVerification)(nil)
+
+// ---------------------------------------------------------------------------
+// Harness
+// ---------------------------------------------------------------------------
+
+func verifyChannelTarget() domain.VerificationTarget {
+	return domain.VerificationTarget{
+		Type: domain.VerificationTargetChannel, ID: 7001,
+		Title: "Example News", Username: "examplenews", AccessHash: 42, Eligible: true,
+	}
+}
+
+func verifyBotTarget() domain.VerificationTarget {
+	return domain.VerificationTarget{
+		Type: domain.VerificationTargetBot, ID: 8002,
+		Title: "Example Bot", Username: "examplebot", Eligible: true,
+	}
+}
+
+func newVerifyBotTestService(t *testing.T, verification verificationApplications, opts ...Option) (*Service, *memory.UserStore, *memory.MessageStore) {
+	t.Helper()
+	users := memory.NewUserStore()
+	bots := memory.NewBotStore(users)
+	dialogs := memory.NewDialogStore()
+	messages := memory.NewMessageStore(dialogs)
+	all := append([]Option{WithVerification(verification)}, opts...)
+	return NewService(users, bots, messages, all...), users, messages
+}
+
+// verifyBotReplies returns every @verifybot message in the user's box, oldest
+// first.
+func verifyBotReplies(t *testing.T, messages *memory.MessageStore, userID int64) []domain.Message {
+	t.Helper()
+	list, err := messages.ListByUser(context.Background(), userID, domain.MessageFilter{
+		HasPeer: true,
+		Peer:    domain.Peer{Type: domain.PeerTypeUser, ID: domain.VerifyBotUserID},
+		Limit:   200,
+	})
+	if err != nil {
+		t.Fatalf("list @verifybot history: %v", err)
+	}
+	out := make([]domain.Message, 0, len(list.Messages))
+	for _, msg := range list.Messages {
+		if msg.From.ID == domain.VerifyBotUserID {
+			out = append(out, msg)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].ID < out[j].ID })
+	return out
+}
+
+func latestVerifyReply(t *testing.T, messages *memory.MessageStore, userID int64) domain.Message {
+	t.Helper()
+	replies := verifyBotReplies(t, messages, userID)
+	if len(replies) == 0 {
+		t.Fatal("no @verifybot reply")
+	}
+	latest := replies[len(replies)-1]
+	// Every keyboard the bot renders must be a valid, persistable markup: the send
+	// path validates before storing, so an invalid one would silently vanish.
+	if err := domain.ValidateReplyMarkup(latest.ReplyMarkup); err != nil {
+		t.Fatalf("reply markup invalid: %v (%+v)", err, latest.ReplyMarkup)
+	}
+	for _, row := range verifyInlineRows(latest) {
+		for _, button := range row {
+			if len(button.Data) > domain.MaxCallbackDataLen {
+				t.Fatalf("callback data %q is %d bytes, limit is %d", button.Data, len(button.Data), domain.MaxCallbackDataLen)
+			}
+		}
+	}
+	return latest
+}
+
+func verifyInlineRows(msg domain.Message) [][]domain.MarkupButton {
+	if msg.ReplyMarkup == nil {
+		return nil
+	}
+	return msg.ReplyMarkup.Inline
+}
+
+// sendToVerifyBot drives the responder synchronously, bypassing the
+// OnPrivateMessage goroutine dispatch for determinism (the same shortcut the
+// BotFather and @Stickers tests take).
+func sendToVerifyBot(t *testing.T, svc *Service, messages *memory.MessageStore, userID int64, text string) domain.Message {
+	t.Helper()
+	svc.respondAsVerify(userID, domain.Message{
+		From: domain.Peer{Type: domain.PeerTypeUser, ID: userID},
+		Peer: domain.Peer{Type: domain.PeerTypeUser, ID: domain.VerifyBotUserID},
+		Body: text,
+	})
+	return latestVerifyReply(t, messages, userID)
+}
+
+func verifyButtonData(msg domain.Message, label string) ([]byte, bool) {
+	for _, row := range verifyInlineRows(msg) {
+		for _, button := range row {
+			if button.Type == domain.MarkupButtonCallback && strings.Contains(button.Text, label) {
+				return append([]byte(nil), button.Data...), true
+			}
+		}
+	}
+	return nil, false
+}
+
+// pressVerifyCallbackData drives the internal callback path with raw data, the
+// way rpc.Router does once it has validated the click.
+func pressVerifyCallbackData(t *testing.T, svc *Service, userID int64, msg domain.Message, data []byte) domain.BotCallbackAnswer {
+	t.Helper()
+	if len(data) > domain.MaxCallbackDataLen {
+		t.Fatalf("callback data too long: %d bytes", len(data))
+	}
+	answer, handled, err := svc.OnCallbackQuery(context.Background(), domain.BotCallbackQuery{
+		ID:        1,
+		BotUserID: domain.VerifyBotUserID,
+		UserID:    userID,
+		Peer:      domain.Peer{Type: domain.PeerTypeUser, ID: userID},
+		MessageID: msg.ID,
+		Data:      data,
+	})
+	if err != nil {
+		t.Fatalf("callback query: %v", err)
+	}
+	if !handled {
+		t.Fatal("callback query reported unhandled for @verifybot")
+	}
+	return answer
+}
+
+func pressVerifyButton(t *testing.T, svc *Service, userID int64, msg domain.Message, label string) domain.BotCallbackAnswer {
+	t.Helper()
+	data, found := verifyButtonData(msg, label)
+	if !found {
+		t.Fatalf("button %q is not in the keyboard of message %d: %+v", label, msg.ID, msg.ReplyMarkup)
+	}
+	return pressVerifyCallbackData(t, svc, userID, msg, data)
+}
+
+const (
+	verifyTestDescription = "Example News is the daily newsroom of the Example Foundation, publishing since 2015."
+	verifyTestWebsite     = "https://news.example.com"
+	verifyTestPressLinks  = "https://press.example.org/story-one\nhttps://media.example.net/story-two"
+)
+
+// runVerifyApplication walks the whole dialog up to (but not including) Submit and
+// returns the summary message.
+func runVerifyApplication(t *testing.T, svc *Service, messages *memory.MessageStore, userID int64) domain.Message {
+	t.Helper()
+	intro := sendToVerifyBot(t, svc, messages, userID, "/start")
+	pressVerifyButton(t, svc, userID, intro, verifyApplyButtonText)
+	picker := latestVerifyReply(t, messages, userID)
+
+	pressVerifyButton(t, svc, userID, picker, "@examplenews")
+	categories := latestVerifyReply(t, messages, userID)
+
+	pressVerifyButton(t, svc, userID, categories, "Media outlet")
+	if got := latestVerifyReply(t, messages, userID); !strings.Contains(got.Body, "describe the subject") {
+		t.Fatalf("after category, reply = %q", got.Body)
+	}
+
+	sendToVerifyBot(t, svc, messages, userID, verifyTestDescription)
+	social := sendToVerifyBot(t, svc, messages, userID, verifyTestWebsite)
+	if !strings.Contains(social.Body, "social media") {
+		t.Fatalf("after website, reply = %q", social.Body)
+	}
+
+	pressVerifyButton(t, svc, userID, social, verifySkipButtonText)
+	if got := latestVerifyReply(t, messages, userID); !strings.Contains(got.Body, "press coverage") {
+		t.Fatalf("after skipping social links, reply = %q", got.Body)
+	}
+
+	note := sendToVerifyBot(t, svc, messages, userID, verifyTestPressLinks)
+	pressVerifyButton(t, svc, userID, note, verifySkipButtonText)
+	return latestVerifyReply(t, messages, userID)
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+func TestVerifyBotStartExplainsAndOffersApplyButton(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7100")
+
+	if !svc.HandlesBot(domain.VerifyBotUserID) {
+		t.Fatal("service should handle @verifybot")
+	}
+	reply := sendToVerifyBot(t, svc, messages, owner.ID, "/start")
+	for _, want := range []string{"official", "public @username", "/new", "/help"} {
+		if !strings.Contains(reply.Body, want) {
+			t.Fatalf("/start reply missing %q: %q", want, reply.Body)
+		}
+	}
+	data, found := verifyButtonData(reply, verifyApplyButtonText)
+	if !found {
+		t.Fatalf("/start reply has no apply button: %+v", reply.ReplyMarkup)
+	}
+	if !strings.HasPrefix(string(data), verifyCallbackDataPrefix) {
+		t.Fatalf("callback data %q is not a @verifybot token", data)
+	}
+	if fake.starts != 0 {
+		t.Fatalf("StartDraft called %d times on /start, want 0", fake.starts)
+	}
+}
+
+func TestVerifyBotFullApplicationFlowFilesExactlyOneApplication(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget(), verifyBotTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7101")
+
+	summary := runVerifyApplication(t, svc, messages, owner.ID)
+	for _, want := range []string{"Example News", "Media outlet", verifyTestWebsite, "press.example.org/story-one", verifySubmitButtonText} {
+		if !strings.Contains(summary.Body, want) {
+			t.Fatalf("summary missing %q: %q", want, summary.Body)
+		}
+	}
+
+	pressVerifyButton(t, svc, owner.ID, summary, verifySubmitButtonText)
+	filed := latestVerifyReply(t, messages, owner.ID)
+	if !strings.Contains(filed.Body, "#101") || !strings.Contains(filed.Body, "/status") {
+		t.Fatalf("submitted reply = %q", filed.Body)
+	}
+	if fake.submits != 1 || len(fake.apps) != 1 {
+		t.Fatalf("submits=%d applications=%d, want exactly one of each", fake.submits, len(fake.apps))
+	}
+	app := fake.apps[101]
+	if app.Status != domain.VerificationStatusSubmitted {
+		t.Fatalf("application status = %q", app.Status)
+	}
+	if app.Category != "media" || app.OfficialWebsite != verifyTestWebsite || len(app.PressLinks) != 2 {
+		t.Fatalf("stored application = %+v", app)
+	}
+	if app.TargetID != 7001 || app.TargetType != domain.VerificationTargetChannel {
+		t.Fatalf("stored target = %s/%d", app.TargetType, app.TargetID)
+	}
+}
+
+// The target buttons must not leak the peer they stand for: the whole point of the
+// token table is that a click cannot name a peer at all.
+func TestVerifyBotCallbackDataCarriesNoTargetIdentity(t *testing.T) {
+	target := verifyChannelTarget()
+	fake := newFakeVerification(target)
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7102")
+
+	intro := sendToVerifyBot(t, svc, messages, owner.ID, "/start")
+	pressVerifyButton(t, svc, owner.ID, intro, verifyApplyButtonText)
+	picker := latestVerifyReply(t, messages, owner.ID)
+
+	buttons := 0
+	for _, row := range verifyInlineRows(picker) {
+		for _, button := range row {
+			buttons++
+			data := string(button.Data)
+			// Structural assertion rather than a substring hunt: the data is the
+			// prefix plus an opaque hex token and nothing else, so it is incapable of
+			// encoding a peer id, an access hash, a username or a peer type.
+			token, ok := strings.CutPrefix(data, verifyCallbackDataPrefix)
+			if !ok || len(token) != 2*verifyOptionTokenBytes {
+				t.Fatalf("callback data %q is not <prefix><token>", data)
+			}
+			for _, c := range token {
+				if !strings.ContainsRune("0123456789abcdef", c) {
+					t.Fatalf("callback data %q carries non-token bytes", data)
+				}
+			}
+			for _, forbidden := range []string{target.Username, string(target.Type)} {
+				if strings.Contains(data, forbidden) {
+					t.Fatalf("callback data %q leaks %q", data, forbidden)
+				}
+			}
+		}
+	}
+	if buttons == 0 {
+		t.Fatal("target picker has no buttons")
+	}
+
+	// The token is minted per render, so the same target never has a stable,
+	// guessable identifier on the wire.
+	firstData, _ := verifyButtonData(picker, "@"+target.Username)
+	sendToVerifyBot(t, svc, messages, owner.ID, "/new")
+	secondData, found := verifyButtonData(latestVerifyReply(t, messages, owner.ID), "@"+target.Username)
+	if !found {
+		t.Fatal("re-rendered picker has no target button")
+	}
+	if string(firstData) == string(secondData) {
+		t.Fatalf("token %q is stable across renders", firstData)
+	}
+}
+
+func TestVerifyBotRepeatedButtonPressIsIdempotent(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7103")
+
+	intro := sendToVerifyBot(t, svc, messages, owner.ID, "/start")
+	pressVerifyButton(t, svc, owner.ID, intro, verifyApplyButtonText)
+	picker := latestVerifyReply(t, messages, owner.ID)
+
+	pressVerifyButton(t, svc, owner.ID, picker, "@examplenews")
+	first := latestVerifyReply(t, messages, owner.ID)
+	pressVerifyButton(t, svc, owner.ID, picker, "@examplenews")
+	second := latestVerifyReply(t, messages, owner.ID)
+
+	if first.Body != second.Body {
+		t.Fatalf("repeat target press changed the answer:\nfirst  = %q\nsecond = %q", first.Body, second.Body)
+	}
+	if len(fake.apps) != 1 {
+		t.Fatalf("applications = %d after pressing the same target twice, want 1", len(fake.apps))
+	}
+}
+
+// The same must hold for the terminal action: a double-tapped Submit files one
+// application and repeats the same confirmation.
+func TestVerifyBotRepeatedSubmitFilesOneApplication(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7121")
+
+	summary := runVerifyApplication(t, svc, messages, owner.ID)
+	pressVerifyButton(t, svc, owner.ID, summary, verifySubmitButtonText)
+	firstFiled := latestVerifyReply(t, messages, owner.ID)
+	pressVerifyButton(t, svc, owner.ID, summary, verifySubmitButtonText)
+	secondFiled := latestVerifyReply(t, messages, owner.ID)
+
+	if firstFiled.Body != secondFiled.Body {
+		t.Fatalf("repeat submit changed the answer:\nfirst  = %q\nsecond = %q", firstFiled.Body, secondFiled.Body)
+	}
+	if fake.submits != 1 || len(fake.apps) != 1 {
+		t.Fatalf("submits=%d applications=%d after double submit, want 1/1", fake.submits, len(fake.apps))
+	}
+}
+
+func TestVerifyBotForgedCallbackTokenIsRefused(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7104")
+
+	intro := sendToVerifyBot(t, svc, messages, owner.ID, "/start")
+	before := len(verifyBotReplies(t, messages, owner.ID))
+
+	// A token that was never minted for this user, and a plausible-looking
+	// hand-written one: both resolve only through the user's own state, so both are
+	// refused without any side effect.
+	for _, data := range [][]byte{
+		[]byte(verifyCallbackDataPrefix + "deadbeefcafe"),
+		[]byte("tgt:channel:7001"),
+		[]byte(verifyCallbackDataPrefix),
+	} {
+		answer := pressVerifyCallbackData(t, svc, owner.ID, intro, data)
+		if !answer.Alert || !strings.Contains(answer.Message, "no longer active") {
+			t.Fatalf("forged data %q answered %+v, want an explaining alert", data, answer)
+		}
+	}
+	if got := len(verifyBotReplies(t, messages, owner.ID)); got != before {
+		t.Fatalf("forged callbacks produced %d new messages", got-before)
+	}
+	if fake.starts != 0 || len(fake.apps) != 0 {
+		t.Fatalf("forged callbacks touched the service: starts=%d apps=%d", fake.starts, len(fake.apps))
+	}
+}
+
+// A token minted for one applicant must be meaningless for another: resolution
+// goes through the clicking user's own chat state only.
+func TestVerifyBotTokenFromAnotherUserIsRefused(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	victim := newOwner(t, users, "+7105")
+	attacker := newOwner(t, users, "+7106")
+
+	intro := sendToVerifyBot(t, svc, messages, victim.ID, "/start")
+	pressVerifyButton(t, svc, victim.ID, intro, verifyApplyButtonText)
+	picker := latestVerifyReply(t, messages, victim.ID)
+	stolen, found := verifyButtonData(picker, "@examplenews")
+	if !found {
+		t.Fatal("victim picker has no target button")
+	}
+
+	sendToVerifyBot(t, svc, messages, attacker.ID, "/start")
+	attackerIntro := latestVerifyReply(t, messages, attacker.ID)
+	answer := pressVerifyCallbackData(t, svc, attacker.ID, attackerIntro, stolen)
+	if !answer.Alert {
+		t.Fatalf("stolen token answered %+v, want an alert", answer)
+	}
+	for _, app := range fake.apps {
+		if app.ApplicantUserID == attacker.ID {
+			t.Fatalf("stolen token created an application for the attacker: %+v", app)
+		}
+	}
+}
+
+func TestVerifyBotPressLinkMinimumIsEnforced(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7107")
+
+	intro := sendToVerifyBot(t, svc, messages, owner.ID, "/start")
+	pressVerifyButton(t, svc, owner.ID, intro, verifyApplyButtonText)
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "@examplenews")
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "Media outlet")
+	sendToVerifyBot(t, svc, messages, owner.ID, verifyTestDescription)
+	social := sendToVerifyBot(t, svc, messages, owner.ID, verifyTestWebsite)
+	pressVerifyButton(t, svc, owner.ID, social, verifySkipButtonText)
+
+	tooFew := sendToVerifyBot(t, svc, messages, owner.ID, "https://press.example.org/story-one")
+	if !strings.Contains(tooFew.Body, strconv.Itoa(domain.MinVerificationPressLinks)) {
+		t.Fatalf("single press link accepted or unexplained: %q", tooFew.Body)
+	}
+	if len(fake.apps[101].PressLinks) != 0 {
+		t.Fatalf("press links stored despite refusal: %+v", fake.apps[101].PressLinks)
+	}
+
+	accepted := sendToVerifyBot(t, svc, messages, owner.ID, verifyTestPressLinks)
+	if !strings.Contains(accepted.Body, "reviewers should know") {
+		t.Fatalf("two press links did not advance the dialog: %q", accepted.Body)
+	}
+	if len(fake.apps[101].PressLinks) != 2 {
+		t.Fatalf("press links = %+v, want two stored", fake.apps[101].PressLinks)
+	}
+}
+
+func TestVerifyBotRejectsInvalidLinksWithAReason(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7108")
+
+	intro := sendToVerifyBot(t, svc, messages, owner.ID, "/start")
+	pressVerifyButton(t, svc, owner.ID, intro, verifyApplyButtonText)
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "@examplenews")
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "Media outlet")
+	sendToVerifyBot(t, svc, messages, owner.ID, verifyTestDescription)
+
+	// Not a URL, a non-web scheme, and an address the domain refuses as
+	// non-public (which is also what keeps a submitted link from becoming an SSRF
+	// probe).
