jelq

public

an http based roguelike rpg about jelqing

Star0

Fork 0

Watch0

12 commits 1 branch 0 tags 0 releases1.3 MiB

Commit `782069860236`

tarball

atagen <boss@atagen.co>2026-10-10 15:15 UTC

38 files changed+4874-4108

jelqd: restructure into typed modules and close the review's correctness gaps

Run ids were the only authorization yet the leaderboard and graveyard published them, so anyone could play or delete a listed run. Runs now have a 128-bit private id in their URL and a separate public id for listings, idle runs are evicted, and a poisoned lock no longer takes the server down. A per-resource method table derives Allow, OPTIONS and 405, which fixes the clinic advertising JELQ, and items are an enum so a shop purchase can no longer fall through to removing the cage. Bodies no longer repeat what the stat headers already say.

Modified file: flake.nix+1−1

@@ -22,7 +22,7 @@

2222 ./Cargo.toml

2323 ./Cargo.lock

2424 ./src

25- ./tests

25+

2626 ];

2727 };

2828 in

Added file: src/config.rs+38 additions@@ -0,0 +1,38 @@
+use std::time::Duration;
+
+use crate::secret::Secret;
+
+pub struct Config {
+    pub addr: String,
+    pub refractory: Duration,
+    pub secret: Secret,
+    pub max_runs: usize,
+    pub idle_ttl: Duration,
+}
+
+impl Default for Config {
+    fn default() -> Self {
+        Self {
+            addr: "127.0.0.1:6969".into(),
+            refractory: Duration::from_secs(30),
+            secret: Secret::random(),
+            max_runs: 10_000,
+            idle_ttl: Duration::from_secs(6 * 60 * 60),
+        }
+    }
+}
+
+impl Config {
+    pub fn from_env() -> Self {
+        let var = |name| std::env::var(name).ok();
+        let defaults = Self::default();
+        Self {
+            addr: var("JELQD_ADDR").unwrap_or(defaults.addr),
+            refractory: var("JELQD_REFRACTORY_SECS")
+                .and_then(|s| s.parse().ok())
+                .map_or(defaults.refractory, Duration::from_secs),
+            secret: var("JELQD_SECRET").map_or(defaults.secret, |s| Secret::new(s.into_bytes())),
+            ..defaults
+        }
+    }
+}

Added file: src/game/balance.rs+68 additions@@ -0,0 +1,68 @@
+//! Every tunable number in the game. Odds are written as "1 in N".
+
+use std::ops::RangeInclusive;
+
+pub const MAX_STAMINA: i32 = 10;
+pub const PULLED_STAMINA: i32 = 7;
+pub const STARTING_EQ: i32 = 20;
+pub const STARTING_CASH: u32 = 20;
+pub const STARTING_ICE_PACKS: u32 = 1;
+pub const SUSPICION_LIMIT: u8 = 5;
+pub const PATIENCE: u8 = 3;
+
+pub const FLOOR_TURNS: u32 = 6;
+pub const FLOOR_ALLOWANCE: u32 = 10;
+pub const BRANCH_TURN: u32 = 10;
+
+pub const EQ_BAND: RangeInclusive<i32> = 50..=70;
+pub const BAND_BONUS: i32 = 2;
+pub const COLD_EQ: i32 = 30;
+pub const DANGER_EQ: i32 = 70;
+pub const HOT_EQ: i32 = 85;
+pub const RUPTURE_LINE: i32 = 90;
+pub const RING_RUPTURE_LINE: i32 = 80;
+pub const PREMATURE_EQ: i32 = 95;
+pub const EQ_WOBBLE: i32 = 3;
+pub const LOCKER_CHILL: i32 = 8;
+
+pub const WARMUP_EQ: i32 = 25;
+pub const SHOWER_EQ: i32 = 35;
+pub const TOWELLESS_EQ: i32 = 10;
+pub const ICE_EQ: i32 = 40;
+pub const EDGE_EQ: i32 = 11;
+pub const EDGE_LOOP: u8 = 3;
+pub const PRIAPISM_EQ: i32 = 75;
+pub const PRIAPISM_TURNS: u8 = 5;
+
+pub const SELF_REPORT_INFLATION: f64 = 1.5;
+pub const MM_PER_INCH: f64 = 25.4;
+pub const HONEST_TOLERANCE: f64 = 0.06;
+pub const EXAGGERATION: f64 = 1.0;
+pub const STORAGE_GIRTH: f64 = 5.0;
+pub const PUT_GAIN: f64 = 0.01;
+pub const PUMP_GAIN: f64 = 0.5;
+pub const EXTENDER_GAIN: f64 = 0.004;
+pub const EDGE_GIRTH: f64 = 0.004;
+
+pub const RUPTURE_IN_BAND: u32 = 250;
+pub const RUPTURE_WARM: u32 = 25;
+pub const RUPTURE_HOT: u32 = 10;
+pub const RUPTURE_PREMATURE: u32 = 3;
+pub const ZIPPER: u32 = 200;
+pub const DEGLOVING: u32 = 60;
+pub const DEGLOVING_INTENSITY: i32 = 8;
+pub const WINDOW: u32 = 60;
+pub const PULLED_MUSCLE: u32 = 12;
+pub const PULLED_MUSCLE_INTENSITY: i32 = 9;
+pub const RING_PRIAPISM: u32 = 10;
+pub const SUPPLEMENT_WORKS: u32 = 5;
+pub const OBSERVED: u32 = 6;
+pub const CAT_TAKES_TOWEL: u32 = 5;
+pub const FRIEND: u32 = 10;
+pub const CURVE_MISSES: u32 = 3;
+pub const HOTEL_STRESS: u32 = 3;
+pub const VIRAL_ERRAND: u32 = 2;
+
+/// Visits are (suspicion + 1) in N per turn.
+pub const MOM_VISIT: u32 = 16;
+pub const WANDERER_VISIT: u32 = 32;

Added file: src/game/body.rs+121 additions@@ -0,0 +1,121 @@
+use axum::http::StatusCode;
+use serde::Deserialize;
+use serde_json::{Value, json};
+
+use super::{
+    Grip, Outcome, Run,
+    balance::{EXAGGERATION, PUT_GAIN},
+    etag_matches, honest,
+};
+use crate::problem::Problem;
+
+#[derive(Deserialize)]
+pub struct PatchOp {
+    pub op: String,
+    pub path: String,
+    #[serde(default)]
+    pub value: Value,
+}
+
+pub(super) fn exaggeration() -> Problem {
+    Problem::new(
+        StatusCode::BAD_REQUEST,
+        "exaggeration",
+        "The server has measured. Lying is not a technique.",
+    )
+}
+
+impl Run {
+    pub fn put(&mut self) -> Outcome {
+        if self.put_applied {
+            return Outcome::empty(StatusCode::NO_CONTENT);
+        }
+        self.put_applied = true;
+        self.length += PUT_GAIN;
+        self.touch();
+        Outcome::json(StatusCode::OK, json!({ "detail": "Applied." }))
+    }
+
+    pub fn patch(&mut self, ops: &[PatchOp]) -> Result<Outcome, Problem> {
+        for op in ops {
+            if op.op != "test" {
+                return Err(Problem::new(
+                    StatusCode::UNPROCESSABLE_ENTITY,
+                    "wishful-thinking",
+                    "The server accepts only the truth.",
+                )
+                .with("op", op.op.clone()));
+            }
+            let actual = match op.path.as_str() {
+                "/length" => self.current_length(),
+                "/girth" => self.girth,
+                "/foreskin" => self.foreskin.unwrap_or(0.0),
+                _ => {
+                    return Err(Problem::new(
+                        StatusCode::UNPROCESSABLE_ENTITY,
+                        "no-such-measurement",
+                        "There is no such measurement.",
+                    )
+                    .with("path", op.path.clone()));
+                }
+            };
+            let Some(claimed) = op.value.as_f64() else {
+                return Err(Problem::new(
+                    StatusCode::BAD_REQUEST,
+                    "malformed-patch",
+                    "A test requires a numeric value.",
+                ));
+            };
+            if op.path == "/length" && claimed >= actual + EXAGGERATION {
+                self.shame += 2;
+                self.touch();
+                return Err(exaggeration());
+            }
+            if !honest(claimed, actual) {
+                self.shame += 1;
+                self.touch();
+                return Err(
+                    Problem::new(StatusCode::CONFLICT, "test-failed", "The test failed.")
+                        .with("path", op.path.clone()),
+                );
+            }
+        }
+        Ok(Outcome::json(
+            StatusCode::OK,
+            json!({ "detail": "Correct." }),
+        ))
+    }
+
+    pub fn delete_foreskin(&mut self, if_match: Option<&str>) -> Result<Outcome, Problem> {
+        if self.foreskin.is_none() {
+            return Err(Problem::new(
+                StatusCode::GONE,
+                "foreskin-gone",
+                "The foreskin is gone. It will not be returning.",
+            ));
+        }
+        let Some(if_match) = if_match else {
+            return Err(Problem::new(
+                StatusCode::PRECONDITION_REQUIRED,
+                "confirmation-required",
+                "The server requires you to be sure. Send If-Match.",
+            ));
+        };
+        if !etag_matches(if_match, &self.etag()) {
+            return Err(Problem::new(
+                StatusCode::PRECONDITION_FAILED,
+                "stale-foreskin",
+                "The foreskin has changed since you last looked at it.",
+            ));
+        }
+        self.foreskin = None;
+        self.shame += 20;
+        self.touch();
+        Ok(Outcome::empty(StatusCode::NO_CONTENT))
+    }
+
+    pub fn set_grip(&mut self, grip: Grip) {
+        self.grip = grip;
+        self.touch();
+    }
+}

Deleted file: src/game/catalog.rs−253 deletions@@ -1,253 +0,0 @@
-use axum::http::StatusCode;
-use serde_json::{Value, json};
-
-use crate::problem::Problem;
-
-pub const LUBRICANTS: [&str; 5] = [
-    "application/baby-oil",
-    "application/coconut-oil",
-    "application/lotion",
-    "application/vaseline",
-    "text/plain; charset=spit",
-];
-
-#[derive(Clone, Copy, PartialEq, Eq, Debug)]
-pub enum Lube {
-    BabyOil,
-    CoconutOil,
-    Lotion,
-    Vaseline,
-    Spit,
-}
-
-impl Lube {
-    pub fn from_content_type(content_type: Option<&str>) -> Result<Option<Self>, Problem> {
-        let Some(raw) = content_type else {
-            return Ok(None);
-        };
-        let lowered = raw.to_ascii_lowercase();
-        let mut parts = lowered.split(';').map(str::trim);
-        let essence = parts.next().unwrap_or_default();
-        let spit = parts.any(|p| p.replace(' ', "") == "charset=spit");
-        match essence {
-            "application/baby-oil" => Ok(Some(Self::BabyOil)),
-            "application/coconut-oil" => Ok(Some(Self::CoconutOil)),
-            "application/lotion" => Ok(Some(Self::Lotion)),
-            "application/vaseline" => Ok(Some(Self::Vaseline)),
-            "text/plain" if spit => Ok(Some(Self::Spit)),
-            e if e.starts_with("image/") || e.starts_with("video/") => Err(Problem::new(
-                StatusCode::UNSUPPORTED_MEDIA_TYPE,
-                "no",
-                "No.",
-            )),
-            _ => Err(Problem::new(
-                StatusCode::UNSUPPORTED_MEDIA_TYPE,
-                "unsupported-lubricant",
-                format!("{essence} is not a lubricant."),
-            )
-            .with("lubricants", json!(LUBRICANTS))),
-        }
-    }
-
-    pub(super) fn modifier(self) -> i32 {
-        match self {
-            Self::BabyOil => 1,
-            Self::CoconutOil => 3,
-            Self::Lotion => 0,
-            Self::Vaseline => 2,
-            Self::Spit => -2,
-        }
-    }
-}
-
-#[derive(Clone, Copy, PartialEq, Eq, Debug)]
-pub enum Technique {
-    Warmup,
-    Ice,
-    Edge,
-    Pump,
-    Supplement,
-    Wet,
-    Dry,
-    Stretch,
-    Uli,
-}
-
-#[derive(Clone, Copy)]
-pub(super) enum LubeRule {
-    Required,
-    Forbidden,
-    Optional,
-}
-
-pub(super) struct Profile {
-    pub dc: i32,
-    pub length: f64,
-    pub girth: f64,
-    pub foreskin: Option<(f64, f64)>,
-    pub foreskin_growth: f64,
-    pub lube: LubeRule,
-}
-
-impl Technique {
-    pub const ALL: [Self; 9] = [
-        Self::Warmup,
-        Self::Ice,
-        Self::Edge,
-        Self::Pump,
-        Self::Supplement,
-        Self::Wet,
-        Self::Dry,
-        Self::Stretch,
-        Self::Uli,
-    ];
-
-    pub fn name(self) -> &'static str {
-        match self {
-            Self::Warmup => "warmup",
-            Self::Ice => "ice",
-            Self::Edge => "edge",
-            Self::Pump => "pump",
-            Self::Supplement => "supplement",
-            Self::Wet => "wet",
-            Self::Dry => "dry",
-            Self::Stretch => "stretch",
-            Self::Uli => "uli",
-        }
-    }
-
-    pub fn parse(name: &str) -> Option<Self> {
-        Self::ALL.into_iter().find(|t| t.name() == name)
-    }
-
-    pub(super) fn profile(self) -> Option<Profile> {
-        let profile = match self {
-            Self::Warmup | Self::Ice | Self::Edge | Self::Pump | Self::Supplement => return None,
-            Self::Wet => Profile {
-                dc: 10,
-                length: 0.010,
-                girth: 0.005,
-                foreskin: None,
-                foreskin_growth: 0.0,
-                lube: LubeRule::Required,
-            },
-            Self::Dry => Profile {
-                dc: 12,
-                length: 0.008,
-                girth: 0.003,
-                foreskin: Some((0.8, 2.0)),
-                foreskin_growth: 0.01,
-                lube: LubeRule::Forbidden,
-            },
-            Self::Stretch => Profile {
-                dc: 11,
-                length: 0.015,
-                girth: 0.0,
-                foreskin: Some((0.0, 1.8)),
-                foreskin_growth: 0.03,
-                lube: LubeRule::Optional,
-            },
-            Self::Uli => Profile {
-                dc: 15,
-                length: 0.002,
-                girth: 0.020,
-                foreskin: None,
-                foreskin_growth: 0.0,
-                lube: LubeRule::Optional,
-            },
-        };
-        Some(profile)
-    }
-
-    pub fn describe(self, forum_read: bool) -> Value {
-        let Some(p) = self.profile() else {
-            let effect = match self {
-                Self::Warmup => "EQ +25. Satisfies the warm-up precondition.",
-                Self::Ice => "EQ -40. Consumes an ice pack.",
-                Self::Edge => "EQ +15 and a little girth. Three in a row is a loop.",
-                Self::Pump => "Large gains, all temporary. Requires a pump.",
-                _ => "Consumes a supplement.",
-            };
-            return json!({ "name": self.name(), "effect": effect });
-        };
-        let lubricant = match p.lube {
-            LubeRule::Required => "required",
-            LubeRule::Forbidden => "forbidden",
-            LubeRule::Optional => "optional",
-        };
-        let foreskin = p
-            .foreskin
-            .map(|(min, max)| json!({ "min": min, "max": max }));
-        json!({
-            "name": self.name(),
-            "dc": p.dc,
-            "lubricant": lubricant,
-            "foreskin": foreskin,
-            "locked": self == Self::Uli && !forum_read,
-        })
-    }
-}
-
-pub struct ShopItem {
-    pub slug: &'static str,
-    pub price: u32,
-    pub description: &'static str,
-}
-
-pub const SHOP: [ShopItem; 11] = [
-    ShopItem {
-        slug: "pump",
-        price: 10,
-        description: "A pump.",
-    },
-    ShopItem {
-        slug: "pump-pro",
-        price: 15,
-        description: "A pump, but professional.",
-    },
-    ShopItem {
-        slug: "extender",
-        price: 15,
-        description: "Passive gains every turn. Takes up room.",
-    },
-    ShopItem {
-        slug: "cock-ring",
-        price: 8,
-        description: "Doubles girth gains. Pump-Bro does not discuss the risks.",
-    },
-    ShopItem {
-        slug: "supplement",
-        price: 5,
-        description: "Clinically formulated. Ships from overseas.",
-    },
-    ShopItem {
-        slug: "door-lock",
-        price: 5,
-        description: "Keeps the roommate out once.",
-    },
-    ShopItem {
-        slug: "do-not-disturb-sign",
-        price: 5,
-        description: "Housekeeping respects it.",
-    },
-    ShopItem {
-        slug: "ruler",
-        price: 5,
-        description: "Pump-Bro does not recommend it.",
-    },
-    ShopItem {
-        slug: "window-blinds",
-        price: 5,
-        description: "The neighbour has a good camera.",
-    },
-    ShopItem {
-        slug: "ice-pack",
-        price: 3,
-        description: "Cold.",
-    },
-    ShopItem {
-        slug: "cage-key",
-        price: 15,
-        description: "Pump-Bro does not ask.",
-    },
-];

Added file: src/game/clinic.rs+73 additions@@ -0,0 +1,73 @@
+use axum::http::{StatusCode, header};
+use serde_json::json;
+
+use super::{Floor, Outcome, Run, etag_matches, parse_credentials, round2};
+use crate::{headers::X_DIAGNOSIS, problem::Problem};
+
+const INTAKE: [&str; 3] = [
+    "The clinic does not accept excuses.",
+    "The clinic accepts one token. You have not been carrying it.",
+    "Be honest.",
+];
+
+impl Run {
+    pub fn diagnose(
+        &mut self,
+        authorization: Option<&str>,
+        if_none_match: Option<&str>,
+    ) -> Result<Outcome, Problem> {
+        if self.floor != Floor::Clinic {
+            let floors = Floor::Clinic.number() - self.floor.number();
+            return Err(Problem::new(
+                StatusCode::TOO_EARLY,
+                "no-appointment",
+                format!("The clinic's next available appointment is {floors} floors away."),
+            ));
+        }
+        let intake = Problem::new(
+            StatusCode::UNAUTHORIZED,
+            "intake",
+            "The clinic requires authorization.",
+        );
+        let Some(authorization) = authorization else {
+            return Err(intake.header(header::WWW_AUTHENTICATE, "Bearer realm=\"clinic\""));
+        };
+        let truthful = parse_credentials(authorization, "bearer")
+            .is_some_and(|token| token.eq_ignore_ascii_case("honesty"));
+        if !truthful {
+            let hint = INTAKE[self.clinic.intake_attempts.min(INTAKE.len() - 1)];
+            self.clinic.intake_attempts += 1;
+            return Err(intake.header(
+                header::WWW_AUTHENTICATE,
+                format!(
+                    "Bearer realm=\"clinic\", error=\"invalid_token\", error_description=\"{hint}\""
+                ),
+            ));
+        }
+
+        self.conditions.peyronie = false;
+        self.conditions.priapism_turns = 0;
+        let etag = self.origin_etag();
+        if if_none_match.is_some_and(|inm| etag_matches(inm, &etag)) {
+            self.clinic.cured = true;
+            return Ok(Outcome::empty(StatusCode::NOT_MODIFIED)
+                .header(header::ETAG, etag)
+                .header(X_DIAGNOSIS, "normal"));
+        }
+        if !self.clinic.measured {
+            self.clinic.measured = true;
+            if !self.items.ruler {
+                self.shame += 15;
+            }
+        }
+        Ok(Outcome::json(
+            StatusCode::OK,
+            json!({
+                "diagnosis": "within normal range",
+                "measured_length": round2(self.length),
+                "prescription": "Please stop.",
+            }),
+        )
+        .header(header::ETAG, etag))
+    }
+}

Deleted file: src/game/encounters.rs−773 deletions@@ -1,773 +0,0 @@
-use std::collections::HashMap;
-
-use axum::http::{HeaderName, StatusCode, header};
-use rand::Rng;
-use serde::Deserialize;
-use serde_json::{Value, json};
-
-use super::{
-    Floor, Grip, Outcome, Run, SHOP, SUSPICION_LIMIT, X_DIAGNOSIS, honest, parse_credentials,
-    round2,
-};
-use crate::problem::Problem;
-
-pub const FORUM_THREAD: &str = "/forum/threads/2009";
-pub const ELDER_LAST_MODIFIED: &str = "Sun, 14 Jun 2009 03:12:00 GMT";
-
-pub const EXCUSES: [&str; 3] = ["changing", "homework", "pulled a muscle"];
-pub const THANKSGIVING_EXCUSES: [&str; 3] = ["on a call", "folding laundry", "praying"];
-const TRUTHS: [&str; 3] = ["the truth", "truth", "honesty"];
-const PATIENCE: u8 = 3;
-const CAUGHT: &str = "Mom has seen enough. The run has ended. Nobody will mention it at dinner.";
-const BANNED: &str = "Your account has been banned. The forum can tell. The run has ended.";
-
-const INTAKE: [&str; 3] = [
-    "The clinic does not accept excuses.",
-    "The clinic accepts one token. You have not been carrying it.",
-    "Be honest.",
-];
-
-const SPREADSHEET: &str = "\
-date,length,girth,technique,notes,honest?
-2007-01-03,7.50,5.50,wet,baseline,no
-2007-06-11,7.50,5.50,wet,feeling fuller,no
-2008-01-02,7.50,5.50,dry,new routine,no
-2008-09-19,7.50,5.50,uli,PUT is idempotent. do not use PUT.,no
-2009-06-14,7.50,5.50,wet,progress is slow but real,no
-";
-
-pub fn forum_thread() -> Value {
-    json!({
-        "title": "The definitive jelqing FAQ (updated 2009)",
-        "posts": [
-            { "author": "TheElder", "body": "Warm up. Always warm up. A cold jelq is a 412 waiting to happen." },
-            { "author": "TheElder", "body": "Keep EQ between 50 and 70. Above 70 you are gambling. Above 90 you are a cautionary tale." },
-            { "author": "newbie_2009", "body": "I have been sending PUT for three weeks and nothing has changed." },
-            { "author": "TheElder", "body": "PUT is idempotent. Read the spec." },
-            { "author": "TheElder", "body": "Members verify with a Ruler. Proxy-Authorization, inches, no rounding up. We can tell." },
-            { "author": "throwaway_77", "body": "my doctor said i was normal. i didnt believe him. i still dont know what he meant by bearer" },
-            { "author": "TheElder", "body": "My numbers are in my spreadsheet. They have not changed since 2009. Nothing about me has changed since 2009." },
-        ],
-    })
-}
-
-#[derive(Deserialize)]
-pub struct PatchOp {
-    pub op: String,
-    pub path: String,
-    #[serde(default)]
-    pub value: Value,
-}
-
-fn digest_params(authorization: &str) -> Option<HashMap<String, String>> {
-    let (scheme, rest) = authorization.trim().split_once(' ')?;
-    if !scheme.eq_ignore_ascii_case("digest") {
-        return None;
-    }
-    Some(
-        rest.split(',')
-            .filter_map(|pair| {
-                let (key, value) = pair.split_once('=')?;
-                Some((
-                    key.trim().to_ascii_lowercase(),
-                    value.trim().trim_matches('"').to_owned(),
-                ))
-            })
-            .collect(),
-    )
-}
-
-fn exaggeration() -> Problem {
-    Problem::new(
-        StatusCode::BAD_REQUEST,
-        "exaggeration",
-        "The server has measured. Lying is not a technique.",
-    )
-}
-
-impl Run {
-    pub fn excuses(&self) -> Vec<&'static str> {
-        if self.floor.number() < Floor::Grandmas.number() {
-            return EXCUSES.to_vec();
-        }
-        EXCUSES
-            .into_iter()
-            .chain(THANKSGIVING_EXCUSES)
-            .filter(|e| !self.heard.iter().any(|h| h == e))
-            .collect()
-    }
-
-    pub fn answer_door(&mut self, authorization: Option<&str>) -> Result<(), Problem> {
-        let digest = self.floor == Floor::Grandmas;
-        let challenge_value = if digest {
-            format!("Digest realm=\"household\", nonce=\"{}\"", self.nonce)
-        } else {
-            "Excuse realm=\"household\"".to_owned()
-        };
-        let challenge = |p: Problem| p.header(header::WWW_AUTHENTICATE, &challenge_value);
-
-        let Some(authorization) = authorization else {
-            return Err(challenge(
-                Problem::new(
-                    StatusCode::UNAUTHORIZED,
-                    "someone-at-the-door",
-                    format!("Someone is at the door. {}", self.mom_errand),
-                )
-                .with("inventory", format!("/runs/{}/inventory", self.id)),
-            ));
-        };
-
-        let spoken = authorization
-            .split_once(' ')
-            .map(|(_, rest)| rest.trim().trim_matches('"').to_ascii_lowercase())
-            .unwrap_or_default();
-        if TRUTHS.contains(&spoken.as_str()) {
-            self.shame += 10;
-            self.leave_door();
-            return Ok(());
-        }
-        if parse_credentials(authorization, "basic").is_some() {
-            return Err(self.mom_strike(challenge(Problem::new(
-                StatusCode::UNAUTHORIZED,
-                "basic",
-                "Mom does not accept Basic authentication. Nobody should.",
-            ))));
-        }
-
-        let excuse = if digest {
-            let Some(params) = digest_params(authorization) else {
-                return Err(self.mom_strike(challenge(Problem::new(
-                    StatusCode::UNAUTHORIZED,
-                    "digest-required",
-                    "Mom has started using Digest authentication.",
-                ))));
-            };
-            if params.get("nonce") != Some(&self.nonce) {
-                return Err(self.mom_strike(challenge(Problem::new(
-                    StatusCode::UNAUTHORIZED,
-                    "stale-nonce",
-                    "That was a different conversation.",
-                ))));
-            }
-            params.get("username").cloned().unwrap_or_default()
-        } else {
-            parse_credentials(authorization, "excuse")
-                .unwrap_or_default()
-                .to_owned()
-        };
-        let excuse = excuse.to_ascii_lowercase();
-
-        if TRUTHS.contains(&excuse.as_str()) {
-            self.shame += 10;
-            self.leave_door();
-            return Ok(());
-        }
-        let true_now = self.pulled_muscle && excuse == "pulled a muscle";
-        if digest && self.heard.contains(&excuse) && !true_now {
-            self.shame += 3;
-            self.touch();
-            return Err(self.mom_strike(challenge(Problem::new(
-                StatusCode::UNAUTHORIZED,
-                "excuse-replayed",
-                "Mom has heard that one before. She would have preferred the truth.",
-            ))));
-        }
-        if true_now || self.excuses().contains(&excuse.as_str()) {
-            self.heard.push(excuse);
-            self.leave_door();
-            return Ok(());
-        }
-        self.shame += 3;
-        self.touch();
-        let detail = if digest {
-            "Mom has not heard that one before. She does not believe it. She would have preferred the truth."
-        } else {
-            "Mom has not heard that one before. She does not believe it."
-        };
-        Err(self.mom_strike(challenge(Problem::new(
-            StatusCode::UNAUTHORIZED,
-            "excuse-rejected",
-            detail,
-        ))))
-    }
-
-    pub(super) fn errand(&mut self, summoned: bool) -> &'static str {
-        if summoned {
-            return "She heard a noise.";
-        }
-        if self.filmed_at.is_some() && self.rng.random_ratio(1, 2) {
-            return "A neighbour has sent her something.";
-        }
-        let errands: &[&'static str] = if self.floor == Floor::Grandmas {
-            &[
-                "Grandma would like to see you.",
-                "Dinner is in ten minutes.",
-                "She needs help with the folding table.",
-                "An uncle has asked where you went.",
-            ]
-        } else {
-            &[
-                "She has brought laundry.",
-                "She wants to know if you have eaten.",
-                "She needs the wifi password.",
-                "She would like to talk about your future.",
-            ]
-        };
-        errands[self.rng.random_range(0..errands.len())]
-    }
-
-    fn mom_strike(&mut self, problem: Problem) -> Problem {
-        self.mom_strikes += 1;
-        self.touch();
-        if self.mom_strikes < PATIENCE {
-            return problem;
-        }
-        self.end("caught", CAUGHT);
-        Problem::new(StatusCode::GONE, "caught", CAUGHT)
-    }
-
-    fn elder_strike(&mut self, problem: Problem) -> Problem {
-        self.elder_strikes += 1;
-        self.touch();
-        if self.elder_strikes < PATIENCE {
-            return problem;
-        }
-        self.end("banned", BANNED);
-        Problem::new(StatusCode::FORBIDDEN, "banned", BANNED)
-    }
-
-    fn leave_door(&mut self) {
-        self.mom_strikes = 0;
-        self.mom_present = false;
-        self.suspicion = 0;
-        self.touch();
-    }
-
-    pub(super) fn floor_enemy(&mut self) -> Result<(), Problem> {
-        let wanders_in = matches!(self.floor, Floor::Bathroom | Floor::Hotel)
-            && self.rng.random_ratio(u32::from(self.suspicion) + 1, 32);
-        if self.suspicion < SUSPICION_LIMIT && !wanders_in {
-            return Ok(());
-        }
-        match self.floor {
-            Floor::Bathroom => {
-                self.suspicion = 0;
-                self.touch();
-                if self.items.door_locks > 0 {
-                    self.items.door_locks -= 1;
-                    return Ok(());
-                }
-                self.roommate_told = true;
-                Err(Problem::new(
-                    StatusCode::CONFLICT,
-                    "roommate",
-                    "The roommate needs the bathroom. He will mention this to people.",
-                ))
-            }
-            Floor::LockerRoom => {
-                self.suspicion = 0;
-                self.shame += 5;
-                self.touch();
-                Err(Problem::new(
-                    StatusCode::UNAVAILABLE_FOR_LEGAL_REASONS,
-                    "gym-staff",
-                    "Gym staff have been notified. The server cannot serve this request for legal reasons.",
-                ))
-            }
-            Floor::Hotel => {
-                self.suspicion = 0;
-                self.touch();
-                if self.items.dnd_sign {
-                    return Ok(());
-                }
-                self.shame += 3;
-                Err(Problem::new(
-                    StatusCode::UNAUTHORIZED,
-                    "housekeeping",
-                    "Housekeeping has entered. Housekeeping accepts no excuses.",
-                )
-                .header(header::WWW_AUTHENTICATE, "Excuse realm=\"housekeeping\""))
-            }
-            _ => Ok(()),
-        }
-    }
-
-    pub fn search_drawer(&mut self) -> Result<Outcome, Problem> {
-        self.drawer_searches += 1;
-        self.touch();
-        let first = self.drawer_searches == 1;
-        let id = self.id.clone();
-        let found = |slug: &str, detail: &str| {
-            Outcome::json(StatusCode::FOUND, json!({ "detail": detail }))
-                .header(header::LOCATION, format!("/runs/{id}/inventory/{slug}"))
-        };
-        match self.floor {
-            Floor::Bedroom if first && !self.items.ruler => {
-                self.items.ruler = true;
-                self.shame += 10;
-                Ok(found(
-                    "ruler",
-                    "You now know. This is the first honest measurement of the run.",
-                ))
-            }
-            Floor::Bathroom if first => {
-                self.items.door_locks += 1;
-                Ok(found("door-lock", "A door lock. It works once."))
-            }
-            Floor::LockerRoom => {
-                self.shame += 3;
-                Err(Problem::new(
-                    StatusCode::UNAVAILABLE_FOR_LEGAL_REASONS,
-                    "not-your-locker",
-                    "That locker belongs to Greg. The server cannot serve this request for legal reasons.",
-                ))
-            }
-            Floor::Grandmas if first => {
-                self.items.cage = true;
-                self.shame += 5;
-                Ok(found(
-                    "chastity-cage",
-                    "A small box. Inside was a cage. It is now on. The key is not in the box.",
-                ))
-            }
-            Floor::Grandmas if self.items.cage => {
-                self.items.cage = false;
-                Ok(Outcome::json(
-                    StatusCode::OK,
-                    json!({ "detail": "The key was under where the box had been. The cage is off." }),
-                ))
-            }
-            Floor::Hotel if first => {
-                self.items.dnd_sign = true;
-                self.items.ice_packs += 2;
-                Ok(found(
-                    "do-not-disturb-sign",
-                    "A Do Not Disturb sign, and two ice packs from the machine down the hall.",
-                ))
-            }
-            Floor::Forum if first => {
-                self.items.spreadsheet = true;
-                Ok(found(
-                    "spreadsheet",
-                    "Your own spreadsheet. Every line is flat.",
-                ))
-            }
-            Floor::Clinic => Err(Problem::new(
-                StatusCode::FORBIDDEN,
-                "doctors-drawer",
-                "That is the doctor's drawer.",
-            )),
-            _ => Ok(Outcome::empty(StatusCode::NO_CONTENT)),
-        }
-    }
-
-    pub fn shop_view(&self) -> Result<Value, Problem> {
-        if !self.floor.shop_open() {
-            return Err(pump_bro_absent());
-        }
-        let stock: Vec<Value> = SHOP
-            .iter()
-            .map(|item| {
-                json!({
-                    "item": item.slug,
-                    "price": item.price,
-                    "description": item.description,
-                    "href": format!("/runs/{}/shop/{}", self.id, item.slug),
-                    "method": "POST",
-                })
-            })
-            .collect();
-        Ok(json!({ "merchant": "Pump-Bro", "cash": self.cash, "stock": stock }))
-    }
-
-    pub fn buy(&mut self, slug: &str) -> Result<Outcome, Problem> {
-        if !self.floor.shop_open() {
-            return Err(pump_bro_absent());
-        }
-        let Some(item) = SHOP.iter().find(|i| i.slug == slug) else {
-            return Err(Problem::new(
-                StatusCode::NOT_FOUND,
-                "not-for-sale",
-                "Pump-Bro does not sell that. He knows a guy.",
-            ));
-        };
-        if slug == "pump" {
-            return Err(Problem::new(
-                StatusCode::UPGRADE_REQUIRED,
-                "upsell",
-                "This pump requires an upgrade.",
-            )
-            .header(header::UPGRADE, "pump-pro/2.0")
-            .with("upgrade", format!("/runs/{}/shop/pump-pro", self.id)));
-        }
-        if self.cash < item.price {
-            return Err(Problem::new(
-                StatusCode::PAYMENT_REQUIRED,
-                "insufficient-funds",
-                "Payment is required. RFC 9110 has reserved this status for future use since 1997. The future is here and you cannot afford it.",
-            )
-            .with("cash", self.cash)
-            .with("price", item.price));
-        }
-        self.cash -= item.price;
-        self.touch();
-        let items = &mut self.items;
-        match slug {
-            "supplement" => {
-                items.supplements += 1;
-                return Err(Problem::new(
-                    StatusCode::GATEWAY_TIMEOUT,
-                    "still-shipping",
-                    "The supplement is still shipping. You have been charged. It may arrive.",
-                )
-                .with("cash", self.cash));
-            }
-            "pump-pro" => items.pump_pro = true,
-            "extender" => items.extender = true,
-            "cock-ring" => items.ring = true,
-            "door-lock" => items.door_locks += 1,
-            "do-not-disturb-sign" => items.dnd_sign = true,
-            "ruler" => items.ruler = true,
-            "ice-pack" => items.ice_packs += 1,
-            "window-blinds" => items.blinds = true,
-            _ => items.cage = false,
-        }
-        Ok(Outcome::json(
-            StatusCode::CREATED,
-            json!({ "detail": "Purchased. No refunds.", "cash": self.cash }),
-        )
-        .header(
-            header::LOCATION,
-            format!("/runs/{}/inventory/{slug}", self.id),
-        ))
-    }
-
-    pub fn drop_item(&mut self, slug: &str) -> Result<Outcome, Problem> {
-        match slug {
-            "extender" => self.items.extender = false,
-            "cock-ring" => self.items.ring = false,
-            "chastity-cage" => {
-                return Err(Problem::new(
-                    StatusCode::LOCKED,
-                    "caged",
-                    "The cage is locked.",
-                ));
-            }
-            _ => {
-                return Err(Problem::new(
-                    StatusCode::FORBIDDEN,
-                    "cannot-be-dropped",
-                    "That cannot be dropped.",
-                ));
-            }
-        }
-        self.touch();
-        Ok(Outcome::empty(StatusCode::NO_CONTENT))
-    }
-
-    pub(super) fn branch_offer(&self) -> Outcome {
-        let forum = format!("/runs/{}/branches/forum", self.id);
-        let close = format!("/runs/{}/branches/close-tab", self.id);
-        Outcome::json(
-            StatusCode::MULTIPLE_CHOICES,
-            json!({
-                "detail": "A browser tab is open. It has been open for some time.",
-                "choices": [
-                    { "href": forum, "method": "POST", "title": "Read the forum" },
-                    { "href": close, "method": "POST", "title": "Close the tab" },
-                ],
-            }),
-        )
-        .header(
-            header::LINK,
-            format!(
-                "<{forum}>; rel=\"alternate\"; title=\"Read the forum\", <{close}>; rel=\"alternate\"; title=\"Close the tab\""
-            ),
-        )
-    }
-
-    pub fn choose(&mut self, choice: &str) -> Result<Outcome, Problem> {
-        if !self.branch_pending {
-            return Err(Problem::new(
-                StatusCode::CONFLICT,
-                "no-decision-pending",
-                "There is no decision pending.",
-            ));
-        }
-        let (location, detail) = match choice {
-            "forum" => {
-                self.forum_read = true;
-                self.shame += 3;
-                (
-                    format!("/runs/{}/techniques", self.id),
-                    "The thread is from 2009. A technique called uli is discussed at length.",
-                )
-            }
-            "close-tab" => {
-                self.suspicion = 0;
-                (
-                    format!("/runs/{}", self.id),
-                    "The tab is closed. Nobody saw it.",
-                )
-            }
-            _ => {
-                return Err(Problem::new(
-                    StatusCode::NOT_FOUND,
-                    "no-such-choice",
-                    "That was not one of the choices.",
-                ));
-            }
-        };
-        self.branch_pending = false;
-        self.touch();
-        Ok(
-            Outcome::json(StatusCode::SEE_OTHER, json!({ "detail": detail }))
-                .header(header::LOCATION, location),
-        )
-    }
-
-    pub fn put(&mut self) -> Outcome {
-        if self.put_applied {
-            return Outcome::empty(StatusCode::NO_CONTENT);
-        }
-        self.put_applied = true;
-        self.length += 0.01;
-        self.touch();
-        Outcome::json(StatusCode::OK, json!({ "detail": "Applied." }))
-    }
-
-    pub fn patch(&mut self, ops: &[PatchOp]) -> Result<Outcome, Problem> {
-        for op in ops {
-            if op.op != "test" {
-                return Err(Problem::new(
-                    StatusCode::UNPROCESSABLE_ENTITY,
-                    "wishful-thinking",
-                    "The server accepts only the truth.",
-                )
-                .with("op", op.op.clone()));
-            }
-            let actual = match op.path.as_str() {
-                "/length" => self.current_length(),
-                "/girth" => self.girth,
-                "/foreskin" => self.foreskin.unwrap_or(0.0),
-                _ => {
-                    return Err(Problem::new(
-                        StatusCode::UNPROCESSABLE_ENTITY,
-                        "no-such-measurement",
-                        "There is no such measurement.",
-                    )
-                    .with("path", op.path.clone()));
-                }
-            };
-            let Some(claimed) = op.value.as_f64() else {
-                return Err(Problem::new(
-                    StatusCode::BAD_REQUEST,
-                    "malformed-patch",
-                    "A test requires a numeric value.",
-                ));
-            };
-            if op.path == "/length" && claimed >= actual + 1.0 {
-                self.shame += 2;
-                self.touch();
-                return Err(exaggeration());
-            }
-            if !honest(claimed, actual) {
-                self.shame += 1;
-                self.touch();
-                return Err(
-                    Problem::new(StatusCode::CONFLICT, "test-failed", "The test failed.")
-                        .with("path", op.path.clone()),
-                );
-            }
-        }
-        Ok(Outcome::json(
-            StatusCode::OK,
-            json!({ "detail": "Correct." }),
-        ))
-    }
-
-    pub fn delete_foreskin(&mut self, if_match: Option<&str>) -> Result<Outcome, Problem> {
-        if self.foreskin.is_none() {
-            return Err(Problem::new(
-                StatusCode::GONE,
-                "foreskin-gone",
-                "The foreskin is gone. It will not be returning.",
-            ));
-        }
-        let Some(if_match) = if_match else {
-            return Err(Problem::new(
-                StatusCode::PRECONDITION_REQUIRED,
-                "confirmation-required",
-                "The server requires you to be sure. Send If-Match.",
-            ));
-        };
-        if !super::etag_matches(if_match, &self.etag()) {
-            return Err(Problem::new(
-                StatusCode::PRECONDITION_FAILED,
-                "stale-foreskin",
-                "The foreskin has changed since you last looked at it.",
-            ));
-        }
-        self.foreskin = None;
-        self.shame += 20;
-        self.touch();
-        Ok(Outcome::empty(StatusCode::NO_CONTENT))
-    }
-
-    pub fn set_grip(&mut self, grip: Grip) {
-        self.grip = grip;
-        self.touch();
-    }
-
-    pub fn accept_terms(&mut self) -> Result<Outcome, Problem> {
-        if self.floor != Floor::Hotel {
-            return Err(Problem::new(
-                StatusCode::NOT_FOUND,
-                "no-portal",
-                "There is no captive portal here. There is only the regular kind of captivity.",
-            ));
-        }
-        self.wifi_accepted = true;
-        self.touch();
-        Ok(Outcome::json(
-            StatusCode::SEE_OTHER,
-            json!({ "detail": "Connected. The hotel does not want to know." }),
-        )
-        .header(header::LOCATION, format!("/runs/{}", self.id)))
-    }
-
-    pub fn elder(
-        &mut self,
-        proxy_authorization: Option<&str>,
-        if_modified_since: Option<&str>,
-    ) -> Result<Outcome, Problem> {
-        if self.floor != Floor::Forum {
-            return Err(Problem::new(
-                StatusCode::NOT_FOUND,
-                "elder-absent",
-                "The Elder only posts on the forum.",
-            ));
-        }
-        if !self.verified {
-            let verification = |detail: &str| {
-                Problem::new(
-                    StatusCode::PROXY_AUTHENTICATION_REQUIRED,
-                    "verification-required",
-                    detail,
-                )
-                .header(header::PROXY_AUTHENTICATE, "Ruler realm=\"forum\"")
-            };
-            let Some(credentials) = proxy_authorization else {
-                return Err(verification("The forum requires verification."));
-            };
-            let Some(claimed) =
-                parse_credentials(credentials, "ruler").and_then(|v| v.parse::<f64>().ok())
-            else {
-                return Err(verification("The forum requires verification, in inches."));
-            };
-            let actual = self.current_length();
-            if claimed >= actual + 1.0 {
-                self.shame += 2;
-                return Err(self.elder_strike(exaggeration()));
-            }
-            if !honest(claimed, actual) {
-                self.shame += 1;
-                return Err(
-                    self.elder_strike(verification("Verification failed. The forum can tell."))
-                );
-            }
-            self.verified = true;
-            self.touch();
-        }
-
-        let last_modified =
-            httpdate::parse_http_date(ELDER_LAST_MODIFIED).expect("valid constant date");
-        let current = if_modified_since
-            .and_then(|d| httpdate::parse_http_date(d).ok())
-            .is_some_and(|since| since >= last_modified);
-        if current {
-            self.elder_beaten = true;
-            self.touch();
-            return Ok(Outcome::empty(StatusCode::NOT_MODIFIED)
-                .header(header::LAST_MODIFIED, ELDER_LAST_MODIFIED));
-        }
-        let spreadsheet = Outcome::raw(StatusCode::OK, "text/csv; header=present", SPREADSHEET)
-            .header(header::LAST_MODIFIED, ELDER_LAST_MODIFIED);
-        if self.filmed_at.is_some() {
-            return Ok(spreadsheet.header(
-                HeaderName::from_static("x-forum-note"),
-                "We have seen the footage.",
-            ));
-        }
-        Ok(spreadsheet)
-    }
-
-    pub fn diagnose(
-        &mut self,
-        authorization: Option<&str>,
-        if_none_match: Option<&str>,
-    ) -> Result<Outcome, Problem> {
-        if self.floor != Floor::Clinic {
-            let floors = Floor::Clinic.number() - self.floor.number();
-            return Err(Problem::new(
-                StatusCode::TOO_EARLY,
-                "no-appointment",
-                format!("The clinic's next available appointment is {floors} floors away."),
-            ));
-        }
-        let intake = Problem::new(
-            StatusCode::UNAUTHORIZED,
-            "intake",
-            "The clinic requires authorization.",
-        );
-        let Some(authorization) = authorization else {
-            return Err(intake.header(header::WWW_AUTHENTICATE, "Bearer realm=\"clinic\""));
-        };
-        let truthful = parse_credentials(authorization, "bearer")
-            .is_some_and(|token| token.eq_ignore_ascii_case("honesty"));
-        if !truthful {
-            let hint = INTAKE[self.intake_attempts.min(INTAKE.len() - 1)];
-            self.intake_attempts += 1;
-            return Err(intake.header(
-                header::WWW_AUTHENTICATE,
-                format!(
-                    "Bearer realm=\"clinic\", error=\"invalid_token\", error_description=\"{hint}\""
-                ),
-            ));
-        }
-
-        self.peyronie = false;
-        self.priapism_turns = 0;
-        let etag = self.origin_etag.clone();
-        if if_none_match.is_some_and(|inm| super::etag_matches(inm, &etag)) {
-            self.cured = true;
-            return Ok(Outcome::empty(StatusCode::NOT_MODIFIED)
-                .header(header::ETAG, etag)
-                .header(X_DIAGNOSIS, "normal"));
-        }
-        if !self.measured {
-            self.measured = true;
-            if !self.items.ruler {
-                self.shame += 15;
-            }
-        }
-        Ok(Outcome::json(
-            StatusCode::OK,
-            json!({
-                "diagnosis": "within normal range",
-                "measured_length": round2(self.length),
-                "you_said": round2(self.self_reported()),
-                "prescription": "Please stop.",
-            }),
-        )
-        .header(header::ETAG, etag))
-    }
-}
-
-fn pump_bro_absent() -> Problem {
-    Problem::new(
-        StatusCode::NOT_FOUND,
-        "pump-bro-absent",
-        "Pump-Bro is not here.",
-    )
-}

