ci: re-trigger

Phase 6 (final) of the room GATE VIEW + seat-renewal sprint. Cron
backstop mirroring delete_stale_my_sea_draws — the lazy
_expire_lapsed_seats already frees seats on every room/gate-view access,
but a mid-game table nobody reopens past the grace window would keep its
stuck seats forever. This command runs the same sweep over every room
holding a timestamped FILLED slot. No flags; idempotent.

Tests: ExpireLapsedRoomSeatsCommandTest (2) — frees a >2S lapsed seat +
flags RENEWAL_DUE; no-op within grace. Full project suite 1590 ITs/UTs
green.

Code architected by Disco DeDisco <discodedisco@outlook.com>
Git commit message Co-Authored-By:
Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -1,2 +1,3 @@
 src/db.sqlite3
 .claude
+.vscode

.gitignore

@@ -4,6 +4,9 @@
 ### Claude ###
 .claude
 
+### VS Code ###
+.vscode
+
 ### Django ###
 *.log
 *.pot

.woodpecker/_retry_failed.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Usage: bash .woodpecker/_retry_failed.sh <test command args...>
+#
+# Runs `python manage.py test "$@"`. If any tests fail/error, parses the
+# failure labels out of stdout and re-runs ONLY those tests — so a single
+# Selenium flake at test 90/93 costs ~22s on retry instead of the full
+# 35-minute step.
+#
+# Django's unittest-based runner prints failures in a predictable shape:
+#
+#   ERROR: test_method (full.dotted.path.TestClass.test_method)
+#   FAIL:  test_method (full.dotted.path.TestClass.test_method)
+#
+# The dotted path inside the parens is exactly what `manage.py test`
+# accepts as a label. We grep for those lines + re-run that list.
+#
+# Exit semantics:
+#   - First run green → exit 0, no retry.
+#   - First run failed AND label parse found nothing (crashed before any
+#     test reported, e.g. ImportError) → propagate first-run exit code,
+#     no retry. Genuine infra problems shouldn't be silently re-run.
+#   - First run failed AND labels parsed → retry just those; exit with
+#     the retry's exit code. A real (not-flaky) regression fails twice
+#     → step still red, with the focused retry log as the authoritative
+#     report (no need to scroll past the noisy first-run output).
+#
+# Run from inside `src/` (Woodpecker preserves cwd across `commands:`,
+# so the upstream `cd ./src` carries through).
+
+set +e  # do NOT bail on first failure; we WANT to handle it
+
+LOG=$(mktemp -t ft-retry.XXXXXX.log)
+trap 'rm -f "$LOG"' EXIT
+
+echo "──── First run ────"
+python manage.py test "$@" 2>&1 | tee "$LOG"
+FIRST=${PIPESTATUS[0]}
+
+if [ "$FIRST" -eq 0 ]; then
+    exit 0
+fi
+
+# Parse failure labels. Match both FAIL: and ERROR: lines; the dotted
+# path lives inside the trailing parens. `sort -u` dedupes if a single
+# test produces multiple lines (rare but possible).
+FAILED=$(grep -E '^(FAIL|ERROR): ' "$LOG" \
+         | sed -E 's/^.*\(([^)]+)\)[^()]*$/\1/' \
+         | sort -u \
+         | tr '\n' ' ')
+
+if [ -z "$FAILED" ]; then
+    echo "──── First run failed, but no FAIL/ERROR labels parseable ────"
+    echo "──── Not retrying — likely an infra problem, not a test flake ────"
+    exit "$FIRST"
+fi
+
+NUM=$(echo "$FAILED" | wc -w | tr -d ' ')
+echo ""
+echo "──── Retry ($NUM failed test(s) from first run) ────"
+echo "$FAILED" | tr ' ' '\n' | sed 's/^/  /'
+echo "─────────────────────────────────────────────────────"
+echo ""
+
+python manage.py test $FAILED

.woodpecker/main.yaml

@@ -11,13 +11,21 @@ services:
 
 steps:
   - name: test-UTs-n-ITs
-    image: python:3.13-slim
+    image: gitea.earthmanrpg.me/discoman/python-tdd-ci:latest
     environment:
       DATABASE_URL: postgresql://postgres:postgres@postgres/python_tdd_test
       CELERY_BROKER_URL: redis://redis:6379/0
       REDIS_URL: redis://redis:6379/1
+      PIP_CACHE_DIR: .pip-cache
     commands:
-      - pip install -r requirements.txt
+      # `requirements.dev.txt` is the pinned superset Dockerfile.ci pre-
+      # installs; pinning here means pip skips resolver+download and just
+      # verifies "already satisfied" (~5-10s) instead of resolving unpinned
+      # requirements.txt against PyPI from scratch (~30-60s). Drift safety
+      # net: if requirements.dev.txt has changed since the CI image was
+      # last rebuilt + pushed, pip installs the delta — slower for that
+      # run but never broken. See TDD SKILL.md § CI dependency discipline.
+      - pip install -r requirements.dev.txt
       - cd ./src
       - python manage.py test apps
     when:
@@ -29,6 +37,8 @@ steps:
 
   - name: test-two-browser-FTs
     image: gitea.earthmanrpg.me/discoman/python-tdd-ci:latest
+    depends_on:
+      - test-UTs-n-ITs
     environment:
       HEADLESS: 1
       CELERY_BROKER_URL: redis://redis:6379/0
@@ -37,13 +47,25 @@ steps:
         from_secret: stripe_secret_key
       STRIPE_PUBLISHABLE_KEY:
         from_secret: stripe_publishable_key
+      PIP_CACHE_DIR: .pip-cache
     commands:
-      - pip install -r requirements.txt
+      - pip install -r requirements.dev.txt
       - cd ./src
+      # Also collectstatic'd here; output sits in the shared workspace so
+      # the downstream FT steps don't have to repeat it.
       - python manage.py collectstatic --noinput
-      - python manage.py test functional_tests --tag=two-browser
+      # All three tag-stages run through `_retry_failed.sh` so a single
-      - python manage.py test functional_tests --tag=sequential
+      # browsing-context-discarded / NoSuchWindow flake on a multi-browser
-      - python manage.py test functional_tests --tag=channels
+      # channels FT (typically the LAST test in the suite, when Firefox
+      # has accumulated memory pressure from 21 prior browser launches)
+      # costs ~30s on retry instead of failing the whole step. Matches
+      # the retry posture of test-FTs-room + test-FTs-non-room. First-
+      # run-green still exits 0 immediately — no overhead in the happy
+      # path. First-run-crash w. no parseable labels propagates the
+      # original exit (genuine infra problems aren't masked).
+      - bash ../.woodpecker/_retry_failed.sh functional_tests --tag=two-browser
+      - bash ../.woodpecker/_retry_failed.sh functional_tests --tag=sequential
+      - bash ../.woodpecker/_retry_failed.sh functional_tests --tag=channels
     when:
       - event: push
         path:
@@ -51,21 +73,104 @@ steps:
           - "requirements.txt"
           - ".woodpecker/main.yaml"
 
-  - name: test-FTs
+  # ── FT split (stage-parallel, intra-stage sequential) ─────────────────
+  #
+  # test_game_room_* is the heaviest cluster — 9 Selenium-driven room-flow
+  # FTs that historically dominate the FT step wall-clock (~70% of the
+  # ~40-min single-step runs). Split off into its own step (`test-FTs-room`)
+  # so the partition is visible in the pipeline view; the non-room bucket
+  # is `test-FTs-non-room`. Both depend on test-two-browser-FTs only, so
+  # they fan out + run concurrently.
+  #
+  # The previous SQLite-collision blocker (pipeline #296: second step
+  # started against the first step's half-created `src/test_db.sqlite3`
+  # → Django interactive prompt → EOFError under non-interactive CI
+  # stdin) is resolved by giving each step a distinct `DATABASE_URL`
+  # pointing at its own sqlite file under /tmp — outside the shared
+  # workspace mount so the two stages can't see each other's DB.
+  #
+  # `--parallel` is dropped from both steps. Empirically (pipelines
+  # #302-304) it was giving ~1-1.5x speedup at most on these Selenium
+  # FTs — Firefox spawn cost + RAM pressure + SQLite file-lock contention
+  # eat most of the gain — while amplifying every transient-DOM flake
+  # (login-race, gecko-perms, ElementNotInteractable, Jasmine-timeout).
+  # Stage-level parallelism gives the same wall-clock reduction without
+  # contention amplification.
+
+  - name: test-FTs-non-room
     image: gitea.earthmanrpg.me/discoman/python-tdd-ci:latest
+    depends_on:
+      - test-two-browser-FTs
     environment:
       HEADLESS: 1
+      # /tmp path (not workspace-relative) so the parallel test-FTs-room
+      # step can't see this DB + vice versa. See split-rationale above.
+      DATABASE_URL: sqlite:////tmp/test_db_non_room.sqlite3
       CELERY_BROKER_URL: redis://redis:6379/0
       REDIS_URL: redis://redis:6379/1
       STRIPE_SECRET_KEY:
         from_secret: stripe_secret_key
       STRIPE_PUBLISHABLE_KEY:
         from_secret: stripe_publishable_key
+      PIP_CACHE_DIR: .pip-cache
     commands:
-      - pip install -r requirements.txt
+      - pip install -r requirements.dev.txt
       - cd ./src
-      - python manage.py collectstatic --noinput
+      # Every FT file EXCEPT test_game_room_*, test_trinket_*, AND
-      - python manage.py test functional_tests --parallel --exclude-tag=channels --exclude-tag=two-browser
+      # test_game_my_sea* — all three clusters run in test-FTs-room.
+      # Channels + two-browser tags already covered upstream.
+      # `ls | grep -v | sed` enumerates module dotted-paths from
+      # filenames. (No trailing `_` in the my-sea alternative — the
+      # file is `test_game_my_sea.py` w. no further suffix today.)
+      #
+      # Wrapped in `_retry_failed.sh` so a single Selenium flake (browser
+      # hang, gecko-perms blip, login race) at test N/M doesn't cost the
+      # full step wall-clock on retry — the script parses Django's
+      # FAIL:/ERROR: lines from stdout + re-runs only those labels.
+      - bash ../.woodpecker/_retry_failed.sh --exclude-tag=channels --exclude-tag=two-browser $(ls functional_tests/test_*.py | grep -vE 'test_(game_room|trinket)_|test_game_my_sea' | sed 's|/|.|g;s|\.py||')
+    when:
+      - event: push
+        path:
+          - "src/**"
+          - "requirements.txt"
+          - ".woodpecker/main.yaml"
+
+  - name: test-FTs-room
+    image: gitea.earthmanrpg.me/discoman/python-tdd-ci:latest
+    depends_on:
+      - test-two-browser-FTs
+    environment:
+      HEADLESS: 1
+      # /tmp path (not workspace-relative) so test-FTs-non-room can't see
+      # this DB + vice versa. See split-rationale above.
+      DATABASE_URL: sqlite:////tmp/test_db_room.sqlite3
+      CELERY_BROKER_URL: redis://redis:6379/0
+      REDIS_URL: redis://redis:6379/1
+      STRIPE_SECRET_KEY:
+        from_secret: stripe_secret_key
+      STRIPE_PUBLISHABLE_KEY:
+        from_secret: stripe_publishable_key
+      PIP_CACHE_DIR: .pip-cache
+    commands:
+      - pip install -r requirements.dev.txt
+      - cd ./src
+      # Heavy Selenium room flows — test_game_room_* (deck_contrib,
+      # gatekeeper, invite, select_role/sea/sig/sky, tray, tray_tooltip),
+      # test_trinket_* (carte_blanche, coin_on_a_string, backstage_pass)
+      # since trinket FTs create rooms + load the room template (where
+      # the table hex SCSS + chair geometry live), AND test_game_my_sea*
+      # (49 my-sea FTs that DRY-reuse the room-shell hex + sea-cross
+      # picker — same Selenium surface, so the same parallel-stage
+      # contention concerns apply). Runs in parallel w. test-FTs-non-room
+      # (distinct DATABASE_URL paths under /tmp; see split-rationale).
+      #
+      # `_retry_failed.sh` parses Django FAIL:/ERROR: lines from the first
+      # run's stdout + re-runs just those labels — single-flake retries
+      # cost ~22s instead of the full ~35-min step wall-clock. Genuine
+      # regressions still fail (second run output is the authoritative
+      # report); first-run crashes w. no parseable labels propagate
+      # the original exit code (don't silently mask infra problems).
+      - bash ../.woodpecker/_retry_failed.sh --exclude-tag=channels --exclude-tag=two-browser $(ls functional_tests/test_game_room_*.py functional_tests/test_trinket_*.py functional_tests/test_game_my_sea*.py | sed 's|/|.|g;s|\.py||')
     when:
       - event: push
         path:
@@ -75,6 +180,9 @@ steps:
 
   - name: screendumps
     image: gitea.earthmanrpg.me/discoman/python-tdd-ci:latest
+    depends_on:
+      - test-FTs-non-room
+      - test-FTs-room
     commands:
       - cat ./src/functional_tests/screendumps/*.html || echo "No screendumps found"
     when:
@@ -87,6 +195,9 @@ steps:
 
   - name: build-and-push
     image: docker:cli
+    depends_on:
+      - test-FTs-non-room
+      - test-FTs-room
     environment:
       REGISTRY_PASSWORD:
         from_secret: gitea_registry_password
@@ -105,6 +216,8 @@ steps:
 
   - name: deploy-staging
     image: alpine
+    depends_on:
+      - build-and-push
     environment:
       SSH_KEY:
         from_secret: deploy_ssh_key
@@ -126,6 +239,8 @@ steps:
 
   - name: deploy-prod
     image: alpine
+    depends_on:
+      - build-and-push
     environment:
       SSH_KEY:
         from_secret: deploy_ssh_key

