test: cover Telegram landing promise smoke

When creating a session with an image, send it as a single SendPhoto
with the schedule text as caption (+ reply markup), instead of two
separate messages. Falls back to two messages if caption exceeds
Telegram's 1024-char limit.

Also adds BatchMessageEditor helper that transparently handles
EditMessageText vs EditMessageCaption depending on whether the batch
message is a text or photo message. Updated all handlers and web
service to use this helper.

Version bump to 1.9.7.

.gitea/workflows/deploy.yml

@@ -6,7 +6,7 @@ on:
       - main 
 
 env:
-  VERSION: 1.9.2
+  VERSION: 1.9.9
 
 jobs:
   # ЧАСТЬ 1: Собираем образы и кладем в Gitea (чтобы делиться с ребятами)

Directory.Build.props

@@ -1,6 +1,6 @@
 <Project>
   <PropertyGroup>
-    <Version>1.9.2</Version>
+    <Version>1.9.9</Version>
     <TargetFramework>net10.0</TargetFramework>
     <LangVersion>preview</LangVersion>
     <Nullable>enable</Nullable>

README.md

@@ -4,7 +4,7 @@
 
 Проект разработан с упором на производительность, архитектуру Vertical Slice, Native AOT (для бота) и удобство развертывания с использованием .NET Aspire.
 
-**Текущая версия:** `v1.9.2`.
+**Текущая версия:** `v1.9.9`.
 
 ---
 
@@ -12,11 +12,12 @@
 
 ### 🤖 Telegram Бот
 - **📅 Создание расписаний (Batch Sessions)**: Создавайте сразу несколько игр одним сообщением (на неделю или месяц вперед).
+- **🖼 Обложки расписаний**: К batch-посту можно прикрепить фото к `/newsession` или указать строку `Картинка: https://...`; бот отправит обложку перед сообщением записи.
 - **⚡ Быстрые повторы расписания**: Для регулярной кампании можно указать одну дату, количество игр и интервал, а бот сам развернёт повторяющийся batch.
 - **✋ Интерактивная запись и выход**: Игроки записываются на конкретные даты и самостоятельно снимают запись нажатием одной кнопки.
 - **👥 Лимит мест и лист ожидания**: ГМ задаёт максимальный состав, бот не переполняет сессию, автоматически ведёт очередь ожидания и освобождённое место отдаёт первому ожидающему.
 - **📁 Поддержка Форумов (Telegram Topics)**: Бот автоматически создает тему во вложенных чатах Telegram под каждую новую пачку игр.
-- **❌ Управление сессиями**: Owner и назначенные co-GM могут создавать, отменять, удалять и переносить игры прямо из Telegram.
+- **❌ Управление сессиями**: Owner и назначенные co-GM могут создавать, отменять, удалять и переносить игры из Telegram через `/listsessions`; публичный пост записи показывает только кнопки игроков.
 - **🔄 Голосование за перенос**: При переносе сессии GM предлагает 2-3 новых времени и дедлайн, игроки голосуют кнопками, а бот показывает текущие результаты и применяет победивший вариант.
 - **🔔 Персональные уведомления**: Игроки получают DM о RSVP за 24 часа, напоминание за 1 час, ссылку перед игрой, отмены и переносы; групповые уведомления при этом остаются.
 - **🗓 Экспорт в Календарь**: Генерация файла `.ics` для добавления всех игр в Google, Apple или Яндекс Календарь одной командой.
@@ -24,7 +25,7 @@
 
 ### 🌐 Web Dashboard (Blazor Server)
 - **🔐 Авторизация через Telegram**: Безопасный вход с использованием Telegram Login Widget (HMAC-SHA256 валидация).
-- **📱 Telegram Mini App Dashboard**: Мобильная версия dashboard открывается прямо из Telegram, проверяет WebApp `initData` на сервере и использует те же права owner/co-GM, что и обычный Web Dashboard. Mini App ждёт данные Telegram при старте и автоматически обновляет состояние входа после внешнего Telegram Login, включая возврат на страницу `/login`.
+- **📱 Telegram Mini App Dashboard**: Мобильная версия dashboard открывается прямо из Telegram, проверяет WebApp `initData` на сервере и использует те же права owner/co-GM, что и обычный Web Dashboard. Если Mini App попадает в fallback-вход, Telegram Login Widget авторизует пользователя callback-запросом внутри текущего WebView, а интерфейс учитывает safe-area телефона и верхнюю панель Telegram.
 - **📝 Удобное редактирование**: Веб-интерфейс для детального редактирования сессий, изменения дат, названий и статусов.
 - **🤝 Co-GM и делегирование**: Owner группы назначает помощников по Telegram ID, а co-GM получает доступ к управлению расписанием в Telegram и Web Dashboard.
 - **📋 Шаблоны кампаний**: Owner и co-GM управляют типовыми параметрами кампаний в отдельной вкладке `Шаблоны`, а на странице группы запускают новый повторяющийся batch из выбранного шаблона.
@@ -88,7 +89,7 @@ GMRELAY_WEB_PORT=8080
 
 *(Опционально)* Настройте домен Telegram бота в @BotFather командой `/setdomain` для работы виджета авторизации на вашем сайте.
 
-Для Telegram Mini App настройте в @BotFather домен Web Dashboard и menu button на URL из `TELEGRAM_MINI_APP_URL`. Бот также показывает кнопку `Открыть dashboard` в ответе на `/start`, если переменная задана.
+Для Telegram Mini App настройте в @BotFather домен Web Dashboard и menu button на URL из `TELEGRAM_MINI_APP_URL`. Бот также показывает кнопку `Открыть dashboard` в ответе на `/start`, если переменная задана. Начиная с v1.9.3 дополнительных действий в BotFather для фикса входа не требуется: URL остаётся тем же HTTPS-адресом `/miniapp`, а fallback-вход выполняется внутри активного Telegram WebView.
 
 ### 3. Запуск
 Выполните команду:
@@ -130,10 +131,13 @@ docker compose up -d
 Время: 22.05.2024 19:00
 Мест: 4
 Ссылка: https://discord.gg/invite-link
+Картинка: https://example.com/adventure-cover.jpg
 ```
 
 Строка `Мест:` необязательна. Если она указана, игроки сверх лимита попадут в лист ожидания, а ГМ сможет повысить первого ожидающего через кнопку в Telegram или Web Dashboard.
 
+Строка `Картинка:` тоже необязательна. Вместо ссылки можно прикрепить фото к сообщению `/newsession` и поместить команду в подпись к фото; бот возьмёт прикреплённое изображение и отправит его перед расписанием.
+
 Для регулярной кампании можно не перечислять все даты вручную. Укажите одну строку `Время:`, количество игр и интервал в днях:
 
 ```text
@@ -154,7 +158,7 @@ docker compose up -d
 На странице группы Web Dashboard показывает owner и список co-GM. Owner может добавить помощника по Telegram ID, имени и username, а также снять роль co-GM. Назначенный co-GM видит группу в панели управления и может редактировать сессии, управлять batch-операциями, очередью, переносами и удалением игр, но не может назначать других co-GM.
 
