Removes operator-private material from the shipped tree, corrects documentation
that had drifted from the code, deletes dead code, and applies a consistent
prose style.
Private material moved out of the public tree (docs/private/, git-ignored):
- the wallet keyfile recovery runbook and its helper scripts, which together
published the mainnet wallet file path, the service account, backup snapshot
filenames, and the wallet RPC listener state. The helper duplicated the same
constants, so relocating the document alone would not have removed them.
- the stagenet parallel-candidate runbook and its fixtures.
- the dated production-state record, the internal remediation plan, and the
TODO list. None are reference documentation for an outside reader.
Redacted or genericised:
- operator home-directory paths in shipped scripts and units. The asset build
script now takes KENNEY_ASSETS_DIR instead of a hard-coded path.
- private LAN addresses in tests, env examples and deploy docs, replaced with
RFC 5737 documentation addresses.
- the default alert sender and the notification hub example.
- the Monero wallet unit now matches the Wownero one: a dedicated service
account and a config file, instead of the operator's login account with the
wallet password in argv where any local user can read it from /proc.
Ignore rules now cover every .env variant rather than the bare name, plus local
agent state. The deployment docs instruct operators to create .env.mainnet and
.env.stagenet, which the exact-name rule would have allowed to be committed.
Documentation corrected against the code: per-chain dungeon level counts, the
premium unlock rule, Tavern chat scope, backup retention, the chain-profile
fallback, the environment template location, and several sections describing
shipped work as pending.
Dead code removed: configPersistence, rpccalls, a duplicate vendored ROT.js
bundle, the unused tile-picker overlay, the unreachable legacy game-size path
and its vestigial parameter, spectator stubs that shadowed the real
SpectatorManager, and commented-out debugging. nip98 now imports the shared
nostr loader rather than duplicating it.
Prose style: em-dashes removed throughout in favour of colons, semicolons and
commas; comments restated as present-tense descriptions of the code rather than
narration of past changes.
127 suites / 1015 tests pass.
Closes the two findings left open from the pre-launch review.
Node redundancy (it was node reachability, not chain health)
RPC_ENDPOINTS accepts any number of daemons in preference order; PRIMARY /
FALLBACK still work and are appended. The list is deduplicated, which exposes
that the stock config pointed both at the SAME host — what looked like
redundancy was one node.
One logical call now walks every endpoint before failing, instead of needing
three consecutive failures to try exactly one alternate. Each node still has
to pass the chain-identity check before it may answer, so failover cannot
silently serve another chain's data. `failoverActive` is no longer a one-way
latch: the preferred node is re-tested every RPC_PREFERRED_RETRY_MS, so
recovery no longer requires a restart. healthCheck probes every node.
Graceful failure
Entries are refused while no node is reachable. A run is measured in blocks
and its entry block comes from the last successful poll, so a game admitted
during an outage was anchored to an already-past block and killed as a timeout
on the first recovered poll — the player lost a run, and in paid mode an
entry, to our infrastructure. The gate sits in _runAdmission, ahead of any
credit spend, and says so to the player.
Wallet: refused, not failed over
Two wallet-rpc processes over one wallet file can build transactions from the
same outputs and corrupt the cache. A standby wallet is a custody decision for
the operator, not something this code may take on its own — daemons are
read-only and interchangeable, wallets are neither. So a wallet outage
declines paid intake cleanly and leaves credits and free play working.
Auth limiter evicts instead of refusing
The bounded key map 429'd any NEW ip once full, turning a memory cap into a
DoS primitive: a distributed source could hold it at capacity and lock every
first-time caller out of Smirk login. It now reclaims expired entries and, if
still full, evicts the oldest live windows. Same memory ceiling, still a
working limiter.
129 suites / 1026 tests pass.
jwinterm