CLAUDE.md

@@ -73,7 +73,7 @@ python src/manage.py setup_sig_session --base-url http://localhost:8000
 python src/manage.py setup_sig_session --room <uuid>
 ```
 
-Fixed gamers: `founder@test.io` (discoman), `amigo@test.io`, `bud@test.io`, `pal@test.io`, `dude@test.io`, `bro@test.io` — all superusers with Earthman deck. URLs use `/lyric/dev-login/<session_key>/` pre-auth pattern.
+Fixed gamers: `founder@test.io` (discoman), `amigo@test.io`, `bud@test.io`, `pal@test.io`, `dude@test.io`, `bro@test.io` — all superusers with Earthman deck. URLs use `/dashboard/dev-login/<session_key>/` pre-auth pattern.
 
 ## CI/CD + Hosting
 - Git remote: `git@gitea:discoman/python-tdd.git` (port 222, key `~/.ssh/gitea_keys/id_ed25519_python-tdd`)
@@ -110,7 +110,7 @@ Drop → RESERVED → confirm/reject. `_gate_context()` builds slot state; `_exp
 `epic:room` view at `/gameboard/room/<uuid>/`. `gatekeeper` redirects there when `table_status` is set. Error redirects in `select_role`/`select_sig` use `epic:room` if `table_status` is set, else `epic:gatekeeper`.
 
 ## SCSS Import Order
-`core.scss`: `rootvars → applets → base → button-pad → dashboard → gameboard → palette-picker → room → card-deck → natus → tray → billboard → tooltips → game-kit → wallet-tokens`
+`core.scss`: `rootvars → applets → base → button-pad → dashboard → gameboard → palette-picker → room → card-deck → sky → tray → billboard → tooltips → game-kit → wallet-tokens`
 
 ## Critical Gotchas
 
@@ -140,4 +140,7 @@ Use `.parent:has(.child-class)` to style a parent based on its contents without
 ### Plausible FT noise
 Plausible analytics script in `base.html` fires a beacon during Selenium tests → harmless console error. Fix: `{% if not debug %}` guard around the script tag.
 
+### JSONField `.exclude(data__key=value)` on SQLite
+`.exclude(data__retracted=True)` on a row whose `data` has no `retracted` key resolves to `WHERE NOT (NULL = TRUE)` → NULL → SQL filters that row out. The exclude becomes "exclude rows where the key is True OR missing" instead of "exclude rows where the key is True". PostgreSQL evaluates this correctly, so the bug only manifests in local dev / SQLite ITs. If you mean *exclude only when the key exists and equals X*, do the predicate in Python after fetching a buffered queryset (see `_billboard_context` for the pattern). The same trap applies to `.filter(data__key=value)` — you'll silently miss rows where the key is missing.
+
 See `.claude/skills/TDD/SKILL.md` for test-specific gotchas (TransactionTestCase flush, static files in tests, Selenium text-transform, multi-browser CI, msgpack integer keys).

infra/coturn-playbook.yaml

@@ -0,0 +1,81 @@
+# Provision the dedicated coturn (TURN/STUN) droplet for WebRTC mesh voice —
+# Phase C of the my-sea invite/voice sprint. Mirrors the PySwiss split: its own
+# DigitalOcean droplet, NOT the app box. CI needs none of this (signaling tests
+# use the in-memory channel layer; the TURN endpoint is unit-tested w. a fake
+# secret) — this runs only when you actually stand voice up on staging/prod.
+#
+# Prereqs (manual, one-time):
+#   1. Create a DO droplet + a reserved/static public IP; point
+#      turn.earthmanrpg.me at it.
+#   2. Add it to inventory.ini under [coturn] with host_vars:
+#        coturn_secret, coturn_realm, coturn_public_ip[, coturn_private_ip,
+#        coturn_tls_cert, coturn_tls_key]
+#   3. Put the SAME coturn_secret into the APP droplet's env as
+#      COTURN_SHARED_SECRET (+ COTURN_TURN_HOST=turn.earthmanrpg.me,
+#      COTURN_REALM) so the /api/voice/turn-credentials/ HMAC matches.
+#
+# Run:  ansible-playbook -i inventory.ini coturn-playbook.yaml
+#
+# nginx already proxy-upgrades WebSocket on the APP droplet (nginx.conf.j2), so
+# ws/voice/ rides the existing proxy — no nginx change here.
+- hosts: coturn
+  become: true
+
+  tasks:
+    - name: Install coturn
+      ansible.builtin.apt:
+        name: coturn
+        state: latest
+        update_cache: true
+
+    - name: Enable the coturn daemon
+      ansible.builtin.lineinfile:
+        path: /etc/default/coturn
+        regexp: '^#?TURNSERVER_ENABLED='
+        line: 'TURNSERVER_ENABLED=1'
+
+    - name: Ensure turn log dir exists
+      ansible.builtin.file:
+        path: /var/log/turnserver
+        state: directory
+        owner: turnserver
+        group: turnserver
+        mode: '0755'
+
+    - name: Deploy turnserver.conf
+      ansible.builtin.template:
+        src: coturn.conf.j2
+        dest: /etc/turnserver.conf
+        mode: '0640'
+      notify: Restart coturn
+
+    - name: Open STUN/TURN signaling ports (3478 udp+tcp)
+      community.general.ufw:
+        rule: allow
+        port: '3478'
+        proto: "{{ item }}"
+      loop: [udp, tcp]
+
+    - name: Open TURN-over-TLS port (5349 tcp)
+      community.general.ufw:
+        rule: allow
+        port: '5349'
+        proto: tcp
+
+    - name: Open the relay UDP port range (49152-65535)
+      community.general.ufw:
+        rule: allow
+        port: '49152:65535'
+        proto: udp
+
+    - name: Enable + start coturn
+      ansible.builtin.systemd:
+        name: coturn
+        enabled: true
+        state: started
+
+  handlers:
+    - name: Restart coturn
+      ansible.builtin.systemd:
+        name: coturn
+        state: restarted

infra/coturn.conf.j2

@@ -0,0 +1,64 @@
+# coturn (TURN/STUN) config for the EarthmanRPG WebRTC mesh voice feature —
+# Phase C of the my-sea invite/voice sprint. Rendered by coturn-playbook.yaml
+# onto a DEDICATED droplet (PySwiss-style split), NOT the app droplet.
+#
+# The app's /api/voice/turn-credentials/ endpoint signs ephemeral credentials
+# with HMAC-SHA1(<expiry>:<user_id>, secret); `use-auth-secret` +
+# `static-auth-secret` here must use the SAME secret (COTURN_SHARED_SECRET in
+# the app env).
+
+listening-port=3478
+tls-listening-port=5349
+
+fingerprint
+lt-cred-mech
+use-auth-secret
+static-auth-secret={{ coturn_secret }}
+realm={{ coturn_realm }}
+
+# ── THE #1 FOOTGUN ──────────────────────────────────────────────────────────
+# Without external-ip, coturn hands out its PRIVATE address as the relay
+# candidate and every relayed connection silently fails. On a DigitalOcean
+# droplet with a single public IP set it to that IP; if the droplet also has a
+# private/anchor IP, use PUBLIC/PRIVATE so coturn maps between them.
+external-ip={{ coturn_public_ip }}{% if coturn_private_ip is defined and coturn_private_ip %}/{{ coturn_private_ip }}{% endif %}
+{% if coturn_public_ip6 is defined and coturn_public_ip6 %}
+# Dual-stack: advertise IPv6 relay candidates too. coturn auto-binds all
+# interfaces (incl. v6) since no listening-ip is pinned; this maps the public
+# v6 explicitly. Set coturn_public_ip6 in inventory to enable — leave it unset
+# for a pure-IPv4 server (the v6 peer-lockdown below is gated on the same var).
+external-ip={{ coturn_public_ip6 }}
+{% endif %}
+
+# Relay port range — open this exact UDP range in the firewall (playbook does).
+min-port=49152
+max-port=65535
+
+# ── TLS (turns: on 5349) — prod hardening ──────────────────────────────────
+{% if coturn_tls_cert is defined and coturn_tls_cert %}
+cert={{ coturn_tls_cert }}
+pkey={{ coturn_tls_key }}
+{% endif %}
+no-tlsv1
+no-tlsv1_1
+
+# ── Lockdown: relay only, no SSRF via the TURN server ───────────────────────
+no-multicast-peers
+no-cli
+no-software-attribute
+# Block relaying to private ranges so the box can't be used to probe internals.
+denied-peer-ip=10.0.0.0-10.255.255.255
+denied-peer-ip=172.16.0.0-172.31.255.255
+denied-peer-ip=192.168.0.0-192.168.255.255
+denied-peer-ip=127.0.0.0-127.255.255.255
+{% if coturn_public_ip6 is defined and coturn_public_ip6 %}
+# IPv6 lockdown parity (only emitted when serving v6): loopback, link-local
+# (fe80::/10), and unique-local (fc00::/7). coturn takes start-end ranges, not
+# CIDR. Keeps a dual-stack relay from being pointed at internal v6 addresses.
+denied-peer-ip=::1
+denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+{% endif %}
+
+log-file=/var/log/turnserver/turn.log
+simple-log

infra/gamearray.env.j2

@@ -10,4 +10,11 @@ STRIPE_SECRET_KEY={{ stripe_secret_key }}
 CELERY_BROKER_URL=redis://gamearray_redis:6379/0
 REDIS_URL=redis://gamearray_redis:6379/1
 PYSWISS_URL=https://charts.earthmanrpg.me
+# coturn / WebRTC voice — only COTURN_SHARED_SECRET is sensitive (it signs the
+# TURN HMAC creds + must equal the coturn droplet's static-auth-secret). Host +
+# realm are public. coturn_secret comes from the vault (share it across the app
+# + coturn host groups, e.g. group_vars/all/vault.yaml, so both plays match).
+COTURN_SHARED_SECRET={{ coturn_secret }}
+COTURN_TURN_HOST=turn.earthmanrpg.me
+COTURN_REALM=earthmanrpg.me
 

infra/group_vars/all/vault.yaml

@@ -0,0 +1,10 @@
+$ANSIBLE_VAULT;1.1;AES256
+62633637333430623762333637306466646161323861663564373533353565366661616433376465
+6138653163616138396163363764353464616133303731370a656166623332656234356564373330
+34656230353138653939313337376365343866623461616466343131313236303439613664616333
+6665333231353436650a616663653630613465613931353232383437623434383930313862626164
+39653231326663626562323832666264366331306365333061613535396532303937343065616261
+62663638386235373566336634616331396434643134303731646435396563343333333034303063
+66313030396437666461303137613233666366376430356164386561626337643930383433653130
+39663237303737333834366530303435666366336664363666646632396630626434373535303937
+3739

infra/inventory.ini

@@ -8,3 +8,15 @@ dashboard.earthmanrpg.me ansible_user=discoman ansible_ssh_private_key_file=~/.s
 
 [cicd]
 gitea.earthmanrpg.me ansible_user=root ansible_ssh_private_key_file=~/.ssh/id_ed25519_wsl_python-tdd
+
+# Dedicated coturn (TURN/STUN) droplet for WebRTC mesh voice — provisioned by
+# coturn-playbook.yaml. UNCOMMENT + fill once the droplet + static IP exist
+# (see the playbook header). coturn_secret is NOT set here — it comes from the
+# shared vault (group_vars/all/vault.yaml) so it matches the app's
+# COTURN_SHARED_SECRET. (Inventory host_vars OVERRIDE group_vars, so never put
+# coturn_secret on this line or it would clobber the vault value.)
+# coturn_private_ip / coturn_tls_* are optional. coturn_public_ip6 (optional):
+# set the droplet's public IPv6 to serve dual-stack TURN (adds a v6 external-ip
+# + matching v6 peer-denial lockdown); leave unset for a pure-IPv4 relay.
+[coturn]
+turn.earthmanrpg.me ansible_user=root ansible_ssh_private_key_file=~/.ssh/id_ed25519_wsl_python-tdd coturn_realm=earthmanrpg.me coturn_public_ip=167.172.236.157 coturn_public_ip6=2604:a880:800:14:0:3:384:6000

requirements.dev.txt

@@ -1,6 +1,7 @@
 asgiref==3.11.0
 attrs==25.4.0
 certifi==2025.11.12
+celery
 cffi==2.0.0
 channels
 channels-redis
@@ -23,9 +24,11 @@ idna==3.11
 lxml==6.0.2
 outcome==1.3.0.post0
 packaging==25.0
+psycopg2-binary
 pycparser==2.23
 PySocks==1.7.1
 python-dotenv
+redis
 requests==2.32.5
 scipy
 selenium==4.39.0

requirements.txt

@@ -16,7 +16,7 @@ gunicorn==23.0.0
 lxml==6.0.2
 psycopg2-binary
 redis
-requests==2.31.0
+requests==2.32.5
 scipy
 stripe
 whitenoise==6.11.0

src/.coveragerc

@@ -4,6 +4,8 @@ omit =
     */migrations/*
     */tests/*
     */routing.py
+    */reset_staging_db.py
+    */delete_stale_my_sea_draws.py
 
 [report]
 show_missing = true

src/apps/api/serializers.py

@@ -1,6 +1,6 @@
 from rest_framework import serializers
 
-from apps.dashboard.models import Line, Post
+from apps.billboard.models import Line, Post
 from apps.lyric.models import User
 
 
@@ -18,7 +18,7 @@ class LineSerializer(serializers.ModelSerializer):
         fields = ["id", "text"]
 
 class PostSerializer(serializers.ModelSerializer):
-    name = serializers.ReadOnlyField()
+    name = serializers.ReadOnlyField(source="title")
     url = serializers.CharField(source="get_absolute_url", read_only=True)
     lines = LineSerializer(many=True, read_only=True)
 

src/apps/api/tests/integrated/test_turn_credentials.py

@@ -0,0 +1,55 @@
+"""ITs for the WebRTC mesh TURN-credentials endpoint — Phase C of
+[[my-sea-invite-voice-blueprint]]. Verifies the coturn `use-auth-secret`
+REST scheme (HMAC-SHA1 username/credential) + auth gating.
+"""
+
+import base64
+import hashlib
+import hmac
+
+from django.test import TestCase, override_settings
+from django.urls import reverse
+
+from apps.lyric.models import User
+
+
+@override_settings(
+    COTURN_SHARED_SECRET="testsecret",
+    COTURN_TURN_HOST="turn.test",
+    COTURN_TTL=86400,
+)
+class TURNCredentialsTest(TestCase):
+    def setUp(self):
+        self.user = User.objects.create(email="turn@test.io", username="turner")
+        self.url = reverse("api_turn_credentials")
+
+    def test_requires_authentication(self):
+        resp = self.client.get(self.url)
+        self.assertIn(resp.status_code, (401, 403))
+
+    def test_returns_ice_servers_and_ttl(self):
+        self.client.force_login(self.user)
+        data = self.client.get(self.url).json()
+        self.assertEqual(data["ttl"], 86400)
+        urls = [s for srv in data["iceServers"] for s in srv["urls"]]
+        self.assertTrue(any(u.startswith("stun:turn.test") for u in urls))
+        self.assertTrue(any("turn:turn.test" in u and "transport=udp" in u for u in urls))
+        self.assertTrue(any("turn:turn.test" in u and "transport=tcp" in u for u in urls))
+
+    def test_username_is_expiry_colon_user_id(self):
+        self.client.force_login(self.user)
+        data = self.client.get(self.url).json()
+        expiry_str, _, uid = data["username"].partition(":")
+        self.assertTrue(expiry_str.isdigit())
+        self.assertEqual(uid, str(self.user.id))
+
+    def test_credential_is_hmac_sha1_of_username(self):
+        self.client.force_login(self.user)
+        data = self.client.get(self.url).json()
+        expected = base64.b64encode(
+            hmac.new(b"testsecret", data["username"].encode(), hashlib.sha1).digest()
+        ).decode()
+        self.assertEqual(data["credential"], expected)
+        # The TURN iceServer entry carries the same credential.
+        turn = [s for s in data["iceServers"] if "credential" in s][0]
+        self.assertEqual(turn["credential"], expected)

src/apps/api/tests/integrated/test_views.py

@@ -1,7 +1,7 @@
 from django.test import TestCase
 from rest_framework.test import APIClient
 
-from apps.dashboard.models import Line, Post
+from apps.billboard.models import Line, Post
 from apps.lyric.models import User
 
 class BaseAPITest(TestCase):
@@ -14,8 +14,8 @@ class BaseAPITest(TestCase):
 class PostDetailAPITest(BaseAPITest):
     def test_returns_post_with_lines(self):
         post = Post.objects.create(owner=self.user)
-        Line.objects.create(text="line 1", post=post)
+        Line.objects.create(text="line 1", post=post, author=self.user)
-        Line.objects.create(text="line 2", post=post)
+        Line.objects.create(text="line 2", post=post, author=self.user)
 
         response = self.client.get(f"/api/posts/{post.id}/")
 
@@ -49,7 +49,7 @@ class PostLinesAPITest(BaseAPITest):
 
     def test_cannot_add_duplicate_line_to_post(self):
         post = Post.objects.create(owner=self.user)
-        Line.objects.create(text="post line", post=post)
+        Line.objects.create(text="post line", post=post, author=self.user)
         duplicate_response = self.client.post(
             f"/api/posts/{post.id}/lines/",
             {"text": "post line"},
@@ -61,7 +61,7 @@ class PostLinesAPITest(BaseAPITest):
 class PostsAPITest(BaseAPITest):
     def test_get_returns_only_users_posts(self):
         post1 = Post.objects.create(owner=self.user)
-        Line.objects.create(text="line 1", post=post1)
+        Line.objects.create(text="line 1", post=post1, author=self.user)
         other_user = User.objects.create_user("other@example.com")
         Post.objects.create(owner=other_user)
 

src/apps/api/urls.py

@@ -8,4 +8,6 @@ urlpatterns = [
     path('posts/<uuid:post_id>/', views.PostDetailAPI.as_view(), name='api_post_detail'),
     path('posts/<uuid:post_id>/lines/', views.PostLinesAPI.as_view(), name='api_post_lines'),
     path('users/', views.UserSearchAPI.as_view(), name='api_users'),
+    path('voice/turn-credentials/', views.VoiceTURNCredentialsAPI.as_view(),
+         name='api_turn_credentials'),
 ]

src/apps/api/views.py

@@ -1,9 +1,16 @@
+import base64
+import hashlib
+import hmac
+import time
+
+from django.conf import settings
 from django.shortcuts import get_object_or_404
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.views import APIView
 from rest_framework.response import Response
 
 from apps.api.serializers import LineSerializer, PostSerializer, UserSerializer
-from apps.dashboard.models import Line, Post
+from apps.billboard.models import Line, Post
 from apps.lyric.models import User
 
 
@@ -18,7 +25,7 @@ class PostLinesAPI(APIView):
         post = get_object_or_404(Post, id=post_id)
         serializer = LineSerializer(data=request.data, context={"post": post})
         if serializer.is_valid():
-            serializer.save(post=post)
+            serializer.save(post=post, author=request.user)
             return Response(serializer.data, status=201)
         return Response(serializer.errors, status=400)
 
@@ -29,8 +36,9 @@ class PostsAPI(APIView):
         return Response(serializer.data)
 
     def post(self, request):
-        post = Post.objects.create(owner=request.user)
+        text = request.data.get("text", "")
-        line = Line.objects.create(text=request.data.get("text", ""), post=post)
+        post = Post.objects.create(owner=request.user, title=text[:35])
+        Line.objects.create(text=text, post=post, author=request.user)
         serializer = PostSerializer(post)
         return Response(serializer.data, status=201)
 
@@ -43,3 +51,44 @@ class UserSearchAPI(APIView):
         )
         serializer = UserSerializer(users, many=True)
         return Response(serializer.data)
+
+
+class VoiceTURNCredentialsAPI(APIView):
+    """Time-limited TURN/STUN credentials for the WebRTC mesh voice client
+    (Phase C of [[my-sea-invite-voice-blueprint]]). Implements the coturn
+    `use-auth-secret` REST scheme: username = `<expiry>:<user_id>`, credential
+    = base64(HMAC-SHA1(username, COTURN_SHARED_SECRET)) — the coturn droplet
+    validates it with the same shared secret, so no per-user state is stored
+    on either side. Authenticated-only."""
+
+    permission_classes = [IsAuthenticated]
+
+    def get(self, request):
+        host = settings.COTURN_TURN_HOST
+        ttl = settings.COTURN_TTL
+        expiry = int(time.time()) + ttl
+        username = f"{expiry}:{request.user.id}"
+        digest = hmac.new(
+            settings.COTURN_SHARED_SECRET.encode(),
+            username.encode(),
+            hashlib.sha1,
+        ).digest()
+        credential = base64.b64encode(digest).decode()
+
+        ice_servers = []
+        if host:
+            ice_servers.append({"urls": [f"stun:{host}:3478"]})
+            ice_servers.append({
+                "urls": [
+                    f"turn:{host}:3478?transport=udp",
+                    f"turn:{host}:3478?transport=tcp",
+                ],
+                "username": username,
+                "credential": credential,
+            })
+        return Response({
+            "iceServers": ice_servers,
+            "username": username,
+            "credential": credential,
+            "ttl": ttl,
+        })

src/apps/applets/migrations/0004_rename_billboard_applet_slugs.py

@@ -0,0 +1,56 @@
+"""Drop the legacy `billboard-` slug prefix from billboard applets and
+rename Most Recent → Most Recent Scroll.
+
+The `billboard-` prefix snuck into seed migration 0003 against intent — no
+other context (dashboard, gameboard, wallet, game-kit) prefixes its applet
+slugs with the context name, and slugs need to stay portable so users can
+later rearrange which page hosts which applet.
+"""
+from django.db import migrations
+
+
+RENAMES = [
+    # (old_slug,                new_slug,             new_name_or_None)
+    ('billboard-my-scrolls',    'my-scrolls',         None),
+    ('billboard-my-contacts',   'my-contacts',        None),
+    ('billboard-most-recent',   'most-recent-scroll', 'Most Recent Scroll'),
+    ('billboard-notes',         'notes',              None),
+]
+
+
+def _apply(apps, mapping):
+    Applet = apps.get_model('applets', 'Applet')
+    for old_slug, new_slug, new_name in mapping:
+        try:
+            applet = Applet.objects.get(slug=old_slug)
+        except Applet.DoesNotExist:
+            continue
+        applet.slug = new_slug
+        fields = ['slug']
+        if new_name is not None:
+            applet.name = new_name
+            fields.append('name')
+        applet.save(update_fields=fields)
+
+
+def forward(apps, schema_editor):
+    _apply(apps, RENAMES)
+
+
+def backward(apps, schema_editor):
+    inverse = [
+        (new, old, 'Most Recent' if old == 'billboard-most-recent' else None)
+        for (old, new, _) in RENAMES
+    ]
+    _apply(apps, inverse)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('applets', '0003_seed_applets'),
+    ]
+
+    operations = [
+        migrations.RunPython(forward, backward),
+    ]

src/apps/applets/migrations/0005_seed_pronouns_applet.py

@@ -0,0 +1,33 @@
+"""Seed the Pronouns applet on the Game Kit page (3x3, default visible)."""
+from django.db import migrations
+
+
+SLUG = "pronouns"
+NAME = "Pronouns"
+CONTEXT = "game-kit"
+
+
+def forward(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.get_or_create(
+        slug=SLUG,
+        defaults={
+            "name": NAME,
+            "context": CONTEXT,
+            "default_visible": True,
+            "grid_cols": 3,
+            "grid_rows": 3,
+        },
+    )
+
+
+def backward(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.filter(slug=SLUG).delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("applets", "0004_rename_billboard_applet_slugs"),
+    ]
+    operations = [migrations.RunPython(forward, backward)]

src/apps/applets/migrations/0006_rename_contacts_to_buddies.py

@@ -0,0 +1,41 @@
+"""Rename the billboard `my-contacts` applet to `my-buddies` (slug + name).
+
+User.buddies M2M (lyric/0004) lands at the same time; the applet links
+to the new /billboard/my-buddies/ page where the user manages their
+buddy list. "Contacts" was a placeholder name from the original
+billboard scaffold.
+"""
+from django.db import migrations
+
+
+def forward(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    try:
+        applet = Applet.objects.get(slug="my-contacts")
+    except Applet.DoesNotExist:
+        return
+    applet.slug = "my-buddies"
+    applet.name = "My Buddies"
+    applet.save(update_fields=["slug", "name"])
+
+
+def backward(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    try:
+        applet = Applet.objects.get(slug="my-buddies")
+    except Applet.DoesNotExist:
+        return
+    applet.slug = "my-contacts"
+    applet.name = "Contacts"
+    applet.save(update_fields=["slug", "name"])
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("applets", "0005_seed_pronouns_applet"),
+    ]
+
+    operations = [
+        migrations.RunPython(forward, backward),
+    ]

src/apps/applets/migrations/0007_rename_my_buddies_to_my_buds.py

@@ -0,0 +1,40 @@
+"""Rename the My Buddies applet → My Buds (slug + name).
+
+UI-vocabulary tightening — see lyric/0005_rename_buddies_to_buds for the
+parallel User.buddies → User.buds field rename. BILLBUDDIES overflowed
+the page-header band; BILLBUDS fits cleanly.
+"""
+from django.db import migrations
+
+
+def forward(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    try:
+        applet = Applet.objects.get(slug="my-buddies")
+    except Applet.DoesNotExist:
+        return
+    applet.slug = "my-buds"
+    applet.name = "My Buds"
+    applet.save(update_fields=["slug", "name"])
+
+
+def backward(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    try:
+        applet = Applet.objects.get(slug="my-buds")
+    except Applet.DoesNotExist:
+        return
+    applet.slug = "my-buddies"
+    applet.name = "My Buddies"
+    applet.save(update_fields=["slug", "name"])
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("applets", "0006_rename_contacts_to_buddies"),
+    ]
+
+    operations = [
+        migrations.RunPython(forward, backward),
+    ]

src/apps/applets/migrations/0008_seed_my_sea_applet.py

@@ -0,0 +1,42 @@
+"""Seed the My Sea applet — Sprint 3 of the My Sea roadmap.
+
+The applet itself is just a shell for now (header + horizontal scroll
+container w. empty-state placeholder). Sprints 4+ will fill in the
+sig-select / sea-select / gatekeeper phases that render in the dedicated
+`my_sea.html` page reachable via the applet's header link.
+
+Grid: 12 cols × 4 rows — wide horizontal banner so the latest draw's
+10-card Celtic Cross spread can render left-to-right in the applet
+aperture, scrollable like My Palette.
+"""
+from django.db import migrations
+
+
+def seed(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.update_or_create(
+        slug="my-sea",
+        defaults={
+            "name": "My Sea",
+            "context": "gameboard",
+            "default_visible": True,
+            "grid_cols": 12,
+            "grid_rows": 4,
+        },
+    )
+
+
+def unseed(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.filter(slug="my-sea").delete()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("applets", "0007_rename_my_buddies_to_my_buds"),
+    ]
+
+    operations = [
+        migrations.RunPython(seed, unseed),
+    ]

src/apps/applets/migrations/0009_seed_my_sig_applet.py

@@ -0,0 +1,41 @@
+"""Seed the My Sign (a.k.a. My Significator) applet on billboard.
+
+Sprint 4 of the My Sea roadmap. "Significator" remains the storage-layer
+term (User.significator FK, room sig-select); the applet itself is "My
+Sign" (the "My X" convention for applet names) while the standalone page
+wordmark reads "Game Sign" (the "Game/Dash/Bill X" convention for pages).
+4×6 (narrow + tall), seeded after all other billboard applets so it
+renders at the end of the billboard grid. Shows the user's saved
+significator card or a blank state.
+"""
+from django.db import migrations
+
+
+def seed(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.update_or_create(
+        slug="my-sign",
+        defaults={
+            "name": "My Sign",
+            "context": "billboard",
+            "default_visible": True,
+            "grid_cols": 4,
+            "grid_rows": 6,
+        },
+    )
+
+
+def unseed(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.filter(slug="my-sign").delete()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("applets", "0008_seed_my_sea_applet"),
+    ]
+
+    operations = [
+        migrations.RunPython(seed, unseed),
+    ]

src/apps/applets/migrations/0010_rename_my_sign_applet.py

@@ -0,0 +1,31 @@
+"""Update the My Sign applet's display name — "Game Sign" → "My Sign".
+
+User clarified naming convention 2026-05-18: **applets** use the "My X"
+prefix (My Sign, My Sea, My Posts, etc.) while **standalone pages** use
+the "Game/Dash/Bill X" prefix (Game Sign page, Game Sea page, Game Kit
+page). Sprint 4a's initial migration (0009) set the applet name to
+"Game Sign", which the user corrected after seeing the gear-menu toggle
+list show the wrong word. Slug stays `my-sign` (URL + selectors stable).
+"""
+from django.db import migrations
+
+
+def rename(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.filter(slug="my-sign").update(name="My Sign")
+
+
+def unrename(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.filter(slug="my-sign").update(name="Game Sign")
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("applets", "0009_seed_my_sig_applet"),
+    ]
+
+    operations = [
+        migrations.RunPython(rename, unrename),
+    ]

src/apps/applets/migrations/0011_seed_wallet_shop_applet.py

@@ -0,0 +1,43 @@
+"""Seed the wallet Shop applet — Chunk 2 of the wallet expansion sprint.
+
+Locked spec from [[project-wallet-shop-expansion]]: 4 rows total in the
+wallet context (Shop atop, Balances + Tokens + Payment beneath); 12 cols
+in landscape (full-width row). Mimics the existing wallet applets'
+grid_cols=12 / grid_rows=3 shape.
+
+`display_order` is NOT a field on Applet — applet ordering is dictated
+by the wallet template's include order in `_applets.html` + the applet
+slug alphabetical fallback in `applet_context()`. The template's include
+order is set in Chunk 4; this migration just ensures the row exists.
+"""
+from django.db import migrations
+
+
+def seed(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.update_or_create(
+        slug="wallet-shop",
+        defaults={
+            "name": "Shop",
+            "context": "wallet",
+            "default_visible": True,
+            "grid_cols": 12,
+            "grid_rows": 3,
+        },
+    )
+
+
+def unseed(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.filter(slug="wallet-shop").delete()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("applets", "0010_rename_my_sign_applet"),
+    ]
+
+    operations = [
+        migrations.RunPython(seed, unseed),
+    ]

src/apps/applets/migrations/0012_applet_display_order.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0 on 2026-05-22 05:27
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('applets', '0011_seed_wallet_shop_applet'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='applet',
+            name='display_order',
+            field=models.PositiveSmallIntegerField(default=100),
+        ),
+    ]

src/apps/applets/migrations/0013_wallet_shop_display_order.py

@@ -0,0 +1,31 @@
+"""Pin the wallet Shop applet atop the wallet row.
+
+The 4-applet wallet layout (per [[project-wallet-shop-expansion]]) wants
+Shop first; the other 3 (Balances, Tokens, Payment) keep their historical
+order via the default `display_order=100` + PK tie-break.
+
+Idempotent — `update_or_create(slug=…, defaults={display_order: 10})`
+also covers fresh DBs where `0011_seed_wallet_shop_applet` already ran.
+"""
+from django.db import migrations
+
+
+def forward(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.filter(slug="wallet-shop").update(display_order=10)
+
+
+def reverse(apps, schema_editor):
+    Applet = apps.get_model("applets", "Applet")
+    Applet.objects.filter(slug="wallet-shop").update(display_order=100)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("applets", "0012_applet_display_order"),
+    ]
+
+    operations = [
+        migrations.RunPython(forward, reverse),
+    ]

src/apps/applets/models.py

@@ -18,6 +18,11 @@ class Applet(models.Model):
     default_visible = models.BooleanField(default=True)
     grid_cols = models.PositiveSmallIntegerField(default=12)
     grid_rows = models.PositiveSmallIntegerField(default=3)
+    # Render-time sort key. Lower = earlier in the applets row. Default 100
+    # gives every existing applet a tied position → falls back to PK insertion
+    # order (the historical behavior), so this field is backwards-compatible.
+    # Set to <100 to pin an applet ABOVE the rest (eg. wallet-shop = 10).
+    display_order = models.PositiveSmallIntegerField(default=100)
 
     def __str__(self):
         return self.name

src/apps/applets/static/apps/applets/applets.js

@@ -30,6 +30,7 @@ const appletContainerIds = new Set([
     'id_game_applets_container',
     'id_gk_sections_container',
     'id_wallet_applets_container',
+    'id_billboard_applets_wrapper',
 ]);
 
 document.body.addEventListener('htmx:afterSwap', (e) => {

src/apps/applets/static/apps/applets/row-lock.js

@@ -0,0 +1,60 @@
+// Click-lock state for `.applet-list-entry.row-3col` rows on the dashboard
+// applet grids (My Posts / My Buds / My Notes / My Scrolls / My Games).
+//
+// Hover styling is pure CSS (`.applet-list-entry.row-3col:hover`); this
+// module just persists the same highlight on tap/click so touch devices can
+// pin a row to read it, and mirrors the toggle-off / shift-to-other-row /
+// click-outside-dismiss behaviour the note-page click-lock established.
+//
+// State machine (clicking …):
+//   • a row that's not locked       → lock it (clearing any prior lock)
+//   • the currently-locked row again → unlock it
+//   • a different row                → move the lock to that row
+//   • anywhere not inside a row      → clear the lock
+
+(function () {
+    'use strict';
+
+    var _lockedRow = null;
+    var _bound = false;
+
+    function _clearLock() {
+        if (_lockedRow) {
+            _lockedRow.classList.remove('row-locked');
+            _lockedRow = null;
+        }
+    }
+
+    function _onClick(e) {
+        var row = e.target.closest('.applet-list-entry.row-3col');
+        if (row) {
+            if (row === _lockedRow) {
+                _clearLock();
+            } else {
+                _clearLock();
+                row.classList.add('row-locked');
+                _lockedRow = row;
+            }
+            return;
+        }
+        _clearLock();
+    }
+
+    function _init() {
+        if (_bound) return;
+        _bound = true;
+        document.addEventListener('click', _onClick);
+    }
+
+    function _testReset() {
+        _clearLock();
+    }
+
+    window.RowLock = {
+        _init: _init,
+        _testReset: _testReset,
+        get _lockedRow() { return _lockedRow; },
+    };
+
+    document.addEventListener('DOMContentLoaded', _init);
+}());

src/apps/applets/utils.py

@@ -13,9 +13,12 @@ def apply_applet_toggle(user, context, checked_slugs):
 
 def applet_context(user, context):
     ua_map = {ua.applet_id: ua.visible for ua in user.user_applets.all()}
-    applets = {a.slug: a for a in Applet.objects.filter(context=context)}
+    # `display_order` (lower = earlier) is the primary sort key; `pk` tie-breaks
+    # so applets at the default order=100 keep their historical insertion-order
+    # rendering. New applets that want pinned positions set order < 100 in
+    # their seed migration (eg. wallet-shop = 10 to render atop the wallet row).
+    applets_qs = Applet.objects.filter(context=context).order_by("display_order", "pk")
     return [
-        {"applet": applets[slug], "visible": ua_map.get(applets[slug].pk, applets[slug].default_visible)}
+        {"applet": a, "visible": ua_map.get(a.pk, a.default_visible)}
-        for slug in applets
+        for a in applets_qs
-        if slug in applets
     ]

src/apps/billboard/forms.py

@@ -1,22 +1,26 @@
 from django import forms
-from django.core.exceptions import ValidationError
+
 from .models import Line
 
+
 DUPLICATE_LINE_ERROR = "You've already logged this to your post"
 EMPTY_LINE_ERROR = "You can't have an empty post line"
 
+
 class LineForm(forms.Form):
     text = forms.CharField(
-        error_messages = {"required": EMPTY_LINE_ERROR},
+        error_messages={"required": EMPTY_LINE_ERROR},
         required=True,
     )
 
-    def save(self, for_post):
+    def save(self, for_post, author):
         return Line.objects.create(
             post=for_post,
             text=self.cleaned_data["text"],
+            author=author,
         )
 
+
 class ExistingPostLineForm(LineForm):
     def __init__(self, for_post, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -28,5 +32,5 @@ class ExistingPostLineForm(LineForm):
             raise forms.ValidationError(DUPLICATE_LINE_ERROR)
         return text
 
-    def save(self):
+    def save(self, author):
-        return super().save(for_post=self._for_post)
+        return super().save(for_post=self._for_post, author=author)

src/apps/billboard/mail.py

@@ -0,0 +1,99 @@
+"""@mailman-authored "Acceptances & rejections" invite log — Phase A of
+[[my-sea-invite-voice-blueprint]].
+
+`log_sea_invite(sea_invite)` appends one interactive Line + spawns one Brief
+on the invitee's single MAIL_ACCEPTANCE Post when an owner invites a bud to
+their my-sea table. Models on `apps.billboard.tax.log_tax_debit` (the @taxman
+ledger); the one genuinely new wrinkle is that the Line is *stateful* — its
+OK/BYE buttons render from the linked `SeaInvite.status` (see post.html, A5),
+so the single line transforms in place rather than appending accept/decline
+lines.
+
+Unlike the tax ledger, the prose carries no timestamp prefix (one invite =
+one line; the A6 view dedups duplicate PENDING/ACCEPTED invites before
+calling here, so the `Line.unique_together = (post, text)` invariant isn't
+stressed by repeat identical prose). `Line.display_text` therefore needs no
+MAIL_ACCEPTANCE branch.
+
+The post_save guard in `billboard.models` nukes any Line on a MAIL_ACCEPTANCE
+Post lacking admin_solicited=True, so this helper sets it True.
+"""
+
+from apps.billboard.models import (
+    Brief,
+    Line,
+    MAIL_ACCEPTANCE_POST_TITLE,
+    Post,
+)
+from apps.lyric.models import get_or_create_mailman, resolve_pronouns
+from apps.lyric.templatetags.lyric_extras import at_handle
+
+
+# Invite prose shown to the invitee. `{handle}` is wrapped in an
+# `<a class="post-attribution">` whose href routes to the owner's per-bud
+# landing page — bud landing page sprint 2026-05-27 replaced the in-Line
+# OK/BYE form-button block w. this navigational anchor. post.html's
+# `safe`-filter branch is gated on `line.author.username == 'mailman'`
+# (alongside 'adman'/'taxman') so the anchor renders as HTML.
+#
+# `{poss}` = the owner's possessive pronoun ("their"/"his"/"her"/…), so the
+# table reads as the owner's. Em dash matches the @taxman "Look!—" house style.
+INVITE_TEMPLATE = (
+    'Listen!—<a class="post-attribution" href="/billboard/buds/{owner_id}/">{handle}</a>'
+    " invites you to {poss} drawing table. "
+    "This invite will expire 24h from the time it was extended."
+)
+
+
+def log_sea_invite(sea_invite):
+    """Append a Line to the invitee's "Acceptances & rejections" Post (creating
+    the Post on first invite) + spawn a Brief that the invitee's next page-load
+    surfaces as a slide-down banner. Links the new Line back onto the SeaInvite
+    so its OK/BYE buttons render from `sea_invite.status`.
+
+    Returns ``(post, line, brief)``. For an unregistered invitee (``invitee``
+    FK still None) there is no per-user log surface yet — returns
+    ``(None, None, None)`` (linking on registration is deferred, mirroring the
+    long-standing RoomInvite-on-registration gap)."""
+    invitee = sea_invite.invitee
+    if invitee is None:
+        return None, None, None
+
+    owner = sea_invite.owner
+
+    post, _ = Post.objects.get_or_create(
+        owner=invitee,
+        kind=Post.KIND_MAIL_ACCEPTANCE,
+        defaults={"title": MAIL_ACCEPTANCE_POST_TITLE},
+    )
+    # Heal a title-less pre-feature Post once on next invite (mirrors the
+    # tax-ledger / Note.grant_if_new title heal).
+    if post.title != MAIL_ACCEPTANCE_POST_TITLE:
+        post.title = MAIL_ACCEPTANCE_POST_TITLE
+        post.save(update_fields=["title"])
+
+    text = INVITE_TEMPLATE.format(
+        owner_id=owner.id,
+        handle=at_handle(owner),
+        poss=resolve_pronouns(owner.pronouns)[2],
+    )
+
+    line = Line.objects.create(
+        post=post,
+        text=text,
+        author=get_or_create_mailman(),
+        admin_solicited=True,
+    )
+    # Link the Line onto the invite so post.html resolves OK/BYE state via the
+    # `line.sea_invite` OneToOne reverse accessor.
+    sea_invite.line = line
+    sea_invite.save(update_fields=["line"])
+
+    brief = Brief.objects.create(
+        owner=invitee,
+        post=post,
+        line=line,
+        kind=Brief.KIND_MAIL_ACCEPTANCE,
+        title=MAIL_ACCEPTANCE_POST_TITLE,
+    )
+    return post, line, brief

src/apps/billboard/migrations/0001_initial.py

@@ -0,0 +1,38 @@
+# Generated by Django 6.0 on 2026-05-08 21:11
+
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Post',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('owner', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='posts', to=settings.AUTH_USER_MODEL)),
+                ('shared_with', models.ManyToManyField(blank=True, related_name='shared_posts', to=settings.AUTH_USER_MODEL)),
+            ],
+        ),
+        migrations.CreateModel(
+            name='Line',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('text', models.TextField(default='')),
+                ('post', models.ForeignKey(default=None, on_delete=django.db.models.deletion.CASCADE, related_name='lines', to='billboard.post')),
+            ],
+            options={
+                'ordering': ('id',),
+                'unique_together': {('post', 'text')},
+            },
+        ),
+    ]

src/apps/billboard/migrations/0002_brief.py

@@ -0,0 +1,34 @@
+# Generated by Django 6.0 on 2026-05-08 21:34
+
+import django.db.models.deletion
+import django.utils.timezone
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('billboard', '0001_initial'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Brief',
+            fields=[
+                ('id', models.UUIDField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('is_unread', models.BooleanField(default=True)),
+                ('kind', models.CharField(choices=[('note_unlock', 'Note unlock'), ('user_post', 'User post'), ('share_invite', 'Share invite')], default='user_post', max_length=32)),
+                ('title', models.CharField(blank=True, max_length=255)),
+                ('created_at', models.DateTimeField(default=django.utils.timezone.now)),
+                ('line', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='briefs', to='billboard.line')),
+                ('owner', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='briefs', to=settings.AUTH_USER_MODEL)),
+                ('post', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='briefs', to='billboard.post')),
+            ],
+            options={
+                'ordering': ['-created_at'],
+            },
+        ),
+    ]

src/apps/billboard/migrations/0003_post_kind.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0 on 2026-05-08 21:42
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('billboard', '0002_brief'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='post',
+            name='kind',
+            field=models.CharField(choices=[('note_unlock', 'Note unlocks'), ('user_post', 'User post'), ('share_invite', 'Share invites')], default='user_post', max_length=32),
+        ),
+    ]

src/apps/billboard/migrations/0004_post_title_line_author_created_at.py

@@ -0,0 +1,98 @@
+# Adds Post.title, Line.author (PROTECT FK to lyric.User), Line.created_at.
+# Backfills Post.title from first-line text (truncate 32 + "…" past 35 chars,
+# or hardcoded "Notes & recognitions" for KIND_NOTE_UNLOCK), and Line.author
+# from Post.owner — except KIND_NOTE_UNLOCK + ownerless rows, which attribute
+# to the seeded `adman` User. Depends on lyric/0003_seed_adman so adman
+# exists before backfill runs.
+
+from django.db import migrations, models
+from django.db.models import deletion
+from django.utils import timezone
+
+
+_NOTE_UNLOCK_TITLE = "Notes & recognitions"
+
+
+def _truncate_title(text, length=35):
+    if len(text) <= length:
+        return text
+    return text[: length - 3] + "..."
+
+
+def backfill(apps, schema_editor):
+    Post = apps.get_model("billboard", "Post")
+    Line = apps.get_model("billboard", "Line")
+    User = apps.get_model("lyric", "User")
+
+    adman = User.objects.filter(username="adman").first()
+
+    for post in Post.objects.all():
+        if post.kind == "note_unlock":
+            post.title = _NOTE_UNLOCK_TITLE
+        else:
+            first_line = post.lines.order_by("id").first()
+            post.title = _truncate_title(first_line.text) if first_line else ""
+        post.save(update_fields=["title"])
+
+    now = timezone.now()
+    for line in Line.objects.select_related("post").all():
+        if line.post.kind == "note_unlock":
+            line.author = adman
+        elif line.post.owner_id:
+            line.author_id = line.post.owner_id
+        else:
+            line.author = adman
+        if line.created_at is None:
+            line.created_at = now
+        line.save(update_fields=["author", "created_at"])
+
+
+def reverse_noop(apps, schema_editor):
+    pass
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("billboard", "0003_post_kind"),
+        ("lyric", "0003_seed_adman"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="post",
+            name="title",
+            field=models.CharField(default="", max_length=35),
+        ),
+        migrations.AddField(
+            model_name="line",
+            name="created_at",
+            field=models.DateTimeField(default=timezone.now),
+        ),
+        migrations.AddField(
+            model_name="line",
+            name="author",
+            field=models.ForeignKey(
+                blank=True,
+                null=True,
+                on_delete=deletion.PROTECT,
+                related_name="authored_lines",
+                to="lyric.user",
+            ),
+        ),
+        migrations.RunPython(backfill, reverse_noop),
+        migrations.AlterField(
+            model_name="line",
+            name="author",
+            field=models.ForeignKey(
+                on_delete=deletion.PROTECT,
+                related_name="authored_lines",
+                to="lyric.user",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="line",
+            name="created_at",
+            field=models.DateTimeField(auto_now_add=True),
+        ),
+    ]

src/apps/billboard/migrations/0005_line_admin_solicited.py

@@ -0,0 +1,34 @@
+# Adds Line.admin_solicited (BooleanField) to discriminate
+# system-authored Lines (Note.grant_if_new) from user writes on
+# NOTE_UNLOCK Posts. The post_save signal nukes any Line on a
+# NOTE_UNLOCK Post that lacks admin_solicited=True — defense-in-depth
+# alongside the view_post POST guard. Backfill: existing NOTE_UNLOCK
+# Lines (the only system-authored kind at this point) get True; all
+# others default False.
+
+from django.db import migrations, models
+
+
+def backfill(apps, schema_editor):
+    Line = apps.get_model("billboard", "Line")
+    Line.objects.filter(post__kind="note_unlock").update(admin_solicited=True)
+
+
+def reverse_noop(apps, schema_editor):
+    pass
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("billboard", "0004_post_title_line_author_created_at"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="line",
+            name="admin_solicited",
+            field=models.BooleanField(default=False),
+        ),
+        migrations.RunPython(backfill, reverse_noop),
+    ]

src/apps/billboard/migrations/0006_alter_line_options.py

@@ -0,0 +1,17 @@
+# Generated by Django 6.0 on 2026-05-09 03:00
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('billboard', '0005_line_admin_solicited'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='line',
+            options={'ordering': ('created_at', 'id')},
+        ),
+    ]

src/apps/billboard/migrations/0007_brief_room_alter_brief_kind_alter_brief_post.py

@@ -0,0 +1,30 @@
+# Generated by Django 6.0 on 2026-05-09 04:45
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('billboard', '0006_alter_line_options'),
+        ('epic', '0008_blades_reversal_fickle'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='brief',
+            name='room',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='briefs', to='epic.room'),
+        ),
+        migrations.AlterField(
+            model_name='brief',
+            name='kind',
+            field=models.CharField(choices=[('note_unlock', 'Note unlock'), ('user_post', 'User post'), ('share_invite', 'Share invite'), ('game_invite', 'Game invite')], default='user_post', max_length=32),
+        ),
+        migrations.AlterField(
+            model_name='brief',
+            name='post',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, related_name='briefs', to='billboard.post'),
+        ),
+    ]

src/apps/billboard/migrations/0008_tax_ledger_kind.py

@@ -0,0 +1,23 @@
+# Generated by Django 6.0 on 2026-05-26 19:44
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('billboard', '0007_brief_room_alter_brief_kind_alter_brief_post'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='brief',
+            name='kind',
+            field=models.CharField(choices=[('note_unlock', 'Note unlock'), ('user_post', 'User post'), ('share_invite', 'Share invite'), ('game_invite', 'Game invite'), ('tax_ledger', 'Tax ledger')], default='user_post', max_length=32),
+        ),
+        migrations.AlterField(
+            model_name='post',
+            name='kind',
+            field=models.CharField(choices=[('note_unlock', 'Note unlocks'), ('user_post', 'User post'), ('share_invite', 'Share invites'), ('tax_ledger', 'Debits & credits')], default='user_post', max_length=32),
+        ),
+    ]

src/apps/billboard/migrations/0009_alter_brief_kind_alter_post_kind.py

@@ -0,0 +1,23 @@
+# Generated by Django 6.0 on 2026-05-27 16:57
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('billboard', '0008_tax_ledger_kind'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='brief',
+            name='kind',
+            field=models.CharField(choices=[('note_unlock', 'Note unlock'), ('user_post', 'User post'), ('share_invite', 'Share invite'), ('game_invite', 'Game invite'), ('tax_ledger', 'Tax ledger'), ('mail_acceptance', 'Mail acceptance')], default='user_post', max_length=32),
+        ),
+        migrations.AlterField(
+            model_name='post',
+            name='kind',
+            field=models.CharField(choices=[('note_unlock', 'Note unlocks'), ('user_post', 'User post'), ('share_invite', 'Share invites'), ('tax_ledger', 'Debits & credits'), ('mail_acceptance', 'Acceptances & rejections')], default='user_post', max_length=32),
+        ),
+    ]

src/apps/billboard/migrations/0010_budshipnote.py

@@ -0,0 +1,30 @@
+# Generated by Django 6.0 on 2026-05-28 15:12
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('billboard', '0009_alter_brief_kind_alter_post_kind'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='BudshipNote',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('shoptalk', models.CharField(default='', max_length=160)),
+                ('edited_at', models.DateTimeField(auto_now=True)),
+                ('bud', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='budship_notes_about', to=settings.AUTH_USER_MODEL)),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='budship_notes_written', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'ordering': ('-edited_at',),
