v0.7.0 — four game types, a lobby you can read and leave, and a multiplayer game that makes a sound

The multiplayer set-up, the lobby, the start of a game, and four signals a remote client had never
been sent. Reasoning, the preset table and what was verified how: CHANGELOG.md.

- Co-op, Competitive, Cutthroat, Solitaire and Custom, on both screens, from one shared block —
  they had drifted, and each was missing a question the other asked.
- A player reads the whole rule set before taking a seat, may leave a lobby or a running game, and
  keeps a seat across a reload. The host may clear a chair. The browser remembers every game it is
  in, not just the last one.
- The start of a game is drawn: a handoff beat, an announcement, the code and type in the header.
- Sound, the timetable flash, announcements and the just-drawn badge now reach a remote client;
  justDrawn goes to the seat that drew it and nobody else.
- Played on StartOS, which found the rest: an Extra belongs to the player who played it, the board
  never named the Superintendent, bot seats were reported as absent players, and rule section
  numbers are out of every string a player reads.

Also carries the previous session's Heavy Grade documentation work — asked again, answer unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016JczK5i33ZNSf2PtzZqdhS

src/server/http.ts

@@ -41,6 +41,7 @@ import { createSession } from './session.ts';
 import type { GameSession, Push } from './session.ts';
 import {
   createLobby,
+  leaveLobby,
   freshGameCode,
   playerCountAllowed,
   joinLobby,
@@ -129,6 +130,15 @@ async function serveStatic(distDir: string, urlPath: string, res: ServerResponse
  * simply ending, indistinguishable from a network hiccup that `EventSource` would otherwise retry.
  */
 type LobbyPush = { lobby: Lobby; you: PlayerIndex; started: boolean };
+/** What `/api/lobby/preview` answers with — everything a player weighing a join needs, and nothing
+ * that would spoil the game. THE SEED IS NOT IN IT: it decides every shuffle and every roll. */
+type LobbyPreview = {
+  gameCode: string;
+  hostName: string;
+  config: GameConfig;
+  players: number;
+  seated: { seat: number; who: string | null; bot: boolean }[];
+};
 
 export function startServer(opts: ServerOptions): void {
   const games = opts.initialGames;
@@ -143,6 +153,8 @@ export function startServer(opts: ServerOptions): void {
   const gameConnections = new Map<string, Map<PlayerIndex, ServerResponse>>();
   const gameEventIds = new Map<string, Map<PlayerIndex, number>>();
   const lobbyConnections = new Map<string, Map<string, ServerResponse>>();
+  /** Which seats of a game have ever held a connection in THIS process — see `presenceOfOthers`. */
+  const everConnected = new Map<string, Set<PlayerIndex>>();
 
   function writeSse(res: ServerResponse, id: number, data: unknown): void {
     res.write(`id: ${id}\ndata: ${JSON.stringify(data)}\n\n`);
@@ -176,11 +188,37 @@ export function startServer(opts: ServerOptions): void {
     if (!conns) return;
     for (const [other, res] of conns) {
       if (other === seat) continue;
-      const push: Push = { menu: null, lines: [], presence: { seat, connected } };
+      const push: Push = { menu: null, lines: [], presence: [{ seat, connected, seen: true }] };
       writeSse(res, nextEventId(gameId, other), push);
     }
   }
 
