Brief: EO Nashville Arcade + colton.land

# BRIEF: EO Nashville Arcade + colton.land redesign

Written 2026-08-09, evening CT, by a Sonnet session on Calvin after Colton pulled the plug on
letting Sonnet keep building and asked for a full handoff brief for a fresh Fable 5 session to
take over end to end. Everything below is verified against the live site and the actual repo,
not recalled from memory. Read this whole file before touching anything: the repo already has a
partial build in it, and re-deriving the plan from scratch will re-break what's already fixed.

## Colton's own words, lightly cleaned up (the source ask, keep the voice)

Colton wants colton.land turned into "a public facing entity that shows off the cool stuff
I've built and doesn't reference the partnerships or any of that." The premise: this is the
sandbox where Colton goes to create things and invite his friends. Keep the running joke that
it's the worst theme park you could ever visit. Two top-level pieces, both wanted live the same
day this brief was written:

1. **The EO Nashville Arcade**, at `colton.land/eo-nashville/arcade/`, mirroring everything the
real Wilcoxson House Arcade does. Anybody can play, zero vetting. They enter their real first
and last name (both required, so people know who's who) and can optionally set a nickname.
Clicking a leaderboard entry opens a profile page showing that person's real name, nickname,
and stats. Below the games: leaderboards and stats. Explicit honor-system language up top:
there is real pace/score-cap checking running server-side to flag suspicious runs for human
review, you can use AI to help you think up strategy beforehand, but every tap, click,
keystroke, and mouse movement during a run has to be an actual human hand, or Colton may
suspend you and revoke your "tickets." Full stop.
2. **A full colton.land redesign.** Current homepage is cluttered, especially on mobile, no
clear menu structure. Colton wants it to follow the Forum Playbook site's clean nav pattern.
Keep the design-skin switcher (it already has one: brutalist/luxury/terminal/newspaper/
default). The point of the whole redesign is a low-key flex of everything Colton's built:
each property gets a card with a screenshot, a short caption underneath, and a public/private
or live/concept tag, similar spirit to the Inspiration Repository's card layout, but tighter
and cleaner. Sortable/filterable. Bottom of the page needs a call to action, roughly:
"Since falling in love with Fable, Colton's building things at a pace that's honestly a
little fast, whatever he thinks is fun, interesting, connects people, or teaches something.
If you want to talk about building something with him, this is the place to start. If it's
fun, he might just collaborate with you. Somebody's probably going to have to pay somebody at
some point though." He explicitly walked back wanting a formal "qualifies them to call FoxFuel
Creative as an agency" pitch, keep it to the casual version above.

**Phase 3, explicitly deferred by Colton himself, do not start until he asks for it in chunks:**
reskin cards for his other live tools with FAKE/dummy data so they're safe to show publicly. He
named one example: the "Can I Retire Early" dashboard, which is built off his and Aly's real
Truthifi financial tracker data and currently is NOT safe to publish as-is (real numbers). There
will be more than just that one; he said "all that stuff I've built" without enumerating it, so
when this phase starts, inventory Colton's live properties with real/private data before
proposing a card list rather than guessing.

## Current state, verified live, right now

- `colton.land` and `colton.land/eo-nashville/arcade/` both return 200, both still carry
`x-robots-tag: noindex, nofollow` (this whole site is deliberately noindex, keep it that way,
it is not a decision for this brief to revisit).
- The arcade FRONT END is live: 20 game cabinets, the launcher, and `leaderboard.html`, all
reachable and rendering (verified: `bros.html` title is "SUPER EO BROS.", `zelda.html` title
is "THE LEGEND OF EO NASHVILLE", both swept of Wilcoxson branding/injokes).
- **The arcade BACKEND is built and committed but NOT deployed. This is why name entry is
broken right now** (see Root Cause below). Colton saw this live and correctly flagged it as
not working.
- The colton.land homepage redesign has NOT started. One registry record was added
(`eo-nashville-arcade`, LIVE, links to the arcade) so the arcade is at least discoverable, but
the nav/layout/card-grid/CTA work described above is entirely undone. What Colton saw
("the home page still looks like garbage") is accurate and expected, nobody claimed otherwise.
- Repo: `/Users/calvin/work/colton-land/` (git, pushed to `git@github.com:coltonmul/colton-land.git`,
branch `main`, currently at commit `3f1806d`). This IS the live deploy source for colton.land.
Read `DEPLOY.md` in that repo before deploying anything: another machine may have deployed
since, and it has a live-vs-local hash check to run first.