 ### Перенос сессии голосованием
-Owner или co-GM нажимает кнопку `⏰ Перенести` у нужной сессии и отправляет в чат 2-3 варианта нового времени вместе с дедлайном:
+Owner или co-GM вызывает `/listsessions`, нажимает кнопку `⏰` у нужной сессии и отправляет в чат 2-3 варианта нового времени вместе с дедлайном:
 
 ```text
 25.04.2026 19:30
@@ -179,13 +183,15 @@ Owner или co-GM нажимает кнопку `⏰ Перенести` у н
 Если включён режим `В группе и в личку`, бот дополнительно отправляет игрокам персональные сообщения о RSVP за 24 часа, напоминание за 1 час, ссылку перед стартом, отмену и перенос. Если Telegram не позволяет написать игроку в ЛС, бот логирует ошибку и продолжает отправку остальным участникам.
 
 ### Telegram Mini App Dashboard
-Owner и co-GM могут открыть мобильный dashboard прямо из Telegram через кнопку меню бота или кнопку `Открыть dashboard` после `/start`. Страница `/miniapp` получает `Telegram.WebApp.initData`, отправляет его на серверный endpoint `/auth/telegram-webapp`, проходит HMAC-проверку токеном бота и выдаёт обычную cookie-сессию dashboard.
+Owner и co-GM могут открыть мобильный dashboard прямо из Telegram: через кнопку меню бота или кнопку `Открыть dashboard` после `/start`. Дополнительный пароль вводить не нужно: GM-Relay сам проверит вход через Telegram.
 
-После входа Mini App использует те же страницы, что и Web Dashboard: список групп, карточки сессий, редактирование игры, повышение игрока из листа ожидания, применение шаблонов и bulk-операции batch. Доступ к чужим группам не появляется: все данные по-прежнему фильтруются через `AuthorizedSessionService` по роли owner/co-GM.
+Внутри открывается та же панель управления, только удобная для телефона. Можно смотреть свои группы, редактировать игры, управлять листом ожидания, запускать шаблоны и выполнять массовые действия с пачками игр. Чужие группы не появятся: dashboard показывает только те группы, где вы owner или co-GM.
+
+Если автоматический вход не сработал, Mini App покажет понятное сообщение и кнопку входа через Telegram. Нажмите её, подтвердите вход, и dashboard откроется в том же окне Telegram.
 
 ### Другие команды
-- `/listsessions` — Показать список всех актуальных игр в этой группе.
-- `⏰ Перенести` в сообщении расписания — Запустить голосование по 2-3 вариантам нового времени.
+- `/listsessions` — Показать список всех актуальных игр в этой группе. Для owner/co-GM команда также показывает кнопки отмены, переноса, повышения из листа ожидания и удаления.
+- `⏰` в панели `/listsessions` — Запустить голосование по 2-3 вариантам нового времени.
 - `/deletesession` — Удалить сессию.
 - `/exportcalendar` — Получить `.ics` файл с играми.
 - `/help` — Справка по формату.
@@ -206,5 +212,17 @@ Owner и co-GM могут открыть мобильный dashboard прямо
 
 ---
 
+## 🧪 Тестирование
+
+Основной набор проверок запускается командой:
+
+```bash
+dotnet test tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj --collect:"XPlat Code Coverage"
+```
+
+Начиная с `v1.9.9`, тестовый набор включает функциональный smoke-сценарий обещаний лендинга для Telegram: batch-сессии на несколько дат, inline-кнопки записи/выхода, лимиты мест, waitlist, автоповышение игрока, голосование за перенос, direct-notification mode и перерисовку Telegram batch-поста после dashboard-изменений. Smoke работает через fake Telegram messenger и не требует внешнего Telegram API.
+
+---
+
 ## 📜 Лицензия
 Проект распространяется под лицензией MIT. Использование в некоммерческих целях приветствуется.

compose.yaml

@@ -17,7 +17,7 @@ services:
       retries: 10
 
   bot:
-    image: git.codeanddice.ru/toutsu/gmrelay-bot:1.9.2
+    image: git.codeanddice.ru/toutsu/gmrelay-bot:1.9.9
     restart: always
     depends_on:
       db:
@@ -30,7 +30,7 @@ services:
       - gmrelay
 
   web:
-    image: git.codeanddice.ru/toutsu/gmrelay-web:1.9.2
+    image: git.codeanddice.ru/toutsu/gmrelay-web:1.9.9
     restart: always
     depends_on:
       db:

docs/plans/2026-05-04-player-list-kick-waitlist.md

@@ -0,0 +1,438 @@
+# Player List + Kick + Waitlist Promotion Implementation Plan
+
+> **For Hermes:** Use subagent-driven-development skill to implement this plan task-by-task.
+
+**Goal:** Add a player list (with names) to the Web UI session views, allow GM to kick a specific player, and auto-promote the next waitlisted player.
+
+**Architecture:** Extend `ISessionStore` with participant queries and a remove method. Update `GroupDetails.razor` to show expandable participant lists. Reuse existing `PromoteWaitlistedPlayerAsync` logic after removal.
+
+**Tech Stack:** C# 14, Blazor SSR, Dapper, PostgreSQL
+
+---
+
+## Task 1: Add domain model for WebParticipant
+
+**Objective:** Create a DTO to represent a session participant in the web layer.
+
+**Files:**
+- Modify: `src/GmRelay.Web/Services/SessionService.cs`
+
+**Step 1: Add record**
+
+```csharp
+public sealed record WebParticipant(
+    Guid Id,
+    long TelegramId,
+    string DisplayName,
+    string? TelegramUsername,
+    string RsvpStatus,
+    string RegistrationStatus,
+    bool IsGm,
+    DateTime? RespondedAt);
+```
+
+**Step 2: Commit**
+
+```bash
+git add src/GmRelay.Web/Services/SessionService.cs
+git commit -m "feat: add WebParticipant record"
+```
+
+---
+
+## Task 2: Add GetSessionParticipantsAsync to ISessionStore
+
+**Objective:** Retrieve all participants for a session with full player info.
+
+**Files:**
+- Modify: `src/GmRelay.Web/Services/ISessionStore.cs`
+- Modify: `src/GmRelay.Web/Services/SessionService.cs`
+- Modify: `src/GmRelay.Web/Services/AuthorizedSessionService.cs`
+
+**Step 1: Add to interface**
+
+In `ISessionStore.cs`, add:
+```csharp
+Task<List<WebParticipant>> GetSessionParticipantsAsync(Guid sessionId);
+```
+
+**Step 2: Implement in SessionService**
+
+In `SessionService.cs`, add:
+```csharp
+public async Task<List<WebParticipant>> GetSessionParticipantsAsync(Guid sessionId)
+{
+    await using var conn = await dataSource.OpenConnectionAsync();
+    return (await conn.QueryAsync<WebParticipant>(
+        """
+        SELECT sp.id AS Id,
+               p.telegram_id AS TelegramId,
+               p.display_name AS DisplayName,
+               p.telegram_username AS TelegramUsername,
+               sp.rsvp_status AS RsvpStatus,
+               sp.registration_status AS RegistrationStatus,
+               sp.is_gm AS IsGm,
+               sp.responded_at AS RespondedAt
+        FROM session_participants sp
+        JOIN players p ON p.id = sp.player_id
+        WHERE sp.session_id = @SessionId
+        ORDER BY sp.is_gm DESC,
+                 CASE sp.registration_status WHEN 'Active' THEN 0 ELSE 1 END,
+                 sp.created_at
+        """,
+        new { SessionId = sessionId })).ToList();
+}
+```
+
+**Step 3: Add authorized wrapper**
+
+In `AuthorizedSessionService.cs`, add:
+```csharp
+public async Task<List<WebParticipant>?> GetSessionParticipantsForGmAsync(Guid sessionId, long gmId)
+{
+    var session = await GetSessionForGmAsync(sessionId, gmId);
+    if (session is null)
+    {
+        return null;
+    }
+
+    return await sessionStore.GetSessionParticipantsAsync(sessionId);
+}
+```
+
+**Step 4: Commit**
+
+```bash
+git add src/GmRelay.Web/Services/ISessionStore.cs
+
+git add src/GmRelay.Web/Services/SessionService.cs
+
+git add src/GmRelay.Web/Services/AuthorizedSessionService.cs
+
+git commit -m "feat: add GetSessionParticipantsAsync"
+```
+
+---
+
+## Task 3: Add RemovePlayerFromSessionAsync with waitlist promotion
+
+**Objective:** Allow GM to remove a specific player; auto-promote next waitlisted player if conditions met.
+
+**Files:**
+- Modify: `src/GmRelay.Web/Services/ISessionStore.cs`
+- Modify: `src/GmRelay.Web/Services/SessionService.cs`
+- Modify: `src/GmRelay.Web/Services/AuthorizedSessionService.cs`
+
+**Step 1: Add to interface**
+
+In `ISessionStore.cs`, add:
+```csharp
+Task RemovePlayerFromSessionAsync(Guid sessionId, Guid groupId, Guid participantId);
+```
+
+**Step 2: Implement in SessionService**
+
+In `SessionService.cs`, add:
+```csharp
+public async Task RemovePlayerFromSessionAsync(Guid sessionId, Guid groupId, Guid participantId)
+{
+    await using var conn = await dataSource.OpenConnectionAsync();
+    await using var transaction = await conn.BeginTransactionAsync();
+
+    var session = await conn.QuerySingleOrDefaultAsync<WebSession>(
+        @"SELECT s.id, s.group_id AS GroupId, s.title, s.scheduled_at AS ScheduledAt, s.status, s.join_link AS JoinLink,
+                 s.batch_id AS BatchId, s.batch_message_id AS BatchMessageId,
+                 g.telegram_chat_id AS TelegramChatId,
+                 s.max_players AS MaxPlayers,
+                 0 AS ActivePlayerCount,
+                 0 AS WaitlistedPlayerCount,
+                 s.notification_mode AS NotificationMode
+          FROM sessions s
+          JOIN game_groups g ON g.id = s.group_id
+          WHERE s.id = @SessionId AND s.group_id = @GroupId
+          FOR UPDATE",
+        new { SessionId = sessionId, GroupId = groupId },
+        transaction);
+
+    if (session is null)
+    {
+        throw new SessionAccessDeniedException(sessionId, 0);
+    }
+
+    // Verify participant exists in this session
+    var participant = await conn.QuerySingleOrDefaultAsync<WebParticipant>(
+        """
+        SELECT sp.id AS Id,
+               p.telegram_id AS TelegramId,
+               p.display_name AS DisplayName,
+               p.telegram_username AS TelegramUsername,
+               sp.rsvp_status AS RsvpStatus,
+               sp.registration_status AS RegistrationStatus,
+               sp.is_gm AS IsGm,
+               sp.responded_at AS RespondedAt
+        FROM session_participants sp
+        JOIN players p ON p.id = sp.player_id
+        WHERE sp.id = @ParticipantId AND sp.session_id = @SessionId
+        """,
+        new { ParticipantId = participantId, SessionId = sessionId },
+        transaction);
+
+    if (participant is null)
+    {
+        throw new InvalidOperationException("Участник не найден в этой сессии.");
+    }
+
+    bool wasActive = participant.RegistrationStatus == ParticipantRegistrationStatus.Active;
+
+    await conn.ExecuteAsync(
+        "DELETE FROM session_participants WHERE id = @ParticipantId",
+        new { ParticipantId = participantId },
+        transaction);
+
+    WebPromotedParticipantDto? promoted = null;
+
+    if (wasActive)
+    {
+        promoted = await conn.QuerySingleOrDefaultAsync<WebPromotedParticipantDto>(
+            """
+            SELECT sp.id AS ParticipantRowId,
+                   p.display_name AS DisplayName
+            FROM session_participants sp
+            JOIN players p ON p.id = sp.player_id
+            WHERE sp.session_id = @SessionId
+              AND sp.is_gm = false
+              AND sp.registration_status = @Waitlisted
+            ORDER BY sp.created_at ASC, sp.id ASC
+            LIMIT 1
+            FOR UPDATE OF sp
+            """,
+            new { SessionId = sessionId, Waitlisted = ParticipantRegistrationStatus.Waitlisted },
+            transaction);
+
+        if (promoted is not null)
+        {
+            await conn.ExecuteAsync(
+                """
+                UPDATE session_participants
+                SET registration_status = @Active,
+                    rsvp_status = @Pending,
+                    responded_at = NULL
+                WHERE id = @ParticipantRowId
+                """,
+                new
+                {
+                    promoted.ParticipantRowId,
+                    Active = ParticipantRegistrationStatus.Active,
+                    Pending = RsvpStatus.Pending
+                },
+                transaction);
+        }
+    }
+
+    await transaction.CommitAsync();
+
+    // Notifications
+    await bot.SendMessage(
+        session.TelegramChatId,
+        $"🚪 <b>{System.Net.WebUtility.HtmlEncode(participant.DisplayName)}</b> удален(а) из сессии «{System.Net.WebUtility.HtmlEncode(session.Title)}».",
+        parseMode: Telegram.Bot.Types.Enums.ParseMode.Html);
+
+    if (promoted is not null)
+    {
+        await bot.SendMessage(
+            session.TelegramChatId,
+            $"⬆️ <b>{System.Net.WebUtility.HtmlEncode(promoted.DisplayName)}</b> переведен(а) из листа ожидания в основной состав «{System.Net.WebUtility.HtmlEncode(session.Title)}».",
+            parseMode: Telegram.Bot.Types.Enums.ParseMode.Html);
+    }
+
+    if (session.BatchMessageId.HasValue)
+    {
+        await TryUpdateBatchMessageAsync(session.BatchId, session.TelegramChatId, session.BatchMessageId.Value, session.Title);
+    }
+}
+```
+
+**Step 3: Add authorized wrapper**
+
+In `AuthorizedSessionService.cs`, add:
+```csharp
+public async Task RemovePlayerFromSessionForGmAsync(Guid sessionId, long gmId, Guid participantId)
+{
+    var session = await GetSessionForGmAsync(sessionId, gmId);
+    if (session is null)
+    {
+        throw new SessionAccessDeniedException(sessionId, gmId);
+    }
+
+    await sessionStore.RemovePlayerFromSessionAsync(sessionId, session.GroupId, participantId);
+}
+```
+
+**Step 4: Commit**
+
+```bash
+git add src/GmRelay.Web/Services/ISessionStore.cs
+
+git add src/GmRelay.Web/Services/SessionService.cs
+
+git add src/GmRelay.Web/Services/AuthorizedSessionService.cs
+
+git commit -m "feat: add RemovePlayerFromSessionAsync with waitlist promotion"
+```
+
+---
+
+## Task 4: Modify GroupDetails.razor to show participant list
+
+**Objective:** Add expandable player lists to each session row with kick buttons.
+
+**Files:**
+- Modify: `src/GmRelay.Web/Components/Pages/GroupDetails.razor`
+
+**Step 1:** Add `participants` dictionary and `kickingParticipantId` state variables.
+
+**Step 2:** Add `LoadParticipants(Guid sessionId)` and `KickParticipant(Guid sessionId, Guid participantId)` methods.
+
+**Step 3:** In desktop table, add a new column or expand row with participant list.
+
+**Step 4:** In mobile cards, add expandable participant section.
+
+**Step 5:** Add styles to `app.css` if needed (badge styles are already present).
+
+**Step 6:** Commit
+
+```bash
+git add src/GmRelay.Web/Components/Pages/GroupDetails.razor
+
+git add src/GmRelay.Web/wwwroot/app.css
+
+git commit -m "feat: show player list and kick button in GroupDetails"
+```
+
+---
+
+## Task 5: Modify EditSession.razor to show participant list
+
+**Objective:** Show participant list on the edit page with kick capability.
+
+**Files:**
+- Modify: `src/GmRelay.Web/Components/Pages/EditSession.razor`
+
+**Step 1:** Load participants in `OnInitializedAsync`.
+
+**Step 2:** Render participant list below the edit form.
+
+**Step 3:** Add kick button for each non-GM participant.
+
+**Step 4:** Commit
+
+```bash
+git add src/GmRelay.Web/Components/Pages/EditSession.razor
+
+git commit -m "feat: show player list and kick button in EditSession"
+```
+
+---
+
+## Task 6: Add backend tests
+
+**Objective:** Cover new GetSessionParticipants and RemovePlayerFromSession logic.
+
+**Files:**
+- Create: `tests/GmRelay.Bot.Tests/Web/SessionParticipantTests.cs`
+
+**Step 1:** Write tests for `GetSessionParticipantsForGmAsync`.
+
+**Step 2:** Write tests for `RemovePlayerFromSessionForGmAsync` including waitlist promotion.
+
+**Step 3:** Run tests
+
+```bash
+dotnet test tests/GmRelay.Bot.Tests/GmRelay.Bot.Tests.csproj -v n
+```
+
+**Step 4:** Commit
+
+```bash
+git add tests/GmRelay.Bot.Tests/Web/SessionParticipantTests.cs
+
+git commit -m "test: add SessionParticipant service tests"
+```
+
+---
+
+## Task 7: Update README
+
+**Objective:** Bump version and document new features.
+
+**Files:**
+- Modify: `README.md`
+
+**Step 1:** Change version from `v1.9.6` to `v1.9.7`.
+
+**Step 2:** Add bullet under Web Dashboard: player list with kick and auto-promote.
+
+**Step 3:** Commit
+
+```bash
+git add README.md
+
+git commit -m "docs: bump README to v1.9.7, document player list kick"
+```
+
+---
+
+## Task 8: Update Wiki
+
+**Objective:** Update `Руководство ГМа` page with player management instructions.
+
+**Files:**
+- Modify: Wiki page `Руководство ГМа`
+
+**Step 1:** Read current wiki content via MCP.
+
+**Step 2:** Add section about viewing player list and removing players.
+
+**Step 3:** Update via MCP.
+
+---
+
+## Task 9: Push branch and run CI
+
+**Objective:** Push branch, monitor workflow, fix issues.
+
+**Step 1:** Push
+
+```bash
+git push -u origin feat/player-list-kick-waitlist
+```
+
+**Step 2:** Check workflow run via MCP gitea actions.
+
+**Step 3:** Fix any issues.
+
+---
+
+## Task 10: Merge and create release
+
+**Objective:** Merge PR (or fast-forward), tag, create release.
+
+**Step 1:** Merge to main
+
+```bash
+git checkout main
+
+git merge --no-ff feat/player-list-kick-waitlist -m "feat: player list, kick, and waitlist promotion (#X)"
+```
+
+**Step 2:** Tag v1.9.7
+
+```bash
+git tag v1.9.7
+
+git push origin main --tags
+```
+
+**Step 3:** Create release via MCP gitea_create_release.
+
+---

src/GmRelay.Bot/Features/Sessions/CreateSession/CancelSessionHandler.cs

@@ -16,7 +16,7 @@ public sealed record CancelSessionCommand(
     int MessageId);
 
 // DTOs for AOT compilation
-internal sealed record CancelSessionInfoDto(string Title, Guid BatchId, bool CanManage, string NotificationMode);
+internal sealed record CancelSessionInfoDto(string Title, Guid BatchId, int? BatchMessageId, bool CanManage, string NotificationMode);
 
 public sealed class CancelSessionHandler(
     NpgsqlDataSource dataSource,
@@ -34,6 +34,7 @@ public sealed class CancelSessionHandler(
             """
             SELECT s.title AS Title,
                    s.batch_id AS BatchId,
+                   s.batch_message_id AS BatchMessageId,
                    s.notification_mode AS NotificationMode,
                    EXISTS (
                        SELECT 1
@@ -105,13 +106,13 @@ public sealed class CancelSessionHandler(
 
         try
         {
-            await bot.EditMessageText(
+            await BatchMessageEditor.EditBatchMessageAsync(
+                bot,
                 chatId: command.ChatId,
-                messageId: command.MessageId,
+                messageId: session.BatchMessageId ?? command.MessageId,
                 text: renderResult.Text,
-                parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
