One player sees a hidden spot on a 0–10 spectrum and writes one short clue that lands on it. Everyone else guesses where. Points for getting close — and the clue-giver earns the average of everyone else's points, so a vague clue costs you.
Three ways to play: one phone passed around the room, apart on everyone's own phone joined by a four-character code, or solo against ten authored clues, offline.
One Node process serves the built client and the WebSocket on the same origin in production, with a real Content-Security-Policy the test suite exercises rather than a relaxed development one.
Worth knowing
The leak assertion
The test that matters captures every WebSocket frame a guesser's socket receives and proves the target is in none of them before the reveal — with a positive control that the recorder actually recorded, and a mutation guard that the same search does find the target once the round is over. Redaction that is merely intended is not redaction.
Eight accessibility checks that no headless browser can prove
The suite covers the live region, focus-to-heading, the dial's accessible name and an axe sweep — but automation cannot tell you whether the live region actually speaks. Eight load-bearing checks are documented to be run on a real iPhone in Safari with VoiceOver on before each release, including the highest-risk item in the build: whether Safari maps role="slider" on an SVG root, and the six-line fix if it does not.
The protocol tests go at raw sockets
Every error code, rotation over two passes, clamping, the frame cap, rate limiting through to the close, host migration, the reconnect fence and the excluded-player arithmetic — driven at the wire rather than through the UI.
Screens