+                'unique_together': {('user', 'bud')},
+            },
+        ),
+    ]

src/apps/billboard/models.py

@@ -0,0 +1,292 @@
+import uuid
+
+from django.db import models
+from django.db.models.signals import post_save
+from django.dispatch import receiver
+from django.urls import reverse
+from django.utils import timezone
+
+
+NOTE_UNLOCK_POST_TITLE_HINT = "Notes & recognitions"  # see drama.NOTE_UNLOCK_POST_TITLE; copy lives there
+TAX_LEDGER_POST_TITLE = "Debits & credits"
+MAIL_ACCEPTANCE_POST_TITLE = "Acceptances & rejections"
+
+
+class Post(models.Model):
+    KIND_NOTE_UNLOCK   = "note_unlock"
+    KIND_USER_POST     = "user_post"
+    KIND_SHARE_INVITE  = "share_invite"
+    # Per-user @taxman-authored ledger (user-spec 2026-05-26). Each FREE/PAID
+    # DRAW spend at /gameboard/my-sea/ appends one Line via
+    # `apps.billboard.tax.log_tax_debit`. Mirrors the NOTE_UNLOCK Post pattern:
+    # one Post per user, system-authored, readonly textarea in post.html.
+    KIND_TAX_LEDGER    = "tax_ledger"
+    # Per-user @mailman-authored "Acceptances & rejections" log (my-sea bud-
+    # invite flow, see [[my-sea-invite-voice-blueprint]]). Each invite appends
+    # one interactive Line (OK/BYE buttons) via `apps.billboard.mail.
+    # log_sea_invite`. Mirrors the TAX_LEDGER Post pattern: one Post per
+    # invitee, system-authored, with admin_solicited Lines.
+    KIND_MAIL_ACCEPTANCE = "mail_acceptance"
+    KIND_CHOICES = [
+        (KIND_NOTE_UNLOCK,     "Note unlocks"),
+        (KIND_USER_POST,       "User post"),
+        (KIND_SHARE_INVITE,    "Share invites"),
+        (KIND_TAX_LEDGER,      "Debits & credits"),
+        (KIND_MAIL_ACCEPTANCE, "Acceptances & rejections"),
+    ]
+
+    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
+    owner = models.ForeignKey(
+        "lyric.User",
+        related_name="posts",
+        blank=True,
+        null=True,
+        on_delete=models.CASCADE,
+    )
+
+    shared_with = models.ManyToManyField(
+        "lyric.User",
+        related_name="shared_posts",
+        blank=True,
+    )
+
+    # `kind` discriminates per-category Posts — e.g. Note.grant_if_new appends
+    # to the user's single (owner=user, kind=NOTE_UNLOCK) Post; user-authored
+    # composes default to KIND_USER_POST.
+    kind = models.CharField(
+        max_length=32,
+        choices=KIND_CHOICES,
+        default=KIND_USER_POST,
+    )
+
+    # Stored title — set explicitly on creation. Note-unlock Posts hardcode
+    # "Notes & recognitions"; user_post Posts truncate first line to 35 chars
+    # (32 + "..." past length). Replaces the legacy `name` property which
+    # gleaned `lines.first().text` lazily and broke if the first Line was
+    # later edited or deleted.
+    title = models.CharField(max_length=35, default="")
+
+    def get_absolute_url(self):
+        return reverse("billboard:view_post", args=[self.id])
+
+
+class Line(models.Model):
+    text = models.TextField(default="")
+    post = models.ForeignKey(Post, default=None, on_delete=models.CASCADE, related_name="lines")
+    # `author` PROTECTs against accidental sitewide-entity deletion (notably
+    # `adman`, the system-author for note_unlock + share_invite Lines).
+    # User-typed Lines attribute to the typing User; system-rendered Lines
+    # attribute to adman so the per-line "username" column always renders.
+    author = models.ForeignKey(
+        "lyric.User",
+        on_delete=models.PROTECT,
+        related_name="authored_lines",
+    )
+    created_at = models.DateTimeField(auto_now_add=True)
+    # System-authored Lines on NOTE_UNLOCK Posts must set this True; the
+    # post_save signal below deletes any Line on a NOTE_UNLOCK Post w.o.
+    # this flag (defense-in-depth alongside view_post's POST guard).
+    admin_solicited = models.BooleanField(default=False)
+
+    class Meta:
+        ordering = ("created_at", "id")
+        unique_together = ("post", "text")
+
+    def __str__(self):
+        return self.text
+
+    @property
+    def display_text(self):
+        """User-facing line text. For TAX_LEDGER lines, strips the leading
+        `[<ISO timestamp>] ` prefix that the `apps.billboard.tax.log_tax_
+        debit` helper bakes in to satisfy `unique_together = (post, text)`
+        on repeat-slug spends — the Brief carries `created_at` and the
+        Post line carries `created_at` independently, so embedding a third
+        timestamp in the prose is noise.
+
+        For non-tax lines this is identity (returns `text` unchanged) —
+        Note-unlock + user-typed Lines have no prefix to strip."""
+        if self.post.kind == Post.KIND_TAX_LEDGER and self.text.startswith("["):
+            close = self.text.find("] ")
+            if close != -1:
+                return self.text[close + 2:]
+        return self.text
+
+
+class Brief(models.Model):
+    """A slide-down notification record. Owner = whose attention; post = where
+    FYI navigates (and where mark-read happens on GET); line = the specific
+    appended Line that triggered it (so the banner can surface its text).
+
+    `kind` discriminates the affordances the banner renders. NOTE_UNLOCK
+    Briefs get a clickable square that jumps direct to my_notes.html;
+    SHARE_INVITE Briefs render the invitation copy; USER_POST is the legacy
+    user-authored compose flow.
+
+    Magic-link confirmation + invalid-link banners use the same Gaussian-glass
+    visual styling but ride no Brief row (transient one-shot).
+    """
+    KIND_NOTE_UNLOCK   = "note_unlock"
+    KIND_USER_POST     = "user_post"
+    KIND_SHARE_INVITE  = "share_invite"
+    KIND_GAME_INVITE   = "game_invite"
+    # Tax-ledger Briefs (FREE/PAID DRAW spend, user-spec 2026-05-26). FYI
+    # navigates to the user's TAX_LEDGER Post. NVM POSTs to the dismiss-
+    # brief endpoint so the dismissal persists per-cycle (see
+    # `dismiss_url` in `to_banner_dict`).
+    KIND_TAX_LEDGER    = "tax_ledger"
+    # Surfaces the invitee's slide-down notification when an owner invites them
+    # to a my-sea table; FYI navigates to their "Acceptances & rejections" Post.
+    KIND_MAIL_ACCEPTANCE = "mail_acceptance"
+    KIND_CHOICES = [
+        (KIND_NOTE_UNLOCK,     "Note unlock"),
+        (KIND_USER_POST,       "User post"),
+        (KIND_SHARE_INVITE,    "Share invite"),
+        (KIND_GAME_INVITE,     "Game invite"),
+        (KIND_TAX_LEDGER,      "Tax ledger"),
+        (KIND_MAIL_ACCEPTANCE, "Mail acceptance"),
+    ]
+
+    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
+    owner = models.ForeignKey(
+        "lyric.User",
+        related_name="briefs",
+        on_delete=models.CASCADE,
+    )
+    # Post is nullable now: KIND_GAME_INVITE briefs ride on a Room FK
+    # instead of a Post (the gatekeeper invite confirmation has no post
+    # to navigate to). Post FKs only set for note_unlock / user_post /
+    # share_invite kinds.
+    post = models.ForeignKey(
+        Post,
+        related_name="briefs",
+        on_delete=models.CASCADE,
+        null=True,
+        blank=True,
+    )
+    # Room FK — set only on KIND_GAME_INVITE briefs; FYI navigates to
+    # the gatekeeper page for that room.
+    room = models.ForeignKey(
+        "epic.Room",
+        related_name="briefs",
+        on_delete=models.CASCADE,
+        null=True,
+        blank=True,
+    )
+    # Line is nullable because a share_invite-style Brief can race ahead of its
+    # async-appended Line write; the post FK alone is enough to navigate.
+    line = models.ForeignKey(
+        Line,
+        related_name="briefs",
+        on_delete=models.CASCADE,
+        null=True,
+        blank=True,
+    )
+    is_unread = models.BooleanField(default=True)
+    kind = models.CharField(
+        max_length=32,
+        choices=KIND_CHOICES,
+        default=KIND_USER_POST,
+    )
+    title = models.CharField(max_length=255, blank=True)
+    created_at = models.DateTimeField(default=timezone.now)
+
+    class Meta:
+        ordering = ["-created_at"]
+
+    def __str__(self):
+        return (
+            f"Brief({self.kind}, {self.owner.email}, "
+            f"unread={self.is_unread})"
+        )
+
+    def to_banner_dict(self):
+        """Shape this Brief for the slide-down banner JS. NOTE_UNLOCK kind
+        carries a square_url pointing at /billboard/my-notes/ so the
+        thumbnail-square inside the banner jumps direct to the user's Note
+        collection. GAME_INVITE kind has no Post — the FYI link navigates
+        to the gatekeeper page for the brief's Room instead.
+
+        `dismiss_url` (TAX_LEDGER only — user-spec 2026-05-26): the POST
+        endpoint the banner's NVM btn fires to so the dismissal persists
+        per-cycle (FREE DRAW until next FREE DRAW spend, PAID DRAW until
+        next PAID DRAW commit). Empty for kinds with no persistence."""
+        square_url = ""
+        dismiss_url = ""
+        if self.kind == self.KIND_NOTE_UNLOCK:
+            square_url = reverse("billboard:my_notes")
+        if self.post_id:
+            post_url = self.post.get_absolute_url()
+        elif self.room_id:
+            post_url = reverse("epic:gatekeeper", args=[self.room_id])
+        else:
+            post_url = ""
+        return {
+            "id":          str(self.id),
+            "kind":        self.kind,
+            "title":       self.title,
+            # `display_text` strips the `[<iso timestamp>] ` prefix on
+            # TAX_LEDGER lines (the prefix exists only to satisfy Line's
+            # `unique_together = (post, text)` invariant on repeat-slug
+            # spends — the Brief's own `created_at` slot below covers the
+            # user-facing timestamp). Identity for all other line kinds.
+            "line_text":   self.line.display_text if self.line else "",
+            "post_url":    post_url,
+            "square_url":  square_url,
+            "dismiss_url": dismiss_url,
+            "created_at":  self.created_at.isoformat(),
+        }
+
+
+# ── Listener: nuke unsolicited Lines on system-author Posts ──────────────
+# Defense-in-depth alongside view_post's POST guard. A Line saved on a
+# NOTE_UNLOCK / TAX_LEDGER / MAIL_ACCEPTANCE Post that lacks
+# admin_solicited=True (e.g. a stray ORM-level write or an API path that
+# bypasses the view) gets deleted right after the save. `Note.grant_if_new`,
+# `apps.billboard.tax.log_tax_debit`, and `apps.billboard.mail.log_sea_invite`
+# all set admin_solicited=True on their Lines so legitimate system prose
+# survives.
+
+_SYSTEM_AUTHOR_POST_KINDS = (
+    Post.KIND_NOTE_UNLOCK,
+    Post.KIND_TAX_LEDGER,
+    Post.KIND_MAIL_ACCEPTANCE,
+)
+
+
+@receiver(post_save, sender=Line)
+def _delete_unsolicited_admin_post_lines(sender, instance, created, **kwargs):
+    if not created:
+        return
+    if instance.post.kind in _SYSTEM_AUTHOR_POST_KINDS and not instance.admin_solicited:
+        instance.delete()
+
+
+class BudshipNote(models.Model):
+    """Per-relation personal note about a bud — bud landing page sprint
+    2026-05-27 ([[project-bud-landing-page-sprint]]). One row per
+    (user, bud) pair: the user's own shoptalk about that bud, NEVER
+    visible to the bud. Lazy-created on first shoptalk save so the
+    absence of a row reads as 'never edited' (drives the `.tt-milestone`
+    slot on the My Buds tooltip portal — present when ≥1 edit, absent
+    otherwise)."""
+
+    user = models.ForeignKey(
+        "lyric.User",
+        on_delete=models.CASCADE,
+        related_name="budship_notes_written",
+    )
+    bud = models.ForeignKey(
+        "lyric.User",
+        on_delete=models.CASCADE,
+        related_name="budship_notes_about",
+    )
+    shoptalk = models.CharField(max_length=160, default="")
+    edited_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        unique_together = ("user", "bud")
+        ordering = ("-edited_at",)
+
+    def __str__(self):
+        return f"BudshipNote({self.user_id} → {self.bud_id})"

src/apps/billboard/static/apps/billboard/bud-autocomplete.js

@@ -0,0 +1,115 @@
+// Bud-list autocomplete for #id_recipient inputs (post share panel + my_buds
+// add panel). Mirrors the sky.html birth-place picker pattern: debounced
+// fetch on input, top-3 suggestions rendered as buttons, click-to-fill,
+// Escape closes, click-outside closes. No keyboard arrow/Enter cycling.
+//
+// Usage:
+//     <div class="bud-panel-wrap">
+//         <input id="id_recipient" ...>
+//         <div id="id_bud_suggestions" class="bud-suggestions" hidden></div>
+//     </div>
+//     <script src="{% static 'apps/billboard/bud-autocomplete.js' %}"></script>
+//     <script>bindBudAutocomplete(
+//         document.getElementById('id_recipient'),
+//         document.getElementById('id_bud_suggestions'),
+//         { searchUrl: '{% url "billboard:search_buds" %}' }
+//     );</script>
+
+(function () {
+    'use strict';
+
+    var DEBOUNCE_MS = 250;
+    var MIN_CHARS = 1;
+
+    function _esc(s) {
+        var d = document.createElement('div');
+        d.textContent = s == null ? '' : s;
+        return d.innerHTML;
+    }
+
+    window.bindBudAutocomplete = function (input, suggestions, options) {
+        if (!input || !suggestions || !options || !options.searchUrl) return;
+
+        var debounceTimer = null;
+        var lastQuery = '';
+
+        function _hide() {
+            suggestions.hidden = true;
+            suggestions.innerHTML = '';
+        }
+
+        function _render(buds) {
+            if (!buds || !buds.length) {
+                _hide();
+                return;
+            }
+            suggestions.innerHTML = buds.map(function (b) {
+                // data-email + data-username so the click handler can fill the
+                // input with whichever the user originally typed (email if they
+                // started with `@`, else username).
+                return (
+                    '<button type="button" class="bud-suggestion-item" ' +
+                    'data-email="'    + _esc(b.email)    + '" ' +
+                    'data-username="' + _esc(b.username) + '">' +
+                        _esc(b.username) +
+                    '</button>'
+                );
+            }).join('');
+            suggestions.hidden = false;
+        }
+
+        function _fetch(q) {
+            var url = options.searchUrl + '?q=' + encodeURIComponent(q);
+            fetch(url, {
+                credentials: 'same-origin',
+                headers: { 'Accept': 'application/json' },
+            })
+                .then(function (r) { return r.ok ? r.json() : Promise.reject(r.status); })
+                .then(function (data) {
+                    // Drop late responses if the user has typed past this query.
+                    if (input.value.trim() !== q) return;
+                    _render(data.buds || []);
+                })
+                .catch(function () { _hide(); });
+        }
+
+        input.addEventListener('input', function () {
+            var q = input.value.trim();
+            lastQuery = q;
+            if (q.length < MIN_CHARS) { _hide(); return; }
+            clearTimeout(debounceTimer);
+            debounceTimer = setTimeout(function () { _fetch(q); }, DEBOUNCE_MS);
+        });
+
+        input.addEventListener('keydown', function (e) {
+            if (e.key === 'Escape') _hide();
+        });
+
+        suggestions.addEventListener('click', function (e) {
+            var btn = e.target.closest('.bud-suggestion-item');
+            if (!btn) return;
+            // Stop propagation so the bud-panel's document-level click-
+            // outside handler doesn't fire and close+clear the panel —
+            // _hide() about to detach the target makes a `sg.contains(e.target)`
+            // check at the document level unreliable.
+            e.stopPropagation();
+            // Fill w. whichever form the user was typing (email vs username).
+            // If the input value already contains '@', prefer email; else
+            // prefer username. This keeps the OK-submit semantics consistent
+            // w. what the user intended.
+            var typed = input.value.trim();
+            input.value = typed.indexOf('@') !== -1
+                ? btn.dataset.email
+                : btn.dataset.username;
+            _hide();
+            input.focus();
+        });
+
+        document.addEventListener('click', function (e) {
+            if (suggestions.hidden) return;
+            if (suggestions.contains(e.target)) return;
+            if (e.target === input) return;
+            _hide();
+        });
+    };
+}());

src/apps/billboard/static/apps/billboard/bud-btn.js

@@ -0,0 +1,137 @@
+// Shared skeleton for the three #id_bud_btn slide-out panels:
+//   • _bud_panel.html        — post-share        (POSTs to billboard:share_post)
+//   • _bud_invite_panel.html — gatekeeper invite (POSTs to epic:invite_gamer)
+//   • _bud_add_panel.html    — My Buds add       (POSTs to billboard:add_bud)
+//
+// Owns: csrf cookie read, open/close + .bud-open html-class, button click,
+// Escape, click-outside, Enter-in-input, OK POST + JSON routing, and the
+// `data.already_present` duplicate-guard branch (error Brief instead of
+// the normal onSuccess append).
+//
+// Each caller drives it with:
+//   bindBudBtn({
+//     submitUrl,
+//     autocompleteUrl?,
+//     onSuccess(data),                    // success path: line/chip/entry/Brief
+//     duplicateTargetSelector?(data),     // selector for .bud-duplicate-flash
+//   })
+//
+// `onSuccess(data)` does the panel-specific DOM updates on the new-row path.
+// `duplicateTargetSelector(data)` returns a CSS selector for the existing
+// element to highlight when the FYI button on the error Brief is clicked
+// (.bud-name / .post-recipient / .gate-slot.filled — varies by page).
+// _close({clear: true}) fires automatically on every successful response.
+//
+// `autocompleteUrl` enables bud-autocomplete on the input (post-share +
+// gatekeeper panels) by binding bud-autocomplete.js to #id_bud_suggestions.
+// My Buds omits it — the autocomplete pool is request.user.buds, which is
+// the set you can't usefully re-add.
+
+(function () {
+    'use strict';
+
+    window.bindBudBtn = function (opts) {
+        opts = opts || {};
+        var btn   = document.getElementById('id_bud_btn');
+        var panel = document.getElementById('id_bud_panel');
+        var input = document.getElementById('id_recipient');
+        var ok    = document.getElementById('id_bud_ok');
+        var html  = document.documentElement;
+        if (!btn || !panel || !input || !ok) return;
+
+        var suggestions = opts.autocompleteUrl
+            ? document.getElementById('id_bud_suggestions')
+            : null;
+
+        function _csrf() {
+            var m = document.cookie.match(/csrftoken=([^;]+)/);
+            return m ? m[1] : '';
+        }
+
+        function _open() {
+            html.classList.add('bud-open');
+            btn.classList.add('active');
+            setTimeout(function () { input.focus(); }, 60);
+        }
+
+        function _close(o) {
+            o = o || {};
+            html.classList.remove('bud-open');
+            btn.classList.remove('active');
+            if (o.clear !== false) input.value = '';
+        }
+
+        btn.addEventListener('click', function () {
+            if (html.classList.contains('bud-open')) _close();
+            else _open();
+        });
+
+        document.addEventListener('keydown', function (e) {
+            if (e.key === 'Escape' && html.classList.contains('bud-open')) _close();
+        });
+
+        document.addEventListener('click', function (e) {
+            if (!html.classList.contains('bud-open')) return;
+            if (panel.contains(e.target)) return;
+            if (e.target === btn || btn.contains(e.target)) return;
+            // Suggestions live outside the panel (panel has overflow:hidden
+            // for its scaleX slide); a click inside them must NOT close+clear.
+            if (suggestions && suggestions.contains(e.target)) return;
+            _close();
+        });
+
+        ok.addEventListener('click', function () {
+            var recipient = input.value.trim();
+            if (!recipient) return;
+
+            var fd = new FormData();
+            fd.set('recipient', recipient);
+
+            fetch(opts.submitUrl, {
+                method: 'POST',
+                credentials: 'same-origin',
+                headers: {
+                    'Accept': 'application/json',
+                    'X-CSRFToken': _csrf(),
+                },
+                body: fd,
+            })
+                .then(function (r) { return r.ok ? r.json() : Promise.reject(r.status); })
+                .then(function (data) {
+                    if (data && data.already_present) {
+                        // Skip onSuccess — there's nothing to append. Show the
+                        // error Brief instead. target_selector resolves at call
+                        // time from the caller's per-page callback.
+                        if (window.Brief) {
+                            var sel = (typeof opts.duplicateTargetSelector === 'function')
+                                ? opts.duplicateTargetSelector(data) : null;
+                            Brief.showDuplicateBanner({
+                                display_name:    data.recipient_display,
+                                target_selector: sel,
+                            });
+                        }
+                    } else if (typeof opts.onSuccess === 'function') {
+                        opts.onSuccess(data);
+                    }
+                    _close({ clear: true });
+                })
+                .catch(function () {
+                    // Privacy-safe response shape — even an unregistered/self
+                    // recipient is a 200. Network/5xx land here; just close.
+                });
+        });
+
+        input.addEventListener('keydown', function (e) {
+            if (e.key === 'Enter') {
+                e.preventDefault();
+                ok.click();
+            }
+        });
+
+        if (opts.autocompleteUrl && window.bindBudAutocomplete && suggestions) {
+            window.bindBudAutocomplete(input, suggestions, {
+                searchUrl: opts.autocompleteUrl,
+            });
+        }
+    };
+}());

src/apps/billboard/static/apps/billboard/my-buds-tooltip.js

@@ -0,0 +1,139 @@
+// Row-click → row-lock + tooltip-portal for the My Buds list.
+//
+// Bud landing page sprint 2026-05-27 ([[project-bud-landing-page-sprint]]).
+// Mirrors apps/applets/row-lock.js's lock/unlock state machine, but binds
+// to `.bud-entry` rows (which are NOT `.row-3col`) AND populates the
+// shared `#id_tooltip_portal` from the row's data-tt-* attrs.
+//
+// Click target semantics:
+//   • Click on the inner `<a>` (the `@<handle>` anchor) — let it navigate
+//     to the bud's landing page. NO lock fires.
+//   • Click anywhere else inside `.bud-entry` — lock the row + open the
+//     tooltip portal w. its data-tt-* fields populated.
+//   • Click outside any `.bud-entry` (and outside the portal) — clear.
+//
+// `.tt-milestone` is REMOVED from the DOM (vs. emptied) when the row's
+// `data-tt-milestone` attr is absent so the FT can distinguish "never
+// edited" (slot absent) from "cleared after edit" (slot empty).
+
+(function () {
+    'use strict';
+
+    var _lockedRow = null;
+    var _portal = null;
+    var _milestoneTemplate = null;
+
+    function _clearLock() {
+        if (_lockedRow) {
+            _lockedRow.classList.remove('row-locked');
+            _lockedRow = null;
+        }
+        if (_portal) {
+            _portal.classList.remove('active');
+            // Reset positional props so the next show measures fresh.
+            _portal.style.top = '';
+            _portal.style.bottom = '';
+            _portal.style.left = '';
+        }
+    }
+
+    // Clamp the position:fixed portal to the viewport — same 1rem-inset
+    // shape as game-kit.js / sky-wheel.js / wallet.js. Called AFTER .active
+    // makes the portal display:block so offsetWidth/Height are real: clamp
+    // the left edge into [rem, viewport-ttW-rem], then prefer ABOVE the row
+    // (flip BELOW when the tooltip is too tall to fit above).
+    function _positionPortal(row) {
+        if (!_portal) return;
+        var rect = row.getBoundingClientRect();
+        var rem = parseFloat(getComputedStyle(document.documentElement).fontSize) || 16;
+        var ttW = _portal.offsetWidth;
+        var ttH = _portal.offsetHeight;
+
+        var minLeft = rem;
+        var maxLeft = window.innerWidth - ttW - rem;
+        var clampedLeft = Math.max(minLeft, Math.min(rect.left, maxLeft));
+        _portal.style.left = clampedLeft + 'px';
+
+        var spaceAbove = rect.top - rem;
+        if (ttH <= spaceAbove) {
+            _portal.style.bottom = (window.innerHeight - rect.top + 8) + 'px';
+            _portal.style.top = '';
+        } else {
+            _portal.style.top = (rect.bottom + 8) + 'px';
+            _portal.style.bottom = '';
+        }
+    }
+
+    function _findSlot(name) {
+        if (!_portal) return null;
+        return _portal.querySelector('.tt-' + name);
+    }
+
+    function _populatePortal(row) {
+        if (!_portal) return;
+        var fields = ['title', 'description', 'email', 'shoptalk'];
+        fields.forEach(function (f) {
+            var slot = _findSlot(f);
+            if (slot) slot.textContent = row.dataset['tt' + f.charAt(0).toUpperCase() + f.slice(1)] || '';
+        });
+        // .tt-milestone — absent when never-edited; present (+ populated)
+        // when the row carries data-tt-milestone.
+        var ms = row.dataset.ttMilestone;
+        var existing = _findSlot('milestone');
+        if (ms) {
+            if (!existing) {
+                var span = _milestoneTemplate.cloneNode(true);
+                span.textContent = ms;
+                _portal.appendChild(span);
+            } else {
+                existing.textContent = ms;
+            }
+        } else {
+            if (existing) existing.remove();
+        }
+    }
+
+    function _onClick(e) {
+        // Anchor click — let navigation proceed; no lock/portal.
+        if (e.target.closest('.bud-entry .bud-name a')) {
+            _clearLock();
+            return;
+        }
+        var row = e.target.closest('.bud-entry');
+        if (row) {
+            if (row === _lockedRow) {
+                _clearLock();
+            } else {
+                _clearLock();
+                row.classList.add('row-locked');
+                _lockedRow = row;
+                _populatePortal(row);
+                if (_portal) {
+                    _portal.classList.add('active');
+                    _positionPortal(row);
+                }
+            }
+            return;
+        }
+        // Click inside the portal itself — preserve lock.
+        if (_portal && _portal.contains(e.target)) return;
+        _clearLock();
+    }
+
+    function _init() {
+        _portal = document.getElementById('id_tooltip_portal');
+        if (_portal) {
+            // Snapshot the milestone element shape so we can restore it
+            // after a never-edited row removes it.
+            var ms = _portal.querySelector('.tt-milestone');
+            if (ms) _milestoneTemplate = ms.cloneNode(false);
+        }
+        document.addEventListener('click', _onClick);
+    }
+
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', _init);
+    } else {
+        _init();
+    }
+}());

src/apps/billboard/tax.py

@@ -0,0 +1,100 @@
+"""@taxman-authored "Debits & credits" ledger — user-spec 2026-05-26.
+
+`log_tax_debit(user, slug)` appends one Line + spawns one Brief on the user's
+single TAX_LEDGER Post for each FREE/PAID DRAW spend at /gameboard/my-sea/.
+Parallels `apps.drama.models.Note.grant_if_new` for Note unlocks; the same
+post_save guard in `billboard.models` nukes any Line saved on a TAX_LEDGER
+Post w.o. admin_solicited=True.
+
+Two debit slugs today:
+    free_draw_locked  → my_sea_lock first-card-of-cycle
+    paid_draw_locked  → my_sea_paid_draw commit
+
+The Brief that spawns here is rendered via the existing slide-down banner
+(note.js `Brief.showBanner`); its FYI .btn-info navigates to the user's
+ledger Post; its NVM stamps the matching `User.{free,paid}_draw_brief_
+dismissed_at` field via the dismiss-brief gameboard endpoints.
+
+Line text is timestamp-prefixed so a second identical-slug spend doesn't
+collide w. `Line.Meta.unique_together = ("post", "text")`."""
+
+from django.utils import timezone
+
+from apps.billboard.models import (
+    Brief,
+    Line,
+    Post,
+    TAX_LEDGER_POST_TITLE,
+)
+from apps.lyric.models import get_or_create_taxman
+
+
+# Canonical Line text per slug. Replaces the prior `_showFreeDrawLockedBrief`
+# helper's wording in my_sea.html — the ledger Line IS the source of truth
+# for both the persistent log surface (Debits & credits Post) AND the slide-
+# down Brief banner (via Brief.line.text in to_banner_dict).
+#
+# `.btn-pri-name` spans wrap canonical .btn-primary button labels referenced
+# inline (FREE DRAW, PAID DRAW, GATE VIEW per user-spec 2026-05-26). SCSS
+# (`_billboard.scss` under `.post-line--system .post-line-text`) styles the
+# spans so the user sees the same `--quaUser` colour + 700-weight on the
+# token in prose as they would on the actual button. Rendered as HTML via
+# `Line.display_text|safe` in post.html (the system-author branch).
+TAX_DEBIT_TEMPLATES = {
+    "free_draw_locked": (
+        'Look!—My Sea\'s <span class="btn-pri-name">FREE DRAW</span> '
+        'is locked. Next free draw available 24h from the production of this log.'
+    ),
+    "paid_draw_locked": (
+        'Look!—My Sea\'s <span class="btn-pri-name">PAID DRAW</span> '
+        'is locked. Another may be unlocked by depositing a Token in '
+        '<span class="btn-pri-name">GATE VIEW</span>.'
+    ),
+}
+
+
+def log_tax_debit(user, slug):
+    """Append a Line to the user's "Debits & credits" Post (creating the Post
+    on first call) + spawn a Brief that the next page-load surfaces as a
+    slide-down banner.
+
+    Returns ``(post, line, brief)``. Raises ``KeyError`` for unknown slugs.
+
+    Line text is prefixed with `[<ISO timestamp>] ` so successive spends of
+    the same slug produce distinct rows (each one survives `Line.Meta.
+    unique_together = ("post", "text")`)."""
+    if slug not in TAX_DEBIT_TEMPLATES:
+        raise KeyError(f"Unknown tax debit slug: {slug!r}")
+
+    post, _ = Post.objects.get_or_create(
+        owner=user,
+        kind=Post.KIND_TAX_LEDGER,
+        defaults={"title": TAX_LEDGER_POST_TITLE},
+    )
+    # Existing TAX_LEDGER Posts (pre-feature migration) might lack a title;
+    # heal once on next debit. Mirrors the Note.grant_if_new title heal.
+    if post.title != TAX_LEDGER_POST_TITLE:
+        post.title = TAX_LEDGER_POST_TITLE
+        post.save(update_fields=["title"])
+
+    body = TAX_DEBIT_TEMPLATES[slug]
+    # Sub-second timestamp prefix — keeps text unique even when two debits
+    # land in the same wallclock second (defensive vs auto-draw paths that
+    # could conceivably commit free + paid in rapid succession).
+    stamp = timezone.now().isoformat(timespec="microseconds")
+    text = f"[{stamp}] {body}"
+
+    line = Line.objects.create(
+        post=post,
+        text=text,
+        author=get_or_create_taxman(),
+        admin_solicited=True,
+    )
+    brief = Brief.objects.create(
+        owner=user,
+        post=post,
+        line=line,
+        kind=Brief.KIND_TAX_LEDGER,
+        title=TAX_LEDGER_POST_TITLE,
+    )
+    return post, line, brief

src/apps/billboard/tests/integrated/test_admin_posts.py

@@ -0,0 +1,126 @@
+"""ITs for admin-Post (kind=NOTE_UNLOCK) write protection.
+
+Three guards stack:
+  1. post.html input is `readonly` w. "No response needed…" placeholder
+     (FT covers this — `functional_tests/test_admin_post_readonly.py`).
+  2. view_post POST handler hard-rejects writes (HTTP 403). This file's
+     PostRejectsAdminWritesTest.
+  3. post_save signal nukes any Line saved on a NOTE_UNLOCK Post that
+     lacks `admin_solicited=True` — defense-in-depth for paths that
+     bypass the view (raw API, ORM, etc.). UnsolicitedLineListenerTest.
+
+Bug A — May 2026.
+"""
+from django.test import TestCase
+from django.urls import reverse
+
+from apps.billboard.models import Brief, Line, Post
+from apps.drama.models import Note
+from apps.lyric.models import User, get_or_create_adman
+
+
+class PostRejectsAdminWritesTest(TestCase):
+    """POST /billboard/post/<note_unlock>/ → HTTP 403, no Line appended."""
+
+    def setUp(self):
+        self.user = User.objects.create(email="admin-rej@test.io")
+        self.client.force_login(self.user)
+        Note.grant_if_new(self.user, "stargazer")
+        self.admin_post = Post.objects.get(
+            owner=self.user, kind=Post.KIND_NOTE_UNLOCK,
+        )
+        self.line_count_before = Line.objects.filter(post=self.admin_post).count()
+
+    def test_post_to_admin_post_returns_403(self):
+        resp = self.client.post(
+            reverse("billboard:view_post", args=[self.admin_post.id]),
+            data={"text": "errant response"},
+        )
+        self.assertEqual(resp.status_code, 403)
+
+    def test_post_to_admin_post_does_not_append_line(self):
+        self.client.post(
+            reverse("billboard:view_post", args=[self.admin_post.id]),
+            data={"text": "errant response"},
+        )
+        self.assertEqual(
+            Line.objects.filter(post=self.admin_post).count(),
+            self.line_count_before,
+        )
+
+    def test_post_to_user_post_still_succeeds(self):
+        """Regression: kind=USER_POST still accepts compose."""
+        user_post = Post.objects.create(
+            owner=self.user, kind=Post.KIND_USER_POST, title="composing",
+        )
+        Line.objects.create(post=user_post, text="seed", author=self.user)
+        resp = self.client.post(
+            reverse("billboard:view_post", args=[user_post.id]),
+            data={"text": "valid append"},
+        )
+        # 302 redirect on success
+        self.assertEqual(resp.status_code, 302)
+        self.assertTrue(
+            Line.objects.filter(post=user_post, text="valid append").exists(),
+        )
+
+
+class UnsolicitedLineListenerTest(TestCase):
+    """post_save signal deletes any Line saved on a NOTE_UNLOCK Post without
+    `admin_solicited=True`. Note.grant_if_new sets it; everything else
+    defaults to False, so a stray ORM-level write gets nuked."""
+
+    def setUp(self):
+        self.user = User.objects.create(email="listener@test.io")
+        Note.grant_if_new(self.user, "stargazer")
+        self.admin_post = Post.objects.get(
+            owner=self.user, kind=Post.KIND_NOTE_UNLOCK,
+        )
+
+    def test_unsolicited_line_on_note_unlock_post_is_deleted(self):
+        unsolicited = Line.objects.create(
+            post=self.admin_post,
+            text="errant ORM write",
+            author=self.user,
+            # admin_solicited defaults to False
+        )
+        # Signal fires post_save; the Line should be gone.
+        self.assertFalse(
+            Line.objects.filter(pk=unsolicited.pk).exists(),
+            "Unsolicited Line on NOTE_UNLOCK Post must be deleted",
+        )
+
+    def test_admin_solicited_line_on_note_unlock_post_persists(self):
+        """The Note grant Lines are admin_solicited=True — must NOT be nuked."""
+        adman = get_or_create_adman()
+        line = Line.objects.create(
+            post=self.admin_post,
+            text="valid system prose",
+            author=adman,
+            admin_solicited=True,
+        )
+        self.assertTrue(Line.objects.filter(pk=line.pk).exists())
+
+    def test_unsolicited_line_on_user_post_persists(self):
+        """User-typed Lines on user_post posts default to admin_solicited=False
+        and must NOT be nuked — the listener only guards NOTE_UNLOCK."""
+        up = Post.objects.create(
+            owner=self.user, kind=Post.KIND_USER_POST, title="x",
+        )
+        line = Line.objects.create(
+            post=up, text="user-typed line", author=self.user,
+        )
+        self.assertTrue(Line.objects.filter(pk=line.pk).exists())
+
+
+class NoteGrantSetsAdminSolicitedTest(TestCase):
+    """Note.grant_if_new must persist Lines with admin_solicited=True so
+    they survive the listener pass."""
+
+    def test_grant_creates_line_with_admin_solicited_true(self):
+        u = User.objects.create(email="grant@test.io")
+        Note.grant_if_new(u, "stargazer")
+        post = Post.objects.get(owner=u, kind=Post.KIND_NOTE_UNLOCK)
+        # Exactly one Line on a fresh grant
+        line = post.lines.get()
+        self.assertTrue(line.admin_solicited)

src/apps/billboard/tests/integrated/test_brief.py

@@ -0,0 +1,121 @@
+"""ITs for the Brief model & view_post's mark-read behavior.
+
+Brief is a notification record — owner + post FK + line FK + is_unread + kind.
+It rides on a Post (one-Post-per-category, Lines accumulate). Clicking FYI on
+a Brief banner navigates to billboard:view_post for the underlying Post; that
+GET is the contract that flips is_unread → False.
+"""
+
+from django.test import TestCase
+from django.urls import reverse
+
+from apps.billboard.models import Brief, Line, Post
+from apps.lyric.models import User
+
+
+class BriefModelTest(TestCase):
+    def setUp(self):
+        self.user = User.objects.create(email="brief@test.io")
+        self.post = Post.objects.create(owner=self.user)
+        self.line = Line.objects.create(post=self.post, text="Stargazer, 5:21pm", author=self.user)
+
+    def test_brief_defaults_unread(self):
+        b = Brief.objects.create(owner=self.user, post=self.post, line=self.line)
+        self.assertTrue(b.is_unread)
+
+    def test_brief_default_kind_is_user_post(self):
+        b = Brief.objects.create(owner=self.user, post=self.post, line=self.line)
+        self.assertEqual(b.kind, Brief.KIND_USER_POST)
+
+    def test_brief_kind_choices_include_note_unlock_and_share_invite(self):
+        choices = dict(Brief._meta.get_field("kind").choices)
+        self.assertIn(Brief.KIND_NOTE_UNLOCK, choices)
+        self.assertIn(Brief.KIND_USER_POST, choices)
+        self.assertIn(Brief.KIND_SHARE_INVITE, choices)
+
+    def test_brief_line_can_be_null(self):
+        """A Brief may pre-date its Line (e.g. share-invite spawns the Line
+        async — the Brief should still be persistable while the Line write
+        is pending). Doesn't break the post FK."""
+        b = Brief.objects.create(owner=self.user, post=self.post)
+        self.assertIsNone(b.line)
+
+    def test_brief_owner_required(self):
+        """Brief without owner is invalid (load-bearing for "whose
+        attention"). Post used to be required too, but became nullable
+        when GAME_INVITE briefs landed (those use Brief.room instead of
+        Brief.post). The view layer enforces "post XOR room" per kind."""
+        from django.db import IntegrityError, transaction
+        with transaction.atomic(), self.assertRaises(IntegrityError):
+            Brief.objects.create(post=self.post, line=self.line)
+
+    def test_brief_carries_title(self):
+        b = Brief.objects.create(
+            owner=self.user, post=self.post, line=self.line,
+            title="Look! — new Note unlocked",
+        )
+        self.assertEqual(b.title, "Look! — new Note unlocked")
+
+    def test_brief_str_includes_owner_kind_unread(self):
+        b = Brief.objects.create(owner=self.user, post=self.post, kind=Brief.KIND_NOTE_UNLOCK)
+        s = str(b)
+        self.assertIn("brief@test.io", s)
+        self.assertIn("note_unlock", s)
+
+
+class ViewPostMarksReadTest(TestCase):
+    """GET /billboard/post/<uuid>/ flips every unread Brief on that post for
+    the requesting user to is_unread=False. NVM (banner dismiss client-side
+    without nav) leaves Briefs untouched — that path doesn't hit this view."""
+
+    def setUp(self):
+        self.user = User.objects.create(email="reader@test.io")
+        self.client.force_login(self.user)
+        self.post = Post.objects.create(owner=self.user)
+        self.line = Line.objects.create(post=self.post, text="entry one", author=self.user)
+
+    def test_get_view_post_flips_owner_unread_brief_to_read(self):
+        b = Brief.objects.create(owner=self.user, post=self.post, line=self.line)
+        self.assertTrue(b.is_unread)
+        self.client.get(reverse("billboard:view_post", args=[self.post.id]))
+        b.refresh_from_db()
+        self.assertFalse(b.is_unread)
+
+    def test_get_does_not_flip_other_users_briefs(self):
+        other = User.objects.create(email="other@test.io")
+        # Both users have a Brief on this post; only the requesting user's flips
+        mine = Brief.objects.create(owner=self.user, post=self.post, line=self.line)
+        theirs = Brief.objects.create(owner=other, post=self.post, line=self.line)
+        self.client.get(reverse("billboard:view_post", args=[self.post.id]))
+        mine.refresh_from_db()
+        theirs.refresh_from_db()
+        self.assertFalse(mine.is_unread)
+        self.assertTrue(theirs.is_unread)
+
+    def test_get_does_not_flip_briefs_on_other_posts(self):
+        other_post = Post.objects.create(owner=self.user)
+        other_line = Line.objects.create(post=other_post, text="other", author=self.user)
+        unrelated = Brief.objects.create(owner=self.user, post=other_post, line=other_line)
+        self.client.get(reverse("billboard:view_post", args=[self.post.id]))
+        unrelated.refresh_from_db()
+        self.assertTrue(unrelated.is_unread)
+
+    def test_get_idempotent_for_already_read_brief(self):
+        already_read = Brief.objects.create(
+            owner=self.user, post=self.post, line=self.line, is_unread=False,
+        )
+        self.client.get(reverse("billboard:view_post", args=[self.post.id]))
+        already_read.refresh_from_db()
+        self.assertFalse(already_read.is_unread)
+
+    def test_post_request_does_not_mark_read(self):
+        """Posting a new Line to view_post (the legacy compose flow) is not
+        the FYI-read contract — the user is composing, not reviewing. Mark-
+        read happens only on a GET render of post.html."""
+        b = Brief.objects.create(owner=self.user, post=self.post, line=self.line)
+        self.client.post(
+            reverse("billboard:view_post", args=[self.post.id]),
+            data={"text": "appended via POST"},
+        )
+        b.refresh_from_db()
+        self.assertTrue(b.is_unread)

src/apps/billboard/tests/integrated/test_buds.py

@@ -0,0 +1,335 @@
+"""ITs for the My Buds feature (User.buds M2M + my_buds view +
+add_bud JSON endpoint).
+
+User.buds is a self M2M (symmetrical=False) — adding Alice to Disco's
+list does NOT auto-reciprocate. Implicit auto-add on shared events
+(post-share, gate-invite) is layered separately in those views.
+
+Privacy: add_bud returns 200 with {bud: null} when the email is
+unregistered, so the response shape never leaks membership.
+"""
+from django.test import TestCase
+from django.urls import reverse
+
+from apps.lyric.models import User
+
+
+class UserBudsM2MTest(TestCase):
+    """The buds field is asymmetric — A.buds.add(B) doesn't
+    reciprocate to B.buds, only to B.added_as_bud."""
+
+    def setUp(self):
+        self.disco = User.objects.create(email="disco@test.io")
+        self.alice = User.objects.create(email="alice@test.io")
+
+    def test_add_bud_one_way(self):
+        self.disco.buds.add(self.alice)
+        self.assertIn(self.alice, self.disco.buds.all())
+        self.assertNotIn(self.disco, self.alice.buds.all())
+
+    def test_added_as_bud_reverse_relation(self):
+        self.disco.buds.add(self.alice)
+        self.assertIn(self.disco, self.alice.added_as_bud.all())
+
+    def test_add_is_idempotent(self):
+        self.disco.buds.add(self.alice)
+        self.disco.buds.add(self.alice)
+        self.assertEqual(self.disco.buds.count(), 1)
+
+
+class MyBudsViewTest(TestCase):
+    def setUp(self):
+        self.user = User.objects.create(email="me@test.io")
+        self.client.force_login(self.user)
+        self.alice = User.objects.create(email="alice@test.io", username="alice")
+        self.bob = User.objects.create(email="bob@test.io", username="bob")
+        self.user.buds.add(self.alice, self.bob)
+
+    def test_my_buds_renders_template(self):
+        response = self.client.get(reverse("billboard:my_buds"))
+        self.assertEqual(response.status_code, 200)
+        self.assertTemplateUsed(response, "apps/billboard/my_buds.html")
+
+    def test_my_buds_lists_users_buds(self):
+        response = self.client.get(reverse("billboard:my_buds"))
+        buds = list(response.context["buds"])
+        self.assertIn(self.alice, buds)
+        self.assertIn(self.bob, buds)
+
+    def test_my_buds_does_not_list_others_buds(self):
+        other = User.objects.create(email="other@test.io")
+        carol = User.objects.create(email="carol@test.io", username="carol")
+        other.buds.add(carol)
+        response = self.client.get(reverse("billboard:my_buds"))
+        self.assertNotIn(carol, list(response.context["buds"]))
+
+    def test_my_buds_redirects_anon_to_login(self):
+        self.client.logout()
+        response = self.client.get(reverse("billboard:my_buds"))
+        self.assertEqual(response.status_code, 302)
+
+
+class AddBudViewTest(TestCase):
+    def setUp(self):
+        self.user = User.objects.create(email="me@test.io", username="me")
+        self.client.force_login(self.user)
+
+    def test_add_registered_email_adds_to_buds(self):
+        alice = User.objects.create(email="alice@test.io", username="alice")
+        response = self.client.post(
+            reverse("billboard:add_bud"),
+            data={"recipient": "alice@test.io"},
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertIn(alice, self.user.buds.all())
+
+    def test_add_returns_bud_payload_with_username(self):
+        User.objects.create(email="alice@test.io", username="alice")
+        response = self.client.post(
+            reverse("billboard:add_bud"),
+            data={"recipient": "alice@test.io"},
+        )
+        body = response.json()
+        self.assertIsNotNone(body["bud"])
+        self.assertEqual(body["bud"]["username"], "alice")
+
+    def test_add_unregistered_email_returns_null_bud(self):
+        """Privacy: 200 with bud=null so the response shape doesn't leak
+        whether the address is on the system."""
+        response = self.client.post(
+            reverse("billboard:add_bud"),
+            data={"recipient": "ghost@test.io"},
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertIsNone(response.json()["bud"])
+        self.assertEqual(self.user.buds.count(), 0)
+
+    def test_add_own_email_is_silent_noop(self):
+        """Adding yourself: no bud added, response carries bud=null."""
+        response = self.client.post(
+            reverse("billboard:add_bud"),
+            data={"recipient": "me@test.io"},
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertIsNone(response.json()["bud"])
+        self.assertNotIn(self.user, self.user.buds.all())
+
+    def test_add_existing_bud_is_idempotent(self):
+        alice = User.objects.create(email="alice@test.io", username="alice")
+        self.user.buds.add(alice)
+        response = self.client.post(
+            reverse("billboard:add_bud"),
+            data={"recipient": "alice@test.io"},
+        )
+        self.assertEqual(response.status_code, 200)
+        # Still only one bud entry — M2M dedup
+        self.assertEqual(self.user.buds.count(), 1)
+        # Response still carries the bud payload (so the JS can refresh
+        # an entry if a fast double-click bypassed the data-bud-id guard).
+        self.assertIsNotNone(response.json()["bud"])
+
+    def test_add_falls_back_to_email_when_no_username(self):
+        """Bud payload returns email when bud.username is None — display
+        layer matches the navbar fallback (display_name filter)."""
+        User.objects.create(email="anon@test.io")
+        response = self.client.post(
+            reverse("billboard:add_bud"),
+            data={"recipient": "anon@test.io"},
+        )
+        self.assertEqual(response.json()["bud"]["username"], "anon@test.io")
+
+    def test_get_returns_405(self):
+        response = self.client.get(reverse("billboard:add_bud"))
+        self.assertEqual(response.status_code, 405)
+
+    def test_add_returns_at_handle_and_title_for_tooltip_row(self):
+        """The async-appended My Buds row mirrors _my_buds_item.html, so the
+        payload must carry the bud's at_handle + active_title_display to fill
+        the data-tt-* attrs — without them the new row's tooltip renders empty
+        (the entries above it, server-rendered, have them). Regression
+        2026-05-29."""
+        alice = User.objects.create(email="alice@test.io", username="alice")
+        body = self.client.post(
+            reverse("billboard:add_bud"), data={"recipient": "alice"},
+        ).json()
+        self.assertEqual(body["bud"]["at_handle"], "@alice")
+        self.assertEqual(body["bud"]["title"], alice.active_title_display)
+
+    def test_add_resolves_username_too_not_just_email(self):
+        """Phase 2: recipient field accepts usernames as well as emails."""
+        alice = User.objects.create(email="alice@test.io", username="alice")
+        response = self.client.post(
+            reverse("billboard:add_bud"),
+            data={"recipient": "alice"},
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json()["bud"]["username"], "alice")
+        self.assertIn(alice, self.user.buds.all())
+
+
+class SearchBudsViewTest(TestCase):
+    """Top-3 prefix-match autocomplete endpoint backing #id_recipient."""
+
+    def setUp(self):
+        self.user = User.objects.create(email="me@test.io", username="me")
+        self.client.force_login(self.user)
+        self.alice  = User.objects.create(email="alice@test.io",  username="alice")
+        self.albert = User.objects.create(email="albert@test.io", username="albert")
+        self.alvin  = User.objects.create(email="alvin@test.io",  username="alvin")
+        self.bob    = User.objects.create(email="bob@test.io",    username="bob")
