Quick fixes
-----------
-[ ] Fix typo in empathy.js: "this.ansering_idle_timer" → "this.answering_idle_timer"
+[X] Fix typo in empathy.js: "this.ansering_idle_timer" → "this.answering_idle_timer"
-[ ] Fix session config in lmno.js: set resave:false and
+[X] Fix session config in lmno.js: set resave:false and
saveUninitialized:false to silence deprecation warnings and avoid
creating unnecessary session cookies for every visitor.
-[ ] Replace body-parser with express.json() / express.urlencoded()
+[X] Replace body-parser with express.json() / express.urlencoded()
(built into Express since 4.16, body-parser is redundant).
Input validation and security
bundler) for ES module imports, HMR in development, and proper
tree-shaking/minification.
+Code sharing between client and server
+--------------------------------------
+[ ] Eliminate duplication of loa-board.js (currently copied into both
+ lmno.games and lmno-server). Games with shared logic need a single
+ canonical copy usable by both Node require() and browser <script>.
+ Options: (a) have Express serve static files in production too
+ (replacing the Apache static / Express dynamic split), so shared
+ files can live in lmno-server and be both required and served;
+ (b) symlinks from lmno.games into lmno-server (simple but
+ assumes sibling repo layout).
+
Server architecture (larger effort)
------------------------------------
[ ] Consider a formal state-machine pattern for Empathy's phase