+	for _, bad := range []string{"my site", "ftp://example.com", "http://127.0.0.1/admin", "https://localhost/x"} {
+		reply := sendToVerifyBot(t, svc, messages, owner.ID, bad)
+		if !strings.Contains(reply.Body, "http:// or https://") {
+			t.Fatalf("website %q answered %q, want the link rules", bad, reply.Body)
+		}
+		if fake.apps[101].OfficialWebsite != "" {
+			t.Fatalf("website %q was stored", bad)
+		}
+	}
+	// A short description is refused with the actual bar, not a generic error.
+	shortDesc := sendToVerifyBot(t, svc, messages, owner.ID, verifyTestWebsite)
+	if !strings.Contains(shortDesc.Body, "social media") {
+		t.Fatalf("valid website not accepted: %q", shortDesc.Body)
+	}
+}
+
+func TestVerifyBotDescriptionMinimumIsExplained(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7109")
+
+	intro := sendToVerifyBot(t, svc, messages, owner.ID, "/start")
+	pressVerifyButton(t, svc, owner.ID, intro, verifyApplyButtonText)
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "@examplenews")
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "Media outlet")
+
+	reply := sendToVerifyBot(t, svc, messages, owner.ID, "a newsroom")
+	if !strings.Contains(reply.Body, strconv.Itoa(domain.MinVerificationDescriptionLength)) {
+		t.Fatalf("short description answered %q, want the minimum length", reply.Body)
+	}
+	if fake.apps[101].Description != "" {
+		t.Fatalf("short description was stored: %q", fake.apps[101].Description)
+	}
+}
+
+func TestVerifyBotGlobalCommandsWorkMidStep(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7110")
+
+	intro := sendToVerifyBot(t, svc, messages, owner.ID, "/start")
+	pressVerifyButton(t, svc, owner.ID, intro, verifyApplyButtonText)
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "@examplenews")
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "Media outlet")
+
+	// /help in the middle of the description step answers help and keeps the step.
+	help := sendToVerifyBot(t, svc, messages, owner.ID, "/help")
+	if help.Body != verifyBotHelpText {
+		t.Fatalf("/help mid-step = %q", help.Body)
+	}
+	status := sendToVerifyBot(t, svc, messages, owner.ID, "/status")
+	if !strings.Contains(status.Body, "#101") {
+		t.Fatalf("/status mid-step = %q", status.Body)
+	}
+	resumed := sendToVerifyBot(t, svc, messages, owner.ID, verifyTestDescription)
+	if !strings.Contains(resumed.Body, "official website") {
+		t.Fatalf("description not accepted after global commands: %q", resumed.Body)
+	}
+	if fake.apps[101].Description != verifyTestDescription {
+		t.Fatalf("description = %q, want the step to have survived", fake.apps[101].Description)
+	}
+	// An unknown command is never swallowed as a field value.
+	unknown := sendToVerifyBot(t, svc, messages, owner.ID, "/nope")
+	if !strings.Contains(unknown.Body, "do not know that command") {
+		t.Fatalf("unknown command = %q", unknown.Body)
+	}
+	if fake.apps[101].OfficialWebsite != "" {
+		t.Fatalf("unknown command stored as a website: %q", fake.apps[101].OfficialWebsite)
+	}
+}
+
+func TestVerifyBotStatusListsApplicationsWithoutInternalNotes(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7111")
+
+	if empty := sendToVerifyBot(t, svc, messages, owner.ID, "/status"); empty.Body != verifyNoApplicationsText {
+		t.Fatalf("/status without applications = %q", empty.Body)
+	}
+
+	fake.apps[500] = domain.VerificationApplication{
+		ID: 500, ApplicantUserID: owner.ID,
+		TargetType: domain.VerificationTargetChannel, TargetID: 7001,
+		TargetTitle: "Example News", TargetUsername: "examplenews",
+		Status:         domain.VerificationStatusRejected,
+		DecisionReason: "the linked coverage does not mention the channel",
+		InternalNote:   "applicant argued with the reviewer",
+		ReviewedAt:     time.Date(2026, 7, 20, 9, 0, 0, 0, time.UTC),
+		Version:        4,
+	}
+	fake.apps[501] = domain.VerificationApplication{
+		ID: 501, ApplicantUserID: owner.ID,
+		TargetType: domain.VerificationTargetBot, TargetID: 8002, TargetUsername: "examplebot",
+		Status:      domain.VerificationStatusSubmitted,
+		SubmittedAt: time.Date(2026, 7, 25, 9, 0, 0, 0, time.UTC),
+		Version:     2,
+	}
+
+	reply := sendToVerifyBot(t, svc, messages, owner.ID, "/status")
+	for _, want := range []string{"#500", "#501", "@examplebot", "does not mention the channel", "2026-07-20"} {
+		if !strings.Contains(reply.Body, want) {
+			t.Fatalf("/status missing %q: %q", want, reply.Body)
+		}
+	}
+	if strings.Contains(reply.Body, "argued with the reviewer") {
+		t.Fatalf("/status leaked the internal note: %q", reply.Body)
+	}
+}
+
+func TestVerifyBotCancelWithdrawsTheOpenApplication(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7112")
+
+	if nothing := sendToVerifyBot(t, svc, messages, owner.ID, "/cancel"); nothing.Body != verifyNothingToCancelText {
+		t.Fatalf("/cancel with nothing open = %q", nothing.Body)
+	}
+
+	intro := sendToVerifyBot(t, svc, messages, owner.ID, "/start")
+	pressVerifyButton(t, svc, owner.ID, intro, verifyApplyButtonText)
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "@examplenews")
+
+	cancelled := sendToVerifyBot(t, svc, messages, owner.ID, "/cancel")
+	if !strings.Contains(cancelled.Body, "#101") || !strings.Contains(cancelled.Body, "withdrawn") {
+		t.Fatalf("/cancel = %q", cancelled.Body)
+	}
+	if fake.apps[101].Status != domain.VerificationStatusCancelled {
+		t.Fatalf("application status = %q after /cancel", fake.apps[101].Status)
+	}
+	// The dialog is gone with it, so a stale button cannot revive it.
+	idle := sendToVerifyBot(t, svc, messages, owner.ID, "still here?")
+	if idle.Body != verifyBotIdleText {
+		t.Fatalf("after /cancel, plain text = %q", idle.Body)
+	}
+}
+
+func TestVerifyBotCancelButtonWithdrawsFromInsideTheForm(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7113")
+
+	intro := sendToVerifyBot(t, svc, messages, owner.ID, "/start")
+	pressVerifyButton(t, svc, owner.ID, intro, verifyApplyButtonText)
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "@examplenews")
+	categories := latestVerifyReply(t, messages, owner.ID)
+
+	pressVerifyButton(t, svc, owner.ID, categories, verifyCancelButtonText)
+	if reply := latestVerifyReply(t, messages, owner.ID); !strings.Contains(reply.Body, "withdrawn") {
+		t.Fatalf("cancel button = %q", reply.Body)
+	}
+	if fake.apps[101].Status != domain.VerificationStatusCancelled {
+		t.Fatalf("application status = %q after the cancel button", fake.apps[101].Status)
+	}
+}
+
+func TestVerifyBotHelpAndIdleText(t *testing.T) {
+	fake := newFakeVerification()
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7114")
+
+	help := sendToVerifyBot(t, svc, messages, owner.ID, "/help")
+	for _, want := range []string{"/new", "/status", "/cancel", "/help"} {
+		if !strings.Contains(help.Body, want) {
+			t.Fatalf("/help missing %q: %q", want, help.Body)
+		}
+	}
+	assertReplyEntityText(t, help, domain.MessageEntityBotCommand, "/new")
+
+	// Nothing to verify: the requirement is stated instead of an empty picker.
+	if reply := sendToVerifyBot(t, svc, messages, owner.ID, "/new"); reply.Body != verifyNoTargetsText {
+		t.Fatalf("/new with no candidates = %q", reply.Body)
+	}
+}
+
+func TestVerifyBotShowsIneligibleTargetsWithTheirReason(t *testing.T) {
+	verified := verifyChannelTarget()
+	verified.Eligible = false
+	verified.Verified = true
+	verified.Reason = domain.ErrVerificationTargetAlreadyVerified.Error()
+	fake := newFakeVerification(verified)
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7115")
+
+	picker := sendToVerifyBot(t, svc, messages, owner.ID, "/new")
+	if !strings.Contains(picker.Body, "cannot be filed") && !strings.Contains(picker.Body, verifyNoEligibleText) {
+		t.Fatalf("picker with only ineligible candidates = %q", picker.Body)
+	}
+	answer := pressVerifyButton(t, svc, owner.ID, picker, "unavailable")
+	if !answer.Alert || !strings.Contains(answer.Message, "already verified") {
+		t.Fatalf("ineligible button answered %+v, want the reason", answer)
+	}
+	if fake.starts != 0 || len(fake.apps) != 0 {
+		t.Fatalf("ineligible button reached the service: starts=%d apps=%d", fake.starts, len(fake.apps))
+	}
+}
+
+func TestVerifyBotNewResumesTheOpenDraft(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7116")
+
+	intro := sendToVerifyBot(t, svc, messages, owner.ID, "/start")
+	pressVerifyButton(t, svc, owner.ID, intro, verifyApplyButtonText)
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "@examplenews")
+	pressVerifyButton(t, svc, owner.ID, latestVerifyReply(t, messages, owner.ID), "Media outlet")
+	sendToVerifyBot(t, svc, messages, owner.ID, verifyTestDescription)
+
+	resumed := sendToVerifyBot(t, svc, messages, owner.ID, "/new")
+	if !strings.Contains(resumed.Body, "#101") || !strings.Contains(resumed.Body, "official website") {
+		t.Fatalf("/new mid-draft = %q, want a resume at the website step", resumed.Body)
+	}
+	if len(fake.apps) != 1 {
+		t.Fatalf("applications = %d after /new mid-draft, want 1", len(fake.apps))
+	}
+}
+
+func TestVerifyBotWithoutServiceReportsUnavailable(t *testing.T) {
+	svc, users, messages := newVerifyBotTestService(t, nil)
+	owner := newOwner(t, users, "+7117")
+
+	if reply := sendToVerifyBot(t, svc, messages, owner.ID, "/new"); reply.Body != verifyUnavailableText {
+		t.Fatalf("/new without a verification service = %q", reply.Body)
+	}
+	if reply := sendToVerifyBot(t, svc, messages, owner.ID, "/help"); reply.Body != verifyBotHelpText {
+		t.Fatalf("/help without a verification service = %q", reply.Body)
+	}
+}
+
+func TestVerifyBotCallbackForForeignBotIsNotClaimed(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, _, _ := newVerifyBotTestService(t, fake)
+
+	if _, handled, err := svc.OnCallbackQuery(context.Background(), domain.BotCallbackQuery{
+		BotUserID: 555111, UserID: 900, Data: []byte("vb:whatever"),
+	}); handled || err != nil {
+		t.Fatalf("foreign bot callback handled=%v err=%v, want (false, nil)", handled, err)
+	}
+	// A built-in bot with no keyboards is claimed but answered empty, so the click
+	// cannot hang for the whole callback timeout.
+	answer, handled, err := svc.OnCallbackQuery(context.Background(), domain.BotCallbackQuery{
+		BotUserID: domain.BotFatherUserID, UserID: 900, Data: []byte("x"),
+	})
+	if !handled || err != nil || answer.Message != "" {
+		t.Fatalf("BotFather callback = (%+v, %v, %v)", answer, handled, err)
+	}
+}
+
+func TestVerifyBotSendVerificationNoticeNeverLeaksInternalNote(t *testing.T) {
+	fake := newFakeVerification()
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7118")
+	ctx := context.Background()
+
+	app := domain.VerificationApplication{
+		ID: 4242, ApplicantUserID: owner.ID,
+		TargetType: domain.VerificationTargetChannel, TargetID: 7001,
+		TargetTitle: "Example News", TargetUsername: "examplenews",
+		DecisionReason: "the coverage you linked does not mention the channel",
+		InternalNote:   "reviewer note: applicant is a repeat filer, escalate next time",
+	}
+
+	if err := svc.SendVerificationNotice(ctx, owner.ID, app, verificationapp.NoticeKindApproved); err != nil {
+		t.Fatalf("approved notice: %v", err)
+	}
+	approved := latestVerifyReply(t, messages, owner.ID)
+	for _, want := range []string{"#4242", "Example News", "@examplenews", "approved"} {
+		if !strings.Contains(approved.Body, want) {
+			t.Fatalf("approved notice missing %q: %q", want, approved.Body)
+		}
+	}
+	if strings.Contains(approved.Body, "repeat filer") {
+		t.Fatalf("approved notice leaked the internal note: %q", approved.Body)
+	}
+
+	if err := svc.SendVerificationNotice(ctx, owner.ID, app, verificationapp.NoticeKindRejected); err != nil {
+		t.Fatalf("rejected notice: %v", err)
+	}
+	rejected := latestVerifyReply(t, messages, owner.ID)
+	if !strings.Contains(rejected.Body, "#4242") || !strings.Contains(rejected.Body, "does not mention the channel") {
+		t.Fatalf("rejected notice = %q", rejected.Body)
+	}
+	if strings.Contains(rejected.Body, "repeat filer") || strings.Contains(rejected.Body, "escalate") {
+		t.Fatalf("rejected notice leaked the internal note: %q", rejected.Body)
+	}
+
+	if err := svc.SendVerificationNotice(ctx, owner.ID, app, verificationapp.NoticeKindRevoked); err != nil {
+		t.Fatalf("revoked notice: %v", err)
+	}
+	revoked := latestVerifyReply(t, messages, owner.ID)
+	if !strings.Contains(revoked.Body, "revoked") || strings.Contains(revoked.Body, "repeat filer") {
+		t.Fatalf("revoked notice = %q", revoked.Body)
+	}
+
+	// An unknown kind is reported rather than delivered as an empty message: the
+	// outbox row must stay pending instead of being marked delivered.
+	before := len(verifyBotReplies(t, messages, owner.ID))
+	if err := svc.SendVerificationNotice(ctx, owner.ID, app, "teleported"); err == nil {
+		t.Fatal("unknown notice kind reported success")
+	}
+	if got := len(verifyBotReplies(t, messages, owner.ID)); got != before {
+		t.Fatalf("unknown notice kind sent %d messages", got-before)
+	}
+	if err := svc.SendVerificationNotice(ctx, 0, app, verificationapp.NoticeKindApproved); err == nil {
+		t.Fatal("empty recipient reported success")
+	}
+}
+
+func TestVerifyBotSubmitBouncesAnIncompleteApplication(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7119")
+
+	summary := runVerifyApplication(t, svc, messages, owner.ID)
+	// Simulate a payload that lost a required field between rendering the summary
+	// and the press: Submit must send the applicant back, not file a broken record.
+	app := fake.apps[101]
+	app.PressLinks = nil
+	app.Version++
+	fake.apps[101] = app
+
+	pressVerifyButton(t, svc, owner.ID, summary, verifySubmitButtonText)
+	bounced := latestVerifyReply(t, messages, owner.ID)
+	if !strings.Contains(bounced.Body, "press coverage") {
+		t.Fatalf("incomplete submit = %q, want the press step", bounced.Body)
+	}
+	if fake.submits != 0 {
+		t.Fatalf("submits = %d for an incomplete application", fake.submits)
+	}
+}
+
+func TestVerifyBotPolicyRefusalsAreExplained(t *testing.T) {
+	fake := newFakeVerification(verifyChannelTarget())
+	fake.startErr = domain.ErrVerificationRateLimited
+	svc, users, messages := newVerifyBotTestService(t, fake)
+	owner := newOwner(t, users, "+7120")
+
+	picker := sendToVerifyBot(t, svc, messages, owner.ID, "/new")
+	pressVerifyButton(t, svc, owner.ID, picker, "@examplenews")
+	if reply := latestVerifyReply(t, messages, owner.ID); !strings.Contains(reply.Body, "limit on open applications") {
+		t.Fatalf("rate-limited StartDraft = %q", reply.Body)
+	}
+
+	fake.targetsErr = verificationapp.ErrDisabled
+	if reply := sendToVerifyBot(t, svc, messages, owner.ID, "/new"); reply.Body != verifyUnavailableText {
+		t.Fatalf("disabled verification = %q", reply.Body)
+	}
+	if !errors.Is(fake.targetsErr, verificationapp.ErrDisabled) {
+		t.Fatal("test setup lost the sentinel")
+	}
+}
--- a/internal/app/botverification/service.go
+++ b/internal/app/botverification/service.go
--- a/internal/app/botverification/service_test.go
+++ b/internal/app/botverification/service_test.go
--- a/internal/app/help/service.go
+++ b/internal/app/help/service.go
@ -55,9 +55,9 @@ const tdesktopClient = "tdesktop"
 //
 // WebK directly calls Array.some on fragment_prefixes while rendering user profiles,
 // so this compatibility key must always remain an array, even when it is empty.
