Credibility pass: one voice, no scars

A three-reviewer sweep for tells of piecemeal machine generation,
every finding verified against the code before touching it. No
behavior changes; the full suite passes unchanged (plus two
strengthened pins).

Engine: removed four void-silenced fossils (a parseEdgeKey call
voided where it stood, stoneEffect's ignored cardId parameter, the
actualTarget remnant in doCast, a voided loop variable in shadow
upkeep); fixed the initialize-then-overwrite narration in
spawnCreature; replaced a filter(() => false) no-op; waterwall now
rides waveFromEdge instead of carrying its own verbatim copy (and the
single-caller washBack wrapper went with it); blind wall-bumps and
LOS blockers each collapsed to one implementation; the wand-id list
and the "permanent" duration sentinel became named constants; the
ambush number local no longer shadows the imported numberValue
function; assorted reviewer-aimed phrasings rewritten as the
constraints they guard.

Server/deploy: the protocol header now documents all eleven message
types; dropped an eslint pragma with no eslint, a test script with no
tests, and an rsync exclude anchored at a path that never existed
(the real data/ dir now excluded); the Caddy vhost has one source of
truth; stale "pending DNS" note removed — the record resolves.

Web: ~90 lines of CSS swallowed verbatim into a mobile media query
deduplicated; the reduced-motion guard on the board now actually
stops the marked-cell pulse; one shared color module replaces two
drifted palettes; an orphaned doc comment rejoined its function.

Tests: the ten-times-pasted helper block became test/helpers.ts;
wave-numbered files renamed for the behaviors they pin; deliberation
comments and void-ed corpses of unwritten assertions deleted; silent
seed-dependent early-returns now fail loudly; one assertion that
compared a value to itself now pins the home-translation it meant to;
the stored-log single-number command form gained the explicit
compatibility test it deserved.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/Caddyfile

@@ -1,12 +0,0 @@
-# Caddy terminates TLS (automatic certificates) and proxies to the game.
-# Replace the hostname with your domain, or use the sslip.io form
-# (wizwar.<droplet-ip>.sslip.io) for zero DNS setup.
-{$WIZWAR_HOST}
-
-header {
-	Strict-Transport-Security "max-age=31536000"
-	X-Content-Type-Options "nosniff"
-	X-Frame-Options "DENY"
-	Referrer-Policy "no-referrer"
-}
-reverse_proxy localhost:8787

deploy/README.md

@@ -8,7 +8,7 @@ survive deploys and reboots.
 ## Current production
 
 - Droplet: `wizwar` (nyc3, s-1vcpu-1gb, tag `wizwar`), IP 104.236.96.198
-- URLs: https://wizwar.kestrelsnest.social (once the Hover A record lands)
+- URLs: https://wizwar.kestrelsnest.social
   and https://wizwar.104.236.96.198.sslip.io (always works, zero DNS).
   Caddy serves both; NOTE: kestrelsnest.social's authoritative DNS is at
   HOVER (ns1/ns2.hover.com), not DigitalOcean — records must be added there.
@@ -18,7 +18,7 @@ survive deploys and reboots.
 
     deploy/deploy.sh 104.236.96.198
 
-Builds the client locally, rsyncs the repo (minus node_modules, /data, .git,
+Builds the client locally, rsyncs the repo (minus node_modules, data/, .git,
 research), installs dependencies on the droplet, and restarts the service.
 Games in progress survive: state lives in room files, and clients reconnect
 automatically.

deploy/deploy.sh

@@ -5,7 +5,7 @@ HOST="${1:?usage: deploy.sh <droplet-ip-or-host>}"
 
 npm run build --workspace=@wizwar/web
 rsync -az --delete \
-  --exclude node_modules --exclude /data --exclude .git --exclude research \
+  --exclude node_modules --exclude data/ --exclude .git --exclude research \
   ./ "root@$HOST:/opt/wizwar/"
 ssh "root@$HOST" '
   cd /opt/wizwar && npm install --no-audit --no-fund

deploy/setup-droplet.sh

@@ -24,7 +24,7 @@ id -u wizwar &>/dev/null || useradd -r -m -d /opt/wizwar-home wizwar
 mkdir -p /opt/wizwar /var/lib/wizwar/rooms
 chown -R wizwar:wizwar /opt/wizwar /var/lib/wizwar
 
-# Caddy vhost (security headers included; see deploy/Caddyfile for the template)
+# Caddy vhost: auto-TLS, security headers, proxy to the game.
 printf '%s\n\nheader {\n\tStrict-Transport-Security "max-age=31536000"\n\tX-Content-Type-Options "nosniff"\n\tX-Frame-Options "DENY"\n\tReferrer-Policy "no-referrer"\n}\nreverse_proxy localhost:8787\n' "$HOST" > /etc/caddy/Caddyfile
 systemctl reload caddy