Operations in wizwar's shape: the determinism gate, backups, the rollup and the pulse

Every deploy first replays every production ledger with the engine about
to ship. The droplet gains a nightly rollup of counts and a nightly
backup to Spaces, a pulse script the pulse skill reads, rate limits on
opening rooms and taking seats, and eviction of idle rooms from memory
with reload from their ledgers on the next visit.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up

deploy/README.md

@@ -44,6 +44,27 @@ A record at the droplet and add the name to the first line of
 /etc/caddy/Caddyfile (space separated), then `systemctl reload caddy`; Caddy
 fetches the certificate on first request.
 
+## Operations scripts on the droplet
+
+`deploy.sh` installs these to /usr/local/bin and the cron file to
+/etc/cron.d/waving-hands on every deploy, so the live copies are the repo copies:
+
+- `waving-hands-visitors.sh [day]`: who is here now and who came that day.
+- `waving-hands-pulse.sh`: the weekly health check (service, errors, rollup
+  trend, backup, box).
+- `waving-hands-rollup.sh [day]`: one JSON line per day of counts, run
+  nightly at 00:12 UTC into /var/lib/waving-hands/rollup.jsonl.
+- `waving-hands-backup.sh`: nightly at 07:23 UTC, mirrors /var/lib/waving-hands
+  to the `kestrel-wizwar-backups` Space under `waving-hands/` (a current copy
+  and dated snapshots kept 90 days). It needs rclone with the Spaces
+  credentials in /root/.config/rclone/rclone.conf, copied by hand from the
+  wizwar droplet; until then it logs "skipped".
+
+Before every deploy, `deploy/verify-ledgers.sh <ip>` fetches every production
+ledger and replays it with the local engine, comparing each room with what the
+server shows. A ledger the new engine refuses or replays differently stops the
+deploy: the server would rewrite that duel on restart.
+
 ## Everyday deploys
 
     deploy/deploy.sh <ip>