The keeper's door asks for a key only root and the game's user can read, so another service on the host cannot re-seat anyone; the deploy makes the key once and the reseat script sends it from a file descriptor; and a seat link is taken out of the address bar with the browser's own call, since the page reads it before the router starts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MbtUPJ24P6vc6tE1x6RS3m

docs/conventions.md

@@ -43,9 +43,10 @@ README.
   a new token and prints a link carrying it in the fragment. The old token
   opens nothing after. A link is kept only once the server takes it, and
   never over a seat the browser holds that still opens. The script answers
-  through the game server's `/keeper` door, which Caddy does not proxy. A
-  spectator at a game in play is told both ways back, and the hall asks
-  before forgetting a game in play.
+  through the game server's `/keeper` door, which Caddy does not proxy and
+  which asks for the key in `/etc/<slug>/keeper.key`, made by the deploy and
+  readable by root and the game's user alone. A spectator at a game in play
+  is told both ways back, and the hall asks before forgetting a game in play.
 - **Held seats are doubted before they are dropped**: the hall forgets a
   seat only on the second refusal in a row from the server. A restart, a
   stale answer or the wrong backend answer with ignorance, and ignorance