## ROOT CAUSE of the broken name entry, and the fix (COLTON ACTION REQUIRED)

Calvin's standing `cf-token` (at `/Users/calvin/.local/share/calvin-agents/cf-token`, normally
used for every Cloudflare Pages deploy on this machine) turns out to be **scoped to Pages only**.
Verified directly against the live API this session:

```
GET /accounts/.../d1/database -> {"success":false,"errors":[{"code":10000,"message":"Authentication error"}]}
GET /accounts/.../storage/kv/namespaces -> {"success":false,"errors":[{"code":10000,"message":"Authentication error"}]}
```

So this session could deploy static files fine, but could not create the D1 database or KV
namespace the arcade backend needs. Rather than deploy a `wrangler.toml` pointing at
placeholder resource ids (which Cloudflare would reject, and which risks the live Pages project
if done wrong), the build stopped short: `functions/`, `wrangler.toml`, and `functions/schema.sql`
are all written and committed to git, just never deployed. Right now a POST to
`/api/eo-nashville/arcade/register` returns **405** (confirmed by curl), because there is no
Function live to answer it. That 405 is the "selecting a name isn't working" Colton hit.

**Whichever session picks this up: try to clear this yourself before asking Colton to click
anything.** If your session has real browser control (a Cowork desktop session with the Chrome
extension, or similar), log into dash.cloudflare.com yourself (colton@foxfuelcreative.com) and
widen the token: profile icon top right -> My Profile -> API Tokens -> the active token whose id
starts `fe790053a943922900c381a6c86797be` -> Edit -> add permissions **Account > D1 > Edit** and
**Account > Workers KV Storage > Edit** -> Continue to summary -> Update Token. No new token
value is issued by editing permissions, nothing else changes on disk.

**What this session actually tried, for the record, so the next one doesn't repeat it:** this
was a plain CLI session with no browser-control tool available at all (confirmed by searching
the full tool list), so driving the Cloudflare dashboard directly was not possible here. Ran
`npx wrangler login` as the lower-friction alternative instead: it printed a real OAuth URL with
the right scopes (`d1:write`, `workers_kv:write`, etc. all present) and started a local callback
listener on `localhost:8976`. That callback only completes if the browser that clicks Allow can
reach that exact port on Calvin, which means either physical/screen access to Calvin itself, or
Colton doing it from a browser already running on this Mac. Opening that URL from his phone or
the MacBook will not complete the login (the redirect has nowhere to land). Killed the attempt
rather than leave it hanging. Two real options remain:

- A session with actual browser control does the token-edit above itself, no Colton click at
all.
- Failing that, it is a genuine COLTON ACTION, and the token-edit path (not `wrangler login`) is
the one to hand him, since it works from any device, phone included, with zero dependency on
being at Calvin's screen:

**COLTON ACTION 8-9-A:** open https://dash.cloudflare.com on your phone or laptop, tap your
profile icon top right, tap **My Profile**, tap **API Tokens**, find the active token whose id
starts `fe790053a943922900c381a6c86797be`, tap **Edit**, add permissions **Account > D1 >
Edit** and **Account > Workers KV Storage > Edit**, tap **Continue to summary**, tap **Update
Token**.

Once either is done, two commands finish the backend (already written, just need real ids):

```
cd /Users/calvin/work/colton-land
npx wrangler d1 create colton-land-arcade # copy the returned database_id
npx wrangler kv namespace create REPLAYS # copy the returned id
```

Then edit `wrangler.toml` in that repo: replace both `REPLACE_ME_D1_DATABASE_ID` and
`REPLACE_ME_KV_NAMESPACE_ID` (each appears twice, once in the top-level block, once in
`[env.preview]`, must match). Apply the schema:

```
npx wrangler d1 execute colton-land-arcade --remote --file=functions/schema.sql
```

Then deploy (see DEPLOY.md for the exact command, refresh-from-live check first). Verify with
curl, not by trusting "deploy succeeded":

```
curl -s -X POST https://colton.land/api/eo-nashville/arcade/register \
-H "Content-Type: application/json" -d '{"first":"Test","last":"User"}'
```

A real JSON response (not 405, not an HTML page) means the backend is actually live.