-const tdesktopDefaultAppConfigBase = `{"chat_read_mark_expire_period":604800,"chat_read_mark_size_threshold":50,"pm_read_date_expire_period":604800,"quote_length_max":1024,"telegram_antispam_group_size_min":200,"telegram_antispam_user_id":"5434988373","fragment_prefixes":["888"],"forum_upgrade_participants_min":2,"reactions_default":{"_":"reactionEmoji","emoticon":"👍"},"reactions_uniq_max":11,"reactions_user_max_default":1,"reactions_user_max_premium":3,"reactions_in_chat_max":3,"boosts_channel_level_max":100,"rich_message_posting":"enabled","upload_markup_video":true,"emojies_send_dice":["🎲","🎯","🏀","⚽","⚽️","🎳","🎰"],"premium_purchase_blocked":false,"stars_purchase_blocked":false,"stargifts_blocked":false,"stargifts_pinned_to_top_limit":6,"stories_stealth_future_period":1500,"stories_stealth_past_period":300,"stories_stealth_cooldown_period":10800,"quick_replies_limit":100,"quick_reply_messages_limit":20,"business_chat_links_limit":100,"dialog_filters_enabled":true,"chatlist_update_period":3600,"chatlist_invites_limit_default":3,"chatlist_invites_limit_premium":20,"chatlists_joined_limit_default":2,"chatlists_joined_limit_premium":20,"about_length_limit_default":70,"about_length_limit_premium":140,"caption_length_limit_default":1024,"caption_length_limit_premium":4096,"channels_limit_default":500,"channels_limit_premium":1000,"channels_public_limit_default":10,"channels_public_limit_premium":20,"dialog_filters_limit_default":10,"dialog_filters_limit_premium":20,"dialog_filters_chats_limit_default":100,"dialog_filters_chats_limit_premium":200,"dialogs_pinned_limit_default":5,"dialogs_pinned_limit_premium":10,"dialogs_folder_pinned_limit_default":100,"dialogs_folder_pinned_limit_premium":200,"saved_dialogs_pinned_limit_default":5,"saved_dialogs_pinned_limit_premium":100,"saved_gifs_limit_default":200,"saved_gifs_limit_premium":400,"stickers_faved_limit_default":5,"stickers_faved_limit_premium":10,"recommended_channels_limit_default":10,"recommended_channels_limit_premium":100,"aicompose_tone_examples_num":3,"aicompose_tone_title_length_max":12,"aicompose_tone_prompt_length_max":1024,"aicompose_tone_saved_limit_default":5,"aicompose_tone_saved_limit_premium":20,"upload_max_fileparts_default":4000,"upload_max_fileparts_premium":8000`
+const tdesktopDefaultAppConfigBase = `{"chat_read_mark_expire_period":604800,"chat_read_mark_size_threshold":50,"pm_read_date_expire_period":604800,"quote_length_max":1024,"telegram_antispam_group_size_min":200,"telegram_antispam_user_id":"5434988373","fragment_prefixes":["888"],"forum_upgrade_participants_min":2,"reactions_default":{"_":"reactionEmoji","emoticon":"👍"},"reactions_uniq_max":11,"reactions_user_max_default":1,"reactions_user_max_premium":3,"reactions_in_chat_max":3,"boosts_channel_level_max":100,"rich_message_posting":"enabled","upload_markup_video":true,"emojies_send_dice":["🎲","🎯","🏀","⚽","⚽️","🎳","🎰"],"premium_purchase_blocked":false,"stars_purchase_blocked":false,"stargifts_blocked":false,"stargifts_pinned_to_top_limit":6,"stories_stealth_future_period":1500,"stories_stealth_past_period":300,"stories_stealth_cooldown_period":10800,"quick_replies_limit":100,"quick_reply_messages_limit":20,"business_chat_links_limit":100,"dialog_filters_enabled":true,"chatlist_update_period":3600,"chatlist_invites_limit_default":3,"chatlist_invites_limit_premium":20,"chatlists_joined_limit_default":2,"chatlists_joined_limit_premium":20,"about_length_limit_default":70,"about_length_limit_premium":140,"bot_verification_description_length_limit":70,"caption_length_limit_default":1024,"caption_length_limit_premium":4096,"channels_limit_default":500,"channels_limit_premium":1000,"channels_public_limit_default":10,"channels_public_limit_premium":20,"dialog_filters_limit_default":10,"dialog_filters_limit_premium":20,"dialog_filters_chats_limit_default":100,"dialog_filters_chats_limit_premium":200,"dialogs_pinned_limit_default":5,"dialogs_pinned_limit_premium":10,"dialogs_folder_pinned_limit_default":100,"dialogs_folder_pinned_limit_premium":200,"saved_dialogs_pinned_limit_default":5,"saved_dialogs_pinned_limit_premium":100,"saved_gifs_limit_default":200,"saved_gifs_limit_premium":400,"stickers_faved_limit_default":5,"stickers_faved_limit_premium":10,"recommended_channels_limit_default":10,"recommended_channels_limit_premium":100,"aicompose_tone_examples_num":3,"aicompose_tone_title_length_max":12,"aicompose_tone_prompt_length_max":1024,"aicompose_tone_saved_limit_default":5,"aicompose_tone_saved_limit_premium":20,"upload_max_fileparts_default":4000,"upload_max_fileparts_premium":8000`

-const defaultAppConfigHash = 24 // 默认 app config 内容变更时必须递增，否则缓存端只会收到 notModified。
+const defaultAppConfigHash = 25 // 默认 app config 内容变更时必须递增，否则缓存端只会收到 notModified。

 // Service 提供客户端启动配置与国家区号目录。
 //
--- a/internal/app/help/service_premium_test.go
+++ b/internal/app/help/service_premium_test.go
@ -45,39 +45,40 @@ func TestAppConfigPremiumKeys(t *testing.T) {
 		t.Fatalf("fragment_prefixes = %#v, want [\"888\"]", decoded["fragment_prefixes"])
 	}
 	wantNumbers := map[string]float64{
-		"reactions_user_max_default":          1,
-		"reactions_user_max_premium":          3,
-		"boosts_channel_level_max":            100,
-		"stargifts_pinned_to_top_limit":       6,
-		"about_length_limit_default":          70,
-		"about_length_limit_premium":          140,
-		"dialogs_pinned_limit_default":        5,
-		"dialogs_pinned_limit_premium":        10,
-		"dialogs_folder_pinned_limit_default": 100,
-		"dialogs_folder_pinned_limit_premium": 200,
-		"saved_dialogs_pinned_limit_default":  5,
-		"saved_dialogs_pinned_limit_premium":  100,
-		"caption_length_limit_default":        1024,
-		"caption_length_limit_premium":        4096,
-		"channels_limit_default":              500,
-		"channels_limit_premium":              1000,
-		"dialog_filters_limit_default":        10,
-		"dialog_filters_limit_premium":        20,
-		"chatlist_update_period":              3600,
-		"chatlist_invites_limit_default":      3,
-		"chatlist_invites_limit_premium":      20,
-		"chatlists_joined_limit_default":      2,
-		"chatlists_joined_limit_premium":      20,
-		"upload_max_fileparts_default":        4000,
-		"upload_max_fileparts_premium":        8000,
-		"aicompose_tone_examples_num":         3,
-		"aicompose_tone_title_length_max":     12,
-		"aicompose_tone_prompt_length_max":    1024,
-		"aicompose_tone_saved_limit_default":  5,
-		"aicompose_tone_saved_limit_premium":  20,
-		"stories_stealth_future_period":       1500,
-		"stories_stealth_past_period":         300,
-		"stories_stealth_cooldown_period":     10800,
+		"reactions_user_max_default":                1,
+		"reactions_user_max_premium":                3,
+		"boosts_channel_level_max":                  100,
+		"stargifts_pinned_to_top_limit":             6,
+		"about_length_limit_default":                70,
+		"about_length_limit_premium":                140,
+		"bot_verification_description_length_limit": 70,
+		"dialogs_pinned_limit_default":              5,
+		"dialogs_pinned_limit_premium":              10,
+		"dialogs_folder_pinned_limit_default":       100,
+		"dialogs_folder_pinned_limit_premium":       200,
+		"saved_dialogs_pinned_limit_default":        5,
+		"saved_dialogs_pinned_limit_premium":        100,
+		"caption_length_limit_default":              1024,
+		"caption_length_limit_premium":              4096,
+		"channels_limit_default":                    500,
+		"channels_limit_premium":                    1000,
+		"dialog_filters_limit_default":              10,
+		"dialog_filters_limit_premium":              20,
+		"chatlist_update_period":                    3600,
+		"chatlist_invites_limit_default":            3,
+		"chatlist_invites_limit_premium":            20,
+		"chatlists_joined_limit_default":            2,
+		"chatlists_joined_limit_premium":            20,
+		"upload_max_fileparts_default":              4000,
+		"upload_max_fileparts_premium":              8000,
+		"aicompose_tone_examples_num":               3,
+		"aicompose_tone_title_length_max":           12,
+		"aicompose_tone_prompt_length_max":          1024,
+		"aicompose_tone_saved_limit_default":        5,
+		"aicompose_tone_saved_limit_premium":        20,
+		"stories_stealth_future_period":             1500,
+		"stories_stealth_past_period":               300,
+		"stories_stealth_cooldown_period":           10800,
 	}
 	for key, want := range wantNumbers {
 		got, ok := decoded[key].(float64)
--- a/internal/app/rating/service.go
+++ b/internal/app/rating/service.go
@ -0,0 +1,453 @@
+// Package rating implements the composite account rating use cases: reading the
+// stored projection, recomputing it from the raw contribution signals, and
+// applying operator adjustments through the contribution ledger.
+//
+// This is an admin-only local model, not Telegram's Stars Rating protocol
+// surface. The service gathers signals, applies the configured weights and
+// pending-delay policy, and persists the result under optimistic concurrency.
+package rating
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"go.uber.org/zap"
+
+	"telesrv/internal/domain"
+	"telesrv/internal/store"
+)
+
+const (
+	// defaultPendingDelay parks a rating increase for a day, matching the
+	// shipped TELESRV_RATING_PENDING_DELAY default.
+	defaultPendingDelay = 24 * time.Hour
+	// defaultStaleAfter is the recompute horizon used when none is configured.
+	defaultStaleAfter = 6 * time.Hour
+	// defaultListLimit / maxListLimit bound one leaderboard page.
+	defaultListLimit = 50
+	maxListLimit     = 200
+	// defaultEventLimit / maxEventLimit bound one ledger page.
+	defaultEventLimit = 50
+	maxEventLimit     = 200
+	// defaultRecomputeBatch / maxRecomputeBatch bound one worker cycle.
+	defaultRecomputeBatch = 500
+	maxRecomputeBatch     = 10000
+)
+
+// ErrDisabled reports that the local composite rating feature is switched off.
+// Reads degrade to an empty admin projection; writes are refused so an operator
+// never believes an adjustment was recorded when it was not.
+var ErrDisabled = errors.New("account rating is disabled")
+
+// Service is the composite account rating use-case layer.
+type Service struct {
+	store        store.AccountRatingStore
+	weights      domain.AccountRatingWeights
+	pendingDelay time.Duration
+	staleAfter   time.Duration
+	enabled      bool
+
+	now func() time.Time
+	log *zap.Logger
+}
+
+// Option adjusts optional service dependencies.
+type Option func(*Service)
+
+// WithStore injects the rating read model and ledger store.
+func WithStore(st store.AccountRatingStore) Option {
+	return func(s *Service) { s.store = st }
+}
+
+// WithWeights installs the composite formula. An invalid set is rejected in
+// favour of the shipped defaults, so a misconfigured deployment produces a
+// conservative rating instead of an inconsistent one.
+func WithWeights(weights domain.AccountRatingWeights) Option {
+	return func(s *Service) {
+		if err := weights.Validate(); err != nil {
+			return
+		}
+		s.weights = weights
+	}
+}
+
+// WithPendingDelay configures how long a rating increase stays parked as
+// pending. Zero applies every change immediately.
+func WithPendingDelay(delay time.Duration) Option {
+	return func(s *Service) {
+		if delay >= 0 {
+			s.pendingDelay = delay
+		}
+	}
+}
+
+// WithStaleAfter configures the projection age after which the background
+// worker recomputes a user.
+func WithStaleAfter(staleAfter time.Duration) Option {
+	return func(s *Service) {
+		if staleAfter > 0 {
+			s.staleAfter = staleAfter
+		}
+	}
+}
+
+// WithEnabled toggles the feature.
+func WithEnabled(enabled bool) Option {
+	return func(s *Service) { s.enabled = enabled }
+}
+
+// WithClock injects the clock (tests).
+func WithClock(now func() time.Time) Option {
+	return func(s *Service) {
+		if now != nil {
+			s.now = now
+		}
+	}
+}
+
+// WithLogger injects the service logger.
+func WithLogger(log *zap.Logger) Option {
+	return func(s *Service) {
+		if log != nil {
+			s.log = log
+		}
+	}
+}
+
+// NewService creates the rating service. It is enabled by default so that the
+// only switch is the configuration flag, and it stays safe without a store:
+// reads answer empty and writes report a configuration error.
+func NewService(opts ...Option) *Service {
+	s := &Service{
+		weights:      domain.DefaultAccountRatingWeights(),
+		pendingDelay: defaultPendingDelay,
+		staleAfter:   defaultStaleAfter,
+		enabled:      true,
+		now:          time.Now,
+		log:          zap.NewNop(),
+	}
+	for _, opt := range opts {
+		if opt != nil {
+			opt(s)
+		}
+	}
+	if s.now == nil {
+		s.now = time.Now
+	}
+	if s.log == nil {
+		s.log = zap.NewNop()
+	}
+	if s.pendingDelay < 0 {
+		s.pendingDelay = 0
+	}
+	if s.staleAfter <= 0 {
+		s.staleAfter = defaultStaleAfter
+	}
+	if err := s.weights.Validate(); err != nil {
+		s.weights = domain.DefaultAccountRatingWeights()
+	}
+	return s
+}
+
+// Enabled reports whether the feature is switched on.
+func (s *Service) Enabled() bool { return s != nil && s.enabled }
+
+// Ready reports whether the feature is on and backed by a store.
+func (s *Service) Ready() bool { return s.Enabled() && s.store != nil }
+
+// Weights returns the configured composite formula, so the admin panel can
+// explain a level with the same numbers that produced it.
+func (s *Service) Weights() domain.AccountRatingWeights {
+	if s == nil {
+		return domain.DefaultAccountRatingWeights()
+	}
+	return s.weights
+}
+
+func (s *Service) ratingStore() (store.AccountRatingStore, error) {
+	if s == nil || s.store == nil {
+		return nil, fmt.Errorf("account rating store is not configured")
+	}
+	return s.store, nil
+}
+
+// Rating returns the stored projection.
+//
+// domain.ErrAccountRatingNotFound is propagated rather than flattened to a zero
+// value so the admin API can distinguish "not computed" from a computed zero.
+// A missing store reports a configuration error an operator can diagnose.
+func (s *Service) Rating(ctx context.Context, userID int64) (domain.AccountRating, error) {
+	if s == nil || !s.enabled || userID <= 0 {
+		return domain.AccountRating{}, domain.ErrAccountRatingNotFound
+	}
+	st, err := s.ratingStore()
+	if err != nil {
+		return domain.AccountRating{}, err
+	}
+	return st.AccountRating(ctx, userID)
+}
+
+// RatingBatch resolves several users in one round trip. Users without a stored
+// projection are absent from the map, so a disabled feature and an unconfigured
+// store both read as "nobody has a rating" -- the batch shape already encodes
+// absence and needs no error to express it.
+func (s *Service) RatingBatch(ctx context.Context, userIDs []int64) (map[int64]domain.AccountRating, error) {
+	if s == nil || !s.enabled || s.store == nil {
+		return map[int64]domain.AccountRating{}, nil
+	}
+	unique := make([]int64, 0, len(userIDs))
+	seen := make(map[int64]struct{}, len(userIDs))
+	for _, userID := range userIDs {
+		if userID <= 0 {
+			continue
+		}
+		if _, ok := seen[userID]; ok {
+			continue
+		}
+		seen[userID] = struct{}{}
+		unique = append(unique, userID)
+	}
+	if len(unique) == 0 {
+		return map[int64]domain.AccountRating{}, nil
+	}
+	batch, err := s.store.AccountRatingBatch(ctx, unique)
+	if err != nil {
+		return nil, err
+	}
+	if batch == nil {
+		return map[int64]domain.AccountRating{}, nil
+	}
+	return batch, nil
+}
+
+// Recompute gathers the contribution signals, applies the configured weights
+// and the pending-delay policy relative to the stored value, and persists the
+// result.
+//
+// The save is guarded by the stored version. A concurrent writer (another
+// recompute, an adjustment, the worker) only invalidates the base the pending
+// policy was resolved against, so exactly one retry against the freshly
+// returned row is both sufficient and terminating.
+func (s *Service) Recompute(ctx context.Context, userID int64) (domain.AccountRating, error) {
+	if s == nil || !s.enabled {
+		return domain.AccountRating{}, ErrDisabled
+	}
+	st, err := s.ratingStore()
+	if err != nil {
+		return domain.AccountRating{}, err
+	}
+	if userID <= 0 {
+		return domain.AccountRating{}, domain.ErrAccountRatingAdjustmentInvalid
+	}
+	// The service accounts are infrastructure, not participants. Refusing here as
+	// well as in the seeding query means an operator cannot create a rating for one
+	// by hand either -- the platform account is not flagged is_bot, so nothing else
+	// would stop it.
+	if !domain.RatableAccount(userID, false) {
+		return domain.AccountRating{}, domain.ErrAccountRatingAdjustmentInvalid
+	}
+	signals, err := st.AccountRatingSignals(ctx, userID)
+	if err != nil {
+		return domain.AccountRating{}, err
+	}
+	signals.UserID = userID
+	prev, err := s.previous(ctx, st, userID)
+	if err != nil {
+		return domain.AccountRating{}, err
+	}
+	now := s.now().UTC()
+	computed := domain.ComputeAccountRating(signals, s.weights, now)
+	stored, changed, err := st.SaveAccountRating(ctx, domain.ResolveAccountRatingPending(prev, computed, s.pendingDelay, now))
+	if err != nil {
+		return domain.AccountRating{}, err
+	}
+	if changed {
+		return stored, nil
+	}
+	// One retry: `stored` is the row that won the race, so resolving the pending
+	// policy against it produces the correct next version.
+	stored, changed, err = st.SaveAccountRating(ctx, domain.ResolveAccountRatingPending(stored, computed, s.pendingDelay, now))
+	if err != nil {
+		return domain.AccountRating{}, err
+	}
+	if !changed {
+		return stored, fmt.Errorf("recompute account rating %d: concurrent version conflict", userID)
+	}
+	return stored, nil
+}
+
+// Adjust records an operator adjustment in the contribution ledger and
+// immediately recomputes the projection, so the manual component is visible
+// without waiting for the background worker. Replaying the same CommandKey
+// records nothing and reports applied=false; the current rating is still
+// returned so a retried admin command stays idempotent.
+func (s *Service) Adjust(ctx context.Context, req domain.AdjustAccountRatingRequest) (domain.AccountRating, bool, error) {
+	if s == nil || !s.enabled {
+		return domain.AccountRating{}, false, ErrDisabled
+	}
+	st, err := s.ratingStore()
+	if err != nil {
+		return domain.AccountRating{}, false, err
+	}
+	if err := req.Validate(); err != nil {
+		return domain.AccountRating{}, false, err
+	}
+	_, applied, err := st.AdjustAccountRating(ctx, req)
+	if err != nil {
+		return domain.AccountRating{}, false, err
+	}
+	rating, err := s.Recompute(ctx, req.UserID)
+	if err != nil {
+		return domain.AccountRating{}, applied, err
+	}
+	return rating, applied, nil
+}
+
+// List is the admin leaderboard query with a bounded page size.
+func (s *Service) List(ctx context.Context, filter domain.AccountRatingFilter) ([]domain.AccountRating, error) {
+	if s == nil || !s.enabled {
+		return nil, nil
+	}
+	st, err := s.ratingStore()
+	if err != nil {
+		return nil, err
+	}
+	if filter.MinLevel < 0 {
+		filter.MinLevel = 0
+	}
+	if filter.MinLevel > domain.MaxAccountRatingLevel {
+		filter.MinLevel = domain.MaxAccountRatingLevel
+	}
+	filter.Limit = clampLimit(filter.Limit, defaultListLimit, maxListLimit)
+	return st.ListAccountRatings(ctx, filter)
+}
+
+// Events returns one user's contribution ledger, newest first.
