RC-5

.dockerignore

@@ -2,7 +2,7 @@
 .env
 web/node_modules
 web/dist
-data
+/data
 *.db
 *.db-shm
 *.db-wal

.env.example

@@ -14,6 +14,8 @@ ARTIFACT_PUBLIC_BASE_URL=
 # changed in the Admin UI.
 DEFAULT_GUESS_MIN_INTERVAL_SEC=10
 DEFAULT_CLIENT_SUBMIT_INTERVAL_SEC=11
+DEFAULT_GUESS_LOTTERY_WINDOW_SEC=60
+DEFAULT_GUESS_LOTTERY_MAX_ACCEPTED=0
 DEFAULT_TASK_RANGE_BITS=28
 DEFAULT_ACTIVE_TASK_COUNT=1
 DEFAULT_PRESENCE_TTL_SEC=35

.gitignore

@@ -1,7 +1,7 @@
 .env
 web/node_modules
 web/dist
-data/
+/data/
 *.db
 *.db-shm
 *.db-wal

README.md

@@ -1,7 +1,11 @@
-# Neural Hunt — V2.8 RIFT Task-Style Collection
+> **V3.5 Random Guess Lottery:** Optional kann die Zahl der tatsächlich ausgewerteten Tipps pro Zeitfenster begrenzt werden. Im Admin-Tab **RUNTIME** steuern `Lotterie-Zeitfenster (s)` und `Max. gezogene Tipps je Task/Fenster` die Funktion; `0` deaktiviert sie vollständig. Die Lotterie läuft getrennt pro aktivem Task. Alle gültigen, signierten Tipps werden bis zum Ende des Zeitfensters gesammelt und anschließend mit `crypto/rand` gleichberechtigt zufällig gezogen. Nur gezogene Tipps werden gegen das geheime Ziel ausgewertet und können Score/Winner/NFT auslösen. Nicht gezogene Tipps verbrauchen ihre Sequenz, damit beim nächsten Fenster ein neuer deterministischer Tipp entsteht, zählen aber nicht als akzeptierter `guess_count`. Abgebrochene HTTP-Requests verbrauchen keinen Lotterie-Slot. Dadurch wird die mögliche Task-Abschluss-/NFT-Rate gedrosselt, ohne Gewinner oder Styles direkt zu manipulieren.
+
+# Neural Hunt — V3.1 RIFT Task-Style Collection + Profile Cleanup
 
 
 
+> **V3.1 Admin Profile Cleanup:** Im Admin-Tab **RUNTIME** gibt es ein manuelles Bereinigungstool für alte Identitäten. Die Inaktivitätsdauer ist in Stunden/Tagen/Wochen einstellbar. Vor dem Löschen zeigt **PRÜFEN** die Anzahl löschbarer Profile. Gelöscht werden ausschließlich Profile, deren letzte Aktivität älter als die gewählte Grenze ist, die aktuell nicht verbunden sind und die niemals Gewinner eines Tasks waren. Gewinner werden immer geschützt; aktuell verbundene Clients ebenfalls. Beim Löschen werden die per Foreign Key abhängigen `task_points`, `client_unlocks` und `client_task_selection` mit entfernt. WebSocket-Verbindungsaufbau und -ende aktualisieren `clients.last_seen`, damit die Inaktivitätsgrenze tatsächliche Nutzung besser abbildet.
+
 > **V2.8 RIFT Task-Styles:** RIFT-Identität und Rendering-Stil sind jetzt sauber getrennt. `/data/artifacts/_collection/character_anchor.png` ist ein globaler, neutraler Identity-Lock für den Waschbären RIFT und kann im Admin-Tab **ARTIFACT** einmalig manuell erzeugt und geprüft werden. Jeder Task kann im Admin-Tab **TASK ACTIONS** ein eigenes JPEG-/PNG-Style-Referenzbild erhalten; Nutzer sehen dieses Stylebild bereits in der Task-Auswahl und wählen damit indirekt die gewünschte NFT-Art. Bei jeder RIFT-Karte sendet Neural Hunt **Image 1 = Character Anchor** und **Image 2 = Task Style Reference** an die Images Edit API. Ohne eigenen Task-Style bleibt `internal/artifact/assets/style_reference.jpg` nur noch der Default-Fallback. Folge-Tasks erben ihren Style. `medium` bleibt Standard und die OpenAI-Usage-/Kosten-KPIs aus V2.7 bleiben erhalten.
 
 
@@ -18,6 +22,11 @@ Neural Hunt ist eine eigenständige Go-Webanwendung für das beschriebene sozial
 
 Die Weboberfläche liegt unter `internal/webui/dist/` und wird mit `//go:embed` in das Binary eingebettet. Der Server lädt beim lokalen Start automatisch eine vorhandene `.env` (bereits gesetzte Prozess-Umgebungsvariablen haben Vorrang), daher reicht `go run ./cmd/server` für Backend, Client-UI, Admin-UI und öffentliches Echtzeit-Leaderboard.
 
+## HTTPS / Browser-WebCrypto
+
+Die Weboberfläche erzeugt ihre ECDSA-P-256-Identität direkt im Browser über die Web Crypto API. Browser stellen `crypto.subtle` für normale Remote-Hosts nur in einem sicheren Kontext bereit. Verwende die Weboberfläche deshalb produktiv über **HTTPS**. `http://localhost` bzw. Loopback-Adressen werden von Browsern für lokale Entwicklung üblicherweise als vertrauenswürdiger Kontext behandelt. Bei einem Aufruf über `http://<IP-or-domain>` zeigt Neural Hunt eine verständliche HTTPS-Fehlermeldung statt eines JavaScript-Fehlers.
+
+
 ## Schnellstart
 
 ```bash

TESTING.md

@@ -319,3 +319,25 @@ go test ./internal/webui ./internal/core ./internal/auth ./internal/artifact ./i
 - Complete a task and verify its successor inherits `nft_style_reference`.
 - Generate a RIFT winner card and inspect the multipart OpenAI edit request: `image[]` must contain two files in this order: `character_anchor.png`, then the task style reference. Provider metadata should contain `reference_mode=character-plus-task-style`, the character-anchor hash and the style-reference hash.
 - Use **AUF DEFAULT ZURÜCK** and verify the task DB reference is empty and generation falls back to `internal/artifact/assets/style_reference.jpg` without deleting shared content-addressed style files.
+
+
+## V3.1 — Admin cleanup for stale non-winner profiles
+
+- In Admin → RUNTIME set e.g. `30 Tage` and click **PRÜFEN**. Verify the preview reports only clients whose `clients.last_seen` is older than the cutoff, that are not currently connected, and that have never appeared as `tasks.winner_client_id`.
+- Keep an old client connected via WebSocket: it must be reported as **aktuell verbunden geschützt** and never be deleted.
+- Create an old winner identity: it must be reported as **Gewinner geschützt** and never be deleted, regardless of age.
+- Confirm deletion and verify the client row is removed together with cascading `task_points`, `client_unlocks`, and `client_task_selection` rows.
+- Verify a recent non-winner remains untouched.
+- Verify WebSocket connect and disconnect update `clients.last_seen`, so a long-running session starts its inactivity window at disconnect rather than at its original login.
+- The API rejects cleanup windows shorter than one hour.
+
+Relevant automated tests: `internal/data/profile_cleanup_test.go` and `internal/server/profile_cleanup_test.go`.
+
+## V3.5 Random Guess Lottery
+
+1. Admin → RUNTIME: `Lotterie-Zeitfenster (s)=20`, `Max. gezogene Tipps je Task/Fenster=2` setzen und speichern.
+2. Mindestens drei Clients mit demselben Task verbinden und innerhalb desselben Fensters je einen Tipp absenden lassen.
+3. Bis zum Fensterende müssen die Requests auf die Losziehung warten. Danach dürfen höchstens zwei Clients `Tipp gezogen & geprüft` sehen; übrige Clients sehen `Tipp diesmal nicht gezogen`.
+4. Admin-Telemetrie: `Reject/s` steigt für nicht gezogene Tipps; `Guess/s` zählt nur tatsächlich gezogene/ausgewertete Tipps.
+5. Mit `Max. gezogene Tipps je Task/Fenster=0` speichern: Tipps müssen wieder ohne Lotterie-Verzögerung normal verarbeitet werden.
+6. Bei mehreren aktiven Tasks prüfen, dass jeder Task sein eigenes Kontingent erhält.

internal/artifact/worker.go

@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log"
 	"net/http"
 	"net/url"
 	"os"
@@ -78,7 +79,9 @@ func (w *Worker) Run(ctx context.Context) {
 		case <-ctx.Done():
 			return
 		case <-t.C:
-			_ = w.one(ctx)
+			if err := w.one(ctx); err != nil {
+				log.Printf("artifact worker: %v", err)
+			}
 		}
 	}
 }
@@ -142,12 +145,12 @@ func (w *Worker) one(ctx context.Context) error {
 	img, err := w.generate(ctx, cfg, x, prompt, negativePrompt)
 	if err != nil {
 		w.fail(ctx, x.ID, err)
-		return err
+		return fmt.Errorf("task %s: %w", x.ID, err)
 	}
 	if len(img.Bytes) == 0 {
 		err := errors.New("image provider returned empty output")
 		w.fail(ctx, x.ID, err)
-		return err
+		return fmt.Errorf("task %s: %w", x.ID, err)
 	}
 	if img.Ext == "" {
 		img.Ext = "png"
@@ -202,7 +205,7 @@ func (w *Worker) one(ctx context.Context) error {
 	outDir := filepath.Join(w.dir, artifactID)
 	if err := os.MkdirAll(outDir, 0o750); err != nil {
 		w.fail(ctx, x.ID, err)
-		return err
+		return fmt.Errorf("task %s: %w", x.ID, err)
 	}
 	if preset == collectionPresetRaccoon {
 		rawName := "art." + strings.TrimPrefix(strings.ToLower(img.Ext), ".")
