The credibility pass on Hnefatafl, ported to the template: the ops scripts count traffic through one parser, the reports digest is one program, the plaintext-token fallback and its migration are gone, and the stylesheet holds each shared rule once

From the hnefatafl repo's pass of the same day, everything that touched a
kit-shared file. The visitors digest and the nightly rollup share
deploy/traffic.py, installed to /usr/local/lib/<slug>; the rollup writes
the finished-games count it computed behind "and False". pull-reports.sh
and the reports skill both use deploy/report-digest.ts. The seat line
requires its token hash and the start line its rules revision; the
migration for ledgers written before hashing goes with them. The route
table in server/src/index.ts lists every route; Report, ReportLine and
Tally are declared once in view.ts for both sides; exports nobody
imported are exports no more.

In the client: .small, the × that dismisses, and the frame of the
reading pages are in app.css once; the preferences panel shares the
report slip's modal shape; the room store gains seatEmpty and
seatUnheld, and the lobby and the join page read those instead of
three spellings of their own. The room's moved and awaiting fields
stay: the demo board reads them, and simultaneous rounds are the
contract.

The deploy README no longer describes a browser-only game; the visitors
skill no longer names a /play route; the reports skill's replay call
carries the room's options. The Slack channel id is passed in the
environment rather than filled in as a placeholder.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwFKMuQnPAEHJ5yA1q4orh

template/deploy/deploy.sh

@@ -25,7 +25,7 @@ rsync -az --delete --filter='P _app/immutable/*' \
 # it needs only its code and the engine. Ledgers live outside this tree.
 rsync -az --delete --exclude='/server/node_modules' \
   --include='/server/***' --include='/src/' --include='/src/lib/' --include='/src/lib/game/***' --include='/src/lib/net/' --include='/src/lib/net/view.ts' \
-  --include='/deploy/' --include='/deploy/__SLUG__.service' --include='/deploy/__SLUG__.cron' --include='/deploy/*.sh' --include='/deploy/hash-tokens.ts' \
+  --include='/deploy/' --include='/deploy/__SLUG__.service' --include='/deploy/__SLUG__.cron' --include='/deploy/*.sh' --include='/deploy/traffic.py' \
   --exclude='*' \
   ./ "root@$HOST:/opt/__SLUG__/app/"
 
@@ -36,12 +36,13 @@ ssh "root@$HOST" '
   cd /opt/__SLUG__/app/server && npm install --no-audit --no-fund
   chown -R __SLUG__:__SLUG__ /opt/__SLUG__/app
   cp /opt/__SLUG__/app/deploy/__SLUG__.service /etc/systemd/system/__SLUG__.service
-  # Cron runs the rollup and the backup from /usr/local/bin: install them on
-  # every deploy so the live copies are always the repo copies.
-  install -m 755 /opt/__SLUG__/app/deploy/visitors.sh /usr/local/bin/__SLUG__-visitors.sh
-  install -m 755 /opt/__SLUG__/app/deploy/pulse.sh /usr/local/bin/__SLUG__-pulse.sh
+  # The ops scripts run from /usr/local/bin and share traffic.py: install them
+  # on every deploy so the live copies are always the repo copies.
+  install -m 755 /opt/__SLUG__/app/deploy/__SLUG__-visitors.sh /usr/local/bin/__SLUG__-visitors.sh
+  install -m 755 /opt/__SLUG__/app/deploy/__SLUG__-pulse.sh /usr/local/bin/__SLUG__-pulse.sh
   install -m 755 /opt/__SLUG__/app/deploy/__SLUG__-rollup.sh /usr/local/bin/__SLUG__-rollup.sh
   install -m 755 /opt/__SLUG__/app/deploy/__SLUG__-backup.sh /usr/local/bin/__SLUG__-backup.sh
+  install -m 644 -D /opt/__SLUG__/app/deploy/traffic.py /usr/local/lib/__SLUG__/traffic.py
   install -m 644 /opt/__SLUG__/app/deploy/__SLUG__.cron /etc/cron.d/__SLUG__
   mkdir -p /var/log/__SLUG__
   systemctl daemon-reload