+  /**
+   * EVERY OTHER SEAT'S STATE, for a client that has just connected.
+   *
+   * `broadcastPresence` only ever reports a CHANGE, so a player arriving at a table where two people
+   * had not opened the game yet was told nothing about them at all — and "is everyone here?" is the
+   * question at the moment a game starts. `seen` separates a seat that was here and dropped from one
+   * that has never connected; it is remembered only for as long as this process runs, so after a
+   * restart every absent seat reads as "not here yet", which is the more cautious of the two.
+   */
+  function presenceOfOthers(
+    gameId: string,
+    seat: PlayerIndex,
+    session: GameSession,
+  ): NonNullable<Push['presence']> {
+    const conns = gameConnections.get(gameId);
+    const ever = everConnected.get(gameId) ?? new Set<PlayerIndex>();
+    const out: NonNullable<Push['presence']> = [];
+    for (let other = 0 as PlayerIndex; other < session.playerCount; other++) {
+      // A bot holds no connection and never will, so reporting it would put "waiting on Bot 1 — not
+      // here yet" on every screen for the whole game. Found by playing a real 3-seat game.
+      if (other === seat || session.isBot(other)) continue;
+      out.push({ seat: other, connected: conns?.has(other) === true, seen: ever.has(other) });
+    }
+    return out;
+  }
+
   function broadcastLobby(gameId: string): void {
     const lobby = lobbies.get(gameId);
     const conns = lobbyConnections.get(gameId);
@@ -389,7 +427,12 @@ export function startServer(opts: ServerOptions): void {
         await persistLobby(result.lobby);
         await persistSession(result.session);
         broadcastLobby(lobby.gameId);
-        sendJson(res, 200, { gameId: lobby.gameId, token: result.session.token, player: result.session.player });
+        sendJson(res, 200, {
+          gameId: lobby.gameId,
+          gameCode: lobby.gameCode,
+          token: result.session.token,
+          player: result.session.player,
+        });
         return;
       }
 
@@ -418,6 +461,83 @@ export function startServer(opts: ServerOptions): void {
         return;
       }
 
+      /**
+       * GIVING UP A SEAT — the player's own, or (host only) somebody else's.
+       *
+       * There was no door out of a lobby before this: a mis-join or a player who wandered off left a
+       * chair that could not be freed, and a table that cannot start until every chair is taken.
+       * The host's "remove" and a player's "Leave" are the same act from opposite ends, so they are
+       * one route — `seat` names somebody else's chair and is refused to anyone but the host.
+       */
+      if (url.pathname === '/api/lobby/leave' && req.method === 'POST') {
+        const body = (await readJson(req)) as { token?: string; seat?: number };
+        const ps = typeof body.token === 'string' ? sessions.get(body.token) : undefined;
+        const lobby = ps ? lobbies.get(ps.gameId) : undefined;
+        if (!ps || !lobby) {
+          sendJson(res, 404, { error: 'no such lobby' });
+          return;
+        }
+        const seat = typeof body.seat === 'number' ? (body.seat as PlayerIndex) : undefined;
+        if (seat !== undefined && seat !== ps.player && lobby.hostToken !== ps.token) {
+          sendJson(res, 403, { error: 'NOT_HOST' });
+          return;
+        }
+        const result = leaveLobby(lobby, ps.token, seat);
+        if (result.empty) {
+          // Nobody human is left to start it. Everything about this lobby goes, including the code,
+          // so it cannot be joined into a game that will never begin.
+          lobbies.delete(lobby.gameId);
+          gameCodes.delete(lobby.gameCode);
+          for (const [, watcher] of lobbyConnections.get(lobby.gameId) ?? []) watcher.end();
+          lobbyConnections.delete(lobby.gameId);
+          await deleteLobby(opts.dataDir, lobby.gameId);
+          // The row goes with the lobby rather than being marked: a game that never started is not a
+          // game an administrator has any use for a record of.
+          await removeIndexEntry(opts.dataDir, lobby.gameId);
+          sendJson(res, 200, { ok: true, closed: true });
+          return;
+        }
+        await persistLobby(result.lobby);
+        broadcastLobby(lobby.gameId);
+        sendJson(res, 200, { ok: true });
+        return;
+      }
+
+      /**
+       * WHAT AM I ABOUT TO JOIN? Read-only, takes no seat, and gated by the same join secret the
+       * door itself is.
+       *
+       * A player used to have to take a chair before they could see a single rule of the game they
+       * were sitting down to — and until 2026-08-23 there was then no way back out of it.
+       */
+      if (url.pathname === '/api/lobby/preview' && req.method === 'GET') {
+        if (url.searchParams.get('secret') !== opts.joinSecret) {
+          sendJson(res, 403, { error: 'bad or missing secret' });
+          return;
+        }
+        const code = (url.searchParams.get('gameCode') ?? '').trim().toUpperCase();
+        const gameId = gameCodes.get(code);
+        const lobby = gameId ? lobbies.get(gameId) : undefined;
+        if (!lobby) {
+          sendJson(res, 404, { error: 'no open lobby with that code' });
+          return;
+        }
+        const hostSeat = lobby.seats.find((seat) => seat?.kind === 'human' && seat.token === lobby.hostToken);
+        const preview: LobbyPreview = {
+          gameCode: lobby.gameCode,
+          hostName: hostSeat?.kind === 'human' ? hostSeat.displayName : 'unknown',
+          config: lobby.config,
+          players: lobby.seats.length,
+          seated: lobby.seats.map((seat, i) => ({
+            seat: i,
+            who: seat?.kind === 'human' ? seat.displayName : null,
+            bot: seat?.kind === 'bot',
+          })),
+        };
+        sendJson(res, 200, preview);
+        return;
+      }
+
       if (url.pathname === '/api/lobby/start' && req.method === 'POST') {
         const body = (await readJson(req)) as { token?: string };
         const ps = typeof body.token === 'string' ? sessions.get(body.token) : undefined;
@@ -523,7 +643,13 @@ export function startServer(opts: ServerOptions): void {
         const conns = gameConnections.get(gameId) ?? new Map<PlayerIndex, ServerResponse>();
         conns.set(seat, res);
         gameConnections.set(gameId, conns);
-        writeSse(res, nextEventId(gameId, seat), session.connect(seat));
+        const ever = everConnected.get(gameId) ?? new Set<PlayerIndex>();
+        ever.add(seat);
+        everConnected.set(gameId, ever);
+        // The board, and who else is at the table — the second half used to be missing entirely.
+        const first = session.connect(seat);
+        first.presence = presenceOfOthers(gameId, seat, session);
+        writeSse(res, nextEventId(gameId, seat), first);
         broadcastPresence(gameId, seat, true);
         // Idle for minutes at a time is the expected shape of this game (multiplayer.md §9) — a
         // silent SSE connection is exactly what a proxy in the path may reap. A comment line is not a