@@ -214,16 +217,21 @@ func (w *Worker) one(ctx context.Context) error {
 	imageName := "image." + finalExt
 	if err := atomicWrite(filepath.Join(outDir, imageName), finalBytes, 0o640); err != nil {
 		w.fail(ctx, x.ID, err)
-		return err
+		return fmt.Errorf("task %s: %w", x.ID, err)
 	}
 	if err := atomicWrite(filepath.Join(outDir, "manifest.json"), mb, 0o640); err != nil {
 		w.fail(ctx, x.ID, err)
-		return err
+		return fmt.Errorf("task %s: %w", x.ID, err)
 	}
 	imgURI := w.uri(filepath.ToSlash(filepath.Join(relDir, imageName)))
 	manURI := w.uri(filepath.ToSlash(filepath.Join(relDir, "manifest.json")))
 	_, err = w.db.ExecContext(ctx, `UPDATE tasks SET artifact_status='ready',artifact_uri=?,artifact_manifest_uri=?,artifact_error=NULL WHERE id=?`, imgURI, manURI, x.ID)
-	return err
+	if err != nil {
+		w.fail(ctx, x.ID, err)
+		return fmt.Errorf("task %s: finalize artifact: %w", x.ID, err)
+	}
+	log.Printf("artifact worker task %s ready: %s", x.ID, imgURI)
+	return nil
 }
 
 func joinPrompt(parts ...string) string {

internal/data/profile_cleanup_test.go

@@ -0,0 +1,72 @@
+package data
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"neuralhunt/internal/auth"
+)
+
+func TestInactiveNonWinnerCleanupProtectsWinnersAndRecentClients(t *testing.T) {
+	ctx := context.Background()
+	db, err := OpenSQLite(ctx, t.TempDir()+"/cleanup.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	s := New(db)
+	jwk := auth.PublicJWK{Kty: "EC", Crv: "P-256", X: "AQ", Y: "Ag"}
+	for _, id := range []string{"old_delete", "old_winner", "recent_keep"} {
+		if err := s.UpsertClient(ctx, id, jwk); err != nil {
+			t.Fatal(err)
+		}
+	}
+	old := time.Now().UTC().Add(-45 * 24 * time.Hour).UnixMilli()
+	recent := time.Now().UTC().Add(-2 * time.Hour).UnixMilli()
+	if _, err := db.ExecContext(ctx, `UPDATE clients SET last_seen=? WHERE id IN ('old_delete','old_winner')`, old); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.ExecContext(ctx, `UPDATE clients SET last_seen=? WHERE id='recent_keep'`, recent); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.EnsureActiveTasks(ctx, 1, 32); err != nil {
+		t.Fatal(err)
+	}
+	var taskID string
+	if err := db.QueryRowContext(ctx, `SELECT id FROM tasks LIMIT 1`).Scan(&taskID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.ExecContext(ctx, `UPDATE tasks SET winner_client_id=? WHERE id=?`, "old_winner", taskID); err != nil {
+		t.Fatal(err)
+	}
+
+	cutoff := time.Now().UTC().Add(-30 * 24 * time.Hour).UnixMilli()
+	candidates, err := s.InactiveNonWinnerClients(ctx, cutoff)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(candidates) != 1 || candidates[0].ClientID != "old_delete" {
+		t.Fatalf("unexpected candidates: %+v", candidates)
+	}
+	wins, err := s.OldWinnerCount(ctx, cutoff)
+	if err != nil || wins != 1 {
+		t.Fatalf("protected winner count=%d err=%v", wins, err)
+	}
+	deleted, err := s.DeleteInactiveNonWinnerClients(ctx, cutoff, []string{"old_delete", "old_winner", "recent_keep"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(deleted) != 1 || deleted[0] != "old_delete" {
+		t.Fatalf("unexpected deleted: %#v", deleted)
+	}
+	if s.ClientExists(ctx, "old_delete") {
+		t.Fatal("old non-winner should have been deleted")
+	}
+	if !s.ClientExists(ctx, "old_winner") {
+		t.Fatal("winner must be protected")
+	}
+	if !s.ClientExists(ctx, "recent_keep") {
+		t.Fatal("recent client must be protected")
+	}
+}

internal/data/schema.sql

@@ -0,0 +1,130 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE IF NOT EXISTS clients (
+    id TEXT PRIMARY KEY,
+    public_jwk TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    last_seen INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS settings (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL,
+    updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tasks (
+    id TEXT PRIMARY KEY,
+    secret TEXT NOT NULL,
+    public_seed TEXT NOT NULL,
+    range_bits INTEGER NOT NULL,
+    status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active','completed','closed')),
+    paused INTEGER NOT NULL DEFAULT 0,
+    guess_min_interval_sec INTEGER,
+    client_submit_interval_sec INTEGER,
+    revision INTEGER NOT NULL DEFAULT 0,
+    parent_task_id TEXT REFERENCES tasks(id),
+    display_name TEXT NOT NULL DEFAULT '',
+    description TEXT NOT NULL DEFAULT '',
+    nft_prompt_instructions TEXT NOT NULL DEFAULT '',
+    nft_negative_prompt TEXT NOT NULL DEFAULT '',
+    nft_style_reference TEXT NOT NULL DEFAULT '',
+    created_at INTEGER NOT NULL,
+    completed_at INTEGER,
+    winner_client_id TEXT REFERENCES clients(id),
+    winner_signature TEXT,
+    winning_guess TEXT,
+    artifact_status TEXT NOT NULL DEFAULT 'none' CHECK (artifact_status IN ('none','pending','generating','ready','error')),
+    artifact_uri TEXT,
+    artifact_manifest_uri TEXT,
+    artifact_error TEXT
+);
+CREATE INDEX IF NOT EXISTS tasks_status_created_idx ON tasks(status, created_at);
+
+-- False guesses are intentionally not persisted. This table only keeps the
+-- aggregate state needed for the 3D map, ranking, rate limiting and next seq.
+CREATE TABLE IF NOT EXISTS task_points (
+    task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+    client_id TEXT NOT NULL REFERENCES clients(id) ON DELETE CASCADE,
+    score REAL NOT NULL DEFAULT 0,
+    x REAL NOT NULL DEFAULT 0,
+    y REAL NOT NULL DEFAULT 0,
+    z REAL NOT NULL DEFAULT 0,
+    guess_count INTEGER NOT NULL DEFAULT 0,
+    next_seq INTEGER NOT NULL DEFAULT 0,
+    last_guess_at INTEGER,
+    PRIMARY KEY (task_id, client_id)
+);
+CREATE INDEX IF NOT EXISTS task_points_rank_idx ON task_points(task_id, score DESC);
+
+
+
+-- A browser or shell identity can explicitly choose which active task it works
+-- on. The selection is persisted so switching devices with the same exported
+-- identity keeps the chosen task (while single-active-connection enforcement
+-- still applies at runtime).
+CREATE TABLE IF NOT EXISTS client_task_selection (
+    client_id TEXT PRIMARY KEY REFERENCES clients(id) ON DELETE CASCADE,
+    task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+    updated_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS client_task_selection_task_idx ON client_task_selection(task_id);
+
+CREATE TABLE IF NOT EXISTS client_unlocks (
+    client_id TEXT NOT NULL REFERENCES clients(id) ON DELETE CASCADE,
+    unlock_key TEXT NOT NULL,
+    task_id TEXT REFERENCES tasks(id) ON DELETE SET NULL,
+    created_at INTEGER NOT NULL,
+    PRIMARY KEY (client_id, unlock_key)
+);
+
+-- A short lease enforces one active websocket per browser identity.
+CREATE TABLE IF NOT EXISTS presence_leases (
+    client_id TEXT PRIMARY KEY,
+    session_id TEXT NOT NULL,
+    expires_at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS presence_exp_idx ON presence_leases(expires_at);
+
+-- Admin task actions may run immediately or at a future timestamp. Payloads are
+-- small JSON objects validated by the Go server before being scheduled.
+CREATE TABLE IF NOT EXISTS task_actions (
+    id TEXT PRIMARY KEY,
+    task_id TEXT NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+    action_type TEXT NOT NULL,
+    payload_json TEXT NOT NULL DEFAULT '{}',
+    execute_at INTEGER NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','running','done','error','cancelled')),
+    created_at INTEGER NOT NULL,
+    executed_at INTEGER,
+    error TEXT
+);
+CREATE INDEX IF NOT EXISTS task_actions_due_idx ON task_actions(status, execute_at);
+CREATE INDEX IF NOT EXISTS task_actions_task_idx ON task_actions(task_id, created_at DESC);
+
+-- Successful external image-model calls are logged with the token usage
+-- returned by the provider. Costs are local estimates based on pinned public
+-- standard token rates. Billing reconciliation still belongs to the provider.
+CREATE TABLE IF NOT EXISTS artifact_api_usage (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    created_at INTEGER NOT NULL,
+    task_id TEXT REFERENCES tasks(id) ON DELETE SET NULL,
+    kind TEXT NOT NULL CHECK (kind IN ('character_anchor','artifact')),
+    provider TEXT NOT NULL,
+    model TEXT NOT NULL,
+    endpoint TEXT NOT NULL,
+    size TEXT NOT NULL,
+    quality TEXT NOT NULL,
+    request_id TEXT,
+    input_tokens INTEGER NOT NULL DEFAULT 0,
+    input_text_tokens INTEGER NOT NULL DEFAULT 0,
+    input_image_tokens INTEGER NOT NULL DEFAULT 0,
+    output_tokens INTEGER NOT NULL DEFAULT 0,
+    total_tokens INTEGER NOT NULL DEFAULT 0,
+    estimated_cost_usd REAL,
+    pricing_basis TEXT NOT NULL DEFAULT '',
+    meta_json TEXT NOT NULL DEFAULT '{}'
+);
+CREATE INDEX IF NOT EXISTS artifact_api_usage_created_idx ON artifact_api_usage(created_at DESC);
+CREATE INDEX IF NOT EXISTS artifact_api_usage_kind_created_idx ON artifact_api_usage(kind, created_at DESC);
+CREATE INDEX IF NOT EXISTS artifact_api_usage_task_idx ON artifact_api_usage(task_id);

internal/data/successor_test.go

@@ -0,0 +1,68 @@
+package data
+
+import (
+	"context"
+	"testing"
+
+	"neuralhunt/internal/auth"
+)
+
+func TestSuccessorInheritsTaskConfigAndSelection(t *testing.T) {
+	ctx := context.Background()
+	db, err := OpenSQLite(ctx, t.TempDir()+"/test.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	s := New(db)
+	if err := s.EnsureActiveTasks(ctx, 1, 40); err != nil {
+		t.Fatal(err)
+	}
+	ts, err := s.ActiveTasks(ctx)
+	if err != nil || len(ts) != 1 {
+		t.Fatalf("active tasks: len=%d err=%v", len(ts), err)
+	}
+	pred := ts[0]
+	if err := s.UpdateTaskConfig(ctx, pred.ID, "Prime Field", "Beschreibung", "winner in crystalline neural lattice", "no text"); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.SetTaskStyleReference(ctx, pred.ID, "abc123.jpg"); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.SetTaskIntervals(ctx, pred.ID, 13, 14); err != nil {
+		t.Fatal(err)
+	}
+	jwk := auth.PublicJWK{Kty: "EC", Crv: "P-256", X: "AQ", Y: "Ag"}
+	// UpsertClient stores the JWK without validating its curve; crypto validation
+	// belongs to auth handlers and is irrelevant to this persistence test.
+	if err := s.UpsertClient(ctx, "client_test", jwk); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.SetClientTaskSelection(ctx, "client_test", pred.ID); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.CloseTask(ctx, pred.ID); err != nil {
+		t.Fatal(err)
+	}
+	next, err := s.EnsureSuccessorTask(ctx, pred.ID, 32)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if next.ParentTaskID == nil || *next.ParentTaskID != pred.ID {
+		t.Fatalf("parent mismatch: %#v", next.ParentTaskID)
+	}
+	if next.RangeBits != 40 || next.DisplayName != "Prime Field" || next.Description != "Beschreibung" || next.NFTPromptInstructions != "winner in crystalline neural lattice" || next.NFTNegativePrompt != "no text" || next.NFTStyleReference != "abc123.jpg" {
+		t.Fatalf("successor did not inherit config: %+v", next)
+	}
+	if next.GuessMinIntervalSec == nil || *next.GuessMinIntervalSec != 13 || next.ClientSubmitIntervalSec == nil || *next.ClientSubmitIntervalSec != 14 {
+		t.Fatalf("successor did not inherit intervals: %+v", next)
+	}
+	selected, err := s.SelectedTaskID(ctx, "client_test")
+	if err != nil || selected != next.ID {
+		t.Fatalf("selection was not migrated: selected=%q next=%q err=%v", selected, next.ID, err)
+	}
+	again, err := s.EnsureSuccessorTask(ctx, pred.ID, 32)
+	if err != nil || again.ID != next.ID {
+		t.Fatalf("successor must be idempotent: first=%q second=%q err=%v", next.ID, again.ID, err)
+	}
+}

internal/runtime/state.go

@@ -100,6 +100,21 @@ func (s *State) ConnectedCount() int64 {
 	return int64(len(s.presence))
 }
 
+// ForgetClient removes non-durable runtime state for an identity that was
+// deleted by the admin profile cleanup tool. The caller must only pass clients
+// that are currently disconnected.
+func (s *State) ForgetClient(clientID string) {
+	s.mu.Lock()
+	delete(s.presence, clientID)
+	delete(s.selected, clientID)
+	for k := range s.guesses {
+		if k.ClientID == clientID {
+			delete(s.guesses, k)
+		}
+	}
+	s.mu.Unlock()
+}
+
 func (s *State) SetTaskSelection(clientID, taskID string) {
 	s.mu.Lock()
 	if taskID == "" {
@@ -161,6 +176,57 @@ type AcceptResult struct {
 	Improved bool
 }
 
+// CanSubmit validates sequence and per-client timing before a request is
+// admitted into the global-per-task lottery. It does not mutate state, so an
+// unselected ticket can be consumed explicitly by SkipLottery.
+func (s *State) CanSubmit(task data.Task, cid string, seq int64, minInterval time.Duration) error {
+	k := guessKey{task.ID, cid}
+	now := time.Now().UTC()
+	s.mu.RLock()
+	g, ok := s.guesses[k]
+	s.mu.RUnlock()
+	if !ok || g.PublicSeed != task.PublicSeed || seq != g.NextSeq {
+		s.record(false, false, true)
+		return ErrBadSequence
+	}
+	if !g.LastGuess.IsZero() && minInterval > 0 && now.Sub(g.LastGuess) < minInterval {
+		s.record(false, false, true)
+		return ErrRateLimited
+	}
+	return nil
+}
+
+// SkipLottery consumes a valid sequence that lost the random draw without
+// evaluating/scoring it. This prevents the same deterministic guess from being
+// resubmitted forever while keeping guess_count reserved for actually accepted
+// and evaluated tips.
