The root address is rewritten to index.html, since try_files passes the root over as a directory and served the shell in place of the hall

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up

.claude/skills/waving-hands-pulse/SKILL.md

@@ -7,7 +7,7 @@ description: The weekly Waving Hands operations pulse — duel server health, er
 
 One command on the droplet prints everything; read it as a short report.
 
-    ssh root@159.203.98.71 waving-hands-pulse.sh
+    ssh root@159.203.115.252 waving-hands-pulse.sh
 
 - **duel server**: whether the service and Caddy are up, restarts and
   journal errors in the last seven days with the last three error lines.

.claude/skills/waving-hands-reports/SKILL.md

@@ -7,7 +7,7 @@ description: Work the Waving Hands reports desk — fetch players' bug reports,
 
 Players file reports from the Report button in a room's masthead (seated
 or from the gallery). Each lands in `/var/lib/waving-hands/feedback.jsonl`
-on the droplet (159.203.98.71) pinned with `roomId`, `turn` (the turn
+on the droplet (159.203.115.252) pinned with `roomId`, `turn` (the turn
 being written when it was filed) and `seq` (the ledger's length then),
 enough to replay the duel to the moment. Replies live in the same file
 and appear under the report in the player's hall. This desk fetches,
@@ -34,7 +34,7 @@ Every report and every player's answer rings a Sentry issue (project
 waving-hands, fingerprinted per report or per line); the desk's own
 replies ring nothing.
 
-Fetch: `ssh root@159.203.98.71 'cat /var/lib/waving-hands/feedback.jsonl'`
+Fetch: `ssh root@159.203.115.252 'cat /var/lib/waving-hands/feedback.jsonl'`
 
 ## a) Fetch and b) display
 
@@ -47,7 +47,7 @@ to hear his players' voices; never compress their words into a table.
 
 ## c) Process an unanswered report
 
-1. **Replay to the pin.** `scp root@159.203.98.71:/var/lib/waving-hands/rooms/<roomId>.jsonl <scratchpad>/`
+1. **Replay to the pin.** `scp root@159.203.115.252:/var/lib/waving-hands/rooms/<roomId>.jsonl <scratchpad>/`
    and replay it with the engine as `deploy/replay-ledgers.ts` does:
    `createGame(names, start.seed)` then `resolveTurn(state, line.inputs)`
    per turn line, printing `state.log` around the pinned turn. The
@@ -70,8 +70,8 @@ to hear his players' voices; never compress their words into a table.
      passing `rules` to `createGame`). Old ledgers then replay as their
      players saw them; new duels get the fix.
    Either way add a test in `src/lib/game/engine.test.ts` pinning the
-   corrected behaviour. Deploy with `deploy/deploy.sh 159.203.98.71`.
-5. **Reply.** `bash deploy/report-reply.sh 159.203.98.71 <reportId> <status> "text"`.
+   corrected behaviour. Deploy with `deploy/deploy.sh 159.203.115.252`.
+5. **Reply.** `bash deploy/report-reply.sh 159.203.115.252 <reportId> <status> "text"`.
    Pass the id as ONE clean argument. Write to the PLAYER: name what you
    replayed, cite the rule, and say plainly what was wrong or why nothing
    was. The desk's voice is warm and specific.

.claude/skills/waving-hands-visitors/SKILL.md

@@ -10,7 +10,7 @@ host glancing over the hall.
 
 ## Gather
 
-    ssh root@159.203.98.71 waving-hands-visitors.sh [YYYY-MM-DD]
+    ssh root@159.203.115.252 waving-hands-visitors.sh [YYYY-MM-DD]
 
 Default is today, UTC; Eric is in US Eastern, so an evening at his desk
 spills into the next UTC day. Run yesterday too when the hour is early.

README.md

@@ -14,7 +14,7 @@ The full rules, as transcribed from the *Duel Purpose* fanzine, are in
 
 ```sh
 npm install
-npm run dev
+npm run dev:all   # the duel server and the site together; Ctrl-C stops both
 ```
 
 The hall at `/` offers two ways in: play the bot at `/play`, or duel a person. A duel between
@@ -45,7 +45,11 @@ Around the two hands:
 A duel against the bot is saved to the browser's local storage after every change, so it
 survives reading the rules, a refresh, or a phone putting the tab to sleep. Starting a new one
 asks first if one is under way. The seats this browser holds at shared duels are remembered the
-same way and listed in the hall with whose move it is. Nothing is rendered on the server.
+same way and listed in the hall with whose move it is; the hall asks before forgetting one
+still in play. A player whose browser lost a seat (Safari's seven days, an app's own browser,
+cleared data) can write to the keeper, whose `waving-hands-reseat.sh` gives the seat a new token
+and prints a link carrying it in the fragment; the old token opens nothing after. Nothing is
+rendered on the server.
 
 ## The duel server
 

deploy/Caddyfile.tmpl

@@ -1,42 +1,52 @@
-__HOST__
+__HOST__ {
+	# The hall-wide notice (hall-announce on the host): one file, served by every game's site.
+	handle_path /hall/* {
+		root * /var/lib/hall
+		header Cache-Control "no-store"
+		file_server
+	}
 
-root * /opt/waving-hands/build
-encode gzip zstd
+	root * /opt/waving-hands/build
+	encode gzip zstd
 
-header {
+	header {
 		Strict-Transport-Security "max-age=31536000"
 		X-Content-Type-Options "nosniff"
 		X-Frame-Options "DENY"
 		Referrer-Policy "no-referrer"
-}
+	}
 
-log {
-	output file /var/lib/caddy/access.log {
+	log {
+		output file /var/lib/caddy/waving-hands-access.log {
 			roll_size 10MiB
 			roll_keep 30
 		}
-}
+	}
 
-# The duel server answers the API and the websocket; a deploy restarts it for
-# a few seconds, and the proxy holds requests that land in that gap.
-@duel path /api/* /ws
-handle @duel {
+	# The game server answers the API and the websocket; a deploy restarts it for
+	# a few seconds, and the proxy holds requests that land in that gap.
+	@game path /api/* /ws
+	handle @game {
 		reverse_proxy localhost:8788 {
 			lb_try_duration 30s
 			lb_try_interval 250ms
 		}
-}
+	}
 
-# Everything else is the static site. SvelteKit writes each route as
-# <route>.html, so /rules is tried as /rules.html before falling back to the
-# app shell, which serves the rooms. Hashed assets under _app/immutable are
-# cached for a year; every other response is revalidated so a deploy shows
-# up on the next load. The two header matchers are disjoint.
-handle {
+	# Everything else is the static site. SvelteKit writes each route as
+	# <route>.html, so /rules is tried as /rules.html before falling back to the
+	# app shell, which serves the rooms. Hashed assets under _app/immutable are
+	# cached for a year; every other response is revalidated so a deploy shows
+	# up on the next load.
+	handle {
 		@immutable path /_app/immutable/*
 		header @immutable Cache-Control "public, max-age=31536000, immutable"
 		@mutable not path /_app/immutable/*
 		header @mutable Cache-Control "no-cache"
-	try_files {path} {path}.html /index.html
+		# try_files passes the root over as a directory and would fall to the shell; the hall's
+		# own page is index.html.
+		rewrite / /index.html
+		try_files {path} {path}.html /shell.html
 		file_server
+	}
 }

deploy/README.md

@@ -1,51 +1,50 @@
 # Deploying Waving Hands
 
-The single-player game runs entirely in the browser. Duels between people
-go through a small Node process that keeps each room as an append-only
-ledger of moves in /var/lib/waving-hands/rooms. Production is one
-DigitalOcean droplet: Caddy terminates TLS with automatic certificates,
-serves the static build from /opt/waving-hands/build, and proxies /api and
-/ws to the duel server on port 8788, which runs as the `waving-hands` user
-under systemd from /opt/waving-hands/app.
+Every game is a room on a small Node process that keeps it as an
+append-only ledger of moves in /var/lib/waving-hands/rooms (the unit names it with WH_DATA_DIR). Production is the
+shared Kestrel's Hall host: Caddy terminates TLS with automatic
+certificates, serves the static build from /opt/waving-hands/build, and proxies
+/api and /ws to the game server on port 8788, which runs as the
+`waving-hands` user under systemd from /opt/waving-hands/app.
 
-## Sizing
+## The shared host
 
-The smallest droplet, `s-1vcpu-512mb-10gb` ($4 a month), carries both Caddy
-and the duel server comfortably: the server is one small Node process capped
-at 300 MB by its unit file, and a room is a few kilobytes of ledger.
-
-The zero-cost alternative is a second site block in an existing Caddy
-server's configuration pointing at a second directory; the deploy script
-works unchanged against that host. A droplet of its own keeps this site's
-uptime and upgrades independent of anything else.
+The games of Kestrel's Hall share one droplet, `hall` (nyc3, s-1vcpu-1gb,
+$6 a month, tag `kestrels-hall`, IP 159.203.115.252). Each game keeps its
+own Caddy site file in /etc/caddy/sites/<slug>.caddy, its own port,
+service user, /opt/<slug> and /var/lib/<slug> trees, access log
+(/var/lib/caddy/<slug>-access.log), cron file and ops scripts;
+/etc/caddy/Caddyfile only says `import sites/*.caddy`. A game server is one
+small Node process capped at 300 MB by its unit file, and a room is a few
+kilobytes of ledger, so the host carries several. Each game needs a port
+of its own on the host: wizwar 8787, waving-hands 8788, hnefatafl 8789,
+dip 8790.
 
 ## Current production
 
-- Droplet: `waving-hands` (nyc3, s-1vcpu-512mb-10gb, tag `waving-hands`), IP 159.203.98.71
-- URLs: https://hands.kestrelsnest.social (A record at Hover, where
-  kestrelsnest.social's DNS lives) and https://waving-hands.159.203.98.71.sslip.io
-  (always works, zero DNS). Caddy serves both from the first line of
-  /etc/caddy/Caddyfile.
-- Everyday deploy: `deploy/deploy.sh 159.203.98.71`
+- Host: 159.203.115.252
+- URLs: https://hands.kestrelsnest.social (A record at Hover, where kestrelsnest.social's
+  DNS lives) and https://hands.159.203.115.252.sslip.io (always works, zero DNS).
+- Everyday deploy: `SITE=https://hands.159.203.115.252.sslip.io deploy/deploy.sh 159.203.115.252`
+  (this Mac's resolver caches the old *.kestrelsnest.social wildcard, so the gate reads the sslip name).
+- Moved here from its own droplet (159.203.98.71) on 2026-09-25.
 - Players' reports: `deploy/pull-reports.sh` mirrors /var/lib/waving-hands/feedback.jsonl
   and the screenshots to ~/Desktop/waving-hands-reports with a digest;
-  `deploy/report-reply.sh 159.203.98.71 <id> <status> "text"` answers one.
+  `deploy/report-reply.sh 159.203.115.252 <id> <status> "text"` answers one.
 
-## New droplet from scratch
+## Adding this game to the host
 
-1. `doctl compute droplet create waving-hands --region nyc3 \
-    --size s-1vcpu-512mb-10gb --image ubuntu-24-04-x64 \
-    --ssh-keys <your-key-ids> --tag-name waving-hands --wait`
-2. `scp deploy/setup-droplet.sh deploy/Caddyfile.tmpl root@<ip>:/root/ && ssh root@<ip> \
-    "bash /root/setup-droplet.sh 'hands.kestrelsnest.social, waving-hands.<ip>.sslip.io'"`
-   (point the A record at the new IP first, or leave the real name out until it is).
-3. `scp deploy/setup-server.sh deploy/Caddyfile.tmpl root@<ip>:/root/ && ssh root@<ip> "bash /root/setup-server.sh"`
-4. `deploy/deploy.sh <ip>`
+1. `scp deploy/setup-droplet.sh deploy/Caddyfile.tmpl root@<ip>:/root/ && ssh root@<ip> \
+    "bash /root/setup-droplet.sh 'hands.kestrelsnest.social, hands.<ip>.sslip.io'"`
+   It installs Caddy and Node if the host lacks them, writes this game's
+   site file, and touches nothing of another game's. Point the A record at
+   the host first, or leave the real name out until it is; running it again
+   with the new line is how a name is added later.
+2. `deploy/deploy.sh <ip>`
 
-The sslip.io hostname works with no DNS at all. To add a real name, point an
-A record at the droplet and add the name to the first line of
-/etc/caddy/Caddyfile (space separated), then `systemctl reload caddy`; Caddy
-fetches the certificate on first request.
+A fresh host, when one is needed: `doctl compute droplet create hall --region nyc3 \
+--size s-1vcpu-1gb --image ubuntu-24-04-x64 --ssh-keys <your-key-ids> \
+--tag-name kestrels-hall --wait`, then step 1.
 
 ## Operations scripts on the droplet
 
@@ -53,6 +52,14 @@ fetches the certificate on first request.
 /etc/cron.d/waving-hands on every deploy, so the live copies are the repo copies:
 
 - `waving-hands-visitors.sh [day]`: who is here now and who came that day.
+- `waving-hands-reseat.sh ROOM [SEAT]`: who sits at a table; with a seat, a new
+  token for a player locked out of it, as a link to send them. It answers
+  through the duel server's `/keeper` door, which Caddy does not proxy and
+  which asks for the key in /etc/waving-hands/keeper.key, made by the deploy
+  and readable by root and the waving-hands user alone.
+- `waving-hands-say.sh ROOM "text"`: a word from the keeper in a table's
+  talk, signed as the keeper, through the same door; it is heard whether or
+  not the gallery may talk, so a call that came too late can be answered.
 - `waving-hands-pulse.sh`: the weekly health check (service, errors, rollup
   trend, backup, box).
 - `waving-hands-rollup.sh [day]`: one JSON line per day of counts, run

deploy/deploy.sh

@@ -4,6 +4,10 @@
 set -euo pipefail
 HOST="${1:?usage: deploy.sh <droplet-ip-or-host>}"
 
+# The family list is the kit's; a game deploys with the kit's latest copy when the kit is beside it.
+KIT_FAMILY="$(dirname "$0")/../../game-kit/family.json"
+[ -f "$KIT_FAMILY" ] && cp "$KIT_FAMILY" static/family.json
+
 npm run check
 npm run check:server
 npm test
@@ -21,7 +25,7 @@ rsync -az --delete --filter='P _app/immutable/*' \
 # it needs only its code and the engine. Ledgers live outside this tree.
 rsync -az --delete --exclude='/server/node_modules' \
   --include='/server/***' --include='/src/' --include='/src/lib/' --include='/src/lib/game/***' \
-  --include='/deploy/' --include='/deploy/waving-hands.service' --include='/deploy/waving-hands.cron' --include='/deploy/*.sh' --include='/deploy/hash-tokens.ts' \
+  --include='/deploy/' --include='/deploy/waving-hands.service' --include='/deploy/waving-hands.cron' --include='/deploy/*.sh' --include='/deploy/Caddyfile.tmpl' --include='/deploy/hash-tokens.ts' --include='/deploy/traffic.py' \
   --exclude='*' \
   ./ "root@$HOST:/opt/waving-hands/app/"
 
@@ -35,14 +39,33 @@ ssh "root@$HOST" '
   # Cron runs the rollup and the backup from /usr/local/bin: install them on
   # every deploy so the live copies are always the repo copies.
   install -m 755 /opt/waving-hands/app/deploy/visitors.sh /usr/local/bin/waving-hands-visitors.sh
+  install -m 644 -D /opt/waving-hands/app/deploy/traffic.py /usr/local/lib/waving-hands/traffic.py
   install -m 755 /opt/waving-hands/app/deploy/pulse.sh /usr/local/bin/waving-hands-pulse.sh
   install -m 755 /opt/waving-hands/app/deploy/waving-hands-rollup.sh /usr/local/bin/waving-hands-rollup.sh
   install -m 755 /opt/waving-hands/app/deploy/waving-hands-backup.sh /usr/local/bin/waving-hands-backup.sh
-  install -m 644 /opt/waving-hands/app/deploy/waving-hands.cron /etc/cron.d/waving-hands
+  install -m 755 /opt/waving-hands/app/deploy/waving-hands-reseat.sh /usr/local/bin/waving-hands-reseat.sh
+  install -m 755 /opt/waving-hands/app/deploy/waving-hands-say.sh /usr/local/bin/waving-hands-say.sh
+  # The key to the keeper door: made once, readable by root (the reseat script) and the game user (the server) alone.
+  if [ ! -s /etc/waving-hands/keeper.key ]; then
+    install -d -m 750 -o root -g waving-hands /etc/waving-hands
+    (umask 037; openssl rand -hex 32 > /etc/waving-hands/keeper.key)
+    chown root:waving-hands /etc/waving-hands/keeper.key
+  fi
+  # On a host the hall shares, its hall-nightly.sh runs the rollup and backup
+  # of every game and checks in with Sentry once for all; a game on a box of
+  # its own schedules its own.
+  if [ -f /etc/cron.d/gamehall ]; then rm -f /etc/cron.d/waving-hands
+  else install -m 644 /opt/waving-hands/app/deploy/waving-hands.cron /etc/cron.d/waving-hands; fi
   mkdir -p /var/log/waving-hands
   systemctl daemon-reload
   systemctl enable --now waving-hands
   systemctl restart waving-hands
+  # The site file is rendered from the template on every deploy, with the address line the box was set up with.
+  ADDR=$(head -1 /etc/caddy/sites/waving-hands.caddy | sed "s/ {\$//")
+  sed "s|__HOST__|$ADDR|" /opt/waving-hands/app/deploy/Caddyfile.tmpl > /etc/caddy/sites/waving-hands.caddy
+  caddy validate --config /etc/caddy/Caddyfile >/dev/null
+  # Validation as root touches the access logs; Caddy runs as caddy and must own them.
+  chown -R caddy:caddy /var/lib/caddy
   systemctl reload caddy
   sleep 1
   systemctl --no-pager -l status waving-hands | head -3

deploy/pull-reports.sh

@@ -3,7 +3,7 @@
 # to a local folder, and write a digest beside them for reading.
 #   deploy/pull-reports.sh [host] [folder]   (default ~/Desktop/waving-hands-reports)
 set -euo pipefail
-HOST="${1:-159.203.98.71}"
+HOST="${1:-159.203.115.252}"
 OUT="${2:-$HOME/Desktop/waving-hands-reports}"
 mkdir -p "$OUT/images"
 scp -q "root@$HOST:/var/lib/waving-hands/feedback.jsonl" "$OUT/feedback.jsonl" 2>/dev/null || : > "$OUT/feedback.jsonl"

deploy/pulse.sh

@@ -33,4 +33,4 @@ else
 fi
 echo "--- box"
 echo "disk: $(df -h / | awk 'NR==2{print $5" used of "$2}'); memory: $(free -m | awk 'NR==2{print $7" MB available of "$2}'); load: $(cut -d' ' -f1-3 /proc/loadavg)"
-echo "caddy access log: $(du -sh /var/lib/caddy/access.log 2>/dev/null | cut -f1) live, $(ls /var/lib/caddy/access*.log* 2>/dev/null | wc -l) files"
+echo "caddy access log: $(du -sh /var/lib/caddy/waving-hands-access.log 2>/dev/null | cut -f1) live, $(ls /var/lib/caddy/waving-hands-access*.log* 2>/dev/null | wc -l) files"

deploy/setup-droplet.sh

@@ -1,34 +1,69 @@
 #!/usr/bin/env bash
-# One-time droplet setup. Copy this script and Caddyfile.tmpl to the droplet
-# and run ON the droplet as root:
-#   bash setup-droplet.sh 'hands.kestrelsnest.social, waving-hands.<droplet-ip>.sslip.io'
-# The argument is the Caddy site address line: one name, or several
-# separated by commas. Every name must already resolve to this droplet.
-# Waving Hands is a static site: Caddy serves the built files and terminates
-# TLS. There is no application process to install or supervise.
+# Prepare a host for Waving Hands. The host may be shared with other games of
+# Kestrel's Hall: each keeps its own Caddy site file in /etc/caddy/sites, its
+# own port, service user, data directory and access log, and this script
+# touches nothing that belongs to another game. Copy it and Caddyfile.tmpl
+# to the host and run ON it as root; safe to run again.
+#   bash setup-droplet.sh 'hands.kestrelsnest.social, waving-hands.<host-ip>.sslip.io'
+# The argument is this game's Caddy site address line: one name, or several
+# separated by commas. Every name must already resolve to this host.
 set -euo pipefail
-HOST="${1:?usage: setup-droplet.sh <hostname>}"
+HOST="${1:?usage: setup-droplet.sh <site address line>}"
 
 apt-get update -q
 apt-get install -qy curl rsync
 
-# Caddy (auto-HTTPS)
-apt-get install -qy debian-keyring debian-archive-keyring apt-transport-https
-curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
+# Caddy (auto-HTTPS), once per host.
+if ! command -v caddy >/dev/null; then
+  apt-get install -qy debian-keyring debian-archive-keyring apt-transport-https
+  curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
     | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
-curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
+  curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
     | tee /etc/apt/sources.list.d/caddy-stable.list
-apt-get update -q && apt-get install -qy caddy
+  apt-get update -q && apt-get install -qy caddy
+fi
 
-# Site directory, readable by Caddy.
-mkdir -p /opt/waving-hands/build
-chown -R root:caddy /opt/waving-hands
-chmod -R g+rX /opt/waving-hands
+# Node 22, once per host; every game runs its server on it.
+if ! command -v node >/dev/null || [[ "$(node -v)" != v22* ]]; then
+  curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+  apt-get install -qy nodejs
+fi
+
+# The host's Caddyfile only gathers the games' site files. A Caddyfile that
+# is neither Caddy's stock one nor this is a single-game host from before the
+# shared layout: stop rather than overwrite it.
+ROOT_CADDY='# Kestrel'"'"'s Hall: every game on this host brings its own site file.
+import sites/*.caddy'
+mkdir -p /etc/caddy/sites
+if ! grep -q '^import sites/\*.caddy' /etc/caddy/Caddyfile 2>/dev/null; then
+  if [ -s /etc/caddy/Caddyfile ] && ! grep -q 'root \* /usr/share/caddy' /etc/caddy/Caddyfile; then
+    echo "/etc/caddy/Caddyfile holds another site; move it into /etc/caddy/sites/ first" >&2
+    exit 1
+  fi
+  printf '%s\n' "$ROOT_CADDY" > /etc/caddy/Caddyfile
+fi
+
+# This game: its user, its directories, its site.
+# The service user shares the slug. A slug that is already a system group
+# (Ubuntu ships "dip", "games", "audio" and others) cannot also be a user:
+# stop and say so, and choose another user name in this script and the unit.
+if ! id -u waving-hands &>/dev/null; then
+  if getent group waving-hands >/dev/null; then
+    echo "a system group is already called waving-hands; pick another service user name" >&2
+    exit 1
+  fi
+  useradd -r -m -d /opt/waving-hands-home waving-hands
+fi
+mkdir -p /opt/waving-hands/build /opt/waving-hands/app /var/lib/waving-hands/rooms /var/log/waving-hands
+chown -R root:caddy /opt/waving-hands/build
+chmod -R g+rX /opt/waving-hands/build
+chown -R waving-hands:waving-hands /var/lib/waving-hands
+sed "s|__HOST__|$HOST|" "$(dirname "$0")/Caddyfile.tmpl" > /etc/caddy/sites/waving-hands.caddy
 
-# Caddy: the site and the duel server's paths, from the template beside this script.
-sed "s|__HOST__|$HOST|" "$(dirname "$0")/Caddyfile.tmpl" > /etc/caddy/Caddyfile
 caddy validate --config /etc/caddy/Caddyfile
-systemctl reload caddy
+# Validation as root touches the access logs; Caddy runs as caddy and must own them.
+chown -R caddy:caddy /var/lib/caddy
+systemctl reload-or-restart caddy
 
 # Firewall: ssh + web only.
 ufw allow OpenSSH
@@ -36,4 +71,4 @@ ufw allow 80/tcp
 ufw allow 443/tcp
 ufw --force enable
 
-echo "droplet ready: now run deploy/deploy.sh <ip> from your machine"
+echo "host ready for waving-hands: now run deploy/deploy.sh <ip> from your machine"

deploy/setup-server.sh

@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-# Adds the duel server to a droplet that setup-droplet.sh already prepared.
-# Copy this script and Caddyfile.tmpl to the droplet and run ON the droplet
-# as root; safe to run again. Installs Node 22, creates the service user and
-# data directory, and teaches Caddy to hand /api and /ws to the server while
-# it keeps serving the static site itself.
-set -euo pipefail
-
-if ! command -v node >/dev/null || [[ "$(node -v)" != v22* ]]; then
-  curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
-  apt-get install -qy nodejs
-fi
-
-id -u waving-hands &>/dev/null || useradd -r -m -d /opt/waving-hands-home waving-hands
-mkdir -p /opt/waving-hands/app /var/lib/waving-hands/rooms
-chown -R waving-hands:waving-hands /var/lib/waving-hands
-
-# Caddy: rewrite the site's configuration from the template, keeping its
-# address line, so the duel server's paths are routed before the files.
-HOST_LINE=$(head -1 /etc/caddy/Caddyfile)
-sed "s|__HOST__|$HOST_LINE|" "$(dirname "$0")/Caddyfile.tmpl" > /etc/caddy/Caddyfile
-caddy validate --config /etc/caddy/Caddyfile
-systemctl reload caddy
-
-echo "server prerequisites ready: now run deploy/deploy.sh <ip> from your machine"

deploy/traffic.py

@@ -0,0 +1,171 @@
+"""Caddy's access log for one day, people and bots apart. The visitors
+digest and the nightly rollup both count through here, so they agree."""
+
+import datetime
+import glob
+import gzip
+import json
+import os
+import re
+from collections import Counter, defaultdict
+
+BOT = re.compile(r"bot|crawl|spider|slurp|facebookexternalhit|slack|discord|twitter|whatsapp|telegram|preview|fetch|curl|python|go-http|wget|headless|scan|monitor|uptime", re.I)
+# Link previews: the app that fetched the page to show it in a conversation. The people
+# who click such a link arrive with no referrer, so this is the best sign of where it went.
+UNFURL = [
+    ("Slack", re.compile(r"slack", re.I)),
+    ("Discord", re.compile(r"discord", re.I)),
+    ("iMessage", re.compile(r"facebookexternalhit.*twitterbot|applebot.*preview", re.I)),
+    ("Facebook", re.compile(r"facebookexternalhit|facebot|meta-externalagent", re.I)),
+    ("WhatsApp", re.compile(r"whatsapp", re.I)),
+    ("Telegram", re.compile(r"telegram", re.I)),
+    ("Reddit", re.compile(r"redditbot", re.I)),
+    ("LinkedIn", re.compile(r"linkedinbot", re.I)),
+    ("Mastodon", re.compile(r"mastodon", re.I)),
+    ("Bluesky", re.compile(r"bluesky|cardyb", re.I)),
+    ("X", re.compile(r"twitterbot", re.I)),
+]
+# Paths nobody asks a game for but a vulnerability scanner: its address is a bot's all day.
+# Matched against whole path segments, never the site's own hashed assets under /_app/.
+SCANNER = re.compile(r"\.php$|(^|/)(\.env|\.git|\.aws|wp-admin|wp-login|wp-content|wp-includes|wordpress|phpmyadmin|cgi-bin|vendor|actuator|boaform|owa|admin)(/|$)", re.I)
+PAGES = {"/": "hall", "/play": "play", "/rules": "rules"}
+SITE = "hands.kestrelsnest.social"
+# Each game on a shared host keeps its own access log.
+LOGS = "/var/lib/caddy/waving-hands-access*.log*"
+# The site's own addresses, for telling a referrer from a move between its pages: its domain, and its sslip.io name.
+OWN = re.compile(re.escape(SITE) + r"|\.sslip\.io\b", re.I)
+# Requests from one address more than this far apart are separate visits.
+VISIT_GAP = 30 * 60
+
+
+def unfurled_by(ua):
+    """The app a link preview came from, or None."""
+    for name, pattern in UNFURL:
+        if pattern.search(ua):
+            return name
+    return None
+
+
+def scan(day, logs=LOGS):
+    """Counts for one UTC day (YYYY-MM-DD): every request, page requests by
+    people, the addresses of people and of bots, requests by page, room links
+    opened, rooms opened from the site itself, where links were shared,
+    referrers, and campaign tags (each counted once per address).
+
+    A request is a bot's when its browser says so. An address is a bot's for
+    the whole day when it asks for a scanner's paths, or comes back for pages
+    three visits or more without ever opening or joining a game: a monitor,
+    not a person. A monitor that takes a new address every visit gives itself
+    away by keeping time: one browser, page loads at a steady interval, four
+    visits or more, never a game."""
+    d0 = datetime.datetime.fromisoformat(day).replace(tzinfo=datetime.timezone.utc)
+    t0, t1 = d0.timestamp(), (d0 + datetime.timedelta(days=1)).timestamp()
+    requests = []
+    for f in sorted(glob.glob(logs)):
+        if os.path.getmtime(f) < t0:
+            continue
+        opener = gzip.open if f.endswith(".gz") else open
+        try:
+            with opener(f, "rt", errors="ignore") as fh:
+                for line in fh:
+                    try:
+                        r = json.loads(line)
+                    except ValueError:
+                        continue
+                    if t0 <= r.get("ts", 0) < t1:
+                        requests.append(r)
+        except OSError:
+            continue
+
+    # First pass: what each address did all day under a browser's name, to find scanners and monitors.
+    seen = defaultdict(lambda: dict(times=[], played=False, scanner=False))
+    for r in requests:
+        q = r.get("request", {})
+        ip = q.get("client_ip") or q.get("remote_ip") or "?"
+        ua = " ".join(q.get("headers", {}).get("User-Agent", [""]))
+        if BOT.search(ua) or not ua:
+            continue
+        path = q.get("uri", "").split("?")[0]
+        a = seen[ip]
+        a["times"].append(r.get("ts", 0))
+        if not path.startswith("/_app/") and SCANNER.search(path):
+            a["scanner"] = True
+        if path.startswith(("/join/", "/api/rooms")) or path == "/ws":
+            a["played"] = True
+
+    def visits(times):
+        n, last = 0, None
+        for ts in sorted(times):
+            if last is None or ts - last > VISIT_GAP:
+                n += 1
+            last = ts
+        return n
+
+    def keeps_time(times):
+        starts, last = [], None
+        for ts in sorted(times):
+            if last is None or ts - last > VISIT_GAP:
+                starts.append(ts)
+            last = ts
+        gaps = [b - a for a, b in zip(starts, starts[1:])]
+        if len(starts) < 4:
+            return False
+        typical = sorted(gaps)[len(gaps) // 2]
+        return all(0.75 * typical <= g <= 1.25 * typical for g in gaps)
+
+    scanners = {ip for ip, a in seen.items() if a["scanner"]}
+    monitors = {ip for ip, a in seen.items() if not (a["scanner"] or a["played"]) and visits(a["times"]) >= 3}
+    by_browser = defaultdict(list)
+    for r in requests:
+        q = r.get("request", {})
+        ip = q.get("client_ip") or q.get("remote_ip") or "?"
+        ua = " ".join(q.get("headers", {}).get("User-Agent", [""]))
+        if ua and not BOT.search(ua) and q.get("uri", "").split("?")[0] in PAGES and not seen[ip]["played"]:
+            by_browser[ua].append((r.get("ts", 0), ip))
+    for hits in by_browser.values():
+        if keeps_time([ts for ts, _ in hits]):
+            monitors |= {ip for _, ip in hits}
+    posing = scanners | monitors
+
+    t = dict(
+        requests=0, human=0, bot=0, addresses=set(), botAddresses=set(), pages=Counter(), joins=Counter(),
+        opened=0, shared=Counter(), scanners=len(scanners), monitors=len(monitors), referrers=Counter(), campaigns=Counter(),
+    )
+    seen_campaign = set()
+    seen_share = set()
+    for r in requests:
+        q = r.get("request", {})
+        h = q.get("headers", {})
+        ua = " ".join(h.get("User-Agent", [""]))
+        ip = q.get("client_ip") or q.get("remote_ip") or "?"
+        uri = q.get("uri", "")
+        path = uri.split("?")[0]
+        t["requests"] += 1
+        if ip in posing or BOT.search(ua) or not ua:
+            t["bot"] += 1
+            t["botAddresses"].add(ip)
+            service = unfurled_by(ua)
+            # One share per app and page: a preview is often fetched twice.
+            if service and (service, path) not in seen_share:
+                seen_share.add((service, path))
+                t["shared"][service] += 1
+            continue
+        # A room opened from the site itself never passes through /join: count the API's answer.
+        if q.get("method") == "POST" and path == "/api/rooms" and 200 <= r.get("status", 0) < 300:
+            t["opened"] += 1
+        if path.startswith(("/_app/", "/api/")) or path == "/ws" or path.endswith((".png", ".ico", ".txt")):
+            continue
+        t["human"] += 1
+        t["addresses"].add(ip)
+        if path in PAGES:
+            t["pages"][PAGES[path]] += 1
+        elif path.startswith("/join/"):
+            t["joins"][path.split("/")[2].upper()] += 1
+        ref = " ".join(h.get("Referer", [""]))
+        if ref and not OWN.search(ref):
+            t["referrers"][re.sub(r"^https?://", "", ref).split("/")[0]] += 1
+        m = re.search(r"[?&](ref|utm_source|fbclid)=([^&]*)", uri)
+        if m and (ip, m.group(1)) not in seen_campaign:
+            seen_campaign.add((ip, m.group(1)))
+            t["campaigns"][m.group(1) + ("=" + m.group(2)[:24] if m.group(1) != "fbclid" else "")] += 1
+    return t

deploy/verify-ledgers.sh

@@ -6,7 +6,7 @@
 #   deploy/verify-ledgers.sh <droplet-ip-or-host> [https://site]
 set -euo pipefail
 HOST="${1:?usage: verify-ledgers.sh <droplet-ip-or-host> [https://site]}"
-SITE="${2:-https://hands.kestrelsnest.social}"
+SITE="${2:-${SITE:-https://hands.kestrelsnest.social}}"
 DIR="$(mktemp -d)"
 trap 'rm -rf "$DIR"' EXIT
 rsync -az "root@$HOST:/var/lib/waving-hands/rooms/" "$DIR/"

deploy/visitors.sh

@@ -25,50 +25,12 @@ print("live sockets: %s | rooms touched in the last hour: %s" % (
     sh("find /var/lib/waving-hands/rooms -name '*.jsonl' -mmin -60 2>/dev/null | wc -l")))
 
 # --- traffic: Caddy's access log, people and bots apart ---
-BOT = re.compile(r"bot|crawl|spider|slurp|facebookexternalhit|preview|fetch|curl|python|go-http|headless|scan|monitor|uptime", re.I)
-PAGES = {"/": "hall", "/play": "play", "/rules": "rules"}
-addresses, bots = set(), set()
-pages, joins, referrers, campaigns, agents = Counter(), Counter(), Counter(), Counter(), Counter()
-requests = 0
-for path in sorted(glob.glob("/var/lib/caddy/access.log*")):
-    try:
-        with open(path) as f:
-            for line in f:
-                try:
-                    x = json.loads(line)
-                except Exception:
-                    continue
-                ts = datetime.datetime.fromtimestamp(x["ts"], datetime.timezone.utc)
-                if ts.strftime("%F") != day:
-                    continue
-                req = x["request"]
-                ua = " ".join(req.get("headers", {}).get("User-Agent", [""]))
-                ip = req.get("remote_ip") or req.get("client_ip", "?")
-                uri = req.get("uri", "")
-                path_only = uri.split("?")[0]
-                if BOT.search(ua) or not ua:
-                    bots.add(ip)
-                    continue
-                if path_only.startswith("/_app/") or path_only.startswith("/api/") or path_only == "/ws" or path_only.endswith((".png", ".ico", ".txt")):
-                    continue
-                requests += 1
-                addresses.add(ip)
-                if path_only in PAGES:
-                    pages[PAGES[path_only]] += 1
-                elif path_only.startswith("/join/"):
-                    joins[path_only.split("/")[2].upper()] += 1
-                ref = " ".join(req.get("headers", {}).get("Referer", [""]))
-                if ref and "hands.kestrelsnest.social" not in ref:
-                    referrers[re.sub(r"^https?://", "", ref).split("/")[0]] += 1
-                m = re.search(r"[?&](ref|utm_source|fbclid)=([^&]*)", uri)
-                if m:
-                    campaigns[m.group(1) + "=" + m.group(2)[:24]] += 1
-                agents[re.sub(r"\(.*?\)", "", ua)[:40].strip()] += 1
-    except OSError:
-        continue
-print("traffic: %d addresses of people, %d page requests (%d bot addresses); hall %d, play %d, rules %d, room links %s; referrers %s; campaigns %s" % (
-    len(addresses), requests, len(bots), pages["hall"], pages["play"], pages["rules"],
-    dict(joins) or "none", dict(referrers) or "none", dict(campaigns) or "none"))
+sys.path.insert(0, "/usr/local/lib/waving-hands")
+import traffic
+t = traffic.scan(day)
+print("traffic: %d addresses of people, %d page requests (%d bot addresses, of them %d scanners, %d monitors); hall %d, play %d, rules %d; rooms opened here %d, room links %s; shared on %s; referrers %s; campaigns %s" % (
+    len(t["addresses"]), t["human"], len(t["botAddresses"]), t["scanners"], t["monitors"], t["pages"]["hall"], t["pages"]["play"], t["pages"]["rules"],
+    t["opened"], dict(t["joins"]) or "none", dict(t["shared"]) or "none", dict(t["referrers"]) or "none", dict(t["campaigns"]) or "none"))
 
