Credibility pass: one voice, no scars

A three-reviewer sweep for tells of piecemeal machine generation,
every finding verified against the code before touching it. No
behavior changes; the full suite passes unchanged (plus two
strengthened pins).

Engine: removed four void-silenced fossils (a parseEdgeKey call
voided where it stood, stoneEffect's ignored cardId parameter, the
actualTarget remnant in doCast, a voided loop variable in shadow
upkeep); fixed the initialize-then-overwrite narration in
spawnCreature; replaced a filter(() => false) no-op; waterwall now
rides waveFromEdge instead of carrying its own verbatim copy (and the
single-caller washBack wrapper went with it); blind wall-bumps and
LOS blockers each collapsed to one implementation; the wand-id list
and the "permanent" duration sentinel became named constants; the
ambush number local no longer shadows the imported numberValue
function; assorted reviewer-aimed phrasings rewritten as the
constraints they guard.

Server/deploy: the protocol header now documents all eleven message
types; dropped an eslint pragma with no eslint, a test script with no
tests, and an rsync exclude anchored at a path that never existed
(the real data/ dir now excluded); the Caddy vhost has one source of
truth; stale "pending DNS" note removed — the record resolves.

Web: ~90 lines of CSS swallowed verbatim into a mobile media query
deduplicated; the reduced-motion guard on the board now actually
stops the marked-cell pulse; one shared color module replaces two
drifted palettes; an orphaned doc comment rejoined its function.

Tests: the ten-times-pasted helper block became test/helpers.ts;
wave-numbered files renamed for the behaviors they pin; deliberation
comments and void-ed corpses of unwritten assertions deleted; silent
seed-dependent early-returns now fail loudly; one assertion that
compared a value to itself now pins the home-translation it meant to;
the stored-log single-number command form gained the explicit
compatibility test it deserved.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/README.md

@@ -8,7 +8,7 @@ survive deploys and reboots.
 ## Current production
 
 - Droplet: `wizwar` (nyc3, s-1vcpu-1gb, tag `wizwar`), IP 104.236.96.198
-- URLs: https://wizwar.kestrelsnest.social (once the Hover A record lands)
+- URLs: https://wizwar.kestrelsnest.social
   and https://wizwar.104.236.96.198.sslip.io (always works, zero DNS).
   Caddy serves both; NOTE: kestrelsnest.social's authoritative DNS is at
   HOVER (ns1/ns2.hover.com), not DigitalOcean — records must be added there.
@@ -18,7 +18,7 @@ survive deploys and reboots.
 
     deploy/deploy.sh 104.236.96.198
 
-Builds the client locally, rsyncs the repo (minus node_modules, /data, .git,
+Builds the client locally, rsyncs the repo (minus node_modules, data/, .git,
 research), installs dependencies on the droplet, and restarts the service.
 Games in progress survive: state lives in room files, and clients reconnect
 automatically.