Hashed seat tokens, ledgered inputs, refusable moves, disk-checked codes, host-only bots, and a drift script

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up

README.md

@@ -44,9 +44,25 @@ Placeholders: `__SLUG__`, `__NAME__`, `__PORT__`, `__DOMAIN__` are filled by
 `__SENTRY_SLACK_INTEGRATION__` and `__SLACK_CHANNEL_ID__` wait until those
 things exist.
 
-## Keeping the kit current
+## What the kit is, and is not
 
-When a game grows something every game should have (the gallery and the
-reports desk were both born in one game and ported to the other), bring it
-back here, with placeholders, so the next game inherits it. The kit is the
-canonical copy of the shared parts; the games are its instances.
+The model is copy and diverge. A new game starts as a copy of the template
+and then goes its own way; the two games that came before it are not
+instances of the template and were not rewritten to be. The kit holds the
+reference copy of the shared parts and the conventions they follow, so a
+third game starts from the best current version of everything.
+
+Drift is meant to be visible, not prevented:
+
+    ./drift.sh ../waving-hands          # how far each shared file has wandered
+
+`drift-map/<slug>.txt` pairs files when a game's layout differs from the
+template's. When a game grows something every game should have (the
+gallery and the reports desk were both born in one game and ported to the
+other), bring it back here, with placeholders, so the next game inherits
+it, and read the drift before assuming the kit has it.
+
+The contract is simultaneous rounds: every seat that needs input submits,
+then the round resolves; turn-at-a-time games fit as the case where one
+seat needs input at a time. A game of single commands with out-of-turn
+interruptions, Wiz-War's shape, does not fit and keeps its own server.