v0.7.9.6 — three things the engine knew and the screen did not

Found by looking rather than by being told. Gitea#21, #22, #94 and #96
were four instances of one fault in a row — the engine gains something
that changes what a train may do, and nothing draws it — and every one
was found by a player hitting it. So instead of waiting for the fifth,
every field of GameState and its nested types was enumerated, checked for
a reader in sim/view.ts, src/web/ and sim/narrate.ts, and the survivors
verified BY RUNNING THE ENGINE rather than by trusting the grep.

Four fields had no reader. `movedThisPhase` lives and dies inside one
`advance` call and is nobody's business. The other three are below. What
was ruled out matters as much: `freightWorked`, `drawnThisTurn`,
`freightAgentUsed`, `switchedSince` and `movesUsed` are invisible on
purpose, their effect already showing as legality or as a complement
already on the Frame. A field is not a display gap merely because nothing
renders it.

#98 — the Crew Tray pool. §7 scarcity is called an explicit mechanic and
was explicit only in the engine. The blocked panel had one tray rule,
keyed off the train due out this Stage, so a player who spent a card on
an Extra or ordered a second section got an EMPTY panel while their train
sat behind an exhausted pool — both having been announced once in the log
in a line promising a future event that nothing then confirmed. The
shared table carries the pool and the queue now, so the common board gets
it too, and the panel reports all three with the count beside them.

#99 — a train held at the Limits vanished off the board, and this one had
shipped. The Interlocking stops an inbound train on the Limit Track
rather than colliding with a full Office. `arriveAtOffice` removes the
tray from the Mainline node's `transits` and the Interlocking branch
pushes it onto `heldAtLimits` without assigning `tray.position` — and the
map draws mainline nodes from `transits` and squares from
`position.at === 'grid'`, so between the two it was drawn in NEITHER. It
disappeared on arrival and reappeared in the Office some Stages later.
Fixed in the view: the engine is right, and `position` is left alone
deliberately so nothing treats the train as standing somewhere it could
be switched from.

#100 — the Campaign Train's speeches change its rules, and the card said
the same thing before and after. Worse, the "EXPEDITED ... costs 1
Revenue" warning prints only under `rules.expedite`, so X17 became
subject to a fault whose warning the game shows to every other expedited
train and never to it. `trainRules` reads `speechMade` now and borrows
`isExpedited` from advance.ts rather than restating the test.

#45 — the 0.7.9 dead-field audit, finished, and the answer was different
for each. `overHandLimit` is WIRED: its consumer existed all along and
was inferring the hand limit from the ABSENCE of `draw.end` in the menu,
which is sound only while `check` keeps refusing for exactly three
reasons. `viewerSeat` is DOCUMENTED, with a condition — Gitea#20's board
keys districts by seat, and the note says to delete it if step 2 ships
without using it.

The audit had missed a third limb. `game.mustPlayCard` was assigned on
every submit and read by nothing: deleted. Chasing it turned up the thing
worth fixing — the §6.2 hand-limit test existed in THREE places, all
agreeing, which is the state #96's disagreement started from. One
`overHandLimit(state, player)` in state.ts now, and the other two ask it.
`Session.overHandLimit()` is deleted rather than kept: the Frame already
carries the fact, so the method was a second path to it.

934 tests pass, up from 917. The 17 new ones were written red, and each
fix checked by mutation: reverting `speechMade` fails 2, dropping the
held-train projection fails 4, forgetting the tray queues fails 2. The
empty blocked panel is reported beside its positive control, since an
empty result from a broken function proves nothing.

NOT VERIFIED AT A TABLE. Engine and view work, checked by tests and by
running the engine. #39 and #35 still stand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y5boPxP6JHRYMm8adXaF5R

TODO.md

@@ -363,11 +363,6 @@ are one section is that each one found the next.
       them. **The flag matters more than the 29** — two are Gitea#18 leftovers in one file, one found
       by hand and the other missed. Do #48 first; it settles ten of them. See **Reference · #46**.
 
-- [ ] **#45** — The Frame carries two things nothing reads — `viewerSeat` and `overHandLimit`.
-      **Deferred by Jesse 2026-08-30** ("leave it for now"); the decision when it comes is
-      delete-or-document, not a patch. The two tally fields found by the same audit are fixed. See
-      **Reference · #45**.
-
 - [ ] **#84** — Five test fixtures pinned a seed and meant "a game like this". All five broke on
       Gitea#14 for that reason. See **Reference · #84**.
 