src/server/lobby.ts

@@ -50,7 +50,12 @@ export type Lobby = {
 };
 
 export type CreateResult = { lobby: Lobby; session: PlayerSession };
-export type JoinResult = { ok: true; lobby: Lobby; session: PlayerSession } | { ok: false; code: 'LOBBY_FULL' | 'ALREADY_STARTED' };
+export type JoinResult =
+  | { ok: true; lobby: Lobby; session: PlayerSession }
+  | { ok: false; code: 'LOBBY_FULL' | 'ALREADY_STARTED' | 'NAME_TAKEN' };
+/** `empty` when the last human has gone — the caller drops the lobby rather than leaving a table of
+ * bots waiting for a host who no longer exists. */
+export type LeaveResult = { lobby: Lobby; empty: boolean };
 export type StartResult = { ok: true; playerNames: string[]; botSeats: PlayerIndex[] } | { ok: false; code: 'NOT_HOST' | 'BAD_PLAYER_COUNT' };
 
 /**
@@ -140,6 +145,19 @@ export function joinLobby(lobby: Lobby, displayName: string): JoinResult {
   const seatIndex = lobby.seats.findIndex((s) => s === null);
   if (seatIndex < 0) return { ok: false, code: 'LOBBY_FULL' };
 
+  /**
+   * TWO PLAYERS CANNOT SHARE A NAME (2026-08-23).
+   *
+   * The name is not decoration: it labels the district on the Division map, it is what the turn
+   * chart means by "waiting on Jesse", and `record()` puts it in front of every line that player
+   * causes. Two identical names make all three ambiguous, and there is no way to fix it once the
+   * game starts — the names are locked into the session at `Lobby.Start`. Refused rather than
+   * silently suffixed: a player should play under the name they chose, or be told to choose again.
+   */
+  const wanted = displayName.trim().toLowerCase();
+  const clash = lobby.seats.some((s) => s?.kind === 'human' && s.displayName.trim().toLowerCase() === wanted);
+  if (clash) return { ok: false, code: 'NAME_TAKEN' };
+
   const token = randomUUID();
   const session: PlayerSession = { token, gameId: lobby.gameId, player: seatIndex, displayName };
   const seats = [...lobby.seats];
@@ -151,6 +169,35 @@ export function joinLobby(lobby: Lobby, displayName: string): JoinResult {
   };
 }
 