Added file: src/game/floors.rs+193 additions@@ -0,0 +1,193 @@
+use axum::http::{StatusCode, header};
+use serde_json::{Value, json};
+
+use super::{
+    Cause, Elder, Floor, FloorState, Item, Outcome, Run,
+    balance::{FLOOR_ALLOWANCE, FLOOR_TURNS, STARTING_EQ, ZIPPER},
+    round2,
+};
+use crate::problem::Problem;
+
+impl Run {
+    pub(super) fn next_floor(&mut self, paid: bool) {
+        let Some(next) = self.floor.next() else {
+            return;
+        };
+        self.floor = next;
+        self.here = FloorState::default();
+        self.warmed_up = false;
+        self.eq = STARTING_EQ;
+        self.suspicion = 0;
+        self.mom = None;
+        if paid {
+            self.cash += FLOOR_ALLOWANCE;
+        }
+        self.touch();
+    }
+
+    pub fn advance(&mut self) -> Result<Outcome, Problem> {
+        match self.floor {
+            Floor::Clinic => {
+                return Err(Problem::new(
+                    StatusCode::CONFLICT,
+                    "no-further-floor",
+                    "There is no further floor. There is only the diagnosis.",
+                ));
+            }
+            Floor::Forum if self.elder != Elder::Beaten => {
+                return Err(Problem::new(
+                    StatusCode::CONFLICT,
+                    "elder-unaddressed",
+                    "The Elder has not been addressed.",
+                )
+                .with("elder", self.path("/elder")));
+            }
+            floor if floor.timed() && self.here.turns < FLOOR_TURNS => {
+                return Err(Problem::new(
+                    StatusCode::TOO_EARLY,
+                    "floor-not-over",
+                    format!(
+                        "The floor is not over. {} turns remain.",
+                        FLOOR_TURNS - self.here.turns
+                    ),
+                ));
+            }
+            _ => {}
+        }
+        if self.chance(ZIPPER) {
+            return Err(self.end(Cause::Zipper));
+        }
+        let reverted = self.here.temp_length;
+        self.next_floor(true);
+        let mut body = json!({
+            "detail": format!("You have arrived at {}.", self.floor.name()),
+            "note": self.floor.note(),
+        });
+        if reverted > 0.0 {
+            body["reverted"] = json!(round2(reverted));
+        }
+        Ok(
+            Outcome::json(StatusCode::SEE_OTHER, body)
+                .header(header::LOCATION, self.path("/floor")),
+        )
+    }
+
+    pub fn floor_view(&self) -> Value {
+        let mut view = json!({
+            "name": self.floor.name(),
+            "note": self.floor.note(),
+            "turns": self.here.turns,
+            "turns_required": self.floor.timed().then_some(FLOOR_TURNS),
+            "exit": { "href": self.path("/floor"), "method": "POST" },
+        });
+        match self.floor {
+            Floor::LockerRoom => {
+                view["others"] = json!([
+                    { "name": "Greg", "self_reported_length": 9.5 },
+                    { "name": "Dmitri", "self_reported_length": 8.75 },
+                    { "name": "a man in a towel", "self_reported_length": 11.0 },
+                ]);
+            }
+            Floor::Hotel => view["portal"] = json!(self.path("/portal")),
+            Floor::Forum => {
+                view["thread"] = json!(super::FORUM_THREAD);
+                view["elder"] = json!(self.path("/elder"));
+            }
+            Floor::Clinic => view["diagnosis"] = json!(self.path("/diagnosis")),
+            _ => {}
+        }
+        if self.floor.shop_open() {
+            view["shop"] = json!(self.path("/shop"));
+        }
+        view
+    }
+
+    fn found(&self, item: Item, detail: &str) -> Outcome {
+        Outcome::json(StatusCode::FOUND, json!({ "detail": detail })).header(
+            header::LOCATION,
+            self.path(&format!("/inventory/{}", item.slug())),
+        )
+    }
+
+    pub fn search_drawer(&mut self) -> Result<Outcome, Problem> {
+        self.here.drawer_searches += 1;
+        self.touch();
+        let first = self.here.drawer_searches == 1;
+        match self.floor {
+            Floor::Bedroom if first && !self.items.ruler => {
+                self.items.grant(Item::Ruler);
+                self.shame += 10;
+                Ok(self.found(
+                    Item::Ruler,
+                    "You now know. This is the first honest measurement of the run.",
+                ))
+            }
+            Floor::Bathroom if first => {
+                self.items.grant(Item::DoorLock);
+                Ok(self.found(Item::DoorLock, "A door lock. It works once."))
+            }
+            Floor::LockerRoom => {
+                self.shame += 3;
+                Err(Problem::new(
+                    StatusCode::UNAVAILABLE_FOR_LEGAL_REASONS,
+                    "not-your-locker",
+                    "That locker belongs to Greg. The server cannot serve this request for legal reasons.",
+                ))
+            }
+            Floor::Grandmas if first => {
+                self.items.grant(Item::Cage);
+                self.shame += 5;
+                Ok(self.found(
+                    Item::Cage,
+                    "A small box. Inside was a cage. It is now on. The key is not in the box.",
+                ))
+            }
+            Floor::Grandmas if self.items.cage => {
+                self.items.grant(Item::CageKey);
+                Ok(Outcome::json(
+                    StatusCode::OK,
+                    json!({ "detail": "The key was under where the box had been. The cage is off." }),
+                ))
+            }
+            Floor::Hotel if first => {
+                self.items.grant(Item::DndSign);
+                self.items.grant(Item::IcePack);
+                self.items.grant(Item::IcePack);
+                Ok(self.found(
+                    Item::DndSign,
+                    "A Do Not Disturb sign, and two ice packs from the machine down the hall.",
+                ))
+            }
+            Floor::Forum if first => {
+                self.items.grant(Item::Spreadsheet);
+                Ok(self.found(
+                    Item::Spreadsheet,
+                    "Your own spreadsheet. Every line is flat.",
+                ))
+            }
+            Floor::Clinic => Err(Problem::new(
+                StatusCode::FORBIDDEN,
+                "doctors-drawer",
+                "That is the doctor's drawer.",
+            )),
+            _ => Ok(Outcome::empty(StatusCode::NO_CONTENT)),
+        }
+    }
+
+    pub fn accept_terms(&mut self) -> Result<Outcome, Problem> {
+        if self.floor != Floor::Hotel {
+            return Err(Problem::new(
+                StatusCode::NOT_FOUND,
+                "no-portal",
+                "There is no captive portal here. There is only the regular kind of captivity.",
+            ));
+        }
+        self.here.wifi_accepted = true;
+        self.touch();
+        Ok(Outcome::json(
+            StatusCode::SEE_OTHER,
+            json!({ "detail": "Connected. The hotel does not want to know." }),
+        )
+        .header(header::LOCATION, self.path("")))
+    }
+}

Added file: src/game/forum.rs+184 additions@@ -0,0 +1,184 @@
+use axum::http::{StatusCode, header};
+use serde_json::{Value, json};
+
+use super::{
+    Cause, Elder, Floor, Outcome, Run, Story,
+    balance::{EXAGGERATION, PATIENCE},
+    body::exaggeration,
+    honest, parse_credentials,
+};
+use crate::{headers::X_FORUM_NOTE, problem::Problem};
+
+pub const FORUM_THREAD: &str = "/forum/threads/2009";
+pub const ELDER_LAST_MODIFIED: &str = "Sun, 14 Jun 2009 03:12:00 GMT";
+
+const SPREADSHEET: &str = "\
+date,length,girth,technique,notes,honest?
+2007-01-03,7.50,5.50,wet,baseline,no
+2007-06-11,7.50,5.50,wet,feeling fuller,no
+2008-01-02,7.50,5.50,dry,new routine,no
+2008-09-19,7.50,5.50,uli,PUT is idempotent. do not use PUT.,no
+2009-06-14,7.50,5.50,wet,progress is slow but real,no
+";
+
+pub fn forum_thread() -> Value {
+    json!({
+        "title": "The definitive jelqing FAQ (updated 2009)",
+        "posts": [
+            { "author": "TheElder", "body": "Warm up. Always warm up. A cold jelq is a 412 waiting to happen." },
+            { "author": "TheElder", "body": "Keep EQ between 50 and 70. Above 70 you are gambling. Above 90 you are a cautionary tale." },
+            { "author": "newbie_2009", "body": "I have been sending PUT for three weeks and nothing has changed." },
+            { "author": "TheElder", "body": "PUT is idempotent. Read the spec." },
+            { "author": "TheElder", "body": "Members verify with a Ruler. Proxy-Authorization, inches, no rounding up. We can tell." },
+            { "author": "throwaway_77", "body": "my doctor said i was normal. i didnt believe him. i still dont know what he meant by bearer" },
+            { "author": "TheElder", "body": "My numbers are in my spreadsheet. They have not changed since 2009. Nothing about me has changed since 2009." },
+        ],
+    })
+}
+
+fn verification(detail: &str) -> Problem {
+    Problem::new(
+        StatusCode::PROXY_AUTHENTICATION_REQUIRED,
+        "verification-required",
+        detail,
+    )
+    .header(header::PROXY_AUTHENTICATE, "Ruler realm=\"forum\"")
+}
+
+impl Run {
+    pub(super) fn branch_offer(&self) -> Outcome {
+        let forum = self.path("/branches/forum");
+        let close = self.path("/branches/close-tab");
+        Outcome::json(
+            StatusCode::MULTIPLE_CHOICES,
+            json!({
+                "detail": "A browser tab is open. It has been open for some time.",
+                "choices": [
+                    { "href": forum, "method": "POST", "title": "Read the forum" },
+                    { "href": close, "method": "POST", "title": "Close the tab" },
+                ],
+            }),
+        )
+        .header(
+            header::LINK,
+            format!(
+                "<{forum}>; rel=\"alternate\"; title=\"Read the forum\", <{close}>; rel=\"alternate\"; title=\"Close the tab\""
+            ),
+        )
+    }
+
+    pub fn choose(&mut self, choice: &str) -> Result<Outcome, Problem> {
+        if self.story != Story::Pending {
+            return Err(Problem::new(
+                StatusCode::CONFLICT,
+                "no-decision-pending",
+                "There is no decision pending.",
+            ));
+        }
+        let (story, location, detail) = match choice {
+            "forum" => {
+                self.shame += 3;
+                (
+                    Story::ReadForum,
+                    self.path("/techniques"),
+                    "The thread is from 2009. A technique called uli is discussed at length.",
+                )
+            }
+            "close-tab" => {
+                self.suspicion = 0;
+                (
+                    Story::ClosedTab,
+                    self.path(""),
+                    "The tab is closed. Nobody saw it.",
+                )
+            }
+            _ => {
+                return Err(Problem::new(
+                    StatusCode::NOT_FOUND,
+                    "no-such-choice",
+                    "That was not one of the choices.",
+                ));
+            }
+        };
+        self.story = story;
+        self.touch();
+        Ok(
+            Outcome::json(StatusCode::SEE_OTHER, json!({ "detail": detail }))
+                .header(header::LOCATION, location),
+        )
+    }
+
+    fn elder_strike(&mut self, problem: Problem) -> Problem {
+        self.touch();
+        let Elder::Unverified { strikes } = &mut self.elder else {
+            return problem;
+        };
+        *strikes += 1;
+        if *strikes < PATIENCE {
+            return problem;
+        }
+        self.end(Cause::Banned)
+    }
+
+    /// Failed verification counts toward a ban even on GET, the way repeated bad credentials lock an account.
+    fn verify_member(&mut self, proxy_authorization: Option<&str>) -> Result<(), Problem> {
+        if !matches!(self.elder, Elder::Unverified { .. }) {
+            return Ok(());
+        }
+        let Some(credentials) = proxy_authorization else {
+            return Err(verification("The forum requires verification."));
+        };
+        let Some(claimed) =
+            parse_credentials(credentials, "ruler").and_then(|v| v.parse::<f64>().ok())
+        else {
+            return Err(verification("The forum requires verification, in inches."));
+        };
+        let actual = self.current_length();
+        if claimed >= actual + EXAGGERATION {
+            self.shame += 2;
+            return Err(self.elder_strike(exaggeration()));
+        }
+        if !honest(claimed, actual) {
+            self.shame += 1;
+            return Err(self.elder_strike(verification("Verification failed. The forum can tell.")));
+        }
+        self.elder = Elder::Verified;
+        self.touch();
+        Ok(())
+    }
+
+    pub fn elder(
+        &mut self,
+        proxy_authorization: Option<&str>,
+        if_modified_since: Option<&str>,
+    ) -> Result<Outcome, Problem> {
+        if self.floor != Floor::Forum {
+            return Err(Problem::new(
+                StatusCode::NOT_FOUND,
+                "elder-absent",
+                "The Elder only posts on the forum.",
+            ));
+        }
+        self.verify_member(proxy_authorization)?;
+
+        let last_modified =
+            httpdate::parse_http_date(ELDER_LAST_MODIFIED).expect("valid constant date");
+        let current = if_modified_since
+            .and_then(|d| httpdate::parse_http_date(d).ok())
+            .is_some_and(|since| since >= last_modified);
+        if current {
+            if self.elder != Elder::Beaten {
+                self.elder = Elder::Beaten;
+                self.touch();
+            }
+            return Ok(Outcome::empty(StatusCode::NOT_MODIFIED)
+                .header(header::LAST_MODIFIED, ELDER_LAST_MODIFIED));
+        }
+        let spreadsheet = Outcome::raw(StatusCode::OK, "text/csv; header=present", SPREADSHEET)
+            .header(header::LAST_MODIFIED, ELDER_LAST_MODIFIED);
+        if self.filmed_at.is_some() {
+            return Ok(spreadsheet.header(X_FORUM_NOTE, "We have seen the footage."));
+        }
+        Ok(spreadsheet)
+    }
+}

Added file: src/game/hazards.rs+148 additions@@ -0,0 +1,148 @@
+use std::{ops::ControlFlow, time::SystemTime};
+
+use axum::http::{StatusCode, header};
+use rand::Rng;
+use serde_json::json;
+
+use super::{
+    Cause, Floor, Outcome, Run,
+    balance::{
+        COLD_EQ, CURVE_MISSES, DANGER_EQ, DEGLOVING, DEGLOVING_INTENSITY, FRIEND, HOT_EQ,
+        PREMATURE_EQ, RUPTURE_HOT, RUPTURE_IN_BAND, RUPTURE_PREMATURE, RUPTURE_WARM,
+        SUSPICION_LIMIT, WANDERER_VISIT, WINDOW,
+    },
+    techniques::Training,
+};
+use crate::problem::Problem;
+
+type Interruption = Result<ControlFlow<Outcome>, Problem>;
+
+impl Run {
+    /// Accidents tied to a specific technique.
+    pub(super) fn mishaps(&mut self, training: Training, intensity: i32) -> Interruption {
+        if training == Training::Dry && intensity >= DEGLOVING_INTENSITY && self.chance(DEGLOVING) {
+            return Err(self.end(Cause::Degloved));
+        }
+        Ok(ControlFlow::Continue(()))
+    }
+
+    /// Everything that can go wrong on a committed turn before the roll.
+    pub(super) fn hazards(&mut self, intensity: i32) -> Interruption {
+        let odds = if self.eq <= DANGER_EQ {
+            RUPTURE_IN_BAND
+        } else if self.eq <= HOT_EQ {
+            RUPTURE_WARM
+        } else {
+            RUPTURE_HOT
+        };
+        if self.chance(odds) {
+            return Err(self.rupture());
+        }
+        if self.floor.has_window() && !self.items.blinds && self.chance(WINDOW) {
+            self.shame += 30;
+            self.filmed_at.get_or_insert_with(SystemTime::now);
+            return Ok(ControlFlow::Break(
+                Outcome::json(
+                    StatusCode::CREATED,
+                    json!({ "detail": "A neighbour was at the window. A recording has been created. It has been shared." }),
+                )
+                .header(header::LOCATION, self.path("/footage")),
+            ));
+        }
+        if self.floor == Floor::LockerRoom && self.chance(FRIEND) {
+            self.shame += 1;
+            return Err(Problem::new(
+                StatusCode::USE_PROXY,
+                "friend",
+                "A friend has offered to help. Use Proxy is deprecated, and the server has declined on your behalf.",
+            ));
+        }
+        if self.conditions.peyronie && self.chance(CURVE_MISSES) {
+            return Err(Problem::new(
+                StatusCode::MISDIRECTED_REQUEST,
+                "misdirected",
+                "The technique landed slightly to the left. It was meant for a different server.",
+            ));
+        }
+        if intensity <= 2 && self.eq < 50 {
+            self.eq = (self.eq - 10).max(0);
+            return Err(Problem::new(
+                StatusCode::REQUEST_TIMEOUT,
+                "lost-it",
+                "The request took too long. It was lost.",
+            )
+            .header(header::CONNECTION, "close"));
+        }
+        if self.eq > PREMATURE_EQ {
+            if self.chance(RUPTURE_PREMATURE) {
+                return Err(self.rupture());
+            }
+            self.shame += 5;
+            self.next_floor(false);
+            return Err(Problem::new(
+                StatusCode::TOO_EARLY,
+                "premature",
+                "The floor has ended early. Everyone involved has agreed not to discuss it.",
+            ));
+        }
+        if self.eq < COLD_EQ {
+            return Err(Problem::new(
+                StatusCode::NOT_FOUND,
+                "cold",
+                "The resource exists. It is cold.",
+            ));
+        }
+        Ok(ControlFlow::Continue(()))
+    }
+
+    /// The enemies suspicion summons on floors without Mom.
+    pub(super) fn floor_enemy(&mut self) -> Result<(), Problem> {
+        let visits = u32::from(self.suspicion) + 1;
+        let wanders_in = matches!(self.floor, Floor::Bathroom | Floor::Hotel)
+            && self.rng.random_ratio(visits, WANDERER_VISIT);
+        if self.suspicion < SUSPICION_LIMIT && !wanders_in {
+            return Ok(());
+        }
+        match self.floor {
+            Floor::Bathroom => {
+                self.suspicion = 0;
+                self.touch();
+                if self.items.door_locks > 0 {
+                    self.items.door_locks -= 1;
+                    return Ok(());
+                }
+                self.here.roommate_told = true;
+                Err(Problem::new(
+                    StatusCode::CONFLICT,
+                    "roommate",
+                    "The roommate needs the bathroom. He will mention this to people.",
+                ))
+            }
+            Floor::LockerRoom => {
+                self.suspicion = 0;
+                self.shame += 5;
+                self.touch();
+                Err(Problem::new(
+                    StatusCode::UNAVAILABLE_FOR_LEGAL_REASONS,
+                    "gym-staff",
+                    "Gym staff have been notified. The server cannot serve this request for legal reasons.",
+                ))
+            }
+            Floor::Hotel => {
+                self.suspicion = 0;
+                self.touch();
+                if self.items.dnd_sign {
+                    return Ok(());
+                }
+                self.shame += 3;
+                Err(Problem::new(
+                    StatusCode::UNAUTHORIZED,
+                    "housekeeping",
+                    "Housekeeping has entered. Housekeeping accepts no excuses.",
+                )
+                .header(header::WWW_AUTHENTICATE, "Excuse realm=\"housekeeping\""))
+            }
+            _ => Ok(()),
+        }
+    }
+}

Added file: src/game/household.rs+192 additions@@ -0,0 +1,192 @@
+use std::collections::HashMap;
+
+use axum::http::{StatusCode, header};
+use rand::Rng;
+
+use super::{
+    Cause, Floor, Run,
+    balance::{PATIENCE, VIRAL_ERRAND},
+    parse_credentials,
+};
+use crate::problem::Problem;
+
+const EXCUSES: [&str; 3] = ["changing", "homework", "pulled a muscle"];
+const THANKSGIVING_EXCUSES: [&str; 3] = ["on a call", "folding laundry", "praying"];
+const TRUTHS: [&str; 3] = ["the truth", "truth", "honesty"];
+const TRUE_WHEN_PULLED: &str = "pulled a muscle";
+
+const BEDROOM_ERRANDS: [&str; 4] = [
+    "She has brought laundry.",
+    "She wants to know if you have eaten.",
+    "She needs the wifi password.",
+    "She would like to talk about your future.",
+];
+const THANKSGIVING_ERRANDS: [&str; 4] = [
+    "Grandma would like to see you.",
+    "Dinner is in ten minutes.",
+    "She needs help with the folding table.",
+    "An uncle has asked where you went.",
+];
+
+fn digest_params(authorization: &str) -> Option<HashMap<String, String>> {
+    let (scheme, rest) = authorization.trim().split_once(' ')?;
+    if !scheme.eq_ignore_ascii_case("digest") {
+        return None;
+    }
+    Some(
+        rest.split(',')
+            .filter_map(|pair| {
+                let (key, value) = pair.split_once('=')?;
+                Some((
+                    key.trim().to_ascii_lowercase(),
+                    value.trim().trim_matches('"').to_owned(),
+                ))
+            })
+            .collect(),
+    )
+}
+
+fn spoken(authorization: &str) -> String {
+    authorization
+        .split_once(' ')
+        .map(|(_, rest)| rest.trim().trim_matches('"').to_ascii_lowercase())
+        .unwrap_or_default()
+}
+
+impl Run {
+    pub fn excuses(&self) -> Vec<&'static str> {
+        if self.floor.number() < Floor::Grandmas.number() {
+            return EXCUSES.to_vec();
+        }
+        EXCUSES
+            .into_iter()
+            .chain(THANKSGIVING_EXCUSES)
+            .filter(|e| !self.heard.iter().any(|h| h == e))
+            .collect()
+    }
+
+    pub(super) fn errand(&mut self, summoned: bool) -> &'static str {
+        if summoned {
+            return "She heard a noise.";
+        }
+        if self.filmed_at.is_some() && self.chance(VIRAL_ERRAND) {
+            return "A neighbour has sent her something.";
+        }
+        let errands = if self.floor == Floor::Grandmas {
+            THANKSGIVING_ERRANDS
+        } else {
+            BEDROOM_ERRANDS
+        };
+        errands[self.rng.random_range(0..errands.len())]
+    }
+
+    /// Mom answers every request on the run until she has been given something she believes.
+    pub fn answer_door(&mut self, authorization: Option<&str>) -> Result<(), Problem> {
+        let Some((errand, nonce)) = self.mom.as_ref().map(|v| (v.errand, v.nonce.clone())) else {
+            return Ok(());
+        };
+        let digest = self.floor == Floor::Grandmas;
+        let challenge_value = if digest {
+            format!("Digest realm=\"household\", nonce=\"{nonce}\"")
+        } else {
+            "Excuse realm=\"household\"".to_owned()
+        };
+        let challenge = |p: Problem| p.header(header::WWW_AUTHENTICATE, &challenge_value);
+
+        let Some(authorization) = authorization else {
+            return Err(challenge(
+                Problem::new(
+                    StatusCode::UNAUTHORIZED,
+                    "someone-at-the-door",
+                    format!("Someone is at the door. {errand}"),
+                )
+                .with("inventory", self.path("/inventory")),
+            ));
+        };
+
+        if TRUTHS.contains(&spoken(authorization).as_str()) {
+            self.shame += 10;
+            self.leave_door();
+            return Ok(());
+        }
+        if parse_credentials(authorization, "basic").is_some() {
+            return Err(self.mom_strike(challenge(Problem::new(
+                StatusCode::UNAUTHORIZED,
+                "basic",
+                "Mom does not accept Basic authentication. Nobody should.",
+            ))));
+        }
+
+        let excuse = if digest {
+            let Some(params) = digest_params(authorization) else {
+                return Err(self.mom_strike(challenge(Problem::new(
+                    StatusCode::UNAUTHORIZED,
+                    "digest-required",
+                    "Mom has started using Digest authentication.",
+                ))));
+            };
+            if params.get("nonce") != Some(&nonce) {
+                return Err(self.mom_strike(challenge(Problem::new(
+                    StatusCode::UNAUTHORIZED,
+                    "stale-nonce",
+                    "That was a different conversation.",
+                ))));
+            }
+            params.get("username").cloned().unwrap_or_default()
+        } else {
+            parse_credentials(authorization, "excuse")
+                .unwrap_or_default()
+                .to_owned()
+        };
+        let excuse = excuse.to_ascii_lowercase();
+
+        if TRUTHS.contains(&excuse.as_str()) {
+            self.shame += 10;
+            self.leave_door();
+            return Ok(());
+        }
+        let true_now = self.conditions.pulled_muscle && excuse == TRUE_WHEN_PULLED;
+        if digest && self.heard.contains(&excuse) && !true_now {
+            self.shame += 3;
+            return Err(self.mom_strike(challenge(Problem::new(
+                StatusCode::UNAUTHORIZED,
+                "excuse-replayed",
+                "Mom has heard that one before. She would have preferred the truth.",
+            ))));
+        }
+        if true_now || self.excuses().contains(&excuse.as_str()) {
+            self.heard.push(excuse);
+            self.leave_door();
+            return Ok(());
+        }
+        self.shame += 3;
+        let detail = if digest {
+            "Mom has not heard that one before. She does not believe it. She would have preferred the truth."
+        } else {
+            "Mom has not heard that one before. She does not believe it."
+        };
+        Err(self.mom_strike(challenge(Problem::new(
+            StatusCode::UNAUTHORIZED,
+            "excuse-rejected",
+            detail,
+        ))))
+    }
+
+    fn mom_strike(&mut self, problem: Problem) -> Problem {
+        self.touch();
+        let Some(visit) = &mut self.mom else {
+            return problem;
+        };
+        visit.strikes += 1;
+        if visit.strikes < PATIENCE {
+            return problem;
+        }
+        self.end(Cause::Caught)
+    }
+
+    fn leave_door(&mut self) {
+        self.mom = None;
+        self.suspicion = 0;
+        self.touch();
+    }
+}

Added file: src/game/items.rs+210 additions@@ -0,0 +1,210 @@
+use super::balance::STARTING_ICE_PACKS;
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Item {
+    WarmTowel,
+    IcePack,
+    Ruler,
+    DoorLock,
+    DndSign,
+    Blinds,
+    Pump,
+    PumpPro,
+    Extender,
+    Ring,
+    Supplement,
+    Cage,
+    CageKey,
+    Spreadsheet,
+    TeapotSpout,
+}
+
+pub const SHOP: [Item; 11] = [
+    Item::Pump,
+    Item::PumpPro,
+    Item::Extender,
+    Item::Ring,
+    Item::Supplement,
+    Item::DoorLock,
+    Item::DndSign,
+    Item::Blinds,
+    Item::Ruler,
+    Item::IcePack,
+    Item::CageKey,
+];
+
+impl Item {
+    const ALL: [Self; 15] = [
+        Self::WarmTowel,
+        Self::IcePack,
+        Self::Ruler,
+        Self::DoorLock,
+        Self::DndSign,
+        Self::Blinds,
+        Self::Pump,
+        Self::PumpPro,
+        Self::Extender,
+        Self::Ring,
+        Self::Supplement,
+        Self::Cage,
+        Self::CageKey,
+        Self::Spreadsheet,
+        Self::TeapotSpout,
+    ];
+
+    pub fn slug(self) -> &'static str {
+        match self {
+            Self::WarmTowel => "warm-towel",
+            Self::IcePack => "ice-pack",
+            Self::Ruler => "ruler",
+            Self::DoorLock => "door-lock",
+            Self::DndSign => "do-not-disturb-sign",
+            Self::Blinds => "window-blinds",
+            Self::Pump => "pump",
+            Self::PumpPro => "pump-pro",
+            Self::Extender => "extender",
+            Self::Ring => "cock-ring",
+            Self::Supplement => "supplement",
+            Self::Cage => "chastity-cage",
+            Self::CageKey => "cage-key",
+            Self::Spreadsheet => "spreadsheet",
+            Self::TeapotSpout => "teapot-spout",
+        }
+    }
+
+    pub fn parse(slug: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|item| item.slug() == slug)
+    }
+
+    pub fn description(self) -> &'static str {
+        match self {
+            Self::WarmTowel => {
+                "Reusable. Satisfies the warm-up precondition. Use technique=warmup."
+            }
+            Self::IcePack => "Lowers EQ by 40. Use technique=ice.",
+            Self::Ruler => "Measures honestly. The length resource now carries a Content-Length.",
+            Self::DoorLock => "Keeps the roommate out once.",
+            Self::DndSign => "Works on housekeeping. Mom does not read signs.",
+            Self::Blinds => "The neighbour has a good camera. The blinds are better.",
+            Self::Pump => "A pump.",
+            Self::PumpPro => "Use technique=pump. Gains are temporary.",
+            Self::Extender => "Passive gains each turn. Takes up room. Can be removed with DELETE.",
+            Self::Ring => {
+                "Girth gains doubled. Rupture risk raised. Responses are compressed if you accept gzip. Can be removed with DELETE."
+            }
+            Self::Supplement => "Use technique=supplement.",
+            Self::Cage => "Locked.",
+            Self::CageKey => "Pump-Bro does not ask.",
+            Self::Spreadsheet => "Charts your progress. Every line is flat.",
+            Self::TeapotSpout => "Does nothing. Cannot be dropped.",
+        }
+    }
+
+    pub fn pitch(self) -> &'static str {
+        match self {
+            Self::PumpPro => "A pump, but professional.",
+            Self::Extender => "Passive gains every turn. Takes up room.",
+            Self::Ring => "Doubles girth gains. Pump-Bro does not discuss the risks.",
+            Self::Supplement => "Clinically formulated. Ships from overseas.",
+            Self::DndSign => "Housekeeping respects it.",
+            Self::Blinds => "The neighbour has a good camera.",
+            Self::Ruler => "Pump-Bro does not recommend it.",
+            Self::IcePack => "Cold.",
+            _ => self.description(),
+        }
+    }
+
+    pub fn price(self) -> Option<u32> {
+        match self {
+            Self::Pump => Some(10),
+            Self::PumpPro | Self::Extender | Self::CageKey => Some(15),
+            Self::Ring => Some(8),
+            Self::Supplement | Self::DoorLock | Self::DndSign | Self::Blinds | Self::Ruler => {
+                Some(5)
+            }
+            Self::IcePack => Some(3),
+            Self::WarmTowel | Self::Cage | Self::Spreadsheet | Self::TeapotSpout => None,
+        }
+    }
+}
+
+pub struct Items {
+    pub ruler: bool,
+    pub ice_packs: u32,
+    pub door_locks: u32,
+    pub dnd_sign: bool,
+    pub blinds: bool,
+    pub pump_pro: bool,
+    pub extender: bool,
+    pub ring: bool,
+    pub supplements: u32,
+    pub cage: bool,
+    pub spreadsheet: bool,
+    pub teapot_spout: bool,
+}
+
+impl Default for Items {
+    fn default() -> Self {
+        Self {
+            ruler: false,
+            ice_packs: STARTING_ICE_PACKS,
+            door_locks: 0,
+            dnd_sign: false,
+            blinds: false,
+            pump_pro: false,
+            extender: false,
+            ring: false,
+            supplements: 0,
+            cage: false,
+            spreadsheet: false,
+            teapot_spout: false,
+        }
+    }
+}
+
+impl Items {
+    pub fn has(&self, item: Item) -> bool {
+        match item {
+            Item::WarmTowel => true,
+            Item::IcePack => self.ice_packs > 0,
+            Item::Ruler => self.ruler,
+            Item::DoorLock => self.door_locks > 0,
+            Item::DndSign => self.dnd_sign,
+            Item::Blinds => self.blinds,
+            Item::PumpPro => self.pump_pro,
+            Item::Extender => self.extender,
+            Item::Ring => self.ring,
+            Item::Supplement => self.supplements > 0,
+            Item::Cage => self.cage,
+            Item::Spreadsheet => self.spreadsheet,
+            Item::TeapotSpout => self.teapot_spout,
+            Item::Pump | Item::CageKey => false,
+        }
+    }
+
+    pub fn owned(&self) -> Vec<Item> {
+        Item::ALL
+            .into_iter()
+            .filter(|&item| self.has(item))
+            .collect()
+    }
+
+    pub fn grant(&mut self, item: Item) {
+        match item {
+            Item::IcePack => self.ice_packs += 1,
+            Item::Ruler => self.ruler = true,
+            Item::DoorLock => self.door_locks += 1,
+            Item::DndSign => self.dnd_sign = true,
+            Item::Blinds => self.blinds = true,
+            Item::PumpPro => self.pump_pro = true,
+            Item::Extender => self.extender = true,
+            Item::Ring => self.ring = true,
+            Item::Supplement => self.supplements += 1,
+            Item::Cage => self.cage = true,
+            Item::CageKey => self.cage = false,
+            Item::Spreadsheet => self.spreadsheet = true,
+            Item::TeapotSpout => self.teapot_spout = true,
+            Item::WarmTowel | Item::Pump => {}
+        }
+    }
+}