@@ -1584,11 +1579,33 @@ screen. Fixing them turned up something else worth knowing: `resultsHtml` draws
 screen, which is how the first attempt at pinning this failed for a reason unrelated to the
 fix.
 
-**The two plumbing ones — `viewerSeat` and `overHandLimit` — are DEFERRED (Jesse, 2026-08-30):
-"leave it for now."** They cost nothing today and v0.7.9 had enough in it. The decision when it
-comes is delete-or-document, not a patch: either strip the field and the `Session`-interface
-method, or write down what each is being carried ahead of a consumer FOR, so the next audit
-does not re-flag them.
+**The two plumbing ones are DONE — 2026-09-07 in v0.7.9.6, and the answer was different for
+each.** Deferred by Jesse 2026-08-30 ("leave it for now") on the understanding that the decision
+would be delete-or-document rather than a patch.
+
+- **`overHandLimit` — WIRED, because the consumer existed all along and was guessing.** `main.ts`
+  draws a disabled "End Local Operations" button explaining the hand limit, and decided to draw it
+  from `f.option === 'draw' && !menu.options.some(i => i.type === 'draw.end')` — i.e. from the
+  ABSENCE of the move. That is sound only because `check('draw.end')` refuses for exactly three
+  reasons and the two guards beside it rule out the other two; a fourth reason would have made the
+  panel explain a refusal by describing something else entirely, which is #90 verbatim. It now reads
+  `f.overHandLimit`, which is what `web/game.ts` says the field is for: "so the page can DISABLE the
+  button with a reason instead of hiding a move that has simply become illegal." Behaviour-neutral
+  today; what changed is that the screen states its reason instead of inferring it.
+- **`viewerSeat` — DOCUMENTED, with a condition.** Gitea#20's common board keys every district by
+  SEAT and resolves the player through `playerAtSeat`, so a client picking its own district out of a
+  seat-keyed board needs this and cannot derive it from `viewer`. The declaration now says so, and
+  says to delete it if step 2 ships without using it — a note is a reason to survive one audit, not
+  an exemption from the next.
+
+**And the audit's own method found a third limb it had missed.** `game.mustPlayCard` was set from
+`overHandLimit` on every submit and read by nothing at all — deleted. Chasing that turned up the
+thing actually worth fixing: the §6.2 hand-limit test existed in **three** places — `check('draw.end')`
+in `apply.ts`, an inline recomputation in `snapshot()`, and `web/game.ts`'s own. All three agreed,
+which is exactly the state #96's disagreement started from. There is now one `overHandLimit(state,
+player)` in `state.ts` and the other two ask it. `Session.overHandLimit()` — declared on the
+interface and implemented twice, locally and remotely — is deleted rather than kept: the Frame
+already carries the fact, so the method was a second path to it.
 
 #### #84 — FIVE TEST FIXTURES PINNED A SEED AND MEANT "A GAME LIKE THIS".
 
@@ -1830,6 +1847,81 @@ the numbers stay so cross-references above and below still resolve.
     `Frame.lines` is the solitaire and replay path, which builds its Frames through `snapshot()`
     directly and is untouched.
 
