The credibility pass on Hnefatafl, ported to the template: the ops scripts count traffic through one parser, the reports digest is one program, the plaintext-token fallback and its migration are gone, and the stylesheet holds each shared rule once

From the hnefatafl repo's pass of the same day, everything that touched a
kit-shared file. The visitors digest and the nightly rollup share
deploy/traffic.py, installed to /usr/local/lib/<slug>; the rollup writes
the finished-games count it computed behind "and False". pull-reports.sh
and the reports skill both use deploy/report-digest.ts. The seat line
requires its token hash and the start line its rules revision; the
migration for ledgers written before hashing goes with them. The route
table in server/src/index.ts lists every route; Report, ReportLine and
Tally are declared once in view.ts for both sides; exports nobody
imported are exports no more.

In the client: .small, the × that dismisses, and the frame of the
reading pages are in app.css once; the preferences panel shares the
report slip's modal shape; the room store gains seatEmpty and
seatUnheld, and the lobby and the join page read those instead of
three spellings of their own. The room's moved and awaiting fields
stay: the demo board reads them, and simultaneous rounds are the
contract.

The deploy README no longer describes a browser-only game; the visitors
skill no longer names a /play route; the reports skill's replay call
carries the room's options. The Slack channel id is passed in the
environment rather than filled in as a placeholder.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwFKMuQnPAEHJ5yA1q4orh

template/server/src/index.ts

@@ -2,18 +2,24 @@
 // websocket only to say "something changed, fetch the view again".
 //
 //   POST /api/rooms                 {name, size?, options?}  create a room and take seat A; options are the game's table choices
+//   GET  /api/rooms/:id?token=      the view for that seat; without a token, the gallery's view
 //   POST /api/rooms/:id/join        {name}             take the next seat
 //   POST /api/rooms/:id/bot         {token}            the host seats a bot, before the game begins
-//   POST /api/rooms/:id/begin       {token}            the host begins with the players seated so far
 //   POST /api/rooms/:id/unseat      {token, seat}      the host sends a bot away before the game begins
-//   GET  /api/rooms/:id?token=      the view for that seat; without a token, the gallery's view
+//   POST /api/rooms/:id/begin       {token}            the host begins with the players seated so far
 //   POST /api/rooms/:id/turn        {token, input}     this seat's move
-//   POST /api/rooms/:id/say         {token, text}      table talk, from a seat to the whole room
+//   POST /api/rooms/:id/say         {token, text}      table talk, from a seat to the whole room;
+//                                   {name, text}       or from the gallery, signed, when the host allows it
+//   POST /api/rooms/:id/gallery     {token, on}        the host lets the Peanut Gallery talk, or hushes it
+//   POST /api/rooms/:id/challenge   {token}            call the keeper to a held seat; their phone rings
+//   POST /api/rooms/:id/rematch     {token}            a finished table opens the next one
+//   POST /api/rooms/:id/transfer    {token}            mint a phrase that carries this seat to another device
+//   POST /api/transfer              {phrase}           claim one
 //   POST /api/rooms/:id/report      {token?, happened, expected}  a report to the keeper, pinned to the round
 //   POST /api/reports/:id/image     <image bytes>      a screenshot for a report just filed
+//   POST /api/reports/:id/answer    {roomId, token, text}        your word under the keeper's reply
 //   POST /api/reports/mine          {seats: [{roomId, token}]}   your reports and the keeper's replies
 //   GET  /api/tally                 what the ledgers add up to, for the hall
-//   POST /api/reports/:id/answer    {roomId, token, text}        your word under the keeper's reply
 //   WS   /ws?room=:id&token=        {type:"update", seq} whenever the room changes; without a token,
 //                                   a seat in the Peanut Gallery, counted for the table
 //
@@ -48,10 +54,11 @@ process.on('unhandledRejection', (reason) => {
 	Sentry.captureException(reason);
 });
 
-const rooms = new Rooms(game, new Store(DATA_DIR), { name: KEEPER, zone: KEEPER_TZ });
+const store = new Store(DATA_DIR);
+const rooms = new Rooms(game, store, { name: KEEPER, zone: KEEPER_TZ });
 /** Reports live beside the room ledgers, not among them. */
 const reports = new Reports(dirname(DATA_DIR));
-const tallies = new Tallies(game, new Store(DATA_DIR));
+const tallies = new Tallies(game, store);
 /** Opening rooms and taking seats are open to anyone; a script gets a few dozen an hour, not thousands. */
 const doors = new RateLimit(40, 60 * 60 * 1000);
 /** Table talk: a lively table says a few lines a minute, not hundreds. */
@@ -305,7 +312,6 @@ server.on('upgrade', (req, socket, head) => {
 		};
 		const unsubscribe = seatId === SPECTATOR ? rooms.watch(room, onChange) : rooms.subscribe(room.id, onChange);
 		ws.on('close', unsubscribe);
-		ws.send(JSON.stringify({ type: 'hello', seat: seatId }));
 	});
 });
 

