docs: record the crawler and game-port behaviour

1 files changed, 4 insertions, 1 deletions

diff --git a/docs/WEB-PLAN.md b/docs/WEB-PLAN.md
index 80e797b..d0f9d9d 100644
--- a/docs/WEB-PLAN.md
+++ b/docs/WEB-PLAN.md
@@ -102,11 +102,14 @@ Test against a staging site with
   logs both fingerprints and refuses credentials.
 - The browser has no certificate UI and no credential storage. XSS cannot read
   the HttpOnly cookie; the backend still must escape every notice.
+- `web/robots.txt` disallows every crawler and the site sends `noindex`
+  headers. The game port is not HTTP: v5 drops a request whose first four bytes
+  are not a valid frame before `HELLO`, without replying or logging.
 - The browser speaks JSON, not the game wire. A malicious page cannot use the
   gateway as a protocol proxy: `Origin` is checked and the session cookie is
   SameSite=Strict.
 - The web app is play-money only. No deposits, withdrawals, KYC or real-money
-  claims belong in v1 copy.
+  claims belong in v1 copy. Do not advertise it in the player-facing copy.
 
 ## Failure behaviour