Merge branch 'main' into feature/dynasty-list-parity

# Conflicts:
#	tools/frontend-legacy-parity/playwright.config.mjs

app/game-api/src/battleSim/inMemoryTransport.ts

@@ -4,16 +4,20 @@ import type { BattleSimJobPayload, BattleSimResultPayload, BattleSimTransportRes
 import { processBattleSimJob } from './processor.js';
 
 export class InMemoryBattleSimTransport {
-    private readonly results = new Map<string, BattleSimResultPayload>();
+    private readonly results = new Map<string, { requesterUserId: string; payload: BattleSimResultPayload }>();
 
-    public async simulate(payload: BattleSimJobPayload): Promise<BattleSimTransportResponse> {
+    public async simulate(payload: BattleSimJobPayload, requesterUserId: string): Promise<BattleSimTransportResponse> {
         const jobId = crypto.randomUUID();
         const result = processBattleSimJob(payload);
-        this.results.set(jobId, result);
+        this.results.set(jobId, { requesterUserId, payload: result });
         return { status: 'completed', jobId, payload: result };
     }
 
-    public async getSimulationResult(jobId: string): Promise<BattleSimResultPayload | null> {
-        return this.results.get(jobId) ?? null;
+    public async getSimulationResult(jobId: string, requesterUserId: string): Promise<BattleSimResultPayload | null> {
+        const result = this.results.get(jobId);
+        if (!result || result.requesterUserId !== requesterUserId) {
+            return null;
+        }
+        return result.payload;
     }
 }

app/game-api/src/battleSim/redisTransport.ts

@@ -44,16 +44,16 @@ export class RedisBattleSimTransport {
         this.resultTtlSeconds = options.resultTtlSeconds;
     }
 
-    private buildResultKey(jobId: string): string {
-        return `${this.keys.resultKeyPrefix}${jobId}`;
+    private buildResultKey(jobId: string, requesterUserId: string): string {
+        return `${this.keys.resultKeyPrefix}${encodeURIComponent(requesterUserId)}:${jobId}`;
     }
 
-    private buildNotifyKey(jobId: string): string {
-        return `${this.keys.notifyKeyPrefix}${jobId}`;
+    private buildNotifyKey(jobId: string, requesterUserId: string): string {
+        return `${this.keys.notifyKeyPrefix}${encodeURIComponent(requesterUserId)}:${jobId}`;
     }
 
-    private async readResult(jobId: string): Promise<BattleSimResultPayload | null> {
-        const raw = await this.client.get(this.buildResultKey(jobId));
+    private async readResult(jobId: string, requesterUserId: string): Promise<BattleSimResultPayload | null> {
+        const raw = await this.client.get(this.buildResultKey(jobId, requesterUserId));
         if (!raw) {
             return null;
         }
@@ -64,44 +64,49 @@ export class RedisBattleSimTransport {
         }
     }
 
-    private async waitForResult(jobId: string, timeoutMs: number): Promise<BattleSimResultPayload | null> {
-        const existing = await this.readResult(jobId);
+    private async waitForResult(
+        jobId: string,
+        requesterUserId: string,
+        timeoutMs: number
+    ): Promise<BattleSimResultPayload | null> {
+        const existing = await this.readResult(jobId, requesterUserId);
         if (existing) {
             return existing;
         }
 
-        const notifyKey = this.buildNotifyKey(jobId);
+        const notifyKey = this.buildNotifyKey(jobId, requesterUserId);
         const timeoutSec = toTimeoutSeconds(timeoutMs);
         const signal = await this.client.blPop(notifyKey, timeoutSec);
         if (!parseBlPopValue(signal)) {
             return null;
         }
-        return this.readResult(jobId);
+        return this.readResult(jobId, requesterUserId);
     }
 
-    public async simulate(payload: BattleSimJobPayload): Promise<BattleSimTransportResponse> {
+    public async simulate(payload: BattleSimJobPayload, requesterUserId: string): Promise<BattleSimTransportResponse> {
         const jobId = crypto.randomUUID();
         const job = {
             jobId,
+            requesterUserId,
             requestedAt: new Date().toISOString(),
             payload,
         };
         await this.client.rPush(this.keys.queueKey, JSON.stringify(job));
 
-        const result = await this.waitForResult(jobId, this.requestTimeoutMs);
+        const result = await this.waitForResult(jobId, requesterUserId, this.requestTimeoutMs);
         if (result) {
             return { status: 'completed', jobId, payload: result };
         }
         return { status: 'queued', jobId };
     }
 
-    public async getSimulationResult(jobId: string): Promise<BattleSimResultPayload | null> {
-        return this.readResult(jobId);
+    public async getSimulationResult(jobId: string, requesterUserId: string): Promise<BattleSimResultPayload | null> {
+        return this.readResult(jobId, requesterUserId);
     }
 
-    public async pushResult(jobId: string, payload: BattleSimResultPayload): Promise<void> {
-        const resultKey = this.buildResultKey(jobId);
-        const notifyKey = this.buildNotifyKey(jobId);
+    public async pushResult(jobId: string, requesterUserId: string, payload: BattleSimResultPayload): Promise<void> {
+        const resultKey = this.buildResultKey(jobId, requesterUserId);
+        const notifyKey = this.buildNotifyKey(jobId, requesterUserId);
         await this.client.set(resultKey, JSON.stringify(payload), {
             EX: this.resultTtlSeconds,
         });

app/game-api/src/battleSim/transport.ts

@@ -1,6 +1,6 @@
 import type { BattleSimJobPayload, BattleSimResultPayload, BattleSimTransportResponse } from './types.js';
 
 export interface BattleSimTransport {
-    simulate(payload: BattleSimJobPayload): Promise<BattleSimTransportResponse>;
-    getSimulationResult(jobId: string): Promise<BattleSimResultPayload | null>;
+    simulate(payload: BattleSimJobPayload, requesterUserId: string): Promise<BattleSimTransportResponse>;
+    getSimulationResult(jobId: string, requesterUserId: string): Promise<BattleSimResultPayload | null>;
 }

app/game-api/src/battleSim/types.ts

@@ -134,6 +134,7 @@ export interface BattleSimResultPayload {
 
 export interface BattleSimJob {
     jobId: string;
+    requesterUserId: string;
     requestedAt: string;
     payload: BattleSimJobPayload;
 }

app/game-api/src/battleSim/worker.ts

@@ -18,7 +18,11 @@ const parseBlPopValue = (result: RedisBlPopResult): string | null => {
     return result.element ?? null;
 };
 
-export const runBattleSimWorker = async (): Promise<void> => {
+export interface BattleSimWorkerOptions {
+    signal?: AbortSignal;
+}
+
+export const runBattleSimWorker = async (options: BattleSimWorkerOptions = {}): Promise<void> => {
     const config = resolveGameApiConfigFromEnv();
     const redis = createRedisConnector(resolveRedisConfigFromEnv());
     await redis.connect();
@@ -30,35 +34,49 @@ export const runBattleSimWorker = async (): Promise<void> => {
         resultTtlSeconds: config.battleSimResultTtlSeconds,
     });
 
-    const handleExit = async () => {
-        await redis.disconnect();
+    let stopped = options.signal?.aborted ?? false;
+    const handleExit = () => {
+        stopped = true;
+    };
+    const handleAbort = () => {
+        stopped = true;
     };
     process.on('SIGINT', handleExit);
     process.on('SIGTERM', handleExit);
+    options.signal?.addEventListener('abort', handleAbort, { once: true });
 
-    while (true) {
-        const item = await redis.client.blPop(keys.queueKey, 0);
-        const raw = parseBlPopValue(item);
-        if (!raw) {
-            continue;
-        }
+    try {
+        while (!stopped) {
+            // A finite block lets SIGTERM and test AbortSignal stop the worker without
+            // leaving a Redis operation or a detached lifecycle process behind.
+            const item = await redis.client.blPop(keys.queueKey, 1);
+            const raw = parseBlPopValue(item);
+            if (!raw) {
+                continue;
+            }
 
-        let job: BattleSimJob | null = null;
-        try {
-            job = JSON.parse(raw) as BattleSimJob;
-        } catch {
-            continue;
-        }
+            let job: BattleSimJob | null = null;
+            try {
+                job = JSON.parse(raw) as BattleSimJob;
+            } catch {
+                continue;
+            }
 
-        try {
-            const result = processBattleSimJob(job.payload);
-            await transport.pushResult(job.jobId, result);
-        } catch (error) {
-            const reason = error instanceof Error ? error.message : '전투 시뮬레이션 오류';
-            await transport.pushResult(job.jobId, {
-                result: false,
-                reason,
-            });
+            try {
+                const result = processBattleSimJob(job.payload);
+                await transport.pushResult(job.jobId, job.requesterUserId, result);
+            } catch (error) {
+                const reason = error instanceof Error ? error.message : '전투 시뮬레이션 오류';
+                await transport.pushResult(job.jobId, job.requesterUserId, {
+                    result: false,
+                    reason,
+                });
+            }
         }
+    } finally {
+        process.off('SIGINT', handleExit);
+        process.off('SIGTERM', handleExit);
+        options.signal?.removeEventListener('abort', handleAbort);
+        await redis.disconnect();
     }
 };

app/game-api/src/index.ts

@@ -30,6 +30,9 @@ export * from './auction/types.js';
 export * from './auction/keys.js';
 export * from './auction/scheduler.js';
 export * from './auction/worker.js';
+export * from './tournament/keys.js';
+export * from './tournament/store.js';
+export * from './tournament/types.js';
 export * from './tournament/worker.js';
 
 // Types for TRPC consumer

app/game-api/src/messages/targets.ts

@@ -23,13 +23,14 @@ export const resolveNationInfo = async (
 
 export const buildTargetFromGeneral = async (db: DatabaseClient, general: GeneralRow): Promise<MessageTarget> => {
     const nation = await resolveNationInfo(db, general.nationId);
+    const picture = general.picture?.trim() || 'default.jpg';
     return {
         generalId: general.id,
         generalName: general.name,
         nationId: general.nationId,
         nationName: nation.name,
         color: nation.color,
-        icon: '',
+        icon: general.imageServer ? `d_pic/${picture}` : `/image/icons/${picture}`,
     };
 };
 

app/game-api/src/router/battle/index.ts

@@ -4,7 +4,7 @@ import { z } from 'zod';
 import { asRecord } from '@sammo-ts/common';
 import { getDexLevel } from '@sammo-ts/logic';
 
-import { authedProcedure, procedure, router } from '../../trpc.js';
+import { authedProcedure, readOnlyAuthedProcedure, router } from '../../trpc.js';
 import { buildBattleSimEnvironment, buildBattleSimJobPayload } from '../../battleSim/environment.js';
 import { zBattleSimJobId, zBattleSimRequest } from '../../battleSim/schema.js';
 import {
@@ -30,6 +30,14 @@ const normalizeOptionalKey = (value: string | null): string | null => {
     return value;
 };
 
+const getAuthenticatedUserId = (auth: { user: { id: string } } | null): string => {
+    const userId = auth?.user.id;
+    if (!userId) {
+        throw new TRPCError({ code: 'UNAUTHORIZED', message: 'Unauthorized' });
+    }
+    return userId;
+};
+
 const resolveExpLevel = (meta: Record<string, unknown>, experience: number): number => {
     const expLevel = meta.explevel ?? meta.expLevel;
     if (typeof expLevel === 'number' && Number.isFinite(expLevel)) {
@@ -48,7 +56,7 @@ const resolveDexValue = (meta: Record<string, unknown>, key: string): number =>
 };
 
 export const battleRouter = router({
-    simulate: procedure.input(zBattleSimRequest).mutation(async ({ ctx, input }) => {
+    simulate: readOnlyAuthedProcedure.input(zBattleSimRequest).mutation(async ({ ctx, input }) => {
         const worldState = await ctx.db.worldState.findFirst();
         if (!worldState) {
             throw new TRPCError({
@@ -58,10 +66,10 @@ export const battleRouter = router({
         }
 
         const payload = await buildBattleSimJobPayload(worldState, input, ctx.profile.id);
-        return ctx.battleSim.simulate(payload);
+        return ctx.battleSim.simulate(payload, getAuthenticatedUserId(ctx.auth));
     }),
-    getSimulation: procedure.input(zBattleSimJobId).query(async ({ ctx, input }) => {
-        const result = await ctx.battleSim.getSimulationResult(input.jobId);
+    getSimulation: readOnlyAuthedProcedure.input(zBattleSimJobId).query(async ({ ctx, input }) => {
+        const result = await ctx.battleSim.getSimulationResult(input.jobId, getAuthenticatedUserId(ctx.auth));
         if (!result) {
             return { status: 'queued', jobId: input.jobId };
         }

app/game-api/src/router/general/index.ts

@@ -37,15 +37,19 @@ const normalizeItemCode = (value: string | null): string | null => {
 };
 
 const resolveUserSettings = (meta: Record<string, unknown>) => {
-    const settings = asRecord(meta.userSettings);
-    const mysetRaw = settings.myset;
+    // The legacy general columns are persisted at the top level of General.meta.
+    // Keep reading the short-lived nested shape for installations that ran the
+    // initial rewrite implementation before this compatibility fix.
+    const nestedSettings = asRecord(meta.userSettings);
+    const readSetting = (key: string): unknown => meta[key] ?? nestedSettings[key];
+    const mysetRaw = readSetting('myset');
     const myset = typeof mysetRaw === 'number' && Number.isFinite(mysetRaw) ? mysetRaw : null;
 
     return {
-        tnmt: readNumber(settings.tnmt, 1),
-        defence_train: readNumber(settings.defence_train, 80),
-        use_treatment: readNumber(settings.use_treatment, 10),
-        use_auto_nation_turn: readNumber(settings.use_auto_nation_turn, 1),
+        tnmt: readNumber(readSetting('tnmt'), 1),
+        defence_train: readNumber(readSetting('defence_train'), 80),
+        use_treatment: readNumber(readSetting('use_treatment'), 10),
+        use_auto_nation_turn: readNumber(readSetting('use_auto_nation_turn'), 1),
         myset,
     };
 };
@@ -262,29 +266,6 @@ export const generalRouter = router({
             throw new TRPCError({ code: 'BAD_REQUEST', message: result.reason });
         }
 
-        const metaRecord = asRecord(general.meta);
-        const prevSettings = asRecord(metaRecord.userSettings);
-        const prevMyset = typeof prevSettings.myset === 'number' && Number.isFinite(prevSettings.myset)
-            ? prevSettings.myset
-            : null;
-        const nextSettings = {
-            ...prevSettings,
-            ...input,
-        } as Record<string, unknown>;
-        if (typeof prevMyset === 'number') {
-            nextSettings.myset = Math.max(0, prevMyset - 1);
-        }
-
-        await ctx.db.general.update({
-            where: { id: general.id },
-            data: {
-                meta: {
-                    ...metaRecord,
-                    userSettings: nextSettings,
-                },
-            } as any,
-        });
-
         return { ok: true };
     }),
     dropItem: authedProcedure.input(z.object({ itemType: z.string() })).mutation(async ({ ctx, input }) => {

app/game-api/src/router/inherit/index.ts

@@ -3,7 +3,14 @@ import { z } from 'zod';
 
 import { authedProcedure, router } from '../../trpc.js';
 import { asNumber, asRecord, parseJson, LiteHashDRBG } from '@sammo-ts/common';
-import { loadWarTraitModules, WarTraitLoader, WAR_TRAIT_KEYS, isWarTraitKey } from '@sammo-ts/logic';
+import {
+    ItemLoader,
+    isItemKey,
+    loadWarTraitModules,
+    WarTraitLoader,
+    WAR_TRAIT_KEYS,
+    isWarTraitKey,
+} from '@sammo-ts/logic';
 import type { InheritBuffType } from '@sammo-ts/logic';
 import {
     appendInheritanceLog,
@@ -23,8 +30,8 @@ const BUFF_KEYS: InheritBuffType[] = [
     'warAvoidRatio',
     'warCriticalRatio',
     'warMagicTrialProb',
-    'success',
-    'fail',
+    'domesticSuccessProb',
+    'domesticFailProb',
     'warAvoidRatioOppose',
     'warCriticalRatioOppose',
     'warMagicTrialProbOppose',
@@ -34,8 +41,8 @@ const BUFF_LABELS: Record<InheritBuffType, string> = {
     warAvoidRatio: '회피 확률 증가',
     warCriticalRatio: '필살 확률 증가',
     warMagicTrialProb: '전투계략 시도 확률 증가',
-    success: '내정 성공률 증가',
-    fail: '내정 실패율 감소',
+    domesticSuccessProb: '내정 성공률 증가',
+    domesticFailProb: '내정 실패율 감소',
     warAvoidRatioOppose: '상대 회피 확률 감소',
     warCriticalRatioOppose: '상대 필살 확률 감소',
     warMagicTrialProbOppose: '상대 전투계략 시도 확률 감소',
@@ -58,6 +65,37 @@ const parseBuffRecord = (raw: unknown): Record<string, number> => {
 
 const serializeBuffRecord = (buff: Record<string, number>): string => JSON.stringify(buff);
 
+const readBuffLevel = (buff: Record<string, number>, key: InheritBuffType): number => {
+    const compatibilityKey = key === 'domesticSuccessProb' ? 'success' : key === 'domesticFailProb' ? 'fail' : null;
+    return Math.max(0, Math.min(5, Math.floor(buff[key] ?? (compatibilityKey ? buff[compatibilityKey] : 0) ?? 0)));
+};
+
+const loadAvailableUniqueItems = async (worldState: WorldStateRow) => {
+    const configuredItems = asRecord(asRecord(worldState.config).const).allItems;
+    const enabledKeys: Array<Parameters<ItemLoader['load']>[0]> = [];
+    for (const entries of Object.values(asRecord(configuredItems))) {
+        for (const [key, amount] of Object.entries(asRecord(entries))) {
+            if (asNumber(amount, 0) !== 0 && isItemKey(key)) {
+                enabledKeys.push(key);
+            }
+        }
+    }
+
+    const loader = new ItemLoader();
+    const items = await Promise.all(
+        [...new Set(enabledKeys)].map(async (key) => {
+            const item = await loader.load(key);
+            return {
+                key,
+                name: item.name,
+                rawName: item.rawName,
+                info: item.info ?? '',
+            };
+        })
+    );
+    return items.sort((left, right) => left.name.localeCompare(right.name, 'ko'));
+};
+
 const resolveWorld = async (ctx: { db: { worldState: { findFirst: () => Promise<unknown> } } }) => {
     const worldState = await ctx.db.worldState.findFirst();
     if (!worldState || typeof worldState !== 'object') {
@@ -199,6 +237,9 @@ export const inheritRouter = router({
                 special2Code: true,
                 meta: true,
                 turnTime: true,
+                leadership: true,
+                strength: true,
+                intel: true,
             },
         });
 
@@ -219,7 +260,7 @@ export const inheritRouter = router({
         const inheritConst = resolveInheritConstants(worldState);
         const buffState = parseBuffRecord(asRecord(general.meta).inheritBuff);
         const buffLevels = BUFF_KEYS.reduce<Record<string, number>>((acc, key) => {
-            acc[key] = Math.max(0, Math.min(5, Math.floor(buffState[key] ?? 0)));
+            acc[key] = readBuffLevel(buffState, key);
             return acc;
         }, {});
 
@@ -240,11 +281,14 @@ export const inheritRouter = router({
             info: trait.info ?? '',
         }));
 
-        const others = await ctx.db.general.findMany({
-            where: { id: { not: general.id }, userId: { not: null } },
-            select: { id: true, name: true },
-            orderBy: { id: 'asc' },
-        });
+        const [others, availableUnique] = await Promise.all([
+            ctx.db.general.findMany({
+                where: { id: { not: general.id }, npcState: { lt: 2 }, userId: { not: null } },
+                select: { id: true, name: true },
+                orderBy: { id: 'asc' },
+            }),
+            loadAvailableUniqueItems(worldState),
+        ]);
 
         return {
             items,
@@ -260,10 +304,16 @@ export const inheritRouter = router({
                 resetTurnTime: resetTurnLevel,
             },
             availableSpecialWar: warSpecials,
+            availableUnique,
             availableTargetGenerals: others,
             turnTimeZones: buildTurnTimeZoneList(Math.max(1, Math.round(worldState.tickSeconds / 60))),
             isUnited,
             currentSpecialWar: general.special2Code ?? 'None',
+            currentStat: {
+                leadership: general.leadership,
+                strength: general.strength,
+                intel: general.intel,
+            },
         };
     }),
     getLogs: authedProcedure
@@ -285,7 +335,7 @@ export const inheritRouter = router({
                 },
                 orderBy: { id: 'desc' },
                 take: 30,
-                select: { id: true, year: true, month: true, text: true },
+                select: { id: true, year: true, month: true, text: true, createdAt: true },
             });
             return logs;
         }),
@@ -318,7 +368,7 @@ export const inheritRouter = router({
             }
 
             const buff = parseBuffRecord(asRecord(general.meta).inheritBuff);
-            const prevLevel = Math.max(0, Math.min(5, Math.floor(buff[input.type] ?? 0)));
+            const prevLevel = readBuffLevel(buff, input.type);
             if (input.level === prevLevel) {
                 throw new TRPCError({ code: 'BAD_REQUEST', message: '이미 구입했습니다.' });
             }
@@ -417,7 +467,12 @@ export const inheritRouter = router({
                 },
             });
 
-            await setInheritancePoint(ctx.db, userId, 'previous', currentPoint - inheritConst.inheritSpecificSpecialPoint);
+            await setInheritancePoint(
+                ctx.db,
+                userId,
+                'previous',
+                currentPoint - inheritConst.inheritSpecificSpecialPoint
+            );
             await appendInheritanceLog(
                 ctx.db,
                 userId,
@@ -460,7 +515,8 @@ export const inheritRouter = router({
         }
 
         const meta = asRecord(general.meta);
-        const prevList = parseJson<string[]>(typeof meta.prev_types_special2 === 'string' ? meta.prev_types_special2 : null) ?? [];
+        const prevList =
+            parseJson<string[]>(typeof meta.prev_types_special2 === 'string' ? meta.prev_types_special2 : null) ?? [];
         prevList.push(general.special2Code);
 
         await patchGeneral(ctx, general.id, {
@@ -473,7 +529,13 @@ export const inheritRouter = router({
         });
 
         await setInheritancePoint(ctx.db, userId, 'previous', currentPoint - cost);
-        await appendInheritanceLog(ctx.db, userId, worldState.currentYear, worldState.currentMonth, `${cost} 포인트로 전투 특기 초기화`);
+        await appendInheritanceLog(
+            ctx.db,
+            userId,
+            worldState.currentYear,
+            worldState.currentMonth,
+            `${cost} 포인트로 전투 특기 초기화`
+        );
         return { ok: true };
     }),
     resetTurnTime: authedProcedure.mutation(async ({ ctx }) => {
@@ -624,9 +686,7 @@ export const inheritRouter = router({
             const finalBonus =
                 bonusSum === 0
                     ? buildRandomBonus(
-                          new LiteHashDRBG(
-                              `${asRecord(worldState.meta).hiddenSeed ?? 'inherit'}:ResetStat:${userId}`
-                          ),
+                          new LiteHashDRBG(`${asRecord(worldState.meta).hiddenSeed ?? 'inherit'}:ResetStat:${userId}`),
                           [input.leadership, input.strength, input.intel]
                       )
                     : (bonus as [number, number, number]);
@@ -674,9 +734,7 @@ export const inheritRouter = router({
             if (seasonValue !== null) {
                 const userState = await readUserStateMeta(ctx.db, userId);
                 const resetSeasons = readResetSeasons(userState);
-                const nextSeasons = resetSeasons.includes(seasonValue)
-                    ? resetSeasons
-                    : [...resetSeasons, seasonValue];
+                const nextSeasons = resetSeasons.includes(seasonValue) ? resetSeasons : [...resetSeasons, seasonValue];
                 await writeUserStateMeta(ctx.db, userId, {
                     ...userState,
                     last_stat_reset: nextSeasons,
@@ -709,7 +767,10 @@ export const inheritRouter = router({
         }
         const meta = asRecord(general.meta);
         if (meta.inheritRandomUnique !== undefined && meta.inheritRandomUnique !== null) {
-            throw new TRPCError({ code: 'BAD_REQUEST', message: '이미 구입 명령을 내렸습니다. 다음 턴까지 기다려주세요.' });
+            throw new TRPCError({
+                code: 'BAD_REQUEST',
+                message: '이미 구입 명령을 내렸습니다. 다음 턴까지 기다려주세요.',
+            });
         }
 
         await patchGeneral(ctx, general.id, {
@@ -803,7 +864,9 @@ export const inheritRouter = router({
                 throw new TRPCError({ code: 'BAD_REQUEST', message: '자신의 정보는 확인할 수 없습니다.' });
             }
 