+func (s *State) SkipLottery(task data.Task, cid string, seq int64, minInterval time.Duration) (int64, error) {
+	k := guessKey{task.ID, cid}
+	now := time.Now().UTC()
+	s.mu.Lock()
+	g, ok := s.guesses[k]
+	if !ok || g.PublicSeed != task.PublicSeed || seq != g.NextSeq {
+		next := g.NextSeq
+		s.mu.Unlock()
+		s.record(false, false, true)
+		return next, ErrBadSequence
+	}
+	if !g.LastGuess.IsZero() && minInterval > 0 && now.Sub(g.LastGuess) < minInterval {
+		next := g.NextSeq
+		s.mu.Unlock()
+		s.record(false, false, true)
+		return next, ErrRateLimited
+	}
+	g.NextSeq++
+	g.LastGuess = now
+	g.Revision = task.Revision
+	s.guesses[k] = g
+	next := g.NextSeq
+	s.mu.Unlock()
+	s.record(false, false, true)
+	return next, nil
+}
+
 func (s *State) Accept(task data.Task, cid string, seq int64, score float64, minInterval time.Duration) (AcceptResult, error) {
 	k := guessKey{task.ID, cid}
 	now := time.Now().UTC()

internal/runtime/state_test.go

@@ -79,3 +79,26 @@ func TestGuessHotPathAndReroll(t *testing.T) {
 		t.Fatalf("reroll not reset: %+v", g)
 	}
 }
+
+func TestLotterySkipConsumesSequenceWithoutCountingAcceptedGuess(t *testing.T) {
+	s := New()
+	task := data.Task{ID: "lottery-task", PublicSeed: "seed", Revision: 1}
+	s.InitGuess(task, "client", GuessState{})
+	if err := s.CanSubmit(task, "client", 0, 0); err != nil {
+		t.Fatalf("eligible guess rejected: %v", err)
+	}
+	next, err := s.SkipLottery(task, "client", 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if next != 1 {
+		t.Fatalf("next seq = %d, want 1", next)
+	}
+	g, ok := s.Current(task, "client")
+	if !ok {
+		t.Fatal("missing runtime state")
+	}
+	if g.NextSeq != 1 || g.GuessCount != 0 || g.LastGuess.IsZero() {
+		t.Fatalf("unexpected lottery skip state: %+v", g)
+	}
+}

internal/server/guess_lottery.go

@@ -0,0 +1,135 @@
+package server
+
+import (
+	"context"
+	crand "crypto/rand"
+	"errors"
+	"math/big"
+	"sync"
+	"time"
+)
+
+var (
+	errLotteryDuplicate = errors.New("guess already entered in current lottery window")
+	errLotteryFull      = errors.New("guess lottery window is full")
+)
+
+const maxLotteryTicketsPerWindow = 250000
+
+type lotteryTicket struct {
+	key    string
+	ctx    context.Context
+	result chan bool
+}
+
+type lotteryBucket struct {
+	max     int
+	end     time.Time
+	tickets []*lotteryTicket
+	keys    map[string]struct{}
+}
+
+type guessLottery struct {
+	mu      sync.Mutex
+	buckets map[string]*lotteryBucket
+}
+
+func newGuessLottery() *guessLottery {
+	return &guessLottery{buckets: make(map[string]*lotteryBucket)}
+}
+
+// enter batches all valid tips for a task into aligned time windows. At the
+// window boundary exactly up to max tickets are selected uniformly at random.
+// The request intentionally waits for the draw so later arrivals in the same
+// window have the same chance as earlier arrivals.
+func (l *guessLottery) enter(ctx context.Context, taskID, clientID string, seq int64, window time.Duration, max int) (bool, error) {
+	if max <= 0 || window <= 0 {
+		return true, nil
+	}
+	now := time.Now().UTC()
+	windowNS := window.Nanoseconds()
+	if windowNS <= 0 {
+		return true, nil
+	}
+	idx := now.UnixNano() / windowNS
+	end := time.Unix(0, (idx+1)*windowNS).UTC()
+	bucketKey := taskID + "|" + end.Format(time.RFC3339Nano) + "|" + window.String()
+	ticketKey := clientID + "|" + big.NewInt(seq).String()
+	t := &lotteryTicket{key: ticketKey, ctx: ctx, result: make(chan bool, 1)}
+
+	l.mu.Lock()
+	b := l.buckets[bucketKey]
+	if b == nil {
+		b = &lotteryBucket{max: max, end: end, keys: make(map[string]struct{})}
+		l.buckets[bucketKey] = b
+		delay := time.Until(end)
+		if delay < 0 {
+			delay = 0
+		}
+		time.AfterFunc(delay, func() { l.draw(bucketKey) })
+	}
+	if _, exists := b.keys[ticketKey]; exists {
+		l.mu.Unlock()
+		return false, errLotteryDuplicate
+	}
+	if len(b.tickets) >= maxLotteryTicketsPerWindow {
+		l.mu.Unlock()
+		return false, errLotteryFull
+	}
+	b.keys[ticketKey] = struct{}{}
+	b.tickets = append(b.tickets, t)
+	l.mu.Unlock()
+
+	select {
+	case selected := <-t.result:
+		return selected, nil
+	case <-ctx.Done():
+		return false, ctx.Err()
+	}
+}
+
+func (l *guessLottery) draw(bucketKey string) {
+	l.mu.Lock()
+	b := l.buckets[bucketKey]
+	if b == nil {
+		l.mu.Unlock()
+		return
+	}
+	delete(l.buckets, bucketKey)
+	tickets := append([]*lotteryTicket(nil), b.tickets...)
+	max := b.max
+	l.mu.Unlock()
+
+	// Canceled HTTP requests do not consume one of the scarce winning slots.
+	alive := tickets[:0]
+	for _, t := range tickets {
+		select {
+		case <-t.ctx.Done():
+			// skip
+		default:
+			alive = append(alive, t)
+		}
+	}
+	tickets = alive
+	if max > len(tickets) {
+		max = len(tickets)
+	}
+	// Partial Fisher-Yates with crypto/rand gives every ticket equal odds.
+	for i := 0; i < max; i++ {
+		nBig, err := crand.Int(crand.Reader, big.NewInt(int64(len(tickets)-i)))
+		if err != nil {
+			// crypto/rand failure is extremely unusual; deterministic fallback still
+			// keeps the quota safe, but does not claim cryptographic randomness.
+			nBig = big.NewInt(0)
+		}
+		j := i + int(nBig.Int64())
+		tickets[i], tickets[j] = tickets[j], tickets[i]
+	}
+	for i, t := range tickets {
+		selected := i < max
+		select {
+		case t.result <- selected:
+		default:
+		}
+	}
+}

internal/server/guess_lottery_test.go

@@ -0,0 +1,44 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+)
+
+func TestGuessLotteryDrawSelectsExactQuota(t *testing.T) {
+	l := newGuessLottery()
+	const total = 40
+	const quota = 9
+	b := &lotteryBucket{max: quota, end: time.Now().Add(time.Second), keys: make(map[string]struct{})}
+	for i := 0; i < total; i++ {
+		ticket := &lotteryTicket{key: fmt.Sprintf("c-%d|0", i), ctx: context.Background(), result: make(chan bool, 1)}
+		b.tickets = append(b.tickets, ticket)
+		b.keys[ticket.key] = struct{}{}
+	}
+	l.buckets["test"] = b
+	l.draw("test")
+	selected := 0
+	for _, ticket := range b.tickets {
+		if <-ticket.result {
+			selected++
+		}
+	}
+	if selected != quota {
+		t.Fatalf("selected %d tickets, want %d", selected, quota)
+	}
+}
+
+func TestGuessLotteryCanceledTicketDoesNotConsumeQuota(t *testing.T) {
+	l := newGuessLottery()
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	canceled := &lotteryTicket{key: "canceled", ctx: ctx, result: make(chan bool, 1)}
+	alive := &lotteryTicket{key: "alive", ctx: context.Background(), result: make(chan bool, 1)}
+	l.buckets["test"] = &lotteryBucket{max: 1, tickets: []*lotteryTicket{canceled, alive}, keys: map[string]struct{}{"canceled": {}, "alive": {}}}
+	l.draw("test")
+	if got := <-alive.result; !got {
+		t.Fatal("live ticket should receive the available slot")
+	}
+}

internal/server/profile_cleanup_test.go

@@ -0,0 +1,55 @@
+package server
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"neuralhunt/internal/auth"
+	"neuralhunt/internal/data"
+	rtx "neuralhunt/internal/runtime"
+)
+
+func TestProfileCleanupPreviewProtectsConnectedClient(t *testing.T) {
+	ctx := context.Background()
+	db, err := data.OpenSQLite(ctx, t.TempDir()+"/cleanup.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	store := data.New(db)
+	jwk := auth.PublicJWK{Kty: "EC", Crv: "P-256", X: "AQ", Y: "Ag"}
+	for _, id := range []string{"offline_old", "online_old"} {
+		if err := store.UpsertClient(ctx, id, jwk); err != nil {
+			t.Fatal(err)
+		}
+	}
+	old := time.Now().UTC().Add(-10 * 24 * time.Hour).UnixMilli()
+	if _, err := db.ExecContext(ctx, `UPDATE clients SET last_seen=?`, old); err != nil {
+		t.Fatal(err)
+	}
+	runtimeState := rtx.New()
+	if _, err := runtimeState.AcquirePresence("online_old", "session"); err != nil {
+		t.Fatal(err)
+	}
+	s := &Server{store: store, runtime: runtimeState}
+	preview, ids, err := s.profileCleanupPreview(ctx, 7*24*60*60)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if preview.Eligible != 1 || preview.ProtectedConnected != 1 {
+		t.Fatalf("unexpected preview: %+v", preview)
+	}
+	if len(ids) != 1 || ids[0] != "offline_old" {
+		t.Fatalf("unexpected ids: %#v", ids)
+	}
+}
+
+func TestProfileCleanupDurationGuard(t *testing.T) {
+	if _, err := profileCleanupDurationSeconds("3599"); err == nil {
+		t.Fatal("sub-hour cleanup window should be rejected")
+	}
+	if got, err := profileCleanupDurationSeconds("86400"); err != nil || got != 86400 {
+		t.Fatalf("got=%d err=%v", got, err)
+	}
+}

internal/server/server.go

@@ -37,6 +37,7 @@ type Server struct {
 	hub                                          *wsx.Hub
 	runtime                                      *rtx.State
 	artifactWorker                               *artifact.Worker
+	lottery                                      *guessLottery
 	adminUser, adminPass, staticDir, artifactDir string
 	upgrader                                     websocket.Upgrader
 }
@@ -49,6 +50,7 @@ func New(store *data.Store, a *auth.Manager, sm *settings.Manager, hub *wsx.Hub,
 		hub:            hub,
 		runtime:        runtimeState,
 		artifactWorker: artifactWorker,
+		lottery:        newGuessLottery(),
 		adminUser:      env("ADMIN_USER", "admin"),
 		adminPass:      env("ADMIN_PASSWORD", "change-me"),
 		staticDir:      env("STATIC_DIR", ""),
@@ -178,6 +180,8 @@ func (s *Server) Routes() http.Handler {
 		r.Use(func(n http.Handler) http.Handler { return s.require("admin", n) })
 		r.Get("/api/admin/overview", s.adminOverview)
 		r.Get("/api/admin/performance", s.adminPerformance)
+		r.Get("/api/admin/profiles/cleanup-preview", s.adminProfileCleanupPreview)
+		r.Post("/api/admin/profiles/cleanup", s.adminProfileCleanup)
 		r.Get("/api/admin/settings", s.adminSettingsGet)
 		r.Put("/api/admin/settings", s.adminSettingsPut)
 		r.Get("/api/admin/tasks", s.adminTasks)
@@ -349,6 +353,8 @@ func taskDTO(t data.Task, next int64, sm settings.Runtime) map[string]any {
 		"next_seq":                   next,
 		"server_min_interval_sec":    serverMin,
 		"client_submit_interval_sec": clientSubmit,
+		"guess_lottery_window_sec":   sm.GuessLotteryWindowSec,
+		"guess_lottery_max_accepted": sm.GuessLotteryMaxAccepted,
 		"default_max_nodes":          sm.DefaultMaxNodes,
 		"paused":                     t.Paused,
 		"revision":                   t.Revision,
@@ -495,6 +501,78 @@ func (s *Server) guess(w http.ResponseWriter, r *http.Request) {
 		jsonOut(w, 401, false)
 		return
 	}
+	if _, ok := s.runtime.Current(t.Task, c.ClientID); !ok {
+		snap, _ := s.store.LoadGuessState(r.Context(), t.ID, c.ClientID)
+		s.runtime.InitGuess(t.Task, c.ClientID, rtx.GuessState{NextSeq: snap.NextSeq, LastGuess: snap.LastGuess, BestScore: snap.BestScore, GuessCount: snap.GuessCount})
+	}
+	cfg := s.settings.Get()
+	serverMin, _ := taskIntervals(t.Task, cfg)
+	minInterval := time.Duration(serverMin) * time.Second
+	if err := s.runtime.CanSubmit(t.Task, c.ClientID, in.Seq, minInterval); err != nil {
+		switch {
+		case errors.Is(err, rtx.ErrRateLimited):
+			jsonOut(w, 429, false)
+		case errors.Is(err, rtx.ErrBadSequence):
+			expected := int64(0)
+			if cur, ok := s.runtime.Current(t.Task, c.ClientID); ok {
+				expected = cur.NextSeq
+			}
+			jsonAPIError(w, http.StatusConflict, "sequence_mismatch", "guess sequence is stale", map[string]any{"next_seq": expected})
+		default:
+			jsonOut(w, 500, false)
+		}
+		return
+	}
+
+	if cfg.GuessLotteryMaxAccepted > 0 {
+		selected, drawErr := s.lottery.enter(r.Context(), t.ID, c.ClientID, in.Seq, time.Duration(cfg.GuessLotteryWindowSec)*time.Second, cfg.GuessLotteryMaxAccepted)
+		if drawErr != nil {
+			switch {
+			case errors.Is(drawErr, errLotteryDuplicate):
+				jsonAPIError(w, http.StatusConflict, "lottery_duplicate", "guess is already waiting for the current draw", nil)
+			case errors.Is(drawErr, errLotteryFull):
+				jsonAPIError(w, http.StatusTooManyRequests, "lottery_full", "guess lottery window is full", nil)
+			case errors.Is(drawErr, context.Canceled), errors.Is(drawErr, context.DeadlineExceeded):
+				return
+			default:
+				jsonOut(w, 500, false)
+			}
+			return
+		}
+
+		// A task may have been rerolled, paused or completed while this request
+		// waited for the draw. Never consume/evaluate a stale lottery ticket.
