Seats are banked in a cookie the server sets, and a lost seat comes back by name to the address it was last used from

A seat lived in the browser's storage alone, and Safari clears that after a week away, or at a word from the person on another device. Now every seat taken is banked as well in an HttpOnly cookie the server writes, which such clearing leaves alone, and the hall takes its seats back from the bank on arrival. For a browser that lost even the cookie, the ledger notes the address each seat was last used from, as a salted hash, at most once in ten minutes, and a name given in the hall or at the duel gets its seats back from the same address, with a new token; where the address differs, two people at the duel share it, or the host gave the seat to a bot, the duel is only counted, and the host's phrase or the keeper's link is the way back. The keeper's script finds a name across duels. The seat endpoints answer only this site's own pages, under a limit of their own.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCLa2PaEeCj8njQZSWGqHx

deploy/waving-hands-reseat.sh

@@ -3,16 +3,27 @@
 # token, the old one stops working, and the link printed carries the new one.
 # Whether the one asking holds that seat is the keeper's call; send the link
 # only to them. Runs ON the droplet, through the duel server's keeper door.
+#   waving-hands-reseat.sh find NAME     every table not yet over where a person of that name sits, for one who lost the codes too
 #   waving-hands-reseat.sh ROOM          who sits at the table, and when each wizard last moved or spoke
 #   waving-hands-reseat.sh ROOM SEAT     re-seat SEAT and print the link
 set -euo pipefail
-ROOM="${1:?usage: waving-hands-reseat.sh ROOM [SEAT]}"
+ROOM="${1:?usage: waving-hands-reseat.sh find NAME | ROOM [SEAT]}"
 DOOR="http://127.0.0.1:8788/keeper/rooms/${ROOM^^}"
 [ -s /etc/waving-hands/keeper.key ] || { echo "No keeper's key at /etc/waving-hands/keeper.key; a deploy makes it." >&2; exit 1; }
 # The key goes as a header read from a file descriptor, never on a command line another user could see.
 KEY="@/dev/fd/3"
 exec 3< <(printf 'x-keeper-key: %s\n' "$(cat /etc/waving-hands/keeper.key)")
-if [ $# -lt 2 ]; then
+if [ "$ROOM" = find ]; then
+  curl -s -H "$KEY" --get --data-urlencode "name=${2:?a name to look for}" "http://127.0.0.1:8788/keeper/seats" | python3 -c '
+import datetime, json, sys
+r = json.load(sys.stdin)
+if "error" in r: sys.exit(r["error"])
+if not r["tables"]: print("no table still in play has a seat under that name")
+for t in r["tables"]:
+    when = datetime.datetime.fromtimestamp(t["updatedAt"] / 1000, datetime.timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
+    print("  %s seat %-3s %s with %s, last moved %s" % (t["roomId"], t["seat"], "(a bot stands in)" if t["standIn"] else "", ", ".join(t["players"]) or "nobody yet", when))
+'
+elif [ $# -lt 2 ]; then
   curl -s -H "$KEY" "$DOOR" | python3 -c '
 import datetime, json, sys
 r = json.load(sys.stdin)