-            const ownerName = typeof asRecord(target.meta).ownerName === 'string' ? (asRecord(target.meta).ownerName as string) : target.userId;
+            const rawOwnerName = asRecord(target.meta).ownerName;
+            const ownerName =
+                typeof rawOwnerName === 'string' && rawOwnerName.trim().length > 0 ? rawOwnerName : '알수없음';
 
             await setInheritancePoint(ctx.db, userId, 'previous', currentPoint - inheritConst.inheritCheckOwnerPoint);
             await appendInheritanceLog(

app/game-api/src/router/messages/index.ts

@@ -1,5 +1,7 @@
 import { TRPCError } from '@trpc/server';
 import { z } from 'zod';
+import { asRecord } from '@sammo-ts/common';
+import type { UserSanctions } from '@sammo-ts/common/auth/gameToken';
 
 import { authedProcedure, router } from '../../trpc.js';
 import {
@@ -26,6 +28,75 @@ import { respondToDiplomaticMessage } from '../../messages/diplomaticResponse.js
 
 const zMessageType = z.enum(['private', 'public', 'national', 'diplomacy']);
 
+const redactDiplomacyMessages = (messages: MessageView[], permission: number): MessageView[] => {
+    if (permission >= 3) {
+        return messages;
+    }
+    return messages.map((message) => {
+        if (!message.dest || message.dest.nationId === 0) {
+            return message;
+        }
+        return {
+            ...message,
+            text: '(외교 메시지입니다)',
+            option: {
+                ...(message.option ?? {}),
+                invalid: true,
+            },
+        };
+    });
+};
+
+const isFutureDate = (value: string | undefined, now = Date.now()): boolean => {
+    if (!value) {
+        return false;
+    }
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) && parsed > now;
+};
+
+const isMessageFeatureBlocked = (sanctions: UserSanctions, profileNames: string[]): boolean => {
+    if (
+        isFutureDate(sanctions.mutedUntil) ||
+        isFutureDate(sanctions.suspendedUntil) ||
+        isFutureDate(sanctions.bannedUntil)
+    ) {
+        return true;
+    }
+    for (const profileName of profileNames) {
+        const restriction = sanctions.serverRestrictions?.[profileName];
+        if (!restriction) {
+            continue;
+        }
+        if (restriction.until && !isFutureDate(restriction.until)) {
+            continue;
+        }
+        if (restriction.blockedFeatures?.includes('messages')) {
+            return true;
+        }
+    }
+    return false;
+};
+
+const readPenaltyNumber = (penalty: unknown, key: string, fallback: number): number => {
+    const value = asRecord(penalty)[key];
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return value;
+    }
+    if (typeof value === 'string') {
+        const parsed = Number(value);
+        if (Number.isFinite(parsed)) {
+            return parsed;
+        }
+    }
+    return fallback;
+};
+
+const hasPenalty = (penalty: unknown, key: string): boolean => {
+    const value = asRecord(penalty)[key];
+    return value === true || value === 1 || value === '1';
+};
+
 export const messagesRouter = router({
     getRecent: authedProcedure
         .input(
@@ -85,11 +156,12 @@ export const messagesRouter = router({
                         : null,
                 ]);
 
+            const permission = nationId > 0 && nation ? resolveNationPermission(general, nation.meta, false) : -1;
             const messageBuckets: Record<MessageType, MessageView[]> = {
                 private: privateMessages,
                 public: publicMessages,
                 national: nationalMessages,
-                diplomacy: diplomacyMessages,
+                diplomacy: redactDiplomacyMessages(diplomacyMessages, permission),
             };
 
             let nextSequence = sequence;
@@ -128,10 +200,8 @@ export const messagesRouter = router({
                 sequence: nextSequence,
                 nationId: nationId,
                 generalName: general.name,
-                canRespondDiplomacy:
-                    general.officerLevel > 4 &&
-                    nation !== null &&
-                    resolveNationPermission(general, nation.meta, false) >= 4,
+                permission,
+                canRespondDiplomacy: permission >= 4 && general.officerLevel > 4,
                 latestRead: {
                     diplomacy: readState?.latestDiplomacyMessage ?? 0,
                     private: readState?.latestPrivateMessage ?? 0,
@@ -178,6 +248,7 @@ export const messagesRouter = router({
             ];
             return {
                 nation: nationList.map((nation) => ({
+                    nationId: nation.id,
                     mailbox: MESSAGE_MAILBOX_NATIONAL_BASE + nation.id,
                     name: nation.name,
                     color: nation.color,
@@ -234,14 +305,24 @@ export const messagesRouter = router({
             if (message.payload.src.generalId !== general.id) {
                 throw new TRPCError({ code: 'FORBIDDEN', message: '본인의 메시지만 삭제할 수 있습니다.' });
             }
-            if (message.msgType === 'diplomacy' || message.payload.option?.deletable === false) {
+            if (message.msgType === 'diplomacy' && message.payload.option?.action) {
+                throw new TRPCError({
+                    code: 'BAD_REQUEST',
+                    message: '시스템 외교 메시지는 삭제할 수 없습니다.',
+                });
+            }
+            if (message.payload.option?.deletable === false) {
                 throw new TRPCError({ code: 'BAD_REQUEST', message: '삭제할 수 없는 메시지입니다.' });
             }
             if (Date.now() - message.time.getTime() > 5 * 60 * 1000) {
                 throw new TRPCError({ code: 'BAD_REQUEST', message: '5분 이내의 메시지만 삭제할 수 있습니다.' });
             }
             const receiverMessageId = message.payload.option?.receiverMessageID;
-            const ids = [message.id, ...(typeof receiverMessageId === 'number' ? [receiverMessageId] : [])];
+            const shouldDeleteReceiverCopy = message.msgType === 'private' || message.msgType === 'national';
+            const ids = [
+                message.id,
+                ...(shouldDeleteReceiverCopy && typeof receiverMessageId === 'number' ? [receiverMessageId] : []),
+            ];
             await invalidateMessages(ctx.db, ids);
             return { ok: true, deletedIds: ids };
         }),
@@ -291,6 +372,14 @@ export const messagesRouter = router({
             const general = await getOwnedGeneral(ctx, input.generalId);
 
             const nationId = general.nationId;
+            const nation =
+                nationId > 0
+                    ? await ctx.db.nation.findUnique({
+                          where: { id: nationId },
+                          select: { meta: true },
+                      })
+                    : null;
+            const permission = nationId > 0 && nation ? resolveNationPermission(general, nation.meta, false) : -1;
             const mailboxes = {
                 private: general.id,
                 public: MESSAGE_MAILBOX_PUBLIC,
@@ -312,7 +401,8 @@ export const messagesRouter = router({
                 toSeq: input.to,
                 limit: 15,
             });
-            messageBuckets[input.type] = messages;
+            messageBuckets[input.type] =
+                input.type === 'diplomacy' ? redactDiplomacyMessages(messages, permission) : messages;
 
             return {
                 result: true,
@@ -320,6 +410,7 @@ export const messagesRouter = router({
                 sequence: 0,
                 nationId,
                 generalName: general.name,
+                permission,
                 ...messageBuckets,
             };
         }),
@@ -333,6 +424,12 @@ export const messagesRouter = router({
         )
         .mutation(async ({ ctx, input }) => {
             const general = await getOwnedGeneral(ctx, input.generalId);
+            if (!ctx.auth || isMessageFeatureBlocked(ctx.auth.sanctions, [ctx.profile.name, ctx.profile.id])) {
+                throw new TRPCError({
+                    code: 'FORBIDDEN',
+                    message: '메시지 전송이 제한된 계정입니다.',
+                });
+            }
 
             const src = await buildTargetFromGeneral(ctx.db, general);
             const now = new Date();
@@ -340,28 +437,93 @@ export const messagesRouter = router({
 
             let msgType: MessageType;
             let dest = src;
+            let receiverMailbox = input.mailbox;
 
             if (input.mailbox === MESSAGE_MAILBOX_PUBLIC) {
-                msgType = 'public';
-            } else if (input.mailbox >= MESSAGE_MAILBOX_NATIONAL_BASE) {
-                const destNationId = input.mailbox - MESSAGE_MAILBOX_NATIONAL_BASE;
-                if (destNationId <= 0) {
+                if (hasPenalty(general.penalty, 'noSendPublicMsg')) {
                     throw new TRPCError({
-                        code: 'BAD_REQUEST',
-                        message: 'Invalid nation mailbox.',
+                        code: 'FORBIDDEN',
+                        message: '공개 메세지를 보낼 수 없습니다.',
                     });
                 }
+                msgType = 'public';
+            } else if (input.mailbox >= MESSAGE_MAILBOX_NATIONAL_BASE) {
+                const sourceNation =
+                    general.nationId > 0
+                        ? await ctx.db.nation.findUnique({
+                              where: { id: general.nationId },
+                              select: { meta: true },
+                          })
+                        : null;
+                const permission =
+                    general.nationId > 0 && sourceNation ? resolveNationPermission(general, sourceNation.meta) : -1;
+                const destNationId = permission < 4 ? general.nationId : input.mailbox - MESSAGE_MAILBOX_NATIONAL_BASE;
                 const nationInfo = await resolveNationInfo(ctx.db, destNationId);
+                if (destNationId > 0) {
+                    const destNation = await ctx.db.nation.findUnique({ where: { id: destNationId } });
+                    if (!destNation) {
+                        throw new TRPCError({
+                            code: 'NOT_FOUND',
+                            message: '존재하지 않는 국가입니다.',
+                        });
+                    }
+                }
                 dest = buildNationTarget(destNationId, nationInfo.name, nationInfo.color);
                 msgType = destNationId === general.nationId ? 'national' : 'diplomacy';
+                receiverMailbox = MESSAGE_MAILBOX_NATIONAL_BASE + destNationId;
             } else if (input.mailbox > 0) {
+                if (hasPenalty(general.penalty, 'noSendPrivateMsg')) {
+                    throw new TRPCError({
+                        code: 'FORBIDDEN',
+                        message: '개인 메세지를 보낼 수 없습니다.',
+                    });
+                }
+                const intervalSeconds = Math.max(
+                    0,
+                    Math.ceil(readPenaltyNumber(general.penalty, 'sendPrivateMsgDelay', 2))
+                );
+                if (intervalSeconds > 0) {
+                    const rateLimitKey = `game:${ctx.profile.name}:message:private:${ctx.auth.sessionId}`;
+                    const acquired = await ctx.redis.set(rateLimitKey, '1', {
+                        NX: true,
+                        PX: intervalSeconds * 1000,
+                    });
+                    if (acquired === null) {
+                        throw new TRPCError({
+                            code: 'TOO_MANY_REQUESTS',
+                            message: `개인메세지는 ${intervalSeconds}초당 1건만 보낼 수 있습니다!`,
+                        });
+                    }
+                }
                 const destGeneral = await ctx.db.general.findUnique({
                     where: { id: input.mailbox },
                 });
                 if (!destGeneral) {
                     throw new TRPCError({
                         code: 'NOT_FOUND',
-                        message: 'Destination general not found.',
+                        message: '존재하지 않는 유저입니다.',
+                    });
+                }
+                const [sourceNation, destNation] = await Promise.all([
+                    general.nationId > 0
+                        ? ctx.db.nation.findUnique({ where: { id: general.nationId }, select: { meta: true } })
+                        : null,
+                    destGeneral.nationId > 0
+                        ? ctx.db.nation.findUnique({ where: { id: destGeneral.nationId }, select: { meta: true } })
+                        : null,
+                ]);
+                const sourcePermission =
+                    sourceNation && general.nationId > 0
+                        ? resolveNationPermission(general, sourceNation.meta, false)
+                        : -1;
+                const destPermission =
+                    destNation && destGeneral.nationId > 0
+                        ? resolveNationPermission(destGeneral, destNation.meta, false)
+                        : -1;
+                if (sourcePermission === 4 && destPermission === 4 && destGeneral.nationId !== general.nationId) {
+                    throw new TRPCError({
+                        code: 'FORBIDDEN',
+                        message: '외교권자끼리는 메시지를 보낼 수 없습니다.',
                     });
                 }
                 dest = await buildTargetFromGeneral(ctx.db, destGeneral);
@@ -394,7 +556,7 @@ export const messagesRouter = router({
                 await publishRealtimeEvent(ctx.redis, ctx.profile.name, {
                     type: 'messageCreated',
                     at: now.toISOString(),
-                    mailbox: input.mailbox,
+                    mailbox: receiverMailbox,
                     msgType,
                     messageId: result.receiverId,
                     senderId: general.id,

app/game-api/src/router/nation/endpoints/getGeneralList.ts

@@ -2,7 +2,21 @@ import { TRPCError } from '@trpc/server';
 
 import { authedProcedure } from '../../../trpc.js';
 import { getMyGeneral } from '../../shared/general.js';
-import { assertNationAccess, loadTraitNames, mapGeneralList, resolveChiefStatMin } from '../shared.js';
+import {
+    assertNationAccess,
+    loadTraitNames,
+    mapGeneralList,
+    resolveChiefStatMin,
+    resolveNationPermission,
+} from '../shared.js';
+
+const experienceLevel = (experience: number): number =>
+    Math.max(
+        0,
+        Math.min(100, experience < 1000 ? Math.floor(experience / 100) : Math.floor(Math.sqrt(experience / 10)))
+    );
+const dedicationLevel = (dedication: number): number =>
+    Math.max(0, Math.min(10, Math.ceil(Math.sqrt(dedication) / 10)));
 
 export const getGeneralList = authedProcedure.query(async ({ ctx }) => {
     const general = await getMyGeneral(ctx);
@@ -62,7 +76,38 @@ export const getGeneralList = authedProcedure.query(async ({ ctx }) => {
     const cityNameMap = new Map(cityRows.map((city) => [city.id, city.name]));
     const troopNameMap = new Map(troopRows.map((troop) => [troop.troopLeaderId, troop.name]));
     const list = await mapGeneralList(generalRows, cityNameMap, troopNameMap);
+    const accessRows = generalRows.length
+        ? await ctx.db.generalAccessLog.findMany({
+              where: { generalId: { in: generalRows.map((entry) => entry.id) } },
+              select: { generalId: true, refreshScoreTotal: true },
+          })
+        : [];
+    const accessByGeneral = new Map(accessRows.map((entry) => [entry.generalId, entry.refreshScoreTotal]));
     const nationTrait = (await loadTraitNames([nation.typeCode], 'nation')).get(nation.typeCode);
+    const permission = resolveNationPermission(general, nation.meta, true);
+    const visibleList = list.map((entry) => {
+        const { permission: _targetPermission, ...safeEntry } = entry;
+        if (permission >= 1) {
+            return {
+                ...safeEntry,
+                refreshScoreTotal: accessByGeneral.get(entry.id) ?? 0,
+                experienceLevel: experienceLevel(entry.experience),
+                dedicationLevel: dedicationLevel(entry.dedication),
+            };
+        }
+        const { crew: _crew, experience: _experience, dedication: _dedication, ...visible } = safeEntry;
+        return {
+            ...visible,
+            refreshScoreTotal: accessByGeneral.get(entry.id) ?? 0,
+            officerLevel: entry.officerLevel >= 5 ? entry.officerLevel : Math.min(1, entry.officerLevel),
+            cityName: null,
+            troopName: null,
+            officerCity: 0,
+            officerCityName: null,
+            experienceLevel: experienceLevel(entry.experience),
+            dedicationLevel: dedicationLevel(entry.dedication),
+        };
+    });
 
     return {
         nation: {
@@ -79,6 +124,7 @@ export const getGeneralList = authedProcedure.query(async ({ ctx }) => {
             capitalCityId: nation.capitalCityId ?? 0,
         },
         chiefStatMin: resolveChiefStatMin(worldState),
-        generals: list,
+        viewer: { generalId: general.id, permission },
+        generals: visibleList,
     };
 });

app/game-api/src/router/nation/endpoints/getSecretGeneralList.ts

@@ -0,0 +1,141 @@
+import { TRPCError } from '@trpc/server';
+
+import { asRecord } from '@sammo-ts/common';
+
+import { authedProcedure } from '../../../trpc.js';
+import { getMyGeneral } from '../../shared/general.js';
+import { assertNationAccess, resolveNationPermission } from '../shared.js';
+
+const readNumber = (record: Record<string, unknown>, keys: string[], fallback = 0): number => {
+    for (const key of keys) {
+        const value = record[key];
+        if (typeof value === 'number' && Number.isFinite(value)) return value;
+    }
+    return fallback;
+};
+const woundedStat = (value: number, injury: number): number =>
+    injury > 0 ? Math.floor((value * (100 - injury)) / 100) : value;
+const experienceLevel = (experience: number): number =>
+    Math.max(
+        0,
+        Math.min(100, experience < 1000 ? Math.floor(experience / 100) : Math.floor(Math.sqrt(experience / 10)))
+    );
+const leadershipBonus = (officerLevel: number, nationLevel: number): number =>
+    officerLevel === 12 ? nationLevel * 2 : officerLevel >= 5 ? nationLevel : 0;
+const defenceTrainText = (value: number): string =>
+    value === 999 ? '×' : value >= 90 ? '☆' : value >= 80 ? '◎' : value >= 60 ? '○' : '△';
+
+export const getSecretGeneralList = authedProcedure.query(async ({ ctx }) => {
+    const me = await getMyGeneral(ctx);
+    assertNationAccess(me);
+    const nation = await ctx.db.nation.findUnique({
+        where: { id: me.nationId },
+        select: { id: true, name: true, color: true, level: true, meta: true },
+    });
+    if (!nation) throw new TRPCError({ code: 'NOT_FOUND', message: 'Nation not found' });
+    const permission = resolveNationPermission(me, nation.meta, true);
+    if (permission < 1) {
+        throw new TRPCError({
+            code: 'FORBIDDEN',
+            message: '권한이 부족합니다. 수뇌부가 아니거나 사관년도가 부족합니다.',
+        });
+    }
+
+    const [cities, troops, generalRows] = await Promise.all([
+        ctx.db.city.findMany({ select: { id: true, name: true } }),
+        ctx.db.troop.findMany({
+            where: { nationId: me.nationId },
+            select: { troopLeaderId: true, name: true },
+        }),
+        ctx.db.general.findMany({
+            where: { nationId: me.nationId },
+            orderBy: [{ turnTime: 'asc' }, { id: 'asc' }],
+        }),
+    ]);
+    const generalIds = generalRows.map((general) => general.id);
+    const turns = generalIds.length
+        ? await ctx.db.generalTurn.findMany({
+              where: { generalId: { in: generalIds }, turnIdx: { lt: 5 } },
+              select: { generalId: true, turnIdx: true, actionCode: true },
+              orderBy: [{ generalId: 'asc' }, { turnIdx: 'asc' }],
+          })
+        : [];
+    const cityNames = new Map(cities.map((city) => [city.id, city.name]));
+    const troopNames = new Map(troops.map((troop) => [troop.troopLeaderId, troop.name]));
+    const turnMap = new Map<number, string[]>();
+    for (const turn of turns) {
+        const list = turnMap.get(turn.generalId) ?? [];
+        list[turn.turnIdx] = turn.actionCode;
+        turnMap.set(turn.generalId, list);
+    }
+    const generals = generalRows.map((general) => {
+        const meta = asRecord(general.meta);
+        const defenceTrain = readNumber(meta, ['defenceTrain', 'defence_train'], 80);
+        return {
+            id: general.id,
+            name: general.name,
+            npcState: general.npcState,
+            injury: general.injury,
+            stats: {
+                leadership: woundedStat(general.leadership, general.injury),
+                strength: woundedStat(general.strength, general.injury),
+                intelligence: woundedStat(general.intel, general.injury),
+            },
+            leadershipBonus: leadershipBonus(general.officerLevel, nation.level),
+            experienceLevel: experienceLevel(general.experience),
+            troopId: general.troopId,
+            troopName: troopNames.get(general.troopId) ?? null,
+            gold: general.gold,
+            rice: general.rice,
+            cityId: general.cityId,
+            cityName: cityNames.get(general.cityId) ?? null,
+            defenceTrain,
+            defenceTrainText: defenceTrainText(defenceTrain),
+            crewTypeId: general.crewTypeId,
+            crew: general.crew,
+            train: general.train,
+            atmos: general.atmos,
+            killTurn: readNumber(meta, ['killturn', 'killTurn']),
+            turnTime: general.turnTime.toISOString(),
+            reservedCommands: general.npcState < 2 ? (turnMap.get(general.id) ?? []) : [],
+        };
+    });
+    const counted = generals.filter((general) => general.npcState !== 5);
+    const summary = counted.reduce(
+        (result, general) => {
+            result.gold += general.gold;
+            result.rice += general.rice;
+            result.crew += general.crew;
+            if (general.crew > 0) {
+                for (const threshold of [90, 80, 60] as const) {
+                    if (general.train >= threshold && general.atmos >= threshold) {
+                        result.readiness[threshold].crew += general.crew;
+                        result.readiness[threshold].generals += 1;
+                    }
+                }
+            }
+            return result;
+        },
+        {
+            gold: 0,
+            rice: 0,
+            crew: 0,
+            readiness: {
+                90: { crew: 0, generals: 0 },
+                80: { crew: 0, generals: 0 },
+                60: { crew: 0, generals: 0 },
+            },
+        }
+    );
+    return {
+        nation: { id: nation.id, name: nation.name, color: nation.color, level: nation.level },
+        viewer: { generalId: me.id, permission },
+        summary: {
+            ...summary,
+            generalCount: counted.length,
+            averageGold: counted.length ? summary.gold / counted.length : 0,
+            averageRice: counted.length ? summary.rice / counted.length : 0,
+        },
+        generals,
+    };
+});

app/game-api/src/router/nation/index.ts

@@ -5,6 +5,7 @@ import { getBattleCenter } from './endpoints/getBattleCenter.js';
 import { getChiefCenter } from './endpoints/getChiefCenter.js';
 import { getCityOverview } from './endpoints/getCityOverview.js';
 import { getGeneralList } from './endpoints/getGeneralList.js';
+import { getSecretGeneralList } from './endpoints/getSecretGeneralList.js';
 import { getGeneralLog } from './endpoints/getGeneralLog.js';
 import { getNationInfo } from './endpoints/getNationInfo.js';
 import { getPersonnelInfo } from './endpoints/getPersonnelInfo.js';
@@ -21,6 +22,7 @@ import { setSecretLimit } from './endpoints/setSecretLimit.js';
 export const nationRouter = router({
     getNationInfo,
     getGeneralList,
+    getSecretGeneralList,
     getCityOverview,
     getPersonnelInfo,
     getStratFinan,

app/game-api/src/router/npc/index.ts

@@ -1,5 +1,3 @@
-import path from 'node:path';
-
 import { TRPCError } from '@trpc/server';
 import { z } from 'zod';
 
@@ -165,8 +163,6 @@ const FLOAT_POLICY_KEYS = ['safeRecruitCityPopulationRatio'] as const;
 type NumericPolicyKey = (typeof INTEGER_POLICY_KEYS)[number];
 type FloatPolicyKey = (typeof FLOAT_POLICY_KEYS)[number];
 
-const UNIT_SET_ROOT = path.resolve(process.cwd(), 'resources', 'unitset');
-
 const readNumber = (value: unknown, fallback = 0): number => {
     if (typeof value === 'number' && Number.isFinite(value)) {
         return value;
@@ -353,8 +349,8 @@ const buildZeroPolicy = async (
     }
 ): Promise<NationPolicy> => {
     const { statMax, statNpcMax, nationTech, develCost, defaultCrewTypeId, unitSetName } = options;
-    const unitSet = await loadUnitSetDefinitionByName(unitSetName, { unitSetRoot: UNIT_SET_ROOT });
-    const crewType = findCrewTypeById(unitSet, defaultCrewTypeId);
+    const unitSet = await loadUnitSetDefinitionByName(unitSetName);
+    const crewType = findCrewTypeById(unitSet, defaultCrewTypeId || unitSet.defaultCrewTypeId || 0);
     const techCost = getTechCost(nationTech);
     const next = clonePolicy(policy);
 
@@ -364,7 +360,7 @@ const buildZeroPolicy = async (
 
     if (next.reqNPCWarGold === 0 || next.reqNPCWarRice === 0) {
         const baseGold = crewType ? crewType.cost * techCost * statNpcMax : 0;
-        const baseRice = statNpcMax;
+        const baseRice = crewType ? crewType.rice * techCost * statNpcMax : 0;
         if (next.reqNPCWarGold === 0) {
             next.reqNPCWarGold = roundTo(baseGold * 4, -2);
         }
@@ -375,7 +371,7 @@ const buildZeroPolicy = async (
 
     if (next.reqHumanWarUrgentGold === 0 || next.reqHumanWarUrgentRice === 0) {
         const baseGold = crewType ? crewType.cost * techCost * statMax : 0;
-        const baseRice = statMax;
+        const baseRice = crewType ? crewType.rice * techCost * statMax : 0;
         if (next.reqHumanWarUrgentGold === 0) {
             next.reqHumanWarUrgentGold = roundTo(baseGold * 6, -2);
         }
@@ -415,8 +411,6 @@ const resolveSetterInfo = (policy: Record<string, unknown>, kind: 'value' | 'pri
     };
 };
 
-const ensureUniquePriority = (priority: string[]): string[] => Array.from(new Set(priority));
-
 const validateGeneralPriority = (priority: string[]): string | null => {
     const orderRequired: Array<[string, string]> = [['출병', '일반내정']];
     const mustHave = new Set(['출병', '일반내정']);
@@ -461,6 +455,7 @@ export const npcRouter = router({
                     id: true,
                     name: true,
                     level: true,
+                    tech: true,
                     meta: true,
                 },
             }),
@@ -508,9 +503,9 @@ export const npcRouter = router({
         const stat = resolveScenarioStat(config);
         const env = resolveCommandEnv(config);
         const unitSetName = resolveUnitSetName(config, 'che');
-        const nationTech = readNumber(asRecord(nationMeta).tech, 0);
+        const nationTech = readNumber(nation.tech, 0);
 