+		fresh, freshErr := s.store.SecretTask(r.Context(), id)
+		if freshErr != nil || fresh.Status != "active" {
+			jsonAPIError(w, http.StatusConflict, "task_inactive", "task is no longer active", nil)
+			return
+		}
+		if fresh.Paused {
+			jsonOut(w, 423, false)
+			return
+		}
+		if fresh.PublicSeed != t.PublicSeed || fresh.Revision != t.Revision {
+			jsonAPIError(w, http.StatusConflict, "task_config_changed", "task configuration changed during lottery; resync required", map[string]any{"revision": fresh.Revision})
+			return
+		}
+		t = fresh
+		if !selected {
+			next, skipErr := s.runtime.SkipLottery(t.Task, c.ClientID, in.Seq, minInterval)
+			if skipErr != nil {
+				if errors.Is(skipErr, rtx.ErrBadSequence) {
+					jsonAPIError(w, http.StatusConflict, "sequence_mismatch", "guess sequence changed while waiting for lottery", map[string]any{"next_seq": next})
+				} else if errors.Is(skipErr, rtx.ErrRateLimited) {
+					jsonOut(w, 429, false)
+				} else {
+					jsonOut(w, 500, false)
+				}
+				return
+			}
+			jsonAPIError(w, http.StatusTooManyRequests, "lottery_not_selected", "guess was not selected in this lottery window", map[string]any{"next_seq": next})
+			return
+		}
+	}
+
 	d, err := core.Distance(in.Guess, t.Secret)
 	if err != nil {
 		jsonOut(w, 400, false)
@@ -502,12 +580,7 @@ func (s *Server) guess(w http.ResponseWriter, r *http.Request) {
 	}
 	correct := d.Sign() == 0
 	score := core.Score(d, t.RangeBits)
-	if _, ok := s.runtime.Current(t.Task, c.ClientID); !ok {
-		snap, _ := s.store.LoadGuessState(r.Context(), t.ID, c.ClientID)
-		s.runtime.InitGuess(t.Task, c.ClientID, rtx.GuessState{NextSeq: snap.NextSeq, LastGuess: snap.LastGuess, BestScore: snap.BestScore, GuessCount: snap.GuessCount})
-	}
-	serverMin, _ := taskIntervals(t.Task, s.settings.Get())
-	accepted, err := s.runtime.Accept(t.Task, c.ClientID, in.Seq, score, time.Duration(serverMin)*time.Second)
+	accepted, err := s.runtime.Accept(t.Task, c.ClientID, in.Seq, score, minInterval)
 	if err != nil {
 		switch {
 		case errors.Is(err, rtx.ErrRateLimited):
@@ -736,6 +809,108 @@ func (s *Server) serveAdminArtifactPart(w http.ResponseWriter, r *http.Request,
 	http.ServeFile(w, r, path)
 }
 
+type profileCleanupPreview struct {
+	CutoffMS           int64 `json:"cutoff_ms"`
+	InactiveForSeconds int64 `json:"inactive_for_seconds"`
+	Eligible           int   `json:"eligible"`
+	ProtectedWinners   int64 `json:"protected_winners"`
+	ProtectedConnected int   `json:"protected_connected"`
+	OldestEligibleMS   int64 `json:"oldest_eligible_ms,omitempty"`
+	NewestEligibleMS   int64 `json:"newest_eligible_ms,omitempty"`
+}
+
+func profileCleanupDurationSeconds(raw string) (int64, error) {
+	seconds, err := strconv.ParseInt(strings.TrimSpace(raw), 10, 64)
+	if err != nil {
+		return 0, errors.New("inactive_for_seconds must be an integer")
+	}
+	// A one-hour minimum prevents an accidental near-live purge while still
+	// allowing short-lived development/test deployments to clean up quickly.
+	if seconds < 3600 || seconds > 10*365*24*60*60 {
+		return 0, errors.New("inactive_for_seconds must be between 3600 seconds and 10 years")
+	}
+	return seconds, nil
+}
+
+func (s *Server) profileCleanupPreview(ctx context.Context, inactiveForSeconds int64) (profileCleanupPreview, []string, error) {
+	cutoff := time.Now().UTC().Add(-time.Duration(inactiveForSeconds) * time.Second).UnixMilli()
+	candidates, err := s.store.InactiveNonWinnerClients(ctx, cutoff)
+	if err != nil {
+		return profileCleanupPreview{}, nil, err
+	}
+	protectedWinners, err := s.store.OldWinnerCount(ctx, cutoff)
+	if err != nil {
+		return profileCleanupPreview{}, nil, err
+	}
+	ids := make([]string, 0, len(candidates))
+	out := profileCleanupPreview{CutoffMS: cutoff, InactiveForSeconds: inactiveForSeconds, ProtectedWinners: protectedWinners}
+	for _, c := range candidates {
+		if s.runtime.IsConnected(c.ClientID) {
+			out.ProtectedConnected++
+			continue
+		}
+		ids = append(ids, c.ClientID)
+		if out.OldestEligibleMS == 0 || c.LastSeen < out.OldestEligibleMS {
+			out.OldestEligibleMS = c.LastSeen
+		}
+		if c.LastSeen > out.NewestEligibleMS {
+			out.NewestEligibleMS = c.LastSeen
+		}
+	}
+	out.Eligible = len(ids)
+	return out, ids, nil
+}
+
+func (s *Server) adminProfileCleanupPreview(w http.ResponseWriter, r *http.Request) {
+	seconds, err := profileCleanupDurationSeconds(r.URL.Query().Get("inactive_for_seconds"))
+	if err != nil {
+		jsonOut(w, 400, map[string]string{"error": err.Error()})
+		return
+	}
+	preview, _, err := s.profileCleanupPreview(r.Context(), seconds)
+	if err != nil {
+		jsonOut(w, 500, map[string]string{"error": "profile cleanup preview failed: " + err.Error()})
+		return
+	}
+	jsonOut(w, 200, preview)
+}
+
+func (s *Server) adminProfileCleanup(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		InactiveForSeconds int64 `json:"inactive_for_seconds"`
+	}
+	if err := decode(r, &in); err != nil {
+		jsonOut(w, 400, map[string]string{"error": "bad json: " + err.Error()})
+		return
+	}
+	seconds, err := profileCleanupDurationSeconds(strconv.FormatInt(in.InactiveForSeconds, 10))
+	if err != nil {
+		jsonOut(w, 400, map[string]string{"error": err.Error()})
+		return
+	}
+	preview, ids, err := s.profileCleanupPreview(r.Context(), seconds)
+	if err != nil {
+		jsonOut(w, 500, map[string]string{"error": "profile cleanup check failed: " + err.Error()})
+		return
+	}
+	deleted, err := s.store.DeleteInactiveNonWinnerClients(r.Context(), preview.CutoffMS, ids)
+	if err != nil {
+		jsonOut(w, 500, map[string]string{"error": "profile cleanup failed: " + err.Error()})
+		return
+	}
+	for _, id := range deleted {
+		s.runtime.ForgetClient(id)
+	}
+	jsonOut(w, 200, map[string]any{
+		"deleted":              len(deleted),
+		"eligible_before":      preview.Eligible,
+		"protected_winners":    preview.ProtectedWinners,
+		"protected_connected":  preview.ProtectedConnected,
+		"cutoff_ms":            preview.CutoffMS,
+		"inactive_for_seconds": seconds,
+	})
+}
+
 func (s *Server) adminOverview(w http.ResponseWriter, r *http.Request) {
 	var clients, activeTasks, completedTasks, guesses, artifacts int64
 	_ = s.store.DB.QueryRowContext(r.Context(), `SELECT count(*) FROM clients`).Scan(&clients)
@@ -1062,6 +1237,10 @@ func (s *Server) ws(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "identity not registered", http.StatusUnauthorized)
 		return
 	}
+	// WebSocket use counts as recent profile activity. This also makes a race
+	// with the admin cleanup safe: a newly connecting identity no longer
+	// matches an old last_seen cutoff.
+	s.store.TouchClient(r.Context(), c.ClientID)
 	t, err := s.store.TaskForClient(r.Context(), c.ClientID)
 	if err != nil {
 		http.Error(w, "no task", 503)
@@ -1080,7 +1259,13 @@ func (s *Server) ws(w http.ResponseWriter, r *http.Request) {
 	}
 	cl := wsx.NewClient(conn, t.ID, c.ClientID, false)
 	s.hub.Add(cl)
-	defer func() { s.hub.Remove(cl); s.runtime.ReleasePresence(c.ClientID, c.SessionID, leaseID) }()
+	defer func() {
+		s.hub.Remove(cl)
+		s.runtime.ReleasePresence(c.ClientID, c.SessionID, leaseID)
+		// Mark the disconnect time as last activity. A client that stayed online
+		// for days therefore starts its inactivity window only after disconnect.
+		s.store.TouchClient(context.Background(), c.ClientID)
+	}()
 
 	// A map point is durable only once per client/task. Subsequent losing guesses
 	// stay in memory; improvements are checkpointed by the guess handler.