+        self.user.buds.add(self.alice, self.albert, self.alvin, self.bob)
+
+    def test_username_prefix_match(self):
+        response = self.client.get(reverse("billboard:search_buds"), {"q": "al"})
+        usernames = [b["username"] for b in response.json()["buds"]]
+        # alice, albert, alvin all start with "al" — exactly 3 (cap)
+        self.assertEqual(len(usernames), 3)
+        self.assertIn("alice", usernames)
+        self.assertIn("albert", usernames)
+        self.assertIn("alvin", usernames)
+        self.assertNotIn("bob", usernames)
+
+    def test_caps_at_three_results(self):
+        d = User.objects.create(email="alfred@test.io", username="alfred")
+        self.user.buds.add(d)
+        response = self.client.get(reverse("billboard:search_buds"), {"q": "al"})
+        self.assertEqual(len(response.json()["buds"]), 3)
+
+    def test_email_prefix_also_matches(self):
+        response = self.client.get(reverse("billboard:search_buds"), {"q": "bob@"})
+        usernames = [b["username"] for b in response.json()["buds"]]
+        self.assertIn("bob", usernames)
+
+    def test_does_not_leak_non_buds(self):
+        """Non-buds (other registered users) don't appear in suggestions."""
+        User.objects.create(email="stranger@test.io", username="stranger")
+        response = self.client.get(reverse("billboard:search_buds"), {"q": "str"})
+        self.assertEqual(response.json()["buds"], [])
+
+    def test_empty_q_returns_empty_list(self):
+        response = self.client.get(reverse("billboard:search_buds"), {"q": ""})
+        self.assertEqual(response.json()["buds"], [])
+
+    def test_anon_redirects(self):
+        self.client.logout()
+        response = self.client.get(reverse("billboard:search_buds"), {"q": "al"})
+        self.assertEqual(response.status_code, 302)
+
+
+class SharePostImplicitAutoAddTest(TestCase):
+    """Per-spec: when a share lands a recipient on Post.shared_with, the
+    sharer + recipient mutually auto-add each other to their buds lists."""
+
+    def setUp(self):
+        from apps.billboard.models import Post
+        self.sharer = User.objects.create(email="sharer@test.io", username="sharer")
+        self.client.force_login(self.sharer)
+        self.alice = User.objects.create(email="alice@test.io", username="alice")
+        self.post = Post.objects.create(owner=self.sharer)
+
+    def _share(self, recipient):
+        return self.client.post(
+            reverse("billboard:share_post", args=[self.post.id]),
+            data={"recipient": recipient},
+            HTTP_ACCEPT="application/json",
+        )
+
+    def test_share_adds_recipient_to_sharer_buds(self):
+        self._share("alice@test.io")
+        self.assertIn(self.alice, self.sharer.buds.all())
+
+    def test_share_adds_sharer_to_recipient_buds(self):
+        """Symmetric on shared events — recipient also gets the sharer."""
+        self._share("alice@test.io")
+        self.assertIn(self.sharer, self.alice.buds.all())
+
+    def test_share_with_username_also_auto_adds(self):
+        self._share("alice")
+        self.assertIn(self.alice, self.sharer.buds.all())
+        self.assertIn(self.sharer, self.alice.buds.all())
+
+    def test_unregistered_recipient_does_not_auto_add(self):
+        """Privacy: unregistered email doesn't touch the buds graph."""
+        self._share("ghost@test.io")
+        self.assertEqual(self.sharer.buds.count(), 0)
+
+
+class AddBudAlreadyPresentTest(TestCase):
+    """Duplicate-add guard: add_bud's JSON response distinguishes "newly
+    added" from "already a bud" so the bud-btn JS can render an error
+    Brief titled `@<username> is already present` instead of the normal
+    bud-entry append. `recipient_user_id` is the highlight target id that
+    the Brief FYI button toggles `.bud-duplicate-flash` onto."""
+
+    def setUp(self):
+        self.user = User.objects.create(email="me@test.io", username="me")
+        self.client.force_login(self.user)
+        self.alice = User.objects.create(email="alice@test.io", username="alice")
+        self.user.buds.add(self.alice)
+
+    def _add(self, recipient):
+        return self.client.post(
+            reverse("billboard:add_bud"), {"recipient": recipient},
+        )
+
+    def test_already_present_true_when_candidate_is_already_a_bud(self):
+        self.assertTrue(self._add("alice@test.io").json()["already_present"])
+
+    def test_already_present_false_for_new_bud(self):
+        User.objects.create(email="bob@test.io", username="bob")
+        self.assertFalse(self._add("bob@test.io").json()["already_present"])
+
+    def test_already_present_false_for_unregistered_email(self):
+        self.assertFalse(self._add("ghost@test.io").json()["already_present"])
+
+    def test_recipient_display_carries_username_on_duplicate(self):
+        self.assertEqual(self._add("alice@test.io").json()["recipient_display"], "alice")
+
+    def test_recipient_user_id_carries_alice_id_on_duplicate(self):
+        self.assertEqual(
+            self._add("alice@test.io").json()["recipient_user_id"],
+            str(self.alice.id),
+        )
+
+    def test_username_typed_recipient_also_detects_duplicate(self):
+        """A user typing 'alice' (no @) resolves the same way as the email."""
+        self.assertTrue(self._add("alice").json()["already_present"])
+
+
+class SharePostAlreadyPresentTest(TestCase):
+    """Duplicate-share guard mirrors AddBudAlreadyPresentTest — when the
+    recipient is already in post.shared_with, response carries
+    already_present + recipient_user_id for the .post-recipient highlight."""
+
+    def setUp(self):
+        from apps.billboard.models import Post
+        self.sharer = User.objects.create(email="sharer@test.io", username="sharer")
+        self.client.force_login(self.sharer)
+        self.alice = User.objects.create(email="alice@test.io", username="alice")
+        self.post = Post.objects.create(owner=self.sharer)
+        self.post.shared_with.add(self.alice)
+
+    def _share(self, recipient):
+        return self.client.post(
+            reverse("billboard:share_post", args=[self.post.id]),
+            data={"recipient": recipient},
+            HTTP_ACCEPT="application/json",
+        )
+
+    def test_already_present_true_when_recipient_in_shared_with(self):
+        self.assertTrue(self._share("alice@test.io").json()["already_present"])
+
+    def test_already_present_false_for_new_recipient(self):
+        User.objects.create(email="bob@test.io", username="bob")
+        self.assertFalse(self._share("bob@test.io").json()["already_present"])
+
+    def test_recipient_user_id_present_on_duplicate(self):
+        self.assertEqual(
+            self._share("alice@test.io").json()["recipient_user_id"],
+            str(self.alice.id),
+        )
+
+    def test_recipient_display_already_present_on_duplicate(self):
+        """`recipient_display` already exists on the success path; on
+        duplicate the same field must carry the matched user's handle."""
+        self.assertEqual(self._share("alice@test.io").json()["recipient_display"], "alice")

src/apps/billboard/tests/integrated/test_mail.py

@@ -0,0 +1,198 @@
+"""ITs for the @mailman "Acceptances & rejections" log — Phase A of
+[[my-sea-invite-voice-blueprint]].
+
+Mirrors `apps.billboard.tests.integrated.test_tax` (the @taxman ledger): a
+reserved system-author user (`mailman`) authors the interactive invite log
+Lines via `apps.billboard.mail.log_sea_invite`.
+
+This file grows in A4 with the `log_sea_invite` Post/Line/Brief tests; A2
+lands only the reserved-username + idempotency contract for `mailman`,
+mirroring `test_tax.TaxmanReservedUsernameTest`.
+"""
+
+from django.test import TestCase
+
+from apps.billboard.mail import INVITE_TEMPLATE, log_sea_invite
+from apps.billboard.models import (
+    Brief,
+    Line,
+    MAIL_ACCEPTANCE_POST_TITLE,
+    Post,
+)
+from apps.gameboard.models import SeaInvite
+from apps.lyric.models import (
+    User,
+    get_or_create_mailman,
+    is_reserved_username,
+)
+
+
+class LogSeaInviteTest(TestCase):
+    """`log_sea_invite` appends one interactive Line + spawns a Brief on the
+    invitee's single "Acceptances & rejections" Post, and links the Line back
+    to the SeaInvite (powering the OK/BYE render in A5)."""
+
+    def setUp(self):
+        self.owner = User.objects.create(
+            email="owner@test.io", username="discoman",
+        )
+        self.invitee = User.objects.create(
+            email="bud@test.io", username="budster",
+        )
+        self.invite = SeaInvite.objects.create(
+            owner=self.owner,
+            invitee=self.invitee,
+            invitee_email=self.invitee.email,
+        )
+
+    def test_creates_post_line_brief_on_invitee(self):
+        post, line, brief = log_sea_invite(self.invite)
+        # Post owned by the INVITEE (it's their notification surface)
+        self.assertEqual(post.owner, self.invitee)
+        self.assertEqual(post.kind, Post.KIND_MAIL_ACCEPTANCE)
+        self.assertEqual(post.title, MAIL_ACCEPTANCE_POST_TITLE)
+        # Line authored by @mailman + admin_solicited (survives the guard)
+        self.assertEqual(line.post, post)
+        self.assertEqual(line.author, get_or_create_mailman())
+        self.assertTrue(line.admin_solicited)
+        # Brief points at the Post + Line w. correct kind
+        self.assertEqual(brief.owner, self.invitee)
+        self.assertEqual(brief.post, post)
+        self.assertEqual(brief.line, line)
+        self.assertEqual(brief.kind, Brief.KIND_MAIL_ACCEPTANCE)
+        self.assertEqual(brief.title, MAIL_ACCEPTANCE_POST_TITLE)
+
+    def test_links_line_to_invite_both_directions(self):
+        _, line, _ = log_sea_invite(self.invite)
+        self.invite.refresh_from_db()
+        self.assertEqual(self.invite.line, line)
+        # OneToOne reverse accessor used by post.html (A5)
+        self.assertEqual(line.sea_invite, self.invite)
+
+    def test_prose_interpolates_owner_handle_and_default_possessive(self):
+        _, line, _ = log_sea_invite(self.invite)
+        self.assertIn("@discoman", line.text)
+        # pluralism (default) possessive = "their"
+        self.assertIn("their drawing table", line.text)
+        self.assertIn("expire 24h", line.text)
+
+    def test_possessive_follows_owner_pronouns(self):
+        self.owner.pronouns = "misogyny"  # he/him/his
+        self.owner.save()
+        _, line, _ = log_sea_invite(self.invite)
+        self.assertIn("his drawing table", line.text)
+
+    def test_line_survives_post_save_guard(self):
+        _, line, _ = log_sea_invite(self.invite)
+        self.assertTrue(Line.objects.filter(pk=line.pk).exists())
+
+    def test_two_inviters_share_invitees_one_post(self):
+        other_owner = User.objects.create(
+            email="other@test.io", username="amigo",
+        )
+        other_invite = SeaInvite.objects.create(
+            owner=other_owner, invitee=self.invitee,
+            invitee_email=self.invitee.email,
+        )
+        log_sea_invite(self.invite)
+        log_sea_invite(other_invite)
+        posts = Post.objects.filter(
+            owner=self.invitee, kind=Post.KIND_MAIL_ACCEPTANCE,
+        )
+        self.assertEqual(posts.count(), 1)
+        self.assertEqual(posts.first().lines.count(), 2)
+
+    def test_unregistered_invitee_creates_no_log(self):
+        # An unregistered recipient has no per-user Post surface yet — linking
+        # on registration is deferred. log_sea_invite no-ops to (None,None,None).
+        invite = SeaInvite.objects.create(
+            owner=self.owner, invitee=None,
+            invitee_email="stranger@nowhere.io",
+        )
+        self.assertEqual(log_sea_invite(invite), (None, None, None))
+
+    def test_template_uses_listen_hook(self):
+        self.assertTrue(INVITE_TEMPLATE.startswith("Listen!"))
+
+    def test_line_wraps_owner_handle_in_post_attribution_anchor(self):
+        """Bud landing page sprint 2026-05-27 — the inline OK/BYE block
+        migrates onto bud.html; the @mailman Line now carries an
+        `<a class="post-attribution">` around the owner's handle whose
+        href routes to the owner's per-bud landing page."""
+        _, line, _ = log_sea_invite(self.invite)
+        self.assertIn('class="post-attribution"', line.text)
+        self.assertIn(
+            f'href="/billboard/buds/{self.owner.id}/"', line.text,
+        )
+        # The anchor wraps ONLY the at_handle (not the surrounding prose)
+        self.assertIn(">@discoman</a>", line.text)
+
+
+class MailAcceptanceKindTest(TestCase):
+    """The new MAIL_ACCEPTANCE kind is registered on both Post + Brief."""
+
+    def test_post_kind_registered(self):
+        self.assertEqual(Post.KIND_MAIL_ACCEPTANCE, "mail_acceptance")
+        kinds = dict(Post.KIND_CHOICES)
+        self.assertIn(Post.KIND_MAIL_ACCEPTANCE, kinds)
+
+    def test_brief_kind_registered(self):
+        self.assertEqual(Brief.KIND_MAIL_ACCEPTANCE, "mail_acceptance")
+        kinds = dict(Brief.KIND_CHOICES)
+        self.assertIn(Brief.KIND_MAIL_ACCEPTANCE, kinds)
+
+    def test_post_title_constant(self):
+        self.assertEqual(MAIL_ACCEPTANCE_POST_TITLE, "Acceptances & rejections")
+
+
+class MailAcceptanceGuardTest(TestCase):
+    """post_save guard nukes any Line saved on a MAIL_ACCEPTANCE Post w.o.
+    admin_solicited=True — same defense-in-depth as NOTE_UNLOCK / TAX_LEDGER.
+    `log_sea_invite` sets admin_solicited=True so legitimate invite Lines
+    survive."""
+
+    def setUp(self):
+        self.user = User.objects.create(email="guard_mail@test.io")
+        self.mailman = get_or_create_mailman()
+        self.post = Post.objects.create(
+            owner=self.user,
+            kind=Post.KIND_MAIL_ACCEPTANCE,
+            title=MAIL_ACCEPTANCE_POST_TITLE,
+        )
+
+    def test_unsolicited_line_on_mail_acceptance_gets_deleted(self):
+        Line.objects.create(
+            post=self.post, text="impostor", author=self.mailman,
+            admin_solicited=False,
+        )
+        self.assertEqual(self.post.lines.count(), 0)
+
+    def test_solicited_line_on_mail_acceptance_survives(self):
+        Line.objects.create(
+            post=self.post, text="legit", author=self.mailman,
+            admin_solicited=True,
+        )
+        self.assertEqual(self.post.lines.count(), 1)
+
+
+class MailmanReservedUsernameTest(TestCase):
+    """`mailman` joins `adman` + `taxman` as a reserved system-author handle."""
+
+    def test_mailman_is_reserved(self):
+        self.assertTrue(is_reserved_username("mailman"))
+        self.assertTrue(is_reserved_username("MAILMAN"))  # case-insensitive
+
+    def test_get_or_create_mailman_is_idempotent(self):
+        a = get_or_create_mailman()
+        b = get_or_create_mailman()
+        self.assertEqual(a.pk, b.pk)
+        self.assertEqual(a.email, "mailman@earthmanrpg.local")
+
+    def test_mailman_is_not_searchable(self):
+        # System users never surface in bud / recipient autocomplete.
+        self.assertFalse(get_or_create_mailman().searchable)
+
+    def test_existing_username_owner_is_not_blocked(self):
+        # A user who already holds a name isn't blocked from re-saving it.
+        u = User.objects.create(email="m@test.io", username="mailman_fan")
+        self.assertFalse(is_reserved_username("mailman_fan", current_user=u))

src/apps/billboard/tests/integrated/test_post_invitee_view.py

@@ -0,0 +1,152 @@
+"""ITs for post.html invitee-vs-owner header rendering.
+
+The "just me, @owner the {title}" / "shared between … & me, @owner …" lines
+were owner-centric (the legacy phrasing assumed the viewer is the post
+creator). For an invitee (a user in post.shared_with), that prose is
+confusing. This view branches the .post-header block:
+
+  • Owner viewing → unchanged existing prose.
+  • Invitee viewing (sole)  → "shared with me, @viewer the {title}" +
+                              "created by @owner the {owner_title}".
+  • Invitee viewing (multi) → "shared with {other_recipients ...}" +
+                              "& me, @viewer the {title}" +
+                              "created by @owner the {owner_title}".
+
+The view layer adds `viewer_is_owner` + `other_recipients` to the
+context; template branches on those.
+"""
+from django.test import TestCase
+from django.urls import reverse
+
+from apps.billboard.models import Line, Post
+from apps.lyric.models import User
+
+
+class PostInviteeViewContextTest(TestCase):
+    """Context vars: viewer_is_owner + other_recipients."""
+
+    def setUp(self):
+        self.owner = User.objects.create(email="owner@test.io", username="owner")
+        self.alice = User.objects.create(email="alice@test.io", username="alice")
+        self.bob   = User.objects.create(email="bob@test.io",   username="bob")
+        self.post = Post.objects.create(owner=self.owner, title="Coolio")
+        Line.objects.create(post=self.post, text="seed", author=self.owner)
+
+    def test_owner_viewing_sets_viewer_is_owner_true(self):
+        self.client.force_login(self.owner)
+        response = self.client.get(reverse("billboard:view_post", args=[self.post.id]))
+        self.assertTrue(response.context["viewer_is_owner"])
+
+    def test_invitee_viewing_sets_viewer_is_owner_false(self):
+        self.post.shared_with.add(self.alice)
+        self.client.force_login(self.alice)
+        response = self.client.get(reverse("billboard:view_post", args=[self.post.id]))
+        self.assertFalse(response.context["viewer_is_owner"])
+
+    def test_other_recipients_excludes_viewer(self):
+        """For an invitee, other_recipients = shared_with minus self."""
+        self.post.shared_with.add(self.alice, self.bob)
+        self.client.force_login(self.alice)
+        response = self.client.get(reverse("billboard:view_post", args=[self.post.id]))
+        others = list(response.context["other_recipients"])
+        self.assertIn(self.bob, others)
+        self.assertNotIn(self.alice, others)
+
+    def test_other_recipients_empty_for_sole_invitee(self):
+        self.post.shared_with.add(self.alice)
+        self.client.force_login(self.alice)
+        response = self.client.get(reverse("billboard:view_post", args=[self.post.id]))
+        self.assertEqual(list(response.context["other_recipients"]), [])
+
+    def test_other_recipients_for_owner_is_full_shared_with(self):
+        """Owner viewing: other_recipients includes everyone (no self exclusion)."""
+        self.post.shared_with.add(self.alice, self.bob)
+        self.client.force_login(self.owner)
+        response = self.client.get(reverse("billboard:view_post", args=[self.post.id]))
+        others = list(response.context["other_recipients"])
+        self.assertIn(self.alice, others)
+        self.assertIn(self.bob, others)
+
+
+class PostInviteeViewTemplateTest(TestCase):
+    """Template prose: invitee branch shows "shared with me, …" /
+    "created by @owner …" — does NOT show the owner-centric "just me" or
+    "shared between"."""
+
+    def setUp(self):
+        self.owner = User.objects.create(email="owner@test.io", username="owner")
+        self.alice = User.objects.create(email="alice@test.io", username="alice")
+        self.bob   = User.objects.create(email="bob@test.io",   username="bob")
+        self.post = Post.objects.create(owner=self.owner, title="Coolio")
+        Line.objects.create(post=self.post, text="seed", author=self.owner)
+
+    def test_sole_invitee_sees_shared_with_me(self):
+        self.post.shared_with.add(self.alice)
+        self.client.force_login(self.alice)
+        response = self.client.get(reverse("billboard:view_post", args=[self.post.id]))
+        body = response.content.decode()
+        self.assertIn("shared with me", body)
+        self.assertIn("@alice", body)
+
+    def test_sole_invitee_does_not_see_just_me_or_shared_between(self):
+        """Scope to .post-header — the bud-panel JS includes 'just me,' as
+        a regex literal in inline script, so a body-wide string match
+        false-positives."""
+        import lxml.html
+        self.post.shared_with.add(self.alice)
+        self.client.force_login(self.alice)
+        body = self.client.get(reverse("billboard:view_post", args=[self.post.id])).content.decode()
+        tree = lxml.html.fromstring(body)
+        header_text = tree.cssselect(".post-header")[0].text_content()
+        self.assertNotIn("just me,", header_text)
+        self.assertNotIn("shared between", header_text)
+
+    def test_invitee_sees_created_by_owner(self):
+        self.post.shared_with.add(self.alice)
+        self.client.force_login(self.alice)
+        body = self.client.get(reverse("billboard:view_post", args=[self.post.id])).content.decode()
+        self.assertIn("created by", body)
+        self.assertIn("@owner", body)
+
+    def test_multi_invitee_sees_shared_with_others_then_amp_me(self):
+        self.post.shared_with.add(self.alice, self.bob)
+        self.client.force_login(self.alice)
+        body = self.client.get(reverse("billboard:view_post", args=[self.post.id])).content.decode()
+        self.assertIn("shared with", body)
+        self.assertIn("@bob", body)
+        self.assertIn("& me", body)
+        self.assertIn("@alice", body)
+
+    def test_multi_invitee_does_not_see_self_in_recipients_line(self):
+        """The recipients line lists OTHER invitees, not self."""
+        self.post.shared_with.add(self.alice, self.bob)
+        self.client.force_login(self.alice)
+        body = self.client.get(reverse("billboard:view_post", args=[self.post.id])).content.decode()
+        # Coarse check: "shared with @bob" appears w/o @alice in same line
+        # (since alice's "@alice" is on the "& me" line below). The full
+        # body contains both, but the .post-shared-recipients line should
+        # only list other_recipients (i.e., bob, not alice).
+        # Use a narrower lxml-style assertion.
+        import lxml.html
+        tree = lxml.html.fromstring(body)
+        recipients_p = tree.cssselect(".post-shared-recipients")
+        self.assertEqual(len(recipients_p), 1)
+        rec_text = recipients_p[0].text_content()
+        self.assertIn("@bob", rec_text)
+        self.assertNotIn("@alice", rec_text)
+
+    def test_owner_view_unchanged_when_recipients_present(self):
+        """Owner sees 'shared between' (old behavior)."""
+        self.post.shared_with.add(self.alice)
+        self.client.force_login(self.owner)
+        body = self.client.get(reverse("billboard:view_post", args=[self.post.id])).content.decode()
+        self.assertIn("shared between", body)
+        self.assertIn("& me", body)
+        self.assertNotIn("created by", body)
+
+    def test_owner_view_just_me_when_no_recipients(self):
+        """Owner with no recipients: 'just me, …' (old behavior)."""
+        self.client.force_login(self.owner)
+        body = self.client.get(reverse("billboard:view_post", args=[self.post.id])).content.decode()
+        self.assertIn("just me,", body)
+        self.assertNotIn("created by", body)

src/apps/billboard/tests/integrated/test_share_post.py

@@ -0,0 +1,151 @@
+"""ITs for share-post async-Brief flow (C3.b).
+
+POST /billboard/post/<uuid>/share-post w. Accept: application/json now:
+  - Adds the recipient to Post.shared_with (if registered, not the sharer)
+  - Appends a Line to the Post recording the share event
+  - Spawns a Brief(kind=SHARE_INVITE) for the sharer that JS slide-downs
+  - Returns JSON {brief: {…}, line_text: "…"}; no redirect, no messages
+
+Legacy form-submit (no Accept: application/json) still redirects + flashes
+the privacy-safe success message — kept for non-AJAX fallback / older FTs.
+"""
+
+from django.test import TestCase
+from django.urls import reverse
+
+from apps.billboard.models import Brief, Line, Post
+from apps.lyric.models import User
+
+
+class SharePostAsyncTest(TestCase):
+    def setUp(self):
+        self.sharer = User.objects.create(email="sharer@test.io")
+        self.client.force_login(self.sharer)
+        self.post = Post.objects.create(owner=self.sharer)
+
+    def _share_async(self, recipient_email):
+        return self.client.post(
+            reverse("billboard:share_post", args=[self.post.id]),
+            data={"recipient": recipient_email},
+            HTTP_ACCEPT="application/json",
+        )
+
+    def test_async_share_returns_brief_payload(self):
+        User.objects.create(email="alice@test.io")
+        response = self._share_async("alice@test.io")
+        self.assertEqual(response.status_code, 200)
+        body = response.json()
+        self.assertIn("brief", body)
+        self.assertIn("line_text", body)
+
+    def test_async_share_appends_line_to_post(self):
+        User.objects.create(email="alice@test.io")
+        self.assertEqual(self.post.lines.count(), 0)
+        self._share_async("alice@test.io")
+        self.assertEqual(self.post.lines.count(), 1)
+        line = self.post.lines.first()
+        self.assertIn("alice@test.io", line.text)
+
+    def test_async_share_creates_share_invite_brief_for_sharer(self):
+        User.objects.create(email="alice@test.io")
+        self._share_async("alice@test.io")
+        brief = Brief.objects.get(owner=self.sharer)
+        self.assertEqual(brief.kind, Brief.KIND_SHARE_INVITE)
+        self.assertEqual(brief.post, self.post)
+        self.assertIsNotNone(brief.line)
+        self.assertTrue(brief.is_unread)
+
+    def test_async_share_adds_registered_recipient_to_shared_with(self):
+        alice = User.objects.create(email="alice@test.io")
+        self._share_async("alice@test.io")
+        self.assertIn(alice, self.post.shared_with.all())
+
+    def test_async_share_unregistered_recipient_still_appends_line_and_brief(self):
+        """Privacy: even if the email isn't registered, the sharer gets the
+        same confirmation Brief + Line. Otherwise the response shape would
+        leak whether an address is on the system."""
+        response = self._share_async("ghost@test.io")
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(self.post.lines.count(), 1)
+        self.assertEqual(Brief.objects.filter(owner=self.sharer).count(), 1)
+
+    def test_async_share_does_not_add_owner_as_recipient(self):
+        """Sharer shares w. their own email — no shared_with add, no Line, no
+        Brief; response carries brief: null so the JS just no-ops."""
+        response = self._share_async("sharer@test.io")
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json()["brief"], None)
+        self.assertEqual(self.post.lines.count(), 0)
+        self.assertEqual(Brief.objects.filter(owner=self.sharer).count(), 0)
+        self.assertNotIn(self.sharer, self.post.shared_with.all())
+
+    def test_async_share_brief_payload_carries_share_invite_kind(self):
+        User.objects.create(email="alice@test.io")
+        body = self._share_async("alice@test.io").json()
+        self.assertEqual(body["brief"]["kind"], "share_invite")
+        self.assertIn("alice@test.io", body["line_text"])
+
+    def test_async_reshare_same_recipient_is_silent_noop(self):
+        """Sharing the same recipient twice is a silent no-op — Post.shared_with
+        M2M is idempotent so a second add is meaningless, and we don't want a
+        duplicate Line cluttering the thread. Response is 200 with brief=null."""
+        User.objects.create(email="alice@test.io")
+        self._share_async("alice@test.io")
+        self.assertEqual(self.post.lines.count(), 1)
+        before_brief_count = Brief.objects.filter(owner=self.sharer).count()
+
+        response = self._share_async("alice@test.io")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json()["brief"], None)
+        # No second Line, no second Brief.
+        self.assertEqual(self.post.lines.count(), 1)
+        self.assertEqual(
+            Brief.objects.filter(owner=self.sharer).count(),
+            before_brief_count,
+        )
+
+    def test_async_share_line_text_drops_timestamp(self):
+        """The share Line's text is plain "Shared with X" — no "at <iso ts>"
+        suffix (timestamp display lives on the per-Line `<time>` element now)."""
+        User.objects.create(email="alice@test.io")
+        self._share_async("alice@test.io")
+        line = self.post.lines.first()
+        self.assertEqual(line.text, "Shared with alice@test.io")
+        self.assertNotIn(" at ", line.text)
+
+    def test_async_share_line_author_is_sharer_not_adman(self):
+        """User-created share Lines attribute to the sharer (the post owner
+        doing the share), not the system adman entity."""
+        User.objects.create(email="alice@test.io")
+        self._share_async("alice@test.io")
+        line = self.post.lines.first()
+        self.assertEqual(line.author, self.sharer)
+
+
+class SharePostLegacyRedirectTest(TestCase):
+    """Legacy form-submit path (no Accept: application/json) is preserved —
+    redirects + flashes the privacy-safe message + adds shared_with. Existing
+    FTs that submit the share form via Selenium still work."""
+
+    def setUp(self):
+        self.sharer = User.objects.create(email="sharer@test.io")
+        self.client.force_login(self.sharer)
+        self.post = Post.objects.create(owner=self.sharer)
+
+    def test_form_submit_still_redirects(self):
+        User.objects.create(email="alice@test.io")
+        response = self.client.post(
+            reverse("billboard:share_post", args=[self.post.id]),
+            data={"recipient": "alice@test.io"},
+        )
+        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response["Location"], reverse("billboard:view_post", args=[self.post.id]))
+
+    def test_form_submit_still_adds_shared_with(self):
+        alice = User.objects.create(email="alice@test.io")
+        self.client.post(
+            reverse("billboard:share_post", args=[self.post.id]),
+            data={"recipient": "alice@test.io"},
+        )
+        self.assertIn(alice, self.post.shared_with.all())

src/apps/billboard/tests/integrated/test_tax.py

@@ -0,0 +1,121 @@
+"""ITs for `apps.billboard.tax.log_tax_debit` — the @taxman-authored
+"Debits & credits" ledger (user-spec 2026-05-26).
+
+Mirrors the shape of `apps.drama.tests.integrated.test_note_brief` for
+`Note.grant_if_new` — each spend appends a Line + spawns a Brief on the
+user's single TAX_LEDGER Post."""
+
+from django.test import TestCase
+
+from apps.billboard.models import Brief, Line, Post, TAX_LEDGER_POST_TITLE
+from apps.billboard.tax import (
+    TAX_DEBIT_TEMPLATES,
+    log_tax_debit,
+)
+from apps.lyric.models import User, get_or_create_taxman
+
+
+class LogTaxDebitTest(TestCase):
+    def setUp(self):
+        self.user = User.objects.create(email="tax@test.io")
+
+    def test_free_draw_locked_creates_post_line_brief(self):
+        post, line, brief = log_tax_debit(self.user, "free_draw_locked")
+        # Post created with the canonical title + correct kind
+        self.assertEqual(post.owner, self.user)
+        self.assertEqual(post.kind, Post.KIND_TAX_LEDGER)
+        self.assertEqual(post.title, TAX_LEDGER_POST_TITLE)
+        # Line authored by @taxman + admin_solicited
+        self.assertEqual(line.post, post)
+        self.assertEqual(line.author, get_or_create_taxman())
+        self.assertTrue(line.admin_solicited)
+        # Brief points at the Post + Line w. correct kind
+        self.assertEqual(brief.owner, self.user)
+        self.assertEqual(brief.post, post)
+        self.assertEqual(brief.line, line)
+        self.assertEqual(brief.kind, Brief.KIND_TAX_LEDGER)
+        self.assertEqual(brief.title, TAX_LEDGER_POST_TITLE)
+
+    def test_paid_draw_locked_uses_paid_template_text(self):
+        _, line, _ = log_tax_debit(self.user, "paid_draw_locked")
+        self.assertIn("PAID DRAW", line.text)
+        # `GATE VIEW` is wrapped in a `.btn-pri-name` span for inline styling
+        # parity w. the actual button label (user-spec 2026-05-26), so the
+        # raw text has HTML between "depositing a Token in " + "GATE VIEW".
+        self.assertIn("depositing a Token in", line.text)
+        self.assertIn("GATE VIEW", line.text)
+
+    def test_free_draw_locked_uses_free_template_text(self):
+        _, line, _ = log_tax_debit(self.user, "free_draw_locked")
+        self.assertIn("FREE DRAW", line.text)
+        self.assertIn("24h from the production of this log", line.text)
+
+    def test_two_spends_share_one_post_with_two_lines(self):
+        """Like Note unlocks: one Post per user, growing thread of Lines."""
+        log_tax_debit(self.user, "free_draw_locked")
+        log_tax_debit(self.user, "paid_draw_locked")
+        posts = Post.objects.filter(owner=self.user, kind=Post.KIND_TAX_LEDGER)
+        self.assertEqual(posts.count(), 1)
+        self.assertEqual(posts.first().lines.count(), 2)
+
+    def test_two_free_draws_produce_distinct_lines(self):
+        """Each spend produces a UNIQUE Line — text is timestamp-prefixed so
+        a second identical-slug spend doesn't collide with `unique_together
+        = (post, text)`."""
+        log_tax_debit(self.user, "free_draw_locked")
+        log_tax_debit(self.user, "free_draw_locked")
+        post = Post.objects.get(owner=self.user, kind=Post.KIND_TAX_LEDGER)
+        line_texts = list(post.lines.values_list("text", flat=True))
+        self.assertEqual(len(line_texts), 2)
+        self.assertNotEqual(line_texts[0], line_texts[1])
+
+    def test_unknown_slug_raises(self):
+        with self.assertRaises(KeyError):
+            log_tax_debit(self.user, "no_such_slug")
+
+    def test_template_keys_cover_both_known_slugs(self):
+        self.assertIn("free_draw_locked", TAX_DEBIT_TEMPLATES)
+        self.assertIn("paid_draw_locked", TAX_DEBIT_TEMPLATES)
+
+
+class UnsolicitedLineGuardTest(TestCase):
+    """post_save guard nukes any Line saved on a TAX_LEDGER Post w.o.
+    admin_solicited=True — mirrors the NOTE_UNLOCK defense-in-depth."""
+
+    def setUp(self):
+        self.user = User.objects.create(email="guard@test.io")
+        self.taxman = get_or_create_taxman()
+        self.post = Post.objects.create(
+            owner=self.user,
+            kind=Post.KIND_TAX_LEDGER,
+            title=TAX_LEDGER_POST_TITLE,
+        )
+
+    def test_unsolicited_line_on_tax_ledger_gets_deleted(self):
+        Line.objects.create(
+            post=self.post, text="impostor", author=self.taxman,
+            admin_solicited=False,
+        )
+        self.assertEqual(self.post.lines.count(), 0)
+
+    def test_solicited_line_on_tax_ledger_survives(self):
+        Line.objects.create(
+            post=self.post, text="legit", author=self.taxman,
+            admin_solicited=True,
+        )
+        self.assertEqual(self.post.lines.count(), 1)
+
+
+class TaxmanReservedUsernameTest(TestCase):
+    """`taxman` joins `adman` as a reserved system-author handle."""
+
+    def test_taxman_is_reserved(self):
+        from apps.lyric.models import is_reserved_username
+        self.assertTrue(is_reserved_username("taxman"))
+        self.assertTrue(is_reserved_username("TAXMAN"))  # case-insensitive
+
+    def test_get_or_create_taxman_is_idempotent(self):
+        a = get_or_create_taxman()
+        b = get_or_create_taxman()
+        self.assertEqual(a.pk, b.pk)
+        self.assertEqual(a.email, "taxman@earthmanrpg.local")

src/apps/billboard/urls.py

@@ -11,6 +11,22 @@ urlpatterns = [
     path("note/<slug:slug>/set-palette", views.note_set_palette, name="note_set_palette"),
     path("note/<slug:slug>/don", views.don_title, name="don_title"),
     path("note/<slug:slug>/doff", views.doff_title, name="doff_title"),
-    path("room/<uuid:room_id>/scroll/", views.room_scroll, name="scroll"),
+    path("room/<uuid:room_id>/scroll/", views.scroll, name="scroll"),
     path("room/<uuid:room_id>/scroll-position/", views.save_scroll_position, name="save_scroll_position"),
+    # Post/Line CRUD (relocated from apps.dashboard.urls)
+    path("new-post", views.new_post, name="new_post"),
+    path("post/<uuid:post_id>/", views.view_post, name="view_post"),
+    path("post/<uuid:post_id>/share-post", views.share_post, name="share_post"),
+    path("post/<uuid:post_id>/delete", views.delete_post, name="delete_post"),
+    path("post/<uuid:post_id>/abandon", views.abandon_post, name="abandon_post"),
+    path("users/<uuid:user_id>/", views.my_posts, name="my_posts"),
+    path("my-buds/", views.my_buds, name="my_buds"),
+    path("buds/add", views.add_bud, name="add_bud"),
+    path("buds/search", views.search_buds, name="search_buds"),
+    path("buds/<uuid:bud_id>/", views.bud_page, name="bud_page"),
+    path("buds/<uuid:bud_id>/shoptalk", views.save_bud_shoptalk, name="save_bud_shoptalk"),
+    path("buds/<uuid:bud_id>/delete", views.delete_bud, name="delete_bud"),
+    path("my-sign/", views.my_sign, name="my_sign"),
+    path("my-sign/save", views.save_sign, name="save_sign"),
+    path("my-sign/clear", views.clear_sign, name="clear_sign"),
 ]

src/apps/billboard/views.py

@@ -1,24 +1,31 @@
 import json
 
+from django.contrib import messages
 from django.contrib.auth.decorators import login_required
 from django.utils.html import mark_safe
 from django.db.models import Max, Q
-from django.http import JsonResponse
+from django.http import HttpResponseForbidden, JsonResponse
 from django.shortcuts import redirect, render
 
 from apps.applets.utils import applet_context, apply_applet_toggle
-from apps.dashboard.forms import LineForm
+
-from apps.dashboard.models import Post
+from apps.billboard.forms import ExistingPostLineForm, LineForm
+from apps.billboard.models import Brief, BudshipNote, Line, Post
 from apps.dashboard.views import _PALETTE_DEFS
 from apps.drama.models import GameEvent, Note, ScrollPosition
 from apps.epic.models import Room
-from apps.epic.utils import rooms_for_user
+from apps.epic.utils import annotate_latest_event, rooms_for_user
+from apps.lyric.models import User, get_or_create_adman
 
 _PALETTE_LABELS = {p["name"]: p["label"] for p in _PALETTE_DEFS}
 
 
 def _recent_posts(user, limit=3):
-    return (
+    """Most-recently-active Posts the user owns or is shared on. Attaches
+    `latest_line` to each Post (Line or None) so the My Posts applet row
+    can render its 3-col `<title> | <latest line text> | <ts>` shape
+    without an extra template-side query."""
+    posts = list(
         Post
             .objects
             .filter(Q(owner=user) | Q(shared_with=user))
@@ -26,15 +33,41 @@ def _recent_posts(user, limit=3):
             .order_by('-last_line')
             .distinct()[:limit]
     )
+    for p in posts:
+        p.latest_line = p.lines.order_by("-id").first()
+    return posts
 
 
-@login_required(login_url="/")
+def _recent_buds(user, limit=3):
-def billboard(request):
+    """Most-recently-added buds, newest first. M2M has no explicit through
-    my_rooms = rooms_for_user(request.user).order_by("-created_at")
+    model, so we sort the auto-through table by its monotonic `id`. The
+    `select_related('to_user__active_title')` chain warms up the active
+    title FK for the My Buds applet row's middle column."""
+    through = User.buds.through  # type: ignore[attr-defined]
+    rows = (
+        through.objects
+            .filter(from_user=user)
+            .select_related("to_user__active_title")
+            .order_by("-id")[:limit]
+    )
+    return [r.to_user for r in rows]
+
+
+def _recent_notes(user, limit=3):
+    """Most-recently-earned Notes. Attaches `description` from _NOTE_META
+    so the My Notes applet row can render `<title> | <description> | <ts>`."""
+    notes = list(user.notes.order_by("-earned_at")[:limit])
+    for n in notes:
+        n.description = _NOTE_META.get(n.slug, {}).get("description", "")
+    return notes
+
+
+def _billboard_context(user):
+    my_rooms = annotate_latest_event(rooms_for_user(user).order_by("-created_at"))
 
     recent_room = (
         Room.objects.filter(
-            Q(owner=request.user) | Q(gate_slots__gamer=request.user)
+            Q(owner=user) | Q(gate_slots__gamer=user)
         )
         .annotate(last_event=Max("events__timestamp"))
         .filter(last_event__isnull=False)
@@ -42,25 +75,44 @@ def billboard(request):
         .distinct()
         .first()
     )
-    recent_events = (
+    # SIG_READY+retracted exclusion is done in Python because SQLite's NULL
-        list(
+    # semantics drop ALL SIG_READY events whose data has no `retracted` key:
+    # `data__retracted=True` resolves to NULL via JSON_EXTRACT for missing keys,
+    # and `WHERE NOT (NULL AND verb='sig_ready')` evaluates to NULL → row
+    # filtered out. We pull a buffer (100) to absorb any retracted prefix and
+    # then slice to 36 after Python filtering.
+    if recent_room:
+        candidates = list(
             recent_room.events
             .select_related("actor")
             .exclude(verb=GameEvent.SIG_UNREADY)
-            .exclude(verb=GameEvent.SIG_READY, data__retracted=True)
+            .order_by("-timestamp")[:100]
-            .order_by("-timestamp")[:36]
-        )[::-1]
-        if recent_room else []
         )
+        visible = [
+            e for e in candidates
+            if not (e.verb == GameEvent.SIG_READY and e.data.get("retracted"))
+        ]
+        recent_events = visible[:36][::-1]
+    else:
+        recent_events = []
 
-    return render(request, "apps/billboard/billboard.html", {
+    return {
         "my_rooms": my_rooms,
         "recent_room": recent_room,
         "recent_events": recent_events,
-        "viewer": request.user,
+        "viewer": user,
-        "applets": applet_context(request.user, "billboard"),
+        "applets": applet_context(user, "billboard"),
         "form": LineForm(),
-        "recent_posts": _recent_posts(request.user),
+        "recent_posts": _recent_posts(user),
+        "recent_buds":  _recent_buds(user),
+        "recent_notes": _recent_notes(user),
+    }
+
+
+@login_required(login_url="/")
+def billboard(request):
+    return render(request, "apps/billboard/billboard.html", {
+        **_billboard_context(request.user),
         "page_class": "page-billboard",
     })
 
@@ -70,20 +122,20 @@ def toggle_billboard_applets(request):
     checked = request.POST.getlist("applets")
     apply_applet_toggle(request.user, "billboard", checked)
     if request.headers.get("HX-Request"):
-        return render(request, "apps/billboard/_partials/_applets.html", {
+        return render(
-            "applets": applet_context(request.user, "billboard"),
+            request,
-            "form": LineForm(),
+            "apps/billboard/_partials/_applets.html",
-            "recent_posts": _recent_posts(request.user),
+            _billboard_context(request.user),
-        })
+        )
     return redirect("billboard:billboard")
 
 
 @login_required(login_url="/")
-def room_scroll(request, room_id):
+def scroll(request, room_id):
     room = Room.objects.get(id=room_id)
     events = room.events.select_related("actor").all()
     sp = ScrollPosition.objects.filter(user=request.user, room=room).first()
-    return render(request, "apps/billboard/room_scroll.html", {
+    return render(request, "apps/billboard/scroll.html", {
         "room": room,
         "events": events,
         "viewer": request.user,
@@ -127,6 +179,12 @@ _NOTE_META = {
         "palette_options": [],
         "swatch_label":    "0",
     },
+    "baltimorean": {
+        "title":           "Baltimorean",
+        "description":     '"Aaron earned an iron urn."',
+        "palette_options": _palette_opts(["palette-baltimore", "palette-maryland"]),
+        "swatch_label":    None,
+    },
 }
 
 
@@ -158,7 +216,7 @@ def my_notes(request):
         {
             "obj":               n,
             "title":             _NOTE_META.get(n.slug, {}).get("title", n.slug),
-            "recognition_title": n.display_title,
+            "recognition_title": n.card_title,
             "description":       _NOTE_META.get(n.slug, {}).get("description", ""),
             "palette_options":   _NOTE_META.get(n.slug, {}).get("palette_options", []),
             "swatch_label":      _NOTE_META.get(n.slug, {}).get("swatch_label"),
@@ -195,6 +253,501 @@ def doff_title(request, slug):
     return JsonResponse({"ok": True, "greeting": "Welcome,", "title": "Earthman"})
 
 
+# ── My Sign — global Significator picker (billboard surface) ────────────────
+# Standalone page where a user picks their global personal significator. The
+# selection persists on User.significator + User.significator_reversed and is
+# reused across My Sea draws (and eventually other contexts). "Sign" is the
+# billboard-context branding; "significator" stays at the storage layer +
+# room sig-select context to keep the DRY model. Sprint 4a of
+# [[project-my-sea-roadmap]] — picker UI is a simplified lift of the room's
+# `_sig_select_overlay.html` (no countdown / WS / polarity / multi-user).
+# Deck-source fallback (Brief-redirect to Game Kit when no equipped deck;
+# Earthman-Backup default) deferred to a follow-up sub-sprint.
+
+@login_required(login_url="/")
+def my_sign(request):
+    """Render the picker — same 18-card pile as room sig-select (16 middle
+    arcana courts + Major 0 & 1), pulled from the user's equipped deck.
+    Polarity is determined post-hoc by the FLIP btn (significator_reversed).
+
+    Backup-deck branch: if the user has no equipped_deck AND no saved sig,
+    `personal_sig_cards` falls back to the Earthman pile and the template
+    renders an intro Brief banner labeling the backup as "Earthman [Shabby
+    Paperboard]" with FYI (→ Game Kit) + NVM (dismiss + proceed) actions."""
+    from apps.epic.models import personal_sig_cards
+    cards = personal_sig_cards(request.user)
+    no_equipped_deck = request.user.equipped_deck is None
+    sig = request.user.significator
+    return render(request, "apps/billboard/my_sign.html", {
+        "cards": cards,
+        "no_equipped_deck": no_equipped_deck,
+        "show_backup_intro_banner": no_equipped_deck and sig is None,
+        "current_significator": sig,
+        "current_significator_reversed": request.user.significator_reversed,
+        "page_class": "page-billboard page-my-sign",
+    })
+
+
+@login_required(login_url="/")
+def save_sign(request):
+    """Persist the user's sign choice — POST { card_id, reversed }."""
+    from apps.epic.models import TarotCard
+    from apps.gameboard.models import MySeaDraw
+    if request.method != "POST":
+        return redirect("billboard:my_sign")
+    card_id = request.POST.get("card_id")
+    reversed_flag = request.POST.get("reversed") in ("1", "true", "True", "on")
+    try:
+        card = TarotCard.objects.get(pk=card_id)
+    except (TarotCard.DoesNotExist, ValueError, TypeError):
+        return HttpResponseForbidden("invalid card_id")
+    sig_changed = request.user.significator_id != card.pk
+    request.user.significator = card
+    request.user.significator_reversed = reversed_flag
+    request.user.save(update_fields=["significator", "significator_reversed"])
+    # Sig change RESETS (but does NOT delete) any active MySeaDraw so the
+    # next /my-sea/ visit reads the NEW sig snapshot — while PRESERVING the
+    # cooldown anchor (row's `created_at` gates `in_cooldown` per views.py
+    # line 266) + paid-state fields (`deposit_token_id`, `paid_through_at`).
+    # Deleting the row would re-open the FREE DRAW gate (loophole — user
+    # could circumvent the 24h cooldown by re-picking a sig) AND forfeit
+    # any paid-draw credit the user already committed. Reset clears just
+    # the hand + sig snapshot, leaving cooldown + paid revenue intact.
+    if sig_changed:
+        MySeaDraw.objects.filter(user=request.user).update(
+            hand=[],
+            significator_id=card.pk,
+            significator_reversed=reversed_flag,
+        )
+    return redirect("billboard:my_sign")
+
+
+@login_required(login_url="/")
+def clear_sign(request):
+    """Wipe the user's saved sig — POST `/billboard/my-sign/clear`.
+    Sprint 4b-adjacent. Unblocks manual verification of My Sea's no-sig
+    branch on dev users w. a sig already set; also gives end users a way
+    to undo a saved choice without re-picking. GET redirects back to the
+    picker (no mutation) per the existing save_sign convention."""
+    if request.method != "POST":
+        return redirect("billboard:my_sign")
+    request.user.significator = None
+    request.user.significator_reversed = False
+    request.user.save(update_fields=["significator", "significator_reversed"])
+    # MySeaDraw is INTENTIONALLY left alone on sig-clear. Without a sig the
+    # user can't draw anyway (`my_sea_lock` returns 400 `no_significator`),
+    # and /my-sea/ routes to its sign-gate Brief via `user_has_sig`. The
+    # row's cooldown anchor + paid-state fields must survive a sig clear
+    # so the user can't re-open the FREE DRAW gate or forfeit paid credit
+    # by toggling sig-clear → sig-pick (user-reported loophole 2026-05-26).
+    # When the user re-picks via save_sign, that view's reset path updates
+    # the row's sig snapshot + clears the hand cleanly.
+    return redirect("billboard:my_sign")
+
+
+# ── Post / Line CRUD (relocated from apps.dashboard) ────────────────────────
+# Templates also live under templates/apps/billboard/. URL names sit in the
+# `billboard:` namespace so reversers across the codebase carry the prefix.
+
+def _truncate_post_title(text, length=35):
+    """Glean a Post.title from the first user-submitted Line: copy first
+    `length` chars exactly, or truncate to `length-3` chars + "..." past
+    that. Mirrors billboard/migrations/0004 backfill helper."""
+    if len(text) <= length:
+        return text
+    return text[: length - 3] + "..."
+
+
+def new_post(request):
+    form = LineForm(data=request.POST)
+    if form.is_valid():
+        # Anonymous compose path (Percival ch. 18 chapters) keeps owner=null
+        # but still needs an author for the Line FK. We require auth on this
+        # view's caller paths in practice; no anonymous Lines reach prod.
+        author = request.user if request.user.is_authenticated else None
+        nupost = Post.objects.create(
+            title=_truncate_post_title(form.cleaned_data["text"]),
+        )
+        if request.user.is_authenticated:
+            nupost.owner = request.user
+            nupost.save()
+        if author is not None:
+            form.save(for_post=nupost, author=author)