-                replyMarkup: renderResult.Markup, 
-                cancellationToken: ct);
+                replyMarkup: renderResult.Markup,
+                ct);
 
             await bot.AnswerCallbackQuery(command.CallbackQueryId, "Сессия отменена!", cancellationToken: ct);
             

src/GmRelay.Bot/Features/Sessions/CreateSession/CreateSessionHandler.cs

@@ -16,7 +16,7 @@ public sealed class CreateSessionHandler(
 {
     public async Task HandleAsync(Message message, CancellationToken cancellationToken)
     {
-        var parseResult = NewSessionCommandParser.Parse(message.Text, DateTimeOffset.UtcNow);
+        var parseResult = NewSessionCommandParser.Parse(message.Text ?? message.Caption, DateTimeOffset.UtcNow);
 
         foreach (var timeInput in parseResult.PastTimeInputs)
         {
@@ -54,13 +54,14 @@ public sealed class CreateSessionHandler(
         {
             await botClient.SendMessage(
                 chatId: message.Chat.Id,
-                text: "❌ Не удалось распознать формат. Пожалуйста, используйте шаблон:\n\n/newsession\nНазвание: My Game\nВремя: 15.05.2026 19:30\nВремя: 22.05.2026 19:30\nМест: 4\nСсылка: https://link\n\nДля повтора можно указать одну дату и строки:\nИгр: 4\nИнтервал: 7",
+                text: "❌ Не удалось распознать формат. Пожалуйста, используйте шаблон:\n\n/newsession\nНазвание: My Game\nВремя: 15.05.2026 19:30\nВремя: 22.05.2026 19:30\nМест: 4\nСсылка: https://link\nКартинка: https://cover\n\nДля повтора можно указать одну дату и строки:\nИгр: 4\nИнтервал: 7",
                 cancellationToken: cancellationToken);
             return;
         }
 
         var title = parseResult.Title!;
         var link = parseResult.Link!;
+        var imageReference = GetBatchImageReference(message, parseResult.ImageUrl);
         var gmId = message.From!.Id;
         var gmName = message.From.FirstName + (string.IsNullOrEmpty(message.From.LastName) ? string.Empty : $" {message.From.LastName}");
         var gmUsername = message.From.Username;
@@ -184,13 +185,63 @@ public sealed class CreateSessionHandler(
 
             var renderResult = SessionBatchRenderer.Render(title, sessions, Array.Empty<ParticipantBatchDto>());
 
-            var batchMessage = await botClient.SendMessage(
-                chatId: chatId,
-                messageThreadId: messageThreadId,
-                text: renderResult.Text,
-                parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
-                replyMarkup: renderResult.Markup,
-                cancellationToken: cancellationToken);
+            Message batchMessage;
+
+            if (imageReference is not null && renderResult.Text.Length <= 1024)
+            {
+                // Картинка + расписание умещаются в одном Telegram-фото с подписью
+                try
+                {
+                    batchMessage = await botClient.SendPhoto(
+                        chatId: chatId,
+                        messageThreadId: messageThreadId,
+                        photo: InputFile.FromString(imageReference),
+                        caption: renderResult.Text,
+                        parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
+                        replyMarkup: renderResult.Markup,
+                        cancellationToken: cancellationToken);
+                }
+                catch (Exception ex)
+                {
+                    logger.LogWarning(ex, "Не удалось отправить картинку для батча {BatchId}, отправляем текстом", batchId);
+                    batchMessage = await botClient.SendMessage(
+                        chatId: chatId,
+                        messageThreadId: messageThreadId,
+                        text: renderResult.Text,
+                        parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
+                        replyMarkup: renderResult.Markup,
+                        cancellationToken: cancellationToken);
+                }
+            }
+            else
+            {
+                // Текст слишком длинный для caption — fallback на два сообщения
+                if (imageReference is not null)
+                {
+                    try
+                    {
+                        await botClient.SendPhoto(
+                            chatId: chatId,
+                            messageThreadId: messageThreadId,
+                            photo: InputFile.FromString(imageReference),
+                            caption: $"🎲 {System.Net.WebUtility.HtmlEncode(title)}",
+                            parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
+                            cancellationToken: cancellationToken);
+                    }
+                    catch (Exception ex)
+                    {
+                        logger.LogWarning(ex, "Не удалось отправить картинку для батча {BatchId}", batchId);
+                    }
+                }
+
+                batchMessage = await botClient.SendMessage(
+                    chatId: chatId,
+                    messageThreadId: messageThreadId,
+                    text: renderResult.Text,
+                    parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
+                    replyMarkup: renderResult.Markup,
+                    cancellationToken: cancellationToken);
+            }
 
             await connection.ExecuteAsync(
                 "UPDATE sessions SET batch_message_id = @MsgId WHERE batch_id = @BatchId",
@@ -215,4 +266,20 @@ public sealed class CreateSessionHandler(
             await botClient.SendMessage(chatId, "💥 Произошла ошибка базы данных при создании сессии.", cancellationToken: cancellationToken);
         }
     }
+
+    internal static string? GetBatchImageReference(Message message, string? parsedImageUrl)
+    {
+        var attachedPhotoFileId = message.Photo?
+            .OrderByDescending(photo => photo.FileSize ?? 0)
+            .ThenByDescending(photo => photo.Width * photo.Height)
+            .FirstOrDefault()
+            ?.FileId;
+
+        if (!string.IsNullOrWhiteSpace(attachedPhotoFileId))
+        {
+            return attachedPhotoFileId;
+        }
+
+        return string.IsNullOrWhiteSpace(parsedImageUrl) ? null : parsedImageUrl.Trim();
+    }
 }

src/GmRelay.Bot/Features/Sessions/CreateSession/JoinSessionHandler.cs

@@ -138,13 +138,13 @@ public sealed class JoinSessionHandler(
             // 4. Перерисовываем сообщение
             var renderResult = SessionBatchRenderer.Render(batchInfo.Title, batchSessions.ToList(), batchParticipants.ToList());
 
-            await bot.EditMessageText(
+            await BatchMessageEditor.EditBatchMessageAsync(
+                bot,
                 chatId: command.ChatId,
                 messageId: command.MessageId,
                 text: renderResult.Text,
-                parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
                 replyMarkup: renderResult.Markup,
-                cancellationToken: ct);
+                ct);
 
             var callbackText = registrationStatus == ParticipantRegistrationStatus.Waitlisted
                 ? "Основной состав заполнен. Вы добавлены в лист ожидания."

src/GmRelay.Bot/Features/Sessions/CreateSession/LeaveSessionHandler.cs

@@ -184,13 +184,13 @@ public sealed class LeaveSessionHandler(
 
             var renderResult = SessionBatchRenderer.Render(session.Title, batchSessions, batchParticipants);
 
-            await bot.EditMessageText(
+            await BatchMessageEditor.EditBatchMessageAsync(
+                bot,
                 chatId: command.ChatId,
                 messageId: command.MessageId,
                 text: renderResult.Text,
-                parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
                 replyMarkup: renderResult.Markup,
-                cancellationToken: ct);
+                ct);
 
             var callbackText = participant.RegistrationStatus == ParticipantRegistrationStatus.Waitlisted
                 ? "Вы удалены из листа ожидания."

src/GmRelay.Bot/Features/Sessions/CreateSession/NewSessionCommandParser.cs

@@ -5,6 +5,7 @@ namespace GmRelay.Bot.Features.Sessions.CreateSession;
 internal sealed record NewSessionParseResult(
     string? Title,
     string? Link,
+    string? ImageUrl,
     int? MaxPlayers,
     IReadOnlyList<DateTimeOffset> ScheduledTimes,
     IReadOnlyList<string> PastTimeInputs,
@@ -27,6 +28,12 @@ internal static class NewSessionCommandParser
     private const string TitlePrefix = "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435:";
     private const string TimePrefix = "\u0412\u0440\u0435\u043c\u044f:";
     private const string LinkPrefix = "\u0421\u0441\u044b\u043b\u043a\u0430:";
+    private static readonly string[] ImagePrefixes =
+    [
+        "\u041a\u0430\u0440\u0442\u0438\u043d\u043a\u0430:",
+        "\u0418\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0435:",
+        "\u041e\u0431\u043b\u043e\u0436\u043a\u0430:"
+    ];
     private static readonly string[] SeatLimitPrefixes =
     [
         "\u041c\u0435\u0441\u0442:",
@@ -49,6 +56,7 @@ internal static class NewSessionCommandParser
     {
         string? title = null;
         string? link = null;
+        string? imageUrl = null;
         int? maxPlayers = null;
         int? recurringCount = null;
         var recurringIntervalDays = 7;
@@ -72,6 +80,14 @@ internal static class NewSessionCommandParser
                 continue;
             }
 
+            var imagePrefix = ImagePrefixes.FirstOrDefault(prefix =>
+                line.StartsWith(prefix, StringComparison.OrdinalIgnoreCase));
+            if (imagePrefix is not null)
+            {
+                imageUrl = line[imagePrefix.Length..].Trim();
+                continue;
+            }
+
             var seatLimitPrefix = SeatLimitPrefixes.FirstOrDefault(prefix =>
                 line.StartsWith(prefix, StringComparison.OrdinalIgnoreCase));
             if (seatLimitPrefix is not null)
@@ -157,6 +173,7 @@ internal static class NewSessionCommandParser
         return new NewSessionParseResult(
             title,
             link,
+            imageUrl,
             maxPlayers,
             scheduledTimes,
             pastTimeInputs,

src/GmRelay.Bot/Features/Sessions/CreateSession/PromoteWaitlistedPlayerHandler.cs

@@ -13,7 +13,7 @@ public sealed record PromoteWaitlistedPlayerCommand(
     long ChatId,
     int MessageId);
 
-internal sealed record PromoteWaitlistSessionDto(string Title, Guid BatchId, bool CanManage, int? MaxPlayers);
+internal sealed record PromoteWaitlistSessionDto(string Title, Guid BatchId, int? BatchMessageId, bool CanManage, int? MaxPlayers);
 internal sealed record WaitlistedParticipantDto(Guid ParticipantRowId, string DisplayName);
 
 public sealed class PromoteWaitlistedPlayerHandler(
@@ -33,6 +33,7 @@ public sealed class PromoteWaitlistedPlayerHandler(
                 """
                 SELECT s.title AS Title,
                        s.batch_id AS BatchId,
+                       s.batch_message_id AS BatchMessageId,
                        s.max_players AS MaxPlayers,
                        EXISTS (
                            SELECT 1
@@ -163,13 +164,13 @@ public sealed class PromoteWaitlistedPlayerHandler(
 
             var renderResult = SessionBatchRenderer.Render(session.Title, batchSessions, batchParticipants);
 
-            await bot.EditMessageText(
+            await BatchMessageEditor.EditBatchMessageAsync(
+                bot,
                 chatId: command.ChatId,
-                messageId: command.MessageId,
+                messageId: session.BatchMessageId ?? command.MessageId,
                 text: renderResult.Text,
-                parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
                 replyMarkup: renderResult.Markup,
-                cancellationToken: ct);
+                ct);
 
             await bot.AnswerCallbackQuery(command.CallbackQueryId, $"{promoted.DisplayName} переведен(а) в основной состав.", cancellationToken: ct);
         }

src/GmRelay.Bot/Features/Sessions/ListSessions/DeleteSessionHandler.cs

@@ -117,30 +117,16 @@ public sealed class DeleteSessionHandler(
             return;
         }
 
-        var text = "📅 <b>Ближайшие игры:</b>\n\n";
-        foreach (var s in sessionsList)
-        {
-            var seats = s.MaxPlayers.HasValue
-                ? $"{s.PlayerCount}/{s.MaxPlayers.Value}"
-                : s.PlayerCount.ToString(System.Globalization.CultureInfo.InvariantCulture);
-            var waitlist = s.WaitlistCount > 0 ? $", ожидание: {s.WaitlistCount}" : string.Empty;
-            text += $"🔹 <b>{s.ScheduledAt.FormatMoscow()}</b> — {System.Net.WebUtility.HtmlEncode(s.Title)} (Места: {seats}{waitlist})\n";
-        }
-
-        var canManage = sessionsList.First().CanManage;
-        var keyboard = canManage
-            ? new Telegram.Bot.Types.ReplyMarkups.InlineKeyboardMarkup(
-                sessionsList.Select(s => new[] { Telegram.Bot.Types.ReplyMarkups.InlineKeyboardButton.WithCallbackData($"🗑 Удалить {s.ScheduledAt.FormatMoscowShort()}", $"delete_session:{s.Id}") }))
-            : null;
+        var renderResult = SessionListMessageRenderer.Render(sessionsList);
 
         try
         {
             await bot.EditMessageText(
                 command.ChatId,
                 command.MessageId,
-                text,
+                renderResult.Text,
                 parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
-                replyMarkup: keyboard,
+                replyMarkup: renderResult.Markup,
                 cancellationToken: ct);
         }
         catch (Exception ex)

src/GmRelay.Bot/Features/Sessions/ListSessions/ListSessionsHandler.cs

@@ -3,11 +3,60 @@ using GmRelay.Shared.Domain;
 using Npgsql;
 using Telegram.Bot;
 using Telegram.Bot.Types;
+using Telegram.Bot.Types.ReplyMarkups;
 
 namespace GmRelay.Bot.Features.Sessions.ListSessions;
 
 internal sealed record SessionListItemDto(Guid Id, string Title, DateTime ScheduledAt, string Status, int? MaxPlayers, int PlayerCount, int WaitlistCount, bool CanManage);
 
+internal static class SessionListMessageRenderer
+{
+    public static (string Text, InlineKeyboardMarkup? Markup) Render(IReadOnlyList<SessionListItemDto> sessions)
+    {
+        var text = "📅 <b>Ближайшие игры:</b>\n\n";
+        foreach (var session in sessions)
+        {
+            var seats = session.MaxPlayers.HasValue
+                ? $"{session.PlayerCount}/{session.MaxPlayers.Value}"
+                : session.PlayerCount.ToString(System.Globalization.CultureInfo.InvariantCulture);
+            var waitlist = session.WaitlistCount > 0 ? $", ожидание: {session.WaitlistCount}" : string.Empty;
+            text += $"🔹 <b>{session.ScheduledAt.FormatMoscow()}</b> — {System.Net.WebUtility.HtmlEncode(session.Title)} (Места: {seats}{waitlist})\n";
+        }
+
+        var canManage = sessions.Count > 0 && sessions.First().CanManage;
+        if (!canManage)
+        {
+            return (text, null);
+        }
+
+        var buttons = new List<InlineKeyboardButton[]>();
+        foreach (var session in sessions)
+        {
+            var dateTitle = session.ScheduledAt.FormatMoscowShort();
+            buttons.Add(
+            [
+                InlineKeyboardButton.WithCallbackData($"❌ {dateTitle}", $"cancel_session:{session.Id}"),
+                InlineKeyboardButton.WithCallbackData($"⏰ {dateTitle}", $"reschedule_session:{session.Id}")
+            ]);
+
+            if (SessionCapacityRules.CanPromoteWaitlistedPlayer(session.MaxPlayers, session.PlayerCount, session.WaitlistCount))
+            {
+                buttons.Add(
+                [
+                    InlineKeyboardButton.WithCallbackData($"⬆️ Из ожидания {dateTitle}", $"promote_waitlist:{session.Id}")
+                ]);
+            }
+
+            buttons.Add(
+            [
+                InlineKeyboardButton.WithCallbackData($"🗑 Удалить {dateTitle}", $"delete_session:{session.Id}")
+            ]);
+        }
+
+        return (text, new InlineKeyboardMarkup(buttons));
+    }
+}
+
 public sealed class ListSessionsHandler(
     NpgsqlDataSource dataSource,
     ITelegramBotClient botClient)
@@ -53,27 +102,13 @@ public sealed class ListSessionsHandler(
             return;
         }
 
-        var text = "📅 <b>Ближайшие игры:</b>\n\n";
-        foreach (var s in sessionsList)
-        {
-            var seats = s.MaxPlayers.HasValue
-                ? $"{s.PlayerCount}/{s.MaxPlayers.Value}"
-                : s.PlayerCount.ToString(System.Globalization.CultureInfo.InvariantCulture);
-            var waitlist = s.WaitlistCount > 0 ? $", ожидание: {s.WaitlistCount}" : string.Empty;
-            text += $"🔹 <b>{s.ScheduledAt.FormatMoscow()}</b> — {System.Net.WebUtility.HtmlEncode(s.Title)} (Места: {seats}{waitlist})\n";
-        }
-
-        var canManage = sessionsList.First().CanManage;
-        var keyboard = canManage
-            ? new Telegram.Bot.Types.ReplyMarkups.InlineKeyboardMarkup(
-                sessionsList.Select(s => new[] { Telegram.Bot.Types.ReplyMarkups.InlineKeyboardButton.WithCallbackData($"🗑 Удалить {s.ScheduledAt.FormatMoscowShort()}", $"delete_session:{s.Id}") }))
-            : null;
+        var renderResult = SessionListMessageRenderer.Render(sessionsList);
 
         await botClient.SendMessage(
             chatId: message.Chat.Id,
-            text: text,
+            text: renderResult.Text,
             parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
-            replyMarkup: keyboard,
+            replyMarkup: renderResult.Markup,
             cancellationToken: cancellationToken);
     }
 }

src/GmRelay.Bot/Features/Sessions/RescheduleSession/HandleRescheduleTimeInputHandler.cs

@@ -378,13 +378,13 @@ public sealed class HandleRescheduleTimeInputHandler(
                 var renderResult = SessionBatchRenderer.Render(
                     proposal.Title, batchSessions, batchParticipants);
 
-                await bot.EditMessageText(
+                await BatchMessageEditor.EditBatchMessageAsync(
+                    bot,
                     chatId: proposal.TelegramChatId,
                     messageId: proposal.BatchMessageId.Value,