## Architecture decisions already made this session (do not re-litigate without a reason)

- **No Google OAuth.** Identity is pure honor system: real first + last name required, nickname
optional, no login gate, no email, no vetting of any kind. This was a deliberate deviation
from the Wilcoxson House Arcade (which uses Google sign-in "for annoyance, not security")
because Colton explicitly said this whole thing runs on the honor system and framed identity
the same way.
- **Registration always creates a new player row**, never silently reclaims an existing name, so
two different "John Smith"s can never collide into one profile. Name collisions get a short
suffix.
- **Anti-cheat is server-side score caps + pace/rate limits per game**, mirrored from the real
Wilcoxson House engine (`/Users/calvin/work/wilcoxsonhouse/functions/_games.js`), NOT
published to the client, flags anomalies into a "pending" review status rather than silently
accepting or rejecting, admin rules one row at a time, nothing is ever deleted so every ruling
is reversible. The thresholds carried over unchanged from Wilcoxson (calibrated off each
game's own mechanics, not player history), reasonable starting point, revisit if EO Nashville
players' real score distributions look off once there's data.
- **API path convention:** `/api/eo-nashville/arcade/...` (not a bare `/api/arcade/...`), on
purpose, so this Pages project can host more than one arcade/tenant later (e.g. a second one
for a different chapter or friend group) off the same D1 database without a path collision.
D1 database name is `colton-land-arcade` (not `eo-nashville-arcade`) for the same forward-
looking reason: it is meant to be the one arcade database for anything hosted under
colton.land, scoped by a tenant/season-style column inside the tables, matching how Wilcoxson
itself does seasons. Don't rename it to something EO-Nashville-specific.
- **Reference source, read-only:** `/Users/calvin/work/wilcoxsonhouse/` is the real, live,
working arcade this was mirrored from. Its `functions/_games.js` comment block explains the
anti-cheat design philosophy in detail. Its `arcade/games-config.js` explains the game roster
and the League/Exhibition split. Read both before changing scoring logic.

## What's already built and where (repo: /Users/calvin/work/colton-land/)

```
eo-nashville/arcade/ 20 game HTML files, arcade.js, arcade.css, games-config.js,
index.html (launcher), leaderboard.html. Swept for Wilcoxson
branding/injokes; wordle.html and hangman.html word banks were
fully rewritten off personal lore, needs a human sanity check
that the new words are actually fun, nobody has playtested them.
functions/_shared.js HMAC pass helpers, ported from Wilcoxson's _shared.js.
functions/_games.js Game list + score caps/pace thresholds, ported from Wilcoxson.
functions/schema.sql D1 schema: players (dynamic, no fixed roster), scores (with a
pending/valid/rejected status column), config, identities-
equivalent. NOT YET APPLIED to any live database (see Root
Cause above).
functions/api/eo-nashville/arcade/
register.js Open self-registration by real name (the no-Google-OAuth path).
session.js, state.js Session pass check / current-state read.
score.js Score submission, applies the caps/pace check, writes pending
or valid.
history.js A player's own run history.
player.js Public profile data for the profile page.
replay.js Replay storage read/write against the REPLAYS KV namespace.
admin/review.js, admin/rule.js The pending-score review queue and the approve/reject action.
Deliberately not linked from any public page.
functions/eo-nashville/arcade/player/[id].js Per-player profile page route.
wrangler.toml D1 + KV bindings, PLACEHOLDER ids, see Root Cause above.
_src/registry.js +1 record: eo-nashville-arcade, status LIVE, links to the
arcade. Registry bumped to v0.7.0. This file also got refreshed
from the actually-live version first (local was one version
behind), see the a9b7be1 commit if the history looks odd.
```