Deleted file: src/game/jelq.rs−677 deletions@@ -1,677 +0,0 @@
-use std::{
-    fmt::Write as _,
-    time::{Duration, Instant, SystemTime},
-};
-
-use axum::http::{StatusCode, header};
-use rand::Rng;
-use serde_json::json;
-
-use super::{
-    CLINIC_ALLOW, FORUM_THREAD, Floor, Grip, Lube, Outcome, REFRACTORY, Run, SERVER_TIMING,
-    SUSPICION_LIMIT, Technique, catalog::LubeRule, catalog::Profile, not_extended, round3,
-};
-use crate::{game::LUBRICANTS, problem::Problem};
-
-const WEEK: Duration = Duration::from_secs(7 * 24 * 60 * 60);
-const PRIAPISM_TURNS: u8 = 5;
-const PRIAPISM_EQ: i32 = 75;
-const DEGLOVED: &str =
-    "The outer layer has been removed in one piece. It will not be returning. The run has ended.";
-
-impl Run {
-    pub fn jelq(
-        &mut self,
-        techniques: &[Technique],
-        intensity: i32,
-        lube: Option<Lube>,
-        now: Instant,
-    ) -> Result<Outcome, Problem> {
-        self.check_refractory(now)?;
-        if self.branch_pending {
-            return Ok(self.branch_offer());
-        }
-        match self.floor {
-            Floor::Forum => {
-                return Ok(Outcome::json(
-                    StatusCode::SEE_OTHER,
-                    json!({ "detail": "Refer to the forum." }),
-                )
-                .header(header::LOCATION, FORUM_THREAD));
-            }
-            Floor::Clinic => {
-                return Err(Problem::new(
-                    StatusCode::METHOD_NOT_ALLOWED,
-                    "not-in-the-clinic",
-                    "JELQ is not performed in the clinic.",
-                )
-                .header(header::ALLOW, CLINIC_ALLOW));
-            }
-            _ => {}
-        }
-        if self.items.cage {
-            return Err(Problem::new(
-                StatusCode::LOCKED,
-                "caged",
-                "The cage is locked. The key is not in the box.",
-            ));
-        }
-        match *techniques {
-            [technique] => self.single(technique, intensity, lube, now),
-            [a, b] => self.combo(a, b, intensity, lube, now),
-            _ => Err(Problem::new(
-                StatusCode::BAD_REQUEST,
-                "too-many-techniques",
-                "Two techniques at most. The server has limits even if you do not.",
-            )),
-        }
-    }
-
-    fn single(
-        &mut self,
-        technique: Technique,
-        intensity: i32,
-        lube: Option<Lube>,
-        now: Instant,
-    ) -> Result<Outcome, Problem> {
-        match technique {
-            Technique::Warmup => return self.warm_up(),
-            Technique::Ice => return self.ice(),
-            Technique::Supplement => return self.supplement(),
-            Technique::Edge => {}
-            _ => self.edges = 0,
-        }
-        self.prepare(technique, lube)?;
-        self.check_storage()?;
-        self.floor_enemy()?;
-        match technique {
-            Technique::Edge => return self.edge(now),
-            Technique::Pump => return self.pump(now),
-            _ => {}
-        }
-        let profile = technique.profile().expect("training technique");
-        self.commit(intensity, lube, now, 1);
-        if technique == Technique::Dry && intensity >= 8 && self.rng.random_ratio(1, 60) {
-            self.end("degloved", DEGLOVED);
-            return Err(Problem::new(StatusCode::GONE, "degloved", DEGLOVED));
-        }
-        if let Some(interrupted) = self.hazards(intensity)? {
-            return Ok(interrupted);
-        }
-        let result = self.roll(technique, &profile, intensity, lube);
-        Ok(self.gossip(result?))
-    }
-
-    fn combo(
-        &mut self,
-        a: Technique,
-        b: Technique,
-        intensity: i32,
-        lube: Option<Lube>,
-        now: Instant,
-    ) -> Result<Outcome, Problem> {
-        let (Some(first), Some(second)) = (a.profile(), b.profile()) else {
-            return Err(Problem::new(
-                StatusCode::BAD_REQUEST,
-                "combo-invalid",
-                "Only training techniques can be combined.",
-            ));
-        };
-        if a == b {
-            return Err(Problem::new(
-                StatusCode::BAD_REQUEST,
-                "combo-invalid",
-                "A technique cannot be combined with itself. The server has checked.",
-            ));
-        }
-        self.edges = 0;
-        self.prepare(a, lube)?;
-        self.prepare(b, lube)?;
-        self.check_storage()?;
-        self.floor_enemy()?;
-        self.commit(intensity, lube, now, 2);
-        if let Some(interrupted) = self.hazards(intensity)? {
-            return Ok(interrupted);
-        }
-
-        let mut statuses = Vec::new();
-        for (technique, profile) in [(a, first), (b, second)] {
-            let result = self.roll(technique, &profile, intensity, lube);
-            if self.ended.is_some() {
-                return result;
-            }
-            let status = match &result {
-                Ok(outcome) => outcome.status(),
-                Err(problem) => problem.status(),
-            };
-            statuses.push((technique, status));
-        }
-
-        let mut xml = String::from(
-            "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<D:multistatus xmlns:D=\"DAV:\">\n",
-        );
-        for (technique, status) in statuses {
-            let _ = write!(
-                xml,
-                "  <D:response>\n    <D:href>/runs/{}?technique={}</D:href>\n    <D:status>HTTP/1.1 {} {}</D:status>\n  </D:response>\n",
-                self.id,
-                technique.name(),
-                status.as_u16(),
-                status.canonical_reason().unwrap_or_default(),
-            );
-        }
-        xml.push_str(
-            "  <D:responsedescription>Each technique has been reported separately.</D:responsedescription>\n</D:multistatus>\n",
-        );
-        Ok(Outcome::raw(
-            StatusCode::MULTI_STATUS,
-            "application/xml; charset=utf-8",
-            xml,
-        ))
-    }
-
-    fn prepare(&self, technique: Technique, lube: Option<Lube>) -> Result<(), Problem> {
-        if technique == Technique::Uli && !self.forum_read {
-            return Err(Problem::new(
-                StatusCode::FORBIDDEN,
-                "technique-locked",
-                "This technique is discussed on the forum. You have not been to the forum.",
-            ));
-        }
-        if !self.warmed_up {
-            return Err(Problem::new(
-                StatusCode::PRECONDITION_FAILED,
-                "cold-start",
-                "Warm-up was skipped. The server has noted this.",
-            )
-            .with("technique", Technique::Warmup.name()));
-        }
-        if technique == Technique::Pump && !self.items.pump_pro {
-            return Err(Problem::new(
-                StatusCode::FAILED_DEPENDENCY,
-                "no-pump",
-                "The pump technique depends on a pump.",
-            ));
-        }
-        let Some(profile) = technique.profile() else {
-            return Ok(());
-        };
-        match (profile.lube, lube) {
-            (LubeRule::Required, None) => {
-                return Err(Problem::new(
-                    StatusCode::UNSUPPORTED_MEDIA_TYPE,
-                    "lubricant-required",
-                    format!(
-                        "The {} technique requires a lubricant. None was declared.",
-                        technique.name()
-                    ),
-                )
-                .with("lubricants", json!(LUBRICANTS)));
-            }
-            (LubeRule::Forbidden, Some(_)) => {
-                return Err(Problem::new(
-                    StatusCode::UNSUPPORTED_MEDIA_TYPE,
-                    "lubricant-declared",
-                    "The dry technique was requested. A lubricant was declared.",
-                ));
-            }
-            _ => {}
-        }
-        if let Some((min, max)) = profile.foreskin {
-            self.check_foreskin(min, max)?;
-        }
-        Ok(())
-    }
-
-    fn check_foreskin(&self, min: f64, max: f64) -> Result<(), Problem> {
-        let Some(f) = self.foreskin else {
-            if min <= 0.0 {
-                return Ok(());
-            }
-            return Err(Problem::new(
-                StatusCode::GONE,
-                "foreskin-gone",
-                "This technique requires a foreskin. The foreskin is gone.",
-            )
-            .header(
-                header::CONTENT_LOCATION,
-                format!("/runs/{}/foreskin", self.id),
-            ));
-        };
-        if f < min {
-            return Err(Problem::new(
-                StatusCode::LENGTH_REQUIRED,
-                "foreskin-insufficient",
-                format!(
-                    "The selected technique requires {min:.1} units of foreskin. {f:.2} units are available. The server has noted the shortfall."
-                ),
-            )
-            .with("required", min)
-            .with("available", super::round2(f)));
-        }
-        if f > max {
-            return Err(Problem::new(
-                StatusCode::PAYLOAD_TOO_LARGE,
-                "foreskin-excessive",
-                format!(
-                    "The selected technique tolerates at most {max:.1} units of foreskin. {f:.2} units are present."
-                ),
-            )
-            .with("maximum", max)
-            .with("present", super::round2(f)));
-        }
-        Ok(())
-    }
-
-    fn check_storage(&self) -> Result<(), Problem> {
-        if self.items.extender && self.girth > 5.0 {
-            return Err(Problem::new(
-                StatusCode::INSUFFICIENT_STORAGE,
-                "jeans-full",
-                "The jeans are full. The extender is occupying the remaining storage.",
-            )
-            .with("extender", format!("/runs/{}/inventory/extender", self.id)));
-        }
-        Ok(())
-    }
-
-    fn commit(&mut self, intensity: i32, lube: Option<Lube>, now: Instant, cost: i32) {
-        self.touch();
-        self.turn += 1;
-        self.floor_turns += 1;
-        self.realize();
-        if self.items.extender {
-            self.length += 0.004;
-        }
-        self.stamina -= cost + i32::from(lube == Some(Lube::Lotion));
-        if self.stamina <= 0 {
-            self.stamina = 0;
-            self.refractory_until = Some(now + *REFRACTORY);
-        }
-        let chill = if self.floor == Floor::LockerRoom {
-            8
-        } else {
-            0
-        };
-        let wobble = self.rng.random_range(-3..=3);
-        self.eq = (self.eq + intensity * 2 - 6 - chill + wobble).clamp(0, 100);
-
-        let mut suspicion = intensity / 5 + i32::from(lube == Some(Lube::Vaseline));
-        if matches!(self.floor, Floor::LockerRoom | Floor::Grandmas) {
-            suspicion *= 2;
-        }
-        if self.floor == Floor::Grandmas && lube == Some(Lube::CoconutOil) {
-            suspicion += 2;
-        }
-        let was_below = self.suspicion < SUSPICION_LIMIT;
-        self.suspicion =
-            (i32::from(self.suspicion) + suspicion).min(i32::from(SUSPICION_LIMIT)) as u8;
-        if self.floor.has_mom() && !self.mom_present {
-            let summoned = was_below && self.suspicion == SUSPICION_LIMIT;
-            if summoned || self.rng.random_ratio(u32::from(self.suspicion) + 1, 16) {
-                self.mom_present = true;
-                self.mom_strikes = 0;
-                self.mom_errand = self.errand(summoned);
-                self.nonce = self.fresh_nonce();
-            }
-        }
-
-        if let Some(observer) = self.floor.observer()
-            && self.rng.random_ratio(1, 6)
-        {
-            self.observed = Some(observer);
-            self.shame += 1;
-            if observer == "cat" && self.rng.random_ratio(1, 5) {
-                self.towel_stolen = true;
-            }
-        }
-        if intensity >= 9 && !self.pulled_muscle && self.rng.random_ratio(1, 12) {
-            self.pulled_muscle = true;
-            self.stamina = self.stamina.min(self.max_stamina());
-        }
-        if self.items.ring && self.eq > 85 && self.rng.random_ratio(1, 10) {
-            self.priapism_turns = PRIAPISM_TURNS;
-        }
-        if self.priapism_turns > 0 {
-            self.priapism_turns -= 1;
-            self.eq = self.eq.max(PRIAPISM_EQ);
-        }
-        if self.turn == super::BRANCH_TURN {
-            self.branch_pending = true;
-        }
-    }
-
-    fn hazards(&mut self, intensity: i32) -> Result<Option<Outcome>, Problem> {
-        let odds = match self.eq {
-            ..=70 => 250,
-            71..=85 => 25,
-            _ => 10,
-        };
-        if self.rng.random_ratio(1, odds) {
-            return Err(self.rupture());
-        }
-        let windowed = matches!(self.floor, Floor::Bedroom | Floor::Grandmas | Floor::Hotel);
-        if windowed && !self.items.blinds && self.rng.random_ratio(1, 60) {
-            self.shame += 30;
-            self.filmed_at.get_or_insert_with(SystemTime::now);
-            return Ok(Some(
-                Outcome::json(
-                    StatusCode::CREATED,
-                    json!({ "detail": "A neighbour was at the window. A recording has been created. It has been shared." }),
-                )
-                .header(header::LOCATION, format!("/runs/{}/footage", self.id)),
-            ));
-        }
-        if self.floor == Floor::LockerRoom && self.rng.random_ratio(1, 10) {
-            self.shame += 1;
-            return Err(Problem::new(
-                StatusCode::USE_PROXY,
-                "friend",
-                "A friend has offered to help. Use Proxy is deprecated, and the server has declined on your behalf.",
-            ));
-        }
-        if self.peyronie && self.rng.random_ratio(1, 3) {
-            return Err(Problem::new(
-                StatusCode::MISDIRECTED_REQUEST,
-                "misdirected",
-                "The technique landed slightly to the left. It was meant for a different server.",
-            ));
-        }
-        if intensity <= 2 && self.eq < 50 {
-            self.eq = (self.eq - 10).max(0);
-            return Err(Problem::new(
-                StatusCode::REQUEST_TIMEOUT,
-                "lost-it",
-                "The request took too long. It was lost.",
-            )
-            .header(header::CONNECTION, "close"));
-        }
-        if self.eq > 95 {
-            if self.rng.random_ratio(1, 3) {
-                return Err(self.rupture());
-            }
-            self.shame += 5;
-            self.next_floor(false);
-            return Err(Problem::new(
-                StatusCode::TOO_EARLY,
-                "premature",
-                "The floor has ended early. Everyone involved has agreed not to discuss it.",
-            )
-            .with("floor", self.floor.number()));
-        }
-        if self.eq < 30 {
-            return Err(Problem::new(
-                StatusCode::NOT_FOUND,
-                "cold",
-                "The resource exists. It is cold.",
-            )
-            .with("eq", self.eq));
-        }
-        Ok(None)
-    }
-
-    fn roll(
-        &mut self,
-        technique: Technique,
-        profile: &Profile,
-        intensity: i32,
-        lube: Option<Lube>,
-    ) -> Result<Outcome, Problem> {
-        let natural: i32 = self.rng.random_range(1..=20);
-        let band = if (50..=70).contains(&self.eq) { 2 } else { 0 };
-        let grip = match (self.grip, technique) {
-            (Grip::Underhand, Technique::Stretch) => 2,
-            (Grip::Underhand, Technique::Wet) => -1,
-            _ => 0,
-        };
-        let modifier = lube.map_or(0, Lube::modifier) + band + grip;
-        let dc = profile.dc + intensity / 3;
-        let total = natural + modifier;
-        let timing = format!("roll;desc=\"d20{modifier:+} vs {dc}\";dur={natural}");
-        let timed = |p: Problem| p.header(SERVER_TIMING, &timing);
-
-        let scale = f64::from(intensity);
-        let (mut length, mut girth) = (profile.length * scale, profile.girth * scale);
-        if self.teapot {
-            length *= 0.5;
-            girth *= 1.5;
-        }
-        if self.items.ring {
-            girth *= 2.0;
-        }
-        let rupture_eq = if self.items.ring { 80 } else { 90 };
-
-        if natural == 1 {
-            let touches_foreskin = profile.foreskin.is_some_and(|(min, _)| min > 0.0);
-            if touches_foreskin && self.foreskin.is_some() {
-                self.foreskin = None;
-                self.shame += 25;
-                return Err(timed(
-                    Problem::new(
-                        StatusCode::GONE,
-                        "foreskin-lost",
-                        "The technique has removed the foreskin. It will not be returning.",
-                    )
-                    .header(
-                        header::CONTENT_LOCATION,
-                        format!("/runs/{}/foreskin", self.id),
-                    ),
-                ));
-            }
-            if self.eq > 70 {
-                return Err(timed(self.rupture()));
-            }
-            if technique == Technique::Stretch && !self.teapot {
-                self.teapot = true;
-                self.items.teapot_spout = true;
-                self.shame += 5;
-                return Err(timed(Problem::new(
-                    StatusCode::IM_A_TEAPOT,
-                    "teapot",
-                    "The subject is now short and stout. Length gains are halved for the rest of the floor.",
-                )));
-            }
-            if technique == Technique::Uli && !self.peyronie {
-                self.peyronie = true;
-                self.shame += 5;
-                return Err(timed(Problem::new(
-                    StatusCode::MISDIRECTED_REQUEST,
-                    "curvature",
-                    "A curvature has developed. Techniques will land slightly to the left until a professional is consulted.",
-                )));
-            }
-            return Err(timed(not_extended()));
-        }
-        if natural == 2 && self.eq > 70 {
-            return Err(timed(self.rupture()));
-        }
-        if self.eq > rupture_eq && total < dc {
-            return Err(timed(self.rupture()));
-        }
-        if natural == 20 {
-            self.gain(length * 2.0, girth * 2.0, profile.foreskin_growth);
-            return Ok(Outcome::json(
-                StatusCode::PERMANENT_REDIRECT,
-                json!({
-                    "detail": "Your length has moved permanently.",
-                    "length": round3(length * 2.0),
-                    "girth": round3(girth * 2.0),
-                }),
-            )
-            .header(header::LOCATION, format!("/runs/{}/length", self.id))
-            .header(SERVER_TIMING, timing));
-        }
-        if total < dc - 3 {
-            return Err(timed(not_extended()));
-        }
-        if total < dc {
-            return Ok(Outcome::empty(StatusCode::NO_CONTENT).header(SERVER_TIMING, timing));
-        }
-
-        let outcome = if self.eq < 50 {
-            self.gain(length / 2.0, girth / 2.0, profile.foreskin_growth);
-            Outcome::json(
-                StatusCode::PARTIAL_CONTENT,
-                json!({
-                    "detail": "Partial gains were applied. EQ was below the band.",
-                    "length": round3(length / 2.0),
-                    "girth": round3(girth / 2.0),
-                }),
-            )
-        } else if total >= dc + 5 {
-            self.gain(length, girth, profile.foreskin_growth);
-            Outcome::json(
-                StatusCode::OK,
-                json!({
-                    "detail": "Gains were applied.",
-                    "length": round3(length),
-                    "girth": round3(girth),
-                }),
-            )
-        } else {
-            let eta = self.rng.random_range(1..=4);
-            self.pending.push(super::Pending {
-                due: self.turn + eta,
-                length,
-                girth,
-            });
-            self.gain(0.0, 0.0, profile.foreskin_growth);
-            Outcome::json(
-                StatusCode::ACCEPTED,
-                json!({
-                    "detail": "Gains have been queued. They may arrive.",
-                    "eta_turns": eta,
-                }),
-            )
-        };
-        Ok(outcome.header(SERVER_TIMING, timing))
-    }
-
-    fn gossip(&mut self, outcome: Outcome) -> Outcome {
-        let reportable = matches!(outcome.status.as_u16(), 200 | 202 | 206);
-        if !self.roommate_told || !reportable {
-            return outcome;
-        }
-        self.roommate_told = false;
-        let mut outcome = outcome;
-        outcome.status = StatusCode::ALREADY_REPORTED;
-        if let super::Payload::Json(body) = &mut outcome.payload {
-            body["detail"] = json!("The roommate has already told everyone.");
-        }
-        outcome
-    }
-
-    fn warm_up(&mut self) -> Result<Outcome, Problem> {
-        if self.floor == Floor::Hotel && self.rng.random_ratio(1, 3) {
-            return Err(Problem::new(
-                StatusCode::SERVICE_UNAVAILABLE,
-                "service-unavailable",
-                "Service is unavailable. The server estimates next week. The server is being pessimistic.",
-            )
-            .header(
-                header::RETRY_AFTER,
-                httpdate::fmt_http_date(SystemTime::now() + WEEK),
-            ));
-        }
-        let (boost, detail) = if self.floor == Floor::Bathroom {
-            (
-                35,
-                "Warmed up. The shower is hot. The roommate's will not be.",
-            )
-        } else if self.towel_stolen {
-            (10, "Warmed up, poorly. The cat has the towel.")
-        } else {
-            (25, "Warmed up. The towel has cooled.")
-        };
-        self.touch();
-        self.warmed_up = true;
-        self.eq = (self.eq + boost).min(100);
-        Ok(Outcome::json(StatusCode::OK, json!({ "detail": detail })))
-    }
-
-    fn ice(&mut self) -> Result<Outcome, Problem> {
-        if self.items.ice_packs == 0 {
-            return Err(Problem::new(
-                StatusCode::FAILED_DEPENDENCY,
-                "no-ice",
-                "The ice technique depends on an ice pack. There are none.",
-            ));
-        }
-        self.touch();
-        self.items.ice_packs -= 1;
-        if self.priapism_turns > 0 {
-            return Ok(Outcome::json(
-                StatusCode::OK,
-                json!({ "detail": "The ice has no effect. The condition persists. The ice pack is gone." }),
-            ));
-        }
-        self.eq = (self.eq - 40).max(0);
-        Ok(Outcome::json(
-            StatusCode::OK,
-            json!({ "detail": "EQ has been reduced. The ice pack is gone." }),
-        ))
-    }
-
-    fn supplement(&mut self) -> Result<Outcome, Problem> {
-        if self.items.supplements == 0 {
-            return Err(Problem::new(
-                StatusCode::FAILED_DEPENDENCY,
-                "no-supplement",
-                "The supplement technique depends on a supplement.",
-            ));
-        }
-        self.items.supplements -= 1;
-        self.touch();
-        if self.rng.random_ratio(1, 5) {
-            self.priapism_turns = PRIAPISM_TURNS;
-            self.eq = self.eq.max(PRIAPISM_EQ);
-            return Ok(Outcome::json(
-                StatusCode::OK,
-                json!({ "detail": "The upstream returned a valid response. It is still returning it." }),
-            ));
-        }
-        Err(Problem::new(
-            StatusCode::BAD_GATEWAY,
-            "bad-gateway",
-            "The upstream returned an invalid response.",
-        )
-        .with("upstream", "Pump-Bro"))
-    }
-
-    fn edge(&mut self, now: Instant) -> Result<Outcome, Problem> {
-        self.commit(5, None, now, 1);
-        self.edges += 1;
-        self.eq = (self.eq + 11).min(100);
-        self.girth += 0.004;
-        if self.edges >= 3 {
-            self.edges = 0;
-            self.stamina = 0;
-            self.refractory_until = Some(now + *REFRACTORY);
-            return Err(Problem::new(
-                StatusCode::LOOP_DETECTED,
-                "edging-loop",
-                "Edging has looped. The server detected an infinite loop and terminated it.",
-            ));
-        }
-        if let Some(interrupted) = self.hazards(5)? {
-            return Ok(interrupted);
-        }
-        Ok(Outcome::json(
-            StatusCode::OK,
-            json!({ "detail": "Edged. EQ is rising. Nothing else is.", "edges": self.edges }),
-        ))
-    }
-
-    fn pump(&mut self, now: Instant) -> Result<Outcome, Problem> {
-        self.commit(4, None, now, 1);
-        if let Some(interrupted) = self.hazards(4)? {
-            return Ok(interrupted);
-        }
-        self.temp_length += 0.5;
-        Ok(Outcome::json(
-            StatusCode::TEMPORARY_REDIRECT,
-            json!({ "detail": "Gains applied. They are temporary.", "length": 0.5 }),
-        )
-        .header(header::LOCATION, format!("/runs/{}/length", self.id)))
-    }
-}

Modified file: src/game/mod.rs+116 additions−519 deletions@@ -1,301 +1,80 @@
-mod catalog;
-mod encounters;
-mod jelq;
-
-pub use catalog::{LUBRICANTS, Lube, SHOP, ShopItem, Technique};
-pub use encounters::{ELDER_LAST_MODIFIED, FORUM_THREAD, PatchOp, forum_thread};
+pub mod balance;
+mod body;
+mod clinic;
+mod floors;
+mod forum;
+mod hazards;
+mod household;
+mod items;
+mod outcome;
+mod shop;
+mod state;
+mod techniques;
+mod turn;
+mod utility;
+
+pub use body::PatchOp;
+pub use forum::{ELDER_LAST_MODIFIED, FORUM_THREAD, forum_thread};
+pub use items::{Item, Items};
+pub use outcome::{Outcome, Payload};
+pub use state::{
+    Cause, Clinic, Conditions, Elder, Ending, Floor, FloorState, Grip, MomVisit, Observer, Story,
+};
+pub use techniques::{LUBRICANTS, Lube, Technique};
 
 use std::{
-    sync::LazyLock,
+    hash::{DefaultHasher, Hash, Hasher},
     time::{Duration, Instant, SystemTime},
 };
 
-use axum::{
-    Json,
-    http::{HeaderName, HeaderValue, StatusCode, header},
-    response::{IntoResponse, Response},
-};
+use axum::http::{StatusCode, header};
 use rand::{Rng, SeedableRng, rngs::StdRng};
 use serde_json::{Value, json};
 
 use crate::problem::Problem;
-
-pub const MAX_STAMINA: i32 = 10;
-pub const SUSPICION_LIMIT: u8 = 5;
-pub const BRANCH_TURN: u32 = 10;
-pub const FLOOR_TURNS: u32 = 6;
-pub const STARTING_CASH: u32 = 20;
-pub const FLOOR_ALLOWANCE: u32 = 10;
-pub static REFRACTORY: LazyLock<Duration> = LazyLock::new(|| {
-    let seconds = std::env::var("JELQD_REFRACTORY_SECS")
-        .ok()
-        .and_then(|s| s.parse().ok())
-        .unwrap_or(30);
-    Duration::from_secs(seconds)
-});
-pub const SELF_REPORT_INFLATION: f64 = 1.5;
-pub const MM_PER_INCH: f64 = 25.4;
-pub const RUN_ALLOW: &str = "GET, HEAD, JELQ, PUT, PATCH, DELETE, OPTIONS, TRACE";
-pub const CLINIC_ALLOW: &str = "GET, HEAD, PUT, PATCH, DELETE, OPTIONS, TRACE";
-
-pub const SERVER_TIMING: HeaderName = HeaderName::from_static("server-timing");
-pub const X_DIAGNOSIS: HeaderName = HeaderName::from_static("x-diagnosis");
-
-#[derive(Clone, Copy, PartialEq, Eq, Debug)]
-pub enum Floor {
-    Bedroom,
-    Bathroom,
-    LockerRoom,
-    Grandmas,
-    Hotel,
-    Forum,
-    Clinic,
-}
-
-impl Floor {
-    const ALL: [Self; 7] = [
-        Self::Bedroom,
-        Self::Bathroom,
-        Self::LockerRoom,
-        Self::Grandmas,
-        Self::Hotel,
-        Self::Forum,
-        Self::Clinic,
-    ];
-
-    pub fn number(self) -> usize {
-        Self::ALL.iter().position(|f| *f == self).unwrap_or(0) + 1
-    }
-
-    fn next(self) -> Option<Self> {
-        Self::ALL.get(self.number()).copied()
-    }
-
-    pub fn name(self) -> &'static str {
-        match self {
-            Self::Bedroom => "the bedroom",
-            Self::Bathroom => "the shared bathroom",
-            Self::LockerRoom => "the gym locker room",
-            Self::Grandmas => "grandma's house for Thanksgiving",
-            Self::Hotel => "a business trip hotel",
-            Self::Forum => "the forum",
-            Self::Clinic => "the urologist's office",
-        }
-    }
-
-    pub fn note(self) -> &'static str {
-        match self {
-            Self::Bedroom => "The door does not lock. The cat is present.",
-            Self::Bathroom => "The water is hot. The roommate showers at eight.",
-            Self::LockerRoom => {
-                "It is cold. Discretion is advised. Everyone here is lying. Pump-Bro is by the lockers."
-            }
-            Self::Grandmas => {
-                "The walls are thin. Mom is here, and she has been reading about Digest authentication."
-            }
-            Self::Hotel => {
-                "The wifi requires agreement. Housekeeping does not knock. Pump-Bro is in the lobby."
-            }
-            Self::Forum => "Nothing physical happens here. The Elder has a spreadsheet.",
-            Self::Clinic => "The urologist will see you now. He is bored.",
-        }
-    }
-
-    fn observer(self) -> Option<&'static str> {
-        match self {
-            Self::Bedroom => Some("cat"),
-            Self::LockerRoom => Some("greg"),
-            Self::Grandmas => Some("grandma"),
-            _ => None,
-        }
-    }
-
-    pub fn shop_open(self) -> bool {
-        matches!(self, Self::LockerRoom | Self::Hotel)
-    }
-
-    pub fn has_mom(self) -> bool {
-        matches!(self, Self::Bedroom | Self::Grandmas)
-    }
-}
-
-#[derive(Clone, Copy, PartialEq, Eq, Debug)]
-pub enum Grip {
-    Overhand,
-    Underhand,
-}
-
-impl Grip {
-    pub fn name(self) -> &'static str {
-        match self {
-            Self::Overhand => "overhand",
-            Self::Underhand => "underhand",
-        }
-    }
-
-    pub fn parse(protocol: &str) -> Option<Self> {
-        match protocol.to_ascii_lowercase().as_str() {
-            "overhand" => Some(Self::Overhand),
-            "underhand" => Some(Self::Underhand),
-            _ => None,
-        }
-    }
-}
-
-#[derive(Default)]
-pub struct Items {
-    pub ruler: bool,
-    pub ice_packs: u32,
-    pub door_locks: u32,
-    pub dnd_sign: bool,
-    pub pump_pro: bool,
-    pub extender: bool,
-    pub ring: bool,
-    pub supplements: u32,
-    pub cage: bool,
-    pub spreadsheet: bool,
-    pub teapot_spout: bool,
-    pub blinds: bool,
-}
-
-enum Payload {
-    Empty,
-    Json(Value),
-    Raw(&'static str, Vec<u8>),
-}
-
-pub struct Outcome {
-    status: StatusCode,
-    payload: Payload,
-    headers: Vec<(HeaderName, String)>,
-}
-
-impl Outcome {
-    pub fn empty(status: StatusCode) -> Self {
-        Self {
-            status,
-            payload: Payload::Empty,
-            headers: Vec::new(),
-        }
-    }
-
-    pub fn json(status: StatusCode, body: Value) -> Self {
-        Self {
-            payload: Payload::Json(body),
-            ..Self::empty(status)
-        }
-    }
-
-    pub fn raw(status: StatusCode, content_type: &'static str, body: impl Into<Vec<u8>>) -> Self {
-        Self {
-            payload: Payload::Raw(content_type, body.into()),
-            ..Self::empty(status)
-        }
-    }
-
-    pub fn header(mut self, name: HeaderName, value: impl Into<String>) -> Self {
-        self.headers.push((name, value.into()));
-        self
-    }
-
-    pub fn status(&self) -> StatusCode {
-        self.status
-    }
-}
-
-impl IntoResponse for Outcome {
-    fn into_response(self) -> Response {
-        let mut response = match self.payload {
-            // RFC 9110 §15.3.7 obliges a 206 to be a byte range of the full representation, so it is.
-            Payload::Json(body) if self.status == StatusCode::PARTIAL_CONTENT => {
-                let full = body.to_string().into_bytes();
-                let half = full.len() / 2;
-                let range = format!("bytes 0-{}/{}", half - 1, full.len());
-                (
-                    self.status,
-                    [
-                        (header::CONTENT_TYPE, "application/json".to_owned()),
-                        (header::CONTENT_RANGE, range),
-                    ],
-                    full[..half].to_vec(),
-                )
-                    .into_response()
-            }
-            Payload::Json(body) => (self.status, Json(body)).into_response(),
-            Payload::Raw(content_type, body) => {
-                (self.status, [(header::CONTENT_TYPE, content_type)], body).into_response()
-            }
-            Payload::Empty => self.status.into_response(),
-        };
-        for (name, value) in self.headers {
-            let value = HeaderValue::from_str(&value).expect("header values are visible ascii");
-            response.headers_mut().append(name, value);
-        }
-        response
-    }
-}
-
-pub struct Pending {
-    due: u32,
-    length: f64,
-    girth: f64,
-}
-
-pub struct Ending {
-    pub cause: &'static str,
-    pub detail: String,
-    pub turn: u32,
-}
+use balance::{
+    HONEST_TOLERANCE, MAX_STAMINA, PULLED_STAMINA, SELF_REPORT_INFLATION, STARTING_CASH,
+    STARTING_EQ,
+};
+use state::Pending;
 
 pub struct Run {
+    /// The private id in the run's URL. Knowing it is the only authorization a run has.
     pub id: String,
-    pub origin_etag: String,
+    pub public_id: String,
+    etag_salt: u64,
     pub version: u64,
     pub turn: u32,
     pub floor: Floor,
-    pub floor_turns: u32,
+    pub here: FloorState,
     pub length: f64,
-    pub temp_length: f64,
     pub girth: f64,
     pub foreskin: Option<f64>,
     pub eq: i32,
     pub stamina: i32,
     pub suspicion: u8,
-    pub shame_base: u32,
     pub shame: u32,
+    pub shame_reported: u32,
+    pub shame_total: u32,
     pub cash: u32,
     pub grip: Grip,
     pub items: Items,
+    pub conditions: Conditions,
     pub warmed_up: bool,
-    pub teapot: bool,
-    pub peyronie: bool,
     pub put_applied: bool,
-    pub forum_read: bool,
-    pub branch_pending: bool,
-    pub mom_present: bool,
-    pub mom_errand: &'static str,
-    pub mom_strikes: u8,
-    pub elder_strikes: u8,
+    pub story: Story,
+    pub mom: Option<MomVisit>,
+    pub heard: Vec<String>,
+    pub elder: Elder,
+    pub clinic: Clinic,
     pub seeded: bool,
-    pub towel_stolen: bool,
-    pub pulled_muscle: bool,
-    pub priapism_turns: u8,
     pub filmed_at: Option<SystemTime>,
-    pub observed: Option<&'static str>,
-    pub measured: bool,
-    pub cured: bool,
-    pub roommate_told: bool,
-    pub wifi_accepted: bool,
-    pub verified: bool,
-    pub elder_beaten: bool,
-    pub edges: u8,
-    pub drawer_searches: u8,
-    pub intake_attempts: usize,
-    pub nonce: String,
-    pub heard: Vec<String>,
+    pub observed: Option<Observer>,
+    pub refractory: Duration,
     pub refractory_until: Option<Instant>,
     pub pending: Vec<Pending>,
     pub ended: Option<Ending>,
+    pub last_seen: Instant,
     rng: StdRng,
 }
 
@@ -308,7 +87,7 @@ fn round3(x: f64) -> f64 {
 }
 
 fn honest(claimed: f64, actual: f64) -> bool {
-    (claimed - actual).abs() < 0.06
+    (claimed - actual).abs() < HONEST_TOLERANCE
 }
 
 fn not_extended() -> Problem {
@@ -338,72 +117,65 @@ pub fn shaft(mm: usize) -> String {
 }
 
 impl Run {
-    pub fn new(id: String, seed: u64, shame_base: u32) -> Self {
+    pub fn new(id: String, public_id: String, seed: u64) -> Self {
         let mut rng = StdRng::seed_from_u64(seed);
         let length = round2(rng.random_range(4.5..6.5));
         let girth = round2(rng.random_range(4.0..5.0));
         let foreskin = round2(rng.random_range(0.4..2.4));
-        let mut run = Self {
+        let etag_salt = rng.random();
+        Self {
             id,
-            origin_etag: String::new(),
+            public_id,
+            etag_salt,
             version: 0,
             turn: 0,
             floor: Floor::Bedroom,
-            floor_turns: 0,
+            here: FloorState::default(),
             length,
-            temp_length: 0.0,
             girth,
             foreskin: Some(foreskin),
-            eq: 20,
+            eq: STARTING_EQ,
             stamina: MAX_STAMINA,
             suspicion: 0,
-            shame_base,
             shame: 0,
+            shame_reported: 0,
+            shame_total: 0,
             cash: STARTING_CASH,
             grip: Grip::Overhand,
-            items: Items {
-                ice_packs: 1,
-                ..Items::default()
-            },
+            items: Items::default(),
+            conditions: Conditions::default(),
             warmed_up: false,
-            teapot: false,
-            peyronie: false,
             put_applied: false,
-            forum_read: false,
-            branch_pending: false,
-            mom_present: false,
-            mom_errand: "She heard a noise.",
-            mom_strikes: 0,
-            elder_strikes: 0,
+            story: Story::Unopened,
+            mom: None,
+            heard: Vec::new(),
+            elder: Elder::Unverified { strikes: 0 },
+            clinic: Clinic::default(),
             seeded: false,
-            towel_stolen: false,
-            pulled_muscle: false,
-            priapism_turns: 0,
             filmed_at: None,
             observed: None,
-            measured: false,
-            cured: false,
-            roommate_told: false,
-            wifi_accepted: false,
-            verified: false,
-            elder_beaten: false,
-            edges: 0,
-            drawer_searches: 0,
-            intake_attempts: 0,
-            nonce: String::new(),
-            heard: Vec::new(),
+            refractory: Duration::from_secs(30),
             refractory_until: None,
             pending: Vec::new(),
             ended: None,
+            last_seen: Instant::now(),
             rng,
-        };
-        run.origin_etag = run.etag();
-        run.nonce = run.fresh_nonce();
-        run
+        }
+    }
+
+    fn etag_at(&self, version: u64) -> String {
+        let mut hasher = DefaultHasher::new();
+        (self.etag_salt, version).hash(&mut hasher);
+        format!("\"{:016x}\"", hasher.finish())
     }
 
     pub fn etag(&self) -> String {
-        format!("\"{}-{}\"", self.id, self.version)
+        self.etag_at(self.version)
+    }
+
+    /// The ETag the run had when it was created, which the true ending asks for.
+    pub fn origin_etag(&self) -> String {
+        self.etag_at(0)
     }
 
     pub fn touch(&mut self) {
@@ -414,8 +186,16 @@ impl Run {
         format!("{:016x}", self.rng.random::<u64>())
     }
 