 # --- rooms: every ledger, today's in detail ---
 first_seen = {}
@@ -82,7 +44,7 @@ for f in glob.glob("/var/lib/waving-hands/rooms/*.jsonl"):
         continue
     created = datetime.datetime.fromtimestamp(meta["createdAt"] / 1000, datetime.timezone.utc)
     humans, bots_seated, started, turns, last, over, talk = [], [], False, 0, created, None, 0
-    names = {}
+    names, seat_changes = {}, []
     for x in lines[1:]:
         if x["t"] == "seat":
             (bots_seated if x["bot"] else humans).append(x["name"])
@@ -94,6 +56,10 @@ for f in glob.glob("/var/lib/waving-hands/rooms/*.jsonl"):
         elif x["t"] == "turn":
             turns += 1
             last = datetime.datetime.fromtimestamp(x["at"] / 1000, datetime.timezone.utc)
+        elif x["t"] == "standIn":
+            seat_changes.append("%s %s's seat to a bot" % (datetime.datetime.fromtimestamp(x["at"] / 1000, datetime.timezone.utc).strftime("%H:%M"), names.get(x["id"], x["id"])))
+        elif x["t"] == "reseat":
+            seat_changes.append("%s %s re-seated" % (datetime.datetime.fromtimestamp(x["at"] / 1000, datetime.timezone.utc).strftime("%H:%M"), names.get(x["id"], x["id"])))
         elif x["t"] == "chat":
             talk += 1
         elif x["t"] == "over":
@@ -101,7 +67,7 @@ for f in glob.glob("/var/lib/waving-hands/rooms/*.jsonl"):
     for h in humans:
         if h not in first_seen or created < first_seen[h]:
             first_seen[h] = created
-    rooms.append(dict(id=meta["id"], size=meta["seats"], created=created, humans=humans, bots=bots_seated, started=started, turns=turns, last=last, over=over, talk=talk))
+    rooms.append(dict(id=meta["id"], size=meta["seats"], created=created, humans=humans, bots=bots_seated, started=started, turns=turns, last=last, over=over, talk=talk, seat_changes=seat_changes))
 
 today = sorted([r for r in rooms if r["created"].strftime("%F") == day], key=lambda r: r["created"])
 names = sorted({h for r in today for h in r["humans"]})
@@ -118,4 +84,6 @@ for r in today:
         r["created"].strftime("%H:%M"), r["id"], seated, (" (%d seat%s empty)" % (empty, "" if empty == 1 else "s")) if empty else "",
         state, r["turns"], span, r["last"].strftime("%H:%M") if r["turns"] else "never",
         ("  %d line%s of talk" % (r["talk"], "" if r["talk"] == 1 else "s")) if r["talk"] else ""))
+    for change in r["seat_changes"]:
+        print("        %s" % change)
 PY

deploy/waving-hands-backup.sh

@@ -5,6 +5,8 @@
 # Ledgers are append-only JSONL; the duel server never needs stopping.
 # Sentry Crons check-in: /root/.waving-hands-sentry-cron holds the check-in
 # URL (absent file = no check-ins). SCHEDULE must match /etc/cron.d/waving-hands.
+# On a host the hall shares, hall-nightly.sh runs this and checks in once
+# for every game, so the file is absent and the exit status is the word.
 set -u
 SCHEDULE="23 7 * * *"
 BUCKET="kestrel-wizwar-backups"
@@ -14,25 +16,31 @@ LOG="/var/log/waving-hands/backup.log"
 STAMP=$(date +%Y-%m-%d)
 mkdir -p "$(dirname "$LOG")"
 CRON_URL=$(cat /root/.waving-hands-sentry-cron 2>/dev/null || true)
+# One check-in, when the run ends, carrying its duration: a start and a
+# finish sent seconds apart can reach Sentry in either order, and a start
+# that lands second is never closed. A run that never ends sends nothing,
+# and Sentry marks the night missed.
+START=$SECONDS
 checkin() {
   [ -n "$CRON_URL" ] && curl -sf -o /dev/null -X POST -H "Content-Type: application/json" \
-    -d "{\"status\":\"$1\",\"monitor_config\":{\"schedule\":{\"type\":\"crontab\",\"value\":\"$SCHEDULE\"},\"checkin_margin\":30,\"max_runtime\":10,\"timezone\":\"UTC\"}}" \
+    -d "{\"status\":\"$1\",\"duration\":$((SECONDS - START)),\"monitor_config\":{\"schedule\":{\"type\":\"crontab\",\"value\":\"$SCHEDULE\"},\"checkin_margin\":30,\"max_runtime\":10,\"timezone\":\"UTC\"}}" \
     "$CRON_URL" || true
 }
 
 if [ ! -s /root/.config/rclone/rclone.conf ]; then
   echo "$(date -Is) skipped: rclone is not configured" >> "$LOG"
-  exit 0
+  exit 1
 fi
 
+status=0
 {
   echo "=== $(date -Is) backup start"
-  checkin in_progress
   if rclone sync "$SRC" "spaces:$BUCKET/$PREFIX/current" --exclude 'rollup.jsonl' 2>&1 &&
      rclone copy "$SRC" "spaces:$BUCKET/$PREFIX/snapshots/$STAMP" 2>&1; then
     checkin ok
   else
     checkin error
+    status=1
   fi
   CUTOFF=$(date -d "90 days ago" +%Y-%m-%d)
   rclone lsf "spaces:$BUCKET/$PREFIX/snapshots/" --dirs-only 2>/dev/null | \
@@ -45,3 +53,4 @@ fi
   done
   echo "=== $(date -Is) backup done"
 } >> "$LOG" 2>&1
+exit $status

deploy/waving-hands-reseat.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# A way back for a player whose browser lost their seat: the seat gets a new
+# token, the old one stops working, and the link printed carries the new one.
+# Whether the one asking holds that seat is the keeper's call; send the link
+# only to them. Runs ON the droplet, through the duel server's keeper door.
+#   waving-hands-reseat.sh ROOM          who sits at the table, and when each wizard last moved or spoke
+#   waving-hands-reseat.sh ROOM SEAT     re-seat SEAT and print the link
+set -euo pipefail
+ROOM="${1:?usage: waving-hands-reseat.sh ROOM [SEAT]}"
+DOOR="http://127.0.0.1:8788/keeper/rooms/${ROOM^^}"
+[ -s /etc/waving-hands/keeper.key ] || { echo "No keeper's key at /etc/waving-hands/keeper.key; a deploy makes it." >&2; exit 1; }
+# The key goes as a header read from a file descriptor, never on a command line another user could see.
+KEY="@/dev/fd/3"
+exec 3< <(printf 'x-keeper-key: %s\n' "$(cat /etc/waving-hands/keeper.key)")
+if [ $# -lt 2 ]; then
+  curl -s -H "$KEY" "$DOOR" | python3 -c '
+import datetime, json, sys
+r = json.load(sys.stdin)
+if "error" in r: sys.exit(r["error"])
+print("room %s, %s" % (r["roomId"], "in play" if r["started"] else "not begun"))
+for s in r["seats"]:
+    when = "bot" if s["bot"] else ("a bot stands in; " if s.get("standIn") else "") + ("never moved or spoke" if s["lastActed"] is None else "last acted " + datetime.datetime.fromtimestamp(s["lastActed"] / 1000, datetime.timezone.utc).strftime("%Y-%m-%d %H:%M UTC"))
+    print("  %-3s %-24s %s" % (s["id"], s["name"], when))
+'
+else
+  curl -s -X POST -H "$KEY" -H 'content-type: application/json' -d "{\"seat\":\"${2^^}\"}" "$DOOR/reseat" | python3 -c '
+import json, sys
+r = json.load(sys.stdin)
+if "error" in r: sys.exit(r["error"])
+print("%s has a new token; their old one opens nothing now. Send them this link:" % r["name"])
+print(r["link"])
+'
+fi

deploy/waving-hands-rollup.sh

@@ -8,7 +8,9 @@
 #   Cron: /etc/cron.d/waving-hands, installed by deploy.sh; SCHEDULE below
 #   must match it, because the Sentry monitor is told the same shape.
 #   Sentry Crons check-in: /root/.waving-hands-sentry-cron-rollup holds the
-#   check-in URL (absent = no check-ins).
+#   check-in URL (absent = no check-ins). On a host the hall shares,
+#   hall-nightly.sh runs this and checks in once for every game, so the
+#   file is absent and the exit status is the word.
 set -u
 OUT="/var/lib/waving-hands/rollup.jsonl"
 LOG="/var/log/waving-hands/rollup.log"
@@ -16,53 +18,25 @@ DAY="${1:-$(date -u -d 'yesterday' +%Y-%m-%d)}"
 SCHEDULE="12 0 * * *"
 CRON_URL=$(cat /root/.waving-hands-sentry-cron-rollup 2>/dev/null || true)
 # The check-in carries the schedule: Sentry keeps a monitor only once told its shape.
+# One check-in, when the run ends, carrying its duration: a start and a
+# finish sent seconds apart can reach Sentry in either order, and a start
+# that lands second is never closed. A run that never ends sends nothing,
+# and Sentry marks the night missed.
+START=$SECONDS
 checkin() {
   [ -n "$CRON_URL" ] && curl -sf -o /dev/null -X POST -H "Content-Type: application/json" \
-    -d "{\"status\":\"$1\",\"monitor_config\":{\"schedule\":{\"type\":\"crontab\",\"value\":\"$SCHEDULE\"},\"checkin_margin\":30,\"max_runtime\":10,\"timezone\":\"UTC\"}}" \
+    -d "{\"status\":\"$1\",\"duration\":$((SECONDS - START)),\"monitor_config\":{\"schedule\":{\"type\":\"crontab\",\"value\":\"$SCHEDULE\"},\"checkin_margin\":30,\"max_runtime\":10,\"timezone\":\"UTC\"}}" \
     "$CRON_URL" || true
 }
 mkdir -p "$(dirname "$LOG")"
-checkin in_progress
 if python3 - "$DAY" "$OUT" <<'PY' >> "$LOG" 2>&1
 import collections, datetime, glob, gzip, json, os, re, shutil, sys
 day, out = sys.argv[1], sys.argv[2]
 d0 = datetime.datetime.fromisoformat(day).replace(tzinfo=datetime.timezone.utc)
 t0, t1 = d0.timestamp(), (d0 + datetime.timedelta(days=1)).timestamp()
-BOT = re.compile(r"bot|crawl|spider|slurp|facebookexternalhit|slack|discord|twitter|preview|fetch|curl|python|go-http|wget|headless|scan|monitor|uptime", re.I)
-
-req = human = bot = 0
-hips, bips = set(), set()
-pages, joins, refs, campaigns = collections.Counter(), collections.Counter(), collections.Counter(), collections.Counter()
-seen_campaign = set()
-for f in sorted(glob.glob("/var/lib/caddy/access*.log*")):
-    if os.path.getmtime(f) < t0: continue
-    opener = gzip.open if f.endswith(".gz") else open
-    with opener(f, "rt", errors="ignore") as fh:
-        for line in fh:
-            try: r = json.loads(line)
-            except ValueError: continue
-            ts = r.get("ts", 0)
-            if not (t0 <= ts < t1): continue
-            q = r.get("request", {}); h = q.get("headers", {})
-            ua = " ".join(h.get("User-Agent", [""]))
-            ip = q.get("client_ip") or q.get("remote_ip") or "?"
-            uri = q.get("uri", ""); path = uri.split("?")[0]
-            req += 1
-            if BOT.search(ua) or not ua:
-                bot += 1; bips.add(ip); continue
-            if path.startswith(("/_app/", "/api/")) or path == "/ws" or path.endswith((".png", ".ico", ".txt")): continue
-            human += 1; hips.add(ip)
-            if path == "/": pages["hall"] += 1
-            elif path == "/play": pages["play"] += 1
-            elif path == "/rules": pages["rules"] += 1
-            elif path.startswith("/join/"): joins[path.split("/")[2].upper()] += 1
-            ref = " ".join(h.get("Referer", [""]))
-            if ref and "hands.kestrelsnest.social" not in ref:
-                refs[re.sub(r"^https?://", "", ref).split("/")[0]] += 1
-            m = re.search(r"[?&](ref|utm_source|fbclid)=([^&]*)", uri)
-            if m and (ip, m.group(1)) not in seen_campaign:
-                seen_campaign.add((ip, m.group(1)))
-                campaigns[m.group(1) + ("=" + m.group(2)[:24] if m.group(1) != "fbclid" else "")] += 1
+sys.path.insert(0, "/usr/local/lib/waving-hands")
+import traffic
+t = traffic.scan(day)
 
 created = started = finished = turned = turns = 0
 humans, bots = set(), 0
@@ -80,20 +54,19 @@ for f in glob.glob("/var/lib/waving-hands/rooms/*.jsonl"):
                 if x["bot"]: bots += 1
                 else: humans.add(x["name"])
             elif x["t"] == "unseat": bots -= 1
-    day_turns = [x for x in lines if x["t"] == "turn" and t0 <= x["at"] / 1000 < t1]
-    turns += len(day_turns)
-    # A duel finished today: its last turn is today's and the engine would say so; approximate by replay-free means:
-    # the ledger's final turn falls today and no turn follows it within the day's end.
-    if day_turns and day_turns[-1] is lines[-1] and False: finished += 1
+    turns += sum(1 for x in lines if x["t"] == "turn" and t0 <= x["at"] / 1000 < t1)
+    # The over line is written with the turn that ends the game, so a finish counts on its own day.
+    if any(x["t"] == "over" and t0 <= x["at"] / 1000 < t1 for x in lines): finished += 1
 
 disk = shutil.disk_usage("/")
 mem = {}
 for line in open("/proc/meminfo"):
     k, v = line.split(":", 1); mem[k] = int(v.split()[0])
 load = os.getloadavg()[1]
-row = dict(day=day, requests=req, human=human, bot=bot, humanAddresses=len(hips), botAddresses=len(bips),
-           paths=dict(pages), roomLinks=sum(joins.values()), referrers=dict(refs), campaigns=dict(campaigns),
-           rooms=dict(created=created, started=started, withTurns=turned, humanNames=len(humans), botSeats=bots),
+row = dict(day=day, requests=t["requests"], human=t["human"], bot=t["bot"], humanAddresses=len(t["addresses"]), botAddresses=len(t["botAddresses"]),
+           paths=dict(t["pages"]), roomLinks=sum(t["joins"].values()), roomsOpened=t["opened"], sharedOn=dict(t["shared"]),
+           scanners=t["scanners"], monitors=t["monitors"], referrers=dict(t["referrers"]), campaigns=dict(t["campaigns"]),
+           rooms=dict(created=created, started=started, withTurns=turned, finished=finished, humanNames=len(humans), botSeats=bots),
            turns=turns, ledgers=len(glob.glob("/var/lib/waving-hands/rooms/*.jsonl")),
            vitals=dict(diskUsedPct=round(disk.used * 100 / disk.total), memAvailableMb=mem.get("MemAvailable", 0) // 1024, load5=round(load, 2)),
            at=datetime.datetime.now(datetime.timezone.utc).isoformat(timespec="seconds"))
@@ -105,6 +78,6 @@ rows.sort(key=lambda r: r["day"])
 with open(out + ".tmp", "w") as fh:
     for r in rows: fh.write(json.dumps(r) + "\n")
 os.replace(out + ".tmp", out)
-print("%s rolled: %d people, %d requests, %d rooms" % (day, len(hips), human, created))
+print("%s rolled: %d people, %d requests, %d rooms" % (day, len(t["addresses"]), t["human"], created))
 PY
-then checkin ok; else checkin error; fi
+then checkin ok; else checkin error; exit 1; fi

deploy/waving-hands-say.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# A word from the keeper in a table's talk, signed as the keeper, whether or
+# not the host lets the gallery talk: the answer to a call that came too late,
+# or anything else the table should hear from the keeper. Runs ON the droplet,
+# through the duel server's keeper door.
+#   waving-hands-say.sh ROOM "text"
+set -euo pipefail
+ROOM="${1:?usage: waving-hands-say.sh ROOM \"text\"}"
+TEXT="${2:?usage: waving-hands-say.sh ROOM \"text\"}"
+DOOR="http://127.0.0.1:8788/keeper/rooms/${ROOM^^}"
+[ -s /etc/waving-hands/keeper.key ] || { echo "No keeper's key at /etc/waving-hands/keeper.key; a deploy makes it." >&2; exit 1; }
+# The key goes as a header read from a file descriptor, never on a command line another user could see.
+KEY="@/dev/fd/3"
+exec 3< <(printf 'x-keeper-key: %s\n' "$(cat /etc/waving-hands/keeper.key)")
+BODY=$(TEXT="$TEXT" python3 -c 'import json, os; print(json.dumps({"text": os.environ["TEXT"]}))')
+CODE=$(curl -s -o /tmp/waving-hands-say.$$ -w '%{http_code}' -X POST -H "$KEY" -H 'content-type: application/json' -d "$BODY" "$DOOR/say")
+if [ "$CODE" = 204 ]; then echo "said at ${ROOM^^}"; else cat /tmp/waving-hands-say.$$ >&2; echo >&2; rm -f /tmp/waving-hands-say.$$; exit 1; fi
+rm -f /tmp/waving-hands-say.$$

deploy/waving-hands.service

@@ -7,6 +7,8 @@ Type=simple
 User=waving-hands
 WorkingDirectory=/opt/waving-hands/app/server
 Environment=PORT=8788
+Environment=KEEPER=Kestrel
+Environment=KEEPER_TZ=America/New_York
 # Caddy terminates TLS; the plaintext port must not face the internet.
 Environment=HOST=127.0.0.1
 Environment=WH_DATA_DIR=/var/lib/waving-hands/rooms

package.json

@@ -5,6 +5,7 @@
 	"type": "module",
 	"scripts": {
 		"dev": "vite dev",
+		"dev:all": "node scripts/dev-all.mjs",
 		"build": "vite build",
 		"preview": "vite preview",
 		"prepare": "svelte-kit sync || echo ''",

scripts/dev-all.mjs

@@ -0,0 +1,39 @@
+// The game server and the site together, for playing locally: one terminal,
+// each line marked with its side, and Ctrl-C (or either one stopping or
+// failing to get its port) stops both.
+import { spawn } from 'node:child_process';
+
+const sides = [
+	['server', ['run', 'server']],
+	['site', ['run', 'dev', '--', ...process.argv.slice(2)]]
+];
+const children = sides.map(([name, args]) => {
+	const child = spawn('npm', args, { stdio: ['inherit', 'pipe', 'pipe'] });
+	for (const stream of [child.stdout, child.stderr]) {
+		let rest = '';
+		stream.on('data', (chunk) => {
+			const lines = (rest + chunk).split('\n');
+			rest = lines.pop();
+			for (const line of lines) {
+				console.log(`[${name}] ${line}`);
+				// A watcher outlives the crash it watches, so a port already taken would leave one side running alone.
+				if (line.includes('EADDRINUSE')) {
+					console.log(`[${name}] its port is taken: is another copy already running?`);
+					stop(1);
+				}
+			}
+		});
+	}
+	child.on('exit', (code) => stop(code ?? 0));
+	return child;
+});
+
+let stopping = false;
+function stop(code) {
+	if (stopping) return;
+	stopping = true;
+	for (const c of children) if (c.exitCode === null) c.kill('SIGTERM');
+	process.exitCode = code;
+}
+process.on('SIGINT', () => stop(0));
+process.on('SIGTERM', () => stop(0));

server/src/index.ts

@@ -8,28 +8,51 @@
 //   POST /api/rooms/:id/unseat      {token, seat}      the host sends a bot away before the duel begins
 //   GET  /api/rooms/:id?token=      the view for that seat; without a token, the gallery's view
 //   POST /api/rooms/:id/turn        {token, input}     this seat's move
-//   POST /api/rooms/:id/say         {token, text}      table talk, from a seat to the whole room
+//   POST /api/rooms/:id/say         {token, text}      table talk, from a seat to the whole room;
+//                                   {name, text} from the gallery, when the host has let it talk
+//   POST /api/rooms/:id/gallery     {token, on}        the host lets the gallery talk, or hushes it
+//   POST /api/rooms/:id/challenge   {token}            call the keeper of the site to a held seat; their phone rings
+//   POST /api/rooms/:id/rematch     {token}            a finished table opens another with the same company
+//   POST /api/rooms/:id/transfer    {token}            a four-word phrase that carries this seat to another device
+//   POST /api/rooms/:id/phrase      {token, seat}      the host mints one for another wizard's seat, which re-seats it when claimed
+//   POST /api/rooms/:id/standin     {token, seat}      the host gives a wizard's seat to a bot for the rest of the duel
+//   POST /api/transfer              {phrase}           claim a phrase: the seat and its token, once
 //   WS   /ws?room=:id&token=        {type:"update", seq} whenever the room changes; without a token,
 //                                   a seat in the Peanut Gallery, counted for the table
 //   POST /api/rooms/:id/report      {token?, happened, expected}  a report to the keeper, pinned to the turn
 //   POST /api/reports/:id/image     <image bytes>      a screenshot for a report just filed
 //   POST /api/reports/mine          {seats: [{roomId, token}]}   your reports and the keeper's replies
+//   GET  /api/tally                 what the ledgers add up to, for the hall
 //   POST /api/reports/:id/answer    {roomId, token, text}        your word under the keeper's reply
 //
-// Caddy serves the static site and proxies /api and /ws here.
+// Caddy serves the static site and proxies /api and /ws here. The keeper's
+// door answers only on the host itself, and only to the key in KEEPER_KEY_FILE
+// (deploy/waving-hands-reseat.sh sends it):
+//
+//   GET  /keeper/rooms/:id          who sits at the table, and when each wizard last moved or spoke
+//   POST /keeper/rooms/:id/reseat   {seat}             a new token for a player locked out, as a link to send them
+//   POST /keeper/rooms/:id/say      {text}             a word from the keeper in the table's talk
 
 import * as Sentry from '@sentry/node';
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
+import { timingSafeEqual } from 'node:crypto';
+import { readFileSync } from 'node:fs';
 import { WebSocketServer, WebSocket } from 'ws';
 import { RateLimit } from './ratelimit';
 import { IMAGE_MAX_BYTES, Reports } from './reports';
 import { RoomError, Rooms, SPECTATOR } from './rooms';
 import { Store } from './store';
+import { Tallies } from './tally';
 import { dirname } from 'node:path';
 
 const PORT = Number(process.env.PORT ?? 8788);
 const HOST = process.env.HOST ?? '127.0.0.1';
 const DATA_DIR = process.env.WH_DATA_DIR ?? '../data/rooms';
+/** The keeper of the site, whom a table may call to a seat, and where they sleep. */
+const KEEPER = process.env.KEEPER ?? 'the keeper';
+const KEEPER_TZ = process.env.KEEPER_TZ ?? 'America/New_York';
+/** The keeper's key, readable by root and this game's user alone, so another service on the host cannot use the keeper's door. Absent, the door stays shut. */
+const KEEPER_KEY_FILE = process.env.KEEPER_KEY_FILE ?? '/etc/waving-hands/keeper.key';
 const BODY_LIMIT = 16 * 1024;
 
 // Errors go to Sentry when a DSN is set; the SDK drops them otherwise.
@@ -41,9 +64,10 @@ process.on('unhandledRejection', (reason) => {
 	Sentry.captureException(reason);
 });
 
-const rooms = new Rooms(new Store(DATA_DIR));
+const rooms = new Rooms(new Store(DATA_DIR), { name: KEEPER, zone: KEEPER_TZ });
 /** Reports live beside the room ledgers, not among them. */
 const reports = new Reports(dirname(DATA_DIR));
+const tallies = new Tallies(new Store(DATA_DIR));
 const PUBLIC_URL = (process.env.WH_PUBLIC_URL ?? 'https://hands.kestrelsnest.social').replace(/\/$/, '');
 /** Opening rooms and taking seats are open to anyone; a script gets a few dozen an hour, not thousands. */
 const doors = new RateLimit(40, 60 * 60 * 1000);
@@ -51,13 +75,24 @@ const doors = new RateLimit(40, 60 * 60 * 1000);
 const voices = new RateLimit(240, 60 * 60 * 1000);
 /** Reports, answers and pictures: a few an hour from one address; each rings the keeper's phone. */
 const desk = new RateLimit(6, 60 * 60 * 1000);
+/** The gallery talks under a tighter rein than the table: no seat, no token, one address. */
+const galleryVoices = new RateLimit(30, 10 * 60 * 1000);
+/** Calls to the keeper: a real person's phone rings for each. */
+const bells = new RateLimit(3, 60 * 60 * 1000);
+/** Claims on transfer phrases: a phrase is guessed, not brute-forced. */
+const claims = new RateLimit(10, 10 * 60 * 1000);
 const MAX_AUDIENCE = 30;
+/** How often each socket is asked to answer; one silent through a whole round is a browser gone, and is closed. */
+const PING_MS = Number(process.env.PING_MS ?? 30_000);
 const IDLE_ROOM_MS = 7 * 24 * 60 * 60 * 1000;
 setInterval(() => {
 	const n = rooms.evictIdle(IDLE_ROOM_MS);
 	doors.prune();
 	voices.prune();
 	desk.prune();
+	galleryVoices.prune();
+	bells.prune();
+	claims.prune();
 	if (n) console.log(`evicted ${n} idle room${n === 1 ? '' : 's'} from memory; ${rooms.loaded} loaded`);
 }, 60 * 60 * 1000).unref();
 
@@ -174,10 +209,51 @@ function readBody(req: IncomingMessage): Promise<Record<string, unknown>> {
 	});
 }
 
+/** The key the keeper's door asks for, read on each knock so a key written after the server started is honoured. */
+function keeperKeyGiven(req: IncomingMessage): boolean {
+	let key: Buffer;
+	try {
+		key = Buffer.from(readFileSync(KEEPER_KEY_FILE, 'utf8').trim());
+	} catch {
+		return false;
+	}
+	const given = Buffer.from(String(req.headers['x-keeper-key'] ?? ''));
+	return key.length > 0 && given.length === key.length && timingSafeEqual(given, key);
+}
+
+/**
+ * The keeper's door. Caddy proxies only /api and /ws, so it is reached from the host alone; a request Caddy
+ * forwarded is turned away besides, and so is one without the keeper's key.
+ */
+async function handleKeeper(req: IncomingMessage, res: ServerResponse, parts: string[]): Promise<void> {
+	if (req.headers['x-forwarded-for'] || parts[1] !== 'rooms' || !keeperKeyGiven(req)) throw new RoomError('Not here.', 404);
+	const room = rooms.get(parts[2] ?? '');
+	if (parts.length === 3 && req.method === 'GET') return send(res, 200, { roomId: room.id, started: !!room.state, seats: rooms.seatsForKeeper(room) });
+	if (parts[3] === 'reseat' && parts.length === 4 && req.method === 'POST') {
+		const body = await readBody(req);
+		const { seat, token } = rooms.reseat(room, body.seat);
+		// The token rides the fragment, which the browser keeps to itself: it reaches neither Caddy's log nor this server.
+		return send(res, 200, { name: seat.name, link: `${PUBLIC_URL}/join/${room.id}#seat=${seat.id}.${token}` });
+	}
+	if (parts[3] === 'say' && parts.length === 4 && req.method === 'POST') {
+		const body = await readBody(req);
+		rooms.keeperSays(room, KEEPER, body.text);
+		return send(res, 204, {});
+	}
+	throw new RoomError('Not here.', 404);
+}
+
 async function handle(req: IncomingMessage, res: ServerResponse): Promise<void> {
 	const url = new URL(req.url ?? '/', 'http://localhost');
 	const parts = url.pathname.split('/').filter(Boolean);
+	if (parts[0] === 'keeper') return handleKeeper(req, res, parts);
 	if (parts[0] === 'api' && parts[1] === 'reports') return handleReports(req, res, parts);
+	if (parts[0] === 'api' && parts[1] === 'tally' && parts.length === 2 && req.method === 'GET') return send(res, 200, tallies.get());
+	if (parts[0] === 'api' && parts[1] === 'transfer' && parts.length === 2 && req.method === 'POST') {
+		if (!claims.allow(clientOf(req))) throw new RoomError('Too many claims from here just now; try again later.', 429);
+		const body = await readBody(req);
+		return send(res, 200, rooms.claim(body.phrase));
+	}
 	if (parts[0] !== 'api' || parts[1] !== 'rooms') throw new RoomError('Not here.', 404);
 
 	if (parts.length === 2 && req.method === 'POST') {
@@ -220,7 +296,7 @@ async function handle(req: IncomingMessage, res: ServerResponse): Promise<void>
 	}
 	if (action === 'turn') {
 		const token = typeof body.token === 'string' ? body.token : undefined;
-		rooms.submit(room, token, body.input);
+		rooms.submit(room, token, body.input, body.resolved);
 		const seat = rooms.seatOf(room, token);
 		return send(res, 200, rooms.view(room, seat.id));
 	}
@@ -237,12 +313,50 @@ async function handle(req: IncomingMessage, res: ServerResponse): Promise<void>
 		return send(res, 201, { id: report.id });
 	}
 	if (action === 'say') {
+		const token = typeof body.token === 'string' && body.token ? body.token : undefined;
+		if (!token) {
+			if (!galleryVoices.allow(clientOf(req))) throw new RoomError('The gallery has said plenty from here for now.', 429);
+			rooms.sayFromGallery(room, body.name, body.text);
+			return send(res, 200, rooms.view(room, SPECTATOR));
+		}
 		if (!voices.allow(clientOf(req))) throw new RoomError('The table has heard enough from here for now.', 429);
-		const token = typeof body.token === 'string' ? body.token : undefined;
 		rooms.say(room, token, body.text);
+		return send(res, 200, rooms.view(room, rooms.seatOf(room, token).id));
+	}
+	if (action === 'gallery') {
+		const token = typeof body.token === 'string' ? body.token : undefined;
+		rooms.setGalleryTalk(room, token, body.on === true);
+		return send(res, 200, rooms.view(room, rooms.seatOf(room, token).id));
+	}
+	if (action === 'challenge') {
+		if (!bells.allow(clientOf(req))) throw new RoomError('The keeper has been called enough from here for one hour.', 429);
+		const token = typeof body.token === 'string' ? body.token : undefined;
 		const seat = rooms.seatOf(room, token);
+		rooms.callKeeper(room, token, KEEPER);
+		const link = `${PUBLIC_URL}/join/${room.id}`;
+		// One issue per table, so each call rings once, with the door in the message.
+		ringBell(`${seat.name} challenges ${KEEPER} to a duel — ${link}`, {
+			fingerprint: ['challenge', room.id],
+			tags: { room: room.id, challenger: seat.name },
+			extra: { link, wizards: room.seats.map((s) => s.name).join(', ') }
+		});
 		return send(res, 200, rooms.view(room, seat.id));
 	}
+	if (action === 'rematch') {
+		const next = rooms.rematch(room, typeof body.token === 'string' ? body.token : undefined);
+		return send(res, next.created ? 201 : 200, { roomId: next.roomId, seat: next.seat?.id ?? null, token: next.token, created: next.created });
+	}
+	if (action === 'transfer') {
+		return send(res, 200, rooms.transfer(room, typeof body.token === 'string' ? body.token : undefined));
+	}
+	if (action === 'phrase') {
+		return send(res, 200, rooms.hostPhrase(room, typeof body.token === 'string' ? body.token : undefined, body.seat));
+	}
+	if (action === 'standin') {
+		const token = typeof body.token === 'string' ? body.token : undefined;
+		rooms.standIn(room, token, body.seat);
+		return send(res, 200, rooms.view(room, rooms.seatOf(room, token).id));
+	}
 	throw new RoomError('Not here.', 404);
 }
 
@@ -255,7 +369,8 @@ const server = createServer((req, res) => {
 	});
 });
 
-const wss = new WebSocketServer({ noServer: true });
+// The socket only ever speaks to the browser; anything the browser sends is ignored, so it may send almost nothing.
+const wss = new WebSocketServer({ noServer: true, maxPayload: 1024 });
 server.on('upgrade', (req, socket, head) => {
 	const url = new URL(req.url ?? '/', 'http://localhost');
 	if (url.pathname !== '/ws') return socket.destroy();
@@ -275,10 +390,31 @@ server.on('upgrade', (req, socket, head) => {
 		};
 		const unsubscribe = seatId === SPECTATOR ? rooms.watch(room, onChange) : rooms.subscribe(room.id, onChange);
 		ws.on('close', unsubscribe);
+		answered.set(ws, true);
+		ws.on('pong', () => answered.set(ws, true));
+		// A socket's own error (a message over the limit, a malformed frame) closes that socket, never the server.
+		ws.on('error', () => ws.terminate());
 		ws.send(JSON.stringify({ type: 'hello', seat: seatId }));
 	});
 });
 