-        const zeroPolicy = await buildZeroPolicy(defaultNationPolicy, {
+        const zeroPolicy = await buildZeroPolicy(DEFAULT_NATION_POLICY, {
             statMax: stat.max,
             statNpcMax: stat.npcMax,
             nationTech,
@@ -542,277 +537,272 @@ export const npcRouter = router({
             permissionLevel,
         };
     }),
-    setNationPolicy: authedProcedure
-        .input(z.record(z.string(), z.unknown()))
-        .mutation(async ({ ctx, input }) => {
-            const general = await getMyGeneral(ctx);
-            if (general.nationId <= 0) {
-                throw new TRPCError({ code: 'PRECONDITION_FAILED', message: 'Nation membership required.' });
-            }
+    setNationPolicy: authedProcedure.input(z.record(z.string(), z.unknown())).mutation(async ({ ctx, input }) => {
+        const general = await getMyGeneral(ctx);
+        if (general.nationId <= 0) {
+            throw new TRPCError({ code: 'PRECONDITION_FAILED', message: 'Nation membership required.' });
+        }
 
-            const nation = await ctx.db.nation.findUnique({
-                where: { id: general.nationId },
-                select: { id: true, meta: true },
-            });
-            if (!nation) {
-                throw new TRPCError({ code: 'NOT_FOUND', message: 'Nation not found' });
-            }
+        const nation = await ctx.db.nation.findUnique({
+            where: { id: general.nationId },
+            select: { id: true, meta: true },
+        });
+        if (!nation) {
+            throw new TRPCError({ code: 'NOT_FOUND', message: 'Nation not found' });
+        }
 
-            const permissionLevel = resolveSecretPermission(
-                {
-                    nationId: general.nationId,
-                    officerLevel: general.officerLevel,
-                    meta: general.meta,
-                    penalty: general.penalty,
-                },
-                nation.meta
-            );
-            if (permissionLevel < 3) {
-                throw new TRPCError({ code: 'FORBIDDEN', message: '권한이 부족합니다.' });
-            }
+        const permissionLevel = resolveSecretPermission(
+            {
+                nationId: general.nationId,
+                officerLevel: general.officerLevel,
+                meta: general.meta,
+                penalty: general.penalty,
+            },
+            nation.meta
+        );
+        if (permissionLevel < 3) {
+            throw new TRPCError({ code: 'FORBIDDEN', message: '권한이 부족합니다.' });
+        }
 
-            const keys = Object.keys(input);
-            for (const key of keys) {
-                if (!NATION_POLICY_KEYS.has(key as keyof NationPolicy)) {
+        const keys = Object.keys(input);
+        for (const key of keys) {
+            if (!NATION_POLICY_KEYS.has(key as keyof NationPolicy)) {
+                throw new TRPCError({ code: 'BAD_REQUEST', message: `${key}는 올바른 정책값이 아닙니다.` });
+            }
+        }
+
+        const troopRows = await ctx.db.troop.findMany({
+            where: { nationId: general.nationId },
+            select: { troopLeaderId: true },
+        });
+        const cityRows = await ctx.db.city.findMany({ select: { id: true } });
+
+        const troopSet = new Set(troopRows.map((row) => row.troopLeaderId));
+        const citySet = new Set(cityRows.map((row) => row.id));
+        const assigned = new Set<number>();
+
+        const nationMeta = asRecord(nation.meta);
+        const policyRoot = asRecord(nationMeta.npc_nation_policy);
+        const nextValues = applyPolicyValues(DEFAULT_NATION_POLICY, asRecord(policyRoot.values));
+
+        for (const key of INTEGER_POLICY_KEYS) {
+            if (!(key in input)) {
+                continue;
+            }
+            const value = input[key];
+            if (typeof value !== 'number' || !Number.isFinite(value) || !Number.isInteger(value)) {
+                throw new TRPCError({ code: 'BAD_REQUEST', message: `${key}는 올바른 값이 아닙니다.` });
+            }
+            nextValues[key] = Math.max(0, value);
+        }
+
+        for (const key of FLOAT_POLICY_KEYS) {
+            if (!(key in input)) {
+                continue;
+            }
+            const value = input[key];
+            if (typeof value !== 'number' || !Number.isFinite(value)) {
+                throw new TRPCError({ code: 'BAD_REQUEST', message: `${key}는 올바른 값이 아닙니다.` });
+            }
+            nextValues[key] = value;
+        }
+
+        if ('CombatForce' in input) {
+            const rawCombat = input.CombatForce;
+            if (!isRecord(rawCombat)) {
+                throw new TRPCError({ code: 'BAD_REQUEST', message: 'CombatForce는 올바른 정책값이 아닙니다.' });
+            }
+            const combatForce: Record<number, [number, number]> = {};
+            for (const [rawKey, rawValue] of Object.entries(rawCombat)) {
+                const leaderId = Number(rawKey);
+                if (!Number.isFinite(leaderId)) {
+                    throw new TRPCError({ code: 'BAD_REQUEST', message: `${rawKey}는 올바른 부대가 아닙니다.` });
+                }
+                if (!troopSet.has(leaderId)) {
+                    throw new TRPCError({ code: 'BAD_REQUEST', message: `${leaderId}는 국가의 부대가 아닙니다.` });
+                }
+                if (assigned.has(leaderId)) {
+                    throw new TRPCError({
+                        code: 'BAD_REQUEST',
+                        message: `부대(${leaderId})는 하나의 역할만 지정할 수 있습니다.`,
+                    });
+                }
+                if (!Array.isArray(rawValue) || rawValue.length < 2) {
+                    throw new TRPCError({
+                        code: 'BAD_REQUEST',
+                        message: `${leaderId}의 입력양식이 올바르지 않습니다.`,
+                    });
+                }
+                const fromCity = Number(rawValue[0]);
+                const toCity = Number(rawValue[1]);
+                if (!citySet.has(fromCity) || !citySet.has(toCity)) {
+                    throw new TRPCError({
+                        code: 'BAD_REQUEST',
+                        message: `${leaderId}의 도시 ${fromCity}, ${toCity}가 올바른 도시 번호가 아닙니다.`,
+                    });
+                }
+                combatForce[leaderId] = [fromCity, toCity];
+                assigned.add(leaderId);
+            }
+            nextValues.CombatForce = combatForce;
+        }
+
+        for (const key of ['SupportForce', 'DevelopForce'] as const) {
+            if (!(key in input)) {
+                continue;
+            }
+            const rawList = input[key];
+            if (!Array.isArray(rawList)) {
+                throw new TRPCError({ code: 'BAD_REQUEST', message: `${key}는 올바른 정책값이 아닙니다.` });
+            }
+            const list: number[] = [];
+            for (const rawValue of rawList) {
+                if (typeof rawValue !== 'number' || !Number.isFinite(rawValue)) {
                     throw new TRPCError({ code: 'BAD_REQUEST', message: `${key}는 올바른 정책값이 아닙니다.` });
                 }
-            }
-
-            const troopRows = await ctx.db.troop.findMany({
-                where: { nationId: general.nationId },
-                select: { troopLeaderId: true },
-            });
-            const cityRows = await ctx.db.city.findMany({ select: { id: true } });
-
-            const troopSet = new Set(troopRows.map((row) => row.troopLeaderId));
-            const citySet = new Set(cityRows.map((row) => row.id));
-            const assigned = new Set<number>();
-
-            const nationMeta = asRecord(nation.meta);
-            const policyRoot = asRecord(nationMeta.npc_nation_policy);
-            const nextValues = applyPolicyValues(DEFAULT_NATION_POLICY, asRecord(policyRoot.values));
-
-            for (const key of INTEGER_POLICY_KEYS) {
-                if (!(key in input)) {
-                    continue;
+                if (!troopSet.has(rawValue)) {
+                    throw new TRPCError({
+                        code: 'BAD_REQUEST',
+                        message: `${rawValue}는 국가의 부대가 아닙니다.`,
+                    });
                 }
-                const value = input[key];
-                if (typeof value !== 'number' || !Number.isFinite(value) || !Number.isInteger(value)) {
-                    throw new TRPCError({ code: 'BAD_REQUEST', message: `${key}는 올바른 값이 아닙니다.` });
+                if (assigned.has(rawValue)) {
+                    throw new TRPCError({
+                        code: 'BAD_REQUEST',
+                        message: `부대(${rawValue})는 하나의 역할만 지정할 수 있습니다.`,
+                    });
                 }
-                nextValues[key] = Math.max(0, value);
+                assigned.add(rawValue);
+                list.push(rawValue);
             }
-
-            for (const key of FLOAT_POLICY_KEYS) {
-                if (!(key in input)) {
-                    continue;
-                }
-                const value = input[key];
-                if (typeof value !== 'number' || !Number.isFinite(value)) {
-                    throw new TRPCError({ code: 'BAD_REQUEST', message: `${key}는 올바른 값이 아닙니다.` });
-                }
-                nextValues[key] = Math.max(0, value);
+            if (key === 'SupportForce') {
+                nextValues.SupportForce = list;
+            } else {
+                nextValues.DevelopForce = list;
             }
+        }
 
-            if ('CombatForce' in input) {
-                const rawCombat = input.CombatForce;
-                if (!isRecord(rawCombat)) {
-                    throw new TRPCError({ code: 'BAD_REQUEST', message: 'CombatForce는 올바른 정책값이 아닙니다.' });
-                }
-                const combatForce: Record<number, [number, number]> = {};
-                for (const [rawKey, rawValue] of Object.entries(rawCombat)) {
-                    const leaderId = Number(rawKey);
-                    if (!Number.isFinite(leaderId)) {
-                        throw new TRPCError({ code: 'BAD_REQUEST', message: `${rawKey}는 올바른 부대가 아닙니다.` });
-                    }
-                    if (!troopSet.has(leaderId)) {
-                        throw new TRPCError({ code: 'BAD_REQUEST', message: `${leaderId}는 국가의 부대가 아닙니다.` });
-                    }
-                    if (assigned.has(leaderId)) {
-                        throw new TRPCError({
-                            code: 'BAD_REQUEST',
-                            message: `부대(${leaderId})는 하나의 역할만 지정할 수 있습니다.`,
-                        });
-                    }
-                    if (!Array.isArray(rawValue) || rawValue.length < 2) {
-                        throw new TRPCError({ code: 'BAD_REQUEST', message: `${leaderId}의 입력양식이 올바르지 않습니다.` });
-                    }
-                    const fromCity = Number(rawValue[0]);
-                    const toCity = Number(rawValue[1]);
-                    if (!citySet.has(fromCity) || !citySet.has(toCity)) {
-                        throw new TRPCError({
-                            code: 'BAD_REQUEST',
-                            message: `${leaderId}의 도시 ${fromCity}, ${toCity}가 올바른 도시 번호가 아닙니다.`,
-                        });
-                    }
-                    combatForce[leaderId] = [fromCity, toCity];
-                    assigned.add(leaderId);
-                }
-                nextValues.CombatForce = combatForce;
+        const nextPolicyRoot = {
+            ...policyRoot,
+            values: nextValues,
+            valueSetter: general.name,
+            valueSetTime: new Date().toISOString(),
+        };
+
+        await updateNationMeta(
+            ctx,
+            nation.id,
+            {
+                npc_nation_policy: nextPolicyRoot,
+            },
+            nationMeta
+        );
+
+        return { ok: true };
+    }),
+    setNationPriority: authedProcedure.input(z.array(z.string())).mutation(async ({ ctx, input }) => {
+        const general = await getMyGeneral(ctx);
+        if (general.nationId <= 0) {
+            throw new TRPCError({ code: 'PRECONDITION_FAILED', message: 'Nation membership required.' });
+        }
+
+        const nation = await ctx.db.nation.findUnique({
+            where: { id: general.nationId },
+            select: { id: true, meta: true },
+        });
+        if (!nation) {
+            throw new TRPCError({ code: 'NOT_FOUND', message: 'Nation not found' });
+        }
+
+        const permissionLevel = resolveSecretPermission(
+            {
+                nationId: general.nationId,
+                officerLevel: general.officerLevel,
+                meta: general.meta,
+                penalty: general.penalty,
+            },
+            nation.meta
+        );
+        if (permissionLevel < 3) {
+            throw new TRPCError({ code: 'FORBIDDEN', message: '권한이 부족합니다.' });
+        }
+
+        for (const item of input) {
+            if (!DEFAULT_NATION_PRIORITY.includes(item as (typeof DEFAULT_NATION_PRIORITY)[number])) {
+                throw new TRPCError({ code: 'BAD_REQUEST', message: `${item}은 올바른 명령이 아닙니다.` });
             }
+        }
 
-            for (const key of ['SupportForce', 'DevelopForce'] as const) {
-                if (!(key in input)) {
-                    continue;
-                }
-                const rawList = input[key];
-                if (!Array.isArray(rawList)) {
-                    throw new TRPCError({ code: 'BAD_REQUEST', message: `${key}는 올바른 정책값이 아닙니다.` });
-                }
-                const list: number[] = [];
-                for (const rawValue of rawList) {
-                    if (typeof rawValue !== 'number' || !Number.isFinite(rawValue)) {
-                        throw new TRPCError({ code: 'BAD_REQUEST', message: `${key}는 올바른 정책값이 아닙니다.` });
-                    }
-                    if (!troopSet.has(rawValue)) {
-                        throw new TRPCError({
-                            code: 'BAD_REQUEST',
-                            message: `${rawValue}는 국가의 부대가 아닙니다.`,
-                        });
-                    }
-                    if (assigned.has(rawValue)) {
-                        throw new TRPCError({
-                            code: 'BAD_REQUEST',
-                            message: `부대(${rawValue})는 하나의 역할만 지정할 수 있습니다.`,
-                        });
-                    }
-                    assigned.add(rawValue);
-                    list.push(rawValue);
-                }
-                if (key === 'SupportForce') {
-                    nextValues.SupportForce = list;
-                } else {
-                    nextValues.DevelopForce = list;
-                }
-            }
+        const nationMeta = asRecord(nation.meta);
+        const policyRoot = asRecord(nationMeta.npc_nation_policy);
+        const nextPolicyRoot = {
+            ...policyRoot,
+            priority: input,
+            prioritySetter: general.name,
+            prioritySetTime: new Date().toISOString(),
+        };
 
-            const nextPolicyRoot = {
-                ...policyRoot,
-                values: nextValues,
-                valueSetter: general.name,
-                valueSetTime: new Date().toISOString(),
-            };
+        await updateNationMeta(
+            ctx,
+            nation.id,
+            {
+                npc_nation_policy: nextPolicyRoot,
+            },
+            nationMeta
+        );
 
-            await updateNationMeta(
-                ctx,
-                nation.id,
-                {
-                    npc_nation_policy: nextPolicyRoot,
-                },
-                nationMeta
-            );
+        return { ok: true };
+    }),
+    setGeneralPriority: authedProcedure.input(z.array(z.string())).mutation(async ({ ctx, input }) => {
+        const general = await getMyGeneral(ctx);
+        if (general.nationId <= 0) {
+            throw new TRPCError({ code: 'PRECONDITION_FAILED', message: 'Nation membership required.' });
+        }
 
-            return { ok: true };
-        }),
-    setNationPriority: authedProcedure
-        .input(z.array(z.string()))
-        .mutation(async ({ ctx, input }) => {
-            const general = await getMyGeneral(ctx);
-            if (general.nationId <= 0) {
-                throw new TRPCError({ code: 'PRECONDITION_FAILED', message: 'Nation membership required.' });
-            }
+        const nation = await ctx.db.nation.findUnique({
+            where: { id: general.nationId },
+            select: { id: true, meta: true },
+        });
+        if (!nation) {
+            throw new TRPCError({ code: 'NOT_FOUND', message: 'Nation not found' });
+        }
 
-            const nation = await ctx.db.nation.findUnique({
-                where: { id: general.nationId },
-                select: { id: true, meta: true },
-            });
-            if (!nation) {
-                throw new TRPCError({ code: 'NOT_FOUND', message: 'Nation not found' });
-            }
+        const permissionLevel = resolveSecretPermission(
+            {
+                nationId: general.nationId,
+                officerLevel: general.officerLevel,
+                meta: general.meta,
+                penalty: general.penalty,
+            },
+            nation.meta
+        );
+        if (permissionLevel < 3) {
+            throw new TRPCError({ code: 'FORBIDDEN', message: '권한이 부족합니다.' });
+        }
 
-            const permissionLevel = resolveSecretPermission(
-                {
-                    nationId: general.nationId,
-                    officerLevel: general.officerLevel,
-                    meta: general.meta,
-                    penalty: general.penalty,
-                },
-                nation.meta
-            );
-            if (permissionLevel < 3) {
-                throw new TRPCError({ code: 'FORBIDDEN', message: '권한이 부족합니다.' });
-            }
+        const validationError = validateGeneralPriority(input);
+        if (validationError) {
+            throw new TRPCError({ code: 'BAD_REQUEST', message: validationError });
+        }
 
-            const unique = ensureUniquePriority(input);
-            for (const item of unique) {
-                if (!DEFAULT_NATION_PRIORITY.includes(item as (typeof DEFAULT_NATION_PRIORITY)[number])) {
-                    throw new TRPCError({ code: 'BAD_REQUEST', message: `${item}은 올바른 명령이 아닙니다.` });
-                }
-            }
+        const nationMeta = asRecord(nation.meta);
+        const policyRoot = asRecord(nationMeta.npc_general_policy);
+        const nextPolicyRoot = {
+            ...policyRoot,
+            priority: input,
+            prioritySetter: general.name,
+            prioritySetTime: new Date().toISOString(),
+        };
 
-            const nationMeta = asRecord(nation.meta);
-            const policyRoot = asRecord(nationMeta.npc_nation_policy);
-            const nextPolicyRoot = {
-                ...policyRoot,
-                priority: unique,
-                prioritySetter: general.name,
-                prioritySetTime: new Date().toISOString(),
-            };
+        await updateNationMeta(
+            ctx,
+            nation.id,
+            {
+                npc_general_policy: nextPolicyRoot,
+            },
+            nationMeta
+        );
 
-            await updateNationMeta(
-                ctx,
-                nation.id,
-                {
-                    npc_nation_policy: nextPolicyRoot,
-                },
-                nationMeta
-            );
-
-            return { ok: true };
-        }),
-    setGeneralPriority: authedProcedure
-        .input(z.array(z.string()))
-        .mutation(async ({ ctx, input }) => {
-            const general = await getMyGeneral(ctx);
-            if (general.nationId <= 0) {
-                throw new TRPCError({ code: 'PRECONDITION_FAILED', message: 'Nation membership required.' });
-            }
-
-            const nation = await ctx.db.nation.findUnique({
-                where: { id: general.nationId },
-                select: { id: true, meta: true },
-            });
-            if (!nation) {
-                throw new TRPCError({ code: 'NOT_FOUND', message: 'Nation not found' });
-            }
-
-            const permissionLevel = resolveSecretPermission(
-                {
-                    nationId: general.nationId,
-                    officerLevel: general.officerLevel,
-                    meta: general.meta,
-                    penalty: general.penalty,
-                },
-                nation.meta
-            );
-            if (permissionLevel < 3) {
-                throw new TRPCError({ code: 'FORBIDDEN', message: '권한이 부족합니다.' });
-            }
-
-            const unique = ensureUniquePriority(input);
-            const validationError = validateGeneralPriority(unique);
-            if (validationError) {
-                throw new TRPCError({ code: 'BAD_REQUEST', message: validationError });
-            }
-
-            const nationMeta = asRecord(nation.meta);
-            const policyRoot = asRecord(nationMeta.npc_general_policy);
-            const nextPolicyRoot = {
-                ...policyRoot,
-                priority: unique,
-                prioritySetter: general.name,
-                prioritySetTime: new Date().toISOString(),
-            };
-
-            await updateNationMeta(
-                ctx,
-                nation.id,
-                {
-                    npc_general_policy: nextPolicyRoot,
-                },
-                nationMeta
-            );
-
-            return { ok: true };
-        }),
+        return { ok: true };
+    }),
 });

app/game-api/src/router/public/index.ts

@@ -42,6 +42,14 @@ type NationCountRow = {
 
 type NpcListSort = 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8;
 
+type TrafficHistoryItem = {
+    year: number;
+    month: number;
+    refresh: number;
+    online: number;
+    date: string;
+};
+
 const PUBLIC_CACHE_TTL_SECONDS = 600;
 
 const buildPublicCacheKey = (ctx: GameApiContext, key: string): string =>
@@ -163,6 +171,26 @@ const readFiniteMetaNumber = (meta: Record<string, unknown>, key: string): numbe
     return typeof value === 'number' && Number.isFinite(value) ? value : 0;
 };
 
+const parseTrafficHistory = (value: unknown): TrafficHistoryItem[] => {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+
+    const result: TrafficHistoryItem[] = [];
+    for (const item of value) {
+        const row = asRecord(item);
+        const year = readFiniteMetaNumber(row, 'year');
+        const month = readFiniteMetaNumber(row, 'month');
+        const refresh = readFiniteMetaNumber(row, 'refresh');
+        const online = readFiniteMetaNumber(row, 'online');
+        const date = typeof row.date === 'string' ? row.date : '';
+        if (year > 0 && month > 0 && date) {
+            result.push({ year, month, refresh, online, date });
+        }
+    }
+    return result;
+};
+
 const compareString = (left: string, right: string): number => {
     if (left === right) {
         return 0;
@@ -222,6 +250,95 @@ export const publicRouter = router({
     getNationList: procedure.query(async ({ ctx }) => {
         return loadCachedNationList(ctx);
     }),
+    getTraffic: procedure.query(async ({ ctx }) => {
+        const worldState = await ctx.db.worldState.findFirst();
+        if (!worldState) {
+            throw new TRPCError({
+                code: 'PRECONDITION_FAILED',
+                message: 'World state is not initialized.',
+            });
+        }
+
+        const meta = asRecord(worldState.meta);
+        const rawOnlineSince = meta.lastTurnTime ?? meta.turntime;
+        const parsedOnlineSince =
+            typeof rawOnlineSince === 'string' || rawOnlineSince instanceof Date
+                ? new Date(rawOnlineSince)
+                : null;
+        const onlineSince =
+            parsedOnlineSince && Number.isFinite(parsedOnlineSince.getTime())
+                ? parsedOnlineSince
+                : new Date(Date.now() - worldState.tickSeconds * 1_000);
+        const [accessTotal, currentOnline, topAccess] = await Promise.all([
+            ctx.db.generalAccessLog.aggregate({
+                _sum: {
+                    refresh: true,
+                    refreshScoreTotal: true,
+                },
+            }),
+            ctx.db.generalAccessLog.count({
+                where: {
+                    lastRefresh: {
+                        gte: onlineSince,
+                    },
+                },
+            }),
+            ctx.db.generalAccessLog.findMany({
+                orderBy: [{ refresh: 'desc' }, { generalId: 'asc' }],
+                take: 5,
+                select: {
+                    generalId: true,
+                    refresh: true,
+                    refreshScoreTotal: true,
+                },
+            }),
+        ]);
+
+        const generalIds = topAccess.map((entry) => entry.generalId);
+        const generalRows =
+            generalIds.length > 0
+                ? await ctx.db.general.findMany({
+                      where: { id: { in: generalIds } },
+                      select: { id: true, name: true },
+                  })
+                : [];
+        const generalName = new Map(generalRows.map((general) => [general.id, general.name]));
+        const totalRefresh = accessTotal._sum.refresh ?? 0;
+        const totalRefreshScore = accessTotal._sum.refreshScoreTotal ?? 0;
+        const currentRefresh = Math.max(readFiniteMetaNumber(meta, 'refresh'), totalRefresh);
+        const history = parseTrafficHistory(meta.recentTraffic);
+        history.push({
+            year: worldState.currentYear,
+            month: worldState.currentMonth,
+            refresh: currentRefresh,
+            online: currentOnline,
+            date: new Date().toISOString(),
+        });
+
+        return {
+            history,
+            maxRefresh: Math.max(
+                1,
+                readFiniteMetaNumber(meta, 'maxrefresh'),
+                ...history.map((entry) => entry.refresh)
+            ),
+            maxOnline: Math.max(1, readFiniteMetaNumber(meta, 'maxonline'), ...history.map((entry) => entry.online)),
+            suspects: [
+                {
+                    generalId: null,
+                    name: '접속자 총합',
+                    refresh: totalRefresh,
+                    refreshScoreTotal: totalRefreshScore,
+                },
+                ...topAccess.map((entry) => ({
+                    generalId: entry.generalId,
+                    name: generalName.get(entry.generalId) ?? `장수 ${entry.generalId}`,
+                    refresh: entry.refresh,
+                    refreshScoreTotal: entry.refreshScoreTotal,
+                })),
+            ],
+        };
+    }),
     getGeneralList: procedure.query(async ({ ctx }) => {
         const [generals, nations] = await Promise.all([
             ctx.db.general.findMany({

app/game-api/src/router/ranking/index.ts

@@ -2,8 +2,11 @@ import { z } from 'zod';
 
 import { asRecord, HALL_OF_FAME_TYPES, type HallOfFameType } from '@sammo-ts/common';
 import { ITEM_KEYS, ItemLoader, loadItemModules } from '@sammo-ts/logic/items/index.js';
+import type { ItemModule } from '@sammo-ts/logic/items/types.js';
+import { buildLegacyDefaultUniqueItemPool } from '@sammo-ts/logic/rewards/legacyUniqueItemPool.js';
+import { resolveUniqueConfig } from '@sammo-ts/logic/rewards/uniqueLottery.js';
 