template/server/src/reports.ts

@@ -7,39 +7,15 @@ import { randomBytes } from 'node:crypto';
 import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import type { SeatId } from '../../src/lib/game/spec';
+import type { Report } from '../../src/lib/net/view';
 import { RoomError, type Room, type Seat } from './rooms';
 
-export const TEXT_MAX = 2000;
+const TEXT_MAX = 2000;
 export const IMAGE_MAX_BYTES = 2_500_000;
 /** How long after filing a picture may still be attached. */
 const IMAGE_WINDOW_MS = 60 * 60 * 1000;
 
-export interface ReportLine {
-	at: string;
-	text: string;
-	from: 'desk' | 'player';
-	status?: string;
-}
-
-export interface Report {
-	id: string;
-	at: string;
-	roomId: string;
-	/** The reporter's name, or "(gallery)" for a watcher. */
-	player: string;
-	seat: SeatId | null;
-	/** The round being written when the report was filed, and the ledger's length. */
-	turn: number | null;
-	seq: number;
-	happened: string;
-	expected: string;
-	/** The whole exchange in order: the keeper's replies and the player's answers. */
-	thread: ReportLine[];
-	/** A screenshot's file name under images/, when one was sent. */
-	image?: string;
-}
-
-export function cleanText(raw: unknown): string {
+function cleanText(raw: unknown): string {
 	return String(raw ?? '')
 		.replace(/[\u0000-\u0009\u000b-\u001f\u007f]/g, ' ')
 		.trim()

template/server/src/rooms.ts

@@ -22,7 +22,7 @@ export interface Seat {
 	bot: boolean;
 }
 
-export function hashToken(token: string): string {
+function hashToken(token: string): string {
 	return createHash('sha256').update(token).digest('hex');
 }
 
@@ -88,11 +88,11 @@ const TRANSFER_WORDS = [
 const TRANSFER_TTL_MS = 10 * 60 * 1000;
 const TRANSFER_FAIL_LIMIT = 20;
 
-export function normalizeCode(raw: string): string {
+function normalizeCode(raw: string): string {
 	return raw.trim().toUpperCase();
 }
 
-export function cleanName(raw: unknown): string {
+function cleanName(raw: unknown): string {
 	const name = String(raw ?? '')
 		.replace(/\s+/g, ' ')
 		.trim()
@@ -106,6 +106,10 @@ export class Rooms<State, Input> {
 	private listeners = new Map<string, Set<(room: Room<State>) => void>>();
 	/** Sockets watching from the gallery, by room. */
 	private gallery = new Map<string, number>();
+	/** Phrases waiting to be claimed, with the seat and the token they carry. */
+	private transfers = new Map<string, { roomId: string; seatId: SeatId; token: string; expiresAt: number }>();
+	private failedClaims = 0;
+	private failWindowStart = 0;
 
 	constructor(
 		private game: GameSpec<State, Input>,
@@ -258,11 +262,6 @@ export class Rooms<State, Input> {
 		return { roomId: next.room.id, seat: next.seat, token: next.token, created: true };
 	}
 
-	/** Phrases waiting to be claimed, with the seat and the token they carry. */
-	private transfers = new Map<string, { roomId: string; seatId: SeatId; token: string; expiresAt: number }>();
-	private failedClaims = 0;
-	private failWindowStart = 0;
-
 	/** Mint a phrase that brings this seat to another device: four words, ten minutes, one use. */
 	transfer(room: Room<State>, token: string | undefined): { phrase: string; expiresAt: number } {
 		const seat = this.seatOf(room, token);
@@ -474,7 +473,7 @@ export class Rooms<State, Input> {
 				room.over = true;
 				break;
 			case 'seat':
-				room.seats.push({ id: line.id, name: line.name, tokenHash: line.tokenHash ?? (line.token ? hashToken(line.token) : ''), bot: line.bot });
+				room.seats.push({ id: line.id, name: line.name, tokenHash: line.tokenHash, bot: line.bot });
 				break;
 			case 'galleryTalk':
 				room.galleryTalk = line.on;
@@ -493,7 +492,7 @@ export class Rooms<State, Input> {
 				room.seats = room.seats.filter((s) => s.id !== line.id);
 				break;
 			case 'start':
-				room.state = this.game.create(Object.fromEntries(room.seats.map((s) => [s.id, s.name])), line.seed, line.rules ?? 1, room.options);
+				room.state = this.game.create(Object.fromEntries(room.seats.map((s) => [s.id, s.name])), line.seed, line.rules, room.options);
 				break;
 			case 'turn':
 				if (!room.state) return;