internal/settings/settings.go

@@ -15,6 +15,8 @@ import (
 type Runtime struct {
 	GuessMinIntervalSec     int    `json:"guess_min_interval_sec"`
 	ClientSubmitIntervalSec int    `json:"client_submit_interval_sec"`
+	GuessLotteryWindowSec   int    `json:"guess_lottery_window_sec"`
+	GuessLotteryMaxAccepted int    `json:"guess_lottery_max_accepted"`
 	TaskRangeBits           int    `json:"task_range_bits"`
 	ActiveTaskCount         int    `json:"active_task_count"`
 	PresenceTTLSec          int    `json:"presence_ttl_sec"`
@@ -57,6 +59,8 @@ func Defaults() Runtime {
 	return Runtime{
 		GuessMinIntervalSec:     envInt("DEFAULT_GUESS_MIN_INTERVAL_SEC", 10),
 		ClientSubmitIntervalSec: envInt("DEFAULT_CLIENT_SUBMIT_INTERVAL_SEC", 11),
+		GuessLotteryWindowSec:   envInt("DEFAULT_GUESS_LOTTERY_WINDOW_SEC", 60),
+		GuessLotteryMaxAccepted: envInt("DEFAULT_GUESS_LOTTERY_MAX_ACCEPTED", 0),
 		TaskRangeBits:           envInt("DEFAULT_TASK_RANGE_BITS", 28),
 		ActiveTaskCount:         envInt("DEFAULT_ACTIVE_TASK_COUNT", 1),
 		PresenceTTLSec:          envInt("DEFAULT_PRESENCE_TTL_SEC", 35),
@@ -199,6 +203,12 @@ func Validate(v Runtime) error {
 	if v.ClientSubmitIntervalSec <= v.GuessMinIntervalSec || v.ClientSubmitIntervalSec > 7200 {
 		return fmt.Errorf("client_submit_interval_sec must be > guess_min_interval_sec and <= 7200")
 	}
+	if v.GuessLotteryWindowSec < 1 || v.GuessLotteryWindowSec > 3600 {
+		return fmt.Errorf("guess_lottery_window_sec must be 1..3600")
+	}
+	if v.GuessLotteryMaxAccepted < 0 || v.GuessLotteryMaxAccepted > 100000 {
+		return fmt.Errorf("guess_lottery_max_accepted must be 0..100000 (0 disables lottery)")
+	}
 	if v.TaskRangeBits < 8 || v.TaskRangeBits > 128 {
 		return fmt.Errorf("task_range_bits must be 8..128")
 	}

internal/webui/dist/app.js

@@ -43,14 +43,24 @@ async function loadProtectedImage(path,img,admin=false){
 const identityKey='neuralhunt.identity.v1';
 const b64u=b=>{const a=b instanceof Uint8Array?b:new Uint8Array(b);let s='';a.forEach(x=>s+=String.fromCharCode(x));return btoa(s).replaceAll('+','-').replaceAll('/','_').replaceAll('=','')};
 const ub64=s=>{s=s.replaceAll('-','+').replaceAll('_','/');while(s.length%4)s+='=';const x=atob(s);return Uint8Array.from(x,c=>c.charCodeAt(0))};
-async function ensureIdentity(){const raw=localStorage.getItem(identityKey);if(raw)return JSON.parse(raw);const kp=await crypto.subtle.generateKey({name:'ECDSA',namedCurve:'P-256'},true,['sign','verify']);const b={version:1,publicJwk:await crypto.subtle.exportKey('jwk',kp.publicKey),privateJwk:await crypto.subtle.exportKey('jwk',kp.privateKey)};localStorage.setItem(identityKey,JSON.stringify(b));return b}
-async function clientId(pub){const s=`${pub.kty}|${pub.crv}|${pub.x}|${pub.y}`;return b64u(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(s)))}
-async function sign(message){const b=await ensureIdentity();const k=await crypto.subtle.importKey('jwk',b.privateJwk,{name:'ECDSA',namedCurve:'P-256'},false,['sign']);return b64u(await crypto.subtle.sign({name:'ECDSA',hash:'SHA-256'},k,new TextEncoder().encode(message)))}
+function requireWebCrypto(){
+  const c=globalThis.crypto;
+  if(c?.subtle)return c.subtle;
+  const host=location.hostname;
+  const local=host==='localhost'||host==='127.0.0.1'||host==='::1'||host==='[::1]';
+  if(location.protocol!=='https:'&&!local){
+    throw new Error(`Sichere Verbindung erforderlich: Neural Hunt verwendet Browser-WebCrypto für deine lokale Identität. Öffne ${location.host} über HTTPS statt HTTP.`);
+  }
+  throw new Error('WebCrypto ist in diesem Browser nicht verfügbar. Bitte verwende einen aktuellen Browser mit aktivierter WebCrypto-Unterstützung.');
+}
+async function ensureIdentity(){const raw=localStorage.getItem(identityKey);if(raw){requireWebCrypto();return JSON.parse(raw)}const subtle=requireWebCrypto();const kp=await subtle.generateKey({name:'ECDSA',namedCurve:'P-256'},true,['sign','verify']);const b={version:1,publicJwk:await subtle.exportKey('jwk',kp.publicKey),privateJwk:await subtle.exportKey('jwk',kp.privateKey)};localStorage.setItem(identityKey,JSON.stringify(b));return b}
+async function clientId(pub){const subtle=requireWebCrypto();const s=`${pub.kty}|${pub.crv}|${pub.x}|${pub.y}`;return b64u(await subtle.digest('SHA-256',new TextEncoder().encode(s)))}
+async function sign(message){const subtle=requireWebCrypto();const b=await ensureIdentity();const k=await subtle.importKey('jwk',b.privateJwk,{name:'ECDSA',namedCurve:'P-256'},false,['sign']);return b64u(await subtle.sign({name:'ECDSA',hash:'SHA-256'},k,new TextEncoder().encode(message)))}
 async function responseError(r,fallback){try{const b=await r.json();return b?.error?`${fallback}: ${b.error}`:`${fallback} (HTTP ${r.status})`}catch{return `${fallback} (HTTP ${r.status})`}}
 async function loginIdentity(){const b=await ensureIdentity();const cr=await fetch('/api/auth/challenge',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({public_jwk:b.publicJwk})});if(!cr.ok)throw new Error(await responseError(cr,'Challenge fehlgeschlagen'));const c=await cr.json();const signature=await sign(`login|${c.challenge}|${c.client_id}`);const r=await fetch('/api/auth/login',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({public_jwk:b.publicJwk,challenge:c.challenge,signature})});if(!r.ok)throw new Error(await responseError(r,'Login fehlgeschlagen'));return r.json()}
-async function deterministicGuess(taskID,seed,cid,seq,bits){const h=new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(`${taskID}|${seed}|${cid}|${seq}`)));let n=0n;for(const x of h)n=(n<<8n)|BigInt(x);return (n%(1n<<BigInt(bits))).toString()}
-async function exportIdentity(passphrase){const b=await ensureIdentity();const salt=crypto.getRandomValues(new Uint8Array(16));const iv=crypto.getRandomValues(new Uint8Array(12));const base=await crypto.subtle.importKey('raw',new TextEncoder().encode(passphrase),'PBKDF2',false,['deriveKey']);const aes=await crypto.subtle.deriveKey({name:'PBKDF2',salt,iterations:250000,hash:'SHA-256'},base,{name:'AES-GCM',length:256},false,['encrypt']);const ct=await crypto.subtle.encrypt({name:'AES-GCM',iv},aes,new TextEncoder().encode(JSON.stringify(b)));return JSON.stringify({version:1,salt:b64u(salt),iv:b64u(iv),ciphertext:b64u(ct)},null,2)}
-async function importIdentity(raw,passphrase){const x=JSON.parse(raw);const base=await crypto.subtle.importKey('raw',new TextEncoder().encode(passphrase),'PBKDF2',false,['deriveKey']);const aes=await crypto.subtle.deriveKey({name:'PBKDF2',salt:ub64(x.salt),iterations:250000,hash:'SHA-256'},base,{name:'AES-GCM',length:256},false,['decrypt']);const pt=await crypto.subtle.decrypt({name:'AES-GCM',iv:ub64(x.iv)},aes,ub64(x.ciphertext));const b=JSON.parse(new TextDecoder().decode(pt));localStorage.setItem(identityKey,JSON.stringify(b));return b}
+async function deterministicGuess(taskID,seed,cid,seq,bits){const subtle=requireWebCrypto();const h=new Uint8Array(await subtle.digest('SHA-256',new TextEncoder().encode(`${taskID}|${seed}|${cid}|${seq}`)));let n=0n;for(const x of h)n=(n<<8n)|BigInt(x);return (n%(1n<<BigInt(bits))).toString()}
+async function exportIdentity(passphrase){const subtle=requireWebCrypto();const b=await ensureIdentity();const salt=crypto.getRandomValues(new Uint8Array(16));const iv=crypto.getRandomValues(new Uint8Array(12));const base=await subtle.importKey('raw',new TextEncoder().encode(passphrase),'PBKDF2',false,['deriveKey']);const aes=await subtle.deriveKey({name:'PBKDF2',salt,iterations:250000,hash:'SHA-256'},base,{name:'AES-GCM',length:256},false,['encrypt']);const ct=await subtle.encrypt({name:'AES-GCM',iv},aes,new TextEncoder().encode(JSON.stringify(b)));return JSON.stringify({version:1,salt:b64u(salt),iv:b64u(iv),ciphertext:b64u(ct)},null,2)}
+async function importIdentity(raw,passphrase){const subtle=requireWebCrypto();const x=JSON.parse(raw);const base=await subtle.importKey('raw',new TextEncoder().encode(passphrase),'PBKDF2',false,['deriveKey']);const aes=await subtle.deriveKey({name:'PBKDF2',salt:ub64(x.salt),iterations:250000,hash:'SHA-256'},base,{name:'AES-GCM',length:256},false,['decrypt']);const pt=await subtle.decrypt({name:'AES-GCM',iv:ub64(x.iv)},aes,ub64(x.ciphertext));const b=JSON.parse(new TextDecoder().decode(pt));localStorage.setItem(identityKey,JSON.stringify(b));return b}
 
 function hashInt(s){let h=2166136261>>>0;s=String(s||'');for(let i=0;i<s.length;i++){h^=s.charCodeAt(i);h=Math.imul(h,16777619)}return h>>>0}
 function pseudo(s,o=0){return ((Math.sin((hashInt(`${s}:${o}`)+1)*0.00000137+o*12.345)*43758.5453123)%1+1)%1}
@@ -269,7 +279,7 @@ function setActive(id,on){const el=$(id);if(el)el.classList.toggle('active',!!on
 function shortID(s,n=10){return String(s||'').slice(0,n)}
 function fmtDate(v){try{return new Date(v).toLocaleString('de-DE')}catch{return '—'}}
 function fmtScore(v){return Number(v||0).toFixed(2)}
-function actionLabel(a){return ({set_range_bits:'Zahlenraum ändern',set_intervals:'Intervalle setzen',clear_intervals:'Intervalle erben',pause:'Task pausieren',resume:'Task fortsetzen',reroll:'Ziel neu würfeln',close:'Task beenden',regenerate_artifact:'NFT-Bild neu erzeugen'})[a]||a}
+function actionLabel(a){return ({set_range_bits:'Zahlenraum ändern',set_intervals:'Intervalle setzen',clear_intervals:'Intervalle erben',pause:'Task pausieren',resume:'Task fortsetzen',reroll:'Ziel neu würfeln',close:'Task beenden',regenerate_artifact:'NFT-Neugenerierung anstoßen'})[a]||a}
 
 function proximityRows(points,selfId,limit=7){
   const rows=(Array.isArray(points)?points:[]).filter(p=>!p._group).slice().sort((a,b)=>Number(b.score||0)-Number(a.score||0)).slice(0,limit);
@@ -350,7 +360,7 @@ async function runUser(){
     if(e.code==='task_config_changed')await refreshTaskConfig(true);
     nextGuessAt=Date.now()+1500;status(e.code==='presence_required'?'Live-Verbindung wird automatisch wiederhergestellt …':'Client wird automatisch synchronisiert …')
   }
-  async function submit(){if(!task||submitting)return;if(!wsReady()){scheduleWSReconnect();nextGuessAt=Date.now()+1000;status('Live-Verbindung wird wiederhergestellt …');return}submitting=true;status('signiert Tipp …','thinking');try{const current=await api('/api/tasks/current');if(current.id!==task.id){await showLanding();return}task=current;if(task.paused){status('Task pausiert');nextGuessAt=0;return}const seq=task.next_seq,guess=await deterministicGuess(task.id,task.public_seed,cid,seq,task.range_bits),signature=await sign(`guess|${task.id}|${seq}|${guess}`),correct=await api(`/api/tasks/${task.id}/guess`,{method:'POST',body:JSON.stringify({seq,guess,signature})});nextGuessAt=Date.now()+Math.max(1,task.client_submit_interval_sec)*1000;status(correct?'Treffer — Task gelöst!':'Tipp akzeptiert',correct?'researching':'living');await Promise.all([refreshMe(),refreshLeaders()]);if(correct)setTimeout(()=>showLanding(),1300)}catch(e){if(e.status===409){await recover409(e);return}nextGuessAt=Date.now()+Math.max(2,task?.client_submit_interval_sec||11)*1000;status(e.message||'Tipp fehlgeschlagen')}finally{submitting=false}}