-import { procedure, router } from '../../trpc.js';
+import { authedProcedure, procedure, router } from '../../trpc.js';
 
 const DEFAULT_BG_COLOR = '#2b2b2b';
 const DEFAULT_FG_COLOR = '#ffffff';
@@ -23,31 +26,31 @@ const readMetaNumber = (value: unknown): number => {
 
 const percentText = (value: number): string => `${(value * 100).toFixed(2)}%`;
 
+const readOwnerDisplayName = (value: unknown): string | null => {
+    const meta = asRecord(value);
+    if (typeof meta.ownerName === 'string' && meta.ownerName.length > 0) {
+        return meta.ownerName;
+    }
+    if (typeof meta.owner_name === 'string' && meta.owner_name.length > 0) {
+        return meta.owner_name;
+    }
+    return null;
+};
+
 const itemLoader = new ItemLoader();
-let cachedUniqueItems: Promise<
-    Array<{ key: string; name: string; slot: string; unique: boolean; buyable: boolean; info: string }>
-> | null = null;
+let cachedUniqueItems: Promise<ItemModule[]> | null = null;
 
 const loadUniqueItems = () => {
     if (!cachedUniqueItems) {
         cachedUniqueItems = loadItemModules([...ITEM_KEYS], itemLoader).then((modules) =>
-            modules
-                .filter((module) => module.unique && !module.buyable)
-                .map((module) => ({
-                    key: module.key,
-                    name: module.name,
-                    slot: module.slot,
-                    unique: module.unique,
-                    buyable: module.buyable,
-                    info: module.info,
-                }))
+            modules.filter((module) => module.unique && !module.buyable)
         );
     }
     return cachedUniqueItems;
 };
 
 export const rankingRouter = router({
-    getBestGeneral: procedure
+    getBestGeneral: authedProcedure
         .input(
             z
                 .object({
@@ -57,7 +60,7 @@ export const rankingRouter = router({
         )
         .query(async ({ ctx, input }) => {
             const worldState = await ctx.db.worldState.findFirst({
-                select: { meta: true },
+                select: { meta: true, config: true },
             });
             const meta = asRecord(worldState?.meta);
             const isUnited = typeof meta.isUnited === 'number' && meta.isUnited !== 0;
@@ -76,6 +79,7 @@ export const rankingRouter = router({
                         userId: true,
                         picture: true,
                         imageServer: true,
+                        meta: true,
                         experience: true,
                         dedication: true,
                         horseCode: true,
@@ -185,7 +189,7 @@ export const rankingRouter = router({
                         let display = {
                             id: general.id,
                             name: general.name,
-                            ownerName: general.userId ?? null,
+                            ownerName: isUnited ? readOwnerDisplayName(general.meta) : null,
                             nationName: nation?.name ?? '재야',
                             bgColor: nation?.color ?? DEFAULT_BG_COLOR,
                             fgColor: DEFAULT_FG_COLOR,
@@ -217,46 +221,91 @@ export const rankingRouter = router({
             });
 
             const uniqueItems = await loadUniqueItems();
-            const itemEntries = uniqueItems.map((item) => {
-                const owners = generals.filter((general) => {
-                    if (item.slot === 'horse') {
-                        return general.horseCode === item.key;
+            const itemRegistry = new Map(uniqueItems.map((item) => [item.key, item]));
+            const uniqueConfig = resolveUniqueConfig(asRecord(asRecord(worldState?.config).const));
+            if (Object.keys(uniqueConfig.allItems).length === 0) {
+                uniqueConfig.allItems = buildLegacyDefaultUniqueItemPool(itemRegistry);
+            }
+            const activeAuctions = await ctx.db.auction.findMany({
+                where: {
+                    type: 'UNIQUE_ITEM',
+                    status: { in: ['OPEN', 'FINALIZING'] },
+                    targetCode: { not: null },
+                },
+                select: { targetCode: true },
+            });
+            const auctionCounts = new Map<string, number>();
+            for (const auction of activeAuctions) {
+                if (auction.targetCode) {
+                    auctionCounts.set(auction.targetCode, (auctionCounts.get(auction.targetCode) ?? 0) + 1);
+                }
+            }
+            const slotTitles = {
+                horse: '명 마',
+                weapon: '명 검',
+                book: '명 서',
+                item: '도 구',
+            } as const;
+            const itemEntries = (['horse', 'weapon', 'book', 'item'] as const).map((slot) => {
+                const configuredItems = Object.entries(uniqueConfig.allItems[slot] ?? {}).reverse();
+                const entries = configuredItems.flatMap(([itemKey, rawCount]) => {
+                    const item = itemRegistry.get(itemKey);
+                    if (!item || item.buyable) {
+                        return [];
                     }
-                    if (item.slot === 'weapon') {
-                        return general.weaponCode === item.key;
+                    const owners = generals
+                        .filter((general) => {
+                            if (slot === 'horse') {
+                                return general.horseCode === itemKey;
+                            }
+                            if (slot === 'weapon') {
+                                return general.weaponCode === itemKey;
+                            }
+                            if (slot === 'book') {
+                                return general.bookCode === itemKey;
+                            }
+                            return general.itemCode === itemKey;
+                        })
+                        .map((general) => {
+                            const nation = nationMap.get(general.nationId) ?? null;
+                            return {
+                                id: general.id,
+                                name: general.name,
+                                nationName: nation?.name ?? '재야',
+                                bgColor: nation?.color ?? DEFAULT_BG_COLOR,
+                                fgColor: DEFAULT_FG_COLOR,
+                                picture: general.picture ?? null,
+                                imageServer: general.imageServer ?? 0,
+                            };
+                        });
+                    for (let index = 0; index < (auctionCounts.get(itemKey) ?? 0); index += 1) {
+                        owners.push({
+                            id: 0,
+                            name: '경매중',
+                            nationName: '-',
+                            bgColor: '#00582c',
+                            fgColor: '#ffffff',
+                            picture: null,
+                            imageServer: 0,
+                        });
                     }
-                    if (item.slot === 'book') {
-                        return general.bookCode === item.key;
-                    }
-                    return general.itemCode === item.key;
+                    const count = Math.max(0, Math.floor(rawCount));
+                    return Array.from({ length: count }, (_, index) => ({
+                        itemKey,
+                        itemName: item.name,
+                        itemInfo: item.info,
+                        owner: owners[index] ?? {
+                            id: 0,
+                            name: '미발견',
+                            nationName: '-',
+                            bgColor: DEFAULT_BG_COLOR,
+                            fgColor: DEFAULT_FG_COLOR,
+                            picture: null,
+                            imageServer: 0,
+                        },
+                    }));
                 });
-
-                const displayOwners = owners.length
-                    ? owners.map((general) => {
-                          const nation = nationMap.get(general.nationId) ?? null;
-                          return {
-                              id: general.id,
-                              name: general.name,
-                              nationName: nation?.name ?? '재야',
-                              bgColor: nation?.color ?? DEFAULT_BG_COLOR,
-                              fgColor: DEFAULT_FG_COLOR,
-                          };
-                      })
-                    : [
-                          {
-                              id: 0,
-                              name: '미발견',
-                              nationName: '-',
-                              bgColor: DEFAULT_BG_COLOR,
-                              fgColor: DEFAULT_FG_COLOR,
-                          },
-                      ];
-
-                return {
-                    title: item.name,
-                    slot: item.slot,
-                    owners: displayOwners,
-                };
+                return { title: slotTitles[slot], slot, entries };
             });
 
             return {
@@ -339,6 +388,10 @@ export const rankingRouter = router({
                         return {
                             generalId: row.generalNo,
                             name: String(aux.name ?? ''),
+                            ownerName:
+                                typeof aux.ownerDisplayName === 'string' && aux.ownerDisplayName.length > 0
+                                    ? aux.ownerDisplayName
+                                    : null,
                             nationName: String(aux.nationName ?? ''),
                             bgColor: String(aux.bgColor ?? DEFAULT_BG_COLOR),
                             fgColor: String(aux.fgColor ?? DEFAULT_FG_COLOR),

app/game-api/src/router/world/index.ts

@@ -7,6 +7,7 @@ import { authedProcedure } from '../../trpc.js';
 import { asRecord, isRecord } from '@sammo-ts/common';
 import { loadWorldMap } from '../../maps/worldMap.js';
 import { loadMapLayout } from '../../maps/mapLayout.js';
+import { loadUnitSetDefinitionByName } from '../../battleSim/unitSetLoader.js';
 import { getMyGeneral, getOwnedGeneral } from '../shared/general.js';
 
 const isWorldAdmin = (roles: readonly string[]): boolean =>
@@ -33,6 +34,29 @@ const defenceTrain = (meta: unknown): number => {
     return typeof raw === 'number' && Number.isFinite(raw) ? raw : 0;
 };
 
+const unitSetName = (world: WorldStateRow | null, fallback: string): string => {
+    const config = asRecord(world?.config);
+    const environment = asRecord(config.environment ?? config.map);
+    return typeof environment.unitSet === 'string' && environment.unitSet.trim() ? environment.unitSet : fallback;
+};
+
+const crewTypeNameCache = new Map<string, Promise<Map<number, string>>>();
+const loadCrewTypeNames = (name: string): Promise<Map<number, string>> => {
+    const cached = crewTypeNameCache.get(name);
+    if (cached) return cached;
+    const pending = loadUnitSetDefinitionByName(name)
+        .then((definition) => new Map((definition.crewTypes ?? []).map((crewType) => [crewType.id, crewType.name])))
+        .catch(() => new Map<number, string>());
+    crewTypeNameCache.set(name, pending);
+    return pending;
+};
+
+const leadershipBonus = (officerLevel: number, nationLevel: number): number => {
+    if (officerLevel === 12) return nationLevel * 2;
+    if (officerLevel >= 5) return nationLevel;
+    return 0;
+};
+
 const toWorldStateSnapshot = (row: WorldStateRow) => ({
     scenarioCode: row.scenarioCode,
     currentYear: row.currentYear,
@@ -122,6 +146,8 @@ export const worldRouter = router({
             if (me.officerLevel > 0 && me.nationId > 0) {
                 cities.filter((city) => city.nationId === me.nationId).forEach((city) => selectable.add(city.id));
                 nationGenerals.forEach((general) => selectable.add(general.cityId));
+            }
+            if ((nation?.level ?? 0) > 0) {
                 Object.keys(spy).forEach((id) => selectable.add(Number(id)));
             }
             if (admin) cities.forEach((city) => selectable.add(city.id));
@@ -150,6 +176,8 @@ export const worldRouter = router({
                 turnMap.set(turn.generalId, list);
             }
             const nationMap = new Map(nations.map((item) => [item.id, item]));
+            const selectedNation = nationMap.get(selected.nationId);
+            const crewTypeNames = await loadCrewTypeNames(unitSetName(world, ctx.profile.id));
             const officers = await ctx.db.general.findMany({
                 where: { officerLevel: { in: [2, 3, 4] } },
                 select: { name: true, officerLevel: true, meta: true },
@@ -175,14 +203,59 @@ export const worldRouter = router({
                     intelligence: general.intel,
                     injury: general.injury,
                     officerLevel: general.officerLevel,
+                    leadershipBonus: leadershipBonus(general.officerLevel, nationMap.get(general.nationId)?.level ?? 0),
                     defenceTrain: ours ? defenceTrain(general.meta) : null,
                     crewTypeId: ours ? general.crewTypeId : null,
+                    crewTypeName: ours ? (crewTypeNames.get(general.crewTypeId) ?? null) : null,
                     crew: ours || full ? general.crew : null,
                     train: ours ? general.train : null,
                     atmos: ours ? general.atmos : null,
                     turns: ours && general.npcState <= 1 ? (turnMap.get(general.id) ?? []) : [],
                 };
             });
+            const forceSummary = mappedGenerals.reduce(
+                (summary, general) => {
+                    if (general.nationId > 0 && me.nationId > 0 && general.nationId !== me.nationId) {
+                        summary.enemyGenerals += 1;
+                        if (general.crew !== null && general.crew >= 0) summary.enemyCrew += general.crew;
+                        if (general.crew !== null && general.crew > 0) summary.enemyArmedGenerals += 1;
+                        return summary;
+                    }
+                    if (me.nationId <= 0 || general.nationId !== me.nationId) return summary;
+                    summary.ownGenerals += 1;
+                    summary.ownCrew += general.crew ?? 0;
+                    if ((general.crew ?? 0) <= 0) return summary;
+                    summary.ownArmedGenerals += 1;
+                    const readiness = Math.min(general.train ?? -1, general.atmos ?? -1);
+                    if (readiness >= 90) {
+                        summary.ready90Crew += general.crew ?? 0;
+                        summary.ready90Generals += 1;
+                    }
+                    if (readiness >= 60) {
+                        summary.ready60Crew += general.crew ?? 0;
+                        summary.ready60Generals += 1;
+                    }
+                    if (general.defenceTrain !== null && readiness >= general.defenceTrain) {
+                        summary.defenceReadyCrew += general.crew ?? 0;
+                        summary.defenceReadyGenerals += 1;
+                    }
+                    return summary;
+                },
+                {
+                    enemyCrew: 0,
+                    enemyArmedGenerals: 0,
+                    enemyGenerals: 0,
+                    ownCrew: 0,
+                    ownArmedGenerals: 0,
+                    ownGenerals: 0,
+                    ready90Crew: 0,
+                    ready90Generals: 0,
+                    ready60Crew: 0,
+                    ready60Generals: 0,
+                    defenceReadyCrew: 0,
+                    defenceReadyGenerals: 0,
+                }
+            );
             return {
                 me: { id: me.id, nationId: me.nationId, officerLevel: me.officerLevel, admin },
                 options: [...selectable]
@@ -194,6 +267,7 @@ export const worldRouter = router({
                     id: selected.id,
                     name: selected.name,
                     nationId: selected.nationId,
+                    nationColor: selectedNation?.color ?? '#000000',
                     level: selected.level,
                     region: selected.region,
                     population: redact(selected.population),
@@ -217,8 +291,11 @@ export const worldRouter = router({
                     },
                 },
                 generals: mappedGenerals,
+                forceSummary,
                 lastExecute:
-                    typeof asRecord(world?.meta).turntime === 'string' ? String(asRecord(world?.meta).turntime) : '',
+                    typeof asRecord(world?.meta).turntime === 'string'
+                        ? String(asRecord(world?.meta).turntime).slice(5, 19)
+                        : '',
             };
         }),
     getState: procedure.query(async ({ ctx }) => {

app/game-api/src/tournament/worker.ts

@@ -1,15 +1,15 @@
-import { createTournamentRng } from '@sammo-ts/common';
+import { createTournamentRng, type TurnDaemonCommandResult } from '@sammo-ts/common';
 import { resolveTournamentBattle } from '@sammo-ts/logic';
 import {
     createGamePostgresConnector,
     createRedisConnector,
     resolvePostgresConfigFromEnv,
     resolveRedisConfigFromEnv,
+    type GamePrismaClient,
 } from '@sammo-ts/infra';
 
 import { resolveGameApiConfigFromEnv } from '../config.js';
-import { RedisTurnDaemonTransport } from '../daemon/redisTransport.js';
-import { buildTurnDaemonStreamKeys } from '../daemon/streamKeys.js';
+import { DatabaseTurnDaemonTransport } from '../daemon/databaseTransport.js';
 import type { TurnDaemonTransport } from '../daemon/transport.js';
 import { buildTournamentKeys } from './keys.js';
 import { TournamentStore } from './store.js';
@@ -462,13 +462,30 @@ export const settleTournamentOutcome = async (options: {
         return null;
     }
 
-    let settledState: TournamentState | null = null;
+    let settledState = state;
+    let changed = false;
 
-    if (!state.rewardSettled) {
+    const requireSuccessfulResult = (
+        result: TurnDaemonCommandResult | null,
+        expectedType: TurnDaemonCommandResult['type']
+    ): void => {
+        if (!result) {
+            throw new Error(`${expectedType} 명령 응답 시간이 초과되었습니다.`);
+        }
+        if (result.type !== expectedType) {
+            throw new Error(`${expectedType} 명령에 잘못된 응답(${result.type})을 받았습니다.`);
+        }
+        if (!result.ok) {
+            throw new Error(`${expectedType} 명령이 실패했습니다: ${result.reason}`);
+        }
+    };
+
+    if (!settledState.rewardSettled) {
         const matches = await store.getMatches();
         const rewardPayload = buildTournamentRewardPayload(matches);
-        await daemonTransport.sendCommand({
+        const result = await daemonTransport.requestCommand({
             type: 'tournamentReward',
+            requestId: `tournament:${state.bettingId ?? `${state.openYear}:${state.openMonth}:${state.type}`}:reward`,
             tournamentType: state.type,
             winnerId: rewardPayload.winnerId,
             runnerUpId: rewardPayload.runnerUpId,
@@ -476,46 +493,100 @@ export const settleTournamentOutcome = async (options: {
             top8: rewardPayload.top8,
             top4: rewardPayload.top4,
         });
+        requireSuccessfulResult(result, 'tournamentReward');
         settledState = {
-            ...(settledState ?? state),
+            ...settledState,
             rewardSettled: true,
         };
+        changed = true;
+        await store.setState(settledState);
     }
 
-    if (state.bettingId && !state.bettingSettled) {
+    if (settledState.bettingId && !settledState.bettingSettled) {
         const bettingEntries = await store.getBettingEntries();
         if (bettingEntries.length > 0) {
-            const payoutInfo = buildBettingPayouts(state.winnerId, bettingEntries);
+            const payoutInfo = buildBettingPayouts(settledState.winnerId!, bettingEntries);
             if (payoutInfo.payouts.length > 0) {
                 if (payoutInfo.refundAll) {
-                    await daemonTransport.sendCommand({
+                    const result = await daemonTransport.requestCommand({
                         type: 'tournamentRefund',
-                        bettingId: state.bettingId,
+                        requestId: `tournament:${settledState.bettingId}:betting-refund`,
+                        bettingId: settledState.bettingId,
                         refunds: payoutInfo.payouts,
                         reason: 'no_winner',
                     });
+                    requireSuccessfulResult(result, 'tournamentRefund');
                 } else {
-                    await daemonTransport.sendCommand({
+                    const result = await daemonTransport.requestCommand({
                         type: 'tournamentBettingPayout',
-                        bettingId: state.bettingId,
+                        requestId: `tournament:${settledState.bettingId}:betting-payout`,
+                        bettingId: settledState.bettingId,
                         payouts: payoutInfo.payouts,
                         reason: 'winner_payout',
                     });
+                    requireSuccessfulResult(result, 'tournamentBettingPayout');
                 }
             }
         }
 
         settledState = {
-            ...(settledState ?? state),
+            ...settledState,
             bettingSettled: true,
         };
-    }
-
-    if (settledState) {
+        changed = true;
         await store.setState(settledState);
     }
 
-    return settledState;
+    return changed ? settledState : null;
+};
+
+const needsSettlement = (state: TournamentState): boolean =>
+    state.stage === 0 &&
+    Boolean(state.winnerId) &&
+    (!state.rewardSettled || (Boolean(state.bettingId) && !state.bettingSettled));
+
+export const processTournamentTick = async (options: {
+    store: TournamentStore;
+    prisma: GamePrismaClient;
+    daemonTransport: TurnDaemonTransport;
+    now?: () => number;
+}): Promise<TournamentState | null> => {
+    const { store, prisma, daemonTransport } = options;
+    const now = options.now ?? Date.now;
+    let processedState: TournamentState | null = null;
+
+    await store.withMutationLock(async () => {
+        const state = await store.getState();
+        if (!state || (!state.auto && !needsSettlement(state))) {
+            return;
+        }
+        const nextAt = new Date(state.nextAt).getTime();
+        if (state.auto && Number.isFinite(nextAt) && nextAt > now()) {
+            return;
+        }
+
+        if (needsSettlement(state)) {
+            processedState = (await settleTournamentOutcome({ store, daemonTransport, state })) ?? state;
+            return;
+        }
+
+        const worldState = await prisma.worldState.findFirst();
+        const baseSeed = (worldState?.meta as Record<string, unknown> | null)?.hiddenSeed ?? 'tournament';
+        let nextState = state;
+        if (isBattleStage(state.stage)) {
+            nextState = await applyBattle(store, state, String(baseSeed), daemonTransport);
+        } else if (isPreBattleStage(state.stage)) {
+            nextState = await applyPreBattleStage(store, prisma, state, String(baseSeed), daemonTransport);
+        }
+        processedState =
+            (await settleTournamentOutcome({
+                store,
+                daemonTransport,
+                state: nextState,
+            })) ?? nextState;
+    });
+
+    return processedState;
 };
 
 export const runTournamentWorker = async (): Promise<void> => {
@@ -527,10 +598,7 @@ export const runTournamentWorker = async (): Promise<void> => {
     await redis.connect();
 
     const store = new TournamentStore(redis.client, buildTournamentKeys(config.profileName));
-    const daemonTransport = new RedisTurnDaemonTransport(redis.client, {
-        keys: buildTurnDaemonStreamKeys(config.profileName),
-        requestTimeoutMs: config.daemonRequestTimeoutMs,
-    });
+    const daemonTransport = new DatabaseTurnDaemonTransport(postgres.prisma, config.daemonRequestTimeoutMs);
 
     const handleExit = async () => {
         await redis.disconnect();
@@ -541,49 +609,23 @@ export const runTournamentWorker = async (): Promise<void> => {
 
     while (true) {
         const state = await store.getState();
-        if (!state || !state.auto) {
+        if (!state || (!state.auto && !needsSettlement(state))) {
             await sleepMs(config.tournamentPollMs);
             continue;
         }
 
         const nextAt = new Date(state.nextAt).getTime();
         const now = Date.now();
-        if (Number.isFinite(nextAt) && nextAt > now) {
+        if (state.auto && Number.isFinite(nextAt) && nextAt > now) {
             await sleepMs(Math.min(config.tournamentPollMs, nextAt - now));
             continue;
         }
 
         try {
-            await store.withMutationLock(async () => {
-                const lockedState = await store.getState();
-                if (!lockedState || !lockedState.auto) {
-                    return;
-                }
-                const lockedNextAt = new Date(lockedState.nextAt).getTime();
-                if (Number.isFinite(lockedNextAt) && lockedNextAt > Date.now()) {
-                    return;
-                }
-
-                const worldState = await postgres.prisma.worldState.findFirst();
-                const baseSeed = (worldState?.meta as Record<string, unknown> | null)?.hiddenSeed ?? 'tournament';
-                let nextState = lockedState;
-                if (isBattleStage(lockedState.stage)) {
-                    nextState = await applyBattle(store, lockedState, String(baseSeed), daemonTransport);
-                } else if (isPreBattleStage(lockedState.stage)) {
-                    nextState = await applyPreBattleStage(
-                        store,
-                        postgres.prisma,
-                        lockedState,
-                        String(baseSeed),
-                        daemonTransport
-                    );
-                }
-
-                await settleTournamentOutcome({
-                    store,
-                    daemonTransport,
-                    state: nextState,
-                });
+            await processTournamentTick({
+                store,
+                prisma: postgres.prisma,
+                daemonTransport,
             });
         } catch (error) {
             const message = error instanceof Error ? error.message : 'Unknown error';
@@ -603,9 +645,9 @@ export const runTournamentWorker = async (): Promise<void> => {
                     },
                 },
             });
+            const currentState = (await store.getState()) ?? state;
             const nextState: TournamentState = {
-                ...state,
-                auto: false,
+                ...currentState,
                 lastError: message,
                 lastErrorAt: now,
             };

app/game-api/src/tournament/workerHelpers.ts

@@ -520,8 +520,9 @@ export const buildBettingPayouts = (
     const winners = entries.filter((entry) => entry.targetId === winnerId);
     const winnersTotal = winners.reduce((sum, entry) => sum + entry.amount, 0);
     if (winnersTotal <= 0) {
-        const refunds = entries.map((entry) => ({ generalId: entry.generalId, amount: entry.amount }));
-        return { payouts: refunds, total, refundAll: true };
+        // Legacy Betting::_calcRewardExclusive() builds a refund candidate list
+        // but returns no rewards when nobody selected the winner.
+        return { payouts: [], total, refundAll: false };
     }
     const ratio = total / winnersTotal;
     const payouts = winners.map((entry) => ({

app/game-api/src/trpc.ts

@@ -7,6 +7,21 @@ import { DuplicateInputEventError, executeInputEvent } from './inputEventBoundar
 
 const t = initTRPC.context<GameApiContext>().create();
 