+/**
+ * A browser that died without closing (a crashed tab, a sleeping laptop, a dropped network) leaves its socket
+ * open until TCP gives up, counted in the gallery all the while. The protocol's own ping, which every browser
+ * answers by itself, finds it within two rounds.
+ */
+const answered = new WeakMap<WebSocket, boolean>();
+setInterval(() => {
+	for (const ws of wss.clients) {
+		if (!answered.get(ws)) {
+			ws.terminate();
+			continue;
+		}
+		answered.set(ws, false);
+		ws.ping();
+	}
+}, PING_MS).unref();
+
 server.listen(PORT, HOST, () => {
 	console.log(`waving-hands server listening on http://${HOST}:${PORT}, rooms in ${DATA_DIR}`);
 });

server/src/rooms.test.ts

@@ -0,0 +1,123 @@
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { Rooms } from './rooms';
+import { chooseBotTurn } from '../../src/lib/game/bot';
+import { Store } from './store';
+import { SPECTATOR } from '../../src/lib/game/state';
+
+let dir: string;
+beforeEach(() => {
+	dir = mkdtempSync(join(tmpdir(), 'rooms-'));
+});
+afterEach(() => {
+	rmSync(dir, { recursive: true, force: true });
+});
+
+/** A table of three with Ann, who opened it, and Bo seated, the duel begun. */
+function table() {
+	const rooms = new Rooms(new Store(dir));
+	const host = rooms.create('Ann', 3);
+	const guest = rooms.join(host.room, 'Bo');
+	rooms.begin(host.room, host.token);
+	return { rooms, room: host.room, ann: host.token, bo: guest.token };
+}
+
+describe('rooms', () => {
+	it("gives a seat a new token at the keeper's word: the old one opens nothing, and a restart keeps the change", () => {
+		const { rooms, room, bo } = table();
+		const phrase = rooms.transfer(room, bo).phrase;
+		const { seat, token } = rooms.reseat(room, 'B');
+		expect(seat.name).toBe('Bo');
+		expect(rooms.seatOf(room, token).id).toBe('B');
+		expect(() => rooms.seatOf(room, bo)).toThrow(/opens no seat/);
+		// A phrase minted with the old token carries nothing now.
+		expect(() => rooms.claim(phrase)).toThrow(/unknown or has expired/);
+		const reopened = new Rooms(new Store(dir)).get(room.id);
+		expect(rooms.seatOf(reopened, token).id).toBe('B');
+		expect(() => rooms.seatOf(reopened, bo)).toThrow(/opens no seat/);
+	});
+
+	it("puts the keeper's word in the table's talk though the gallery may not talk, and a restart keeps it", () => {
+		const { rooms, room } = table();
+		expect(room.galleryTalk).toBe(false);
+		rooms.keeperSays(room, 'Kestrel', 'I came too late for the seat; call me again.');
+		const said = { id: SPECTATOR, name: 'Kestrel', keeper: true, text: 'I came too late for the seat; call me again.' };
+		expect(room.chat.at(-1)).toMatchObject(said);
+		expect(new Rooms(new Store(dir)).get(room.id).chat.at(-1)).toMatchObject(said);
+	});
+
+	it('re-seats only a wizard, and says when each last acted', () => {
+		const { rooms, room, ann } = table();
+		expect(() => rooms.reseat(room, 'Z')).toThrow(/No wizard sits/);
+		rooms.submit(room, ann, { left: 'P', right: '-', casts: [] }, 0);
+		const seats = rooms.seatsForKeeper(room);
+		expect(seats.map((s) => [s.id, s.name])).toEqual([['A', 'Ann'], ['B', 'Bo']]);
+		expect(seats[0].lastActed).toBeGreaterThan(0);
+		expect(seats[1].lastActed).toBeNull();
+	});
+});
+
+describe('the host and the other seats', () => {
+	it("gives a wizard's seat to a bot, which duels the turn it was waiting on, and the wizard's token opens nothing", () => {
+		const { rooms, room, ann, bo } = table();
+		rooms.submit(room, ann, chooseBotTurn(room.state!, 'A'), 0);
+		rooms.standIn(room, ann, 'B');
+		expect(room.resolved).toBe(1);
+		expect(() => rooms.seatOf(room, bo)).toThrow(/gave your seat to a bot/);
+		expect(rooms.view(room, 'A').seats[1]).toEqual({ id: 'B', name: 'Bo', bot: true, standIn: true });
+	});
+
+	it('keeps the gestures a wizard made before the bot stood in', () => {
+		const { rooms, room, ann, bo } = table();
+		const mine = { left: 'P', right: 'W', casts: [] } as const;
+		rooms.submit(room, bo, mine, 0);
+		rooms.standIn(room, ann, 'B');
+		rooms.submit(room, ann, chooseBotTurn(room.state!, 'A'), 0);
+		expect(room.state!.wizards.B.history.at(-1)).toMatchObject({ left: 'P', right: 'W' });
+	});
+
+	it("is the host's call alone, in a duel under way, for a wizard other than the host", () => {
+		const { rooms, room, ann, bo } = table();
+		expect(() => rooms.standIn(room, bo, 'A')).toThrow(/Only the wizard who opened/);
+		expect(() => rooms.standIn(room, ann, 'A')).toThrow(/keeps their own seat/);
+		expect(() => rooms.standIn(room, ann, 'Z')).toThrow(/No wizard sits/);
+		const lobby = rooms.create('Ann', 2);
+		rooms.join(lobby.room, 'Bo');
+		expect(() => rooms.standIn(lobby.room, lobby.token, 'B')).toThrow(/under way/);
+	});
+
+	it("gives the seat back by the host's phrase, with a new token, and a restart keeps both changes", () => {
+		const { rooms, room, ann, bo } = table();
+		rooms.standIn(room, ann, 'B');
+		expect(new Rooms(new Store(dir)).get(room.id).seats[1]).toMatchObject({ bot: true, standIn: true });
+		const claimed = rooms.claim(rooms.hostPhrase(room, ann, 'B').phrase);
+		expect(rooms.seatOf(room, claimed.token).name).toBe('Bo');
+		expect(() => rooms.seatOf(room, bo)).toThrow(/opens no seat/);
+		const reopened = new Rooms(new Store(dir)).get(room.id);
+		expect(reopened.seats[1]).toEqual({ id: 'B', name: 'Bo', tokenHash: room.seats[1].tokenHash, bot: false });
+	});
+
+	it("re-seats a wizard whose browser lost the seat, by the host's phrase, once, and only the host makes one", () => {
+		const { rooms, room, ann, bo } = table();
+		expect(() => rooms.hostPhrase(room, bo, 'A')).toThrow(/Only the wizard who opened/);
+		expect(() => rooms.hostPhrase(room, ann, 'A')).toThrow(/No other wizard/);
+		const { phrase } = rooms.hostPhrase(room, ann, 'B');
+		expect(rooms.claim(phrase).token).not.toBe(bo);
+		expect(() => rooms.seatOf(room, bo)).toThrow(/opens no seat/);
+		expect(() => rooms.claim(phrase)).toThrow(/unknown or has expired/);
+	});
+
+	it('voids a phrase for the seat once a bot stands in, and holds the wizard\'s seat at a rematch without the stand-in', () => {
+		const { rooms, room, ann } = table();
+		const { phrase } = rooms.hostPhrase(room, ann, 'B');
+		rooms.standIn(room, ann, 'B');
+		expect(() => rooms.claim(phrase)).toThrow(/unknown or has expired/);
+		room.state = { ...room.state!, over: { winner: 'A', reason: 'test' } } as typeof room.state;
+		const next = rooms.get(rooms.rematch(room, ann).roomId);
+		expect(next.expected).toEqual(['Bo']);
+		expect(next.seats.map((s) => s.name)).toEqual(['Ann']);
+	});
+});
+

server/src/rooms.ts

@@ -23,9 +23,12 @@ const CHAT_KEEP = 200;
 export interface Seat {
 	id: WizardId;
 	name: string;
-	/** SHA-256 of the seat's token, hex; empty for a bot. */
+	/** SHA-256 of the seat's token, hex; empty for a bot. A seat a bot stands in for keeps the wizard's, which opens nothing while it does. */
 	tokenHash: string;
+	/** A bot plays this seat: one seated as a bot, or one standing in for a wizard. */
 	bot: boolean;
+	/** The host gave this wizard's seat to a bot; a phrase from the host, or the keeper, gives it back. */
+	standIn?: true;
 }
 
 export function hashToken(token: string): string {
@@ -37,10 +40,22 @@ export interface Room {
 	size: number;
 	createdAt: number;
 	seats: Seat[];
+	/** The host lets the Peanut Gallery talk at this table. */
+	galleryTalk: boolean;
+	/** The keeper of the site was called to a seat, and by whom. */
+	challenge: { by: WizardId; at: number } | null;
+	/** Names with a seat held for them: the wizards of the last table, or the keeper. */
+	expected: string[];
+	/** A finished table that called for a rematch: where it went, and who called. */
+	rematch: { to: string; by: WizardId } | null;
+	/** The table this one is the rematch of. */
+	rematchOf: string | null;
 	state: GameState | null;
 	/** Inputs received for the turn in progress, by seat. */
 	pending: Record<WizardId, TurnInput>;
 	chat: ChatLine[];
+	/** Turns played so far, time stops included; a move names the count it was made against. */
+	resolved: number;
 	/** Bumped on every change a client might want to see. */
 	seq: number;
 	updatedAt: number;
@@ -70,6 +85,21 @@ function newSeed(): number {
 	return (Date.now() ^ (Math.random() * 0xffffffff)) >>> 0;
 }
 
+/** Phrases that carry a seat between devices: four plain words, ten minutes, one use. */
+const TRANSFER_WORDS = [
+	'ember', 'raven', 'flagon', 'wand', 'rune', 'moss', 'torch', 'frost', 'amber', 'wisp', 'cellar', 'gable',
+	'onyx', 'briar', 'tome', 'cinder', 'gloom', 'spiral', 'mirror', 'lantern', 'thistle', 'harbor', 'quill', 'saddle',
+	'willow', 'copper', 'meadow', 'anvil', 'beacon', 'orchard', 'pebble', 'cloister', 'walnut', 'tallow', 'heron', 'marble',
+	'ivy', 'kestrel', 'fennel', 'velvet', 'canyon', 'lattice', 'ledger', 'bramble', 'sable', 'tundra', 'juniper', 'compass'
+];
+const TRANSFER_TTL_MS = 10 * 60 * 1000;
+const TRANSFER_FAIL_LIMIT = 20;
+
+/** A table with nobody seated yet. */
+function blank(id: string, size: number, createdAt: number, rematchOf: string | null, expected: string[], seq = 0): Room {
+	return { id, size, createdAt, seats: [], galleryTalk: false, challenge: null, expected, rematch: null, rematchOf, state: null, pending: {}, chat: [], resolved: 0, seq, updatedAt: createdAt };
+}
+
 export function normalizeCode(raw: string): string {
 	return raw.trim().toUpperCase();
 }
@@ -80,7 +110,11 @@ export class Rooms {
 	/** Sockets watching from the gallery, by room. */
 	private gallery = new Map<string, number>();
 
-	constructor(private store: Store) {
+	constructor(
+		private store: Store,
+		/** The keeper of the site: the name a table may call to a seat, and where they live. */
+		private keeper: { name: string; zone: string } = { name: 'the keeper', zone: 'UTC' }
+	) {
 		for (const id of store.roomIds()) {
 			const room = replay(id, store.read(id));
 			if (room) this.rooms.set(id, room);
@@ -122,18 +156,24 @@ export class Rooms {
 	seatOf(room: Room, token: string | undefined): Seat {
 		if (!token) throw new RoomError('That token opens no seat at this duel.', 403);
 		const given = Buffer.from(hashToken(token), 'hex');
-		const seat = room.seats.find((s) => !s.bot && s.tokenHash.length === given.length * 2 && timingSafeEqual(Buffer.from(s.tokenHash, 'hex'), given));
+		const seat = room.seats.find((s) => s.tokenHash.length === given.length * 2 && timingSafeEqual(Buffer.from(s.tokenHash, 'hex'), given));
+		if (seat?.standIn) throw new RoomError('The host gave your seat to a bot, which duels on in your place. Ask them for a transfer phrase to take it back.', 403);
 		if (!seat) throw new RoomError('That token opens no seat at this duel.', 403);
 		return seat;
 	}
 
 	create(name: string, size: number): { room: Room; seat: Seat; token: string } {
 		if (!Number.isInteger(size) || size < 2 || size > MAX_SEATS) throw new RoomError(`A table seats 2 to ${MAX_SEATS} wizards.`);
+		return this.open(name, size);
+	}
+
+	/** Open a table with its first seat taken; a rematch names the table it follows and holds seats for its wizards. */
+	private open(name: string, size: number, follows?: { rematchOf: string; expected: string[] }): { room: Room; seat: Seat; token: string } {
 		let id = newCode();
 		while (this.rooms.has(id) || this.store.exists(id)) id = newCode();
-		const room: Room = { id, size, createdAt: Date.now(), seats: [], state: null, pending: {}, chat: [], seq: 0, updatedAt: Date.now() };
+		const room = blank(id, size, Date.now(), follows?.rematchOf ?? null, follows?.expected ?? []);
 		this.rooms.set(id, room);
-		this.commit(room, { t: 'room', id, seats: size, createdAt: room.createdAt });
+		this.commit(room, { t: 'room', id, seats: size, createdAt: room.createdAt, ...(follows ? { rematchOf: follows.rematchOf, expected: follows.expected } : {}) });
 		return { room, ...this.sit(room, name, false) };
 	}
 
@@ -142,6 +182,125 @@ export class Rooms {
 		return this.sit(room, name, false);
 	}
 
+	/** Names with a seat held who have not yet sat. */
+	private awaited(room: Room): string[] {
+		return room.expected.filter((n) => !room.seats.some((s) => s.name.toLowerCase() === n.toLowerCase()));
+	}
+
+	/** Host only: let the Peanut Gallery talk at this table, or hush it. Written to the ledger. */
+	setGalleryTalk(room: Room, token: string | undefined, on: boolean): void {
+		const seat = this.seatOf(room, token);
+		if (seat.id !== room.seats[0]?.id) throw new RoomError('Only the wizard who opened the table decides whether the gallery may talk.', 403);
+		if (room.galleryTalk === on) return;
+		this.commit(room, { t: 'galleryTalk', at: Date.now(), on, by: seat.id });
+	}
+
+	/** A word from the Peanut Gallery, when the host allows it: signed with a name no seat holds. */
+	sayFromGallery(room: Room, rawName: unknown, raw: unknown): void {
+		if (!room.galleryTalk) throw new RoomError('The gallery listens at this table; the host has not let it talk.', 403);
+		const name = cleanName(rawName);
+		if (room.seats.some((s) => s.name.toLowerCase() === name.toLowerCase())) throw new RoomError('A wizard at the table has that name.', 409);
+		this.commit(room, { t: 'chat', at: Date.now(), id: SPECTATOR, name, text: cleanTalk(raw) });
+	}
+
+	/** The keeper of the site says a word at a table from the keeper's door, whether or not the gallery may talk: the answer to a call they could not take up. */
+	keeperSays(room: Room, keeper: string, raw: unknown): void {
+		this.commit(room, { t: 'chat', at: Date.now(), id: SPECTATOR, name: keeper, text: cleanTalk(raw), keeper: true });
+	}
+
+	/**
+	 * A seated wizard calls the keeper of the site to the table: a seat is
+	 * held under the keeper's name and the call goes on the ledger. Once per
+	 * table, before the duel begins. The caller rings the keeper's bell.
+	 */
+	callKeeper(room: Room, token: string | undefined, keeper: string): void {
+		const seat = this.seatOf(room, token);
+		if (room.state) throw new RoomError('The duel has begun.', 409);
+		if (room.challenge) throw new RoomError(`${keeper} has already been called to this table.`, 409);
+		if (room.seats.some((s) => s.name.toLowerCase() === keeper.toLowerCase())) throw new RoomError(`${keeper} is already here.`, 409);
+		if (room.seats.length + this.awaited(room).length >= room.size) throw new RoomError('Every seat at this table is taken or held.', 409);
+		this.commit(room, { t: 'challenge', at: Date.now(), by: seat.id, keeper });
+	}
+
+	/**
+	 * A finished table calls for a rematch: a new table of the same size with
+	 * the same bots, seats held for the same people, the caller seated as its
+	 * host. Anyone at the old table may call; a second call finds the table
+	 * already open.
+	 */
+	rematch(room: Room, token: string | undefined): { roomId: string; seat: Seat | null; token: string | null; created: boolean } {
+		const caller = this.seatOf(room, token);
+		if (!room.state?.over) throw new RoomError('The duel is not over yet.', 409);
+		if (room.rematch) return { roomId: room.rematch.to, seat: null, token: null, created: false };
+		// A wizard a bot stood in for is still one of the company; the stand-in does not follow.
+		const others = room.seats.filter((s) => (!s.bot || s.standIn) && s.id !== caller.id).map((s) => s.name);
+		const next = this.open(caller.name, room.size, { rematchOf: room.id, expected: others });
+		for (const bot of room.seats.filter((s) => s.bot && !s.standIn)) this.sit(next.room, bot.name, true);
+		this.commit(room, { t: 'rematch', at: Date.now(), to: next.room.id, by: caller.id });
+		return { roomId: next.room.id, seat: next.seat, token: next.token, created: true };
+	}
+
+	/** Phrases waiting to be claimed, with the seat and the token they carry; the host's carry none, and re-seat on claim. */
+	private transfers = new Map<string, { roomId: string; seatId: WizardId; token: string | null; expiresAt: number }>();
+	private failedClaims = 0;
+	private failWindowStart = 0;
+
+	/** Mint a phrase that brings this seat to another device: four words, ten minutes, one use. */
+	transfer(room: Room, token: string | undefined): { phrase: string; expiresAt: number } {
+		const seat = this.seatOf(room, token);
+		return this.mint(room.id, seat.id, token!);
+	}
+
+	/**
+	 * The host mints a phrase for another wizard's seat: for a player whose browser lost it, or to take it back
+	 * from a bot standing in. Claimed, it gives the seat a new token, so the old one opens nothing after.
+	 */
+	hostPhrase(room: Room, token: string | undefined, seatId: unknown): { phrase: string; expiresAt: number } {
+		const host = this.seatOf(room, token);
+		if (host.id !== room.seats[0]?.id) throw new RoomError('Only the wizard who opened the table may make a phrase for another seat.', 403);
+		const seat = room.seats.find((s) => s.id === seatId && s.id !== host.id && (!s.bot || s.standIn));
+		if (!seat) throw new RoomError('No other wizard sits in that seat.', 404);
+		return this.mint(room.id, seat.id, null);
+	}
+
+	private mint(roomId: string, seatId: WizardId, token: string | null): { phrase: string; expiresAt: number } {
+		const now = Date.now();
+		for (const [phrase, t] of this.transfers) if (t.expiresAt < now) this.transfers.delete(phrase);
+		if (this.transfers.size >= 200) throw new RoomError('Too many transfers are pending; try again in a few minutes.', 429);
+		let phrase: string;
+		do {
+			phrase = Array.from({ length: 4 }, () => TRANSFER_WORDS[randomBytes(1)[0] % TRANSFER_WORDS.length]).join('-');
+		} while (this.transfers.has(phrase));
+		const expiresAt = now + TRANSFER_TTL_MS;
+		this.transfers.set(phrase, { roomId, seatId, token, expiresAt });
+		return { phrase, expiresAt };
+	}
+
+	/** Claim a phrase: the seat and its token, once. Too many misses void every pending phrase. */
+	claim(raw: unknown): { roomId: string; seat: WizardId; token: string } {
+		const now = Date.now();
+		if (now - this.failWindowStart > TRANSFER_TTL_MS) {
+			this.failWindowStart = now;
+			this.failedClaims = 0;
+		}
+		if (this.failedClaims >= TRANSFER_FAIL_LIMIT) throw new RoomError('Too many failed claims; transfers are cooling off. Mint a fresh phrase.', 429);
+		const phrase = String(raw ?? '').trim().toLowerCase().replace(/\s+/g, '-');
+		const t = this.transfers.get(phrase);
+		if (!t || t.expiresAt < now) {
+			this.failedClaims += 1;
+			if (this.failedClaims >= TRANSFER_FAIL_LIMIT) this.transfers.clear();
+			throw new RoomError('That phrase is unknown or has expired.', 404);
+		}
+		this.transfers.delete(phrase);
+		const room = this.get(t.roomId);
+		if (t.token === null) {
+			const { seat, token } = this.reseat(room, t.seatId);
+			return { roomId: room.id, seat: seat.id, token };
+		}
+		const seat = this.seatOf(room, t.token);
+		return { roomId: room.id, seat: seat.id, token: t.token };
+	}
+
 	/** The host, who opened the table, begins the duel once at least two are seated, however full the table. */
 	begin(room: Room, token: string | undefined): void {
 		const seat = this.seatOf(room, token);
@@ -166,6 +325,10 @@ export class Rooms {
 	private sit(room: Room, rawName: string, bot: boolean): { seat: Seat; token: string } {
 		if (room.seats.length >= room.size) throw new RoomError('Every seat at this duel is taken.', 409);
 		const name = cleanName(rawName);
+		const awaited = this.awaited(room);
+		if (!awaited.some((n) => n.toLowerCase() === name.toLowerCase()) && room.seats.length + awaited.length >= room.size) {
+			throw new RoomError('The seats left are held for wizards expected at this table.', 409);
+		}
 		if (room.seats.some((s) => s.name.toLowerCase() === name.toLowerCase())) throw new RoomError('Another wizard here already has that name.', 409);
 		const id = SEAT_IDS.find((s) => !room.seats.some((taken) => taken.id === s))!;
 		const token = bot ? '' : newId(18);
@@ -174,6 +337,52 @@ export class Rooms {
 		return { seat, token };
 	}
 
+	/**
+	 * A wizard's seat gets a new token, for a player whose browser lost the old one, or one taking it back from a
+	 * bot standing in. Whether the one asking holds the seat is the keeper's judgment, or the host's in the phrase
+	 * they made; this carries it out. The old token opens nothing after.
+	 */
+	reseat(room: Room, seatId: unknown): { seat: Seat; token: string } {
+		const seat = room.seats.find((s) => s.id === seatId && (!s.bot || s.standIn));
+		if (!seat) throw new RoomError('No wizard sits in that seat.', 404);
+		const token = newId(18);
+		this.commit(room, { t: 'reseat', at: Date.now(), id: seat.id, tokenHash: hashToken(token) });
+		this.voidPhrases(room, seat.id);
+		return { seat, token };
+	}
+
+	/**
+	 * The host gives a wizard's seat to a bot, for a player who cannot go on: the bot plays it from the gestures the
+	 * seat owes, and the wizard's token opens nothing until a phrase from the host gives it back.
+	 */
+	standIn(room: Room, token: string | undefined, seatId: unknown): void {
+		const host = this.seatOf(room, token);
+		if (host.id !== room.seats[0]?.id) throw new RoomError('Only the wizard who opened the table may give a seat to a bot.', 403);
+		if (!room.state || room.state.over) throw new RoomError('Only a duel under way needs a stand-in.', 409);
+		if (seatId === host.id) throw new RoomError('The host keeps their own seat.', 409);
+		const seat = room.seats.find((s) => s.id === seatId && !s.bot);
+		if (!seat) throw new RoomError('No wizard sits in that seat.', 404);
+		this.commit(room, { t: 'standIn', at: Date.now(), id: seat.id, by: host.id });
+		this.voidPhrases(room, seat.id);
+		// The turn may have been waiting on this seat alone.
+		if (waitingOn(room).length === 0) this.resolve(room);
+	}
+
+	/** A phrase minted for a seat whose token has changed hands would carry a seat that no longer answers to it. */
+	private voidPhrases(room: Room, seatId: WizardId): void {
+		for (const [phrase, t] of this.transfers) if (t.roomId === room.id && t.seatId === seatId) this.transfers.delete(phrase);
+	}
+
+	/** The table as the keeper sees it before re-seating: who sits where, and when each wizard last moved or spoke. */
+	seatsForKeeper(room: Room): { id: WizardId; name: string; bot: boolean; standIn: boolean; lastActed: number | null }[] {
+		const last = new Map<WizardId, number>();
+		for (const line of this.store.read(room.id)) {
+			if (line.t === 'input' || line.t === 'chat') last.set(line.id, line.at);
+			else if (line.t === 'turn') for (const id of Object.keys(line.inputs)) last.set(id, line.at);
+		}
+		return room.seats.map((s) => ({ id: s.id, name: s.name, bot: s.bot && !s.standIn, standIn: !!s.standIn, lastActed: s.bot && !s.standIn ? null : (last.get(s.id) ?? null) }));
+	}
+
 	/** The host sends a bot away before the duel begins. People leave by not coming back. */
 	unseat(room: Room, token: string | undefined, seatId: unknown): void {
 		const host = this.seatOf(room, token);
@@ -184,11 +393,18 @@ export class Rooms {
 		this.commit(room, { t: 'unseat', id: seat.id });
 	}
 
-	/** Record a seat's move on the ledger, so a restart keeps it; resolve the turn once nobody else is awaited. */
-	submit(room: Room, token: string | undefined, raw: unknown): void {
+	/**
+	 * Record a seat's move on the ledger, so a restart keeps it; resolve the turn once nobody else is awaited.
+	 * `resolved` is how many turns the page had seen played when the gestures were made: gestures that
+	 * arrive after their turn was played (a slow connection, a second click, a stale tab) are refused
+	 * rather than taken as the next turn's.
+	 */
+	submit(room: Room, token: string | undefined, raw: unknown, resolved?: unknown): void {
 		const seat = this.seatOf(room, token);
 		if (!room.state) throw new RoomError('The duel has not begun: seats are still empty.', 409);
 		if (room.state.over) throw new RoomError('The duel is over.', 409);
+		if (typeof resolved !== 'number') throw new RoomError('This page is out of date. Reload it to see the duel as it stands.', 409);
+		if (resolved !== room.resolved) throw new RoomError('Those gestures were made for a turn that has already been played. Your page will catch up.', 409);
 		if (!waitingOn(room).includes(seat.id)) throw new RoomError('It is not your move.', 409);
 		this.commit(room, { t: 'input', at: Date.now(), id: seat.id, input: cleanInput(raw) });
 		if (waitingOn(room).length === 0) this.resolve(room);
@@ -197,8 +413,9 @@ export class Rooms {
 	private resolve(room: Room): void {
 		const state = room.state!;
 		const inputs: Record<WizardId, TurnInput> = { ...room.pending };
+		// Gestures a wizard made before a bot stood in for them stand.
 		for (const seat of room.seats) {
-			if (seat.bot && needsInput(state, seat.id)) inputs[seat.id] = chooseBotTurn(state, seat.id);
+			if (seat.bot && needsInput(state, seat.id) && !(seat.id in inputs)) inputs[seat.id] = chooseBotTurn(state, seat.id);
 		}
 		this.commit(room, { t: 'turn', at: Date.now(), inputs });
 		// A time stop owed to a bot resolves at once; a human's waits for them.
@@ -212,13 +429,7 @@ export class Rooms {
 	/** Table talk, from a seat to everyone at the table and in the gallery. */
 	say(room: Room, token: string | undefined, raw: unknown): void {
 		const seat = this.seatOf(room, token);
-		const text = String(raw ?? '')
-			.replace(/[\u0000-\u001f\u007f]/g, ' ')
-			.replace(/\s+/g, ' ')
-			.trim()
-			.slice(0, CHAT_MAX_LENGTH);
-		if (!text) throw new RoomError('Nothing to say.');
-		this.commit(room, { t: 'chat', at: Date.now(), id: seat.id, text });
+		this.commit(room, { t: 'chat', at: Date.now(), id: seat.id, text: cleanTalk(raw) });
 	}
 
 	/** The view for a seat, or for the gallery when the seat is SPECTATOR. */
@@ -229,11 +440,19 @@ export class Rooms {
 			size: room.size,
 			me: seatId,
 			host: room.seats[0]?.id ?? seatId,
-			seats: room.seats.map((s) => ({ id: s.id, name: s.name, bot: s.bot })),
+			seats: room.seats.map((s) => ({ id: s.id, name: s.name, bot: s.bot, ...(s.standIn ? { standIn: true as const } : {}) })),
 			waitingOn: waitingOn(room),
+			resolved: room.resolved,
 			state: room.state ? viewFor(room.state, seatId) : null,
 			chat: room.chat,
-			audience: this.gallery.get(room.id) ?? 0
+			audience: this.gallery.get(room.id) ?? 0,
+			galleryTalk: room.galleryTalk,
+			challenge: room.challenge,
+			expected: this.awaited(room),
+			rematch: room.rematch,
+			rematchOf: room.rematchOf,
+			keeper: this.keeper.name,
+			keeperZone: this.keeper.zone
 		};
 	}
 
@@ -295,9 +514,34 @@ function apply(room: Room, line: LedgerLine): void {
 		case 'seat':
 			room.seats.push({ id: line.id, name: line.name, tokenHash: line.tokenHash ?? (line.token ? hashToken(line.token) : ''), bot: line.bot });
 			break;
+		case 'reseat': {
+			const seat = room.seats.find((s) => s.id === line.id);
+			if (!seat) break;
+			seat.tokenHash = line.tokenHash;
+			seat.bot = false;
+			delete seat.standIn;
+			break;
+		}
+		case 'standIn': {
+			const seat = room.seats.find((s) => s.id === line.id);
+			if (!seat) break;
+			seat.bot = true;
+			seat.standIn = true;
+			break;
+		}
 		case 'input':
 			room.pending[line.id] = line.input;
 			break;
+		case 'galleryTalk':
+			room.galleryTalk = line.on;
+			break;
+		case 'challenge':
+			room.challenge = { by: line.by, at: line.at };
+			if (!room.expected.some((n) => n.toLowerCase() === line.keeper.toLowerCase())) room.expected = [...room.expected, line.keeper];
+			break;
+		case 'rematch':
+			room.rematch = { to: line.to, by: line.by };
+			break;
 		case 'unseat':
 			room.seats = room.seats.filter((s) => s.id !== line.id);
 			break;
@@ -308,11 +552,12 @@ function apply(room: Room, line: LedgerLine): void {
 			if (!room.state) return;
 			room.state = resolveTurn(room.state, line.inputs);
 			room.pending = {};
+			room.resolved += 1;
 			break;
 		case 'over':
 			break;
 		case 'chat':
-			room.chat.push({ id: line.id, text: line.text, at: line.at });
+			room.chat.push({ id: line.id, text: line.text, at: line.at, ...(line.name ? { name: line.name } : {}), ...(line.keeper ? { keeper: true as const } : {}) });
 			if (room.chat.length > CHAT_KEEP) room.chat.splice(0, room.chat.length - CHAT_KEEP);
 			break;
 	}
@@ -321,7 +566,7 @@ function apply(room: Room, line: LedgerLine): void {
 function replay(id: string, lines: LedgerLine[]): Room | null {
 	const first = lines[0];
 	if (!first || first.t !== 'room') return null;
-	const room: Room = { id, size: first.seats, createdAt: first.createdAt, seats: [], state: null, pending: {}, chat: [], seq: lines.length, updatedAt: first.createdAt };
+	const room = blank(id, first.seats, first.createdAt, first.rematchOf ?? null, first.expected ?? [], lines.length);
 	for (const line of lines) {
 		apply(room, line);
 		if (line.t === 'turn' || line.t === 'input') room.updatedAt = line.at;
@@ -329,6 +574,16 @@ function replay(id: string, lines: LedgerLine[]): Room | null {
 	return room;
 }
 
+function cleanTalk(raw: unknown): string {
+	const text = String(raw ?? '')
+		.replace(/[\u0000-\u001f\u007f]/g, ' ')
+		.replace(/\s+/g, ' ')
+		.trim()
+		.slice(0, CHAT_MAX_LENGTH);
+	if (!text) throw new RoomError('Nothing to say.');
+	return text;
+}
+
 export function cleanName(raw: unknown): string {
 	const name = String(raw ?? '')
 		.replace(/\s+/g, ' ')

server/src/store.ts

@@ -7,9 +7,17 @@ import { join } from 'node:path';
 import type { TurnInput, WizardId } from '../../src/lib/game/state';
 
 export type LedgerLine =
-	| { t: 'room'; id: string; seats: number; createdAt: number }
+	/** `rematchOf` and `expected` mark a table opened for a rematch: whose it follows, and whose seats are held. */
+	| { t: 'room'; id: string; seats: number; createdAt: number; rematchOf?: string; expected?: string[] }
 	/** A seat holds only the hash of its token; the token itself goes once to the browser that earned it. Ledgers written before hashing carry `token` and are read once more. */
 	| { t: 'seat'; id: WizardId; name: string; tokenHash?: string; token?: string; bot: boolean }
+	/**
+	 * A wizard's seat got a new token, from the keeper or a phrase the host made, for a player whose browser lost the
+	 * old one; the old one opens nothing after. A seat a bot was standing in for is the wizard's again.
+	 */
+	| { t: 'reseat'; at: number; id: WizardId; tokenHash: string }
+	/** The host gave a wizard's seat to a bot, which duels in it from here on; a reseat gives it back. */
+	| { t: 'standIn'; at: number; id: WizardId; by: WizardId }
 	/** One seat's move for the turn in progress, so a restart keeps it. The turn line that follows carries every input again. */
 	| { t: 'input'; at: number; id: WizardId; input: TurnInput }
 	/** A bot sent away by the host before the duel began; its seat id is free again. */
@@ -19,8 +27,14 @@ export type LedgerLine =
 	| { t: 'turn'; at: number; inputs: Record<WizardId, TurnInput> }
 	/** Written after the turn that ends the duel, for anything that reads ledgers without the engine. */
 	| { t: 'over'; at: number; winner: WizardId | null; reason: string }
-	/** A line of table talk from a seated wizard. */
-	| { t: 'chat'; at: number; id: WizardId; text: string };
+	/** A line of table talk: from a seat, or, with `name`, from the Peanut Gallery (id SPECTATOR). */
+	| { t: 'chat'; at: number; id: WizardId; text: string; name?: string; keeper?: true }
+	/** The host let the gallery talk, or hushed it. */
+	| { t: 'galleryTalk'; at: number; on: boolean; by: WizardId }
+	/** A seat is held for the keeper of the site, called to the table. */
+	| { t: 'challenge'; at: number; by: WizardId; keeper: string }
+	/** A finished table called for a rematch: where it went, and who called. */
+	| { t: 'rematch'; at: number; to: string; by: WizardId };
 
 export class Store {
 	constructor(private dir: string) {

server/src/tally.ts

@@ -0,0 +1,102 @@
+// The tally: what the ledgers add up to, for the hall's about panel. Read
+// from the files on demand and cached for a minute, so a curious visitor
+// costs nothing and a busy hall costs one scan a minute. The counts are the
+// kit's; the duel's own lines come from tallyOf.
+
+import { resolveTurn } from '../../src/lib/game/resolve';
+import { createGame, type GameState, type WizardId } from '../../src/lib/game/state';
+import { tallyOf } from '../../src/lib/game/tally';
+import type { LedgerLine, Store } from './store';
+
+export interface Tally {
+	tablesOpened: number;
+	gamesBegun: number;
+	gamesFinished: number;
+	/** Distinct names of people who have taken a seat; a bot's name is not counted. */
+	namesSeated: number;
+	turnsPlayed: number;
+	/** Minutes at the table: gaps under ten minutes between one move and the next, summed. */
+	minutesAtTable: number;
+	longestGameTurns: number;
+	gamesWithBot: number;
+	talkLines: number;
+	firstGameAt: string | null;
+	/** The duel's own lines, summed over finished duels. */
+	byGame: Record<string, number>;
+}
+
+const GAP_LIMIT_MS = 10 * 60 * 1000;
+const CACHE_MS = 60 * 1000;
+
+export class Tallies {
+	private cached: { at: number; tally: Tally } | null = null;
+
+	constructor(private store: Store) {}
+
+	get(): Tally {
+		if (this.cached && Date.now() - this.cached.at < CACHE_MS) return this.cached.tally;
+		const tally = this.count();
+		this.cached = { at: Date.now(), tally };
+		return tally;
+	}
+
+	private count(): Tally {
+		const t: Tally = { tablesOpened: 0, gamesBegun: 0, gamesFinished: 0, namesSeated: 0, turnsPlayed: 0, minutesAtTable: 0, longestGameTurns: 0, gamesWithBot: 0, talkLines: 0, firstGameAt: null, byGame: {} };
+		const names = new Set<string>();
+		let firstStart = Infinity;
+		for (const id of this.store.roomIds()) {
+			const lines = this.store.read(id);
+			const first = lines[0];
+			if (first?.t !== 'room') continue;
+			t.tablesOpened += 1;
+			const seats: { id: WizardId; name: string; bot: boolean }[] = [];
+			let state: GameState | null = null;
+			let turns = 0;
+			let lastMoveAt = 0;
+			let hasBot = false;
+			let over: LedgerLine | null = null;
+			for (const line of lines) {
+				if (line.t === 'seat') {
+					seats.push(line);
+					if (line.bot) hasBot = true;
+					else names.add(line.name.toLowerCase());
+				} else if (line.t === 'unseat') seats.splice(seats.findIndex((s) => s.id === line.id), 1);
+				else if (line.t === 'start') {
+					t.gamesBegun += 1;
+					if (hasBot) t.gamesWithBot += 1;
+					if (first.createdAt < firstStart) firstStart = first.createdAt;
+					try {
+						state = createGame(Object.fromEntries(seats.map((s) => [s.id, s.name])), line.seed, line.rules ?? 1);
+					} catch {
+						state = null;
+					}
+				} else if (line.t === 'input') {
+					if (lastMoveAt && line.at - lastMoveAt < GAP_LIMIT_MS) t.minutesAtTable += (line.at - lastMoveAt) / 60000;
+					lastMoveAt = line.at;
+				} else if (line.t === 'turn') {
+					turns += 1;
+					if (lastMoveAt && line.at - lastMoveAt < GAP_LIMIT_MS) t.minutesAtTable += (line.at - lastMoveAt) / 60000;
+					lastMoveAt = line.at;
+					if (state) {
+						try {
+							state = resolveTurn(state, line.inputs);
+						} catch {
+							state = null;
+						}
+					}
+				} else if (line.t === 'chat') t.talkLines += 1;
+				else if (line.t === 'over') over = line;
+			}
+			t.turnsPlayed += turns;
+			if (turns > t.longestGameTurns) t.longestGameTurns = turns;
+			if (over) {
+				t.gamesFinished += 1;
+				if (state) for (const [k, v] of Object.entries(tallyOf(state))) t.byGame[k] = (t.byGame[k] ?? 0) + v;
+			}
+		}
+		t.namesSeated = names.size;
+		t.minutesAtTable = Math.round(t.minutesAtTable);
+		t.firstGameAt = Number.isFinite(firstStart) ? new Date(firstStart).toISOString() : null;
+		return t;
+	}
+}