+        return redirect(nupost)
+    else:
+        context = {
+            "form": form,
+            "page_class": "page-billboard",
+        }
+        if request.user.is_authenticated:
+            context["applets"] = applet_context(request.user, "billboard")
+            context["recent_posts"] = _recent_posts(request.user)
+            context["recent_buds"]  = _recent_buds(request.user)
+            context["recent_notes"] = _recent_notes(request.user)
+        return render(request, "apps/billboard/billboard.html", context)
+
+
+def view_post(request, post_id):
+    our_post = Post.objects.get(id=post_id)
+
+    if our_post.owner:
+        if not request.user.is_authenticated:
+            return redirect("/")
+        if request.user != our_post.owner and request.user not in our_post.shared_with.all():
+            return HttpResponseForbidden()
+
+    # System-author Post hard write-rejection (note unlock + tax ledger
+    # threads) — the per-Line signal in billboard.models nukes any Line
+    # that bypasses this guard, but at the view level we want a clean 403
+    # so the FT/IT contract is explicit and the client never sees a silent
+    # line vanish.
+    if our_post.kind in (Post.KIND_NOTE_UNLOCK, Post.KIND_TAX_LEDGER) and request.method == "POST":
+        return HttpResponseForbidden()
+
+    form = ExistingPostLineForm(for_post=our_post)
+
+    if request.method == "POST":
+        form = ExistingPostLineForm(for_post=our_post, data=request.POST)
+        if form.is_valid():
+            form.save(author=request.user)
+            return redirect(our_post)
+
+    # GET render is the FYI-read contract — flip every unread Brief on this
+    # post for the requesting user. POST (compose) is intentionally excluded
+    # because the user is authoring, not reviewing the new Line.
+    if request.user.is_authenticated:
+        Brief.objects.filter(
+            owner=request.user, post=our_post, is_unread=True,
+        ).update(is_unread=False)
+
+    # Header-prose branching: post.html shows different self/shared lines
+    # depending on whether the viewer IS the owner. The invitee branch
+    # ("shared with me, @viewer …" + "created by @owner …") only kicks
+    # in when (a) the viewer is authenticated AND (b) the post has an
+    # owner AND (c) the viewer is NOT that owner. Ownerless posts and
+    # anonymous viewers fall through to the owner-style rendering (which
+    # handles missing data gracefully via the at_handle/display_name
+    # filter guards).
+    is_real_invitee = (
+        request.user.is_authenticated
+        and our_post.owner is not None
+        and request.user != our_post.owner
+    )
+    viewer_is_owner = not is_real_invitee
+    if is_real_invitee:
+        other_recipients = our_post.shared_with.exclude(pk=request.user.pk)
+    else:
+        other_recipients = our_post.shared_with.all()
+
+    return render(request, "apps/billboard/post.html", {
+        "post": our_post,
+        "form": form,
+        "viewer_is_owner": viewer_is_owner,
+        "other_recipients": other_recipients,
+        "page_class": "page-billpost",
+    })
+
+
+def my_posts(request, user_id):
+    owner = User.objects.get(id=user_id)
+    if not request.user.is_authenticated:
+        return redirect("/")
+    if request.user.id != owner.id:
+        return HttpResponseForbidden()
+    return render(request, "apps/billboard/my_posts.html", {
+        "owner": owner,
+        "owner_posts_title":  "Posts by Me",
+        "others_posts_title": "Posts by Others",
+        "page_class": "page-billposts",
+    })
+
+
+@login_required
+def delete_post(request, post_id):
+    if request.method == "POST":
+        post = Post.objects.get(id=post_id)
+        if request.user == post.owner and post.kind not in (Post.KIND_NOTE_UNLOCK, Post.KIND_TAX_LEDGER):
+            post.delete()
+    return redirect("billboard:my_posts", user_id=request.user.id)
+
+
+@login_required
+def abandon_post(request, post_id):
+    if request.method == "POST":
+        post = Post.objects.get(id=post_id)
+        if post.kind not in (Post.KIND_NOTE_UNLOCK, Post.KIND_TAX_LEDGER):
+            post.shared_with.remove(request.user)
+    return redirect("billboard:my_posts", user_id=request.user.id)
+
+
+def share_post(request, post_id):
+    our_post = Post.objects.get(id=post_id)
+    is_ajax = "application/json" in request.headers.get("Accept", "")
+
+    # Recipient may be email OR username — _resolve_recipient handles both
+    # (email if "@" present, else username lookup). The raw value is kept
+    # for the Line text since users see what they typed in the per-line
+    # rendering (post-refresh + optimistic JS append).
+    recipient_email = (request.POST.get("recipient") or "").strip()
+    recipient = _resolve_recipient(recipient_email)
+
+    # Sharer-tries-to-share-with-themselves: silent no-op (existing behavior).
+    if recipient is not None and recipient == request.user:
+        if is_ajax:
+            return JsonResponse({"brief": None, "line_text": ""})
+        return redirect(our_post)
+
+    # Re-share dedup: if the recipient is already in shared_with (registered
+    # email previously shared), skip the Line + Brief — silent no-op.
+    # `add()` itself is idempotent on M2M, but we want the JSON response to
+    # signal "nothing happened" so the JS can suppress the banner.
+    is_reshare = recipient is not None and recipient in our_post.shared_with.all()
+
+    if recipient is not None and not is_reshare:
+        our_post.shared_with.add(recipient)
+        # Implicit auto-add to the buds graph — symmetric on shared events
+        # (per-spec): a share-event implies a mutual social link.
+        # `add()` is idempotent on M2M, no need to pre-check membership.
+        if request.user.is_authenticated:
+            request.user.buds.add(recipient)
+            recipient.buds.add(request.user)
+
+    line = None
+    brief = None
+    line_text = ""
+    if not is_reshare:
+        # Plain "Shared with X" — timestamp display lives on the per-Line
+        # `<time>` element, not in the prose. Author = sharer (post owner)
+        # so the per-line "username" column attributes correctly. Anonymous
+        # shares (legacy Percival ch. 19 ownerless-post path) fall back to
+        # adman since AnonymousUser can't be FK'd. Privacy: we still create
+        # the Line + Brief even when the address is unregistered, so the
+        # response doesn't leak membership.
+        line_text = f"Shared with {recipient_email}"
+        author = request.user if request.user.is_authenticated else get_or_create_adman()
+        line = Line.objects.create(
+            post=our_post, text=line_text, author=author,
+        )
+        if request.user.is_authenticated:
+            brief = Brief.objects.create(
+                owner=request.user,
+                post=our_post,
+                line=line,
+                kind=Brief.KIND_SHARE_INVITE,
+                title="Invite sent",
+            )
+
+    if is_ajax:
+        # recipient_display is populated only when the address resolves to a
+        # registered User — same evidence the server-rendered .post-recipient
+        # list exposes; doesn't widen the privacy surface beyond what the
+        # post detail page already shows publicly.
+        recipient_display = None
+        recipient_user_id = None
+        if recipient is not None:
+            recipient_display = recipient.username or recipient.email
+            recipient_user_id = str(recipient.id)
+        return JsonResponse({
+            "brief":             brief.to_banner_dict() if brief is not None else None,
+            "line_text":         line_text,
+            "recipient_display": recipient_display,
+            "recipient_user_id": recipient_user_id,
+            "already_present":   is_reshare,
+        })
+
+    messages.success(request, "An invite has been sent if that address is registered.")
+    return redirect(our_post)
+
+
+# ── My Buds ───────────────────────────────────────────────────────────────
+# User.buds is an asymmetric self M2M (lyric/0004 + 0005 rename). `my_buds`
+# is the manage-page; `add_bud` is the JSON endpoint hit by the bud-panel
+# slide-out. Privacy: when an entered email isn't a registered User, we
+# 200 with {bud: null} so the response shape doesn't leak membership.
+
+@login_required(login_url="/")
+def my_buds(request):
+    """My Buds page — enriched per-row w. shoptalk + milestone for the
+    tooltip portal (bud landing page sprint 2026-05-27). Attaches
+    `.shoptalk_text` + `.milestone_dt` to each bud User so the row
+    template can render data-tt-* attrs without an extra template tag."""
+    notes_by_bud = {
+        bn.bud_id: bn
+        for bn in BudshipNote.objects.filter(user=request.user)
+    }
+    buds = list(request.user.buds.all().select_related("active_title"))
+    for bud in buds:
+        bn = notes_by_bud.get(bud.id)
+        bud.shoptalk_text = bn.shoptalk if bn else ""
+        bud.milestone_dt = bn.edited_at if bn else None
+    return render(request, "apps/billboard/my_buds.html", {
+        "buds": buds,
+        "page_class": "page-billbuds",
+    })
+
+
+# ── Per-bud landing page ───────────────────────────────────────────────────
+# /billboard/buds/<bud_id>/ + shoptalk save + bud delete — see
+# [[project-bud-landing-page-sprint]]. Replaces the @mailman invite Line's
+# inline OK/BYE block w. a dedicated surface; bud.html is also the click
+# target of the My Buds row's `@<handle>` anchor.
+
+@login_required(login_url="/")
+def bud_page(request, bud_id):
+    """Render the per-bud landing page. Auto-adds the bud on first visit
+    (mirrors share_post's implicit-add posture) so following the @mailman
+    post-attribution anchor from an invite Brief grows the buds graph
+    without an explicit add step. Self-visits are no-op for the auto-add
+    branch — users don't accumulate themselves as a bud.
+
+    Cascade context (`sea_btn_active` + `sea_first_draw_pending`) reuses
+    the same template variables `_burger.html` already reads on my_sea +
+    room — server-side conditional renders `glow-handoff` on the burger
+    + `.active` on the sea sub-btn. The flags fire iff a *live* SeaInvite
+    exists from this bud to the viewer — non-terminal (PENDING or ACCEPTED)
+    AND inside its 24h-from-proffer window OR within 24h of the viewer's
+    last gate token deposit (user-spec 2026-05-29, `invitee_access_open`).
+    Accepting the invite no longer darkens the btn; the cascade now stays
+    lit across the whole window so the user can reach the bud's sea
+    (`my_sea_visit` accepts a still-pending invite on GET)."""
+    from django.shortcuts import get_object_or_404
+    from apps.gameboard.models import SeaInvite
+    bud = get_object_or_404(User, id=bud_id)
+    if bud != request.user and not request.user.buds.filter(id=bud.id).exists():
+        request.user.buds.add(bud)
+    bn = BudshipNote.objects.filter(user=request.user, bud=bud).first()
+    live = (
+        SeaInvite.objects
+        .filter(
+            owner=bud, invitee=request.user,
+            status__in=[SeaInvite.PENDING, SeaInvite.ACCEPTED],
+        )
+        .order_by("-created_at")
+        .first()
+    )
+    if live is not None and not live.invitee_access_open:
+        live = None
+    return render(request, "apps/billboard/bud.html", {
+        "bud":                    bud,
+        "shoptalk_text":          bn.shoptalk if bn else "",
+        "milestone_dt":           bn.edited_at if bn else None,
+        "pending_invite":         live,
+        "sea_btn_active":         live is not None,
+        "sea_first_draw_pending": live is not None,
+        "page_class": "page-billbud",
+    })
+
+
+@login_required(login_url="/")
+def save_bud_shoptalk(request, bud_id):
+    """POST-only — upsert a BudshipNote w. up to 160 chars of shoptalk."""
+    from django.http import HttpResponseNotAllowed
+    from django.shortcuts import get_object_or_404
+    if request.method != "POST":
+        return HttpResponseNotAllowed(["POST"])
+    bud = get_object_or_404(User, id=bud_id)
+    text = (request.POST.get("shoptalk") or "")[:160]
+    BudshipNote.objects.update_or_create(
+        user=request.user, bud=bud,
+        defaults={"shoptalk": text},
+    )
+    return JsonResponse({"ok": True, "shoptalk": text})
+
+
+@login_required(login_url="/")
+def delete_bud(request, bud_id):
+    """POST-only — remove the bud from the user's M2M; redirect to my_buds.
+    GET is a silent no-op redirect (no membership change)."""
+    from django.shortcuts import get_object_or_404
+    if request.method == "POST":
+        bud = get_object_or_404(User, id=bud_id)
+        request.user.buds.remove(bud)
+    return redirect("billboard:my_buds")
+
+
+def _resolve_recipient(raw):
+    """Resolve a free-form recipient (email OR username) to a User, or None.
+    Email match takes precedence — if the input contains '@' we don't even
+    try the username lookup, so a username that happens to match an email
+    user's local part doesn't get coerced. Used by add_bud + share_post."""
+    raw = (raw or "").strip()
+    if not raw:
+        return None
+    if "@" in raw:
+        try:
+            return User.objects.get(email__iexact=raw)
+        except User.DoesNotExist:
+            return None
+    try:
+        return User.objects.get(username__iexact=raw)
+    except User.DoesNotExist:
+        return None
+
+
+@login_required(login_url="/")
+def add_bud(request):
+    if request.method != "POST":
+        from django.http import HttpResponseNotAllowed
+        return HttpResponseNotAllowed(["POST"])
+
+    candidate = _resolve_recipient(request.POST.get("recipient"))
+
+    bud = None
+    already_present = False
+    recipient_display = None
+    recipient_user_id = None
+    if candidate is not None and candidate != request.user:
+        already_present = candidate in request.user.buds.all()
+        if not already_present:
+            request.user.buds.add(candidate)
+        from apps.lyric.templatetags.lyric_extras import at_handle
+        display = candidate.username or candidate.email
+        bud = {
+            "id":        str(candidate.id),
+            "username":  display,
+            "email":     candidate.email,
+            # at_handle + title feed the async row's data-tt-* attrs so its
+            # tooltip matches the server-rendered rows (regression 2026-05-29).
+            "at_handle": at_handle(candidate),
+            "title":     candidate.active_title_display,
+        }
+        recipient_display = display
+        recipient_user_id = str(candidate.id)
+
+    return JsonResponse({
+        "bud":               bud,
+        "already_present":   already_present,
+        "recipient_display": recipient_display,
+        "recipient_user_id": recipient_user_id,
+    })
+
+
+@login_required(login_url="/")
+def search_buds(request):
+    """Top-3 prefix-match autocomplete pool for #id_recipient inputs.
+    Pulls only from request.user.buds — buds that haven't been added yet
+    don't appear in the autocomplete (privacy-by-default; new buds enter
+    the list via explicit add or implicit auto-add on share/invite).
+    Matches case-insensitive on either username or email prefix."""
+    from django.db.models import Q
+    q = (request.GET.get("q") or "").strip()
+    if not q:
+        return JsonResponse({"buds": []})
+    matches = (
+        request.user.buds
+        .filter(Q(username__istartswith=q) | Q(email__istartswith=q))
+        .order_by("username", "email")[:3]
+    )
+    return JsonResponse({"buds": [
+        {
+            "id":       str(b.id),
+            "username": b.username or b.email,
+            "email":    b.email,
+        }
+        for b in matches
+    ]})
+
+
 @login_required(login_url="/")
 def save_scroll_position(request, room_id):
     if request.method != "POST":

src/apps/dashboard/migrations/0003_remove_post_owner_remove_post_shared_with_and_more.py

@@ -0,0 +1,27 @@
+# Generated by Django 6.0 on 2026-05-08 21:11
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('dashboard', '0002_initial'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='post',
+            name='owner',
+        ),
+        migrations.RemoveField(
+            model_name='post',
+            name='shared_with',
+        ),
+        migrations.DeleteModel(
+            name='Line',
+        ),
+        migrations.DeleteModel(
+            name='Post',
+        ),
+    ]

src/apps/dashboard/models.py

@@ -1,39 +1,3 @@
-import uuid
+# Post + Line have moved to apps.billboard. The legacy tables are dropped via
-
+# the migration in dashboard/migrations/0003_*; data is preserved via the
-from django.db import models
+# RunPython step in billboard/migrations/0002_*.
-from django.urls import reverse
-
-
-class Post(models.Model):
-    id = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
-    owner = models.ForeignKey(
-        "lyric.User",
-        related_name="posts",
-        blank=True,
-        null=True,
-        on_delete=models.CASCADE,
-    )
-
-    shared_with = models.ManyToManyField(
-        "lyric.User",
-        related_name="shared_posts",
-        blank=True,
-    )
-
-    @property
-    def name(self):
-        return self.lines.first().text
-
-    def get_absolute_url(self):
-        return reverse("view_post", args=[self.id])
-
-class Line(models.Model):
-    text = models.TextField(default="")
-    post = models.ForeignKey(Post, default=None, on_delete=models.CASCADE, related_name="lines")
-
-    class Meta:
-        ordering = ("id",)
-        unique_together = ("post", "text")
-
-    def __str__(self):
-        return self.text

src/apps/dashboard/static/apps/dashboard/game-kit.js

@@ -64,13 +64,42 @@
             if (!tooltip) return;
             var rect = el.getBoundingClientRect();
             tooltip.style.position = 'fixed';
-            tooltip.style.bottom = (window.innerHeight - rect.top + 8) + 'px';
+            // Show first so offsetWidth/offsetHeight measure real layout,
-            tooltip.style.left = rect.left + 'px';
+            // then clamp both axes so the tooltip never bleeds past the
+            // viewport. Same shape as sky-wheel.js + wallet.js: 1rem inset
+            // margin on every edge.
             tooltip.style.display = 'block';
+            var rem = parseFloat(getComputedStyle(document.documentElement).fontSize) || 16;
+            var ttW = tooltip.offsetWidth;
+            var ttH = tooltip.offsetHeight;
+
+            // Horizontal clamp — left edge stays within [rem, viewport-ttW-rem].
+            var minLeft = rem;
+            var maxLeft = window.innerWidth - ttW - rem;
+            var clampedLeft = Math.max(minLeft, Math.min(rect.left, maxLeft));
+            tooltip.style.left = clampedLeft + 'px';
+
+            // Vertical: prefer ABOVE the element; flip BELOW when the
+            // tooltip is too tall to fit above (e.g. in landscape where
+            // the kit bag dialog runs along the top of the right sidebar
+            // + tokens row anchors near the top of the viewport).
+            var spaceAbove = rect.top - rem;
+            if (ttH <= spaceAbove) {
+                tooltip.style.bottom = (window.innerHeight - rect.top + 8) + 'px';
+                tooltip.style.top = '';
+            } else {
+                tooltip.style.top = (rect.bottom + 8) + 'px';
+                tooltip.style.bottom = '';
+            }
         });
         el.addEventListener('mouseleave', function () {
             var tooltip = el.querySelector('.tt');
-            if (tooltip) tooltip.style.display = '';
+            if (tooltip) {
+                tooltip.style.display = '';
+                // Reset positional props so the next show measures fresh.
+                tooltip.style.top = '';
+                tooltip.style.bottom = '';
+            }
         });
     }
 

src/apps/dashboard/static/apps/dashboard/note.js

@@ -1,49 +1,180 @@
-const Note = (() => {
+// Slide-down Brief banner — appears under the navbar h2 with a Gaussian-glass
+// background. Banner data comes from the Brief.to_banner_dict shape on the
+// server: {id, kind, title, line_text, post_url, square_url, created_at}.
+//
+// FYI button → brief.post_url (the post detail; that GET marks the Brief read).
+// .note-banner__image (the "square") → brief.square_url (kind-specific
+// shortcut; note-unlock briefs jump direct to /billboard/my-notes/).
+// NVM dismisses without marking read.
+//
+// `Note` is preserved as an alias for backwards-compat with any leftover
+// caller while the C3 sprint lands; new code should use `Brief.*`.
+
+const Brief = (() => {
     'use strict';
 
-    function showBanner(note) {
+    function showBanner(brief) {
-        if (!note) return;
+        if (!brief) return;
 
-        const earned = new Date(note.earned_at);
+        const created = new Date(brief.created_at);
-        const dateStr = earned.toLocaleDateString(undefined, {
+        const dateStr = created.toLocaleDateString(undefined, {
             year: 'numeric', month: 'short', day: 'numeric',
         });
 
         const banner = document.createElement('div');
         banner.className = 'note-banner';
+
+        // The square mirrors my_notes.html's .note-item__image-box (dashed
+        // border + "?" placeholder) when the brief carries a square_url —
+        // currently note_unlock kind, which jumps direct to /billboard/my-notes/.
+        const squareEl = brief.square_url
+            ? '<a href="' + _esc(brief.square_url) + '" class="note-banner__image note-item__image-box">?</a>'
+            : '<div class="note-banner__image"></div>';
+
+        // line_text is server-rendered prose from drama.Note.grant_if_new
+        // (and server-side share_post) — it may carry a `<a class="note-ref">`
+        // anchor wrapping the Note name. Insert as HTML, NOT escaped text.
+        // Title is plain (no HTML), so it stays escaped.
         banner.innerHTML =
             '<div class="note-banner__body">' +
-                '<p class="note-banner__title">'       + _esc(note.title)       + '</p>' +
+                '<p class="note-banner__title">'       + _esc(brief.title)     + '</p>' +
-                '<p class="note-banner__description">' + _esc(note.description) + '</p>' +
+                '<p class="note-banner__description">' + (brief.line_text || '') + '</p>' +
-                '<time class="note-banner__timestamp" datetime="' + _esc(note.earned_at) + '">' +
+                '<time class="note-banner__timestamp" datetime="' + _esc(brief.created_at) + '">' +
                     dateStr +
                 '</time>' +
             '</div>' +
-            '<div class="note-banner__image"></div>' +
+            squareEl +
             '<button type="button" class="btn btn-cancel note-banner__nvm">NVM</button>' +
-            '<a href="/billboard/my-notes/" class="btn btn-info note-banner__fyi">FYI</a>';
+            '<a href="' + _esc(brief.post_url) + '" class="btn btn-info note-banner__fyi">FYI</a>';
+
+        banner.querySelector('.note-banner__nvm').addEventListener('click', function () {
+            // Persistent-NVM kinds (TAX_LEDGER FREE/PAID DRAW per user-spec
+            // 2026-05-26) carry a `dismiss_url` — POST it so the dismissal
+            // anchor is stamped server-side + the Brief stays suppressed on
+            // future page loads until the cycle resets. Fire-and-forget; the
+            // banner removal is unconditional so the user gets immediate
+            // feedback regardless of network state.
+            if (brief.dismiss_url) {
+                var csrfMatch = document.cookie.match(/(?:^|; )csrftoken=([^;]+)/);
+                fetch(brief.dismiss_url, {
+                    method: 'POST',
+                    credentials: 'same-origin',
+                    headers: {
+                        'X-CSRFToken': csrfMatch ? decodeURIComponent(csrfMatch[1]) : '',
+                    },
+                });
+            }
+            banner.remove();
+        });
+
+        // Prefer the explicit anchor (set in base.html under the messages
+        // block, before {% block content %}) — keeps the banner in the
+        // visible content flow on pages where the first <h2> is
+        // position:absolute (e.g. post.html's rotated navbar header).
+        // Falls back to <h2> for pages that pre-date the anchor.
+        var anchor = document.getElementById('id_brief_banner_anchor')
+                  || document.querySelector('h2');
+        if (anchor && anchor.parentNode) {
+            anchor.parentNode.insertBefore(banner, anchor.nextSibling);
+        } else {
+            document.body.insertBefore(banner, document.body.firstChild);
+        }
+        _alignToH2(banner);
+    }
+
+    // Slot the (position:fixed) banner over the page's h2 letter-spread
+    // header so it visually portals across the wordmark rather than parking
+    // at the top of the viewport.
+    //
+    // Portrait only: h2 is a horizontal wordmark in `.container .row`; its
+    // top edge is navbar-height + row-padding which differs per viewport,
+    // so we measure at render-time + set inline `top`.
+    //
+    // Landscape: h2 is rotated into the fixed --h2-col-w sidebar slot via
+    // `writing-mode: vertical-rl`. A horizontally-flowing banner can't
+    // "overlay" a vertical h2 without a full reorientation of its own
+    // contents (writing-mode + flex-direction restyle). Defer that to a
+    // landscape-vertical-banner sprint; for now landscape keeps the SCSS
+    // default `top: 0.5rem` (banner reads as a horizontal strip near the
+    // top of the page content area).
+    function _alignToH2(banner) {
+        if (window.innerWidth > window.innerHeight) return;  // landscape: skip
+        var h2 = document.querySelector('.row .col-lg-6 h2');
+        if (!h2) return;
+        var rect = h2.getBoundingClientRect();
+        if (rect.height <= 0) return;
+        banner.style.top = rect.top + 'px';
+    }
+
+    function handleSaveResponse(data) {
+        showBanner(data && data.brief);
+    }
+
+    // Error-variant banner for "@<username> is already present". Distinct
+    // from showBanner because it's purely client-side (no Brief DB row);
+    // title carries the recipient handle; there's no date/square/post_url;
+    // FYI is a <button> (no navigation) that toggles `.bud-duplicate-flash`
+    // onto a caller-supplied target element + dismisses. NVM just dismisses.
+    function showDuplicateBanner(opts) {
+        if (!opts || !opts.display_name) return;
+
+        var banner = document.createElement('div');
+        banner.className = 'note-banner note-banner--duplicate';
+        banner.innerHTML =
+            '<div class="note-banner__body">' +
+                '<p class="note-banner__title">@' + _esc(opts.display_name) + ' is already present</p>' +
+            '</div>' +
+            '<button type="button" class="btn btn-cancel note-banner__nvm">NVM</button>' +
+            '<button type="button" class="btn btn-info note-banner__fyi">FYI</button>';
 
         banner.querySelector('.note-banner__nvm').addEventListener('click', function () {
             banner.remove();
         });
+        banner.querySelector('.note-banner__fyi').addEventListener('click', function () {
+            if (opts.target_selector) {
+                var target = document.querySelector(opts.target_selector);
+                if (target) {
+                    target.classList.add('bud-duplicate-flash');
+                    // Auto-ease-out — the SCSS rule has a 600ms transition
+                    // on color + text-shadow, so removing the class 3s after
+                    // FYI lets the peak state breathe before fading back to
+                    // the default text styling. Without this the flash
+                    // persisted til page refresh.
+                    setTimeout(function () {
+                        target.classList.remove('bud-duplicate-flash');
+                    }, 3000);
+                }
+            }
+            banner.remove();
+        });
 
-        var h2 = document.querySelector('h2');
+        var anchor = document.getElementById('id_brief_banner_anchor')
-        if (h2 && h2.parentNode) {
+                  || document.querySelector('h2');
-            h2.parentNode.insertBefore(banner, h2.nextSibling);
+        if (anchor && anchor.parentNode) {
+            anchor.parentNode.insertBefore(banner, anchor.nextSibling);
         } else {
             document.body.insertBefore(banner, document.body.firstChild);
         }
     }
 
-    function handleSaveResponse(data) {
-        showBanner(data && data.note);
-    }
-
     function _esc(str) {
         var d = document.createElement('div');
         d.textContent = str || '';
         return d.innerHTML;
     }
 
-    return { showBanner: showBanner, handleSaveResponse: handleSaveResponse };
+    return {
+        showBanner:          showBanner,
+        showDuplicateBanner: showDuplicateBanner,
+        handleSaveResponse:  handleSaveResponse,
+    };
 })();
+
+// Backwards-compat shim — to be removed once the codebase uniformly uses Brief.
+const Note = Brief;
+
+// `const Brief = (...)` at script-tag scope is reachable as a bare name but
+// is NOT auto-attached to window — explicit assignment so callers that gate
+// on `if (window.Brief)` (e.g. _bud_panel.html's OK handler) succeed.
+window.Brief = Brief;
+window.Note  = Note;

src/apps/dashboard/static/apps/dashboard/wallet-shop.js

@@ -0,0 +1,195 @@
+// wallet-shop.js — BUY-ITEM click handler for the wallet's Shop applet.
+//
+// Flow:
+//   1. User clicks a `.tt-buy-btn` inside a `.shop-tile`.
+//   2. We open the global guard portal (`window.showGuard`) w. a prompt
+//      naming the item + price.
+//   3. On OK confirm → POST /dashboard/wallet/shop/buy {shop_item_slug} →
+//      get {client_secret, purchase_id}.
+//   4. Stripe.js confirmCardPayment (handles 3DS natively).
+//   5. On Stripe success → POST /dashboard/wallet/shop/confirm {purchase_id}.
+//   6. Reload the wallet (tokens + balances update server-side via the
+//      Purchase.fulfill() chain that fires from BOTH /shop/confirm AND
+//      the /stripe/webhook handler — whichever lands first, idempotent).
+//
+// Disabled tiles (`.btn-disabled` on the BUY btn — eg already-owned BAND)
+// are a no-op: clicks don't open the guard portal.
+//
+// Module pattern matches the rest of the project (`Brief`, `SeaDeal`,
+// `StageCard`) — exposes a singleton `WalletShop` w. a tested public
+// `initWalletShop()` method.
+
+const WalletShop = (function () {
+    'use strict';
+
+    function _getCsrf() {
+        const m = document.cookie.match(/csrftoken=([^;]+)/);
+        return m ? m[1] : '';
+    }
+
+    async function _doBuy(slug, btn, shopRoot) {
+        const pmId = shopRoot.dataset.defaultPaymentMethodId || '';
+        const pubKey = shopRoot.dataset.stripePublishableKey || '';
+        if (!pmId) {
+            // No saved payment method — surface a friendly message + bail.
+            // (Server-side this would 402, but we'd rather not waste the
+            // round trip OR confuse the user w. a stripe-side error.)
+            alert('Add a payment method below first.');
+            return;
+        }
+        const buyRes = await fetch('/dashboard/wallet/shop/buy', {
+            method: 'POST',
+            headers: {
+                'X-CSRFToken': _getCsrf(),
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: 'shop_item_slug=' + encodeURIComponent(slug),
+        });
+        if (!buyRes.ok) {
+            alert('Could not start purchase (' + buyRes.status + ').');
+            return;
+        }
+        const { client_secret, purchase_id } = await buyRes.json();
+        const stripe = window.Stripe(pubKey);
+        const { error, paymentIntent } = await stripe.confirmCardPayment(
+            client_secret, { payment_method: pmId },
+        );
+        if (error) {
+            alert('Payment failed: ' + (error.message || 'unknown error'));
+            return;
+        }
+        if (paymentIntent && paymentIntent.status === 'succeeded') {
+            // Sync-confirm endpoint: belt-and-suspenders w. the webhook —
+            // whichever lands first wins via Purchase.fulfill()'s idempotent
+            // status guard. We always call it for the snappy UX.
+            await fetch('/dashboard/wallet/shop/confirm', {
+                method: 'POST',
+                headers: {
+                    'X-CSRFToken': _getCsrf(),
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                },
+                body: 'purchase_id=' + encodeURIComponent(purchase_id),
+            });
+            // Reload to refresh the Tokens + Balances applets w. the
+            // freshly-minted tokens + writs.
+            window.location.reload();
+        }
+    }
+
+    async function _doClaimFree(slug) {
+        // Free decks (RWS / Fiorentine) — $0, no Stripe, no guard portal.
+        // One click POSTs the claim; the server adds the DeckVariant to
+        // `unlocked_decks` (→ Game Kit on /gameboard/).
+        const res = await fetch('/dashboard/wallet/shop/claim', {
+            method: 'POST',
+            headers: {
+                'X-CSRFToken': _getCsrf(),
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: 'deck_slug=' + encodeURIComponent(slug),
+        });
+        if (!res.ok) {
+            alert('Could not claim deck (' + res.status + ').');
+            return;
+        }
+        // Reload so the tile re-renders w. the 'Already owned' pill — server
+        // is the source of truth (same posture as the BUY flow's reload).
+        window.location.reload();
+    }
+
+    function _onFreeClick(e) {
+        const btn = e.target.closest('.tt-free-btn');
+        if (!btn) return;
+        if (btn.classList.contains('btn-disabled')) return;
+        e.preventDefault();
+        e.stopPropagation();
+        const slug = btn.dataset.deckSlug;
+        if (!slug) return;
+        _doClaimFree(slug);
+    }
+
+    function _onBuyClick(e) {
+        const btn = e.target.closest('.tt-buy-btn');
+        if (!btn) return;
+        if (btn.classList.contains('btn-disabled')) return;
+        e.preventDefault();
+        e.stopPropagation();
+        // The btn may be the original (inside .shop-tile) OR the portal
+        // clone (sibling of .wallet-page) — `closest('.shop-tile')` only
+        // works on the former. Read every datum from the btn itself + look
+        // up the shop root via document.querySelector (singleton).
+        const shopRoot = document.querySelector('.wallet-shop');
+        if (!shopRoot) return;
+        const slug = btn.dataset.shopItemSlug;
+        const name = btn.dataset.itemName || slug;
+        const priceCents = parseInt(btn.dataset.priceCents || '0', 10);
+        // Render "$1" / "$4" / "$20.50" — trim ".00" for whole-dollar prices.
+        const dollars = priceCents / 100;
+        const priceStr = (dollars === Math.floor(dollars))
+            ? '$' + dollars
+            : '$' + dollars.toFixed(2);
+        const message = 'Buy ' + name + ' for ' + priceStr + '?';
+        if (typeof window.showGuard === 'function') {
+            // Pin the wallet tooltip so the item card + microbtn stay
+            // visible while the guard portal is open — otherwise the
+            // cursor moving from the BUY btn down to the guard's OK/NVM
+            // triggers the tooltip's mouseleave, leaving the guard's
+            // "Buy {name} for ${price}?" prompt floating w. no referent.
+            // Both callbacks (confirm + dismiss) unpin so the next
+            // mouseleave (or the unpin-triggered _scheduleHide) dismisses
+            // the tooltip after the user resolves the prompt.
+            if (window.WalletTooltips && typeof window.WalletTooltips.pin === 'function') {
+                window.WalletTooltips.pin();
+            }
+            window.showGuard(
+                btn, message,
+                function () {  // onConfirm
+                    if (window.WalletTooltips && window.WalletTooltips.unpin) {
+                        window.WalletTooltips.unpin();
+                    }
+                    _doBuy(slug, btn, shopRoot);
+                },
+                function () {  // onDismiss
+                    if (window.WalletTooltips && window.WalletTooltips.unpin) {
+                        window.WalletTooltips.unpin();
+                    }
+                },
+            );
+        }
+    }
+
+    function initWalletShop() {
+        const shopRoot = document.querySelector('.wallet-shop');
+        if (!shopRoot) return;
+        // Wired-state is DOM-keyed (`data-shop-wired`) rather than a
+        // module-scope flag so per-test fixture rebuilds re-wire cleanly.
+        // Calling twice on the SAME root is still a safe no-op (idempotent).
+        if (shopRoot.dataset.shopWired === '1') return;
+        // Triple delegation — the BUY btn click can come from:
+        //   (a) original tile (inside `.shop-tile`) — shopRoot listener
+        //   (b) cloned main portal — kept for legacy / non-mini-portal pages
+        //   (c) cloned mini portal (`#id_mini_tooltip_portal`) — production
+        //       path post-microtooltip refactor; the BUY btn lives in
+        //       `.tt-micro` which clones into the mini portal on hover.
+        // Free-deck claim (`.tt-free-btn`) rides the SAME delegated roots as
+        // the BUY flow — the FREE ITEM btn lives in `.tt-micro` (clones into
+        // the mini portal on hover, same as BUY ITEM).
+        shopRoot.addEventListener('click', _onBuyClick);
+        shopRoot.addEventListener('click', _onFreeClick);
+        const portal = document.getElementById('id_tooltip_portal');
+        if (portal) {
+            portal.addEventListener('click', _onBuyClick);
+            portal.addEventListener('click', _onFreeClick);
+        }
+        const miniPortal = document.getElementById('id_mini_tooltip_portal');
+        if (miniPortal) {
+            miniPortal.addEventListener('click', _onBuyClick);
+            miniPortal.addEventListener('click', _onFreeClick);
+        }
+        shopRoot.dataset.shopWired = '1';
+    }
+
+    return { initWalletShop: initWalletShop };
+})();
+
+document.addEventListener('DOMContentLoaded', WalletShop.initWalletShop);

src/apps/dashboard/static/apps/dashboard/wallet.js

@@ -64,17 +64,60 @@ const initWallet = () => {
     });
 };
 
+// `WalletTooltips` module — exposes pin/unpin so other JS (eg. wallet-shop.js'
+// BUY-flow guard portal) can hold the wallet tooltip open across user
+// interactions that would otherwise dismiss it. The internals (hide
+// timer, _show/_hide helpers) live inside the singleton's IIFE — only
+// pin/unpin/initWalletTooltips are public.
+const WalletTooltips = (function () {
+    'use strict';
+
+    let _hideTimer = null;
+    let _pinned = false;
+    const HIDE_DELAY_MS = 200;
+    let _portal = null;
+    let _miniPortal = null;
+
+    function _hideAll() {
+        if (_portal) _portal.classList.remove('active');
+        if (_miniPortal) _miniPortal.classList.remove('active');
+    }
+
+    function _cancelHide() {
+        if (_hideTimer) { clearTimeout(_hideTimer); _hideTimer = null; }
+    }
+
+    function _scheduleHide() {
+        // Pinned (eg. guard portal open) — suppress the hide. unpin() will
+        // call _scheduleHide() again to dismiss after the guard closes.
+        if (_pinned) return;
+        _cancelHide();
+        _hideTimer = setTimeout(() => { _hideAll(); _hideTimer = null; }, HIDE_DELAY_MS);
+    }
+
+    function pin()  { _pinned = true;  _cancelHide(); }
+    function unpin(){ _pinned = false; _scheduleHide(); }
+
 function initWalletTooltips() {
     const portal = document.getElementById('id_tooltip_portal');
     if (!portal) return;
+    _portal = portal;
+    // Mini portal — used by shop tiles (BUY ITEM / "Already owned" pill).
+    // Tokens applet tiles have no `.tt-micro` sibling so the mini stays
+    // hidden on those hovers. Mirrors gameboard.html's mini portal.
+    const miniPortal = document.getElementById('id_mini_tooltip_portal');
+    _miniPortal = miniPortal;
 
-    document.querySelectorAll('.wallet-tokens .token').forEach(token => {
+    // Hover-persistence — keep the portal(s) open while the cursor moves
-        const tooltip = token.querySelector('.tt');
+    // from tile → portal → mini-portal so users can click the BUY-ITEM
-        if (!tooltip) return;
+    // microbutton. A short hide delay covers the gap between
+    // mouseleave-on-tile and mouseenter-on-portal; entering any of the
+    // 3 zones cancels the hide.
 
-        token.addEventListener('mouseenter', () => {
+    function _show(anchor, tooltipHtml, microHtml) {
-            const rect = token.getBoundingClientRect();
+        _cancelHide();
-            portal.innerHTML = tooltip.innerHTML;
+        const rect = anchor.getBoundingClientRect();
+        portal.innerHTML = tooltipHtml;
         portal.classList.add('active');
         const halfW = portal.offsetWidth / 2;
         const rawLeft = rect.left + rect.width / 2;
@@ -82,13 +125,52 @@ function initWalletTooltips() {
         portal.style.left = Math.round(clampedLeft) + 'px';
         portal.style.top = Math.round(rect.top) + 'px';
         portal.style.transform = 'translate(-50%, calc(-100% - 0.5rem))';
-        });
 
-        token.addEventListener('mouseleave', () => {
+        if (miniPortal && microHtml) {
-            portal.classList.remove('active');
+            miniPortal.innerHTML = microHtml;
-        });
+            miniPortal.classList.add('active');
-    });
+            // Pin mini-portal to the bottom-right of the main portal —
+            // same anchor pattern as gameboard.js's gameKit tooltips.
+            const mainRect = portal.getBoundingClientRect();
+            miniPortal.style.left = '';
+            miniPortal.style.right = Math.round(window.innerWidth - mainRect.right) + 'px';
+            miniPortal.style.top = (mainRect.bottom + 4) + 'px';
+        } else if (miniPortal) {
+            miniPortal.classList.remove('active');
+        }
+    }
+
+    function _bindHover(anchor) {
+        const tooltip = anchor.querySelector('.tt');
+        if (!tooltip) return;
+        // `.tt-micro` is a SIBLING of `.tt` (not a child) so it lives
+        // alongside the main tooltip content without nesting — keeps the
+        // BUY-ITEM btn visually distinct in the mini portal.
+        const micro = anchor.querySelector(':scope > .tt-micro');
+        const microHtml = micro ? micro.innerHTML : null;
+        anchor.addEventListener('mouseenter', () => _show(anchor, tooltip.innerHTML, microHtml));
+        anchor.addEventListener('mouseleave', _scheduleHide);
+    }
+
+    document.querySelectorAll('.wallet-tokens .token, .wallet-shop .shop-tile')
+        .forEach(_bindHover);
+
+    // Re-entering either portal cancels the pending hide — keeps the
+    // microbutton clickable. Leaving either restarts the hide timer.
+    portal.addEventListener('mouseenter', _cancelHide);
+    portal.addEventListener('mouseleave', _scheduleHide);
+    if (miniPortal) {
+        miniPortal.addEventListener('mouseenter', _cancelHide);
+        miniPortal.addEventListener('mouseleave', _scheduleHide);
+    }
 }
 
+    return { initWalletTooltips: initWalletTooltips, pin: pin, unpin: unpin };
+})();
+
+// Expose globally so wallet-shop.js can call WalletTooltips.pin/unpin
+// without depending on script-load order.
+window.WalletTooltips = WalletTooltips;
+
 document.addEventListener('DOMContentLoaded', initWallet);
-document.addEventListener('DOMContentLoaded', initWalletTooltips);
+document.addEventListener('DOMContentLoaded', WalletTooltips.initWalletTooltips);

src/apps/dashboard/tests/integrated/test_forms.py

@@ -1,25 +1,32 @@
 from django.test import TestCase
 
-from apps.dashboard.forms import (
+from apps.billboard.forms import (
     DUPLICATE_LINE_ERROR,
     EMPTY_LINE_ERROR,
     ExistingPostLineForm,
     LineForm,
 )
-from apps.dashboard.models import Line, Post
+from apps.billboard.models import Line, Post
+from apps.lyric.models import User
 
 
 class LineFormTest(TestCase):
+    def setUp(self):
+        self.author = User.objects.create(email="author@test.io")
+
     def test_form_save_handles_saving_to_a_post(self):
         mypost = Post.objects.create()
         form = LineForm(data={"text": "do re mi"})
         self.assertTrue(form.is_valid())
-        new_line = form.save(for_post=mypost)
+        new_line = form.save(for_post=mypost, author=self.author)
         self.assertEqual(new_line, Line.objects.get())
         self.assertEqual(new_line.text, "do re mi")
         self.assertEqual(new_line.post, mypost)
 
 class ExistingPostLineFormTest(TestCase):
+    def setUp(self):
+        self.author = User.objects.create(email="author@test.io")
+
     def test_form_validation_for_blank_lines(self):
         post = Post.objects.create()
         form = ExistingPostLineForm(for_post=post, data={"text": ""})
@@ -28,7 +35,7 @@ class ExistingPostLineFormTest(TestCase):
 
     def test_form_validation_for_duplicate_lines(self):
         post = Post.objects.create()
-        Line.objects.create(post=post, text="twins, basil")
+        Line.objects.create(post=post, text="twins, basil", author=self.author)
         form = ExistingPostLineForm(for_post=post, data={"text": "twins, basil"})
         self.assertFalse(form.is_valid())
         self.assertEqual(form.errors["text"], [DUPLICATE_LINE_ERROR])
@@ -37,5 +44,5 @@ class ExistingPostLineFormTest(TestCase):
         mypost = Post.objects.create()
         form = ExistingPostLineForm(for_post=mypost, data={"text": "howdy"})
         self.assertTrue(form.is_valid())
-        new_line = form.save()
+        new_line = form.save(author=self.author)
         self.assertEqual(new_line, Line.objects.get())

src/apps/dashboard/tests/integrated/test_models.py

@@ -2,69 +2,71 @@ from django.core.exceptions import ValidationError
 from django.db.utils import IntegrityError
 from django.test import TestCase
 
-from apps.dashboard.models import Line, Post
+from apps.billboard.models import Line, Post
 from apps.lyric.models import User
 
 
 class LineModelTest(TestCase):
+    def setUp(self):
+        self.user = User.objects.create(email="a@b.cde")
+
     def test_line_is_related_to_post(self):
         mypost = Post.objects.create()
-        line = Line()
+        line = Line(post=mypost, author=self.user, text="x")
-        line.post = mypost
         line.save()
         self.assertIn(line, mypost.lines.all())
 
     def test_cannot_save_null_post_lines(self):
         mypost = Post.objects.create()
-        line = Line(post=mypost, text=None)
+        line = Line(post=mypost, author=self.user, text=None)
         with self.assertRaises(IntegrityError):
             line.save()
 
     def test_cannot_save_empty_post_lines(self):
         mypost = Post.objects.create()
-        line = Line(post=mypost, text="")
+        line = Line(post=mypost, author=self.user, text="")
         with self.assertRaises(ValidationError):
             line.full_clean()
 
     def test_duplicate_lines_are_invalid(self):
         mypost = Post.objects.create()
-        Line.objects.create(post=mypost, text="jklol")
+        Line.objects.create(post=mypost, author=self.user, text="jklol")
         with self.assertRaises(ValidationError):
-            line = Line(post=mypost, text="jklol")
+            line = Line(post=mypost, author=self.user, text="jklol")
             line.full_clean()
 
     def test_still_can_save_same_line_to_different_posts(self):
         post1 = Post.objects.create()
         post2 = Post.objects.create()
-        Line.objects.create(post=post1, text="nojk")
+        Line.objects.create(post=post1, author=self.user, text="nojk")
-        line = Line(post=post2, text="nojk")
+        line = Line(post=post2, author=self.user, text="nojk")
         line.full_clean()  # should not raise
 
 class PostModelTest(TestCase):
+        def setUp(self):
+            self.user = User.objects.create(email="a@b.cde")
+
         def test_get_absolute_url(self):
             mypost = Post.objects.create()
-            self.assertEqual(mypost.get_absolute_url(), f"/dashboard/post/{mypost.id}/")
+            self.assertEqual(mypost.get_absolute_url(), f"/billboard/post/{mypost.id}/")
 
         def test_post_lines_order(self):
             post1 = Post.objects.create()
-            line1 = Line.objects.create(post=post1, text="i1")
+            line1 = Line.objects.create(post=post1, author=self.user, text="i1")
-            line2 = Line.objects.create(post=post1, text="line 2")
+            line2 = Line.objects.create(post=post1, author=self.user, text="line 2")
-            line3 = Line.objects.create(post=post1, text="3")
+            line3 = Line.objects.create(post=post1, author=self.user, text="3")
             self.assertEqual(
                 list(post1.lines.all()),
                 [line1, line2, line3],
             )
 
         def test_posts_can_have_owners(self):
-            user = User.objects.create(email="a@b.cde")
+            mypost = Post.objects.create(owner=self.user)
-            mypost = Post.objects.create(owner=user)
+            self.assertIn(mypost, self.user.posts.all())
-            self.assertIn(mypost, user.posts.all())
 
         def test_post_owner_is_optional(self):
             Post.objects.create()
 
-        def test_post_name_is_first_line_text(self):
+        def test_post_title_is_explicit_field(self):
-            post = Post.objects.create()
+            post = Post.objects.create(title="first line")
-            Line.objects.create(post=post, text="first line")
+            self.assertEqual(post.title, "first line")
-            Line.objects.create(post=post, text="second line")
-            self.assertEqual(post.name, "first line")

src/apps/dashboard/tests/integrated/test_shop_views.py

@@ -0,0 +1,472 @@
+"""Shop view ITs — Chunk 3 of the wallet-expansion sprint.
+
+Three endpoints under test:
+  * `POST /dashboard/wallet/shop/buy` (`shop_buy`) — creates a Stripe
+    PaymentIntent + a `Purchase` row in PENDING; returns
+    `{client_secret, purchase_id}` for Stripe.js confirmCardPayment.