+    fn chance(&mut self, odds: u32) -> bool {
+        self.rng.random_ratio(1, odds)
+    }
+
+    pub fn path(&self, sub: &str) -> String {
+        format!("/runs/{}{sub}", self.id)
+    }
+
     pub fn current_length(&self) -> f64 {
-        self.length + self.temp_length
+        self.length + self.here.temp_length
     }
 
     pub fn self_reported(&self) -> f64 {
@@ -423,7 +203,15 @@ impl Run {
     }
 
     pub fn max_stamina(&self) -> i32 {
-        if self.pulled_muscle { 7 } else { MAX_STAMINA }
+        if self.conditions.pulled_muscle {
+            PULLED_STAMINA
+        } else {
+            MAX_STAMINA
+        }
+    }
+
+    pub fn forum_read(&self) -> bool {
+        self.story == Story::ReadForum
     }
 
     pub fn footage(&self) -> Option<(SystemTime, u64)> {
@@ -432,163 +220,45 @@ impl Run {
         Some((filmed, age))
     }
 
-    pub fn total_shame(&self) -> u32 {
-        self.shame_base + self.shame
-    }
-
     pub fn status(&self) -> &'static str {
-        match (&self.ended, self.cured) {
+        match (&self.ended, self.clinic.cured) {
             (Some(_), _) => "gone",
             (None, true) => "normal",
             (None, false) => "alive",
         }
     }
 
+    /// The parts of the run that its response headers do not already carry.
     pub fn view(&self) -> Value {
         let conditions: Vec<&str> = [
-            (self.teapot, "short and stout"),
-            (self.peyronie, "curved"),
+            (self.here.teapot, "short and stout"),
+            (self.conditions.peyronie, "curved"),
             (self.items.cage, "caged"),
-            (self.priapism_turns > 0, "priapism"),
-            (self.pulled_muscle, "pulled muscle"),
+            (self.conditions.priapism_turns > 0, "priapism"),
+            (self.conditions.pulled_muscle, "pulled muscle"),
             (self.filmed_at.is_some(), "viral"),
         ]
         .into_iter()
         .filter_map(|(active, name)| active.then_some(name))
         .collect();
-        let mut view = json!({
-            "id": self.id,
+        json!({
+            "public_id": self.public_id,
             "status": self.status(),
             "turn": self.turn,
-            "floor": { "number": self.floor.number(), "name": self.floor.name() },
-            "self_reported_length": round2(self.self_reported()),
-            "girth": round2(self.girth),
-            "foreskin": self.foreskin.map(round2),
-            "eq": self.eq,
-            "stamina": self.stamina,
-            "suspicion": self.suspicion,
-            "shame": self.total_shame(),
-            "cash": self.cash,
+            "run_shame": self.shame,
             "grip": self.grip.name(),
             "warmed_up": self.warmed_up,
             "ranked": !self.seeded,
             "conditions": conditions,
-        });
-        if self.items.ruler {
-            view["length"] = json!(round2(self.current_length()));
-        }
-        view
-    }
-
-    pub fn floor_view(&self) -> Value {
-        let id = &self.id;
-        let turns_required = match self.floor {
-            Floor::Forum | Floor::Clinic => Value::Null,
-            _ => json!(FLOOR_TURNS),
-        };
-        let mut view = json!({
-            "number": self.floor.number(),
-            "name": self.floor.name(),
-            "note": self.floor.note(),
-            "turns": self.floor_turns,
-            "turns_required": turns_required,
-            "exit": { "href": format!("/runs/{id}/floor"), "method": "POST" },
-        });
-        match self.floor {
-            Floor::LockerRoom => {
-                view["others"] = json!([
-                    { "name": "Greg", "self_reported_length": 9.5 },
-                    { "name": "Dmitri", "self_reported_length": 8.75 },
-                    { "name": "a man in a towel", "self_reported_length": 11.0 },
-                ]);
-            }
-            Floor::Hotel => view["portal"] = json!(format!("/runs/{id}/portal")),
-            Floor::Forum => {
-                view["thread"] = json!(FORUM_THREAD);
-                view["elder"] = json!(format!("/runs/{id}/elder"));
-            }
-            Floor::Clinic => view["diagnosis"] = json!(format!("/runs/{id}/diagnosis")),
-            _ => {}
-        }
-        if self.floor.shop_open() {
-            view["shop"] = json!(format!("/runs/{id}/shop"));
-        }
-        view
+        })
     }
 
-    pub fn inventory(&self) -> Vec<(&'static str, &'static str)> {
-        let i = &self.items;
-        let owned = [
-            (
-                true,
-                "warm-towel",
-                "Reusable. Satisfies the warm-up precondition. Use technique=warmup.",
-            ),
-            (
-                i.ice_packs > 0,
-                "ice-pack",
-                "Lowers EQ by 40. Use technique=ice.",
-            ),
-            (
-                i.ruler,
-                "ruler",
-                "Measures honestly. The length resource now carries a Content-Length.",
-            ),
-            (
-                i.door_locks > 0,
-                "door-lock",
-                "Keeps the roommate out once.",
-            ),
-            (
-                i.dnd_sign,
-                "do-not-disturb-sign",
-                "Works on housekeeping. Mom does not read signs.",
-            ),
-            (
-                i.pump_pro,
-                "pump-pro",
-                "Use technique=pump. Gains are temporary.",
-            ),
-            (
-                i.extender,
-                "extender",
-                "Passive gains each turn. Takes up room. Can be removed with DELETE.",
-            ),
-            (
-                i.ring,
-                "cock-ring",
-                "Girth gains doubled. Rupture risk raised. Responses are compressed if you accept gzip. Can be removed with DELETE.",
-            ),
-            (i.supplements > 0, "supplement", "Use technique=supplement."),
-            (i.cage, "chastity-cage", "Locked."),
-            (
-                i.spreadsheet,
-                "spreadsheet",
-                "Charts your progress. Every line is flat.",
-            ),
-            (
-                i.teapot_spout,
-                "teapot-spout",
-                "Does nothing. Cannot be dropped.",
-            ),
-            (
-                i.blinds,
-                "window-blinds",
-                "The neighbour has a good camera. The blinds are better.",
-            ),
-        ];
-        owned
-            .into_iter()
-            .filter_map(|(have, slug, description)| have.then_some((slug, description)))
-            .collect()
-    }
-
-    pub fn end(&mut self, cause: &'static str, detail: &str) {
+    pub fn end(&mut self, cause: Cause) -> Problem {
         self.ended = Some(Ending {
             cause,
-            detail: detail.into(),
             turn: self.turn,
         });
+        cause.problem().with("turn", self.turn)
     }
 
     fn check_refractory(&mut self, now: Instant) -> Result<(), Problem> {
@@ -606,12 +276,17 @@ impl Run {
         }
         self.refractory_until = None;
         self.stamina = self.max_stamina();
-        self.eq = 20;
+        self.eq = STARTING_EQ;
         self.warmed_up = false;
         self.touch();
         Ok(())
     }
 
+    fn exhaust(&mut self, now: Instant) {
+        self.stamina = 0;
+        self.refractory_until = Some(now + self.refractory);
+    }
+
     fn realize(&mut self) {
         let (due, waiting): (Vec<_>, Vec<_>) = std::mem::take(&mut self.pending)
             .into_iter()
@@ -632,87 +307,9 @@ impl Run {
     }
 
     fn rupture(&mut self) -> Problem {
-        let detail = if self.items.ice_packs > 0 {
-            "A vessel has exceeded its rated pressure. The run has ended. An ice pack was available and was not used."
-        } else {
-            "A vessel has exceeded its rated pressure. The run has ended."
+        let cause = Cause::Ruptured {
+            ice_unused: self.items.ice_packs > 0,
         };
-        self.end("vascular-event", detail);
-        Problem::new(StatusCode::INTERNAL_SERVER_ERROR, "vascular-event", detail)
-            .with("eq_at_failure", self.eq)
-            .with("turn", self.turn)
-    }
-
-    fn next_floor(&mut self, paid: bool) {
-        let Some(next) = self.floor.next() else {
-            return;
-        };
-        self.floor = next;
-        self.floor_turns = 0;
-        self.temp_length = 0.0;
-        self.teapot = false;
-        self.warmed_up = false;
-        self.eq = 20;
-        self.suspicion = 0;
-        self.mom_present = false;
-        self.roommate_told = false;
-        self.drawer_searches = 0;
-        self.towel_stolen = false;
-        self.edges = 0;
-        if paid {
-            self.cash += FLOOR_ALLOWANCE;
-        }
-        self.nonce = self.fresh_nonce();
-        self.touch();
-    }
-
-    pub fn advance(&mut self) -> Result<Outcome, Problem> {
-        match self.floor {
-            Floor::Clinic => {
-                return Err(Problem::new(
-                    StatusCode::CONFLICT,
-                    "no-further-floor",
-                    "There is no further floor. There is only the diagnosis.",
-                ));
-            }
-            Floor::Forum if !self.elder_beaten => {
-                return Err(Problem::new(
-                    StatusCode::CONFLICT,
-                    "elder-unaddressed",
-                    "The Elder has not been addressed.",
-                )
-                .with("elder", format!("/runs/{}/elder", self.id)));
-            }
-            Floor::Forum => {}
-            _ if self.floor_turns < FLOOR_TURNS => {
-                return Err(Problem::new(
-                    StatusCode::TOO_EARLY,
-                    "floor-not-over",
-                    format!(
-                        "The floor is not over. {} turns remain.",
-                        FLOOR_TURNS - self.floor_turns
-                    ),
-                ));
-            }
-            _ => {}
-        }
-        if self.rng.random_ratio(1, 200) {
-            let detail =
-                "The request conflicts with the current state of the zipper. The run has ended.";
-            self.end("zipper", detail);
-            return Err(Problem::new(StatusCode::CONFLICT, "zipper", detail));
-        }
-        let reverted = self.temp_length;
-        self.next_floor(true);
-        let mut body = json!({
-            "detail": format!("You have arrived at {}.", self.floor.name()),
-            "floor": self.floor.number(),
-            "note": self.floor.note(),
-        });
-        if reverted > 0.0 {
-            body["reverted"] = json!(round2(reverted));
-        }
-        Ok(Outcome::json(StatusCode::SEE_OTHER, body)
-            .header(header::LOCATION, format!("/runs/{}/floor", self.id)))
+        self.end(cause)
     }
 }

Added file: src/game/outcome.rs+44 additions@@ -0,0 +1,44 @@
+use axum::http::{HeaderName, StatusCode};
+use serde_json::Value;
+
+pub enum Payload {
+    Empty,
+    Json(Value),
+    Raw(&'static str, Vec<u8>),
+}
+
+/// A successful result of a game action, before it becomes an HTTP response.
+pub struct Outcome {
+    pub status: StatusCode,
+    pub payload: Payload,
+    pub headers: Vec<(HeaderName, String)>,
+}
+
+impl Outcome {
+    pub fn empty(status: StatusCode) -> Self {
+        Self {
+            status,
+            payload: Payload::Empty,
+            headers: Vec::new(),
+        }
+    }
+
+    pub fn json(status: StatusCode, body: Value) -> Self {
+        Self {
+            payload: Payload::Json(body),
+            ..Self::empty(status)
+        }
+    }
+
+    pub fn raw(status: StatusCode, content_type: &'static str, body: impl Into<Vec<u8>>) -> Self {
+        Self {
+            payload: Payload::Raw(content_type, body.into()),
+            ..Self::empty(status)
+        }
+    }
+
+    pub fn header(mut self, name: HeaderName, value: impl Into<String>) -> Self {
+        self.headers.push((name, value.into()));
+        self
+    }
+}

Added file: src/game/shop.rs+109 additions@@ -0,0 +1,109 @@
+use axum::http::{StatusCode, header};
+use serde_json::{Value, json};
+
+use super::{Item, Outcome, Run, items::SHOP};
+use crate::problem::Problem;
+
+fn pump_bro_absent() -> Problem {
+    Problem::new(
+        StatusCode::NOT_FOUND,
+        "pump-bro-absent",
+        "Pump-Bro is not here.",
+    )
+}
+
+impl Run {
+    pub fn shop_view(&self) -> Result<Value, Problem> {
+        if !self.floor.shop_open() {
+            return Err(pump_bro_absent());
+        }
+        let stock: Vec<Value> = SHOP
+            .iter()
+            .filter_map(|item| {
+                Some(json!({
+                    "item": item.slug(),
+                    "price": item.price()?,
+                    "description": item.pitch(),
+                    "href": self.path(&format!("/shop/{}", item.slug())),
+                    "method": "POST",
+                }))
+            })
+            .collect();
+        Ok(json!({ "merchant": "Pump-Bro", "stock": stock }))
+    }
+
+    pub fn buy(&mut self, slug: &str) -> Result<Outcome, Problem> {
+        if !self.floor.shop_open() {
+            return Err(pump_bro_absent());
+        }
+        let not_for_sale = || {
+            Problem::new(
+                StatusCode::NOT_FOUND,
+                "not-for-sale",
+                "Pump-Bro does not sell that. He knows a guy.",
+            )
+        };
+        let item = Item::parse(slug)
+            .filter(|item| SHOP.contains(item))
+            .ok_or_else(not_for_sale)?;
+        let price = item.price().ok_or_else(not_for_sale)?;
+        if item == Item::Pump {
+            return Err(Problem::new(
+                StatusCode::UPGRADE_REQUIRED,
+                "upsell",
+                "This pump requires an upgrade.",
+            )
+            .header(header::UPGRADE, "pump-pro/2.0")
+            .with("upgrade", self.path("/shop/pump-pro")));
+        }
+        if self.cash < price {
+            return Err(Problem::new(
+                StatusCode::PAYMENT_REQUIRED,
+                "insufficient-funds",
+                "Payment is required. RFC 9110 has reserved this status for future use since 1997. The future is here and you cannot afford it.",
+            )
+            .with("price", price));
+        }
+        self.cash -= price;
+        self.items.grant(item);
+        self.touch();
+        if item == Item::Supplement {
+            return Err(Problem::new(
+                StatusCode::GATEWAY_TIMEOUT,
+                "still-shipping",
+                "The supplement is still shipping. You have been charged. It may arrive.",
+            ));
+        }
+        Ok(Outcome::json(
+            StatusCode::CREATED,
+            json!({ "detail": "Purchased. No refunds." }),
+        )
+        .header(
+            header::LOCATION,
+            self.path(&format!("/inventory/{}", item.slug())),
+        ))
+    }
+
+    pub fn drop_item(&mut self, item: Item) -> Result<Outcome, Problem> {
+        match item {
+            Item::Extender => self.items.extender = false,
+            Item::Ring => self.items.ring = false,
+            Item::Cage => {
+                return Err(Problem::new(
+                    StatusCode::LOCKED,
+                    "caged",
+                    "The cage is locked.",
+                ));
+            }
+            _ => {
+                return Err(Problem::new(
+                    StatusCode::FORBIDDEN,
+                    "cannot-be-dropped",
+                    "That cannot be dropped.",
+                ));
+            }
+        }
+        self.touch();
+        Ok(Outcome::empty(StatusCode::NO_CONTENT))
+    }
+}

Added file: src/game/state.rs+245 additions@@ -0,0 +1,245 @@
+use axum::http::StatusCode;
+
+use crate::problem::Problem;
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+#[repr(u8)]
+pub enum Floor {
+    Bedroom = 1,
+    Bathroom = 2,
+    LockerRoom = 3,
+    Grandmas = 4,
+    Hotel = 5,
+    Forum = 6,
+    Clinic = 7,
+}
+
+impl Floor {
+    pub fn number(self) -> u8 {
+        self as u8
+    }
+
+    pub fn next(self) -> Option<Self> {
+        match self {
+            Self::Bedroom => Some(Self::Bathroom),
+            Self::Bathroom => Some(Self::LockerRoom),
+            Self::LockerRoom => Some(Self::Grandmas),
+            Self::Grandmas => Some(Self::Hotel),
+            Self::Hotel => Some(Self::Forum),
+            Self::Forum => Some(Self::Clinic),
+            Self::Clinic => None,
+        }
+    }
+
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Bedroom => "the bedroom",
+            Self::Bathroom => "the shared bathroom",
+            Self::LockerRoom => "the gym locker room",
+            Self::Grandmas => "grandma's house for Thanksgiving",
+            Self::Hotel => "a business trip hotel",
+            Self::Forum => "the forum",
+            Self::Clinic => "the urologist's office",
+        }
+    }
+
+    pub fn note(self) -> &'static str {
+        match self {
+            Self::Bedroom => "The door does not lock. The cat is present.",
+            Self::Bathroom => "The water is hot. The roommate showers at eight.",
+            Self::LockerRoom => {
+                "It is cold. Discretion is advised. Everyone here is lying. Pump-Bro is by the lockers."
+            }
+            Self::Grandmas => {
+                "The walls are thin. Mom is here, and she has been reading about Digest authentication."
+            }
+            Self::Hotel => {
+                "The wifi requires agreement. Housekeeping does not knock. Pump-Bro is in the lobby."
+            }
+            Self::Forum => "Nothing physical happens here. The Elder has a spreadsheet.",
+            Self::Clinic => "The urologist will see you now. He is bored.",
+        }
+    }
+
+    pub fn observer(self) -> Option<Observer> {
+        match self {
+            Self::Bedroom => Some(Observer::Cat),
+            Self::LockerRoom => Some(Observer::Greg),
+            Self::Grandmas => Some(Observer::Grandma),
+            _ => None,
+        }
+    }
+
+    pub fn has_mom(self) -> bool {
+        matches!(self, Self::Bedroom | Self::Grandmas)
+    }
+
+    pub fn has_window(self) -> bool {
+        matches!(self, Self::Bedroom | Self::Grandmas | Self::Hotel)
+    }
+
+    pub fn shop_open(self) -> bool {
+        matches!(self, Self::LockerRoom | Self::Hotel)
+    }
+
+    pub fn timed(self) -> bool {
+        !matches!(self, Self::Forum | Self::Clinic)
+    }
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Observer {
+    Cat,
+    Greg,
+    Grandma,
+}
+
+impl Observer {
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Cat => "cat",
+            Self::Greg => "greg",
+            Self::Grandma => "grandma",
+        }
+    }
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Grip {
+    Overhand,
+    Underhand,
+}
+
+impl Grip {
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Overhand => "overhand",
+            Self::Underhand => "underhand",
+        }
+    }
+
+    pub fn parse(protocol: &str) -> Option<Self> {
+        match protocol.to_ascii_lowercase().as_str() {
+            "overhand" => Some(Self::Overhand),
+            "underhand" => Some(Self::Underhand),
+            _ => None,
+        }
+    }
+}
+
+/// State that belongs to the current floor and resets when you leave it.
+#[derive(Default)]
+pub struct FloorState {
+    pub turns: u32,
+    pub drawer_searches: u8,
+    pub edges: u8,
+    pub temp_length: f64,
+    pub teapot: bool,
+    pub towel_stolen: bool,
+    pub roommate_told: bool,
+    pub wifi_accepted: bool,
+}
+
+#[derive(Default)]
+pub struct Conditions {
+    pub peyronie: bool,
+    pub pulled_muscle: bool,
+    pub priapism_turns: u8,
+}
+
+pub struct MomVisit {
+    pub errand: &'static str,
+    pub nonce: String,
+    pub strikes: u8,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Elder {
+    Unverified { strikes: u8 },
+    Verified,
+    Beaten,
+}
+
+#[derive(Default)]
+pub struct Clinic {
+    pub intake_attempts: usize,
+    pub measured: bool,
+    pub cured: bool,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Story {
+    Unopened,
+    Pending,
+    ReadForum,
+    ClosedTab,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Cause {
+    Ruptured { ice_unused: bool },
+    Caught,
+    Banned,
+    Degloved,
+    Zipper,
+    Abandoned,
+}
+
+impl Cause {
+    pub fn slug(self) -> &'static str {
+        match self {
+            Self::Ruptured { .. } => "vascular-event",
+            Self::Caught => "caught",
+            Self::Banned => "banned",
+            Self::Degloved => "degloved",
+            Self::Zipper => "zipper",
+            Self::Abandoned => "abandoned",
+        }
+    }
+
+    pub fn detail(self) -> &'static str {
+        match self {
+            Self::Ruptured { ice_unused: true } => {
+                "A vessel has exceeded its rated pressure. The run has ended. An ice pack was available and was not used."
+            }
+            Self::Ruptured { ice_unused: false } => {
+                "A vessel has exceeded its rated pressure. The run has ended."
+            }
+            Self::Caught => {
+                "Mom has seen enough. The run has ended. Nobody will mention it at dinner."
+            }
+            Self::Banned => "Your account has been banned. The forum can tell. The run has ended.",
+            Self::Degloved => {
+                "The outer layer has been removed in one piece. It will not be returning. The run has ended."
+            }
+            Self::Zipper => {
+                "The request conflicts with the current state of the zipper. The run has ended."
+            }
+            Self::Abandoned => "The run was abandoned.",
+        }
+    }
+
+    fn status(self) -> StatusCode {
+        match self {
+            Self::Ruptured { .. } => StatusCode::INTERNAL_SERVER_ERROR,
+            Self::Caught | Self::Degloved | Self::Abandoned => StatusCode::GONE,
+            Self::Banned => StatusCode::FORBIDDEN,
+            Self::Zipper => StatusCode::CONFLICT,
+        }
+    }
+
+    pub fn problem(self) -> Problem {
+        Problem::new(self.status(), self.slug(), self.detail())
+    }
+}
+
+pub struct Ending {
+    pub cause: Cause,
+    pub turn: u32,
+}
+
+pub struct Pending {
+    pub due: u32,
+    pub length: f64,
+    pub girth: f64,
+}

Added file: src/game/techniques.rs+220 additions@@ -0,0 +1,220 @@
+use axum::http::StatusCode;
+use serde_json::{Value, json};
+
+use crate::problem::Problem;
+
+pub const LUBRICANTS: [&str; 5] = [
+    "application/baby-oil",
+    "application/coconut-oil",
+    "application/lotion",
+    "application/vaseline",
+    "text/plain; charset=spit",
+];
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Lube {
+    BabyOil,
+    CoconutOil,
+    Lotion,
+    Vaseline,
+    Spit,
+}
+
+impl Lube {
+    pub fn from_content_type(content_type: Option<&str>) -> Result<Option<Self>, Problem> {
+        let Some(raw) = content_type else {
+            return Ok(None);
+        };
+        let lowered = raw.to_ascii_lowercase();
+        let mut parts = lowered.split(';').map(str::trim);
+        let essence = parts.next().unwrap_or_default();
+        let spit = parts.any(|p| p.replace(' ', "") == "charset=spit");
+        match essence {
+            "application/baby-oil" => Ok(Some(Self::BabyOil)),
+            "application/coconut-oil" => Ok(Some(Self::CoconutOil)),
+            "application/lotion" => Ok(Some(Self::Lotion)),
+            "application/vaseline" => Ok(Some(Self::Vaseline)),
+            "text/plain" if spit => Ok(Some(Self::Spit)),
+            e if e.starts_with("image/") || e.starts_with("video/") => Err(Problem::new(
+                StatusCode::UNSUPPORTED_MEDIA_TYPE,
+                "no",
+                "No.",
+            )),
+            _ => Err(Problem::new(
+                StatusCode::UNSUPPORTED_MEDIA_TYPE,
+                "unsupported-lubricant",
+                format!("{essence} is not a lubricant."),
+            )
+            .with("lubricants", json!(LUBRICANTS))),
+        }
+    }
+
+    pub fn modifier(self) -> i32 {
+        match self {
+            Self::BabyOil => 1,
+            Self::CoconutOil => 3,
+            Self::Lotion => 0,
+            Self::Vaseline => 2,
+            Self::Spit => -2,
+        }
+    }
+}
+
+/// Techniques that roll for gains.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Training {
+    Wet,
+    Dry,
+    Stretch,
+    Uli,
+}
+
+/// Techniques that change EQ or spend an item without rolling.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Utility {
+    Warmup,
+    Ice,
+    Edge,
+    Pump,
+    Supplement,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum Technique {
+    Training(Training),
+    Utility(Utility),
+}
+
+#[derive(Clone, Copy)]
+pub enum LubeRule {
+    Required,
+    Forbidden,
+    Optional,
+}
+
+pub struct Profile {
+    pub dc: i32,
+    pub length: f64,
+    pub girth: f64,
+    /// Minimum and maximum foreskin the technique tolerates. A minimum above zero means it is used.
+    pub foreskin: Option<(f64, f64)>,
+    pub foreskin_growth: f64,
+    pub lube: LubeRule,
+}
+
+impl Training {
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Wet => "wet",
+            Self::Dry => "dry",
+            Self::Stretch => "stretch",
+            Self::Uli => "uli",
+        }
+    }
+
+    pub fn profile(self) -> Profile {
+        match self {
+            Self::Wet => Profile {
+                dc: 10,
+                length: 0.010,
+                girth: 0.005,
+                foreskin: None,
+                foreskin_growth: 0.0,
+                lube: LubeRule::Required,
+            },
+            Self::Dry => Profile {
+                dc: 12,
+                length: 0.008,
+                girth: 0.003,
+                foreskin: Some((0.8, 2.0)),
+                foreskin_growth: 0.01,
+                lube: LubeRule::Forbidden,
+            },
+            Self::Stretch => Profile {
+                dc: 11,
+                length: 0.015,
+                girth: 0.0,
+                foreskin: Some((0.0, 1.8)),
+                foreskin_growth: 0.03,
+                lube: LubeRule::Optional,
+            },
+            Self::Uli => Profile {
+                dc: 15,
+                length: 0.002,
+                girth: 0.020,
+                foreskin: None,
+                foreskin_growth: 0.0,
+                lube: LubeRule::Optional,
+            },
+        }
+    }
+}
+
+impl Utility {
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Warmup => "warmup",
+            Self::Ice => "ice",
+            Self::Edge => "edge",
+            Self::Pump => "pump",
+            Self::Supplement => "supplement",
+        }
+    }
+
+    fn effect(self) -> &'static str {
+        match self {
+            Self::Warmup => "EQ +25. Satisfies the warm-up precondition.",
+            Self::Ice => "EQ -40. Consumes an ice pack.",
+            Self::Edge => "EQ +15 and a little girth. Three in a row is a loop.",
+            Self::Pump => "Large gains, all temporary. Requires a pump.",
+            Self::Supplement => "Consumes a supplement.",
+        }
+    }
+}
+
+impl Technique {
+    pub const ALL: [Self; 9] = [
+        Self::Utility(Utility::Warmup),
+        Self::Utility(Utility::Ice),
+        Self::Utility(Utility::Edge),
+        Self::Utility(Utility::Pump),
+        Self::Utility(Utility::Supplement),
+        Self::Training(Training::Wet),
+        Self::Training(Training::Dry),
+        Self::Training(Training::Stretch),
+        Self::Training(Training::Uli),
+    ];
+
+    pub fn name(self) -> &'static str {
+        match self {
+            Self::Training(t) => t.name(),
+            Self::Utility(u) => u.name(),
+        }
+    }
+
+    pub fn parse(name: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|t| t.name() == name)
+    }
+
+    pub fn describe(self, forum_read: bool) -> Value {
+        let training = match self {
+            Self::Utility(utility) => {
+                return json!({ "name": utility.name(), "effect": utility.effect() });
+            }
+            Self::Training(training) => training,
+        };
+        let profile = training.profile();
+        let lubricant = match profile.lube {
+            LubeRule::Required => "required",
+            LubeRule::Forbidden => "forbidden",
+            LubeRule::Optional => "optional",
+        };
+        json!({
+            "name": training.name(),
+            "dc": profile.dc,
+            "lubricant": lubricant,
+            "foreskin": profile.foreskin.map(|(min, max)| json!({ "min": min, "max": max })),
+            "locked": training == Training::Uli && !forum_read,
+        })
+    }
+}

Added file: src/game/turn.rs+522 additions@@ -0,0 +1,522 @@
+use std::{fmt::Write as _, ops::ControlFlow, time::Instant};
+
+use axum::http::{StatusCode, header};
+use rand::Rng;
+use serde_json::json;
+
+use super::{
+    Floor, Grip, LUBRICANTS, Lube, Outcome, Payload, Run, Story, Technique,
+    balance::{
+        BAND_BONUS, BRANCH_TURN, CAT_TAKES_TOWEL, DANGER_EQ, EQ_BAND, EQ_WOBBLE, EXTENDER_GAIN,
+        HOT_EQ, LOCKER_CHILL, OBSERVED, PRIAPISM_EQ, PRIAPISM_TURNS, PULLED_MUSCLE,
+        PULLED_MUSCLE_INTENSITY, RING_PRIAPISM, RING_RUPTURE_LINE, RUPTURE_LINE, STORAGE_GIRTH,
+        SUSPICION_LIMIT,
+    },
+    not_extended, round3,
+    state::{MomVisit, Observer, Pending},
+    techniques::{LubeRule, Profile, Training, Utility},
+};
+use crate::{headers::SERVER_TIMING, problem::Problem};
+
+impl Run {
+    pub fn jelq(
+        &mut self,
+        techniques: &[Technique],
+        intensity: i32,
+        lube: Option<Lube>,
+        now: Instant,
+    ) -> Result<Outcome, Problem> {
+        self.check_refractory(now)?;
+        if self.story == Story::Pending {
+            return Ok(self.branch_offer());
+        }
+        if self.floor == Floor::Forum {
+            return Ok(Outcome::json(
+                StatusCode::SEE_OTHER,
+                json!({ "detail": "Refer to the forum." }),
+            )
+            .header(header::LOCATION, super::FORUM_THREAD));
+        }
+        if self.items.cage {
+            return Err(Problem::new(
+                StatusCode::LOCKED,
+                "caged",
+                "The cage is locked. The key is not in the box.",
+            ));
+        }
+        match *techniques {
+            [Technique::Utility(utility)] => self.utility(utility, lube, now),
+            [Technique::Training(training)] => self.single(training, intensity, lube, now),
+            [Technique::Training(a), Technique::Training(b)] => {
+                self.combo(a, b, intensity, lube, now)
+            }
+            [_, _] => Err(Problem::new(
+                StatusCode::BAD_REQUEST,
+                "combo-invalid",
+                "Only training techniques can be combined.",
+            )),
+            _ => Err(Problem::new(
+                StatusCode::BAD_REQUEST,
+                "too-many-techniques",
+                "Two techniques at most. The server has limits even if you do not.",
+            )),
+        }
+    }
+
+    fn utility(
+        &mut self,
+        utility: Utility,
+        lube: Option<Lube>,
+        now: Instant,
+    ) -> Result<Outcome, Problem> {
+        match utility {
+            Utility::Warmup => return self.warm_up(),
+            Utility::Ice => return self.ice(),
+            Utility::Supplement => return self.supplement(),
+            Utility::Edge | Utility::Pump => {}
+        }
+        if utility == Utility::Pump {
+            self.here.edges = 0;
+        }
+        self.ready(Technique::Utility(utility), lube)?;
+        self.check_storage()?;
+        self.floor_enemy()?;
+        match utility {
+            Utility::Edge => self.edge(now),
+            _ => self.pump(now),
+        }
+    }
+
+    fn single(
+        &mut self,
+        training: Training,
+        intensity: i32,
+        lube: Option<Lube>,
+        now: Instant,
+    ) -> Result<Outcome, Problem> {
+        self.here.edges = 0;
+        self.ready(Technique::Training(training), lube)?;
+        self.check_storage()?;
+        self.floor_enemy()?;
+        self.commit(intensity, lube, now, 1);
+        if let ControlFlow::Break(interrupted) = self.mishaps(training, intensity)? {
+            return Ok(interrupted);
+        }
+        if let ControlFlow::Break(interrupted) = self.hazards(intensity)? {
+            return Ok(interrupted);
+        }
+        let outcome = self.roll(training, intensity, lube)?;
+        Ok(self.gossip(outcome))
+    }
+
+    fn combo(
+        &mut self,
+        a: Training,
+        b: Training,
+        intensity: i32,
+        lube: Option<Lube>,
+        now: Instant,
+    ) -> Result<Outcome, Problem> {
+        if a == b {
+            return Err(Problem::new(
+                StatusCode::BAD_REQUEST,
+                "combo-invalid",
+                "A technique cannot be combined with itself. The server has checked.",
+            ));
+        }
+        self.here.edges = 0;
+        self.ready(Technique::Training(a), lube)?;
+        self.ready(Technique::Training(b), lube)?;
+        self.check_storage()?;
+        self.floor_enemy()?;
+        self.commit(intensity, lube, now, 2);
+        for training in [a, b] {
+            if let ControlFlow::Break(interrupted) = self.mishaps(training, intensity)? {
+                return Ok(interrupted);
+            }
+        }
+        if let ControlFlow::Break(interrupted) = self.hazards(intensity)? {
+            return Ok(interrupted);
+        }
+
+        let mut statuses = Vec::new();
+        for training in [a, b] {
+            let result = self.roll(training, intensity, lube);
+            if self.ended.is_some() {
+                return result;
+            }
+            let status = match result {
+                Ok(outcome) => self.gossip(outcome).status,
+                Err(problem) => problem.status(),
+            };
+            statuses.push((training, status));
+        }
+
+        let mut xml = String::from(
+            "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<D:multistatus xmlns:D=\"DAV:\">\n",
+        );
+        for (training, status) in statuses {
+            let _ = write!(
+                xml,
+                "  <D:response>\n    <D:href>{}?technique={}</D:href>\n    <D:status>HTTP/1.1 {} {}</D:status>\n  </D:response>\n",
+                self.path(""),
+                training.name(),
+                status.as_u16(),
+                crate::problem::reason(status),
+            );
+        }
+        xml.push_str(
+            "  <D:responsedescription>Each technique has been reported separately.</D:responsedescription>\n</D:multistatus>\n",
+        );
+        Ok(Outcome::raw(
+            StatusCode::MULTI_STATUS,
+            "application/xml; charset=utf-8",
+            xml,
+        ))
+    }
+
+    fn ready(&self, technique: Technique, lube: Option<Lube>) -> Result<(), Problem> {
+        if technique == Technique::Training(Training::Uli) && !self.forum_read() {
+            return Err(Problem::new(
+                StatusCode::FORBIDDEN,
+                "technique-locked",
+                "This technique is discussed on the forum. You have not been to the forum.",
+            ));
+        }
+        if !self.warmed_up {
+            return Err(Problem::new(
+                StatusCode::PRECONDITION_FAILED,
+                "cold-start",
+                "Warm-up was skipped. The server has noted this.",
+            )
+            .with("technique", Utility::Warmup.name()));
+        }
+        let training = match technique {
+            Technique::Utility(Utility::Pump) if !self.items.pump_pro => {
+                return Err(Problem::new(
+                    StatusCode::FAILED_DEPENDENCY,
+                    "no-pump",
+                    "The pump technique depends on a pump.",
+                ));
+            }
+            Technique::Utility(_) => return Ok(()),
+            Technique::Training(training) => training,
+        };
+        let profile = training.profile();
+        match (profile.lube, lube) {
+            (LubeRule::Required, None) => {
+                return Err(Problem::new(
+                    StatusCode::UNSUPPORTED_MEDIA_TYPE,
+                    "lubricant-required",
+                    format!(
+                        "The {} technique requires a lubricant. None was declared.",
+                        training.name()
+                    ),
+                )
+                .with("lubricants", json!(LUBRICANTS)));
+            }
+            (LubeRule::Forbidden, Some(_)) => {
+                return Err(Problem::new(
+                    StatusCode::UNSUPPORTED_MEDIA_TYPE,
+                    "lubricant-declared",
+                    format!(
+                        "The {} technique was requested. A lubricant was declared.",
+                        training.name()
+                    ),
+                ));
+            }
+            _ => {}
+        }
+        match profile.foreskin {
+            Some((min, max)) => self.check_foreskin(min, max),
+            None => Ok(()),
+        }
+    }
+
+    fn check_foreskin(&self, min: f64, max: f64) -> Result<(), Problem> {
+        let Some(f) = self.foreskin else {
+            if min <= 0.0 {
+                return Ok(());
+            }
+            return Err(Problem::new(
+                StatusCode::GONE,
+                "foreskin-gone",
+                "This technique requires a foreskin. The foreskin is gone.",
+            )
+            .header(header::CONTENT_LOCATION, self.path("/foreskin")));
+        };
+        if f < min {
+            return Err(Problem::new(
+                StatusCode::LENGTH_REQUIRED,
+                "foreskin-insufficient",
+                format!(
+                    "The selected technique requires {min:.1} units of foreskin. {f:.2} units are available. The server has noted the shortfall."
+                ),
+            )
+            .with("required", min));
+        }
+        if f > max {
+            return Err(Problem::new(
+                StatusCode::PAYLOAD_TOO_LARGE,
+                "foreskin-excessive",
+                format!(
+                    "The selected technique tolerates at most {max:.1} units of foreskin. {f:.2} units are present."
+                ),
+            )
+            .with("maximum", max));
+        }
+        Ok(())
+    }
+
+    fn check_storage(&self) -> Result<(), Problem> {
+        if self.items.extender && self.girth > STORAGE_GIRTH {
+            return Err(Problem::new(
+                StatusCode::INSUFFICIENT_STORAGE,
+                "jeans-full",
+                "The jeans are full. The extender is occupying the remaining storage.",
+            )
+            .with("extender", self.path("/inventory/extender")));
+        }
+        Ok(())
+    }
+
+    pub(super) fn commit(&mut self, intensity: i32, lube: Option<Lube>, now: Instant, cost: i32) {
+        self.touch();
+        self.turn += 1;
+        self.here.turns += 1;
+        self.realize();
+        if self.items.extender {
+            self.length += EXTENDER_GAIN;
+        }
+        self.stamina -= cost + i32::from(lube == Some(Lube::Lotion));
+        if self.stamina <= 0 {
+            self.exhaust(now);
+        }
+        let chill = if self.floor == Floor::LockerRoom {
+            LOCKER_CHILL
+        } else {
+            0
+        };
+        let wobble = self.rng.random_range(-EQ_WOBBLE..=EQ_WOBBLE);
+        self.eq = (self.eq + intensity * 2 - 6 - chill + wobble).clamp(0, 100);
+
+        let mut suspicion = intensity / 5 + i32::from(lube == Some(Lube::Vaseline));
+        if matches!(self.floor, Floor::LockerRoom | Floor::Grandmas) {
+            suspicion *= 2;
+        }
+        if self.floor == Floor::Grandmas && lube == Some(Lube::CoconutOil) {
+            suspicion += 2;
+        }
+        let was_below = self.suspicion < SUSPICION_LIMIT;
+        self.suspicion =
+            u8::try_from((i32::from(self.suspicion) + suspicion).min(i32::from(SUSPICION_LIMIT)))
+                .unwrap_or(SUSPICION_LIMIT);
+        self.maybe_summon_mom(was_below);
+
+        if let Some(observer) = self.floor.observer()
+            && self.chance(OBSERVED)
+        {
+            self.observed = Some(observer);
+            self.shame += 1;
+            if observer == Observer::Cat && self.chance(CAT_TAKES_TOWEL) {
+                self.here.towel_stolen = true;
+            }
+        }
+        if intensity >= PULLED_MUSCLE_INTENSITY
+            && !self.conditions.pulled_muscle
+            && self.chance(PULLED_MUSCLE)
+        {
+            self.conditions.pulled_muscle = true;
+            self.stamina = self.stamina.min(self.max_stamina());
+        }
+        if self.items.ring && self.eq > HOT_EQ && self.chance(RING_PRIAPISM) {
+            self.conditions.priapism_turns = PRIAPISM_TURNS;
+        }
+        if self.conditions.priapism_turns > 0 {
+            self.conditions.priapism_turns -= 1;
+            self.eq = self.eq.max(PRIAPISM_EQ);
+        }
+        if self.turn == BRANCH_TURN && self.story == Story::Unopened {
+            self.story = Story::Pending;
+        }
+    }
+
+    fn maybe_summon_mom(&mut self, was_below: bool) {
+        if !self.floor.has_mom() || self.mom.is_some() {
+            return;
+        }
+        let summoned = was_below && self.suspicion == SUSPICION_LIMIT;
+        let visits = u32::from(self.suspicion) + 1;
+        if summoned || self.rng.random_ratio(visits, super::balance::MOM_VISIT) {
+            let errand = self.errand(summoned);
+            let nonce = self.fresh_nonce();
+            self.mom = Some(MomVisit {
+                errand,
+                nonce,
+                strikes: 0,
+            });
+        }
+    }
+
+    fn roll(
+        &mut self,
+        training: Training,
+        intensity: i32,
+        lube: Option<Lube>,
+    ) -> Result<Outcome, Problem> {
+        let profile = training.profile();
+        let natural: i32 = self.rng.random_range(1..=20);
+        let band = if EQ_BAND.contains(&self.eq) {
+            BAND_BONUS
+        } else {
+            0
+        };
+        let grip = match (self.grip, training) {
+            (Grip::Underhand, Training::Stretch) => 2,
+            (Grip::Underhand, Training::Wet) => -1,
+            _ => 0,
+        };
+        let modifier = lube.map_or(0, Lube::modifier) + band + grip;
+        let dc = profile.dc + intensity / 3;
+        let total = natural + modifier;
+        let timing = format!("roll;desc=\"d20{modifier:+} vs {dc}\";dur={natural}");
+        let timed = |p: Problem| p.header(SERVER_TIMING, &timing);
+
+        let (length, girth) = self.scaled_gains(&profile, intensity);
+        let rupture_line = if self.items.ring {
+            RING_RUPTURE_LINE
+        } else {
+            RUPTURE_LINE
+        };
+
+        if natural == 1 {
+            return Err(timed(self.critical_failure(training, &profile)));
+        }
+        if natural == 2 && self.eq > DANGER_EQ {
+            return Err(timed(self.rupture()));
+        }
+        if self.eq > rupture_line && total < dc {
+            return Err(timed(self.rupture()));
+        }
+        if natural == 20 {
+            self.gain(length * 2.0, girth * 2.0, profile.foreskin_growth);
+            return Ok(Outcome::json(
+                StatusCode::PERMANENT_REDIRECT,
+                json!({
+                    "detail": "Your length has moved permanently.",
+                    "length": round3(length * 2.0),
+                    "girth": round3(girth * 2.0),
+                }),
+            )
+            .header(header::LOCATION, self.path("/length"))
+            .header(SERVER_TIMING, timing));
+        }
+        if total < dc - 3 {
+            return Err(timed(not_extended()));
+        }
+        if total < dc {
+            return Ok(Outcome::empty(StatusCode::NO_CONTENT).header(SERVER_TIMING, timing));
+        }
+
+        let outcome = if self.eq < *EQ_BAND.start() {
+            self.gain(length / 2.0, girth / 2.0, profile.foreskin_growth);
+            Outcome::json(
+                StatusCode::PARTIAL_CONTENT,
+                json!({
+                    "detail": "Partial gains were applied. EQ was below the band.",
+                    "length": round3(length / 2.0),
+                    "girth": round3(girth / 2.0),
+                }),
+            )
+        } else if total >= dc + 5 {
+            self.gain(length, girth, profile.foreskin_growth);
+            Outcome::json(
+                StatusCode::OK,
+                json!({
+                    "detail": "Gains were applied.",
+                    "length": round3(length),
+                    "girth": round3(girth),
+                }),
+            )
+        } else {
+            let eta = self.rng.random_range(1..=4);
+            self.pending.push(Pending {
+                due: self.turn + eta,
+                length,
+                girth,
+            });
+            self.gain(0.0, 0.0, profile.foreskin_growth);
+            Outcome::json(
+                StatusCode::ACCEPTED,
+                json!({
+                    "detail": "Gains have been queued. They may arrive.",
+                    "eta_turns": eta,
+                }),
+            )
+        };
+        Ok(outcome.header(SERVER_TIMING, timing))
+    }
+
+    fn scaled_gains(&self, profile: &Profile, intensity: i32) -> (f64, f64) {
+        let scale = f64::from(intensity);
+        let (mut length, mut girth) = (profile.length * scale, profile.girth * scale);
+        if self.here.teapot {
+            length *= 0.5;
+            girth *= 1.5;
+        }
+        if self.items.ring {
+            girth *= 2.0;
+        }
+        (length, girth)
+    }
+
+    fn critical_failure(&mut self, training: Training, profile: &Profile) -> Problem {
+        let uses_foreskin = profile.foreskin.is_some_and(|(min, _)| min > 0.0);
+        if uses_foreskin && self.foreskin.is_some() {
+            self.foreskin = None;
+            self.shame += 25;
+            return Problem::new(
+                StatusCode::GONE,
+                "foreskin-lost",
+                "The technique has removed the foreskin. It will not be returning.",
+            )
+            .header(header::CONTENT_LOCATION, self.path("/foreskin"));
+        }
+        if self.eq > DANGER_EQ {
+            return self.rupture();
+        }
+        if training == Training::Stretch && !self.here.teapot {
+            self.here.teapot = true;
+            self.items.teapot_spout = true;
+            self.shame += 5;
+            return Problem::new(
+                StatusCode::IM_A_TEAPOT,
+                "teapot",
+                "The subject is now short and stout. Length gains are halved for the rest of the floor.",
+            );
+        }
+        if training == Training::Uli && !self.conditions.peyronie {
+            self.conditions.peyronie = true;
+            self.shame += 5;
+            return Problem::new(
+                StatusCode::MISDIRECTED_REQUEST,
+                "curvature",
+                "A curvature has developed. Techniques will land slightly to the left until a professional is consulted.",
+            );
+        }
+        not_extended()
+    }
+
+    fn gossip(&mut self, mut outcome: Outcome) -> Outcome {
+        let reportable = matches!(outcome.status.as_u16(), 200 | 202 | 206);
+        if !self.here.roommate_told || !reportable {
+            return outcome;
+        }
+        self.here.roommate_told = false;
+        outcome.status = StatusCode::ALREADY_REPORTED;
+        if let Payload::Json(body) = &mut outcome.payload {
+            body["detail"] = json!("The roommate has already told everyone.");
+        }
+        outcome
+    }
+}