+const requireAuthMiddleware = t.middleware(({ ctx, next }) => {
+    if (!ctx.auth) {
+        throw new TRPCError({
+            code: 'UNAUTHORIZED',
+            message: 'Unauthorized',
+        });
+    }
+    return next({
+        ctx: {
+            ...ctx,
+            auth: ctx.auth,
+        },
+    });
+});
+
 const inputEventMiddleware = t.middleware(async ({ ctx, type, path, next }) => {
     if (type !== 'mutation' || !ctx.db.$transaction) {
         return next();
@@ -46,17 +61,8 @@ const inputEventMiddleware = t.middleware(async ({ ctx, type, path, next }) => {
 
 export const router = t.router;
 export const procedure = t.procedure.use(inputEventMiddleware);
-export const authedProcedure: typeof procedure = procedure.use(({ ctx, next }) => {
-    if (!ctx.auth) {
-        throw new TRPCError({
-            code: 'UNAUTHORIZED',
-            message: 'Unauthorized',
-        });
-    }
-    return next({
-        ctx: {
-            ...ctx,
-            auth: ctx.auth,
-        },
-    });
-});
+export const authedProcedure: typeof procedure = procedure.use(requireAuthMiddleware);
+
+// 시뮬레이터처럼 게임 상태를 변경하지 않는 계산은 input-event transaction과
+// 이벤트 원장을 만들지 않는다. 인증은 유지하되 lifecycle DB 경계 밖에서 실행한다.
+export const readOnlyAuthedProcedure: typeof procedure = t.procedure.use(requireAuthMiddleware);

app/game-api/src/turns/commandTable.ts

@@ -203,6 +203,8 @@ const buildCommandEnv = (worldState: WorldStateRow): CommandEnv => {
         initialAllowedTechLevel: resolveNumber(constValues, ['initialAllowedTechLevel'], 1),
         baseGold: resolveNumber(constValues, ['baseGold', 'basegold'], 0),
         baseRice: resolveNumber(constValues, ['baseRice', 'baserice'], 0),
+        generalMinimumGold: resolveNumber(constValues, ['generalMinimumGold'], 0),
+        generalMinimumRice: resolveNumber(constValues, ['generalMinimumRice'], 500),
         maxResourceActionAmount: resolveNumber(constValues, ['maxResourceActionAmount'], 0),
     };
 };

app/game-api/test/battleSimRouter.test.ts

@@ -19,19 +19,30 @@ const profile: GameProfile = {
 class QueuedBattleSimTransport implements BattleSimTransport {
     public simulateCalls = 0;
     public lastPayload: BattleSimJobPayload | null = null;
+    public lastRequesterUserId: string | null = null;
+    private readonly owners = new Map<string, string>();
     private readonly results = new Map<string, BattleSimResultPayload>();
 
-    async simulate(payload: BattleSimJobPayload) {
+    async simulate(payload: BattleSimJobPayload, requesterUserId: string) {
         this.simulateCalls += 1;
         this.lastPayload = payload;
-        return { status: 'queued', jobId: 'job-1' } as const;
+        this.lastRequesterUserId = requesterUserId;
+        const jobId = `job-${this.simulateCalls}`;
+        this.owners.set(jobId, requesterUserId);
+        return { status: 'queued', jobId } as const;
     }
 
-    async getSimulationResult(jobId: string) {
+    async getSimulationResult(jobId: string, requesterUserId: string) {
+        if (this.owners.get(jobId) !== requesterUserId) {
+            return null;
+        }
         return this.results.get(jobId) ?? null;
     }
 
-    pushResult(jobId: string, payload: BattleSimResultPayload) {
+    pushResult(jobId: string, requesterUserId: string, payload: BattleSimResultPayload) {
+        if (this.owners.get(jobId) !== requesterUserId) {
+            throw new Error('requester mismatch');
+        }
         this.results.set(jobId, payload);
     }
 }
@@ -194,8 +205,13 @@ const buildBattleRequest = () => ({
     },
 });
 
-const buildContext = (options: { state: WorldStateRow; battleSim: BattleSimTransport }): GameApiContext => {
-    const db = {
+const buildContext = (options: {
+    state: WorldStateRow;
+    battleSim: BattleSimTransport;
+    userId?: string | null;
+    db?: Partial<DatabaseClient>;
+}): GameApiContext => {
+    const db = options.db ?? {
         worldState: {
             findFirst: async () => options.state,
         },
@@ -207,20 +223,23 @@ const buildContext = (options: { state: WorldStateRow; battleSim: BattleSimTrans
         },
         profile.name
     );
-    const auth: GameSessionTokenPayload = {
-        version: 1,
-        profile: profile.name,
-        issuedAt: new Date('2026-01-01T00:00:00Z').toISOString(),
-        expiresAt: new Date('2026-01-02T00:00:00Z').toISOString(),
-        sessionId: 'session-1',
-        user: {
-            id: 'user-1',
-            username: 'tester',
-            displayName: 'Tester',
-            roles: [],
-        },
-        sanctions: {},
-    };
+    const auth: GameSessionTokenPayload | null =
+        options.userId === null
+            ? null
+            : {
+                  version: 1,
+                  profile: profile.name,
+                  issuedAt: new Date('2026-01-01T00:00:00Z').toISOString(),
+                  expiresAt: new Date('2026-01-02T00:00:00Z').toISOString(),
+                  sessionId: 'session-1',
+                  user: {
+                      id: options.userId ?? 'user-1',
+                      username: 'tester',
+                      displayName: 'Tester',
+                      roles: [],
+                  },
+                  sanctions: {},
+              };
     return {
         db: db as unknown as DatabaseClient,
         turnDaemon: new InMemoryTurnDaemonTransport(),
@@ -255,14 +274,204 @@ describe('battle router orchestration', () => {
         const response = await caller.battle.simulate(buildBattleRequest());
         expect(response.status).toBe('queued');
         expect(battleSim.simulateCalls).toBe(1);
+        expect(battleSim.lastRequesterUserId).toBe('user-1');
 
         const queued = await caller.battle.getSimulation({ jobId: response.jobId });
         expect(queued.status).toBe('queued');
 
-        battleSim.pushResult(response.jobId, { result: true, reason: 'success', avgWar: 1 });
+        battleSim.pushResult(response.jobId, 'user-1', { result: true, reason: 'success', avgWar: 1 });
 
         const completed = await caller.battle.getSimulation({ jobId: response.jobId });
         expect(completed.status).toBe('completed');
         expect(completed.payload?.result).toBe(true);
     });
+
+    it('requires login, allows a user without a general, and does not open an input-event transaction', async () => {
+        const battleSim = new QueuedBattleSimTransport();
+        const state: WorldStateRow = {
+            id: 1,
+            scenarioCode: 'default',
+            currentYear: 200,
+            currentMonth: 1,
+            tickSeconds: 600,
+            config: {},
+            meta: {},
+            updatedAt: new Date('2026-01-01T00:00:00Z'),
+        };
+        let transactionCalls = 0;
+        const db = {
+            worldState: { findFirst: async () => state },
+            $transaction: async () => {
+                transactionCalls += 1;
+                throw new Error('simulation must not create an input event transaction');
+            },
+        } as unknown as DatabaseClient;
+
+        const anonymous = appRouter.createCaller(buildContext({ state, battleSim, userId: null, db }));
+        await expect(anonymous.battle.simulate(buildBattleRequest())).rejects.toMatchObject({
+            code: 'UNAUTHORIZED',
+        });
+
+        const noGeneralUser = appRouter.createCaller(
+            buildContext({ state, battleSim, userId: 'user-without-general', db })
+        );
+        await expect(noGeneralUser.battle.simulate(buildBattleRequest())).resolves.toMatchObject({
+            status: 'queued',
+        });
+        expect(transactionCalls).toBe(0);
+        expect(battleSim.lastRequesterUserId).toBe('user-without-general');
+    });
+
+    it('does not expose queued results across authenticated users', async () => {
+        const battleSim = new QueuedBattleSimTransport();
+        const state: WorldStateRow = {
+            id: 1,
+            scenarioCode: 'default',
+            currentYear: 200,
+            currentMonth: 1,
+            tickSeconds: 600,
+            config: {},
+            meta: {},
+            updatedAt: new Date('2026-01-01T00:00:00Z'),
+        };
+        const owner = appRouter.createCaller(buildContext({ state, battleSim, userId: 'owner-user' }));
+        const other = appRouter.createCaller(buildContext({ state, battleSim, userId: 'other-user' }));
+        const response = await owner.battle.simulate(buildBattleRequest());
+        battleSim.pushResult(response.jobId, 'owner-user', { result: true, reason: 'success', avgWar: 7 });
+
+        await expect(owner.battle.getSimulation({ jobId: response.jobId })).resolves.toMatchObject({
+            status: 'completed',
+            payload: { avgWar: 7 },
+        });
+        await expect(other.battle.getSimulation({ jobId: response.jobId })).resolves.toEqual({
+            status: 'queued',
+            jobId: response.jobId,
+        });
+    });
+});
+
+describe('battle simulator general import permissions', () => {
+    const state: WorldStateRow = {
+        id: 1,
+        scenarioCode: 'default',
+        currentYear: 200,
+        currentMonth: 1,
+        tickSeconds: 600,
+        config: {},
+        meta: {},
+        updatedAt: new Date('2026-01-01T00:00:00Z'),
+    };
+
+    const buildGeneral = (overrides: Record<string, unknown>) => ({
+        id: 1,
+        userId: 'same-nation-user',
+        name: '관전자',
+        npcState: 0,
+        nationId: 1,
+        leadership: 70,
+        strength: 71,
+        intel: 72,
+        officerLevel: 1,
+        injury: 0,
+        rice: 9000,
+        crew: 5000,
+        crewTypeId: 100,
+        atmos: 100,
+        train: 100,
+        experience: 400,
+        horseCode: null,
+        weaponCode: null,
+        bookCode: null,
+        itemCode: null,
+        personalCode: null,
+        special2Code: null,
+        meta: {},
+        ...overrides,
+    });
+
+    const actor = buildGeneral({ id: 1, userId: 'same-nation-user', nationId: 1 });
+    const ally = buildGeneral({
+        id: 2,
+        userId: 'ally-user',
+        name: '아군 장수',
+        nationId: 1,
+        officerLevel: 4,
+        rice: 4321,
+        crew: 3210,
+        train: 97,
+        atmos: 96,
+        horseCode: 'che_적토마',
+        weaponCode: 'che_의천검',
+        bookCode: 'che_손자병법',
+        itemCode: 'che_옥새',
+        meta: {
+            dex1: 10000,
+            rank_warnum: 33,
+            rank_killnum: 22,
+            rank_killcrew: 1111,
+        },
+    });
+    const foreignActor = buildGeneral({ id: 3, userId: 'foreign-user', nationId: 2 });
+    const generals = [actor, ally, foreignActor];
+    const db = {
+        worldState: { findFirst: async () => state },
+        general: {
+            findFirst: async ({ where }: { where: { userId: string } }) =>
+                generals.find((general) => general.userId === where.userId) ?? null,
+            findUnique: async ({ where }: { where: { id: number } }) =>
+                generals.find((general) => general.id === where.id) ?? null,
+        },
+    } as unknown as DatabaseClient;
+
+    it('returns full ally details to the same nation but redacts them for another nation', async () => {
+        const battleSim = new QueuedBattleSimTransport();
+        const sameNation = appRouter.createCaller(buildContext({ state, battleSim, userId: 'same-nation-user', db }));
+        const foreign = appRouter.createCaller(buildContext({ state, battleSim, userId: 'foreign-user', db }));
+
+        const visible = await sameNation.battle.getGeneralDetail({ generalId: ally.id });
+        expect(visible.general).toMatchObject({
+            name: '아군 장수',
+            officer_level: 4,
+            horse: 'che_적토마',
+            crew: 3210,
+            rice: 4321,
+            train: 97,
+            atmos: 96,
+            warnum: 33,
+            killnum: 22,
+            killcrew: 1111,
+        });
+
+        const redacted = await foreign.battle.getGeneralDetail({ generalId: ally.id });
+        expect(redacted.general).toMatchObject({
+            name: '아군 장수',
+            officer_level: 1,
+            horse: null,
+            weapon: null,
+            book: null,
+            item: null,
+            crew: 0,
+            rice: 10000,
+            dex1: 0,
+            warnum: 0,
+            killnum: 0,
+            killcrew: 0,
+        });
+    });
+
+    it('requires a game general only for server-side general import', async () => {
+        const caller = appRouter.createCaller(
+            buildContext({
+                state,
+                battleSim: new QueuedBattleSimTransport(),
+                userId: 'user-without-general',
+                db,
+            })
+        );
+
+        await expect(caller.battle.getGeneralDetail({ generalId: ally.id })).rejects.toMatchObject({
+            code: 'NOT_FOUND',
+            message: 'General not found',
+        });
+    });
 });

app/game-api/test/battleSimTransport.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, it } from 'vitest';
+
+import { buildBattleSimQueueKeys } from '../src/battleSim/keys.js';
+import { RedisBattleSimTransport } from '../src/battleSim/redisTransport.js';
+import type { BattleSimJob, BattleSimJobPayload } from '../src/battleSim/types.js';
+
+class FakeRedisClient {
+    readonly values = new Map<string, string>();
+    readonly lists = new Map<string, string[]>();
+
+    async rPush(key: string, value: string): Promise<number> {
+        const list = this.lists.get(key) ?? [];
+        list.push(value);
+        this.lists.set(key, list);
+        return list.length;
+    }
+
+    async blPop(): Promise<null> {
+        return null;
+    }
+
+    async set(key: string, value: string): Promise<'OK'> {
+        this.values.set(key, value);
+        return 'OK';
+    }
+
+    async get(key: string): Promise<string | null> {
+        return this.values.get(key) ?? null;
+    }
+
+    async expire(): Promise<number> {
+        return 1;
+    }
+}
+
+describe('RedisBattleSimTransport requester isolation', () => {
+    it('records the requester on queued jobs and scopes completed results to that user', async () => {
+        const client = new FakeRedisClient();
+        const keys = buildBattleSimQueueKeys('che:test');
+        const transport = new RedisBattleSimTransport(client, {
+            keys,
+            requestTimeoutMs: 1,
+            resultTtlSeconds: 60,
+        });
+
+        const response = await transport.simulate({} as BattleSimJobPayload, 'user/one');
+        expect(response.status).toBe('queued');
+
+        const queuedRaw = client.lists.get(keys.queueKey)?.[0];
+        expect(queuedRaw).toBeTruthy();
+        expect(JSON.parse(queuedRaw ?? '{}') as BattleSimJob).toMatchObject({
+            jobId: response.jobId,
+            requesterUserId: 'user/one',
+        });
+
+        await transport.pushResult(response.jobId, 'user/one', {
+            result: true,
+            reason: 'success',
+            avgWar: 3,
+        });
+
+        await expect(transport.getSimulationResult(response.jobId, 'user/one')).resolves.toMatchObject({
+            result: true,
+            avgWar: 3,
+        });
+        await expect(transport.getSimulationResult(response.jobId, 'user/two')).resolves.toBeNull();
+        expect(Array.from(client.values.keys()).some((key) => key.includes('user%2Fone'))).toBe(true);
+    });
+});

app/game-api/test/battleSimWorker.integration.test.ts

@@ -0,0 +1,94 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+import { createRedisConnector, resolveRedisConfigFromEnv } from '@sammo-ts/infra';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { buildBattleSimEnvironment } from '../src/battleSim/environment.js';
+import { buildBattleSimQueueKeys } from '../src/battleSim/keys.js';
+import { RedisBattleSimTransport } from '../src/battleSim/redisTransport.js';
+import type { BattleSimRequestPayload } from '../src/battleSim/types.js';
+import { runBattleSimWorker } from '../src/battleSim/worker.js';
+import type { WorldStateRow } from '../src/context.js';
+
+const liveDescribe = process.env.REDIS_URL ? describe : describe.skip;
+
+afterEach(() => {
+    vi.unstubAllEnvs();
+});
+
+liveDescribe('battle simulator worker with live Redis', () => {
+    it('consumes an isolated queue, produces a result, and stops cleanly', { timeout: 30_000 }, async () => {
+        const scenario = `battle-sim-e2e-${randomUUID()}`;
+        const profileName = `che:${scenario}`;
+        const requesterUserId = 'worker-e2e-user';
+        vi.stubEnv('PROFILE', 'che');
+        vi.stubEnv('SCENARIO', scenario);
+        vi.stubEnv('GAME_TOKEN_SECRET', 'battle-sim-test-only');
+
+        const fixturePath = path.resolve(
+            process.cwd(),
+            '../../tools/integration-tests/fixtures/battle/basic-infantry.json'
+        );
+        const fixture = JSON.parse(await fs.readFile(fixturePath, 'utf8')) as BattleSimRequestPayload & {
+            startYear: number;
+        };
+        const { startYear, ...request } = fixture;
+        const worldState: WorldStateRow = {
+            id: 1,
+            scenarioCode: 'default',
+            currentYear: request.year,
+            currentMonth: request.month,
+            tickSeconds: 600,
+            config: {},
+            meta: { scenarioMeta: { startYear } },
+            updatedAt: new Date(),
+        };
+        const environment = await buildBattleSimEnvironment(worldState, 'che');
+        const payload = {
+            ...request,
+            unitSet: environment.unitSet,
+            config: environment.config,
+            time: { year: request.year, month: request.month, startYear },
+        };
+
+        const clientConnector = createRedisConnector(resolveRedisConfigFromEnv());
+        await clientConnector.connect();
+        const keys = buildBattleSimQueueKeys(profileName);
+        const transport = new RedisBattleSimTransport(clientConnector.client, {
+            keys,
+            requestTimeoutMs: 15_000,
+            resultTtlSeconds: 60,
+        });
+        const abortController = new AbortController();
+        const worker = runBattleSimWorker({ signal: abortController.signal });
+        let jobId: string | null = null;
+
+        try {
+            const result = await transport.simulate(payload, requesterUserId);
+            jobId = result.jobId;
+            expect(result.status).toBe('completed');
+            if (result.status === 'completed') {
+                expect(result.payload).toMatchObject({
+                    result: true,
+                    reason: 'success',
+                    avgWar: 1,
+                });
+                expect(result.payload.phase).toBeGreaterThan(0);
+            }
+        } finally {
+            abortController.abort();
+            await worker;
+            if (jobId) {
+                const encodedRequester = encodeURIComponent(requesterUserId);
+                await clientConnector.client.del([
+                    keys.queueKey,
+                    `${keys.resultKeyPrefix}${encodedRequester}:${jobId}`,
+                    `${keys.notifyKeyPrefix}${encodedRequester}:${jobId}`,
+                ]);
+            }
+            await clientConnector.disconnect();
+        }
+    });
+});

app/game-api/test/inGameInfoRouter.test.ts

@@ -53,13 +53,13 @@ const general = (overrides: Partial<GeneralRow> = {}): GeneralRow => ({
     updatedAt: now,
     ...overrides,
 });
-const auth = (roles: string[] = []): GameSessionTokenPayload => ({
+const auth = (roles: string[] = [], userId = 'user-1'): GameSessionTokenPayload => ({
     version: 1,
     profile: 'che:default',
     issuedAt: now.toISOString(),
     expiresAt: new Date(now.getTime() + 86400000).toISOString(),
     sessionId: 'session',
-    user: { id: 'user-1', username: 'tester', displayName: 'Tester', roles },
+    user: { id: userId, username: 'tester', displayName: 'Tester', roles },
     sanctions: {},
 });
 const city = (id: number, nationId: number) => ({
@@ -88,15 +88,30 @@ const city = (id: number, nationId: number) => ({
     meta: {},
 });
 
-const context = (options: { me?: GeneralRow; roles?: string[]; nationMeta?: Record<string, unknown> } = {}) => {
+const context = (
+    options: {
+        me?: GeneralRow;
+        roles?: string[];
+        userId?: string;
+        nationMeta?: Record<string, unknown>;
+        nationLevel?: number;
+        stationCityId?: number;
+    } = {}
+) => {
     const me = options.me ?? general();
     const cities = [city(1, 1), city(2, 2), city(3, 2), city(80, 1)];
     const foreign = general({ id: 2, userId: 'user-2', name: '적군', nationId: 2, cityId: 2, crew: 777 });
     const db = {
         general: {
-            findFirst: vi.fn(async () => me),
+            findFirst: vi.fn(async ({ where }: { where: { userId: string } }) =>
+                where.userId === me.userId ? me : null
+            ),
             findMany: vi.fn(async (args: { where?: Record<string, unknown>; select?: Record<string, boolean> }) => {
-                if (args.where?.nationId === 1 && args.select?.cityId) return [{ cityId: me.cityId }];
+                if (args.where?.nationId === 1 && args.select?.cityId)
+                    return [
+                        { cityId: me.cityId },
+                        ...(options.stationCityId ? [{ cityId: options.stationCityId }] : []),
+                    ];
                 if (args.where?.cityId === 2) return [foreign];
                 if (args.where?.cityId === 3) return [foreign];
                 if (args.where?.officerLevel) return [];
@@ -108,7 +123,7 @@ const context = (options: { me?: GeneralRow; roles?: string[]; nationMeta?: Reco
                 id: 1,
                 name: '아국',
                 color: '#008000',
-                level: 1,
+                level: options.nationLevel ?? 1,
                 capitalCityId: 1,
                 meta: options.nationMeta ?? {},
             })),
@@ -130,7 +145,7 @@ const context = (options: { me?: GeneralRow; roles?: string[]; nationMeta?: Reco
         turnDaemon: {} as GameApiContext['turnDaemon'],
         battleSim: {} as GameApiContext['battleSim'],
         profile: { id: 'che', scenario: 'default', name: 'che:default' },
-        auth: auth(options.roles),
+        auth: auth(options.roles, options.userId),
         uploadDir: 'uploads',
         uploadPath: '/uploads',
         uploadPublicUrl: null,
@@ -157,6 +172,25 @@ describe('in-game information permissions', () => {
         expect(result.generals).toEqual([]);
     });
 
+    it('derives the actor from the session user instead of accepting another user general', async () => {
+        const caller = appRouter.createCaller(context({ userId: 'user-2' }));
+        await expect(caller.world.getCurrentCity({ cityId: 1 })).rejects.toMatchObject({ code: 'NOT_FOUND' });
+    });
+
+    it('allows a nation member to select a city occupied by another general of the same nation', async () => {
+        const result = await appRouter.createCaller(context({ stationCityId: 2 })).world.getCurrentCity({ cityId: 2 });
+        expect(result.options.map((entry) => entry.id)).toContain(2);
+        expect(result.visibility.full).toBe(true);
+    });
+
+    it('does not grant a spy city while the nation has no active level', async () => {
+        const result = await appRouter
+            .createCaller(context({ nationMeta: { spy: { 2: 2 } }, nationLevel: 0 }))
+            .world.getCurrentCity({ cityId: 2 });
+        expect(result.options.map((entry) => entry.id)).not.toContain(2);
+        expect(result.visibility.full).toBe(false);
+    });
+
     it('keeps adjacent foreign detail redacted and never reveals military fields', async () => {
         const result = await appRouter
             .createCaller(context({ me: general({ cityId: 80 }) }))
@@ -174,12 +208,20 @@ describe('in-game information permissions', () => {
         expect(result.visibility.full).toBe(true);
         expect(result.city.population).toBe(1000);
         expect(result.generals[0]).toMatchObject({ crew: 777, train: null, atmos: null, crewTypeId: null });
+        expect(result.forceSummary).toMatchObject({
+            enemyCrew: 777,
+            enemyArmedGenerals: 1,
+            enemyGenerals: 1,
+        });
     });
 
