The keeper's door asks for a key only root and the waving-hands user can read, so another service on the host cannot re-seat anyone; the deploy makes the key once and the reseat script sends it from a file descriptor; and a seat link is taken out of the address bar with the browser's own call, since the page reads it before the router starts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MbtUPJ24P6vc6tE1x6RS3m

deploy/README.md

@@ -54,7 +54,9 @@ A fresh host, when one is needed: `doctl compute droplet create hall --region ny
 - `waving-hands-visitors.sh [day]`: who is here now and who came that day.
 - `waving-hands-reseat.sh ROOM [SEAT]`: who sits at a table; with a seat, a new
   token for a player locked out of it, as a link to send them. It answers
-  through the duel server's `/keeper` door, which Caddy does not proxy.
+  through the duel server's `/keeper` door, which Caddy does not proxy and
+  which asks for the key in /etc/waving-hands/keeper.key, made by the deploy
+  and readable by root and the waving-hands user alone.
 - `waving-hands-pulse.sh`: the weekly health check (service, errors, rollup
   trend, backup, box).
 - `waving-hands-rollup.sh [day]`: one JSON line per day of counts, run