+func (s *Service) Events(ctx context.Context, userID int64, limit int) ([]domain.AccountRatingEvent, error) {
+	if s == nil || !s.enabled {
+		return nil, nil
+	}
+	st, err := s.ratingStore()
+	if err != nil {
+		return nil, err
+	}
+	if userID <= 0 {
+		return nil, domain.ErrAccountRatingAdjustmentInvalid
+	}
+	return st.AccountRatingEvents(ctx, userID, clampLimit(limit, defaultEventLimit, maxEventLimit))
+}
+
+// RunRecomputeCycle advances the read model by one bounded batch and returns how
+// many users it wrote. A single user's failure is logged and skipped: one poisoned
+// row must not stall the whole cycle.
+//
+// The cycle does two things, and the order matters. It first refreshes projections
+// that have gone stale, because those are rows somebody is already looking at.
+// Whatever batch budget is left it spends seeding accounts that have no projection
+// at all -- without that pass the read model can never populate itself, since
+// StaleAccountRatings walks account_rating and cannot return a user who is not in
+// it. Staleness keeps existing ratings honest; seeding is what makes them exist at
+// all, which is what makes the admin leaderboard populate without an operator
+// opening every account first.
+func (s *Service) RunRecomputeCycle(ctx context.Context, limit int) (int, error) {
+	if s == nil || !s.enabled {
+		return 0, nil
+	}
+	st, err := s.ratingStore()
+	if err != nil {
+		return 0, err
+	}
+	limit = clampLimit(limit, defaultRecomputeBatch, maxRecomputeBatch)
+	olderThan := s.now().UTC().Add(-s.staleAfter).Unix()
+	userIDs, err := st.StaleAccountRatings(ctx, olderThan, limit)
+	if err != nil {
+		return 0, err
+	}
+	processed, err := s.recomputeEach(ctx, userIDs, "recompute account rating failed")
+	if err != nil {
+		return processed, err
+	}
+	// The bound belongs to the cycle, not to each pass, so a backlog of stale rows
+	// can never turn one cycle into an unbounded amount of work.
+	remaining := limit - len(userIDs)
+	if remaining <= 0 {
+		return processed, nil
+	}
+	unrated, err := st.UnratedAccounts(ctx, remaining)
+	if err != nil {
+		// Seeding extends the cycle rather than being its purpose: a store that
+		// cannot enumerate accounts must not turn a successful stale pass into a
+		// failed cycle.
+		s.log.Warn("list unrated accounts failed", zap.Error(err))
+		return processed, nil
+	}
+	seeded, err := s.recomputeEach(ctx, unrated, "seed account rating failed")
+	return processed + seeded, err
+}
+
+// recomputeEach recomputes a list of users, skipping the ones that fail, and
+// giving up early only when the context is done.
+func (s *Service) recomputeEach(ctx context.Context, userIDs []int64, failureMessage string) (int, error) {
+	processed := 0
+	for _, userID := range userIDs {
+		if err := ctx.Err(); err != nil {
+			return processed, err
+		}
+		if userID <= 0 {
+			continue
+		}
+		if _, err := s.Recompute(ctx, userID); err != nil {
+			s.log.Warn(failureMessage,
+				zap.Int64("user_id", userID),
+				zap.Error(err))
+			continue
+		}
+		processed++
+	}
+	return processed, nil
+}
+
+// EnsureRating returns the stored local-admin projection, computing and storing
+// it first when an administrative caller needs an immediate value.
+//
+// The background cycle reaches every account eventually; callers that require a
+// local rating immediately use this bounded materialization path instead.
+func (s *Service) EnsureRating(ctx context.Context, userID int64) (domain.AccountRating, error) {
+	if s == nil || !s.enabled || userID <= 0 {
+		return domain.AccountRating{}, domain.ErrAccountRatingNotFound
+	}
+	rating, err := s.Rating(ctx, userID)
+	if err == nil {
+		return rating, nil
+	}
+	if !errors.Is(err, domain.ErrAccountRatingNotFound) {
+		return domain.AccountRating{}, err
+	}
+	return s.Recompute(ctx, userID)
+}
+
+// previous reads the stored projection the pending policy is resolved against.
+// A never-computed user yields the zero value, which domain.ResolveAccountRating
+// Pending treats as "apply immediately" -- a first rating is never parked.
+func (s *Service) previous(ctx context.Context, st store.AccountRatingStore, userID int64) (domain.AccountRating, error) {
+	prev, err := st.AccountRating(ctx, userID)
+	if err != nil {
+		if errors.Is(err, domain.ErrAccountRatingNotFound) {
+			return domain.AccountRating{}, nil
+		}
+		return domain.AccountRating{}, err
+	}
+	return prev, nil
+}
+
+func clampLimit(limit, fallback, maximum int) int {
+	if limit <= 0 {
+		return fallback
+	}
+	if limit > maximum {
+		return maximum
+	}
+	return limit
+}
--- a/internal/app/rating/service_test.go
+++ b/internal/app/rating/service_test.go
@ -0,0 +1,719 @@
+package rating
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"telesrv/internal/domain"
+)
+
+var testNow = time.Date(2026, 7, 26, 12, 0, 0, 0, time.UTC)
+
+// fakeRatingStore is an in-memory AccountRatingStore with the same optimistic
+// concurrency contract as PostgreSQL: a save whose version does not follow the
+// stored one reports changed=false and returns the row that won.
+type fakeRatingStore struct {
+	signals map[int64]domain.AccountRatingSignals
+	ratings map[int64]domain.AccountRating
+	manual  map[int64]int64
+	events  map[int64][]domain.AccountRatingEvent
+	keys    map[string]domain.AccountRatingEvent
+
+	stale          []int64
+	staleOlderThan int64
+	staleLimit     int
+
+	unrated      []int64
+	unratedLimit int
+	unratedCalls int
+	unratedErr   error
+
+	saves          []domain.AccountRating
+	forceConflicts int
+	signalsErr     error
+}
+
+func newFakeRatingStore() *fakeRatingStore {
+	return &fakeRatingStore{
+		signals: map[int64]domain.AccountRatingSignals{},
+		ratings: map[int64]domain.AccountRating{},
+		manual:  map[int64]int64{},
+		events:  map[int64][]domain.AccountRatingEvent{},
+		keys:    map[string]domain.AccountRatingEvent{},
+	}
+}
+
+func (f *fakeRatingStore) AccountRating(_ context.Context, userID int64) (domain.AccountRating, error) {
+	rating, ok := f.ratings[userID]
+	if !ok {
+		return domain.AccountRating{}, domain.ErrAccountRatingNotFound
+	}
+	return rating, nil
+}
+
+func (f *fakeRatingStore) AccountRatingBatch(_ context.Context, userIDs []int64) (map[int64]domain.AccountRating, error) {
+	out := make(map[int64]domain.AccountRating, len(userIDs))
+	for _, userID := range userIDs {
+		if rating, ok := f.ratings[userID]; ok {
+			out[userID] = rating
+		}
+	}
+	return out, nil
+}
+
+func (f *fakeRatingStore) SaveAccountRating(_ context.Context, rating domain.AccountRating) (domain.AccountRating, bool, error) {
+	f.saves = append(f.saves, rating)
+	current := f.ratings[rating.UserID]
+	if f.forceConflicts > 0 {
+		f.forceConflicts--
+		return current, false, nil
+	}
+	if rating.Version != current.Version+1 {
+		return current, false, nil
+	}
+	f.ratings[rating.UserID] = rating
+	return rating, true, nil
+}
+
+func (f *fakeRatingStore) AccountRatingSignals(_ context.Context, userID int64) (domain.AccountRatingSignals, error) {
+	if f.signalsErr != nil {
+		return domain.AccountRatingSignals{}, f.signalsErr
+	}
+	signals := f.signals[userID]
+	signals.UserID = userID
+	signals.Manual = f.manual[userID]
+	return signals, nil
+}
+
+func (f *fakeRatingStore) AdjustAccountRating(_ context.Context, req domain.AdjustAccountRatingRequest) (domain.AccountRatingEvent, bool, error) {
+	if req.CommandKey != "" {
+		if event, ok := f.keys[req.CommandKey]; ok {
+			return event, false, nil
+		}
+	}
+	event := domain.AccountRatingEvent{
+		ID: int64(len(f.events[req.UserID]) + 1), UserID: req.UserID, Kind: domain.AccountRatingEventManual,
+		Amount: req.Amount, Reason: req.Reason, Actor: req.Actor, CommandKey: req.CommandKey, CreatedAt: testNow,
+	}
+	f.events[req.UserID] = append(f.events[req.UserID], event)
+	f.manual[req.UserID] += req.Amount
+	if req.CommandKey != "" {
+		f.keys[req.CommandKey] = event
+	}
+	return event, true, nil
+}
+
+func (f *fakeRatingStore) ListAccountRatings(_ context.Context, filter domain.AccountRatingFilter) ([]domain.AccountRating, error) {
+	out := make([]domain.AccountRating, 0, len(f.ratings))
+	for _, rating := range f.ratings {
+		if rating.Level >= filter.MinLevel {
+			out = append(out, rating)
+		}
+		if len(out) >= filter.Limit {
+			break
+		}
+	}
+	return out, nil
+}
+
+func (f *fakeRatingStore) AccountRatingEvents(_ context.Context, userID int64, limit int) ([]domain.AccountRatingEvent, error) {
+	events := f.events[userID]
+	if len(events) > limit {
+		events = events[:limit]
+	}
+	return append([]domain.AccountRatingEvent(nil), events...), nil
+}
+
+func (f *fakeRatingStore) StaleAccountRatings(_ context.Context, olderThanUnix int64, limit int) ([]int64, error) {
+	f.staleOlderThan = olderThanUnix
+	f.staleLimit = limit
+	if len(f.stale) > limit {
+		return append([]int64(nil), f.stale[:limit]...), nil
+	}
+	return append([]int64(nil), f.stale...), nil
+}
+
+func (f *fakeRatingStore) UnratedAccounts(_ context.Context, limit int) ([]int64, error) {
+	f.unratedCalls++
+	f.unratedLimit = limit
+	if f.unratedErr != nil {
+		return nil, f.unratedErr
+	}
+	out := make([]int64, 0, len(f.unrated))
+	for _, userID := range f.unrated {
+		if _, rated := f.ratings[userID]; rated {
+			continue
+		}
+		out = append(out, userID)
+		if len(out) == limit {
+			break
+		}
+	}
+	return out, nil
+}
+
+func newTestService(st *fakeRatingStore, opts ...Option) *Service {
+	base := []Option{WithStore(st), WithClock(func() time.Time { return testNow })}
+	return NewService(append(base, opts...)...)
+}
+
+func TestRecomputeAppliesConfiguredWeights(t *testing.T) {
+	st := newFakeRatingStore()
+	st.signals[7] = domain.AccountRatingSignals{
+		StarsReceived: 1000, StarsSpent: 400, MessagesSent: 30, AccountAgeDays: 10,
+		GiftsReceived: 2, ModerationCases: 1,
+	}
+	service := newTestService(st)
+
+	rating, err := service.Recompute(context.Background(), 7)
+	if err != nil {
+		t.Fatalf("Recompute: %v", err)
+	}
+	weights := domain.DefaultAccountRatingWeights()
+	want := domain.ComputeAccountRating(domain.AccountRatingSignals{
+		UserID: 7, StarsReceived: 1000, StarsSpent: 400, MessagesSent: 30, AccountAgeDays: 10,
+		GiftsReceived: 2, ModerationCases: 1,
+	}, weights, testNow)
+	if rating.Stars != want.Stars || rating.Level != want.Level ||
+		rating.StarsComponent != want.StarsComponent || rating.ActivityComponent != want.ActivityComponent ||
+		rating.PenaltyComponent != want.PenaltyComponent {
+		t.Fatalf("rating = %#v, want the domain formula result %#v", rating, want)
+	}
+	if rating.Version != 1 {
+		t.Fatalf("first stored version = %d, want 1", rating.Version)
+	}
+	if !rating.ComputedAt.Equal(testNow) {
+		t.Fatalf("ComputedAt = %v, want the injected clock %v", rating.ComputedAt, testNow)
+	}
+}
+
+func TestRecomputePendingPolicy(t *testing.T) {
+	t.Run("increase is parked", func(t *testing.T) {
+		st := newFakeRatingStore()
+		st.ratings[7] = domain.AccountRating{UserID: 7, Stars: 100, Level: 1, Version: 4}
+		st.signals[7] = domain.AccountRatingSignals{StarsReceived: 500}
+		service := newTestService(st, WithPendingDelay(24*time.Hour))
+
+		rating, err := service.Recompute(context.Background(), 7)
+		if err != nil {
+			t.Fatalf("Recompute: %v", err)
+		}
+		if rating.Stars != 100 {
+			t.Fatalf("visible stars = %d, want the previous 100 while the increase is pending", rating.Stars)
+		}
+		if rating.PendingStars != 400 {
+			t.Fatalf("pending stars = %d, want 400", rating.PendingStars)
+		}
+		if want := testNow.Add(24 * time.Hour); !rating.PendingDate.Equal(want) {
+			t.Fatalf("pending date = %v, want %v", rating.PendingDate, want)
+		}
+		if rating.Version != 5 {
+			t.Fatalf("version = %d, want 5", rating.Version)
+		}
+	})
+
+	t.Run("decrease applies immediately", func(t *testing.T) {
+		st := newFakeRatingStore()
+		st.ratings[7] = domain.AccountRating{UserID: 7, Stars: 500, Level: 2, Version: 1}
+		st.signals[7] = domain.AccountRatingSignals{StarsReceived: 500, Scam: true}
+		service := newTestService(st, WithPendingDelay(24*time.Hour))
+
+		rating, err := service.Recompute(context.Background(), 7)
+		if err != nil {
+			t.Fatalf("Recompute: %v", err)
+		}
+		if rating.Stars != 0 || rating.PendingStars != 0 {
+			t.Fatalf("rating = %d stars / %d pending, want a penalty applied at once", rating.Stars, rating.PendingStars)
+		}
+		if rating.PenaltyComponent != domain.DefaultAccountRatingWeights().ScamPenalty {
+			t.Fatalf("penalty = %d, want the scam penalty", rating.PenaltyComponent)
+		}
+	})
+
+	t.Run("expired parking is folded into the visible rating", func(t *testing.T) {
+		st := newFakeRatingStore()
+		st.ratings[7] = domain.AccountRating{
+			UserID: 7, Stars: 100, Level: 1, Version: 2,
+			PendingStars: 400, PendingDate: testNow.Add(-time.Hour),
+		}
+		st.signals[7] = domain.AccountRatingSignals{StarsReceived: 500}
+		service := newTestService(st, WithPendingDelay(24*time.Hour))
+
+		rating, err := service.Recompute(context.Background(), 7)
+		if err != nil {
+			t.Fatalf("Recompute: %v", err)
+		}
+		if rating.Stars != 500 || rating.PendingStars != 0 || !rating.PendingDate.IsZero() {
+			t.Fatalf("rating = %#v, want the parked delta applied and cleared", rating)
+		}
+	})
+
+	t.Run("zero delay never parks", func(t *testing.T) {
+		st := newFakeRatingStore()
+		st.ratings[7] = domain.AccountRating{UserID: 7, Stars: 100, Version: 1}
+		st.signals[7] = domain.AccountRatingSignals{StarsReceived: 500}
+		service := newTestService(st, WithPendingDelay(0))
+
+		rating, err := service.Recompute(context.Background(), 7)
+		if err != nil {
+			t.Fatalf("Recompute: %v", err)
+		}
+		if rating.Stars != 500 || rating.PendingStars != 0 {
+			t.Fatalf("rating = %d stars / %d pending, want an immediate apply", rating.Stars, rating.PendingStars)
+		}
+	})
+}
+
+func TestRecomputeRetriesOnceOnVersionConflict(t *testing.T) {
+	st := newFakeRatingStore()
+	st.ratings[7] = domain.AccountRating{UserID: 7, Stars: 100, Version: 3}
+	st.signals[7] = domain.AccountRatingSignals{StarsReceived: 200}
+	st.forceConflicts = 1
+	service := newTestService(st, WithPendingDelay(0))
+
+	rating, err := service.Recompute(context.Background(), 7)
+	if err != nil {
+		t.Fatalf("Recompute: %v", err)
+	}
+	if len(st.saves) != 2 {
+		t.Fatalf("saves = %d, want exactly one retry", len(st.saves))
+	}
+	if rating.Version != 4 || rating.Stars != 200 {
+		t.Fatalf("rating = %#v, want version 4 with 200 stars", rating)
+	}
+}
+
+func TestRecomputeFailsAfterPersistentConflict(t *testing.T) {
+	st := newFakeRatingStore()
+	st.signals[7] = domain.AccountRatingSignals{StarsReceived: 200}
+	st.forceConflicts = 2
+	service := newTestService(st)
+
+	if _, err := service.Recompute(context.Background(), 7); err == nil {
+		t.Fatal("Recompute reported success while every save lost the version race")
+	}
+	if len(st.saves) != 2 {
+		t.Fatalf("saves = %d, want the bounded single retry", len(st.saves))
+	}
+}
+
+func TestAdjustRecordsLedgerAndRecomputes(t *testing.T) {
+	st := newFakeRatingStore()
+	st.signals[7] = domain.AccountRatingSignals{StarsReceived: 100}
+	service := newTestService(st, WithPendingDelay(0))
+
+	rating, applied, err := service.Adjust(context.Background(), domain.AdjustAccountRatingRequest{
+		UserID: 7, Amount: 300, Reason: "support compensation", Actor: "admin", CommandKey: "cmd-1",
+	})
+	if err != nil || !applied {
+		t.Fatalf("Adjust = %v, %v", applied, err)
+	}
+	if rating.ManualComponent != 300 || rating.Stars != 400 {
+		t.Fatalf("rating = %#v, want the manual component folded in", rating)
+	}
+	if len(st.events[7]) != 1 {
+		t.Fatalf("ledger rows = %d, want 1", len(st.events[7]))
+	}
+}
+
+func TestAdjustReplayByCommandKeyIsIdempotent(t *testing.T) {
+	st := newFakeRatingStore()
+	st.signals[7] = domain.AccountRatingSignals{StarsReceived: 100}
+	service := newTestService(st, WithPendingDelay(0))
+	req := domain.AdjustAccountRatingRequest{UserID: 7, Amount: 300, Actor: "admin", CommandKey: "cmd-1"}
+
+	first, applied, err := service.Adjust(context.Background(), req)
+	if err != nil || !applied {
+		t.Fatalf("first Adjust = %v, %v", applied, err)
+	}
+	second, applied, err := service.Adjust(context.Background(), req)
+	if err != nil {
+		t.Fatalf("replayed Adjust: %v", err)
+	}
+	if applied {
+		t.Fatal("replayed Adjust reported applied=true")
+	}
+	if len(st.events[7]) != 1 || st.manual[7] != 300 {
+		t.Fatalf("ledger = %d rows / manual %d, want the replay recorded nothing", len(st.events[7]), st.manual[7])
+	}
+	if second.Stars != first.Stars || second.ManualComponent != first.ManualComponent {
+		t.Fatalf("replayed rating = %#v, want the same score as %#v", second, first)
+	}
+}
+
+func TestAdjustValidatesRequest(t *testing.T) {
+	st := newFakeRatingStore()
+	service := newTestService(st)
+	tests := []domain.AdjustAccountRatingRequest{
+		{UserID: 0, Amount: 10},
+		{UserID: 7, Amount: 0},
+		{UserID: 7, Amount: 10, Reason: string(make([]byte, domain.MaxAccountRatingReasonLength+1))},
+	}
+	for _, req := range tests {
+		if _, _, err := service.Adjust(context.Background(), req); !errors.Is(err, domain.ErrAccountRatingAdjustmentInvalid) {
+			t.Fatalf("Adjust(%#v) error = %v, want ErrAccountRatingAdjustmentInvalid", req, err)
+		}
+	}
+	if len(st.events) != 0 || len(st.saves) != 0 {
+		t.Fatal("store was touched by an invalid adjustment")
+	}
+}
+
+func TestRunRecomputeCycleProcessesTheBatch(t *testing.T) {
+	st := newFakeRatingStore()
+	st.stale = []int64{1, 2, 3}
+	for _, userID := range st.stale {
+		st.signals[userID] = domain.AccountRatingSignals{StarsReceived: 100 * userID}
+	}
+	service := newTestService(st, WithStaleAfter(6*time.Hour))
+
+	processed, err := service.RunRecomputeCycle(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("RunRecomputeCycle: %v", err)
+	}
+	if processed != 3 {
+		t.Fatalf("processed = %d, want 3", processed)
+	}
+	if st.staleLimit != 10 {
+		t.Fatalf("stale limit = %d, want the requested 10", st.staleLimit)
+	}
+	if want := testNow.Add(-6 * time.Hour).Unix(); st.staleOlderThan != want {
+		t.Fatalf("stale horizon = %d, want %d", st.staleOlderThan, want)
+	}
+	for _, userID := range st.stale {
+		if _, ok := st.ratings[userID]; !ok {
+			t.Fatalf("user %d was not recomputed", userID)
+		}
+	}
+}
+
+func TestRunRecomputeCycleSkipsFailingUsers(t *testing.T) {
+	st := newFakeRatingStore()
+	st.stale = []int64{1, 0, 2}
+	st.forceConflicts = 2 // both saves of the first user lose the race
+	service := newTestService(st)
+
+	processed, err := service.RunRecomputeCycle(context.Background(), 0)
+	if err != nil {
+		t.Fatalf("RunRecomputeCycle: %v", err)
+	}
+	if processed != 1 {
+		t.Fatalf("processed = %d, want the surviving user only", processed)
+	}
+	if st.staleLimit != defaultRecomputeBatch {
+		t.Fatalf("stale limit = %d, want the default batch", st.staleLimit)
+	}
+}
+
+func TestReadPathsDegradeWhenDisabled(t *testing.T) {
+	st := newFakeRatingStore()
+	st.ratings[7] = domain.AccountRating{UserID: 7, Stars: 500, Level: 2, Version: 1}
+	service := newTestService(st, WithEnabled(false))
+
+	if service.Enabled() || service.Ready() {
+		t.Fatal("disabled service reported enabled/ready")
+	}
+	// The userFull projection omits both TL flags on this error, which is exactly
+	// the pre-rating wire shape.
