The keeper's door asks for a key only root and the waving-hands user can read, so another service on the host cannot re-seat anyone; the deploy makes the key once and the reseat script sends it from a file descriptor; and a seat link is taken out of the address bar with the browser's own call, since the page reads it before the router starts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MbtUPJ24P6vc6tE1x6RS3m

deploy/deploy.sh

@@ -44,6 +44,12 @@ ssh "root@$HOST" '
   install -m 755 /opt/waving-hands/app/deploy/waving-hands-rollup.sh /usr/local/bin/waving-hands-rollup.sh
   install -m 755 /opt/waving-hands/app/deploy/waving-hands-backup.sh /usr/local/bin/waving-hands-backup.sh
   install -m 755 /opt/waving-hands/app/deploy/waving-hands-reseat.sh /usr/local/bin/waving-hands-reseat.sh
+  # The key to the keeper door: made once, readable by root (the reseat script) and the game user (the server) alone.
+  if [ ! -s /etc/waving-hands/keeper.key ]; then
+    install -d -m 750 -o root -g waving-hands /etc/waving-hands
+    (umask 037; openssl rand -hex 32 > /etc/waving-hands/keeper.key)
+    chown root:waving-hands /etc/waving-hands/keeper.key
+  fi
   # On a host the hall shares, its hall-nightly.sh runs the rollup and backup
   # of every game and checks in with Sentry once for all; a game on a box of
   # its own schedules its own.