Browser play, keyboard + mouse. The scheme is deliberately small — six things a panicking player can remember. Anything destructive (reset) is guarded so it can’t be fat-fingered in the dark.
WASD | Move — walk / strafe. Loud on hard floors. |
MOUSE | Look — first-person aim; the torch follows your view. |
SHIFT | Sprint (hold) — fast but louder footsteps, drains stamina, raises detection. |
E | Interact / pick up — tap for items & doors; hold for timed actions (revive, loud key door). |
F | Flashlight toggle — your only reliable light. Off = invisible to the zombie’s sight, blind to you. |
Q | Character ability — Joe: Sprint Burst · Billy: Steady Hands · Bob: Barricade · PhilBillyBob: all of it. |
L-MOUSE | Melee swing P1.5 · bat — slow, heavy, loud. R-MOUSE aims a throwable P2. |
G | Drop / hand off — pass a key or medkit to a teammate. |
TAB | Map (hold) — the scratched blueprint of rooms you’ve revealed. Lowers your guard while open. |
ENTER | Text chat — open / send. V (hold) = push-to-talk voice P2. Middle-mouse = ping. |
ESC | Pause / menu — settings, mute roster, leave, and the guarded Reset Session. |
HOLD | Reset session — never a hotkey. Menu only, hold-to-confirm. See below. |
CONTROLS UI / The keybinds appear once on a CRT “how to survive” boot card in the lobby, and as faint contextual prompts on interactables. Remappable in settings. No on-screen button clutter during play.
Any player can reset the room — but resetting ends the run for everyone, so it is guarded, named, and logged. When someone pulls it, the whole room is told who, and 6741 makes a show of tracing the connection.
The instant a reset confirms, the server pushes a SESSION_RESET message to every socket in the room. The client slams up a full-width, glitching, entity-red banner naming the initiator, then runs the “tracing” theatre while a fresh session spins up. It reads as the house itself reacting — and it makes griefing socially expensive.
On confirm, record { playerId, displayName, room, sessionId, socketIp, utc, resetCountThisSession } to the moderation log.
Push SESSION_RESET to all room sockets → the named red banner + countdown on every screen.
Run a WHOIS / RDAP lookup on the IP to resolve the owning network & abuse contact. Cache it; never expose it to other players.
If the account crosses a repeat-abuse threshold, file an abuse-notice record into a review queue — not an automatic email.
A human moderator approves or dismisses. Only approved, repeat, confirmed cases ever generate an actual notice to the carrier.
The menacing “6741 is tracing your connection / notifying your carrier” banner is the right call as an in-fiction deterrent — it discourages griefing and fits the paranoid tone whether or not any message is ever sent. Recommend shipping exactly that: log + WHOIS lookup + a scary banner.
Do not wire up automatic emails to ISPs. An IP address is personal data (GDPR / CCPA), shared and CGNAT/VPN addresses make false positives routine, abuse desks ignore automated reports, and unsolicited automated mail risks your own deliverability and legal exposure. If real notices are ever needed, gate them behind: confirmed repeat abuse, human moderator approval, a privacy policy disclosed to players at join, and strict log-retention limits. Keep the theatre; skip the auto-send.