+	if _, err := service.Rating(context.Background(), 7); !errors.Is(err, domain.ErrAccountRatingNotFound) {
+		t.Fatalf("Rating error = %v, want ErrAccountRatingNotFound", err)
+	}
+	batch, err := service.RatingBatch(context.Background(), []int64{7})
+	if err != nil || len(batch) != 0 {
+		t.Fatalf("RatingBatch = %#v, %v; want empty", batch, err)
+	}
+	if _, err := service.Recompute(context.Background(), 7); !errors.Is(err, ErrDisabled) {
+		t.Fatalf("Recompute error = %v, want ErrDisabled", err)
+	}
+	if _, _, err := service.Adjust(context.Background(), domain.AdjustAccountRatingRequest{UserID: 7, Amount: 5}); !errors.Is(err, ErrDisabled) {
+		t.Fatalf("Adjust error = %v, want ErrDisabled", err)
+	}
+	processed, err := service.RunRecomputeCycle(context.Background(), 10)
+	if err != nil || processed != 0 {
+		t.Fatalf("RunRecomputeCycle = %d, %v; want a no-op", processed, err)
+	}
+}
+
+func TestUnconfiguredStoreReportsConfiguration(t *testing.T) {
+	service := NewService()
+	if service.Ready() {
+		t.Fatal("Ready = true without a store")
+	}
+	if _, err := service.Rating(context.Background(), 7); err == nil {
+		t.Fatal("Rating accepted a missing store")
+	}
+	if _, err := service.Recompute(context.Background(), 7); err == nil {
+		t.Fatal("Recompute accepted a missing store")
+	}
+	if _, _, err := service.Adjust(context.Background(), domain.AdjustAccountRatingRequest{UserID: 7, Amount: 5}); err == nil {
+		t.Fatal("Adjust accepted a missing store")
+	}
+	if _, err := service.RunRecomputeCycle(context.Background(), 10); err == nil {
+		t.Fatal("RunRecomputeCycle accepted a missing store")
+	}
+}
+
+func TestNilServiceIsSafe(t *testing.T) {
+	var service *Service
+	if service.Enabled() || service.Ready() {
+		t.Fatal("nil service reported enabled/ready")
+	}
+	if got := service.Weights(); got != domain.DefaultAccountRatingWeights() {
+		t.Fatalf("nil service weights = %#v, want the defaults", got)
+	}
+	if _, err := service.Rating(context.Background(), 7); !errors.Is(err, domain.ErrAccountRatingNotFound) {
+		t.Fatalf("nil service Rating error = %v, want ErrAccountRatingNotFound", err)
+	}
+	if batch, err := service.RatingBatch(context.Background(), []int64{7}); err != nil || len(batch) != 0 {
+		t.Fatalf("nil service RatingBatch = %#v, %v; want empty", batch, err)
+	}
+	if _, err := service.Recompute(context.Background(), 7); !errors.Is(err, ErrDisabled) {
+		t.Fatalf("nil service Recompute error = %v, want ErrDisabled", err)
+	}
+	if processed, err := service.RunRecomputeCycle(context.Background(), 10); err != nil || processed != 0 {
+		t.Fatalf("nil service RunRecomputeCycle = %d, %v", processed, err)
+	}
+}
+
+func TestInvalidWeightsFallBackToDefaults(t *testing.T) {
+	st := newFakeRatingStore()
+	service := newTestService(st, WithWeights(domain.AccountRatingWeights{StarsReceivedPermille: -1}))
+	if got := service.Weights(); got != domain.DefaultAccountRatingWeights() {
+		t.Fatalf("weights = %#v, want the defaults after rejecting a negative set", got)
+	}
+}
+
+func TestListAndEventsBoundThePage(t *testing.T) {
+	st := newFakeRatingStore()
+	st.ratings[7] = domain.AccountRating{UserID: 7, Level: 3, Version: 1}
+	for i := range maxEventLimit + 10 {
+		st.events[7] = append(st.events[7], domain.AccountRatingEvent{ID: int64(i + 1), UserID: 7, Amount: 1})
+	}
+	service := newTestService(st)
+
+	list, err := service.List(context.Background(), domain.AccountRatingFilter{MinLevel: -5, Limit: 0})
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(list) != 1 {
+		t.Fatalf("List = %d rows, want 1", len(list))
+	}
+	events, err := service.Events(context.Background(), 7, 100000)
+	if err != nil {
+		t.Fatalf("Events: %v", err)
+	}
+	if len(events) != maxEventLimit {
+		t.Fatalf("Events = %d rows, want the %d cap", len(events), maxEventLimit)
+	}
+	if _, err := service.Events(context.Background(), 0, 10); !errors.Is(err, domain.ErrAccountRatingAdjustmentInvalid) {
+		t.Fatalf("Events accepted a zero user id")
+	}
+}
+
+func TestRecomputeWorkerRunsAndStops(t *testing.T) {
+	st := newFakeRatingStore()
+	st.stale = []int64{1}
+	st.signals[1] = domain.AccountRatingSignals{StarsReceived: 100}
+	service := newTestService(st)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		NewRecomputeWorker(service, nil, time.Hour, 10).Run(ctx)
+	}()
+	// The first cycle runs before the ticker, so cancelling immediately still
+	// leaves exactly one recompute behind.
+	<-time.After(20 * time.Millisecond)
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("worker did not stop on context cancellation")
+	}
+	if _, ok := st.ratings[1]; !ok {
+		t.Fatal("worker did not recompute the stale user")
+	}
+}
+
+func TestRecomputeWorkerExitsWhenNotReady(t *testing.T) {
+	worker := NewRecomputeWorker(newTestService(newFakeRatingStore(), WithEnabled(false)), nil, time.Millisecond, 0)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		worker.Run(context.Background())
+	}()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("disabled worker kept running")
+	}
+	if worker.batch != defaultRecomputeBatch {
+		t.Fatalf("batch = %d, want the default fallback", worker.batch)
+	}
+}
+
+// TestRunRecomputeCycleSeedsAccountsWithNoProjection is the report "the ratings tab
+// is empty and no client shows a rating". StaleAccountRatings reads account_rating,
+// so it can only ever refresh rows that already exist; without a seeding pass the
+// very first row for a user has to come from an operator recomputing that user by
+// hand, and the read model stays permanently empty.
+func TestRunRecomputeCycleSeedsAccountsWithNoProjection(t *testing.T) {
+	st := newFakeRatingStore()
+	st.unrated = []int64{11, 12, 13}
+	for _, userID := range st.unrated {
+		st.signals[userID] = domain.AccountRatingSignals{StarsReceived: 100 * userID}
+	}
+	service := newTestService(st)
+
+	processed, err := service.RunRecomputeCycle(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("RunRecomputeCycle: %v", err)
+	}
+	if processed != 3 {
+		t.Fatalf("processed = %d, want the three seeded accounts", processed)
+	}
+	for _, userID := range st.unrated {
+		if _, ok := st.ratings[userID]; !ok {
+			t.Fatalf("account %d was not seeded", userID)
+		}
+	}
+	// A second cycle has nothing left to seed, so seeding converges instead of
+	// rewriting the same rows every interval.
+	if processed, err := service.RunRecomputeCycle(context.Background(), 10); err != nil || processed != 0 {
+		t.Fatalf("second cycle = %d,%v, want 0,nil", processed, err)
+	}
+}
+
+// The batch bound belongs to the cycle, not to each pass: a backlog of stale rows
+// must not let one cycle do an unbounded amount of work.
+func TestRunRecomputeCycleSharesTheBatchBudget(t *testing.T) {
+	st := newFakeRatingStore()
+	st.stale = []int64{1, 2}
+	st.unrated = []int64{11, 12, 13, 14}
+	service := newTestService(st)
+
+	processed, err := service.RunRecomputeCycle(context.Background(), 3)
+	if err != nil {
+		t.Fatalf("RunRecomputeCycle: %v", err)
+	}
+	if processed != 3 {
+		t.Fatalf("processed = %d, want the batch bound of 3", processed)
+	}
+	if st.unratedLimit != 1 {
+		t.Fatalf("seeding limit = %d, want the 1 left after two stale rows", st.unratedLimit)
+	}
+
+	// A cycle whose stale pass already fills the batch does not query for seeds at
+	// all: refreshing rows somebody is looking at comes first.
+	full := newFakeRatingStore()
+	full.stale = []int64{1, 2, 3}
+	full.unrated = []int64{11}
+	if _, err := newTestService(full).RunRecomputeCycle(context.Background(), 3); err != nil {
+		t.Fatalf("RunRecomputeCycle: %v", err)
+	}
+	if full.unratedCalls != 0 {
+		t.Fatalf("seeding was queried %d times, want none when the batch is already full", full.unratedCalls)
+	}
+}
+
+// Seeding extends the cycle; it is not its purpose. A store that cannot enumerate
+// accounts must not turn a successful stale pass into a failed cycle.
+func TestRunRecomputeCycleSurvivesSeedingFailure(t *testing.T) {
+	st := newFakeRatingStore()
+	st.stale = []int64{1}
+	st.unratedErr = errors.New("no users table")
+	service := newTestService(st)
+
+	processed, err := service.RunRecomputeCycle(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("RunRecomputeCycle = %v, want the stale pass to stand", err)
+	}
+	if processed != 1 {
+		t.Fatalf("processed = %d, want the one stale row", processed)
+	}
+}
+
+// TestEnsureRatingMaterializesOnce covers an administrative immediate-read path:
+// when the worker has not reached an account yet, the first read materializes the
+// local projection and the second read must not write again.
+func TestEnsureRatingMaterializesOnce(t *testing.T) {
+	st := newFakeRatingStore()
+	st.signals[7] = domain.AccountRatingSignals{StarsReceived: 900}
+	service := newTestService(st)
+
+	if _, err := service.Rating(context.Background(), 7); !errors.Is(err, domain.ErrAccountRatingNotFound) {
+		t.Fatalf("Rating before materialising = %v, want ErrAccountRatingNotFound", err)
+	}
+	rating, err := service.EnsureRating(context.Background(), 7)
+	if err != nil {
+		t.Fatalf("EnsureRating: %v", err)
+	}
+	if rating.UserID != 7 || rating.Stars == 0 {
+		t.Fatalf("materialised rating = %+v, want a computed rating for user 7", rating)
+	}
+	writes := len(st.saves)
+	again, err := service.EnsureRating(context.Background(), 7)
+	if err != nil {
+		t.Fatalf("second EnsureRating: %v", err)
+	}
+	if again.Version != rating.Version {
+		t.Fatalf("second EnsureRating rewrote the row: version %d then %d", rating.Version, again.Version)
+	}
+	if len(st.saves) != writes {
+		t.Fatalf("second EnsureRating issued %d extra saves, want none", len(st.saves)-writes)
+	}
+}
+
+// A disabled feature materialises nothing. Telegram wire fields remain unset
+// independently of this local feature flag.
+func TestEnsureRatingDisabledStaysEmpty(t *testing.T) {
+	st := newFakeRatingStore()
+	st.signals[7] = domain.AccountRatingSignals{StarsReceived: 900}
+	service := newTestService(st, WithEnabled(false))
+
+	if _, err := service.EnsureRating(context.Background(), 7); !errors.Is(err, domain.ErrAccountRatingNotFound) {
+		t.Fatalf("EnsureRating while disabled = %v, want ErrAccountRatingNotFound", err)
+	}
+	if len(st.saves) != 0 {
+		t.Fatalf("EnsureRating while disabled wrote %d rows, want none", len(st.saves))
+	}
+}
+
+// TestRecomputeRefusesServiceAccounts pins that the platform account and the
+// built-in bots carry no rating. The platform account is not flagged is_bot, so the
+// bot exclusion in the seeding query does not cover it -- which is how it acquired a
+// rating in the first place -- and an operator must not be able to create one by
+// hand either.
+func TestRecomputeRefusesServiceAccounts(t *testing.T) {
+	for _, userID := range domain.SystemUserIDs() {
+		st := newFakeRatingStore()
+		st.signals[userID] = domain.AccountRatingSignals{StarsReceived: 5000}
+		st.unrated = []int64{userID}
+		service := newTestService(st)
+
+		if _, err := service.Recompute(context.Background(), userID); !errors.Is(err, domain.ErrAccountRatingAdjustmentInvalid) {
+			t.Fatalf("Recompute(%d) = %v, want ErrAccountRatingAdjustmentInvalid", userID, err)
+		}
+		if _, err := service.EnsureRating(context.Background(), userID); err == nil {
+			t.Fatalf("EnsureRating(%d) succeeded, want a refusal", userID)
+		}
+		if len(st.ratings) != 0 {
+			t.Fatalf("service account %d ended up with a projection: %#v", userID, st.ratings)
+		}
+		// A seeding pass that is somehow handed one skips it rather than failing the
+		// whole cycle.
+		if processed, err := service.RunRecomputeCycle(context.Background(), 10); err != nil || processed != 0 {
+			t.Fatalf("cycle over service account %d = %d,%v, want 0,nil", userID, processed, err)
+		}
+	}
+
+	// An ordinary account is unaffected.
+	st := newFakeRatingStore()
+	st.signals[42] = domain.AccountRatingSignals{StarsReceived: 5000}
+	if _, err := newTestService(st).Recompute(context.Background(), 42); err != nil {
+		t.Fatalf("Recompute of an ordinary account: %v", err)
+	}
+}
--- a/internal/app/rating/worker.go
+++ b/internal/app/rating/worker.go
@ -0,0 +1,91 @@
+package rating
+
+import (
+	"context"
+	"time"
+
+	"go.uber.org/zap"
+)
+
+const (
+	// defaultRecomputeInterval matches the shipped
+	// TELESRV_RATING_RECOMPUTE_INTERVAL default.
+	defaultRecomputeInterval = 15 * time.Minute
+)
+
+// RecomputeWorker keeps the rating read model fresh.
+//
+// The projection is derived from signals that change outside the rating write
+// path (Stars flow, message activity, moderation decisions, account age), so no
+// single writer can keep it current. This worker walks the stale projections in
+// bounded batches; it never recomputes the whole table in one pass, and a
+// cancelled context stops it between users rather than mid-write.
+type RecomputeWorker struct {
+	service  *Service
+	logger   *zap.Logger
+	interval time.Duration
+	batch    int
+}
+
+// NewRecomputeWorker creates the periodic recompute worker. Non-positive
+// interval/batch fall back to the shipped defaults, matching the retention
+// worker's contract.
+func NewRecomputeWorker(service *Service, logger *zap.Logger, interval time.Duration, batch int) *RecomputeWorker {
+	if logger == nil {
+		logger = zap.NewNop()
+	}
+	if interval <= 0 {
+		interval = defaultRecomputeInterval
+	}
+	if batch <= 0 {
+		batch = defaultRecomputeBatch
+	}
+	return &RecomputeWorker{service: service, logger: logger, interval: interval, batch: batch}
+}
+
+// Run recomputes one batch immediately and then on every tick until ctx is
+// done. A disabled or store-less service exits immediately with one explicit
+// log line instead of ticking forever over a no-op.