+  async function submit(){if(!task||submitting)return;if(!wsReady()){scheduleWSReconnect();nextGuessAt=Date.now()+1000;status('Live-Verbindung wird wiederhergestellt …');return}submitting=true;status('signiert Tipp …','thinking');try{const current=await api('/api/tasks/current');if(current.id!==task.id){await showLanding();return}task=current;if(task.paused){status('Task pausiert');nextGuessAt=0;return}const seq=task.next_seq,guess=await deterministicGuess(task.id,task.public_seed,cid,seq,task.range_bits),signature=await sign(`guess|${task.id}|${seq}|${guess}`);if(Number(task.guess_lottery_max_accepted||0)>0)status(`wartet auf Losziehung · max. ${Number(task.guess_lottery_max_accepted).toLocaleString('de-DE')} Tipps / ${Number(task.guess_lottery_window_sec||60)}s`,'thinking');const correct=await api(`/api/tasks/${task.id}/guess`,{method:'POST',body:JSON.stringify({seq,guess,signature})});nextGuessAt=Date.now()+Math.max(1,task.client_submit_interval_sec)*1000;status(correct?'Treffer — Task gelöst!':Number(task.guess_lottery_max_accepted||0)>0?'Tipp gezogen & geprüft':'Tipp akzeptiert',correct?'researching':'living');await Promise.all([refreshMe(),refreshLeaders()]);if(correct)setTimeout(()=>showLanding(),1300)}catch(e){if(e.status===409){await recover409(e);return}nextGuessAt=Date.now()+Math.max(2,task?.client_submit_interval_sec||11)*1000;if(e.code==='lottery_not_selected'){status('Tipp diesmal nicht gezogen · nächstes Los folgt','living');return}if(e.code==='lottery_full'){status('Losfenster voll · nächster Versuch folgt','living');return}status(e.message||'Tipp fehlgeschlagen')}finally{submitting=false}}
   function openWS(force=false){if(!task||$('taskLanding').classList.contains('visible'))return;clearWSReconnect();if(ws&&(ws.readyState===WebSocket.OPEN||ws.readyState===WebSocket.CONNECTING)){if(!force)return;const old=ws;old._plannedClose=true;try{old.close(1000,'reconnect')}catch{}}const proto=location.protocol==='https:'?'wss':'ws',mx=+$('maxnodes').value||task.default_max_nodes||2000,socket=new WebSocket(`${proto}://${location.host}/api/ws?token=${encodeURIComponent(getToken())}&max_nodes=${encodeURIComponent(mx)}`);ws=socket;socket.onopen=()=>{if(ws!==socket)return;wsBackoff=500;status(task?.paused?'Task pausiert':'verbunden')};socket.onmessage=async ev=>{if(ws!==socket)return;const e=JSON.parse(ev.data);if(e.type==='snapshot'){points=Array.isArray(e.data)?e.data:[];render()}else if(e.type==='point'){const p=e.data,i=points.findIndex(x=>x.client_id===p.client_id);if(i<0)points.push(p);else points[i]=p;render()}else if(e.type==='points'){for(const p of (Array.isArray(e.data)?e.data:[])){const i=points.findIndex(x=>x.client_id===p.client_id);if(i<0)points.push(p);else points[i]=p}render()}else if(e.type==='task_changed'){await refreshTaskConfig(true);await Promise.all([refreshMe(),refreshLeaders()])}else if(e.type==='task_completed'){status('Task abgeschlossen — Folge-Task ist bereit','researching');setTimeout(()=>showLanding(),1300)}};socket.onclose=e=>{if(ws===socket)ws=null;if(!socket._plannedClose&&task&&!$('taskLanding').classList.contains('visible')){status('Live-Verbindung unterbrochen · verbinde automatisch neu …');scheduleWSReconnect()}};socket.onerror=()=>{if(!socket._plannedClose&&ws===socket)status('WebSocket-Fehler · Reconnect folgt automatisch')}}
   async function enterTask(taskID){if(landingBusy)return;landingBusy=true;try{await stopTaskSession();task=await api('/api/tasks/select',{method:'POST',body:JSON.stringify({task_id:taskID})});$('taskLanding').classList.remove('visible');$('taskid').textContent=task.display_name?shortID(task.display_name,16):shortID(task.id.slice(-12),12);let max=+$('maxnodes').value||clamp(Number(task.default_max_nodes||2000),100,25000);if(document.documentElement.classList.contains('mobile-mode'))max=Math.min(max,1000);$('maxnodes').value=max;$('maxnodesvalue').textContent=max.toLocaleString('de-DE');points=await api(`/api/tasks/${task.id}/points?limit=${Math.min(10000,Math.max(300,max*3))}`);points=Array.isArray(points)?points:[];render();await Promise.all([refreshMe(),refreshLeaders()]);syncMobile();openWS();status(task.paused?'Task pausiert':`${task.range_bits} Bit · verbunden`);nextGuessAt=task.paused?0:Date.now()+Math.max(1,task.client_submit_interval_sec)*1000;scheduler=setInterval(()=>{if(task&&!task.paused&&nextGuessAt&&Date.now()>=nextGuessAt)submit()},300);countdownTimer=setInterval(countdown,250);countdown()}catch(e){status(e.message||'Task konnte nicht gestartet werden');$('taskLanding').classList.add('visible')}finally{landingBusy=false}}
   try{const id=await ensureIdentity();cid=await clientId(id.publicJwk);$('cid').textContent=cid;$('landingCid').textContent=cid;await ensureSession();syncMobile();await Promise.all([refreshLeaders()]);await showLanding()}catch(e){status(e.message||'Startfehler');$('taskCards').innerHTML=`<div class="task-card-empty glass"><b>Startfehler</b><span>${esc(e.message||'')}</span></div>`}
@@ -418,8 +428,8 @@ async function runAdmin(){
   const setAdminPanel=name=>{const grid=$('adminGrid');grid.classList.remove('mobile-show-map','mobile-show-tasks','mobile-show-control');grid.classList.add(`mobile-show-${name}`);document.querySelectorAll('[data-admin-panel]').forEach(b=>b.classList.toggle('active',b.dataset.adminPanel===name));if(name==='map')setTimeout(()=>map.resize(),30)};
   const syncAdminMobile=()=>{const on=document.documentElement.classList.contains('mobile-mode');$('adminMobileToggle').textContent=mobileButtonLabel();setActive('adminMobileToggle',on);if(on){map.eco=true;map.labels=false;map.edges=false;map.zoom=Math.min(map.zoom,.94);setActive('adminEco',true);setActive('adminEdges',false);if(+$('adminmaxnodes').value>1500){$('adminmaxnodes').value=1500;$('adminmaxvalue').textContent='1.500'}}else{map.eco=false;setActive('adminEco',false)}map.resize()};
   $('adminMobileToggle').onclick=()=>toggleMobileMode();document.querySelectorAll('[data-admin-panel]').forEach(b=>b.onclick=()=>setAdminPanel(b.dataset.adminPanel));window.addEventListener('neuralhunt-mobile-mode',syncAdminMobile);syncAdminMobile();
-  const runtimeKeys=['guess_min_interval_sec','client_submit_interval_sec','task_range_bits','active_task_count','presence_ttl_sec','default_max_nodes','public_score_precision'];
-  const labels={guess_min_interval_sec:'Server-Tippintervall (s)',client_submit_interval_sec:'Client-Tippintervall (s)',task_range_bits:'Default Zahlenraum (Bit)',active_task_count:'Parallele aktive Tasks',presence_ttl_sec:'Presence TTL (s)',default_max_nodes:'Default Max Nodes',public_score_precision:'Öffentliche Score-Präzision'};
+  const runtimeKeys=['guess_min_interval_sec','client_submit_interval_sec','guess_lottery_window_sec','guess_lottery_max_accepted','task_range_bits','active_task_count','presence_ttl_sec','default_max_nodes','public_score_precision'];
+  const labels={guess_min_interval_sec:'Server-Tippintervall (s)',client_submit_interval_sec:'Client-Tippintervall (s)',guess_lottery_window_sec:'Lotterie-Zeitfenster (s)',guess_lottery_max_accepted:'Max. gezogene Tipps je Task/Fenster (0 = aus)',task_range_bits:'Default Zahlenraum (Bit)',active_task_count:'Parallele aktive Tasks',presence_ttl_sec:'Presence TTL (s)',default_max_nodes:'Default Max Nodes',public_score_precision:'Öffentliche Score-Präzision'};
   const msg=s=>$('adminstatus').textContent=s;
   const saveDraft=()=>{try{draft.tab=tab;draft.selectedTaskId=selected?.id||draft.selectedTaskId||'';draft.filters={status:$('statusfilter')?.value||'',q:$('taskquery')?.value||''};localStorage.setItem(adminDraftKey,JSON.stringify(draft))}catch{}};
   const draftScope=()=>tab==='task'&&selected?`task:${selected.id}`:`global:${tab}`;
@@ -428,11 +438,20 @@ async function runAdmin(){
   const restoreDraft=()=>{const scope=draftScope(),values=draft.fields?.[scope]||{};document.querySelectorAll('#settingfields input,#settingfields textarea,#settingfields select').forEach(el=>{if(el.type==='file')return;const k=draftFieldKey(el);if(k&&Object.prototype.hasOwnProperty.call(values,k))el.value=values[k]})};
   const clearDraftKeys=keys=>{const scope=draftScope(),values=draft.fields?.[scope];if(values){keys.forEach(k=>delete values[k]);saveDraft()}};
   function renderOverview(o){$('overview').innerHTML=`<span><b>${o.connected}</b> verbunden</span><span><b>${o.clients}</b> Identitäten</span><span><b>${o.active_tasks}</b> aktive Tasks</span><span><b>${o.completed_tasks}</b> abgeschlossen</span><span><b>${Number(o.guesses||0).toLocaleString('de-DE')}</b> Tipps</span><span><b>${o.artifacts_ready}</b> Artefakte</span>`}
-  function renderPerformance(p){const r=p?.runtime||{},w=p?.websocket||{},x=p?.process||{};$('performance').innerHTML=`<span><b>${Number(r.guesses_per_sec||0).toFixed(1)}</b> Guess/s</span><span><b>${Number(r.improvements_per_sec||0).toFixed(1)}</b> Improve/s</span><span><b>${Number(r.sqlite_writes_per_sec||0).toFixed(1)}</b> SQLite W/s</span><span><b>${Number(w.frames_per_sec||0).toFixed(0)}</b> WS Frames/s</span><span><b>${(Number(w.bytes_per_sec||0)/1048576).toFixed(2)}</b> WS MB/s</span><span><b>${Number(w.dropped_per_sec||0).toFixed(1)}</b> Drops/s</span><span><b>${Number(x.goroutines||0).toLocaleString('de-DE')}</b> Goroutines</span><span><b>${(Number(x.heap_bytes||0)/1048576).toFixed(1)}</b> Heap MB</span>`}
+  function renderPerformance(p){const r=p?.runtime||{},w=p?.websocket||{},x=p?.process||{};$('performance').innerHTML=`<span><b>${Number(r.guesses_per_sec||0).toFixed(1)}</b> Guess/s</span><span><b>${Number(r.rejected_per_sec||0).toFixed(1)}</b> Reject/s</span><span><b>${Number(r.improvements_per_sec||0).toFixed(1)}</b> Improve/s</span><span><b>${Number(r.sqlite_writes_per_sec||0).toFixed(1)}</b> SQLite W/s</span><span><b>${Number(w.frames_per_sec||0).toFixed(0)}</b> WS Frames/s</span><span><b>${(Number(w.bytes_per_sec||0)/1048576).toFixed(2)}</b> WS MB/s</span><span><b>${Number(w.dropped_per_sec||0).toFixed(1)}</b> Drops/s</span><span><b>${Number(x.goroutines||0).toLocaleString('de-DE')}</b> Goroutines</span><span><b>${(Number(x.heap_bytes||0)/1048576).toFixed(1)}</b> Heap MB</span>`}
   async function openAdminFile(taskID,kind){const popup=window.open('','_blank');try{const token=localStorage.getItem(adminTokenKey),r=await fetch(`/api/admin/tasks/${encodeURIComponent(taskID)}/${kind}`,{headers:{Authorization:'Bearer '+token}});if(!r.ok)throw new Error(await responseError(r,'Datei konnte nicht geöffnet werden'));const blob=await r.blob(),u=URL.createObjectURL(blob);if(popup)popup.location=u;else{const a=document.createElement('a');a.href=u;a.target='_blank';a.click()}setTimeout(()=>URL.revokeObjectURL(u),60000)}catch(e){if(popup)popup.close();msg(e.message)}}
-  function renderTasks(){tasks=Array.isArray(tasks)?tasks:[];$('taskCount').textContent=tasks.length;$('tasks').innerHTML=tasks.length?tasks.map(t=>`<button data-id="${esc(t.id)}" class="${selected?.id===t.id?'selected':''}"><span><b>${esc(t.display_name||t.id.slice(-12))}</b><small>${esc(t.id.slice(-12))} · ${fmtDate(t.created_at)}</small></span><span><em class="task-state ${esc(t.status)}">${t.paused?'PAUSED':esc(t.status)}</em><small>${t.range_bits} Bit · rev ${t.revision} · ${Number(t.point_count||0).toLocaleString('de-DE')} Clients · ${Number(t.guess_count||0).toLocaleString('de-DE')} Tipps</small></span><span>${esc(t.artifact_status||'—')}<small>${t.parent_task_id?`↳ ${esc(String(t.parent_task_id).slice(-7))}`:'ROOT'}</small><small class="artifactLinks">${t.artifact_uri?`<span data-artifact-task="${esc(t.id)}">Bild</span> · <span data-manifest-task="${esc(t.id)}">Manifest</span>`:''}</small></span></button>`).join(''):'<div class="empty">Keine Tasks</div>';document.querySelectorAll('#tasks button[data-id]').forEach(b=>b.onclick=e=>{const art=e.target.closest('[data-artifact-task]'),man=e.target.closest('[data-manifest-task]');if(art){e.preventDefault();e.stopPropagation();openAdminFile(art.dataset.artifactTask,'artifact');return}if(man){e.preventDefault();e.stopPropagation();openAdminFile(man.dataset.manifestTask,'manifest');return}openTask(tasks.find(t=>t.id===b.dataset.id))})}