+  * `POST /dashboard/wallet/shop/confirm` (`shop_confirm`) — sync follow-up
+    after Stripe.js confirms client-side; retrieves the PI from Stripe,
+    if `status=='succeeded'` calls `Purchase.fulfill()` (idempotent w. the
+    webhook's parallel call).
+  * `POST /stripe/webhook` (`stripe_webhook`) — async fulfillment fallback
+    + bulletproof for 3DS-completed cards. Verifies signature against
+    `STRIPE_WEBHOOK_SECRET`; on `payment_intent.succeeded` calls
+    `Purchase.fulfill()` (same idempotent method as `shop_confirm`).
+
+`apps.dashboard.views.stripe` is mocked across all three. The webhook
+view's signature verification is also mocked via
+`stripe.Webhook.construct_event`.
+"""
+from unittest import mock
+
+from django.test import TestCase, override_settings
+
+from apps.epic.models import DeckVariant
+from apps.lyric.models import PaymentMethod, Purchase, ShopItem, Token, User
+
+
+def _seed_free_decks():
+    """Two free-in-shop decks (RWS + Fiorentine) + one paid deck (Earthman,
+    free_in_shop=False) so the claim endpoint's `free_in_shop` guard is
+    exercised. Mirrors the seed-migration row shapes (TestCase rolls back
+    the data migrations)."""
+    rws, _ = DeckVariant.objects.update_or_create(
+        slug="tarot-rider-waite-smith",
+        defaults={
+            "name": "Tarot (Rider-Waite-Smith)", "card_count": 78,
+            "family": "english", "has_card_images": False,
+            "is_polarized": False, "free_in_shop": True,
+        },
+    )
+    fiorentine, _ = DeckVariant.objects.update_or_create(
+        slug="minchiate-fiorentine-1860-1890",
+        defaults={
+            "name": "Minchiate Fiorentine (1860–1890)", "card_count": 97,
+            "family": "italian", "has_card_images": True,
+            "is_polarized": False, "free_in_shop": True,
+            "description": "97-card Minchiate Fiorentine deck.",
+        },
+    )
+    earthman, _ = DeckVariant.objects.update_or_create(
+        slug="earthman",
+        defaults={
+            "name": "Earthman", "card_count": 106, "is_default": True,
+            "is_polarized": True, "has_card_images": False,
+            "free_in_shop": False,
+        },
+    )
+    return rws, fiorentine, earthman
+
+
+class ShopClaimFreeViewTest(TestCase):
+    """`POST /dashboard/wallet/shop/claim` (`shop_claim_free`) — adds a free-
+    in-shop DeckVariant to the user's `unlocked_decks` so it appears in the
+    Game Kit applet. No Stripe, no Purchase row, idempotent."""
+
+    def setUp(self):
+        self.rws, self.fiorentine, self.earthman = _seed_free_decks()
+        self.user = User.objects.create(email="decker@test.io")
+        # Start from a known unlock set — strip the signal's auto-grant so
+        # the claim is the only thing that adds a deck.
+        self.user.unlocked_decks.clear()
+        self.client.force_login(self.user)
+
+    def test_requires_login(self):
+        self.client.logout()
+        response = self.client.post(
+            "/dashboard/wallet/shop/claim",
+            {"deck_slug": "tarot-rider-waite-smith"},
+        )
+        self.assertRedirects(
+            response, "/?next=/dashboard/wallet/shop/claim",
+            fetch_redirect_response=False,
+        )
+
+    def test_claim_adds_deck_to_unlocked(self):
+        response = self.client.post(
+            "/dashboard/wallet/shop/claim",
+            {"deck_slug": "tarot-rider-waite-smith"},
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(
+            self.user.unlocked_decks.filter(pk=self.rws.pk).exists()
+        )
+
+    def test_claim_returns_owned_json(self):
+        response = self.client.post(
+            "/dashboard/wallet/shop/claim",
+            {"deck_slug": "tarot-rider-waite-smith"},
+        )
+        body = response.json()
+        self.assertTrue(body["owned"])
+        self.assertEqual(body["deck_name"], "Tarot (Rider-Waite-Smith)")
+
+    def test_claim_is_idempotent(self):
+        for _ in range(2):
+            response = self.client.post(
+                "/dashboard/wallet/shop/claim",
+                {"deck_slug": "tarot-rider-waite-smith"},
+            )
+            self.assertEqual(response.status_code, 200)
+        self.assertEqual(
+            self.user.unlocked_decks.filter(pk=self.rws.pk).count(), 1
+        )
+
+    def test_unknown_slug_returns_404(self):
+        response = self.client.post(
+            "/dashboard/wallet/shop/claim", {"deck_slug": "no-such-deck"},
+        )
+        self.assertEqual(response.status_code, 404)
+
+    def test_non_free_deck_cannot_be_claimed(self):
+        """Guard: a deck with free_in_shop=False (eg Earthman, or any paid
+        deck) is NOT claimable via this $0 endpoint → 404, no unlock."""
+        response = self.client.post(
+            "/dashboard/wallet/shop/claim", {"deck_slug": "earthman"},
+        )
+        self.assertEqual(response.status_code, 404)
+        self.assertFalse(
+            self.user.unlocked_decks.filter(pk=self.earthman.pk).exists()
+        )
+
+
+class WalletFreeDecksContextTest(TestCase):
+    """The wallet page exposes `free_decks` — the free-in-shop DeckVariants
+    decorated w. a per-user `.owned` flag the Shop applet uses to render
+    FREE ITEM vs 'Already owned'."""
+
+    def setUp(self):
+        self.rws, self.fiorentine, self.earthman = _seed_free_decks()
+        self.user = User.objects.create(email="ctx@test.io")
+        self.user.unlocked_decks.clear()
+        self.client.force_login(self.user)
+
+    def test_free_decks_in_context_unowned_initially(self):
+        response = self.client.get("/dashboard/wallet/")
+        free = {d.slug: d for d in response.context["free_decks"]}
+        # Both free decks present; the paid Earthman is NOT listed here.
+        self.assertIn("tarot-rider-waite-smith", free)
+        self.assertIn("minchiate-fiorentine-1860-1890", free)
+        self.assertNotIn("earthman", free)
+        self.assertFalse(free["tarot-rider-waite-smith"].owned)
+
+    def test_free_deck_marked_owned_after_claim(self):
+        self.user.unlocked_decks.add(self.rws)
+        response = self.client.get("/dashboard/wallet/")
+        free = {d.slug: d for d in response.context["free_decks"]}
+        self.assertTrue(free["tarot-rider-waite-smith"].owned)
+        self.assertFalse(free["minchiate-fiorentine-1860-1890"].owned)
+
+
+def _seed_starting_items():
+    """Mirror the seed-migration row shape so each TestCase starts w. a
+    known catalog (TestCase rolls back the data migration, so the rows
+    seeded by `0009_seed_shop_items` aren't there during tests)."""
+    ShopItem.objects.update_or_create(
+        slug="tithe-1",
+        defaults={
+            "name": "Tithe Token", "description": "1 Tithe Token + 12 Writs",
+            "icon": "fa-piggy-bank", "badge_text": "",
+            "price_cents": 100, "granted_token_type": Token.TITHE,
+            "granted_count": 1, "granted_writs": 12,
+            "max_owned": None, "display_order": 10, "active": True,
+        },
+    )
+    ShopItem.objects.update_or_create(
+        slug="band-1",
+        defaults={
+            "name": "Wristband", "description": "Admit All Entry",
+            "shoptalk": "Unlimited free entry (BYOB)",
+            "icon": "fa-ring", "badge_text": "",
+            "price_cents": 2000, "granted_token_type": Token.BAND,
+            "granted_count": 1, "granted_writs": 0,
+            "max_owned": 1, "display_order": 30, "active": True,
+        },
+    )
+
+
+class ShopBuyViewTest(TestCase):
+    def setUp(self):
+        _seed_starting_items()
+        self.user = User.objects.create(email="buyer@test.io")
+        self.user.stripe_customer_id = "cus_buyer"
+        self.user.save()
+        PaymentMethod.objects.create(
+            user=self.user, stripe_pm_id="pm_test_4242",
+            last4="4242", brand="visa",
+        )
+        self.client.force_login(self.user)
+
+    def test_requires_login(self):
+        self.client.logout()
+        response = self.client.post(
+            "/dashboard/wallet/shop/buy", {"shop_item_slug": "tithe-1"}
+        )
+        self.assertRedirects(
+            response, "/?next=/dashboard/wallet/shop/buy",
+            fetch_redirect_response=False,
+        )
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_success_creates_payment_intent_and_purchase(self, mock_stripe):
+        mock_stripe.PaymentIntent.create.return_value = mock.Mock(
+            id="pi_test_abc", client_secret="pi_test_abc_secret",
+        )
+        response = self.client.post(
+            "/dashboard/wallet/shop/buy", {"shop_item_slug": "tithe-1"},
+        )
+        self.assertEqual(response.status_code, 200)
+        body = response.json()
+        self.assertEqual(body["client_secret"], "pi_test_abc_secret")
+        purchase = Purchase.objects.get(pk=body["purchase_id"])
+        self.assertEqual(purchase.user, self.user)
+        self.assertEqual(purchase.shop_item.slug, "tithe-1")
+        self.assertEqual(purchase.status, Purchase.PENDING)
+        self.assertEqual(purchase.stripe_payment_intent_id, "pi_test_abc")
+        self.assertEqual(purchase.amount_cents, 100)
+        self.assertEqual(purchase.granted_writs, 12)
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_payment_intent_called_with_correct_args(self, mock_stripe):
+        mock_stripe.PaymentIntent.create.return_value = mock.Mock(
+            id="pi_a", client_secret="pi_a_secret",
+        )
+        self.client.post(
+            "/dashboard/wallet/shop/buy", {"shop_item_slug": "tithe-1"},
+        )
+        kwargs = mock_stripe.PaymentIntent.create.call_args.kwargs
+        self.assertEqual(kwargs["amount"], 100)
+        self.assertEqual(kwargs["currency"], "usd")
+        self.assertEqual(kwargs["customer"], "cus_buyer")
+        self.assertEqual(kwargs["payment_method"], "pm_test_4242")
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_unknown_item_slug_returns_404(self, mock_stripe):
+        response = self.client.post(
+            "/dashboard/wallet/shop/buy", {"shop_item_slug": "no-such-item"},
+        )
+        self.assertEqual(response.status_code, 404)
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_inactive_item_returns_404(self, mock_stripe):
+        item = ShopItem.objects.get(slug="tithe-1")
+        item.active = False
+        item.save()
+        response = self.client.post(
+            "/dashboard/wallet/shop/buy", {"shop_item_slug": "tithe-1"},
+        )
+        self.assertEqual(response.status_code, 404)
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_max_owned_violation_returns_409(self, mock_stripe):
+        """User already owns 1 BAND (max_owned=1) → buy refused w. 409."""
+        Token.objects.create(user=self.user, token_type=Token.BAND)
+        response = self.client.post(
+            "/dashboard/wallet/shop/buy", {"shop_item_slug": "band-1"},
+        )
+        self.assertEqual(response.status_code, 409)
+        # No PaymentIntent created
+        mock_stripe.PaymentIntent.create.assert_not_called()
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_no_payment_method_returns_402(self, mock_stripe):
+        """User w. no saved PaymentMethod → 402 Payment Required."""
+        self.user.payment_methods.all().delete()
+        response = self.client.post(
+            "/dashboard/wallet/shop/buy", {"shop_item_slug": "tithe-1"},
+        )
+        self.assertEqual(response.status_code, 402)
+        mock_stripe.PaymentIntent.create.assert_not_called()
+
+
+class ShopConfirmViewTest(TestCase):
+    def setUp(self):
+        _seed_starting_items()
+        self.user = User.objects.create(email="confirm@test.io")
+        self.user.tokens.all().delete()
+        self.user.refresh_from_db()
+        self.client.force_login(self.user)
+        self.tithe = ShopItem.objects.get(slug="tithe-1")
+        self.purchase = Purchase.objects.create(
+            user=self.user, shop_item=self.tithe,
+            stripe_payment_intent_id="pi_conf_1",
+            amount_cents=100, granted_writs=12,
+        )
+
+    def test_requires_login(self):
+        self.client.logout()
+        response = self.client.post(
+            "/dashboard/wallet/shop/confirm", {"purchase_id": self.purchase.pk},
+        )
+        self.assertRedirects(
+            response, "/?next=/dashboard/wallet/shop/confirm",
+            fetch_redirect_response=False,
+        )
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_succeeded_pi_triggers_fulfill(self, mock_stripe):
+        mock_stripe.PaymentIntent.retrieve.return_value = mock.Mock(status="succeeded")
+        response = self.client.post(
+            "/dashboard/wallet/shop/confirm", {"purchase_id": self.purchase.pk},
+        )
+        self.assertEqual(response.status_code, 200)
+        self.purchase.refresh_from_db()
+        self.assertEqual(self.purchase.status, Purchase.SUCCEEDED)
+        self.assertEqual(
+            self.user.tokens.filter(token_type=Token.TITHE).count(), 1
+        )
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_pending_pi_does_not_fulfill(self, mock_stripe):
+        """Stripe still processing → leave Purchase PENDING for the webhook."""
+        mock_stripe.PaymentIntent.retrieve.return_value = mock.Mock(status="processing")
+        self.client.post(
+            "/dashboard/wallet/shop/confirm", {"purchase_id": self.purchase.pk},
+        )
+        self.purchase.refresh_from_db()
+        self.assertEqual(self.purchase.status, Purchase.PENDING)
+        self.assertEqual(
+            self.user.tokens.filter(token_type=Token.TITHE).count(), 0
+        )
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_idempotent_when_already_succeeded(self, mock_stripe):
+        """Webhook already fulfilled — confirm endpoint shouldn't double-mint."""
+        self.purchase.fulfill()
+        self.assertEqual(self.purchase.status, Purchase.SUCCEEDED)
+        mock_stripe.PaymentIntent.retrieve.return_value = mock.Mock(status="succeeded")
+        response = self.client.post(
+            "/dashboard/wallet/shop/confirm", {"purchase_id": self.purchase.pk},
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(
+            self.user.tokens.filter(token_type=Token.TITHE).count(), 1
+        )
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_other_users_purchase_returns_404(self, mock_stripe):
+        """A user trying to confirm someone else's PendingPurchase gets 404."""
+        other = User.objects.create(email="other@test.io")
+        other_purchase = Purchase.objects.create(
+            user=other, shop_item=self.tithe,
+            stripe_payment_intent_id="pi_other",
+            amount_cents=100, granted_writs=12,
+        )
+        response = self.client.post(
+            "/dashboard/wallet/shop/confirm", {"purchase_id": other_purchase.pk},
+        )
+        self.assertEqual(response.status_code, 404)
+
+
+@override_settings(STRIPE_WEBHOOK_SECRET="whsec_test_123")
+class StripeWebhookViewTest(TestCase):
+    def setUp(self):
+        _seed_starting_items()
+        self.user = User.objects.create(email="webhook@test.io")
+        self.user.tokens.all().delete()
+        self.user.refresh_from_db()
+        self.tithe = ShopItem.objects.get(slug="tithe-1")
+        self.purchase = Purchase.objects.create(
+            user=self.user, shop_item=self.tithe,
+            stripe_payment_intent_id="pi_wh_1",
+            amount_cents=100, granted_writs=12,
+        )
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_signature_mismatch_returns_400(self, mock_stripe):
+        mock_stripe.Webhook.construct_event.side_effect = ValueError("bad sig")
+        response = self.client.post(
+            "/stripe/webhook",
+            data=b"{}",
+            content_type="application/json",
+            HTTP_STRIPE_SIGNATURE="t=0,v1=deadbeef",
+        )
+        self.assertEqual(response.status_code, 400)
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_payment_intent_succeeded_triggers_fulfill(self, mock_stripe):
+        # `Mock(intent_obj, ...)` returns a `dict()`-style object that supports
+        # `event["type"]` AND `event["data"]["object"]["id"]` — match what the
+        # webhook view will read.
+        mock_stripe.Webhook.construct_event.return_value = {
+            "type": "payment_intent.succeeded",
+            "data": {"object": {
+                "id": "pi_wh_1",
+                "metadata": {"purchase_id": str(self.purchase.pk)},
+            }},
+        }
+        response = self.client.post(
+            "/stripe/webhook", data=b"{}",
+            content_type="application/json",
+            HTTP_STRIPE_SIGNATURE="t=0,v1=goodsig",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.purchase.refresh_from_db()
+        self.assertEqual(self.purchase.status, Purchase.SUCCEEDED)
+        self.assertEqual(
+            self.user.tokens.filter(token_type=Token.TITHE).count(), 1
+        )
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_unknown_event_type_is_noop(self, mock_stripe):
+        """Stripe sends a lot of event types we don't care about (eg
+        `charge.dispute.created`). Webhook view should return 2xx so
+        Stripe doesn't retry, but NOT touch the Purchase."""
+        mock_stripe.Webhook.construct_event.return_value = {
+            "type": "charge.dispute.created",
+            "data": {"object": {"id": "pi_wh_1"}},
+        }
+        response = self.client.post(
+            "/stripe/webhook", data=b"{}",
+            content_type="application/json",
+            HTTP_STRIPE_SIGNATURE="t=0,v1=goodsig",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.purchase.refresh_from_db()
+        self.assertEqual(self.purchase.status, Purchase.PENDING)
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_duplicate_delivery_is_idempotent(self, mock_stripe):
+        """Stripe may redeliver a webhook (network blip, our 5xx, etc.).
+        Re-firing the same `payment_intent.succeeded` event must not
+        double-mint tokens."""
+        mock_stripe.Webhook.construct_event.return_value = {
+            "type": "payment_intent.succeeded",
+            "data": {"object": {
+                "id": "pi_wh_1",
+                "metadata": {"purchase_id": str(self.purchase.pk)},
+            }},
+        }
+        self.client.post(
+            "/stripe/webhook", data=b"{}",
+            content_type="application/json",
+            HTTP_STRIPE_SIGNATURE="t=0,v1=goodsig",
+        )
+        self.client.post(
+            "/stripe/webhook", data=b"{}",
+            content_type="application/json",
+            HTTP_STRIPE_SIGNATURE="t=0,v1=goodsig",
+        )
+        self.assertEqual(
+            self.user.tokens.filter(token_type=Token.TITHE).count(), 1
+        )
+
+    @mock.patch("apps.dashboard.views.stripe")
+    def test_unknown_purchase_id_in_metadata_is_noop(self, mock_stripe):
+        """If metadata.purchase_id doesn't match any row, log + 200 (don't
+        crash the webhook listener — Stripe would retry on 5xx)."""
+        mock_stripe.Webhook.construct_event.return_value = {
+            "type": "payment_intent.succeeded",
+            "data": {"object": {
+                "id": "pi_unknown",
+                "metadata": {"purchase_id": "999999"},
+            }},
+        }
+        response = self.client.post(
+            "/stripe/webhook", data=b"{}",
+            content_type="application/json",
+            HTTP_STRIPE_SIGNATURE="t=0,v1=goodsig",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.purchase.refresh_from_db()
+        self.assertEqual(self.purchase.status, Purchase.PENDING)

src/apps/dashboard/tests/integrated/test_sky_views.py

@@ -37,6 +37,48 @@ class SkyViewTest(TestCase):
         self.assertContains(response, reverse("sky_preview"))
         self.assertContains(response, reverse("sky_save"))
 
+    def test_saved_birth_date_renders_in_user_tz_when_set(self):
+        """A user w. saved sky_birth_dt + sky_birth_tz hits the astimezone
+        branch (views.py L300-306) — saved_birth_date / saved_birth_time
+        render in the user's local tz, not UTC."""
+        from datetime import datetime
+        import zoneinfo
+        # 1990-06-15 16:00 UTC = 12:00 PM in America/New_York (EDT, UTC-4)
+        self.user.sky_birth_dt = datetime(1990, 6, 15, 16, 0, tzinfo=zoneinfo.ZoneInfo("UTC"))
+        self.user.sky_birth_tz = "America/New_York"
+        self.user.save()
+        response = self.client.get(reverse("sky"))
+        self.assertEqual(response.context["saved_birth_date"], "1990-06-15")
+        self.assertEqual(response.context["saved_birth_time"], "12:00")
+
+    def test_saved_birth_falls_back_to_utc_when_tz_invalid(self):
+        """A garbage sky_birth_tz triggers ZoneInfoNotFoundError — the view
+        swallows it (pass) and renders the UTC representation."""
+        from datetime import datetime
+        import zoneinfo
+        self.user.sky_birth_dt = datetime(1990, 6, 15, 16, 0, tzinfo=zoneinfo.ZoneInfo("UTC"))
+        self.user.sky_birth_tz = "Not/A/Real_Zone"
+        self.user.save()
+        response = self.client.get(reverse("sky"))
+        # UTC fallback — 16:00 stays 16:00
+        self.assertEqual(response.context["saved_birth_time"], "16:00")
+
+    def test_tz_input_is_readonly_and_carries_auto_detect_placeholder(self):
+        """Manual TZ edits throw the schedulePreview / PySwiss fetch off (the
+        backend gets a stale TZ for the new lat/lon), so the field is render-
+        readonly like lat/lon — auto-fills from preview, never from a typed
+        override. The old <small id="id_nf_tz_hint"> is gone; its copy lives
+        in the placeholder so an empty field is self-explanatory."""
+        response = self.client.get(reverse("sky"))
+        self.assertContains(response, 'id="id_nf_tz"')
+        # readonly + tabindex:-1 mirrors the lat/lon pattern.
+        self.assertRegex(
+            response.content.decode(),
+            r'id="id_nf_tz"[^>]*\breadonly\b',
+        )
+        self.assertContains(response, 'placeholder="auto-detected from coordinates"')
+        self.assertNotContains(response, 'id="id_nf_tz_hint"')
+
 
 class SkyPreviewTest(TestCase):
     def setUp(self):
@@ -256,23 +298,25 @@ class SkySaveNoteTest(TestCase):
             content_type="application/json",
         )
 
-    def test_first_save_with_chart_data_returns_stargazer_note(self):
+    def test_first_save_with_chart_data_returns_stargazer_brief(self):
         data = self._post().json()
-        self.assertIn("note", data)
+        self.assertIn("brief", data)
-        recog = data["note"]
+        brief = data["brief"]
-        self.assertEqual(recog["slug"], "stargazer")
+        self.assertEqual(brief["kind"], "note_unlock")
-        self.assertIn("title", recog)
+        self.assertEqual(brief["title"], "Stargazer")
-        self.assertIn("description", recog)
+        self.assertIn("Stargazer", brief["line_text"])
-        self.assertIn("earned_at", recog)
+        self.assertIn("/billboard/post/", brief["post_url"])
+        self.assertEqual(brief["square_url"], "/billboard/my-notes/")
+        self.assertIn("created_at", brief)
 
     def test_first_save_creates_note_in_db(self):
         self._post()
         self.assertEqual(Note.objects.filter(user=self.user, slug="stargazer").count(), 1)
 
-    def test_second_save_returns_null_note(self):
+    def test_second_save_returns_null_brief(self):
         self._post()
         data = self._post().json()
-        self.assertIsNone(data["note"])
+        self.assertIsNone(data["brief"])
 
     def test_second_save_does_not_create_duplicate_note(self):
         self._post()
@@ -281,10 +325,66 @@ class SkySaveNoteTest(TestCase):
 
     def test_save_with_empty_chart_data_does_not_grant_note(self):
         data = self._post(chart_data={}).json()
-        self.assertIsNone(data["note"])
+        self.assertIsNone(data["brief"])
         self.assertEqual(Note.objects.filter(user=self.user, slug="stargazer").count(), 0)
 
     def test_save_with_null_chart_data_does_not_grant_note(self):
         data = self._post(chart_data=None).json()
-        self.assertIsNone(data["note"])
+        self.assertIsNone(data["brief"])
         self.assertEqual(Note.objects.filter(user=self.user, slug="stargazer").count(), 0)
+
+
+class SkyDeleteTest(TestCase):
+    """POST /dashboard/sky/delete clears all sky fields on the User model and
+    redirects back to /dashboard/sky/. The Stargazer Note is preserved (it's
+    earned, not stateful)."""
+
+    def setUp(self):
+        from datetime import datetime
+        import zoneinfo
+
+        self.user = User.objects.create(email="star@test.io")
+        self.user.sky_chart_data  = {"planets": {"Sun": {"sign": "Gemini"}}}
+        self.user.sky_birth_place = "Baltimore, MD, US"
+        self.user.sky_birth_tz    = "America/New_York"
+        self.user.sky_birth_lat   = 39.2904
+        self.user.sky_birth_lon   = -76.6122
+        self.user.sky_birth_dt    = datetime(
+            1990, 6, 15, 12, 0, tzinfo=zoneinfo.ZoneInfo("UTC")
+        )
+        self.user.sky_house_system = "O"
+        self.user.save()
+        self.client.force_login(self.user)
+        self.url = reverse("sky_delete")
+
+    def test_post_clears_all_sky_fields(self):
+        self.client.post(self.url)
+        self.user.refresh_from_db()
+        self.assertIsNone(self.user.sky_chart_data)
+        self.assertIsNone(self.user.sky_birth_dt)
+        self.assertIsNone(self.user.sky_birth_lat)
+        self.assertIsNone(self.user.sky_birth_lon)
+        self.assertEqual(self.user.sky_birth_place, "")
+        self.assertEqual(self.user.sky_birth_tz, "")
+
+    def test_post_redirects_to_sky_view(self):
+        response = self.client.post(self.url)
+        self.assertEqual(response.status_code, 302)
+        self.assertEqual(response["Location"], reverse("sky"))
+
+    def test_get_returns_405(self):
+        response = self.client.get(self.url)
+        self.assertEqual(response.status_code, 405)
+
+    def test_requires_login(self):
+        self.client.logout()
+        response = self.client.post(self.url)
+        self.assertEqual(response.status_code, 302)
+        self.assertIn("/?next=", response["Location"])
+
+    def test_post_preserves_unrelated_user_fields(self):
+        self.user.username = "stargazer-keepme"
+        self.user.save()
+        self.client.post(self.url)
+        self.user.refresh_from_db()
+        self.assertEqual(self.user.username, "stargazer-keepme")

src/apps/dashboard/tests/integrated/test_views.py

@@ -8,11 +8,11 @@ from django.urls import reverse
 from django.utils import html, timezone
 
 from apps.applets.models import Applet, UserApplet
-from apps.dashboard.forms import (
+from apps.billboard.forms import (
     DUPLICATE_LINE_ERROR,
     EMPTY_LINE_ERROR,
 )
-from apps.dashboard.models import Line, Post
+from apps.billboard.models import Line, Post
 from apps.drama.models import Note
 from apps.lyric.models import User
 
@@ -37,19 +37,19 @@ class NewPostTest(TestCase):
         )
 
     def test_can_save_a_POST_request(self):
-        self.client.post("/dashboard/new_post", data={"text": "A new post line"})
+        self.client.post("/billboard/new-post", data={"text": "A new post line"})
         self.assertEqual(Line.objects.count(), 1)
         new_line = Line.objects.get()
         self.assertEqual(new_line.text, "A new post line")
 
     def test_redirects_after_POST(self):
-        response = self.client.post("/dashboard/new_post", data={"text": "A new post line"})
+        response = self.client.post("/billboard/new-post", data={"text": "A new post line"})
         new_post = Post.objects.get()
-        self.assertRedirects(response, f"/dashboard/post/{new_post.id}/")
+        self.assertRedirects(response, f"/billboard/post/{new_post.id}/")
 
     # Post invalid input helper
     def post_invalid_input(self):
-        return self.client.post("/dashboard/new_post", data={"text": ""})
+        return self.client.post("/billboard/new-post", data={"text": ""})
 
     def test_for_invalid_input_nothing_saved_to_db(self):
         self.post_invalid_input()
@@ -66,14 +66,21 @@ class NewPostTest(TestCase):
 
 @override_settings(COMPRESS_ENABLED=False)
 class PostViewTest(TestCase):
+    def setUp(self):
+        self.author = User.objects.create(email="author@test.io")
+        # POST flows append a Line with author=request.user — non-null FK
+        # since Line.author is required. force_login so the view's view_post
+        # path saves cleanly; anonymous compose is no longer supported.
+        self.client.force_login(self.author)
+
     def test_uses_post_template(self):
         mypost = Post.objects.create()
-        response = self.client.get(f"/dashboard/post/{mypost.id}/")
+        response = self.client.get(f"/billboard/post/{mypost.id}/")
-        self.assertTemplateUsed(response, "apps/dashboard/post.html")
+        self.assertTemplateUsed(response, "apps/billboard/post.html")
 
     def test_renders_input_form(self):
         mypost = Post.objects.create()
-        url = f"/dashboard/post/{mypost.id}/"
+        url = f"/billboard/post/{mypost.id}/"
         response = self.client.get(url)
         parsed = lxml.html.fromstring(response.content)
         forms = parsed.cssselect("form[method=POST]")
@@ -85,12 +92,12 @@ class PostViewTest(TestCase):
     def test_displays_only_lines_for_that_post(self):
         # Given/Arrange
         correct_post = Post.objects.create()
-        Line.objects.create(text="itemey 1", post=correct_post)
+        Line.objects.create(text="itemey 1", post=correct_post, author=self.author)
-        Line.objects.create(text="itemey 2", post=correct_post)
+        Line.objects.create(text="itemey 2", post=correct_post, author=self.author)
         other_post = Post.objects.create()
-        Line.objects.create(text="other post line", post=other_post)
+        Line.objects.create(text="other post line", post=other_post, author=self.author)
         # When/Act
-        response = self.client.get(f"/dashboard/post/{correct_post.id}/")
+        response = self.client.get(f"/billboard/post/{correct_post.id}/")
         # Then/Assert
         self.assertContains(response, "itemey 1")
         self.assertContains(response, "itemey 2")
@@ -101,7 +108,7 @@ class PostViewTest(TestCase):
         correct_post = Post.objects.create()
 
         self.client.post(
-            f"/dashboard/post/{correct_post.id}/",
+            f"/billboard/post/{correct_post.id}/",
             data={"text": "A new line for an existing post"},
         )
 
@@ -115,16 +122,16 @@ class PostViewTest(TestCase):
         correct_post = Post.objects.create()
 
         response = self.client.post(
-            f"/dashboard/post/{correct_post.id}/",
+            f"/billboard/post/{correct_post.id}/",
             data={"text": "A new line for an existing post"},
         )
 
-        self.assertRedirects(response, f"/dashboard/post/{correct_post.id}/")
+        self.assertRedirects(response, f"/billboard/post/{correct_post.id}/")
 
     # Post invalid input helper
     def post_invalid_input(self):
         mypost = Post.objects.create()
-        return self.client.post(f"/dashboard/post/{mypost.id}/", data={"text": ""})
+        return self.client.post(f"/billboard/post/{mypost.id}/", data={"text": ""})
 
     def test_for_invalid_input_nothing_saved_to_db(self):
         self.post_invalid_input()
@@ -133,7 +140,7 @@ class PostViewTest(TestCase):
     def test_for_invalid_input_renders_post_template(self):
         response = self.post_invalid_input()
         self.assertEqual(response.status_code, 200)
-        self.assertTemplateUsed(response, "apps/dashboard/post.html")
+        self.assertTemplateUsed(response, "apps/billboard/post.html")
 
     def test_for_invalid_input_shows_error_on_page(self):
         response = self.post_invalid_input()
@@ -147,49 +154,49 @@ class PostViewTest(TestCase):
 
     def test_duplicate_line_validation_errors_end_up_on_post_page(self):
         post1 = Post.objects.create()
-        Line.objects.create(post=post1, text="lorem ipsum")
+        Line.objects.create(post=post1, text="lorem ipsum", author=self.author)
 
         response = self.client.post(
-            f"/dashboard/post/{post1.id}/",
+            f"/billboard/post/{post1.id}/",
             data={"text": "lorem ipsum"},
         )
 
         expected_error = html.escape(DUPLICATE_LINE_ERROR)
         self.assertContains(response, expected_error)
-        self.assertTemplateUsed(response, "apps/dashboard/post.html")
+        self.assertTemplateUsed(response, "apps/billboard/post.html")
         self.assertEqual(Line.objects.all().count(), 1)
 
 class MyPostsTest(TestCase):
     def test_my_posts_url_renders_my_posts_template(self):
         user = User.objects.create(email="a@b.cde")
         self.client.force_login(user)
-        response = self.client.get(f"/dashboard/users/{user.id}/")
+        response = self.client.get(f"/billboard/users/{user.id}/")
-        self.assertTemplateUsed(response, "apps/dashboard/my_posts.html")
+        self.assertTemplateUsed(response, "apps/billboard/my_posts.html")
 
     def test_passes_correct_owner_to_template(self):
         User.objects.create(email="wrongowner@example.com")
         correct_user = User.objects.create(email="a@b.cde")
         self.client.force_login(correct_user)
-        response = self.client.get(f"/dashboard/users/{correct_user.id}/")
+        response = self.client.get(f"/billboard/users/{correct_user.id}/")
         self.assertEqual(response.context["owner"], correct_user)
 
     def test_post_owner_is_saved_if_user_is_authenticated(self):
         user = User.objects.create(email="a@b.cde")
         self.client.force_login(user)
-        self.client.post("/dashboard/new_post", data={"text": "new line"})
+        self.client.post("/billboard/new-post", data={"text": "new line"})
         new_post = Post.objects.get()
         self.assertEqual(new_post.owner, user)
 
     def test_my_posts_redirects_if_not_logged_in(self):
         user = User.objects.create(email="a@b.cde")
-        response = self.client.get(f"/dashboard/users/{user.id}/")
+        response = self.client.get(f"/billboard/users/{user.id}/")
         self.assertRedirects(response, "/")
 
     def test_my_posts_returns_403_for_wrong_user(self):
         user1 = User.objects.create(email="a@b.cde")
         user2 = User.objects.create(email="wrongowner@example.com")
         self.client.force_login(user2)
-        response = self.client.get(f"/dashboard/users/{user1.id}/")
+        response = self.client.get(f"/billboard/users/{user1.id}/")
         self.assertEqual(response.status_code, 403)
 
 class SharePostTest(TestCase):
@@ -197,16 +204,16 @@ class SharePostTest(TestCase):
         our_post = Post.objects.create()
         alice = User.objects.create(email="alice@example.com")
         response = self.client.post(
-            f"/dashboard/post/{our_post.id}/share_post",
+            f"/billboard/post/{our_post.id}/share-post",
             data={"recipient": "alice@example.com"},
         )
-        self.assertRedirects(response, f"/dashboard/post/{our_post.id}/")
+        self.assertRedirects(response, f"/billboard/post/{our_post.id}/")
 
     def test_post_with_email_adds_user_to_shared_with(self):
         our_post = Post.objects.create()
         alice = User.objects.create(email="alice@example.com")
         self.client.post(
-            f"/dashboard/post/{our_post.id}/share_post",
+            f"/billboard/post/{our_post.id}/share-post",
             data={"recipient": "alice@example.com"},
         )
         self.assertIn(alice, our_post.shared_with.all())
@@ -214,12 +221,12 @@ class SharePostTest(TestCase):
     def test_post_with_nonexistent_email_redirects_to_post(self):
         our_post = Post.objects.create()
         response = self.client.post(
-            f"/dashboard/post/{our_post.id}/share_post",
+            f"/billboard/post/{our_post.id}/share-post",
             data={"recipient": "nobody@example.com"},
         )
         self.assertRedirects(
             response,
-            f"/dashboard/post/{our_post.id}/",
+            f"/billboard/post/{our_post.id}/",
             fetch_redirect_response=False,
         )
 
@@ -227,7 +234,7 @@ class SharePostTest(TestCase):
         owner = User.objects.create(email="owner@example.com")
         our_post = Post.objects.create(owner=owner)
         self.client.force_login(owner)
-        self.client.post(reverse("share_post", args=[our_post.id]),
+        self.client.post(reverse("billboard:share_post", args=[our_post.id]),
                          data={"recipient": "owner@example.com"})
         self.assertNotIn(owner, our_post.shared_with.all())
 
@@ -235,7 +242,7 @@ class SharePostTest(TestCase):
     def test_share_post_shows_privacy_safe_message(self):
         our_post = Post.objects.create()
         response = self.client.post(
-            f"/dashboard/post/{our_post.id}/share_post",
+            f"/billboard/post/{our_post.id}/share-post",
             data={"recipient": "nobody@example.com"},
             follow=True,
         )
@@ -251,20 +258,20 @@ class ViewAuthPostTest(TestCase):
         self.our_post = Post.objects.create(owner=self.owner)
 
     def test_anonymous_user_is_redirected(self):
-        response = self.client.get(reverse("view_post", args=[self.our_post.id]))
+        response = self.client.get(reverse("billboard:view_post", args=[self.our_post.id]))
         self.assertRedirects(response, "/", fetch_redirect_response=False)
 
     def test_non_owner_non_shared_user_gets_403(self):
         stranger = User.objects.create(email="stranger@example.com")
         self.client.force_login(stranger)
-        response = self.client.get(reverse("view_post", args=[self.our_post.id]))
+        response = self.client.get(reverse("billboard:view_post", args=[self.our_post.id]))
         self.assertEqual(response.status_code, 403)
 
     def test_shared_with_user_can_access_post(self):
         guest = User.objects.create(email="guest@example.com")
         self.our_post.shared_with.add(guest)
         self.client.force_login(guest)
-        response = self.client.get(reverse("view_post", args=[self.our_post.id]))
+        response = self.client.get(reverse("billboard:view_post", args=[self.our_post.id]))
         self.assertEqual(response.status_code, 200)
 
 @override_settings(COMPRESS_ENABLED=False)
@@ -454,6 +461,107 @@ class ProfileViewTest(TestCase):
         [username_input] = parsed.cssselect("#id_new_username")
         self.assertEqual("discoman", username_input.get("value"))
 
+    def test_post_reserved_username_does_not_save(self):
+        """RESERVED_USERNAMES (e.g. 'adman') must be rejected — the view bails
+        with an error message + redirect to / before reaching user.save()."""
+        original_username = self.user.username
+        self.client.post("/dashboard/set_profile", data={"username": "adman"})
+        self.user.refresh_from_db()
+        self.assertEqual(self.user.username, original_username)
+
+    def test_post_reserved_username_redirects_home(self):
+        response = self.client.post("/dashboard/set_profile", data={"username": "adman"})
+        self.assertRedirects(response, "/", fetch_redirect_response=False)
+
+
+class KitBagViewTest(TestCase):
+    """`kit_bag` view — renders the kit-bag panel partial w. equipped + token state."""
+
+    def setUp(self):
+        from apps.lyric.models import Token
+        self.user = User.objects.create(email="gamer@test.io")
+        self.client.force_login(self.user)
+        # Stash a TITHE token so the list-comprehension branch lands non-empty
+        Token.objects.create(user=self.user, token_type=Token.TITHE)
+        self.url = "/dashboard/kit-bag/"
+
+    def test_get_returns_200_and_renders_panel(self):
+        response = self.client.get(self.url)
+        self.assertEqual(response.status_code, 200)
+        self.assertTemplateUsed(response, "core/_partials/_kit_bag_panel.html")
+
+    def test_context_passes_free_and_tithe_counts(self):
+        response = self.client.get(self.url)
+        # signal seeds a FREE + COIN; we added a TITHE in setUp.
+        self.assertEqual(response.context["tithe_count"], 1)
+        self.assertGreaterEqual(response.context["free_count"], 0)
+
+    def test_requires_login(self):
+        self.client.logout()
+        response = self.client.get(self.url)
+        self.assertEqual(response.status_code, 302)
+        self.assertIn("/?next=", response["Location"])
+
+    def test_deck_section_renders_card_stack_svg_not_fa_id_badge(self):
+        """Sprint A.4 follow-up — kit-bag Deck section uses the new card-deck
+        SVG icon partial, replacing the prior `<i class="fa-regular fa-id-badge">`
+        for both the equipped-deck branch and the placeholder branch."""
+        import lxml.html
+        response = self.client.get(self.url)
+        parsed = lxml.html.fromstring(response.content)
+        # Auto-equipped Earthman appears in the Deck section.
+        deck = parsed.cssselect(".kit-bag-deck")[0]
+        [_] = deck.cssselect("svg.deck-stack-icon")
+        self.assertEqual(
+            len(deck.cssselect("i.fa-id-badge")), 0,
+            "fa-regular fa-id-badge must be gone from kit-bag-deck",
+        )
+
+    def test_no_deck_equipped_renders_placeholder_card_stack_icon(self):
+        """Sprint A.4 follow-up — when the user has no equipped_deck, the
+        kit-bag Deck section renders the same .deck-stack-icon SVG inside a
+        .kit-bag-placeholder wrapper (no fan-out trigger; CSS dims it to
+        --quaUser at 0.3 alpha to match the empty dice slot)."""
+        import lxml.html
+        # Clear the auto-equipped Earthman to land in the placeholder branch.
+        self.user.equipped_deck = None
+        self.user.save(update_fields=["equipped_deck"])
+        response = self.client.get(self.url)
+        parsed = lxml.html.fromstring(response.content)
+        # equipped-deck branch is skipped → placeholder branch fires.
+        self.assertEqual(
+            len(parsed.cssselect(".kit-bag-deck")), 0,
+            "No equipped deck → no .kit-bag-deck wrapper",
+        )
+        placeholders = parsed.cssselect(".kit-bag-section .kit-bag-placeholder")
+        # First placeholder is the Deck slot (Dice + Trinket slots also use
+        # .kit-bag-placeholder when empty); assert at least one carries the
+        # card-stack SVG.
+        deck_placeholder = placeholders[0]
+        [_] = deck_placeholder.cssselect("svg.deck-stack-icon")
+        # Old fa-id-badge must be gone.
+        self.assertEqual(
+            len(deck_placeholder.cssselect("i.fa-id-badge")), 0,
+            "fa-regular fa-id-badge must be gone from kit-bag-placeholder",
+        )
+
+    def test_polarized_equipped_deck_tooltip_has_x2_decoration(self):
+        """Same (x2) decoration as the gameboard applet — polarized decks
+        signal segment-doubling in the tooltip card-count line via --terUser
+        `.tt-x2` span. Element-presence assertion (the literal `×2` content
+        is exercised by the parent template; this test only locks the conditional
+        render on `is_polarized`)."""
+        import lxml.html
+        response = self.client.get(self.url)
+        parsed = lxml.html.fromstring(response.content)
+        deck = parsed.cssselect(".kit-bag-deck")[0]
+        # Earthman is auto-equipped + is_polarized=True per A.0 migration.
+        self.assertEqual(
+            len(deck.cssselect(".tt-x2")), 1,
+            "Polarized equipped deck must render .tt-x2 decoration in kit-bag tooltip",
+        )
+
+
 class ToggleDashAppletsViewTest(TestCase):
     def setUp(self):
         self.user = User.objects.create(email="disco@test.io")
@@ -619,13 +727,13 @@ class SkySaveViewTest(TestCase):
         self.assertAlmostEqual(self.user.sky_chart_data["houses"]["asc"], 123.4)
 
 
-class SkyNatusDataViewTest(TestCase):
+class SkyDataViewTest(TestCase):
     def setUp(self):
         self.user = User.objects.create(email="disco@test.io")
         self.client.force_login(self.user)
 
     def test_returns_stored_chart_with_asc_preserved(self):
-        """sky_natus_data returns sky_chart_data — asc must match what was saved."""
+        """sky_data returns sky_chart_data — asc must match what was saved."""
         stored = {
             "planets": {},
             "houses": {"cusps": [float(i * 30) for i in range(12)], "asc": 236.1, "mc": 159.1},
@@ -651,3 +759,114 @@ class SkyNatusDataViewTest(TestCase):
         self.client.logout()
         response = self.client.get("/dashboard/sky/data")
         self.assertRedirects(response, "/?next=/dashboard/sky/data", fetch_redirect_response=False)
+
+
+class SetPronounsViewTest(TestCase):
+    def setUp(self):
+        self.user = User.objects.create(email="they@test.io")
+        self.client.force_login(self.user)
+        self.url = reverse("set_pronouns")
+
+    def test_post_valid_choice_persists_on_user(self):
+        response = self.client.post(self.url, data={"pronouns": "misogyny"})
+        self.assertEqual(response.status_code, 204)
+        self.user.refresh_from_db()
+        self.assertEqual(self.user.pronouns, "misogyny")
+
+    def test_post_each_valid_choice(self):
+        """Every PRONOUN_TABLE key persists. Note: bawlmorese also triggers the
+        Baltimorean Note-unlock JSON response (status 200) on first call —
+        covered separately by SetPronounsBawlmoreseUnlockTest. Here we just
+        confirm the user.pronouns write lands for each choice."""
+        for key in ("pluralism", "bawlmorese", "misogyny", "misandry", "misanthropy"):
+            with self.subTest(key=key):
+                self.client.post(self.url, data={"pronouns": key})
+                self.user.refresh_from_db()
+                self.assertEqual(self.user.pronouns, key)
+
+    def test_post_invalid_choice_returns_400_and_does_not_change_user(self):
+        original = self.user.pronouns
+        response = self.client.post(self.url, data={"pronouns": "bogus"})
+        self.assertEqual(response.status_code, 400)
+        self.user.refresh_from_db()
+        self.assertEqual(self.user.pronouns, original)
+
+    def test_get_returns_405(self):
+        response = self.client.get(self.url)
+        self.assertEqual(response.status_code, 405)
+
+    def test_requires_login(self):
+        self.client.logout()
+        response = self.client.post(self.url, data={"pronouns": "misogyny"})
+        self.assertEqual(response.status_code, 302)
+
+
+class SetPronounsBawlmoreseUnlockTest(TestCase):
+    """First-time selection of `pronouns = bawlmorese` grants the Baltimorean
+    Note + returns a Brief banner payload (similar to sky_save's stargazer
+    unlock). Subsequent selections are idempotent — no new Note, no new
+    Brief, status 204 like other pronoun choices."""
+
+    def setUp(self):
+        self.user = User.objects.create(email="aaron@bawlmore.io")
+        self.client.force_login(self.user)
+        self.url = reverse("set_pronouns")
+
+    def test_first_bawlmorese_returns_200_with_brief_json(self):
+        response = self.client.post(self.url, data={"pronouns": "bawlmorese"})
+        self.assertEqual(response.status_code, 200)
+        data = response.json()
+        self.assertIn("brief", data)
+        self.assertIsNotNone(data["brief"])
+
+    def test_first_bawlmorese_grants_baltimorean_note(self):
+        self.client.post(self.url, data={"pronouns": "bawlmorese"})
+        self.assertTrue(
+            Note.objects.filter(user=self.user, slug="baltimorean").exists()
+        )
+
+    def test_brief_payload_carries_baltimorean_title(self):
+        response = self.client.post(self.url, data={"pronouns": "bawlmorese"})
+        brief = response.json()["brief"]
+        self.assertEqual(brief["title"], "Baltimorean")
+
+    def test_brief_payload_square_url_jumps_to_my_notes(self):
+        """NOTE_UNLOCK Briefs carry a `square_url` pointing at /billboard/my-notes/
+        so the banner's `?` square jumps straight to the user's Note list."""
+        response = self.client.post(self.url, data={"pronouns": "bawlmorese"})
+        brief = response.json()["brief"]
+        self.assertEqual(brief["square_url"], "/billboard/my-notes/")
+
+    def test_second_bawlmorese_is_idempotent_no_new_note(self):
+        self.client.post(self.url, data={"pronouns": "bawlmorese"})
+        self.client.post(self.url, data={"pronouns": "bawlmorese"})
+        self.assertEqual(
+            Note.objects.filter(user=self.user, slug="baltimorean").count(), 1
+        )
+
+    def test_second_bawlmorese_returns_204(self):
+        """No fresh Brief on the repeat call — status returns to the no-payload
+        204 that other pronoun choices use."""
+        self.client.post(self.url, data={"pronouns": "bawlmorese"})
+        response = self.client.post(self.url, data={"pronouns": "bawlmorese"})
+        self.assertEqual(response.status_code, 204)
+
+    def test_non_bawlmorese_choice_does_not_grant_baltimorean(self):
+        self.client.post(self.url, data={"pronouns": "misogyny"})
+        self.assertFalse(
+            Note.objects.filter(user=self.user, slug="baltimorean").exists()
+        )
+
+    def test_non_bawlmorese_choice_still_returns_204(self):
+        response = self.client.post(self.url, data={"pronouns": "misogyny"})
+        self.assertEqual(response.status_code, 204)
+
+    def test_bawlmorese_after_other_choice_still_grants_note(self):
+        """User picks misogyny first, then bawlmorese — the first bawlmorese
+        click is still the unlock moment regardless of prior pronoun history."""
+        self.client.post(self.url, data={"pronouns": "misogyny"})
+        response = self.client.post(self.url, data={"pronouns": "bawlmorese"})
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(
+            Note.objects.filter(user=self.user, slug="baltimorean").exists()
+        )

src/apps/dashboard/tests/integrated/test_wallet_views.py

@@ -40,12 +40,134 @@ class WalletViewTest(TestCase):
     def test_wallet_page_shows_stripe_payment_element(self):
         [_] = self.parsed.cssselect("#id_stripe_payment_element")
 
-    def test_wallet_page_shows_tithe_token_shop(self):
+    # Note: the legacy `#id_tithe_token_shop` HTML in Balances was
-        [_] = self.parsed.cssselect("#id_tithe_token_shop")
+    # superseded by the dedicated Shop applet in Chunk 5 of
+    # [[project-wallet-shop-expansion]]. Shop-applet coverage lives in