Added file: src/game/utility.rs+133 additions@@ -0,0 +1,133 @@
+use std::{
+    ops::ControlFlow,
+    time::{Duration, Instant, SystemTime},
+};
+
+use axum::http::{StatusCode, header};
+use serde_json::json;
+
+use super::{
+    Floor, Outcome, Run,
+    balance::{
+        EDGE_EQ, EDGE_GIRTH, EDGE_LOOP, HOTEL_STRESS, ICE_EQ, PRIAPISM_EQ, PRIAPISM_TURNS,
+        PUMP_GAIN, SHOWER_EQ, SUPPLEMENT_WORKS, TOWELLESS_EQ, WARMUP_EQ,
+    },
+};
+use crate::problem::Problem;
+
+const WEEK: Duration = Duration::from_secs(7 * 24 * 60 * 60);
+
+impl Run {
+    pub(super) fn warm_up(&mut self) -> Result<Outcome, Problem> {
+        if self.floor == Floor::Hotel && self.chance(HOTEL_STRESS) {
+            return Err(Problem::new(
+                StatusCode::SERVICE_UNAVAILABLE,
+                "service-unavailable",
+                "Service is unavailable. The server estimates next week. The server is being pessimistic.",
+            )
+            .header(
+                header::RETRY_AFTER,
+                httpdate::fmt_http_date(SystemTime::now() + WEEK),
+            ));
+        }
+        let (boost, detail) = if self.floor == Floor::Bathroom {
+            (
+                SHOWER_EQ,
+                "Warmed up. The shower is hot. The roommate's will not be.",
+            )
+        } else if self.here.towel_stolen {
+            (TOWELLESS_EQ, "Warmed up, poorly. The cat has the towel.")
+        } else {
+            (WARMUP_EQ, "Warmed up. The towel has cooled.")
+        };
+        self.touch();
+        self.warmed_up = true;
+        self.eq = (self.eq + boost).min(100);
+        Ok(Outcome::json(StatusCode::OK, json!({ "detail": detail })))
+    }
+
+    pub(super) fn ice(&mut self) -> Result<Outcome, Problem> {
+        if self.items.ice_packs == 0 {
+            return Err(Problem::new(
+                StatusCode::FAILED_DEPENDENCY,
+                "no-ice",
+                "The ice technique depends on an ice pack. There are none.",
+            ));
+        }
+        self.touch();
+        self.items.ice_packs -= 1;
+        if self.conditions.priapism_turns > 0 {
+            return Ok(Outcome::json(
+                StatusCode::OK,
+                json!({ "detail": "The ice has no effect. The condition persists. The ice pack is gone." }),
+            ));
+        }
+        self.eq = (self.eq - ICE_EQ).max(0);
+        Ok(Outcome::json(
+            StatusCode::OK,
+            json!({ "detail": "EQ has been reduced. The ice pack is gone." }),
+        ))
+    }
+
+    pub(super) fn supplement(&mut self) -> Result<Outcome, Problem> {
+        if self.items.supplements == 0 {
+            return Err(Problem::new(
+                StatusCode::FAILED_DEPENDENCY,
+                "no-supplement",
+                "The supplement technique depends on a supplement.",
+            ));
+        }
+        self.items.supplements -= 1;
+        self.touch();
+        if self.chance(SUPPLEMENT_WORKS) {
+            self.conditions.priapism_turns = PRIAPISM_TURNS;
+            self.eq = self.eq.max(PRIAPISM_EQ);
+            return Ok(Outcome::json(
+                StatusCode::OK,
+                json!({ "detail": "The upstream returned a valid response. It is still returning it." }),
+            ));
+        }
+        Err(Problem::new(
+            StatusCode::BAD_GATEWAY,
+            "bad-gateway",
+            "The upstream returned an invalid response.",
+        )
+        .with("upstream", "Pump-Bro"))
+    }
+
+    pub(super) fn edge(&mut self, now: Instant) -> Result<Outcome, Problem> {
+        self.commit(5, None, now, 1);
+        self.here.edges += 1;
+        self.eq = (self.eq + EDGE_EQ).min(100);
+        self.girth += EDGE_GIRTH;
+        if self.here.edges >= EDGE_LOOP {
+            self.here.edges = 0;
+            self.exhaust(now);
+            return Err(Problem::new(
+                StatusCode::LOOP_DETECTED,
+                "edging-loop",
+                "Edging has looped. The server detected an infinite loop and terminated it.",
+            ));
+        }
+        if let ControlFlow::Break(interrupted) = self.hazards(5)? {
+            return Ok(interrupted);
+        }
+        Ok(Outcome::json(
+            StatusCode::OK,
+            json!({ "detail": "Edged. EQ is rising. Nothing else is.", "edges": self.here.edges }),
+        ))
+    }
+
+    pub(super) fn pump(&mut self, now: Instant) -> Result<Outcome, Problem> {
+        self.commit(4, None, now, 1);
+        if let ControlFlow::Break(interrupted) = self.hazards(4)? {
+            return Ok(interrupted);
+        }
+        self.here.temp_length += PUMP_GAIN;
+        Ok(Outcome::json(
+            StatusCode::TEMPORARY_REDIRECT,
+            json!({ "detail": "Gains applied. They are temporary.", "length": PUMP_GAIN }),
+        )
+        .header(header::LOCATION, self.path("/length")))
+    }
+}

Added file: src/headers.rs+18 additions@@ -0,0 +1,18 @@
+use axum::http::HeaderName;
+
+pub const ACCEPT_PATCH: HeaderName = HeaderName::from_static("accept-patch");
+pub const SERVER_TIMING: HeaderName = HeaderName::from_static("server-timing");
+pub const X_CASH: HeaderName = HeaderName::from_static("x-cash");
+pub const X_DIAGNOSIS: HeaderName = HeaderName::from_static("x-diagnosis");
+pub const X_EQ: HeaderName = HeaderName::from_static("x-eq");
+pub const X_FLOOR: HeaderName = HeaderName::from_static("x-floor");
+pub const X_FORESKIN: HeaderName = HeaderName::from_static("x-foreskin");
+pub const X_FORUM_NOTE: HeaderName = HeaderName::from_static("x-forum-note");
+pub const X_GIRTH: HeaderName = HeaderName::from_static("x-girth");
+pub const X_OBSERVED_BY: HeaderName = HeaderName::from_static("x-observed-by");
+pub const X_POWERED_BY: HeaderName = HeaderName::from_static("x-powered-by");
+pub const X_SEED: HeaderName = HeaderName::from_static("x-seed");
+pub const X_SELF_REPORTED_LENGTH: HeaderName = HeaderName::from_static("x-self-reported-length");
+pub const X_SHAME: HeaderName = HeaderName::from_static("x-shame");
+pub const X_STAMINA: HeaderName = HeaderName::from_static("x-stamina");
+pub const X_SUSPICION: HeaderName = HeaderName::from_static("x-suspicion");

Deleted file: src/http.rs−1278 deletions@@ -1,1278 +0,0 @@
-use std::{
-    collections::HashMap,
-    convert::Infallible,
-    fmt::Write as _,
-    io::{Read as _, Write as _},
-    sync::{Arc, Mutex},
-    time::Instant,
-};
-
-use axum::{
-    Json, Router,
-    body::{Body, Bytes},
-    extract::{Path, Query, Request, State},
-    http::{HeaderMap, HeaderName, HeaderValue, Method, StatusCode, Uri, Version, header},
-    middleware::{self, Next},
-    response::{Html, IntoResponse, Redirect, Response},
-    routing::any,
-};
-use flate2::{Compression, read::GzDecoder, write::GzEncoder};
-use hyper_util::rt::TokioIo;
-use rand::Rng;
-use serde::Deserialize;
-use serde_json::{Value, json};
-use tokio::io::AsyncWriteExt;
-use tower::ServiceExt;
-
-use crate::{
-    game::{
-        ELDER_LAST_MODIFIED, FORUM_THREAD, Floor, Grip, LUBRICANTS, Lube, MM_PER_INCH, PatchOp,
-        RUN_ALLOW, Run, SUSPICION_LIMIT, Technique, forum_thread, shaft,
-    },
-    problem::{PROBLEM_BASE, Problem, reason},
-    secret,
-};
-
-const REL_BASE: &str = "https://jelq.dev/rels/";
-const COOKIE_ATTRIBUTES: &str = "Max-Age=31536000; Path=/; HttpOnly; SameSite=Strict";
-const THERAPY: &str = "Your options are listed in the Allow header. There are more of them than you think. You could also try being honest. It is not in the Allow header because it is not a method.";
-const MAX_URI: usize = 512;
-const MAX_HEADER: usize = 1024;
-
-#[derive(Default)]
-pub struct AppState {
-    runs: Mutex<HashMap<String, Run>>,
-}
-
-impl AppState {
-    pub fn insert(&self, run: Run) {
-        self.runs.lock().unwrap().insert(run.id.clone(), run);
-    }
-}
-
-type Shared = Arc<AppState>;
-
-#[derive(Clone)]
-struct Compress;
-
-/// Which household hazards stand between the request and the run.
-#[derive(Clone, Copy, PartialEq, Eq)]
-enum Scope {
-    Home,
-    Pockets,
-}
-
-pub fn app() -> Router {
-    router(Arc::default())
-}
-
-pub fn router(state: Shared) -> Router {
-    let api = api(state);
-    let ui = Router::new()
-        .route("/ui", any(|| async { Redirect::permanent("/ui/") }))
-        .route("/ui/", any(ui))
-        .route("/ui/send", any(ui_send))
-        .with_state(api.clone());
-    api.merge(ui)
-}
-
-fn api(state: Shared) -> Router {
-    Router::new()
-        .route("/", any(index))
-        .route("/runs", any(runs))
-        .route("/runs/{id}", any(run))
-        .route("/runs/{id}/length", any(length))
-        .route("/runs/{id}/foreskin", any(foreskin))
-        .route("/runs/{id}/inventory", any(inventory))
-        .route("/runs/{id}/inventory/{item}", any(item))
-        .route("/runs/{id}/techniques", any(techniques))
-        .route("/runs/{id}/drawer", any(drawer))
-        .route("/runs/{id}/branches/{choice}", any(branch))
-        .route("/runs/{id}/floor", any(floor))
-        .route("/runs/{id}/shop", any(shop))
-        .route("/runs/{id}/shop/{item}", any(buy))
-        .route("/runs/{id}/portal", any(portal))
-        .route("/runs/{id}/elder", any(elder))
-        .route("/runs/{id}/grip", any(grip))
-        .route("/runs/{id}/diagnosis", any(diagnosis))
-        .route("/runs/{id}/footage", any(footage))
-        .route("/forum/threads/{year}", any(thread))
-        .route("/graveyard", any(graveyard))
-        .route("/leaderboard", any(leaderboard))
-        .fallback(not_found)
-        .layer(middleware::from_fn(chrome))
-        .with_state(state)
-}
-
-fn reject(request: &Request) -> Option<Problem> {
-    if request.version() < Version::HTTP_11 {
-        return Some(Problem::new(
-            StatusCode::HTTP_VERSION_NOT_SUPPORTED,
-            "pdf",
-            "HTTP/1.0 is the version the original jelqing PDF was written for. The server has read it.",
-        ));
-    }
-    if request.uri().to_string().len() > MAX_URI {
-        return Some(Problem::new(
-            StatusCode::URI_TOO_LONG,
-            "uri-too-long",
-            "The URI is longer than anything else here.",
-        ));
-    }
-    if request.headers().values().any(|v| v.len() > MAX_HEADER) {
-        return Some(Problem::new(
-            StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE,
-            "head-too-large",
-            "Head too large.",
-        ));
-    }
-    let expectation = request.headers().get(header::EXPECT)?;
-    if expectation.as_bytes().eq_ignore_ascii_case(b"100-continue") {
-        return None;
-    }
-    Some(Problem::new(
-        StatusCode::EXPECTATION_FAILED,
-        "expectations",
-        format!(
-            "Expect: {} cannot be met.",
-            expectation.to_str().unwrap_or("that")
-        ),
-    ))
-}
-
-async fn compress(response: Response) -> Response {
-    let (mut parts, body) = response.into_parts();
-    let Ok(bytes) = axum::body::to_bytes(body, usize::MAX).await else {
-        return Response::from_parts(parts, Body::empty());
-    };
-    let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
-    if encoder.write_all(&bytes).is_err() {
-        return Response::from_parts(parts, Body::from(bytes));
-    }
-    let Ok(gzipped) = encoder.finish() else {
-        return Response::from_parts(parts, Body::from(bytes));
-    };
-    parts
-        .headers
-        .insert(header::CONTENT_ENCODING, HeaderValue::from_static("gzip"));
-    parts.headers.remove(header::CONTENT_LENGTH);
-    parts
-        .headers
-        .append(header::VARY, HeaderValue::from_static("Accept-Encoding"));
-    Response::from_parts(parts, Body::from(gzipped))
-}
-
-async fn chrome(request: Request, next: Next) -> Response {
-    let gzip = header_str(request.headers(), header::ACCEPT_ENCODING)
-        .is_some_and(|e| e.to_ascii_lowercase().contains("gzip"));
-    let mut response = match reject(&request) {
-        Some(problem) => problem.into_response(),
-        None => next.run(request).await,
-    };
-    if gzip && response.extensions().get::<Compress>().is_some() {
-        response = compress(response).await;
-    }
-    let headers = response.headers_mut();
-    headers.insert(header::SERVER, HeaderValue::from_static("jelqd/0.6.9"));
-    headers.insert("x-powered-by", HeaderValue::from_static("blood"));
-    headers
-        .entry(header::CACHE_CONTROL)
-        .or_insert(HeaderValue::from_static("no-store, private"));
-    response
-}
-
-fn header_str(headers: &HeaderMap, name: HeaderName) -> Option<&str> {
-    headers.get(name).and_then(|v| v.to_str().ok())
-}
-
-fn cookie<'a>(headers: &'a HeaderMap, name: &str) -> Option<&'a str> {
-    headers
-        .get_all(header::COOKIE)
-        .iter()
-        .filter_map(|v| v.to_str().ok())
-        .flat_map(|v| v.split(';'))
-        .filter_map(|pair| pair.trim().split_once('='))
-        .find(|(key, _)| *key == name)
-        .map(|(_, value)| value)
-}
-
-fn unsupported(method: &Method, allow: &'static str) -> Response {
-    if *method == Method::CONNECT {
-        return StatusCode::NOT_IMPLEMENTED.into_response();
-    }
-    let known = matches!(
-        method.as_str(),
-        "GET" | "HEAD" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS" | "TRACE" | "JELQ"
-    );
-    if method.as_str() == "BREW" {
-        return Problem::new(
-            StatusCode::IM_A_TEAPOT,
-            "brew",
-            "The server is a teapot. RFC 2324 is clear on this. It is not yet short and stout.",
-        )
-        .into_response();
-    }
-    if method.as_str().eq_ignore_ascii_case("jelq") {
-        return Problem::new(
-            StatusCode::NOT_IMPLEMENTED,
-            "not-implemented",
-            format!(
-                "The server does not implement {method}. Methods are case-sensitive. JELQ is shouted for a reason."
-            ),
-        )
-        .into_response();
-    }
-    if !known {
-        return Problem::new(
-            StatusCode::NOT_IMPLEMENTED,
-            "not-implemented",
-            format!("The server does not implement {method}."),
-        )
-        .into_response();
-    }
-    Problem::new(
-        StatusCode::METHOD_NOT_ALLOWED,
-        "method-not-allowed",
-        format!("{method} is not supported here."),
-    )
-    .header(header::ALLOW, allow)
-    .into_response()
-}
-
-fn options(allow: &'static str, patchable: bool) -> Response {
-    let mut response = (
-        StatusCode::OK,
-        [(header::ALLOW, allow)],
-        Json(json!({ "detail": THERAPY })),
-    )
-        .into_response();
-    if patchable {
-        response.headers_mut().insert(
-            "accept-patch",
-            HeaderValue::from_static("application/json-patch+json"),
-        );
-    }
-    response
-}
-
-fn trace(method: &Method, uri: &Uri, version: Version, headers: &HeaderMap) -> Response {
-    let mut message = format!("{method} {uri} {version:?}\r\n");
-    for (name, value) in headers {
-        let _ = write!(
-            message,
-            "{name}: {}\r\n",
-            value.to_str().unwrap_or("<binary>")
-        );
-    }
-    message.push_str("\r\n");
-    (
-        StatusCode::OK,
-        [(header::CONTENT_TYPE, "message/http")],
-        message,
-    )
-        .into_response()
-}
-
-fn links(run: &Run) -> String {
-    let id = &run.id;
-    let mut links = vec![format!("</runs/{id}>; rel=\"{REL_BASE}run\"")];
-    for rel in [
-        "floor",
-        "length",
-        "foreskin",
-        "inventory",
-        "techniques",
-        "drawer",
-        "grip",
-        "diagnosis",
-    ] {
-        links.push(format!("</runs/{id}/{rel}>; rel=\"{REL_BASE}{rel}\""));
-    }
-    if run.floor.shop_open() {
-        links.push(format!("</runs/{id}/shop>; rel=\"{REL_BASE}shop\""));
-    }
-    links.join(", ")
-}
-
-fn finish(run: &Run, mut response: Response) -> Response {
-    let status = response.status();
-    if status == StatusCode::NOT_MODIFIED {
-        return response;
-    }
-    let mut stats = vec![
-        (
-            "x-self-reported-length",
-            format!("{:.2}", run.self_reported()),
-        ),
-        ("x-girth", format!("{:.2}", run.girth)),
-        (
-            "x-foreskin",
-            run.foreskin.map_or("gone".into(), |f| format!("{f:.2}")),
-        ),
-        ("x-eq", run.eq.to_string()),
-        (
-            "x-stamina",
-            format!("{}/{}", run.stamina, run.max_stamina()),
-        ),
-        (
-            "x-suspicion",
-            format!("{}/{SUSPICION_LIMIT}", run.suspicion),
-        ),
-        ("x-shame", run.total_shame().to_string()),
-        ("x-cash", run.cash.to_string()),
-        ("x-floor", run.floor.number().to_string()),
-        ("link", links(run)),
-    ];
-    if let Some(observer) = run.observed {
-        stats.push(("x-observed-by", observer.into()));
-    }
-    if run.mom_present {
-        stats.push(("via", "1.1 mom".into()));
-        stats.push(("vary", "Mom".into()));
-    }
-    // RFC 9111 obsoleted Warning, which is why nobody heeds it.
-    if run.pulled_muscle {
-        stats.push(("warning", "199 - \"a muscle has been pulled\"".into()));
-    }
-    if run.eq > 70 && run.ended.is_none() {
-        stats.push(("warning", "199 - \"it is turning purple\"".into()));
-    }
-    stats.push((
-        "set-cookie",
-        format!(
-            "shame={}; {COOKIE_ATTRIBUTES}",
-            secret::sign("shame", &run.total_shame().to_string())
-        ),
-    ));
-    if run.items.ruler {
-        stats.push((
-            "set-cookie",
-            format!("ruler={}; {COOKIE_ATTRIBUTES}", secret::sign("ruler", "1")),
-        ));
-    }
-    let headers = response.headers_mut();
-    for (name, value) in stats {
-        headers.append(name, HeaderValue::from_str(&value).expect("visible ascii"));
-    }
-    let bodiless = status.is_informational() || status == StatusCode::NO_CONTENT;
-    if run.items.ring && !bodiless {
-        response.extensions_mut().insert(Compress);
-    }
-    response
-}
-
-fn gone(run: &Run) -> Response {
-    let ending = run.ended.as_ref().expect("only called on ended runs");
-    Problem::new(StatusCode::GONE, "run-ended", "This run has ended.")
-        .with("cause", format!("{PROBLEM_BASE}{}", ending.cause))
-        .with("turn", ending.turn)
-        .with("graveyard", "/graveyard")
-        .into_response()
-}
-
-fn captive_portal(run: &Run) -> Response {
-    Problem::new(
-        StatusCode::NETWORK_AUTHENTICATION_REQUIRED,
-        "captive-portal",
-        "The network requires authentication. The hotel would like you to agree to some terms.",
-    )
-    .with("portal", format!("/runs/{}/portal", run.id))
-    .header(
-        header::LINK,
-        format!("</runs/{}/portal>; rel=\"{REL_BASE}portal\"", run.id),
-    )
-    .into_response()
-}
-
-fn with_run(
-    state: &AppState,
-    id: &str,
-    headers: &HeaderMap,
-    scope: Scope,
-    handle: impl FnOnce(&mut Run) -> Response,
-) -> Response {
-    let mut runs = state.runs.lock().unwrap();
-    let Some(run) = runs.get_mut(id) else {
-        return Problem::new(
-            StatusCode::NOT_FOUND,
-            "no-such-run",
-            format!("There is no run {id}. There may never have been."),
-        )
-        .into_response();
-    };
-    if run.ended.is_some() {
-        return gone(run);
-    }
-    run.observed = None;
-    if scope == Scope::Home {
-        if run.floor == Floor::Hotel && !run.wifi_accepted {
-            return finish(run, captive_portal(run));
-        }
-        if run.floor.has_mom()
-            && run.mom_present
-            && let Err(problem) = run.answer_door(header_str(headers, header::AUTHORIZATION))
-        {
-            return finish(run, problem.into_response());
-        }
-    }
-    let response = handle(run);
-    finish(run, response)
-}
-
-fn respond<T: IntoResponse, E: IntoResponse>(result: Result<T, E>) -> Response {
-    match result {
-        Ok(ok) => ok.into_response(),
-        Err(err) => err.into_response(),
-    }
-}
-
-async fn runs(
-    State(state): State<Shared>,
-    method: Method,
-    Query(query): Query<HashMap<String, String>>,
-    headers: HeaderMap,
-) -> Response {
-    if method != Method::POST {
-        return unsupported(&method, "POST");
-    }
-    let seeded = query.contains_key("seed");
-    let seed = match query.get("seed").map(|s| s.parse::<u64>()) {
-        None => rand::rng().random(),
-        Some(Ok(seed)) => seed,
-        Some(Err(_)) => {
-            return Problem::new(
-                StatusCode::BAD_REQUEST,
-                "bad-seed",
-                "The seed must be an unsigned 64-bit integer.",
-            )
-            .into_response();
-        }
-    };
-    let shame = cookie(&headers, "shame")
-        .and_then(|s| secret::verify("shame", s))
-        .and_then(|s| s.parse().ok())
-        .unwrap_or(0);
-    let id = format!("{:08x}", rand::rng().random::<u32>());
-    let mut run = Run::new(id.clone(), secret::mix_seed(seed), shame);
-    run.seeded = seeded;
-    let response = (
-        StatusCode::CREATED,
-        [
-            (header::LOCATION, format!("/runs/{id}")),
-            (header::ETAG, run.etag()),
-            (HeaderName::from_static("x-seed"), seed.to_string()),
-        ],
-        Json(run.view()),
-    )
-        .into_response();
-    let response = finish(&run, response);
-    state.insert(run);
-    response
-}
-
-#[allow(clippy::too_many_arguments)]
-async fn run(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    uri: Uri,
-    version: Version,
-    Query(query): Query<HashMap<String, String>>,
-    headers: HeaderMap,
-    body: Bytes,
-) -> Response {
-    let now = Instant::now();
-    with_run(&state, &id, &headers, Scope::Home, |run| {
-        match method.as_str() {
-            "GET" | "HEAD" => {
-                let accept = header_str(&headers, header::ACCEPT).unwrap_or_default();
-                if accept.contains("reassurance") {
-                    return Problem::new(
-                        StatusCode::NOT_ACCEPTABLE,
-                        "no-reassurance",
-                        "The server does not produce reassurance.",
-                    )
-                    .into_response();
-                }
-                (
-                    StatusCode::OK,
-                    [(header::ETAG, run.etag())],
-                    Json(run.view()),
-                )
-                    .into_response()
-            }
-            "JELQ" => jelq(run, &query, &headers, now),
-            "PUT" => run.put().into_response(),
-            "PATCH" => patch(run, &headers, &body),
-            "DELETE" => {
-                run.end("abandoned", "The run was abandoned.");
-                StatusCode::NO_CONTENT.into_response()
-            }
-            "OPTIONS" => options(RUN_ALLOW, true),
-            "TRACE" => {
-                run.shame += 1;
-                trace(&method, &uri, version, &headers)
-            }
-            _ => unsupported(&method, RUN_ALLOW),
-        }
-    })
-}
-
-fn jelq(
-    run: &mut Run,
-    query: &HashMap<String, String>,
-    headers: &HeaderMap,
-    now: Instant,
-) -> Response {
-    let techniques_href = format!("/runs/{}/techniques", run.id);
-    let Some(names) = query.get("technique").filter(|n| !n.trim().is_empty()) else {
-        return Problem::new(
-            StatusCode::BAD_REQUEST,
-            "technique-required",
-            "No technique was specified.",
-        )
-        .with("techniques", techniques_href)
-        .into_response();
-    };
-    let mut techniques = Vec::new();
-    for name in names.split(',').map(str::trim).filter(|n| !n.is_empty()) {
-        let Some(technique) = Technique::parse(name) else {
-            return Problem::new(
-                StatusCode::BAD_REQUEST,
-                "unknown-technique",
-                format!("{name} is not a technique."),
-            )
-            .with("techniques", techniques_href)
-            .into_response();
-        };
-        techniques.push(technique);
-    }
-    let intensity = match query.get("intensity").map(|i| i.parse::<i32>()) {
-        None => 5,
-        Some(Ok(i)) if (1..=10).contains(&i) => i,
-        Some(_) => {
-            return Problem::new(
-                StatusCode::BAD_REQUEST,
-                "intensity-out-of-range",
-                "Intensity is measured from 1 to 10.",
-            )
-            .into_response();
-        }
-    };
-    let lube = match Lube::from_content_type(header_str(headers, header::CONTENT_TYPE)) {
-        Ok(lube) => lube,
-        Err(problem) => return problem.into_response(),
-    };
-    respond(run.jelq(&techniques, intensity, lube, now))
-}
-
-fn patch(run: &mut Run, headers: &HeaderMap, body: &[u8]) -> Response {
-    let content_type = header_str(headers, header::CONTENT_TYPE).unwrap_or_default();
-    if !content_type.starts_with("application/json-patch+json") {
-        return Problem::new(
-            StatusCode::UNSUPPORTED_MEDIA_TYPE,
-            "patch-format",
-            "Patches are accepted as application/json-patch+json.",
-        )
-        .header(
-            HeaderName::from_static("accept-patch"),
-            "application/json-patch+json",
-        )
-        .into_response();
-    }
-    match serde_json::from_slice::<Vec<PatchOp>>(body) {
-        Ok(ops) => respond(run.patch(&ops)),
-        Err(_) => Problem::new(
-            StatusCode::BAD_REQUEST,
-            "malformed-patch",
-            "The patch could not be parsed.",
-        )
-        .into_response(),
-    }
-}
-
-fn millimetres(inches: f64) -> usize {
-    (inches * MM_PER_INCH).round() as usize
-}
-
-fn parse_inch_range(range: &str, total: f64) -> Option<(f64, f64)> {
-    let (start, end) = range.strip_prefix("inches=")?.split_once('-')?;
-    let start: f64 = start.trim().parse().ok()?;
-    let end: f64 = match end.trim() {
-        "" => total,
-        end => end.parse().ok()?,
-    };
-    (start >= 0.0 && start < total && start <= end).then_some((start, end.min(total)))
-}
-
-fn length_response(run: &Run, headers: &HeaderMap) -> Response {
-    let inches = if run.items.ruler {
-        run.current_length()
-    } else {
-        run.self_reported()
-    };
-    let body = shaft(millimetres(inches));
-    let content_type = (
-        header::CONTENT_TYPE,
-        "text/plain; charset=us-ascii".to_owned(),
-    );
-    let accept_ranges = (header::ACCEPT_RANGES, "inches".to_owned());
-
-    if let Some(range) = header_str(headers, header::RANGE)
-        && range.starts_with("inches=")
-    {
-        let Some((start, end)) = parse_inch_range(range, inches) else {
-            return Problem::new(
-                StatusCode::RANGE_NOT_SATISFIABLE,
-                "range-not-satisfiable",
-                format!("The requested range is not available. {inches:.2} inches are."),
-            )
-            .header(header::CONTENT_RANGE, format!("inches */{inches:.2}"))
-            .into_response();
-        };
-        let from = millimetres(start).min(body.len() - 1);
-        let to = millimetres(end).clamp(from + 1, body.len());
-        let content_range = (
-            header::CONTENT_RANGE,
-            format!("inches {start:.2}-{end:.2}/{inches:.2}"),
-        );
-        return (
-            StatusCode::PARTIAL_CONTENT,
-            [content_type, accept_ranges, content_range],
-            body[from..to].to_owned(),
-        )
-            .into_response();
-    }
-
-    if run.items.ruler {
-        return (StatusCode::OK, [content_type, accept_ranges], body).into_response();
-    }
-    let chunks: Vec<Result<Bytes, Infallible>> = body
-        .into_bytes()
-        .chunks(16)
-        .map(|c| Ok(Bytes::copy_from_slice(c)))
-        .collect();
-    let body = Body::from_stream(futures_util::stream::iter(chunks));
-    (StatusCode::OK, [content_type, accept_ranges], body).into_response()
-}
-
-async fn length(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, OPTIONS";
-    with_run(&state, &id, &headers, Scope::Home, |run| {
-        match method.as_str() {
-            "GET" | "HEAD" => length_response(run, &headers),
-            "OPTIONS" => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    })
-}
-
-async fn foreskin(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, DELETE, OPTIONS";
-    with_run(&state, &id, &headers, Scope::Home, |run| {
-        match method.as_str() {
-            "GET" | "HEAD" => match run.foreskin {
-                Some(f) => (
-                    StatusCode::OK,
-                    [(header::ETAG, run.etag())],
-                    Json(json!({ "foreskin": (f * 100.0).round() / 100.0 })),
-                )
-                    .into_response(),
-                None => Problem::new(
-                    StatusCode::GONE,
-                    "foreskin-gone",
-                    "The foreskin is gone. It will not be returning.",
-                )
-                .into_response(),
-            },
-            "DELETE" => respond(run.delete_foreskin(header_str(&headers, header::IF_MATCH))),
-            "OPTIONS" => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    })
-}
-
-async fn inventory(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, OPTIONS";
-    with_run(&state, &id, &headers, Scope::Pockets, |run| {
-        match method.as_str() {
-            "GET" | "HEAD" => {
-                let listed: Vec<Value> = run
-                    .inventory()
-                    .into_iter()
-                    .map(|(name, _)| {
-                        json!({ "name": name, "href": format!("/runs/{}/inventory/{name}", run.id) })
-                    })
-                    .collect();
-                Json(json!({
-                    "items": listed,
-                    "ice_packs": run.items.ice_packs,
-                    "cash": run.cash,
-                    "excuses": run.excuses(),
-                }))
-                .into_response()
-            }
-            "OPTIONS" => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    })
-}
-
-async fn item(
-    State(state): State<Shared>,
-    Path((id, name)): Path<(String, String)>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, DELETE, OPTIONS";
-    with_run(&state, &id, &headers, Scope::Pockets, |run| {
-        let Some((name, description)) = run.inventory().into_iter().find(|(n, _)| *n == name)
-        else {
-            return Problem::new(
-                StatusCode::NOT_FOUND,
-                "no-such-item",
-                "You do not have that.",
-            )
-            .into_response();
-        };
-        match method.as_str() {
-            "GET" | "HEAD" => {
-                Json(json!({ "name": name, "description": description })).into_response()
-            }
-            "DELETE" => respond(run.drop_item(name)),
-            "OPTIONS" => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    })
-}
-
-async fn techniques(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, OPTIONS";
-    with_run(&state, &id, &headers, Scope::Home, |run| {
-        match method.as_str() {
-            "GET" | "HEAD" => {
-                let listed: Vec<Value> = Technique::ALL
-                    .into_iter()
-                    .map(|t| t.describe(run.forum_read))
-                    .collect();
-                Json(json!({
-                    "usage": format!("JELQ /runs/{}?technique=<name>[,<name>]&intensity=<1-10>", run.id),
-                    "lubricant": "Declared with Content-Type.",
-                    "lubricants": LUBRICANTS,
-                    "eq_band": [50, 70],
-                    "techniques": listed,
-                }))
-                .into_response()
-            }
-            "OPTIONS" => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    })
-}
-
-async fn drawer(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    with_run(&state, &id, &headers, Scope::Home, |run| {
-        match method.as_str() {
-            "POST" => respond(run.search_drawer()),
-            "OPTIONS" => options("POST, OPTIONS", false),
-            _ => unsupported(&method, "POST, OPTIONS"),
-        }
-    })
-}
-
-async fn branch(
-    State(state): State<Shared>,
-    Path((id, choice)): Path<(String, String)>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    with_run(&state, &id, &headers, Scope::Home, |run| {
-        match method.as_str() {
-            "POST" => respond(run.choose(&choice)),
-            "OPTIONS" => options("POST, OPTIONS", false),
-            _ => unsupported(&method, "POST, OPTIONS"),
-        }
-    })
-}
-
-async fn floor(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, POST, OPTIONS";
-    with_run(&state, &id, &headers, Scope::Pockets, |run| {
-        match method.as_str() {
-            "GET" | "HEAD" => Json(run.floor_view()).into_response(),
-            "POST" => respond(run.advance()),
-            "OPTIONS" => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    })
-}
-
-async fn shop(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, OPTIONS";
-    with_run(&state, &id, &headers, Scope::Home, |run| {
-        match method.as_str() {
-            "GET" | "HEAD" => respond(run.shop_view().map(Json)),
-            "OPTIONS" => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    })
-}
-
-async fn buy(
-    State(state): State<Shared>,
-    Path((id, item)): Path<(String, String)>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    with_run(&state, &id, &headers, Scope::Home, |run| {
-        match method.as_str() {
-            "POST" => respond(run.buy(&item)),
-            "OPTIONS" => options("POST, OPTIONS", false),
-            _ => unsupported(&method, "POST, OPTIONS"),
-        }
-    })
-}
-
-async fn portal(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, POST, OPTIONS";
-    with_run(&state, &id, &headers, Scope::Pockets, |run| {
-        match method.as_str() {
-            "GET" | "HEAD" => Json(json!({
-                "terms": "By connecting you agree that the hotel is not responsible for anything that happens in this room, and that it does not want to know.",
-                "accept": { "href": format!("/runs/{}/portal", run.id), "method": "POST" },
-            }))
-            .into_response(),
-            "POST" => respond(run.accept_terms()),
-            "OPTIONS" => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    })
-}
-
-async fn elder(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, OPTIONS";
-    with_run(&state, &id, &headers, Scope::Home, |run| {
-        match method.as_str() {
-            "GET" | "HEAD" => respond(run.elder(
-                header_str(&headers, header::PROXY_AUTHORIZATION),
-                header_str(&headers, header::IF_MODIFIED_SINCE),
-            )),
-            "OPTIONS" => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    })
-}
-
-fn requested_grip(headers: &HeaderMap) -> Option<Grip> {
-    let connection = header_str(headers, header::CONNECTION)?.to_ascii_lowercase();
-    if !connection.split(',').any(|token| token.trim() == "upgrade") {
-        return None;
-    }
-    header_str(headers, header::UPGRADE)?
-        .split(',')
-        .find_map(|protocol| Grip::parse(protocol.trim()))
-}
-
-async fn grip(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    mut request: Request,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, OPTIONS";
-    let method = request.method().clone();
-    let headers = request.headers().clone();
-    let wanted = requested_grip(&headers);
-    let upgrade = wanted.map(|_| hyper::upgrade::on(&mut request));
-    let detail = match header_str(&headers, header::UPGRADE) {
-        Some(protocol) if wanted.is_none() => {
-            format!("The server does not know the {protocol} grip. Grips are protocols.")
-        }
-        _ => "Grips are protocols. Change grip by upgrading the connection.".to_owned(),
-    };
-    let response = with_run(&state, &id, &headers, Scope::Home, |run| {
-        match (method.as_str(), wanted) {
-            ("GET" | "HEAD", Some(grip)) => {
-                run.set_grip(grip);
-                (
-                    StatusCode::SWITCHING_PROTOCOLS,
-                    [
-                        (header::UPGRADE, grip.name()),
-                        (header::CONNECTION, "upgrade"),
-                    ],
-                )
-                    .into_response()
-            }
-            ("GET" | "HEAD", None) => (
-                StatusCode::OK,
-                [(header::UPGRADE, "overhand, underhand")],
-                Json(json!({
-                    "grip": run.grip.name(),
-                    "detail": detail,
-                })),
-            )
-                .into_response(),
-            ("OPTIONS", _) => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    });
-    if response.status() == StatusCode::SWITCHING_PROTOCOLS
-        && let (Some(upgrade), Some(grip)) = (upgrade, wanted)
-    {
-        tokio::spawn(async move {
-            if let Ok(upgraded) = upgrade.await {
-                let mut io = TokioIo::new(upgraded);
-                let line = format!("You are now jelqing {}.\r\n", grip.name());
-                let _ = io.write_all(line.as_bytes()).await;
-                let _ = io.shutdown().await;
-            }
-        });
-    }
-    response
-}
-
-async fn diagnosis(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, OPTIONS";
-    with_run(&state, &id, &headers, Scope::Pockets, |run| {
-        match method.as_str() {
-            "GET" | "HEAD" => respond(run.diagnose(
-                header_str(&headers, header::AUTHORIZATION),
-                header_str(&headers, header::IF_NONE_MATCH),
-            )),
-            "OPTIONS" => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    })
-}
-
-async fn footage(
-    State(state): State<Shared>,
-    Path(id): Path<String>,
-    method: Method,
-    headers: HeaderMap,
-) -> Response {
-    const ALLOW: &str = "GET, HEAD, OPTIONS";
-    with_run(&state, &id, &headers, Scope::Pockets, |run| {
-        match method.as_str() {
-            "GET" | "HEAD" => {
-                let Some((filmed, age)) = run.footage() else {
-                    return Problem::new(
-                        StatusCode::NOT_FOUND,
-                        "no-footage",
-                        "There is no footage. Yet.",
-                    )
-                    .into_response();
-                };
-                (
-                    [
-                        (header::CACHE_CONTROL, "public, max-age=31536000, immutable".to_owned()),
-                        (header::AGE, age.to_string()),
-                        (header::LAST_MODIFIED, httpdate::fmt_http_date(filmed)),
-                    ],
-                    Json(json!({
-                        "detail": "A recording. It is grainy. It is unmistakably you. It has been shared.",
-                        "views": 1 + age * 37,
-                    })),
-                )
-                    .into_response()
-            }
-            "DELETE" => Problem::new(
-                StatusCode::METHOD_NOT_ALLOWED,
-                "the-internet",
-                "The footage has been cached by intermediaries. It cannot be deleted.",
-            )
-            .header(header::ALLOW, ALLOW)
-            .into_response(),
-            "OPTIONS" => options(ALLOW, false),
-            _ => unsupported(&method, ALLOW),
-        }
-    })
-}
-
-async fn thread(Path(year): Path<String>, method: Method) -> Response {
-    if method != Method::GET && method != Method::HEAD {
-        return unsupported(&method, "GET, HEAD");
-    }
-    match year.parse::<u32>() {
-        Ok(2009) => (
-            [(header::LAST_MODIFIED, ELDER_LAST_MODIFIED)],
-            Json(forum_thread()),
-        )
-            .into_response(),
-        Ok(y) if y > 2009 => Problem::new(
-            StatusCode::NOT_FOUND,
-            "no-thread",
-            "Nobody has posted since 2009.",
-        )
-        .with("thread", FORUM_THREAD)
-        .into_response(),
-        _ => Problem::new(
-            StatusCode::NOT_FOUND,
-            "no-thread",
-            "The forum did not exist yet. The problem did.",
-        )
-        .with("thread", FORUM_THREAD)
-        .into_response(),
-    }
-}
-
-async fn graveyard(State(state): State<Shared>, method: Method) -> Response {
-    if method != Method::GET && method != Method::HEAD {
-        return unsupported(&method, "GET, HEAD");
-    }
-    let runs = state.runs.lock().unwrap();
-    let dead: Vec<Value> = runs
-        .values()
-        .filter_map(|run| {
-            let ending = run.ended.as_ref()?;
-            Some(json!({
-                "id": run.id,
-                "cause": format!("{PROBLEM_BASE}{}", ending.cause),
-                "detail": ending.detail,
-                "turn": ending.turn,
-            }))
-        })
-        .collect();
-    Json(json!({ "runs": dead })).into_response()
-}
-
-async fn leaderboard(
-    State(state): State<Shared>,
-    method: Method,
-    Query(query): Query<HashMap<String, String>>,
-    headers: HeaderMap,
-) -> Response {
-    if method != Method::GET && method != Method::HEAD {
-        return unsupported(&method, "GET, HEAD");
-    }
-    let truthful = match query.get("sort").map(String::as_str) {
-        None | Some("self-reported-length") => false,
-        Some("content-length") => match cookie(&headers, "ruler") {
-            Some(ruler) if secret::verify("ruler", ruler) == Some("1") => true,
-            Some(_) => {
-                return Problem::new(
-                    StatusCode::BAD_REQUEST,
-                    "exaggeration",
-                    "The server has measured. Lying is not a technique.",
-                )
-                .with("cookie", "ruler")
-                .into_response();
-            }
-            None => {
-                return Problem::new(
-                    StatusCode::FORBIDDEN,
-                    "ruler-required",
-                    "Sorting by the truth requires a Ruler.",
-                )
-                .into_response();
-            }
-        },
-        Some(_) => {
-            return Problem::new(
-                StatusCode::BAD_REQUEST,
-                "unknown-sort",
-                "The leaderboard sorts by self-reported-length or content-length.",
-            )
-            .into_response();
-        }
-    };
-    let include_seeded = query.get("seeded").is_some_and(|s| s == "include");
-    let runs = state.runs.lock().unwrap();
-    let mut entries: Vec<&Run> = runs
-        .values()
-        .filter(|run| include_seeded || !run.seeded)
-        .collect();
-    let key = |r: &Run| {
-        if truthful {
-            r.current_length()
-        } else {
-            r.self_reported()
-        }
-    };
-    entries.sort_by(|a, b| key(b).total_cmp(&key(a)));
-    let entries: Vec<Value> = entries
-        .into_iter()
-        .map(|run| {
-            let mut entry = json!({
-                "id": run.id,
-                "status": run.status(),
-                "floor": run.floor.number(),
-                "self_reported_length": (run.self_reported() * 100.0).round() / 100.0,
-                "ranked": !run.seeded,
-                "viral": run.filmed_at.is_some(),
-            });
-            if truthful {
-                entry["content_length"] = json!(millimetres(run.current_length()));
-            }
-            entry
-        })
-        .collect();
-    Json(json!({ "entries": entries })).into_response()
-}
-
-async fn index(method: Method, headers: HeaderMap) -> Response {
-    if method != Method::GET && method != Method::HEAD {
-        return unsupported(&method, "GET, HEAD");
-    }
-    let wants_html =
-        header_str(&headers, header::ACCEPT).is_some_and(|accept| accept.contains("text/html"));
-    if wants_html {
-        return (
-            StatusCode::SEE_OTHER,
-            [(header::LOCATION, "/ui/"), (header::VARY, "Accept")],
-        )
-            .into_response();
-    }
-    (
-        [(header::VARY, "Accept")],
-        Json(json!({
-            "detail": "This is jelqd. It is a roguelike. It is played over HTTP.",
-            "start": { "href": "/runs", "method": "POST" },
-            "leaderboard": "/leaderboard",
-            "graveyard": "/graveyard",
-            "forum": FORUM_THREAD,
-            "ui": "/ui/",
-        })),
-    )
-        .into_response()
-}
-
-async fn ui(method: Method) -> Response {
-    if method != Method::GET && method != Method::HEAD {
-        return unsupported(&method, "GET, HEAD");
-    }
-    Html(include_str!("ui.html")).into_response()
-}
-
-#[derive(Deserialize)]
-struct Envelope {
-    method: String,
-    path: String,
-    #[serde(default)]
-    headers: Vec<(String, String)>,
-    #[serde(default)]
-    body: String,
-}
-
-fn bad_envelope(detail: &str) -> Response {
-    Problem::new(StatusCode::BAD_REQUEST, "bad-envelope", detail).into_response()
-}
-
-// Browsers hide 3xx responses from fetch and refuse TRACE, Upgrade, and Expect, so the page
-// replays requests in-process to show the player exactly what the API said.
-async fn ui_send(State(api): State<Router>, headers: HeaderMap, body: Bytes) -> Response {
-    let Ok(envelope) = serde_json::from_slice::<Envelope>(&body) else {
-        return bad_envelope("The envelope could not be parsed.");
-    };
-    if !envelope.path.starts_with('/') || envelope.path.starts_with("/ui") {
-        return bad_envelope("The path must be an API path.");
-    }
-    let Ok(method) = Method::from_bytes(envelope.method.as_bytes()) else {
-        return bad_envelope("That is not a method.");
-    };
-    let mut request = Request::builder().method(method).uri(&envelope.path);
-    for (name, value) in envelope.headers.iter().filter(|(_, v)| !v.is_empty()) {
-        request = request.header(name, value);
-    }
-    for cookie in headers.get_all(header::COOKIE) {
-        request = request.header(header::COOKIE, cookie);
-    }
-    let Ok(request) = request.body(Body::from(envelope.body)) else {
-        return bad_envelope("The request could not be built. A header may be malformed.");
-    };
-    let Ok(response) = api.oneshot(request).await;
-    let (parts, body) = response.into_parts();
-    let mut bytes = axum::body::to_bytes(body, 1 << 20)
-        .await
-        .unwrap_or_default()
-        .to_vec();
-    if parts.headers.get(header::CONTENT_ENCODING) == Some(&HeaderValue::from_static("gzip")) {
-        let mut decoded = Vec::new();
-        if GzDecoder::new(bytes.as_slice())
-            .read_to_end(&mut decoded)
-            .is_ok()
-        {
-            bytes = decoded;
-        }
-    }
-    let listed: Vec<(String, String)> = parts
-        .headers
-        .iter()
-        .map(|(name, value)| {
-            (
-                name.to_string(),
-                value.to_str().unwrap_or("<binary>").to_owned(),
-            )
-        })
-        .collect();
-    let mut response = Json(json!({
-        "status": parts.status.as_u16(),
-        "reason": reason(parts.status),
-        "headers": listed,
-        "body": String::from_utf8_lossy(&bytes),
-    }))
-    .into_response();
-    for cookie in parts.headers.get_all(header::SET_COOKIE) {
-        response
-            .headers_mut()
-            .append(header::SET_COOKIE, cookie.clone());
-    }
-    response
-}
-
-async fn not_found() -> Problem {
-    Problem::new(
-        StatusCode::NOT_FOUND,
-        "not-found",
-        "The resource does not exist. This is not about you.",
-    )
-}

