Wordle module, cross-language tests, and the deploy path

The browser engine is a port of the Python one and CI proves it: all 21.2M
(guess, answer) pairs hashed on both sides to the same SHA-256. Six TS tests,
including the duplicate-letter table and the twelve pinned seed vectors that
keep ?seed= permalinks pointing at the same word the recording used.

Word lists are split by how they are used. answers.json is inlined because the
board needs it before first paint to turn a seed into a word, and a fetch there
means a visibly empty board on a cold cache. guesses.json is fetched, because it
is three times larger and only needed the first time somebody presses Enter;
until it lands, validation falls back to the answer list, which accepts strictly
fewer words. The failure mode is 'your real word was briefly rejected', not 'a
non-word was accepted' — the right way round.

The solver runs in a worker constructed from a same-origin module URL, never
Vite's ?worker&inline: that yields a blob:, and production CSP has no
worker-src, so it falls back to default-src 'self' and the worker is blocked
with no console error. It would fail in production only.

deploy.sh smoke-tests the real public hostname from the deploying machine and
fails on a body under 1 kB, because the bind bug's signature is a valid
certificate over an empty 200 and a local --resolve check passes anyway.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019mt6sHQHEnEYrJZvoMCJSB

deploy/deploy.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Ship dist/ to cloud-2.
+#
+# Run from a machine on the tailnet (cloud-2's :22 is tailnet-only, which is
+# also why a GitHub-hosted runner cannot do this).
+#
+#   bash deploy/deploy.sh
+#
+# Keeps the last 10 releases as hard-linked snapshots, so a rollback is a
+# directory rename rather than a rebuild.
+set -euo pipefail
+
+HOST="${PIG_DEMO_HOST:-ubuntu@100.92.185.76}"
+ROOT="/var/www/demo.primeintellectgrowth.com"
+SNAPS="${ROOT}-rollbacks"
+URL="https://demo.primeintellectgrowth.com"
+
+cd "$(dirname "$0")/.."
+
+[ -d dist ] || { echo "no dist/ — run 'pnpm build' first"; exit 1; }
+[ -f dist/index.html ] || { echo "dist/index.html missing"; exit 1; }
+# The prerender pass is what makes shared links preview correctly. A dist
+# without it builds and serves fine, which is exactly why it needs asserting.
+[ -f dist/404.html ] || { echo "dist/404.html missing — did prerender run?"; exit 1; }
+
+echo "==> preflight on ${HOST}"
+ssh "$HOST" "set -e
+  free=\$(df --output=avail -BG / | tail -1 | tr -dc 0-9)
+  [ \"\$free\" -ge 3 ] || { echo \"only \${free}G free on /\"; exit 1; }
+  mkdir -p '$SNAPS'
+  if [ -d '$ROOT' ] && [ -n \"\$(ls -A '$ROOT' 2>/dev/null)\" ]; then
+    cp -al '$ROOT' '$SNAPS/\$(date +%Y%m%d-%H%M%S)'
+  fi
+  ls -1dt '$SNAPS'/*/ 2>/dev/null | tail -n +11 | xargs -r rm -rf"
+
+echo "==> rsync"
+rsync -az --delete --checksum dist/ "$HOST:$ROOT/"
+
+echo "==> smoke test against the public hostname"
+# Against the real name from THIS machine, never --resolve from cloud-2: a
+# missing `bind 10.0.0.2` in the Caddy block serves an empty 200 to the
+# internet while a local --resolve check still passes.
+code=$(curl -sS -o /tmp/pigdemo-smoke.html -w '%{http_code}' --max-time 30 "$URL/")
+size=$(wc -c < /tmp/pigdemo-smoke.html)
+echo "    / -> $code, ${size}b"
+[ "$code" = "200" ] || { echo "FAILED: / returned $code"; exit 1; }
+[ "$size" -gt 1000 ] || { echo "FAILED: / is ${size}b — almost certainly the empty-200 bind bug"; exit 1; }
+grep -q '<div id="root"' /tmp/pigdemo-smoke.html || { echo "FAILED: no app root in the HTML"; exit 1; }
+
+demo=$(curl -sS -o /tmp/pigdemo-demo.html -w '%{http_code}' --max-time 30 "$URL/demos/wordle")
+echo "    /demos/wordle -> $demo"
+[ "$demo" = "200" ] || { echo "FAILED: demo route returned $demo"; exit 1; }
+grep -q 'og:title' /tmp/pigdemo-demo.html || { echo "FAILED: demo route has no baked og tags"; exit 1; }
+
+missing=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 30 "$URL/nope-not-a-page")
+echo "    /nope-not-a-page -> $missing"
+[ "$missing" = "404" ] || { echo "WARNING: unknown path returned $missing, expected 404"; }
+
+echo "==> live: $URL"