src/app.css

@@ -108,6 +108,100 @@ button:disabled {
 	background: #fff;
 }
 
+/* The smaller reveal used in forms and slips. Qualified with the element so it
+   outranks a component's scoped `.small` text rule on the same button. */
+button.reveal.small {
+	padding: 0.4rem 0.9rem;
+	font-size: 1rem;
+}
+
+/* A secondary action: an outlined button or link. */
+.quiet {
+	background: none;
+	border: 1px solid var(--rule-strong);
+	border-radius: 4px;
+	padding: 0.4rem 0.9rem;
+	white-space: nowrap;
+	color: var(--bone);
+	text-decoration: none;
+	line-height: 1.55;
+}
+
+.quiet:hover:not(:disabled) {
+	border-color: var(--bone);
+}
+
+/* The page head on the play and join pages: title and standfirst on the left, actions on the right. */
+.masthead {
+	display: flex;
+	align-items: flex-start;
+	justify-content: space-between;
+	gap: 1rem;
+	padding: 1rem var(--gutter) 0.6rem;
+	max-width: 1280px;
+	margin: 0 auto;
+}
+
+.masthead h1 {
+	font-size: clamp(2rem, 4vw, 2.7rem);
+	font-weight: 300;
+	font-variation-settings: 'opsz' 144;
+	letter-spacing: -0.01em;
+}
+
+.standfirst {
+	max-width: 38em;
+	color: var(--bone-dim);
+	margin-top: 0.4rem;
+}
+
+.standfirst em {
+	color: var(--bone);
+}
+
+.masthead .actions {
+	display: flex;
+	flex-wrap: wrap;
+	gap: 0.5rem;
+	flex-shrink: 0;
+	min-width: 0;
+	max-width: 100%;
+}
+
+.colophon {
+	max-width: 1280px;
+	margin: 0 auto;
+	padding: 2rem var(--gutter) 3rem;
+	color: var(--bone-faint);
+	font-size: 0.85rem;
+}
+
+.colophon a {
+	color: var(--frost);
+}
+
+/* Must match COMPACT_QUERY in duel.svelte.ts. The extra foot padding clears MobileBar. */
+@media (max-width: 860px) {
+	.masthead {
+		flex-direction: column;
+	}
+
+	.colophon {
+		padding-bottom: 6rem;
+	}
+}
+
+/* A modal backdrop that centres its dialog. */
+.scrim {
+	position: fixed;
+	inset: 0;
+	z-index: 20;
+	background: rgba(0, 0, 0, 0.55);
+	display: grid;
+	place-items: center;
+	padding: 16px;
+}
+
 /* An italic prompt beside a control, e.g. "at" before a target list. */
 .field {
 	display: inline-flex;

src/app.html

@@ -6,13 +6,15 @@
 		<meta name="color-scheme" content="dark" />
 		<meta name="theme-color" content="#121a20" />
 		<title>Waving Hands</title>
-		<meta name="description" content="A duel of gestures against a rival wizard, after Richard Bartle's 1977 pencil-and-paper game. Free to play in the browser." />
+		<meta name="description" content="A duel of gestures between wizards, two or a dozen, after Richard Bartle's 1977 pencil-and-paper game. Free to play in the browser." />
 		<link rel="canonical" href="https://hands.kestrelsnest.social/" />
 		<link rel="apple-touch-icon" href="/apple-touch-icon.png" />
+		<link rel="icon" href="/favicon.ico" sizes="32x32" />
+		<link rel="icon" href="/favicon.svg" type="image/svg+xml" />
 		<meta property="og:type" content="website" />
 		<meta property="og:site_name" content="Waving Hands" />
 		<meta property="og:title" content="Waving Hands" />
-		<meta property="og:description" content="A duel of gestures against a rival wizard, after Richard Bartle's 1977 pencil-and-paper game. Free to play in the browser." />
+		<meta property="og:description" content="A duel of gestures between wizards, two or a dozen, after Richard Bartle's 1977 pencil-and-paper game. Free to play in the browser." />
 		<meta property="og:url" content="https://hands.kestrelsnest.social/" />
 		<meta property="og:image" content="https://hands.kestrelsnest.social/og.png" />
 		<meta property="og:image:width" content="1200" />
@@ -20,7 +22,7 @@
 		<meta property="og:image:alt" content="Waving Hands: a ledger of gesture letters beside the title and a snapping hand." />
 		<meta name="twitter:card" content="summary_large_image" />
 		<meta name="twitter:title" content="Waving Hands" />
-		<meta name="twitter:description" content="A duel of gestures against a rival wizard, after Richard Bartle's 1977 pencil-and-paper game. Free to play in the browser." />
+		<meta name="twitter:description" content="A duel of gestures between wizards, two or a dozen, after Richard Bartle's 1977 pencil-and-paper game. Free to play in the browser." />
 		<meta name="twitter:image" content="https://hands.kestrelsnest.social/og.png" />
 		<link rel="preconnect" href="https://fonts.googleapis.com" />
 		<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />

src/lib/components/About.svelte

@@ -0,0 +1,138 @@
+<script lang="ts" module>
+	import type { Snippet } from 'svelte';
+
+	/** One section of the about panel: a tab and what it shows. */
+	export interface AboutTab {
+		id: string;
+		label: string;
+		body: Snippet;
+	}
+</script>
+
+<script lang="ts">
+	// A tabbed modal for the about content. Opened from the landing page's
+	// "about this game" link or the #about hash; closes on its button, a click
+	// on the backdrop, or Escape. Keeps the last-read tab while mounted, so
+	// reopening shows it.
+	import { tick } from 'svelte';
+
+	let { open = $bindable(false), tabs, title }: { open?: boolean; tabs: AboutTab[]; title: string } = $props();
+
+	let current = $state('');
+	const shown = $derived(tabs.find((t) => t.id === current) ?? tabs[0]);
+	let tabButtons: HTMLButtonElement[] = $state([]);
+
+	function onKey(e: KeyboardEvent) {
+		if (open && e.key === 'Escape') open = false;
+	}
+
+	/** Arrow keys walk the tabs, as a tab list should; Home and End go to the ends. */
+	async function onTabKey(e: KeyboardEvent, i: number) {
+		const to = e.key === 'ArrowRight' ? i + 1 : e.key === 'ArrowLeft' ? i - 1 : e.key === 'Home' ? 0 : e.key === 'End' ? tabs.length - 1 : null;
+		if (to === null) return;
+		e.preventDefault();
+		const next = (to + tabs.length) % tabs.length;
+		current = tabs[next].id;
+		await tick();
+		tabButtons[next]?.focus();
+	}
+</script>
+
+<svelte:window onkeydown={onKey} />
+
+{#if open}
+	<div class="scrim" role="presentation" onclick={(ev) => ev.target === ev.currentTarget && (open = false)}>
+		<div class="panel" role="dialog" aria-modal="true" aria-labelledby="about-title">
+			<header>
+				<h2 id="about-title">{title}</h2>
+				<button type="button" class="close" aria-label="Close" onclick={() => (open = false)}>×</button>
+			</header>
+			<div class="tabs" role="tablist" aria-label="About this game">
+				{#each tabs as t, i (t.id)}
+					<button
+						type="button"
+						role="tab"
+						id="about-tab-{t.id}"
+						aria-controls="about-panel"
+						aria-selected={shown.id === t.id}
+						tabindex={shown.id === t.id ? 0 : -1}
+						class:on={shown.id === t.id}
+						bind:this={tabButtons[i]}
+						onclick={() => (current = t.id)}
+						onkeydown={(e) => onTabKey(e, i)}>{t.label}</button
+					>
+				{/each}
+			</div>
+			<div class="body" id="about-panel" role="tabpanel" aria-labelledby="about-tab-{shown.id}" tabindex="0">
+				{@render shown.body()}
+			</div>
+		</div>
+	</div>
+{/if}
+
+<style>
+	.panel {
+		width: min(100%, 44rem);
+		max-height: 100%;
+		display: flex;
+		flex-direction: column;
+		background: var(--slate);
+		border: 1px solid var(--rule-strong);
+		border-radius: 6px;
+		padding: 1rem 1.4rem 1.2rem;
+	}
+	header {
+		display: flex;
+		align-items: baseline;
+		justify-content: space-between;
+		gap: 1rem;
+	}
+	h2 {
+		font-size: 1.3rem;
+		margin: 0 0 0.6rem;
+	}
+	.close {
+		background: none;
+		border: none;
+		color: inherit;
+		font-size: 1.5rem;
+		line-height: 1;
+		cursor: pointer;
+		padding: 0.2rem 0.4rem;
+	}
+	.tabs {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 0.2rem 0.4rem;
+		border-bottom: 1px solid var(--rule-strong);
+		margin-bottom: 0.8rem;
+	}
+	.tabs button {
+		background: none;
+		border: none;
+		border-bottom: 3px solid transparent;
+		color: inherit;
+		opacity: 0.75;
+		font: inherit;
+		padding: 0.35rem 0.5rem 0.4rem;
+		cursor: pointer;
+	}
+	.tabs button.on {
+		opacity: 1;
+		border-bottom-color: currentColor;
+	}
+	.body {
+		overflow: auto;
+		min-height: 12rem;
+	}
+	.body :global(p + p) {
+		margin-top: 0.7rem;
+	}
+	.body :global(h3) {
+		font-size: 1.05rem;
+		margin: 1rem 0 0.4rem;
+	}
+	.body :global(h3:first-child) {
+		margin-top: 0;
+	}
+</style>

src/lib/components/Announcement.svelte

@@ -0,0 +1,119 @@
+<script lang="ts">
+	// The site-family announcement, shown by every game: the maintainer writes
+	// /var/lib/hall/announcement.json on the host (hall-announce), and each game's
+	// site serves it at /hall/announcement.json. It is fetched on load, every few
+	// minutes, and whenever the tab becomes visible again. Dismissal is per
+	// announcement id, so the next one still shows.
+	import { onMount } from 'svelte';
+
+	interface Announcement {
+		/** Names this announcement, so dismissing it does not hide the next. */
+		id: string;
+		text: string;
+		/** When what it announces happens, told in each reader's own time. */
+		at?: string;
+		/** After this it is no longer shown. */
+		until?: string;
+	}
+
+	const SOURCE = '/hall/announcement.json';
+	const CHECK_MS = 5 * 60_000;
+	const DISMISSED = 'hall:dismissed';
+
+	let current = $state<Announcement | null>(null);
+	let dismissed = $state<string | null>(null);
+	let now = $state(Date.now());
+
+	async function check() {
+		try {
+			const res = await fetch(SOURCE, { cache: 'no-store' });
+			const a: unknown = res.ok ? await res.json() : null;
+			current = a && typeof a === 'object' && typeof (a as Announcement).text === 'string' && (a as Announcement).text && typeof (a as Announcement).id === 'string' ? (a as Announcement) : null;
+		} catch {
+			// No announcement reachable: none shown.
+		}
+		now = Date.now();
+	}
+
+	onMount(() => {
+		try {
+			dismissed = localStorage.getItem(DISMISSED);
+		} catch {
+			// Without storage a dismissal lasts this visit.
+		}
+		void check();
+		const poll = setInterval(check, CHECK_MS);
+		const tick = setInterval(() => (now = Date.now()), 30_000);
+		const looked = () => {
+			if (document.visibilityState === 'visible') void check();
+		};
+		document.addEventListener('visibilitychange', looked);
+		return () => {
+			clearInterval(poll);
+			clearInterval(tick);
+			document.removeEventListener('visibilitychange', looked);
+		};
+	});
+
+	const shown = $derived(current && current.id !== dismissed && !(current.until && Date.parse(current.until) < now) ? current : null);
+
+	/** When it happens, in the reader's own clock: "in 25 minutes, at 7:00 AM", or the day and time further off. */
+	const when = $derived.by(() => {
+		const t = shown?.at ? Date.parse(shown.at) : NaN;
+		if (!Number.isFinite(t)) return '';
+		const minutes = Math.round((t - now) / 60_000);
+		if (minutes > 90) return ` (${new Date(t).toLocaleString([], { weekday: 'short', hour: 'numeric', minute: '2-digit' })}, your time)`;
+		if (minutes > 1) return ` (in ${minutes} minutes, at ${new Date(t).toLocaleTimeString([], { hour: 'numeric', minute: '2-digit' })})`;
+		return minutes >= -15 ? ' (now)' : '';
+	});
+
+	function dismiss() {
+		// Taken first: once dismissed, nothing is shown.
+		const id = shown?.id;
+		if (!id) return;
+		dismissed = id;
+		try {
+			localStorage.setItem(DISMISSED, id);
+		} catch {
+			// The dismissal still holds for this visit.
+		}
+	}
+</script>
+
+{#if shown}
+	<div class="hall-announcement" role="status">
+		<span>{shown.text}{when}</span>
+		<button type="button" aria-label="Dismiss this announcement" onclick={dismiss}>×</button>
+	</div>
+{/if}
+
+<style>
+	/* Fixed colours rather than the game's tokens, so the notice looks the same on every site that shows it. */
+	.hall-announcement {
+		position: sticky;
+		top: 0;
+		z-index: 1000;
+		display: flex;
+		align-items: center;
+		justify-content: center;
+		gap: 0.8rem;
+		padding: 0.45rem 2.4rem 0.45rem 1rem;
+		background: #f2c45a;
+		color: #1d1a12;
+		font: 500 0.95rem/1.35 system-ui, -apple-system, 'Segoe UI', sans-serif;
+		text-align: center;
+		box-shadow: 0 1px 4px #0005;
+	}
+
+	button {
+		position: absolute;
+		right: 0.5rem;
+		background: none;
+		border: 0;
+		color: inherit;
+		font-size: 1.3rem;
+		line-height: 1;
+		padding: 0.2rem 0.5rem;
+		cursor: pointer;
+	}
+</style>

src/lib/components/Board.svelte

@@ -11,17 +11,46 @@
 	import { castKey, listText, tokensText, type Duel } from '$lib/game/duel.svelte';
 	import { seatColor } from '$lib/game/colors';
 	import { GESTURE_SHORT, glyph } from '$lib/game/glyphs';
-	import { MAGIC_GESTURES } from '$lib/game/spells';
+	import { MAGIC_GESTURES, type Gesture } from '$lib/game/spells';
 
 	let { duel }: { duel: Duel } = $props();
 
 	const foeMonsters = $derived(duel.state.monsters.filter((m) => m.owner !== duel.me));
 	const outcome = $derived(duel.state.over);
 	const won = $derived(outcome?.winner === duel.me);
-	/** Past three wizards the rail lists the others on a line each. */
+	/** With three or more opponents the rail shows a one-line roster instead of a status card each. */
 	const crowded = $derived(duel.others.length >= 3);
+	/** The seal button's label for the current state. */
+	const sealLabel = $derived(
+		duel.moved ? 'Waiting' : duel.sending ? 'Sending' : duel.surrendering ? 'Surrender' : duel.timeStopped ? 'Act in the stopped moment' : 'Seal the turn'
+	);
+
+	/** Letters typed anywhere on the board fill the hands, left then right; Enter seals the turn. */
+	const KEYS: Record<string, Gesture> = { f: 'F', p: 'P', s: 'S', w: 'W', d: 'D', c: 'C', k: '>', '>': '>', '-': '-', '.': '-', ' ': '-' };
+	function onKey(e: KeyboardEvent) {
+		if (e.metaKey || e.ctrlKey || e.altKey) return;
+		const el = e.target as HTMLElement | null;
+		if (el && (el.isContentEditable || ['INPUT', 'TEXTAREA', 'SELECT'].includes(el.tagName))) return;
+		if (outcome || duel.out || duel.moved || duel.spectating) return;
+		if (e.key === 'Enter') {
+			if (duel.ready) {
+				e.preventDefault();
+				duel.reveal();
+			}
+			return;
+		}
+		if (e.key === 'Backspace') {
+			e.preventDefault();
+			duel.untype();
+			return;
+		}
+		const g = KEYS[e.key.toLowerCase()];
+		if (g && duel.typeGesture(g)) e.preventDefault();
+	}
 </script>
 
+<svelte:window onkeydown={onKey} />
+
 <main class="board">
 	<section class="play">
 		<Ledger {duel} />
@@ -54,7 +83,7 @@
 					<h2 id="move-heading">Time stands still. Take your extra turn.</h2>
 					<p class="threats"><span class="muted">{duel.foe.name} cannot move, see this, or resist anything you do. Last turn's enchantments do not bind you.</span></p>
 				{:else}
-					<h2 id="move-heading">Turn {duel.turnNumber}: write your gestures{#if duel.hasted}, twice{/if}</h2>
+					<h2 id="move-heading">Your gestures for turn {duel.turnNumber}{#if duel.hasted}, twice over{/if}</h2>
 				{/if}
 
 				{#if duel.threats.length && !duel.timeStopped}
@@ -111,7 +140,7 @@
 					</label>
 				</div>
 				{#if duel.hasted}
-					<p class="haste-note">You are hastened: a second pair of gestures follows the first, and both take effect together.</p>
+					<p class="haste-note">You are hastened, so a second pair of gestures follows the first, and both take effect together.</p>
 					<div class="hands">
 						<HandPicker {duel} hand="left" set="haste" />
 						<HandPicker {duel} hand="right" set="haste" />
@@ -191,22 +220,35 @@
 				{#if duel.remote?.error}
 					<p class="warning">{duel.remote.error}</p>
 				{/if}
-				{#if duel.intentText && !duel.moved}
-					<p class="intent">{duel.intentText}</p>
-				{/if}
+				<div class="commit">
+					<div class="pair" aria-label="This turn's gestures">
+						{#each duel.activeSets as set (set)}
+							<span class="hand-pair">
+								<span class="which">left</span> <span class="letter" class:empty={duel.chosenGesture(set, 'left') === null}>{duel.drawn(set, 'left')}</span>
+								<span class="which">right</span> <span class="letter" class:empty={duel.chosenGesture(set, 'right') === null}>{duel.drawn(set, 'right')}</span>
+							</span>
+						{/each}
+					</div>
+					<div class="notes">
 						{#if duel.moved}
-					<p class="waiting">Your move is in. Waiting for {duel.awaitingText}.</p>
+							<p class="waiting">Your hands are still. Waiting for {duel.awaitingText}.</p>
+						{:else if duel.intentText}
+							<p class="intent">{duel.intentText}</p>
 						{/if}
 						{#if duel.surrendering}
 							<p class="warning">Both palms at once is surrender. You will lose the duel.</p>
+						{:else if duel.loneClap && !duel.moved}
+							<p class="warning">A clap needs both hands, and one hand clapping does nothing. Clap with both, or rest the other hand.</p>
 						{/if}
 						{#if duel.conflict}
-					<p class="warning">Those two spells share a gesture. A gesture can finish only one spell; let one of them pass.</p>
+							<p class="warning">Those two spells share a gesture, and a gesture can finish only one spell. Let one of them pass.</p>
 						{/if}
-
-				<button type="button" class="reveal" disabled={!duel.ready} onclick={() => duel.reveal()}>
-					{duel.moved ? 'Waiting' : duel.sending ? 'Sending' : duel.surrendering ? 'Surrender' : duel.timeStopped ? 'Act in the stopped moment' : 'Reveal gestures'}
-				</button>
+						{#if !duel.moved}
+							<p class="keys muted">Or type: F P S W D C, K to stab, a dash to rest; Backspace undoes, Enter seals.</p>
+						{/if}
+					</div>
+					<button type="button" class="reveal" disabled={!duel.ready} onclick={() => duel.reveal()}>{sealLabel}</button>
+				</div>
 			</section>
 			{/if}
 		{/if}
@@ -214,13 +256,13 @@
 
 	<aside class="rail">
 		{#if !duel.spectating}
-			<WizardStatus wizard={duel.you} monsters={duel.yourMonsters} you />
+			<WizardStatus turnsPlayed={duel.state.turn} wizard={duel.you} monsters={duel.yourMonsters} you />
 		{/if}
 		{#if crowded}
 			<Roster {duel} />
 		{:else}
 			{#each duel.others as id (id)}
-				<WizardStatus wizard={duel.state.wizards[id]} monsters={duel.state.monsters.filter((m) => m.owner === id)} />
+				<WizardStatus turnsPlayed={duel.state.turn} wizard={duel.state.wizards[id]} monsters={duel.state.monsters.filter((m) => m.owner === id)} />
 			{/each}
 		{/if}
 		<TableTalk {duel} />
@@ -378,8 +420,66 @@
 		margin: 1rem 0 0.6rem;
 	}
 
-	.move > .reveal {
-			margin-top: 0.8rem;
+	/* Box the hand pickers so they read apart from the ledger table above. */
+	.hands {
+		background: var(--slate);
+		border: 1px solid var(--rule-strong);
+		border-radius: 6px;
+		padding: 0.7rem 0.9rem 0.9rem;
+	}
+
+	/* Sticky at the foot so the chosen pair and the seal button stay in view while the pickers scroll. */
+	.commit {
+		position: sticky;
+		bottom: 0;
+		z-index: 4;
+		display: grid;
+		grid-template-columns: auto minmax(0, 1fr) auto;
+		align-items: center;
+		gap: 0.4rem 1rem;
+		margin-top: 0.9rem;
+		padding: 0.6rem 0.2rem;
+		background: var(--slate-deep);
+		border-top: 1px solid var(--rule-strong);
+	}
+
+	.pair {
+		display: flex;
+		flex-direction: column;
+		gap: 0.1rem;
+	}
+
+	.hand-pair {
+		display: flex;
+		align-items: baseline;
+		gap: 0.35rem;
+	}
+
+	.which {
+		font-size: 0.75rem;
+		font-style: italic;
+		color: var(--bone-faint);
+	}
+
+	.pair .letter {
+		font-size: 1.5rem;
+		min-width: 1ch;
+	}
+
+	.pair .letter.empty {
+		color: var(--bone-faint);
+	}
+
+	.notes p {
+		margin: 0;
+	}
+
+	.notes p + p {
+		margin-top: 0.2rem;
+	}
+
+	.keys {
+		font-size: 0.8rem;
 	}
 
 	.verdict {
@@ -407,8 +507,16 @@
 			grid-template-columns: minmax(0, 1fr);
 		}
 
-		/* The sticky bar carries the reveal button on phones. */
-				.move > .reveal {
+		/* Narrow screens: MobileBar carries the pair and the button instead. */
+		.commit {
+			position: static;
+			grid-template-columns: minmax(0, 1fr);
+			border-top: 0;
+		}
+
+		.commit .pair,
+		.commit .reveal,
+		.keys {
 			display: none;
 		}
 
@@ -425,7 +533,6 @@
 
 	.waiting {
 		color: var(--frost);
-		margin-top: 0.8rem;
 	}
 
 	.reveal.again {

src/lib/components/Chronicle.svelte

@@ -1,4 +1,5 @@
 <script lang="ts">
+	import { tick } from 'svelte';
 	import type { LogEntry } from '$lib/game/state';
 
 	let { log }: { log: LogEntry[] } = $props();
@@ -9,14 +10,23 @@
 			if (!groups.has(entry.turn)) groups.set(entry.turn, []);
 			groups.get(entry.turn)!.push(entry);
 		}
-		return [...groups.entries()].reverse();
+		return [...groups.entries()];
+	});
+
+	// Read top to bottom like a conversation; each new turn scrolls into view at the foot.
+	let box = $state<HTMLElement | null>(null);
+	$effect(() => {
+		void log.length;
+		void tick().then(() => {
+			if (box) box.scrollTop = box.scrollHeight;
+		});
 	});
 </script>
 
-<section class="chronicle">
+<section class="chronicle" bind:this={box}>
 	<h2>Chronicle</h2>
 	{#if turns.length === 0}
-		<p class="muted">Nothing has happened yet. Choose a gesture for each hand and reveal them.</p>
+		<p class="muted">Nothing has happened yet. Choose a gesture for each hand and seal the turn.</p>
 	{/if}
 	{#each turns as [turn, entries] (turn)}
 		<article>

src/lib/components/Hall.svelte

@@ -1,6 +1,9 @@
 <script lang="ts">
+	import About from './About.svelte';
+	import TallyBoard from './Tally.svelte';
 	import { goto } from '$app/navigation';
-	import { allSeats, api, forgetSeat, type Report } from '$lib/game/client';
+	import { loadFamily, type FamilyGame } from '$lib/family';
+	import { allSeats, api, doubtSeat, forgetSeat, rememberSeat, ServerError, trustSeat, type Report, type Tally } from '$lib/game/client';
 	import { Duel, duel, NAME_MAX, playerName, rememberName } from '$lib/game/duel.svelte';
 	import { unreadTalk } from '$lib/game/talk';
 	import type { RoomView } from '$lib/game/view';
@@ -12,12 +15,54 @@
 	let seats = $state(allSeats());
 	let games = $state<Record<string, RoomView | null>>({});
 	let aboutOpen = $state(false);
-	/** Reports this browser's seats have filed, with the keeper's replies. */
+	$effect(() => {
+		if (location.hash === '#about') aboutOpen = true;
+	});
+	/** Site-wide statistics, fetched the first time the about panel opens. */
+	let tally = $state<Tally | null>(null);
+	$effect(() => {
+		if (aboutOpen && !tally) api.tally().then((t) => (tally = t)).catch(() => (tally = null));
+	});
+	const hours = (minutes: number) => (minutes < 90 ? `${minutes} minutes` : `${Math.round(minutes / 60)} hours`);
+
+	/** The tally split for the about panel: headline figures for the cards, every other count as a detail line. */
+	const told = $derived.by(() => {
+		const t = tally;
+		if (!t) return null;
+
+		const headline = [
+			{ n: t.gamesFinished, label: t.gamesFinished === 1 ? 'duel fought to a finish' : 'duels fought to a finish' },
+			{ n: t.byGame['duels won with every rival slain'] ?? 0, label: 'won with every rival slain' },
+			{ n: t.byGame["duels won by a rival's surrender"] ?? 0, label: "won by a rival's surrender" },
+			{ n: hours(t.minutesAtTable), label: 'at the table' }
+		];
+		const onCards = new Set<string>(['duels won with every rival slain', "duels won by a rival's surrender"]);
+		const details = [
+			{ n: t.gamesBegun, label: `duels begun, at ${t.tablesOpened} ${t.tablesOpened === 1 ? 'table' : 'tables'}` },
+			{ n: t.namesSeated, label: t.namesSeated === 1 ? 'name has taken a seat' : 'names have taken a seat' },
+			{ n: t.turnsPlayed, label: `turns of gestures written; ${t.longestGameTurns} in the longest duel` },
+			{ n: t.gamesWithBot, label: `duels with the bot seated` },
+			...(t.talkLines ? [{ n: t.talkLines, label: t.talkLines === 1 ? 'line of table talk' : 'lines of table talk' }] : []),
+			...Object.entries(t.byGame).filter(([label]) => !onCards.has(label)).map(([label, n]) => ({ n, label }))
+		];
+		const first = t.firstGameAt ? `The first duel began ${new Date(t.firstGameAt).toLocaleDateString(undefined, { year: 'numeric', month: 'long', day: 'numeric' })}. ` : '';
+		return { headline, details, note: `${first}The count is of names, so one player under two names is two here. Table time counts only the minutes between reveals, so a duel left open overnight adds nothing for the night.` };
+	});
+	/** The sibling games listed in the about panel, and the family's landing page. */
+	let family = $state<FamilyGame[]>([]);
+	let hall = $state('');
+	$effect(() => {
+		void loadFamily('waving-hands').then((f) => {
+			family = f.games;
+			hall = f.hall;
+		});
+	});
+	/** Bug reports filed from this browser's seats, with the maintainer's replies. */
 	let reports = $state<Report[]>([]);
 	let answers = $state<Record<string, string>>({});
 	let answerError = $state('');
 
-	// The desk is asked once per visit for every seat this browser holds.
+	// Fetch the reports for every held seat; re-runs when the held seats change.
 	$effect(() => {
 		const held = seats;
 		if (!held.length) return;
@@ -40,25 +85,47 @@
 		}
 	}
 
-	/** The single-player duel saved in this browser, if one is under way. */
+	/** The offline game saved in this browser, if one is unfinished. */
 	const local = $derived(duel.inProgress ? duel : null);
 	const ready = $derived(name.trim().length > 0);
 
-	// Each held seat is looked up once, so the ledger can say whose move it is.
+	// Each held seat is fetched once so the list can say whose move it is. A 403 or 404 marks
+	// the seat doubtful, and a second refusal in a row drops it; a network failure changes nothing.
 	$effect(() => {
 		for (const held of seats) {
 			if (held.roomId in games) continue;
 			games[held.roomId] = null;
 			api.view(held.roomId, held.token)
 				.then((v) => {
+					trustSeat(held.roomId);
 					games[held.roomId] = v;
 				})
-				.catch(() => {
+				.catch((e: unknown) => {
 					games[held.roomId] = null;
+					if (e instanceof ServerError && (e.status === 403 || e.status === 404) && doubtSeat(held.roomId)) seats = allSeats();
 				});
 		}
 	});
 
+	let phrase = $state('');
+	let claiming = $state(false);
+
+	/** Claim a seat transferred from another device, by its transfer phrase. */
+	async function claim(e: SubmitEvent) {
+		e.preventDefault();
+		claiming = true;
+		error = '';
+		try {
+			const got = await api.claim(phrase.trim());
+			rememberSeat(got.roomId, { seat: got.seat, token: got.token });
+			await goto(`/join/${got.roomId}`);
+		} catch (err) {
+			error = err instanceof Error ? err.message : 'The phrase opened no seat.';
+		} finally {
+			claiming = false;
+		}
+	}
+
 	async function playBot() {
 		busy = true;
 		error = '';
@@ -99,7 +166,14 @@
 		if (c) void goto(`/join/${c}`);
 	}
 
+	/** Forgetting an unfinished game asks first: this browser's token may be the only copy of the seat. */
+	let forgetting = $state<string | null>(null);
 	function forget(roomId: string) {
+		if (!games[roomId]?.state?.over && forgetting !== roomId) {
+			forgetting = roomId;
+			return;
+		}
+		forgetting = null;
 		forgetSeat(roomId);
 		seats = allSeats();
 	}
@@ -108,7 +182,7 @@
 		const g = games[held.roomId];
 		if (g === undefined) return 'looking';
 		if (g === null) return 'unreachable';
-		const others = g.seats.filter((s) => s.id !== held.seat).map((s) => (s.bot ? `${s.name} (the bot)` : s.name));
+		const others = g.seats.filter((s) => s.id !== held.seat).map((s) => (s.standIn ? `${s.name} (a bot stands in)` : s.bot ? `${s.name} (the bot)` : s.name));
 		if (!g.state) return `waiting to start${g.seats.length ? ` · ${g.seats.map((s) => s.name).join(', ')}` : ''}`;
 		if (g.state.over) {
 			if (g.state.over.winner === held.seat) return 'you won';
@@ -120,7 +194,7 @@
 		return `waiting on ${g.waitingOn.map((id) => g.state!.wizards[id].name).join(', ')} · ${turn}`;
 	}
 
-	/** Lines of table talk said since this browser last looked in. */
+	/** Chat lines posted since this browser last opened the room. */
 	function unread(held: { roomId: string }): number {
 		const g = games[held.roomId];
 		return g ? unreadTalk(held.roomId, g.chat.length) : 0;
@@ -131,7 +205,7 @@
 		return !!g?.state && !g.state.over && g.waitingOn.includes(held.seat);
 	}
 
-	/* A few turns of a duel, as the ledger writes them. */
+	/** Fixed sample rows for the illustration table. */
 	const sample = [
 		{ turn: 1, a: ['W', 'S'], b: ['P', 'W'], notes: { b0: 'Shield' } },
 		{ turn: 2, a: ['W', 'D'], b: ['P', 'D'], notes: { a1: 'Missile', b0: 'Shield' } },
@@ -143,9 +217,9 @@
 <section class="lid">
 	<div class="lid-head">
 		<h1>Waving Hands</h1>
-		<p class="pitch">Duelling wizards. Two hands each. The right run of gestures is a spell.</p>
-		<p class="tag">Richard Bartle's 1977 pencil-and-paper duel, free in your browser. Each turn every wizard chooses a gesture per hand and all reveal together; a Fireball is F-S-S-D-D on one hand, a Shield is a single palm. Play the bot, or open a table for up to a dozen wizards and play by turns.</p>
-		<p class="links"><a href="/guide">how to play</a> · <a href="/rules">the rules</a> · <a class="about-link" href="#about" onclick={() => (aboutOpen = true)}>about this game — a labor of love</a></p>
+		<p class="pitch">Wizards duel with their hands, and the right run of gestures is a spell.</p>
+		<p class="tag">Richard Bartle's 1977 pencil-and-paper duel, free in your browser. Each turn every wizard chooses a gesture for each hand, and all are shown together. A Fireball is F-S-S-D-D on one hand, and a Shield is a single palm. Play the bot, or open a table for up to a dozen wizards and play by turns.</p>
+		<p class="links" id="about"><a href="/guide">how to play</a> · <a href="/rules">the rules</a> · <a class="about-link" href="#about" onclick={() => (aboutOpen = true)}>about this game</a></p>
 	</div>
 
 	<div class="lid-play">
@@ -169,7 +243,12 @@
 				<button type="submit" class="quiet" disabled={!ready || code.trim().length < 4}>Join</button>
 			</form>
 		</div>
-		<p class="muted small">A code opens the door either way: take a seat if one is free, or watch from the Peanut Gallery.</p>
+		<p class="muted small">With a code you can take a seat if one is free, or watch from the Peanut Gallery.</p>
+		<form class="joinform claimform" onsubmit={claim}>
+			<span class="or">or bring a seat from another device</span>
+			<input type="text" bind:value={phrase} placeholder="the four-word phrase" autocomplete="off" aria-label="transfer phrase" />
+			<button type="submit" class="quiet" disabled={claiming || phrase.trim().split(/[\s-]+/).length < 4}>Claim</button>
+		</form>
 		{#if error}<p class="warning">{error}</p>{/if}
 	</div>
 
@@ -191,7 +270,7 @@
 				{/each}
 			</tbody>
 		</table>
-		<p class="caption">The ledger: every gesture both wizards have made, and the spells they finished.</p>
+		<p class="caption">A few turns of a duel. Each row is a turn, each letter one hand's gesture, and a spell is named under the gesture that finished it.</p>
 	</div>
 
 	{#if seats.length || local}
@@ -206,12 +285,16 @@
 				</div>
 			{/if}
 			{#each seats as held (held.roomId)}
-				<div class="ledger-row" class:your-move={yourMove(held)}>
+				<div class="ledger-row" class:your-move={yourMove(held)} class:asking={forgetting === held.roomId}>
 					<a class="ledger-resume" href={`/join/${held.roomId}`}>
 						<span class="ledger-code">{held.roomId}</span>
 						<span class="ledger-info">{status(held)}{#if unread(held) > 0} · <span class="talk-new">{unread(held)} new {unread(held) === 1 ? 'line' : 'lines'} of talk</span>{/if}</span>
 					</a>
+					{#if forgetting === held.roomId}
+						<span class="forget-ask">This browser may be all that holds your seat. <button type="button" class="quiet" onclick={() => forget(held.roomId)}>Forget it</button> <button type="button" class="quiet" onclick={() => (forgetting = null)}>Keep it</button></span>
+					{:else}
 						<button type="button" class="ledger-forget" title="forget this duel" onclick={() => forget(held.roomId)}>×</button>
+					{/if}
 				</div>
 			{/each}
 			{#if reports.length}
@@ -248,17 +331,43 @@
 		</div>
 	{/if}
 
