The credibility pass on Hnefatafl, ported to the template: the ops scripts count traffic through one parser, the reports digest is one program, the plaintext-token fallback and its migration are gone, and the stylesheet holds each shared rule once

From the hnefatafl repo's pass of the same day, everything that touched a
kit-shared file. The visitors digest and the nightly rollup share
deploy/traffic.py, installed to /usr/local/lib/<slug>; the rollup writes
the finished-games count it computed behind "and False". pull-reports.sh
and the reports skill both use deploy/report-digest.ts. The seat line
requires its token hash and the start line its rules revision; the
migration for ledgers written before hashing goes with them. The route
table in server/src/index.ts lists every route; Report, ReportLine and
Tally are declared once in view.ts for both sides; exports nobody
imported are exports no more.

In the client: .small, the × that dismisses, and the frame of the
reading pages are in app.css once; the preferences panel shares the
report slip's modal shape; the room store gains seatEmpty and
seatUnheld, and the lobby and the join page read those instead of
three spellings of their own. The room's moved and awaiting fields
stay: the demo board reads them, and simultaneous rounds are the
contract.

The deploy README no longer describes a browser-only game; the visitors
skill no longer names a /play route; the reports skill's replay call
carries the room's options. The Slack channel id is passed in the
environment rather than filled in as a placeholder.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwFKMuQnPAEHJ5yA1q4orh

template/server/src/index.ts

@@ -2,18 +2,24 @@
 // websocket only to say "something changed, fetch the view again".
 //
 //   POST /api/rooms                 {name, size?, options?}  create a room and take seat A; options are the game's table choices
+//   GET  /api/rooms/:id?token=      the view for that seat; without a token, the gallery's view
 //   POST /api/rooms/:id/join        {name}             take the next seat
 //   POST /api/rooms/:id/bot         {token}            the host seats a bot, before the game begins
-//   POST /api/rooms/:id/begin       {token}            the host begins with the players seated so far
 //   POST /api/rooms/:id/unseat      {token, seat}      the host sends a bot away before the game begins
-//   GET  /api/rooms/:id?token=      the view for that seat; without a token, the gallery's view
+//   POST /api/rooms/:id/begin       {token}            the host begins with the players seated so far
 //   POST /api/rooms/:id/turn        {token, input}     this seat's move
-//   POST /api/rooms/:id/say         {token, text}      table talk, from a seat to the whole room
+//   POST /api/rooms/:id/say         {token, text}      table talk, from a seat to the whole room;
+//                                   {name, text}       or from the gallery, signed, when the host allows it
+//   POST /api/rooms/:id/gallery     {token, on}        the host lets the Peanut Gallery talk, or hushes it
+//   POST /api/rooms/:id/challenge   {token}            call the keeper to a held seat; their phone rings
+//   POST /api/rooms/:id/rematch     {token}            a finished table opens the next one
+//   POST /api/rooms/:id/transfer    {token}            mint a phrase that carries this seat to another device
+//   POST /api/transfer              {phrase}           claim one
 //   POST /api/rooms/:id/report      {token?, happened, expected}  a report to the keeper, pinned to the round
 //   POST /api/reports/:id/image     <image bytes>      a screenshot for a report just filed
+//   POST /api/reports/:id/answer    {roomId, token, text}        your word under the keeper's reply
 //   POST /api/reports/mine          {seats: [{roomId, token}]}   your reports and the keeper's replies
 //   GET  /api/tally                 what the ledgers add up to, for the hall
-//   POST /api/reports/:id/answer    {roomId, token, text}        your word under the keeper's reply
 //   WS   /ws?room=:id&token=        {type:"update", seq} whenever the room changes; without a token,
 //                                   a seat in the Peanut Gallery, counted for the table
 //
@@ -48,10 +54,11 @@ process.on('unhandledRejection', (reason) => {
 	Sentry.captureException(reason);
 });
 
-const rooms = new Rooms(game, new Store(DATA_DIR), { name: KEEPER, zone: KEEPER_TZ });
+const store = new Store(DATA_DIR);
+const rooms = new Rooms(game, store, { name: KEEPER, zone: KEEPER_TZ });
 /** Reports live beside the room ledgers, not among them. */
 const reports = new Reports(dirname(DATA_DIR));
-const tallies = new Tallies(game, new Store(DATA_DIR));
+const tallies = new Tallies(game, store);
 /** Opening rooms and taking seats are open to anyone; a script gets a few dozen an hour, not thousands. */
 const doors = new RateLimit(40, 60 * 60 * 1000);
 /** Table talk: a lively table says a few lines a minute, not hundreds. */
@@ -305,7 +312,6 @@ server.on('upgrade', (req, socket, head) => {
 		};
 		const unsubscribe = seatId === SPECTATOR ? rooms.watch(room, onChange) : rooms.subscribe(room.id, onChange);
 		ws.on('close', unsubscribe);
-		ws.send(JSON.stringify({ type: 'hello', seat: seatId }));
 	});
 });