THE LAST DISCIPLE — WEB MULTIPLAYER v1.0
2–4 people; four companions. Server-authoritative play, private recovery keys, chat, seven-day inactive-room expiry. Rooms persist across server restarts. Use ONE Node worker/process; file storage does not coordinate multiple workers.

DO NOT REPLACE GENESIS CODE OR ITS NODE APP.

A. PRIVATE NODE APPLICATION (outside public_html)
Create /home/deskatur/last-disciple-board-multiplayer/
Upload this package's app.js, server.cjs, engine.cjs, package.json, and public folder there. Keep the public folder here even when you copy it in step B.
The server creates private room-data here. Do not put room-data under public_html.

B. PUBLIC WEBSITE FILES (inside public_html)
Create /home/deskatur/public_html/board-games/the-last-disciple/multiplayer/
COPY the CONTENTS of this package's public folder into that directory:
index.html, app.js (the browser script), engine.js, style.css, assets/.
Do not copy the private startup app.js into the public website. They have the same name but different jobs.

C. CPANEL NODE APPLICATION
Use a supported Node version offered by your host; the server has no npm dependencies.
Mode: Production
Application root: last-disciple-board-multiplayer
Application URL: deskatur.com / board-games/the-last-disciple/multiplayer
Startup file: app.js
Passenger log: /home/deskatur/last-disciple-board-multiplayer/passenger.log
Environment variables:
BASE_PATH = /board-games/the-last-disciple/multiplayer
PUBLIC_ORIGIN = https://deskatur.com
Do not set PORT; the hosting platform assigns it.
Create/start or restart the application. No NPM Install is required.

D. WORDPRESS ROUTING
In /home/deskatur/public_html/.htaccess, preserve your existing Genesis Code exception. Add this SEPARATE block above # BEGIN WordPress:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^board-games/the-last-disciple/multiplayer(/|$) - [L]
</IfModule>

Do not remove or edit CloudLinux-generated Passenger settings in the multiplayer folder.

E. CHECK
Open https://deskatur.com/board-games/the-last-disciple/multiplayer/api
A JSON message saying Use POST. is expected. A WordPress No content found page means routing is still intercepting the API.
Open https://deskatur.com/board-games/the-last-disciple/multiplayer/
Create a room, join from another browser/phone, mark everyone ready, and begin. With two players: host controls John/Sera; other player controls Karesh/Lys. With three: host also controls Lys. With four: one each.
Share only the room code. Save each person's PRIVATE recovery key for reconnection. Late joining after start is disabled. After a player is offline 90 seconds the host can take over; if the host is offline another player can claim host. Original player recovery authenticates their seat, but a taken-over figure stays assigned to its new owner until the host uses the Give companion control to return it.

For local development only: node app.js, then http://127.0.0.1:3000/ .
Verification: room authority, readiness, duplicates, stale updates, auth rejection, private-file protection and disk recovery tested locally. Public hosting and browser UI still need checking after upload.