-	<details class="about" id="about" bind:open={aboutOpen}>
-		<summary>about this game</summary>
+	<!-- The about panel's tabs. Their copy is this game's own, in its in-world voice by design. -->
+	{#snippet aboutGame()}
 		<div class="about-body">
 			<p>Waving Hands is Richard Bartle's game from 1977, played with pencil, paper and two hands. It was later known as Spellbinder and Spellcaster, and Andrew Plotkin's <em>Spellcast</em> brought it to university X terminals in 1993, which is where the maker of this page first met it.</p>
-			<p>This version keeps the game as written: all forty spells, the same simultaneous resolution, the same ledger of letters. The rules text it follows is the fanzine transcription, kept in full on the <a href="/rules">rules page</a>. The bot reads your gestures as you would read its; the hand silhouettes on the buttons are adapted from Plotkin's bitmaps, with his notice retained.</p>
-			<p>It is free and keeps no accounts. A duel against the bot lives in your own browser. A duel between people lives on a small server as an append-only ledger of moves, so it can be replayed from its first gesture, and each wizard is shown only what the rules let them see.</p>
-			<h3>Send word</h3>
-			<p>A rule read wrong, a bug, a duel you would like to tell of: write to <a href="mailto:eric@ericwagoner.com">eric@ericwagoner.com</a>, <a href="https://bsky.app/profile/kestrelsnest.social" target="_blank" rel="noreferrer">@kestrelsnest.social</a> on Bluesky, or <a href="https://toots.kestrelsnest.social/@eric" target="_blank" rel="noreferrer">@eric@toots.kestrelsnest.social</a> on Mastodon. The keeper of this hall roosts at <a href="https://kestrelsnest.social" target="_blank" rel="noreferrer">kestrelsnest.social</a>.</p>
-			<p class="made">Waving Hands is Richard Bartle's, 1977. This page was made by Eric and a very enthusiastic AI, 2026.</p>
+			<p>This version keeps the game as written, with all forty spells, the same simultaneous turns and the same ledger of letters. The rules text it follows is the fanzine transcription, kept in full on the <a href="/rules">rules page</a>. The bot reads your gestures as you would read its. The hand silhouettes on the buttons are adapted from Plotkin's bitmaps, with his notice retained.</p>
+			<p>It is free and keeps no accounts. An offline duel stays in your own browser. Every other duel, against the bot or between people, lives on a small server as an append-only ledger of moves, so it can be replayed from its first gesture, and each wizard is shown only what the rules let them see.</p>
 		</div>
-	</details>
+	{/snippet}
+	{#snippet aboutTally()}
+		{#if told}
+			<TallyBoard title="What the ledgers add up to" headline={told.headline} details={told.details} note={told.note} />
+		{:else}
+			<p class="muted">Counting…</p>
+		{/if}
+	{/snippet}
+	{#snippet aboutFamily()}
+		<div class="about-body">{#if family.length}
+				<h3>More games in {#if hall}<a href={hall}>Kestrel's Hall</a>{:else}Kestrel's Hall{/if}</h3>
+				<ul class="family">
+					{#each family as g (g.slug)}
+						<li><a href={g.url}>{g.name}</a>: {g.pitch} <span class="muted">{g.players} players; {g.origin}.</span></li>
+					{/each}
+				</ul>
+			{/if}
+			<p class="hosting">
+				The games of Kestrel's Hall are free and will stay free. They run on small servers that cost a few dollars a month, and anyone who wants to chip in toward the hosting can do so at
+				<a href="https://ko-fi.com/kestrelsnest" target="_blank" rel="noreferrer">ko-fi.com/kestrelsnest</a>. Chipping in unlocks nothing, and the games are the same for everyone.
+			</p>
+			<p class="made">Waving Hands is Richard Bartle's, 1977.</p>
+		</div>
+	{/snippet}
+	{#snippet aboutWord()}
+		<div class="about-body">
+			<p>If a rule reads wrong, something breaks, or you have a duel to tell of, write to <a href="mailto:eric@ericwagoner.com">eric@ericwagoner.com</a>, <a href="https://bsky.app/profile/kestrelsnest.social" target="_blank" rel="noreferrer">@kestrelsnest.social</a> on Bluesky, or <a href="https://toots.kestrelsnest.social/@eric" target="_blank" rel="noreferrer">@eric@toots.kestrelsnest.social</a> on Mastodon. The keeper of this hall roosts at <a href="https://kestrelsnest.social" target="_blank" rel="noreferrer">kestrelsnest.social</a>.</p>
+		</div>
+	{/snippet}
+	<About bind:open={aboutOpen} title="About Waving Hands" tabs={[{ id: 'game', label: 'Origins', body: aboutGame }, { id: 'tally', label: 'Duels so far', body: aboutTally }, { id: 'family', label: 'More games', body: aboutFamily }, { id: 'word', label: 'Send word', body: aboutWord }]} />
 </section>
 
 <style>
@@ -271,14 +380,14 @@
 		padding: clamp(1.4rem, 3vw, 2.2rem) clamp(1.2rem, 3vw, 2.6rem) 1.8rem;
 		display: grid;
 		grid-template-columns: minmax(0, 1fr);
-		grid-template-areas: 'head' 'play' 'look' 'ledger' 'about';
+		grid-template-areas: 'head' 'play' 'look' 'ledger';
 		gap: 1.2rem 2.2rem;
 	}
 
 	@media (min-width: 901px) {
 		.lid {
 			grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
-			grid-template-areas: 'head head' 'play look' 'ledger ledger' 'about about';
+			grid-template-areas: 'head head' 'play look' 'ledger ledger';
 		}
 	}
 
@@ -367,6 +476,15 @@
 		gap: 0.5rem;
 	}
 
+	.claimform {
+		flex-wrap: wrap;
+		margin-top: -0.2rem;
+	}
+
+	.claimform input {
+		width: 15em;
+	}
+
 	.or {
 		color: var(--bone-dim);
 		font-style: italic;
@@ -381,18 +499,6 @@
 		font-weight: 600;
 	}
 
-	.quiet {
-		background: none;
-		border: 1px solid var(--rule-strong);
-		border-radius: 4px;
-		padding: 0.45rem 0.9rem;
-		color: var(--bone);
-	}
-
-	.quiet:hover:not(:disabled) {
-		border-color: var(--bone);
-	}
-
 	.warning {
 		color: var(--blood);
 	}
@@ -457,7 +563,7 @@
 		text-align: center;
 	}
 
-	/* the games ledger */
+	/* The list of held seats, and the reports under it. */
 	.ledger {
 		grid-area: ledger;
 		border-top: 1px solid var(--rule-strong);
@@ -567,6 +673,16 @@
 		color: var(--ember);
 	}
 
+	/* The confirmation wraps onto its own line when the row is narrow. */
+	.ledger-row.asking {
+		flex-wrap: wrap;
+	}
+
+	.forget-ask {
+		font-size: 0.85em;
+		padding: 0 0.2rem 0.3rem;
+	}
+
 	.ledger-forget {
 		background: none;
 		border: 0;
@@ -579,18 +695,6 @@
 		color: var(--blood);
 	}
 
-	.about {
-		grid-area: about;
-		border-top: 1px solid var(--rule);
-		padding-top: 0.6rem;
-	}
-
-	.about summary {
-		cursor: pointer;
-		font-style: italic;
-		color: var(--frost);
-	}
-
 	.about-body h3 {
 		font-size: 1rem;
 		font-style: italic;
@@ -620,4 +724,12 @@
 	.about-body a {
 		color: var(--frost);
 	}
+	.family {
+		margin: 0.4rem 0 0.8rem 1.2rem;
+		padding: 0;
+	}
+
+	.family li + li {
+		margin-top: 0.3rem;
+	}
 </style>

src/lib/components/HandPicker.svelte

@@ -21,20 +21,20 @@
 	const hiddenPlans = $derived(duel.plans[hand].length - plans.length);
 	const whyForced = $derived(
 		duel.you.constraints.amnesia
-			? 'Amnesia: you must repeat last turn.'
+			? 'Amnesia holds this hand to last turn\'s gesture.'
 			: duel.you.constraints.paralysedHand === hand
-				? "Paralysed in last turn's position."
+				? "Paralysis has locked this hand in last turn's position."
 				: ''
 	);
 </script>
 
 <fieldset class="hand">
-	<legend>{hand === 'left' ? 'Left hand' : 'Right hand'}{#if set === 'haste'}<span class="again">, again</span>{/if}</legend>
+	<legend>{hand === 'left' ? 'Your left hand' : 'Your right hand'}{#if set === 'haste'}<span class="again">, again</span>{/if}</legend>
 
 	{#if forced}
 		<p class="locked"><span class="letter big">{glyph(forced, duel.gestureFor(set, other))}</span> {whyForced}</p>
 	{:else if charmed}
-		<p class="locked"><span class="letter big">?</span> Charmed: {duel.foe.name} chooses this hand's gesture.</p>
+		<p class="locked"><span class="letter big">?</span> {duel.foe.name} has charmed this hand and chooses its gesture.</p>
 	{:else}
 		<div class="gestures" role="group" aria-label="{hand} hand gesture{set === 'haste' ? ', second pair' : ''}">
 			{#each GESTURES as g (g)}
@@ -53,7 +53,7 @@
 			{/each}
 		</div>
 		{#if duel.you.constraints.fear && !duel.timeStopped}
-			<p class="hint">Fear: no clap, digit, fingers or snap this turn.</p>
+			<p class="hint">Fear keeps this hand from clapping, pointing, wriggling or snapping this turn.</p>
 		{/if}
 		{#if set === 'main' && duel.showPlans}
 			{#if duel.plans[hand].length === 0}

src/lib/components/Ledger.svelte

@@ -22,7 +22,7 @@
 		cells: Record<WizardId, Placed[]>;
 	}
 
-	/** You first, then the others in table order; the gallery sees the table as laid. */
+	/** Column order: the viewer first, then the others in seat order; a spectator gets no column of their own. */
 	const columns = $derived<WizardId[]>(duel.spectating ? duel.others : [duel.me, ...duel.others]);
 
 	function placed(who: WizardId, turn: number, phases: string[]): Placed[] {
@@ -68,9 +68,42 @@
 		return !!h && h.who === who && h.hand === hand && index >= h.from && index <= h.to;
 	}
 
+	// The stylesheet caps the box at a share of the viewport, which is rarely a whole number of
+	// rows, so after each turn the cap is trimmed to the header plus as many of the newest rows
+	// as fit under it, and the box is scrolled to the newest. Older rows then sit wholly under
+	// the sticky header rather than showing a cut-off sliver. The second header row sticks at
+	// the measured height of the first, so the two meet exactly whatever the font or wrapping.
+	// Row heights change with the viewport and the web font, so this is redone on resize and
+	// once fonts are in.
+	function fitRows() {
+		if (!scroller) return;
+		scroller.style.maxHeight = '';
+		const names = scroller.querySelector('thead tr');
+		if (names) scroller.style.setProperty('--names-row', `${names.getBoundingClientRect().height}px`);
+		const cap = parseFloat(getComputedStyle(scroller).maxHeight);
+		if (Number.isFinite(cap)) {
+			const head = scroller.querySelector('thead')?.getBoundingClientRect().height ?? 0;
+			const chrome = scroller.offsetHeight - scroller.clientHeight;
+			let inner = head;
+			for (const row of [...scroller.querySelectorAll('tbody tr')].reverse()) {
+				const h = row.getBoundingClientRect().height;
+				if (inner > head && inner + h + chrome > cap) break;
+				inner += h;
+			}
+			scroller.style.maxHeight = `${Math.ceil(inner + chrome)}px`;
+		}
+		scroller.scrollTop = scroller.scrollHeight;
+	}
+
 	$effect(() => {
 		void turns;
-		if (scroller) scroller.scrollTop = scroller.scrollHeight;
+		fitRows();
+	});
+
+	$effect(() => {
+		window.addEventListener('resize', fitRows);
+		void document.fonts?.ready.then(fitRows);
+		return () => window.removeEventListener('resize', fitRows);
 	});
 
 	const crowded = $derived(duel.others.length >= 3);
@@ -221,7 +254,7 @@
 	}
 
 	.scroller {
-		max-height: clamp(170px, 30vh, 400px);
+		max-height: clamp(170px, 38vh, 420px);
 		overflow: auto;
 		border-top: 1px solid var(--rule-strong);
 		border-bottom: 1px solid var(--rule-strong);
@@ -259,16 +292,13 @@
 		left: 7.4rem;
 	}
 
-	thead th.pin-left,
-	thead th.pin-right {
-		z-index: 3;
-	}
-
 	thead th.gone {
 		text-decoration: line-through;
 		color: var(--bone-dim);
 	}
 
+	/* The header must stack above every body cell, including the pinned ones (z-index 1 and 2 below),
+	   or a row scrolled under it shows its turn number through the header while its letters are hidden. */
 	thead th {
 		position: sticky;
 		top: 0;
@@ -277,7 +307,7 @@
 		text-align: center;
 		padding: 0.5rem 0 0.15rem;
 		font-size: 1.05rem;
-		z-index: 1;
+		z-index: 3;
 	}
 
 	thead th.you,
@@ -287,7 +317,8 @@
 	}
 
 	thead tr.hands th {
-		top: 2.2rem;
+		/* The measured height of the row above (set by fitRows), so the two sticky rows meet with no gap. */
+		top: var(--names-row, 2.2rem);
 		font-size: 0.8rem;
 		font-weight: 400;
 		color: var(--bone-dim);
@@ -312,6 +343,13 @@
 		padding-top: 0.6rem;
 	}
 
+	/* The header's own pinned cells sit above the rest of the header, which slides under them sideways. */
+	thead th.turn,
+	thead th.pin-left,
+	thead th.pin-right {
+		z-index: 4;
+	}
+
 	.rownote {
 		display: block;
 		font-size: 0.6rem;

src/lib/components/MobileBar.svelte

@@ -36,7 +36,7 @@
 				{/each}
 			</div>
 			<button type="button" class="reveal" disabled={!duel.ready} onclick={() => duel.reveal()}>
-				{duel.out ? 'Out' : duel.moved ? 'Waiting' : duel.surrendering ? 'Surrender' : duel.timeStopped ? 'Act' : 'Reveal'}
+				{duel.out ? 'Out' : duel.moved ? 'Waiting' : duel.surrendering ? 'Surrender' : duel.timeStopped ? 'Act' : 'Seal'}
 			</button>
 		{/if}
 	</div>

src/lib/components/ReportSlip.svelte

@@ -61,7 +61,7 @@
 		<form class="slip" aria-labelledby="report-heading" onsubmit={send}>
 			<h2 id="report-heading">Something amiss?</h2>
 			{#if sent}
-				<p class="thanks">Recorded beside the room's ledger, with the turn. Thank you; the keeper will study the moment.{#if error} {error}{/if}</p>
+				<p class="thanks">Recorded beside the room's ledger, with the turn. Thank you. The keeper will look into it.{#if error} {error}{/if}</p>
 			{:else}
 				<label class="field">
 					<span>What happened?</span>
@@ -76,7 +76,7 @@
 					<input type="file" accept="image/png,image/jpeg,image/webp" onchange={pickImage} />
 					{#if preview}<img class="preview" src={preview} alt="The screenshot you chose" />{/if}
 				</label>
-				<p class="muted small">The room code and the turn ride along; the keeper can replay the duel to this moment.</p>
+				<p class="muted small">The room code and the turn are sent with it, so the keeper can replay the duel to this moment.</p>
 				{#if error}<p class="warning">{error}</p>{/if}
 				<div class="actions">
 					<button type="submit" class="reveal small" disabled={!happened.trim() || busy}>{busy ? 'Sending' : 'Send it'}</button>
@@ -88,16 +88,6 @@
 {/if}
 
 <style>
-	.scrim {
-		position: fixed;
-		inset: 0;
-		z-index: 20;
-		background: rgba(0, 0, 0, 0.55);
-		display: grid;
-		place-items: center;
-		padding: 16px;
-	}
-
 	.slip {
 		width: min(100%, 30rem);
 		max-height: 100%;
@@ -168,11 +158,6 @@
 		margin-top: 0.9rem;
 	}
 
-	.reveal.small {
-		padding: 0.4rem 0.9rem;
-		font-size: 1rem;
-	}
-
 	.link {
 		background: none;
 		border: 0;

src/lib/components/Roster.svelte

@@ -1,6 +1,6 @@
 <script lang="ts">
-	// A crowded table's rail: every other wizard on one line, with the one
-	// you are looking at opened out. Your own panel stays in full above.
+	// The rail for three or more opponents: each on one line, with the focused
+	// one expanded. The player's own status card stays above in full.
 	import WizardStatus from './WizardStatus.svelte';
 	import type { Duel } from '$lib/game/duel.svelte';
 	import { seatColor } from '$lib/game/colors';
@@ -20,8 +20,9 @@
 		if (!duel.remote?.started || duel.state.over) return '';
 		const w = duel.state.wizards[id];
 		if (!w.alive || w.surrendered) return 'out';
-		const bot = duel.remote.seats.find((s) => s.id === id)?.bot;
-		if (bot) return '';
+		const seat = duel.remote.seats.find((s) => s.id === id);
+		if (seat?.standIn) return 'a bot duels for them';
+		if (seat?.bot) return '';
 		return waitingOn.includes(id) ? 'writing' : 'moved';
 	}
 </script>
@@ -43,7 +44,7 @@
 				</button>
 				{#if open}
 					<div class="detail">
-						<WizardStatus wizard={w} monsters={duel.state.monsters.filter((m) => m.owner === id)} />
+						<WizardStatus turnsPlayed={duel.state.turn} wizard={w} monsters={duel.state.monsters.filter((m) => m.owner === id)} />
 					</div>
 				{/if}
 			</li>

src/lib/components/SeatsSlip.svelte

@@ -0,0 +1,148 @@
+<script lang="ts">
+	// Host-only controls over the other seats during a game: a transfer phrase
+	// for a player whose browser lost its seat, and handing a seat to a bot until
+	// a phrase claims it back.
+	import type { Duel } from '$lib/game/duel.svelte';
+	import type { WizardId } from '$lib/game/state';
+
+	let { duel, open = $bindable(false) }: { duel: Duel; open?: boolean } = $props();
+
+	const people = $derived((duel.remote?.seats ?? []).filter((s) => s.id !== duel.me && (!s.bot || s.standIn)));
+	let asked = $state<WizardId | null>(null);
+	let phrase = $state<{ name: string; phrase: string; expiresAt: number } | null>(null);
+	let error = $state('');
+
+	function close() {
+		open = false;
+		asked = null;
+		error = '';
+	}
+
+	async function makePhrase(seat: WizardId, name: string) {
+		error = '';
+		try {
+			const made = await duel.hostPhrase(seat);
+			phrase = { name, ...made };
+			setTimeout(() => {
+				if (phrase?.phrase === made.phrase) phrase = null;
+			}, Math.max(0, made.expiresAt - Date.now()));
+		} catch (e) {
+			error = e instanceof Error ? e.message : 'The phrase could not be made.';
+		}
+	}
+
+	async function standIn(seat: WizardId) {
+		asked = null;
+		if (!(await duel.standIn(seat))) error = duel.remote?.error ?? '';
+	}
+
+	function phraseTitle(name: string, standIn: boolean): string {
+		const why = standIn ? `Brings ${name} back from the bot.` : `For when ${name}'s browser lost the seat, or they need to play from another device.`;
+		return `${why} You get four words to pass to them. Within ten minutes, they enter them in the hall, or in the claim box while watching this duel, and sit back down as ${name}. The phrase works once, and the browser they used before stops opening the seat.`;
+	}
+</script>
+
+<svelte:window onkeydown={(e) => open && e.key === 'Escape' && close()} />
+
+{#if open}
+	<div class="scrim" role="presentation" onclick={(ev) => ev.target === ev.currentTarget && close()}>
+		<div class="slip" role="dialog" aria-labelledby="seats-heading">
+			<h2 id="seats-heading">The other seats</h2>
+			<p class="muted small">As the host, you can bring a wizard back to a seat their browser lost, or give the seat of one who cannot go on to a bot, which duels in it from this turn.</p>
+			{#if people.length === 0}
+				<p class="muted">Every other wizard at this table is a bot.</p>
+			{/if}
+			<ul>
+				{#each people as s (s.id)}
+					<li>
+						<span class="name">{s.name}{#if s.standIn}<span class="muted note">a bot duels for them</span>{/if}</span>
+						<span class="ways">
+							<button type="button" class="quiet" title={phraseTitle(s.name, !!s.standIn)} onclick={() => makePhrase(s.id, s.name)}>{s.standIn ? 'Transfer phrase to take it back' : 'Make a transfer phrase'}</button>
+							{#if !s.standIn && !duel.state.over}
+								{#if asked === s.id}
+									<button type="button" class="reveal small" onclick={() => standIn(s.id)}>Yes, a bot plays for {s.name}</button>
+									<button type="button" class="link" onclick={() => (asked = null)}>no</button>
+								{:else}
+									<button type="button" class="quiet" title="A bot duels in {s.name}'s seat from this turn, and their browser stops opening it. A transfer phrase gives it back." onclick={() => (asked = s.id)}>Give to a bot</button>
+								{/if}
+							{/if}
+						</span>
+					</li>
+				{/each}
+			</ul>
+			{#if phrase}
+				<p class="made">Give {phrase.name} this phrase to claim within ten minutes, in the hall or while watching this duel: <b class="phrase">{phrase.phrase}</b>. It works once, and their old link stops opening the seat.</p>
+			{/if}
+			{#if error}<p class="warning">{error}</p>{/if}
+			<div class="actions"><button type="button" class="link" onclick={close}>close</button></div>
+		</div>
+	</div>
+{/if}
+
+<style>
+	/* A definite row, so the slip's max-height resolves and it scrolls instead of overflowing the viewport. */
+	.scrim {
+		grid-template-rows: minmax(0, 1fr);
+	}
+
+	.slip {
+		width: min(100%, 34rem);
+		max-height: 100%;
+		overflow-y: auto;
+		background: var(--slate);
+		border: 1px solid var(--rule-strong);
+		border-radius: 6px;
+		padding: 1rem 1.2rem 1.2rem;
+	}
+
+	h2 {
+		font-size: 1.3rem;
+		margin-bottom: 0.4rem;
+	}
+
+	ul {
+		list-style: none;
+		padding: 0;
+		margin: 0.8rem 0 0;
+	}
+
+	li {
+		display: flex;
+		flex-wrap: wrap;
+		align-items: center;
+		justify-content: space-between;
+		gap: 0.4rem 1rem;
+		padding: 0.5rem 0;
+		border-bottom: 1px solid var(--rule);
+	}
+
+	.note {
+		margin-left: 0.5em;
+		font-style: italic;
+		font-size: 0.9em;
+	}
+
+	.ways {
+		display: flex;
+		flex-wrap: wrap;
+		align-items: center;
+		gap: 0.5rem;
+	}
+
+	.made {
+		margin-top: 0.8rem;
+	}
+
+	.phrase {
+		letter-spacing: 0.06em;
+		user-select: all;
+	}
+
+	.warning {
+		margin-top: 0.5rem;
+	}
+
+	.actions {
+		margin-top: 0.9rem;
+	}
+</style>

src/lib/components/SpellSheet.svelte

@@ -16,7 +16,7 @@
 
 <details class="sheet" id="spell-sheet" bind:open={duel.sheetOpen}>
 	<summary>Spell sheet</summary>
-	<p class="muted intro">Gestures you have already made light up; select a spell to read what it does. A bracketed lower-case letter, such as (w, is that gesture made with both hands at once; C, the clap, is always two-handed. Surrender is both palms at once: never a spell. <a href="/rules">Full rules</a>.</p>
+	<p class="muted intro">Gestures you have already made light up. Select a spell to read what it does. A bracketed lower-case letter, such as (w, is that gesture made with both hands at once; C, the clap, is always two-handed. Surrender is both palms at once: never a spell. <a href="/rules">Full rules</a>.</p>
 	{#each groups as g (g.category)}
 		<h3>{g.title}</h3>
 		<ul>

src/lib/components/TableTalk.svelte

@@ -1,16 +1,18 @@
 <script lang="ts">
 	import { tick } from 'svelte';
-	import type { Duel } from '$lib/game/duel.svelte';
+	import { NAME_MAX, playerName, rememberName, type Duel } from '$lib/game/duel.svelte';
 
 	let { duel }: { duel: Duel } = $props();
 
 	const remote = $derived(duel.remote);
 	const lines = $derived(remote?.chat ?? []);
 	let draft = $state('');
+	/** Spectators sign their lines; the default is the name saved in local storage. */
+	let galleryName = $state(playerName());
 	let sending = $state(false);
 	let list = $state<HTMLElement | null>(null);
 
-	// New talk scrolls into view, as at any table.
+	// Keep the list scrolled to the newest line.
 	$effect(() => {
 		void lines.length;
 		void tick().then(() => {
@@ -26,6 +28,17 @@
 		if (await duel.say(text)) draft = '';
 		sending = false;
 	}
+
+	async function sayFromGallery(e: SubmitEvent) {
+		e.preventDefault();
+		const text = draft.trim();
+		const name = galleryName.trim();
+		if (!text || !name || sending) return;
+		sending = true;
+		rememberName(name);
+		if (await duel.sayFromGallery(name, text)) draft = '';
+		sending = false;
+	}
 </script>
 
 {#if remote}
@@ -36,11 +49,17 @@
 				<li class="muted">Nobody has said a word.</li>
 			{/if}
 			{#each lines as line, i (line.at + ':' + i)}
-				<li class:you={line.id === duel.me}><em>{line.id === duel.me ? 'You' : duel.speaker(line.id)}</em> {line.text}</li>
+				<li class:you={!line.name && line.id === duel.me}><em>{line.keeper ? `${line.name}, the keeper` : line.name ? `${line.name} (gallery)` : line.id === duel.me ? 'You' : duel.speaker(line.id)}</em> {line.text}</li>
 			{/each}
 		</ul>
-		{#if remote.spectating}
-			<p class="muted small">The gallery listens; only seated wizards speak.</p>
+		{#if remote.spectating && remote.galleryTalk}
+			<form onsubmit={sayFromGallery}>
+				<input type="text" class="name" bind:value={galleryName} maxlength={NAME_MAX} placeholder="Your name" aria-label="Your name in the gallery" autocomplete="nickname" />
+				<input type="text" bind:value={draft} maxlength="300" placeholder="Say something from the gallery" aria-label="Say something from the gallery" autocomplete="off" />
+				<button type="submit" class="quiet" disabled={!draft.trim() || !galleryName.trim() || sending}>Say</button>
+			</form>
+		{:else if remote.spectating}
+			<p class="muted small">The host has not let the gallery talk at this table.</p>
 		{:else}
 			<form onsubmit={say}>
 				<input type="text" bind:value={draft} maxlength="300" placeholder="Say something to the table" aria-label="Say something to the table" autocomplete="off" />
@@ -105,12 +124,8 @@
 		min-width: 0;
 	}
 
-	.quiet {
-		background: none;
-		border: 1px solid var(--rule-strong);
-		border-radius: 4px;
-		padding: 0.3rem 0.8rem;
-		color: var(--bone);
+	input.name {
+		flex: 0 1 8rem;
 	}
 
 	.quiet:disabled {

src/lib/components/Tally.svelte

@@ -0,0 +1,94 @@
+<script lang="ts" module>
+	/** One statistic: the figure and its label. */
+	export interface TallyLine {
+		n: number | string;
+		label: string;
+	}
+</script>
+
+<script lang="ts">
+	// A statistics panel: a few headline counts on large cards, the rest in a
+	// two-column list, then an optional note. The caller supplies the counts
+	// and their labels.
+	let { headline, details, note, title = 'What the ledgers add up to' }: { headline: TallyLine[]; details: TallyLine[]; note?: string; title?: string } =
+		$props();
+
+	const shown = (n: number | string) => (typeof n === 'number' ? n.toLocaleString() : n);
+</script>
+
+<h3>{title}</h3>
+<div class="stories">
+	{#each headline as s (s.label)}
+		<div class="story"><span class="big">{shown(s.n)}</span><span>{s.label}</span></div>
+	{/each}
+</div>
+{#if details.length}
+	<h3>Every count</h3>
+	<dl class="ledger">
+		{#each details as d (d.label)}
+			<dt>{shown(d.n)}</dt><dd>{d.label}</dd>
+		{/each}
+	</dl>
+{/if}
+{#if note}<p class="note">{note}</p>{/if}
+
+<style>
+	h3 {
+		font-size: 0.8rem;
+		font-weight: 600;
+		letter-spacing: 0.12em;
+		text-transform: uppercase;
+		color: var(--bone);
+		border-bottom: 1px solid var(--rule-strong);
+		padding-bottom: 0.25rem;
+		margin: 0.2rem 0 0.7rem;
+	}
+	.stories {
+		display: grid;
+		grid-template-columns: repeat(auto-fit, minmax(8.5rem, 1fr));
+		gap: 0.7rem;
+		margin: 0 0 1.2rem;
+	}
+	.story {
+		display: flex;
+		flex-direction: column;
+		align-items: center;
+		text-align: center;
+		gap: 0.2rem;
+		background: var(--slate-deep);
+		border: 1px solid var(--rule-strong);
+		border-radius: 4px;
+		padding: 0.7rem 0.5rem 0.6rem;
+		font-size: 0.9rem;
+		color: var(--bone-dim);
+	}
+	.big {
+		font-size: 1.9rem;
+		font-weight: 700;
+		line-height: 1.05;
+		color: var(--ember);
+		font-variant-numeric: tabular-nums;
+	}
+	.ledger {
+		display: grid;
+		grid-template-columns: auto 1fr;
+		gap: 0.35rem 0.8rem;
+		margin: 0 0 1rem;
+	}
+	.ledger dt {
+		font-weight: 700;
+		color: var(--ember);
+		text-align: right;
+		white-space: nowrap;
+		font-variant-numeric: tabular-nums;
+	}
+	.ledger dd {
+		margin: 0;
+		color: var(--bone-dim);
+	}
+	.note {
+		font-size: 0.85rem;
+		font-style: italic;
+		color: var(--bone-faint);
+	}
+</style>

src/lib/components/WizardStatus.svelte

@@ -2,9 +2,9 @@
 	import { effectsOf } from '$lib/game/status';
 	import { MAX_HP, type Monster, type WizardState } from '$lib/game/state';
 
-	let { wizard, monsters, you = false }: { wizard: WizardState; monsters: Monster[]; you?: boolean } = $props();
+	let { wizard, monsters, you = false, turnsPlayed }: { wizard: WizardState; monsters: Monster[]; you?: boolean; turnsPlayed?: number } = $props();
 
-	const effects = $derived(effectsOf(wizard));
+	const effects = $derived(effectsOf(wizard, turnsPlayed));
 </script>
 
 <section class="wizard" class:you class:dead={!wizard.alive}>

src/lib/family.ts

@@ -0,0 +1,29 @@
+// The sibling games, from the family list the kit ships (family.json, one copy
+// per game), so a player can find the next game and the family's landing page.
+// This game is left out of its own list.
+
+export interface FamilyGame {
+	slug: string;
+	name: string;
+	url: string;
+	pitch: string;
+	players: string;
+	origin: string;
+}
+
+/** The family list: the landing page's URL and every game but this one. */
+export interface Family {
+	hall: string;
+	games: FamilyGame[];
+}
+
+export async function loadFamily(self: string): Promise<Family> {
+	try {
+		const res = await fetch('/family.json', { cache: 'no-cache' });
+		if (!res.ok) return { hall: '', games: [] };
+		const data = (await res.json()) as { hall?: string; games?: FamilyGame[] };
+		return { hall: data.hall ?? '', games: (data.games ?? []).filter((g) => g.slug !== self) };
+	} catch {
+		return { hall: '', games: [] };
+	}
+}

src/lib/game/client.ts

@@ -19,6 +19,12 @@ function heldSeats(): Record<string, HeldSeat> {
 	}
 }
 
+/** A seat carried in a link, `#seat=<seat>.<token>`: a fragment stays in the browser, out of server logs. */
+export function seatInLink(hash: string): HeldSeat | null {
+	const m = /^#seat=([^.]+)\.([A-Za-z0-9_-]+)$/.exec(hash);
+	return m ? { seat: m[1], token: m[2] } : null;
+}
+
 export function seatFor(roomId: string): HeldSeat | null {
 	return heldSeats()[roomId] ?? null;
 }
@@ -38,6 +44,54 @@ export function forgetSeat(roomId: string): void {
 	}
 }
 
+/**
+ * A seat the server refused is doubted, not dropped: a restarting server, a
+ * stale answer or the wrong backend all answer with ignorance, and ignorance
+ * is not deletion. Only the SECOND refusal in a row costs the seat.
+ */
+const DOUBT_KEY = 'wh:doubted';
+
+function doubted(): Record<string, true> {
+	try {
+		return JSON.parse(localStorage.getItem(DOUBT_KEY) ?? '{}') as Record<string, true>;
+	} catch {
+		return {};
+	}
+}
+
+/** Note a refusal; true when it is the second in a row and the seat is forgotten. */
+export function doubtSeat(roomId: string): boolean {
+	const all = doubted();
+	if (all[roomId]) {
+		forgetSeat(roomId);
+		delete all[roomId];
+		try {
+			localStorage.setItem(DOUBT_KEY, JSON.stringify(all));
+		} catch {
+			// Nothing to note without storage.
+		}
+		return true;
+	}
+	try {
+		localStorage.setItem(DOUBT_KEY, JSON.stringify({ ...all, [roomId]: true }));
+	} catch {
+		// Nothing to note without storage.
+	}
+	return false;
+}
+
+/** The server answered for this seat: any doubt is cleared. */
+export function trustSeat(roomId: string): void {
+	const all = doubted();
+	if (!all[roomId]) return;
+	delete all[roomId];
+	try {
+		localStorage.setItem(DOUBT_KEY, JSON.stringify(all));
+	} catch {
+		// Nothing to clear without storage.
+	}
+}
+
 export function rememberSeat(roomId: string, held: HeldSeat): void {
 	try {
 		localStorage.setItem(SEATS_KEY, JSON.stringify({ ...heldSeats(), [roomId]: held }));
@@ -68,7 +122,22 @@ async function call<T>(method: string, path: string, body?: unknown): Promise<T>
 
 type Seated = { seat: WizardId; token: string; view: RoomView };
 
-/** A report to the keeper, with the exchange under it. */
+/** Site-wide statistics. */
+export interface Tally {
+	tablesOpened: number;
+	gamesBegun: number;
+	gamesFinished: number;
+	namesSeated: number;
+	turnsPlayed: number;
+	minutesAtTable: number;
+	longestGameTurns: number;
+	gamesWithBot: number;
+	talkLines: number;
+	firstGameAt: string | null;
+	byGame: Record<string, number>;
+}
+
+/** A bug report, with the exchange of replies under it. */
 export interface Report {
 	id: string;
 	at: string;
@@ -91,19 +160,31 @@ export const api = {
 	view: (roomId: string, token: string) => call<RoomView>('GET', `/api/rooms/${roomId}?token=${encodeURIComponent(token)}`),
 	/** The gallery's view: no token, no seat, nothing any wizard could not see. */
 	watch: (roomId: string) => call<RoomView>('GET', `/api/rooms/${roomId}`),
-	turn: (roomId: string, token: string, input: TurnInput) => call<RoomView>('POST', `/api/rooms/${roomId}/turn`, { token, input }),
+	turn: (roomId: string, token: string, input: TurnInput, resolved: number) => call<RoomView>('POST', `/api/rooms/${roomId}/turn`, { token, input, resolved }),
 	say: (roomId: string, token: string, text: string) => call<RoomView>('POST', `/api/rooms/${roomId}/say`, { token, text }),
+	/** A word from the gallery, signed with a name, when the host allows it. */
+	sayFromGallery: (roomId: string, name: string, text: string) => call<RoomView>('POST', `/api/rooms/${roomId}/say`, { name, text }),
+	setGalleryTalk: (roomId: string, token: string, on: boolean) => call<RoomView>('POST', `/api/rooms/${roomId}/gallery`, { token, on }),
+	challenge: (roomId: string, token: string) => call<RoomView>('POST', `/api/rooms/${roomId}/challenge`, { token }),
+	rematch: (roomId: string, token: string) =>
+		call<{ roomId: string; seat: WizardId | null; token: string | null; created: boolean }>('POST', `/api/rooms/${roomId}/rematch`, { token }),
+	transfer: (roomId: string, token: string) => call<{ phrase: string; expiresAt: number }>('POST', `/api/rooms/${roomId}/transfer`, { token }),
+	/** The host's phrase for another wizard's seat; claimed, it re-seats them. */
+	hostPhrase: (roomId: string, token: string, seat: WizardId) => call<{ phrase: string; expiresAt: number }>('POST', `/api/rooms/${roomId}/phrase`, { token, seat }),
+	standIn: (roomId: string, token: string, seat: WizardId) => call<RoomView>('POST', `/api/rooms/${roomId}/standin`, { token, seat }),
+	claim: (phrase: string) => call<{ roomId: string; seat: WizardId; token: string }>('POST', '/api/transfer', { phrase }),
 	report: (roomId: string, token: string, happened: string, expected: string) =>
 		call<{ id: string }>('POST', `/api/rooms/${roomId}/report`, { token, happened, expected }),
 	reportImage: async (id: string, file: File) => {
 		const res = await fetch(`/api/reports/${id}/image`, { method: 'POST', headers: { 'content-type': file.type || 'application/octet-stream' }, body: file });
 		if (!res.ok) throw new ServerError(((await res.json().catch(() => ({}))) as { error?: string }).error ?? `The server answered ${res.status}.`, res.status);
 	},
+	tally: () => call<Tally>('GET', '/api/tally'),
 	myReports: (seats: { roomId: string; token: string }[]) => call<{ reports: Report[] }>('POST', '/api/reports/mine', { seats }),
 	answerReport: (id: string, roomId: string, token: string, text: string) => call<{ ok: true }>('POST', `/api/reports/${id}/answer`, { roomId, token, text })
 };
 