                     text: renderResult.Text,
-                    parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
                     replyMarkup: renderResult.Markup,
-                    cancellationToken: ct);
+                    ct);
             }
             else
             {

src/GmRelay.Bot/Features/Sessions/RescheduleSession/RescheduleVotingDeadlineService.cs

@@ -306,13 +306,13 @@ public sealed class RescheduleVotingDeadlineService(
             {
                 var renderResult = SessionBatchRenderer.Render(proposal.Title, batchSessions, batchParticipants);
 
-                await bot.EditMessageText(
+                await BatchMessageEditor.EditBatchMessageAsync(
+                    bot,
                     chatId: proposal.TelegramChatId,
                     messageId: proposal.BatchMessageId.Value,
                     text: renderResult.Text,
-                    parseMode: ParseMode.Html,
                     replyMarkup: renderResult.Markup,
-                    cancellationToken: ct);
+                    ct);
             }
             else
             {

src/GmRelay.Bot/Infrastructure/Telegram/UpdateRouter.cs

@@ -42,17 +42,26 @@ public sealed class UpdateRouter(
                 await HandleCallbackQueryAsync(query, ct);
                 break;
 
-            case { Message: { Text: { } text } message } when text.StartsWith('/'):
-                await HandleCommandAsync(message, text, ct);
-                break;
+            case { Message: { } message }:
+                var commandText = GetCommandText(message);
+                if (commandText.StartsWith("/", StringComparison.Ordinal))
+                {
+                    await HandleCommandAsync(message, commandText, ct);
+                    break;
+                }
+
+                if (message.Text is not null)
+                {
+                    await rescheduleTimeInputHandler.TryHandleAsync(message, ct);
+                }
 
-            // Non-command text messages — check for reschedule time input
-            case { Message: { Text: { } } message } when !message.Text!.StartsWith('/'):
-                await rescheduleTimeInputHandler.TryHandleAsync(message, ct);
                 break;
         }
     }
 
+    internal static string GetCommandText(Message message)
+        => (message.Text ?? message.Caption ?? string.Empty).TrimStart();
+
     private async Task HandleCallbackQueryAsync(CallbackQuery query, CancellationToken ct)
     {
         if (query.Data is not { } data || query.Message is not { } message)
@@ -216,14 +225,15 @@ public sealed class UpdateRouter(
                         Время: 15.05.2026 19:30
                         Мест: 4
                         Ссылка: https://link
+                        Картинка: https://cover
 
                         Для регулярного расписания можно указать одну дату:
                         Игр: 4
                         Интервал: 7
 
                         /listsessions — список предстоящих сессий
+                        Для owner/co-GM /listsessions показывает кнопки отмены, переноса, удаления и повышения из листа ожидания.
                         Игроки могут записаться кнопкой «На дату» и сняться кнопкой «Выйти».
-                        Owner и co-GM могут переносить сессии кнопкой «Перенести»: бот попросит 2-3 варианта времени и дедлайн голосования.
                         /help — эта справка
                         """,
                     cancellationToken: ct);

src/GmRelay.Shared/Rendering/BatchMessageEditor.cs

@@ -0,0 +1,51 @@
+using Telegram.Bot;
+using Telegram.Bot.Types.Enums;
+using Telegram.Bot.Types.ReplyMarkups;
+
+namespace GmRelay.Shared.Rendering;
+
+/// <summary>
+/// Handles editing batch messages that may be either text or photo messages.
+/// When the batch was created with SendPhoto (image + caption), we need
+/// EditMessageCaption instead of EditMessageText.
+/// </summary>
+public static class BatchMessageEditor
+{
+    /// <summary>
+    /// Edits a batch message, automatically detecting whether it is a text or photo message.
+    /// Tries EditMessageText first; on failure falls back to EditMessageCaption.
+    /// </summary>
+    public static async Task EditBatchMessageAsync(
+        ITelegramBotClient bot,
+        long chatId,
+        int messageId,
+        string text,
+        InlineKeyboardMarkup? replyMarkup,
+        CancellationToken ct = default)
+    {
+        try
+        {
+            await bot.EditMessageText(
+                chatId: chatId,
+                messageId: messageId,
+                text: text,
+                parseMode: ParseMode.Html,
+                replyMarkup: replyMarkup,
+                cancellationToken: ct);
+        }
+        catch (Telegram.Bot.Exceptions.ApiRequestException ex)
+            when (ex.Message.Contains("there is no text in the message", StringComparison.OrdinalIgnoreCase))
+        {
+            // The batch message is a photo — use EditMessageCaption instead.
+            // Caption is limited to 1024 chars; if text exceeds that, truncate gracefully.
+            var caption = text.Length <= 1024 ? text : text[..1021] + "...";
+            await bot.EditMessageCaption(
+                chatId: chatId,
+                messageId: messageId,
+                caption: caption,
+                parseMode: ParseMode.Html,
+                replyMarkup: replyMarkup,
+                cancellationToken: ct);
+        }
+    }
+}

src/GmRelay.Shared/Rendering/SessionBatchRenderer.cs

@@ -63,15 +63,6 @@ public static class SessionBatchRenderer
                     InlineKeyboardButton.WithCallbackData($"🚪 Выйти {dateTitle}", $"leave_session:{session.SessionId}")
                 });
 
-                buttons.Add(new[]
-                {
-                    InlineKeyboardButton.WithCallbackData($"❌ Отменить {dateTitle} (ГМ)", $"cancel_session:{session.SessionId}"),
-                    InlineKeyboardButton.WithCallbackData($"⏰ (ГМ)", $"reschedule_session:{session.SessionId}")
-                }
-                .Concat(SessionCapacityRules.CanPromoteWaitlistedPlayer(session.MaxPlayers, sessionPlayers.Count, waitlistedPlayers.Count)
-                    ? [InlineKeyboardButton.WithCallbackData($"⬆️ Из ожидания {dateTitle} (ГМ)", $"promote_waitlist:{session.SessionId}")]
-                    : [])
-                .ToArray());
             }
         }
 

src/GmRelay.Web/Components/App.razor

@@ -24,6 +24,22 @@
     <ReconnectModal />
     <script src="@Assets["_framework/blazor.web.js"]"></script>
     <script>
+        window.waitForTelegramMiniApp = async function (timeoutMs) {
+            var deadline = Date.now() + (timeoutMs || 3000);
+
+            while (Date.now() <= deadline) {
+                if (window.Telegram && window.Telegram.WebApp) {
+                    return window.Telegram.WebApp;
+                }
+
+                await new Promise(function (resolve) {
+                    setTimeout(resolve, 100);
+                });
+            }
+
+            return null;
+        };
+
         window.waitForTelegramMiniAppInitData = async function (timeoutMs) {
             var deadline = Date.now() + (timeoutMs || 3000);
 
@@ -40,30 +56,111 @@
             return null;
         };
 
-        (async function () {
-            var webApp = await window.waitForTelegramMiniAppInitData(1000);
+        window.syncTelegramMiniAppViewport = function (webApp) {
+            if (!webApp) {
+                return;
+            }
+
+            var root = document.documentElement;
+            var safeArea = webApp.safeAreaInset || {};
+            var contentSafeArea = webApp.contentSafeAreaInset || {};
+            var setPx = function (name, value) {
+                root.style.setProperty(name, Math.max(0, Number(value) || 0) + 'px');
+            };
+
+            setPx('--gm-tg-safe-top', safeArea.top);
+            setPx('--gm-tg-safe-right', safeArea.right);
+            setPx('--gm-tg-safe-bottom', safeArea.bottom);
+            setPx('--gm-tg-safe-left', safeArea.left);
+            setPx('--gm-tg-content-safe-top', contentSafeArea.top);
+            setPx('--gm-tg-content-safe-right', contentSafeArea.right);
+            setPx('--gm-tg-content-safe-bottom', contentSafeArea.bottom);
+            setPx('--gm-tg-content-safe-left', contentSafeArea.left);
+
+            if (webApp.viewportHeight) {
+                root.style.setProperty('--gm-tg-viewport-height', webApp.viewportHeight + 'px');
+            }
+        };
+
+        window.prepareTelegramMiniApp = function (webApp) {
             if (!webApp) {
                 return;
             }
 
             document.body.classList.add('telegram-mini-app');
-            webApp.ready();
+            window.syncTelegramMiniAppViewport(webApp);
+
+            try {
+                webApp.ready();
+            } catch (error) {
+            }
+
+            try {
+                webApp.expand();
+            } catch (error) {
+            }
+
+            if (webApp.onEvent && !window.gmRelayTelegramMiniAppViewportEventsRegistered) {
+                window.gmRelayTelegramMiniAppViewportEventsRegistered = true;
+                webApp.onEvent('safeAreaChanged', function () {
+                    window.syncTelegramMiniAppViewport(webApp);
+                });
+                webApp.onEvent('contentSafeAreaChanged', function () {
+                    window.syncTelegramMiniAppViewport(webApp);
+                });
+                webApp.onEvent('viewportChanged', function () {
+                    window.syncTelegramMiniAppViewport(webApp);
+                });
+            }
+        };
+
+        (async function () {
+            var webApp = await window.waitForTelegramMiniApp(1000);
+            window.prepareTelegramMiniApp(webApp);
         })();
 
         window.loadTelegramWidget = function (botUsername, authUrl) {
             var container = document.getElementById('telegram-login-container');
             if (!container) return;
             container.innerHTML = '';
+            window.gmRelayTelegramLoginAuthUrl = authUrl || '/auth/telegram-login';
             var script = document.createElement('script');
             script.async = true;
             script.src = 'https://telegram.org/js/telegram-widget.js?22';
             script.setAttribute('data-telegram-login', botUsername);
             script.setAttribute('data-size', 'large');
-            script.setAttribute('data-auth-url', authUrl);
+            script.setAttribute('data-onauth', 'window.handleTelegramLogin(user)');
             script.setAttribute('data-request-access', 'write');
             container.appendChild(script);
         };
 
+        window.handleTelegramLogin = async function (user) {
+            if (!user) {
+                window.location.href = '/login?error=auth_failed';
+                return;
+            }
+
+            try {
+                var response = await fetch(window.gmRelayTelegramLoginAuthUrl || '/auth/telegram-login', {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    credentials: 'same-origin',
+                    cache: 'no-store',
+                    body: JSON.stringify(user)
+                });
+
+                if (!response.ok) {
+                    window.location.href = '/login?error=auth_failed';
+                    return;
+                }
+
+                var payload = await response.json();
+                window.location.href = payload.redirectUrl || '/';
+            } catch (error) {
+                window.location.href = '/login?error=auth_failed';
+            }
+        };
+
         window.watchTelegramMiniAppLogin = function (statusUrl, redirectUrl, reloadOnReturn) {
             window.gmRelayMiniAppLoginReloadOnReturn =
                 window.gmRelayMiniAppLoginReloadOnReturn || reloadOnReturn === true;
@@ -161,29 +258,40 @@
         };
 
         window.authenticateTelegramMiniApp = async function (authUrl, redirectUrl) {
-            var webApp = await window.waitForTelegramMiniAppInitData(3000);
+            var webApp = await window.waitForTelegramMiniApp(3000);
             if (!webApp) {
-                return false;
+                return { authenticated: false, reason: 'telegram-webapp-missing' };
             }
 
-            document.body.classList.add('telegram-mini-app');
-            webApp.ready();
-            webApp.expand();
+            window.prepareTelegramMiniApp(webApp);
 
-            var response = await fetch(authUrl, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                credentials: 'same-origin',
-                body: JSON.stringify({ initData: webApp.initData })
-            });
-
-            if (!response.ok) {
-                return false;
+            if (!webApp.initData) {
+                return { authenticated: false, reason: 'telegram-init-data-empty' };
             }
 
-            var payload = await response.json();
-            window.location.href = payload.redirectUrl || redirectUrl || '/';
-            return true;
+            try {
+                var response = await fetch(authUrl, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    credentials: 'same-origin',
+                    cache: 'no-store',
+                    body: JSON.stringify({ initData: webApp.initData })
+                });
+
+                if (!response.ok) {
+                    return {
+                        authenticated: false,
+                        reason: 'telegram-auth-failed',
+                        status: response.status
+                    };
+                }
+
+                var payload = await response.json();
+                window.location.href = payload.redirectUrl || redirectUrl || '/';
+                return { authenticated: true, redirectUrl: payload.redirectUrl || redirectUrl || '/' };
+            } catch (error) {
+                return { authenticated: false, reason: 'telegram-auth-failed' };
+            }
         };
     </script>
 </body>

src/GmRelay.Web/Components/Layout/NavMenu.razor

@@ -56,7 +56,7 @@
                     </button>
                 </form>
 
-                <div class="nav-version">v1.9.2</div>
+                <div class="nav-version">v1.9.9</div>
             </div>
         </Authorized>
         <NotAuthorized>

src/GmRelay.Web/Components/Pages/GroupDetails.razor

@@ -214,7 +214,7 @@
         </div>
 
         @* Desktop table *@
-        <div class="glass-card session-table-desktop animate-slide-up" style="padding: 0; overflow: hidden;">
+        <div class="glass-card session-table-desktop session-table-desktop-card animate-slide-up">
             <table class="gm-table">
                 <thead>
                     <tr>
@@ -229,33 +229,80 @@
                 <tbody>
                     @foreach (var session in sessions)
                     {
+                        var isExpanded = expandedSessions.Contains(session.Id);
                         <tr>
-                            <td style="color: var(--text-primary); font-weight: 500;">@session.Title</td>
+                            <td style="color: var(--text-primary); font-weight: 500;">
+                                <button type="button" class="btn-gm btn-gm-link" @onclick="() => ToggleParticipants(session.Id)">
+                                    @(isExpanded ? "▼" : "▶") @session.Title
+                                </button>
+                            </td>
                             <td>@session.ScheduledAt.FormatMoscow()</td>
                             <td>@FormatSeats(session)</td>
                             <td>
                                 <span class="status-badge @GetStatusClass(session.Status)">@TranslateStatus(session.Status)</span>
                             </td>
                             <td>
-                                <a href="@session.JoinLink" target="_blank" rel="noopener noreferrer"
-                                   style="max-width: 150px; display: inline-block; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">
+                                <a href="@session.JoinLink" target="_blank" rel="noopener noreferrer" class="session-join-link">
                                     Подключиться ↗
                                 </a>
                             </td>
                             <td>
-                                <div style="display: flex; gap: 0.5rem; flex-wrap: wrap;">
-                                    <a href="/session/edit/@session.Id" class="btn-gm btn-gm-outline" style="font-size: 0.8125rem; padding: 0.375rem 0.75rem;">
+                                <div class="session-table-actions">
+                                    <a href="/session/edit/@session.Id" class="btn-gm btn-gm-outline">
                                         ✏️ Изменить
                                     </a>
                                     @if (CanPromote(session))
                                     {
-                                        <button type="button" class="btn-gm btn-gm-success" style="font-size: 0.8125rem; padding: 0.375rem 0.75rem;" disabled="@(promotingSessionId == session.Id)" @onclick="() => PromoteWaitlisted(session.Id)">
+                                        <button type="button" class="btn-gm btn-gm-success" disabled="@(promotingSessionId == session.Id)" @onclick="() => PromoteWaitlisted(session.Id)">
                                             @(promotingSessionId == session.Id ? "⏳ Поднимаем..." : "⬆️ Из ожидания")
                                         </button>
                                     }
                                 </div>
                             </td>
                         </tr>
+                        @if (isExpanded)
+                        {
+                            <tr>
+                                <td colspan="6" style="padding: 0; border: none;">
+                                    <div class="participant-panel">
+                                        @if (loadingParticipantsSessionId == session.Id)
+                                        {
+                                            <div class="skeleton skeleton-text" style="width: 60%;"></div>
+                                        }
