v4.2.0: wire the GUI to the core, transport and all four games

Phase 4. The egui frontend now shares ClientCore and the client database with the terminal: one background worker owns TLS, trust answers go through a channel, and a 10 s request deadline mirrors the terminal socket timeout. First contact, a changed key and a version mismatch are explicit screens; login can remember the credential and auto-login signs in before the login form appears.

Adds the lobby with an update notice, a full-width scrollable history table, and the four games painted from View: slots with reel animation and win lines that stop at the last matching reel, roulette with the hover lattice and wheel spin, blackjack with vector-drawn suits, and a smooth crash curve. Sidebars pin their action block; leaving a live hand or round asks before forfeiting.

The header balance holds the staked amount while the reels or wheel turn and only shows the payout when they stop. Refused spins cancel the animation. Live crash multipliers keep full precision for the chart; the terminal still displays two decimals.

Verified live against a 4.2.0 server: register, login, auto-login, trust, all four games settling, history (50 rows), logout, disconnect, forfeit confirmation, and the version-mismatch screen. Release: 8.3 MB Linux, 6.8 MB Windows, 61 ms to window, 131 MB idle RSS.

9 files changed, 86 insertions, 45 deletions

diff --git a/docs/GUI-PLAN.md b/docs/GUI-PLAN.md
index bb63530..4279626 100644
--- a/docs/GUI-PLAN.md
+++ b/docs/GUI-PLAN.md
@@ -67,9 +67,7 @@ crash board from its local clock.
 
 **Gate:** all four games playable in the TUI through `Command`/`View`.
 
-## Phase 3 — `gui/` skeleton and the style spike
-
-**Code complete in v4.1.0; awaiting the screenshot sign-off.**
+## Phase 3 — `gui/` skeleton and the style spike (done)
 
 - `gui/` is a workspace member (`zagan-bet-gui`). It depends on the core with
   `default-features = false`, so neither egui nor native-tls enters the TUI or
@@ -104,24 +102,65 @@ Measured on Linux at 1080p with llvmpipe software GL:
 | Idle RSS | 137 MB |
 | Idle CPU | 0% |
 
-The approved reference lives at `docs/screenshots/gui-roulette-1080p.png`, with
-the result state at `docs/screenshots/gui-roulette-result-1080p.png`.
-
-**Gate:** the screenshot needs your approval. Frame rate on integrated graphics
-still needs a run on real hardware.
+The Phase 4 screenshots in `docs/screenshots/` supersede the spike captures;
+they show the same layout with the real session and the pinned action bars.
+
+**Gate:** met. The style was approved and the spike grew into Phase 4.
+
+## Phase 4 — GUI wiring (code complete, v4.2.0)
+
+- `gui/src/net.rs` is the adapter's network worker. One blocking thread owns the
+  TLS stream; `Command` goes in, `Event` comes out (connected, failed, trust,
+  line, closed), and every event calls `Context::request_repaint`. There is no
+  async runtime.
+- First contact is a modal that answers the transport's trust callback through
+  a channel. A changed key is a hard stop with an explicit forget-and-retry;
+  a version mismatch links to the download page; a saved credential auto-logs
+  in before the login screen is ever shown.
+- Screens: connect (remembered hosts, forget trust), login/register with a
+  "remember this login" choice, lobby with the update notice, history table,
+  and the four games. "Log out" and "forget saved login" are separate. Leaving
+  a live hand or round asks first and forfeits the reservation.
+- Games are painted from `View`: slots with a 0.9 s reel animation and payline
+  highlights, roulette with the wheel spin, the hover lattice, chip placement
+  and payouts, blackjack with vector-drawn suits and legal actions, crash with
+  a sampled curve, cashout and a server-drawn crash point. A refused spin shows
+  the error and never runs the animation: the reels and the wheel wait for the
+  server's answer, not for the click.
+- Sidebars pin their action block below the content, so SPIN, CLEAR, DEAL and
+  START never move as the bet slip or a hand grows. The embedded fonts have no
+  suit or arrow glyphs, so suits are shapes and navigation uses plain words.
+- The header balance is held at the staked amount while the reels or wheel
+  turn, then jumps to the settled value: the GUI never reveals a payout before
+  the animation does. Refused spins cancel the animation and show the error.
+  The crash multiplier keeps full precision in the game state so the chart is
+  a smooth line; the terminal still formats it to two decimals.
+- `gui/tests/layout.rs` covers money, wheel angles, lattice snapping, table
+  aspect and bet names.
+
+Verified live against a v4.2.0 server: register, login, auto-login, trust,
+all four games settling, history, logout, disconnect, the leave-forfeit
+confirmation, and the version-mismatch screen (new client against a 4.1.1
+server).
+
+Screenshots: `docs/screenshots/gui-{lobby,slots,roulette,blackjack,crash,
+history}-1080p.png`, plus the roulette result state.
 