+  function renderTasks(){tasks=Array.isArray(tasks)?tasks:[];$('taskCount').textContent=tasks.length;$('tasks').innerHTML=tasks.length?tasks.map(t=>{const aerr=String(t.artifact_error||'').trim();return `<button data-id="${esc(t.id)}" class="${selected?.id===t.id?'selected':''}"><span><b>${esc(t.display_name||t.id.slice(-12))}</b><small>${esc(t.id.slice(-12))} · ${fmtDate(t.created_at)}</small></span><span><em class="task-state ${esc(t.status)}">${t.paused?'PAUSED':esc(t.status)}</em><small>${t.range_bits} Bit · rev ${t.revision} · ${Number(t.point_count||0).toLocaleString('de-DE')} Clients · ${Number(t.guess_count||0).toLocaleString('de-DE')} Tipps</small></span><span class="artifact-state-wrap"><b class="artifact-state ${esc(t.artifact_status||'')}">${esc(t.artifact_status||'—')}</b>${aerr?`<small class="danger artifact-error-summary" title="${esc(aerr)}">${esc(aerr.length>76?aerr.slice(0,75)+'…':aerr)}</small>`:`<small>${t.parent_task_id?`↳ ${esc(String(t.parent_task_id).slice(-7))}`:'ROOT'}</small>`}<small class="artifactLinks">${t.artifact_uri?`<span data-artifact-task="${esc(t.id)}">Bild</span> · <span data-manifest-task="${esc(t.id)}">Manifest</span>`:''}</small></span></button>`}).join(''):'<div class="empty">Keine Tasks</div>';document.querySelectorAll('#tasks button[data-id]').forEach(b=>b.onclick=e=>{const art=e.target.closest('[data-artifact-task]'),man=e.target.closest('[data-manifest-task]');if(art){e.preventDefault();e.stopPropagation();openAdminFile(art.dataset.artifactTask,'artifact');return}if(man){e.preventDefault();e.stopPropagation();openAdminFile(man.dataset.manifestTask,'manifest');return}openTask(tasks.find(t=>t.id===b.dataset.id))})}
   function renderRuntime(){
-    $('settingfields').innerHTML=`<div class="control-section"><div class="section-title">GLOBAL RUNTIME</div>${runtimeKeys.map(k=>`<label><span>${esc(labels[k])}</span><input type="number" data-setting="${k}" value="${settings?.[k]??''}"></label>`).join('')}<p class="small">Diese Defaults gelten für neue Tasks. Task-spezifische Intervalle und Zahlenräume steuerst du im Tab „Task Actions“.</p></div>`;$('savesettings').style.display='inline-block';$('ensuretasks').style.display='inline-block';
+    $('settingfields').innerHTML=`<div class="control-section"><div class="section-title">GLOBAL RUNTIME</div>${runtimeKeys.map(k=>`<label><span>${esc(labels[k])}</span><input type="number" data-setting="${k}" value="${settings?.[k]??''}"></label>`).join('')}<p class="small">Die Tipp-Lotterie gilt <b>getrennt pro aktivem Task</b>. Bei einem Wert &gt; 0 werden alle gültigen Tipps eines Zeitfensters gesammelt und am Fensterende exakt bis zur eingestellten Menge zufällig gezogen. Nicht gezogene Tipps werden nicht gegen das Ziel geprüft und verändern den Score nicht; ihre Sequenz wird trotzdem verbraucht. <b>0 = Lotterie aus</b>. Änderungen greifen für neu beginnende Fenster.</p><p class="small">Die übrigen Defaults gelten global. Task-spezifische Intervalle und Zahlenräume steuerst du im Tab „Task Actions“.</p></div>
+      <div class="control-section profile-cleanup"><div class="section-title">ALTE PROFILE BEREINIGEN</div><p class="small">Löscht ausschließlich Accounts, die <b>seit mindestens X Zeit inaktiv</b>, aktuell <b>nicht verbunden</b> und <b>niemals Gewinner</b> eines Tasks waren. Gewinner werden unabhängig vom Alter immer geschützt. Zugehörige Punkte, Unlocks und Task-Auswahl werden mit dem Profil entfernt.</p>
+        <div class="cleanup-controls"><label><span>Inaktiv seit mindestens</span><input id="profileCleanupValue" data-draft="profileCleanupValue" type="number" min="1" step="1" value="30"></label><label><span>Einheit</span><select id="profileCleanupUnit" data-draft="profileCleanupUnit"><option value="hours">Stunden</option><option value="days" selected>Tage</option><option value="weeks">Wochen</option></select></label></div>
+        <div class="cleanup-actions"><button id="previewProfileCleanup">PRÜFEN</button><button id="runProfileCleanup" class="danger-button">PROFILE LÖSCHEN</button></div><div id="profileCleanupResult" class="cleanup-result">Noch nicht geprüft.</div>
+      </div>`;$('savesettings').style.display='inline-block';$('ensuretasks').style.display='inline-block';
+    const cleanupSeconds=()=>{const v=Math.max(1,Number($('profileCleanupValue')?.value||0)),unit=$('profileCleanupUnit')?.value||'days',factor=unit==='hours'?3600:unit==='weeks'?7*86400:86400;return Math.round(v*factor)};
+    const showCleanup=p=>{const box=$('profileCleanupResult');if(!box)return;const eligible=Number(p?.eligible||0),wins=Number(p?.protected_winners||0),online=Number(p?.protected_connected||0),cutoff=p?.cutoff_ms?fmtDate(p.cutoff_ms):'—';box.innerHTML=`<b>${eligible.toLocaleString('de-DE')} löschbar</b><span>· ${wins.toLocaleString('de-DE')} alte Gewinner geschützt · ${online.toLocaleString('de-DE')} aktuell verbundene Accounts geschützt</span><small>Grenze: letzte Aktivität vor ${esc(cutoff)}</small>`;};
+    const previewCleanup=async()=>{try{captureDraft();const seconds=cleanupSeconds(),p=await api(`/api/admin/profiles/cleanup-preview?inactive_for_seconds=${seconds}`,{},true);showCleanup(p);return p}catch(e){msg(e.message);throw e}};
+    $('previewProfileCleanup').onclick=()=>previewCleanup().catch(()=>{});
+    $('runProfileCleanup').onclick=async()=>{try{const p=await previewCleanup();const n=Number(p?.eligible||0);if(!n){msg('Keine passenden inaktiven Nicht-Gewinner-Profile gefunden');return}const value=$('profileCleanupValue').value,unitLabel=$('profileCleanupUnit').selectedOptions[0]?.textContent||'';if(!confirm(`${n.toLocaleString('de-DE')} Profile endgültig löschen?\n\nKriterium: seit mindestens ${value} ${unitLabel} inaktiv, offline und niemals Gewinner.\nGewinner und aktuell verbundene Accounts bleiben geschützt.`))return;const out=await api('/api/admin/profiles/cleanup',{method:'POST',body:JSON.stringify({inactive_for_seconds:cleanupSeconds()})},true);msg(`${Number(out.deleted||0).toLocaleString('de-DE')} alte Profile gelöscht`);showCleanup({...p,eligible:Math.max(0,n-Number(out.deleted||0))});await load(true,false)}catch(e){msg(e.message)}};
   }
   function renderArtifact(){
     const ps=providers?.providers||{},preset=settings?.artifact_preset||'legacy',u=artifactUsage||{},recent=Array.isArray(u.recent)?u.recent:[];
@@ -466,7 +485,9 @@ async function runAdmin(){
   function renderTaskControl(){
     $('savesettings').style.display='none';$('ensuretasks').style.display='none';if(!selected){$('settingfields').innerHTML='<div class="empty">Links einen Task auswählen.</div>';return}
     const customStyle=!!String(selected.nft_style_reference||'').trim();
-    $('settingfields').innerHTML=`<div class="control-section task-control"><div class="section-title">TASK ${esc(selected.display_name||selected.id.slice(-12))}</div><div class="task-facts"><span><b>${selected.range_bits}</b> Bit</span><span><b>${selected.paused?'PAUSED':selected.status}</b> Status</span><span><b>${selected.revision}</b> Revision</span></div>
+    const artifactErr=String(selected.artifact_error||'').trim();
+    const artifactDiag=selected.artifact_status==='error'?`<div class="artifact-diagnostic"><div><b>NFT-GENERIERUNG FEHLGESCHLAGEN</b><span>${esc(artifactErr||'Unbekannter Artifact-Fehler')}</span></div><small>Die Meldung stammt direkt aus <code>tasks.artifact_error</code>. „NFT-Neugenerierung anstoßen · DONE“ bedeutet nur, dass die Admin-Aktion die Karte erneut in die Queue gestellt hat.</small></div>`:'';
+    $('settingfields').innerHTML=`<div class="control-section task-control"><div class="section-title">TASK ${esc(selected.display_name||selected.id.slice(-12))}</div><div class="task-facts"><span><b>${selected.range_bits}</b> Bit</span><span><b>${selected.paused?'PAUSED':selected.status}</b> Status</span><span><b>${selected.revision}</b> Revision</span></div>${artifactDiag}
       <div class="task-config-box"><div class="section-title">TASK-DARSTELLUNG & RIFT ART-DIRECTION</div>${selected.parent_task_id?`<span class="inherit-badge">↳ geerbt von ${esc(String(selected.parent_task_id).slice(-12))}</span>`:'<span class="inherit-badge">ROOT TASK</span>'}<p class="draft-note">Der Folge-Task erbt Anzeigename, Beschreibung, kreative Vorgaben, Ausschlüsse und die Style-Referenz. Entwürfe in Textfeldern bleiben bei Auto-Refresh erhalten.</p>
         <label class="wide"><span>Anzeigename</span><input id="taskDisplayName" data-draft="taskDisplayName" maxlength="80" value="${esc(selected.display_name||'')}"></label>
         <label class="wide"><span>Beschreibung für Landing-Page</span><textarea id="taskDescription" data-draft="taskDescription" rows="3" maxlength="1200">${esc(selected.description||'')}</textarea></label>
@@ -474,14 +495,14 @@ async function runAdmin(){
         <label class="wide"><span>Kreative Vorgaben für RIFT-Karten dieses Tasks · optional</span><textarea id="taskNFTPrompt" data-draft="taskNFTPrompt" rows="6" maxlength="8000" placeholder="Leer lassen = automatische Theme-/Outfit-/Szenen-Generierung. Optional z.B. Winter, elegante Streetwear, keine Waffen …">${esc(selected.nft_prompt_instructions||'')}</textarea></label>
         <label class="wide"><span>Zusätzliche Ausschlüsse · optional</span><textarea id="taskNFTNegative" data-draft="taskNFTNegative" rows="3" maxlength="4000" placeholder="Leer lassen = nur globale RIFT-Regeln. Optional z.B. kein Helm, keine Waffen, kein Schnee …">${esc(selected.nft_negative_prompt||'')}</textarea></label>
         <div class="task-config-actions"><button id="saveTaskConfig">TASK-KONFIG SPEICHERN</button></div><div class="task-config-box pipeline-test-box"><div class="section-title">LOKALER PIPELINE-TEST</div><p class="small">Erzeugt eine komplette Testkarte <b>ohne OpenAI-Aufruf</b>. Der vorhandene <code>character_anchor.png</code> dient als Mock-Artwork, die Style-Referenz dieses Tasks als Hintergrund. Kartenlayout, Traits, Dateischreiben und SVG-Ausgabe werden lokal durchgespielt. Der echte Task-/Artifact-Status bleibt unverändert.</p><div class="task-config-actions"><button id="runPipelineTest">TEST-KARTE ERZEUGEN · 0 API-TOKENS</button></div></div></div>
-      <div class="section-title">AKTIONEN / SCHEDULER</div><label><span>Aktion</span><select id="actionType" data-draft="actionType"><option value="set_range_bits">Zahlenraum ändern</option><option value="set_intervals">Intervalle ändern</option><option value="clear_intervals">Intervalle auf Defaults</option><option value="pause">Pausieren</option><option value="resume">Fortsetzen</option><option value="reroll">Ziel neu würfeln</option><option value="close">Task beenden</option><option value="regenerate_artifact">NFT-Bild neu erzeugen</option></select></label><div id="actionPayload"></div>