+/**
+ * GIVING UP A SEAT — a player leaving, or the host clearing somebody out of a chair.
+ *
+ * There was no way out of a lobby at all before 2026-08-23: a mis-join or a player who wandered off
+ * wedged the table, because Start needs every chair filled and `setBotSeat` refuses to touch an
+ * occupied human seat. One function serves both, since they differ only in whose seat is named, and
+ * `http.ts` is what checks that a caller naming somebody else's seat is the host.
+ *
+ * Host rights move exactly as they do on a dropped connection (`reassignHost`), and the caller is
+ * told when the last human has gone so the lobby can be dropped rather than left orphaned.
+ */
+export function leaveLobby(lobby: Lobby, token: string, seat?: PlayerIndex): LeaveResult {
+  const index =
+    seat === undefined ? lobby.seats.findIndex((s) => s?.kind === 'human' && s.token === token) : seat;
+  const occupant = index >= 0 ? (lobby.seats[index] ?? null) : null;
+  if (index < 0 || occupant?.kind !== 'human') return { lobby, empty: false };
+
+  const seats = [...lobby.seats];
+  seats[index] = null;
+  const departing = occupant.token;
+  const withoutThem: Lobby = {
+    ...lobby,
+    seats,
+    joinOrder: lobby.joinOrder.filter((t) => t !== departing),
+  };
+  const empty = !seats.some((s) => s?.kind === 'human');
+  return { lobby: reassignHost(withoutThem, departing), empty };
+}
+
 /** Host-only in effect (`http.ts` checks the caller's token against `hostToken` before calling
  * this) — marks an empty seat as bot-filled, or clears one back to empty. Never touches an occupied
  * human seat; the host removes a person by them leaving, not by overwriting their seat. */

src/server/session.ts

@@ -42,14 +42,33 @@ export type Push = {
   /** Narration since the LAST push to this specific seat, not the whole game's log. */
   lines: { text: string; tone: string }[];
   /**
-   * Connection news about ANOTHER seat — never this push's own recipient. `lobby-and-sessions.md`
+   * Connection news about OTHER seats — never this push's own recipient. `lobby-and-sessions.md`
    * §5: a disconnect is server-layer news about a connection, not a `GameEvent`, so it must not go
    * through the engine or the shared narration log (which must stay replayable from a seed). Built
    * and broadcast entirely by `http.ts`, which already owns the connection table; `session.ts` never
    * sets this field itself — every `Push` `session.ts` builds carries a real `frame` and no
    * `presence`, and `http.ts`'s presence notices carry no `frame` and no `menu`.
+   *
+   * A LIST, since 2026-08-23: a connecting client is told about every other seat at once. It used to
+   * learn of a seat only when that seat disconnected AFTER it connected, so a player arriving at a
+   * table where two people had not shown up yet was told nothing at all. `seen` distinguishes "was
+   * here and dropped" from "has never opened the game".
    */
-  presence?: { seat: PlayerIndex; connected: boolean };
+  presence?: { seat: PlayerIndex; connected: boolean; seen: boolean }[];
+  /**
+   * THE FOUR TRANSIENT SIGNALS (2026-08-23) — what solitaire has always drawn and multiplayer never
+   * did: sound cues, the timetable slot a D12 just filled, a one-line announcement, and the card
+   * that just came into this seat's hand.
+   *
+   * The first three are SHARED — a collision anywhere on the Division, the Stage bell, a train
+   * running off the end pays everyone — so they are identical in every seat's push and drained once
+   * per broadcast. `justDrawn` is not: it goes ONLY to the seat that drew it (`game.justDrawn` is
+   * one field for the whole game and does not say whose). `test/redaction.test.ts` is the guard.
+   */
+  cues?: string[];
+  scheduled?: number | null;
+  announcement?: string | null;
+  justDrawn?: string | null;
 };
 
 /**
@@ -141,6 +160,9 @@ function buildSession(
   lastMoveAtInit: number,
 ): GameSession {
   let lastMoveAt = lastMoveAtInit;
+  /** Who drew the card `game.justDrawn` names. The engine records WHICH card came into hand but not
+   * whose hand it went into, and that is the whole difference between a badge and a leak. */
+  let lastDraw: { seat: PlayerIndex; cardId: string } | null = null;
   const lastSeq = new Map<PlayerIndex, number>();
   const lastFrame = new Map<PlayerIndex, Frame>();
   const sentLines = new Map<PlayerIndex, number>();
@@ -166,16 +188,41 @@ function buildSession(
     return seat === currentActor(game) ? actionMenu(game, seat) : null;
   }
 