-## Phase 4 — GUI wiring
-## Phase 4 — GUI wiring
+Measured on Linux at 1080p with llvmpipe software GL:
 
-- Network thread with channels, request deadlines in the shared adapter.
-- Trust modal, version-mismatch screen, login/register, lobby, history panel.
-- All four games, per-frame painting and tier 1–2 effects.
-- Update notice from the handshake in the lobby.
+| Check | Result |
+| --- | --- |
+| Linux binary | 8.3 MB |
+| Windows x86_64 binary | 6.8 MB |
+| Cold start to window | 61 ms |
+| Idle RSS | 131 MB |
+| Idle CPU | 0% |
 
-**Gate:** manual checklist per game at 60 fps, `egui_kittest` wiring tests,
-modem-throttled run.
+**Gate:** the screenshot set is ready for review. Remaining for the gate:
+frame rate on integrated graphics and the Windows interactive pass.
 
 ## Phase 5 — packaging
+## Phase 5 — packaging
 
 - `publish.sh` emits `zagan-bet-gui-<version>-<platform>-<arch>[.exe]`.
 - Bash and PowerShell installers that verify the SHA-256, install to the user
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 32fc628..817cb3d 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -46,7 +46,7 @@ or a vendored OpenSSL.
 | `tests/slots.rs` | Server slots payout rules and overflow handling. |
 | `tests/storage.rs` | Client/server SQLite storage helpers. |
 | `tests/tofu.rs` | SPKI fingerprint and TOFU decisions. |
-| `gui/tests/layout.rs` | GUI presentation maths: money grouping, wheel angle, table aspect, bet names. |
+| `gui/tests/layout.rs` | GUI presentation maths: money grouping, wheel angle, table aspect, lattice snapping (straight/split/corner/outside), bet names. |
 
 `tests/tofu.rs` and `tests/server_setup.rs` shell out to `openssl`, so run them
 on a machine where the `openssl` CLI is available.
@@ -118,34 +118,36 @@ Use an 80-column terminal because several output lines are width-sensitive.
 