+func (w *RecomputeWorker) Run(ctx context.Context) {
+	if w == nil {
+		return
+	}
+	if !w.service.Ready() {
+		w.logger.Info("account rating recompute worker disabled",
+			zap.Bool("enabled", w.service.Enabled()))
+		return
+	}
+	w.runOnce(ctx)
+	ticker := time.NewTicker(w.interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			w.runOnce(ctx)
+		}
+	}
+}
+
+func (w *RecomputeWorker) runOnce(ctx context.Context) {
+	if w == nil || w.service == nil {
+		return
+	}
+	processed, err := w.service.RunRecomputeCycle(ctx, w.batch)
+	if err != nil {
+		if ctx.Err() != nil {
+			return
+		}
+		w.logger.Warn("account rating recompute cycle failed",
+			zap.Int("processed", processed),
+			zap.Int("batch", w.batch),
+			zap.Error(err))
+		return
+	}
+	if processed > 0 {
+		w.logger.Info("account rating recompute cycle completed",
+			zap.Int("processed", processed),
+			zap.Int("batch", w.batch))
+	}
+}
--- a/internal/app/usernames/service.go
+++ b/internal/app/usernames/service.go
@ -0,0 +1,552 @@
+// Package usernames implements the collectible (Fragment-style) username
+// registry use cases: reading a peer's username vector, toggling and reordering
+// the collectible rows a client owns, and the operator lifecycle that mints,
+// transfers, revokes and burns the assets behind those rows.
+//
+// The service owns normalisation and validation. Every entry point normalises
+// the name through domain.NormalizeUsername and runs the domain Validate()
+// checks before the store is touched, so an RPC handler, the admin API and a
+// unit test all reject the same shapes with the same errors.
+package usernames
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"go.uber.org/zap"
+
+	"telesrv/internal/domain"
+	"telesrv/internal/links"
+	"telesrv/internal/store"
+)
+
+const (
+	// defaultListLimit is the admin listing page size used when the caller does
+	// not bound the query itself.
+	defaultListLimit = 50
+	// maxListLimit bounds one listing page regardless of the requested limit.
+	maxListLimit = 200
+	// defaultTransferLimit / maxTransferLimit bound the provenance log page.
+	defaultTransferLimit = 50
+	maxTransferLimit     = 200
+	// usernamePlaceholder is the substitution supported by the operator URL
+	// template, e.g. https://example.org/nft/{username}.
+	usernamePlaceholder = "{username}"
+	// defaultCollectibleURLPath is the public-link route used when no operator
+	// template is configured.
+	defaultCollectibleURLPath = "nft/username"
+)
+
+// ErrPeerInvalid rejects a registry mutation for a peer that cannot hold
+// usernames. Only users and channels have a username registry; anything else is
+// a caller bug rather than a client-visible protocol state.
+var ErrPeerInvalid = errors.New("username peer invalid")
+
+// PeerUsernameNotifier is the domain-only edge hook invoked after a username
+// registry mutation. The RPC router implements it: it invalidates the cached
+// peer projections and pushes the username change to online clients, exactly
+// like the account.updateUsername path does for the editable slot. Keeping it an
+// injected port means this package never depends on the protocol edge.
+type PeerUsernameNotifier interface {
+	NotifyPeerUsernamesChanged(ctx context.Context, peer domain.Peer) error
+}
+
+// Service is the collectible username use-case layer.
+type Service struct {
+	registry     store.UsernameRegistryStore
+	collectibles store.CollectibleUsernameStore
+	notifier     PeerUsernameNotifier
+
+	// urlTemplate is the operator-provided collectible landing URL template;
+	// publicBaseURL is the fallback root the default route is built from.
+	urlTemplate   string
+	publicBaseURL string
+
+	now func() time.Time
+	log *zap.Logger
+}
+
+// Option adjusts optional service dependencies.
+type Option func(*Service)
+
+// WithRegistryStore injects the peer username registry reader/writer.
+func WithRegistryStore(registry store.UsernameRegistryStore) Option {
+	return func(s *Service) { s.registry = registry }
+}
+
+// WithCollectibleStore injects the collectible asset lifecycle store.
+func WithCollectibleStore(collectibles store.CollectibleUsernameStore) Option {
+	return func(s *Service) { s.collectibles = collectibles }
+}
+
+// WithNotifier injects the edge invalidation/update hook.
+func WithNotifier(notifier PeerUsernameNotifier) Option {
+	return func(s *Service) { s.notifier = notifier }
+}
+
+// WithURLTemplate configures the collectible asset landing URL template. An
+// empty template keeps the public-link default route.
+func WithURLTemplate(template string) Option {
+	return func(s *Service) { s.urlTemplate = strings.TrimSpace(template) }
+}
+
+// WithPublicBaseURL configures the public-link root the default collectible URL
+// route is derived from.
+func WithPublicBaseURL(baseURL string) Option {
+	return func(s *Service) { s.publicBaseURL = strings.TrimSpace(baseURL) }
+}
+
+// WithClock injects the clock (tests).
+func WithClock(now func() time.Time) Option {
+	return func(s *Service) {
+		if now != nil {
+			s.now = now
+		}
+	}
+}
+
+// WithLogger injects the service logger.
+func WithLogger(log *zap.Logger) Option {
+	return func(s *Service) {
+		if log != nil {
+			s.log = log
+		}
+	}
+}
+
+// NewService creates the collectible username service. Every dependency is
+// optional: a service without stores answers with a configuration error instead
+// of panicking, which keeps partial deployments diagnosable.
+func NewService(opts ...Option) *Service {
+	s := &Service{now: time.Now, log: zap.NewNop()}
+	for _, opt := range opts {
+		if opt != nil {
+			opt(s)
+		}
+	}
+	if s.now == nil {
+		s.now = time.Now
+	}
+	if s.log == nil {
+		s.log = zap.NewNop()
+	}
+	return s
+}
+
+// SetPeerUsernameNotifier injects the edge hook after construction. The RPC
+// router is built after the app services, so the notification port is bound
+// here rather than through NewService.
+func (s *Service) SetPeerUsernameNotifier(notifier PeerUsernameNotifier) {
+	if s == nil {
+		return
+	}
+	s.notifier = notifier
+}
+
+// Configured reports whether both registries are installed.
+func (s *Service) Configured() bool {
+	return s != nil && s.registry != nil && s.collectibles != nil
+}
+
+func (s *Service) registryStore() (store.UsernameRegistryStore, error) {
+	if s == nil || s.registry == nil {
+		return nil, fmt.Errorf("username registry store is not configured")
+	}
+	return s.registry, nil
+}
+
+func (s *Service) collectibleStore() (store.CollectibleUsernameStore, error) {
+	if s == nil || s.collectibles == nil {
+		return nil, fmt.Errorf("collectible username store is not configured")
+	}
+	return s.collectibles, nil
+}
+
+// PeerUsernames returns the peer's username vector in projection order.
+func (s *Service) PeerUsernames(ctx context.Context, peer domain.Peer) ([]domain.Username, error) {
+	registry, err := s.registryStore()
+	if err != nil {
+		return nil, err
+	}
+	if !validPeer(peer) {
+		return nil, nil
+	}
+	list, err := registry.PeerUsernames(ctx, peer)
+	if err != nil {
+		return nil, err
+	}
+	return domain.SortUsernames(list), nil
+}
+
+// UsernamesBatch resolves several peers in one round trip. Peers holding no
+// usernames are absent from the result.
+func (s *Service) UsernamesBatch(ctx context.Context, peers []domain.Peer) (map[domain.Peer][]domain.Username, error) {
+	registry, err := s.registryStore()
+	if err != nil {
+		return nil, err
+	}
+	unique := make([]domain.Peer, 0, len(peers))
+	seen := make(map[domain.Peer]struct{}, len(peers))
+	for _, peer := range peers {
+		if !validPeer(peer) {
+			continue
+		}
+		if _, ok := seen[peer]; ok {
+			continue
+		}
+		seen[peer] = struct{}{}
+		unique = append(unique, peer)
+	}
+	if len(unique) == 0 {
+		return map[domain.Peer][]domain.Username{}, nil
+	}
+	batch, err := registry.PeerUsernamesBatch(ctx, unique)
+	if err != nil {
+		return nil, err
+	}
+	out := make(map[domain.Peer][]domain.Username, len(batch))
+	for peer, list := range batch {
+		if len(list) == 0 {
+			continue
+		}
+		out[peer] = domain.SortUsernames(list)
+	}
+	return out, nil
+}
+
+// ToggleUsername activates or deactivates one collectible row. The editable
+// slot is never touched: it is owned by account/channels.updateUsername.
+func (s *Service) ToggleUsername(ctx context.Context, peer domain.Peer, username string, active bool) (bool, error) {
+	registry, err := s.registryStore()
+	if err != nil {
+		return false, err
+	}
+	if !validPeer(peer) {
+		return false, ErrPeerInvalid
+	}
+	username = domain.NormalizeUsername(username)
+	if username == "" {
+		return false, domain.ErrUsernameInvalid
+	}
+	current, err := registry.PeerUsernames(ctx, peer)
+	if err != nil {
+		return false, err
+	}
+	if err := domain.ValidateUsernameToggle(current, username, active); err != nil {
+		return false, err
+	}
+	changed, err := registry.SetUsernameActive(ctx, peer, username, active)
+	if err != nil {
+		return false, err
+	}
+	if changed {
+		s.notifyPeers(ctx, peer)
+	}
+	return changed, nil
+}
+
+// ReorderUsernames rewrites the collectible order. order must be a permutation
+// of the peer's collectible usernames; the editable slot always projects first.
+func (s *Service) ReorderUsernames(ctx context.Context, peer domain.Peer, order []string) (bool, error) {
+	registry, err := s.registryStore()
+	if err != nil {
+		return false, err
+	}
+	if !validPeer(peer) {
+		return false, ErrPeerInvalid
+	}
+	normalized := make([]string, 0, len(order))
+	for _, name := range order {
+		normalized = append(normalized, domain.NormalizeUsername(name))
+	}
+	current, err := registry.PeerUsernames(ctx, peer)
+	if err != nil {
+		return false, err
+	}
+	if err := domain.ValidateUsernameReorder(current, normalized); err != nil {
+		return false, err
+	}
+	changed, err := registry.ReorderUsernames(ctx, peer, normalized)
+	if err != nil {
+		return false, err
+	}
+	if changed {
+		s.notifyPeers(ctx, peer)
+	}
+	return changed, nil
+}
+
+// DeactivateAllUsernames clears the active flag on every collectible row.
+func (s *Service) DeactivateAllUsernames(ctx context.Context, peer domain.Peer) (bool, error) {
+	registry, err := s.registryStore()
+	if err != nil {
+		return false, err
+	}
+	if !validPeer(peer) {
+		return false, ErrPeerInvalid
+	}
+	changed, err := registry.DeactivateAllUsernames(ctx, peer)
+	if err != nil {
+		return false, err
+	}
+	if changed {
+		s.notifyPeers(ctx, peer)
+	}
+	return changed, nil
+}
+
+// CollectibleInfo returns the fragment.collectibleInfo projection for a name.
+func (s *Service) CollectibleInfo(ctx context.Context, username string) (domain.CollectibleInfo, error) {
+	asset, err := s.Collectible(ctx, username)
+	if err != nil {
+		return domain.CollectibleInfo{}, err
+	}
+	return asset.Info(), nil
+}
+
+// Collectible looks up the asset behind a collectible username.
+func (s *Service) Collectible(ctx context.Context, username string) (domain.CollectibleUsername, error) {
+	collectibles, err := s.collectibleStore()
+	if err != nil {
+		return domain.CollectibleUsername{}, err
+	}
+	username = domain.NormalizeUsername(username)
+	if !domain.ValidCollectibleUsername(username) {
+		return domain.CollectibleUsername{}, domain.ErrUsernameInvalid
+	}
+	return collectibles.CollectibleUsername(ctx, username)
+}
+
+// Mint creates a collectible asset, optionally assigning it in the same
+// command. An empty URL is rendered from the configured template and an unset
+// purchase date is stamped with the service clock, so the stored provenance is
+// always complete and reproducible.
+func (s *Service) Mint(ctx context.Context, req domain.MintCollectibleUsernameRequest) (domain.CollectibleUsername, bool, error) {
+	collectibles, err := s.collectibleStore()
+	if err != nil {
+		return domain.CollectibleUsername{}, false, err
+	}
+	req.Username = domain.NormalizeUsername(req.Username)
+	req.Actor = strings.TrimSpace(req.Actor)
+	req.Reason = strings.TrimSpace(req.Reason)
+	req.CommandKey = strings.TrimSpace(req.CommandKey)
+	if strings.TrimSpace(req.URL) == "" {
+		req.URL = s.CollectibleURL(req.Username)
+	}
+	if req.PurchaseDate.IsZero() {
+		req.PurchaseDate = s.now().UTC()
+	}
+	if err := req.Validate(); err != nil {
+		return domain.CollectibleUsername{}, false, err
+	}
+	asset, created, err := collectibles.MintCollectibleUsername(ctx, req)
+	if err != nil {
+		return domain.CollectibleUsername{}, false, err
+	}
+	if created {
+		s.notifyPeers(ctx, req.Owner, asset.Owner)
+	}
+	return asset, created, nil
+}
+
+// Transfer moves the asset to req.To, either out of the vault or from the
+// current holder. Both the previous and the new holder are invalidated.
+func (s *Service) Transfer(ctx context.Context, req domain.TransferCollectibleUsernameRequest) (domain.CollectibleUsername, bool, error) {
+	collectibles, err := s.collectibleStore()
+	if err != nil {
+		return domain.CollectibleUsername{}, false, err
+	}
+	req.Username = domain.NormalizeUsername(req.Username)
+	req.Actor = strings.TrimSpace(req.Actor)
+	req.Reason = strings.TrimSpace(req.Reason)
+	req.CommandKey = strings.TrimSpace(req.CommandKey)
+	if err := req.Validate(); err != nil {
+		return domain.CollectibleUsername{}, false, err
+	}
+	previousOwner := s.currentOwner(ctx, collectibles, req.Username)
+	asset, changed, err := collectibles.TransferCollectibleUsername(ctx, req)
+	if err != nil {
+		return domain.CollectibleUsername{}, false, err
+	}
+	if changed {
+		s.notifyPeers(ctx, previousOwner, req.To, asset.Owner)
+	}
+	return asset, changed, nil
+}
+
+// Revoke returns the asset to the vault, or burns it when req.Burn is set.
+func (s *Service) Revoke(ctx context.Context, req domain.RevokeCollectibleUsernameRequest) (domain.CollectibleUsername, bool, error) {
+	collectibles, err := s.collectibleStore()
+	if err != nil {
+		return domain.CollectibleUsername{}, false, err
+	}
+	req.Username = domain.NormalizeUsername(req.Username)
+	req.Actor = strings.TrimSpace(req.Actor)
+	req.Reason = strings.TrimSpace(req.Reason)
+	req.CommandKey = strings.TrimSpace(req.CommandKey)
+	if err := req.Validate(); err != nil {
+		return domain.CollectibleUsername{}, false, err
+	}
+	previousOwner := s.currentOwner(ctx, collectibles, req.Username)
+	asset, changed, err := collectibles.RevokeCollectibleUsername(ctx, req)
+	if err != nil {
+		return domain.CollectibleUsername{}, false, err
+	}
+	if changed {
+		s.notifyPeers(ctx, previousOwner, asset.Owner)
+	}
+	return asset, changed, nil
+}
+
+// Delete removes an asset outright, releasing its name and discarding its
+// provenance. Revoke with Burn retires an asset but keeps the history; this is
+// the operator's escape hatch for an asset issued by mistake.
+//
+// The previous owner is notified exactly like a revoke: the peer's projection
+// still carries the username until it is invalidated.
+func (s *Service) Delete(ctx context.Context, req domain.DeleteCollectibleUsernameRequest) (bool, error) {
+	collectibles, err := s.collectibleStore()
+	if err != nil {
+		return false, err
+	}
+	req.Username = domain.NormalizeUsername(req.Username)
+	req.Actor = strings.TrimSpace(req.Actor)
+	req.Reason = strings.TrimSpace(req.Reason)
+	req.CommandKey = strings.TrimSpace(req.CommandKey)
+	if err := req.Validate(); err != nil {
+		return false, err
+	}
+	previousOwner := s.currentOwner(ctx, collectibles, req.Username)
+	deleted, err := collectibles.DeleteCollectibleUsername(ctx, req)
+	if err != nil {
+		return false, err
+	}
+	if deleted {
+		s.notifyPeers(ctx, previousOwner, domain.Peer{})
+	}
+	return deleted, nil
+}
+
+// List is the admin listing query. The limit is always bounded, so an
+// unfiltered operator request can never ask the store for an unbounded scan.
+func (s *Service) List(ctx context.Context, filter domain.CollectibleUsernameFilter) ([]domain.CollectibleUsername, error) {
+	collectibles, err := s.collectibleStore()
+	if err != nil {
+		return nil, err
+	}
+	if filter.Status != "" && !filter.Status.Valid() {
+		return nil, domain.ErrCollectibleUsernameStateInvalid
+	}
+	if filter.Owner.Type != "" && !validPeer(filter.Owner) {
+		return nil, domain.ErrCollectibleUsernameStateInvalid
+	}
+	filter.Query = domain.NormalizeUsername(filter.Query)
+	filter.Limit = clampLimit(filter.Limit, defaultListLimit, maxListLimit)
+	return collectibles.ListCollectibleUsernames(ctx, filter)
+}
+
+// Transfers returns the provenance log of one asset, newest first.
+func (s *Service) Transfers(ctx context.Context, collectibleID int64, limit int) ([]domain.CollectibleUsernameTransfer, error) {
+	collectibles, err := s.collectibleStore()
+	if err != nil {
+		return nil, err
+	}
+	if collectibleID <= 0 {
+		return nil, domain.ErrCollectibleUsernameNotFound
+	}
+	return collectibles.CollectibleUsernameTransfers(ctx, collectibleID, clampLimit(limit, defaultTransferLimit, maxTransferLimit))
+}
+
+// CollectibleURL renders the asset landing URL for a name. The operator
+// template wins; {username} is substituted when present and appended as a path
+// segment when it is not. Without a template the public-link default route is
+// used, and without any configured root the URL stays empty rather than
+// pointing at an unrelated host.
+func (s *Service) CollectibleURL(username string) string {
+	if s == nil {
+		return ""
+	}
+	username = domain.NormalizeUsername(username)
+	if username == "" {
+		return ""
+	}
+	template := strings.TrimSpace(s.urlTemplate)
+	if template != "" {
+		if strings.Contains(template, usernamePlaceholder) {
+			return strings.ReplaceAll(template, usernamePlaceholder, username)
+		}
+		return strings.TrimRight(template, "/") + "/" + username
+	}
+	if strings.TrimSpace(s.publicBaseURL) == "" {
+		return ""
+	}
+	return links.Build(s.publicBaseURL, defaultCollectibleURLPath+"/"+username, nil)
+}
+
+// currentOwner reads the holder before a lifecycle mutation so the previous
+// peer's projection is invalidated too. It is best effort: a missing or
+// unreadable asset only means there is no extra peer to notify, and the
+// mutation itself remains the authority.