+98. ~~**The Crew Tray pool was an "explicit mechanic" that only the engine could see.**~~ — done
+    2026-09-07 in v0.7.9.6. §7 scarcity is real — there are fewer trays than trains wanting one — and
+    the view read none of the three things the engine knows about it: how many are free, which Extras
+    are queued for one, which second sections are. The panel that answers "why is nothing moving?"
+    had a single tray rule, keyed off the train due out THIS Stage, so a player who had spent a card
+    on an Extra or ordered a second section got an **empty** panel while their train sat behind an
+    exhausted pool. Both had been announced once in the log, in a line promising a future event ("as
+    soon as a Crew Tray frees up") that nothing then confirmed.
+
+    `projectSharedTable` now carries `crewTrays` and `queued`, so the common board gets it too, and
+    the blocked panel reports all three cases with the count beside them — "no free Crew Tray" alone
+    reads as a permanent fact about the game rather than a state that will pass. An Extra is reported
+    to the player who played the card, because §7 gives the train to them; a second section is the
+    table's, like any Timetabled train.
+
+    **Worth knowing:** the first draft derived the pool size as `trays.size + freeTrays.length`,
+    which is invariant in play (`retireTrain` returns the tray) and read **"0 of 0"** the moment it
+    met a state where a tray was neither free nor carrying a train. `crewTrayCount` already owned
+    that number. A second way to know one fact is the shape of every bug in this release.
+
+    **THE METHOD, which is worth more than the three fixes** (#98, #99, #100 all came out of it, and
+    `test/display-gaps.test.ts` cites this entry for it). Gitea#21, Gitea#22, #94 and #96 were four
+    instances of one fault in a row — the engine gained something that changes what a train may do,
+    and nothing drew it — and every one was found by a player hitting it. So instead of waiting for
+    the fifth: enumerate every field of `GameState` and its nested types, check each for a reader in
+    `sim/view.ts`, `src/web/` and `sim/narrate.ts`, then **verify the survivors by running the engine
+    rather than trusting the grep**. Four fields had no reader. `movedThisPhase` is set and cleared
+    inside one `advance` call and is genuinely nobody's business; the other three are the items
+    above.
+
+    **A field is not a display gap merely because nothing renders it**, and saying so is what keeps
+    the sweep honest. `freightWorked`, `drawnThisTurn`, `freightAgentUsed`, `switchedSince` and
+    `movesUsed` were all ruled out: their EFFECT is already visible as legality, or as a complement
+    already on the Frame (`movesRemaining`). `dispatchUsedToday` — a once-a-Day bonus already spent,
+    discoverable only by the action being refused — is the one genuine maybe left, and is not done.
+
+    The verification mattered twice. The blocked panel returning `[]` for the two queues is only
+    evidence alongside the positive control — the same state with a timetabled train due, which
+    correctly reports "no free Crew Tray". And #99's "drawn nowhere" was established by watching a
+    chip present on the Interchange node before the move to `heldAtLimits` and absent after.
+
+99. ~~**A train held at the Limits by an Interlocking vanished off the board.**~~ — done 2026-09-07
+    in v0.7.9.6, and the most serious of the three. The Interlocking is the designed answer to a full
+    Office — instead of Gap 2d's automatic collision, "may stop an inbound train on the Limit Track",
+    and it takes the first A/D track that frees ahead of any newcomer.
+
+    `arriveAtOffice` removes the tray from the Mainline node's `transits` and the Interlocking branch
+    pushes it onto `area.heldAtLimits` **without assigning `tray.position`**. The map draws mainline
+    nodes from `transits` and district squares from `position.at === 'grid'`, so between the two it
+    was drawn in NEITHER. Measured: with the tray in `transits` the Interchange node carries its
+    chip; moved to `heldAtLimits` exactly as the engine moves it, the node's `trains` is `[]` and no
+    grid square has gained it. The train disappeared on arrival and reappeared in the Office some
+    Stages later, with one log line as the only account of it.
+
+    **Fixed in the VIEW, not the engine.** The engine's state is right — a held train is inside the
+    Limits and not on an A/D track — and `position` is left alone deliberately, so nothing may treat
+    it as standing on a square it could be switched from. `trainsOnCard` draws it on the Limits
+    square it came in by (eastbound at `limitsWest`, westbound at `limitsEast`), flagged
+    `heldAtLimits` so it does not read as an ordinary arrival, with the reason on the chip and in the
+    blocked panel.
+
+100. ~~**The Campaign Train's speeches changed its rules and the card never said which half it was
+     in.**~~ — done 2026-09-07 in v0.7.9.6. X17 is "one turn at station (speeches) then expedite":
+     its first Office arrival is an ordinary stop, and every arrival after runs EXPEDITED — so if it
+     is not back on the Office square when the next Mainline Phase begins, that is a Station Master
+     fault costing 1 Revenue.
+
+     `trainRules()` took `{ trainNumber, trainIsExtra }` and so could not see `speechMade`, even
+     though both of its tray-side callers hand it a whole `CrewTray` that has it. The chip therefore
+     read identically before and after — and worse, the "EXPEDITED … costs 1 Revenue" warning is
+     printed only under `rules.expedite`, so X17 became subject to a fault whose warning the game
+     shows to every other expedited train and never to it. It now says which half it is in, and
+     borrows `isExpedited` from `advance.ts` rather than restating the test: a card describing a rule
+     the engine does not apply is the failure this sits inside.
+
 32. ~~**Tell the 0.4.9 playtesters their saves are dead, before they find out.**~~ — done
     2026-09-07. `PLAYTEST-0.7.4.md` was written for exactly this and did its job; Jesse, 2026-09-07:
     "a temporary document to help some of the playtesters out on making the big jump, but that is no