+    # `WalletTokensAppletAllTrinketsVisibleTest` below + `test_shop_models.py`
+    # + `test_shop_views.py`.
 
-    def test_tithe_token_shop_shows_bundle(self):
+
-        bundles = self.parsed.cssselect("#id_tithe_token_shop .token-bundle")
+class WalletTokensAppletAllTrinketsVisibleTest(TestCase):
-        self.assertGreater(len(bundles), 0)
+    """Chunk 1 of the Shop applet rollout (2026-05-22) — the Tokens applet
+    in `wallet.html` must show every owned trinket-as-token type at once.
+    Pre-Chunk-1 the template's `{% if pass_token %} ... {% elif band %}
+    ... {% elif coin %}` chain hid two of the three from any user holding
+    a higher-priority trinket — bad UX since all three are usable at the
+    gate (per [[feedback-equip-slot-gates-trinket-use]], the user picks
+    WHICH one fires via the equip slot)."""
+
+    def setUp(self):
+        self.user = User.objects.create(email="multitoken@test.io", is_staff=True)
+        # Auto-COIN (equipped) + FREE created by post_save signal; PASS auto-
+        # granted by the is_staff branch of the same signal. Add the rest.
+        Token.objects.create(user=self.user, token_type=Token.BAND)
+        Token.objects.create(user=self.user, token_type=Token.CARTE)
+        Token.objects.create(user=self.user, token_type=Token.TITHE)
+        self.client.force_login(self.user)
+        response = self.client.get("/dashboard/wallet/")
+        self.parsed = lxml.html.fromstring(response.content)
+
+    def test_wallet_shows_pass_token(self):
+        [_] = self.parsed.cssselect("#id_pass_token")
+
+    def test_wallet_shows_band_token(self):
+        [_] = self.parsed.cssselect("#id_band_token")
+
+    def test_wallet_shows_coin_on_a_string(self):
+        [_] = self.parsed.cssselect("#id_coin_on_a_string")
+
+    def test_wallet_shows_carte_token(self):
+        [_] = self.parsed.cssselect("#id_carte_token")
+
+    def test_wallet_shows_free_token(self):
+        [_] = self.parsed.cssselect("#id_free_token")
+
+    def test_wallet_shows_tithe_token(self):
+        [_] = self.parsed.cssselect("#id_tithe_token")
+
+    def test_view_context_passes_carte(self):
+        """Defense-in-depth: not just the template but the view context too —
+        a renamed/refactored template should still receive `carte` in ctx."""
+        response = self.client.get("/dashboard/wallet/")
+        self.assertEqual(response.context["carte"].token_type, Token.CARTE)
+
+    def test_view_context_passes_band(self):
+        response = self.client.get("/dashboard/wallet/")
+        self.assertEqual(response.context["band"].token_type, Token.BAND)
+
+    def test_non_staff_user_with_carte_still_sees_carte(self):
+        """CARTE has no `is_staff` gating (unlike PASS) — a regular gamer
+        holding a CARTE must see it in the Tokens applet."""
+        non_staff = User.objects.create(email="grunt@test.io")
+        Token.objects.create(user=non_staff, token_type=Token.CARTE)
+        self.client.force_login(non_staff)
+        response = self.client.get("/dashboard/wallet/")
+        parsed = lxml.html.fromstring(response.content)
+        [_] = parsed.cssselect("#id_carte_token")
+
+
+class WalletAppletOrderTest(TestCase):
+    """The wallet row renders Shop first, then Balances/Tokens/Payment in
+    their historical insertion order — pinned via `Applet.display_order`
+    (lower = earlier; default 100 + PK tie-break preserves the legacy
+    order for the rest). Bug-prevention pin: a future migration that
+    renames or reseeds applets must keep wallet-shop at order < 100.
+    See [[project-wallet-shop-expansion]] for the locked layout spec."""
+
+    def setUp(self):
+        self.user = User.objects.create(email="layout@test.io")
+        self.client.force_login(self.user)
+
+    def test_shop_applet_renders_first_in_wallet_row(self):
+        response = self.client.get("/dashboard/wallet/")
+        html = response.content.decode()
+        shop_pos = html.find('id="id_wallet_shop"')
+        balances_pos = html.find('id="id_wallet_balances"')
+        tokens_pos = html.find('id_writs_balance')  # inside balances applet
+        # Shop's id_wallet_shop appears before Balances' id_wallet_balances
+        self.assertGreater(shop_pos, 0)
+        self.assertGreater(balances_pos, 0)
+        self.assertLess(shop_pos, balances_pos)
+        self.assertLess(shop_pos, tokens_pos)
+
+    def test_shop_applet_first_in_context_list(self):
+        """View-context shape pin: `applets` is a list ordered Shop-first."""
+        response = self.client.get("/dashboard/wallet/")
+        slugs = [e["applet"].slug for e in response.context["applets"]]
+        self.assertEqual(slugs[0], "wallet-shop")
+
+
+class WalletPassTokenVisibilityTest(TestCase):
+    """PASS is admin-only — the model guard blocks bogus rows from existing
+    for non-staff users, but defend the wallet surface too so a future
+    code path that bypasses the model (eg. raw SQL backfill) doesn't
+    silently leak the trinket into a non-admin's view."""
+
+    def test_pass_token_in_context_for_staff(self):
+        user = User.objects.create(email="staff@test.io", is_staff=True)
+        self.client.force_login(user)
+        response = self.client.get("/dashboard/wallet/")
+        self.assertIsNotNone(response.context["pass_token"])
+
+    def test_pass_token_absent_for_non_staff(self):
+        user = User.objects.create(email="reg@test.io")
+        self.client.force_login(user)
+        response = self.client.get("/dashboard/wallet/")
+        self.assertIsNone(response.context["pass_token"])
+
+    def test_pass_token_absent_in_htmx_toggle_partial_for_non_staff(self):
+        Applet.objects.get_or_create(
+            slug="wallet-tokens",
+            defaults={"name": "Wallet Tokens", "grid_cols": 3, "grid_rows": 3, "context": "wallet"},
+        )
+        user = User.objects.create(email="reg2@test.io")
+        self.client.force_login(user)
+        response = self.client.post(
+            "/dashboard/wallet/toggle-applets",
+            {"applets": ["wallet-tokens"]},
+            HTTP_HX_REQUEST="true",
+        )
+        self.assertIsNone(response.context["pass_token"])
 
 
 class WalletViewAppletContextTest(TestCase):

src/apps/dashboard/tests/unit/test_forms.py

@@ -1,6 +1,6 @@
 from django.test import SimpleTestCase
 
-from apps.dashboard.forms import (
+from apps.billboard.forms import (
     EMPTY_LINE_ERROR,
     LineForm,
 )

src/apps/dashboard/tests/unit/test_models.py

@@ -1,6 +1,6 @@
 from django.test import SimpleTestCase
 
-from apps.dashboard.models import Line
+from apps.billboard.models import Line
 
 
 class SimpleLineModelTest(SimpleTestCase):

src/apps/dashboard/urls.py

@@ -2,20 +2,22 @@ from django.urls import path
 from . import views
 
 urlpatterns = [
-    path('new_post', views.new_post, name='new_post'),
+    # Post/Line CRUD has moved to apps.billboard.urls (`billboard:` namespace).
-    path('post/<uuid:post_id>/', views.view_post, name='view_post'),
-    path('post/<uuid:post_id>/share_post', views.share_post, name="share_post"),
     path('set_palette', views.set_palette, name='set_palette'),
     path('set_profile', views.set_profile, name='set_profile'),
-    path('users/<uuid:user_id>/', views.my_posts, name='my_posts'),
     path('toggle_applets', views.toggle_applets, name="toggle_applets"),
     path('wallet/', views.wallet, name='wallet'),
     path('wallet/toggle-applets', views.toggle_wallet_applets, name='toggle_wallet_applets'),
     path('wallet/setup-intent', views.setup_intent, name='setup_intent'),
     path('wallet/save-payment-method', views.save_payment_method, name='save_payment_method'),
+    path('wallet/shop/buy', views.shop_buy, name='shop_buy'),
+    path('wallet/shop/confirm', views.shop_confirm, name='shop_confirm'),
+    path('wallet/shop/claim', views.shop_claim_free, name='shop_claim_free'),
     path('kit-bag/', views.kit_bag, name='kit_bag'),
     path('sky/', views.sky_view, name='sky'),
     path('sky/preview', views.sky_preview, name='sky_preview'),
     path('sky/save', views.sky_save, name='sky_save'),
-    path('sky/data', views.sky_natus_data, name='sky_natus_data'),
+    path('sky/delete', views.sky_delete, name='sky_delete'),
+    path('sky/data', views.sky_data, name='sky_data'),
+    path('set-pronouns', views.set_pronouns, name='set_pronouns'),
 ]

src/apps/dashboard/views.py

@@ -9,17 +9,17 @@ from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth.decorators import login_required
 from django.db.models import Max, Q
-from django.http import HttpResponse, HttpResponseForbidden, JsonResponse
+from django.http import HttpResponse, HttpResponseForbidden, HttpResponseRedirect, JsonResponse
 from django.shortcuts import redirect, render
+from django.urls import reverse
 from django.utils import timezone
-from django.views.decorators.csrf import ensure_csrf_cookie
+from django.views.decorators.csrf import csrf_exempt, ensure_csrf_cookie
 
 from apps.applets.utils import applet_context, apply_applet_toggle
-from apps.dashboard.forms import ExistingPostLineForm, LineForm
-from apps.dashboard.models import Line, Post
 from apps.drama.models import Note
+from apps.epic.models import DeckVariant
 from apps.epic.utils import _compute_distinctions
-from apps.lyric.models import PaymentMethod, Token, User, Wallet
+from apps.lyric.models import PaymentMethod, Purchase, ShopItem, Token, User, Wallet, is_reserved_username
 
 
 APPLET_ORDER = ["wallet", "username", "palette"]
@@ -39,11 +39,14 @@ _PALETTE_DEFS = [
     {"name": "palette-inferno",        "label": "Inferno",         "locked": True},
     {"name": "palette-terrestre",      "label": "Terrestre",       "locked": True},
     {"name": "palette-celestia",       "label": "Celestia",        "locked": True},
+    {"name": "palette-baltimore",      "label": "Baltimore",       "locked": True},
+    {"name": "palette-maryland",       "label": "Maryland",        "locked": True},
 ]
 _NOTE_TITLES = {
     "stargazer": "Stargazer",
     "schizo":    "Schizo",
     "nomad":     "Nomad",
+    "baltimorean": "Baltimorean",
 }
 # Keep PALETTES as an alias used by views that don't have a request user.
 PALETTES = _PALETTE_DEFS
@@ -84,16 +87,6 @@ def _unlocked_palettes_for_user(user):
     return base
 
 
-def _recent_posts(user, limit=3):
-    return (
-        Post
-            .objects
-            .filter(Q(owner=user) | Q(shared_with=user))
-            .annotate(last_line=Max('lines__id'))
-            .order_by('-last_line')
-            .distinct()[:limit]
-    )
-
 def home_page(request):
     context = {
         "palettes": _palettes_for_user(request.user),
@@ -101,64 +94,33 @@ def home_page(request):
     }
     if request.user.is_authenticated:
         context["applets"] = applet_context(request.user, "dashboard")
+        # My Wallet applet — show all trinkets (PASS/BAND/CARTE/COIN) + stacked
+        # Free + Tithe tokens (badge count) + Writs placeholder. Trinkets COPY
+        # the Game Kit applet's tooltip + DON/DOFF wiring so the user can equip
+        # from either surface; Free + Tithe tokens MOVED off the Game Kit applet
+        # since they aren't equippable (user spec 2026-05-25 PM).
+        user = request.user
+        free_tokens = list(user.tokens.filter(
+            token_type=Token.FREE, expires_at__gt=timezone.now()
+        ).order_by("expires_at"))
+        tithe_tokens = list(user.tokens.filter(token_type=Token.TITHE))
+        context.update({
+            "coin": user.tokens.filter(token_type=Token.COIN).first(),
+            "pass_token": user.tokens.filter(token_type=Token.PASS).first() if user.is_staff else None,
+            "band": user.tokens.filter(token_type=Token.BAND).first(),
+            "carte": user.tokens.filter(token_type=Token.CARTE).first(),
+            "free_tokens": free_tokens,
+            "tithe_tokens": tithe_tokens,
+            "free_count": len(free_tokens),
+            "tithe_count": len(tithe_tokens),
+            "equipped_trinket_id": user.equipped_trinket_id,
+        })
     return render(request, "apps/dashboard/home.html", context)
 
-def new_post(request):
-    form = LineForm(data=request.POST)
-    if form.is_valid():
-        nupost = Post.objects.create()
-        if request.user.is_authenticated:
-            nupost.owner = request.user
-            nupost.save()
-        form.save(for_post=nupost)
-        return redirect(nupost)
-    else:
-        context = {
-            "form": form,
-            "page_class": "page-billboard",
-        }
-        if request.user.is_authenticated:
-            context["applets"] = applet_context(request.user, "billboard")
-            context["recent_posts"] = _recent_posts(request.user)
-        return render(request, "apps/billboard/billboard.html", context)
 
-def view_post(request, post_id):
+# Post / Line CRUD lives in apps.billboard.views since the Post + Line models
-    our_post = Post.objects.get(id=post_id)
+# moved to apps.billboard.models.
 
-    if our_post.owner:
-        if not request.user.is_authenticated:
-            return redirect("/")
-        if request.user != our_post.owner and request.user not in our_post.shared_with.all():
-            return HttpResponseForbidden()
-
-    form = ExistingPostLineForm(for_post=our_post)
-
-    if request.method == "POST":
-        form = ExistingPostLineForm(for_post=our_post, data=request.POST)
-        if form.is_valid():
-            form.save()
-            return redirect(our_post)
-    return render(request, "apps/dashboard/post.html", {"post": our_post, "form": form})
-
-def my_posts(request, user_id):
-    owner = User.objects.get(id=user_id)
-    if not request.user.is_authenticated:
-        return redirect("/")
-    if request.user.id != owner.id:
-        return HttpResponseForbidden()
-    return render(request, "apps/dashboard/my_posts.html", {"owner": owner})
-
-def share_post(request, post_id):
-    our_post = Post.objects.get(id=post_id)
-    try:
-        recipient = User.objects.get(email=request.POST["recipient"])
-        if recipient == request.user:
-            return redirect(our_post)
-        our_post.shared_with.add(recipient)
-    except User.DoesNotExist:
-        pass
-    messages.success(request, "An invite has been sent if that address is registered.")
-    return redirect(our_post)
 
 @login_required(login_url="/")
 def set_palette(request):
@@ -175,10 +137,35 @@ def set_palette(request):
 def set_profile(request):
     if request.method == "POST":
         username = request.POST.get("username", "")
+        if is_reserved_username(username, current_user=request.user):
+            messages.error(request, "That handle is reserved.")
+            return redirect("/")
         request.user.username = username
         request.user.save(update_fields=["username"])
     return redirect("/")
 
+
+@login_required(login_url="/")
+def set_pronouns(request):
+    from django.http import HttpResponseNotAllowed
+    from apps.lyric.models import PRONOUN_TABLE
+    if request.method != "POST":
+        return HttpResponseNotAllowed(["POST"])
+    choice = request.POST.get("pronouns", "")
+    if choice not in PRONOUN_TABLE:
+        return HttpResponse(status=400)
+    request.user.pronouns = choice
+    request.user.save(update_fields=["pronouns"])
+    # bawlmorese is the pronoun-side trigger for the Baltimorean Note unlock —
+    # mirrors sky_save's stargazer grant. Grant is idempotent (grant_if_new
+    # returns no Brief on the second + later calls) so the 204 path resumes
+    # naturally after the first unlock.
+    if choice == "bawlmorese":
+        _note, _created, brief = Note.grant_if_new(request.user, "baltimorean")
+        if brief is not None:
+            return JsonResponse({"brief": brief.to_banner_dict()})
+    return HttpResponse(status=204)
+
 @login_required(login_url="/")
 def toggle_applets(request):
     checked = request.POST.getlist("applets")
@@ -190,6 +177,30 @@ def toggle_applets(request):
         })
     return redirect("home")
 
+def _shop_items_for(user):
+    """Decorate the active ShopItem catalog w. per-user availability so the
+    template can render `.btn-disabled` + 'Already owned' microtooltip
+    for `max_owned`-capped items the user already holds. Items are returned
+    in `display_order` ASC (matches the seeded `tithe-1` < `tithe-5` < `band-1`)."""
+    items = []
+    for item in ShopItem.objects.filter(active=True).order_by("display_order", "slug"):
+        item.available = item.is_available_for(user)
+        items.append(item)
+    return items
+
+
+def _free_decks_for(user):
+    """Decorate the free-in-shop DeckVariant catalog (RWS + Fiorentine) w. a
+    per-user `.owned` flag so the Shop applet renders a FREE ITEM btn for
+    decks the user hasn't claimed + an 'Already owned' pill for ones already
+    in `unlocked_decks`. Ordered by name for a stable render."""
+    unlocked_ids = set(user.unlocked_decks.values_list("pk", flat=True))
+    decks = list(DeckVariant.objects.filter(free_in_shop=True).order_by("name"))
+    for deck in decks:
+        deck.owned = deck.pk in unlocked_ids
+    return decks
+
+
 @login_required(login_url="/")
 @ensure_csrf_cookie
 def wallet(request):
@@ -197,10 +208,18 @@ def wallet(request):
         token_type=Token.FREE, expires_at__gt=timezone.now()
     ).order_by("expires_at"))
     tithe_tokens = list(request.user.tokens.filter(token_type=Token.TITHE))
+    shop_items = _shop_items_for(request.user)
+    default_pm = request.user.payment_methods.order_by("-pk").first()
     return render(request, "apps/dashboard/wallet.html", {
         "wallet": request.user.wallet,
-        "pass_token": request.user.tokens.filter(token_type=Token.PASS).first(),
+        "pass_token": request.user.tokens.filter(token_type=Token.PASS).first() if request.user.is_staff else None,
+        "band": request.user.tokens.filter(token_type=Token.BAND).first(),
         "coin": request.user.tokens.filter(token_type=Token.COIN).first(),
+        "carte": request.user.tokens.filter(token_type=Token.CARTE).first(),
+        "shop_items": shop_items,
+        "free_decks": _free_decks_for(request.user),
+        "default_payment_method_id": default_pm.stripe_pm_id if default_pm else "",
+        "stripe_publishable_key": settings.STRIPE_PUBLISHABLE_KEY,
         "free_tokens": free_tokens,
         "tithe_tokens": tithe_tokens,
         "free_count": len(free_tokens),
@@ -232,11 +251,18 @@ def toggle_wallet_applets(request):
     checked = request.POST.getlist("applets")
     apply_applet_toggle(request.user, "wallet", checked)
     if request.headers.get("HX-Request"):
+        default_pm = request.user.payment_methods.order_by("-pk").first()
         return render(request, "apps/wallet/_partials/_applets.html", {
             "applets": applet_context(request.user, "wallet"),
             "wallet": request.user.wallet,
-            "pass_token": request.user.tokens.filter(token_type=Token.PASS).first(),
+            "pass_token": request.user.tokens.filter(token_type=Token.PASS).first() if request.user.is_staff else None,
+            "band": request.user.tokens.filter(token_type=Token.BAND).first(),
             "coin": request.user.tokens.filter(token_type=Token.COIN).first(),
+            "carte": request.user.tokens.filter(token_type=Token.CARTE).first(),
+            "shop_items": _shop_items_for(request.user),
+            "free_decks": _free_decks_for(request.user),
+            "default_payment_method_id": default_pm.stripe_pm_id if default_pm else "",
+            "stripe_publishable_key": settings.STRIPE_PUBLISHABLE_KEY,
             "free_tokens": list(request.user.tokens.filter(token_type=Token.FREE)),
             "tithe_tokens": list(request.user.tokens.filter(token_type=Token.TITHE)),
         })
@@ -271,9 +297,169 @@ def save_payment_method(request):
     return JsonResponse({"last4": pm.card.last4, "brand": pm.card.brand})
 
 
+# ── Shop: PaymentIntent flow ─────────────────────────────────────────────────
+# Three endpoints split fulfillment responsibility:
+#   /shop/buy     creates a Purchase (PENDING) + a Stripe PaymentIntent.
+#                 Returns client_secret so Stripe.js can confirmCardPayment
+#                 (handles 3DS natively).
+#   /shop/confirm sync follow-up after Stripe.js confirms client-side. Pulls
+#                 PI status from Stripe; if SUCCEEDED, calls Purchase.fulfill()
+#                 immediately (faster UX than waiting for the webhook round-trip).
+#   /stripe/webhook async fulfillment from Stripe's webhook delivery. Same
+#                 Purchase.fulfill() call — whichever (confirm or webhook)
+#                 lands first wins; the other becomes a no-op via fulfill()'s
+#                 idempotent guard.
+#
+# Decisions locked 2026-05-21 in [[project-wallet-shop-expansion]]:
+#   * Webhook is THE authoritative source for fulfillment (resilient to 3DS,
+#     network drops, browser closes during checkout).
+#   * Confirm endpoint is a UX-speedup belt-and-suspenders; never required.
+#   * Webhook idempotency via Purchase.fulfill()'s status==SUCCEEDED guard.
+#   * No STRIPE_LIVE_MODE setting — env-var swap is all that's needed.
+
+
+@login_required(login_url="/")
+def shop_buy(request):
+    """Create a Stripe PaymentIntent + a PENDING Purchase row.
+
+    Body: `shop_item_slug` (form-encoded).
+    Returns: 200 `{client_secret, purchase_id}` on success;
+             402 if the user has no saved PaymentMethod;
+             404 if the slug doesn't match an active ShopItem;
+             409 if the item's max_owned cap is reached for this user.
+    """
+    stripe.api_key = settings.STRIPE_SECRET_KEY
+    slug = request.POST.get("shop_item_slug", "")
+    item = ShopItem.objects.filter(slug=slug, active=True).first()
+    if item is None:
+        return HttpResponse(status=404)
+    if not item.is_available_for(request.user):
+        return HttpResponse(status=409)
+    pm = request.user.payment_methods.order_by("-pk").first()
+    if pm is None:
+        return HttpResponse(status=402)
+    intent = stripe.PaymentIntent.create(
+        amount=item.price_cents,
+        currency="usd",
+        customer=request.user.stripe_customer_id,
+        payment_method=pm.stripe_pm_id,
+        # `automatic_payment_methods` so Stripe.js picks the right confirm
+        # method (cards, wallets, etc.) without us hard-coding payment-method-
+        # type plumbing. `allow_redirects=never` keeps the 3DS challenge in
+        # the same window — Stripe.js handles the modal natively.
+        automatic_payment_methods={"enabled": True, "allow_redirects": "never"},
+        metadata={
+            # Webhook handler looks up the Purchase by this on
+            # `payment_intent.succeeded`. Belt-and-suspenders w. looking up
+            # by `stripe_payment_intent_id` (also unique).
+            "purchase_id": "_pending_",  # overwritten after Purchase.save() below
+        },
+    )
+    purchase = Purchase.objects.create(
+        user=request.user,
+        shop_item=item,
+        stripe_payment_intent_id=intent.id,
+        amount_cents=item.price_cents,
+        granted_writs=item.granted_writs,
+    )
+    # Now we have purchase.pk — backfill the metadata on the PI so the
+    # webhook handler can resolve back to it.
+    stripe.PaymentIntent.modify(
+        intent.id, metadata={"purchase_id": str(purchase.pk)},
+    )
+    return JsonResponse({
+        "client_secret": intent.client_secret,
+        "purchase_id": purchase.pk,
+    })
+
+
+@login_required(login_url="/")
+def shop_confirm(request):
+    """Sync follow-up after Stripe.js confirms client-side. Polls the PI
+    once + fulfills if SUCCEEDED. Idempotent w. the webhook handler via
+    `Purchase.fulfill()`'s status guard.
+
+    Body: `purchase_id` (form-encoded).
+    Returns: 200 always (sync fulfillment is best-effort; webhook is
+             authoritative). 404 if the purchase doesn't belong to this user.
+    """
+    stripe.api_key = settings.STRIPE_SECRET_KEY
+    purchase_id = request.POST.get("purchase_id")
+    purchase = Purchase.objects.filter(
+        pk=purchase_id, user=request.user,
+    ).first()
+    if purchase is None:
+        return HttpResponse(status=404)
+    if purchase.status != Purchase.SUCCEEDED:
+        intent = stripe.PaymentIntent.retrieve(purchase.stripe_payment_intent_id)
+        if intent.status == "succeeded":
+            purchase.fulfill()
+    return JsonResponse({"status": purchase.status})
+
+
+@login_required(login_url="/")
+def shop_claim_free(request):
+    """Claim a free ($0) deck from the Shop applet — adds the DeckVariant to
+    the user's `unlocked_decks` so it renders in the Game Kit applet. No
+    Stripe, no Purchase row (free decks aren't paid goods).
+
+    Body: `deck_slug` (form-encoded).
+    Returns: 200 `{owned: true, deck_name}` on claim or re-claim (M2M add is
+             idempotent); 404 if the slug isn't a `free_in_shop` deck — the
+             `free_in_shop` filter is the guard that stops this $0 endpoint
+             from unlocking paid/auto-granted decks (eg Earthman).
+    """
+    slug = request.POST.get("deck_slug", "")
+    deck = DeckVariant.objects.filter(slug=slug, free_in_shop=True).first()
+    if deck is None:
+        return HttpResponse(status=404)
+    request.user.unlocked_decks.add(deck)
+    return JsonResponse({"owned": True, "deck_name": deck.name})
+
+
+@csrf_exempt
+def stripe_webhook(request):
+    """Stripe webhook listener. Verifies signature against
+    `STRIPE_WEBHOOK_SECRET`; on `payment_intent.succeeded` calls
+    `Purchase.fulfill()` (idempotent w. `/shop/confirm`).
+
+    Always returns 2xx (even on unknown event types or already-fulfilled
+    purchases) — Stripe retries on 5xx, which would just deliver the same
+    event repeatedly. 4xx is reserved for signature mismatch (a genuine
+    auth failure that Stripe should NOT retry).
+    """
+    stripe.api_key = settings.STRIPE_SECRET_KEY
+    payload = request.body
+    sig_header = request.headers.get("Stripe-Signature", "")
+    try:
+        event = stripe.Webhook.construct_event(
+            payload, sig_header, settings.STRIPE_WEBHOOK_SECRET,
+        )
+    except (ValueError, Exception) as e:
+        # ValueError = invalid payload; SignatureVerificationError = bad sig.
+        # Either way, refuse — Stripe will alert if it can't deliver.
+        if isinstance(e, ValueError) or "Signature" in type(e).__name__:
+            return HttpResponse(status=400)
+        raise
+    if event["type"] == "payment_intent.succeeded":
+        intent = event["data"]["object"]
+        purchase_id = intent.get("metadata", {}).get("purchase_id")
+        purchase = None
+        if purchase_id and purchase_id.isdigit():
+            purchase = Purchase.objects.filter(pk=int(purchase_id)).first()
+        # Fall-back lookup by PI ID in case metadata's missing for any reason.
+        if purchase is None:
+            purchase = Purchase.objects.filter(
+                stripe_payment_intent_id=intent.get("id", ""),
+            ).first()
+        if purchase is not None:
+            purchase.fulfill()
+    return HttpResponse(status=200)
+
+
 # ── My Sky (personal natal chart) ────────────────────────────────────────────
 
-def _sky_natus_preview(request):
+def _sky_preview_data(request):
     """Shared preview logic — proxies to PySwiss, no DB writes."""
     date_str = request.GET.get('date')
     time_str = request.GET.get('time', '12:00')
@@ -360,13 +546,13 @@ def sky_view(request):
         "saved_birth_lat":   request.user.sky_birth_lat,
         "saved_birth_lon":   request.user.sky_birth_lon,
         "saved_birth_tz":    request.user.sky_birth_tz,
-        "page_class":  "page-sky",
+        "page_class":  "page-sky" + (" sky-saved" if chart_data else ""),
     })
 
 
 @login_required(login_url="/")
 def sky_preview(request):
-    return _sky_natus_preview(request)
+    return _sky_preview_data(request)
 
 
 @login_required(login_url="/")
@@ -411,22 +597,36 @@ def sky_save(request):
         'sky_birth_place', 'sky_birth_tz', 'sky_house_system', 'sky_chart_data',
     ])
 
-    note_payload = None
+    brief_payload = None
     if user.sky_chart_data:
-        note, created = Note.grant_if_new(user, "stargazer")
+        note, created, brief = Note.grant_if_new(user, "stargazer")
-        if created:
+        if created and brief is not None:
-            note_payload = {
+            brief_payload = brief.to_banner_dict()
-                "slug":        note.slug,
-                "title":       "Stargazer",
-                "description": "You saved your first personal sky chart.",
-                "earned_at":   note.earned_at.isoformat(),
-            }
 
-    return JsonResponse({"saved": True, "note": note_payload})
+    return JsonResponse({"saved": True, "brief": brief_payload})
 
 
 @login_required(login_url="/")
-def sky_natus_data(request):
+def sky_delete(request):
+    if request.method != 'POST':
+        return HttpResponse(status=405)
+    user = request.user
+    user.sky_birth_dt    = None
+    user.sky_birth_lat   = None
+    user.sky_birth_lon   = None
+    user.sky_birth_place = ''
+    user.sky_birth_tz    = ''
+    user.sky_house_system = User._meta.get_field('sky_house_system').default
+    user.sky_chart_data  = None
+    user.save(update_fields=[
+        'sky_birth_dt', 'sky_birth_lat', 'sky_birth_lon',
+        'sky_birth_place', 'sky_birth_tz', 'sky_house_system', 'sky_chart_data',
+    ])
+    return HttpResponseRedirect(reverse('sky'))
+
+
+@login_required(login_url="/")
+def sky_data(request):
     user = request.user
     if not user.sky_chart_data:
         return HttpResponse(status=404)

src/apps/drama/migrations/0004_alter_gameevent_verb.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0 on 2026-05-08 21:11
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('drama', '0003_grant_super_notes_to_existing_superusers'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='gameevent',
+            name='verb',
+            field=models.CharField(choices=[('room_created', 'Room created'), ('slot_reserved', 'Gate slot reserved'), ('slot_filled', 'Gate slot filled'), ('slot_returned', 'Gate slot returned'), ('slot_released', 'Gate slot released'), ('invite_sent', 'Invite sent'), ('role_select_started', 'Role select started'), ('role_selected', 'Role selected'), ('roles_revealed', 'Roles revealed'), ('sig_ready', 'Sig claim staked'), ('sig_unready', 'Sig claim withdrawn'), ('sky_saved', 'Sky saved')], max_length=30),
+        ),
+    ]

src/apps/drama/models.py

@@ -1,11 +1,12 @@
 from django.conf import settings
 from django.db import models
 
-# ── Default gender-neutral pronouns (Baltimore original) ──────────────────────
+from apps.lyric.models import resolve_pronouns
-# Later: replace with per-actor lookup when User model gains a pronouns field.
+
-PRONOUN_SUBJ = "yo"
+
-PRONOUN_OBJ  = "yo"
+def _actor_pronouns(actor):
-PRONOUN_POSS = "yos"
+    """Return (subj, obj, poss) for an event actor; default = pluralism when None."""
+    return resolve_pronouns(getattr(actor, "pronouns", None) if actor else None)
 
 
 class GameEvent(models.Model):
@@ -23,6 +24,8 @@ class GameEvent(models.Model):
     # Sig Select phase
     SIG_READY = "sig_ready"
     SIG_UNREADY = "sig_unready"
+    # Sky Select phase
+    SKY_SAVED = "sky_saved"
 
     VERB_CHOICES = [
         (ROOM_CREATED, "Room created"),
@@ -36,6 +39,7 @@ class GameEvent(models.Model):
         (ROLES_REVEALED, "Roles revealed"),
         (SIG_READY, "Sig claim staked"),
         (SIG_UNREADY, "Sig claim withdrawn"),
+        (SKY_SAVED, "Sky saved"),
     ]
 
     room = models.ForeignKey(
@@ -67,12 +71,29 @@ class GameEvent(models.Model):
             return f"deposits a {token} for slot {slot} (expires in {days} days)."
         if self.verb == self.SLOT_RESERVED:
             return "reserves a seat"
-        if self.verb == self.SLOT_RETURNED:
+        if self.verb in (self.SLOT_RETURNED, self.SLOT_RELEASED):
-            return "withdraws from the gate"
+            # Symmetric counterpart to SLOT_FILLED's "deposits a {token} for
-        if self.verb == self.SLOT_RELEASED:
+            # slot {#} …" — same shape so the redact-pair (strikethrough on
-            return f"releases slot {d.get('slot_number', '?')}"
+            # the prior deposit, new withdraw entry below it) reads as a
+            # mirror image in the room scroll. User-spec 2026-05-26 sprint
+            # A.8. SLOT_RETURNED + SLOT_RELEASED both render w. this prose;
+            # the verb distinction stays in the data layer (different paths
+            # trigger them — full token return vs. per-slot CARTE release).
+            _token_names = {
+                "coin": "Coin-on-a-String", "Free": "Free Token",
+                "tithe": "Tithe Token", "pass": "Backstage Pass", "carte": "Carte Blanche",
+            }
+            code = d.get("token_type", "token")
+            token = d.get("token_display") or _token_names.get(code, code)
+            slot = d.get("slot_number", "?")
+            _, _, poss = _actor_pronouns(self.actor)
+            return f"withdraws {poss} {token} from slot {slot}."
         if self.verb == self.ROOM_CREATED:
-            return "opens this room"
+            # First scroll log on a fresh room — system-authored greeting
+            # (actor=None upstream). Format intentionally drops the actor
+            # prefix the rest of the verbs use; the room's title is what
+            # the welcome line celebrates.
+            return f"Welcome to {self.room.name}!"
         if self.verb == self.INVITE_SENT:
             return "sends an invitation"
         if self.verb == self.ROLE_SELECT_STARTED:
@@ -90,7 +111,8 @@ class GameEvent(models.Model):
                 ordinal = _ordinals[_chair_order.index(code)]
             except ValueError:
                 ordinal = "?"
-            return f"assumes {ordinal} Chair; yo will start the game as the {role}."
+            subj, _, _ = _actor_pronouns(self.actor)
+            return f"assumes {ordinal} Chair; {subj} will start the game as the {role}."
         if self.verb == self.ROLES_REVEALED:
             return "All roles assigned"
         if self.verb == self.SIG_READY:
@@ -102,9 +124,36 @@ class GameEvent(models.Model):
                 abbrev = f" ({corner_rank}{icon_html})"
             else:
                 abbrev = ""
-            return f"embodies as {PRONOUN_POSS} Significator the {card_name}{abbrev}."
+            # Trump cards ("The Schizo", "The Nomad", "The Wanderer") drop
+            # their "The " in this rendering: the prose template already
+            # supplies "the", and a levity/gravity qualifier (e.g. "Engraven"
+            # in "Engraven The Nomad") needs to butt up against the proper name.
+            card_name = card_name.replace("The ", "", 1)
+            _, _, poss = _actor_pronouns(self.actor)
+            return f"embodies as {poss} Significator the {card_name}{abbrev}."
         if self.verb == self.SIG_UNREADY:
-            return f"disembodies {PRONOUN_POSS} Significator."
+            _, _, poss = _actor_pronouns(self.actor)
+            return f"disembodies {poss} Significator."
+        if self.verb == self.SKY_SAVED:
+            _, obj, poss = _actor_pronouns(self.actor)
+            caps = list(d.get("top_capacitors") or [])
+            if not caps:
+                return f"beholds the skyscape of {poss} birth."
+            if len(caps) == 1:
+                return (
+                    f"beholds the skyscape of {poss} birth, "
+                    f"which yields {obj} a unique {caps[0]} capacity."
+                )
+            # Tied highest: "equal X and Y capacities" (2-way) or
+            # "equal X, Y, and Z capacities" (3+, Oxford comma).
+            if len(caps) == 2:
+                joined = f"{caps[0]} and {caps[1]}"
+            else:
+                joined = ", ".join(caps[:-1]) + f", and {caps[-1]}"
+            return (
+                f"beholds the skyscape of {poss} birth, "
+                f"which yields {obj} equal {joined} capacities."
+            )
         return self.verb
 
     @property
@@ -176,8 +225,18 @@ _NOTE_DISPLAY = {
     "nomad":        {"greeting": "Welcome,",                                   "title": "Nomad"},
     "super-schizo": {"greeting": "21<span class='ord'>st</span> Century",      "title": "Schizoid Man"},
     "super-nomad":  {"greeting": "Howdy,",                                     "title": "Stranger"},
+    "baltimorean":  {"greeting": "Ayo,",                                       "title": "Ard!", "card_title": "Baltimorean"},
 }
 
+# Note slugs whose grant prose uses the long admin format ("The administration
+# recognizes…") rather than the standard "Look!—new Note unlocked…" format.
+# Any slug not in this set gets the standard format.
+_ADMIN_NOTE_SLUGS = frozenset({"super-schizo", "super-nomad"})
+
+# Hardcoded title for the per-user "Note unlocks" Post — supplants any
+# first-line-glean for posts of kind=NOTE_UNLOCK.
+NOTE_UNLOCK_POST_TITLE = "Notes & recognitions"
+
 
 class Note(models.Model):
     user = models.ForeignKey(
@@ -203,10 +262,109 @@ class Note(models.Model):
     def display_greeting(self):
         return _NOTE_DISPLAY.get(self.slug, {}).get("greeting", "Welcome,")
 
+    @property
+    def card_title(self):
+        """The string shown in the my-notes card's "Title:" row. Defaults to
+        `display_title` (the don-able title — most slugs render the title you
+        DON here, e.g. "Schizoid Man" for super-schizo). Baltimorean overrides
+        so the card reads "Baltimorean" instead of the navbar-only "Ard!"
+        flair."""
+        return _NOTE_DISPLAY.get(self.slug, {}).get("card_title", self.display_title)
+
+    @property
+    def display_name(self):
+        """The Note's *name* (e.g., "Stargazer", "Super-Schizo") — the heading
+        rendered on the my-notes card. Distinct from `display_title` which is
+        the *recognition title* the user dons (e.g., "Schizoid Man" for
+        super-schizo). For all current slugs `slug.title()` recovers the right
+        casing (.title() capitalizes after non-letter chars, so "super-schizo"
+        → "Super-Schizo"); special-case in `_NOTE_DISPLAY[slug]["name"]` if a
+        future slug needs a different rendering."""
+        return _NOTE_DISPLAY.get(self.slug, {}).get("name", self.slug.title())
+
     @classmethod
     def grant_if_new(cls, user, slug):
+        """Grants the Note if it doesn't already exist on the user; on a fresh
+        grant ALSO appends a Line to the user's per-category "Notes &
+        recognitions" Post (creating the Post on first-ever unlock) and spawns
+        a Brief that FKs the appended Line. Returns ``(note, created, brief)``
+        — brief is None on idempotent re-grants. Banner-side affordances (FYI
+        navigation, my-notes square) ride on Brief.kind=NOTE_UNLOCK.
+
+        Line text dispatches by slug: admin-grant slugs (super-schizo,
+        super-nomad) use the long "The administration recognizes…" format;
+        every other slug uses the standard "Look!—new Note unlocked. {Note
+        name} recognizes {username} the {title}." format. Both wrap the Note
+        name in a `note-ref` anchor pointing at /billboard/my-notes/.
+        Author is hardcoded to the seeded `adman` User; the per-line username
+        column then attributes the Line correctly."""
         from django.utils import timezone
-        return cls.objects.get_or_create(
+
+        from apps.billboard.models import Brief, Line, Post
+        from apps.lyric.models import get_or_create_adman
+
+        note, created = cls.objects.get_or_create(
             user=user, slug=slug,
             defaults={"earned_at": timezone.now()},
         )
+        if not created:
+            return note, created, None
+
+        post, _ = Post.objects.get_or_create(
+            owner=user, kind=Post.KIND_NOTE_UNLOCK,
+            defaults={"title": NOTE_UNLOCK_POST_TITLE},
+        )
+        # Existing Note-unlock Posts (pre-0004 migration) might lack a title
+        # if they predate this code path's get_or_create defaults. Heal once.
+        if post.title != NOTE_UNLOCK_POST_TITLE:
+            post.title = NOTE_UNLOCK_POST_TITLE
+            post.save(update_fields=["title"])
+
+        # Bare-email fallback when user.username is None (no `@` prefix —
+        # the address already carries one). When username is set, use the
+        # `@handle` form. Both wrapped in .post-attribution so the CSS
+        # palette key (--quaUser) lights up the username + title combo.
+        handle = f"@{user.username}" if user.username else user.email
+        note_anchor = (
+            f'<a class="note-ref" href="/billboard/my-notes/">'
+            f'{note.display_name}</a>'
+        )
+        attr_handle = f'<span class="post-attribution">{handle}</span>'
+        attr_title  = f'<span class="post-attribution">{note.display_title}</span>'
+        if slug in _ADMIN_NOTE_SLUGS:
+            line_text = (
+                f"The administration recognizes {attr_handle} for {note_anchor}, "
+                f"which bestows the honorary title of {attr_title}. "
+                "This does not entail any additional corporate benefits."
+            )
+        else:
+            # Inline attribution reads "{handle} the {Note name}", not the
+            # don-able title. For most slugs the two coincide ("the Stargazer")
+            # but Baltimorean's title is the navbar flair "Ard!" — "the Ard!"
+            # reads oddly inline; "the Baltimorean" matches the Note name.
+            attr_combo = (
+                f'<span class="post-attribution">{handle} '
+                f'the {note.display_name}</span>'
+            )
+            line_text = (
+                f"Look!—new Note unlocked. {note_anchor} "
+                f"recognizes {attr_combo}."
+            )
+
+        # Lazy get-or-create: TransactionTestCase flushes the migration-seeded
+        # adman row, so tests that create superusers (which auto-grants
+        # super-schizo + super-nomad via the User post_save signal) need a
+        # safety net. Production migrations seed it once.
+        adman = get_or_create_adman()
+        line = Line.objects.create(
+            post=post, text=line_text, author=adman,
+            admin_solicited=True,
+        )
+        brief = Brief.objects.create(
+            owner=user,
+            post=post,
+            line=line,
+            kind=Brief.KIND_NOTE_UNLOCK,
+            title=note.display_name,
+        )
+        return note, created, brief

src/apps/drama/tests/integrated/test_models.py

@@ -56,7 +56,8 @@ class GameEventModelTest(TestCase):
                        role="PC", role_display="Player")
         prose = event.to_prose()
         self.assertIn("Player", prose)
-        self.assertIn("yo will start the game", prose)
+        # Default user pronouns = pluralism → "they".
+        self.assertIn("they will start the game", prose)
 
     # ── to_prose — SIG_READY ─────────────────────────────────────────────
 
@@ -65,7 +66,8 @@ class GameEventModelTest(TestCase):
                        card_name="Maid of Brands", corner_rank="M",
                        suit_icon="fa-wand-sparkles")
         prose = event.to_prose()
-        self.assertIn("embodies as yos Significator the Maid of Brands", prose)
+        # Default user pronouns = pluralism → "their".
+        self.assertIn("embodies as their Significator the Maid of Brands", prose)
         self.assertIn("(M", prose)
         self.assertIn("fa-wand-sparkles", prose)
 
@@ -73,15 +75,100 @@ class GameEventModelTest(TestCase):
         event = record(self.room, GameEvent.SIG_READY, actor=self.user,
                        card_name="The Wanderer", corner_rank="0", suit_icon="")
         prose = event.to_prose()
-        self.assertIn("embodies as yos Significator the The Wanderer (0)", prose)
+        # Trump card: leading "The " is stripped so qualifier (if any) butts up
+        # against the proper name and "the The Wanderer" never reads doubled.
+        self.assertIn("embodies as their Significator the Wanderer (0)", prose)
+        self.assertNotIn("the The Wanderer", prose)
         self.assertNotIn("fa-", prose)
 
+    def test_sig_ready_prose_strips_leading_the_on_qualified_trump(self):
+        # Trump card with a levity/gravity qualifier already pre-pended in
+        # card_name: must read "the Engraven Nomad", not "the Engraven The Nomad".
+        # Default actor pronouns = pluralism → "their".
+        event = record(self.room, GameEvent.SIG_READY, actor=self.user,
+                       card_name="Engraven The Nomad", corner_rank="0", suit_icon="")
+        prose = event.to_prose()
+        self.assertIn("embodies as their Significator the Engraven Nomad (0)", prose)
+        self.assertNotIn("Engraven The Nomad", prose)
+
+    def test_sig_ready_prose_uses_actor_pronouns_at_render_time(self):
+        # Bawlmorese actor → "yos"; default actor → "their"; switching
+        # the actor's pronouns updates ALL their existing prose on next render.
+        self.user.pronouns = "bawlmorese"
+        self.user.save(update_fields=["pronouns"])
+        event = record(self.room, GameEvent.SIG_READY, actor=self.user,
+                       card_name="Maid of Brands", corner_rank="M",
+                       suit_icon="fa-wand-sparkles")
+        self.assertIn("embodies as yos Significator the Maid of Brands", event.to_prose())
+        self.user.pronouns = "misogyny"
+        self.user.save(update_fields=["pronouns"])
+        # Re-fetch — the related object cache may hold the stale pronouns.
+        event.refresh_from_db()
+        self.assertIn("embodies as his Significator the Maid of Brands", event.to_prose())
+
+    def test_sig_unready_prose_uses_actor_pronouns(self):
+        self.user.pronouns = "misandry"
+        self.user.save(update_fields=["pronouns"])
+        event = record(self.room, GameEvent.SIG_UNREADY, actor=self.user)
+        self.assertIn("disembodies hers Significator", event.to_prose())
+
+    def test_role_selected_prose_uses_actor_pronouns(self):
+        self.user.pronouns = "misanthropy"
+        self.user.save(update_fields=["pronouns"])
+        event = record(self.room, GameEvent.ROLE_SELECTED, actor=self.user,
+                       role="PC", role_display="Player")
+        self.assertIn("it will start the game", event.to_prose())
+
+    # ── to_prose — SKY_SAVED ──────────────────────────────────────────────
+
+    def test_sky_saved_prose_single_capacitor(self):
+        # Default user pronouns = pluralism → "their" + "them".
+        event = record(self.room, GameEvent.SKY_SAVED, actor=self.user,
+                       top_capacitors=["Ardor"])
+        prose = event.to_prose()
+        self.assertIn(
+            "beholds the skyscape of their birth, which yields them a unique Ardor capacity.",
+            prose,
+        )
+
+    def test_sky_saved_prose_two_way_tie(self):
+        # Tied highest scores: pluralize "a unique" → "equal", join w. "and",
+        # pluralize "capacity" → "capacities".
+        event = record(self.room, GameEvent.SKY_SAVED, actor=self.user,
+                       top_capacitors=["Ardor", "Ossum"])
+        prose = event.to_prose()
+        self.assertIn(
+            "beholds the skyscape of their birth, which yields them equal Ardor and Ossum capacities.",
+            prose,
+        )
+
+    def test_sky_saved_prose_three_way_tie_uses_oxford_comma(self):
+        event = record(self.room, GameEvent.SKY_SAVED, actor=self.user,
+                       top_capacitors=["Ardor", "Ossum", "Pneuma"])
+        prose = event.to_prose()
+        self.assertIn(
+            "beholds the skyscape of their birth, which yields them equal Ardor, Ossum, and Pneuma capacities.",
+            prose,
+        )
+
+    def test_sky_saved_prose_uses_actor_pronouns(self):
+        self.user.pronouns = "bawlmorese"
+        self.user.save(update_fields=["pronouns"])
+        event = record(self.room, GameEvent.SKY_SAVED, actor=self.user,
+                       top_capacitors=["Tempo"])
+        # Bawlmorese → poss "yos", obj "yo".
+        self.assertIn(
+            "beholds the skyscape of yos birth, which yields yo a unique Tempo capacity.",
+            event.to_prose(),
+        )
+
     def test_sig_ready_prose_degrades_without_corner_rank(self):
         # Old events recorded before this change have no corner_rank key
         event = record(self.room, GameEvent.SIG_READY, actor=self.user,
                        card_name="Maid of Brands")
         prose = event.to_prose()
-        self.assertIn("embodies as yos Significator the Maid of Brands", prose)
+        # Default user pronouns = pluralism → "their".
+        self.assertIn("embodies as their Significator the Maid of Brands", prose)
         self.assertNotIn("(", prose)
 
     def test_str_without_actor_shows_system(self):
@@ -94,13 +181,33 @@ class GameEventModelTest(TestCase):
         event = record(self.room, GameEvent.SLOT_RESERVED, actor=self.user)
         self.assertEqual(event.to_prose(), "reserves a seat")
 
-    def test_slot_returned_prose(self):
+    def test_slot_returned_prose_includes_token_and_slot(self):
-        event = record(self.room, GameEvent.SLOT_RETURNED, actor=self.user)
+        # Sprint A.8 (2026-05-26): SLOT_RETURNED now mirrors SLOT_FILLED's
-        self.assertEqual(event.to_prose(), "withdraws from the gate")
+        # shape — symmetric redact-pair on the scroll. Data fields match
+        # the deposit event so the prose reads as a clean mirror.
+        event = record(
+            self.room, GameEvent.SLOT_RETURNED, actor=self.user,
+            slot_number=2, token_type="coin",
+            token_display="Coin-on-a-String",
+        )
+        prose = event.to_prose()
+        self.assertIn("withdraws", prose)
+        self.assertIn("Coin-on-a-String", prose)
+        self.assertIn("slot 2", prose)
 
-    def test_slot_released_prose_includes_slot_number(self):
+    def test_slot_released_prose_uses_unified_withdraw_shape(self):
-        event = record(self.room, GameEvent.SLOT_RELEASED, actor=self.user, slot_number=3)
+        # SLOT_RELEASED (per-slot CARTE release) shares the unified
-        self.assertIn("slot 3", event.to_prose())
+        # withdraw prose w. SLOT_RETURNED — same visual mirror of the
