a fixed stage for the game, and close the VNC port nobody meant to open

── the stage ──

The framebuffer is now the picture. 800x600 whatever the difficulty, the game
centred in it by the sidecar, and the panel draws it entire — scaled to fit,
centred by its flex parent, never cropped. Changing difficulty moves the board
instead of resizing the panel.

What this replaces parked the window at the origin and had the client crop to
the window's size, polled every four seconds. Two things wrong with it. The
panel resized under the player mid-game; and wine puts the window at 3,29
rather than 0,0, so cropping from the origin showed a black strip on top and
cut a row of cells off the bottom — the "expert gets cut off" report.

Centring runs on a one-second timer because nothing announces a resize: not
RFB, which keeps the framebuffer, and not X without a window manager to listen
through. One chained `xdotool search … getwindowgeometry` per tick, one
process, and a `windowmove` only when the numbers actually changed.

The client loses the geometry poll, the offscreen canvas and the crop with it.

── the port ──

x11vnc was listening on 0.0.0.0:5900 and [::]:5900 with -nopw. Every account
on this machine, every device on the tailnet and everything on the LAN could
open it and take the display — which is precisely the hole the 5907 version
was replaced to close, reopened wider and documented as impossible.

`-unixsock` ADDS a unix socket. It does not remove the TCP one. Three flags do:
-rfbport 0 for IPv4, -rfbportv6 0 for IPv6, -noipv6 for outgoing. `-rfbport 0`
alone leaves [::]:5900 up, which is how this nearly shipped half-fixed.

Found with `ss -lntp` on the running process, and that is the only check that
was right about it at any point. Running the same argv by hand showed no IPv6
listener — most likely because the PM2 session still held [::]:5900 and the
hand-run copy failed to bind it silently. Comments in session.ts and index.ts
that asserted there was no port are corrected rather than deleted.

Verified on the live socket: the streamed framebuffer is 447k teal pixels
around a 152x214 window at 324,193 — dead centre — and window grey arrives as
c0 c0 c0, no TCP listener for the x11vnc pid.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: de3ed4e6-f88a-429c-94e6-a760336ba83b

sidecar/index.ts

@@ -29,9 +29,13 @@ import { isRunning, start, status, stop } from './session';
   ─────────────────────────────────────────────────────────────────────────────────────────────────
   WHAT REACHES x11vnc
 
-  Nothing but this file. x11vnc binds a socket inside a mode-0700 directory and has no port at all, so the
-  kernel refuses every other account before any credential could be checked. That is why `-nopw` is right
-  rather than lazy — see the block comment in `session.ts` where it is spawned.
+  Nothing but this file. x11vnc binds a socket inside a mode-0700 directory, so the kernel refuses every
+  other account before any credential could be checked. That is why `-nopw` is right rather than lazy —
+  see the block comment in `session.ts` where it is spawned.
+
+  This paragraph used to end "and has no port at all", and that was false for as long as it existed:
+  `-unixsock` ADDS a unix socket, it does not remove the TCP listener, so x11vnc was on 0.0.0.0:5900 with
+  no password. `-rfbport 0` is what makes the sentence true, and it is in `session.ts` for that reason.
 
   This listener is loopback and unauthenticated, exactly like every other sidecar in the fleet; the platform
   is the authenticator and `X-Officer-User` is how a request proves it came through one.