Added file: src/http/ctx.rs+90 additions@@ -0,0 +1,90 @@
+use std::{collections::HashMap, time::Instant};
+
+use axum::{
+    body::Bytes,
+    extract::{FromRequest, FromRequestParts, Query, RawPathParams, Request},
+    http::{HeaderMap, HeaderName, Method, StatusCode, Uri, Version, header},
+    response::{IntoResponse, Response},
+};
+use hyper::upgrade::OnUpgrade;
+
+use crate::problem::Problem;
+
+const BODY_LIMIT: usize = 64 * 1024;
+
+/// Everything a handler may look at, gathered once per request.
+pub struct Ctx {
+    pub method: Method,
+    pub uri: Uri,
+    pub version: Version,
+    pub headers: HeaderMap,
+    pub query: HashMap<String, String>,
+    pub params: HashMap<String, String>,
+    pub body: Bytes,
+    pub now: Instant,
+    pub upgrade: Option<OnUpgrade>,
+}
+
+impl Ctx {
+    pub fn header(&self, name: HeaderName) -> Option<&str> {
+        self.headers.get(name).and_then(|v| v.to_str().ok())
+    }
+
+    pub fn cookie(&self, name: &str) -> Option<&str> {
+        self.headers
+            .get_all(header::COOKIE)
+            .iter()
+            .filter_map(|v| v.to_str().ok())
+            .flat_map(|v| v.split(';'))
+            .filter_map(|pair| pair.trim().split_once('='))
+            .find(|(key, _)| *key == name)
+            .map(|(_, value)| value)
+    }
+
+    pub fn param(&self, name: &str) -> &str {
+        self.params.get(name).map_or("", String::as_str)
+    }
+
+    pub fn query(&self, name: &str) -> Option<&str> {
+        self.query.get(name).map(String::as_str)
+    }
+}
+
+impl<S: Send + Sync> FromRequest<S> for Ctx {
+    type Rejection = Response;
+
+    async fn from_request(mut request: Request, state: &S) -> Result<Self, Self::Rejection> {
+        let upgrade = request.extensions_mut().remove::<OnUpgrade>();
+        let (mut parts, body) = request.into_parts();
+        let params = RawPathParams::from_request_parts(&mut parts, state)
+            .await
+            .map(|raw| {
+                raw.iter()
+                    .map(|(k, v)| (k.to_owned(), v.to_owned()))
+                    .collect()
+            })
+            .unwrap_or_default();
+        let query = Query::<HashMap<String, String>>::try_from_uri(&parts.uri)
+            .map(|q| q.0)
+            .unwrap_or_default();
+        let body = axum::body::to_bytes(body, BODY_LIMIT).await.map_err(|_| {
+            Problem::new(
+                StatusCode::PAYLOAD_TOO_LARGE,
+                "body-too-large",
+                "The request body is larger than anything the server is prepared to receive.",
+            )
+            .into_response()
+        })?;
+        Ok(Self {
+            method: parts.method,
+            uri: parts.uri,
+            version: parts.version,
+            headers: parts.headers,
+            query,
+            params,
+            body,
+            now: Instant::now(),
+            upgrade,
+        })
+    }
+}

Added file: src/http/meta.rs+219 additions@@ -0,0 +1,219 @@
+//! Resources that do not belong to a single run.
+
+use axum::{
+    Json,
+    http::{StatusCode, header},
+    response::{IntoResponse, Response},
+};
+use rand::Rng;
+use serde_json::{Value, json};
+
+use super::{
+    Shared,
+    ctx::Ctx,
+    resource::{Resource, Verb},
+    run,
+};
+use crate::{
+    game::{ELDER_LAST_MODIFIED, FORUM_THREAD, Run, balance::MM_PER_INCH, forum_thread},
+    headers::X_SEED,
+    problem::{PROBLEM_BASE, Problem},
+};
+
+pub static INDEX: Resource<Shared> = Resource::new(&[Verb::new("GET", index)]);
+pub static RUNS: Resource<Shared> = Resource::new(&[Verb::new("POST", create_run)]);
+pub static THREAD: Resource<Shared> = Resource::new(&[Verb::new("GET", thread)]);
+pub static GRAVEYARD: Resource<Shared> = Resource::new(&[Verb::new("GET", graveyard)]);
+pub static LEADERBOARD: Resource<Shared> = Resource::new(&[Verb::new("GET", leaderboard)]);
+
+fn index(_: &mut Shared, ctx: &Ctx) -> Response {
+    let wants_html = ctx
+        .header(header::ACCEPT)
+        .is_some_and(|accept| accept.contains("text/html"));
+    if wants_html {
+        return (
+            StatusCode::SEE_OTHER,
+            [(header::LOCATION, "/ui/"), (header::VARY, "Accept")],
+        )
+            .into_response();
+    }
+    (
+        [(header::VARY, "Accept")],
+        Json(json!({
+            "detail": "This is jelqd. It is a roguelike. It is played over HTTP.",
+            "start": { "href": "/runs", "method": "POST" },
+            "leaderboard": "/leaderboard",
+            "graveyard": "/graveyard",
+            "forum": FORUM_THREAD,
+            "ui": "/ui/",
+        })),
+    )
+        .into_response()
+}
+
+fn create_run(state: &mut Shared, ctx: &Ctx) -> Response {
+    let seeded = ctx.query("seed").is_some();
+    let seed = match ctx.query("seed").map(str::parse::<u64>) {
+        None => rand::rng().random(),
+        Some(Ok(seed)) => seed,
+        Some(Err(_)) => {
+            return Problem::new(
+                StatusCode::BAD_REQUEST,
+                "bad-seed",
+                "The seed must be an unsigned 64-bit integer.",
+            )
+            .into_response();
+        }
+    };
+    let config = &state.config;
+    let mut runs = state.runs();
+    runs.retain(|_, run| ctx.now.duration_since(run.last_seen) < config.idle_ttl);
+    if runs.len() >= config.max_runs {
+        return Problem::new(
+            StatusCode::SERVICE_UNAVAILABLE,
+            "server-full",
+            "The server is full. Everyone is in there.",
+        )
+        .header(header::RETRY_AFTER, "600")
+        .into_response();
+    }
+    let id = loop {
+        let id = format!("{:032x}", rand::rng().random::<u128>());
+        if !runs.contains_key(&id) {
+            break id;
+        }
+    };
+    let public_id = format!("{:08x}", rand::rng().random::<u32>());
+    let mut run = Run::new(id.clone(), public_id, config.secret.mix_seed(seed));
+    run.seeded = seeded;
+    run.refractory = config.refractory;
+    run.last_seen = ctx.now;
+    let response = (
+        StatusCode::CREATED,
+        [
+            (header::LOCATION, run.path("")),
+            (header::ETAG, run.etag()),
+            (X_SEED, seed.to_string()),
+        ],
+        Json(run.view()),
+    )
+        .into_response();
+    let response = run::finish(&mut run, ctx, &config.secret, response);
+    runs.insert(id, run);
+    response
+}
+
+fn thread(_: &mut Shared, ctx: &Ctx) -> Response {
+    match ctx.param("year").parse::<u32>() {
+        Ok(2009) => (
+            [(header::LAST_MODIFIED, ELDER_LAST_MODIFIED)],
+            Json(forum_thread()),
+        )
+            .into_response(),
+        Ok(year) if year > 2009 => Problem::new(
+            StatusCode::NOT_FOUND,
+            "no-thread",
+            "Nobody has posted since 2009.",
+        )
+        .with("thread", FORUM_THREAD)
+        .into_response(),
+        _ => Problem::new(
+            StatusCode::NOT_FOUND,
+            "no-thread",
+            "The forum did not exist yet. The problem did.",
+        )
+        .with("thread", FORUM_THREAD)
+        .into_response(),
+    }
+}
+
+fn graveyard(state: &mut Shared, _: &Ctx) -> Response {
+    let runs = state.runs();
+    let dead: Vec<Value> = runs
+        .values()
+        .filter_map(|run| {
+            let ending = run.ended.as_ref()?;
+            Some(json!({
+                "public_id": run.public_id,
+                "cause": format!("{PROBLEM_BASE}{}", ending.cause.slug()),
+                "detail": ending.cause.detail(),
+                "turn": ending.turn,
+            }))
+        })
+        .collect();
+    Json(json!({ "runs": dead })).into_response()
+}
+
+fn leaderboard(state: &mut Shared, ctx: &Ctx) -> Response {
+    let truthful = match ctx.query("sort") {
+        None | Some("self-reported-length") => false,
+        Some("content-length") => match ctx.cookie("ruler") {
+            Some(ruler) if state.config.secret.verify("ruler", ruler) == Some("1") => true,
+            Some(_) => {
+                return Problem::new(
+                    StatusCode::BAD_REQUEST,
+                    "exaggeration",
+                    "The server has measured. Lying is not a technique.",
+                )
+                .with("cookie", "ruler")
+                .into_response();
+            }
+            None => {
+                return Problem::new(
+                    StatusCode::FORBIDDEN,
+                    "ruler-required",
+                    "Sorting by the truth requires a Ruler.",
+                )
+                .into_response();
+            }
+        },
+        Some(_) => {
+            return Problem::new(
+                StatusCode::BAD_REQUEST,
+                "unknown-sort",
+                "The leaderboard sorts by self-reported-length or content-length.",
+            )
+            .into_response();
+        }
+    };
+    let include_seeded = ctx.query("seeded") == Some("include");
+    let runs = state.runs();
+    let mut entries: Vec<&Run> = runs
+        .values()
+        .filter(|run| include_seeded || !run.seeded)
+        .collect();
+    let key = |run: &Run| {
+        if truthful {
+            run.current_length()
+        } else {
+            run.self_reported()
+        }
+    };
+    entries.sort_by(|a, b| key(b).total_cmp(&key(a)));
+    let entries: Vec<Value> = entries
+        .into_iter()
+        .map(|run| {
+            let mut entry = json!({
+                "public_id": run.public_id,
+                "status": run.status(),
+                "floor": run.floor.number(),
+                "self_reported_length": (run.self_reported() * 100.0).round() / 100.0,
+                "ranked": !run.seeded,
+                "viral": run.filmed_at.is_some(),
+            });
+            if truthful {
+                entry["content_length"] = json!((run.current_length() * MM_PER_INCH).round());
+            }
+            entry
+        })
+        .collect();
+    Json(json!({ "entries": entries })).into_response()
+}
+
+pub async fn not_found() -> Problem {
+    Problem::new(
+        StatusCode::NOT_FOUND,
+        "not-found",
+        "The resource does not exist. This is not about you.",
+    )
+}

Added file: src/http/middleware.rs+97 additions@@ -0,0 +1,97 @@
+use std::io::Write as _;
+
+use axum::{
+    body::Body,
+    extract::Request,
+    http::{HeaderValue, StatusCode, Version, header},
+    middleware::Next,
+    response::{IntoResponse, Response},
+};
+use flate2::{Compression, write::GzEncoder};
+
+use crate::{headers::X_POWERED_BY, problem::Problem};
+
+const MAX_URI: usize = 512;
+const MAX_HEADER: usize = 1024;
+
+/// Marks a response for gzip, which the cock ring asks for.
+#[derive(Clone)]
+pub struct Compress;
+
+fn reject(request: &Request) -> Option<Problem> {
+    if request.version() < Version::HTTP_11 {
+        return Some(Problem::new(
+            StatusCode::HTTP_VERSION_NOT_SUPPORTED,
+            "pdf",
+            "HTTP/1.0 is the version the original jelqing PDF was written for. The server has read it.",
+        ));
+    }
+    if request.uri().to_string().len() > MAX_URI {
+        return Some(Problem::new(
+            StatusCode::URI_TOO_LONG,
+            "uri-too-long",
+            "The URI is longer than anything else here.",
+        ));
+    }
+    if request.headers().values().any(|v| v.len() > MAX_HEADER) {
+        return Some(Problem::new(
+            StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE,
+            "head-too-large",
+            "Head too large.",
+        ));
+    }
+    let expectation = request.headers().get(header::EXPECT)?;
+    if expectation.as_bytes().eq_ignore_ascii_case(b"100-continue") {
+        return None;
+    }
+    Some(Problem::new(
+        StatusCode::EXPECTATION_FAILED,
+        "expectations",
+        format!(
+            "Expect: {} cannot be met.",
+            expectation.to_str().unwrap_or("that")
+        ),
+    ))
+}
+
+async fn compress(response: Response) -> Response {
+    let (mut parts, body) = response.into_parts();
+    let Ok(bytes) = axum::body::to_bytes(body, usize::MAX).await else {
+        return Response::from_parts(parts, Body::empty());
+    };
+    let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
+    let gzipped = encoder.write_all(&bytes).and_then(|()| encoder.finish());
+    let Ok(gzipped) = gzipped else {
+        return Response::from_parts(parts, Body::from(bytes));
+    };
+    parts
+        .headers
+        .insert(header::CONTENT_ENCODING, HeaderValue::from_static("gzip"));
+    parts.headers.remove(header::CONTENT_LENGTH);
+    parts
+        .headers
+        .append(header::VARY, HeaderValue::from_static("Accept-Encoding"));
+    Response::from_parts(parts, Body::from(gzipped))
+}
+
+pub async fn chrome(request: Request, next: Next) -> Response {
+    let gzip = request
+        .headers()
+        .get(header::ACCEPT_ENCODING)
+        .and_then(|v| v.to_str().ok())
+        .is_some_and(|e| e.to_ascii_lowercase().contains("gzip"));
+    let mut response = match reject(&request) {
+        Some(problem) => problem.into_response(),
+        None => next.run(request).await,
+    };
+    if gzip && response.extensions().get::<Compress>().is_some() {
+        response = compress(response).await;
+    }
+    let headers = response.headers_mut();
+    headers.insert(header::SERVER, HeaderValue::from_static("jelqd/0.6.9"));
+    headers.insert(X_POWERED_BY, HeaderValue::from_static("blood"));
+    headers
+        .entry(header::CACHE_CONTROL)
+        .or_insert(HeaderValue::from_static("no-store, private"));
+    response
+}

Added file: src/http/mod.rs+113 additions@@ -0,0 +1,113 @@
+mod ctx;
+mod meta;
+mod middleware;
+mod resource;
+mod response;
+mod run;
+mod runs;
+mod ui;
+
+use std::{
+    collections::HashMap,
+    sync::{Arc, Mutex, MutexGuard, PoisonError},
+};
+
+use axum::{
+    Router,
+    extract::State,
+    response::Redirect,
+    routing::{MethodRouter, any},
+};
+
+use crate::{config::Config, game::Run};
+use ctx::Ctx;
+use resource::Resource;
+use run::RunResource;
+
+pub struct AppState {
+    runs: Mutex<HashMap<String, Run>>,
+    config: Config,
+}
+
+impl AppState {
+    pub fn new(config: Config) -> Self {
+        Self {
+            runs: Mutex::default(),
+            config,
+        }
+    }
+
+    /// A panic mid-request must not take every other run down with it, so a poisoned lock is recovered.
+    fn runs(&self) -> MutexGuard<'_, HashMap<String, Run>> {
+        self.runs.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn insert(&self, run: Run) {
+        self.runs().insert(run.id.clone(), run);
+    }
+}
+
+impl Default for AppState {
+    fn default() -> Self {
+        Self::new(Config::default())
+    }
+}
+
+type Shared = Arc<AppState>;
+
+pub fn app(config: Config) -> Router {
+    router(Arc::new(AppState::new(config)))
+}
+
+pub fn router(state: Shared) -> Router {
+    let api = api(state);
+    let ui = Router::new()
+        .route("/ui", any(|| async { Redirect::permanent("/ui/") }))
+        .route("/ui/", any(ui::page))
+        .route("/ui/send", any(ui::send))
+        .with_state(api.clone());
+    api.merge(ui)
+}
+
+fn global(resource: &'static Resource<Shared>) -> MethodRouter<Shared> {
+    any(
+        move |State(mut state): State<Shared>, ctx: Ctx| async move {
+            resource.dispatch(&mut state, &ctx)
+        },
+    )
+}
+
+fn scoped(resource: &'static RunResource) -> MethodRouter<Shared> {
+    any(
+        move |State(state): State<Shared>, ctx: Ctx| async move { run::serve(&state, ctx, resource) },
+    )
+}
+
+fn api(state: Shared) -> Router {
+    Router::new()
+        .route("/", global(&meta::INDEX))
+        .route("/runs", global(&meta::RUNS))
+        .route("/runs/{id}", scoped(&runs::RUN))
+        .route("/runs/{id}/length", scoped(&runs::LENGTH))
+        .route("/runs/{id}/foreskin", scoped(&runs::FORESKIN))
+        .route("/runs/{id}/inventory", scoped(&runs::INVENTORY))
+        .route("/runs/{id}/inventory/{item}", scoped(&runs::ITEM))
+        .route("/runs/{id}/techniques", scoped(&runs::TECHNIQUES))
+        .route("/runs/{id}/drawer", scoped(&runs::DRAWER))
+        .route("/runs/{id}/branches/{choice}", scoped(&runs::BRANCH))
+        .route("/runs/{id}/floor", scoped(&runs::FLOOR))
+        .route("/runs/{id}/shop", scoped(&runs::SHOP))
+        .route("/runs/{id}/shop/{item}", scoped(&runs::BUY))
+        .route("/runs/{id}/portal", scoped(&runs::PORTAL))
+        .route("/runs/{id}/elder", scoped(&runs::ELDER))
+        .route("/runs/{id}/grip", scoped(&runs::GRIP))
+        .route("/runs/{id}/diagnosis", scoped(&runs::DIAGNOSIS))
+        .route("/runs/{id}/footage", scoped(&runs::FOOTAGE))
+        .route("/forum/threads/{year}", global(&meta::THREAD))
+        .route("/graveyard", global(&meta::GRAVEYARD))
+        .route("/leaderboard", global(&meta::LEADERBOARD))
+        .fallback(meta::not_found)
+        .layer(axum::middleware::from_fn(middleware::chrome))
+        .with_state(state)
+}

Added file: src/http/resource.rs+141 additions@@ -0,0 +1,141 @@
+use axum::{
+    Json,
+    http::{HeaderValue, Method, StatusCode, header},
+    response::{IntoResponse, Response},
+};
+use serde_json::json;
+
+use super::ctx::Ctx;
+use crate::{headers::ACCEPT_PATCH, problem::Problem};
+
+const THERAPY: &str = "Your options are listed in the Allow header. There are more of them than you think. You could also try being honest. It is not in the Allow header because it is not a method.";
+
+pub type Handler<T> = fn(&mut T, &Ctx) -> Response;
+
+/// A predicate for when a method is available, and the refusal when it is not.
+type Guard<T> = (fn(&T) -> bool, &'static str);
+
+pub struct Verb<T: 'static> {
+    method: &'static str,
+    handle: Handler<T>,
+    guard: Option<Guard<T>>,
+}
+
+impl<T> Verb<T> {
+    pub const fn new(method: &'static str, handle: Handler<T>) -> Self {
+        Self {
+            method,
+            handle,
+            guard: None,
+        }
+    }
+
+    /// Makes the method available only while `available` holds, refusing with `refusal` otherwise.
+    pub const fn only_when(self, available: fn(&T) -> bool, refusal: &'static str) -> Self {
+        Self {
+            guard: Some((available, refusal)),
+            ..self
+        }
+    }
+
+    fn available(&self, target: &T) -> bool {
+        self.guard.is_none_or(|(available, _)| available(target))
+    }
+}
+
+/// The methods a resource supports. `Allow`, `OPTIONS` and `405` are all derived from this list.
+pub struct Resource<T: 'static> {
+    pub verbs: &'static [Verb<T>],
+    pub accept_patch: bool,
+}
+
+impl<T> Resource<T> {
+    pub const fn new(verbs: &'static [Verb<T>]) -> Self {
+        Self {
+            verbs,
+            accept_patch: false,
+        }
+    }
+
+    pub fn allow(&self, target: &T) -> String {
+        let mut methods = Vec::new();
+        for verb in self.verbs.iter().filter(|verb| verb.available(target)) {
+            methods.push(verb.method);
+            if verb.method == "GET" {
+                methods.push("HEAD");
+            }
+        }
+        methods.push("OPTIONS");
+        methods.join(", ")
+    }
+
+    pub fn dispatch(&self, target: &mut T, ctx: &Ctx) -> Response {
+        let requested = ctx.method.as_str();
+        let lookup = if requested == "HEAD" {
+            "GET"
+        } else {
+            requested
+        };
+        match self.verbs.iter().find(|verb| verb.method == lookup) {
+            Some(verb) if verb.available(target) => (verb.handle)(target, ctx),
+            Some(verb) => {
+                let refusal = verb.guard.map_or("", |(_, refusal)| refusal);
+                method_not_allowed(refusal.to_owned(), &self.allow(target))
+            }
+            None if requested == "OPTIONS" => options(&self.allow(target), self.accept_patch),
+            None => unsupported(&ctx.method, &self.allow(target)),
+        }
+    }
+}
+
+fn method_not_allowed(detail: String, allow: &str) -> Response {
+    Problem::new(StatusCode::METHOD_NOT_ALLOWED, "method-not-allowed", detail)
+        .header(header::ALLOW, allow)
+        .into_response()
+}
+
+pub fn unsupported(method: &Method, allow: &str) -> Response {
+    let name = method.as_str();
+    match name {
+        "CONNECT" => StatusCode::NOT_IMPLEMENTED.into_response(),
+        "BREW" => Problem::new(
+            StatusCode::IM_A_TEAPOT,
+            "brew",
+            "The server is a teapot. RFC 2324 is clear on this. It is not yet short and stout.",
+        )
+        .into_response(),
+        "GET" | "HEAD" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS" | "TRACE" | "JELQ" => {
+            method_not_allowed(format!("{method} is not supported here."), allow)
+        }
+        _ if name.eq_ignore_ascii_case("jelq") => Problem::new(
+            StatusCode::NOT_IMPLEMENTED,
+            "not-implemented",
+            format!(
+                "The server does not implement {method}. Methods are case-sensitive. JELQ is shouted for a reason."
+            ),
+        )
+        .into_response(),
+        _ => Problem::new(
+            StatusCode::NOT_IMPLEMENTED,
+            "not-implemented",
+            format!("The server does not implement {method}."),
+        )
+        .into_response(),
+    }
+}
+
+fn options(allow: &str, accept_patch: bool) -> Response {
+    let mut response = (
+        StatusCode::OK,
+        [(header::ALLOW, allow)],
+        Json(json!({ "detail": THERAPY })),
+    )
+        .into_response();
+    if accept_patch {
+        response.headers_mut().insert(
+            ACCEPT_PATCH,
+            HeaderValue::from_static("application/json-patch+json"),
+        );
+    }
+    response
+}

Added file: src/http/response.rs+48 additions@@ -0,0 +1,48 @@
+use axum::{
+    Json,
+    http::{HeaderValue, StatusCode, header},
+    response::{IntoResponse, Response},
+};
+
+use crate::game::{Outcome, Payload};
+
+impl IntoResponse for Outcome {
+    fn into_response(self) -> Response {
+        let mut response = match self.payload {
+            // RFC 9110 §15.3.7 obliges a 206 to be a byte range of the full representation, so it is.
+            Payload::Json(body) if self.status == StatusCode::PARTIAL_CONTENT => {
+                let full = body.to_string().into_bytes();
+                let half = full.len() / 2;
+                let range = format!("bytes 0-{}/{}", half.saturating_sub(1), full.len());
+                (
+                    self.status,
+                    [
+                        (header::CONTENT_TYPE, "application/json".to_owned()),
+                        (header::CONTENT_RANGE, range),
+                    ],
+                    full[..half].to_vec(),
+                )
+                    .into_response()
+            }
+            Payload::Json(body) => (self.status, Json(body)).into_response(),
+            Payload::Raw(content_type, body) => {
+                (self.status, [(header::CONTENT_TYPE, content_type)], body).into_response()
+            }
+            Payload::Empty => self.status.into_response(),
+        };
+        let headers = response.headers_mut();
+        for (name, value) in self.headers {
+            if let Ok(value) = HeaderValue::from_str(&value) {
+                headers.append(name, value);
+            }
+        }
+        response
+    }
+}
+
+pub fn respond<T: IntoResponse, E: IntoResponse>(result: Result<T, E>) -> Response {
+    match result {
+        Ok(ok) => ok.into_response(),
+        Err(err) => err.into_response(),
+    }
+}

