v0.4.0 — multiplayer Phases 0 and 1: seat and player split apart, turn state per player, the page behind a Session, and eight seat/player mix-ups fixed with tests that fail without them

TODO.md

@@ -469,6 +469,24 @@ target is settled and freight carries its intended share.
       engine currently has no per-player turn within the New Train phase, so this is unbuilt rather
       than wrong.
 
+- [ ] **MULTIPLAYER — three things deliberately deferred while planning the server.** Decisions and
+      reasoning are in `docs/architecture/multiplayer.md` §11; these are the ones left open.
+      - **Bots should take minimally damaging, defensive actions when a player steps away**, so a
+        game is not permanently halted. Deliberately NOT automatic today: a turn timer forfeiting is
+        different from a bot competing, and the clearance ruling is the one decision that changes
+        another player's score. Bots fill empty seats at lobby time only (D8).
+      - **Let a player resign and hand their railroad to a bot** to finish. Same care needed as
+        above, but it is consented rather than imposed.
+      - **Revisit the join secret** (D14). One server-wide secret, passed out of band, gates create
+        and join. Enough for a private box, probably not enough if `stationmaster.<domain>` is
+        pointed at the open internet for long. Note that one-game-at-a-time per person is expected
+        usage and deliberately NOT enforced — enforcing it needs cross-game state whose only job is
+        deciding when to release someone, and getting that wrong locks a player out.
+- [ ] **WHY DOES A 4-PLAYER COMPETITIVE GAME END AFTER ~16 STAGES OF A POSSIBLE 60?** Measured while
+      sizing multiplayer: 8 games, all reaching Day 5, but only ~16 distinct (day, stage) pairs each
+      and ~355 intents. Most likely the collision or revenue floor (§3.4) firing early, which would
+      make a competitive game about an hour rather than four. Worth knowing whether that is the
+      design working or a balance bug — it decides what a lobby should tell players about length.
 - [ ] **THE 22 OPPONENT-DIRECTED CARDS — 10 Action, 12 Space-use — ARE OUT OF EVERY DECK UNTIL THEY
       ARE BUILT.** Jesse's call. They were already cut from solitaire (Q6, no legal target with one
       player); they are now cut from the competitive deck too, because `checkPlay` answers both
@@ -478,8 +496,13 @@ target is settled and freight carries its intended share.
       **three Enhancements are waiting on them**: Facing Point Locks, Water Column and Overpass are
       wired and read, and fire only against these cards. Until then those three are dormant by
       design rather than broken.
-- [ ] **Multiplayer proper.** The engine runs 2–5 player games and the bot plays them, but there is no
-      server, no turn submission, and no per-player view.
+- [ ] **Multiplayer proper — Phases 0 and 1 done (v0.4.0), Phases 2–6 to go.** The full plan is
+      `docs/architecture/multiplayer.md` §12. The engine now has seat/player separation and
+      per-player turn state, the page renders from `Frame` + `Menu` alone and talks to a `Session`
+      rather than to the engine — so a `RemoteSession` can be dropped in without the page changing.
+      Still no server, no turn submission and no per-player push: that is Phase 2, and it is
+      deliberately held until the two provisional rules have been playtested, because a rule change
+      after the wire format is live is much more expensive than one before it.
 
 ---