Hashed seat tokens, ledgered inputs, refusable moves, disk-checked codes, host-only bots, and a drift script

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up

template/src/lib/game/spec.ts

@@ -4,6 +4,11 @@
 // inputs at a time, ask who still has to move, and hand each viewer the
 // view they are allowed to see. A new game implements GameSpec once, in
 // src/lib/game/index.ts, and the rest of the kit works unchanged.
+//
+// The shape is simultaneous rounds: every seat that needs input submits, then
+// the round resolves. Turn-at-a-time games fit too (only one seat needs input
+// at once). A game of single commands with out-of-turn interruptions, like
+// Wiz-War, does not fit this contract and needs its own server.
 
 /** A seat at the table: a single letter from GameSpec.seatIds. */
 export type SeatId = string;
@@ -43,6 +48,8 @@ export interface GameSpec<State, Input> {
 	botInput(state: State, seat: SeatId): Input;
 	/** Only the shapes the engine understands get through; the engine validates the rest. */
 	cleanInput(raw: unknown): Input;
+	/** Why this seat may not make this move now, or null when it may. The server answers with the reason. */
+	validate?(state: State, seat: SeatId, input: Input): string | null;
 	/** A seat's name from the state, for the hall and the chronicle. */
 	nameOf(state: State, seat: SeatId): string;
 }