Credibility pass: one conflict check, one hostile list, one set of chrome

Duplicated logic and styling that had drifted apart is unified: the
gesture-sharing check, the hostile spell list, the enchanted test, the
plan limits, and the shared button, link, field and disabled styles.
Dead plumbing is gone: the always-true implemented flag, the unread
cast length, an unreachable guard, an impossible time-stop condition,
the unused sequence formatter and utility class, the template
placeholder. The counter-spell tests now put a counter-spell in front
of a spell, the test helpers live in one file, and the resolver's
sections are numbered in order. The deploy script's cache headers now
do what its comment says, and the README describes the screen rather
than listing features in the order they arrived.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/setup-droplet.sh

@@ -4,8 +4,7 @@
 # The argument is the Caddy site address line: one name, or several
 # separated by commas. Every name must already resolve to this droplet.
 # Waving Hands is a static site: Caddy serves the built files and terminates
-# TLS. There is no application process, so nothing but Caddy and rsync is
-# installed.
+# TLS. There is no application process to install or supervise.
 set -euo pipefail
 HOST="${1:?usage: setup-droplet.sh <hostname>}"
 
@@ -28,8 +27,9 @@ chmod -R g+rX /opt/waving-hands
 # Caddy vhost: auto-TLS, security headers, static files. SvelteKit writes
 # each route as <route>.html, so /rules is tried as /rules.html before
 # falling back to the app shell. Hashed assets under _app/immutable are
-# cached for a year; everything else is revalidated so a deploy shows up
-# on the next load.
+# cached for a year; every other response is revalidated so a deploy shows
+# up on the next load. The two header matchers are disjoint, so their order
+# does not matter.
 cat > /etc/caddy/Caddyfile <<CADDY
 $HOST
 
@@ -42,8 +42,10 @@ header {
 	X-Frame-Options "DENY"
 	Referrer-Policy "no-referrer"
 }
-header /_app/immutable/* Cache-Control "public, max-age=31536000, immutable"
-header /index.html Cache-Control "no-cache"
+@immutable path /_app/immutable/*
+header @immutable Cache-Control "public, max-age=31536000, immutable"
+@mutable not path /_app/immutable/*
+header @mutable Cache-Control "no-cache"
 
 log {
 	output file /var/lib/caddy/access.log {