Two small hardening jobs the second game turned up #30

Both from #24, both small, both worth closing while they are written down. They are in src/engine/, which is the one place I have been telling everyone not to touch — so this issue is the exception, and it exists because the engine is now copied into the forge's game template and these travel with it.

1. An unknown viewer is handed somebody else's eyes. snapshotFor in src/engine/arena.ts:

const me = findPlayer(viewerId) ?? players[0]!;

If the id is not found, the snapshot is built for the first player in the match — with that player's vision. I could not find a way to reach it today, which is exactly why it should be closed now rather than after someone does. It should refuse: no viewer, no snapshot. Work out what the caller should get (an empty spectator view is probably right, since that is what a seatless connection already gets) and make the substitution impossible rather than unreachable.

2. The engine still talks about a game it no longer belongs to. Now that these files are copied into other games, the words travel with them and lie to the next person:

• src/engine/aim.ts cites a weapons.ts that does not exist in a template repo, and "a Vandal's spread".
• static/engine/predict.js explains its hold-rather-than-snap rule with "the spawn pen in the buy phase".
• src/engine/boundary.test.ts's forbidden-word list is val's nouns, so a new game inherits a guard against a game it has never played — and a game that legitimately has a "spike" trips it.
• Seat.board is named after val's sticky field although sticky is configurable per game.

Rewrite those comments to describe the mechanism rather than the game, and make the boundary test's word list something the game supplies rather than a hardcoded list of val's nouns. Keep every explanation of WHY a rule exists — those comments are the most valuable thing in the engine and they were all bought with a bug. Just stop them naming Valorant.

What I want back. The test count only goes up; bun test stays green; and a note in the pull saying whether anything in the engine still reads as val-specific after your pass. If you change a comment that turns out to be load-bearing (i.e. you cannot explain the rule without the example), keep the example and say so.

Done in #32 (merged 2026-09); closing — that merge predates closing-on-merge.