Admin: Daily Word pool curation (lookup + add/remove)

First games admin tool. A "Games" tab in the operator console for the Daily Word
answer pool.
* Lookup: is a word real (in the guess dictionary), the right length (5/6), and
  already in the pool — instant as you type.
* Add: appends to the pool, enforcing the invariant (alpha · 5/6 letters · in the
  guess dict) so the daily answer is always guessable. Remove: drops admin-added
  words (curated static ones stay).
* Additions persist in a new word_pool table (survives redeploys, unlike the
  baked-in JSON); the daily picker reads static pool ∪ DB additions. Guess dicts
  shipped with the package (goodnews/data/words-5/6.json) for server-side
  validation. Admin-gated endpoints + tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

goodnews/games.py

@@ -17,7 +17,11 @@ import re
 import sqlite3
 from pathlib import Path
 
-_POOL = json.loads((Path(__file__).parent / "data" / "wordpool.json").read_text())
+_DATA = Path(__file__).parent / "data"
+_POOL = json.loads((_DATA / "wordpool.json").read_text())  # curated static answer pool
+# Guess dictionaries (same lists the client validates against) — used server-side to
+# guarantee any admin-added answer is actually guessable.
+_DICT = {v: set(json.loads((_DATA / f"words-{v}.json").read_text())) for v in ("5", "6")}
 
 # Daily Word: 5 letters / 6 guesses · Long Word: 6 letters / 7 guesses.
 WORD_VARIANTS = {"5": {"length": 5, "guesses": 6}, "6": {"length": 6, "guesses": 7}}
@@ -27,6 +31,65 @@ def _seed(*parts: str) -> int:
     return int(hashlib.sha256(":".join(parts).encode()).hexdigest(), 16)
 
 
+def _db_pool(conn: sqlite3.Connection, variant: str) -> list[str]:
+    rows = conn.execute("SELECT word FROM word_pool WHERE variant=? ORDER BY word", (variant,)).fetchall()
+    return [r["word"] for r in rows]
+
+
+def answer_pool(conn: sqlite3.Connection, variant: str) -> list[str]:
+    """The day's answer pool = curated static list ∪ admin-added (DB) words."""
+    return sorted(set(_POOL.get(variant, [])) | set(_db_pool(conn, variant)))
+
+
+# --- Admin: Daily Word pool curation -------------------------------------------
+
+def lookup_word(word: str) -> dict:
+    """Is this word a valid, guessable answer candidate?"""
+    w = (word or "").strip().lower()
+    variant = str(len(w))
+    return {
+        "word": w,
+        "length": len(w),
+        "alpha": bool(w) and w.isalpha(),
+        "variant": variant if variant in WORD_VARIANTS else None,
+        "in_dictionary": w.isalpha() and w in _DICT.get(variant, set()),
+    }
+
+
+def add_pool_word(conn: sqlite3.Connection, word: str) -> dict:
+    """Add a word to the answer pool. Enforces the invariant (alpha, 5/6 letters,
+    present in the guess dictionary) so the daily answer is always guessable."""
+    w = (word or "").strip().lower()
+    variant = str(len(w))
+    if not w.isalpha() or variant not in WORD_VARIANTS:
+        return {"error": "must be a 5- or 6-letter word"}
+    if w not in _DICT[variant]:
+        return {"error": "not in the guess dictionary — it wouldn't be guessable"}
+    if w in set(_POOL.get(variant, [])) or w in set(_db_pool(conn, variant)):
+        return {"error": "already in the pool"}
+    conn.execute("INSERT OR IGNORE INTO word_pool (word, variant) VALUES (?, ?)", (w, variant))
+    conn.commit()
+    return {"word": w, "variant": variant, "added": True}
+
+
+def remove_pool_word(conn: sqlite3.Connection, word: str) -> dict:
+    """Remove an admin-added word. Curated static words can't be removed here."""
+    w = (word or "").strip().lower()
+    cur = conn.execute("DELETE FROM word_pool WHERE variant=? AND word=?", (str(len(w)), w))
+    conn.commit()
+    return {"word": w, "removed": cur.rowcount > 0}
+
+
+def pool_summary(conn: sqlite3.Connection) -> dict:
+    """Pool counts + the removable (admin-added) words, per variant."""
+    out = {}
+    for v in WORD_VARIANTS:
+        added = _db_pool(conn, v)
+        out[v] = {"curated": len(_POOL.get(v, [])), "added": added,
+                  "total": len(set(_POOL.get(v, [])) | set(added))}
+    return out
+
+
 def _recent_answers(conn: sqlite3.Connection, variant: str, limit: int) -> set[str]:
     rows = conn.execute(
         "SELECT payload_json FROM daily_puzzles WHERE game='word' AND variant=? "
@@ -43,7 +106,7 @@ def _recent_answers(conn: sqlite3.Connection, variant: str, limit: int) -> set[s
 
 
 def _pick_answer(conn: sqlite3.Connection, date: str, variant: str) -> str:
-    pool = _POOL.get(variant, [])
+    pool = answer_pool(conn, variant)
     recent = _recent_answers(conn, variant, max(1, len(pool) // 2))
     start = _seed(date, "word", variant) % len(pool)
     for i in range(len(pool)):