The keeper's door asks for a key only root and the game's user can read, so another service on the host cannot re-seat anyone; the deploy makes the key once and the reseat script sends it from a file descriptor; and a seat link is taken out of the address bar with the browser's own call, since the page reads it before the router starts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MbtUPJ24P6vc6tE1x6RS3m

CONVENTIONS.md

@@ -52,7 +52,9 @@ README.
   the keeper, and `<slug>-reseat.sh ROOM SEAT` on the host gives the seat
   a new token and prints a link carrying it in the fragment. The old token
   opens nothing after. The script answers through the game server's
-  `/keeper` door, which Caddy does not proxy. A spectator at a game in play
+  `/keeper` door, which Caddy does not proxy and which asks for the key in
+  `/etc/<slug>/keeper.key`, made by the deploy and readable by root and the
+  game's user alone. A spectator at a game in play
   is told both ways back, and the hall asks before forgetting a game in play.
 - **Held seats are doubted before they are dropped**: the hall forgets a
   seat only on the second refusal in a row from the server. A restart, a