-    it('allows administrative roles to inspect all city and general fields', async () => {
-        const result = await appRouter.createCaller(context({ roles: ['admin'] })).world.getCurrentCity({ cityId: 3 });
-        expect(result.options).toHaveLength(4);
-        expect(result.visibility.full).toBe(true);
-        expect(result.generals[0]).toMatchObject({ crew: 777, train: 90, atmos: 90, crewTypeId: 1 });
-    });
+    it.each(['admin', 'superuser', 'admin.superuser'])(
+        'allows the %s role to inspect all city and general fields',
+        async (role) => {
+            const result = await appRouter.createCaller(context({ roles: [role] })).world.getCurrentCity({ cityId: 3 });
+            expect(result.options).toHaveLength(4);
+            expect(result.visibility.full).toBe(true);
+            expect(result.generals[0]).toMatchObject({ crew: 777, train: 90, atmos: 90, crewTypeId: 1 });
+        }
+    );
 });

app/game-api/test/inGameMenuPermissions.test.ts

@@ -0,0 +1,257 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
+import type { RedisConnector } from '@sammo-ts/infra';
+
+import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
+import { InMemoryFlushStore } from '../src/auth/flushStore.js';
+import type { DatabaseClient, GameApiContext, GeneralRow } from '../src/context.js';
+import type { TurnDaemonTransport } from '../src/daemon/transport.js';
+import { appRouter } from '../src/router.js';
+
+const now = new Date('2026-01-01T00:00:00.000Z');
+const buildGeneral = (overrides: Partial<GeneralRow> = {}): GeneralRow => ({
+    id: 7,
+    userId: 'user-7',
+    name: '검증장수',
+    nationId: 1,
+    cityId: 1,
+    troopId: 0,
+    npcState: 0,
+    affinity: null,
+    bornYear: 180,
+    deadYear: 300,
+    picture: 'default.jpg',
+    imageServer: 0,
+    leadership: 70,
+    strength: 60,
+    intel: 50,
+    injury: 0,
+    experience: 10,
+    dedication: 20,
+    officerLevel: 1,
+    gold: 1_000,
+    rice: 1_000,
+    crew: 100,
+    crewTypeId: 0,
+    train: 80,
+    atmos: 80,
+    weaponCode: 'None',
+    bookCode: 'None',
+    horseCode: 'None',
+    itemCode: 'None',
+    turnTime: now,
+    recentWarTime: null,
+    age: 20,
+    startAge: 20,
+    personalCode: 'None',
+    specialCode: 'None',
+    special2Code: 'None',
+    lastTurn: {},
+    meta: {
+        belong: 1,
+        permission: 'normal',
+        myset: 3,
+        tnmt: 0,
+        defence_train: 80,
+        use_treatment: 21,
+        use_auto_nation_turn: 1,
+    },
+    penalty: {},
+    createdAt: now,
+    updatedAt: now,
+    ...overrides,
+});
+
+const auth: GameSessionTokenPayload = {
+    version: 1,
+    profile: 'che:default',
+    issuedAt: now.toISOString(),
+    expiresAt: new Date(now.getTime() + 86_400_000).toISOString(),
+    sessionId: 'session-7',
+    user: { id: 'user-7', username: 'tester', displayName: 'Tester', roles: [] },
+    sanctions: {},
+};
+
+const createContext = (options: {
+    me?: GeneralRow;
+    targets?: GeneralRow[];
+    nationMeta?: Record<string, unknown>;
+    requestCommand?: ReturnType<typeof vi.fn>;
+}) => {
+    const me = options.me ?? buildGeneral();
+    const targets = options.targets ?? [me];
+    const requestCommand =
+        options.requestCommand ?? vi.fn(async () => ({ type: 'setMySetting', ok: true, generalId: me.id }));
+    const generalFindUnique = vi.fn(
+        async ({ where }: { where: { id: number } }) => targets.find((general) => general.id === where.id) ?? null
+    );
+    const db = {
+        general: {
+            findFirst: vi.fn(async () => me),
+            findUnique: generalFindUnique,
+            findMany: vi.fn(async () => targets.filter((general) => general.nationId === me.nationId)),
+            update: vi.fn(),
+        },
+        city: { findUnique: vi.fn(async () => null) },
+        nation: {
+            findUnique: vi.fn(async () => ({
+                id: 1,
+                name: '위',
+                color: '#777777',
+                level: 3,
+                gold: 10_000,
+                rice: 20_000,
+                tech: 100,
+                typeCode: 'che_법가',
+                capitalCityId: 1,
+                meta: options.nationMeta ?? { secretlimit: 3 },
+            })),
+        },
+        worldState: {
+            findFirst: vi.fn(async () => ({
+                currentYear: 185,
+                currentMonth: 1,
+                tickSeconds: 600,
+            })),
+        },
+        logEntry: {
+            groupBy: vi.fn(async () => []),
+            findMany: vi.fn(async () => [{ id: 1, text: '기록' }]),
+        },
+    };
+    const redisClient = { get: async () => null, set: async () => null };
+    const context: GameApiContext = {
+        db: db as unknown as DatabaseClient,
+        redis: {} as RedisConnector['client'],
+        turnDaemon: { requestCommand } as unknown as TurnDaemonTransport,
+        battleSim: {} as GameApiContext['battleSim'],
+        profile: { id: 'che', scenario: 'default', name: 'che:default' },
+        auth,
+        uploadDir: 'uploads',
+        uploadPath: '/uploads',
+        uploadPublicUrl: null,
+        accessTokenStore: new RedisAccessTokenStore(redisClient, 'che:default'),
+        flushStore: new InMemoryFlushStore(),
+        gameTokenSecret: 'test-secret',
+    };
+    return { context, db, requestCommand };
+};
+
+describe('in-game my information ownership', () => {
+    it('reads legacy top-level settings and dispatches only the session-owned general', async () => {
+        const requestCommand = vi.fn(async () => ({ type: 'setMySetting', ok: true, generalId: 7 }));
+        const fixture = createContext({ requestCommand });
+        const caller = appRouter.createCaller(fixture.context);
+
+        const me = await caller.general.me();
+        expect(me?.settings).toEqual({
+            tnmt: 0,
+            defence_train: 80,
+            use_treatment: 21,
+            use_auto_nation_turn: 1,
+            myset: 3,
+        });
+
+        await caller.general.setMySetting({ tnmt: 1, defence_train: 999 });
+        expect(requestCommand).toHaveBeenCalledWith({
+            type: 'setMySetting',
+            generalId: 7,
+            settings: { tnmt: 1, defence_train: 999 },
+        });
+        expect(fixture.db.general.update).not.toHaveBeenCalled();
+    });
+
+    it('uses the authenticated user for both the page and its logs without accepting a target general id', async () => {
+        const otherUser = buildGeneral({ id: 8, userId: 'user-8', name: '타유저' });
+        const fixture = createContext({ targets: [buildGeneral(), otherUser] });
+        const caller = appRouter.createCaller(fixture.context);
+
+        await expect(caller.general.me()).resolves.toMatchObject({
+            general: { id: 7, name: '검증장수' },
+        });
+        await expect(caller.general.getMyLog({ type: 'generalAction' })).resolves.toMatchObject({
+            type: 'generalAction',
+            logs: [{ id: 1 }],
+        });
+
+        expect(fixture.db.general.findFirst).toHaveBeenCalledWith(
+            expect.objectContaining({
+                where: { userId: 'user-7' },
+            })
+        );
+        expect(fixture.db.logEntry.findMany).toHaveBeenCalledWith(
+            expect.objectContaining({
+                where: expect.objectContaining({ generalId: 7 }),
+            })
+        );
+    });
+});
+
+describe('battle-center general and user permissions', () => {
+    it('distinguishes an ordinary member, a tenured member, and an auditor', async () => {
+        const ordinary = createContext({
+            me: buildGeneral({ officerLevel: 1, meta: { belong: 1, permission: 'normal' } }),
+            nationMeta: { secretlimit: 3 },
+        });
+        await expect(appRouter.createCaller(ordinary.context).nation.getBattleCenter()).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+
+        const tenured = createContext({
+            me: buildGeneral({ officerLevel: 1, meta: { belong: 3, permission: 'normal' } }),
+            nationMeta: { secretlimit: 3 },
+        });
+        await expect(appRouter.createCaller(tenured.context).nation.getBattleCenter()).resolves.toMatchObject({
+            me: { id: 7, permissionLevel: 1 },
+        });
+
+        const auditor = createContext({
+            me: buildGeneral({ officerLevel: 1, meta: { belong: 0, permission: 'auditor' } }),
+            nationMeta: { secretlimit: 3 },
+        });
+        await expect(appRouter.createCaller(auditor.context).nation.getBattleCenter()).resolves.toMatchObject({
+            me: { id: 7, permissionLevel: 3 },
+        });
+    });
+
+    it('redacts another user action log while allowing own, NPC, chief, and non-private logs', async () => {
+        const me = buildGeneral({ meta: { belong: 3, permission: 'normal' } });
+        const otherUser = buildGeneral({ id: 8, userId: 'user-8', name: '타유저', npcState: 0 });
+        const npc = buildGeneral({ id: 9, userId: null, name: 'NPC', npcState: 2 });
+        const foreign = buildGeneral({ id: 10, userId: 'user-10', name: '타국', nationId: 2 });
+        const memberFixture = createContext({
+            me,
+            targets: [me, otherUser, npc, foreign],
+            nationMeta: { secretlimit: 3 },
+        });
+        const member = appRouter.createCaller(memberFixture.context);
+
+        await expect(member.nation.getGeneralLog({ generalId: me.id, type: 'generalAction' })).resolves.toMatchObject({
+            generalId: me.id,
+        });
+        await expect(
+            member.nation.getGeneralLog({ generalId: otherUser.id, type: 'generalAction' })
+        ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        await expect(
+            member.nation.getGeneralLog({ generalId: otherUser.id, type: 'battleDetail' })
+        ).resolves.toMatchObject({ generalId: otherUser.id });
+        await expect(member.nation.getGeneralLog({ generalId: npc.id, type: 'generalAction' })).resolves.toMatchObject({
+            generalId: npc.id,
+        });
+        await expect(
+            member.nation.getGeneralLog({ generalId: foreign.id, type: 'battleDetail' })
+        ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+
+        const chiefFixture = createContext({
+            me: buildGeneral({ officerLevel: 5 }),
+            targets: [buildGeneral({ officerLevel: 5 }), otherUser],
+            nationMeta: { secretlimit: 3 },
+        });
+        await expect(
+            appRouter
+                .createCaller(chiefFixture.context)
+                .nation.getGeneralLog({ generalId: otherUser.id, type: 'generalAction' })
+        ).resolves.toMatchObject({ generalId: otherUser.id });
+    });
+});

app/game-api/test/inheritRouter.test.ts

@@ -0,0 +1,266 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
+import type { RedisConnector } from '@sammo-ts/infra';
+
+import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
+import { InMemoryFlushStore } from '../src/auth/flushStore.js';
+import type { DatabaseClient, GameApiContext, GeneralRow } from '../src/context.js';
+import type { TurnDaemonTransport } from '../src/daemon/transport.js';
+import { appRouter } from '../src/router.js';
+
+const buildGeneral = (overrides: Partial<GeneralRow> = {}): GeneralRow => ({
+    id: 7,
+    userId: 'user-1',
+    name: '유비',
+    nationId: 1,
+    cityId: 1,
+    troopId: 0,
+    npcState: 0,
+    affinity: null,
+    bornYear: 180,
+    deadYear: 300,
+    picture: null,
+    imageServer: 0,
+    leadership: 70,
+    strength: 45,
+    intel: 85,
+    injury: 0,
+    experience: 0,
+    dedication: 0,
+    officerLevel: 1,
+    gold: 1000,
+    rice: 1000,
+    crew: 0,
+    crewTypeId: 0,
+    train: 0,
+    atmos: 0,
+    weaponCode: 'None',
+    bookCode: 'None',
+    horseCode: 'None',
+    itemCode: 'None',
+    turnTime: new Date('2026-07-26T00:00:00Z'),
+    recentWarTime: null,
+    age: 20,
+    startAge: 20,
+    personalCode: 'None',
+    specialCode: 'None',
+    special2Code: 'che_선봉',
+    lastTurn: {},
+    meta: {},
+    penalty: {},
+    createdAt: new Date('2026-07-26T00:00:00Z'),
+    updatedAt: new Date('2026-07-26T00:00:00Z'),
+    ...overrides,
+});
+
+const buildAuth = (userId = 'user-1'): GameSessionTokenPayload => ({
+    version: 1,
+    profile: 'che:default',
+    issuedAt: '2026-07-26T00:00:00.000Z',
+    expiresAt: '2026-07-27T00:00:00.000Z',
+    sessionId: `session-${userId}`,
+    user: {
+        id: userId,
+        username: userId,
+        displayName: userId,
+        roles: [],
+    },
+    sanctions: {},
+});
+
+const worldState = {
+    id: 1,
+    scenarioCode: 'default',
+    currentYear: 200,
+    currentMonth: 4,
+    tickSeconds: 3600,
+    config: {
+        const: {
+            availableSpecialWar: ['che_선봉'],
+            allItems: {
+                weapon: {
+                    che_무기_12_칠성검: 1,
+                    che_무기_01_단도: 0,
+                },
+            },
+        },
+    },
+    meta: { hiddenSeed: 'test-seed', isUnited: 0, season: 1 },
+    updatedAt: new Date('2026-07-26T00:00:00Z'),
+};
+
+const buildContext = (options: {
+    auth?: GameSessionTokenPayload | null;
+    general?: GeneralRow | null;
+    target?: GeneralRow | null;
+    inheritancePoint?: number;
+}) => {
+    const auth = options.auth === undefined ? buildAuth() : options.auth;
+    const general = options.general === undefined ? buildGeneral() : options.general;
+    const target =
+        options.target === undefined
+            ? buildGeneral({ id: 8, userId: 'user-2', name: '조조', meta: { ownerName: '위유저' } })
+            : options.target;
+    const requestCommand = vi.fn(async (command: { type: string; generalId: number }) => ({
+        type: command.type,
+        ok: true,
+        generalId: command.generalId,
+    }));
+    const pointUpsert = vi.fn(async () => ({}));
+    const logCreate = vi.fn(async () => ({}));
+    const findMany = vi.fn(async () => (target ? [{ id: target.id, name: target.name }] : []));
+    const db = {
+        $queryRaw: vi.fn(async () => [{ value: options.inheritancePoint ?? 10_000 }]),
+        worldState: {
+            findFirst: vi.fn(async () => worldState),
+        },
+        general: {
+            findFirst: vi.fn(async ({ where }: { where: { userId: string } }) =>
+                general?.userId === where.userId ? general : null
+            ),
+            findMany,
+            findUnique: vi.fn(async ({ where }: { where: { id: number } }) =>
+                target?.id === where.id ? target : null
+            ),
+        },
+        inheritancePoint: {
+            upsert: pointUpsert,
+        },
+        inheritanceLog: {
+            create: logCreate,
+            findMany: vi.fn(async () => []),
+        },
+        inheritanceUserState: {
+            findUnique: vi.fn(async () => null),
+            upsert: vi.fn(async () => ({})),
+        },
+    };
+    const accessTokenStore = new RedisAccessTokenStore(
+        {
+            get: async () => null,
+            set: async () => null,
+        },
+        'che:default'
+    );
+    const context: GameApiContext = {
+        db: db as unknown as DatabaseClient,
+        redis: {} as RedisConnector['client'],
+        turnDaemon: { requestCommand } as unknown as TurnDaemonTransport,
+        battleSim: {} as GameApiContext['battleSim'],
+        profile: { id: 'che', scenario: 'default', name: 'che:default' },
+        auth,
+        uploadDir: 'uploads',
+        uploadPath: '/uploads',
+        uploadPublicUrl: null,
+        accessTokenStore,
+        flushStore: new InMemoryFlushStore(),
+        gameTokenSecret: 'test-secret',
+    };
+    return { context, requestCommand, pointUpsert, logCreate, findMany };
+};
+
+describe('inherit router actor and permission boundaries', () => {
+    it('rejects unauthenticated status and mutations', async () => {
+        const fixture = buildContext({ auth: null });
+        const caller = appRouter.createCaller(fixture.context);
+
+        await expect(caller.inherit.getStatus()).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        await expect(caller.inherit.buyHiddenBuff({ type: 'warAvoidRatio', level: 1 })).rejects.toMatchObject({
+            code: 'UNAUTHORIZED',
+        });
+        expect(fixture.requestCommand).not.toHaveBeenCalled();
+    });
+
+    it('builds status only from the authenticated user general and filters target generals like ref', async () => {
+        const fixture = buildContext({});
+        const status = await appRouter.createCaller(fixture.context).inherit.getStatus();
+
+        expect(status.currentStat).toEqual({ leadership: 70, strength: 45, intel: 85 });
+        expect(status.availableTargetGenerals).toEqual([{ id: 8, name: '조조' }]);
+        expect(status.availableUnique).toEqual([
+            expect.objectContaining({ key: 'che_무기_12_칠성검', rawName: '칠성검' }),
+        ]);
+        expect(status.buffLevels).toHaveProperty('domesticSuccessProb', 0);
+        expect(fixture.findMany).toHaveBeenCalledWith({
+            where: { id: { not: 7 }, npcState: { lt: 2 }, userId: { not: null } },
+            select: { id: true, name: true },
+            orderBy: { id: 'asc' },
+        });
+    });
+
+    it('does not dispatch or charge when the authenticated user owns no general', async () => {
+        const fixture = buildContext({
+            auth: buildAuth('user-2'),
+            general: buildGeneral({ userId: 'user-1' }),
+        });
+
+        await expect(
+            appRouter.createCaller(fixture.context).inherit.buyHiddenBuff({
+                type: 'domesticSuccessProb',
+                level: 1,
+            })
+        ).rejects.toMatchObject({
+            code: 'PRECONDITION_FAILED',
+            message: '장수가 존재하지 않습니다.',
+        });
+        expect(fixture.requestCommand).not.toHaveBeenCalled();
+        expect(fixture.pointUpsert).not.toHaveBeenCalled();
+    });
+
+    it('mutates only the authenticated user general and inheritance balance', async () => {
+        const fixture = buildContext({ inheritancePoint: 1000 });
+
+        await expect(
+            appRouter.createCaller(fixture.context).inherit.buyHiddenBuff({
+                type: 'domesticSuccessProb',
+                level: 1,
+            })
+        ).resolves.toEqual({ ok: true, remainPoint: 800 });
+
+        expect(fixture.requestCommand).toHaveBeenCalledWith(
+            expect.objectContaining({
+                type: 'patchGeneral',
+                generalId: 7,
+                patch: expect.objectContaining({
+                    meta: expect.objectContaining({
+                        inheritBuff: JSON.stringify({ domesticSuccessProb: 1 }),
+                    }),
+                }),
+            })
+        );
+        expect(fixture.pointUpsert).toHaveBeenCalledWith(
+            expect.objectContaining({
+                where: { userId_key: { userId: 'user-1', key: 'previous' } },
+                update: { value: 800 },
+            })
+        );
+    });
+
+    it('reveals a target owner to the caller without using the caller general id from input', async () => {
+        const fixture = buildContext({ inheritancePoint: 1500 });
+
+        await expect(
+            appRouter.createCaller(fixture.context).inherit.checkOwner({ targetGeneralId: 8 })
+        ).resolves.toEqual({
+            ok: true,
+            ownerName: '위유저',
+            targetName: '조조',
+        });
+        expect(fixture.pointUpsert).toHaveBeenCalledWith(
+            expect.objectContaining({
+                where: { userId_key: { userId: 'user-1', key: 'previous' } },
+                update: { value: 500 },
+            })
+        );
+        expect(fixture.logCreate).toHaveBeenCalledWith({
+            data: {
+                userId: 'user-1',
+                year: 200,
+                month: 4,
+                text: '1000 포인트로 장수 소유자 확인',
+            },
+        });
+        expect(fixture.requestCommand).not.toHaveBeenCalled();
+    });
+});

app/game-api/test/messagesRouter.test.ts

@@ -30,7 +30,7 @@ const auth: GameSessionTokenPayload = {
     sanctions: {},
 };
 
-const buildContext = (overrides: Record<string, unknown> = {}) => {
+const buildContext = (overrides: Record<string, unknown> = {}, contextOverrides: Record<string, unknown> = {}) => {
     const executeRaw = vi.fn(async () => 1);
     const updateMany = vi.fn(async () => ({ count: 1 }));
     const db = {
@@ -55,11 +55,15 @@ const buildContext = (overrides: Record<string, unknown> = {}) => {
         $executeRaw: executeRaw,
         ...overrides,
     };
+    const redis = {
+        set: vi.fn(async () => 'OK'),
+        publish: vi.fn(async () => 1),
+    };
     const context = {
         db,
         auth,
         profile: { id: 'che', scenario: 'default', name: 'che:default' },
-        redis: {},
+        redis,
         turnDaemon: {},
         battleSim: {},
         uploadDir: 'uploads',
@@ -68,8 +72,9 @@ const buildContext = (overrides: Record<string, unknown> = {}) => {
         accessTokenStore: {},
         flushStore: {},
         gameTokenSecret: 'test-secret',
+        ...contextOverrides,
     } as unknown as GameApiContext;
-    return { caller: appRouter.createCaller(context), db, executeRaw, updateMany };
+    return { caller: appRouter.createCaller(context), db, executeRaw, updateMany, redis };
 };
 
 describe('messages router missing-flow compatibility', () => {
@@ -99,6 +104,291 @@ describe('messages router missing-flow compatibility', () => {
         expect(result.canRespondDiplomacy).toBe(true);
     });
 
+    it('lists an appointed ambassador as permission 4 but keeps responses limited to officers', async () => {
+        const ambassador = {
+            ...general,
+            officerLevel: 1,
+            meta: { permission: 'ambassador' },
+        } as GeneralRow;
+        const { caller } = buildContext({
+            general: {
+                findUnique: vi.fn(async () => ambassador),
+                findMany: vi.fn(async () => []),
+            },
+            nation: {
+                findMany: vi.fn(async () => []),
+                findUnique: vi.fn(async () => ({ meta: {} })),
+            },
+        });
+
+        const result = await caller.messages.getRecent({ generalId: ambassador.id });
+
+        expect(result.permission).toBe(4);
+        expect(result.canRespondDiplomacy).toBe(false);
+    });
+
+    it('redacts recent and old diplomacy content below secret permission 3', async () => {
+        const diplomacyRow = {
+            id: 19,
+            mailbox: 9001,
+            type: 'diplomacy',
+            src: 9002,
+            dest: 9001,
+            time: new Date(),
+            valid_until: new Date('9999-12-31T00:00:00Z'),
+            message: {
+                src: {
+                    generalId: 8,
+                    generalName: '외교관',
+                    nationId: 2,
+                    nationName: '촉',
+                    color: '#000000',
+                    icon: '',
+                },
+                dest: {
+                    generalId: 0,
+                    generalName: '',
+                    nationId: 1,
+                    nationName: '위',
+                    color: '#ffffff',
+                    icon: '',
+                },
+                text: '보이면 안 되는 외교 본문',
+                option: { action: 'noAggression' },
+            },
+        };
+        const queryRaw = vi.fn(async () => [diplomacyRow]);
+        const { caller } = buildContext({
+            $queryRaw: queryRaw,
+            nation: {
+                findMany: vi.fn(async () => []),
+                findUnique: vi.fn(async () => ({ meta: {} })),
+            },
+        });
+
+        const recent = await caller.messages.getRecent({ generalId: general.id });
+        const old = await caller.messages.getOld({
+            generalId: general.id,
+            type: 'diplomacy',
+            to: 20,
+        });
+
+        expect(recent.permission).toBe(2);
+        expect(recent.diplomacy[0]).toMatchObject({
+            text: '(외교 메시지입니다)',
+            option: { action: 'noAggression', invalid: true },
+        });
+        expect(old.diplomacy[0]).toMatchObject({
+            text: '(외교 메시지입니다)',
+            option: { action: 'noAggression', invalid: true },
+        });
+    });
+
+    it('forces a non-diplomat foreign nation target back to the owned nation mailbox', async () => {
+        const queryRaw = vi.fn(async () => [{ id: 51 }]);
+        const findNation = vi.fn(async ({ where }: { where: { id: number } }) => ({
+            id: where.id,
+            name: where.id === 1 ? '위' : '촉',
+            color: '#112233',
+            meta: {},
+        }));
+        const { caller } = buildContext({
+            $queryRaw: queryRaw,
+            nation: {
+                findMany: vi.fn(async () => []),
+                findUnique: findNation,
+            },
+        });
+
+        const result = await caller.messages.send({
+            generalId: general.id,
+            mailbox: 9002,
+            text: '국가 메시지',
+        });
+
+        expect(result.msgType).toBe('national');
+        expect(queryRaw.mock.calls[0]?.slice(1)).toEqual(expect.arrayContaining([9001, 'national']));
+    });
+
+    it('allows an ambassador to target a foreign nation mailbox as diplomacy', async () => {
+        const ambassador = {
+            ...general,
+            officerLevel: 1,
+            meta: { permission: 'ambassador' },
+        } as GeneralRow;
+        const queryRaw = vi.fn(async () => [{ id: 52 }]);
+        const { caller } = buildContext({
+            $queryRaw: queryRaw,
+            general: {
+                findUnique: vi.fn(async () => ambassador),
+                findMany: vi.fn(async () => []),
+            },
+            nation: {
+                findMany: vi.fn(async () => []),
+                findUnique: vi.fn(async ({ where }: { where: { id: number } }) => ({
+                    id: where.id,
+                    name: where.id === 1 ? '위' : '촉',
+                    color: '#112233',
+                    meta: {},
+                })),
+            },
+        });
+
+        const result = await caller.messages.send({
+            generalId: ambassador.id,
+            mailbox: 9002,
+            text: '외교 메시지',
+        });
+
+        expect(result.msgType).toBe('diplomacy');
+        expect(queryRaw.mock.calls[0]?.slice(1)).toEqual(expect.arrayContaining([9002, 'diplomacy']));
+    });
+
+    it('blocks private messages between foreign ambassadors', async () => {
+        const ambassador = {
+            ...general,
+            officerLevel: 1,
+            meta: { permission: 'ambassador' },
+        } as GeneralRow;
+        const foreignAmbassador = {
+            ...ambassador,
+            id: 8,
+            userId: 'user-8',
+            name: '상대 외교관',
+            nationId: 2,
+        } as GeneralRow;
+        const { caller } = buildContext({
+            general: {
+                findUnique: vi.fn(async ({ where }: { where: { id: number } }) =>
+                    where.id === ambassador.id ? ambassador : foreignAmbassador
+                ),
+                findMany: vi.fn(async () => []),
+            },
+            nation: {
+                findMany: vi.fn(async () => []),
+                findUnique: vi.fn(async ({ where }: { where: { id: number } }) => ({
+                    id: where.id,
+                    name: where.id === 1 ? '위' : '촉',
+                    color: '#112233',
+                    meta: {},
+                })),
+            },
+        });
+
+        await expect(
+            caller.messages.send({
+                generalId: ambassador.id,
+                mailbox: foreignAmbassador.id,
+                text: '개인 메시지',
+            })
+        ).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+            message: '외교권자끼리는 메시지를 보낼 수 없습니다.',
+        });
+    });
+
+    it.each([
+        ['public', { noSendPublicMsg: 1 }, 9999, '공개 메세지를 보낼 수 없습니다.'],
+        ['private', { noSendPrivateMsg: 1 }, 8, '개인 메세지를 보낼 수 없습니다.'],
+    ])('enforces the general %s-message penalty', async (_type, penalty, mailbox, message) => {
+        const penalized = { ...general, penalty } as GeneralRow;
+        const { caller } = buildContext({
+            general: {
+                findUnique: vi.fn(async () => penalized),
+                findMany: vi.fn(async () => []),
+            },
+            nation: {
+                findMany: vi.fn(async () => []),
+                findUnique: vi.fn(async () => ({ id: 1, name: '위', color: '#fff', meta: {} })),
+            },
+        });
+
+        await expect(
+            caller.messages.send({
+                generalId: penalized.id,
+                mailbox,
+                text: '차단 메시지',
+            })
+        ).rejects.toMatchObject({ code: 'FORBIDDEN', message });
+    });
+
+    it('enforces the legacy private-message interval through Redis without touching lifecycle', async () => {
+        const redis = {
+            set: vi.fn(async () => null),
+            publish: vi.fn(async () => 1),
+        };
+        const { caller } = buildContext(
+            {
+                nation: {
+                    findMany: vi.fn(async () => []),
+                    findUnique: vi.fn(async () => ({ id: 1, name: '위', color: '#fff', meta: {} })),
+                },
+            },
+            { redis }
+        );
+
+        await expect(
+            caller.messages.send({
+                generalId: general.id,
+                mailbox: 8,
+                text: '너무 빠른 메시지',
+            })
+        ).rejects.toMatchObject({
+            code: 'TOO_MANY_REQUESTS',
+            message: '개인메세지는 2초당 1건만 보낼 수 있습니다!',
+        });
+    });
+
+    it('blocks sends for a muted authenticated user independently of general permission', async () => {
+        const mutedAuth = {
+            ...auth,
+            sanctions: { mutedUntil: '2099-01-01T00:00:00.000Z' },
+        };
+        const { caller } = buildContext({}, { auth: mutedAuth });
+
+        await expect(
+            caller.messages.send({
+                generalId: general.id,
+                mailbox: 9999,
+                text: '사용자 mute',
+            })
+        ).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+            message: '메시지 전송이 제한된 계정입니다.',
+        });
+    });
+
+    it('rejects every remaining general-scoped message mutation for another user general', async () => {
+        const foreignGeneral = { ...general, userId: 'user-8' } as GeneralRow;
+        const { caller } = buildContext({
+            general: {
+                findUnique: vi.fn(async () => foreignGeneral),
+                findMany: vi.fn(async () => []),
+            },
+        });
+
+        await expect(caller.messages.getContacts({ generalId: foreignGeneral.id })).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+        await expect(
+            caller.messages.readLatest({
+                generalId: foreignGeneral.id,
+                type: 'private',
+                messageId: 1,
+            })
+        ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        await expect(caller.messages.delete({ generalId: foreignGeneral.id, messageId: 1 })).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+        await expect(
+            caller.messages.respond({
+                generalId: foreignGeneral.id,
+                messageId: 1,
+                response: true,
+            })
+        ).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    });
+
     it('persists latest-read updates through the monotonic upsert', async () => {
         const { caller, executeRaw } = buildContext();
 