+                                        else if (participantsCache.TryGetValue(session.Id, out var participants))
+                                        {
+                                            @if (participants.Count == 0)
+                                            {
+                                                <div class="empty-state empty-state-compact">
+                                                    <div class="empty-state-title">Нет участников</div>
+                                                </div>
+                                            }
+                                            else
+                                            {
+                                                <div class="participant-list">
+                                                    @foreach (var p in participants)
+                                                    {
+                                                        <div class="participant-row">
+                                                            <div class="participant-info">
+                                                                <span class="participant-name">@p.DisplayName</span>
+                                                                <span class="participant-username">@FormatParticipantUsername(p)</span>
+                                                                <span class="status-badge @GetParticipantStatusClass(p)">@TranslateParticipantStatus(p)</span>
+                                                            </div>
+                                                            @if (!p.IsGm)
+                                                            {
+                                                                <button type="button" class="btn-gm btn-gm-danger" style="font-size: 0.75rem; padding: 0.25rem 0.5rem;" disabled="@(kickingParticipantId == p.Id)" @onclick="() => KickParticipant(session.Id, p.Id)">
+                                                                    @(kickingParticipantId == p.Id ? "⏳..." : "🚪 Исключить")
+                                                                </button>
+                                                            }
+                                                        </div>
+                                                    }
+                                                </div>
+                                            }
+                                        }
+                                    </div>
+                                </td>
+                            </tr>
+                        }
                     }
                 </tbody>
             </table>
@@ -265,9 +312,12 @@
         <div class="session-card-mobile stagger-children">
             @foreach (var session in sessions)
             {
+                var isExpanded = expandedSessions.Contains(session.Id);
                 <div class="session-card">
                     <div class="session-card-header">
-                        <span class="session-card-title">@session.Title</span>
+                        <button type="button" class="btn-gm btn-gm-link" style="text-align: left; padding: 0;" @onclick="() => ToggleParticipants(session.Id)">
+                            @(isExpanded ? "▼" : "▶") @session.Title
+                        </button>
                         <span class="status-badge @GetStatusClass(session.Status)">@TranslateStatus(session.Status)</span>
                     </div>
                     <div class="session-card-body">
@@ -295,6 +345,45 @@
                             </button>
                         }
                     </div>
+                    @if (isExpanded)
+                    {
+                        <div class="participant-panel" style="margin-top: 0.75rem;">
+                            @if (loadingParticipantsSessionId == session.Id)
+                            {
+                                <div class="skeleton skeleton-text" style="width: 60%;"></div>
+                            }
+                            else if (participantsCache.TryGetValue(session.Id, out var participants))
+                            {
+                                @if (participants.Count == 0)
+                                {
+                                    <div class="empty-state empty-state-compact">
+                                        <div class="empty-state-title">Нет участников</div>
+                                    </div>
+                                }
+                                else
+                                {
+                                    <div class="participant-list">
+                                        @foreach (var p in participants)
+                                        {
+                                            <div class="participant-row">
+                                                <div class="participant-info">
+                                                    <span class="participant-name">@p.DisplayName</span>
+                                                    <span class="participant-username">@FormatParticipantUsername(p)</span>
+                                                    <span class="status-badge @GetParticipantStatusClass(p)">@TranslateParticipantStatus(p)</span>
+                                                </div>
+                                                @if (!p.IsGm)
+                                                {
+                                                    <button type="button" class="btn-gm btn-gm-danger" style="font-size: 0.75rem; padding: 0.25rem 0.5rem;" disabled="@(kickingParticipantId == p.Id)" @onclick="() => KickParticipant(session.Id, p.Id)">
+                                                        @(kickingParticipantId == p.Id ? "⏳..." : "🚪 Исключить")
+                                                    </button>
+                                                }
+                                            </div>
+                                        }
+                                    </div>
+                                }
+                            }
+                        </div>
+                    }
                 </div>
             }
         </div>
@@ -317,6 +406,10 @@
     private string? errorMessage;
     private string? successMessage;
     private CoGmEditModel coGmModel = new();
+    private Dictionary<Guid, List<WebParticipant>> participantsCache = new();
+    private HashSet<Guid> expandedSessions = new();
+    private Guid? kickingParticipantId;
+    private Guid? loadingParticipantsSessionId;
 
     protected override async Task OnInitializedAsync()
     {
@@ -448,6 +541,105 @@
         }
     }
 
+    private async Task ToggleParticipants(Guid sessionId)
+    {
+        if (expandedSessions.Contains(sessionId))
+        {
+            expandedSessions.Remove(sessionId);
+            return;
+        }
+
+        expandedSessions.Add(sessionId);
+
+        if (!participantsCache.ContainsKey(sessionId))
+        {
+            loadingParticipantsSessionId = sessionId;
+            try
+            {
+                var participants = await SessionService.GetSessionParticipantsForGmAsync(sessionId, telegramId);
+                participantsCache[sessionId] = participants ?? [];
+            }
+            catch (Exception ex)
+            {
+                errorMessage = "Не удалось загрузить участников: " + ex.Message;
+                expandedSessions.Remove(sessionId);
+            }
+            finally
+            {
+                loadingParticipantsSessionId = null;
+            }
+        }
+    }
+
+    private async Task KickParticipant(Guid sessionId, Guid participantId)
+    {
+        errorMessage = null;
+        successMessage = null;
+        kickingParticipantId = participantId;
+
+        try
+        {
+            await SessionService.RemovePlayerFromSessionForGmAsync(sessionId, telegramId, participantId);
+            participantsCache.Remove(sessionId);
+            successMessage = "Игрок исключён.";
+            await LoadSessions();
+            if (expandedSessions.Contains(sessionId))
+            {
+                await ToggleParticipants(sessionId);
+            }
+        }
+        catch (SessionAccessDeniedException)
+        {
+            Navigation.NavigateTo("/access-denied");
+        }
+        catch (Exception ex)
+        {
+            errorMessage = ex.Message;
+        }
+        finally
+        {
+            kickingParticipantId = null;
+        }
+    }
+
+    private static string FormatParticipantUsername(WebParticipant p)
+    {
+        var username = string.IsNullOrWhiteSpace(p.TelegramUsername)
+            ? p.TelegramId.ToString(System.Globalization.CultureInfo.InvariantCulture)
+            : "@" + p.TelegramUsername;
+        return $"{username} · {FormatParticipantRsvp(p.RsvpStatus)}";
+    }
+
+    private static string FormatParticipantRsvp(string rsvp) => rsvp switch
+    {
+        RsvpStatus.Pending => "⏳ не ответил",
+        RsvpStatus.Confirmed => "✅ подтвердил",
+        RsvpStatus.Declined => "❌ отказался",
+        _ => rsvp
+    };
+
+    private static string GetParticipantStatusClass(WebParticipant p)
+    {
+        if (p.IsGm) return "status-success";
+        return p.RegistrationStatus switch
+        {
+            "Active" => "status-info",
+            "Waitlisted" => "status-warning",
+            _ => "status-neutral"
+        };
+    }
+
+    private static string TranslateParticipantStatus(WebParticipant p)
+    {
+        if (p.IsGm) return "ГМ";
+        return p.RegistrationStatus switch
+        {
+            "Active" => "Основной состав",
+            "Waitlisted" => "Ожидание",
+            _ => p.RegistrationStatus
+        };
+    }
+
     private async Task UpdateBatchDetails(BatchBulkEditModel batch)
     {
         errorMessage = null;

src/GmRelay.Web/Components/Pages/Login.razor

@@ -25,7 +25,6 @@
 
 @code {
     private string BotUsername => Configuration["Telegram:BotUsername"] ?? "GmRelayBot";
-    private string AuthUrl => Navigation.ToAbsoluteUri("/auth/telegram").ToString();
 
     [CascadingParameter]
     private Task<AuthenticationState>? AuthStateTask { get; set; }
@@ -46,8 +45,8 @@
     {
         if (firstRender)
         {
-            await JS.InvokeVoidAsync("loadTelegramWidget", BotUsername, AuthUrl);
-            await JS.InvokeVoidAsync("watchTelegramMiniAppLogin", "/auth/status", "/", true);
+            await JS.InvokeVoidAsync("loadTelegramWidget", BotUsername, "/auth/telegram-login");
+            await JS.InvokeVoidAsync("watchTelegramMiniAppLogin", "/auth/status", "/", false);
         }
     }
 }

src/GmRelay.Web/Components/Pages/MiniApp.razor

@@ -1,12 +1,13 @@
 @page "/miniapp"
 @using Microsoft.AspNetCore.Components.Authorization
+@using System.Text.Json.Serialization
 @inject IJSRuntime JS
 @inject NavigationManager Navigation
 
 <PageTitle>Mini App Dashboard — GM-Relay</PageTitle>
 
 <div class="mini-app-page">
-    <div class="mini-app-auth-card">
+    <div class="mini-app-auth-card" data-auth-status="@miniAppAuthStatus">
         <div class="mini-app-logo">🎲</div>
         <h1>GM-Relay</h1>
         <p>@statusMessage</p>
@@ -20,6 +21,7 @@
 
 @code {
     private string statusMessage = "Открываем dashboard внутри Telegram...";
+    private string miniAppAuthStatus = "starting";
     private bool showFallback;
 
     [CascadingParameter]
@@ -48,14 +50,17 @@
 
         try
         {
-            var authenticated = await JS.InvokeAsync<bool>(
+            var result = await JS.InvokeAsync<MiniAppAuthResult>(
                 "authenticateTelegramMiniApp",
                 "/auth/telegram-webapp",
                 "/");
 
-            if (!authenticated)
+            if (!result.Authenticated)
             {
-                statusMessage = "Mini App доступен из Telegram. Для браузера используйте обычный вход.";
+                miniAppAuthStatus = string.IsNullOrWhiteSpace(result.Reason)
+                    ? "telegram-auth-failed"
+                    : result.Reason;
+                statusMessage = GetStatusMessage(miniAppAuthStatus);
                 showFallback = true;
                 StateHasChanged();
                 await TryWatchLoginAsync();
@@ -63,6 +68,7 @@
         }
         catch (JSException)
         {
+            miniAppAuthStatus = "telegram-auth-failed";
             statusMessage = "Не удалось получить данные Telegram Mini App. Попробуйте открыть dashboard из бота.";
             showFallback = true;
             StateHasChanged();
@@ -80,4 +86,18 @@
         {
         }
     }
+
+    private static string GetStatusMessage(string reason) => reason switch
+    {
+        "telegram-webapp-missing" => "Mini App API не найден. Если страница открыта в браузере, войдите через Telegram.",
+        "telegram-init-data-empty" => "Telegram открыл страницу без Mini App initData. Попробуйте войти через Telegram на этом экране.",
+        "telegram-auth-failed" => "Не удалось проверить Telegram Mini App. Попробуйте войти через Telegram.",
+        _ => "Mini App доступен из Telegram. Для браузера используйте обычный вход."
+    };
+
+    private sealed record MiniAppAuthResult(
+        [property: JsonPropertyName("authenticated")] bool Authenticated,
+        [property: JsonPropertyName("reason")] string? Reason,
+        [property: JsonPropertyName("status")] int? Status,
+        [property: JsonPropertyName("redirectUrl")] string? RedirectUrl);
 }

src/GmRelay.Web/Program.cs

@@ -117,6 +117,25 @@ app.MapPost("/auth/telegram-webapp", async (
     return Results.Ok(new { redirectUrl = "/" });
 }).DisableAntiforgery();
 
+app.MapPost("/auth/telegram-login", async (
+    HttpContext context,
+    TelegramAuthService authService,
+    TelegramLoginPayload request) =>
+{
+    if (!authService.VerifyLoginPayload(request, out var telegramId, out var name))
+    {
+        return Results.Unauthorized();
+    }
+
+    var authProperties = new AuthenticationProperties { IsPersistent = true };
+    await context.SignInAsync(
+        CookieAuthenticationDefaults.AuthenticationScheme,
+        CreateTelegramPrincipal(telegramId, name),
+        authProperties);
+
+    return Results.Ok(new { redirectUrl = "/" });
+}).DisableAntiforgery();
+
 app.MapGet("/auth/status", (HttpContext context) =>
     Results.Ok(new { authenticated = context.User.Identity?.IsAuthenticated == true }));
 

src/GmRelay.Web/Services/AuthorizedSessionService.cs

@@ -219,6 +219,28 @@ public sealed class AuthorizedSessionService(ISessionStore sessionStore)
         await sessionStore.RemoveGroupCoGmAsync(groupId, coGmTelegramId);
     }
 
+    public async Task<List<WebParticipant>?> GetSessionParticipantsForGmAsync(Guid sessionId, long gmId)
+    {
+        var session = await GetSessionForGmAsync(sessionId, gmId);
+        if (session is null)
+        {
+            return null;
+        }
+
+        return await sessionStore.GetSessionParticipantsAsync(sessionId);
+    }
+
+    public async Task RemovePlayerFromSessionForGmAsync(Guid sessionId, long gmId, Guid participantId)
+    {
+        var session = await GetSessionForGmAsync(sessionId, gmId);
+        if (session is null)
+        {
+            throw new SessionAccessDeniedException(sessionId, gmId);
+        }
+
+        await sessionStore.RemovePlayerFromSessionAsync(sessionId, session.GroupId, participantId);
+    }
+
     private async Task<bool> GroupBelongsToGmAsync(Guid groupId, long gmId)
     {
         return await sessionStore.IsGroupManagerAsync(groupId, gmId);

src/GmRelay.Web/Services/ISessionStore.cs

@@ -25,4 +25,6 @@ public interface ISessionStore
     Task<WebSessionBatch> CreateBatchFromTemplateAsync(Guid templateId, Guid groupId, DateTime firstScheduledAt);
     Task AddGroupCoGmAsync(Guid groupId, long ownerTelegramId, long coGmTelegramId, string displayName, string? telegramUsername);
     Task RemoveGroupCoGmAsync(Guid groupId, long coGmTelegramId);
+    Task<List<WebParticipant>> GetSessionParticipantsAsync(Guid sessionId);
+    Task RemovePlayerFromSessionAsync(Guid sessionId, Guid groupId, Guid participantId);
 }

src/GmRelay.Web/Services/SessionService.cs

@@ -39,6 +39,16 @@ public sealed record WebSession(
     int WaitlistedPlayerCount,
     string NotificationMode = SessionNotificationModeExtensions.GroupAndDirectValue);
 
+public sealed record WebParticipant(
+    Guid Id,
+    long TelegramId,
+    string DisplayName,
+    string? TelegramUsername,
+    string RsvpStatus,
+    string RegistrationStatus,
+    bool IsGm,
+    DateTime? RespondedAt);
+
 internal sealed record WebPromotedParticipantDto(Guid ParticipantRowId, string DisplayName);
 internal sealed record WebDirectNotificationRecipient(long TelegramId, string DisplayName);
 internal sealed record WebBatchInfo(
@@ -507,6 +517,148 @@ public sealed class SessionService(
         }
     }
 
+    public async Task<List<WebParticipant>> GetSessionParticipantsAsync(Guid sessionId)
+    {
+        await using var conn = await dataSource.OpenConnectionAsync();
+        return (await conn.QueryAsync<WebParticipant>(
+            """
+            SELECT sp.id AS Id,
+                   p.telegram_id AS TelegramId,
+                   p.display_name AS DisplayName,
+                   p.telegram_username AS TelegramUsername,
+                   sp.rsvp_status AS RsvpStatus,
+                   sp.registration_status AS RegistrationStatus,
+                   sp.is_gm AS IsGm,
+                   sp.responded_at AS RespondedAt
+            FROM session_participants sp
+            JOIN players p ON p.id = sp.player_id
+            WHERE sp.session_id = @SessionId
+            ORDER BY sp.is_gm DESC,
+                     CASE sp.registration_status WHEN 'Active' THEN 0 ELSE 1 END,
+                     sp.created_at
+            """,
+            new { SessionId = sessionId })).ToList();
+    }
+
+    public async Task RemovePlayerFromSessionAsync(Guid sessionId, Guid groupId, Guid participantId)
+    {
+        await using var conn = await dataSource.OpenConnectionAsync();
+        await using var transaction = await conn.BeginTransactionAsync();