+        # deposit. The verb distinction stays in the data layer.
+        event = record(
+            self.room, GameEvent.SLOT_RELEASED, actor=self.user,
+            slot_number=3, token_type="carte",
+            token_display="Carte Blanche",
+        )
+        prose = event.to_prose()
+        self.assertIn("withdraws", prose)
+        self.assertIn("Carte Blanche", prose)
+        self.assertIn("slot 3", prose)
 
     def test_invite_sent_prose(self):
         event = record(self.room, GameEvent.INVITE_SENT, actor=self.user)
@@ -221,14 +328,14 @@ class NoteModelTest(TestCase):
         self.assertIn("earner@test.io", s)
 
     def test_grant_if_new_creates_on_first_call(self):
-        recog, created = Note.grant_if_new(self.user, "stargazer")
+        recog, created, _brief = Note.grant_if_new(self.user, "stargazer")
         self.assertTrue(created)
         self.assertEqual(recog.slug, "stargazer")
         self.assertIsNotNone(recog.earned_at)
 
     def test_grant_if_new_is_idempotent(self):
         Note.grant_if_new(self.user, "stargazer")
-        recog, created = Note.grant_if_new(self.user, "stargazer")
+        recog, created, _brief = Note.grant_if_new(self.user, "stargazer")
         self.assertFalse(created)
         self.assertEqual(Note.objects.count(), 1)
 
@@ -237,6 +344,6 @@ class NoteModelTest(TestCase):
             user=self.user, slug="stargazer",
             earned_at=timezone.now(), palette="palette-bardo",
         )
-        recog, created = Note.grant_if_new(self.user, "stargazer")
+        recog, created, _brief = Note.grant_if_new(self.user, "stargazer")
         self.assertFalse(created)
         self.assertEqual(recog.palette, "palette-bardo")

src/apps/drama/tests/integrated/test_note_brief.py

@@ -0,0 +1,87 @@
+"""ITs for the Brief sprint C3.a — Note.grant_if_new spawns Line + Brief.
+
+Per the per-category Post model: the user has a single "Note Unlocks" Post;
+each unlock appends a Line ("Stargazer, 5:21pm") and spawns a Brief FKing
+the appended Line. Briefs of kind=NOTE_UNLOCK live on Posts of kind=
+NOTE_UNLOCK.
+"""
+
+from django.test import TestCase
+
+from apps.billboard.models import Brief, Line, Post
+from apps.drama.models import Note
+from apps.lyric.models import User
+
+
+class GrantIfNewSpawnsBriefTest(TestCase):
+    def setUp(self):
+        self.user = User.objects.create(email="brief-grant@test.io")
+
+    def test_first_grant_creates_post_line_and_brief(self):
+        note, created, brief = Note.grant_if_new(self.user, "stargazer")
+        self.assertTrue(created)
+        self.assertIsNotNone(brief)
+        # Note Unlocks Post created on user
+        post = Post.objects.get(owner=self.user, kind=Post.KIND_NOTE_UNLOCK)
+        # Brief points at that Post + the appended Line
+        self.assertEqual(brief.post_id, post.id)
+        self.assertEqual(brief.kind, Brief.KIND_NOTE_UNLOCK)
+        self.assertTrue(brief.is_unread)
+        self.assertEqual(brief.owner, self.user)
+        # The Brief's line is one of the Post's lines
+        self.assertIn(brief.line, list(post.lines.all()))
+        # Brief title matches Note display name (the Note's name — used in the
+        # banner's title slot and inline "the {name}" attribution).
+        self.assertEqual(brief.title, note.display_name)
+
+    def test_second_grant_same_slug_returns_no_brief(self):
+        Note.grant_if_new(self.user, "stargazer")
+        note, created, brief = Note.grant_if_new(self.user, "stargazer")
+        self.assertFalse(created)
+        self.assertIsNone(brief)
+        # Still only one Brief / Line for the user (idempotent)
+        self.assertEqual(
+            Brief.objects.filter(owner=self.user, kind=Brief.KIND_NOTE_UNLOCK).count(), 1
+        )
+
+    def test_two_different_grants_share_one_post(self):
+        """Per-category Post: stargazer + schizo unlocks both append Lines to
+        the same "Notes & recognitions" Post (one growing thread)."""
+        Note.grant_if_new(self.user, "stargazer")
+        Note.grant_if_new(self.user, "schizo")
+        posts = Post.objects.filter(owner=self.user, kind=Post.KIND_NOTE_UNLOCK)
+        self.assertEqual(posts.count(), 1, "Only one Note Unlocks Post per user")
+        post = posts.first()
+        # 2 Briefs, one per unlock
+        self.assertEqual(Brief.objects.filter(post=post).count(), 2)
+        # 2 distinct Lines on the Post — one per grant. The standalone
+        # "Look! — new Note unlocked" header Line was dropped in the May-8b
+        # refactor; the standard format now embeds that text inline per Line.
+        line_texts = list(post.lines.values_list("text", flat=True))
+        self.assertEqual(len(set(line_texts)), 2)
+
+    def test_brief_line_text_includes_note_title(self):
+        _, _, brief = Note.grant_if_new(self.user, "stargazer")
+        self.assertIn("Stargazer", brief.line.text)
+
+    def test_post_kind_is_note_unlock_for_grant(self):
+        Note.grant_if_new(self.user, "stargazer")
+        post = Post.objects.get(owner=self.user, kind=Post.KIND_NOTE_UNLOCK)
+        self.assertEqual(post.kind, Post.KIND_NOTE_UNLOCK)
+
+
+class PostKindFieldTest(TestCase):
+    """Post gains a `kind` enum so the per-category lookup (e.g. find the
+    user's Note Unlocks Post) is deterministic; user-authored Posts default
+    to KIND_USER_POST."""
+
+    def test_post_default_kind_is_user_post(self):
+        u = User.objects.create(email="kind@test.io")
+        p = Post.objects.create(owner=u)
+        self.assertEqual(p.kind, Post.KIND_USER_POST)
+
+    def test_post_kind_choices_include_three_values(self):
+        choices = dict(Post._meta.get_field("kind").choices)
+        self.assertIn(Post.KIND_NOTE_UNLOCK, choices)
+        self.assertIn(Post.KIND_USER_POST, choices)
+        self.assertIn(Post.KIND_SHARE_INVITE, choices)

src/apps/drama/tests/unit/test_models.py

@@ -0,0 +1,50 @@
+from django.test import SimpleTestCase
+
+from apps.drama.models import Note
+
+
+def _note(slug):
+    n = Note()
+    n.slug = slug
+    return n
+
+
+class NoteDisplayBaltimoreanTest(SimpleTestCase):
+    """`_NOTE_DISPLAY['baltimorean']` — greeting/title combo "Ayo, Ard!" replaces
+    "Welcome, Earthman" once the user dons the Baltimorean Note (unlocked by
+    first-time `pronouns = bawlmorese` selection)."""
+
+    def test_baltimorean_display_title_is_ard(self):
+        self.assertEqual(_note("baltimorean").display_title, "Ard!")
+
+    def test_baltimorean_display_greeting_is_ayo(self):
+        self.assertEqual(_note("baltimorean").display_greeting, "Ayo,")
+
+    def test_baltimorean_display_name_is_baltimorean(self):
+        """The my-notes heading label — `.title()` of the slug recovers the
+        proper rendering for any slug without a `name` override in
+        `_NOTE_DISPLAY`. Baltimorean has no override, so this should fall
+        through to `slug.title()` → 'Baltimorean'."""
+        self.assertEqual(_note("baltimorean").display_name, "Baltimorean")
+
+    def test_baltimorean_card_title_is_baltimorean(self):
+        """The my-notes card's "Title:" row uses `card_title`, which Baltimorean
+        explicitly overrides to "Baltimorean" so the navbar-only "Ard!" flair
+        doesn't leak onto the card."""
+        self.assertEqual(_note("baltimorean").card_title, "Baltimorean")
+
+
+class NoteDisplayStargazerTest(SimpleTestCase):
+    """Smoke tests for the existing stargazer entry — pins the contract that
+    new entries follow."""
+
+    def test_stargazer_display_title_is_stargazer(self):
+        self.assertEqual(_note("stargazer").display_title, "Stargazer")
+
+    def test_stargazer_display_greeting_is_welcome(self):
+        self.assertEqual(_note("stargazer").display_greeting, "Welcome,")
+
+    def test_stargazer_card_title_falls_back_to_display_title(self):
+        """Slugs without a `card_title` override fall through to display_title —
+        for stargazer that's "Stargazer" (don-able title == Note name)."""
+        self.assertEqual(_note("stargazer").card_title, "Stargazer")

src/apps/epic/management/commands/expire_lapsed_room_seats.py

@@ -0,0 +1,35 @@
+"""Auto-BYE gamers whose room seat token cost lapsed past the renewal grace.
+
+The lazy `_expire_lapsed_seats` inside the room view / gatekeeper /
+gate-view already frees lapsed seats on every access; this command is the
+cron backstop for rooms nobody reopens — a mid-game table left idle past
+the grace window (filled_at + 2*renewal_period) would otherwise keep its
+stuck seats forever. Mirrors `delete_stale_my_sea_draws`. No flags;
+idempotent.
+
+Usage:
+    python manage.py expire_lapsed_room_seats
+"""
+from django.core.management.base import BaseCommand
+
+from apps.epic.models import GateSlot, Room
+from apps.epic.views import _expire_lapsed_seats
+
+
+class Command(BaseCommand):
+    help = "Free room seats whose token cost lapsed past the renewal grace."
+
+    def handle(self, *args, **options):
+        rooms = Room.objects.filter(
+            gate_slots__status=GateSlot.FILLED,
+            gate_slots__filled_at__isnull=False,
+        ).distinct()
+        freed = 0
+        for room in rooms:
+            before = room.gate_slots.filter(status=GateSlot.FILLED).count()
+            _expire_lapsed_seats(room)
+            if room.gate_slots.filter(status=GateSlot.FILLED).count() < before:
+                freed += 1
+        self.stdout.write(self.style.SUCCESS(
+            f"Freed lapsed seats in {freed} room{'s' if freed != 1 else ''}."
+        ))

src/apps/epic/management/commands/reset_staging_db.py

@@ -0,0 +1,110 @@
+"""Wipe the configured database and re-run all migrations from scratch.
+
+Intended for ephemeral environments (staging) where losing every user, room,
+billpost, token, etc. is acceptable. Refuses to run when DEBUG=False unless
+the operator explicitly confirms with --i-mean-it, and always prints the
+DB host before doing anything destructive.
+
+Typical staging usage from the deploy host:
+
+    docker exec -it gamearray python manage.py reset_staging_db --i-mean-it
+
+Locally (sqlite, DEBUG=True) the safety prompt is skipped:
+
+    python src/manage.py reset_staging_db
+"""
+from django.conf import settings
+from django.core.management import call_command
+from django.core.management.base import BaseCommand, CommandError
+from django.db import connection
+
+
+PROD_HOST_FRAGMENTS = ("earthmanrpg.me",)
+
+
+class Command(BaseCommand):
+    help = "Drop every table in the default DB and re-run migrations. Destructive."
+
+    def add_arguments(self, parser):
+        parser.add_argument(
+            "--i-mean-it",
+            action="store_true",
+            help="Required when DEBUG=False. Bypasses the interactive confirmation.",
+        )
+        parser.add_argument(
+            "--no-superuser",
+            action="store_true",
+            help="Skip the post-migrate ensure_superuser call.",
+        )
+
+    def handle(self, *args, **opts):
+        db_settings = settings.DATABASES["default"]
+        engine = db_settings.get("ENGINE", "")
+        host = db_settings.get("HOST") or db_settings.get("NAME") or "(unknown)"
+
+        # Refuse outright if the host name suggests production
+        if any(frag in str(host) for frag in PROD_HOST_FRAGMENTS) and not host.startswith("staging"):
+            if "staging" not in str(host):
+                raise CommandError(
+                    f"Refusing to reset DB at host={host!r} — looks like production. "
+                    "Edit PROD_HOST_FRAGMENTS in this command if you really mean it."
+                )
+
+        self.stdout.write(self.style.WARNING(
+            f"\nAbout to wipe DB:\n  ENGINE: {engine}\n  HOST/NAME: {host}\n"
+        ))
+
+        if not settings.DEBUG and not opts["i_mean_it"]:
+            raise CommandError(
+                "DEBUG=False — pass --i-mean-it to confirm. "
+                "(This is the staging-safety check; it does not bypass the prod-host refusal above.)"
+            )
+
+        if settings.DEBUG and not opts["i_mean_it"]:
+            answer = input("Type the DB host/name to confirm: ").strip()
+            if answer != str(host):
+                raise CommandError(f"Got {answer!r}, expected {str(host)!r}. Aborting.")
+
+        # Drop schema. Postgres + sqlite both honor `flush --no-input`'s
+        # truncate-tables-in-place model, but for a *fresh* migration run we
+        # need the migration history wiped too. For Postgres the cleanest
+        # route is `DROP SCHEMA public CASCADE; CREATE SCHEMA public;` —
+        # for sqlite, deleting the file is simpler but Django's connection
+        # has it open. So: introspect the connection and drop all tables.
+        self.stdout.write("Dropping all tables…")
+        self._drop_all_tables()
+
+        self.stdout.write("Running migrate from scratch…")
+        call_command("migrate", verbosity=1, interactive=False)
+
+        if not opts["no_superuser"]:
+            try:
+                call_command("ensure_superuser", verbosity=1)
+            except Exception as exc:  # pragma: no cover - depends on env vars
+                self.stdout.write(self.style.WARNING(
+                    f"ensure_superuser skipped/failed: {exc}"
+                ))
+
+        self.stdout.write(self.style.SUCCESS("\nDB reset complete."))
+
+    def _drop_all_tables(self):
+        vendor = connection.vendor
+        with connection.cursor() as cursor:
+            if vendor == "postgresql":
+                cursor.execute("DROP SCHEMA public CASCADE;")
+                cursor.execute("CREATE SCHEMA public;")
+                cursor.execute("GRANT ALL ON SCHEMA public TO public;")
+            elif vendor == "sqlite":
+                cursor.execute("PRAGMA foreign_keys = OFF;")
+                cursor.execute(
+                    "SELECT name FROM sqlite_master "
+                    "WHERE type='table' AND name NOT LIKE 'sqlite_%'"
+                )
+                tables = [row[0] for row in cursor.fetchall()]
+                for table in tables:
+                    cursor.execute(f'DROP TABLE IF EXISTS "{table}"')
+                cursor.execute("PRAGMA foreign_keys = ON;")
+            else:
+                raise CommandError(
+                    f"reset_staging_db only knows postgresql + sqlite, got {vendor!r}"
+                )

src/apps/epic/migrations/0007_finalize_earthman_deck.py

@@ -0,0 +1,200 @@
+"""Collapse of old migrations 0007–0022 into a single end-state finalize.
+
+Schema:
+  - mechanisms      → energies            (was 0008)
+  - articulations   → operations          (was 0008)
+  - reversal        → reversal_qualifier  (was 0014)
+  - +italic_word                          (was 0018)
+
+Data (operates on the Earthman deck seeded in 0004; idempotent against the
+current schema, which is the post-rename state thanks to the operations
+above running first):
+  - Middle court reversal_qualifier per suit       (was 0007)
+  - Schizo energies + operations w/ .card-ref      (was 0008 + 0009)
+  - fa-hand-dots fallback for empty MAJOR icons    (was 0010; only card 41
+                                                     in fresh-seed state)
+  - Card 49 polarity-split reversal titles         (was 0015 + 0016)
+  - Castanedan Virtues: trumps 6-9 + 19-21         (was 0017)
+  - italic_word for trumps 19-21                   (was 0019)
+  - Trump 8 rename + non-breaking hyphen           (was 0020 + 0021)
+  - Trump 9 non-breaking space                     (was 0021)
+  - Pip cards (number 1-10) MIDDLE → MINOR arcana  (was 0022)
+
+Skipped (all no-ops against fresh 0004 seed):
+  - 0011 (nomad/schizo icons already correct in 0004)
+  - 0012 (no PENTACLES seeded for Earthman in 0004)
+  - 0013 (nomad icon already fa-hat-cowboy-side in 0004)
+"""
+from django.db import migrations, models
+
+
+# ── Schizo energies + operations ─────────────────────────────────────────────
+CR = '<span class="card-ref">{}</span>'
+
+SCHIZO_ENERGIES = [
+    {"type": "LIBIDO",   "effect": f'When encountering territorial Libido, may convert Emanation into {CR.format("1. The Priest")}.'},
+    {"type": "NUMEN",    "effect": f'When encountering despotic Numen, may convert Emanation into {CR.format("1. The Powerful")}.'},
+    {"type": "VOLUPTAS", "effect": f'When encountering axiomatic Voluptas, may convert Emanation into {CR.format("1. The Normal")}.'},
+    {"type": "VOLUPTAS", "effect": f'When encountering annihilating Voluptas, may convert Emanation into {CR.format("1. The Surrendered")}.'},
+]
+
+SCHIZO_OPERATIONS = [
+    {"type": "COVER",  "effect": f'When covering {CR.format("2. The Occultist")} she may choose, by converting her own Reversal into {CR.format("2. Pestilence")}, to convert this Reversal into {CR.format("1. The Pervert")}.'},
+    {"type": "CROWN",  "effect": f'When crowning {CR.format("3. The Despot")} she may choose, by converting her own Reversal into {CR.format("3. War")}, to convert this Reversal into {CR.format("1. The Paranoiac")}.'},
+    {"type": "BEHIND", "effect": f'When behind {CR.format("4. The Capitalist")} he may choose, by converting his own Reversal into {CR.format("4. Famine")}, to convert this Reversal into {CR.format("1. The Neurotic")}.'},
+    {"type": "BEFORE", "effect": f'When before {CR.format("5. The Fascist")} he may choose, by converting his own Reversal into {CR.format("5. Death")}, to convert this Reversal into {CR.format("1. The Suicidal")}.'},
+]
+
+# ── Middle court suit reversals ──────────────────────────────────────────────
+SUIT_REVERSAL_QUALIFIER = {
+    "BRANDS": "Seething",
+    "GRAILS": "Gloomy",
+    "BLADES": "Nervous",
+    "CROWNS": "Vacant",
+}
+COURT_NUMBERS = [11, 12, 13, 14]
+
+# ── Castanedan Virtues ───────────────────────────────────────────────────────
+IMPLICIT_VIRTUES = [
+    # (number, levity_qualifier, gravity_qualifier, reversal_title)
+    (6, "Sublimating", "Sedimentary", "Indulged Folly"),
+    (7, "Sublimating", "Sedimentary", "Indulgent Doing"),
+    (8, "Sublimating", "Sedimentary", "Self-Indulgence"),
+    (9, "Sublimating", "Sedimentary", "Indulging Personal History"),
+]
+
+EXPLICIT_VIRTUES = [
+    # (number, levity_emanation, gravity_emanation, levity_reversal, gravity_reversal, italic_word)
+    (19, "The Hunter's Stalking",  "The Hunter's Stalking",  "The Sleeper's Stalking", "The Quarry's Stalking",   "Stalking"),
+    (20, "The Dreamer's Dreaming", "The Dreamer's Dreaming", "The Sleeper's Dreaming", "The Dreamed's Dreaming",  "Dreaming"),
+    (21, "The Warrior's Intent",   "The Warrior's Intent",   "The Sleeper's Intent",   "The Predator's Intent",   "Intent"),
+]
+
+
+def finalize(apps, schema_editor):
+    TarotCard = apps.get_model("epic", "TarotCard")
+    DeckVariant = apps.get_model("epic", "DeckVariant")
+    try:
+        earthman = DeckVariant.objects.get(slug="earthman")
+    except DeckVariant.DoesNotExist:
+        return
+
+    # Middle court suit reversals
+    for suit, qualifier in SUIT_REVERSAL_QUALIFIER.items():
+        TarotCard.objects.filter(
+            deck_variant=earthman, arcana="MIDDLE", suit=suit,
+            number__in=COURT_NUMBERS,
+        ).update(reversal_qualifier=qualifier)
+
+    # Schizo: clear stray reversal_qualifier (0004 seeds 'Territoriality') +
+    # populate energies/operations
+    TarotCard.objects.filter(
+        deck_variant=earthman, arcana="MAJOR", number=1,
+    ).update(
+        reversal_qualifier="",
+        energies=SCHIZO_ENERGIES,
+        operations=SCHIZO_OPERATIONS,
+    )
+
+    # fa-hand-dots fallback for empty MAJOR icons (number ≥ 2)
+    TarotCard.objects.filter(
+        deck_variant=earthman, arcana="MAJOR", number__gte=2, icon="",
+    ).update(icon="fa-hand-dots")
+
+    # Card 49 polarity reversal titles
+    TarotCard.objects.filter(
+        deck_variant=earthman, arcana="MAJOR", number=49,
+    ).update(
+        levity_reversal="The Vibrational Mould of Man",
+        gravity_reversal="The Bestowing Eagle",
+    )
+
+    # Castanedan Virtues — implicit (trumps 6-9): trump 7 name canonicalize +
+    # qualifiers + reversal titles
+    TarotCard.objects.filter(
+        deck_variant=earthman, arcana="MAJOR", number=7,
+    ).update(name="Not-Doing")
+    for number, lvty, grav, rev in IMPLICIT_VIRTUES:
+        TarotCard.objects.filter(
+            deck_variant=earthman, arcana="MAJOR", number=number,
+        ).update(
+            levity_qualifier=lvty,
+            gravity_qualifier=grav,
+            levity_reversal=rev,
+            gravity_reversal=rev,
+        )
+
+    # Castanedan Virtues — explicit (trumps 19-21): polarity-split titles +
+    # italic_word for the agency stem
+    for number, le, ge, lr, gr, word in EXPLICIT_VIRTUES:
+        TarotCard.objects.filter(
+            deck_variant=earthman, arcana="MAJOR", number=number,
+        ).update(
+            levity_emanation=le,
+            gravity_emanation=ge,
+            levity_reversal=lr,
+            gravity_reversal=gr,
+            italic_word=word,
+        )
+
+    # Trump 8: "Losing Self-Importance" → "Self‑Unimportance" w/ U+2011
+    # non-breaking hyphen (keeps title on one line above qualifier)
+    TarotCard.objects.filter(
+        deck_variant=earthman, arcana="MAJOR", number=8,
+    ).update(name="Self‑Unimportance", slug="self-unimportance")
+
+    # Trump 9: insert U+00A0 between "Personal" and "History" so they wrap as
+    # a single unit ("Erasing / Personal History, / Sublimating")
+    TarotCard.objects.filter(
+        deck_variant=earthman, arcana="MAJOR", number=9,
+    ).update(name="Erasing Personal History")
+
+    # Pip cards (number 1-10) → MINOR arcana; courts (11-14) stay MIDDLE
+    TarotCard.objects.filter(
+        deck_variant=earthman, arcana="MIDDLE", number__lte=10,
+    ).update(arcana="MINOR")
+
+
+def revert(apps, schema_editor):
+    """Reverse just enough to restore 0006 schema state. Data reverts to the
+    raw 0004 seed shape (without any of the post-seed tweaks)."""
+    TarotCard = apps.get_model("epic", "TarotCard")
+    DeckVariant = apps.get_model("epic", "DeckVariant")
+    try:
+        earthman = DeckVariant.objects.get(slug="earthman")
+    except DeckVariant.DoesNotExist:
+        return
+    # Pip arcana
+    TarotCard.objects.filter(
+        deck_variant=earthman, arcana="MINOR", number__lte=10,
+    ).update(arcana="MIDDLE")
+    # Trump 8 + 9 names back
+    TarotCard.objects.filter(
+        deck_variant=earthman, arcana="MAJOR", number=8,
+    ).update(name="Losing Self-Importance", slug="losing-self-importance")
+    TarotCard.objects.filter(
+        deck_variant=earthman, arcana="MAJOR", number=9,
+    ).update(name="Erasing Personal History")
+    # Trump 7 name back
+    TarotCard.objects.filter(
+        deck_variant=earthman, arcana="MAJOR", number=7,
+    ).update(name="Not Doing")
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("epic", "0006_add_deck_variant_to_tableseat"),
+    ]
+
+    operations = [
+        migrations.RenameField("TarotCard", "mechanisms",    "energies"),
+        migrations.RenameField("TarotCard", "articulations", "operations"),
+        migrations.RenameField("TarotCard", "reversal",      "reversal_qualifier"),
+        migrations.AddField(
+            model_name="tarotcard",
+            name="italic_word",
+            field=models.CharField(blank=True, default="", max_length=50),
+        ),
+        migrations.RunPython(finalize, reverse_code=revert),
+    ]

src/apps/epic/migrations/0007_populate_middle_arcana_reversals.py

@@ -1,73 +0,0 @@
-"""Populate TarotCard.reversal for Earthman Middle Arcana court cards.
-
-Each suit has a fixed reversal qualifier that replaces the polarity qualifier
-(Elevated/Graven) when the card is spun to its reversed face:
-  Brands → Seething   Grails → Gloomy   Blades → Nervous   Crowns → Vacant
-
-Also clears the incorrectly inherited reversal on The Schizo (card 1), which
-mistakenly carried 'Territoriality' from The Occultist (card 2).
-"""
-from django.db import migrations
-
-SUIT_REVERSAL_QUALIFIER = {
-    "BRANDS": "Seething",
-    "GRAILS": "Gloomy",
-    "BLADES": "Nervous",
-    "CROWNS": "Vacant",
-}
-
-RANK_NAMES = {11: "Maid", 12: "Jack", 13: "Queen", 14: "King"}
-
-
-def populate_reversals(apps, schema_editor):
-    TarotCard = apps.get_model("epic", "TarotCard")
-    DeckVariant = apps.get_model("epic", "DeckVariant")
-
-    try:
-        earthman = DeckVariant.objects.get(slug="earthman")
-    except DeckVariant.DoesNotExist:
-        return
-
-    # Middle Arcana court cards
-    for suit, qualifier in SUIT_REVERSAL_QUALIFIER.items():
-        TarotCard.objects.filter(
-            deck_variant=earthman,
-            arcana="MIDDLE",
-            suit=suit,
-            number__in=list(RANK_NAMES.keys()),
-        ).update(reversal=qualifier)
-
-    # Clear The Schizo's incorrectly inherited reversal (belongs to The Occultist)
-    TarotCard.objects.filter(
-        deck_variant=earthman,
-        arcana="MAJOR",
-        number=1,
-    ).update(reversal="")
-
-
-def clear_reversals(apps, schema_editor):
-    TarotCard = apps.get_model("epic", "TarotCard")
-    DeckVariant = apps.get_model("epic", "DeckVariant")
-    try:
-        earthman = DeckVariant.objects.get(slug="earthman")
-    except DeckVariant.DoesNotExist:
-        return
-    TarotCard.objects.filter(
-        deck_variant=earthman, arcana="MIDDLE",
-        suit__in=list(SUIT_REVERSAL_QUALIFIER.keys()),
-        number__in=list(RANK_NAMES.keys()),
-    ).update(reversal="")
-    TarotCard.objects.filter(deck_variant=earthman, arcana="MAJOR", number=1).update(
-        reversal="Territoriality"
-    )
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("epic", "0006_add_deck_variant_to_tableseat"),
-    ]
-
-    operations = [
-        migrations.RunPython(populate_reversals, reverse_code=clear_reversals),
-    ]

src/apps/epic/migrations/0008_blades_reversal_fickle.py

@@ -0,0 +1,38 @@
+"""Rename the Blades Middle Arcana reversal qualifier "Nervous" → "Fickle"."""
+from django.db import migrations
+
+
+SUIT = "BLADES"
+COURT_NUMBERS = [11, 12, 13, 14]
+OLD = "Nervous"
+NEW = "Fickle"
+
+
+def _update(apps, value):
+    TarotCard = apps.get_model("epic", "TarotCard")
+    DeckVariant = apps.get_model("epic", "DeckVariant")
+    try:
+        earthman = DeckVariant.objects.get(slug="earthman")
+    except DeckVariant.DoesNotExist:
+        return
+    TarotCard.objects.filter(
+        deck_variant=earthman,
+        arcana="MIDDLE",
+        suit=SUIT,
+        number__in=COURT_NUMBERS,
+    ).update(reversal_qualifier=value)
+
+
+def forward(apps, schema_editor):
+    _update(apps, NEW)
+
+
+def backward(apps, schema_editor):
+    _update(apps, OLD)
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("epic", "0007_finalize_earthman_deck"),
+    ]
+    operations = [migrations.RunPython(forward, backward)]

src/apps/epic/migrations/0008_rename_energies_operations_seed_schizo.py

@@ -1,57 +0,0 @@
-"""Rename mechanisms→energies and articulations→operations on TarotCard;
-seed The Schizo (Earthman major arcana card 1) with Energy and Operation entries.
-"""
-from django.db import migrations
-
-CR = '<span class="card-ref">{}</span>'
-
-SCHIZO_ENERGIES = [
-    {"type": "LIBIDO",   "effect": f'When encountering territorial Libido, may convert Emanation into {CR.format("1. The Priest")}.'},
-    {"type": "NUMEN",    "effect": f'When encountering despotic Numen, may convert Emanation into {CR.format("1. The Powerful")}.'},
-    {"type": "VOLUPTAS", "effect": f'When encountering axiomatic Voluptas, may convert Emanation into {CR.format("1. The Normal")}.'},
-    {"type": "VOLUPTAS", "effect": f'When encountering annihilating Voluptas, may convert Emanation into {CR.format("1. The Surrendered")}.'},
-]
-
-SCHIZO_OPERATIONS = [
-    {"type": "COVER",  "effect": f'When covering {CR.format("2. The Occultist")} she may choose, by converting her own Reversal into {CR.format("2. Pestilence")}, to convert this Reversal into {CR.format("1. The Pervert")}.'},
-    {"type": "CROWN",  "effect": f'When crowning {CR.format("3. The Despot")} she may choose, by converting her own Reversal into {CR.format("3. War")}, to convert this Reversal into {CR.format("1. The Paranoiac")}.'},
-    {"type": "BEHIND", "effect": f'When behind {CR.format("4. The Capitalist")} he may choose, by converting his own Reversal into {CR.format("4. Famine")}, to convert this Reversal into {CR.format("1. The Neurotic")}.'},
-    {"type": "BEFORE", "effect": f'When before {CR.format("5. The Fascist")} he may choose, by converting his own Reversal into {CR.format("5. Death")}, to convert this Reversal into {CR.format("1. The Suicidal")}.'},
-]
-
-
-def seed_schizo(apps, schema_editor):
-    TarotCard = apps.get_model("epic", "TarotCard")
-    DeckVariant = apps.get_model("epic", "DeckVariant")
-    try:
-        earthman = DeckVariant.objects.get(slug="earthman")
-    except DeckVariant.DoesNotExist:
-        return
-    TarotCard.objects.filter(
-        deck_variant=earthman, arcana="MAJOR", number=1,
-    ).update(energies=SCHIZO_ENERGIES, operations=SCHIZO_OPERATIONS)
-
-
-def clear_schizo(apps, schema_editor):
-    TarotCard = apps.get_model("epic", "TarotCard")
-    DeckVariant = apps.get_model("epic", "DeckVariant")
-    try:
-        earthman = DeckVariant.objects.get(slug="earthman")
-    except DeckVariant.DoesNotExist:
-        return
-    TarotCard.objects.filter(
-        deck_variant=earthman, arcana="MAJOR", number=1,
-    ).update(energies=[], operations=[])
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("epic", "0007_populate_middle_arcana_reversals"),
-    ]
-
-    operations = [
-        migrations.RenameField("TarotCard", "mechanisms", "energies"),
-        migrations.RenameField("TarotCard", "articulations", "operations"),
-        migrations.RunPython(seed_schizo, reverse_code=clear_schizo),
-    ]

src/apps/epic/migrations/0009_reversal_drops_qualifier.py

@@ -0,0 +1,18 @@
+# Generated by Django 6.0 on 2026-05-23 18:44
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('epic', '0008_blades_reversal_fickle'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='tarotcard',
+            name='reversal_drops_qualifier',
+            field=models.BooleanField(default=False),
+        ),
+    ]

src/apps/epic/migrations/0009_schizo_card_ref_spans.py

@@ -1,53 +0,0 @@
-"""Re-seed The Schizo's energies and operations with .card-ref HTML spans."""
-from django.db import migrations
-
-CR = '<span class="card-ref">{}</span>'
-
-SCHIZO_ENERGIES = [
-    {"type": "LIBIDO",   "effect": f'When encountering territorial Libido, may convert Emanation into {CR.format("1. The Priest")}.'},
-    {"type": "NUMEN",    "effect": f'When encountering despotic Numen, may convert Emanation into {CR.format("1. The Powerful")}.'},
-    {"type": "VOLUPTAS", "effect": f'When encountering axiomatic Voluptas, may convert Emanation into {CR.format("1. The Normal")}.'},
-    {"type": "VOLUPTAS", "effect": f'When encountering annihilating Voluptas, may convert Emanation into {CR.format("1. The Surrendered")}.'},
-]
-
-SCHIZO_OPERATIONS = [
-    {"type": "COVER",  "effect": f'When covering {CR.format("2. The Occultist")} she may choose, by converting her own Reversal into {CR.format("2. Pestilence")}, to convert this Reversal into {CR.format("1. The Pervert")}.'},
-    {"type": "CROWN",  "effect": f'When crowning {CR.format("3. The Despot")} she may choose, by converting her own Reversal into {CR.format("3. War")}, to convert this Reversal into {CR.format("1. The Paranoiac")}.'},
-    {"type": "BEHIND", "effect": f'When behind {CR.format("4. The Capitalist")} he may choose, by converting his own Reversal into {CR.format("4. Famine")}, to convert this Reversal into {CR.format("1. The Neurotic")}.'},
-    {"type": "BEFORE", "effect": f'When before {CR.format("5. The Fascist")} he may choose, by converting his own Reversal into {CR.format("5. Death")}, to convert this Reversal into {CR.format("1. The Suicidal")}.'},
-]
-
-
-def seed_schizo(apps, schema_editor):
-    TarotCard = apps.get_model("epic", "TarotCard")
-    DeckVariant = apps.get_model("epic", "DeckVariant")
-    try:
-        earthman = DeckVariant.objects.get(slug="earthman")
-    except DeckVariant.DoesNotExist:
-        return
-    TarotCard.objects.filter(
-        deck_variant=earthman, arcana="MAJOR", number=1,
-    ).update(energies=SCHIZO_ENERGIES, operations=SCHIZO_OPERATIONS)
-
-
-def clear_schizo(apps, schema_editor):
-    TarotCard = apps.get_model("epic", "TarotCard")
-    DeckVariant = apps.get_model("epic", "DeckVariant")
-    try:
-        earthman = DeckVariant.objects.get(slug="earthman")
-    except DeckVariant.DoesNotExist:
-        return
-    TarotCard.objects.filter(
-        deck_variant=earthman, arcana="MAJOR", number=1,
-    ).update(energies=[], operations=[])
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("epic", "0008_rename_energies_operations_seed_schizo"),
-    ]
-
-    operations = [
-        migrations.RunPython(seed_schizo, reverse_code=clear_schizo),
-    ]

src/apps/epic/migrations/0010_major_arcana_hand_dots_icon.py

@@ -1,49 +0,0 @@
-"""Assign fa-hand-dots icon to all Earthman Major Arcana cards with number >= 2.
-
-Cards 0 (The Nomad) and 1 (The Schizo) keep their existing icon value so they
-can receive distinct icons later. All other Major Arcana groups (Popes, Implicit
-Virtues, Elements, Realms, Explicit Virtues, Zodiac, Lunars, Planets, Inner Rings,
-polarity-split finals) default to fa-hand-dots until per-group icons are assigned.
-"""
-from django.db import migrations
-
-
-def assign_hand_dots(apps, schema_editor):
-    TarotCard = apps.get_model("epic", "TarotCard")
-    DeckVariant = apps.get_model("epic", "DeckVariant")
-    try:
-        earthman = DeckVariant.objects.get(slug="earthman")
-    except DeckVariant.DoesNotExist:
-        return
-    TarotCard.objects.filter(
-        deck_variant=earthman,
-        arcana="MAJOR",
-        number__gte=2,
-        icon="",
-    ).update(icon="fa-hand-dots")
-
-
-def clear_hand_dots(apps, schema_editor):
-    TarotCard = apps.get_model("epic", "TarotCard")
-    DeckVariant = apps.get_model("epic", "DeckVariant")
-    try:
-        earthman = DeckVariant.objects.get(slug="earthman")
-    except DeckVariant.DoesNotExist:
-        return
-    TarotCard.objects.filter(
-        deck_variant=earthman,
-        arcana="MAJOR",
-        number__gte=2,
-        icon="fa-hand-dots",
-    ).update(icon="")
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("epic", "0009_schizo_card_ref_spans"),
-    ]
-
-    operations = [
-        migrations.RunPython(assign_hand_dots, reverse_code=clear_hand_dots),
-    ]

src/apps/epic/migrations/0010_set_reversal_drops_qualifier_realms.py

@@ -0,0 +1,37 @@
+"""Cards 16-18 (Realms — Disco Inferno / Torre Terrestre / Fantasia Celestia)
+have a reversal NAME swap (`reversal_qualifier` field carrying "Shame" /
+"Guilt" / "Anxiety") but per user-spec 2026-05-23 the reversal face renders
+the name ALONE, with NO polarity qualifier appended. Set
+`reversal_drops_qualifier=True` so `TarotCard.applet_face()` knows to drop
+the polarity qualifier on the reversal face. See [[feedback-reversal-
+qualifier-dual-role]] for the broader Pattern B vs Pattern B' distinction.
+"""
+from django.db import migrations
+
+
+REVERSAL_DROPS_QUALIFIER_NUMBERS = [16, 17, 18]
+
+
+def set_flag(apps, schema_editor):
+    TarotCard = apps.get_model("epic", "TarotCard")
+    TarotCard.objects.filter(
+        arcana="MAJOR", number__in=REVERSAL_DROPS_QUALIFIER_NUMBERS,
+    ).update(reversal_drops_qualifier=True)
+
+
+def clear_flag(apps, schema_editor):
+    TarotCard = apps.get_model("epic", "TarotCard")
+    TarotCard.objects.filter(
+        arcana="MAJOR", number__in=REVERSAL_DROPS_QUALIFIER_NUMBERS,
+    ).update(reversal_drops_qualifier=False)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("epic", "0009_reversal_drops_qualifier"),
+    ]
+
+    operations = [
+        migrations.RunPython(set_flag, reverse_code=clear_flag),
+    ]

src/apps/epic/migrations/0011_deckvariant_family_deckvariant_has_card_images_and_more.py

@@ -0,0 +1,33 @@
+# Generated by Django 6.0 on 2026-05-25 03:15
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('epic', '0010_set_reversal_drops_qualifier_realms'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='deckvariant',
+            name='family',
+            field=models.CharField(choices=[('earthman', 'Earthman'), ('italian', 'Italian / Minchiate'), ('english', 'English Tarot'), ('playing', 'Playing card')], default='earthman', max_length=10),
+        ),
+        migrations.AddField(
+            model_name='deckvariant',
+            name='has_card_images',
+            field=models.BooleanField(default=True),
+        ),
+        migrations.AddField(
+            model_name='deckvariant',
+            name='is_polarized',
+            field=models.BooleanField(default=False),
+        ),
+        migrations.AlterField(
+            model_name='tarotcard',
+            name='suit',
+            field=models.CharField(blank=True, choices=[('BRANDS', 'Brands'), ('CROWNS', 'Crowns'), ('GRAILS', 'Grails'), ('BLADES', 'Blades')], max_length=10, null=True),
+        ),
+    ]

src/apps/epic/migrations/0011_nomad_schizo_icons.py

@@ -1,43 +0,0 @@
-"""Assign individual icons to The Nomad (0) and The Schizo (1).
-
-All other Major Arcana already have fa-hand-dots from migration 0010.
-"""
-from django.db import migrations
-
-ICONS = {0: 'fa-hat-cowboy', 1: 'fa-hat-wizard'}
-
-
-def assign_icons(apps, schema_editor):
-    TarotCard = apps.get_model("epic", "TarotCard")
-    DeckVariant = apps.get_model("epic", "DeckVariant")
-    try:
-        earthman = DeckVariant.objects.get(slug="earthman")
-    except DeckVariant.DoesNotExist:
-        return
-    for number, icon in ICONS.items():
-        TarotCard.objects.filter(
-            deck_variant=earthman, arcana="MAJOR", number=number
-        ).update(icon=icon)
-
-
-def clear_icons(apps, schema_editor):
-    TarotCard = apps.get_model("epic", "TarotCard")
-    DeckVariant = apps.get_model("epic", "DeckVariant")
-    try:
-        earthman = DeckVariant.objects.get(slug="earthman")
-    except DeckVariant.DoesNotExist:
-        return
-    TarotCard.objects.filter(
-        deck_variant=earthman, arcana="MAJOR", number__in=list(ICONS.keys())
-    ).update(icon="")
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("epic", "0010_major_arcana_hand_dots_icon"),
-    ]
-
-    operations = [
-        migrations.RunPython(assign_icons, reverse_code=clear_icons),
-    ]

src/apps/epic/migrations/0012_delete_stray_pentacles.py

@@ -1,27 +0,0 @@
-"""Delete 4 stray PENTACLES court cards from the Earthman deck.
-
-These survived the migration collapse; the Earthman deck uses
-BRANDS/GRAILS/BLADES/CROWNS only.
-"""
-from django.db import migrations
-
-
-def delete_pentacles(apps, schema_editor):
-    TarotCard = apps.get_model("epic", "TarotCard")
-    DeckVariant = apps.get_model("epic", "DeckVariant")
-    try:
-        earthman = DeckVariant.objects.get(slug="earthman")
-    except DeckVariant.DoesNotExist:
-        return
-    TarotCard.objects.filter(deck_variant=earthman, suit="PENTACLES").delete()
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("epic", "0011_nomad_schizo_icons"),
-    ]
-
-    operations = [
-        migrations.RunPython(delete_pentacles, reverse_code=migrations.RunPython.noop),
-    ]

src/apps/epic/migrations/0012_rws_rename_and_suit_revocab.py

@@ -0,0 +1,70 @@
+"""Sprint A.0 data migration.
+
+The existing `fiorentine-minchiate` DeckVariant is actually 78-card Rider-Waite-Smith
+Tarot (22 majors numbered 0-21 with RWS names + 56 minors in WANDS/CUPS/SWORDS/PENTACLES).
+Rename to its true identity, set the new schema fields (family / has_card_images /
+is_polarized), and revocab card suits to the canonical Earthman vocabulary that
+SUIT_CHOICES now requires. Earthman gets its new-field values set too. FKs remain
+intact since slug-only changes don't break referential integrity.
+
+The actual Minchiate Fiorentine deck (97 cards, 1860-1890 publication, image set
+already imported per [[reference-card-image-naming-convention]]) is seeded in
+Sprint A.1's follow-up migration.
+"""
+from django.db import migrations
+
+
+SUIT_REVOCAB = {
+    "WANDS":     "BRANDS",
+    "CUPS":      "GRAILS",
+    "SWORDS":    "BLADES",
+    "PENTACLES": "CROWNS",
+}
+
+
+def forward(apps, schema_editor):
+    DeckVariant = apps.get_model("epic", "DeckVariant")
+    TarotCard = apps.get_model("epic", "TarotCard")
+
+    # Earthman: set new-field values explicitly (default=True for has_card_images
+    # would have left it True after the schema migration — wrong for Earthman).
+    DeckVariant.objects.filter(slug="earthman").update(
+        family="earthman", has_card_images=False, is_polarized=True,
+    )
+
+    # fiorentine-minchiate → RWS Tarot rename + new-field values.
+    rws = DeckVariant.objects.filter(slug="fiorentine-minchiate").first()
+    if rws:
+        rws.slug = "tarot-rider-waite-smith"
+        rws.name = "Tarot (Rider-Waite-Smith)"
+        rws.family = "english"
+        rws.has_card_images = False
+        rws.is_polarized = False
+        rws.save()
+        # Revocab the 56 minor cards' suits to canonical Earthman vocab.
+        for old_suit, new_suit in SUIT_REVOCAB.items():
+            TarotCard.objects.filter(deck_variant=rws, suit=old_suit).update(
+                suit=new_suit,
+            )
+
+
+def backward(apps, schema_editor):
+    DeckVariant = apps.get_model("epic", "DeckVariant")
+    TarotCard = apps.get_model("epic", "TarotCard")
+
+    rws = DeckVariant.objects.filter(slug="tarot-rider-waite-smith").first()
+    if rws:
+        for new_suit, old_suit in {v: k for k, v in SUIT_REVOCAB.items()}.items():
+            TarotCard.objects.filter(deck_variant=rws, suit=new_suit).update(
+                suit=old_suit,
+            )
+        rws.slug = "fiorentine-minchiate"
+        rws.name = "Fiorentine Minchiate"
+        rws.save()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("epic", "0011_deckvariant_family_deckvariant_has_card_images_and_more"),
+    ]
+    operations = [migrations.RunPython(forward, backward)]

src/apps/epic/migrations/0013_seed_minchiate_fiorentine_1860_1890.py

@@ -0,0 +1,137 @@
+"""Sprint A.1 — seed the Minchiate Fiorentine (1860-1890) deck.
+
+97 cards: 40 numbered trumps + Il Matto (rank 0, unnumbered Fool) + 56 minors
+(4 suits × 14 cards: pip 1-10, page 11, knight 12, queen 13, king 14).
+
+Names are stored in Italian-display form (Italian for trumps; English-rank +
+Italian-suit hybrid for minors — "Page of Batons", "King of Coins"). The
+canonical SUIT enum stays Earthman vocab (BRANDS/GRAILS/BLADES/CROWNS) per the
+2026-05-25 lock; Sprint A.2's `display_suit_name` property handles the
+canonical→display translation.
+
+Correspondences cite the RWS Tarot equivalent where one exists (16 trumps map
+cleanly; the 5 popes, 4 theological+cardinal virtues, 4 elements, and 12
+zodiac trumps don't have RWS parallels — left blank).
+
+Keywords intentionally left empty for now; admin form (Sprint B) will enrich.
+"""
+from django.db import migrations
+
+
+TRUMPS = [
+    # (number, name, slug, correspondence)
+    (0,  "Il Matto",                "il-matto",                "The Fool"),
+    (1,  "Papa Uno",                "papa-uno",                ""),
+    (2,  "Papa Due",                "papa-due",                ""),
+    (3,  "Papa Tre",                "papa-tre",                ""),
+    (4,  "Papa Quattro",            "papa-quattro",            ""),
+    (5,  "Papa Cinque",             "papa-cinque",             ""),
+    (6,  "La Temperanza",           "la-temperanza",           "Temperance"),
+    (7,  "La Forza",                "la-forza",                "Strength"),
+    (8,  "La Giustizia",            "la-giustizia",            "Justice"),
+    (9,  "La Ruota della Fortuna",  "la-ruota-della-fortuna",  "Wheel of Fortune"),
+    (10, "Il Carro",                "il-carro",                "The Chariot"),
+    (11, "Il Gobbo",                "il-gobbo",                "The Hermit"),
+    (12, "L'Impiccato",             "l-impiccato",             "The Hanged Man"),
+    (13, "La Morte",                "la-morte",                "Death"),
+    (14, "Il Diavolo",              "il-diavolo",              "The Devil"),
+    (15, "La Casa del Diavolo",     "la-casa-del-diavolo",     "The Tower"),
+    (16, "La Speranza",             "la-speranza",             ""),  # Hope — theological virtue
+    (17, "La Prudenza",             "la-prudenza",             ""),  # Prudence — cardinal virtue
+    (18, "La Fede",                 "la-fede",                 ""),  # Faith
+    (19, "La Carita",               "la-carita",               ""),  # Charity
+    (20, "Il Fuoco",                "il-fuoco",                ""),  # Fire — element
+    (21, "L'Acqua",                 "l-acqua",                 ""),  # Water
+    (22, "La Terra",                "la-terra",                ""),  # Earth
+    (23, "L'Aria",                  "l-aria",                  ""),  # Air
+    (24, "La Bilancia",             "la-bilancia",             ""),  # Libra — zodiac
+    (25, "La Vergine",              "la-vergine",              ""),  # Virgo
+    (26, "Il Scorpione",            "il-scorpione",            ""),  # Scorpio
+    (27, "L'Ariete",                "l-ariete",                ""),  # Aries
+    (28, "Il Capricorno",           "il-capricorno",           ""),  # Capricorn
+    (29, "Il Sagittario",           "il-sagittario",           ""),  # Sagittarius
+    (30, "Il Cancro",               "il-cancro",               ""),  # Cancer
+    (31, "I Pesci",                 "i-pesci",                 ""),  # Pisces
+    (32, "L'Acquario",              "l-acquario",              ""),  # Aquarius
+    (33, "Il Leone",                "il-leone",                ""),  # Leo
+    (34, "Il Toro",                 "il-toro",                 ""),  # Taurus
+    (35, "I Gemelli",               "i-gemelli",               ""),  # Gemini
+    (36, "La Stella",               "la-stella",               "The Star"),
+    (37, "La Luna",                 "la-luna",                 "The Moon"),
+    (38, "Il Sole",                 "il-sole",                 "The Sun"),
+    (39, "Il Mondo",                "il-mondo",                "The World"),
+    (40, "Le Trombe",               "le-trombe",               "Judgement"),
+]
+
+# Canonical Earthman suit enum → Italian-family display name (also used as slug stem).
+SUIT_DISPLAY = {
+    "BRANDS": "Batons",
+    "GRAILS": "Cups",
+    "BLADES": "Swords",
+    "CROWNS": "Coins",
+}
+PIP_NAMES = {1: "Ace", 2: "Two", 3: "Three", 4: "Four", 5: "Five",
+             6: "Six", 7: "Seven", 8: "Eight", 9: "Nine", 10: "Ten"}
+COURT_NAMES = {11: "Page", 12: "Knight", 13: "Queen", 14: "King"}
+
+
+def forward(apps, schema_editor):
+    DeckVariant = apps.get_model("epic", "DeckVariant")
+    TarotCard = apps.get_model("epic", "TarotCard")
+
+    deck = DeckVariant.objects.create(
+        name="Minchiate Fiorentine (1860–1890)",
+        slug="minchiate-fiorentine-1860-1890",
+        card_count=97,
+        is_default=False,
+        family="italian",
+        has_card_images=True,
+        is_polarized=False,
+        description=(
+            "97-card Minchiate Fiorentine deck from the Baragioli-era 1860-1890 "
+            "Florence lithograph series. Five popes, four theological/cardinal "
+            "virtues, four elements, twelve zodiac signs, plus the standard "
+            "trump iconography and Il Matto."
+        ),
+    )
+
+    # 41 trumps (incl. Il Matto at rank 0).
+    for number, name, slug, correspondence in TRUMPS:
+        TarotCard.objects.create(
+            deck_variant=deck,
+            arcana="MAJOR",
+            suit=None,
+            number=number,
+            name=name,
+            slug=slug,
+            correspondence=correspondence,
+        )
+
+    # 56 minors: 4 suits × 14 cards.
+    for canonical_suit, display in SUIT_DISPLAY.items():
+        for n in range(1, 15):
+            rank_word = PIP_NAMES.get(n) or COURT_NAMES[n]
+            TarotCard.objects.create(
+                deck_variant=deck,
+                arcana="MINOR",
+                suit=canonical_suit,
+                number=n,
+                name=f"{rank_word} of {display}",
+                slug=f"{rank_word.lower()}-of-{display.lower()}",
+            )
+
+
+def backward(apps, schema_editor):
+    DeckVariant = apps.get_model("epic", "DeckVariant")
+    TarotCard = apps.get_model("epic", "TarotCard")
+    deck = DeckVariant.objects.filter(slug="minchiate-fiorentine-1860-1890").first()
+    if deck:
+        TarotCard.objects.filter(deck_variant=deck).delete()
+        deck.delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("epic", "0012_rws_rename_and_suit_revocab"),
+    ]
+    operations = [migrations.RunPython(forward, backward)]

src/apps/epic/migrations/0014_rws_has_card_images_true.py

@@ -0,0 +1,35 @@
+"""Flip RWS `has_card_images` to True now that the 79 RWS card-face PNGs are
+installed + resized + pngquant'd at `cards-faces/english/rider-waite-smith/`.
+Light up the existing image-mode rendering branches (already shipped for
+Minchiate) for the RWS deck too — the card face becomes the image; the text
+metadata moves to the adjacent stat block; the deck-stack icon uses the
+RWS card-back PNG instead of the generic SCSS placeholder rect-fill.
+
+`is_polarized` stays False (set by 0012). RWS was always a monodeck — flip-to-
+back FLIP renders the card-back image instead of cycling gravity/levity halves.
+
+The is_default flag stays False (Earthman remains the default-equipped deck for
+new users); explicit equip via Game Kit is required to put RWS on the table.
+"""
+from django.db import migrations
+
+
+def forward(apps, schema_editor):
+    DeckVariant = apps.get_model("epic", "DeckVariant")
+    DeckVariant.objects.filter(slug="tarot-rider-waite-smith").update(
+        has_card_images=True,
+    )
+
+
+def backward(apps, schema_editor):
+    DeckVariant = apps.get_model("epic", "DeckVariant")
+    DeckVariant.objects.filter(slug="tarot-rider-waite-smith").update(
+        has_card_images=False,
+    )
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("epic", "0013_seed_minchiate_fiorentine_1860_1890"),
+    ]
+    operations = [migrations.RunPython(forward, backward)]