v0.5.3 — a table you size yourself, and games an administrator can see and end

Both halves came out of playing the StartOS build. The wrapper's health
check and admin actions consume this; they land separately.

The host picks the table size (2-4) when creating a game, and the seats
array is built at that length once. Before, it GREW as people joined, so
the four rows on screen were partly fiction — a 2-player game just started
with a 2-long array, while a host who dropped a bot into a later chair
padded it with a null and silently disabled Start behind a one-line note.
A gap can no longer be written down rather than merely being refused.

That also avoided a trap. Compacting seats at Lobby.Start — the obvious
way to support a "closed" chair — would have shifted the player index that
every PlayerSession stamps at join time and that /api/stream and
/api/intent both route by, handing a player somebody else's railroad with
no error anywhere.

And it fixed a live balance bug: minCombinedRevenue is derived from the
player count, but the config was fixed at CREATE while the count wasn't
known until START, so the lobby guessed 4. Every 2-player game ran against
a floor of 60 instead of 30 — and missing the floor means everyone loses,
so a 2-player competitive game was set up to fail for a UI artifact rather
than a rule.

/api/health gained games:{active,lobby}, read from a new cheap summary()
on GameSession rather than exportSave(), which would copy every intent of
every game to answer a question about none of them. Three admin routes are
new behind an ADMIN_SECRET env var in an x-admin-secret header: GET
/api/games, GET /api/games/<id>/save, DELETE /api/games/<id>. Until now a
started game could not be ended by anyone — no route, no player action, no
resignation — so an abandoned game stayed active in the index and was
faithfully resumed on every boot, forever.

Three deliberate choices there: the admin secret is NOT the join secret,
which every player holds and which would therefore let anyone at the table
destroy anyone else's game; unset means the routes 404 exactly as any
unknown path does, with or without a header, so a server never given an
administrator doesn't advertise that it has one; and a delete returns the
deleted game's save, since the intents are the game (D5) — nothing is
destroyed without being handed to whoever destroyed it.

SavedGame gained an optional lastMoveAt (falling back to createdAt) so
"has this stalled?" survives a restart. Kept out of history for the same
reason the turn timings are: a replay must reproduce a game from decisions
alone, and wall-clock is not a decision.

index.ts logs "Resuming N saved games..." before the loop rather than one
line per game after it. Measured a full 4-player game at 100ms to replay,
and only unfinished games are replayed, so listening before loading would
have bought nothing for the cost of a "still loading" state everywhere.

Verified: 667 tests pass (662 + 5), and the new session tests were checked
against two mutations (lastMoveAt never advancing; resume dropping it) to
confirm they fail without the code. Live against a running server: health
counts tracking through the lobby->game transition, admin auth rejecting a
missing and a wrong secret, list/export/delete, the deleted game's files
and index entry actually gone from disk, a second delete 404ing, the admin
routes invisible when ADMIN_SECRET is unset, and a 3-player table refusing
a 4th player and a size of 5 refused at the door.

Also carries the TODO items raised on 2026-08-21: the lobby offering no
game parameters (the floor bug within it now fixed, the form still
missing), and the four optionalRules — of which only reducedVisibility and
emergencyToolbox are read by anything, while sisterTrains and
employeeRotation are declared, defaulted, and consulted nowhere.

test/server/session.test.ts

@@ -234,3 +234,69 @@ describe('persistence hooks — exportSave / resumeSession (Phase 3)', () => {
     assert.equal(session.exportSave().status, 'active');
   });
 });
+
+describe('summary() — what an administrator sees without replaying the game', () => {
+  it('describes a fresh game: who is at the table, where it has got to, and who it waits on', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    const s = session.summary();
+
+    assert.equal(s.playerCount, 2);
+    assert.deepEqual(s.playerNames, ['Alice', 'Bob']);
+    assert.equal(s.status, 'active');
+    assert.equal(s.day, 1);
+    assert.equal(s.stage, 1);
+    assert.equal(typeof s.phase, 'string');
+    assert.ok(s.waitingOn, 'a game in play must be waiting on somebody');
+    assert.equal(s.waitingOn!.name, s.playerNames[s.waitingOn!.seat]);
+  });
+
+  it('does not hand back a copy of the history the way exportSave must', () => {
+    // The health check polls this on a timer, so it answering with every intent of every game
+    // would make a question about none of them cost a copy of all of them.
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    assert.equal('history' in session.summary(), false);
+  });
+
+  it('moves lastMoveAt when a move is accepted, and leaves it alone when one is refused', async () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    const created = session.summary();
+    assert.equal(created.lastMoveAt, created.createdAt, 'an untouched game has not moved since it began');
+
+    const actor = (session.connect(0 as PlayerIndex).menu !== null ? 0 : 1) as PlayerIndex;
+    const idle = (1 - actor) as PlayerIndex;
+
+    // A rejection is not a move — a player poking at a game they cannot act in must not make it
+    // look alive to whoever is deciding whether it has stalled.
+    session.intent(idle, 1, { type: 'localOps.choose', option: 'draw' });
+    assert.equal(session.summary().lastMoveAt, created.lastMoveAt, 'a refused intent moved the clock');
+
+    await new Promise((r) => setTimeout(r, 2));
+    const accepted = session.intent(actor, 1, { type: 'localOps.choose', option: 'draw' });
+    assert.equal(accepted.accepted, true);
+    assert.ok(session.summary().lastMoveAt > created.lastMoveAt, 'an accepted intent did not move the clock');
+  });
+
+  it('carries lastMoveAt across a restart, and falls back to createdAt for a save without one', async () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    const actor = (session.connect(0 as PlayerIndex).menu !== null ? 0 : 1) as PlayerIndex;
+    await new Promise((r) => setTimeout(r, 2));
+    session.intent(actor, 1, { type: 'localOps.choose', option: 'draw' });
+
+    const saved = session.exportSave();
+    assert.equal(resumeSession(saved).summary().lastMoveAt, saved.lastMoveAt);
+
+    // A game written before the field existed still has to load, and reads as untouched since it
+    // began rather than as having just moved.
+    const { lastMoveAt: _dropped, ...older } = saved;
+    const revived = resumeSession(older).summary();
+    assert.equal(revived.lastMoveAt, saved.createdAt);
+  });
+
+  it('reports a finished game as waiting on nobody', () => {
+    // Every seat a bot, so the game plays itself to a finish inside the constructor.
+    const session = createSession(4242, config, ['A', 'B'], [0 as PlayerIndex, 1 as PlayerIndex]);
+    const s = session.summary();
+    assert.equal(s.status, 'finished');
+    assert.equal(s.waitingOn, null, 'a finished game must not name somebody to wait for');
+  });
+});