-/** A socket that only ever says "fetch the view again"; reconnects on its own. An empty token sits in the gallery. */
+/** A socket that only ever signals "fetch the view again"; reconnects on its own. An empty token spectates. */
 export function watchRoom(roomId: string, token: string, onUpdate: () => void, onStatus: (open: boolean) => void): () => void {
 	let socket: WebSocket | null = null;
 	let closed = false;

src/lib/game/duel.svelte.ts

@@ -4,7 +4,7 @@
 
 import { tick } from 'svelte';
 import { chooseBotTurn } from './bot';
-import { api, rememberSeat, watchRoom, type HeldSeat } from './client';
+import { api, rememberSeat, ServerError, watchRoom, type HeldSeat } from './client';
 import { markTalkSeen } from './talk';
 import {
 	cellsOverlap,
@@ -219,11 +219,22 @@ export interface Remote extends HeldSeat {
 	started: boolean;
 	connected: boolean;
 	error: string;
+	/** Set when the server stopped accepting this seat's token while the page was open, with the reason; the page then spectates. */
+	lost: string;
 	chat: ChatLine[];
 	/** How many watch from the Peanut Gallery. */
 	audience: number;
-	/** Watching from the gallery: no seat, no hands, no voice. */
+	/** Watching from the gallery: no seat, no hands, no voice unless the host allows it. */
 	spectating: boolean;
+	galleryTalk: boolean;
+	challenge: RoomView['challenge'];
+	expected: string[];
+	rematch: RoomView['rematch'];
+	rematchOf: string | null;
+	/** Turns played so far, as the server last said. */
+	resolved: number;
+	keeper: string;
+	keeperZone: string;
 }
 
 export class Duel {
@@ -329,7 +340,7 @@ export class Duel {
 
 	/** Watching from the gallery, with no seat at the table. */
 	spectating = $derived(this.remote?.spectating ?? false);
-	/** The gallery has no wizard of its own; it borrows the first seat for the fields that need one, and shows none of them. */
+	/** A spectator has no wizard of their own; borrow the first seat for the fields that need one (none of them are shown). */
 	you = $derived(this.state.wizards[this.me] ?? this.state.wizards[this.state.seats[0]]);
 	/** The opponent spells go at by default: the first still standing. */
 	foeId = $derived(enemyOf(this.state, this.me));
@@ -687,6 +698,35 @@ export class Duel {
 		return list;
 	}
 
+	/** The hands a typed gesture fills, in the order they are filled: left then right, and the second pair after the first when hastened. */
+	private typingSlots(): { set: SetName; hand: Hand }[] {
+		return this.activeSets.flatMap((set) =>
+			HANDS.filter((h) => !this.forcedFor(set, h) && this.charmedHand !== h).map((hand) => ({ set, hand }))
+		);
+	}
+
+	/** A gesture typed on the keyboard goes to the first open hand. Returns false when no hand can take it. */
+	typeGesture(gesture: Gesture): boolean {
+		const slot = this.typingSlots().find((s) => this.sets[s.set][s.hand].gesture === null);
+		if (!slot || !this.allowed[slot.hand].includes(gesture)) return false;
+		this.sets[slot.set][slot.hand].gesture = gesture;
+		this.syncAll();
+		return true;
+	}
+
+	/** Backspace clears the last hand filled. */
+	untype(): void {
+		const slot = [...this.typingSlots()].reverse().find((s) => this.sets[s.set][s.hand].gesture !== null);
+		if (!slot) return;
+		this.sets[slot.set][slot.hand].gesture = null;
+		this.syncAll();
+	}
+
+	/** A clap with only one hand does nothing; said before the turn is sealed, not after. */
+	loneClap = $derived(
+		this.activeSets.some((set) => (this.gestureFor(set, 'left') === 'C') !== (this.gestureFor(set, 'right') === 'C'))
+	);
+
 	choose(set: SetName, hand: Hand, gesture: Gesture): void {
 		const draft = this.sets[set][hand];
 		draft.gesture = draft.gesture === gesture ? null : gesture;
@@ -773,7 +813,7 @@ export class Duel {
 		this.sending = true;
 		r.error = '';
 		try {
-			this.apply(await api.turn(r.roomId, r.token, yours));
+			this.apply(await api.turn(r.roomId, r.token, yours, r.resolved));
 		} catch (e) {
 			r.error = e instanceof Error ? e.message : 'The move did not reach the server.';
 		} finally {
@@ -786,6 +826,69 @@ export class Duel {
 		return this.remote?.seats.find((s) => s.id === id)?.name ?? this.state.wizards[id]?.name ?? id;
 	}
 
+	private async remoteAct(fn: (r: Remote) => Promise<RoomView>, failure: string): Promise<boolean> {
+		const r = this.remote;
+		if (!r) return false;
+		r.error = '';
+		try {
+			this.apply(await fn(r));
+			return true;
+		} catch (e) {
+			r.error = e instanceof Error ? e.message : failure;
+			return false;
+		}
+	}
+
+	/** A word from the gallery, signed; only when the host has let the gallery talk. */
+	sayFromGallery(name: string, text: string): Promise<boolean> {
+		if (!this.remote?.spectating) return Promise.resolve(false);
+		return this.remoteAct((r) => api.sayFromGallery(r.roomId, name, text), 'The table did not hear you.');
+	}
+
+	/** Host only: let the Peanut Gallery talk at this table, or hush it. */
+	setGalleryTalk(on: boolean): Promise<boolean> {
+		return this.remoteAct((r) => api.setGalleryTalk(r.roomId, r.token, on), 'The gallery could not be told.');
+	}
+
+	/** Invite the site maintainer to the seat held for them; the server notifies them. */
+	callKeeper(): Promise<boolean> {
+		return this.remoteAct((r) => api.challenge(r.roomId, r.token), 'The keeper could not be called.');
+	}
+
+	/** Open a rematch room for the same players; the caller becomes its host. */
+	async rematch(): Promise<string> {
+		const r = this.remote!;
+		const next = await api.rematch(r.roomId, r.token);
+		if (next.created && next.seat && next.token) rememberSeat(next.roomId, { seat: next.seat, token: next.token });
+		return next.roomId;
+	}
+
+	/** A phrase that brings this seat to another device, good for ten minutes. */
+	transfer(): Promise<{ phrase: string; expiresAt: number }> {
+		const r = this.remote!;
+		return api.transfer(r.roomId, r.token);
+	}
+
+	/** Host only: a phrase for another wizard's seat, which gives it a new token when claimed. */
+	hostPhrase(seat: WizardId): Promise<{ phrase: string; expiresAt: number }> {
+		const r = this.remote!;
+		return api.hostPhrase(r.roomId, r.token, seat);
+	}
+
+	/** Host only: a bot duels in this wizard's seat for the rest of the duel, until a phrase gives it back. */
+	async standIn(seat: WizardId): Promise<boolean> {
+		const r = this.remote;
+		if (!r) return false;
+		r.error = '';
+		try {
+			this.apply(await api.standIn(r.roomId, r.token, seat));
+			return true;
+		} catch (e) {
+			r.error = e instanceof Error ? e.message : 'The seat could not be given to a bot.';
+			return false;
+		}
+	}
+
 	/** Say something to the whole table. Resolves false when the words did not arrive. */
 	async say(text: string): Promise<boolean> {
 		const r = this.remote;
@@ -809,6 +912,12 @@ export class Duel {
 		r.waitingOn = view.waitingOn;
 		r.chat = view.chat;
 		r.audience = view.audience;
+		r.galleryTalk = view.galleryTalk;
+		r.challenge = view.challenge;
+		r.expected = view.expected;
+		r.rematch = view.rematch;
+		r.rematchOf = view.rematchOf;
+		r.resolved = view.resolved;
 		markTalkSeen(r.roomId, view.chat.length);
 		const wasStarted = r.started;
 		r.started = view.state !== null;
@@ -826,12 +935,15 @@ export class Duel {
 		const refresh = () => {
 			fetchView()
 				.then((v) => this.apply(v))
-				.catch((e: Error) => (r.error = e.message));
+				.catch((e: Error) => {
+					if (e instanceof ServerError && e.status === 403 && !r.spectating) r.lost = e.message;
+					else r.error = e.message;
+				});
 		};
 		return watchRoom(r.roomId, r.token, refresh, (open) => (r.connected = open));
 	}
 
-	/** You opened this table, so the duel begins when you say. */
+	/** The viewer holds the host seat, so may begin the game. */
 	isHost = $derived(!!this.remote && this.remote.host === this.remote.seat);
 
 	/** Begin the duel with whoever is seated. */
@@ -914,7 +1026,7 @@ export class Duel {
 		this.resetDrafts();
 	}
 
-	/** Open a table on the server, seated as its host; it takes up to a dozen and begins when the host says. */
+	/** Create a room on the server with the caller as host; it takes up to `size` seats and starts when the host says. */
 	static async createRoom(name: string, size = 12): Promise<Remote> {
 		const seated = await api.create(name, size);
 		rememberSeat(seated.view.roomId, { seat: seated.seat, token: seated.token });
@@ -940,7 +1052,7 @@ export class Duel {
 		return remoteFrom(await api.view(roomId, held.token), held.token);
 	}
 
-	/** Take a place in the Peanut Gallery: watch a table with no seat and no voice. */
+	/** Open a room as a spectator: no seat and no token. */
 	static async watchRoom(roomId: string): Promise<Remote> {
 		return remoteFrom(await api.watch(roomId), '');
 	}
@@ -958,9 +1070,18 @@ function remoteFrom(view: RoomView, token: string): Remote {
 		started: view.state !== null,
 		connected: false,
 		error: '',
+		lost: '',
 		chat: view.chat,
 		audience: view.audience,
-		spectating: view.me === SPECTATOR
+		spectating: view.me === SPECTATOR,
+		galleryTalk: view.galleryTalk,
+		challenge: view.challenge,
+		expected: view.expected,
+		rematch: view.rematch,
+		rematchOf: view.rematchOf,
+		resolved: view.resolved,
+		keeper: view.keeper,
+		keeperZone: view.keeperZone
 	};
 }
 

src/lib/game/duel.test.ts

@@ -49,3 +49,28 @@ describe('threats at a crowded table', () => {
 		expect(duel.targetLabel('C')).toBe('Cass · 8 HP · invisible');
 	});
 });
+
+describe('typing a move', () => {
+	it('fills the left hand, then the right, and backspace takes the last one back', () => {
+		const duel = new Duel(createGame({ A: 'You', B: 'Foe' }, 1));
+		expect(duel.typeGesture('S')).toBe(true);
+		expect(duel.typeGesture('P')).toBe(true);
+		expect(duel.sets.main.left.gesture).toBe('S');
+		expect(duel.sets.main.right.gesture).toBe('P');
+		expect(duel.typeGesture('W')).toBe(false);
+		duel.untype();
+		expect(duel.sets.main.right.gesture).toBeNull();
+		expect(duel.sets.main.left.gesture).toBe('S');
+	});
+
+	it('warns of a clap made with one hand before the turn is sealed', () => {
+		const duel = new Duel(createGame({ A: 'You', B: 'Foe' }, 1));
+		duel.typeGesture('C');
+		duel.typeGesture('W');
+		expect(duel.loneClap).toBe(true);
+		expect(duel.ready).toBe(true);
+		duel.untype();
+		duel.typeGesture('C');
+		expect(duel.loneClap).toBe(false);
+	});
+});

src/lib/game/engine.test.ts

@@ -484,3 +484,20 @@ describe('at a table of several wizards', () => {
 		expect(s.wizards.B.history.at(-1)?.left).toBe('D');
 	});
 });
+
+describe('the course of a disease', () => {
+	it('names the turn it kills on, gives a symptom each turn, and kills at the end of the fifth turn after the cast', () => {
+		let s = createGame({ A: 'Ann', B: 'Bo' }, 1);
+		s = runSequence(s, 'A', 'DSFFFC', '-----C', { casts: [{ hand: 'left', spellId: 'disease', target: 'B' }] });
+		expect(s.log.some((l) => l.text.includes('will die at the end of turn 11'))).toBe(true);
+		for (let turn = 7; turn <= 10; turn++) {
+			s = play(s, {});
+			expect(s.wizards.B.alive).toBe(true);
+		}
+		expect(s.log.some((l) => l.text.includes('last turn to find a cure'))).toBe(true);
+		s = play(s, {});
+		expect(s.turn).toBe(11);
+		expect(s.wizards.B.alive).toBe(false);
+		expect(s.over?.winner).toBe('A');
+	});
+});

src/lib/game/resolve.ts

@@ -140,6 +140,42 @@ function tick(n: number): number {
 	return n === Infinity ? n : Math.max(0, n - 1);
 }
 
+/** What a creature does when it strikes, before the name of the one struck. */
+const ATTACKS: Record<MonsterKind, string> = {
+	goblin: 'darts in and slashes',
+	ogre: 'swings a heavy fist into',
+	troll: 'rakes its claws across',
+	giant: 'brings a vast club down on',
+	fire_elemental: 'washes searing heat over',
+	ice_elemental: 'breathes killing cold over'
+};
+
+/** How a summoned creature arrives. */
+const SUMMONED: Record<MonsterKind, string> = {
+	goblin: 'The ground cracks and something small and quick climbs out.',
+	ogre: 'The earth shudders under heavy feet.',
+	troll: 'A smell of wet stone and old meat fills the air.',
+	giant: 'A shadow falls across the field, and keeps falling.',
+	fire_elemental: 'A column of flame spins up out of nothing.',
+	ice_elemental: 'Frost races across the ground and rises into a shape.'
+};
+
+/** The disease's course, by turns left after this one: a symptom each turn, and the last warning. */
+const FEVER: Record<number, (name: string) => string> = {
+	4: (n) => `${n}'s brow is hot and damp with fever.`,
+	3: (n) => `${n}'s cheeks burn red; the fever is climbing.`,
+	2: (n) => `${n} sways, slick with sweat, every joint aching.`,
+	1: (n) => `${n} shakes with chills beneath the fever. This is the last turn to find a cure.`
+};
+
+/** The poison's course, by turns left after this one. */
+const VENOM: Record<number, (name: string) => string> = {
+	4: (n) => `${n}'s fingertips have gone cold and dull.`,
+	3: (n) => `${n} is ashen, and a numbness is creeping up the arms.`,
+	2: (n) => `${n}'s gestures turn clumsy; the legs are going.`,
+	1: (n) => `${n} can barely stand, eyes clouding over. This is the last turn to find a cure.`
+};
+
 export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnInput>): GameState {
 	const state = structuredClone(previous);
 	if (state.over) return state;
@@ -191,7 +227,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 	const note = (id: TargetId, label: string, delta: number) => {
 		if (isWizard(id)) summary.wizards[id].effects.push({ label, delta });
 	};
-	if (actor) log(`Time stands still. ${W[actor].name} alone can move.`, 'spell');
+	if (actor) log(`The world holds its breath. Dust hangs in the air, and only ${W[actor].name} can move.`, 'spell');
 	/** Facts gathered along the way, turned into explanations at the end. */
 	const facts = {
 		shieldBlocked: new Set<TargetId>(),
@@ -210,7 +246,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 	// ---- 1. Gestures, after last turn's enchantments have their say ----
 	const shape = (w: WizardState, c: Constraints, left: Gesture, right: Gesture, prev: HistoryEntry | undefined): [Gesture, Gesture] => {
 		if (c.amnesia && prev) {
-			log(`${w.name}, struck by amnesia, repeats the last gestures.`);
+			log(`${w.name}'s thoughts slide away like water; the hands, remembering nothing new, repeat the last gestures.`);
 			return [prev.left, prev.right];
 		}
 		if (c.charmed) {
@@ -219,25 +255,25 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 			if (w.permanent.charmed && !w.permanent.charmedGesture) w.permanent.charmedGesture = g;
 			if (c.charmed.hand === 'left') left = g;
 			else right = g;
-			log(`${W[c.charmed.by].name} charms ${w.name}'s ${c.charmed.hand} hand into a ${GESTURE_NAMES[g]}.`);
+			log(`${w.name}'s ${c.charmed.hand} hand moves to ${W[c.charmed.by].name}'s will, into a ${GESTURE_NAMES[g]}.`);
 		}
 		if (c.paralysedHand && prev) {
 			const g = paralysedForm(w.history[w.history.length - 1][c.paralysedHand]);
 			if (c.paralysedHand === 'left') left = g;
 			else right = g;
-			log(`${w.name}'s ${c.paralysedHand} hand is paralysed into a ${GESTURE_NAMES[g]}.`);
+			log(`${w.name}'s ${c.paralysedHand} hand is locked stiff, frozen in a ${GESTURE_NAMES[g]}.`);
 		}
 		if (c.fear) {
 			if (FEAR_BANNED.includes(left)) left = '-';
 			if (FEAR_BANNED.includes(right)) right = '-';
-			log(`${w.name} is too afraid to snap, point, clap or wriggle.`);
+			log(`Dread grips ${w.name}; the hands will not snap, point, clap or wriggle.`);
 		}
 		if (c.confusion) {
 			const slip = c.confusionFixed ?? { hand: rng() < 0.5 ? 'left' : 'right', gesture: pick(MAGIC_GESTURES) };
 			if (w.permanent.confusion && !w.permanent.confusionFixed) w.permanent.confusionFixed = slip;
 			if (slip.hand === 'left') left = slip.gesture;
 			else right = slip.gesture;
-			log(`Confused, ${w.name}'s ${slip.hand} hand makes a ${GESTURE_NAMES[slip.gesture]} instead.`);
+			log(`${w.name}'s head swims, and the ${slip.hand} hand makes a ${GESTURE_NAMES[slip.gesture]} instead.`);
 		}
 		if (left === '>' && right === '>') right = '-';
 		return [left, right];
@@ -276,7 +312,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 			record(w, l2, r2, 'haste');
 			entries[id].push(w.history.length - 1);
 		}
-		if (w.surrendered) log(`${w.name} offers both palms in surrender.`, 'death');
+		if (w.surrendered) log(`${w.name} lowers both hands and shows empty palms in surrender.`, 'death');
 	}
 
 	// ---- 2. Which completed spells are actually loosed ----
@@ -300,7 +336,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 					options.find((c) => choice.seqIndex === undefined || c.seqIndex === choice.seqIndex) ?? options[0];
 				if (!completion) continue;
 				if (completion.spell.id === 'lightning_bolt_quick' && w.usedQuickLightning) {
-					log(`${w.name}'s quick lightning bolt sputters: it has already been used this duel.`, 'fizzle');
+					log(`${w.name}'s quick lightning bolt sputters and dies, spent earlier in this duel.`, 'fizzle');
 					continue;
 				}
 				const cells = usedCells(completion, choice.hand, index + 1);
@@ -341,7 +377,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 			w.casts.push({ turn, index: -1, hand: 'left', spellId: spell.id, target });
 			w.banked = null;
 			const at = BLANKET_SPELLS.includes(spell.id) || target === id ? '' : ` at ${beingName(state, target)}`;
-			log(`${w.name} releases the banked ${spell.name}${at}.`, 'spell');
+			log(`The ${spell.name} ${w.name} had held in reserve uncoils and flies${at}.`, 'spell');
 		}
 		casts.push(...accepted);
 	}
@@ -349,10 +385,10 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 	for (const c of casts) {
 		if (!BLANKET_SPELLS.includes(c.spell.id) && c.target === NOWHERE) {
 			c.nullified = 'released harmlessly';
-			log(`${W[c.caster].name} lets the ${c.spell.name} dissipate harmlessly.`, 'fizzle');
+			log(`${W[c.caster].name} lets the ${c.spell.name} unravel into the air, harmless.`, 'fizzle');
 		} else if (!BLANKET_SPELLS.includes(c.spell.id) && !isBeing(c.target)) {
 			c.nullified = 'target gone';
-			log(`${W[c.caster].name}'s ${c.spell.name} finds no target.`, 'fizzle');
+			log(`${W[c.caster].name}'s ${c.spell.name} casts about for a target, finds none, and fades.`, 'fizzle');
 		}
 	}
 	const live = () => casts.filter((c) => !c.nullified);
@@ -368,7 +404,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 	const countered = new Set<TargetId>();
 	const dispels = live().filter((c) => c.spell.id === 'dispel_magic');
 	if (dispels.length > 0) {
-		log('Dispel magic sweeps the field: every other spell fails, all enchantments end, and every monster will fall after this turn.', 'spell');
+		log('A wave of stillness rolls across the field as the magic is dispelled. Every other spell fails, every enchantment ends, and every creature will fade after this turn.', 'spell');
 		for (const c of casts) if (!c.nullified && c.spell.id !== 'dispel_magic') c.nullified = 'dispelled';
 		for (const d of dispels) shielded.set(d.target, 'dispel magic');
 		for (const id of seats) clearEnchantments(W[id]);
@@ -382,7 +418,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 		for (const c of live()) {
 			if (c.spell.id === 'magic_mirror' && countered.has(c.target)) {
 				c.nullified = 'countered';
-				log(`The magic mirror on ${beingName(state, c.target)} is shattered by a counter-spell.`, 'fizzle');
+				log(`The magic mirror around ${beingName(state, c.target)} cracks and falls away in shards, broken by a counter-spell.`, 'fizzle');
 			}
 		}
 		const mirrored = new Set(live().filter((c) => c.spell.id === 'magic_mirror').map((c) => c.target));
@@ -395,7 +431,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 			const original = c.caster;
 			c.target = original;
 			c.caster = owner;
-			log(`${W[owner].name}'s magic mirror turns the ${c.spell.name} back on ${W[original].name}.`, 'spell');
+			log(`The ${c.spell.name} strikes ${W[owner].name}'s magic mirror and flashes straight back at ${W[original].name}.`, 'spell');
 		}
 		for (const c of live()) {
 			if (UNCOUNTERABLE.includes(c.spell.id)) continue;
@@ -430,7 +466,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 				chosen.nullified = 'banked';
 				w.banked = { spellId: chosen.spell.id, elemental: chosen.choice.elemental, chosenHand: chosen.choice.chosenHand };
 				bankedNow.add(id);
-				log(`${w.name} banks the ${chosen.spell.name} to release later.`, 'spell');
+				log(`${w.name} catches the ${chosen.spell.name} before it leaves the hand and holds it in reserve, to loose later.`, 'spell');
 			}
 		}
 		const extending = w.permanencyTurns > 0 || live().some((c) => c.spell.id === 'permanency' && c.target === id);
@@ -440,7 +476,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 			if (chosen) {
 				chosen.permanent = true;
 				extendedNow.add(id);
-				log(`${w.name}'s ${chosen.spell.name} is made permanent.`, 'spell');
+				log(`${w.name}'s ${chosen.spell.name} sets hard, like wax cooling, and will not fade.`, 'spell');
 			}
 		}
 	}
@@ -471,7 +507,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 		const targetMonster = monsterOf(c.target);
 		if (targetMonster && isElemental(targetMonster.kind)) {
 			c.nullified = 'cast at an elemental';
-			log(`Nothing can be summoned for an elemental; ${W[c.caster].name}'s ${c.spell.name} fails.`, 'fizzle');
+			log(`An elemental answers to no master; ${W[c.caster].name}'s ${c.spell.name} calls into emptiness and fails.`, 'fizzle');
 			continue;
 		}
 		const controller = controllerOf(state, c.target);
@@ -497,7 +533,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 		state.monsters.push(m);
 		orders.set(m.id, c.choice.monsterTarget ?? enemyOf(state, controller));
 		const creature = stats.name.toLowerCase();
-		log(`${/^[aeiou]/.test(creature) ? 'An' : 'A'} ${creature} answers ${W[controller].name}'s summons.`, 'spell');
+		log(`${SUMMONED[kind]} ${/^[aeiou]/.test(creature) ? 'An' : 'A'} ${creature} answers ${W[controller].name}'s summons.`, 'spell');
 	}
 
 	let fireStorm = live().some((c) => c.spell.id === 'fire_storm');
@@ -509,7 +545,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 	};
 	if (fireStorm && iceStorm) {
 		fireStorm = iceStorm = false;
-		log('The fire storm and the ice storm cancel each other; nothing is harmed.', 'fizzle');
+		log('Fire storm meets ice storm in a great hiss of steam, and the two cancel. Nothing is harmed.', 'fizzle');
 	}
 	if (fireStorm && elementals('ice_elemental').length > 0) {
 		fireStorm = false;
@@ -557,7 +593,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 			for (const extra of same.slice(1)) {
 				destroyedBeforeAttack.add(extra.id);
 				same[0].hp = same[0].maxHp;
-				log(`Two ${MONSTER_STATS[kind].name.toLowerCase()}s merge into one.`, 'info');
+				log(`Two ${MONSTER_STATS[kind].name.toLowerCase()}s flow together and become one.`, 'info');
 			}
 		}
 	}
@@ -572,7 +608,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 	for (const [target, ids] of controlByTarget) {
 		if (ids.size < 2) continue;
 		for (const c of live()) if (c.target === target && ids.has(c.spell.id)) c.nullified = 'contradictory enchantments';
-		log(`Contradictory enchantments on ${beingName(state, target)} cancel each other out.`, 'fizzle');
+		log(`The enchantments on ${beingName(state, target)} pull against each other and tear apart; none takes hold.`, 'fizzle');
 	}
 	for (const c of live()) {
 		const wiz = isWizard(c.target) ? W[c.target] : undefined;
@@ -585,17 +621,19 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 				if (wiz) {
 					wiz.pending.amnesia = true;
 					if (c.permanent) wiz.permanent.amnesia = true;
+					log(`A grey haze drifts behind ${wiz.name}'s eyes. Next turn the hands will repeat what they just did${c.permanent ? ', and every turn after' : ''}.`);
 				} else if (mon) mon.pending.forcedTarget = orders.get(mon.id);
 				break;
 			case 'confusion':
 				if (wiz) {
 					wiz.pending.confusion = true;
 					if (c.permanent) wiz.permanent.confusion = true;
+					log(`The field tilts and swims around ${wiz.name}. One hand will go astray next turn${c.permanent ? ', and every turn after' : ''}.`);
 				} else if (mon) {
 					const candidates = [...seats.filter((id) => W[id].alive), ...state.monsters.filter((o) => o.id !== mon.id).map((o) => o.id)];
 					const t = pick(candidates as TargetId[]);
 					orders.set(mon.id, t);
-					log(`${mon.name} is confused and lunges at ${beingName(state, t)}.`);
+					log(`${mon.name} shakes its head, bewildered, and lunges at ${beingName(state, t)}.`);
 				}
 				break;
 			case 'charm_person':
@@ -603,20 +641,20 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 					const hand = c.choice.chosenHand ?? pick(HANDS);
 					wiz.pending.charmed = { hand, by: c.caster };
 					if (c.permanent) wiz.permanent.charmed = { hand, by: c.caster };
-					log(`${wiz.name}'s ${hand} hand will obey ${W[c.caster].name}${c.permanent ? ' from now on' : ' next turn'}.`);
+					log(`A warm, easy trust comes over ${wiz.name}, whose ${hand} hand will obey ${W[c.caster].name}${c.permanent ? ' from now on' : ' next turn'}.`);
 				} else {
 					c.nullified = 'monsters cannot be charmed as people';
-					log(`Charm person has no hold on ${target}.`, 'fizzle');
+					log(`The charm slides off ${target}, finding no mind to hold.`, 'fizzle');
 				}
 				break;
 			case 'charm_monster':
 				if (mon && !isElemental(mon.kind)) {
 					mon.owner = c.caster;
 					orders.set(mon.id, input(c.caster).monsterOrders?.[mon.id] ?? enemyOf(state, c.caster));
-					log(`${mon.name} now serves ${W[c.caster].name}.`);
+					log(`${mon.name} turns, blinks, and pads over to ${W[c.caster].name}'s side to serve a new master.`);
 				} else {
 					c.nullified = 'not a charmable monster';
-					log(`Charm monster has no hold on ${target}.`, 'fizzle');
+					log(`The charm slides off ${target} and takes no hold.`, 'fizzle');
 				}
 				break;
 			case 'paralysis':
@@ -624,10 +662,10 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 					const hand = wiz.constraints.paralysedHand ?? c.choice.chosenHand ?? 'left';
 					wiz.pending.paralysedHand = hand;
 					if (c.permanent) wiz.permanent.paralysedHand = hand;
-					log(`${wiz.name}'s ${hand} hand will be paralysed${c.permanent ? ' from now on' : ' next turn'}.`);
+					log(`A cold stiffness creeps into ${wiz.name}'s ${hand} hand, which will be paralysed${c.permanent ? ' from now on' : ' next turn'}.`);
 				} else if (mon && !isElemental(mon.kind)) {
 					mon.pending.skipAttack = true;
-					log(`${mon.name} will stand paralysed next turn.`);
+					log(`${mon.name}'s limbs stiffen, and it will stand paralysed next turn.`);
 				} else {
 					c.nullified = 'elementals cannot be paralysed';
 				}
@@ -636,76 +674,76 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 				if (wiz) {
 					wiz.pending.fear = true;
 					if (c.permanent) wiz.permanent.fear = true;
-					log(`${wiz.name} will be too afraid to snap, point, clap or wriggle${c.permanent ? ' from now on' : ' next turn'}.`);
+					log(`A chill of terror runs through ${wiz.name}, who will be too afraid to snap, point, clap or wriggle${c.permanent ? ' from now on' : ' next turn'}.`);
 				} else c.nullified = 'monsters know no fear';
 				break;
 			case 'anti_spell':
 				if (wiz) {
 					wiz.sequenceStart = wiz.history.length;
-					log(`${wiz.name}'s gestures so far are wiped from the weave; every spell must start afresh.`);
+					log(`The half-woven magic around ${wiz.name}'s hands flickers and goes out; every spell must start afresh.`);
 				}
 				break;
 			case 'protection_from_evil':
 				if (wiz) wiz.protectionTurns = duration(4);
 				else if (mon) mon.protectionTurns = duration(4);
-				log(`${target} is protected from evil${c.permanent ? forever : ' for this turn and the next three'}.`);
+				log(`A pale circle of light rises around ${target}, protected from evil${c.permanent ? forever : ' for this turn and the next three'}.`);
 				break;
 			case 'resist_heat':
 				if (wiz) wiz.resistHeat = true;
 				else if (mon) mon.resistHeat = true;
-				log(`${target} now resists heat.`);
+				log(`A cool blue aura settles over ${target}, who now resists heat.`);
 				break;
 			case 'resist_cold':
 				if (wiz) wiz.resistCold = true;
 				else if (mon) mon.resistCold = true;
-				log(`${target} now resists cold.`);
+				log(`A warm rosy aura wraps ${target}, who now resists cold.`);
 				break;
 			case 'disease':
 				if (wiz) {
 					wiz.diseaseTurns = 6;
-					log(`${wiz.name} sickens with a deadly disease: six turns to find a cure.`);
+					log(`${wiz.name} coughs, and a fever takes hold. Unless cured, ${wiz.name} will die at the end of turn ${state.turn + 6}.`);
 				} else c.nullified = 'monsters do not sicken';
 				break;
 			case 'poison':
 				if (wiz) {
 					wiz.poisonTurns = 6;
-					log(`${wiz.name} is poisoned: six turns to find a cure.`);
+					log(`${wiz.name} goes grey about the lips as poison takes the blood. Unless cured, ${wiz.name} will die at the end of turn ${state.turn + 6}.`);
 				} else c.nullified = 'monsters do not sicken';
 				break;
 			case 'blindness':
 				if (wiz) {
 					wiz.blindTurns = duration(4);
-					log(`${wiz.name} is struck blind${c.permanent ? forever : ' for three turns'}.`);
+					log(`A milky film clouds ${wiz.name}'s eyes and leaves them blind${c.permanent ? forever : ' for three turns'}.`);
 				} else if (mon) destroyBefore(mon, 'blinded and unmade');
 				break;
 			case 'invisibility':
 				if (wiz) {
 					wiz.invisibleTurns = duration(4);
-					log(`${wiz.name} fades from sight${c.permanent ? forever : ' for three turns'}.`);
+					log(`${wiz.name} thins like mist and fades from sight${c.permanent ? forever : ' for three turns'}.`);
 				} else if (mon) destroyBefore(mon, 'made invisible and unmade');
 				break;
 			case 'haste':
 				if (wiz) {
 					wiz.hasteTurns = duration(4);
-					log(`${wiz.name} is hastened${c.permanent ? forever : ' for the next three turns'}: two pairs of gestures a turn.`);
+					log(`The air about ${wiz.name} quickens; everyone else seems to move through honey. Hastened${c.permanent ? forever : ' for the next three turns'}, ${wiz.name} makes two pairs of gestures a turn.`);
 				} else c.nullified = 'monsters cannot be hastened';
 				break;
 			case 'time_stop':
 				if (wiz) {
 					state.timeStops.push(wiz.id);
-					log(`${wiz.name} will act alone in a stopped moment.`);
+					log(`The moment catches on ${wiz.name} like a snagged thread. When this turn ends, time will stop, and ${wiz.name} alone will move.`);
 				} else c.nullified = 'only wizards can stop time';
 				break;
 			case 'delayed_effect':
 				if (wiz) {
 					wiz.delayedTurns = bankedNow.has(wiz.id) ? 0 : duration(4);
-					if (!bankedNow.has(wiz.id)) log(`${wiz.name}'s next spell will be banked.`);
+					if (!bankedNow.has(wiz.id)) log(`A hollow of waiting opens around ${wiz.name}'s hands, ready to catch and hold the next spell.`);
 				} else c.nullified = 'only wizards can delay a spell';
 				break;
 			case 'permanency':
 				if (wiz) {
 					wiz.permanencyTurns = extendedNow.has(wiz.id) ? 0 : 4;
-					if (!extendedNow.has(wiz.id)) log(`${wiz.name}'s next enchantment will be permanent.`);
+					if (!extendedNow.has(wiz.id)) log(`Something steady and unhurried takes hold of ${wiz.name}, and the next enchantment will be permanent.`);
 				} else c.nullified = 'only a wizard can hold a permanency';
 				break;
 		}
@@ -718,10 +756,10 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 		const mon = monsterOf(c.target);
 		if (wiz) {
 			clearEnchantments(wiz);
-			log(`Every enchantment on ${wiz.name} is lifted.`);
+			log(`Threads of old magic lift from ${wiz.name} and drift away. Every enchantment is gone.`);
 		} else if (mon && c.spell.id === 'remove_enchantment') {
 			destroyedAfterAttack.add(mon.id);
-			log(`${mon.name} will be unmade once it has attacked.`);
+			log(`${mon.name} begins to fray at the edges, and will be unmade once it has attacked.`);
 		}
 	}
 