+
+        var session = await conn.QuerySingleOrDefaultAsync<WebSession>(
+            @"SELECT s.id, s.group_id AS GroupId, s.title, s.scheduled_at AS ScheduledAt, s.status, s.join_link AS JoinLink,
+                     s.batch_id AS BatchId, s.batch_message_id AS BatchMessageId,
+                     g.telegram_chat_id AS TelegramChatId,
+                     s.max_players AS MaxPlayers,
+                     0 AS ActivePlayerCount,
+                     0 AS WaitlistedPlayerCount,
+                     s.notification_mode AS NotificationMode
+              FROM sessions s
+              JOIN game_groups g ON g.id = s.group_id
+              WHERE s.id = @SessionId AND s.group_id = @GroupId
+              FOR UPDATE",
+            new { SessionId = sessionId, GroupId = groupId },
+            transaction);
+
+        if (session is null)
+        {
+            throw new SessionAccessDeniedException(sessionId, 0);
+        }
+
+        var participant = await conn.QuerySingleOrDefaultAsync<WebParticipant>(
+            """
+            SELECT sp.id AS Id,
+                   p.telegram_id AS TelegramId,
+                   p.display_name AS DisplayName,
+                   p.telegram_username AS TelegramUsername,
+                   sp.rsvp_status AS RsvpStatus,
+                   sp.registration_status AS RegistrationStatus,
+                   sp.is_gm AS IsGm,
+                   sp.responded_at AS RespondedAt
+            FROM session_participants sp
+            JOIN players p ON p.id = sp.player_id
+            WHERE sp.id = @ParticipantId AND sp.session_id = @SessionId
+            """,
+            new { ParticipantId = participantId, SessionId = sessionId },
+            transaction);
+
+        if (participant is null)
+        {
+            throw new InvalidOperationException("Участник не найден в этой сессии.");
+        }
+
+        bool wasActive = participant.RegistrationStatus == ParticipantRegistrationStatus.Active;
+
+        await conn.ExecuteAsync(
+            "DELETE FROM session_participants WHERE id = @ParticipantId",
+            new { ParticipantId = participantId },
+            transaction);
+
+        WebPromotedParticipantDto? promoted = null;
+
+        if (wasActive)
+        {
+            promoted = await conn.QuerySingleOrDefaultAsync<WebPromotedParticipantDto>(
+                """
+                SELECT sp.id AS ParticipantRowId,
+                       p.display_name AS DisplayName
+                FROM session_participants sp
+                JOIN players p ON p.id = sp.player_id
+                WHERE sp.session_id = @SessionId
+                  AND sp.is_gm = false
+                  AND sp.registration_status = @Waitlisted
+                ORDER BY sp.created_at ASC, sp.id ASC
+                LIMIT 1
+                FOR UPDATE OF sp
+                """,
+                new { SessionId = sessionId, Waitlisted = ParticipantRegistrationStatus.Waitlisted },
+                transaction);
+
+            if (promoted is not null)
+            {
+                await conn.ExecuteAsync(
+                    """
+                    UPDATE session_participants
+                    SET registration_status = @Active,
+                        rsvp_status = @Pending,
+                        responded_at = NULL
+                    WHERE id = @ParticipantRowId
+                    """,
+                    new
+                    {
+                        promoted.ParticipantRowId,
+                        Active = ParticipantRegistrationStatus.Active,
+                        Pending = RsvpStatus.Pending
+                    },
+                    transaction);
+            }
+        }
+
+        await transaction.CommitAsync();
+
+        await bot.SendMessage(
+            session.TelegramChatId,
+            $"🚪 <b>{System.Net.WebUtility.HtmlEncode(participant.DisplayName)}</b> удален(а) из сессии «{System.Net.WebUtility.HtmlEncode(session.Title)}».",
+            parseMode: Telegram.Bot.Types.Enums.ParseMode.Html);
+
+        if (promoted is not null)
+        {
+            await bot.SendMessage(
+                session.TelegramChatId,
+                $"⬆️ <b>{System.Net.WebUtility.HtmlEncode(promoted.DisplayName)}</b> переведен(а) из листа ожидания в основной состав «{System.Net.WebUtility.HtmlEncode(session.Title)}».",
+                parseMode: Telegram.Bot.Types.Enums.ParseMode.Html);
+
+            if (session.BatchMessageId.HasValue)
+            {
+                await TryUpdateBatchMessageAsync(session.BatchId, session.TelegramChatId, session.BatchMessageId.Value, session.Title);
+            }
+        }
+        else if (session.BatchMessageId.HasValue)
+        {
+            await TryUpdateBatchMessageAsync(session.BatchId, session.TelegramChatId, session.BatchMessageId.Value, session.Title);
+        }
+    }
+
     public async Task UpdateBatchDetailsAsync(Guid batchId, Guid groupId, string title, string joinLink)
     {
         await using var conn = await dataSource.OpenConnectionAsync();
@@ -1048,11 +1200,11 @@ public sealed class SessionService(
 
             var renderResult = SessionBatchRenderer.Render(title, sessions, participants);
 
-            await bot.EditMessageText(
+            await BatchMessageEditor.EditBatchMessageAsync(
+                bot,
                 chatId: chatId,
                 messageId: messageId,
                 text: renderResult.Text,
-                parseMode: Telegram.Bot.Types.Enums.ParseMode.Html,
                 replyMarkup: renderResult.Markup);
         }
         catch (Exception ex)

src/GmRelay.Web/Services/TelegramAuthService.cs

@@ -1,6 +1,7 @@
 using System.Security.Cryptography;
 using System.Text;
 using System.Text.Json;
+using System.Text.Json.Serialization;
 using Microsoft.AspNetCore.WebUtilities;
 
 namespace GmRelay.Web.Services;
@@ -113,6 +114,69 @@ public sealed class TelegramAuthService(IConfiguration configuration)
         return TryReadWebAppUser(userJson.ToString(), out telegramId, out name);
     }
 
+    public bool VerifyLoginPayload(TelegramLoginPayload payload, out long telegramId, out string name)
+    {
+        telegramId = 0;
+        name = string.Empty;
+
+        if (payload.Id <= 0 ||
+            string.IsNullOrWhiteSpace(payload.FirstName) ||
+            payload.AuthDate <= 0 ||
+            string.IsNullOrWhiteSpace(payload.Hash))
+        {
+            return false;
+        }
+
+        var token = configuration["Telegram__BotToken"] ?? configuration["Telegram:BotToken"];
+        if (string.IsNullOrEmpty(token))
+            return false;
+
+        var values = new SortedDictionary<string, string>(StringComparer.Ordinal)
+        {
+            ["auth_date"] = payload.AuthDate.ToString(System.Globalization.CultureInfo.InvariantCulture),
+            ["first_name"] = payload.FirstName,
+            ["id"] = payload.Id.ToString(System.Globalization.CultureInfo.InvariantCulture)
+        };
+
+        if (!string.IsNullOrWhiteSpace(payload.LastName))
+            values["last_name"] = payload.LastName;
+        if (!string.IsNullOrWhiteSpace(payload.PhotoUrl))
+            values["photo_url"] = payload.PhotoUrl;
+        if (!string.IsNullOrWhiteSpace(payload.Username))
+            values["username"] = payload.Username;
+
+        var dataCheckString = string.Join("\n", values.Select(pair => $"{pair.Key}={pair.Value}"));
+        var secretKey = SHA256.HashData(Encoding.UTF8.GetBytes(token));
+        var computedHashBytes = HMACSHA256.HashData(secretKey, Encoding.UTF8.GetBytes(dataCheckString));
+
+        byte[] hashBytes;
+        try
+        {
+            hashBytes = Convert.FromHexString(payload.Hash);
+        }
+        catch (FormatException)
+        {
+            return false;
+        }
+        catch (ArgumentException)
+        {
+            return false;
+        }
+
+        if (!CryptographicOperations.FixedTimeEquals(computedHashBytes, hashBytes))
+            return false;
+
+        var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+        if (now - payload.AuthDate > 86400)
+            return false;
+
+        telegramId = payload.Id;
+        name = string.IsNullOrWhiteSpace(payload.LastName)
+            ? payload.FirstName
+            : $"{payload.FirstName} {payload.LastName}";
+        return true;
+    }
+
     private static bool TryReadWebAppUser(string userJson, out long telegramId, out string name)
     {
         telegramId = 0;
@@ -152,3 +216,12 @@ public sealed class TelegramAuthService(IConfiguration configuration)
         }
     }
 }
+
+public sealed record TelegramLoginPayload(
+    [property: JsonPropertyName("id")] long Id,
+    [property: JsonPropertyName("first_name")] string FirstName,
+    [property: JsonPropertyName("last_name")] string? LastName,
+    [property: JsonPropertyName("username")] string? Username,
+    [property: JsonPropertyName("photo_url")] string? PhotoUrl,
+    [property: JsonPropertyName("auth_date")] long AuthDate,
+    [property: JsonPropertyName("hash")] string Hash);

src/GmRelay.Web/wwwroot/app.css

@@ -1,5 +1,5 @@
 /* ============================================
-   GM-Relay Design System v1.9.2
+   GM-Relay Design System v1.9.9
    Dark RPG Dashboard Theme
    ============================================ */
 
@@ -69,6 +69,21 @@
 
     /* Sidebar */
     --sidebar-width: 260px;
+
+    /* Telegram Mini App safe areas */
+    --gm-tg-safe-top: var(--tg-safe-area-inset-top, env(safe-area-inset-top, 0px));
+    --gm-tg-safe-right: var(--tg-safe-area-inset-right, env(safe-area-inset-right, 0px));
+    --gm-tg-safe-bottom: var(--tg-safe-area-inset-bottom, env(safe-area-inset-bottom, 0px));
+    --gm-tg-safe-left: var(--tg-safe-area-inset-left, env(safe-area-inset-left, 0px));
+    --gm-tg-content-safe-top: var(--tg-content-safe-area-inset-top, 0px);
+    --gm-tg-content-safe-right: var(--tg-content-safe-area-inset-right, 0px);
+    --gm-tg-content-safe-bottom: var(--tg-content-safe-area-inset-bottom, 0px);
+    --gm-tg-content-safe-left: var(--tg-content-safe-area-inset-left, 0px);
+    --gm-mini-app-top-inset: calc(var(--gm-tg-safe-top, 0px) + var(--gm-tg-content-safe-top, 0px));
+    --gm-mini-app-bottom-inset: calc(var(--gm-tg-safe-bottom, 0px) + var(--gm-tg-content-safe-bottom, 0px));
+    --gm-mini-app-left-inset: calc(var(--gm-tg-safe-left, 0px) + var(--gm-tg-content-safe-left, 0px));
+    --gm-mini-app-right-inset: calc(var(--gm-tg-safe-right, 0px) + var(--gm-tg-content-safe-right, 0px));
+    --gm-tg-viewport-height: 100dvh;
 }
 
 /* === Reset & Base === */
@@ -407,6 +422,46 @@ select option {
     border-bottom: none;
 }
 
+.session-table-desktop {
+    overflow-x: auto;
+    overflow-y: hidden;
+}
+
+.session-table-desktop-card {
+    padding: 0;
+}
+
+.session-table-desktop .gm-table {
+    min-width: 760px;
+}
+
+.session-table-desktop .gm-table th:last-child,
+.session-table-desktop .gm-table td:last-child {
+    width: 8.5rem;
+    min-width: 8.5rem;
+}
+
+.session-join-link {
+    display: inline-block;
+    max-width: 150px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.session-table-actions {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    flex-wrap: wrap;
+}
+
+.session-table-actions .btn-gm {
+    font-size: 0.8125rem;
+    padding: 0.375rem 0.75rem;
+    white-space: nowrap;
+}
+
 /* === Alerts === */
 .gm-alert {
     padding: 0.875rem 1.125rem;
@@ -845,6 +900,7 @@ select option {
 /* === Telegram Mini App entry === */
 .mini-app-page {
     min-height: 100vh;
+    min-height: var(--gm-tg-viewport-height, 100dvh);
     display: flex;
     align-items: center;
     justify-content: center;
@@ -882,12 +938,84 @@ select option {
     max-width: 720px;
 }
 
+body.telegram-mini-app {
+    min-height: var(--gm-tg-viewport-height, 100dvh);
+}
+
+body.telegram-mini-app .mini-app-page {
+    padding-top: calc(1rem + var(--gm-mini-app-top-inset, 0px));
+    padding-right: calc(1rem + var(--gm-mini-app-right-inset, 0px));
+    padding-bottom: calc(1rem + var(--gm-mini-app-bottom-inset, 0px));
+    padding-left: calc(1rem + var(--gm-mini-app-left-inset, 0px));
+}
+
+body.telegram-mini-app .content {
+    padding-bottom: calc(1.5rem + var(--gm-mini-app-bottom-inset, 0px));
+}
+
 /* === Mobile Sessions Cards (instead of table) === */
 .session-card-mobile {
     display: none;
 }
 
-@media (max-width: 768px) {
+body.telegram-mini-app .session-table-desktop {
+    display: none;
+}
+
+body.telegram-mini-app .session-card-mobile {
+    display: block;
+}
+
+.session-card {
+    background: var(--glass-bg);
+    backdrop-filter: blur(var(--glass-blur));
+    border: 1px solid var(--glass-border);
+    border-radius: var(--radius-md);
+    padding: 1rem;
+    margin-bottom: 0.75rem;
+    transition: all var(--transition-smooth);
+}
+
+.session-card:hover {
+    border-color: var(--border-glow);
+}
+
+.session-card-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: flex-start;
+    margin-bottom: 0.75rem;
+}
+
+.session-card-title {
+    font-weight: 600;
+    font-size: 0.9375rem;
+    color: var(--text-primary);
+}
+
+.session-card-body {
+    display: flex;
+    flex-direction: column;
+    gap: 0.5rem;
+    font-size: 0.8125rem;
+    color: var(--text-secondary);
+}
+
+.session-card-row {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+}
+
+.session-card-actions {
+    margin-top: 0.75rem;
+    padding-top: 0.75rem;
+    border-top: 1px solid var(--border-color);
+    display: flex;
+    gap: 0.5rem;
+}
+
+@media (max-width: 1024px) {
     .session-table-desktop {
         display: none;
     }
@@ -895,56 +1023,9 @@ select option {
     .session-card-mobile {
         display: block;
     }
+}
 
-    .session-card {
-        background: var(--glass-bg);
-        backdrop-filter: blur(var(--glass-blur));
-        border: 1px solid var(--glass-border);
-        border-radius: var(--radius-md);
-        padding: 1rem;
-        margin-bottom: 0.75rem;
-        transition: all var(--transition-smooth);
-    }
-
-    .session-card:hover {
-        border-color: var(--border-glow);
-    }
-
-    .session-card-header {
-        display: flex;
-        justify-content: space-between;
-        align-items: flex-start;
-        margin-bottom: 0.75rem;
-    }
-
-    .session-card-title {
-        font-weight: 600;
-        font-size: 0.9375rem;
-        color: var(--text-primary);
-    }
-
-    .session-card-body {
-        display: flex;
-        flex-direction: column;
-        gap: 0.5rem;
-        font-size: 0.8125rem;
-        color: var(--text-secondary);
-    }
-
-    .session-card-row {
-        display: flex;
-        justify-content: space-between;
-        align-items: center;
-    }
-
-    .session-card-actions {
-        margin-top: 0.75rem;
-        padding-top: 0.75rem;
-        border-top: 1px solid var(--border-color);
-        display: flex;
-        gap: 0.5rem;
-    }
-
+@media (max-width: 768px) {
     .card-grid {
         grid-template-columns: 1fr;
     }
@@ -970,12 +1051,24 @@ select option {
 
     .telegram-mini-app .content {
         padding: 0.75rem;
+        padding-bottom: calc(0.75rem + var(--gm-mini-app-bottom-inset, 0px));
     }
 
     .telegram-mini-app .page-container {
         padding: 0.75rem;
     }
 
+    body.telegram-mini-app .nav-header {
+        padding-top: calc(1.25rem + var(--gm-mini-app-top-inset, 0px));
+        padding-left: calc(1rem + var(--gm-mini-app-left-inset, 0px));
+        padding-right: calc(0.75rem + var(--gm-mini-app-right-inset, 0px));
+    }
+
+    body.telegram-mini-app .nav-toggle {
+        top: calc(0.75rem + var(--gm-mini-app-top-inset, 0px));
+        left: calc(0.75rem + var(--gm-mini-app-left-inset, 0px));
+    }
+
     h2 {
         font-size: 1.25rem;
     }
@@ -1022,3 +1115,56 @@ select option {
         padding: 1rem;
     }
 }
+
+/* === Participant list === */
+.participant-panel {
+    background: rgba(0, 0, 0, 0.2);
+    border-radius: 0.75rem;
+    padding: 0.75rem;
+    margin: 0.5rem 0;
+}
+
+.participant-list {
+    display: flex;
+    flex-direction: column;
+    gap: 0.5rem;
+}
+
+.participant-row {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    padding: 0.5rem 0.75rem;
+    background: rgba(255, 255, 255, 0.03);
+    border-radius: 0.5rem;
+    gap: 0.5rem;
+}
+
+.participant-info {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    flex-wrap: wrap;
+    flex: 1;
+}
+
+.participant-name {
+    font-weight: 500;
+    color: var(--text-primary);
+}
+
+.participant-username {
+    font-size: 0.75rem;
+    color: var(--text-muted);
+}
+
+.btn-gm-link {
+    background: transparent;
+    border: none;
+    color: var(--text-primary);
+    font-weight: 500;
+    cursor: pointer;
+    font-size: inherit;
+    font-family: inherit;
+    padding: 0;
+}

tests/GmRelay.Bot.Tests/Features/Landing/TelegramLandingPromisesSmokeTests.cs

@@ -0,0 +1,390 @@
+using GmRelay.Bot.Features.Sessions.CreateSession;
+using GmRelay.Bot.Features.Sessions.RescheduleSession;
+using GmRelay.Shared.Domain;
+using GmRelay.Shared.Rendering;
+using Telegram.Bot.Types.ReplyMarkups;
+
+namespace GmRelay.Bot.Tests.Features.Landing;
+
+public sealed class TelegramLandingPromisesSmokeTests
+{
+    [Fact]
+    public void Smoke_ShouldCoverTelegramLandingPromisesWithoutExternalTelegramApi()
+    {
+        var nowUtc = new DateTimeOffset(2026, 5, 1, 12, 0, 0, TimeSpan.Zero);
+        var parseResult = NewSessionCommandParser.Parse(BuildRecurringSessionCommand(), nowUtc);
+
+        Assert.True(parseResult.IsValid);
+        Assert.Equal(3, parseResult.ScheduledTimes.Count);
+        Assert.Equal(2, parseResult.MaxPlayers);
+        Assert.Equal(TimeSpan.FromDays(7), parseResult.ScheduledTimes[1] - parseResult.ScheduledTimes[0]);
+
+        var scenario = TelegramLandingSmokeScenario.Publish(parseResult, SessionNotificationMode.GroupAndDirect);
+        var publishedCallbacks = CallbackData(scenario.LastMessage.Markup);
+
+        Assert.Contains("Landing Promise Smoke", scenario.LastMessage.Text);
+        Assert.Equal(6, publishedCallbacks.Count);
+        Assert.All(scenario.Sessions, session =>
+        {
+            Assert.Contains($"join_session:{session.Id}", publishedCallbacks);
+            Assert.Contains($"leave_session:{session.Id}", publishedCallbacks);
