0.7.9.8:0 — bundle Station Master v0.7.9.8

Eight releases of fixes since v0.7.9, most of them multiplayer, which is
what this package is for. Submodule pin and `startos/versions/current.ts`
only — no Dockerfile, main.ts or manifest change, as an ordinary bump
should be.

Bumped in place rather than spun off: v0.7.9's migration body is empty,
which is `versions.md`'s common case, and git history keeps its release
notes.

FOUR-COMPONENT VERSION, CHECKED. Every example in `versions.md` has
three, so `0.7.9.8:0` was parsed with the SDK's own ExVer parser before
being written down: upstream `[0,7,9,8]`, which sorts above `[0,7,9]`, so
a box on 0.7.9:0 takes this as an update rather than refusing it as a
downgrade.

GAMES IN PROGRESS ON THE BOX RESUME, and that was established rather than
hoped for. v0.7.9 broke solitaire saves because it changed a RULE, and
the rule behind that is that a save is a seed plus the moves played,
replayed through the CURRENT rules — so the question for any bump is
whether something became illegal. `git diff v0.7.9..HEAD -- src/engine/`
is, in full: `isExpedited` exported and widened to a structural parameter
type, `isFreight` exported, one new read-only helper
(`freightRuleSpentHere`, which only the blocked panel asks), and
`check('draw.end')`'s inline hand-limit test replaced by a call to
`overHandLimit(state, player)` holding the identical expression. No
predicate changed its answer. The release notes say so in all five
locales rather than leaving it to be discovered.

UPDATING.md CORRECTED: it said a running server's saves "are stamped with
`engineVersion` and refuse to resume under a mismatched one". They are
stamped with it and it is reported, but `src/server/index.ts` decides by
attempting the replay and names the versions only inside the failure
message — its own comment says why, that "some version differs" was never
enough to act on. A doc that sends the next person to schedule downtime
for a bump that needs none costs about as much as the reverse. It now
carries the diff command to ask the question of the code instead.

What players get, briefly: two multiplayer information leaks closed (the
seed in the shared log, and a blind Home Office draw naming its card); a
history panel that came back EMPTY after a mid-game browser reload; the
extended-play vote no longer naming an arbitrary player when the vote is
open to everyone at once; a train held at your Limits by an Interlocking
no longer vanishing off the board until a track frees; trains queued for
a Crew Tray saying so with the free count; a Red Flag drawn on the map; a
spent Telegraph/Telephone/Radio struck through; the Campaign Train saying
whether its speeches are made; and two bugs from the last playtest — the
Express's one-freight-car-per-location rule explained where it refuses
you, and westbound trains drawn in the correct half of a card.

README.md and instructions.md updated in the same change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y5boPxP6JHRYMm8adXaF5R

UPDATING.md

@@ -77,8 +77,34 @@ from a dirty tree. Never publish one of those.
 
 ---
 
-If the jump carries a multiplayer protocol or persistence-format change (check the game repo's
-`CHANGELOG.md` and `docs/architecture/multiplayer.md`), read it before bumping: a running
-server's saved games are stamped with `engineVersion` and refuse to resume under a mismatched
-one (`src/server/index.ts` in the game repo) — nothing in this package works around that, so an
-in-progress game must finish (or be accepted as lost) before an incompatible bump.
+## Will the games already on the box survive the bump?
+
+**`engineVersion` is NOT a gate, and this section used to say it was.** It claimed a running server's
+saves "are stamped with `engineVersion` and refuse to resume under a mismatched one". They are
+stamped with it, and it is *reported* — but `src/server/index.ts` decides by attempting the replay,
+and names the stored and running versions only inside the failure message. Its own comment says why:
+"some version differs" was never enough to act on. A game is refused because a move no longer
+replays, never because a string changed.
+
+**So the real question is whether anything became ILLEGAL.** A save is a seed plus the moves played,
+replayed through the *current* rules, so a change that makes a once-legal move illegal truncates an
+older save; everything else — new fields, renderer work, exports, refactors — cannot. Ask it directly
+of the code rather than of the changelog:
+
+```bash
+cd station-master
+git diff v<old>..v<new> -- src/engine/ | grep -E '^[+-]' | grep -vE '^[+-]{3}' \
+  | grep -vE '^[+-]\s*(\*|//|/\*)' | grep -vE '^[+-]\s*$'
+```
+
+Read every surviving line. For v0.7.9 → v0.7.9.8 that was four things — two exports, one new
+read-only helper, and one inline expression moved into a shared function — so no predicate changed
+its answer and every game resumed. **If a predicate in `apply.ts`, `legal.ts` or `advance.ts` did
+change, say so in the release notes in all five locales**, the way v0.7.9 did: an in-progress game
+must then finish, or be accepted as lost, before the bump.
+
+Multiplayer saves live on the SERVER, which is the half this package can actually strand — a
+solitaire save lives in the player's own browser, where nothing here can reach it either way.
+
+The `Frame` sent to a browser is not part of this question. It gains and loses fields freely; a
+browser reloads onto the new client as part of the update, so there is no version skew to migrate.