Added file: src/http/run.rs+205 additions@@ -0,0 +1,205 @@
+//! Plumbing shared by every resource under `/runs/{id}`.
+
+use axum::{
+    http::{HeaderName, HeaderValue, StatusCode, header},
+    response::{IntoResponse, Response},
+};
+use hyper_util::rt::TokioIo;
+use tokio::io::AsyncWriteExt;
+
+use super::{AppState, ctx::Ctx, middleware::Compress, resource::Resource};
+use crate::{
+    game::{Floor, Run, balance::SUSPICION_LIMIT},
+    headers::{
+        X_CASH, X_EQ, X_FLOOR, X_FORESKIN, X_GIRTH, X_OBSERVED_BY, X_SELF_REPORTED_LENGTH, X_SHAME,
+        X_STAMINA, X_SUSPICION,
+    },
+    problem::{PROBLEM_BASE, Problem},
+    secret::Secret,
+};
+
+pub const REL_BASE: &str = "https://jelq.dev/rels/";
+const COOKIE_ATTRIBUTES: &str = "Max-Age=31536000; Path=/; HttpOnly; SameSite=Strict";
+const LINKED: [&str; 8] = [
+    "floor",
+    "length",
+    "foreskin",
+    "inventory",
+    "techniques",
+    "drawer",
+    "grip",
+    "diagnosis",
+];
+
+/// Which household hazards stand between a request and the run.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum Scope {
+    Home,
+    Pockets,
+}
+
+pub struct RunResource {
+    pub scope: Scope,
+    pub resource: Resource<Run>,
+}
+
+/// What the server writes over the connection after a `101`.
+#[derive(Clone)]
+pub struct Greeting(pub String);
+
+pub fn serve(state: &AppState, mut ctx: Ctx, target: &RunResource) -> Response {
+    let mut runs = state.runs();
+    let Some(run) = runs.get_mut(ctx.param("id")) else {
+        return Problem::new(
+            StatusCode::NOT_FOUND,
+            "no-such-run",
+            "There is no such run. There may never have been.",
+        )
+        .into_response();
+    };
+    if let Some(ending) = &run.ended {
+        return Problem::new(StatusCode::GONE, "run-ended", "This run has ended.")
+            .with("cause", format!("{PROBLEM_BASE}{}", ending.cause.slug()))
+            .with("turn", ending.turn)
+            .with("graveyard", "/graveyard")
+            .into_response();
+    }
+    run.last_seen = ctx.now;
+    run.observed = None;
+    let response =
+        gate(run, &ctx, target.scope).unwrap_or_else(|| target.resource.dispatch(run, &ctx));
+    let response = finish(run, &ctx, &state.config.secret, response);
+    drop(runs);
+    greet(response, &mut ctx)
+}
+
+fn gate(run: &mut Run, ctx: &Ctx, scope: Scope) -> Option<Response> {
+    if scope == Scope::Pockets {
+        return None;
+    }
+    if run.floor == Floor::Hotel && !run.here.wifi_accepted {
+        let portal = run.path("/portal");
+        return Some(
+            Problem::new(
+                StatusCode::NETWORK_AUTHENTICATION_REQUIRED,
+                "captive-portal",
+                "The network requires authentication. The hotel would like you to agree to some terms.",
+            )
+            .with("portal", portal.as_str())
+            .header(header::LINK, format!("<{portal}>; rel=\"{REL_BASE}portal\""))
+            .into_response(),
+        );
+    }
+    run.answer_door(ctx.header(header::AUTHORIZATION))
+        .err()
+        .map(IntoResponse::into_response)
+}
+
+fn links(run: &Run) -> String {
+    let mut links = vec![format!("<{}>; rel=\"{REL_BASE}run\"", run.path(""))];
+    let shop = run.floor.shop_open().then_some("shop");
+    for rel in LINKED.into_iter().chain(shop) {
+        links.push(format!(
+            "<{}>; rel=\"{REL_BASE}{rel}\"",
+            run.path(&format!("/{rel}"))
+        ));
+    }
+    links.join(", ")
+}
+
+/// Shame lives in a signed cookie so it follows the player across runs. Each response adds this
+/// run's new shame to whatever total the client presents, so two runs at once both count.
+fn settle_shame(run: &mut Run, ctx: &Ctx, secret: &Secret) -> u32 {
+    let presented = ctx
+        .cookie("shame")
+        .and_then(|signed| secret.verify("shame", signed))
+        .and_then(|total| total.parse::<u32>().ok());
+    let total = presented.unwrap_or(run.shame_total) + (run.shame - run.shame_reported);
+    run.shame_reported = run.shame;
+    run.shame_total = total;
+    total
+}
+
+pub fn finish(run: &mut Run, ctx: &Ctx, secret: &Secret, mut response: Response) -> Response {
+    let status = response.status();
+    if status == StatusCode::NOT_MODIFIED {
+        return response;
+    }
+    let shame = settle_shame(run, ctx, secret);
+    let mut stats: Vec<(HeaderName, String)> = vec![
+        (
+            X_SELF_REPORTED_LENGTH,
+            format!("{:.2}", run.self_reported()),
+        ),
+        (X_GIRTH, format!("{:.2}", run.girth)),
+        (
+            X_FORESKIN,
+            run.foreskin.map_or("gone".into(), |f| format!("{f:.2}")),
+        ),
+        (X_EQ, run.eq.to_string()),
+        (X_STAMINA, format!("{}/{}", run.stamina, run.max_stamina())),
+        (X_SUSPICION, format!("{}/{SUSPICION_LIMIT}", run.suspicion)),
+        (X_SHAME, shame.to_string()),
+        (X_CASH, run.cash.to_string()),
+        (X_FLOOR, run.floor.number().to_string()),
+        (header::LINK, links(run)),
+    ];
+    if let Some(observer) = run.observed {
+        stats.push((X_OBSERVED_BY, observer.name().into()));
+    }
+    if run.mom.is_some() {
+        stats.push((header::VIA, "1.1 mom".into()));
+        stats.push((header::VARY, "Mom".into()));
+    }
+    // RFC 9111 obsoleted Warning, which is why nobody heeds it.
+    if run.conditions.pulled_muscle {
+        stats.push((header::WARNING, "199 - \"a muscle has been pulled\"".into()));
+    }
+    if run.eq > 70 && run.ended.is_none() {
+        stats.push((header::WARNING, "199 - \"it is turning purple\"".into()));
+    }
+    stats.push((
+        header::SET_COOKIE,
+        format!(
+            "shame={}; {COOKIE_ATTRIBUTES}",
+            secret.sign("shame", &shame.to_string())
+        ),
+    ));
+    if run.items.ruler {
+        stats.push((
+            header::SET_COOKIE,
+            format!("ruler={}; {COOKIE_ATTRIBUTES}", secret.sign("ruler", "1")),
+        ));
+    }
+    let headers = response.headers_mut();
+    for (name, value) in stats {
+        if let Ok(value) = HeaderValue::from_str(&value) {
+            headers.append(name, value);
+        }
+    }
+    let bodiless = status.is_informational() || status == StatusCode::NO_CONTENT;
+    if run.items.ring && !bodiless {
+        response.extensions_mut().insert(Compress);
+    }
+    response
+}
+
+fn greet(response: Response, ctx: &mut Ctx) -> Response {
+    if response.status() != StatusCode::SWITCHING_PROTOCOLS {
+        return response;
+    }
+    let (Some(Greeting(text)), Some(upgrade)) = (
+        response.extensions().get::<Greeting>().cloned(),
+        ctx.upgrade.take(),
+    ) else {
+        return response;
+    };
+    tokio::spawn(async move {
+        if let Ok(upgraded) = upgrade.await {
+            let mut io = TokioIo::new(upgraded);
+            let _ = io.write_all(text.as_bytes()).await;
+            let _ = io.shutdown().await;
+        }
+    });
+    response
+}

Added file: src/http/runs.rs+488 additions@@ -0,0 +1,488 @@
+//! The resources under `/runs/{id}`.
+
+use std::{convert::Infallible, fmt::Write as _};
+
+use axum::{
+    Json,
+    body::{Body, Bytes},
+    http::{StatusCode, header},
+    response::{IntoResponse, Response},
+};
+use serde_json::{Value, json};
+
+use super::{
+    ctx::Ctx,
+    resource::{Resource, Verb},
+    response::respond,
+    run::{Greeting, RunResource, Scope},
+};
+use crate::{
+    game::{
+        Cause, Floor, Grip, Item, LUBRICANTS, Lube, PatchOp, Run, Technique,
+        balance::{EQ_BAND, MM_PER_INCH},
+        shaft,
+    },
+    headers::ACCEPT_PATCH,
+    problem::Problem,
+};
+
+const fn home(verbs: &'static [Verb<Run>]) -> RunResource {
+    RunResource {
+        scope: Scope::Home,
+        resource: Resource::new(verbs),
+    }
+}
+
+const fn pockets(verbs: &'static [Verb<Run>]) -> RunResource {
+    RunResource {
+        scope: Scope::Pockets,
+        resource: Resource::new(verbs),
+    }
+}
+
+fn not_in_clinic(run: &Run) -> bool {
+    run.floor != Floor::Clinic
+}
+
+fn never(_: &Run) -> bool {
+    false
+}
+
+fn unreachable_handler(_: &mut Run, _: &Ctx) -> Response {
+    StatusCode::METHOD_NOT_ALLOWED.into_response()
+}
+
+pub static RUN: RunResource = RunResource {
+    scope: Scope::Home,
+    resource: Resource {
+        verbs: &[
+            Verb::new("GET", get_run),
+            Verb::new("JELQ", jelq)
+                .only_when(not_in_clinic, "JELQ is not performed in the clinic."),
+            Verb::new("PUT", put_run),
+            Verb::new("PATCH", patch_run),
+            Verb::new("DELETE", delete_run),
+            Verb::new("TRACE", trace_run),
+        ],
+        accept_patch: true,
+    },
+};
+pub static LENGTH: RunResource = home(&[Verb::new("GET", get_length)]);
+pub static FORESKIN: RunResource = home(&[
+    Verb::new("GET", get_foreskin),
+    Verb::new("DELETE", delete_foreskin),
+]);
+pub static INVENTORY: RunResource = pockets(&[Verb::new("GET", get_inventory)]);
+pub static ITEM: RunResource =
+    pockets(&[Verb::new("GET", get_item), Verb::new("DELETE", delete_item)]);
+pub static TECHNIQUES: RunResource = home(&[Verb::new("GET", get_techniques)]);
+pub static DRAWER: RunResource = home(&[Verb::new("POST", search_drawer)]);
+pub static BRANCH: RunResource = home(&[Verb::new("POST", choose_branch)]);
+pub static FLOOR: RunResource =
+    pockets(&[Verb::new("GET", get_floor), Verb::new("POST", leave_floor)]);
+pub static SHOP: RunResource = home(&[Verb::new("GET", get_shop)]);
+pub static BUY: RunResource = home(&[Verb::new("POST", buy)]);
+pub static PORTAL: RunResource = pockets(&[
+    Verb::new("GET", get_portal),
+    Verb::new("POST", accept_portal),
+]);
+pub static ELDER: RunResource = home(&[Verb::new("GET", get_elder)]);
+pub static GRIP: RunResource = home(&[Verb::new("GET", get_grip)]);
+pub static DIAGNOSIS: RunResource = pockets(&[Verb::new("GET", get_diagnosis)]);
+pub static FOOTAGE: RunResource = pockets(&[
+    Verb::new("GET", get_footage),
+    Verb::new("DELETE", unreachable_handler).only_when(
+        never,
+        "The footage has been cached by intermediaries. It cannot be deleted.",
+    ),
+]);
+
+fn get_run(run: &mut Run, ctx: &Ctx) -> Response {
+    if ctx
+        .header(header::ACCEPT)
+        .is_some_and(|accept| accept.contains("reassurance"))
+    {
+        return Problem::new(
+            StatusCode::NOT_ACCEPTABLE,
+            "no-reassurance",
+            "The server does not produce reassurance.",
+        )
+        .into_response();
+    }
+    (
+        StatusCode::OK,
+        [(header::ETAG, run.etag())],
+        Json(run.view()),
+    )
+        .into_response()
+}
+
+fn parse_techniques(run: &Run, ctx: &Ctx) -> Result<Vec<Technique>, Problem> {
+    let required = || {
+        Problem::new(
+            StatusCode::BAD_REQUEST,
+            "technique-required",
+            "No technique was specified.",
+        )
+        .with("techniques", run.path("/techniques"))
+    };
+    let names = ctx
+        .query("technique")
+        .filter(|n| !n.trim().is_empty())
+        .ok_or_else(required)?;
+    names
+        .split(',')
+        .map(str::trim)
+        .filter(|n| !n.is_empty())
+        .map(|name| {
+            Technique::parse(name).ok_or_else(|| {
+                Problem::new(
+                    StatusCode::BAD_REQUEST,
+                    "unknown-technique",
+                    format!("{name} is not a technique."),
+                )
+                .with("techniques", run.path("/techniques"))
+            })
+        })
+        .collect()
+}
+
+fn parse_intensity(ctx: &Ctx) -> Result<i32, Problem> {
+    match ctx.query("intensity").map(str::parse::<i32>) {
+        None => Ok(5),
+        Some(Ok(i)) if (1..=10).contains(&i) => Ok(i),
+        Some(_) => Err(Problem::new(
+            StatusCode::BAD_REQUEST,
+            "intensity-out-of-range",
+            "Intensity is measured from 1 to 10.",
+        )),
+    }
+}
+
+fn jelq(run: &mut Run, ctx: &Ctx) -> Response {
+    let parsed = parse_techniques(run, ctx).and_then(|techniques| {
+        let intensity = parse_intensity(ctx)?;
+        let lube = Lube::from_content_type(ctx.header(header::CONTENT_TYPE))?;
+        Ok((techniques, intensity, lube))
+    });
+    match parsed {
+        Ok((techniques, intensity, lube)) => {
+            respond(run.jelq(&techniques, intensity, lube, ctx.now))
+        }
+        Err(problem) => problem.into_response(),
+    }
+}
+
+fn put_run(run: &mut Run, _: &Ctx) -> Response {
+    run.put().into_response()
+}
+
+fn patch_run(run: &mut Run, ctx: &Ctx) -> Response {
+    let is_patch = ctx
+        .header(header::CONTENT_TYPE)
+        .is_some_and(|ct| ct.starts_with("application/json-patch+json"));
+    if !is_patch {
+        return Problem::new(
+            StatusCode::UNSUPPORTED_MEDIA_TYPE,
+            "patch-format",
+            "Patches are accepted as application/json-patch+json.",
+        )
+        .header(ACCEPT_PATCH, "application/json-patch+json")
+        .into_response();
+    }
+    match serde_json::from_slice::<Vec<PatchOp>>(&ctx.body) {
+        Ok(ops) => respond(run.patch(&ops)),
+        Err(_) => Problem::new(
+            StatusCode::BAD_REQUEST,
+            "malformed-patch",
+            "The patch could not be parsed.",
+        )
+        .into_response(),
+    }
+}
+
+fn delete_run(run: &mut Run, _: &Ctx) -> Response {
+    run.end(Cause::Abandoned);
+    StatusCode::NO_CONTENT.into_response()
+}
+
+fn trace_run(run: &mut Run, ctx: &Ctx) -> Response {
+    run.shame += 1;
+    let mut message = format!("{} {} {:?}\r\n", ctx.method, ctx.uri, ctx.version);
+    for (name, value) in &ctx.headers {
+        let _ = write!(
+            message,
+            "{name}: {}\r\n",
+            value.to_str().unwrap_or("<binary>")
+        );
+    }
+    message.push_str("\r\n");
+    (
+        StatusCode::OK,
+        [(header::CONTENT_TYPE, "message/http")],
+        message,
+    )
+        .into_response()
+}
+
+fn millimetres(inches: f64) -> usize {
+    (inches * MM_PER_INCH).round() as usize
+}
+
+fn parse_inch_range(range: &str, total: f64) -> Option<(f64, f64)> {
+    let (start, end) = range.strip_prefix("inches=")?.split_once('-')?;
+    let start: f64 = start.trim().parse().ok()?;
+    let end: f64 = match end.trim() {
+        "" => total,
+        end => end.parse().ok()?,
+    };
+    (start >= 0.0 && start < total && start <= end).then_some((start, end.min(total)))
+}
+
+fn get_length(run: &mut Run, ctx: &Ctx) -> Response {
+    let inches = if run.items.ruler {
+        run.current_length()
+    } else {
+        run.self_reported()
+    };
+    let body = shaft(millimetres(inches));
+    let content_type = (
+        header::CONTENT_TYPE,
+        "text/plain; charset=us-ascii".to_owned(),
+    );
+    let accept_ranges = (header::ACCEPT_RANGES, "inches".to_owned());
+
+    if let Some(range) = ctx.header(header::RANGE)
+        && range.starts_with("inches=")
+    {
+        let Some((start, end)) = parse_inch_range(range, inches) else {
+            return Problem::new(
+                StatusCode::RANGE_NOT_SATISFIABLE,
+                "range-not-satisfiable",
+                format!("The requested range is not available. {inches:.2} inches are."),
+            )
+            .header(header::CONTENT_RANGE, format!("inches */{inches:.2}"))
+            .into_response();
+        };
+        let from = millimetres(start).min(body.len() - 1);
+        let to = millimetres(end).clamp(from + 1, body.len());
+        let content_range = (
+            header::CONTENT_RANGE,
+            format!("inches {start:.2}-{end:.2}/{inches:.2}"),
+        );
+        return (
+            StatusCode::PARTIAL_CONTENT,
+            [content_type, accept_ranges, content_range],
+            body[from..to].to_owned(),
+        )
+            .into_response();
+    }
+
+    if run.items.ruler {
+        return (StatusCode::OK, [content_type, accept_ranges], body).into_response();
+    }
+    let chunks: Vec<Result<Bytes, Infallible>> = body
+        .into_bytes()
+        .chunks(16)
+        .map(|c| Ok(Bytes::copy_from_slice(c)))
+        .collect();
+    let body = Body::from_stream(futures_util::stream::iter(chunks));
+    (StatusCode::OK, [content_type, accept_ranges], body).into_response()
+}
+
+fn get_foreskin(run: &mut Run, _: &Ctx) -> Response {
+    if run.foreskin.is_none() {
+        return Problem::new(
+            StatusCode::GONE,
+            "foreskin-gone",
+            "The foreskin is gone. It will not be returning.",
+        )
+        .into_response();
+    }
+    (StatusCode::NO_CONTENT, [(header::ETAG, run.etag())]).into_response()
+}
+
+fn delete_foreskin(run: &mut Run, ctx: &Ctx) -> Response {
+    respond(run.delete_foreskin(ctx.header(header::IF_MATCH)))
+}
+
+fn get_inventory(run: &mut Run, _: &Ctx) -> Response {
+    let items: Vec<Value> = run
+        .items
+        .owned()
+        .into_iter()
+        .map(|item| {
+            json!({
+                "name": item.slug(),
+                "href": run.path(&format!("/inventory/{}", item.slug())),
+            })
+        })
+        .collect();
+    Json(json!({
+        "items": items,
+        "ice_packs": run.items.ice_packs,
+        "supplements": run.items.supplements,
+        "excuses": run.excuses(),
+    }))
+    .into_response()
+}
+
+fn owned_item(run: &Run, ctx: &Ctx) -> Result<Item, Problem> {
+    Item::parse(ctx.param("item"))
+        .filter(|&item| run.items.has(item))
+        .ok_or_else(|| {
+            Problem::new(
+                StatusCode::NOT_FOUND,
+                "no-such-item",
+                "You do not have that.",
+            )
+        })
+}
+
+fn get_item(run: &mut Run, ctx: &Ctx) -> Response {
+    match owned_item(run, ctx) {
+        Ok(item) => {
+            Json(json!({ "name": item.slug(), "description": item.description() })).into_response()
+        }
+        Err(problem) => problem.into_response(),
+    }
+}
+
+fn delete_item(run: &mut Run, ctx: &Ctx) -> Response {
+    match owned_item(run, ctx) {
+        Ok(item) => respond(run.drop_item(item)),
+        Err(problem) => problem.into_response(),
+    }
+}
+
+fn get_techniques(run: &mut Run, _: &Ctx) -> Response {
+    let listed: Vec<Value> = Technique::ALL
+        .into_iter()
+        .map(|t| t.describe(run.forum_read()))
+        .collect();
+    Json(json!({
+        "usage": format!("JELQ {}?technique=<name>[,<name>]&intensity=<1-10>", run.path("")),
+        "lubricant": "Declared with Content-Type.",
+        "lubricants": LUBRICANTS,
+        "eq_band": [EQ_BAND.start(), EQ_BAND.end()],
+        "techniques": listed,
+    }))
+    .into_response()
+}
+
+fn search_drawer(run: &mut Run, _: &Ctx) -> Response {
+    respond(run.search_drawer())
+}
+
+fn choose_branch(run: &mut Run, ctx: &Ctx) -> Response {
+    respond(run.choose(ctx.param("choice")))
+}
+
+fn get_floor(run: &mut Run, _: &Ctx) -> Response {
+    Json(run.floor_view()).into_response()
+}
+
+fn leave_floor(run: &mut Run, _: &Ctx) -> Response {
+    respond(run.advance())
+}
+
+fn get_shop(run: &mut Run, _: &Ctx) -> Response {
+    respond(run.shop_view().map(Json))
+}
+
+fn buy(run: &mut Run, ctx: &Ctx) -> Response {
+    respond(run.buy(ctx.param("item")))
+}
+
+fn get_portal(run: &mut Run, _: &Ctx) -> Response {
+    Json(json!({
+        "terms": "By connecting you agree that the hotel is not responsible for anything that happens in this room, and that it does not want to know.",
+        "accept": { "href": run.path("/portal"), "method": "POST" },
+    }))
+    .into_response()
+}
+
+fn accept_portal(run: &mut Run, _: &Ctx) -> Response {
+    respond(run.accept_terms())
+}
+
+fn get_elder(run: &mut Run, ctx: &Ctx) -> Response {
+    respond(run.elder(
+        ctx.header(header::PROXY_AUTHORIZATION),
+        ctx.header(header::IF_MODIFIED_SINCE),
+    ))
+}
+
+fn requested_grip(ctx: &Ctx) -> Option<Grip> {
+    let connection = ctx.header(header::CONNECTION)?.to_ascii_lowercase();
+    if !connection.split(',').any(|token| token.trim() == "upgrade") {
+        return None;
+    }
+    ctx.header(header::UPGRADE)?
+        .split(',')
+        .find_map(|protocol| Grip::parse(protocol.trim()))
+}
+
+fn get_grip(run: &mut Run, ctx: &Ctx) -> Response {
+    if let Some(grip) = requested_grip(ctx) {
+        run.set_grip(grip);
+        let mut response = (
+            StatusCode::SWITCHING_PROTOCOLS,
+            [
+                (header::UPGRADE, grip.name()),
+                (header::CONNECTION, "upgrade"),
+            ],
+        )
+            .into_response();
+        response.extensions_mut().insert(Greeting(format!(
+            "You are now jelqing {}.\r\n",
+            grip.name()
+        )));
+        return response;
+    }
+    let detail = match ctx.header(header::UPGRADE) {
+        Some(protocol) => {
+            format!("The server does not know the {protocol} grip. Grips are protocols.")
+        }
+        None => "Grips are protocols. Change grip by upgrading the connection.".to_owned(),
+    };
+    (
+        StatusCode::OK,
+        [(header::UPGRADE, "overhand, underhand")],
+        Json(json!({ "grip": run.grip.name(), "detail": detail })),
+    )
+        .into_response()
+}
+
+fn get_diagnosis(run: &mut Run, ctx: &Ctx) -> Response {
+    respond(run.diagnose(
+        ctx.header(header::AUTHORIZATION),
+        ctx.header(header::IF_NONE_MATCH),
+    ))
+}
+
+fn get_footage(run: &mut Run, _: &Ctx) -> Response {
+    let Some((filmed, age)) = run.footage() else {
+        return Problem::new(
+            StatusCode::NOT_FOUND,
+            "no-footage",
+            "There is no footage. Yet.",
+        )
+        .into_response();
+    };
+    (
+        [
+            (
+                header::CACHE_CONTROL,
+                "public, max-age=31536000, immutable".to_owned(),
+            ),
+            (header::AGE, age.to_string()),
+            (header::LAST_MODIFIED, httpdate::fmt_http_date(filmed)),
+        ],
+        Json(json!({
+            "detail": "A recording. It is grainy. It is unmistakably you. It has been shared.",
+            "views": 1 + age * 37,
+        })),
+    )
+        .into_response()
+}

Added file: src/http/ui.rs+105 additions@@ -0,0 +1,105 @@
+use std::io::Read as _;
+
+use axum::{
+    Json, Router,
+    body::{Body, Bytes},
+    extract::{Request, State},
+    http::{HeaderMap, HeaderValue, Method, StatusCode, header},
+    response::{Html, IntoResponse, Response},
+};
+use flate2::read::GzDecoder;
+use serde::Deserialize;
+use serde_json::json;
+use tower::ServiceExt;
+
+use super::resource::unsupported;
+use crate::problem::{Problem, reason};
+
+const RESPONSE_LIMIT: usize = 1 << 20;
+
+#[derive(Deserialize)]
+struct Envelope {
+    method: String,
+    path: String,
+    #[serde(default)]
+    headers: Vec<(String, String)>,
+    #[serde(default)]
+    body: String,
+}
+
+pub async fn page(method: Method) -> Response {
+    if method != Method::GET && method != Method::HEAD {
+        return unsupported(&method, "GET, HEAD, OPTIONS");
+    }
+    Html(include_str!("../ui.html")).into_response()
+}
+
+fn bad_envelope(detail: &str) -> Response {
+    Problem::new(StatusCode::BAD_REQUEST, "bad-envelope", detail).into_response()
+}
+
+fn decode(headers: &HeaderMap, bytes: Bytes) -> Vec<u8> {
+    let gzipped = headers.get(header::CONTENT_ENCODING) == Some(&HeaderValue::from_static("gzip"));
+    let mut decoded = Vec::new();
+    if gzipped
+        && GzDecoder::new(bytes.as_ref())
+            .read_to_end(&mut decoded)
+            .is_ok()
+    {
+        return decoded;
+    }
+    bytes.to_vec()
+}
+
+// Browsers hide 3xx responses from fetch and refuse TRACE, Upgrade, and Expect, so the page
+// replays requests in-process to show the player exactly what the API said.
+pub async fn send(State(api): State<Router>, headers: HeaderMap, body: Bytes) -> Response {
+    let Ok(envelope) = serde_json::from_slice::<Envelope>(&body) else {
+        return bad_envelope("The envelope could not be parsed.");
+    };
+    if !envelope.path.starts_with('/') || envelope.path.starts_with("/ui") {
+        return bad_envelope("The path must be an API path.");
+    }
+    let Ok(method) = Method::from_bytes(envelope.method.as_bytes()) else {
+        return bad_envelope("That is not a method.");
+    };
+    let mut request = Request::builder().method(method).uri(&envelope.path);
+    for (name, value) in envelope.headers.iter().filter(|(_, v)| !v.is_empty()) {
+        request = request.header(name, value);
+    }
+    for cookie in headers.get_all(header::COOKIE) {
+        request = request.header(header::COOKIE, cookie);
+    }
+    let Ok(request) = request.body(Body::from(envelope.body)) else {
+        return bad_envelope("The request could not be built. A header may be malformed.");
+    };
+    let Ok(response) = api.oneshot(request).await;
+    let (parts, body) = response.into_parts();
+    let bytes = axum::body::to_bytes(body, RESPONSE_LIMIT)
+        .await
+        .unwrap_or_default();
+    let shown = decode(&parts.headers, bytes);
+    let listed: Vec<(String, String)> = parts
+        .headers
+        .iter()
+        .map(|(name, value)| {
+            (
+                name.to_string(),
+                value.to_str().unwrap_or("<binary>").to_owned(),
+            )
+        })
+        .collect();
+    let mut response = Json(json!({
+        "status": parts.status.as_u16(),
+        "reason": reason(parts.status),
+        "headers": listed,
+        "body": String::from_utf8_lossy(&shown),
+    }))
+    .into_response();
+    for cookie in parts.headers.get_all(header::SET_COOKIE) {
+        response
+            .headers_mut()
+            .append(header::SET_COOKIE, cookie.clone());
+    }
+    response
+}

Modified file: src/lib.rs+10 additions−4 deletions@@ -1,6 +1,12 @@
-pub mod game;
-pub mod http;
-pub mod problem;
-pub mod secret;
+mod config;
+mod game;
+mod headers;
+mod http;
+mod problem;
+mod secret;
 
+#[cfg(test)]
+mod tests;
+
+pub use config::Config;
 pub use http::{AppState, app, router};

Modified file: src/main.rs+4 additions−4 deletions@@ -1,7 +1,7 @@
 #[tokio::main]
 async fn main() -> std::io::Result<()> {
-    let addr = std::env::var("JELQD_ADDR").unwrap_or_else(|_| "127.0.0.1:6969".into());
-    let listener = tokio::net::TcpListener::bind(&addr).await?;
-    eprintln!("jelqd listening on http://{addr}");
-    axum::serve(listener, jelqd::app()).await
+    let config = jelqd::Config::from_env();
+    let listener = tokio::net::TcpListener::bind(&config.addr).await?;
+    eprintln!("jelqd listening on http://{}", config.addr);
+    axum::serve(listener, jelqd::app(config)).await
 }

Modified file: src/problem.rs+3 additions−2 deletions@@ -39,8 +39,9 @@ impl Problem {
     }
 
     pub fn header(mut self, name: HeaderName, value: impl AsRef<str>) -> Self {
-        let value = HeaderValue::from_str(value.as_ref()).expect("header values are visible ascii");
-        self.0.headers.append(name, value);
+        if let Ok(value) = HeaderValue::from_str(value.as_ref()) {
+            self.0.headers.append(name, value);
+        }
         self
     }
 }

Modified file: src/secret.rs+33 additions−27 deletions@@ -1,19 +1,9 @@
-use std::{fmt::Write as _, sync::LazyLock};
+use std::fmt::Write as _;
 
 use hmac::{Hmac, Mac};
 use sha2::Sha256;
 
-static SECRET: LazyLock<Vec<u8>> = LazyLock::new(|| {
-    std::env::var("JELQD_SECRET")
-        .map(String::into_bytes)
-        .unwrap_or_else(|_| rand::random::<[u8; 32]>().to_vec())
-});
-
-fn mac(message: &str) -> Hmac<Sha256> {
-    let mut mac = Hmac::<Sha256>::new_from_slice(&SECRET).expect("hmac accepts any key length");
-    mac.update(message.as_bytes());
-    mac
-}
+pub struct Secret(Vec<u8>);
 
 fn hex(bytes: &[u8]) -> String {
     bytes.iter().fold(String::new(), |mut out, b| {
@@ -32,21 +22,37 @@ fn unhex(text: &str) -> Option<Vec<u8>> {
         .collect()
 }
 
-pub fn sign(name: &str, value: &str) -> String {
-    let tag = mac(&format!("{name}={value}")).finalize().into_bytes();
-    format!("{value}.{}", hex(&tag))
-}
+impl Secret {
+    pub fn new(key: Vec<u8>) -> Self {
+        Self(key)
+    }
 
-pub fn verify<'a>(name: &str, signed: &'a str) -> Option<&'a str> {
-    let (value, tag) = signed.rsplit_once('.')?;
-    mac(&format!("{name}={value}"))
-        .verify_slice(&unhex(tag)?)
-        .ok()?;
-    Some(value)
-}
+    pub fn random() -> Self {
+        Self(rand::random::<[u8; 32]>().to_vec())
+    }
 
-/// Mixes the server secret into a seed, so a public seed and public source cannot predict rolls offline.
-pub fn mix_seed(seed: u64) -> u64 {
-    let tag = mac(&format!("seed={seed}")).finalize().into_bytes();
-    u64::from_le_bytes(tag[..8].try_into().expect("sha256 is longer than 8 bytes"))
+    fn mac(&self, message: &str) -> Hmac<Sha256> {
+        let mut mac = Hmac::<Sha256>::new_from_slice(&self.0).expect("hmac accepts any key length");
+        mac.update(message.as_bytes());
+        mac
+    }
+
+    pub fn sign(&self, name: &str, value: &str) -> String {
+        let tag = self.mac(&format!("{name}={value}")).finalize().into_bytes();
+        format!("{value}.{}", hex(&tag))
+    }
+
+    pub fn verify<'a>(&self, name: &str, signed: &'a str) -> Option<&'a str> {
+        let (value, tag) = signed.rsplit_once('.')?;
+        self.mac(&format!("{name}={value}"))
+            .verify_slice(&unhex(tag)?)
+            .ok()?;
+        Some(value)
+    }
+
+    /// Mixes the secret into a seed, so a public seed and public source cannot predict rolls offline.
+    pub fn mix_seed(&self, seed: u64) -> u64 {
+        let tag = self.mac(&format!("seed={seed}")).finalize().into_bytes();
+        u64::from_le_bytes(tag[..8].try_into().expect("sha256 is longer than 8 bytes"))
+    }
 }