@@ -154,6 +444,49 @@ describe('messages router missing-flow compatibility', () => {
         });
     });
 
+    it('lets the sender delete a manual diplomacy copy without deleting the receiver copy', async () => {
+        const queryRaw = vi.fn(async () => [
+            {
+                id: 25,
+                mailbox: 9001,
+                type: 'diplomacy',
+                src: 9001,
+                dest: 9002,
+                time: new Date(),
+                valid_until: new Date('9999-12-31T00:00:00Z'),
+                message: {
+                    src: {
+                        generalId: general.id,
+                        generalName: general.name,
+                        nationId: 1,
+                        nationName: '위',
+                        color: '#fff',
+                        icon: '',
+                    },
+                    dest: {
+                        generalId: 0,
+                        generalName: '',
+                        nationId: 2,
+                        nationName: '촉',
+                        color: '#000',
+                        icon: '',
+                    },
+                    text: '일반 외교 메시지',
+                    option: { receiverMessageID: 26 },
+                },
+            },
+        ]);
+        const { caller, updateMany } = buildContext({ $queryRaw: queryRaw });
+
+        const result = await caller.messages.delete({ generalId: general.id, messageId: 25 });
+
+        expect(result.deletedIds).toEqual([25]);
+        expect(updateMany).toHaveBeenCalledWith({
+            where: { id: { in: [25] } },
+            data: { validUntil: expect.any(Date) },
+        });
+    });
+
     it('rejects deleting another general message', async () => {
         const queryRaw = vi.fn(async () => [
             {

app/game-api/test/nationBettingRouter.integration.test.ts

@@ -14,8 +14,12 @@ const integration = describe.skipIf(!databaseUrl);
 const bettingId = 990_071;
 const concurrentBettingId = 990_072;
 const generalId = 9_971;
+const otherGeneralId = 9_972;
 const nationId = 990_071;
+const otherNationId = 990_072;
 const userId = 'nation-betting-router-user';
+const otherUserId = 'nation-betting-router-other-user';
+const noGeneralUserId = 'nation-betting-router-no-general-user';
 
 const auth: GameSessionTokenPayload = {
     version: 1,
@@ -32,12 +36,34 @@ const auth: GameSessionTokenPayload = {
     sanctions: {},
 };
 
+const otherAuth: GameSessionTokenPayload = {
+    ...auth,
+    sessionId: 'nation-betting-router-other-session',
+    user: {
+        ...auth.user,
+        id: otherUserId,
+        username: 'other-bettor',
+        displayName: 'Other Bettor',
+    },
+};
+
+const noGeneralAuth: GameSessionTokenPayload = {
+    ...auth,
+    sessionId: 'nation-betting-router-no-general-session',
+    user: {
+        ...auth.user,
+        id: noGeneralUserId,
+        username: 'no-general',
+        displayName: 'No General',
+    },
+};
+
 integration('nation betting router', () => {
     let db: GamePrismaClient;
     let closeDb: (() => Promise<void>) | undefined;
     let worldStateId: number;
 
-    const buildContext = (requestId: string): GameApiContext => {
+    const buildContext = (requestId: string, actorAuth: GameSessionTokenPayload | null = auth): GameApiContext => {
         const redisClient = {
             get: async () => null,
             set: async () => null,
@@ -52,7 +78,7 @@ integration('nation betting router', () => {
             uploadDir: 'uploads',
             uploadPath: '/uploads',
             uploadPublicUrl: null,
-            auth,
+            auth: actorAuth,
             accessTokenStore: new RedisAccessTokenStore(redisClient, 'che:2'),
             flushStore: new InMemoryFlushStore(),
             gameTokenSecret: 'test-secret',
@@ -64,33 +90,55 @@ integration('nation betting router', () => {
         await connector.connect();
         db = connector.prisma;
         closeDb = () => connector.disconnect();
-        await db.inputEvent.deleteMany({ where: { actorUserId: userId } });
+        await db.inputEvent.deleteMany({ where: { actorUserId: { in: [userId, otherUserId, noGeneralUserId] } } });
         await db.nationBetting.deleteMany({ where: { id: { in: [bettingId, concurrentBettingId] } } });
-        await db.rankData.deleteMany({ where: { generalId } });
-        await db.inheritanceLog.deleteMany({ where: { userId } });
-        await db.inheritancePoint.deleteMany({ where: { userId } });
-        await db.general.deleteMany({ where: { id: generalId } });
-        await db.nation.deleteMany({ where: { id: nationId } });
+        await db.rankData.deleteMany({ where: { generalId: { in: [generalId, otherGeneralId] } } });
+        await db.inheritanceLog.deleteMany({ where: { userId: { in: [userId, otherUserId] } } });
+        await db.inheritancePoint.deleteMany({ where: { userId: { in: [userId, otherUserId] } } });
+        await db.general.deleteMany({ where: { id: { in: [generalId, otherGeneralId] } } });
+        await db.nation.deleteMany({ where: { id: { in: [nationId, otherNationId] } } });
 
-        await db.nation.create({
-            data: {
-                id: nationId,
-                name: '베팅국',
-                color: '#123456',
-                level: 2,
-            },
+        await db.nation.createMany({
+            data: [
+                {
+                    id: nationId,
+                    name: '베팅국',
+                    color: '#123456',
+                    level: 2,
+                },
+                {
+                    id: otherNationId,
+                    name: '다른베팅국',
+                    color: '#654321',
+                    level: 6,
+                },
+            ],
         });
-        await db.general.create({
-            data: {
-                id: generalId,
-                userId,
-                name: '베팅장수',
-                nationId,
-                cityId: 1,
-                npcState: 0,
-                turnTime: new Date('0200-01-01T00:00:00.000Z'),
-                meta: {},
-            },
+        await db.general.createMany({
+            data: [
+                {
+                    id: generalId,
+                    userId,
+                    name: '베팅장수',
+                    nationId,
+                    cityId: 1,
+                    npcState: 0,
+                    officerLevel: 0,
+                    turnTime: new Date('0200-01-01T00:00:00.000Z'),
+                    meta: {},
+                },
+                {
+                    id: otherGeneralId,
+                    userId: otherUserId,
+                    name: '다른국가수뇌',
+                    nationId: otherNationId,
+                    cityId: 1,
+                    npcState: 0,
+                    officerLevel: 12,
+                    turnTime: new Date('0200-01-01T00:00:00.000Z'),
+                    meta: {},
+                },
+            ],
         });
         const world = await db.worldState.create({
             data: {
@@ -132,19 +180,22 @@ integration('nation betting router', () => {
                 candidates: [{ title: '베팅국', info: '', isHtml: true, aux: { nation: nationId } }],
             },
         });
-        await db.inheritancePoint.create({
-            data: { userId, key: 'previous', value: 1_000 },
+        await db.inheritancePoint.createMany({
+            data: [
+                { userId, key: 'previous', value: 1_000 },
+                { userId: otherUserId, key: 'previous', value: 500 },
+            ],
         });
     });
 
     afterAll(async () => {
-        await db.inputEvent.deleteMany({ where: { actorUserId: userId } });
+        await db.inputEvent.deleteMany({ where: { actorUserId: { in: [userId, otherUserId, noGeneralUserId] } } });
         await db.nationBetting.deleteMany({ where: { id: { in: [bettingId, concurrentBettingId] } } });
-        await db.rankData.deleteMany({ where: { generalId } });
-        await db.inheritanceLog.deleteMany({ where: { userId } });
-        await db.inheritancePoint.deleteMany({ where: { userId } });
-        await db.general.deleteMany({ where: { id: generalId } });
-        await db.nation.deleteMany({ where: { id: nationId } });
+        await db.rankData.deleteMany({ where: { generalId: { in: [generalId, otherGeneralId] } } });
+        await db.inheritanceLog.deleteMany({ where: { userId: { in: [userId, otherUserId] } } });
+        await db.inheritancePoint.deleteMany({ where: { userId: { in: [userId, otherUserId] } } });
+        await db.general.deleteMany({ where: { id: { in: [generalId, otherGeneralId] } } });
+        await db.nation.deleteMany({ where: { id: { in: [nationId, otherNationId] } } });
         await db.worldState.delete({ where: { id: worldStateId } });
         await closeDb?.();
     });
@@ -229,12 +280,107 @@ integration('nation betting router', () => {
             }),
         ]);
         expect(results.map((result) => result.status).sort()).toEqual(['fulfilled', 'rejected']);
-        expect(await db.nationBet.aggregate({ where: { bettingId: concurrentBettingId }, _sum: { amount: true } }))
-            .toMatchObject({ _sum: { amount: 600 } });
+        expect(
+            await db.nationBet.aggregate({ where: { bettingId: concurrentBettingId }, _sum: { amount: true } })
+        ).toMatchObject({ _sum: { amount: 600 } });
         expect(
             await db.inheritancePoint.findUniqueOrThrow({
                 where: { userId_key: { userId, key: 'previous' } },
             })
         ).toMatchObject({ value: 250 });
     });
+
+    it('requires authentication and an owned player general for every betting operation', async () => {
+        await expect(
+            appRouter.createCaller(buildContext('nation-betting-anonymous-list', null)).betting.getList({
+                req: 'bettingNation',
+            })
+        ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        await expect(
+            appRouter
+                .createCaller(buildContext('nation-betting-anonymous-detail', null))
+                .betting.getDetail({ bettingId })
+        ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        await expect(
+            appRouter.createCaller(buildContext('nation-betting-anonymous-bet', null)).betting.bet({
+                bettingId,
+                bettingType: [0],
+                amount: 10,
+            })
+        ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+        await expect(
+            appRouter.createCaller(buildContext('nation-betting-no-general-list', noGeneralAuth)).betting.getList({
+                req: 'bettingNation',
+            })
+        ).rejects.toMatchObject({ code: 'NOT_FOUND', message: 'General not found' });
+        await expect(
+            appRouter
+                .createCaller(buildContext('nation-betting-no-general-detail', noGeneralAuth))
+                .betting.getDetail({ bettingId })
+        ).rejects.toMatchObject({ code: 'NOT_FOUND', message: 'General not found' });
+        await expect(
+            appRouter.createCaller(buildContext('nation-betting-no-general-bet', noGeneralAuth)).betting.bet({
+                bettingId,
+                bettingType: [0],
+                amount: 10,
+            })
+        ).rejects.toMatchObject({ code: 'NOT_FOUND', message: 'General not found' });
+    });
+
+    it('allows generals across nation and office levels while isolating each session user bet', async () => {
+        await expect(
+            appRouter.createCaller(buildContext('nation-betting-other-list', otherAuth)).betting.getList({
+                req: 'bettingNation',
+            })
+        ).resolves.toMatchObject({
+            result: true,
+            bettingList: {
+                [bettingId]: { name: '천통국 예상' },
+            },
+        });
+        await expect(
+            appRouter.createCaller(buildContext('nation-betting-other-bet', otherAuth)).betting.bet({
+                bettingId,
+                bettingType: [0],
+                amount: 100,
+            })
+        ).resolves.toEqual({ result: true });
+
+        const [firstUserDetail, otherUserDetail] = await Promise.all([
+            appRouter.createCaller(buildContext('nation-betting-first-user-detail')).betting.getDetail({ bettingId }),
+            appRouter
+                .createCaller(buildContext('nation-betting-other-user-detail', otherAuth))
+                .betting.getDetail({ bettingId }),
+        ]);
+        expect(firstUserDetail.myBetting).toEqual([['[0]', 150]]);
+        expect(otherUserDetail.myBetting).toEqual([['[0]', 100]]);
+        expect(firstUserDetail.bettingDetail).toEqual([['[0]', 250]]);
+        expect(otherUserDetail.bettingDetail).toEqual([['[0]', 250]]);
+
+        expect(
+            await db.nationBet.findUniqueOrThrow({
+                where: {
+                    bettingId_userId_selectionKey: {
+                        bettingId,
+                        userId: otherUserId,
+                        selectionKey: '[0]',
+                    },
+                },
+            })
+        ).toMatchObject({
+            generalId: otherGeneralId,
+            userId: otherUserId,
+            amount: 100,
+        });
+        expect(
+            await db.inheritancePoint.findUniqueOrThrow({
+                where: { userId_key: { userId: otherUserId, key: 'previous' } },
+            })
+        ).toMatchObject({ value: 400 });
+        expect(
+            await db.rankData.findUniqueOrThrow({
+                where: { generalId_type: { generalId: otherGeneralId, type: 'inherit_spent_dyn' } },
+            })
+        ).toMatchObject({ nationId: otherNationId, value: 100 });
+    });
 });

app/game-api/test/nationGeneralSecretRouter.test.ts

@@ -0,0 +1,142 @@
+import { describe, expect, it, vi } from 'vitest';
+import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
+import type { RedisConnector } from '@sammo-ts/infra';
+import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
+import { InMemoryFlushStore } from '../src/auth/flushStore.js';
+import type { DatabaseClient, GameApiContext, GeneralRow } from '../src/context.js';
+import { appRouter } from '../src/router.js';
+
+const now = new Date('2026-01-01T01:02:00Z');
+const general = (overrides: Partial<GeneralRow> = {}): GeneralRow => ({
+    id: 1,
+    userId: 'u1',
+    name: '장수',
+    nationId: 1,
+    cityId: 1,
+    troopId: 0,
+    npcState: 0,
+    affinity: null,
+    bornYear: 180,
+    deadYear: 300,
+    picture: null,
+    imageServer: 0,
+    leadership: 70,
+    strength: 60,
+    intel: 50,
+    injury: 0,
+    experience: 900,
+    dedication: 100,
+    officerLevel: 1,
+    gold: 1000,
+    rice: 2000,
+    crew: 300,
+    crewTypeId: 1,
+    train: 90,
+    atmos: 90,
+    weaponCode: 'None',
+    bookCode: 'None',
+    horseCode: 'None',
+    itemCode: 'None',
+    turnTime: now,
+    recentWarTime: null,
+    age: 20,
+    startAge: 20,
+    personalCode: 'None',
+    specialCode: 'None',
+    special2Code: 'None',
+    lastTurn: {},
+    meta: { belong: 1, defence_train: 80, killturn: 7 },
+    penalty: {},
+    createdAt: now,
+    updatedAt: now,
+    ...overrides,
+});
+const token = (userId: string): GameSessionTokenPayload => ({
+    version: 1,
+    profile: 'che:default',
+    issuedAt: now.toISOString(),
+    expiresAt: new Date(now.getTime() + 86400000).toISOString(),
+    sessionId: userId,
+    user: { id: userId, username: userId, displayName: userId, roles: [] },
+    sanctions: {},
+});
+const fixture = (generals: GeneralRow[], userId = 'u1') => {
+    const db = {
+        general: {
+            findFirst: vi.fn(async ({ where }: { where: { userId: string } }) =>
+                generals.find((g) => g.userId === where.userId)
+            ),
+            findMany: vi.fn(async ({ where }: { where: { nationId: number } }) =>
+                generals.filter((g) => g.nationId === where.nationId)
+            ),
+        },
+        nation: {
+            findUnique: vi.fn(async () => ({
+                id: 1,
+                name: '위',
+                color: '#080',
+                level: 3,
+                typeCode: 'che_중립',
+                capitalCityId: 1,
+                meta: { secretlimit: 3 },
+            })),
+        },
+        city: { findMany: vi.fn(async () => [{ id: 1, name: '업' }]) },
+        troop: { findMany: vi.fn(async () => [{ troopLeaderId: 2, name: '선봉대' }]) },
+        worldState: { findFirst: vi.fn(async () => null) },
+        generalTurn: { findMany: vi.fn(async () => [{ generalId: 1, turnIdx: 0, actionCode: '징병' }]) },
+        generalAccessLog: {
+            findMany: vi.fn(async () => generals.map((g) => ({ generalId: g.id, refreshScoreTotal: g.id * 10 }))),
+        },
+    };
+    const redis = { get: vi.fn(async () => null), set: vi.fn(async () => null) } as unknown as RedisConnector['client'];
+    const context: GameApiContext = {
+        db: db as unknown as DatabaseClient,
+        redis,
+        turnDaemon: {} as GameApiContext['turnDaemon'],
+        battleSim: {} as GameApiContext['battleSim'],
+        profile: { id: 'che', scenario: 'default', name: 'che:default' },
+        auth: token(userId),
+        uploadDir: 'uploads',
+        uploadPath: '/uploads',
+        uploadPublicUrl: null,
+        accessTokenStore: new RedisAccessTokenStore(redis, 'che:default'),
+        flushStore: new InMemoryFlushStore(),
+        gameTokenSecret: 'secret',
+    };
+    return { caller: appRouter.createCaller(context), db };
+};
+
+describe('nation general and secret office permissions', () => {
+    it('redacts ordinary-member details and denies the secret office', async () => {
+        const { caller } = fixture([general()]);
+        const result = await caller.nation.getGeneralList();
+        expect(result.viewer).toEqual({ generalId: 1, permission: 0 });
+        expect(result.generals[0]).toMatchObject({
+            officerLevel: 1,
+            cityName: null,
+            troopName: null,
+            refreshScoreTotal: 10,
+        });
+        expect(result.generals[0]).not.toHaveProperty('crew');
+        await expect(caller.nation.getSecretGeneralList()).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    });
+    it('uses the session-owned general and scopes secret rows to that nation', async () => {
+        const first = general();
+        const actor = general({ id: 2, userId: 'u2', officerLevel: 5, meta: { belong: 1 } });
+        const ally = general({ id: 3, userId: 'u3', gold: 3000, crew: 200, train: 80, atmos: 80 });
+        const foreign = general({ id: 4, userId: 'u4', nationId: 2, gold: 99999 });
+        const { caller, db } = fixture([first, actor, ally, foreign], 'u2');
+        const result = await caller.nation.getSecretGeneralList();
+        expect(result.viewer).toEqual({ generalId: 2, permission: 2 });
+        expect(result.generals.map((g) => g.id)).toEqual([1, 2, 3]);
+        expect(result.summary).toMatchObject({ gold: 5000, crew: 800, generalCount: 3 });
+        expect(db.general.findFirst).toHaveBeenCalledWith({ where: { userId: 'u2' } });
+        expect(db.general.findMany).toHaveBeenCalledWith(expect.objectContaining({ where: { nationId: 1 } }));
+    });
+    it('honors general penalties after a user switch', async () => {
+        const penalized = general({ officerLevel: 5, penalty: { noChief: true } });
+        const { caller } = fixture([penalized]);
+        await expect(caller.nation.getSecretGeneralList()).rejects.toMatchObject({ code: 'FORBIDDEN' });
+    });
+});