## Task list for the next session (Fable, ordered)

**0. Read this whole brief. Then read `/Users/calvin/work/colton-land/DEPLOY.md` and do its
refresh-from-live check before changing anything, in case another machine deployed since this
was written.**

**1. Unblock and finish the arcade backend.**
- Confirm COLTON ACTION 8-9-A is done (ask Colton directly if unsure, do not guess).
- Create the real D1 database and KV namespace, fill in `wrangler.toml`, apply
`functions/schema.sql`, deploy.
- **Test registration, score submission, the leaderboard, and a profile page in an actual
incognito/private browser window before telling Colton anything works.** This is a direct,
explicit correction from Colton this session: verify like a real first-time visitor would
experience it, not just with curl and not while logged into anything. Test on both desktop
width and a phone-sized viewport.
- Sanity-check the wordle/hangman word banks that got rewritten (see above).
- Confirm the admin review queue path is reachable but not linked anywhere public, and walk
Colton through where it lives (he'll want this for actually ruling on flagged scores).

**2. colton.land homepage redesign.** Not started. Scope, from Colton's own words above:
- Clean sticky nav, mobile-friendly, structured like Forum Playbook's
(`/Users/calvin/Sites/forum-playbook/index.html` for the structural pattern only, not its
content). Current nav is cluttered, especially on mobile: fix that specifically, then verify
it in a real mobile-width browser window, not just by reading the CSS.
- Keep the existing skin switcher (brutalist/luxury/terminal/newspaper/default) working exactly
as it does today, at the bottom of the page as it is now.
- Rebuild the property/idea card grid: one screenshot (check `assets/` in the repo for anything
already captured; if a property has no screenshot yet, flag that rather than inventing a fake
one), a short caption, and a live/concept or public/private tag per card, in the spirit of the
Inspiration Repository's card style but tighter and cleaner than what's there now. Keep
whatever sort/filter logic `registry.js` already has rather than rebuilding it from scratch,
it may already do most of this.
- Feature the EO Nashville Arcade card prominently, it's the new flagship live thing.
- Bottom CTA section in the language above (the "since falling in love with Fable" paragraph),
keep the casual tone, no formal agency-quals pitch.
- Keep the running "worst theme park" joke visible somewhere prominent, the existing hero
og:description ("An enterprise, not a hobby") is already in that vein, build on it rather than
replacing it with something disconnected.
- Hard constraint: **this page must not reference the Business Partner Initiative, the
IStartedABusinessWithColton registry, the Marty pitch site, or any partnership-specific
material.** Colton was explicit this is a personal-projects showcase only.
- Deploy, then verify with curl (both the page and the noindex header) AND in an actual browser,
desktop and mobile widths, before calling it done.
- No em dashes anywhere in any copy written for this (commas, colons, periods, parens only,
this is a hard global rule for everything written for Colton, not a style suggestion).
- Bump the version/changelog the same way the rest of this codebase does (check if index.html
already has a changelog block; if not, add a minimal one, mirroring wilcoxsonhouse's pattern
of a CHANGELOG.md plus an in-page collapsible section).

**3. Do NOT start the reskin-with-fake-data cards (Can I Retire Early etc.) unless Colton
explicitly asks for that chunk in this new session.** If he does, inventory his live properties
that currently show real/private data before proposing which ones go first, rather than
guessing from this brief.

**4. When done, write a report (not just a chat reply) covering: exact live URLs to check, what
was verified in an actual incognito browser and on what viewport widths, what if anything got
deferred and why, and the current registry.js version number. Do not report anything as
"live" or "working" without a curl or browser check backing that specific claim up.**

## Why this session got handed off

Colton hit a real bug (name entry broken, homepage still the old cluttered layout), reasonably
read that as this build being behind where it should be, and asked for a clean handoff to a
fresh Fable 5 session rather than continuing to debug live with Sonnet. The bug itself has a
clear, verified root cause (Cloudflare token scope, see above), not a logic or judgment failure
in what got built, but the ask to hand off and have a fresh session own it end to end,
including actually testing in a browser before claiming anything works, stands regardless.