v0.4.1 - bug fixes. initial d12 rolls determine what player in which seat.

docs/architecture/multiplayer.md

@@ -31,10 +31,17 @@ follows is assembly.
 ## 2. What holds, and what moved
 
 `overview.md`'s core claims survived contact with the implementation: server authority, a pure
-deterministic engine, two entry points (`applyIntent` / `pump`), `state = fold(events)`, events that
-render standalone, per-player redacted views.
+deterministic engine, two entry points (`applyIntent` / `pump`), events that render standalone,
+per-player redacted views.
 
-Three things moved:
+Four things moved:
+
+**`state = fold(events)` is not true, and the intents are canonical instead.** `applyIntent` does go
+through the reducer, but the phase driver does not — it mutates and then emits a descriptive event —
+so fourteen of the forty-six event types are never reduced, including the clock and the whole Mainline
+phase. This costs nothing, because the plan never needed it: persistence is `{ seed, history }` (§10)
+and the wire carries `Frame`s rather than events (D2/D3). Reconnection is a fresh `Frame`, not an
+event tail.
 
 **The save format is already the wire format.** A game is `{ seed, history: Intent[] }` and `fromSave`
 reconstructs it exactly. That is what makes persistence nearly free (§7).
@@ -270,14 +277,24 @@ Two consequences:
 runs the server. Anyone holding it may create a game, and may join any created game that has not
 started. No accounts, no user database. *(Revisit — see `TODO.md`.)*
 
-**Identity: a session token scoped to one game**, exactly as `lobby-and-sessions.md` already
-describes. Joining issues it; presenting it *is* the rejoin, because it already names the game and
-the seat:
+**Seating is decided by §4.4's D12** as of v0.4.1, so `seating` is a real permutation rather than the
+identity mapping. Everything "round the table" — acting order, the deal, the Fedora — is seat
+arithmetic via `playerLeftOf`, and the three places that were doing it with player indices were found
+and fixed by turning the roll on. That is the point: the seat/player split is now exercised by every
+multi-player game instead of only by tests that rotate `seating` by hand.
+
+**Identity: a session token scoped to one game**, exactly as `lobby-and-sessions.md` describes.
+Joining issues it; presenting it *is* the rejoin, because it already names the game and the person:
 
 ```
-Session   token, gameId, seat, displayName
+Session   token, gameId, player, displayName
 ```
 
+It names the **player**, not the seat — the two stopped being the same thing in v0.4.0, and Employee
+Rotation is precisely the case where a token naming a chair would seat someone in the wrong Office.
+The seat is `seatOf(state, player)`, one lookup and always current. (This said `seat` until the
+`lobby-and-sessions.md` review.)
+
 The join secret is separate and server-wide — typed once and kept per-origin for convenience. It
 gates entry; the token identifies a seat.
 
@@ -378,31 +395,38 @@ source check that `main.ts` never regains a `GameState` read or a value import f
 
 14. Append-only `{engineVersion, seed, config, history}` per game; index.
 15. Load on start; rebuild via `fromSave`; refuse a version mismatch explicitly.
+16. **Turn timings**, stored beside the history and never inside it — wall-clock per player per
+    phase, so "how long does a 4-player game take, and which phase is the wait?" becomes a measured
+    answer instead of a guess (`lobby-and-sessions.md` §5).
 
 **Done when:** the server restarts mid-game and both clients carry on.
 
 ### Phase 4 — Lobby, sessions, reconnection · M
 
-16. Join secret; per-game session token; display name.
-17. Create/join by game code; bot seats; seating UI showing the west-to-east chain; config locked at
-    start.
-18. Disconnect keeps the seat and announces it; reconnect resumes from `Last-Event-ID`.
-19. Optional turn timer, off by default, **denying** clearance on expiry.
+17. Join secret; per-game session token naming the **player** (not the seat); display name.
+18. Create/join by game code; bot seats; seating UI showing the west-to-east chain; config locked at
+    start; **2–4 players enforced here**, since the engine enforces nothing.
+19. Disconnect keeps the seat and announces it; reconnect replies with a full `Frame`.
+20. Host rights pass to the earliest-joined remaining player if the host leaves before start.
+
+**No forcing turn timer** — cut in the `lobby-and-sessions.md` review, and in `TODO.md` as something
+to explore only if halted games turn out to be a real problem. Nothing moves on an absent player's
+behalf.
 
 **Done when:** four people join from four browsers at two different addresses, one closes the tab and
 rejoins where they left off.
 
 ### Phase 5 — Multiplayer content · M
 
-20. The 10 Action and 12 Space-use cards; flip `opponentCardsInDeck` in `setup.ts`.
-21. Facing Point Locks, Water Column and Overpass stop being dormant — already wired.
+21. The 10 Action and 12 Space-use cards; flip `opponentCardsInDeck` in `setup.ts`.
+22. Facing Point Locks, Water Column and Overpass stop being dormant — already wired.
 
 **Done when:** an opponent-directed card resolves against another player and the Enhancement that
 answers it fires.
 
 ### Phase 6 — Package for StartOS · S
 
-22. `.s9pk` per the workspace guide: interface, health check, backup of the data directory.
+23. `.s9pk` per the workspace guide: interface, health check, backup of the data directory.
 
 **Done when:** it installs on a StartOS box and players on two different addresses play a game.