@@ -729,11 +767,12 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 	const damage = new Map<TargetId, number>();
 	const healing = new Map<TargetId, number>();
 	const slain = new Set<TargetId>();
-	const hurt = (id: TargetId, n: number, why: string, by?: WizardId) => {
+	/** `line` pictures the blow, with % for the one struck; the damage is added after it. */
+	const hurt = (id: TargetId, n: number, why: string, by?: WizardId, line?: string) => {
 		damage.set(id, (damage.get(id) ?? 0) + n);
 		if (isWizard(id) && by && by !== id) W[id].lastHurtBy = by;
 		note(id, tidy(why), -n);
-		log(`${beingName(state, id)} takes ${n} from ${why}.`, 'damage');
+		log(`${(line ?? `${tidy(why)} strikes ${beingName(state, id)}`).replace('%', beingName(state, id))}, for ${n}.`, 'damage');
 	};
 	const heal = (id: TargetId, n: number, label: string) => {
 		healing.set(id, (healing.get(id) ?? 0) + n);
@@ -746,32 +785,32 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 				if (isShielded(t)) {
 					facts.shieldBlocked.add(t);
 					log(`${guard(t)} turns the missile aside.`, 'fizzle');
-				} else hurt(t, 1, 'a missile', c.caster);
+				} else hurt(t, 1, 'a missile', c.caster, 'A dart of blue force streaks across and strikes %');
 				break;
 			case 'finger_of_death':
 				slain.add(t);
 				if (isWizard(t)) W[t].lastHurtBy = c.caster;
 				note(t, 'Finger of death', -(isWizard(t) ? W[t].hp : 0));
-				log(`The finger of death touches ${beingName(state, t)}.`, 'death');
+				log(`${W[c.caster].name}'s pointing finger goes black to the knuckle, and death reaches out and touches ${beingName(state, t)}.`, 'death');
 				break;
 			case 'lightning_bolt':
 			case 'lightning_bolt_quick':
 				if (isShielded(t)) facts.throughShield.push({ target: t, spell: 'a lightning bolt' });
-				hurt(t, 5, 'a lightning bolt', c.caster);
+				hurt(t, 5, 'a lightning bolt', c.caster, 'Lightning cracks down on %');
 				break;
 			case 'cause_light_wounds':
 				if (isShielded(t)) facts.throughShield.push({ target: t, spell: 'cause light wounds' });
-				hurt(t, 2, 'cause light wounds', c.caster);
+				hurt(t, 2, 'cause light wounds', c.caster, 'Thin cuts open across %');
 				break;
 			case 'cause_heavy_wounds':
 				if (isShielded(t)) facts.throughShield.push({ target: t, spell: 'cause heavy wounds' });
-				hurt(t, 3, 'cause heavy wounds', c.caster);
+				hurt(t, 3, 'cause heavy wounds', c.caster, 'Deep wounds tear open on %');
 				break;
 			case 'fireball':
-				if (resists(t, 'heat')) log(`${beingName(state, t)} shrugs off the fireball.`, 'fizzle');
+				if (resists(t, 'heat')) log(`The fireball bursts over ${beingName(state, t)}, and the flames slide off a cool blue aura.`, 'fizzle');
 				else {
 					if (isShielded(t)) facts.throughShield.push({ target: t, spell: 'a fireball' });
-					hurt(t, 5, 'a fireball', c.caster);
+					hurt(t, 5, 'a fireball', c.caster, 'A fireball bursts over %');
 				}
 				break;
 			case 'cure_light_wounds':
@@ -781,7 +820,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 				heal(t, 2, 'Cure heavy wounds');
 				if (isWizard(t) && W[t].diseaseTurns !== null) {
 					W[t].diseaseTurns = null;
-					log(`${W[t].name}'s disease is cured.`);
+					log(`${W[t].name}'s fever breaks, and the flush fades from the skin. The disease is cured.`);
 				}
 				break;
 			case 'raise_dead':
@@ -794,19 +833,19 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 		...state.monsters.filter((m) => !destroyedBeforeAttack.has(m.id)).map((m) => m.id)
 	];
 	if (fireStorm) {
-		log('A fire storm rages across the field.', 'spell');
+		log('The sky turns orange, and a fire storm roars across the whole field.', 'spell');
 		for (const id of everyone()) {
 			if (resists(id, 'heat')) continue;
 			if (countered.has(id)) continue;
-			hurt(id, 5, 'the fire storm');
+			hurt(id, 5, 'the fire storm', undefined, 'The fire storm engulfs %');
 		}
 	}
 	if (iceStorm) {
-		log('An ice storm howls across the field.', 'spell');
+		log('The air turns bitter, and an ice storm howls across the whole field.', 'spell');
 		for (const id of everyone()) {
 			if (resists(id, 'cold')) continue;
 			if (countered.has(id) || exemptFromIceStorm.has(id)) continue;
-			hurt(id, 5, 'the ice storm');
+			hurt(id, 5, 'the ice storm', undefined, 'Hail and sleet flay %');
 		}
 	}
 
@@ -815,7 +854,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 		if (destroyedBeforeAttack.has(m.id)) continue;
 		if (frozen(m.owner)) continue;
 		if (m.constraints.skipAttack && phase === 'main') {
-			log(`${m.name} stands paralysed.`);
+			log(`${m.name} strains against its stiff limbs and cannot move.`);
 			continue;
 		}
 		if (isElemental(m.kind)) {
@@ -829,24 +868,24 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 					if (isShielded(id)) continue;
 					if (isWizard(id) && W[id].invisibleTurns > 0) continue;
 				}
-				hurt(id, m.attack, `the ${m.name.toLowerCase()}`, m.owner);
+				hurt(id, m.attack, `the ${m.name.toLowerCase()}`, m.owner, `${m.name} ${ATTACKS[m.kind]} %`);
 			}
 			continue;
 		}
 		const target = orders.get(m.id);
 		m.lastTarget = target;
 		if (!isBeing(target)) {
-			log(`${m.name} has nothing to attack.`);
+			log(`${m.name} prowls about, finding nothing to attack.`);
 			continue;
 		}
 		if (isShielded(target)) {
 			facts.shieldBlocked.add(target);
 			log(`${m.name}'s blows glance off ${guard(target)}.`, 'fizzle');
 		} else if (isWizard(target) && W[target].invisibleTurns > 0 && !frozen(target)) {
-			log(`${m.name} flails at the air where ${W[target].name} used to be.`, 'fizzle');
+			log(`${m.name} swings at the empty air where ${W[target].name} last stood.`, 'fizzle');
 		} else {
 			if (m.createdTurn === turn && phase === 'main') facts.newMonsterAttacked = m.name;
-			hurt(target, m.attack, `the ${m.name.toLowerCase()}`, m.owner);
+			hurt(target, m.attack, `the ${m.name.toLowerCase()}`, m.owner, `${m.name} ${ATTACKS[m.kind]} %`);
 		}
 	}
 
@@ -858,12 +897,12 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 			if (g.left !== '>' && g.right !== '>') return;
 			const target = (half === 0 ? input(id).stabTarget : input(id).second?.stabTarget) ?? enemyOf(state, id);
 			if (target === id || !isBeing(target)) {
-				log(`${w.name} stabs at nothing.`, 'fizzle');
+				log(`${w.name} stabs at the air, and the knife finds nothing.`, 'fizzle');
 			} else if (isShielded(target)) {
 				facts.shieldBlocked.add(target);
 				log(`${w.name}'s knife skids off ${guard(target)}.`, 'fizzle');
 			} else {
-				hurt(target, 1, `${w.name}'s knife`, id);
+				hurt(target, 1, `${w.name}'s knife`, id, `${w.name}'s knife bites into %`);
 			}
 		});
 	}
@@ -881,7 +920,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 		if (w.hp <= 0) {
 			w.hp = 0;
 			w.alive = false;
-			log(`${w.name} falls dead.`, 'death');
+			log(`${w.name} crumples and does not rise.`, 'death');
 		}
 	}
 	state.monsters = state.monsters.filter((m) => {
@@ -889,11 +928,11 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 		if (slain.has(m.id)) m.hp = 0;
 		if (destroyedBeforeAttack.has(m.id)) return false;
 		if (destroyedAfterAttack.has(m.id)) {
-			log(`${m.name} is unmade.`, 'death');
+			log(`${m.name} comes apart like smoke and is gone.`, 'death');
 			return false;
 		}
 		if (m.hp <= 0) {
-			log(`${m.name} is destroyed.`, 'death');
+			log(`${m.name} falls and does not get up.`, 'death');
 			return false;
 		}
 		return true;
@@ -917,8 +956,8 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 					note(id, 'Disease', -w.hp);
 					w.alive = false;
 					w.hp = 0;
-					log(`${w.name} succumbs to the disease.`, 'death');
-				}
+					log(`${w.name} sinks to the ground, burning and shaking, and is still. The disease has run its course.`, 'death');
+				} else if (FEVER[w.diseaseTurns]) log(FEVER[w.diseaseTurns](w.name));
 			}
 			if (w.alive && w.poisonTurns !== null) {
 				w.poisonTurns -= 1;
@@ -926,8 +965,8 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 					note(id, 'Poison', -w.hp);
 					w.alive = false;
 					w.hp = 0;
-					log(`${w.name} succumbs to the poison.`, 'death');
-				}
+					log(`${w.name} folds to the ground, cold and numb, and breathes no more. The poison has done its work.`, 'death');
+				} else if (VENOM[w.poisonTurns]) log(VENOM[w.poisonTurns](w.name));
 			}
 		}
 		for (const m of state.monsters) {
@@ -989,7 +1028,7 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 	if (facts.counterAimedAway) {
 		lessons.push({
 			key: 'counter-aim',
-			text: `A counter-spell protects its subject, not its caster: ${facts.counterAimedAway} cancelled spells aimed at them and shielded them from creatures, missiles and stabs. To stop what the other wizard casts at you, cast the counter-spell on yourself.`
+			text: `A counter-spell protects its subject, not its caster. This one guarded ${facts.counterAimedAway}, cancelling spells aimed at them and shielding them from creatures, missiles and stabs. To stop what the other wizard casts at you, cast the counter-spell on yourself.`
 		});
 	}
 	if (facts.fingerThroughCounter) {
@@ -998,11 +1037,11 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 		lessons.push({ key: 'counter-scope', text: 'A counter-spell stops every other spell cast at its subject that turn, even the subject\'s own, and shields them as well. It cannot stop finger of death or dispel magic.' });
 	}
 	if (facts.loneClap.length > 0) {
-		lessons.push({ key: 'lone-clap', text: `A clap needs both hands at once. ${facts.loneClap[0]}'s single-handed clap counts as nothing, and that hand's spells start from scratch.` });
+		lessons.push({ key: 'lone-clap', text: `A clap needs both hands at once, so ${facts.loneClap[0]}'s one-handed clap counted as nothing, and that hand's spells start from scratch.` });
 	}
 	if (facts.overlaps.length > 0) {
 		const o = facts.overlaps[0];
-		lessons.push({ key: 'overlap', text: `A gesture can serve more than one spell as long as each run is unbroken: ${o.name}'s ${o.spell} reused gestures from the earlier ${o.earlier}.` });
+		lessons.push({ key: 'overlap', text: `${o.name}'s ${o.spell} reused gestures from the earlier ${o.earlier}. A gesture can serve more than one spell as long as each run is unbroken.` });
 	}
 	if (facts.broken.length > 0) {
 		const b = facts.broken[0];
@@ -1010,10 +1049,10 @@ export function resolveTurn(previous: GameState, inputs: Record<WizardId, TurnIn
 	}
 	if (facts.curedAndHurt.length > 0) {
 		const c = facts.curedAndHurt[0];
-		lessons.push({ key: 'cure-timing', text: `Cures land in the same turn as the damage: ${c.name} lost ${c.hurt} and regained ${c.healed} at once.` });
+		lessons.push({ key: 'cure-timing', text: `${c.name} lost ${c.hurt} and regained ${c.healed} in the same turn. Cures land together with the damage.` });
 	}
 	if (facts.newMonsterAttacked) {
-		lessons.push({ key: 'monster-same-turn', text: `A creature attacks on the very turn it is summoned: ${facts.newMonsterAttacked} struck at once. A shield that turn is the only defence.` });
+		lessons.push({ key: 'monster-same-turn', text: `${facts.newMonsterAttacked} struck on the very turn it was summoned. Only a shield, a counter-spell or protection from evil cast that same turn would have stopped it.` });
 	}
 	for (const l of lessons) {
 		if (state.lessonsShown.includes(l.key) || summary.lessons.length >= 2) continue;

src/lib/game/spells.ts

@@ -116,7 +116,7 @@ export const SPELLS: Spell[] = [
 	spell('shield', 'Shield', 'protection', ['P'], 'self', 'Blocks monsters, missiles and stabs against the subject this turn.'),
 	spell('remove_enchantment', 'Remove enchantment', 'protection', ['P-D-W-P'], 'enemy', 'Ends every enchantment on the subject. Destroys a monster after it attacks.'),
 	spell('magic_mirror', 'Magic mirror', 'protection', ['C-(w'], 'self', 'Spells cast at the subject this turn rebound on their caster. Undone by a counter-spell.'),
-	spell('counter_spell', 'Counter-spell', 'protection', ['W-P-P', 'W-W-S'], 'self', 'Every other spell cast at the subject this turn fails, and the subject is shielded. Cast it on yourself to stop what the other wizard casts at you. Cannot stop finger of death or dispel magic.'),
+	spell('counter_spell', 'Counter-spell', 'protection', ['W-P-P', 'W-W-S'], 'self', 'Every other spell cast at the subject this turn fails, and the subject is shielded. Cast it on yourself to stop what the others cast at you. Cannot stop finger of death or dispel magic.'),
 	spell('dispel_magic', 'Dispel magic', 'protection', ['C-D-P-W'], 'self', 'Every other spell this turn fails, all enchantments end, all monsters die after attacking. Shields the subject.'),
 	spell('raise_dead', 'Raise dead', 'protection', ['D-W-W-F-W-C'], 'self', 'Heals 5 damage and removes all enchantments from the subject.'),
 	spell('cure_light_wounds', 'Cure light wounds', 'protection', ['D-F-W'], 'self', 'Heals 1 damage.'),
@@ -148,10 +148,10 @@ export const SPELLS: Spell[] = [
 	spell('protection_from_evil', 'Protection from evil', 'enchantment', ['W-W-P'], 'self', 'Shields the subject this turn and for the next three.'),
 	spell('resist_heat', 'Resist heat', 'enchantment', ['W-W-F-P'], 'self', 'The subject ignores fireballs, fire storms and fire elementals until dispelled. Destroys a fire elemental.'),
 	spell('resist_cold', 'Resist cold', 'enchantment', ['S-S-F-P'], 'self', 'The subject ignores ice storms and ice elementals until dispelled. Destroys an ice elemental.'),
-	spell('disease', 'Disease', 'enchantment', ['D-S-F-F-F-C'], 'enemy', 'The subject dies at the end of the sixth turn unless cured by cure heavy wounds, remove enchantment or dispel magic.'),
+	spell('disease', 'Disease', 'enchantment', ['D-S-F-F-F-C'], 'enemy', 'A fever takes the subject, who dies at the end of the fifth turn after this one unless cured by cure heavy wounds, remove enchantment or dispel magic.'),
 	spell('poison', 'Poison', 'enchantment', ['D-W-W-F-W-D'], 'enemy', 'As disease, but cure heavy wounds does not help.'),
-	spell('blindness', 'Blindness', 'enchantment', ['D-W-F-F-(d'], 'enemy', 'For three turns the subject cannot see the opponent’s gestures. Destroys a monster.'),
-	spell('invisibility', 'Invisibility', 'enchantment', ['P-P-(w-(s'], 'self', 'For three turns the opponent cannot see the subject’s gestures and monsters cannot attack them. Destroys a monster.'),
+	spell('blindness', 'Blindness', 'enchantment', ['D-W-F-F-(d'], 'enemy', 'For three turns the subject cannot see other wizards’ gestures. Destroys a monster.'),
+	spell('invisibility', 'Invisibility', 'enchantment', ['P-P-(w-(s'], 'self', 'For three turns other wizards cannot see the subject’s gestures, and monsters cannot attack them. Destroys a monster.'),
 	spell('haste', 'Haste', 'enchantment', ['P-W-P-W-W-C'], 'self', 'For the next three turns the subject makes two pairs of gestures a turn, both taking effect together.'),
 	spell('time_stop', 'Time stop', 'enchantment', ['S-P-P-C'], 'self', 'The subject at once takes an extra turn nobody else can see or resist.'),
 	spell('delayed_effect', 'Delayed effect', 'enchantment', ['D-W-S-S-S-P'], 'self', 'The subject’s next spell (this turn or the next three) is banked, to be released whenever they choose.'),

src/lib/game/state.ts

@@ -306,7 +306,7 @@ export function visibleHistory(state: GameState, viewer: WizardId, subject: Wiza
 	return state.wizards[subject].history.map((h) => (hiddenFromViewer(h.hiddenFrom, viewer) ? { ...h, left: '-', right: '-' } : h));
 }
 
-/** The gallery holds no seat: it is shown only what every wizard at the table could see. */
+/** A spectator holds no seat and is shown only what every seated player could see. */
 export const SPECTATOR: WizardId = '';
 
 export function hiddenFromViewer(hiddenFrom: WizardId[] | undefined, viewer: WizardId): boolean {

src/lib/game/status.ts

@@ -7,7 +7,9 @@ import type { WizardState } from './state';
 const more = (n: number) => (n === Infinity ? 'for good' : `${n} more`);
 
 /** Everything on a wizard, each with how long it lasts. */
-export function effectsOf(w: WizardState): string[] {
+/** `turnsPlayed` names the turn an illness will kill on; without it the count of turns left is given. */
+export function effectsOf(w: WizardState, turnsPlayed?: number): string[] {
+	const dies = (left: number) => (turnsPlayed === undefined ? `dies in ${left}` : `dies at the end of turn ${turnsPlayed + left} unless cured`);
 	const out: string[] = [];
 	if (w.resistHeat) out.push('resists heat');
 	if (w.resistCold) out.push('resists cold');
@@ -18,8 +20,8 @@ export function effectsOf(w: WizardState): string[] {
 	if (w.banked) out.push(`holding a banked ${SPELL_BY_ID[w.banked.spellId].name.toLowerCase()}`);
 	else if (w.delayedTurns > 0) out.push(`next spell will be banked, ${more(w.delayedTurns)}`);
 	if (w.permanencyTurns > 0) out.push(`next enchantment will be permanent, ${more(w.permanencyTurns)}`);
-	if (w.diseaseTurns !== null) out.push(`diseased, dies in ${w.diseaseTurns}`);
-	if (w.poisonTurns !== null) out.push(`poisoned, dies in ${w.poisonTurns}`);
+	if (w.alive && w.diseaseTurns !== null) out.push(`fevered with disease, ${dies(w.diseaseTurns)}`);
+	if (w.alive && w.poisonTurns !== null) out.push(`poisoned, ${dies(w.poisonTurns)}`);
 	const c = w.constraints;
 	if (c.amnesia) out.push(w.permanent.amnesia ? 'amnesia for good' : 'amnesia this turn');
 	if (c.confusion) out.push(w.permanent.confusion ? 'confused for good' : 'confused this turn');
@@ -41,8 +43,8 @@ export function statusWords(w: WizardState): string[] {
 	if (w.resistHeat) out.push('resists heat');
 	if (w.resistCold) out.push('resists cold');
 	if (w.hasteTurns > 0) out.push('hastened');
-	if (w.diseaseTurns !== null) out.push(`dies in ${w.diseaseTurns}`);
-	if (w.poisonTurns !== null) out.push(`poisoned`);
+	if (w.diseaseTurns !== null) out.push('fevered');
+	if (w.poisonTurns !== null) out.push('poisoned');
 	const c = w.constraints;
 	if (c.paralysedHand) out.push(`${c.paralysedHand} hand paralysed`);
 	if (c.charmed) out.push('charmed');

src/lib/game/talk.ts

@@ -1,4 +1,4 @@
-// How much of each table's talk this browser has read, so the hall can say what is new.
+// How many chat lines of each room this browser has read, so the landing page can count what is new.
 
 const SEEN_KEY = 'wh:talk-seen';
 

src/lib/game/tally.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'vitest';
+import { createGame } from './state';
+import { play } from './test-helpers';
+import { tallyOf } from './tally';
+
+describe('the tally of a finished duel', () => {
+	it('counts nothing for a duel still in play', () => {
+		expect(tallyOf(createGame({ A: 'Ann', B: 'Bo' }, 1))).toEqual({});
+	});
+
+	it('counts a surrender as a win by surrender', () => {
+		const s = play(createGame({ A: 'Ann', B: 'Bo' }, 1), { left: 'P', right: 'P' });
+		expect(s.over?.winner).toBe('B');
+		expect(tallyOf(s)).toEqual({ "duels won by a rival's surrender": 1, 'wizards who yielded, all told': 1 });
+	});
+});

src/lib/game/tally.ts

@@ -0,0 +1,26 @@
+// This game's lines for the site-wide tally, read off a finished game: only
+// what the final state records for certain (who is dead, who yielded, and
+// how the game was decided).
+
+import type { GameState } from './state';
+
+export function tallyOf(state: GameState): Record<string, number> {
+	if (!state.over) return {};
+	const wizards = state.seats.map((id) => state.wizards[id]);
+	const dead = wizards.filter((w) => !w.alive).length;
+	const yielded = wizards.filter((w) => w.alive && w.surrendered).length;
+	const out: Record<string, number> = {};
+	const add = (label: string, n = 1) => {
+		if (n > 0) out[label] = (out[label] ?? 0) + n;
+	};
+	if (state.over.winner !== null) {
+		const losers = wizards.filter((w) => w.id !== state.over!.winner);
+		if (losers.every((w) => !w.alive)) add('duels won with every rival slain');
+		else add("duels won by a rival's surrender");
+	} else if (dead === wizards.length) add('duels drawn with every wizard dead');
+	else add('duels drawn with every wizard yielding');
+	add('wizards slain, all told', dead);
+	add('wizards who yielded, all told', yielded);
+	add('stopped moments taken', wizards.reduce((n, w) => n + w.history.filter((h) => h.phase === 'timestop').length, 0));
+	return out;
+}

src/lib/game/view.ts

@@ -15,11 +15,13 @@ export function viewFor(state: GameState, viewer: WizardId): GameState {
 	return view;
 }
 
-/** One line of table talk. Only seated wizards speak; the gallery listens. */
+/** One chat line: from a seat, from a spectator when the host allows it (id SPECTATOR, signed with `name`), or from the site maintainer (`keeper`). */
 export interface ChatLine {
 	id: WizardId;
 	text: string;
 	at: number;
+	name?: string;
+	keeper?: true;
 }
 
 /** What a seated player, or the gallery, is told by the server. Other seats' moves and tokens never leave it. */
@@ -32,11 +34,27 @@ export interface RoomView {
 	me: WizardId;
 	/** The wizard who opened the table and may begin the duel. */
 	host: WizardId;
-	seats: { id: WizardId; name: string; bot: boolean }[];
+	/** Who sits where; `standIn` marks a wizard's seat the host gave to a bot, which duels in it until they take it back. */
+	seats: { id: WizardId; name: string; bot: boolean; standIn?: true }[];
 	/** Seats that still have to move before the turn resolves. */
 	waitingOn: WizardId[];
+	/** Turns played so far, time stops included; gestures are sent with the count they were made against. */
+	resolved: number;
 	state: GameState | null;
 	chat: ChatLine[];
 	/** How many watch from the Peanut Gallery. */
 	audience: number;
+	/** The host lets the gallery talk. */
+	galleryTalk: boolean;
+	/** The site maintainer was invited to a held seat, and by whom. */
+	challenge: { by: WizardId; at: number } | null;
+	/** Names with a seat held who have not yet sat: the previous room's players, or the site maintainer. */
+	expected: string[];
+	/** A finished table's rematch: where it went, and who called. */
+	rematch: { to: string; by: WizardId } | null;
+	/** The table this one is the rematch of. */
+	rematchOf: string | null;
+	/** The site maintainer's name and time zone, for rooms that invite them. */
+	keeper: string;
+	keeperZone: string;
 }

src/routes/+layout.svelte

@@ -1,12 +1,9 @@
 <script lang="ts">
 	import '../app.css';
-	import favicon from '$lib/assets/favicon.svg';
+	import Announcement from '$lib/components/Announcement.svelte';
 
 	let { children } = $props();
 </script>
 
-<svelte:head>
-	<link rel="icon" href={favicon} />
-</svelte:head>
-
+<Announcement />
 {@render children()}

src/routes/+layout.ts

@@ -1,4 +1,5 @@
-// The duel lives in the browser and is saved to local storage, so nothing is rendered on the
-// server. Each route is prerendered as an empty shell that the client fills in.
+// The duel lives in the browser and is saved to local storage, so by default a route is
+// prerendered as an empty shell that the client fills in. The hall, the rules and the guide
+// turn rendering on in their own +page.ts, since their text is the same for everyone.
 export const ssr = false;
 export const prerender = true;

src/routes/+page.ts

@@ -0,0 +1,3 @@
+// The page is text that reads the same for everyone, so it is rendered at build time and served whole;
+// the browser-only state it shows (held seats, the saved name) fills in once the script runs.
+export const ssr = true;

src/routes/guide/+page.svelte

@@ -6,14 +6,14 @@
 	<header>
 		<a class="back" href="/">Back to the hall</a>
 		<h1>How to play</h1>
-		<p class="lede">You are a wizard with two hands and a rival across the table. Every turn each of you writes down a gesture for each hand, and all are revealed at once. The right run of gestures on one hand is a spell. This page walks the room.</p>
+		<p class="lede">You are a wizard with two hands, and across the table sits one rival or several. Every turn each of you chooses a gesture for each hand, and all of them are shown at once. The right run of gestures on one hand is a spell. This guide goes through the screen from the hall to your first duel.</p>
 		<nav aria-label="Sections">
 			<a href="#hall">The hall</a>
 			<a href="#table">The table</a>
 			<a href="#ledger">The ledger</a>
 			<a href="#hands">Your hands</a>
 			<a href="#threats">What they may do</a>
-			<a href="#reveal">The reveal</a>
+			<a href="#reveal">Sealing the turn</a>
 			<a href="#rail">Health, creatures and the sheet</a>
 			<a href="#phone">On a phone</a>
 			<a href="#gallery">The Peanut Gallery and table talk</a>
@@ -27,7 +27,7 @@
 			<img src="/guide/hall.png" alt="The hall: the title, a field for your name, a button to play the bot, and buttons to open a table or join one by code." />
 		</figure>
 		<p>Write your name and choose your company. <strong>Play now against the bot</strong> seats you across from a construct that reads your gestures as you read its. <strong>Open a table</strong> lays a table for up to a dozen wizards and hands you a link and a four-letter code to send. <strong>Join one</strong> takes a code someone sent you.</p>
-		<p>Beneath, <em>your duels</em> lists every table this browser holds a seat at, and whose move it is. A duel waits for you as long as you like; nothing is lost by closing the page.</p>
+		<p>Beneath, <em>your duels</em> lists every table this browser holds a seat at, and whose move it is. A duel waits for you as long as you like, and nothing is lost by closing the page.</p>
 	</section>
 
 	<section id="table">
@@ -35,8 +35,8 @@
 		<figure>
 			<img src="/guide/table.png" alt="A table being laid: the invite link, a roster of seated wizards, an empty-seat count, and the host's button to begin." />
 		</figure>
-		<p>A table fills as wizards open the link. Whoever laid it is the host: they may seat a bot in any empty chair or send one away, and they begin the duel when the company suits them, from two wizards to twelve; a full table waits for them too. Once begun, the seats are closed and the ledger opens.</p>
-		<p>A duel between people is played by turns, whenever each of you has a moment. The page keeps watch and fills itself in when the others have moved; the masthead's <em>room</em> button copies the invite for latecomers who wish to watch.</p>
+		<p>A table fills as wizards open the link. Whoever laid it is the host. The host may seat a bot in any empty chair or send one away, and begins the duel when the company suits them, with anywhere from two wizards to twelve. Even a full table waits for the host. Once the duel begins, the seats are closed and the ledger opens.</p>
+		<p>A duel between people is played by turns, whenever each of you has a moment. When the others move, their turns appear without a reload. The <em>room</em> button at the top copies the invite link for anyone who arrives late and wants to watch.</p>
 	</section>
 
 	<section id="ledger">
@@ -44,8 +44,8 @@
 		<figure>
 			<img src="/guide/ledger.png" alt="The ledger: a table with a turn number down the left, two letter columns for each wizard, and spells named in ember beneath the gesture that finished them." />
 		</figure>
-		<p>This is the game, as Bartle drew it: one row a turn, two columns a wizard, one letter a hand. <strong>F</strong> wriggled fingers, <strong>P</strong> proffered palm, <strong>S</strong> snap, <strong>W</strong> wave, <strong>D</strong> pointed digit, <strong>C</strong> clap. A dagger is a stab; a dash, a hand that rested. A gesture written in ember finished a spell, and the spell is named beneath it.</p>
-		<p>The bottom row is the turn being written. Your letters appear as you choose them; your rivals' show as <strong>?</strong> until the reveal. A question mark in an older row means a gesture you were not allowed to see: you were blind, or they were invisible. With many wizards the ledger runs sideways; the turn and your own two columns stay pinned while you slide across to the rest, and a row of names above it turns the ledger toward any wizard. Pressing a warning or choosing a target does the same. Each wizard keeps one colour in the ledger, the warnings and the rail, so a name met in one place is known in the next.</p>
+		<p>The ledger is the game as Bartle drew it on paper. Each row is a turn, each wizard has two columns, and each letter is one hand's gesture. <strong>F</strong> is wriggled fingers, <strong>P</strong> a proffered palm, <strong>S</strong> a snap, <strong>W</strong> a wave, <strong>D</strong> a pointed digit and <strong>C</strong> a clap. A dagger is a stab, and a dash is a hand that rested. A gesture written in ember finished a spell, and the spell is named beneath it.</p>
+		<p>The bottom row is the turn being written. Your letters appear as you choose them, and your rivals' show as <strong>?</strong> until every hand is shown. A question mark in an older row is a gesture you were not allowed to see, because you were blind or they were invisible. With many wizards the ledger runs sideways. The turn number and your own two columns stay put while you slide across to the rest, and the row of names above the ledger jumps to any wizard. Pressing a warning or choosing a target jumps there too. Each wizard has one colour, used in the ledger, the warnings and the list of wizards alike.</p>
 	</section>
 
 	<section id="hands">
@@ -53,9 +53,10 @@
 		<figure>
 			<img src="/guide/hands.png" alt="Two panels of gesture buttons, left hand and right, each with a list beneath of spells under way and the gesture that continues them." />
 		</figure>
-		<p>Press a gesture for each hand. Beneath each hand is what that hand is part-way through: <em>D → F-W, Cure light wounds</em> means the digit you made last turn is the first gesture of that spell, and F then W would finish it. Press a line to make its next gesture; the diamond pins a spell so it stays at the top while you work toward it.</p>
-		<p>When a gesture finishes a spell, <em>Finishes</em> appears with the spell chosen and <em>at</em> naming the likeliest subject. Change either. A gesture can belong to more than one spell so long as each run is unbroken, which is how F-F-F followed by S-S-D-D casts a Paralysis and then a Fireball; but one gesture may finish only one spell, and the page will tell you when two of your choices would share one.</p>
-		<p>Some hands are not yours to move. A hand paralysed or charmed by a rival, or a turn under amnesia, shows its forced gesture locked. Both palms at once is surrender, and the page warns before you do it.</p>
+		<p>Press a gesture for each hand, or type them. The first letter you type goes to your left hand and the second to your right. K is a stab and a dash rests the hand. Backspace takes the last letter back, and Enter seals the turn. Your two letters wait beside the button in a row that stays in view however far you scroll.</p>
+		<p>Under each hand is a list of the spells that hand is part of the way through. <em>D → F-W, Cure light wounds</em> means the digit you made last turn starts that spell, and F then W would finish it. Press a line to make its next gesture. The diamond pins a spell to the top of the list while you work toward it.</p>
+		<p>When a gesture finishes a spell, <em>Finishes</em> shows which spell, and <em>at</em> shows the likeliest target. You can change either. A gesture can belong to more than one spell as long as each run is unbroken, which is how F-F-F followed by S-S-D-D casts a Paralysis and then a Fireball. But one gesture can finish only one spell, and you will be warned if two of your choices would share one.</p>
+		<p>Some hands are not yours to move. A hand paralysed or charmed by a rival, or a turn under amnesia, shows its forced gesture locked. Both palms at once is surrender, and you are warned before you commit to it.</p>
 	</section>
 
 	<section id="threats">
@@ -63,17 +64,17 @@
 		<figure>
 			<img src="/guide/threats.png" alt="Warnings above the hands: a rival's hand, the gestures already made, an arrow, and the gesture that would finish a hostile spell." />
 		</figure>
-		<p>Above the hands the page reads your rivals' ledgers for you. <em>Lucan, left: S → D, Missile</em> means Lucan's left hand snapped last turn, and one pointed digit would send a missile this turn. <em>Two gestures away</em> lists what could land the turn after. Press a warning to light those gestures in the ledger.</p>
-		<p>This is the whole art. A shield, a single palm, stops missiles, creatures and knives this turn. A counter-spell on yourself, W-W-S or W-P-P, stops every other spell aimed at you this turn and shields you besides. Neither stops a wound spell or a lightning bolt, and nothing but dispel magic stops the finger of death; against those, break their run with an anti-spell before it ends.</p>
+		<p>Above your hands is a list of what your rivals could cast soon, read from their gestures so far. <em>Lucan, left, S → D, Missile</em> means Lucan's left hand snapped last turn, and one pointed digit would send a missile this turn. <em>Two gestures away</em> lists what could land the turn after. Press a warning to light those gestures in the ledger.</p>
+		<p>Answering these warnings is most of the skill. A shield, a single palm, stops missiles, creatures and knives this turn, but not wound spells, lightning or fire. A counter-spell on yourself, W-W-S or W-P-P, stops every other spell cast at you this turn and shields you as well. Only finger of death and dispel magic get past it. Finger of death is stopped only by dispel magic, so the better answer is to break its run with an anti-spell before it ends.</p>
 	</section>
 
 	<section id="reveal">
-		<h2>The reveal</h2>
+		<h2>Sealing the turn</h2>
 		<figure>
 			<img src="/guide/result.png" alt="The result strip: each wizard's health before and after the turn, then the events of the turn in a line each." />
 		</figure>
-		<p><strong>Reveal gestures</strong> commits your turn. Against the bot the turn resolves at once; at a table it resolves when the last wizard has moved, and until then the button reads <em>Waiting</em>. Everything happens together: a shield made this turn stops a missile made this turn, a creature summoned this turn strikes this turn, and a cure lands in the same breath as the wound.</p>
-		<p>The strip above the hands says what changed: each wizard's health, then the events worth knowing, and the first time a rule surprises you, a line explaining it. The chronicle in the rail keeps the whole story.</p>
+		<p><strong>Seal the turn</strong> commits your two gestures. Nobody sees them until every wizard has sealed theirs, and then all the hands are shown at once. Against the bot this happens straight away. At a table it happens when the last wizard moves, and until then your button reads <em>Waiting</em>. Everything in a turn happens together. A shield made this turn stops a missile made this turn, a creature summoned this turn strikes this turn, and a cure lands in the same breath as the wound.</p>
+		<p>The strip above your hands sums up the turn. It gives each wizard's health and the events worth knowing, and the first time a rule comes up it adds a line explaining it. The chronicle at the side keeps the whole story, turn by turn.</p>
 	</section>
 
 	<section id="rail">
@@ -86,29 +87,31 @@
 				<img src="/guide/sheet.png" alt="The spell sheet, open at Fireball: its gestures, what it does, and buttons to plan it with the left or right hand." />
 			</figure>
 		</div>
-		<p>The rail shows every wizard: fifteen marks of health, the enchantments on them and for how long, and the creatures that serve them with hits left and damage dealt. Past three wizards the rail lists the others on a line each, with their health, what matters about their condition, and whether they have written their turn; press a line to open it out. Your own creatures take orders beneath your hands each turn and keep attacking what they last attacked until told otherwise.</p>
+		<p>The column at the side shows every wizard's fifteen marks of health, the enchantments on them and for how long, and the creatures that serve them. At a table of more than three, the other wizards get one line each, showing their health, anything important about their condition, and whether they have moved yet. Press a line to see the rest. Your own creatures take orders beneath your hands each turn and keep attacking what they last attacked until told otherwise.</p>
 		<p>The spell sheet lists all forty spells. Gestures you have already made light up along each sequence. Open a spell to read it, then <strong>Plan with left hand</strong> or <strong>right hand</strong> to pin it and make its next gesture, which is how a duel begins when nothing is yet under way.</p>
 	</section>
 