+      <div class="section-title">AKTIONEN / SCHEDULER</div><label><span>Aktion</span><select id="actionType" data-draft="actionType"><option value="set_range_bits">Zahlenraum ändern</option><option value="set_intervals">Intervalle ändern</option><option value="clear_intervals">Intervalle auf Defaults</option><option value="pause">Pausieren</option><option value="resume">Fortsetzen</option><option value="reroll">Ziel neu würfeln</option><option value="close">Task beenden</option><option value="regenerate_artifact">NFT-Neugenerierung anstoßen</option></select></label><div id="actionPayload"></div>
       <label class="wide"><span>Ausführen am</span><div class="schedule-row"><input id="actionAt" data-draft="actionAt" type="datetime-local"><button id="runAction">JETZT</button><button id="scheduleAction">PLANEN</button></div></label><div class="action-warning" id="actionWarning"></div>
       <div class="section-title action-history-title">AKTIONSPLAN / AUDIT</div><div class="action-list">${actions.length?actions.map(a=>`<div class="action-item ${esc(a.status)}"><span><b>${esc(actionLabel(a.action_type))}</b><small>${fmtDate(a.execute_at)} · ${esc(payloadText(a))}</small>${a.error?`<small class="danger">${esc(a.error)}</small>`:''}</span><em>${esc(a.status)}</em>${a.status==='pending'?`<button data-cancel-action="${esc(a.id)}">×</button>`:''}</div>`).join(''):'<div class="empty small">Noch keine geplanten Aktionen</div>'}</div></div>`;
     const styleImg=$('taskStylePreview');loadProtectedImage(`/api/admin/tasks/${selected.id}/style-reference?ts=${Date.now()}`,styleImg,true).catch(()=>{if(styleImg)styleImg.alt='Style-Referenz konnte nicht geladen werden'});
     const uploadStyle=$('uploadTaskStyle');if(uploadStyle)uploadStyle.onclick=async()=>{const file=$('taskStyleFile')?.files?.[0];if(!file){msg('Bitte zuerst ein JPEG- oder PNG-Stylebild auswählen');return}const fd=new FormData();fd.append('file',file,file.name);uploadStyle.disabled=true;uploadStyle.textContent='STYLE WIRD HOCHGELADEN …';try{await api(`/api/admin/tasks/${selected.id}/style-reference`,{method:'PUT',body:fd},true);msg('Task-Style gespeichert · Folge-Task übernimmt ihn');await load(true,true)}catch(e){msg(e.message);uploadStyle.disabled=false;uploadStyle.textContent='STYLE HOCHLADEN / ERSETZEN'}};
     const clearStyle=$('clearTaskStyle');if(clearStyle)clearStyle.onclick=async()=>{if(!confirm('Eigenen Task-Style entfernen und wieder den eingebetteten Default-Style verwenden?'))return;try{await api(`/api/admin/tasks/${selected.id}/style-reference`,{method:'DELETE'},true);msg('Task-Style auf Default zurückgesetzt');await load(true,true)}catch(e){msg(e.message)}};
     const pipelineTest=$('runPipelineTest');if(pipelineTest)pipelineTest.onclick=async()=>{pipelineTest.disabled=true;pipelineTest.textContent='TEST-KARTE WIRD LOKAL ERZEUGT …';try{const r=await api(`/api/admin/tasks/${selected.id}/pipeline-test`,{method:'POST'},true);const popup=window.open('','_blank');const token=localStorage.getItem(adminTokenKey),resp=await fetch(r.url,{headers:{Authorization:'Bearer '+token}});if(!resp.ok)throw new Error(await responseError(resp,'Testkarte konnte nicht geöffnet werden'));const blob=await resp.blob(),u=URL.createObjectURL(blob);if(popup)popup.location=u;else{const a=document.createElement('a');a.href=u;a.target='_blank';a.click()}setTimeout(()=>URL.revokeObjectURL(u),60000);msg('Lokale Testkarte erzeugt · 0 API-Calls · $0.00')}catch(e){msg(e.message)}finally{pipelineTest.disabled=false;pipelineTest.textContent='TEST-KARTE ERZEUGEN · 0 API-TOKENS'}};
-    const renderPayload=()=>{const type=$('actionType').value,host=$('actionPayload');if(type==='set_range_bits')host.innerHTML=`<label><span>Task-Zahlenraum (Bit)</span><input id="actionBits" data-draft="actionBits" type="number" min="8" max="128" value="${selected.range_bits}"></label><label><span>Änderungsmodus</span><select id="actionMode" data-draft="actionMode"><option value="preserve">preserve · bestehendes Ziel</option><option value="reroll">reroll · neues Ziel</option></select></label><p class="small">Preserve erhält Seed/Sequenzen und re-skaliert Scores mathematisch. Reroll setzt Scores/Sequenzen zurück.</p>`;else if(type==='set_intervals')host.innerHTML=`<label><span>Server Minimum (s)</span><input id="actionServer" data-draft="actionServer" type="number" min="1" max="3600" value="${selected.guess_min_interval_sec??settings.guess_min_interval_sec}"></label><label><span>Client Submit (s)</span><input id="actionClient" data-draft="actionClient" type="number" min="2" max="7200" value="${selected.client_submit_interval_sec??settings.client_submit_interval_sec}"></label>`;else host.innerHTML=`<p class="small">${type==='reroll'?'Achtung: neues Ziel und neuer öffentlicher Seed; aktuelle Scores werden auf 0 gesetzt.':type==='close'?'Beendet den Task. Der automatisch erzeugte Folge-Task erbt Zahlenraum, Intervalle, Darstellung, RIFT-Prompt und Style-Referenz.':type==='regenerate_artifact'?'Nur für abgeschlossene Tasks: setzt das Artifact wieder auf queued.':'Keine weiteren Parameter.'}</p>`};
+    const renderPayload=()=>{const type=$('actionType').value,host=$('actionPayload');if(type==='set_range_bits')host.innerHTML=`<label><span>Task-Zahlenraum (Bit)</span><input id="actionBits" data-draft="actionBits" type="number" min="8" max="128" value="${selected.range_bits}"></label><label><span>Änderungsmodus</span><select id="actionMode" data-draft="actionMode"><option value="preserve">preserve · bestehendes Ziel</option><option value="reroll">reroll · neues Ziel</option></select></label><p class="small">Preserve erhält Seed/Sequenzen und re-skaliert Scores mathematisch. Reroll setzt Scores/Sequenzen zurück.</p>`;else if(type==='set_intervals')host.innerHTML=`<label><span>Server Minimum (s)</span><input id="actionServer" data-draft="actionServer" type="number" min="1" max="3600" value="${selected.guess_min_interval_sec??settings.guess_min_interval_sec}"></label><label><span>Client Submit (s)</span><input id="actionClient" data-draft="actionClient" type="number" min="2" max="7200" value="${selected.client_submit_interval_sec??settings.client_submit_interval_sec}"></label>`;else host.innerHTML=`<p class="small">${type==='reroll'?'Achtung: neues Ziel und neuer öffentlicher Seed; aktuelle Scores werden auf 0 gesetzt.':type==='close'?'Beendet den Task. Der automatisch erzeugte Folge-Task erbt Zahlenraum, Intervalle, Darstellung, RIFT-Prompt und Style-Referenz.':type==='regenerate_artifact'?'Nur für abgeschlossene Tasks: setzt das Artifact wieder auf pending. DONE im Audit bestätigt nur das Einreihen; der Artifact-Status zeigt danach generating, ready oder error.':'Keine weiteren Parameter.'}</p>`};
     const defaultAt=new Date(Date.now()+5*60*1000);defaultAt.setMinutes(defaultAt.getMinutes()-defaultAt.getTimezoneOffset());$('actionAt').value=defaultAt.toISOString().slice(0,16);restoreDraft();renderPayload();restoreDraft();$('actionType').onchange=()=>{renderPayload();restoreDraft();captureDraft()};
     $('saveTaskConfig').onclick=async()=>{try{captureDraft();await api(`/api/admin/tasks/${selected.id}/config`,{method:'PUT',body:JSON.stringify({display_name:$('taskDisplayName').value,description:$('taskDescription').value,nft_prompt_instructions:$('taskNFTPrompt').value,nft_negative_prompt:$('taskNFTNegative').value})},true);clearDraftKeys(['taskDisplayName','taskDescription','taskNFTPrompt','taskNFTNegative']);msg('Task-Konfiguration gespeichert · Folge-Task übernimmt sie');await load(true,true)}catch(e){msg(e.message)}};
     const submitAction=async runNow=>{try{captureDraft();const type=$('actionType').value,payload={};if(type==='set_range_bits'){payload.bits=Number($('actionBits').value);payload.mode=$('actionMode').value}else if(type==='set_intervals'){payload.server_min_interval_sec=Number($('actionServer').value);payload.client_submit_interval_sec=Number($('actionClient').value)}const execute_at=runNow?null:new Date($('actionAt').value).toISOString();await api(`/api/admin/tasks/${selected.id}/actions`,{method:'POST',body:JSON.stringify({action_type:type,payload,execute_at})},true);msg(runNow?'Aktion ausgeführt':'Aktion geplant');await load(true,true)}catch(e){msg(e.message)}};

internal/webui/dist/styles.css

@@ -98,3 +98,9 @@ html.mobile-mode .task-landing-inner{width:calc(100% - 16px);padding:82px 0 22px
 html.mobile-mode .cost-grid{grid-template-columns:1fr}.mobile-mode .cost-card{padding:8px}.mobile-mode .usage-table-wrap{max-width:100%}
 .reference-admin-box,.task-style-admin{display:grid;grid-template-columns:minmax(0,1fr) 128px;gap:10px;align-items:stretch;border:1px solid rgba(82,231,255,.13);border-radius:12px;padding:10px;margin:10px 0;background:rgba(82,231,255,.025)}.reference-preview{min-height:128px;border:1px dashed rgba(133,200,255,.18);border-radius:10px;display:grid;place-items:center;overflow:hidden;background:rgba(2,8,17,.72);color:#607f92;font-size:7px;letter-spacing:.12em}.reference-preview.has-image{border-style:solid}.reference-preview img{width:100%;height:100%;min-height:128px;display:block;object-fit:cover}.ready-copy{color:#8edbb8}.anchor-actions{margin:0 0 12px}.task-style-admin{grid-template-columns:128px minmax(0,1fr);margin:10px 0 12px}.task-style-controls{min-width:0}.task-style-controls .section-title{margin-top:0}.task-style-controls input[type=file]{width:100%;font-size:7px;color:#7898aa;border:1px solid rgba(133,200,255,.12);border-radius:8px;padding:6px;background:rgba(2,8,17,.55)}.style-actions{justify-content:flex-start;flex-wrap:wrap}.danger-button{color:#ff9bad!important;border-color:rgba(255,95,136,.22)!important;background:rgba(255,95,136,.04)!important}.control-section button:disabled{opacity:.45;cursor:not-allowed}
 html.mobile-mode .reference-admin-box,html.mobile-mode .task-style-admin{grid-template-columns:1fr}.mobile-mode .reference-preview{min-height:160px}.mobile-mode .reference-preview img{min-height:160px;max-height:240px}
+
+/* Admin-only cleanup for stale non-winner identities. */
+.profile-cleanup{margin-top:12px;border-top:1px solid rgba(133,200,255,.12);padding-top:14px}.cleanup-controls{display:grid;grid-template-columns:minmax(0,1fr) minmax(110px,.7fr);gap:8px;margin:9px 0}.cleanup-actions{display:flex;gap:7px;flex-wrap:wrap}.cleanup-result{margin-top:9px;border:1px solid rgba(133,200,255,.11);background:rgba(2,8,17,.55);border-radius:9px;padding:9px;color:#88a6b8;font-size:8px;line-height:1.5}.cleanup-result b{color:#dffaff;font-size:11px}.cleanup-result span{margin-left:5px}.cleanup-result small{display:block;color:#64879a;margin-top:3px}.profile-cleanup .danger-button{margin-left:auto}@media(max-width:520px){.cleanup-controls{grid-template-columns:1fr}.profile-cleanup .danger-button{margin-left:0}.cleanup-actions button{flex:1}}
+
+/* Artifact worker diagnostics (v3.6). */
+.artifact-state-wrap{gap:2px}.artifact-state{font-size:8px;text-transform:uppercase;letter-spacing:.06em}.artifact-state.ready{color:var(--green)}.artifact-state.generating,.artifact-state.pending{color:var(--amber)}.artifact-state.error{color:#ff9bad}.artifact-error-summary{display:block;max-width:100%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.artifact-diagnostic{margin:10px 0 12px;border:1px solid rgba(255,95,136,.32);background:rgba(255,95,136,.055);border-radius:11px;padding:10px;display:grid;gap:7px}.artifact-diagnostic>div{display:grid;gap:5px}.artifact-diagnostic b{color:#ff9bad;font-size:9px;letter-spacing:.08em}.artifact-diagnostic span{color:#ffd3dc;font-size:8px;line-height:1.55;overflow-wrap:anywhere}.artifact-diagnostic small{color:#9c7580;font-size:7px;line-height:1.5}