template/server/src/store.ts

@@ -4,19 +4,19 @@
 
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
-import type { SeatId } from '../../src/lib/game/spec';
+import type { SeatId, TableOptions } from '../../src/lib/game/spec';
 
 export type LedgerLine =
 	/** `rematchOf` and `expected` mark a table opened for a rematch: whose it follows, and whose seats are held. */
-	| { t: 'room'; id: string; seats: number; createdAt: number; rematchOf?: string; expected?: string[]; options?: Record<string, string> }
-	/** A seat holds only the hash of its token; the token itself goes once to the browser that earned it. Ledgers written before hashing carry `token` and are read once more. */
-	| { t: 'seat'; id: SeatId; name: string; tokenHash?: string; token?: string; bot: boolean }
+	| { t: 'room'; id: string; seats: number; createdAt: number; rematchOf?: string; expected?: string[]; options: TableOptions }
+	/** A seat holds only the hash of its token; the token itself goes once to the browser that earned it. A bot's hash is empty. */
+	| { t: 'seat'; id: SeatId; name: string; tokenHash: string; bot: boolean }
 	/** One seat's move for the round in progress, so a restart keeps it. The turn line that follows carries every input again. */
 	| { t: 'input'; at: number; id: SeatId; input: unknown }
 	/** A bot sent away by the host before the game began; its seat id is free again. */
 	| { t: 'unseat'; id: SeatId }
-	/** Ledgers from before revisions were recorded resolve under rules 1. */
-	| { t: 'start'; seed: number; rules?: number }
+	/** The seed and the rules revision the game began under; a later fix keeps this revision's path for it. */
+	| { t: 'start'; seed: number; rules: number }
 	| { t: 'turn'; at: number; inputs: Record<SeatId, unknown> }
 	/** Written after the turn that ends the game, for anything that reads ledgers without the engine. */
 	| { t: 'over'; at: number; winner: SeatId | null; reason: string }

template/server/src/tally.ts

@@ -4,25 +4,9 @@
 // the kit's; a game may add its own lines through GameSpec.tally.
 
 import type { GameSpec, SeatId } from '../../src/lib/game/spec';
+import type { Tally } from '../../src/lib/net/view';
 import type { LedgerLine, Store } from './store';
 
-export interface Tally {
-	tablesOpened: number;
-	gamesBegun: number;
-	gamesFinished: number;
-	/** Distinct names of people who have taken a seat; a bot's name is not counted. */
-	namesSeated: number;
-	turnsPlayed: number;
-	/** Minutes at the table: gaps under ten minutes between one move and the next, summed. */
-	minutesAtTable: number;
-	longestGameTurns: number;
-	gamesWithBot: number;
-	talkLines: number;
-	firstGameAt: string | null;
-	/** The game's own lines, summed over finished games. */
-	byGame: Record<string, number>;
-}
-
 const GAP_LIMIT_MS = 10 * 60 * 1000;
 const CACHE_MS = 60 * 1000;
 
@@ -66,7 +50,7 @@ export class Tallies<State, Input> {
 					if (hasBot) t.gamesWithBot += 1;
 					if (lines[0].createdAt < firstStart) firstStart = lines[0].createdAt;
 					try {
-						state = this.game.create(Object.fromEntries(seats.map((s) => [s.id, s.name])), line.seed, line.rules ?? 1, lines[0].options);
+						state = this.game.create(Object.fromEntries(seats.map((s) => [s.id, s.name])), line.seed, line.rules, lines[0].options);
 					} catch {
 						state = null;
 					}

template/server/tsconfig.json

@@ -15,11 +15,10 @@
 		"src/**/*.ts",
 		"../src/lib/game/**/*.ts",
 		"../src/lib/net/view.ts",
-		"../deploy/replay-ledgers.ts"
+		"../deploy/replay-ledgers.ts",
+		"../deploy/report-digest.ts"
 	],
 	"exclude": [
-		"../src/lib/game/*.test.ts",
-		"../src/lib/game/*.svelte.ts",
-		"../src/lib/game/test-helpers.ts"
+		"../src/lib/game/*.test.ts"
 	]
 }