 	<section id="phone">
 		<h2>On a phone</h2>
 		<figure class="narrow">
-			<img src="/guide/phone.png" alt="The duel on a phone: the ledger, the result, the hands, and a bar fixed at the foot with every wizard's health, the chosen gestures and the reveal button." />
+			<img src="/guide/phone.png" alt="The duel on a phone: the ledger, the result, the hands, and a bar fixed at the foot with every wizard's health, the chosen gestures and the button that seals the turn." />
 		</figure>
-		<p>Everything is here, in one column. The bar at the foot keeps every wizard's health, your two chosen gestures and the reveal button in reach; after a reveal the page brings the ledger's last rows and the result into view. Lists are shorter, and <em>More spells</em> opens the rest.</p>
+		<p>On a phone everything sits in one column. A bar at the bottom of the screen keeps the wizards' health, your two gestures and the button that seals the turn within reach. After each turn the screen scrolls back to the ledger's last rows and the result. Lists are shorter, and <em>More spells</em> opens the rest.</p>
 	</section>
 
 	<section id="gallery">
 		<h2>The Peanut Gallery and table talk</h2>
-		<p>A room's link is an invitation to sit while the table is laid and to watch once the duel has begun. Anyone who opens it without a seat takes a place in the Peanut Gallery: they see the ledger, the result of each turn and the chronicle, and the table is told how many are watching. The gallery is shown only what every wizard at the table could see; a gesture hidden from any one of them is a question mark to everyone in the gallery, and the turn being written shows nothing at all.</p>
-		<p><em>Table talk</em>, in the rail, is for the wizards seated. A line goes to everyone at the table and everyone in the gallery, and it is kept with the duel; when you come back to a table, the hall says how many lines were said while you were away. The gallery listens and does not speak.</p>
+		<p>A room's link is an invitation to sit while the table is laid and to watch once the duel has begun. Anyone who opens it without a seat takes a place in the Peanut Gallery. They see the ledger, the result of each turn and the chronicle, and the table can see how many are watching. The gallery is shown only what every wizard at the table could see. A gesture hidden from any one wizard is a question mark to the whole gallery, and the turn being written shows nothing at all.</p>
+		<p><em>Table talk</em>, in the rail, is for the wizards seated. A line goes to everyone at the table and in the gallery, and it is kept with the duel. When you come back, the hall says how many lines were said while you were away. The gallery only listens unless the host lets it talk. Then a watcher signs a name, and their lines read <em>Name (gallery)</em>.</p>
+		<p>Before a duel begins, any seated wizard may <strong>challenge the keeper</strong>, who looks after this site. A seat is held under the keeper's name and the keeper's phone rings. The note beside the button gives the hour where the keeper lives, so you know whether to wait or come back later.</p>
+		<p>When a duel is over, anyone at the table may call for <strong>a rematch</strong>. That opens a new table of the same size with the same bots, and holds a seat for everyone who played. <strong>Transfer seat</strong> at the top of the page gives you four words that move your seat to another device. They work for ten minutes, and you enter them in the hall on the other device. If your browser has lost your seat altogether, ask the host: <strong>Seats</strong> at the top of their page makes the four words for you. Failing that, write to the keeper from the room's page for a link that brings the seat back. A wizard who cannot go on can have their seat given to a bot by the host, and four words from the host bring them back to it.</p>
 	</section>
 
 	<section id="first">
 		<h2>A first duel</h2>
-		<p>Open with a wave on each hand. From W-W you may turn either hand into a counter-spell (W-W-S), a protection from evil (W-W-P) or resist heat (W-W-F-P), and nobody can hurt you on the first turn. Watch the warnings: when a missile is one gesture away, a palm costs you one hand for one turn; when a fireball is one gesture away, only a counter-spell, a resistance, or a counter of your own will do.</p>
-		<p>Then choose a spell from the sheet and pin it to a hand, and keep the other hand for answering. Cause light wounds is three gestures, a fireball five, and summoning a goblin three; a goblin that lives for four turns has done a fireball's work. Read the rival's ledger every turn as they read yours. Both of you are bluffing, and the whole page is the paper.</p>
-		<p>The full rules are on the <a href="/rules">rules page</a>, with Bartle's text. If a rule here reads wrong to you, or the page misbehaves, <a href="mailto:eric@ericwagoner.com">send word</a>; the hall's <em>about this game</em> has the other ways to reach the keeper.</p>
+		<p>Open with a wave on each hand. From W-W either hand can go on to a counter-spell (W-W-S), protection from evil (W-W-P) or resist heat (W-W-F-P). On the first turn only a knife can hurt you. Then watch the warnings. When a missile is one gesture away, a palm on one hand stops it. When a fireball is one gesture away, a palm will not help, but a counter-spell on yourself or resist heat will.</p>
+		<p>Next, choose a spell from the sheet and pin it to one hand, and keep the other hand free for answering. Cause light wounds takes three gestures, a fireball five, and summoning a goblin three. A goblin left alone strikes every turn, so in five turns it does a fireball's damage. Read your rivals' ledgers every turn, because they are reading yours, and any of you can feint.</p>
+		<p>The full rules are on the <a href="/rules">rules page</a>, with Bartle's text. If a rule here reads wrong to you, or something misbehaves, <a href="mailto:eric@ericwagoner.com">send word</a>. The hall's <em>about this game</em> lists the other ways to reach the keeper.</p>
 	</section>
 </main>
 

src/routes/guide/+page.ts

@@ -0,0 +1,3 @@
+// The page is text that reads the same for everyone, so it is rendered at build time and served whole;
+// the browser-only state it shows (held seats, the saved name) fills in once the script runs.
+export const ssr = true;

src/routes/join/[code]/+page.svelte

@@ -1,9 +1,11 @@
 <script lang="ts">
+	import { goto } from '$app/navigation';
 	import { page } from '$app/state';
 	import Board from '$lib/components/Board.svelte';
 	import ReportSlip from '$lib/components/ReportSlip.svelte';
+	import SeatsSlip from '$lib/components/SeatsSlip.svelte';
 	import TableTalk from '$lib/components/TableTalk.svelte';
-	import { seatFor } from '$lib/game/client';
+	import { api, rememberSeat, seatFor, seatInLink, ServerError, trustSeat, type HeldSeat } from '$lib/game/client';
 	import { COMPACT_QUERY, Duel, NAME_MAX, playerName } from '$lib/game/duel.svelte';
 
 	const roomId = $derived((page.params.code ?? '').toUpperCase());
@@ -11,34 +13,109 @@
 	let room = $state<Duel | null>(null);
 	let name = $state('');
 	let joining = $state(false);
+	/** The host pressed Begin while a seat is still held for someone expected; confirm before going on. */
+	let beginAsked = $state(false);
 	let busy = $state(false);
 	let error = $state('');
 	let copied = $state(false);
 	let reporting = $state(false);
+	/** This seat's transfer phrase, until it expires. */
+	let phrase = $state<{ phrase: string; expiresAt: number } | null>(null);
+	let rematching = $state(false);
+	let seatsOpen = $state(false);
+	/** The server's reason for refusing this browser's seat; shown while spectating. */
+	let seatLost = $state('');
+	let claimPhrase = $state('');
+	let claiming = $state(false);
+
+	/** The current hour in the site maintainer's time zone, in words, shown beside the challenge button. */
+	let minute = $state(0);
+	$effect(() => {
+		const id = setInterval(() => (minute += 1), 60_000);
+		return () => clearInterval(id);
+	});
+	const keeperHour = $derived.by(() => {
+		void minute;
+		const zone = room?.remote?.keeperZone;
+		if (!zone) return '';
+		try {
+			const hour = Number(new Intl.DateTimeFormat('en-US', { hour: 'numeric', hour12: false, timeZone: zone }).format(new Date())) % 24;
+			if (hour === 0) return 'midnight';
+			if (hour === 12) return 'noon';
+			const word = ['twelve', 'one', 'two', 'three', 'four', 'five', 'six', 'seven', 'eight', 'nine', 'ten', 'eleven'][hour % 12];
+			const part = hour < 5 ? 'in the small hours' : hour < 12 ? 'in the morning' : hour < 18 ? 'in the afternoon' : 'in the evening';
+			return `${word} ${part}`;
+		} catch {
+			return '';
+		}
+	});
+
+	async function transfer() {
+		if (!room) return;
+		try {
+			phrase = await room.transfer();
+			setTimeout(() => (phrase = null), Math.max(0, phrase.expiresAt - Date.now()));
+		} catch (e) {
+			error = e instanceof Error ? e.message : 'The seat could not be offered.';
+		}
+	}
+
+	/** Call for a rematch, or take the seat held at one already called. */
+	async function rematch() {
+		if (!room) return;
+		rematching = true;
+		try {
+			await goto(`/join/${await room.rematch()}`);
+		} catch (e) {
+			error = e instanceof Error ? e.message : 'The rematch could not be called.';
+		} finally {
+			rematching = false;
+		}
+	}
 
 	const link = $derived(typeof location === 'undefined' ? '' : `${location.origin}/join/${roomId}`);
 	const lobby = $derived(room !== null && !room.remote?.started);
 	const watching = $derived(room?.spectating ?? false);
-	/** A watcher may still sit while the table is laid and a seat is free. */
+	/** A spectator may still take a seat before the game starts, while one is free. */
 	const seatFree = $derived(!!room?.remote && !room.remote.started && room.remote.seats.length < room.remote.size);
 
-	// Return to a held seat, or take a place in the gallery and offer one.
+	// Resume a held seat, else spectate. A link may carry a seat (#seat=...): it is stripped from the address
+	// bar at once, saved only once the server accepts it, and never replaces a held seat the server still
+	// accepts, so a forwarded link cannot take a working seat.
 	$effect(() => {
 		const id = roomId;
 		room = null;
 		error = '';
+		const sent = seatInLink(location.hash);
+		// The History API directly, not SvelteKit's replaceState: this runs on first load, before the router is ready.
+		if (sent) history.replaceState(history.state, '', location.pathname + location.search);
 		const held = seatFor(id);
-		if (!held) {
-			name = playerName();
-			joining = true;
-			Duel.watchRoom(id)
-				.then((remote) => (room = new Duel(remote)))
-				.catch((e: Error) => (error = e.message));
-			return;
-		}
-		joining = false;
-		Duel.resumeRoom(id, held)
-			.then((remote) => (room = new Duel(remote)))
+		const take = (s: HeldSeat) =>
+			Duel.resumeRoom(id, s).then((remote) => {
+				rememberSeat(id, s);
+				trustSeat(id);
+				return remote;
+			});
+		// Only a 403 on the held token lets the link's seat in; a dropped connection is not a lost seat.
+		const refused = (e: unknown) => e instanceof ServerError && e.status === 403;
+		// A refused seat with no link to replace it falls back to spectating, keeping the server's reason.
+		const watchRefused = (e: Error) => {
+			seatLost = e.message;
+			return Duel.watchRoom(id);
+		};
+		seatLost = '';
+		const arrive = held
+			? Duel.resumeRoom(id, held).catch((e: Error) => (sent && refused(e) ? take(sent) : refused(e) ? watchRefused(e) : Promise.reject(e)))
+			: sent
+				? take(sent).catch(() => Duel.watchRoom(id))
+				: Duel.watchRoom(id);
+		joining = !held && !sent;
+		if (!held) name = playerName();
+		arrive
+			.then((remote) => {
+				room = new Duel(remote);
+				if (remote.spectating) joining = true;
+			})
 			.catch((e: Error) => (error = e.message));
 	});
 
@@ -50,6 +127,37 @@
 		return stop;
 	});
 
+	// The seat was revoked while the page was open (the host gave it to a bot): switch to spectating.
+	$effect(() => {
+		const r = room;
+		const lost = r?.remote?.lost;
+		if (!r || !lost) return;
+		seatLost = lost;
+		Duel.watchRoom(r.remote!.roomId)
+			.then((remote) => (room = new Duel(remote)))
+			.catch((e: Error) => (error = e.message));
+	});
+
+	/** Claim a seat by transfer phrase: the host's, or one this seat made on another device. */
+	async function claim(e: SubmitEvent) {
+		e.preventDefault();
+		claiming = true;
+		error = '';
+		try {
+			const got = await api.claim(claimPhrase.trim());
+			rememberSeat(got.roomId, { seat: got.seat, token: got.token });
+			trustSeat(got.roomId);
+			claimPhrase = '';
+			seatLost = '';
+			if (got.roomId === roomId) room = new Duel(await Duel.resumeRoom(roomId, { seat: got.seat, token: got.token }));
+			else await goto(`/join/${got.roomId}`);
+		} catch (err) {
+			error = err instanceof Error ? err.message : 'The phrase opened no seat.';
+		} finally {
+			claiming = false;
+		}
+	}
+
 	// The store's idea of a narrow screen must agree with the stylesheets' breakpoint.
 	$effect(() => {
 		const r = room;
@@ -115,7 +223,13 @@
 				<span class="muted">{watching ? 'watching · room' : 'invite friends · room'}</span> <b>{roomId}</b>{copied ? ' · link copied' : ''}
 			</button>
 			{#if room.remote && room.remote.audience > 0}
-				<span class="audience" title="the Peanut Gallery">{room.remote.audience} in the gallery</span>
+				<span class="audience" title="the Peanut Gallery">{room.remote.audience} in the gallery{room.remote.galleryTalk ? ', talking' : ''}</span>
+			{/if}
+			{#if !watching}
+				<button type="button" class="quiet" title="A phrase that brings this seat to another device" onclick={transfer}>Transfer seat</button>
+			{/if}
+			{#if room.isHost && room.remote?.started}
+				<button type="button" class="quiet" title="Bring a wizard back to a seat their browser lost, or give a seat to a bot" onclick={() => (seatsOpen = true)}>Seats</button>
 			{/if}
 		{/if}
 		<a class="quiet" href="/guide">How to play</a>
@@ -129,17 +243,51 @@
 
 {#if room}
 	<ReportSlip duel={room} bind:open={reporting} />
+	{#if room.isHost}<SeatsSlip duel={room} bind:open={seatsOpen} />{/if}
 {/if}
 
 {#if error}
 	<p class="notice">{error}</p>
 {/if}
 
+{#if phrase}
+	<p class="notice muted">On the other device, open the hall and claim this phrase within ten minutes: <b class="phrase">{phrase.phrase}</b></p>
+{/if}
+
+{#if room?.remote?.started && !seatLost && room.remote.seats.some((s) => s.standIn)}
+	<p class="notice muted">A bot duels for {room.remote.seats.filter((s) => s.standIn).map((s) => s.name).join(', ')}, at the host's word, until a transfer phrase from the host brings them back.</p>
+{/if}
+
+{#if watching && room?.remote?.started && !room.state.over}
+	<div class="notice muted">
+		{#if seatLost}<p>{seatLost} Claim it here, or <a href="mailto:eric@ericwagoner.com?subject={encodeURIComponent(`My seat in room ${roomId}`)}">write to the keeper</a>.</p>
+		{:else}{#if room.remote.expected.length > 0}<p>{room.speaker(room.remote.host)} began the duel before {room.remote.expected.join(' and ')} arrived, and the seat held for {room.remote.expected.length === 1 ? 'them' : 'each'} went with it.</p>{/if}
+			<p>Had a seat at this duel? Ask the host for a transfer phrase, or make one on the device that still holds the seat, and claim it here. Or <a href="mailto:eric@ericwagoner.com?subject={encodeURIComponent(`My seat in room ${roomId}`)}">write to the keeper</a> for a link that brings it back.</p>{/if}
+		<form class="rename" onsubmit={claim}>
+			<input type="text" bind:value={claimPhrase} placeholder="the four-word phrase" autocomplete="off" aria-label="transfer phrase" />
+			<button type="submit" class="quiet" disabled={claiming || claimPhrase.trim().split(/[\s-]+/).length < 4}>Claim the seat</button>
+		</form>
+	</div>
+{/if}
+
+{#if room?.remote?.started && room.state.over && !watching}
+	{@const r = room.remote}
+	<p class="notice muted">
+		{#if r.rematch}
+			{room.speaker(r.rematch.by)} called for a rematch at table {r.rematch.to}.
+			<a href={`/join/${r.rematch.to}`}>Take your seat</a>
+		{:else}
+			<button type="button" class="quiet" disabled={rematching} onclick={rematch}>Duel again with this table</button>
+			<span>The same company sits down at a new table, with a seat held for everyone here.</span>
+		{/if}
+	</p>
+{/if}
+
 {#if joining && seatFree}
 	<section class="lobby">
 		<p class="eyebrow">room {roomId}</p>
 		<h2>Take a seat</h2>
-		<p>A wizard has opened this table and is gathering opponents. Choose a name and sit; the duel begins when the host says.</p>
+		<p>A wizard has opened this table and is gathering opponents. Choose a name and sit down. The duel begins when the host says.</p>
 		<form class="rename" onsubmit={takeSeat}>
 			<label class="field">
 				<span>Your name</span>
@@ -160,12 +308,12 @@
 			{#if seatFree}
 				<p>{hostName} is gathering wizards. Sit down above, or watch from the gallery until the duel begins.</p>
 			{:else}
-				<p>The table is full. You watch from the Peanut Gallery; the duel begins when {hostName} says.</p>
+				<p>The table is full, so you watch from the Peanut Gallery. The duel begins when {hostName} says.</p>
 			{/if}
 		{:else}
 			<p class="eyebrow">room {roomId}</p>
 			<h2>The table is laid</h2>
-			<p>Send this link, or the code. Whoever opens it takes a seat; the table holds a dozen, and the duel begins when you say. Anyone who arrives once it has begun watches from the Peanut Gallery.</p>
+			<p>Send this link, or the code. Whoever opens it takes a seat, up to a dozen, and the duel begins when you say. Anyone who arrives once it has begun watches from the Peanut Gallery.</p>
 			<p class="link-row"><code>{link}</code><button type="button" class="quiet" onclick={copyLink}>{copied ? 'Copied' : 'Copy link'}</button></p>
 		{/if}
 		<ul class="roster">
@@ -176,20 +324,47 @@
 							<button type="button" class="unseat" title="Send this bot away" aria-label="Send {s.name} away" onclick={() => room?.unseat(s.id)}>×</button>{/if}</span>
 				</li>
 			{/each}
-			<li class="empty muted">{r.size - r.seats.length} of {r.size} seats empty{#if r.audience > 0}; {r.audience} in the gallery{/if}</li>
+			{#each r.expected as name (name)}
+				<li>
+					<span class="seat-name">{name}</span>
+					<span class="muted">{r.challenge && name.toLowerCase() === r.keeper.toLowerCase() ? 'called to the table; a seat is held' : 'from the last table; a seat is held'}</span>
+				</li>
+			{/each}
+			<li class="empty muted">{r.size - r.seats.length - r.expected.length} of {r.size} seats empty{#if r.audience > 0}; {r.audience} in the gallery{r.galleryTalk ? ', allowed to talk' : ''}{/if}</li>
 		</ul>
+		{#if r.rematchOf}
+			<p class="muted">This is a rematch of table {r.rematchOf}, with seats held for those not yet back.</p>
+		{/if}
 		{#if !watching}
 			<div class="ways">
 				{#if r.seats.length < r.size && room.isHost}
 					<button type="button" class="quiet" onclick={() => room?.addBot()}>Seat a bot</button>
 				{/if}
-				{#if room.isHost}
-					<button type="button" class="reveal small" disabled={r.seats.length < 2} onclick={() => room?.begin()}>Begin the duel</button>
+				{#if room.isHost && beginAsked && r.expected.length > 0}
+					<span>A seat is held for {r.expected.join(' and ')}, who {r.expected.length === 1 ? 'has' : 'have'} not arrived. The seat goes once the duel begins.</span>
+					<button type="button" class="reveal small" onclick={() => room?.begin()}>Begin without them</button>
+					<button type="button" class="link" onclick={() => (beginAsked = false)}>wait</button>
+				{:else if room.isHost}
+					<button type="button" class="reveal small" disabled={r.seats.length < 2} onclick={() => (r.expected.length > 0 ? (beginAsked = true) : room?.begin())}>Begin the duel</button>
 					<span class="muted">{r.seats.length < 2 ? 'once a second wizard is seated' : `with ${r.seats.length} wizards`}</span>
 				{:else}
 					<span class="muted">{hostName} will begin the duel when the table is ready.</span>
 				{/if}
 			</div>
+			{#if room.isHost}
+				<label class="switch muted">
+					<input type="checkbox" checked={r.galleryTalk} onchange={(e) => room?.setGalleryTalk(e.currentTarget.checked)} />
+					Let the Peanut Gallery talk at the table
+				</label>
+			{/if}
+			{#if r.keeper && !r.challenge && !r.seats.some((s) => s.name.toLowerCase() === r.keeper.toLowerCase()) && r.seats.length + r.expected.length < r.size}
+				<div class="keeper">
+					<button type="button" class="quiet" title="A seat is held for {r.keeper}, who keeps this site, and their phone rings" onclick={() => room?.callKeeper()}>Challenge {r.keeper}, the keeper</button>
+					<p class="muted small">{r.keeper} keeps this site and answers every call, sometimes within the minute, sometimes after a night's sleep.{#if keeperHour}&nbsp;It is {keeperHour} where {r.keeper} lives.{/if} The seat is held either way.</p>
+				</div>
+			{:else if r.challenge}
+				<p class="muted small">{r.keeper} has been called to the table by {room.speaker(r.challenge.by)}.{#if keeperHour}&nbsp;It is {keeperHour} there.{/if} A seat is held for them. If they can come now, they will take it. If they are asleep or away, they will leave a word below when they can. In the meantime you can seat a bot, invite a friend, or play another duel in a new tab. This table keeps its place in your hall until you come back.</p>
+			{/if}
 		{/if}
 		{#if r.error}<p class="notice">{r.error}</p>{/if}
 		<div class="lobby-talk"><TableTalk duel={room} /></div>
@@ -205,57 +380,6 @@
 </footer>
 
 <style>
-	.masthead {
-		display: flex;
-		align-items: flex-start;
-		justify-content: space-between;
-		gap: 1rem;
-		padding: 1rem var(--gutter) 0.6rem;
-		max-width: 1280px;
-		margin: 0 auto;
-	}
-
-	h1 {
-		font-size: clamp(2rem, 4vw, 2.7rem);
-		font-weight: 300;
-		font-variation-settings: 'opsz' 144;
-		letter-spacing: -0.01em;
-	}
-
-	.standfirst {
-		max-width: 38em;
-		color: var(--bone-dim);
-		margin-top: 0.4rem;
-	}
-
-	.standfirst em {
-		color: var(--bone);
-	}
-
-	.actions {
-		display: flex;
-		flex-wrap: wrap;
-		gap: 0.5rem;
-		flex-shrink: 0;
-		min-width: 0;
-		max-width: 100%;
-	}
-
-	.quiet {
-		background: none;
-		border: 1px solid var(--rule-strong);
-		border-radius: 4px;
-		padding: 0.4rem 0.9rem;
-		white-space: nowrap;
-		color: var(--bone);
-		text-decoration: none;
-		line-height: 1.55;
-	}
-
-	.quiet:hover {
-		border-color: var(--bone);
-	}
-
 	.quiet.room b {
 		letter-spacing: 0.12em;
 		font-weight: 600;
@@ -274,6 +398,29 @@
 		margin-top: 1rem;
 	}
 
+	.switch {
+		display: flex;
+		align-items: center;
+		gap: 0.5rem;
+		margin-top: 0.6rem;
+		font-size: 0.9rem;
+	}
+
+	.keeper {
+		margin-top: 0.8rem;
+		max-width: 38em;
+	}
+
+	.small {
+		font-size: 0.85rem;
+		margin-top: 0.4rem;
+	}
+
+	.phrase {
+		letter-spacing: 0.06em;
+		user-select: all;
+	}
+
 	.eyebrow {
 		font-size: 0.85rem;
 		letter-spacing: 0.12em;
@@ -319,11 +466,6 @@
 		width: 14em;
 	}
 
-	.reveal.small {
-		padding: 0.4rem 0.9rem;
-		font-size: 1rem;
-	}
-
 	.roster {
 		list-style: none;
 		margin: 0.9rem 0 0.6rem;
@@ -385,27 +527,4 @@
 		border-radius: 4px;
 		word-break: break-all;
 	}
-
-	.colophon {
-		max-width: 1280px;
-		margin: 0 auto;
-		padding: 2rem var(--gutter) 3rem;
-		color: var(--bone-faint);
-		font-size: 0.85rem;
-	}
-
-	.colophon a {
-		color: var(--frost);
-	}
-
-	/* Must match COMPACT_QUERY in duel.svelte.ts. */
-	@media (max-width: 860px) {
-		.masthead {
-			flex-direction: column;
-		}
-
-		.colophon {
-			padding-bottom: 6rem;
-		}
-	}
 </style>

src/routes/play/+page.svelte

@@ -61,7 +61,7 @@
 		{:else}
 			<p class="standfirst">
 				You are <em>{duel.you.name}</em><button type="button" class="link" onclick={startRename}>change name</button>, duelling <em>{duel.foe.name}</em>.
-				{#if duel.state.turn === 0}Each turn, both wizards choose one gesture per hand and reveal them together. The right run of gestures on one hand is a spell.{/if}
+				{#if duel.state.turn === 0}Each turn, each wizard chooses one gesture per hand, and the gestures are shown together. The right run of gestures on one hand is a spell.{/if}
 			</p>
 		{/if}
 	</div>
@@ -90,33 +90,6 @@
 </footer>
 
 <style>
-	.masthead {
-			display: flex;
-			align-items: flex-start;
-			justify-content: space-between;
-			gap: 1rem;
-			padding: 1rem var(--gutter) 0.6rem;
-			max-width: 1280px;
-			margin: 0 auto;
-		}
-
-	h1 {
-			font-size: clamp(2rem, 4vw, 2.7rem);
-			font-weight: 300;
-			font-variation-settings: 'opsz' 144;
-			letter-spacing: -0.01em;
-		}
-
-	.standfirst {
-			max-width: 38em;
-			color: var(--bone-dim);
-			margin-top: 0.4rem;
-		}
-
-	.standfirst em {
-			color: var(--bone);
-		}
-
 	.standfirst .link {
 		margin-left: 0.5em;
 		font-size: 0.8rem;
@@ -134,30 +107,6 @@
 		width: 14em;
 	}
 
-	.actions {
-		display: flex;
-		flex-wrap: wrap;
-		gap: 0.5rem;
-		flex-shrink: 0;
-		min-width: 0;
-		max-width: 100%;
-	}
-
-	.quiet {
-			background: none;
-			border: 1px solid var(--rule-strong);
-			border-radius: 4px;
-			padding: 0.4rem 0.9rem;
-			white-space: nowrap;
-			color: var(--bone);
-			text-decoration: none;
-			line-height: 1.55;
-		}
-
-	.quiet:hover {
-			border-color: var(--bone);
-		}
-
 	.confirm {
 		max-width: 1280px;
 		margin: 0 auto 0.75rem;
@@ -174,32 +123,4 @@
 		gap: 0.6rem;
 		flex-wrap: wrap;
 	}
-
-	.reveal.small {
-			padding: 0.4rem 0.9rem;
-			font-size: 1rem;
-		}
-
-	.colophon {
-			max-width: 1280px;
-			margin: 0 auto;
-			padding: 2rem var(--gutter) 3rem;
-			color: var(--bone-faint);
-			font-size: 0.85rem;
-		}
-
-	.colophon a {
-			color: var(--frost);
-		}
-
-	/* Must match COMPACT_QUERY in duel.svelte.ts. */
-	@media (max-width: 860px) {
-		.colophon {
-					padding-bottom: 6rem;
-				}
-	
-		.masthead {
-					flex-direction: column;
-				}
-	}
 </style>

src/routes/rules/+page.svelte

@@ -55,7 +55,7 @@
 	<header>
 		<a class="back" href="/">Back to the hall</a> · <a class="back" href="/guide">How to play</a>
 		<h1>How to duel</h1>
-		<p class="lede">Waving Hands is Richard Bartle's 1977 game of two wizards trading spells made of hand gestures. This page is a working reference; the original transcription is at the end.</p>
+		<p class="lede">Waving Hands is Richard Bartle's 1977 game of duelling wizards, who trade spells made of hand gestures. Two can play, or a whole table. This page is a working reference, and the original transcription is at the end.</p>
 		<nav aria-label="Sections">
 			<a href="#turn">A turn</a>
 			<a href="#gestures">Gestures</a>
@@ -71,7 +71,7 @@
 	<section id="turn">
 		<h2>A turn</h2>
 		<ol>
-			<li>Both wizards secretly choose a gesture for each hand. In this game you pick them, then choose which finished spells to cast and at whom.</li>
+			<li>Every wizard secretly chooses a gesture for each hand. In this game you pick them, then choose which finished spells to cast and at whom.</li>
 			<li>Both reveal at once. Every spell, stab and monster attack of the turn takes effect together, so a shield you make this turn stops a missile made this turn.</li>
 			<li>Damage and healing are added up, monsters that lost all their hit points are removed, and enchantments cast this turn bind next turn.</li>
 		</ol>
@@ -79,19 +79,19 @@
 
 	<section id="gestures">
 		<h2>Gestures</h2>
-		<p>Six magical gestures: <strong>F</strong> wriggled fingers, <strong>P</strong> proffered palm, <strong>S</strong> snap, <strong>W</strong> wave, <strong>D</strong> pointed digit and <strong>C</strong> clap. A clap needs both hands; a clap with one hand is nothing. A hand may instead <strong>stab</strong> with the knife (one point of damage, one stab a turn) or do <strong>nothing</strong>. Neither belongs to any spell, so a hand that stabs or rests starts its next spell from scratch.</p>
+		<p>There are six magical gestures. <strong>F</strong> is wriggled fingers, <strong>P</strong> a proffered palm, <strong>S</strong> a snap, <strong>W</strong> a wave, <strong>D</strong> a pointed digit and <strong>C</strong> a clap. A clap needs both hands, and a clap with one hand counts as nothing. A hand may instead <strong>stab</strong> with the knife (one point of damage, one stab a turn) or do <strong>nothing</strong>. Neither belongs to any spell, so a hand that stabs or rests starts its next spell from scratch.</p>
 		<p>A spell is a run of gestures made on consecutive turns by one hand. In the notation, a bracketed lower-case letter such as <strong>(w</strong> means that gesture made with both hands at once.</p>
 		<p>Both palms at once is <strong>surrender</strong>. It is not a spell and it ends the duel.</p>
 	</section>
 
 	<section id="overlap">
 		<h2>Overlapping spells</h2>
-		<p>A gesture can belong to more than one spell as long as each spell's run is unbroken. F-F-F is Paralysis; follow it with S-S-D-D and the last five gestures, F-S-S-D-D, are a Fireball. Another F after F-F-F is a second Paralysis. Each gesture can finish only one spell, so if two spells would end on the same gesture you choose one. Any finished spell may be let go harmlessly, except the storms, which rage wherever they are released.</p>
+		<p>A gesture can belong to more than one spell as long as each spell's run is unbroken. F-F-F is Paralysis. Follow it with S-S-D-D, and the last five gestures, F-S-S-D-D, are a Fireball. Another F after F-F-F is a second Paralysis. Each gesture can finish only one spell, so if two spells would end on the same gesture you choose one. Any finished spell may be let go harmlessly, except the storms, which rage wherever they are released.</p>
 	</section>
 
 	<section id="targets">
 		<h2>Targets and timing</h2>
-		<p>Every spell has a subject. Protection and summons are usually cast on yourself; attacks and enchantments on your opponent; but any spell may be aimed at any wizard or monster, and a spell aimed at something that no longer exists is lost.</p>
+		<p>Every spell has a subject. Protection and summons are usually cast on yourself, and attacks and enchantments on an opponent, but any spell may be aimed at any wizard or monster, and a spell aimed at something that no longer exists is lost.</p>
 		<p>Because everything is simultaneous, a monster killed the turn it appears still attacks that turn, a Resist heat cast in the same turn as a Fireball saves you, and a Remove enchantment cast in the same turn as a Fireball leaves you burned. <strong>Counter-spell</strong> stops every other spell cast at its subject that turn, except Finger of death and Dispel magic. <strong>Dispel magic</strong> stops every spell on the field, ends every enchantment and unmakes every monster after it attacks.</p>
 	</section>
 
@@ -110,7 +110,7 @@
 
 	<section id="winning">
 		<h2>Winning</h2>
-		<p>Each wizard has fifteen hit points and dies on losing them all. If both die in the same turn the duel is a draw. Surrender loses, unless the surrendering wizard's last gestures also killed the opponent.</p>
+		<p>Each wizard has fifteen hit points and dies on losing them all. The last wizard standing wins. If the last wizards standing all die in the same turn, the duel is a draw. Surrender loses, unless the surrendering wizard's last gestures also killed the last opponent.</p>
 	</section>
 
 	<section id="spells">

src/routes/rules/+page.ts

@@ -0,0 +1,3 @@
+// The page is text that reads the same for everyone, so it is rendered at build time and served whole;
+// the browser-only state it shows (held seats, the saved name) fills in once the script runs.
+export const ssr = true;

static/family.json

@@ -0,0 +1,46 @@
+{
+  "family": "Kestrel's Hall",
+  "hall": "https://gamehall.kestrelsnest.social",
+  "games": [
+    {
+      "slug": "wizwar",
+      "name": "Wiz-War",
+      "url": "https://wizwar.kestrelsnest.social",
+      "pitch": "Steal treasure. Blast through walls. Outwit your friends.",
+      "players": "2 to 6",
+      "origin": "Tom Jolly's board game, sixth edition, 1993"
+    },
+    {
+      "slug": "waving-hands",
+      "name": "Waving Hands",
+      "url": "https://hands.kestrelsnest.social",
+      "pitch": "Wizards duel with their hands, and the right run of gestures is a spell.",
+      "players": "2 to 12",
+      "origin": "Richard Bartle's pencil-and-paper duel, 1977"
+    },
+    {
+      "slug": "hnefatafl",
+      "name": "Hnefatafl",
+      "url": "https://tafl.kestrelsnest.social",
+      "pitch": "The Viking board game of a king breaking for safety and a ring of attackers closing in.",
+      "players": "2",
+      "origin": "the Norse tafl game, reconstructed from Linnaeus's 1732 notes; Copenhagen rules or Tablut"
+    },
+    {
+      "slug": "dip",
+      "name": "Dip",
+      "url": "https://dip.kestrelsnest.social",
+      "pitch": "Seven powers share one map, and none of them has to keep its word.",
+      "players": "2 to 10, depending on the map",
+      "origin": "Allan B. Calhamer's Diplomacy, 1959; an unofficial rebuild"
+    },
+    {
+      "slug": "wyrm",
+      "name": "Wyrm",
+      "url": "https://wyrm.kestrelsnest.social",
+      "pitch": "Chess on three boards, with a Dragon in the air above your King and a Basilisk in the earth below.",
+      "players": "2",
+      "origin": "Gary Gygax's Dragonchess, Dragon Magazine No. 100, 1985; an unofficial rebuild"
+    }
+  ]
+}

vite.config.ts

@@ -11,7 +11,9 @@ export default defineConfig({
 					filename.split(/[/\\]/).includes('node_modules') ? undefined : true
 			},
 			// A static build: the duel runs entirely in the browser, so Caddy serves files and nothing else.
-			adapter: adapter({ fallback: 'index.html' })
+			// The fallback is the empty shell Caddy serves for a room address; it is not index.html, so the
+			// hall's own prerendered page is not overwritten by it.
+			adapter: adapter({ fallback: 'shell.html' })
 		})
 	],
 	server: {
@@ -22,6 +24,6 @@ export default defineConfig({
 		}
 	},
 	test: {
-		include: ['src/**/*.test.ts']
+		include: ['src/**/*.test.ts', 'server/src/**/*.test.ts']
 	}
 });