Credibility pass: the accretion sanded smooth

Blind reviews over d2b40ec..HEAD (engine / web / server+deploy). Orphaned
doc comments rejoined their functions; the swap-meet tradables collapsed
from four pasted deriveds to one (killing the "the's treasure" label);
FEAR's aura and banner now share the engine's own dreadDistance; the
long-press peek got one home; rulebook.ts stopped wearing JSON quotes;
process-named tests and war-story comments now state the constraints they
pin; the protocol doc caught up to its handlers; verify-ledgers.sh can
actually count failures; the runbook learned about the determinism gate
and the nightly backups. No behavior changes — 255 tests and all 48
production ledgers replay identically.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

deploy/README.md

@@ -23,6 +23,14 @@ research), installs dependencies on the droplet, and restarts the service.
 Games in progress survive: state lives in room files, and clients reconnect
 automatically.
 
+Before any deploy that touches the engine, run the determinism gate:
+
+    deploy/verify-ledgers.sh 104.236.96.198
+
+It fetches every production ledger and strictly replays it against the local
+engine; a single refused command fails the check. A room whose ledger no
+longer replays becomes unreachable after restart, so this is not optional.
+
 ## New droplet from scratch
 
 1. `doctl compute droplet create wizwar --region nyc3 --size s-1vcpu-1gb \
@@ -35,4 +43,10 @@ automatically.
 
 - Logs: `ssh root@<ip> journalctl -u wizwar -f`
 - Restart: `ssh root@<ip> systemctl restart wizwar`
-- Backup games: `scp -r root@<ip>:/var/lib/wizwar/rooms ./rooms-backup`
+- Nightly backups: `wizwar-backup.sh` runs from root's crontab at 07:17 UTC,
+  pushing /var/lib/wizwar to the `kestrel-wizwar-backups` Space (nyc3) via
+  rclone. It is installed at /usr/local/bin/wizwar-backup.sh on the droplet;
+  `setup-droplet.sh` does NOT install it — on a fresh droplet, copy the
+  script, configure rclone (the script refuses to run while the config still
+  holds its CHANGE_ME placeholder), and add the cron entry by hand.
+- One-off backup: `scp -r root@<ip>:/var/lib/wizwar/rooms ./rooms-backup`

deploy/verify-ledgers.sh

@@ -9,9 +9,11 @@ trap 'rm -rf "$TMP"' EXIT
 scp -q "root@$HOST:/var/lib/wizwar/rooms/*.jsonl" "$TMP/"
 fails=0
 for f in "$TMP"/*.jsonl; do
-  out=$(npx tsx deploy/replay-verify.mjs "$f" 2>&1 | tail -1)
+  # `|| true`: a failing replay must feed the tally, not abort the loop.
+  out=$(npx tsx deploy/replay-verify.mjs "$f" 2>&1 | tail -1) || true
   case "$out" in
-    FAIL*) echo "$out"; fails=$((fails+1));;
+    OK*) ;;
+    *) echo "${out:-$(basename "$f"): replay crashed with no output}"; fails=$((fails+1));;
   esac
 done
 count=$(ls "$TMP" | wc -l | tr -d ' ')