The credibility pass on Hnefatafl, ported to the template: the ops scripts count traffic through one parser, the reports digest is one program, the plaintext-token fallback and its migration are gone, and the stylesheet holds each shared rule once

From the hnefatafl repo's pass of the same day, everything that touched a
kit-shared file. The visitors digest and the nightly rollup share
deploy/traffic.py, installed to /usr/local/lib/<slug>; the rollup writes
the finished-games count it computed behind "and False". pull-reports.sh
and the reports skill both use deploy/report-digest.ts. The seat line
requires its token hash and the start line its rules revision; the
migration for ledgers written before hashing goes with them. The route
table in server/src/index.ts lists every route; Report, ReportLine and
Tally are declared once in view.ts for both sides; exports nobody
imported are exports no more.

In the client: .small, the × that dismisses, and the frame of the
reading pages are in app.css once; the preferences panel shares the
report slip's modal shape; the room store gains seatEmpty and
seatUnheld, and the lobby and the join page read those instead of
three spellings of their own. The room's moved and awaiting fields
stay: the demo board reads them, and simultaneous rounds are the
contract.

The deploy README no longer describes a browser-only game; the visitors
skill no longer names a /play route; the reports skill's replay call
carries the room's options. The Slack channel id is passed in the
environment rather than filled in as a placeholder.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GwFKMuQnPAEHJ5yA1q4orh

template/server/src/rooms.ts

@@ -22,7 +22,7 @@ export interface Seat {
 	bot: boolean;
 }
 
-export function hashToken(token: string): string {
+function hashToken(token: string): string {
 	return createHash('sha256').update(token).digest('hex');
 }
 
@@ -88,11 +88,11 @@ const TRANSFER_WORDS = [
 const TRANSFER_TTL_MS = 10 * 60 * 1000;
 const TRANSFER_FAIL_LIMIT = 20;
 
-export function normalizeCode(raw: string): string {
+function normalizeCode(raw: string): string {
 	return raw.trim().toUpperCase();
 }
 
-export function cleanName(raw: unknown): string {
+function cleanName(raw: unknown): string {
 	const name = String(raw ?? '')
 		.replace(/\s+/g, ' ')
 		.trim()
@@ -106,6 +106,10 @@ export class Rooms<State, Input> {
 	private listeners = new Map<string, Set<(room: Room<State>) => void>>();
 	/** Sockets watching from the gallery, by room. */
 	private gallery = new Map<string, number>();
+	/** Phrases waiting to be claimed, with the seat and the token they carry. */
+	private transfers = new Map<string, { roomId: string; seatId: SeatId; token: string; expiresAt: number }>();
+	private failedClaims = 0;
+	private failWindowStart = 0;
 
 	constructor(
 		private game: GameSpec<State, Input>,
@@ -258,11 +262,6 @@ export class Rooms<State, Input> {
 		return { roomId: next.room.id, seat: next.seat, token: next.token, created: true };
 	}
 
-	/** Phrases waiting to be claimed, with the seat and the token they carry. */
-	private transfers = new Map<string, { roomId: string; seatId: SeatId; token: string; expiresAt: number }>();
-	private failedClaims = 0;
-	private failWindowStart = 0;
-
 	/** Mint a phrase that brings this seat to another device: four words, ten minutes, one use. */
 	transfer(room: Room<State>, token: string | undefined): { phrase: string; expiresAt: number } {
 		const seat = this.seatOf(room, token);
@@ -474,7 +473,7 @@ export class Rooms<State, Input> {
 				room.over = true;
 				break;
 			case 'seat':
-				room.seats.push({ id: line.id, name: line.name, tokenHash: line.tokenHash ?? (line.token ? hashToken(line.token) : ''), bot: line.bot });
+				room.seats.push({ id: line.id, name: line.name, tokenHash: line.tokenHash, bot: line.bot });
 				break;
 			case 'galleryTalk':
 				room.galleryTalk = line.on;
@@ -493,7 +492,7 @@ export class Rooms<State, Input> {
 				room.seats = room.seats.filter((s) => s.id !== line.id);
 				break;
 			case 'start':
-				room.state = this.game.create(Object.fromEntries(room.seats.map((s) => [s.id, s.name])), line.seed, line.rules ?? 1, room.options);
+				room.state = this.game.create(Object.fromEntries(room.seats.map((s) => [s.id, s.name])), line.seed, line.rules, room.options);
 				break;
 			case 'turn':
 				if (!room.state) return;