+func (s *Service) currentOwner(ctx context.Context, collectibles store.CollectibleUsernameStore, username string) domain.Peer {
+	asset, err := collectibles.CollectibleUsername(ctx, username)
+	if err != nil {
+		if !errors.Is(err, domain.ErrCollectibleUsernameNotFound) {
+			s.log.Debug("read collectible username owner before mutation",
+				zap.String("username", username),
+				zap.Error(err))
+		}
+		return domain.Peer{}
+	}
+	if !asset.Owned() {
+		return domain.Peer{}
+	}
+	return asset.Owner
+}
+
+// notifyPeers invalidates projections and pushes updates for every distinct
+// affected peer. Notification is best effort: the registry mutation already
+// committed, and a failed push converges through the client's next
+// authoritative peer read.
+func (s *Service) notifyPeers(ctx context.Context, peers ...domain.Peer) {
+	if s == nil || s.notifier == nil {
+		return
+	}
+	seen := make(map[domain.Peer]struct{}, len(peers))
+	for _, peer := range peers {
+		if !validPeer(peer) {
+			continue
+		}
+		if _, ok := seen[peer]; ok {
+			continue
+		}
+		seen[peer] = struct{}{}
+		if err := s.notifier.NotifyPeerUsernamesChanged(ctx, peer); err != nil {
+			s.log.Warn("notify collectible username change failed",
+				zap.String("peer_type", string(peer.Type)),
+				zap.Int64("peer_id", peer.ID),
+				zap.Error(err))
+		}
+	}
+}
+
+func validPeer(peer domain.Peer) bool {
+	switch peer.Type {
+	case domain.PeerTypeUser, domain.PeerTypeChannel:
+		return peer.ID > 0
+	default:
+		return false
+	}
+}
+
+func clampLimit(limit, fallback, maximum int) int {
+	if limit <= 0 {
+		return fallback
+	}
+	if limit > maximum {
+		return maximum
+	}
+	return limit
+}
--- a/internal/app/usernames/service_test.go
+++ b/internal/app/usernames/service_test.go
@ -0,0 +1,734 @@
+package usernames
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"telesrv/internal/domain"
+)
+
+var (
+	testUser    = domain.Peer{Type: domain.PeerTypeUser, ID: 42}
+	testChannel = domain.Peer{Type: domain.PeerTypeChannel, ID: 77}
+	testClock   = time.Date(2026, 7, 26, 10, 0, 0, 0, time.UTC)
+)
+
+type toggleCall struct {
+	peer     domain.Peer
+	username string
+	active   bool
+}
+
+// fakeRegistry is an in-memory domain.Username registry recording exactly what
+// the service asked it to do, so the tests can assert normalisation reached the
+// store and validation did not.
+type fakeRegistry struct {
+	lists    map[domain.Peer][]domain.Username
+	toggles  []toggleCall
+	orders   [][]string
+	clears   []domain.Peer
+	changed  bool
+	batchErr error
+}
+
+func newFakeRegistry() *fakeRegistry {
+	return &fakeRegistry{lists: map[domain.Peer][]domain.Username{}, changed: true}
+}
+
+func (f *fakeRegistry) PeerUsernames(_ context.Context, peer domain.Peer) ([]domain.Username, error) {
+	if f.batchErr != nil {
+		return nil, f.batchErr
+	}
+	return append([]domain.Username(nil), f.lists[peer]...), nil
+}
+
+func (f *fakeRegistry) PeerUsernamesBatch(_ context.Context, peers []domain.Peer) (map[domain.Peer][]domain.Username, error) {
+	if f.batchErr != nil {
+		return nil, f.batchErr
+	}
+	out := make(map[domain.Peer][]domain.Username, len(peers))
+	for _, peer := range peers {
+		if list, ok := f.lists[peer]; ok {
+			out[peer] = append([]domain.Username(nil), list...)
+		}
+	}
+	return out, nil
+}
+
+func (f *fakeRegistry) SetUsernameActive(_ context.Context, peer domain.Peer, username string, active bool) (bool, error) {
+	f.toggles = append(f.toggles, toggleCall{peer: peer, username: username, active: active})
+	return f.changed, nil
+}
+
+func (f *fakeRegistry) ReorderUsernames(_ context.Context, _ domain.Peer, order []string) (bool, error) {
+	f.orders = append(f.orders, append([]string(nil), order...))
+	return f.changed, nil
+}
+
+func (f *fakeRegistry) DeactivateAllUsernames(_ context.Context, peer domain.Peer) (bool, error) {
+	f.clears = append(f.clears, peer)
+	return f.changed, nil
+}
+
+// fakeCollectibles records the lifecycle commands and serves stored assets.
+type fakeCollectibles struct {
+	assets    map[string]domain.CollectibleUsername
+	mints     []domain.MintCollectibleUsernameRequest
+	transfers []domain.TransferCollectibleUsernameRequest
+	revokes   []domain.RevokeCollectibleUsernameRequest
+	deletes   []domain.DeleteCollectibleUsernameRequest
+	filters   []domain.CollectibleUsernameFilter
+	logLimits []int
+	created   bool
+	changed   bool
+}
+
+func newFakeCollectibles() *fakeCollectibles {
+	return &fakeCollectibles{assets: map[string]domain.CollectibleUsername{}, created: true, changed: true}
+}
+
+func (f *fakeCollectibles) MintCollectibleUsername(_ context.Context, req domain.MintCollectibleUsernameRequest) (domain.CollectibleUsername, bool, error) {
+	f.mints = append(f.mints, req)
+	asset := domain.CollectibleUsername{
+		ID: int64(len(f.mints)), Username: req.Username, Status: domain.CollectibleUsernameStatusVault,
+		PurchaseDate: req.PurchaseDate, Currency: req.Currency, Amount: req.Amount, URL: req.URL,
+	}
+	if req.Owner.Type != "" {
+		asset.Status = domain.CollectibleUsernameStatusOwned
+		asset.Owner = req.Owner
+		asset.OriginalOwner = req.Owner
+	}
+	f.assets[strings.ToLower(req.Username)] = asset
+	return asset, f.created, nil
+}
+
+func (f *fakeCollectibles) TransferCollectibleUsername(_ context.Context, req domain.TransferCollectibleUsernameRequest) (domain.CollectibleUsername, bool, error) {
+	f.transfers = append(f.transfers, req)
+	asset := f.assets[strings.ToLower(req.Username)]
+	asset.Username = req.Username
+	asset.Status = domain.CollectibleUsernameStatusOwned
+	asset.Owner = req.To
+	asset.TransferCount++
+	f.assets[strings.ToLower(req.Username)] = asset
+	return asset, f.changed, nil
+}
+
+func (f *fakeCollectibles) RevokeCollectibleUsername(_ context.Context, req domain.RevokeCollectibleUsernameRequest) (domain.CollectibleUsername, bool, error) {
+	f.revokes = append(f.revokes, req)
+	asset := f.assets[strings.ToLower(req.Username)]
+	asset.Username = req.Username
+	asset.Owner = domain.Peer{}
+	asset.Status = domain.CollectibleUsernameStatusVault
+	if req.Burn {
+		asset.Status = domain.CollectibleUsernameStatusBurned
+	}
+	f.assets[strings.ToLower(req.Username)] = asset
+	return asset, f.changed, nil
+}
+
+func (f *fakeCollectibles) DeleteCollectibleUsername(_ context.Context, req domain.DeleteCollectibleUsernameRequest) (bool, error) {
+	f.deletes = append(f.deletes, req)
+	key := strings.ToLower(req.Username)
+	if _, ok := f.assets[key]; !ok {
+		return false, nil
+	}
+	delete(f.assets, key)
+	return true, nil
+}
+
+func (f *fakeCollectibles) CollectibleUsername(_ context.Context, username string) (domain.CollectibleUsername, error) {
+	asset, ok := f.assets[strings.ToLower(username)]
+	if !ok {
+		return domain.CollectibleUsername{}, domain.ErrCollectibleUsernameNotFound
+	}
+	return asset, nil
+}
+
+func (f *fakeCollectibles) CollectibleUsernameByID(_ context.Context, id int64) (domain.CollectibleUsername, error) {
+	for _, asset := range f.assets {
+		if asset.ID == id {
+			return asset, nil
+		}
+	}
+	return domain.CollectibleUsername{}, domain.ErrCollectibleUsernameNotFound
+}
+
+func (f *fakeCollectibles) ListCollectibleUsernames(_ context.Context, filter domain.CollectibleUsernameFilter) ([]domain.CollectibleUsername, error) {
+	f.filters = append(f.filters, filter)
+	return nil, nil
+}
+
+func (f *fakeCollectibles) CollectibleUsernameTransfers(_ context.Context, _ int64, limit int) ([]domain.CollectibleUsernameTransfer, error) {
+	f.logLimits = append(f.logLimits, limit)
+	return nil, nil
+}
+
+// recordingNotifier captures the peers whose projections were invalidated.
+type recordingNotifier struct {
+	peers []domain.Peer
+	err   error
+}
+
+func (n *recordingNotifier) NotifyPeerUsernamesChanged(_ context.Context, peer domain.Peer) error {
+	n.peers = append(n.peers, peer)
+	return n.err
+}
+
+func newTestService(t *testing.T, registry *fakeRegistry, collectibles *fakeCollectibles, opts ...Option) (*Service, *recordingNotifier) {
+	t.Helper()
+	notifier := &recordingNotifier{}
+	base := []Option{
+		WithRegistryStore(registry),
+		WithCollectibleStore(collectibles),
+		WithNotifier(notifier),
+		WithClock(func() time.Time { return testClock }),
+	}
+	return NewService(append(base, opts...)...), notifier
+}
+
+func TestPeerUsernamesProjectsStoredOrder(t *testing.T) {
+	// Legacy numbering: the editable slot and the first collectible both carry
+	// sort_order 0, and the editable slot wins that tie, so a peer that never
+	// reordered anything projects its own username first.
+	registry := newFakeRegistry()
+	registry.lists[testUser] = []domain.Username{
+		{Username: "zeta", Active: true, SortOrder: 1, CollectibleID: 2},
+		{Username: "alpha", Active: true, SortOrder: 0, CollectibleID: 1},
+		{Username: "editable", Active: true, Editable: true, SortOrder: 0},
+	}
+	service, _ := newTestService(t, registry, newFakeCollectibles())
+
+	if got := projectedNames(t, service); got != "editable,alpha,zeta" {
+		t.Fatalf("projection order = %v, want editable,alpha,zeta", got)
+	}
+
+	// After a reorder that made a collectible primary, stored order decides and
+	// the editable slot is no longer first: clients show usernames[0] as primary.
+	registry.lists[testUser] = []domain.Username{
+		{Username: "zeta", Active: true, SortOrder: 2, CollectibleID: 2},
+		{Username: "alpha", Active: true, SortOrder: 0, CollectibleID: 1},
+		{Username: "editable", Active: true, Editable: true, SortOrder: 1},
+	}
+	if got := projectedNames(t, service); got != "alpha,editable,zeta" {
+		t.Fatalf("reordered projection = %v, want alpha,editable,zeta", got)
+	}
+}
+
+func projectedNames(t *testing.T, service *Service) string {
+	t.Helper()
+	list, err := service.PeerUsernames(context.Background(), testUser)
+	if err != nil {
+		t.Fatalf("PeerUsernames: %v", err)
+	}
+	got := make([]string, 0, len(list))
+	for _, item := range list {
+		got = append(got, item.Username)
+	}
+	return strings.Join(got, ",")
+}
+
+func TestUsernamesBatchSkipsInvalidAndEmptyPeers(t *testing.T) {
+	registry := newFakeRegistry()
+	registry.lists[testUser] = []domain.Username{{Username: "alpha", Active: true, CollectibleID: 1}}
+	registry.lists[testChannel] = nil
+	service, _ := newTestService(t, registry, newFakeCollectibles())
+
+	batch, err := service.UsernamesBatch(context.Background(), []domain.Peer{testUser, testUser, testChannel, {}, {Type: domain.PeerTypeUser}})
+	if err != nil {
+		t.Fatalf("UsernamesBatch: %v", err)
+	}
+	if len(batch) != 1 || len(batch[testUser]) != 1 {
+		t.Fatalf("batch = %#v, want only the peer holding usernames", batch)
+	}
+}
+
+func TestToggleUsernameNormalizesBeforeStore(t *testing.T) {
+	registry := newFakeRegistry()
+	registry.lists[testUser] = []domain.Username{
+		{Username: "editable", Active: true, Editable: true},
+		{Username: "Nft_One", Active: false, CollectibleID: 1},
+	}
+	service, notifier := newTestService(t, registry, newFakeCollectibles())
+
+	changed, err := service.ToggleUsername(context.Background(), testUser, "  @Nft_One ", true)
+	if err != nil || !changed {
+		t.Fatalf("ToggleUsername = %v, %v", changed, err)
+	}
+	if len(registry.toggles) != 1 || registry.toggles[0].username != "Nft_One" || !registry.toggles[0].active {
+		t.Fatalf("store toggles = %#v, want normalized Nft_One", registry.toggles)
+	}
+	if len(notifier.peers) != 1 || notifier.peers[0] != testUser {
+		t.Fatalf("notified peers = %#v, want the toggled peer", notifier.peers)
+	}
+}
+
+func TestToggleUsernameValidatesBeforeStore(t *testing.T) {
+	tests := []struct {
+		name     string
+		list     []domain.Username
+		username string
+		active   bool
+		wantErr  error
+	}{
+		{
+			name:     "editable slot is not collectible",
+			list:     []domain.Username{{Username: "editable", Active: true, Editable: true}},
+			username: "editable",
+			wantErr:  domain.ErrUsernameNotCollectible,
+		},
+		{
+			name:     "unknown username",
+			list:     []domain.Username{{Username: "alpha", Active: true, CollectibleID: 1}},
+			username: "missing",
+			wantErr:  domain.ErrUsernameNotOccupied,
+		},
+		{
+			name:     "empty username",
+			list:     []domain.Username{{Username: "alpha", Active: true, CollectibleID: 1}},
+			username: "@",
+			wantErr:  domain.ErrUsernameInvalid,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			registry := newFakeRegistry()
+			registry.lists[testUser] = test.list
+			service, notifier := newTestService(t, registry, newFakeCollectibles())
+
+			_, err := service.ToggleUsername(context.Background(), testUser, test.username, test.active)
+			if !errors.Is(err, test.wantErr) {
+				t.Fatalf("ToggleUsername error = %v, want %v", err, test.wantErr)
+			}
+			if len(registry.toggles) != 0 {
+				t.Fatalf("store was called with invalid input: %#v", registry.toggles)
+			}
+			if len(notifier.peers) != 0 {
+				t.Fatalf("notifier ran for a rejected toggle: %#v", notifier.peers)
+			}
+		})
+	}
+}
+
+func TestReorderUsernamesNormalizesPermutation(t *testing.T) {
+	registry := newFakeRegistry()
+	registry.lists[testUser] = []domain.Username{
+		{Username: "editable", Active: true, Editable: true},
+		{Username: "alpha", Active: true, SortOrder: 0, CollectibleID: 1},
+		{Username: "zeta", Active: true, SortOrder: 1, CollectibleID: 2},
+	}
+	service, notifier := newTestService(t, registry, newFakeCollectibles())
+
+	changed, err := service.ReorderUsernames(context.Background(), testUser, []string{"@zeta", " alpha ", "editable"})
+	if err != nil || !changed {
+		t.Fatalf("ReorderUsernames = %v, %v", changed, err)
+	}
+	if len(registry.orders) != 1 || strings.Join(registry.orders[0], ",") != "zeta,alpha,editable" {
+		t.Fatalf("store order = %#v, want normalized zeta,alpha,editable", registry.orders)
+	}
+	if len(notifier.peers) != 1 {
+		t.Fatalf("notified peers = %#v, want one", notifier.peers)
+	}
+}
+
+func TestReorderUsernamesRejectsIncompletePermutation(t *testing.T) {
+	registry := newFakeRegistry()
+	registry.lists[testUser] = []domain.Username{
+		{Username: "alpha", Active: true, CollectibleID: 1},
+		{Username: "zeta", Active: true, CollectibleID: 2},
+	}
+	service, _ := newTestService(t, registry, newFakeCollectibles())
+
+	if _, err := service.ReorderUsernames(context.Background(), testUser, []string{"alpha"}); !errors.Is(err, domain.ErrUsernameOrderInvalid) {
+		t.Fatalf("ReorderUsernames error = %v, want ErrUsernameOrderInvalid", err)
+	}
+	if len(registry.orders) != 0 {
+		t.Fatalf("store was called with a non-permutation: %#v", registry.orders)
+	}
+}
+
+// TestReorderUsernamesAcceptsTheEditableSlot is the report "channels.reorderUsernames
+// answers USERNAME_INVALID": Telegram Desktop sends the whole visible list, and
+// core.telegram.org/api/fragment requires exactly that ("all currently active
+// usernames must be specified"), so the editable slot is a legitimate member of
+// the order -- including as its first entry, and including when it is the only
+// username the peer has.
+func TestReorderUsernamesAcceptsTheEditableSlot(t *testing.T) {
+	registry := newFakeRegistry()
+	registry.lists[testChannel] = []domain.Username{
+		{Username: "chan_slot", Active: true, Editable: true},
+	}
+	service, _ := newTestService(t, registry, newFakeCollectibles())
+
+	if _, err := service.ReorderUsernames(context.Background(), testChannel, []string{"chan_slot"}); err != nil {
+		t.Fatalf("editable-only reorder: %v", err)
+	}
+	if len(registry.orders) != 1 || strings.Join(registry.orders[0], ",") != "chan_slot" {
+		t.Fatalf("store order = %#v, want chan_slot", registry.orders)
+	}
+
+	// An inactive collectible does not have to be listed, and listing an unknown
+	// name is still rejected.
