Hashed seat tokens, ledgered inputs, refusable moves, disk-checked codes, host-only bots, and a drift script

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up

template/deploy/replay-ledgers.ts

@@ -13,7 +13,6 @@ import type { SeatId } from '../src/lib/game/spec';
 interface Seat {
 	id: SeatId;
 	name: string;
-	token: string;
 	bot: boolean;
 }
 
@@ -52,9 +51,9 @@ async function main(): Promise<void> {
 		}
 		const outcome = state ? game.over(state) : null;
 		let verdict = state ? `${turns} turns, ${outcome ? 'over' : 'in play'}` : 'not started';
-		const human = seats.find((s) => !s.bot);
-		if (host && state && human) {
-			const res = await fetch(`${host}/api/rooms/${code}?token=${encodeURIComponent(human.token)}`);
+		if (host && state) {
+			// The gallery's view carries the round and the outcome, which is all the comparison needs.
+			const res = await fetch(`${host}/api/rooms/${code}`);
 			if (!res.ok) {
 				verdict += `, server ${res.status}`;
 			} else {