+            Assert.Contains(session.ScheduledAt.FormatMoscow(), scenario.LastMessage.Text);
+        });
+
+        var firstSessionId = scenario.Sessions[0].Id;
+        var alice = scenario.Join(firstSessionId, 1001, "Alice", "alice");
+        var bob = scenario.Join(firstSessionId, 1002, "Bob", "bob");
+        var carol = scenario.Join(firstSessionId, 1003, "Carol", "carol");
+
+        Assert.Equal(ParticipantRegistrationStatus.Active, scenario.RegistrationStatus(firstSessionId, alice));
+        Assert.Equal(ParticipantRegistrationStatus.Active, scenario.RegistrationStatus(firstSessionId, bob));
+        Assert.Equal(ParticipantRegistrationStatus.Waitlisted, scenario.RegistrationStatus(firstSessionId, carol));
+        Assert.Contains("2/2", scenario.LastMessage.Text);
+        Assert.Contains("@alice", scenario.LastMessage.Text);
+        Assert.Contains("@bob", scenario.LastMessage.Text);
+        Assert.Contains("@carol", scenario.LastMessage.Text);
+
+        scenario.Leave(firstSessionId, alice);
+
+        Assert.False(scenario.HasParticipant(firstSessionId, alice));
+        Assert.Equal(ParticipantRegistrationStatus.Active, scenario.RegistrationStatus(firstSessionId, carol));
+        Assert.DoesNotContain("@alice", scenario.LastMessage.Text);
+        Assert.Contains("@carol", scenario.LastMessage.Text);
+
+        scenario.MarkRsvpConfirmed(firstSessionId, bob);
+        scenario.MarkRsvpConfirmed(firstSessionId, carol);
+
+        var option1Id = Guid.NewGuid();
+        var option2Id = Guid.NewGuid();
+        var options = new[]
+        {
+            new RescheduleOptionDto(option1Id, 1, new DateTimeOffset(2026, 5, 29, 16, 30, 0, TimeSpan.Zero)),
+            new RescheduleOptionDto(option2Id, 2, new DateTimeOffset(2026, 5, 30, 15, 0, 0, TimeSpan.Zero))
+        };
+        var deadline = new DateTimeOffset(2026, 5, 20, 18, 0, 0, TimeSpan.Zero);
+        var voteParticipants = scenario.ActiveVoteParticipants(firstSessionId);
+        var voteMessage = HandleRescheduleTimeInputHandler.BuildVotingMessage(
+            scenario.Title,
+            scenario.Sessions[0].ScheduledAt,
+            deadline,
+            options,
+            voteParticipants,
+            []);
+        var voteKeyboard = HandleRescheduleTimeInputHandler.BuildVotingKeyboard(options);
+
+        Assert.Contains("Landing Promise Smoke", voteMessage);
+        Assert.Contains("0/2", voteMessage);
+        Assert.Contains($"reschedule_vote:{option1Id}", CallbackData(voteKeyboard));
+        Assert.Contains($"reschedule_vote:{option2Id}", CallbackData(voteKeyboard));
+
+        var votes = voteParticipants
+            .Select(participant => new RescheduleOptionVoteDto(
+                option2Id,
+                participant.PlayerId,
+                participant.DisplayName,
+                participant.TelegramUsername))
+            .ToList();
+        var decision = RescheduleVoteRules.SelectWinner(
+            options.Select(option => new RescheduleOptionVoteCount(
+                option.OptionId,
+                votes.Count(vote => vote.OptionId == option.OptionId))).ToList());
+
+        Assert.Equal(RescheduleVoteOutcome.Approved, decision.Outcome);
+        Assert.Equal(option2Id, decision.SelectedOptionId);
+
+        scenario.ApplyReschedule(firstSessionId, options[1].ProposedAt);
+
+        Assert.Equal(options[1].ProposedAt.UtcDateTime, scenario.Sessions[0].ScheduledAt);
+        Assert.Equal(RsvpStatus.Pending, scenario.RsvpStatus(firstSessionId, bob));
+        Assert.Equal(RsvpStatus.Pending, scenario.RsvpStatus(firstSessionId, carol));
+        Assert.Contains(options[1].ProposedAt.UtcDateTime.FormatMoscow(), scenario.LastMessage.Text);
+        Assert.Collection(
+            scenario.Messenger.DirectMessages.Select(message => message.TelegramId).Order(),
+            telegramId => Assert.Equal(1002, telegramId),
+            telegramId => Assert.Equal(1003, telegramId));
+        Assert.All(scenario.Messenger.DirectMessages, message =>
+        {
+            Assert.Contains("Landing Promise Smoke", message.Text);
+            Assert.Contains(options[1].ProposedAt.UtcDateTime.FormatMoscow(), message.Text);
+        });
+
+        var editsBeforeDashboardUpdate = scenario.Messenger.Edits.Count;
+
+        scenario.UpdateBatchFromDashboard("Landing Promise Smoke - Dashboard Sync");
+
+        Assert.True(scenario.Messenger.Edits.Count > editsBeforeDashboardUpdate);
+        Assert.Contains("Landing Promise Smoke - Dashboard Sync", scenario.LastMessage.Text);
+        Assert.Contains("@bob", scenario.LastMessage.Text);
+        Assert.Contains("@carol", scenario.LastMessage.Text);
+    }
+
+    private static string BuildRecurringSessionCommand() =>
+        string.Join(
+            '\n',
+            "/newsession",
+            "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435: Landing Promise Smoke",
+            "\u0412\u0440\u0435\u043c\u044f: 15.05.2026 19:30",
+            "\u0418\u0433\u0440: 3",
+            "\u0418\u043d\u0442\u0435\u0440\u0432\u0430\u043b: 7",
+            "\u041c\u0435\u0441\u0442: 2",
+            "\u0421\u0441\u044b\u043b\u043a\u0430: https://example.test/table");
+
+    private static IReadOnlyList<string> CallbackData(InlineKeyboardMarkup markup) =>
+        markup.InlineKeyboard
+            .SelectMany(row => row)
+            .Select(button => button.CallbackData)
+            .OfType<string>()
+            .ToList();
+
+    private sealed class TelegramLandingSmokeScenario
+    {
+        private readonly List<SmokeSession> sessions;
+        private readonly List<SmokeParticipant> participants = [];
+        private readonly SessionNotificationMode notificationMode;
+
+        private TelegramLandingSmokeScenario(
+            string title,
+            IReadOnlyList<DateTimeOffset> scheduledTimes,
+            int? maxPlayers,
+            SessionNotificationMode notificationMode)
+        {
+            Title = title;
+            this.notificationMode = notificationMode;
+            sessions = scheduledTimes
+                .Select(scheduledAt => new SmokeSession(
+                    Guid.NewGuid(),
+                    scheduledAt.UtcDateTime,
+                    SessionStatus.Planned,
+                    maxPlayers))
+                .ToList();
+        }
+
+        public string Title { get; private set; }
+        public FakeTelegramMessenger Messenger { get; } = new();
+        public IReadOnlyList<SmokeSession> Sessions => sessions;
+        public FakeTelegramMessage LastMessage => Messenger.LastMessage;
+
+        public static TelegramLandingSmokeScenario Publish(
+            NewSessionParseResult parseResult,
+            SessionNotificationMode notificationMode)
+        {
+            var scenario = new TelegramLandingSmokeScenario(
+                parseResult.Title!,
+                parseResult.ScheduledTimes,
+                parseResult.MaxPlayers,
+                notificationMode);
+
+            scenario.RenderBatch();
+            return scenario;
+        }
+
+        public Guid Join(Guid sessionId, long telegramId, string displayName, string? telegramUsername)
+        {
+            var session = sessions.Single(value => value.Id == sessionId);
+            var activeParticipants = participants.Count(participant =>
+                participant.SessionId == sessionId &&
+                participant.RegistrationStatus == ParticipantRegistrationStatus.Active);
+            var registrationStatus = SessionCapacityRules.DecideJoinStatus(
+                session.MaxPlayers,
+                activeParticipants);
+            var playerId = Guid.NewGuid();
+
+            participants.Add(new SmokeParticipant(
+                sessionId,
+                playerId,
+                telegramId,
+                displayName,
+                telegramUsername,
+                registrationStatus,
+                GmRelay.Shared.Domain.RsvpStatus.Pending,
+                participants.Count));
+
+            RenderBatch();
+            return playerId;
+        }
+
+        public void Leave(Guid sessionId, Guid playerId)
+        {
+            var participant = participants.Single(value =>
+                value.SessionId == sessionId &&
+                value.PlayerId == playerId);
+            participants.Remove(participant);
+
+            var session = sessions.Single(value => value.Id == sessionId);
+            var activeParticipantsAfterLeave = participants.Count(value =>
+                value.SessionId == sessionId &&
+                value.RegistrationStatus == ParticipantRegistrationStatus.Active);
+            var waitlistedParticipants = participants.Count(value =>
+                value.SessionId == sessionId &&
+                value.RegistrationStatus == ParticipantRegistrationStatus.Waitlisted);
+
+            if (SessionCapacityRules.ShouldPromoteAfterParticipantLeaves(
+                    participant.RegistrationStatus,
+                    session.MaxPlayers,
+                    activeParticipantsAfterLeave,
+                    waitlistedParticipants))
+            {
+                var promoted = participants
+                    .Where(value =>
+                        value.SessionId == sessionId &&
+                        value.RegistrationStatus == ParticipantRegistrationStatus.Waitlisted)
+                    .OrderBy(value => value.JoinOrder)
+                    .First();
+
+                promoted.RegistrationStatus = ParticipantRegistrationStatus.Active;
+                promoted.RsvpStatus = GmRelay.Shared.Domain.RsvpStatus.Pending;
+            }
+
+            RenderBatch();
+        }
+
+        public bool HasParticipant(Guid sessionId, Guid playerId) =>
+            participants.Any(value => value.SessionId == sessionId && value.PlayerId == playerId);
+
+        public string RegistrationStatus(Guid sessionId, Guid playerId) =>
+            participants.Single(value =>
+                value.SessionId == sessionId &&
+                value.PlayerId == playerId).RegistrationStatus;
+
+        public string RsvpStatus(Guid sessionId, Guid playerId) =>
+            participants.Single(value =>
+                value.SessionId == sessionId &&
+                value.PlayerId == playerId).RsvpStatus;
+
+        public void MarkRsvpConfirmed(Guid sessionId, Guid playerId)
+        {
+            participants.Single(value =>
+                value.SessionId == sessionId &&
+                value.PlayerId == playerId).RsvpStatus = GmRelay.Shared.Domain.RsvpStatus.Confirmed;
+        }
+
+        public IReadOnlyList<VoteParticipantDto> ActiveVoteParticipants(Guid sessionId) =>
+            participants
+                .Where(value =>
+                    value.SessionId == sessionId &&
+                    value.RegistrationStatus == ParticipantRegistrationStatus.Active)
+                .OrderBy(value => value.DisplayName)
+                .Select(value => new VoteParticipantDto(
+                    value.PlayerId,
+                    value.DisplayName,
+                    value.TelegramUsername,
+                    value.TelegramId))
+                .ToList();
+
+        public void ApplyReschedule(Guid sessionId, DateTimeOffset newScheduledAt)
+        {
+            sessions.Single(value => value.Id == sessionId).ScheduledAt = newScheduledAt.UtcDateTime;
+
+            foreach (var participant in participants.Where(value =>
+                         value.SessionId == sessionId &&
+                         value.RegistrationStatus == ParticipantRegistrationStatus.Active))
+            {
+                participant.RsvpStatus = GmRelay.Shared.Domain.RsvpStatus.Pending;
+            }
+
+            RenderBatch();
+
+            if (!notificationMode.ShouldSendDirectMessages())
+            {
+                return;
+            }
+
+            var notification = $"""
+                Reschedule approved
+                {Title}
+                {newScheduledAt.UtcDateTime.FormatMoscow()}
+                """;
+            foreach (var participant in participants.Where(value =>
+                         value.SessionId == sessionId &&
+                         value.RegistrationStatus == ParticipantRegistrationStatus.Active))
+            {
+                Messenger.SendDirectMessage(participant.TelegramId, notification);
+            }
+        }
+
+        public void UpdateBatchFromDashboard(string title)
+        {
+            Title = title;
+            RenderBatch();
+        }
+
+        private void RenderBatch()
+        {
+            var renderResult = SessionBatchRenderer.Render(
+                Title,
+                sessions
+                    .Select(session => new SessionBatchDto(
+                        session.Id,
+                        session.ScheduledAt,
+                        session.Status,
+                        session.MaxPlayers))
+                    .ToList(),
+                participants
+                    .Select(participant => new ParticipantBatchDto(
+                        participant.SessionId,
+                        participant.DisplayName,
+                        participant.TelegramUsername,
+                        participant.RegistrationStatus))
+                    .ToList());
+
+            if (Messenger.HasPublishedMessage)
+            {
+                Messenger.EditBatchMessage(renderResult.Text, renderResult.Markup);
+            }
+            else
+            {
+                Messenger.PublishBatchMessage(renderResult.Text, renderResult.Markup);
+            }
+        }
+    }
+
+    private sealed class FakeTelegramMessenger
+    {
+        private const int BatchMessageId = 7001;
+
+        public List<FakeTelegramMessage> Sends { get; } = [];
+        public List<FakeTelegramMessage> Edits { get; } = [];
+        public List<FakeDirectMessage> DirectMessages { get; } = [];
+        public bool HasPublishedMessage => Sends.Count > 0;
+        public FakeTelegramMessage LastMessage => Edits.Count > 0 ? Edits[^1] : Sends[^1];
+
+        public void PublishBatchMessage(string text, InlineKeyboardMarkup markup) =>
+            Sends.Add(new FakeTelegramMessage(BatchMessageId, text, markup));
+
+        public void EditBatchMessage(string text, InlineKeyboardMarkup markup) =>
+            Edits.Add(new FakeTelegramMessage(BatchMessageId, text, markup));
+
+        public void SendDirectMessage(long telegramId, string text) =>
+            DirectMessages.Add(new FakeDirectMessage(telegramId, text));
+    }
+
+    private sealed record FakeTelegramMessage(
+        int MessageId,
+        string Text,
+        InlineKeyboardMarkup Markup);
+
+    private sealed record FakeDirectMessage(long TelegramId, string Text);
+
+    private sealed record SmokeSession(
+        Guid Id,
+        DateTime ScheduledAt,
+        string Status,
+        int? MaxPlayers)
+    {
+        public DateTime ScheduledAt { get; set; } = ScheduledAt;
+    }
+
+    private sealed record SmokeParticipant(
+        Guid SessionId,
+        Guid PlayerId,
+        long TelegramId,
+        string DisplayName,
+        string? TelegramUsername,
+        string RegistrationStatus,
+        string RsvpStatus,
+        int JoinOrder)
+    {
+        public string RegistrationStatus { get; set; } = RegistrationStatus;
+        public string RsvpStatus { get; set; } = RsvpStatus;
+    }
+}

tests/GmRelay.Bot.Tests/Features/Sessions/CreateSession/NewSessionCommandParserTests.cs

@@ -1,4 +1,5 @@
 using GmRelay.Bot.Features.Sessions.CreateSession;
+using Telegram.Bot.Types;
 
 namespace GmRelay.Bot.Tests.Features.Sessions.CreateSession;
 
@@ -33,6 +34,43 @@ public sealed class NewSessionCommandParserTests
         Assert.Empty(result.InvalidTimeInputs);
     }
 
+    [Fact]
+    public void Parse_ShouldExtractOptionalImageUrl()
+    {
+        var nowUtc = new DateTimeOffset(2026, 4, 23, 12, 0, 0, TimeSpan.Zero);
+        var text = """
+            /newsession
+            Название: Curse of Strahd
+            Время: 24.04.2026 19:30
+            Ссылка: https://example.test/room
+            Картинка: https://example.test/strahd.jpg
+            """;
+
+        var result = NewSessionCommandParser.Parse(text, nowUtc);
+
+        Assert.True(result.IsValid);
+        Assert.Equal("https://example.test/strahd.jpg", result.ImageUrl);
+    }
+
+    [Fact]
+    public void GetBatchImageReference_ShouldPreferAttachedPhotoOverParsedUrl()
+    {
+        var message = new Message
+        {
+            Photo =
+            [
+                new PhotoSize { FileId = "small-photo", Width = 320, Height = 180, FileSize = 10 },
+                new PhotoSize { FileId = "large-photo", Width = 1280, Height = 720, FileSize = 20 }
+            ]
+        };
+
+        var imageReference = CreateSessionHandler.GetBatchImageReference(
+            message,
+            "https://example.test/cover.jpg");
+
+        Assert.Equal("large-photo", imageReference);
+    }
+
     [Fact]
     public void Parse_ShouldExpandRecurringSchedule_WhenRepeatCountAndIntervalProvided()
     {

tests/GmRelay.Bot.Tests/Features/Sessions/ListSessions/SessionListMessageRendererTests.cs

@@ -0,0 +1,58 @@
+using GmRelay.Bot.Features.Sessions.ListSessions;
+using GmRelay.Shared.Domain;
+
+namespace GmRelay.Bot.Tests.Features.Sessions.ListSessions;
+
+public sealed class SessionListMessageRendererTests
+{
+    [Fact]
+    public void Render_ShouldIncludeManagerActions_WhenUserCanManage()
+    {
+        var sessionId = Guid.NewGuid();
+        var sessions = new[]
+        {
+            new SessionListItemDto(
+                sessionId,
+                "Ravenloft",
+                new DateTime(2026, 5, 7, 16, 30, 0, DateTimeKind.Utc),
+                SessionStatus.Planned,
+                4,
+                3,
+                1,
+                true)
+        };
+
+        var result = SessionListMessageRenderer.Render(sessions);
+        Assert.NotNull(result.Markup);
+        var buttons = result.Markup.InlineKeyboard.SelectMany(row => row).ToList();
+
+        Assert.Contains("Ravenloft", result.Text);
+        Assert.Collection(
+            buttons.Select(button => button.CallbackData),