app/game-api/test/npcPolicyRouter.test.ts

@@ -0,0 +1,275 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
+import type { RedisConnector } from '@sammo-ts/infra';
+
+import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
+import { InMemoryFlushStore } from '../src/auth/flushStore.js';
+import type { DatabaseClient, GameApiContext, GeneralRow } from '../src/context.js';
+import type { TurnDaemonTransport } from '../src/daemon/transport.js';
+import { appRouter } from '../src/router.js';
+
+const baseGeneral: GeneralRow = {
+    id: 22,
+    userId: 'user-22',
+    name: '정책담당',
+    nationId: 1,
+    cityId: 1,
+    troopId: 0,
+    npcState: 0,
+    affinity: null,
+    bornYear: 180,
+    deadYear: 300,
+    picture: 'default.jpg',
+    imageServer: 0,
+    leadership: 70,
+    strength: 70,
+    intel: 70,
+    injury: 0,
+    experience: 0,
+    dedication: 0,
+    officerLevel: 12,
+    gold: 1_000,
+    rice: 1_000,
+    crew: 0,
+    crewTypeId: 0,
+    train: 0,
+    atmos: 0,
+    weaponCode: 'None',
+    bookCode: 'None',
+    horseCode: 'None',
+    itemCode: 'None',
+    turnTime: new Date('2026-01-01T00:00:00.000Z'),
+    recentWarTime: null,
+    age: 20,
+    startAge: 20,
+    personalCode: 'None',
+    specialCode: 'None',
+    special2Code: 'None',
+    lastTurn: {},
+    meta: { belong: 5, permission: 'normal' },
+    penalty: {},
+    createdAt: new Date('2026-01-01T00:00:00.000Z'),
+    updatedAt: new Date('2026-01-01T00:00:00.000Z'),
+};
+
+const auth: GameSessionTokenPayload = {
+    version: 1,
+    profile: 'che:default',
+    issuedAt: '2026-01-01T00:00:00.000Z',
+    expiresAt: '2026-01-02T00:00:00.000Z',
+    sessionId: 'session-22',
+    user: { id: 'user-22', username: 'tester', displayName: 'Tester', roles: [] },
+    sanctions: {},
+};
+
+const baseNation = {
+    id: 1,
+    name: '위',
+    level: 3,
+    tech: 3_000,
+    meta: {
+        _updatedAt: '2026-01-01T00:00:00.000Z',
+        npc_nation_policy: {
+            values: { reqNationRice: 456 },
+            priority: ['천도', '천도'],
+        },
+        npc_general_policy: {
+            priority: ['출병', '일반내정', '출병'],
+        },
+    },
+};
+
+const baseWorld = {
+    config: {
+        stat: { max: 80, npcMax: 75 },
+        environment: { unitSet: 'basic' },
+        const: { develCost: 100 },
+    },
+    meta: {
+        npc_nation_policy: { values: { reqNationGold: 123 } },
+        npc_general_policy: {},
+    },
+};
+
+const createContext = (
+    options: {
+        me?: GeneralRow;
+        nation?: typeof baseNation;
+        world?: typeof baseWorld;
+        requestCommand?: ReturnType<typeof vi.fn>;
+        troopRows?: Array<{ troopLeaderId: number }>;
+        cityRows?: Array<{ id: number }>;
+    } = {}
+): { context: GameApiContext; findFirst: ReturnType<typeof vi.fn>; requestCommand: ReturnType<typeof vi.fn> } => {
+    const requestCommand =
+        options.requestCommand ??
+        vi.fn(async () => ({
+            type: 'setNationMeta',
+            ok: true,
+            nationId: 1,
+            updatedAt: '2026-01-01T00:01:00.000Z',
+        }));
+    const findFirst = vi.fn(async () => options.me ?? baseGeneral);
+    const db = {
+        general: { findFirst },
+        nation: { findUnique: vi.fn(async () => options.nation ?? baseNation) },
+        worldState: { findFirst: vi.fn(async () => options.world ?? baseWorld) },
+        troop: { findMany: vi.fn(async () => options.troopRows ?? [{ troopLeaderId: 101 }]) },
+        city: { findMany: vi.fn(async () => options.cityRows ?? [{ id: 1 }, { id: 2 }]) },
+    };
+    const redisClient = { get: async () => null, set: async () => null };
+    return {
+        context: {
+            db: db as unknown as DatabaseClient,
+            redis: {} as RedisConnector['client'],
+            turnDaemon: { requestCommand } as unknown as TurnDaemonTransport,
+            battleSim: {} as GameApiContext['battleSim'],
+            profile: { id: 'che', scenario: 'default', name: 'che:default' },
+            auth,
+            uploadDir: 'uploads',
+            uploadPath: '/uploads',
+            uploadPublicUrl: null,
+            accessTokenStore: new RedisAccessTokenStore(redisClient, 'che:default'),
+            flushStore: new InMemoryFlushStore(),
+            gameTokenSecret: 'test-secret',
+        },
+        findFirst,
+        requestCommand,
+    };
+};
+
+describe('NPC policy router', () => {
+    it('loads server and nation overrides while calculating legacy zero-value hints from nation tech', async () => {
+        const fixture = createContext();
+        const result = await appRouter.createCaller(fixture.context).npc.getPolicy();
+
+        expect(fixture.findFirst).toHaveBeenCalledWith({ where: { userId: 'user-22' } });
+        expect(result.currentNationPolicy).toMatchObject({ reqNationGold: 123, reqNationRice: 456 });
+        expect(result.currentNationPriority).toEqual(['천도', '천도']);
+        expect(result.currentGeneralActionPriority).toEqual(['출병', '일반내정', '출병']);
+        expect(result.zeroPolicy).toMatchObject({
+            reqNationGold: 10_000,
+            reqNationRice: 12_000,
+            reqNPCDevelGold: 3_000,
+            reqNPCWarGold: 3_900,
+            reqNPCWarRice: 3_900,
+            reqHumanWarUrgentGold: 6_300,
+            reqHumanWarUrgentRice: 6_300,
+            reqHumanWarRecommandGold: 12_600,
+            reqHumanWarRecommandRice: 12_600,
+        });
+    });
+
+    it('lets a secret-level reader load the page but rejects every mutation before daemon dispatch', async () => {
+        const reader = { ...baseGeneral, officerLevel: 2 };
+        const fixture = createContext({ me: reader });
+        const caller = appRouter.createCaller(fixture.context);
+
+        await expect(caller.npc.getPolicy()).resolves.toMatchObject({ permissionLevel: 1 });
+        await expect(caller.npc.setNationPriority(['천도'])).rejects.toMatchObject({ code: 'FORBIDDEN' });
+        await expect(caller.npc.setGeneralPriority(['출병', '일반내정'])).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+        await expect(caller.npc.setNationPolicy({ reqNationGold: 100 })).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+        expect(fixture.requestCommand).not.toHaveBeenCalled();
+    });
+
+    it.each([
+        ['군주', { ...baseGeneral, officerLevel: 12 }],
+        ['감찰권자', { ...baseGeneral, officerLevel: 1, meta: { belong: 0, permission: 'auditor' } }],
+        ['외교권자', { ...baseGeneral, officerLevel: 1, meta: { belong: 0, permission: 'ambassador' } }],
+    ])('%s can persist policy through the daemon-owned metadata command', async (_label, me) => {
+        const fixture = createContext({ me });
+        await expect(appRouter.createCaller(fixture.context).npc.setNationPriority(['천도', '천도'])).resolves.toEqual({
+            ok: true,
+        });
+        expect(fixture.requestCommand).toHaveBeenCalledWith({
+            type: 'setNationMeta',
+            nationId: 1,
+            updates: {
+                npc_nation_policy: expect.objectContaining({
+                    priority: ['천도', '천도'],
+                    prioritySetter: '정책담당',
+                    prioritySetTime: expect.any(String),
+                }),
+            },
+            expectedUpdatedAt: '2026-01-01T00:00:00.000Z',
+        });
+    });
+
+    it('clamps legacy integer values, preserves float values, and validates troop ownership before dispatch', async () => {
+        const fixture = createContext();
+        const caller = appRouter.createCaller(fixture.context);
+
+        await caller.npc.setNationPolicy({
+            reqNationGold: -100,
+            safeRecruitCityPopulationRatio: -0.5,
+            CombatForce: { 101: [1, 2] },
+        });
+        expect(fixture.requestCommand).toHaveBeenCalledWith(
+            expect.objectContaining({
+                updates: {
+                    npc_nation_policy: expect.objectContaining({
+                        values: expect.objectContaining({
+                            reqNationGold: 0,
+                            safeRecruitCityPopulationRatio: -0.5,
+                            CombatForce: { 101: [1, 2] },
+                        }),
+                    }),
+                },
+            })
+        );
+
+        fixture.requestCommand.mockClear();
+        await expect(caller.npc.setNationPolicy({ SupportForce: [999] })).rejects.toMatchObject({
+            code: 'BAD_REQUEST',
+        });
+        expect(fixture.requestCommand).not.toHaveBeenCalled();
+    });
+
+    it('preserves duplicate legacy priority entries and enforces required general actions and ordering', async () => {
+        const fixture = createContext();
+        const caller = appRouter.createCaller(fixture.context);
+
+        await caller.npc.setGeneralPriority(['출병', '출병', '일반내정']);
+        expect(fixture.requestCommand).toHaveBeenCalledWith(
+            expect.objectContaining({
+                updates: {
+                    npc_general_policy: expect.objectContaining({
+                        priority: ['출병', '출병', '일반내정'],
+                    }),
+                },
+            })
+        );
+        await expect(caller.npc.setGeneralPriority(['일반내정', '출병'])).rejects.toMatchObject({
+            code: 'BAD_REQUEST',
+        });
+        await expect(caller.npc.setGeneralPriority(['출병'])).rejects.toMatchObject({ code: 'BAD_REQUEST' });
+    });
+
+    it('blocks nationless, penalized, and stale writers without changing lifecycle state directly', async () => {
+        const nationless = createContext({ me: { ...baseGeneral, nationId: 0, officerLevel: 0 } });
+        await expect(appRouter.createCaller(nationless.context).npc.getPolicy()).rejects.toMatchObject({
+            code: 'PRECONDITION_FAILED',
+        });
+
+        const penalized = createContext({ me: { ...baseGeneral, penalty: { noChief: true } } });
+        await expect(appRouter.createCaller(penalized.context).npc.getPolicy()).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+
+        const staleCommand = vi.fn(async () => ({
+            type: 'setNationMeta',
+            ok: false,
+            nationId: 1,
+            reason: 'CONFLICT',
+        }));
+        const stale = createContext({ requestCommand: staleCommand });
+        await expect(appRouter.createCaller(stale.context).npc.setNationPriority(['천도'])).rejects.toMatchObject({
+            code: 'CONFLICT',
+        });
+    });
+});

app/game-api/test/publicTraffic.test.ts

@@ -0,0 +1,115 @@
+import { describe, expect, it } from 'vitest';
+
+import type { RedisConnector } from '@sammo-ts/infra';
+
+import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
+import { InMemoryFlushStore } from '../src/auth/flushStore.js';
+import { InMemoryBattleSimTransport } from '../src/battleSim/inMemoryTransport.js';
+import type { DatabaseClient, GameApiContext, GameProfile } from '../src/context.js';
+import { InMemoryTurnDaemonTransport } from '../src/daemon/inMemoryTransport.js';
+import { appRouter } from '../src/router.js';
+
+const profile: GameProfile = {
+    id: 'che',
+    scenario: 'default',
+    name: 'che:default',
+};
+
+const buildContext = (): GameApiContext => {
+    const db = {
+        worldState: {
+            findFirst: async () => ({
+                id: 1,
+                currentYear: 185,
+                currentMonth: 3,
+                tickSeconds: 600,
+                config: {},
+                meta: {
+                    lastTurnTime: '2026-07-26T03:00:00.000Z',
+                    refresh: 12,
+                    maxrefresh: 30,
+                    maxonline: 5,
+                    recentTraffic: [
+                        {
+                            year: 185,
+                            month: 2,
+                            refresh: 30,
+                            online: 5,
+                            date: '2026-07-26 02:50:00',
+                        },
+                    ],
+                },
+            }),
+        },
+        generalAccessLog: {
+            aggregate: async () => ({
+                _sum: {
+                    refresh: 12,
+                    refreshScoreTotal: 21,
+                },
+            }),
+            count: async (args: { where: { lastRefresh: { gte: Date } } }) => {
+                expect(args.where.lastRefresh.gte).toEqual(new Date('2026-07-26T03:00:00.000Z'));
+                return 2;
+            },
+            findMany: async () => [
+                { generalId: 7, refresh: 9, refreshScoreTotal: 15 },
+                { generalId: 8, refresh: 3, refreshScoreTotal: 6 },
+            ],
+        },
+        general: {
+            findMany: async () => [
+                { id: 7, name: '갑' },
+                { id: 8, name: '을' },
+            ],
+        },
+    };
+    const redis = {
+        get: async () => null,
+        set: async () => null,
+    } as unknown as RedisConnector['client'];
+
+    return {
+        db: db as unknown as DatabaseClient,
+        turnDaemon: new InMemoryTurnDaemonTransport(),
+        battleSim: new InMemoryBattleSimTransport(),
+        profile,
+        auth: null,
+        uploadDir: 'uploads',
+        uploadPath: '/uploads',
+        uploadPublicUrl: null,
+        redis,
+        accessTokenStore: new RedisAccessTokenStore(redis, profile.name),
+        flushStore: new InMemoryFlushStore(),
+        gameTokenSecret: 'test-secret',
+    };
+};
+
+describe('public.getTraffic', () => {
+    it('is public and returns only aggregate traffic plus allowlisted general names', async () => {
+        const result = await appRouter.createCaller(buildContext()).public.getTraffic();
+
+        expect(result.history).toHaveLength(2);
+        expect(result.history[0]).toEqual({
+            year: 185,
+            month: 2,
+            refresh: 30,
+            online: 5,
+            date: '2026-07-26 02:50:00',
+        });
+        expect(result.history[1]).toMatchObject({
+            year: 185,
+            month: 3,
+            refresh: 12,
+            online: 2,
+        });
+        expect(result.maxRefresh).toBe(30);
+        expect(result.maxOnline).toBe(5);
+        expect(result.suspects).toEqual([
+            { generalId: null, name: '접속자 총합', refresh: 12, refreshScoreTotal: 21 },
+            { generalId: 7, name: '갑', refresh: 9, refreshScoreTotal: 15 },
+            { generalId: 8, name: '을', refresh: 3, refreshScoreTotal: 6 },
+        ]);
+        expect(JSON.stringify(result)).not.toContain('userId');
+    });
+});

app/game-api/test/rankingRouter.test.ts

@@ -0,0 +1,248 @@
+import { describe, expect, it } from 'vitest';
+
+import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
+import type { RedisConnector } from '@sammo-ts/infra';
+
+import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
+import { InMemoryFlushStore } from '../src/auth/flushStore.js';
+import { InMemoryBattleSimTransport } from '../src/battleSim/inMemoryTransport.js';
+import type { DatabaseClient, GameApiContext, GameProfile } from '../src/context.js';
+import { InMemoryTurnDaemonTransport } from '../src/daemon/inMemoryTransport.js';
+import { appRouter } from '../src/router.js';
+
+const profile: GameProfile = {
+    id: 'che',
+    scenario: 'default',
+    name: 'che:default',
+};
+
+const auth: GameSessionTokenPayload = {
+    version: 1,
+    profile: 'che',
+    issuedAt: '2026-07-26T00:00:00.000Z',
+    expiresAt: '2026-07-27T00:00:00.000Z',
+    sessionId: 'ranking-session',
+    user: {
+        id: 'request-user-id',
+        username: 'ranking-user',
+        displayName: '조회자',
+        roles: [],
+    },
+    sanctions: {},
+};
+
+const generalRows = [
+    {
+        id: 1,
+        name: '유비',
+        nationId: 1,
+        userId: 'private-user-id-1',
+        npcState: 0,
+        picture: '1.jpg',
+        imageServer: 0,
+        meta: { ownerName: '공개소유자' },
+        experience: 1200,
+        dedication: 900,
+        horseCode: 'che_명마_15_적토마',
+        weaponCode: 'None',
+        bookCode: 'None',
+        itemCode: 'None',
+    },
+    {
+        id: 2,
+        name: '빙의관우',
+        nationId: 1,
+        userId: 'private-user-id-2',
+        npcState: 1,
+        picture: null,
+        imageServer: 0,
+        meta: { owner_name: '빙의소유자' },
+        experience: 1100,
+        dedication: 800,
+        horseCode: 'None',
+        weaponCode: 'None',
+        bookCode: 'None',
+        itemCode: 'None',
+    },
+    {
+        id: 3,
+        name: 'NPC조조',
+        nationId: 2,
+        userId: null,
+        npcState: 2,
+        picture: null,
+        imageServer: 0,
+        meta: {},
+        experience: 1300,
+        dedication: 1000,
+        horseCode: 'None',
+        weaponCode: 'None',
+        bookCode: 'None',
+        itemCode: 'None',
+    },
+] as const;
+
+const buildContext = (options?: {
+    authenticated?: boolean;
+    isUnited?: boolean;
+    includeOwnerDisplayName?: boolean;
+}): GameApiContext => {
+    const db = {
+        worldState: {
+            findFirst: async () => ({
+                meta: { isUnited: options?.isUnited ? 1 : 0 },
+                config: {
+                    const: {
+                        allItems: {
+                            horse: { che_명마_15_적토마: 2 },
+                            weapon: {},
+                            book: {},
+                            item: {},
+                        },
+                    },
+                },
+            }),
+        },
+        nation: {
+            findMany: async () => [
+                { id: 1, name: '촉', color: '#006400' },
+                { id: 2, name: '위', color: '#8b0000' },
+            ],
+        },
+        general: {
+            findMany: async (args: { where: { npcState: { lt?: number; gte?: number } } }) =>
+                generalRows.filter((general) =>
+                    args.where.npcState.gte !== undefined
+                        ? general.npcState >= args.where.npcState.gte
+                        : general.npcState < (args.where.npcState.lt ?? Number.POSITIVE_INFINITY)
+                ),
+        },
+        rankData: {
+            findMany: async () => [
+                { generalId: 1, type: 'firenum', value: 10 },
+                { generalId: 2, type: 'firenum', value: 20 },
+                { generalId: 3, type: 'firenum', value: 30 },
+            ],
+        },
+        auction: {
+            findMany: async () => [{ targetCode: 'che_명마_15_적토마' }],
+        },
+        gameHistory: {
+            findMany: async () => [
+                { season: 3, scenario: 22, scenarioName: '가상모드22' },
+                { season: 3, scenario: 22, scenarioName: '가상모드22' },
+            ],
+        },
+        hallOfFame: {
+            findMany: async (args: { where: { type: string } }) =>
+                args.where.type === 'experience'
+                    ? [
+                          {
+                              generalNo: 1,
+                              value: 1200,
+                              aux: {
+                                  name: '유비',
+                                  ownerName: 'private-hall-user-id',
+                                  ...(options?.includeOwnerDisplayName ? { ownerDisplayName: '공개소유자' } : {}),
+                                  nationName: '촉',
+                                  bgColor: '#006400',
+                                  fgColor: '#ffffff',
+                              },
+                          },
+                      ]
+                    : [],
+        },
+    };
+    const redis = {
+        get: async () => null,
+        set: async () => null,
+    } as unknown as RedisConnector['client'];
+
+    return {
+        db: db as unknown as DatabaseClient,
+        turnDaemon: new InMemoryTurnDaemonTransport(),
+        battleSim: new InMemoryBattleSimTransport(),
+        profile,
+        auth: options?.authenticated === false ? null : auth,
+        uploadDir: 'uploads',
+        uploadPath: '/uploads',
+        uploadPublicUrl: null,
+        redis,
+        accessTokenStore: new RedisAccessTokenStore(redis, profile.name),
+        flushStore: new InMemoryFlushStore(),
+        gameTokenSecret: 'test-secret',
+    };
+};
+
+describe('ranking.getBestGeneral', () => {
+    it('requires a game login even though the ranking is the same for every authenticated user', async () => {
+        await expect(
+            appRouter.createCaller(buildContext({ authenticated: false })).ranking.getBestGeneral({ view: 'user' })
+        ).rejects.toMatchObject({ code: 'UNAUTHORIZED' });
+    });
+
+    it('keeps possessed generals in the user view and redacts account identifiers before unification', async () => {
+        const result = await appRouter.createCaller(buildContext({ isUnited: false })).ranking.getBestGeneral({
+            view: 'user',
+        });
+
+        expect(result.sections[0]?.entries.map((entry) => entry.id)).toEqual([1, 2]);
+        expect(result.sections[0]?.entries.map((entry) => entry.ownerName)).toEqual([null, null]);
+        expect(result.sections.find((section) => section.title === '계 략 성 공')?.entries).toEqual([
+            expect.objectContaining({ id: 2, name: '???', nationName: '???', ownerName: null }),
+            expect.objectContaining({ id: 1, name: '???', nationName: '???', ownerName: null }),
+        ]);
+        expect(JSON.stringify(result)).not.toContain('private-user-id');
+    });
+
+    it('uses display names only after unification and preserves configured item copies plus auctions', async () => {
+        const result = await appRouter.createCaller(buildContext({ isUnited: true })).ranking.getBestGeneral({
+            view: 'user',
+        });
+
+        expect(result.sections[0]?.entries.map((entry) => entry.ownerName)).toEqual(['공개소유자', '빙의소유자']);
+        expect(result.uniqueItems.find((section) => section.slot === 'horse')?.entries).toEqual([
+            expect.objectContaining({
+                itemKey: 'che_명마_15_적토마',
+                owner: expect.objectContaining({ id: 1, name: '유비' }),
+            }),
+            expect.objectContaining({
+                itemKey: 'che_명마_15_적토마',
+                owner: expect.objectContaining({ id: 0, name: '경매중' }),
+            }),
+        ]);
+        expect(JSON.stringify(result)).not.toContain('private-user-id');
+    });
+
+    it('separates autonomous NPCs from users and possessed generals', async () => {
+        const result = await appRouter.createCaller(buildContext()).ranking.getBestGeneral({ view: 'npc' });
+        expect(result.sections[0]?.entries.map((entry) => entry.id)).toEqual([3]);
+    });
+});
+
+describe('ranking hall of fame', () => {
+    it('remains public and groups scenario counts', async () => {
+        const options = await appRouter
+            .createCaller(buildContext({ authenticated: false }))
+            .ranking.getHallOfFameOptions();
+        expect(options).toEqual([
+            {
+                season: 3,
+                scenarios: [{ id: 22, name: '가상모드22', count: 2 }],
+            },
+        ]);
+    });
+
+    it('returns an explicit display name but never exposes the stored account identifier', async () => {
+        const result = await appRouter
+            .createCaller(buildContext({ authenticated: false, includeOwnerDisplayName: true }))
+            .ranking.getHallOfFame({ season: 3 });
+        expect(result.sections[0]?.entries[0]?.ownerName).toBe('공개소유자');
+        expect(JSON.stringify(result)).not.toContain('private-hall-user-id');
+
+        const redacted = await appRouter
+            .createCaller(buildContext({ authenticated: false }))
+            .ranking.getHallOfFame({ season: 3 });
+        expect(redacted.sections[0]?.entries[0]?.ownerName).toBeNull();
+    });
+});

app/game-api/test/tournamentWorker.test.ts

@@ -12,6 +12,7 @@ import type {
     TournamentState,
 } from '../src/tournament/types.js';
 import { applyBattle, applyPreBattleStage, settleTournamentOutcome } from '../src/tournament/worker.js';
+import { buildBettingPayouts } from '../src/tournament/workerHelpers.js';
 import type { TurnDaemonTransport } from '../src/daemon/transport.js';
 
 class MemoryRedis {
@@ -209,6 +210,15 @@ const runTournamentToCompletion = async (options: {
 const delayTick = async (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0));
 
 describe('tournament worker (in-memory)', () => {
+    it('당첨자가 없으면 레거시와 같이 베팅금을 지급하거나 환불하지 않는다', () => {
+        expect(
+            buildBettingPayouts(10, [
+                { generalId: 1, targetId: 11, amount: 100 },
+                { generalId: 2, targetId: 12, amount: 200 },
+            ])
+        ).toEqual({ payouts: [], total: 300, refundAll: false });
+    });
+
     it('locks 64 applicants into eight groups of eight', async () => {
         const redis = new MemoryRedis();
         const store = new TournamentStore(redis, buildTournamentKeys('test-groups'));
@@ -284,11 +294,33 @@ describe('tournament worker (in-memory)', () => {
 
         const sent: TurnDaemonCommand[] = [];
         const transport: TurnDaemonTransport = {
-            sendCommand: async (command) => {
+            sendCommand: async () => 'unused',
+            requestCommand: async (command) => {
                 sent.push(command);
-                return 'ok';
+                if (command.type === 'tournamentReward') {
+                    return {
+                        type: 'tournamentReward',
+                        ok: true,
+                        winnerId: command.winnerId,
+                        runnerUpId: command.runnerUpId,
+                        rewarded: 2,
+                        missing: 0,
+                        totalGold: 100,
+                        totalExp: 10,
+                    };
+                }
+                if (command.type === 'tournamentBettingPayout') {
+                    return {
+                        type: 'tournamentBettingPayout',
+                        ok: true,
+                        bettingId: command.bettingId,
+                        processed: command.payouts.length,
+                        missing: 0,
+                        totalPayout: command.payouts.reduce((sum, payout) => sum + payout.amount, 0),
+                    };
+                }
+                return null;
             },
-            requestCommand: async () => null,
             requestStatus: async () => null,
         };
 
@@ -302,6 +334,82 @@ describe('tournament worker (in-memory)', () => {
         if (bettingCommand && bettingCommand.type === 'tournamentBettingPayout') {
             expect(bettingCommand.payouts).toEqual([{ generalId: 1, amount: 300 }]);
         }
+        expect(await store.getState()).toMatchObject({
+            rewardSettled: true,
+            bettingSettled: true,
+        });
+    });
+
+    it('정산 응답 실패 시 완료 표시를 남기지 않고 성공한 보상만 재시도에서 제외한다', async () => {
+        const redis = new MemoryRedis();
+        const store = new TournamentStore(redis, buildTournamentKeys('test-bet-retry'));
+        const state = createTournamentState({
+            stage: 0,
+            auto: false,
+            winnerId: 10,
+            bettingId: 124,
+            rewardSettled: false,
+            bettingSettled: false,
+        });
+        await store.setMatches([{ id: 1, stage: 10, roundIndex: 0, attackerId: 10, defenderId: 11, winnerId: 10 }]);
+        await store.setBettingEntries([{ generalId: 1, targetId: 10, amount: 100 }]);
+        await store.setState(state);
+
+        let payoutAttempts = 0;
+        const commands: TurnDaemonCommand[] = [];
+        const transport: TurnDaemonTransport = {
+            sendCommand: async () => 'unused',
+            requestCommand: async (command) => {
+                commands.push(command);
+                if (command.type === 'tournamentReward') {
+                    return {
+                        type: 'tournamentReward',
+                        ok: true,
+                        winnerId: command.winnerId,
+                        runnerUpId: command.runnerUpId,
+                        rewarded: 2,
+                        missing: 0,
+                        totalGold: 100,
+                        totalExp: 10,
+                    };
+                }
+                if (command.type === 'tournamentBettingPayout') {
+                    payoutAttempts += 1;
+                    if (payoutAttempts === 1) {
+                        return {
+                            type: 'tournamentBettingPayout',
+                            ok: false,
+                            bettingId: command.bettingId,
+                            reason: '일시적 실패',
+                        };
+                    }
+                    return {
+                        type: 'tournamentBettingPayout',
+                        ok: true,
+                        bettingId: command.bettingId,
+                        processed: 1,
+                        missing: 0,
+                        totalPayout: 100,
+                    };
+                }
+                return null;
+            },
+            requestStatus: async () => null,
+        };
+
+        await expect(settleTournamentOutcome({ store, daemonTransport: transport, state })).rejects.toThrow(
+            '일시적 실패'
+        );
+        const afterFailure = await store.getState();
+        expect(afterFailure).toMatchObject({ rewardSettled: true, bettingSettled: false });
+
+        await settleTournamentOutcome({ store, daemonTransport: transport, state: afterFailure! });
+        expect(await store.getState()).toMatchObject({ rewardSettled: true, bettingSettled: true });
+        expect(commands.filter((command) => command.type === 'tournamentReward')).toHaveLength(1);
+        expect(commands.filter((command) => command.type === 'tournamentBettingPayout')).toHaveLength(2);
+        expect(
+            commands.filter((command) => command.type === 'tournamentBettingPayout').map((command) => command.requestId)
+        ).toEqual(['tournament:124:betting-payout', 'tournament:124:betting-payout']);
     });
 
     it('자동 오픈 후 참가자 보충(NPC/더미 포함)하고 결승까지 진행된다', async () => {