 ## Manual GUI checklist
 
-The GUI is a style spike until Phase 4: the table and wheel are painted from a
-demo `RouletteView`, and no network connection is made. Run it on Linux and on
-Windows 10 before approving the look.
-
-1. `cargo run -p zagan-bet-gui` at 1440x900, then at 1920x1080. The header
-   keeps its right margin at both sizes and shows ONLINE, host, ping, account
-   and balance; the table is centred and the sidebar is full height.
-2. The felt shows 0, the 3x12 numbers, dozens, columns (each a quarter of the
-   row) and the six outside cells. Chips sit on their targets: a straight in
-   the cell, a corner on the lattice crossing, an outside bet in its box.
-3. Hover a number: a translucent chip of the selected denomination appears.
-   In the inner half of a cell it is a straight (one cell tints); near an edge
-   it snaps to a split (two cells tint) and near a corner to a corner (four
-   cells tint). Hovering the dozens, columns and outside boxes moves the
-   preview there.
-4. Left click adds the chip where the preview is; right or middle click takes
-   one chip of that value back, dropping the row when it reaches zero. The
-   slip and total follow every change. C or CLEAR empties the slip.
-5. Space or SPIN animates the wheel for about 2.4 s and stops with the winning
-   pocket under the pointer. The winning cell gets a gold outline and LAST
-   gains a dot. RESULT names the number and colour, WON shows the amount paid
-   and the net for the round, and a losing spin says NO WIN. SPIN, CLEAR and
-   the chips are disabled during the spin.
-6. Placing a chip after a result starts the next round: the payout row goes
-   back to PLACE YOUR BETS while the wheel stays where it stopped. Resize to
-   1100x720: the sidebar scrolls, nothing overlaps the header, and the table
-   keeps its aspect ratio.
-7. Compare the 1080p window against the approved reference screenshots.
+The desktop frontend shares `ClientCore` and the data directory with the
+terminal client; a saved login from one signs in the other.
+
+1. `cargo run -p zagan-bet-gui` (or `-d <dir>` / `--unsafe`). The connect
+   screen lists remembered hosts with short fingerprints.
+2. First contact: the fingerprint modal appears before any credentials. Cancel
+   leaves the connect screen; Trust continues to the login screen.
+3. Register, then log in with "Remember this login". The lobby shows the host,
+   ping, account, balance and the four games; quit and reconnect: the stored
+   login signs in without asking.
+4. Each game: place a bet or deal, play a round, and confirm the balance and the
+   header update. Slots shows reels and win lines; roulette spins the wheel and
+   reports the payout; blackjack draws suits and settles; crash draws a smooth
+   curve and cashes out. While the reels or wheel turn, the balance shows the
+   stake already deducted; the payout appears only when they stop. A spin or
+   deal the server refuses (for example an insufficient balance) shows the
+   error and must not animate the reels, the wheel or the curve.
+5. Sidebar actions never move while the slip grows. CLEAR empties the slip;
+   right or middle click on the felt takes one chip back; C clears and space
+   spins in roulette.
+6. Leaving a live blackjack hand or crash round asks for confirmation, then
+   forfeits. Leaving an idle table returns to the lobby.
+7. HISTORY shows the last plays; SHOW changes the limit. LOG OUT returns to
+   the login screen but stays connected; Disconnect drops the session (the
+   saved login survives).
+8. Run the client against a server of another MAJOR.MINOR version: the
+   mismatch screen names both versions and the download page. A changed host
+   key stops the connection and offers forget-and-reconnect.
+9. Resize to 1100x720: the sidebar scrolls, the actions stay reachable, and
+   the board keeps its aspect ratio.
 
 ## Manual roulette checklist
 
diff --git a/docs/screenshots/gui-blackjack-1080p.png b/docs/screenshots/gui-blackjack-1080p.png
new file mode 100644
index 0000000..b0fcc19
--- /dev/null
+++ b/docs/screenshots/gui-blackjack-1080p.png
diff --git a/docs/screenshots/gui-crash-1080p.png b/docs/screenshots/gui-crash-1080p.png
new file mode 100644
index 0000000..245a3a1
--- /dev/null
+++ b/docs/screenshots/gui-crash-1080p.png
diff --git a/docs/screenshots/gui-history-1080p.png b/docs/screenshots/gui-history-1080p.png
new file mode 100644
index 0000000..a979dcd
--- /dev/null
+++ b/docs/screenshots/gui-history-1080p.png
diff --git a/docs/screenshots/gui-lobby-1080p.png b/docs/screenshots/gui-lobby-1080p.png
new file mode 100644
index 0000000..a258967
--- /dev/null
+++ b/docs/screenshots/gui-lobby-1080p.png
diff --git a/docs/screenshots/gui-roulette-1080p.png b/docs/screenshots/gui-roulette-1080p.png
index 2f30aa7..1d7af3d 100644
--- a/docs/screenshots/gui-roulette-1080p.png
+++ b/docs/screenshots/gui-roulette-1080p.png
diff --git a/docs/screenshots/gui-roulette-result-1080p.png b/docs/screenshots/gui-roulette-result-1080p.png
index a7d425c..fe4c9cd 100644
--- a/docs/screenshots/gui-roulette-result-1080p.png
+++ b/docs/screenshots/gui-roulette-result-1080p.png
diff --git a/docs/screenshots/gui-slots-1080p.png b/docs/screenshots/gui-slots-1080p.png
new file mode 100644
index 0000000..9d79321
--- /dev/null
+++ b/docs/screenshots/gui-slots-1080p.png