+            callbackData => Assert.Equal($"cancel_session:{sessionId}", callbackData),
+            callbackData => Assert.Equal($"reschedule_session:{sessionId}", callbackData),
+            callbackData => Assert.Equal($"promote_waitlist:{sessionId}", callbackData),
+            callbackData => Assert.Equal($"delete_session:{sessionId}", callbackData));
+    }
+
+    [Fact]
+    public void Render_ShouldHideManagerActions_WhenUserCannotManage()
+    {
+        var sessions = new[]
+        {
+            new SessionListItemDto(
+                Guid.NewGuid(),
+                "Ravenloft",
+                new DateTime(2026, 5, 7, 16, 30, 0, DateTimeKind.Utc),
+                SessionStatus.Planned,
+                4,
+                3,
+                1,
+                false)
+        };
+
+        var result = SessionListMessageRenderer.Render(sessions);
+
+        Assert.Null(result.Markup);
+    }
+}

tests/GmRelay.Bot.Tests/Infrastructure/Telegram/UpdateRouterTests.cs

@@ -0,0 +1,23 @@
+using GmRelay.Bot.Infrastructure.Telegram;
+using Telegram.Bot.Types;
+
+namespace GmRelay.Bot.Tests.Infrastructure.Telegram;
+
+public sealed class UpdateRouterTests
+{
+    [Fact]
+    public void GetCommandText_ShouldUseCaption_WhenMessageHasNoText()
+    {
+        var message = new Message
+        {
+            Caption = """
+                /newsession
+                Название: Curse of Strahd
+                """
+        };
+
+        var commandText = UpdateRouter.GetCommandText(message);
+
+        Assert.StartsWith("/newsession", commandText);
+    }
+}

tests/GmRelay.Bot.Tests/Rendering/SessionBatchRendererTests.cs

@@ -42,17 +42,15 @@ public sealed class SessionBatchRendererTests
         Assert.Contains("Лист ожидания (1)", text);
         Assert.Contains("Charlie", text);
         Assert.Contains("Bob", text);
-        Assert.Equal(4, result.Markup.InlineKeyboard.Count());
+        Assert.Equal(2, result.Markup.InlineKeyboard.Count());
         Assert.Collection(
             buttons.Select(button => button.CallbackData),
             callbackData => Assert.Equal($"join_session:{firstSessionId}", callbackData),
             callbackData => Assert.Equal($"leave_session:{firstSessionId}", callbackData),
-            callbackData => Assert.Equal($"cancel_session:{firstSessionId}", callbackData),
-            callbackData => Assert.Equal($"reschedule_session:{firstSessionId}", callbackData),
             callbackData => Assert.Equal($"join_session:{secondSessionId}", callbackData),
-            callbackData => Assert.Equal($"leave_session:{secondSessionId}", callbackData),
-            callbackData => Assert.Equal($"cancel_session:{secondSessionId}", callbackData),
-            callbackData => Assert.Equal($"reschedule_session:{secondSessionId}", callbackData),
-            callbackData => Assert.Equal($"promote_waitlist:{secondSessionId}", callbackData));
+            callbackData => Assert.Equal($"leave_session:{secondSessionId}", callbackData));
+        Assert.DoesNotContain(buttons, button => button.CallbackData?.StartsWith("cancel_session:", StringComparison.Ordinal) == true);
+        Assert.DoesNotContain(buttons, button => button.CallbackData?.StartsWith("reschedule_session:", StringComparison.Ordinal) == true);
+        Assert.DoesNotContain(buttons, button => button.CallbackData?.StartsWith("promote_waitlist:", StringComparison.Ordinal) == true);
     }
 }

tests/GmRelay.Bot.Tests/Web/AuthorizedSessionServiceTests.cs

@@ -655,6 +655,10 @@ public sealed class AuthorizedSessionServiceTests
         public string? LastAddedCoGmUsername { get; private set; }
         public Guid? LastRemovedCoGmGroupId { get; private set; }
         public long? LastRemovedCoGmTelegramId { get; private set; }
+        public bool RemovePlayerCalled { get; private set; }
+        public Guid? LastRemovedPlayerSessionId { get; private set; }
+        public Guid? LastRemovedPlayerGroupId { get; private set; }
+        public Guid? LastRemovedPlayerParticipantId { get; private set; }
 
         public Task<List<WebGameGroup>> GetGroupsForGmAsync(long gmId) =>
             Task.FromResult(groupsById.Values.Where(group => IsManager(group.Id, gmId)).ToList());
@@ -870,6 +874,18 @@ public sealed class AuthorizedSessionServiceTests
             return Task.CompletedTask;
         }
 
+        public Task<List<WebParticipant>> GetSessionParticipantsAsync(Guid sessionId) =>
+            Task.FromResult(new List<WebParticipant>());
+
+        public Task RemovePlayerFromSessionAsync(Guid sessionId, Guid groupId, Guid participantId)
+        {
+            RemovePlayerCalled = true;
+            LastRemovedPlayerSessionId = sessionId;
+            LastRemovedPlayerGroupId = groupId;
+            LastRemovedPlayerParticipantId = participantId;
+            return Task.CompletedTask;
+        }
+
         private bool IsManager(Guid groupId, long telegramId) =>
             IsOwner(groupId, telegramId) ||
             managers.Any(manager => manager.GroupId == groupId && manager.TelegramId == telegramId);

tests/GmRelay.Bot.Tests/Web/CampaignTemplatesNavigationTests.cs

@@ -1,3 +1,5 @@
+using System.Xml.Linq;
+
 namespace GmRelay.Bot.Tests.Web;
 
 public sealed class CampaignTemplatesNavigationTests
@@ -11,6 +13,20 @@ public sealed class CampaignTemplatesNavigationTests
         Assert.Contains("Шаблоны", navMenu, StringComparison.Ordinal);
     }
 
+    [Fact]
+    public async Task NavMenu_ShouldExposeCurrentProjectVersion()
+    {
+        var navMenu = await File.ReadAllTextAsync(FindRepositoryFile("src/GmRelay.Web/Components/Layout/NavMenu.razor"));
+        var props = XDocument.Load(FindRepositoryFile("Directory.Build.props"));
+        var version = props.Root?
+            .Element("PropertyGroup")?
+            .Element("Version")?
+            .Value;
+
+        Assert.False(string.IsNullOrWhiteSpace(version));
+        Assert.Contains($"v{version}", navMenu, StringComparison.Ordinal);
+    }
+
     [Fact]
     public async Task NavMenuStyles_ShouldStyleNavLinkAnchorsAsStackedRows()
     {

tests/GmRelay.Bot.Tests/Web/MiniAppDashboardTests.cs

@@ -12,6 +12,10 @@ public sealed class MiniAppDashboardTests
         Assert.Contains("/auth/telegram-webapp", miniAppPage, StringComparison.Ordinal);
         Assert.Contains("watchTelegramMiniAppLogin", miniAppPage, StringComparison.Ordinal);
         Assert.Contains("/auth/status", miniAppPage, StringComparison.Ordinal);
+        Assert.Contains("miniAppAuthStatus", miniAppPage, StringComparison.Ordinal);
+        Assert.Contains("telegram-webapp-missing", miniAppPage, StringComparison.Ordinal);
+        Assert.Contains("telegram-init-data-empty", miniAppPage, StringComparison.Ordinal);
+        Assert.Contains("telegram-auth-failed", miniAppPage, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -24,10 +28,18 @@ public sealed class MiniAppDashboardTests
         Assert.Contains("Telegram.WebApp.initData", appShell, StringComparison.Ordinal);
         Assert.Contains("window.waitForTelegramMiniAppInitData", appShell, StringComparison.Ordinal);
         Assert.Contains("window.watchTelegramMiniAppLogin", appShell, StringComparison.Ordinal);
+        Assert.Contains("window.handleTelegramLogin", appShell, StringComparison.Ordinal);
+        Assert.Contains("/auth/telegram-login", appShell, StringComparison.Ordinal);
+        Assert.Contains("data-onauth", appShell, StringComparison.Ordinal);
+        Assert.DoesNotContain("data-auth-url", appShell, StringComparison.Ordinal);
         Assert.Contains("setTimeout(resolve, 100)", appShell, StringComparison.Ordinal);
         Assert.Contains("reloadOnReturn", appShell, StringComparison.Ordinal);
         Assert.Contains("gmRelayMiniAppLoginLeftPage", appShell, StringComparison.Ordinal);
         Assert.Contains("window.location.reload()", appShell, StringComparison.Ordinal);
+        Assert.Contains("syncTelegramMiniAppViewport", appShell, StringComparison.Ordinal);
+        Assert.Contains("safeAreaChanged", appShell, StringComparison.Ordinal);
+        Assert.Contains("contentSafeAreaChanged", appShell, StringComparison.Ordinal);
+        Assert.Contains("viewportChanged", appShell, StringComparison.Ordinal);
     }
 
     [Fact]
@@ -36,7 +48,9 @@ public sealed class MiniAppDashboardTests
         var program = await File.ReadAllTextAsync(FindRepositoryFile("src/GmRelay.Web/Program.cs"));
 
         Assert.Contains("MapPost(\"/auth/telegram-webapp\"", program, StringComparison.Ordinal);
+        Assert.Contains("MapPost(\"/auth/telegram-login\"", program, StringComparison.Ordinal);
         Assert.Contains("VerifyWebAppInitData", program, StringComparison.Ordinal);
+        Assert.Contains("VerifyLoginPayload", program, StringComparison.Ordinal);
         Assert.Contains("MapGet(\"/auth/status\"", program, StringComparison.Ordinal);
         Assert.Contains("authenticated", program, StringComparison.Ordinal);
     }
@@ -49,15 +63,24 @@ public sealed class MiniAppDashboardTests
         Assert.Contains("mini-app-page", css, StringComparison.Ordinal);
         Assert.Contains("mini-app-auth-card", css, StringComparison.Ordinal);
         Assert.Contains("@media (max-width: 768px)", css, StringComparison.Ordinal);
+        Assert.Contains("--tg-safe-area-inset-top", css, StringComparison.Ordinal);
+        Assert.Contains("--tg-content-safe-area-inset-top", css, StringComparison.Ordinal);
+        Assert.Contains(".telegram-mini-app .nav-header", css, StringComparison.Ordinal);
+        Assert.Contains(".telegram-mini-app .nav-toggle", css, StringComparison.Ordinal);
+        Assert.Contains(".telegram-mini-app .mini-app-page", css, StringComparison.Ordinal);
     }
 
     [Fact]
-    public async Task LoginPage_ShouldRefreshMiniAppAfterExternalTelegramLogin()
+    public async Task LoginPage_ShouldAuthenticateMiniAppFallbackInsideCurrentWebView()
     {
         var loginPage = await File.ReadAllTextAsync(FindRepositoryFile("src/GmRelay.Web/Components/Pages/Login.razor"));
 
         Assert.Contains(
-            "JS.InvokeVoidAsync(\"watchTelegramMiniAppLogin\", \"/auth/status\", \"/\", true)",
+            "JS.InvokeVoidAsync(\"loadTelegramWidget\", BotUsername, \"/auth/telegram-login\")",
+            loginPage,
+            StringComparison.Ordinal);
+        Assert.Contains(
+            "JS.InvokeVoidAsync(\"watchTelegramMiniAppLogin\", \"/auth/status\", \"/\", false)",
             loginPage,
             StringComparison.Ordinal);
     }

tests/GmRelay.Bot.Tests/Web/TelegramAuthServiceTests.cs

@@ -1,5 +1,6 @@
 using System.Security.Cryptography;
 using System.Text;
+using System.Text.Json;
 using GmRelay.Web.Services;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Configuration;
@@ -135,6 +136,125 @@ public sealed class TelegramAuthServiceTests
         Assert.False(verified);
     }
 
+    [Fact]
+    public void VerifyLoginPayload_ShouldAcceptValidTelegramWidgetCallbackPayload()
+    {
+        const string botToken = "test-bot-token";
+        var authDate = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+        var values = new Dictionary<string, string>
+        {
+            ["auth_date"] = authDate.ToString(),
+            ["first_name"] = "Ada",
+            ["id"] = "424242",
+            ["last_name"] = "Lovelace",
+            ["photo_url"] = "https://t.me/i/userpic/320/ada.jpg",
+            ["username"] = "ada"
+        };
+        var payload = new TelegramLoginPayload(
+            424242,
+            "Ada",
+            "Lovelace",
+            "ada",
+            "https://t.me/i/userpic/320/ada.jpg",
+            authDate,
+            ComputeTelegramHash(botToken, values));
+        var service = new TelegramAuthService(CreateConfiguration(botToken));
+
+        var verified = service.VerifyLoginPayload(payload, out var telegramId, out var name);
+
+        Assert.True(verified);
+        Assert.Equal(424242L, telegramId);
+        Assert.Equal("Ada Lovelace", name);
+    }
+
+    [Fact]
+    public void VerifyLoginPayload_ShouldRejectTamperedCallbackHash()
+    {
+        var payload = new TelegramLoginPayload(
+            424242,
+            "Ada",
+            null,
+            null,
+            null,
+            DateTimeOffset.UtcNow.ToUnixTimeSeconds(),
+            "00");
+        var service = new TelegramAuthService(CreateConfiguration("test-bot-token"));
+
+        var verified = service.VerifyLoginPayload(payload, out _, out _);
+
+        Assert.False(verified);
+    }
+
+    [Fact]
+    public void VerifyLoginPayload_ShouldRejectExpiredCallbackPayload()
+    {
+        const string botToken = "test-bot-token";
+        var authDate = DateTimeOffset.UtcNow.AddDays(-2).ToUnixTimeSeconds();
+        var values = new Dictionary<string, string>
+        {
+            ["auth_date"] = authDate.ToString(),
+            ["first_name"] = "Ada",
+            ["id"] = "424242"
+        };
+        var payload = new TelegramLoginPayload(
+            424242,
+            "Ada",
+            null,
+            null,
+            null,
+            authDate,
+            ComputeTelegramHash(botToken, values));
+        var service = new TelegramAuthService(CreateConfiguration(botToken));
+
+        var verified = service.VerifyLoginPayload(payload, out _, out _);
+
+        Assert.False(verified);
+    }
+
+    [Fact]
+    public void VerifyLoginPayload_ShouldRejectMissingRequiredCallbackFields()
+    {
+        var payload = new TelegramLoginPayload(
+            0,
+            "",
+            null,
+            null,
+            null,
+            DateTimeOffset.UtcNow.ToUnixTimeSeconds(),
+            "");
+        var service = new TelegramAuthService(CreateConfiguration("test-bot-token"));
+
+        var verified = service.VerifyLoginPayload(payload, out _, out _);
+
+        Assert.False(verified);
+    }
+
+    [Fact]
+    public void TelegramLoginPayload_ShouldDeserializeTelegramWidgetSnakeCaseJson()
+    {
+        var payload = JsonSerializer.Deserialize<TelegramLoginPayload>(
+            """
+            {
+              "id": 424242,
+              "first_name": "Ada",
+              "last_name": "Lovelace",
+              "username": "ada",
+              "photo_url": "https://t.me/i/userpic/320/ada.jpg",
+              "auth_date": 1714300000,
+              "hash": "abcdef"
+            }
+            """);
+
+        Assert.NotNull(payload);
+        Assert.Equal(424242L, payload.Id);
+        Assert.Equal("Ada", payload.FirstName);
+        Assert.Equal("Lovelace", payload.LastName);
+        Assert.Equal("ada", payload.Username);
+        Assert.Equal("https://t.me/i/userpic/320/ada.jpg", payload.PhotoUrl);
+        Assert.Equal(1714300000L, payload.AuthDate);
+        Assert.Equal("abcdef", payload.Hash);
+    }
+
     private static IConfiguration CreateConfiguration(string botToken) =>
         new ConfigurationBuilder()
             .AddInMemoryCollection(new Dictionary<string, string?>

tests/GmRelay.Bot.Tests/Web/WebStylesTests.cs

@@ -12,6 +12,69 @@ public sealed class WebStylesTests
             css);
     }
 
+    [Fact]
+    public async Task AppCss_ShouldReserveTelegramMiniAppSafeAreaForMobileChrome()
+    {
+        var appCss = await File.ReadAllTextAsync(FindRepositoryFile("src/GmRelay.Web/wwwroot/app.css"));
+        Assert.Contains("--gm-tg-safe-top", appCss, StringComparison.Ordinal);
+        Assert.Contains("--tg-safe-area-inset-top", appCss, StringComparison.Ordinal);
+        Assert.Contains("--tg-content-safe-area-inset-top", appCss, StringComparison.Ordinal);
+        Assert.Contains("env(safe-area-inset-top", appCss, StringComparison.Ordinal);
+        Assert.Contains(".telegram-mini-app .content", appCss, StringComparison.Ordinal);
+        Assert.Contains(".telegram-mini-app .nav-header", appCss, StringComparison.Ordinal);
+        Assert.Contains(".telegram-mini-app .nav-toggle", appCss, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task AppCss_ShouldKeepDesktopSessionActionsReadableWhenTableOverflows()
+    {
+        var appCss = await File.ReadAllTextAsync(FindRepositoryFile("src/GmRelay.Web/wwwroot/app.css"));
+
+        Assert.Matches(
+            @"\.session-table-desktop\s*\{[\s\S]*overflow-x:\s*auto;",
+            appCss);
+        Assert.Matches(
+            @"\.session-table-desktop\s+\.gm-table\s*\{[\s\S]*min-width:\s*760px;",
+            appCss);
+        Assert.Matches(
+            @"\.session-table-actions\s+\.btn-gm\s*\{[\s\S]*white-space:\s*nowrap;",
+            appCss);
+    }
+
+    [Fact]
+    public async Task AppCss_ShouldUseCardSessionLayoutInsideTelegramMiniApp()
+    {
+        var appCss = await File.ReadAllTextAsync(FindRepositoryFile("src/GmRelay.Web/wwwroot/app.css"));
+
+        Assert.Matches(
+            @"body\.telegram-mini-app\s+\.session-table-desktop\s*\{[\s\S]*display:\s*none;",
+            appCss);
+        Assert.Matches(
+            @"body\.telegram-mini-app\s+\.session-card-mobile\s*\{[\s\S]*display:\s*block;",
+            appCss);
+    }
+
+    [Fact]
+    public async Task AppCss_ShouldUseCardSessionLayoutWhenDesktopSidebarLeavesNarrowContent()
+    {
+        var appCss = await File.ReadAllTextAsync(FindRepositoryFile("src/GmRelay.Web/wwwroot/app.css"));
+
+        Assert.Matches(
+            @"@media\s*\(max-width:\s*1024px\)\s*\{[\s\S]*\.session-table-desktop\s*\{[\s\S]*display:\s*none;[\s\S]*\.session-card-mobile\s*\{[\s\S]*display:\s*block;",
+            appCss);
+    }
+
+    [Fact]
+    public async Task GroupDetailsPage_ShouldUseSessionTableLayoutClasses()
+    {
+        var groupDetailsPage = await File.ReadAllTextAsync(FindRepositoryFile("src/GmRelay.Web/Components/Pages/GroupDetails.razor"));
+
+        Assert.Contains("session-table-desktop-card", groupDetailsPage, StringComparison.Ordinal);
+        Assert.Contains("session-table-actions", groupDetailsPage, StringComparison.Ordinal);
+        Assert.Contains("session-join-link", groupDetailsPage, StringComparison.Ordinal);
+        Assert.DoesNotContain("overflow: hidden", groupDetailsPage, StringComparison.Ordinal);
+    }
+
     private static string FindRepositoryFile(string relativePath)
     {
         var directory = new DirectoryInfo(AppContext.BaseDirectory);