Operations in wizwar's shape: the determinism gate, backups, the rollup and the pulse

Every deploy first replays every production ledger with the engine about
to ship. The droplet gains a nightly rollup of counts and a nightly
backup to Spaces, a pulse script the pulse skill reads, rate limits on
opening rooms and taking seats, and eviction of idle rooms from memory
with reload from their ledgers on the next visit.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up

deploy/deploy.sh

@@ -9,6 +9,9 @@ npm run check:server
 npm test
 npm run build
 
+# Every production ledger must replay identically with the engine about to ship.
+deploy/verify-ledgers.sh "$HOST"
+
 # Old hashed chunks stay a week: a page loaded before this deploy can still
 # fetch the module it was built against instead of failing mid-duel.
 rsync -az --delete --filter='P _app/immutable/*' \
@@ -18,7 +21,7 @@ rsync -az --delete --filter='P _app/immutable/*' \
 # it needs only its code and the engine. Ledgers live outside this tree.
 rsync -az --delete --exclude='/server/node_modules' \
   --include='/server/***' --include='/src/' --include='/src/lib/' --include='/src/lib/game/***' \
-  --include='/deploy/' --include='/deploy/waving-hands.service' --include='/deploy/visitors.sh' \
+  --include='/deploy/' --include='/deploy/waving-hands.service' --include='/deploy/waving-hands.cron' --include='/deploy/*.sh' \
   --exclude='*' \
   ./ "root@$HOST:/opt/waving-hands/app/"
 
@@ -29,7 +32,14 @@ ssh "root@$HOST" '
   cd /opt/waving-hands/app/server && npm install --no-audit --no-fund
   chown -R waving-hands:waving-hands /opt/waving-hands/app
   cp /opt/waving-hands/app/deploy/waving-hands.service /etc/systemd/system/waving-hands.service
+  # Cron runs the rollup and the backup from /usr/local/bin: install them on
+  # every deploy so the live copies are always the repo copies.
   install -m 755 /opt/waving-hands/app/deploy/visitors.sh /usr/local/bin/waving-hands-visitors.sh
+  install -m 755 /opt/waving-hands/app/deploy/pulse.sh /usr/local/bin/waving-hands-pulse.sh
+  install -m 755 /opt/waving-hands/app/deploy/waving-hands-rollup.sh /usr/local/bin/waving-hands-rollup.sh
+  install -m 755 /opt/waving-hands/app/deploy/waving-hands-backup.sh /usr/local/bin/waving-hands-backup.sh
+  install -m 644 /opt/waving-hands/app/deploy/waving-hands.cron /etc/cron.d/waving-hands
+  mkdir -p /var/log/waving-hands
   systemctl daemon-reload
   systemctl enable --now waving-hands
   systemctl restart waving-hands