+	registry.lists[testChannel] = []domain.Username{
+		{Username: "chan_slot", Active: true, Editable: true},
+		{Username: "hidden", Active: false, CollectibleID: 7},
+	}
+	if _, err := service.ReorderUsernames(context.Background(), testChannel, []string{"chan_slot"}); err != nil {
+		t.Fatalf("reorder omitting an inactive collectible: %v", err)
+	}
+	if _, err := service.ReorderUsernames(context.Background(), testChannel, []string{"chan_slot", "nothere"}); !errors.Is(err, domain.ErrUsernameOrderInvalid) {
+		t.Fatalf("reorder with an unknown name = %v, want ErrUsernameOrderInvalid", err)
+	}
+}
+
+func TestDeactivateAllUsernamesNotifiesPeer(t *testing.T) {
+	registry := newFakeRegistry()
+	service, notifier := newTestService(t, registry, newFakeCollectibles())
+
+	changed, err := service.DeactivateAllUsernames(context.Background(), testChannel)
+	if err != nil || !changed {
+		t.Fatalf("DeactivateAllUsernames = %v, %v", changed, err)
+	}
+	if len(registry.clears) != 1 || registry.clears[0] != testChannel {
+		t.Fatalf("store clears = %#v", registry.clears)
+	}
+	if len(notifier.peers) != 1 || notifier.peers[0] != testChannel {
+		t.Fatalf("notified peers = %#v", notifier.peers)
+	}
+}
+
+func TestMintRendersCollectibleURL(t *testing.T) {
+	tests := []struct {
+		name     string
+		opts     []Option
+		url      string
+		wantURL  string
+		username string
+	}{
+		{
+			name:     "public-link default route",
+			opts:     []Option{WithPublicBaseURL("https://example.test")},
+			username: "alpha",
+			wantURL:  "https://example.test/nft/username/alpha",
+		},
+		{
+			name:     "template placeholder",
+			opts:     []Option{WithURLTemplate("https://frag.example/u/{username}?ref=1"), WithPublicBaseURL("https://example.test")},
+			username: "alpha",
+			wantURL:  "https://frag.example/u/alpha?ref=1",
+		},
+		{
+			name:     "template without placeholder appends the name",
+			opts:     []Option{WithURLTemplate("https://frag.example/u/")},
+			username: "alpha",
+			wantURL:  "https://frag.example/u/alpha",
+		},
+		{
+			name:     "explicit request URL wins",
+			opts:     []Option{WithURLTemplate("https://frag.example/u/{username}")},
+			username: "alpha",
+			url:      "https://operator.example/custom",
+			wantURL:  "https://operator.example/custom",
+		},
+		{
+			name:     "no template and no base URL keeps the URL empty",
+			username: "alpha",
+			wantURL:  "",
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			collectibles := newFakeCollectibles()
+			service, _ := newTestService(t, newFakeRegistry(), collectibles, test.opts...)
+
+			asset, created, err := service.Mint(context.Background(), domain.MintCollectibleUsernameRequest{
+				Username: "@" + test.username, Currency: domain.CollectibleCurrencyStars, Amount: 1000, URL: test.url,
+			})
+			if err != nil || !created {
+				t.Fatalf("Mint = %v, %v", created, err)
+			}
+			if asset.URL != test.wantURL {
+				t.Fatalf("asset URL = %q, want %q", asset.URL, test.wantURL)
+			}
+			if len(collectibles.mints) != 1 {
+				t.Fatalf("mints = %d, want 1", len(collectibles.mints))
+			}
+			if got := collectibles.mints[0].Username; got != test.username {
+				t.Fatalf("stored username = %q, want normalized %q", got, test.username)
+			}
+			if !collectibles.mints[0].PurchaseDate.Equal(testClock) {
+				t.Fatalf("purchase date = %v, want the service clock %v", collectibles.mints[0].PurchaseDate, testClock)
+			}
+		})
+	}
+}
+
+func TestMintValidatesBeforeStore(t *testing.T) {
+	tests := []struct {
+		name    string
+		req     domain.MintCollectibleUsernameRequest
+		wantErr error
+	}{
+		{
+			name:    "username too short",
+			req:     domain.MintCollectibleUsernameRequest{Username: "ab", Currency: domain.CollectibleCurrencyStars},
+			wantErr: domain.ErrUsernameInvalid,
+		},
+		{
+			name:    "unsupported currency",
+			req:     domain.MintCollectibleUsernameRequest{Username: "alpha", Currency: "EUR"},
+			wantErr: domain.ErrCollectibleCurrencyInvalid,
+		},
+		{
+			name:    "crypto amount without currency",
+			req:     domain.MintCollectibleUsernameRequest{Username: "alpha", Currency: domain.CollectibleCurrencyStars, CryptoAmount: 5},
+			wantErr: domain.ErrCollectibleCurrencyInvalid,
+		},
+		{
+			name: "owner peer is not a username holder",
+			req: domain.MintCollectibleUsernameRequest{
+				Username: "alpha", Currency: domain.CollectibleCurrencyStars,
+				Owner: domain.Peer{Type: domain.PeerTypeCommunity, ID: 5},
+			},
+			wantErr: domain.ErrCollectibleUsernameStateInvalid,
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			collectibles := newFakeCollectibles()
+			service, notifier := newTestService(t, newFakeRegistry(), collectibles)
+
+			if _, _, err := service.Mint(context.Background(), test.req); !errors.Is(err, test.wantErr) {
+				t.Fatalf("Mint error = %v, want %v", err, test.wantErr)
+			}
+			if len(collectibles.mints) != 0 {
+				t.Fatalf("store was called with invalid input: %#v", collectibles.mints)
+			}
+			if len(notifier.peers) != 0 {
+				t.Fatalf("notifier ran for a rejected mint: %#v", notifier.peers)
+			}
+		})
+	}
+}
+
+func TestMintNotifiesOwnerOnly(t *testing.T) {
+	collectibles := newFakeCollectibles()
+	service, notifier := newTestService(t, newFakeRegistry(), collectibles, WithPublicBaseURL("https://example.test"))
+
+	if _, _, err := service.Mint(context.Background(), domain.MintCollectibleUsernameRequest{
+		Username: "vaulted", Currency: domain.CollectibleCurrencyStars,
+	}); err != nil {
+		t.Fatalf("Mint vault: %v", err)
+	}
+	if len(notifier.peers) != 0 {
+		t.Fatalf("vault mint notified %#v, want nothing", notifier.peers)
+	}
+
+	if _, _, err := service.Mint(context.Background(), domain.MintCollectibleUsernameRequest{
+		Username: "assigned", Currency: domain.CollectibleCurrencyStars, Owner: testUser,
+	}); err != nil {
+		t.Fatalf("Mint assigned: %v", err)
+	}
+	if len(notifier.peers) != 1 || notifier.peers[0] != testUser {
+		t.Fatalf("notified peers = %#v, want the assigned owner", notifier.peers)
+	}
+}
+
+func TestTransferNotifiesPreviousAndNewOwner(t *testing.T) {
+	collectibles := newFakeCollectibles()
+	collectibles.assets["alpha"] = domain.CollectibleUsername{
+		ID: 1, Username: "alpha", Status: domain.CollectibleUsernameStatusOwned, Owner: testUser,
+	}
+	service, notifier := newTestService(t, newFakeRegistry(), collectibles)
+
+	_, changed, err := service.Transfer(context.Background(), domain.TransferCollectibleUsernameRequest{
+		Username: "@Alpha", To: testChannel, Actor: "admin", CommandKey: "cmd-1",
+	})
+	if err != nil || !changed {
+		t.Fatalf("Transfer = %v, %v", changed, err)
+	}
+	if len(collectibles.transfers) != 1 || collectibles.transfers[0].Username != "Alpha" {
+		t.Fatalf("stored transfer = %#v, want normalized username", collectibles.transfers)
+	}
+	if len(notifier.peers) != 2 {
+		t.Fatalf("notified peers = %#v, want previous and new owner", notifier.peers)
+	}
+	seen := map[domain.Peer]bool{notifier.peers[0]: true, notifier.peers[1]: true}
+	if !seen[testUser] || !seen[testChannel] {
+		t.Fatalf("notified peers = %#v, want %v and %v", notifier.peers, testUser, testChannel)
+	}
+}
+
+func TestRevokeNotifiesPreviousOwner(t *testing.T) {
+	collectibles := newFakeCollectibles()
+	collectibles.assets["alpha"] = domain.CollectibleUsername{
+		ID: 1, Username: "alpha", Status: domain.CollectibleUsernameStatusOwned, Owner: testUser,
+	}
+	service, notifier := newTestService(t, newFakeRegistry(), collectibles)
+
+	asset, changed, err := service.Revoke(context.Background(), domain.RevokeCollectibleUsernameRequest{
+		Username: "alpha", Burn: true, Actor: "admin",
+	})
+	if err != nil || !changed {
+		t.Fatalf("Revoke = %v, %v", changed, err)
+	}
+	if asset.Status != domain.CollectibleUsernameStatusBurned {
+		t.Fatalf("asset status = %q, want burned", asset.Status)
+	}
+	if len(notifier.peers) != 1 || notifier.peers[0] != testUser {
+		t.Fatalf("notified peers = %#v, want the previous owner", notifier.peers)
+	}
+}
+
+func TestCollectibleInfoProjectsPurchaseRecord(t *testing.T) {
+	collectibles := newFakeCollectibles()
+	collectibles.assets["alpha"] = domain.CollectibleUsername{
+		ID: 1, Username: "alpha", Status: domain.CollectibleUsernameStatusOwned, Owner: testUser,
+		PurchaseDate: testClock, Currency: domain.CollectibleCurrencyStars, Amount: 2500,
+		URL: "https://example.test/nft/username/alpha",
+	}
+	service, _ := newTestService(t, newFakeRegistry(), collectibles)
+
+	info, err := service.CollectibleInfo(context.Background(), "@ALPHA")
+	if err != nil {
+		t.Fatalf("CollectibleInfo: %v", err)
+	}
+	if info.PurchaseDate != int(testClock.Unix()) || info.Amount != 2500 || info.Currency != domain.CollectibleCurrencyStars {
+		t.Fatalf("collectible info = %#v", info)
+	}
+	if _, err := service.CollectibleInfo(context.Background(), "ab"); !errors.Is(err, domain.ErrUsernameInvalid) {
+		t.Fatalf("CollectibleInfo short name error = %v, want ErrUsernameInvalid", err)
+	}
+}
+
+func TestListAndTransfersBoundThePage(t *testing.T) {
+	collectibles := newFakeCollectibles()
+	service, _ := newTestService(t, newFakeRegistry(), collectibles)
+
+	if _, err := service.List(context.Background(), domain.CollectibleUsernameFilter{Query: " @Alpha ", Limit: 0}); err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if _, err := service.List(context.Background(), domain.CollectibleUsernameFilter{Limit: 100000}); err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(collectibles.filters) != 2 ||
+		collectibles.filters[0].Limit != defaultListLimit || collectibles.filters[0].Query != "Alpha" ||
+		collectibles.filters[1].Limit != maxListLimit {
+		t.Fatalf("filters = %#v", collectibles.filters)
+	}
+	if _, err := service.List(context.Background(), domain.CollectibleUsernameFilter{Status: "sold"}); !errors.Is(err, domain.ErrCollectibleUsernameStateInvalid) {
+		t.Fatalf("List accepted an unmodelled status")
+	}
+
+	if _, err := service.Transfers(context.Background(), 7, 0); err != nil {
+		t.Fatalf("Transfers: %v", err)
+	}
+	if len(collectibles.logLimits) != 1 || collectibles.logLimits[0] != defaultTransferLimit {
+		t.Fatalf("transfer log limits = %#v", collectibles.logLimits)
+	}
+	if _, err := service.Transfers(context.Background(), 0, 10); !errors.Is(err, domain.ErrCollectibleUsernameNotFound) {
+		t.Fatalf("Transfers accepted a zero collectible id")
+	}
+}
+
+func TestServiceWithoutStoresReportsConfiguration(t *testing.T) {
+	service := NewService()
+	if service.Configured() {
+		t.Fatal("Configured = true without stores")
+	}
+	if _, err := service.PeerUsernames(context.Background(), testUser); err == nil {
+		t.Fatal("PeerUsernames accepted a missing registry store")
+	}
+	if _, err := service.ToggleUsername(context.Background(), testUser, "alpha", true); err == nil {
+		t.Fatal("ToggleUsername accepted a missing registry store")
+	}
+	if _, _, err := service.Mint(context.Background(), domain.MintCollectibleUsernameRequest{Username: "alpha"}); err == nil {
+		t.Fatal("Mint accepted a missing collectible store")
+	}
+}
+
+func TestNilServiceIsSafe(t *testing.T) {
+	var service *Service
+	service.SetPeerUsernameNotifier(&recordingNotifier{})
+	if service.Configured() {
+		t.Fatal("nil service reported configured")
+	}
+	if url := service.CollectibleURL("alpha"); url != "" {
+		t.Fatalf("nil service URL = %q", url)
+	}
+	if _, err := service.PeerUsernames(context.Background(), testUser); err == nil {
+		t.Fatal("nil service PeerUsernames returned no error")
+	}
+	if _, _, err := service.Transfer(context.Background(), domain.TransferCollectibleUsernameRequest{Username: "alpha", To: testUser}); err == nil {
+		t.Fatal("nil service Transfer returned no error")
+	}
+}
+
+func TestNotifierFailureDoesNotFailTheMutation(t *testing.T) {
+	registry := newFakeRegistry()
+	registry.lists[testUser] = []domain.Username{
+		{Username: "editable", Active: true, Editable: true},
+		{Username: "alpha", Active: true, CollectibleID: 1},
+	}
+	notifier := &recordingNotifier{err: errors.New("push failed")}
+	service := NewService(
+		WithRegistryStore(registry),
+		WithCollectibleStore(newFakeCollectibles()),
+		WithNotifier(notifier),
+	)
+
+	changed, err := service.ToggleUsername(context.Background(), testUser, "alpha", false)
+	if err != nil || !changed {
+		t.Fatalf("ToggleUsername = %v, %v; committed mutation must survive a failed push", changed, err)
+	}
+}
+
+// TestServiceDeleteNotifiesPreviousOwner covers the hard delete: the request is
+// normalised and validated before the store is touched, and the peer that held
+// the asset is invalidated so its projection stops advertising the username.
+func TestServiceDeleteNotifiesPreviousOwner(t *testing.T) {
+	ctx := context.Background()
+	registry := newFakeRegistry()
+	collectibles := newFakeCollectibles()
+	holder := domain.Peer{Type: domain.PeerTypeUser, ID: 501}
+	collectibles.assets["gone"] = domain.CollectibleUsername{
+		ID: 9, Username: "Gone", Status: domain.CollectibleUsernameStatusOwned, Owner: holder,
+	}
+	svc, notifier := newTestService(t, registry, collectibles)
+
+	deleted, err := svc.Delete(ctx, domain.DeleteCollectibleUsernameRequest{
+		Username: " @Gone ", Actor: "admin", Reason: "issued by mistake",
+	})
+	if err != nil || !deleted {
+		t.Fatalf("delete: deleted=%v err=%v", deleted, err)
+	}
+	if len(collectibles.deletes) != 1 || collectibles.deletes[0].Username != "Gone" {
+		t.Fatalf("store received %+v, want the normalised name", collectibles.deletes)
+	}
+	if len(notifier.peers) != 1 || notifier.peers[0] != holder {
+		t.Fatalf("notified peers = %#v, want the previous owner %+v", notifier.peers, holder)
+	}
+
+	// An invalid name never reaches the store.
+	before := len(collectibles.deletes)
+	if _, err := svc.Delete(ctx, domain.DeleteCollectibleUsernameRequest{Username: "no"}); err == nil {
+		t.Fatalf("delete of a too-short name = nil error, want rejection")
+	}
+	if len(collectibles.deletes) != before {
+		t.Fatalf("store was called with an invalid request: %+v", collectibles.deletes)
+	}
+
+	// Nothing live left is not an error, and nothing is notified.
+	notifier.peers = nil
+	deleted, err = svc.Delete(ctx, domain.DeleteCollectibleUsernameRequest{
+		Username: "absentname", Actor: "admin", Reason: "again",
+	})
+	if err != nil || deleted {
+		t.Fatalf("delete of unknown name = %v err=%v, want (false, nil)", deleted, err)
+	}
+	if len(notifier.peers) != 0 {
+		t.Fatalf("no-op delete notified %+v", notifier.peers)
+	}
+}
--- a/internal/app/verification/service.go
+++ b/internal/app/verification/service.go
--- a/internal/app/verification/service_test.go
+++ b/internal/app/verification/service_test.go
--- a/internal/app/verification/worker.go
+++ b/internal/app/verification/worker.go
@ -0,0 +1,88 @@
+package verification
+
+import (
+	"context"
+	"time"
+
+	"go.uber.org/zap"
+)
+
+// defaultNotifyInterval matches the shipped
+// TELESRV_VERIFICATION_NOTIFY_INTERVAL default.
+const defaultNotifyInterval = 15 * time.Second
+
+// NotificationWorker drains the applicant-notification outbox.
+//
+// A decision is committed together with its outbox row, never with a message
+// send: @verifybot may be blocked, the applicant may be deleted, and the panel
+// must not wait on either. Delivery is therefore a separate, retrying cycle over
+// durable rows, and this worker is only its cadence.
+type NotificationWorker struct {
+	service  *Service
+	logger   *zap.Logger
+	interval time.Duration
+	batch    int
+}
+
+// NewNotificationWorker creates the periodic delivery worker. Non-positive
+// interval/batch fall back to the shipped defaults, matching the rating
+// recompute worker's contract.
+func NewNotificationWorker(service *Service, logger *zap.Logger, interval time.Duration, batch int) *NotificationWorker {
+	if logger == nil {
+		logger = zap.NewNop()
+	}
+	if interval <= 0 {
+		interval = defaultNotifyInterval
+	}
+	if batch <= 0 {
+		batch = defaultNotifyBatch
+	}
+	return &NotificationWorker{service: service, logger: logger, interval: interval, batch: batch}
+}
+
+// Run delivers one batch immediately and then on every tick until ctx is done. A
+// disabled or store-less service exits immediately with one explicit log line
+// instead of ticking forever over a no-op.
+func (w *NotificationWorker) Run(ctx context.Context) {
+	if w == nil {
+		return
+	}
+	if !w.service.Ready() {
+		w.logger.Info("verification notification worker disabled",
+			zap.Bool("enabled", w.service.Enabled()))
+		return
+	}
+	w.runOnce(ctx)
+	ticker := time.NewTicker(w.interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			w.runOnce(ctx)
+		}
+	}
+}
+
+func (w *NotificationWorker) runOnce(ctx context.Context) {
+	if w == nil || w.service == nil {
+		return
+	}
+	delivered, err := w.service.RunNotificationCycle(ctx, w.batch)
+	if err != nil {
+		if ctx.Err() != nil {
+			return
+		}
+		w.logger.Warn("verification notification cycle failed",
+			zap.Int("delivered", delivered),
+			zap.Int("batch", w.batch),
+			zap.Error(err))
+		return
+	}
+	if delivered > 0 {
+		w.logger.Info("verification notification cycle completed",
+			zap.Int("delivered", delivered),
+			zap.Int("batch", w.batch))
+	}
+}