-  function pushFor(seat: PlayerIndex): Push {
+  /** What the last batch of events earned, drained from the game exactly once and then handed to
+   * every seat. `null` on a (re)connect: a fresh connection is drawing a STATE, and replaying the
+   * sounds of everything it missed would be a burst of noise about the past. */
+  type Moment = { cues: string[]; scheduled: number | null; announcement: string | null };
+
+  function takeMoment(): Moment {
+    const cues = game.cues.splice(0, game.cues.length);
+    const scheduled = game.scheduled;
+    game.scheduled = null;
+    const announcement = game.announced;
+    game.announced = null;
+    return { cues, scheduled, announcement };
+  }
+
+  function pushFor(seat: PlayerIndex, moment: Moment | null): Push {
     const frame = frameFor(seat);
     const delta = deltaFrame(lastFrame.get(seat) ?? null, frame);
     lastFrame.set(seat, frame);
-    return { frame: delta, menu: menuFor(seat), lines: linesSince(seat) };
+    const push: Push = { frame: delta, menu: menuFor(seat), lines: linesSince(seat) };
+    if (moment) {
+      if (moment.cues.length > 0) push.cues = moment.cues;
+      if (moment.scheduled !== null) push.scheduled = moment.scheduled;
+      if (moment.announcement !== null) push.announcement = moment.announcement;
+    }
+    // The drawer's own card, and nobody else's — on a reconnect too, so the badge survives a refresh.
+    if (lastDraw !== null && lastDraw.seat === seat) push.justDrawn = lastDraw.cardId;
+    return push;
   }
 
   function pushesForAll(): Map<PlayerIndex, Push> {
+    const moment = takeMoment();
     const out = new Map<PlayerIndex, Push>();
-    for (let seat = 0; seat < playerNames.length; seat++) out.set(seat as PlayerIndex, pushFor(seat as PlayerIndex));
+    for (let seat = 0; seat < playerNames.length; seat++) {
+      out.set(seat as PlayerIndex, pushFor(seat as PlayerIndex, moment));
+    }
     return out;
   }
 
@@ -224,13 +271,21 @@ function buildSession(
       const options = legalActions(game.state, actor);
       if (options.length === 0) return;
       const choice = developerBot.choose(game.state, actor, options);
+      const drawnBefore = game.justDrawn;
       const ok = submit(game, choice);
+      if (game.justDrawn !== drawnBefore && game.justDrawn !== null) {
+        lastDraw = { seat: actor, cardId: game.justDrawn };
+      }
       /* c8 ignore next -- `options` came from `legalActions`, so `choice` is always legal. */
       if (!ok) throw new Error(`driveBots: developerBot chose an illegal action for seat ${actor}`);
       settleTiming();
     }
   }
   driveBots();
+  // Whatever the opening bot turns earned belongs to a game nobody was connected to yet — dropped
+  // here rather than fired at the first client to arrive. (It also stops `game.cues` growing without
+  // bound on a server, which nothing was draining before this.)
+  takeMoment();
 
   return {
     playerCount: playerNames.length,
@@ -240,7 +295,7 @@ function buildSession(
       // A (re)connect always starts from a clean slate — no cache to trust across a lost connection
       // (or a server restart, Phase 3) — so the honest thing is a full Frame, not a delta.
       lastFrame.delete(seat);
-      return pushFor(seat);
+      return pushFor(seat, null);
     },
 
     intent(seat, seq, i) {
@@ -259,7 +314,11 @@ function buildSession(
       const code = check(game.state, seat, i);
       if (code) return { accepted: false, code };
 
+      const drawnBefore = game.justDrawn;
       const applied = submit(game, i);
+      if (game.justDrawn !== drawnBefore && game.justDrawn !== null) {
+        lastDraw = { seat, cardId: game.justDrawn };
+      }
       /* c8 ignore next -- `check` above already proved this intent is legal; `submit` cannot then refuse it. */
       if (!applied) return { accepted: false, code: 'REJECTED' };