A seat line now carries the SHA-256 of its token, compared in constant time; the token itself goes once to the browser that earned it. Ledgers written before this are read once more by their raw token, and deploy/hash-tokens.ts rewrites them in place. Each submitted move is its own ledger line, so a half-written turn survives a restart. A room code is never reissued over an evicted room's ledger. Only the host seats a bot. The deploy gate compares against the gallery view, so no token leaves the ledger for it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up