Credibility pass: comments say what the code can't, and the seams are gone

Engine: pit-rim exits live in one helper (pitRimExits) shared by the
resolver and the automaton; chargeReach names the six-stride cap; dust
sight is inDust + dustAtEnd; PushPending is exported once; the force-field
counter builds its events in one list; drawUnderSlowDeath says what it
draws under. Test groups are named for the rule they pin, not the
revision that introduced it.

Client: one smoothstep; one edgeScar per battle-scarred edge; one
board-zone rule (which also seats the caption strip on phones); the
compass names live in SIDE_NAMES; net.flash() is the one toast; MediaQuery
replaces two hand-rolled matchMedia listeners; sprites carry their sizes
as plain numbers and their CSS in one rule each; canvas helpers are
formatted like the rest of the tree. Comments that told how a cel or a
fallback used to look now say what it draws. The actions-over notice no
longer blames a pickup when slime ended the turn.

Server and ops: dataRoot() is the one data directory; headlineOf builds
its deeds without a cast; the rollup and skills read the same way the
code behaves.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jm2auWk6RP71CjaAb4FMoG

deploy/wizwar-rollup.sh

@@ -4,22 +4,26 @@
 # the room ledgers, stats.json and feedback.jsonl), and the box's vitals.
 # Counts only: no addresses are kept. The pulse reads it for trends the
 # self-rotating access log cannot keep. Referrers are what browsers send
-# (Reddit and BGG send none); campaigns are the ?ref=<name> tags on links
-# Eric posts, one count per address per day, plus Facebook's fbclid.
-#   Cron: 10 0 * * * (UTC), see /etc/cron.d/wizwar-rollup (deploy.sh installs both).
+# (Reddit and BGG send none); campaigns are the tags a link itself carries
+# — ?ref=<name> on a link Eric posts, a utm_source, or Facebook's fbclid —
+# one count per address per day.
+#   Cron: see SCHEDULE below and /etc/cron.d/wizwar-rollup (deploy.sh installs both).
 #   Sentry Crons check-in: /root/.wizwar-sentry-cron-rollup holds the URL
 #   (absent = no check-ins).
 set -u
 OUT="/var/lib/wizwar/rollup.jsonl"
 LOG="/var/log/wizwar/rollup.log"
 DAY="${1:-$(date -u -d 'yesterday' +%Y-%m-%d)}"
+# The crontab line, as /etc/cron.d/wizwar-rollup spells it: the Sentry
+# monitor is told the same shape, so a missed night is noticed.
+SCHEDULE="10 0 * * *"
 CRON_URL=$(cat /root/.wizwar-sentry-cron-rollup 2>/dev/null || true)
 # The check-in carries the schedule: Sentry only keeps a monitor it has
 # been told the shape of, and a bare ping to an unknown slug is accepted
 # and dropped without a word.
 checkin() {
   [ -n "$CRON_URL" ] && curl -sf -o /dev/null -X POST -H "Content-Type: application/json" \
-    -d "{\"status\":\"$1\",\"monitor_config\":{\"schedule\":{\"type\":\"crontab\",\"value\":\"10 0 * * *\"},\"checkin_margin\":30,\"max_runtime\":10,\"timezone\":\"UTC\"}}" \
+    -d "{\"status\":\"$1\",\"monitor_config\":{\"schedule\":{\"type\":\"crontab\",\"value\":\"$SCHEDULE\"},\"checkin_margin\":30,\"max_runtime\":10,\"timezone\":\"UTC\"}}" \
     "$CRON_URL" || true
 }
 
@@ -31,7 +35,9 @@ d0 = datetime.datetime.fromisoformat(day).replace(tzinfo=datetime.timezone.utc)
 t0, t1 = d0.timestamp(), (d0 + datetime.timedelta(days=1)).timestamp()
 BOT = ("bot", "crawl", "spider", "facebookexternalhit", "slack", "discord", "twitter", "preview", "curl", "python", "go-http", "wget", "headless")
 
-# --- traffic: every access log file touched since the day began ---
+# --- traffic: every access log file touched since the day began. Address
+# and request counts split people from bots; the path mix and referrers
+# count people only. ---
 req = 0; human = 0; bot = 0; hips = set(); bips = set()
 paths = collections.Counter(); status = collections.Counter(); refs = collections.Counter(); ws = 0
 # Where a visit came from, when the link itself says so: ?ref=<name> on a
@@ -63,15 +69,15 @@ for f in sorted(glob.glob("/var/lib/caddy/access*.log*")):
             key = ("/clips" if uri.startswith("/clips") else "/watch" if uri.startswith("/watch")
                    else "(assets)" if uri.startswith("/assets") or re.search(r"\.(png|jpg|svg|ico|css|js|webmanifest|mp4)$", uri)
                    else uri if uri in ("/", "/ws", "/robots.txt") else "(other)")
-            if not isbot: paths[key] += 1  # the path mix is what people looked at
+            if not isbot: paths[key] += 1
             status[str(r.get("status", 0))[0] + "xx"] += 1
             ref = " ".join(h.get("Referer", [""]))
             m = re.match(r"https?://([^/]+)", ref)
             host = m.group(1) if m else ""
             ours = host.endswith("kestrelsnest.social") or "104.236.96.198" in host
-            # A referrer on /.env is a scanner's costume (a forged google.com),
-            # not a reader — and the app answers unknown paths with the page,
-            # so the status cannot tell them apart. Only the pages count.
+            # Scanners forge referrers on paths like /.env, and the app answers
+            # unknown paths with the page itself, so the status cannot tell a
+            # probe from a reader. Only the pages count.
             if host and not ours and not isbot and key in ("/", "/clips", "/watch"): refs[host] += 1
 
 # --- the table ---
@@ -107,7 +113,7 @@ except OSError: pass
 # --- vitals (now, at rollup time) ---
 def sh(cmd):
     try: return subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=20).stdout.strip()
-    except Exception: return ""
+    except Exception: return "?"
 mem = sh("systemctl show wizwar -p MemoryCurrent --value"); peak = sh("systemctl show wizwar -p MemoryPeak --value")
 disk = sh("df --output=pcent / | tail -1").strip().rstrip("%")
 load = sh("cut -d' ' -f1 /proc/loadavg")