Added file: src/tests.rs+682 additions@@ -0,0 +1,682 @@
+use std::{sync::Arc, time::Duration};
+
+use axum::{
+    Router,
+    body::{Body, to_bytes},
+    http::{Method, Request, StatusCode, Version, header},
+    response::Response,
+};
+use serde_json::Value;
+use tower::ServiceExt;
+
+use crate::{
+    AppState, Config,
+    game::{Floor, MomVisit, Run},
+    router,
+};
+
+async fn send(
+    app: &Router,
+    method: &str,
+    uri: &str,
+    headers: &[(&str, &str)],
+    body: &str,
+) -> Response {
+    let mut request = Request::builder()
+        .method(Method::from_bytes(method.as_bytes()).unwrap())
+        .uri(uri);
+    for (name, value) in headers {
+        request = request.header(*name, *value);
+    }
+    app.clone()
+        .oneshot(request.body(Body::from(body.to_owned())).unwrap())
+        .await
+        .unwrap()
+}
+
+async fn json(response: Response) -> Value {
+    serde_json::from_slice(&to_bytes(response.into_body(), usize::MAX).await.unwrap()).unwrap()
+}
+
+async fn text(response: Response) -> String {
+    String::from_utf8(
+        to_bytes(response.into_body(), usize::MAX)
+            .await
+            .unwrap()
+            .to_vec(),
+    )
+    .unwrap()
+}
+
+fn header<'a>(response: &'a Response, name: &str) -> &'a str {
+    response.headers()[name].to_str().unwrap()
+}
+
+fn fixture() -> Run {
+    Run::new("cafebabe".into(), "cafe".into(), 69)
+}
+
+fn seeded_with(floor: Floor, setup: impl FnOnce(&mut Run)) -> Router {
+    let state = Arc::new(AppState::default());
+    let mut run = fixture();
+    run.floor = floor;
+    setup(&mut run);
+    state.insert(run);
+    router(state)
+}
+
+fn seeded(floor: Floor) -> (Router, String) {
+    let state = Arc::new(AppState::default());
+    let mut run = fixture();
+    run.floor = floor;
+    let etag = run.origin_etag();
+    state.insert(run);
+    (router(state), etag)
+}
+
+fn app() -> Router {
+    crate::app(Config::default())
+}
+
+fn mom_at_the_door(run: &mut Run) {
+    run.mom = Some(MomVisit {
+        errand: "She heard a noise.",
+        nonce: "abc".into(),
+        strikes: 0,
+    });
+}
+
+#[tokio::test]
+async fn creating_a_run_returns_location_and_etag() {
+    let response = send(&app(), "POST", "/runs?seed=1", &[], "").await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+    assert!(header(&response, "location").starts_with("/runs/"));
+    assert!(response.headers().contains_key(header::ETAG));
+    assert_eq!(header(&response, "server"), "jelqd/0.6.9");
+}
+
+#[tokio::test]
+async fn bodies_do_not_repeat_the_headers() {
+    let (app, _) = seeded(Floor::Bedroom);
+    let response = send(&app, "GET", "/runs/cafebabe", &[], "").await;
+    assert!(response.headers().contains_key("x-eq"));
+    let body = json(response).await;
+    for stat in [
+        "eq",
+        "girth",
+        "foreskin",
+        "stamina",
+        "cash",
+        "self_reported_length",
+    ] {
+        assert!(body.get(stat).is_none(), "{stat} is already a header");
+    }
+}
+
+#[tokio::test]
+async fn jelqing_cold_fails_the_precondition() {
+    let (app, _) = seeded(Floor::Bedroom);
+    let response = send(&app, "JELQ", "/runs/cafebabe?technique=stretch", &[], "").await;
+    assert_eq!(response.status(), StatusCode::PRECONDITION_FAILED);
+    assert_eq!(
+        header(&response, "content-type"),
+        "application/problem+json"
+    );
+}
+
+#[tokio::test]
+async fn wet_without_lube_is_unsupported_media() {
+    let (app, _) = seeded(Floor::Bedroom);
+    send(&app, "JELQ", "/runs/cafebabe?technique=warmup", &[], "").await;
+    let response = send(&app, "JELQ", "/runs/cafebabe?technique=wet", &[], "").await;
+    assert_eq!(response.status(), StatusCode::UNSUPPORTED_MEDIA_TYPE);
+    let images = send(
+        &app,
+        "JELQ",
+        "/runs/cafebabe?technique=wet",
+        &[("content-type", "image/jpeg")],
+        "",
+    )
+    .await;
+    assert_eq!(json(images).await["detail"], "No.");
+}
+
+#[tokio::test]
+async fn unknown_methods_are_not_implemented() {
+    let (app, _) = seeded(Floor::Bedroom);
+    let response = send(&app, "MILK", "/runs/cafebabe", &[], "").await;
+    assert_eq!(response.status(), StatusCode::NOT_IMPLEMENTED);
+    let teapot = send(&app, "BREW", "/runs/cafebabe", &[], "").await;
+    assert_eq!(teapot.status(), StatusCode::IM_A_TEAPOT);
+}
+
+#[tokio::test]
+async fn the_clinic_does_not_advertise_jelq() {
+    let (app, _) = seeded(Floor::Clinic);
+    let options = send(&app, "OPTIONS", "/runs/cafebabe", &[], "").await;
+    assert!(!header(&options, "allow").contains("JELQ"));
+    let jelq = send(&app, "JELQ", "/runs/cafebabe?technique=wet", &[], "").await;
+    assert_eq!(jelq.status(), StatusCode::METHOD_NOT_ALLOWED);
+    assert!(!header(&jelq, "allow").contains("JELQ"));
+    let (bedroom, _) = seeded(Floor::Bedroom);
+    let options = send(&bedroom, "OPTIONS", "/runs/cafebabe", &[], "").await;
+    assert!(header(&options, "allow").contains("JELQ"));
+}
+
+#[tokio::test]
+async fn patch_only_accepts_the_truth() {
+    let (app, _) = seeded(Floor::Bedroom);
+    let patch = [("content-type", "application/json-patch+json")];
+    let replace = send(
+        &app,
+        "PATCH",
+        "/runs/cafebabe",
+        &patch,
+        r#"[{"op":"replace","path":"/length","value":12}]"#,
+    )
+    .await;
+    assert_eq!(replace.status(), StatusCode::UNPROCESSABLE_ENTITY);
+    let lie = send(
+        &app,
+        "PATCH",
+        "/runs/cafebabe",
+        &patch,
+        r#"[{"op":"test","path":"/length","value":40}]"#,
+    )
+    .await;
+    assert_eq!(
+        json(lie).await["type"],
+        "https://jelq.dev/problems/exaggeration"
+    );
+}
+
+#[tokio::test]
+async fn deleting_the_foreskin_requires_certainty() {
+    let (app, _) = seeded(Floor::Bedroom);
+    let response = send(&app, "DELETE", "/runs/cafebabe/foreskin", &[], "").await;
+    assert_eq!(response.status(), StatusCode::PRECONDITION_REQUIRED);
+    let look = send(&app, "GET", "/runs/cafebabe/foreskin", &[], "").await;
+    assert_eq!(look.status(), StatusCode::NO_CONTENT);
+    let etag = header(&look, "etag").to_owned();
+    let response = send(
+        &app,
+        "DELETE",
+        "/runs/cafebabe/foreskin",
+        &[("if-match", &etag)],
+        "",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::NO_CONTENT);
+    let response = send(&app, "GET", "/runs/cafebabe/foreskin", &[], "").await;
+    assert_eq!(response.status(), StatusCode::GONE);
+}
+
+#[tokio::test]
+async fn length_is_chunked_until_the_ruler() {
+    let (app, _) = seeded(Floor::Bedroom);
+    let lie = send(&app, "GET", "/runs/cafebabe/length", &[], "").await;
+    assert!(!lie.headers().contains_key(header::CONTENT_LENGTH));
+    let found = send(&app, "POST", "/runs/cafebabe/drawer", &[], "").await;
+    assert_eq!(found.status(), StatusCode::FOUND);
+    let truth = send(&app, "GET", "/runs/cafebabe/length", &[], "").await;
+    let declared: usize = header(&truth, "content-length").parse().unwrap();
+    let body = text(truth).await;
+    assert_eq!(body.len(), declared);
+    assert!(body.starts_with("8=") && body.ends_with('D'));
+}
+
+#[tokio::test]
+async fn length_supports_inch_ranges() {
+    let (app, _) = seeded(Floor::Bedroom);
+    let response = send(
+        &app,
+        "GET",
+        "/runs/cafebabe/length",
+        &[("range", "inches=0-1")],
+        "",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::PARTIAL_CONTENT);
+    assert!(header(&response, "content-range").starts_with("inches 0.00-1.00/"));
+    assert_eq!(text(response).await.len(), 25);
+    let absurd = send(
+        &app,
+        "GET",
+        "/runs/cafebabe/length",
+        &[("range", "inches=40-50")],
+        "",
+    )
+    .await;
+    assert_eq!(absurd.status(), StatusCode::RANGE_NOT_SATISFIABLE);
+}
+
+#[tokio::test]
+async fn the_clinic_escalates_toward_honesty() {
+    let (app, _) = seeded(Floor::Clinic);
+    let mut hints = Vec::new();
+    for _ in 0..3 {
+        let response = send(
+            &app,
+            "GET",
+            "/runs/cafebabe/diagnosis",
+            &[("authorization", "Excuse \"changing\"")],
+            "",
+        )
+        .await;
+        assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+        hints.push(header(&response, "www-authenticate").to_owned());
+    }
+    assert!(hints[2].contains("Be honest."));
+}
+
+#[tokio::test]
+async fn the_true_ending_is_not_modified() {
+    let (early, _) = seeded(Floor::Bedroom);
+    let response = send(&early, "GET", "/runs/cafebabe/diagnosis", &[], "").await;
+    assert_eq!(response.status(), StatusCode::TOO_EARLY);
+
+    let (app, etag) = seeded(Floor::Clinic);
+    assert!(
+        !etag.contains("cafebabe"),
+        "the origin ETag must not be derivable from the id"
+    );
+    let response = send(
+        &app,
+        "GET",
+        "/runs/cafebabe/diagnosis",
+        &[
+            ("authorization", "Bearer honesty"),
+            ("if-none-match", &etag),
+        ],
+        "",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::NOT_MODIFIED);
+    assert_eq!(header(&response, "x-diagnosis"), "normal");
+}
+
+#[tokio::test]
+async fn mom_accepts_a_known_excuse() {
+    let app = seeded_with(Floor::Bedroom, mom_at_the_door);
+    let response = send(&app, "GET", "/runs/cafebabe", &[], "").await;
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+    assert_eq!(header(&response, "via"), "1.1 mom");
+    let response = send(
+        &app,
+        "GET",
+        "/runs/cafebabe",
+        &[("authorization", "Excuse \"homework\"")],
+        "",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn mom_runs_out_of_patience() {
+    let app = seeded_with(Floor::Bedroom, mom_at_the_door);
+    let lie = [("authorization", "Excuse \"it is for science\"")];
+    for _ in 0..2 {
+        let response = send(&app, "GET", "/runs/cafebabe", &lie, "").await;
+        assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+    }
+    let caught = send(&app, "GET", "/runs/cafebabe", &lie, "").await;
+    assert_eq!(caught.status(), StatusCode::GONE);
+    assert_eq!(
+        json(caught).await["type"],
+        "https://jelq.dev/problems/caught"
+    );
+}
+
+#[tokio::test]
+async fn mom_remembers_excuses_by_thanksgiving() {
+    let app = seeded_with(Floor::Grandmas, |run| {
+        mom_at_the_door(run);
+        run.heard.push("homework".into());
+    });
+    let basic = send(
+        &app,
+        "GET",
+        "/runs/cafebabe",
+        &[("authorization", "Excuse \"changing\"")],
+        "",
+    )
+    .await;
+    assert_eq!(basic.status(), StatusCode::UNAUTHORIZED);
+    assert!(header(&basic, "www-authenticate").starts_with("Digest"));
+    let replay = send(
+        &app,
+        "GET",
+        "/runs/cafebabe",
+        &[(
+            "authorization",
+            "Digest username=\"homework\", nonce=\"abc\"",
+        )],
+        "",
+    )
+    .await;
+    assert_eq!(
+        json(replay).await["type"],
+        "https://jelq.dev/problems/excuse-replayed"
+    );
+    let fresh = send(
+        &app,
+        "GET",
+        "/runs/cafebabe",
+        &[(
+            "authorization",
+            "Digest username=\"praying\", nonce=\"abc\"",
+        )],
+        "",
+    )
+    .await;
+    assert_eq!(fresh.status(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn a_pulled_muscle_is_a_true_excuse() {
+    let app = seeded_with(Floor::Grandmas, |run| {
+        mom_at_the_door(run);
+        run.conditions.pulled_muscle = true;
+        run.heard.push("pulled a muscle".into());
+    });
+    let response = send(
+        &app,
+        "GET",
+        "/runs/cafebabe",
+        &[(
+            "authorization",
+            "Digest username=\"pulled a muscle\", nonce=\"abc\"",
+        )],
+        "",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    assert!(header(&response, "x-stamina").ends_with("/7"));
+}
+
+#[tokio::test]
+async fn floors_end_when_they_end() {
+    let app = seeded_with(Floor::Bedroom, |_| {});
+    let early = send(&app, "POST", "/runs/cafebabe/floor", &[], "").await;
+    assert_eq!(early.status(), StatusCode::TOO_EARLY);
+    let app = seeded_with(Floor::Bedroom, |run| run.here.turns = 6);
+    let next = send(&app, "POST", "/runs/cafebabe/floor", &[], "").await;
+    assert!(
+        next.status() == StatusCode::SEE_OTHER || next.status() == StatusCode::CONFLICT,
+        "either the floor changed or the zipper did"
+    );
+}
+
+#[tokio::test]
+async fn pump_bro_upsells() {
+    let closed = seeded_with(Floor::Bedroom, |_| {});
+    let response = send(&closed, "GET", "/runs/cafebabe/shop", &[], "").await;
+    assert_eq!(response.status(), StatusCode::NOT_FOUND);
+
+    let app = seeded_with(Floor::LockerRoom, |_| {});
+    let pump = send(&app, "POST", "/runs/cafebabe/shop/pump", &[], "").await;
+    assert_eq!(pump.status(), StatusCode::UPGRADE_REQUIRED);
+    assert_eq!(header(&pump, "upgrade"), "pump-pro/2.0");
+    let pro = send(&app, "POST", "/runs/cafebabe/shop/pump-pro", &[], "").await;
+    assert_eq!(pro.status(), StatusCode::CREATED);
+    let broke = send(&app, "POST", "/runs/cafebabe/shop/extender", &[], "").await;
+    assert_eq!(broke.status(), StatusCode::PAYMENT_REQUIRED);
+}
+
+#[tokio::test]
+async fn only_the_key_opens_the_cage() {
+    let app = seeded_with(Floor::LockerRoom, |run| run.items.cage = true);
+    send(&app, "POST", "/runs/cafebabe/shop/ice-pack", &[], "").await;
+    let still = send(
+        &app,
+        "GET",
+        "/runs/cafebabe/inventory/chastity-cage",
+        &[],
+        "",
+    )
+    .await;
+    assert_eq!(still.status(), StatusCode::OK);
+    send(&app, "POST", "/runs/cafebabe/shop/cage-key", &[], "").await;
+    let gone = send(
+        &app,
+        "GET",
+        "/runs/cafebabe/inventory/chastity-cage",
+        &[],
+        "",
+    )
+    .await;
+    assert_eq!(gone.status(), StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn combos_are_multi_status_xml() {
+    let app = seeded_with(Floor::Bathroom, |run| {
+        run.foreskin = Some(1.0);
+        run.items.blinds = true;
+    });
+    send(&app, "JELQ", "/runs/cafebabe?technique=warmup", &[], "").await;
+    let response = send(
+        &app,
+        "JELQ",
+        "/runs/cafebabe?technique=wet,stretch",
+        &[("content-type", "application/baby-oil")],
+        "",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::MULTI_STATUS);
+    assert!(text(response).await.contains("<D:multistatus"));
+}
+
+#[tokio::test]
+async fn the_elder_is_stale() {
+    let app = seeded_with(Floor::Forum, |run| run.length = 5.0);
+    let unverified = send(&app, "GET", "/runs/cafebabe/elder", &[], "").await;
+    assert_eq!(
+        unverified.status(),
+        StatusCode::PROXY_AUTHENTICATION_REQUIRED
+    );
+    let lie = send(
+        &app,
+        "GET",
+        "/runs/cafebabe/elder",
+        &[("proxy-authorization", "Ruler 9")],
+        "",
+    )
+    .await;
+    assert_eq!(lie.status(), StatusCode::BAD_REQUEST);
+    let csv = send(
+        &app,
+        "GET",
+        "/runs/cafebabe/elder",
+        &[("proxy-authorization", "Ruler 5.0")],
+        "",
+    )
+    .await;
+    assert_eq!(csv.status(), StatusCode::OK);
+    let stale = send(
+        &app,
+        "GET",
+        "/runs/cafebabe/elder",
+        &[("if-modified-since", "Mon, 15 Jun 2009 00:00:00 GMT")],
+        "",
+    )
+    .await;
+    assert_eq!(stale.status(), StatusCode::NOT_MODIFIED);
+}
+
+#[tokio::test]
+async fn the_displayed_length_is_accepted_as_honest() {
+    let app = seeded_with(Floor::Forum, |run| run.length = 5.2496);
+    let response = send(
+        &app,
+        "GET",
+        "/runs/cafebabe/elder",
+        &[("proxy-authorization", "Ruler 5.25")],
+        "",
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn the_hotel_has_a_captive_portal() {
+    let app = seeded_with(Floor::Hotel, |_| {});
+    let blocked = send(&app, "GET", "/runs/cafebabe", &[], "").await;
+    assert_eq!(
+        blocked.status(),
+        StatusCode::NETWORK_AUTHENTICATION_REQUIRED
+    );
+    let accepted = send(&app, "POST", "/runs/cafebabe/portal", &[], "").await;
+    assert_eq!(accepted.status(), StatusCode::SEE_OTHER);
+    let online = send(&app, "GET", "/runs/cafebabe", &[], "").await;
+    assert_eq!(online.status(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn the_internet_never_forgets() {
+    let app = seeded_with(Floor::Bedroom, |run| {
+        run.filmed_at = Some(std::time::SystemTime::now());
+    });
+    let footage = send(&app, "GET", "/runs/cafebabe/footage", &[], "").await;
+    assert_eq!(footage.status(), StatusCode::OK);
+    assert_eq!(
+        header(&footage, "cache-control"),
+        "public, max-age=31536000, immutable"
+    );
+    assert!(footage.headers().contains_key(header::AGE));
+    let delete = send(&app, "DELETE", "/runs/cafebabe/footage", &[], "").await;
+    assert_eq!(delete.status(), StatusCode::METHOD_NOT_ALLOWED);
+    assert!(!header(&delete, "allow").contains("DELETE"));
+}
+
+#[tokio::test]
+async fn forged_ruler_cookies_are_lies() {
+    let forged = send(
+        &app(),
+        "GET",
+        "/leaderboard?sort=content-length",
+        &[("cookie", "ruler=1")],
+        "",
+    )
+    .await;
+    assert_eq!(forged.status(), StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn listings_never_reveal_the_private_id() {
+    let app = app();
+    let created = send(&app, "POST", "/runs", &[], "").await;
+    let location = header(&created, "location").to_owned();
+    let board = text(send(&app, "GET", "/leaderboard", &[], "").await).await;
+    let private = location.trim_start_matches("/runs/");
+    assert!(!board.contains(private));
+    let entry: Value = serde_json::from_str(&board).unwrap();
+    let public = entry["entries"][0]["public_id"].as_str().unwrap();
+    let guess = send(&app, "DELETE", &format!("/runs/{public}"), &[], "").await;
+    assert_eq!(guess.status(), StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn seeded_runs_are_unranked() {
+    let app = app();
+    send(&app, "POST", "/runs?seed=7", &[], "").await;
+    let board = json(send(&app, "GET", "/leaderboard", &[], "").await).await;
+    assert_eq!(board["entries"].as_array().unwrap().len(), 0);
+    let all = json(send(&app, "GET", "/leaderboard?seeded=include", &[], "").await).await;
+    assert_eq!(all["entries"][0]["ranked"], false);
+}
+
+#[tokio::test]
+async fn idle_runs_are_evicted_and_the_server_has_a_limit() {
+    let forgetful = crate::app(Config {
+        idle_ttl: Duration::ZERO,
+        ..Config::default()
+    });
+    let first = send(&forgetful, "POST", "/runs", &[], "").await;
+    let location = header(&first, "location").to_owned();
+    send(&forgetful, "POST", "/runs", &[], "").await;
+    let gone = send(&forgetful, "GET", &location, &[], "").await;
+    assert_eq!(gone.status(), StatusCode::NOT_FOUND);
+
+    let tiny = crate::app(Config {
+        max_runs: 1,
+        ..Config::default()
+    });
+    send(&tiny, "POST", "/runs", &[], "").await;
+    let full = send(&tiny, "POST", "/runs", &[], "").await;
+    assert_eq!(full.status(), StatusCode::SERVICE_UNAVAILABLE);
+}
+
+#[tokio::test]
+async fn shame_from_two_runs_adds_up() {
+    let state = Arc::new(AppState::default());
+    state.insert(fixture());
+    state.insert(Run::new("deadbeef".into(), "dead".into(), 7));
+    let app = router(state);
+    let first = send(&app, "TRACE", "/runs/cafebabe", &[], "").await;
+    assert_eq!(header(&first, "x-shame"), "1");
+    let cookie = header(&first, "set-cookie")
+        .split(';')
+        .next()
+        .unwrap()
+        .to_owned();
+    let second = send(&app, "TRACE", "/runs/deadbeef", &[("cookie", &cookie)], "").await;
+    assert_eq!(header(&second, "x-shame"), "2");
+}
+
+#[tokio::test]
+async fn the_root_negotiates() {
+    let app = app();
+    let browser = send(&app, "GET", "/", &[("accept", "text/html,*/*")], "").await;
+    assert_eq!(browser.status(), StatusCode::SEE_OTHER);
+    assert_eq!(header(&browser, "location"), "/ui/");
+    let curl = send(&app, "GET", "/", &[("accept", "*/*")], "").await;
+    assert_eq!(json(curl).await["ui"], "/ui/");
+    let page = send(&app, "GET", "/ui/", &[], "").await;
+    assert_eq!(page.status(), StatusCode::OK);
+}
+
+#[tokio::test]
+async fn the_ui_replays_what_browsers_cannot_send() {
+    let app = app();
+    let envelope =
+        r#"{"method": "TRACE", "path": "/graveyard", "headers": [["X-Confession", "I did it"]]}"#;
+    let traced = json(send(&app, "POST", "/ui/send", &[], envelope).await).await;
+    assert_eq!(traced["status"], 405);
+    let envelope = r#"{"method": "GET", "path": "/", "headers": [["Accept", "text/html"]]}"#;
+    let redirected = json(send(&app, "POST", "/ui/send", &[], envelope).await).await;
+    assert_eq!(redirected["status"], 303);
+    assert_eq!(redirected["reason"], "See Other");
+}
+
+#[tokio::test]
+async fn the_ui_decodes_gzip_for_display() {
+    let app = seeded_with(Floor::Bedroom, |run| run.items.ring = true);
+    let envelope =
+        r#"{"method": "GET", "path": "/runs/cafebabe", "headers": [["Accept-Encoding", "gzip"]]}"#;
+    let shown = json(send(&app, "POST", "/ui/send", &[], envelope).await).await;
+    assert!(
+        shown["body"]
+            .as_str()
+            .unwrap()
+            .contains("\"public_id\":\"cafe\"")
+    );
+    let encoding = shown["headers"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .any(|h| h[0] == "content-encoding" && h[1] == "gzip");
+    assert!(encoding);
+}
+
+#[tokio::test]
+async fn http_1_0_gets_the_pdf_treatment() {
+    let request = Request::builder()
+        .uri("/graveyard")
+        .version(Version::HTTP_10)
+        .body(Body::empty())
+        .unwrap();
+    let response = app().oneshot(request).await.unwrap();
+    assert_eq!(response.status(), StatusCode::HTTP_VERSION_NOT_SUPPORTED);
+}

Modified file: src/ui.html+1

@@ -3,6 +3,7 @@

33 <head>

44 <meta charset="utf-8">

55 <title>jelqd</title>

6+<style>pre { white-space: pre-wrap; } pre, li, p { overflow-wrap: anywhere; }</style>

67 </head>

78 <body>

Deleted file: tests/http.rs−570 deletions@@ -1,570 +0,0 @@
-use std::sync::Arc;
-
-use axum::{
-    Router,
-    body::{Body, to_bytes},
-    http::{Method, Request, StatusCode, header},
-    response::Response,
-};
-use jelqd::{
-    AppState,
-    game::{Floor, Run},
-    router,
-};
-use serde_json::Value;
-use tower::ServiceExt;
-
-async fn send(
-    app: &Router,
-    method: &str,
-    uri: &str,
-    headers: &[(&str, &str)],
-    body: &str,
-) -> Response {
-    let mut request = Request::builder()
-        .method(Method::from_bytes(method.as_bytes()).unwrap())
-        .uri(uri);
-    for (name, value) in headers {
-        request = request.header(*name, *value);
-    }
-    app.clone()
-        .oneshot(request.body(Body::from(body.to_owned())).unwrap())
-        .await
-        .unwrap()
-}
-
-async fn json(response: Response) -> Value {
-    serde_json::from_slice(&to_bytes(response.into_body(), usize::MAX).await.unwrap()).unwrap()
-}
-
-fn seeded(floor: Floor) -> (Router, String) {
-    let state = Arc::new(AppState::default());
-    let mut run = Run::new("cafebabe".into(), 69, 0);
-    run.floor = floor;
-    let etag = run.origin_etag.clone();
-    state.insert(run);
-    (router(state), etag)
-}
-
-#[tokio::test]
-async fn creating_a_run_returns_location_and_etag() {
-    let app = jelqd::app();
-    let response = send(&app, "POST", "/runs?seed=1", &[], "").await;
-    assert_eq!(response.status(), StatusCode::CREATED);
-    assert!(response.headers().contains_key(header::LOCATION));
-    assert!(response.headers().contains_key(header::ETAG));
-    assert_eq!(response.headers()[header::SERVER], "jelqd/0.6.9");
-}
-
-#[tokio::test]
-async fn jelqing_cold_fails_the_precondition() {
-    let (app, _) = seeded(Floor::Bedroom);
-    let response = send(&app, "JELQ", "/runs/cafebabe?technique=stretch", &[], "").await;
-    assert_eq!(response.status(), StatusCode::PRECONDITION_FAILED);
-    assert_eq!(
-        response.headers()[header::CONTENT_TYPE],
-        "application/problem+json"
-    );
-}
-
-#[tokio::test]
-async fn wet_without_lube_is_unsupported_media() {
-    let (app, _) = seeded(Floor::Bedroom);
-    send(&app, "JELQ", "/runs/cafebabe?technique=warmup", &[], "").await;
-    let response = send(&app, "JELQ", "/runs/cafebabe?technique=wet", &[], "").await;
-    assert_eq!(response.status(), StatusCode::UNSUPPORTED_MEDIA_TYPE);
-    let images = send(
-        &app,
-        "JELQ",
-        "/runs/cafebabe?technique=wet",
-        &[("content-type", "image/jpeg")],
-        "",
-    )
-    .await;
-    assert_eq!(json(images).await["detail"], "No.");
-}
-
-#[tokio::test]
-async fn unknown_methods_are_not_implemented() {
-    let (app, _) = seeded(Floor::Bedroom);
-    let response = send(&app, "MILK", "/runs/cafebabe", &[], "").await;
-    assert_eq!(response.status(), StatusCode::NOT_IMPLEMENTED);
-}
-
-#[tokio::test]
-async fn patch_only_accepts_the_truth() {
-    let (app, _) = seeded(Floor::Bedroom);
-    let patch = [("content-type", "application/json-patch+json")];
-    let replace = send(
-        &app,
-        "PATCH",
-        "/runs/cafebabe",
-        &patch,
-        r#"[{"op":"replace","path":"/length","value":12}]"#,
-    )
-    .await;
-    assert_eq!(replace.status(), StatusCode::UNPROCESSABLE_ENTITY);
-    let lie = send(
-        &app,
-        "PATCH",
-        "/runs/cafebabe",
-        &patch,
-        r#"[{"op":"test","path":"/length","value":40}]"#,
-    )
-    .await;
-    assert_eq!(
-        json(lie).await["type"],
-        "https://jelq.dev/problems/exaggeration"
-    );
-}
-
-#[tokio::test]
-async fn deleting_the_foreskin_requires_certainty() {
-    let (app, _) = seeded(Floor::Bedroom);
-    let response = send(&app, "DELETE", "/runs/cafebabe/foreskin", &[], "").await;
-    assert_eq!(response.status(), StatusCode::PRECONDITION_REQUIRED);
-    let etag = send(&app, "GET", "/runs/cafebabe/foreskin", &[], "")
-        .await
-        .headers()[header::ETAG]
-        .to_str()
-        .unwrap()
-        .to_owned();
-    let response = send(
-        &app,
-        "DELETE",
-        "/runs/cafebabe/foreskin",
-        &[("if-match", &etag)],
-        "",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::NO_CONTENT);
-    let response = send(&app, "GET", "/runs/cafebabe/foreskin", &[], "").await;
-    assert_eq!(response.status(), StatusCode::GONE);
-}
-
-#[tokio::test]
-async fn length_is_chunked_until_the_ruler() {
-    let (app, _) = seeded(Floor::Bedroom);
-    let lie = send(&app, "GET", "/runs/cafebabe/length", &[], "").await;
-    assert!(!lie.headers().contains_key(header::CONTENT_LENGTH));
-    let found = send(&app, "POST", "/runs/cafebabe/drawer", &[], "").await;
-    assert_eq!(found.status(), StatusCode::FOUND);
-    let truth = send(&app, "GET", "/runs/cafebabe/length", &[], "").await;
-    let declared: usize = truth.headers()[header::CONTENT_LENGTH]
-        .to_str()
-        .unwrap()
-        .parse()
-        .unwrap();
-    let body = to_bytes(truth.into_body(), usize::MAX).await.unwrap();
-    assert_eq!(body.len(), declared);
-    assert!(body.starts_with(b"8=") && body.ends_with(b"D"));
-}
-
-#[tokio::test]
-async fn the_clinic_escalates_toward_honesty() {
-    let (app, _) = seeded(Floor::Clinic);
-    let mut hints = Vec::new();
-    for _ in 0..3 {
-        let response = send(
-            &app,
-            "GET",
-            "/runs/cafebabe/diagnosis",
-            &[("authorization", "Excuse \"changing\"")],
-            "",
-        )
-        .await;
-        assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
-        hints.push(
-            response.headers()[header::WWW_AUTHENTICATE]
-                .to_str()
-                .unwrap()
-                .to_owned(),
-        );
-    }
-    assert!(hints[2].contains("Be honest."));
-}
-
-#[tokio::test]
-async fn the_true_ending_is_not_modified() {
-    let (app, etag) = seeded(Floor::Clinic);
-    let early = seeded(Floor::Bedroom).0;
-    let response = send(&early, "GET", "/runs/cafebabe/diagnosis", &[], "").await;
-    assert_eq!(response.status(), StatusCode::TOO_EARLY);
-
-    let response = send(
-        &app,
-        "GET",
-        "/runs/cafebabe/diagnosis",
-        &[
-            ("authorization", "Bearer honesty"),
-            ("if-none-match", &etag),
-        ],
-        "",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::NOT_MODIFIED);
-    assert_eq!(response.headers()["x-diagnosis"], "normal");
-}
-
-#[tokio::test]
-async fn mom_accepts_a_known_excuse() {
-    let state = Arc::new(AppState::default());
-    let mut run = Run::new("cafebabe".into(), 69, 0);
-    run.mom_present = true;
-    state.insert(run);
-    let app = router(state);
-    let response = send(&app, "GET", "/runs/cafebabe", &[], "").await;
-    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
-    assert_eq!(response.headers()["via"], "1.1 mom");
-    let response = send(
-        &app,
-        "GET",
-        "/runs/cafebabe",
-        &[("authorization", "Excuse \"homework\"")],
-        "",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::OK);
-}
-
-fn seeded_with(floor: Floor, setup: impl FnOnce(&mut Run)) -> Router {
-    let state = Arc::new(AppState::default());
-    let mut run = Run::new("cafebabe".into(), 69, 0);
-    run.floor = floor;
-    setup(&mut run);
-    state.insert(run);
-    router(state)
-}
-
-#[tokio::test]
-async fn floors_end_when_they_end() {
-    let app = seeded_with(Floor::Bedroom, |_| {});
-    let early = send(&app, "POST", "/runs/cafebabe/floor", &[], "").await;
-    assert_eq!(early.status(), StatusCode::TOO_EARLY);
-    let app = seeded_with(Floor::Bedroom, |run| run.floor_turns = 6);
-    let next = send(&app, "POST", "/runs/cafebabe/floor", &[], "").await;
-    assert_eq!(next.status(), StatusCode::SEE_OTHER);
-    assert_eq!(next.headers()["x-floor"], "2");
-}
-
-#[tokio::test]
-async fn pump_bro_upsells() {
-    let closed = seeded_with(Floor::Bedroom, |_| {});
-    let response = send(&closed, "GET", "/runs/cafebabe/shop", &[], "").await;
-    assert_eq!(response.status(), StatusCode::NOT_FOUND);
-
-    let app = seeded_with(Floor::LockerRoom, |_| {});
-    let pump = send(&app, "POST", "/runs/cafebabe/shop/pump", &[], "").await;
-    assert_eq!(pump.status(), StatusCode::UPGRADE_REQUIRED);
-    assert_eq!(pump.headers()[header::UPGRADE], "pump-pro/2.0");
-    let pro = send(&app, "POST", "/runs/cafebabe/shop/pump-pro", &[], "").await;
-    assert_eq!(pro.status(), StatusCode::CREATED);
-    let broke = send(&app, "POST", "/runs/cafebabe/shop/extender", &[], "").await;
-    assert_eq!(broke.status(), StatusCode::PAYMENT_REQUIRED);
-}
-
-#[tokio::test]
-async fn combos_are_multi_status_xml() {
-    let app = seeded_with(Floor::Bedroom, |run| run.foreskin = Some(1.0));
-    send(&app, "JELQ", "/runs/cafebabe?technique=warmup", &[], "").await;
-    let response = send(
-        &app,
-        "JELQ",
-        "/runs/cafebabe?technique=wet,stretch",
-        &[("content-type", "application/baby-oil")],
-        "",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::MULTI_STATUS);
-    let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
-    assert!(String::from_utf8_lossy(&body).contains("<D:multistatus"));
-}
-
-#[tokio::test]
-async fn the_elder_is_stale() {
-    let app = seeded_with(Floor::Forum, |run| run.length = 5.0);
-    let unverified = send(&app, "GET", "/runs/cafebabe/elder", &[], "").await;
-    assert_eq!(
-        unverified.status(),
-        StatusCode::PROXY_AUTHENTICATION_REQUIRED
-    );
-    let lie = send(
-        &app,
-        "GET",
-        "/runs/cafebabe/elder",
-        &[("proxy-authorization", "Ruler 9")],
-        "",
-    )
-    .await;
-    assert_eq!(lie.status(), StatusCode::BAD_REQUEST);
-    let csv = send(
-        &app,
-        "GET",
-        "/runs/cafebabe/elder",
-        &[("proxy-authorization", "Ruler 5.0")],
-        "",
-    )
-    .await;
-    assert_eq!(csv.status(), StatusCode::OK);
-    let stale = send(
-        &app,
-        "GET",
-        "/runs/cafebabe/elder",
-        &[("if-modified-since", "Mon, 15 Jun 2009 00:00:00 GMT")],
-        "",
-    )
-    .await;
-    assert_eq!(stale.status(), StatusCode::NOT_MODIFIED);
-    let exit = send(&app, "POST", "/runs/cafebabe/floor", &[], "").await;
-    assert_eq!(exit.status(), StatusCode::SEE_OTHER);
-}
-
-#[tokio::test]
-async fn the_hotel_has_a_captive_portal() {
-    let app = seeded_with(Floor::Hotel, |_| {});
-    let blocked = send(&app, "GET", "/runs/cafebabe", &[], "").await;
-    assert_eq!(
-        blocked.status(),
-        StatusCode::NETWORK_AUTHENTICATION_REQUIRED
-    );
-    let accepted = send(&app, "POST", "/runs/cafebabe/portal", &[], "").await;
-    assert_eq!(accepted.status(), StatusCode::SEE_OTHER);
-    let online = send(&app, "GET", "/runs/cafebabe", &[], "").await;
-    assert_eq!(online.status(), StatusCode::OK);
-}
-
-#[tokio::test]
-async fn mom_remembers_excuses_by_thanksgiving() {
-    let app = seeded_with(Floor::Grandmas, |run| {
-        run.mom_present = true;
-        run.nonce = "abc".into();
-        run.heard.push("homework".into());
-    });
-    let basic = send(
-        &app,
-        "GET",
-        "/runs/cafebabe",
-        &[("authorization", "Excuse \"changing\"")],
-        "",
-    )
-    .await;
-    assert_eq!(basic.status(), StatusCode::UNAUTHORIZED);
-    assert!(
-        basic.headers()[header::WWW_AUTHENTICATE]
-            .to_str()
-            .unwrap()
-            .starts_with("Digest")
-    );
-    let replay = send(
-        &app,
-        "GET",
-        "/runs/cafebabe",
-        &[(
-            "authorization",
-            "Digest username=\"homework\", nonce=\"abc\"",
-        )],
-        "",
-    )
-    .await;
-    assert_eq!(
-        json(replay).await["type"],
-        "https://jelq.dev/problems/excuse-replayed"
-    );
-    let fresh = send(
-        &app,
-        "GET",
-        "/runs/cafebabe",
-        &[(
-            "authorization",
-            "Digest username=\"praying\", nonce=\"abc\"",
-        )],
-        "",
-    )
-    .await;
-    assert_eq!(fresh.status(), StatusCode::OK);
-}
-
-#[tokio::test]
-async fn length_supports_inch_ranges() {
-    let app = seeded_with(Floor::Bedroom, |_| {});
-    let response = send(
-        &app,
-        "GET",
-        "/runs/cafebabe/length",
-        &[("range", "inches=0-1")],
-        "",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::PARTIAL_CONTENT);
-    assert!(
-        response.headers()[header::CONTENT_RANGE]
-            .to_str()
-            .unwrap()
-            .starts_with("inches 0.00-1.00/")
-    );
-    let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
-    assert_eq!(body.len(), 25);
-    let absurd = send(
-        &app,
-        "GET",
-        "/runs/cafebabe/length",
-        &[("range", "inches=40-50")],
-        "",
-    )
-    .await;
-    assert_eq!(absurd.status(), StatusCode::RANGE_NOT_SATISFIABLE);
-}
-
-#[tokio::test]
-async fn http_1_0_gets_the_pdf_treatment() {
-    let request = Request::builder()
-        .uri("/graveyard")
-        .version(axum::http::Version::HTTP_10)
-        .body(Body::empty())
-        .unwrap();
-    let response = jelqd::app().oneshot(request).await.unwrap();
-    assert_eq!(response.status(), StatusCode::HTTP_VERSION_NOT_SUPPORTED);
-}
-
-#[tokio::test]
-async fn the_displayed_length_is_accepted_as_honest() {
-    let app = seeded_with(Floor::Forum, |run| run.length = 5.2496);
-    let response = send(
-        &app,
-        "GET",
-        "/runs/cafebabe/elder",
-        &[("proxy-authorization", "Ruler 5.25")],
-        "",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::OK);
-}
-
-#[tokio::test]
-async fn mom_runs_out_of_patience() {
-    let app = seeded_with(Floor::Bedroom, |run| run.mom_present = true);
-    let lie = [("authorization", "Excuse \"it is for science\"")];
-    for _ in 0..2 {
-        let response = send(&app, "GET", "/runs/cafebabe", &lie, "").await;
-        assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
-    }
-    let caught = send(&app, "GET", "/runs/cafebabe", &lie, "").await;
-    assert_eq!(caught.status(), StatusCode::GONE);
-    assert_eq!(
-        json(caught).await["type"],
-        "https://jelq.dev/problems/caught"
-    );
-}
-
-#[tokio::test]
-async fn forged_ruler_cookies_are_lies() {
-    let app = jelqd::app();
-    let forged = send(
-        &app,
-        "GET",
-        "/leaderboard?sort=content-length",
-        &[("cookie", "ruler=1")],
-        "",
-    )
-    .await;
-    assert_eq!(forged.status(), StatusCode::BAD_REQUEST);
-}
-
-#[tokio::test]
-async fn seeded_runs_are_unranked() {
-    let app = jelqd::app();
-    send(&app, "POST", "/runs?seed=7", &[], "").await;
-    let board = json(send(&app, "GET", "/leaderboard", &[], "").await).await;
-    assert_eq!(board["entries"].as_array().unwrap().len(), 0);
-    let all = json(send(&app, "GET", "/leaderboard?seeded=include", &[], "").await).await;
-    assert_eq!(all["entries"][0]["ranked"], false);
-}
-
-#[tokio::test]
-async fn the_root_negotiates() {
-    let app = jelqd::app();
-    let browser = send(&app, "GET", "/", &[("accept", "text/html,*/*")], "").await;
-    assert_eq!(browser.status(), StatusCode::SEE_OTHER);
-    assert_eq!(browser.headers()[header::LOCATION], "/ui/");
-    let curl = send(&app, "GET", "/", &[("accept", "*/*")], "").await;
-    assert_eq!(json(curl).await["ui"], "/ui/");
-    let page = send(&app, "GET", "/ui/", &[], "").await;
-    assert_eq!(page.status(), StatusCode::OK);
-}
-
-#[tokio::test]
-async fn the_ui_replays_what_browsers_cannot_send() {
-    let app = jelqd::app();
-    let envelope =
-        r#"{"method": "TRACE", "path": "/graveyard", "headers": [["X-Confession", "I did it"]]}"#;
-    let traced = json(send(&app, "POST", "/ui/send", &[], envelope).await).await;
-    assert_eq!(traced["status"], 405);
-    let envelope = r#"{"method": "GET", "path": "/", "headers": [["Accept", "text/html"]]}"#;
-    let redirected = json(send(&app, "POST", "/ui/send", &[], envelope).await).await;
-    assert_eq!(redirected["status"], 303);
-    assert_eq!(redirected["reason"], "See Other");
-}
-
-#[tokio::test]
-async fn the_internet_never_forgets() {
-    let app = seeded_with(Floor::Bedroom, |run| {
-        run.filmed_at = Some(std::time::SystemTime::now());
-    });
-    let footage = send(&app, "GET", "/runs/cafebabe/footage", &[], "").await;
-    assert_eq!(footage.status(), StatusCode::OK);
-    assert_eq!(
-        footage.headers()[header::CACHE_CONTROL],
-        "public, max-age=31536000, immutable"
-    );
-    assert!(footage.headers().contains_key(header::AGE));
-    let delete = send(&app, "DELETE", "/runs/cafebabe/footage", &[], "").await;
-    assert_eq!(delete.status(), StatusCode::METHOD_NOT_ALLOWED);
-}
-
-#[tokio::test]
-async fn a_pulled_muscle_is_a_true_excuse() {
-    let app = seeded_with(Floor::Grandmas, |run| {
-        run.mom_present = true;
-        run.nonce = "abc".into();
-        run.pulled_muscle = true;
-        run.heard.push("pulled a muscle".into());
-    });
-    let response = send(
-        &app,
-        "GET",
-        "/runs/cafebabe",
-        &[(
-            "authorization",
-            "Digest username=\"pulled a muscle\", nonce=\"abc\"",
-        )],
-        "",
-    )
-    .await;
-    assert_eq!(response.status(), StatusCode::OK);
-    assert!(
-        response.headers()["x-stamina"]
-            .to_str()
-            .unwrap()
-            .ends_with("/7")
-    );
-}
-
-#[tokio::test]
-async fn the_ui_decodes_gzip_for_display() {
-    let app = seeded_with(Floor::Bedroom, |run| run.items.ring = true);
-    let envelope =
-        r#"{"method": "GET", "path": "/runs/cafebabe", "headers": [["Accept-Encoding", "gzip"]]}"#;
-    let shown = json(send(&app, "POST", "/ui/send", &[], envelope).await).await;
-    assert!(
-        shown["body"]
-            .as_str()
-            .unwrap()
-            .contains("\"id\":\"cafebabe\"")
-    );
-    let encoding = shown["headers"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .any(|h| h[0] == "content-encoding" && h[1] == "gzip");
-    assert!(encoding);
-}

show truncated diff

jelq

Commit 782069860236

Commit `782069860236`