v0.5.0 — multiplayer Phases 2 and 3: a server that runs a game and survives being restarted

Phases 0-1 shipped in v0.4.0 (seat/identity split, per-player turn state, the Session boundary).
This lands Phase 2 (server core, one game, no lobby) and Phase 3 (persistence and resumption) per
docs/architecture/multiplayer.md §12. Phases 4-6 (lobby/reconnection, the 22 opponent-directed
cards, StartOS packaging) are still ahead.

Phase 2: src/server/session.ts hosts a game in pure logic (no sockets) on top of game.ts's existing
Game/submit/currentActor/actionMenu; it verifies seat === currentActor(game) itself before calling
submit, since submit() trusts its caller and a server can't. src/server/http.ts and index.ts add
POST /api/game, GET /api/stream (SSE, per-seat), POST /api/intent, and static serving of dist/.
src/sim/frame-delta.ts is a purpose-built per-seat board delta for one live push at a time. Found
and fixed along the way: actionMenu(game, seat) only used seat for the hand field, so a server
computing every connected seat's Menu would have handed the acting player's legal moves to a
waiting seat. Verified with a live end-to-end smoke test (2-player game, two SSE streams, a
rejected intent from the wrong seat, an idempotent resend) plus test/server/session.test.ts and
test/redaction.test.ts. Not verified: an actual browser (none available in this environment).

Phase 3: src/server/persistence.ts writes game.json and turn-timings.json, atomic-rewrite-then-
rename. game.ts gained fromMultiplayerSave, fixing a narration-attribution bug found while testing
it (fromSave's replay loop drops the actor argument, invisible in solitaire, unreadable the moment
there's more than one seat — fromSave itself still has this gap, deliberately untouched). Verified
live: server killed and restarted mid-game, both seats reconnected exactly where they left off.

Two rules bugs found while building this: the New Train phase never implemented its car-placement
round (every car of every train was placed by the Superintendent alone, in every mode, all along —
now reads the round position off tray.consist.length); and victory conditions are now one shared,
configurable GameConfig set across solitaire/competitive/coop instead of a fixed length lookup and
a dead firstToTarget condition.

Also folds in the three fixes already released on the patch line as v0.4.9b/c/d: a switching
train's crew badge failing to draw once it left the Office square, an unload that always took the
westmost car regardless of which was picked, and a legal decision that could render with zero
buttons.

docs/testing/0.5.0-test-plan.md and three reported-bug save files (docs/station-master-seed*.json)
included for reproducibility. tools/jitsi-harness/ deliberately left untracked — unrelated
side-project work, not part of this release. 635 tests, 0 failures.

src/engine/setup.ts

@@ -53,13 +53,16 @@ export type SetupOptions = {
 };
 
 /** Builds the 52-card Home Office deck (§12.1). Unshuffled; caller shuffles with the seeded RNG. */
-export function buildDeck(mode: GameConfig['mode'] = 'competitive'): Card[] {
+export function buildDeck(mode: GameConfig['mode'] = 'competitive', pvpCardsAllowed = false): Card[] {
   /**
-   * THE 22 OPPONENT-DIRECTED CARDS ARE OUT OF EVERY DECK FOR NOW, not just the solitaire one.
+   * THE 22 OPPONENT-DIRECTED CARDS ARE OUT OF EVERY DECK REGARDLESS OF `pvpCardsAllowed`, for now.
    *
    * Q6 took them out of solitaire because they have no legal target in a one-player game. They are
    * out of the competitive deck too because `checkPlay` answers both categories `NOT_IMPLEMENTED`:
    * leaving them in would make ~9% of draws reject outright, which is worse than not dealing them.
+   * `pvpCardsAllowed` (`GameConfig`, wired 2026-08-20) is the player-facing toggle, but ANDing it
+   * with `cardsImplemented` keeps it inert until Phase 5 actually builds the cards — flipping
+   * `pvpCardsAllowed` on today must not turn a working game into one where ~9% of draws reject.
    *
    * AND SO ARE THE SEVEN CARDS THAT ANSWER THEM — see below. They used to be dealt and sit dormant,
    * which is the same dead draw by another name. Recorded in TODO.md as multiplayer work.
@@ -68,7 +71,8 @@ export function buildDeck(mode: GameConfig['mode'] = 'competitive'): Card[] {
    * for these two categories today.
    */
   void mode;
-  const opponentCardsInDeck = false;
+  const cardsImplemented = false;
+  const opponentCardsInDeck = pvpCardsAllowed && cardsImplemented;
   const cards: Card[] = [];
   let n = 0;
   const push = (kind: Card['kind']): void => {
@@ -226,17 +230,15 @@ function buildDivision(players: number, rng: Rng): DivisionNode[] {
   const mainline = (): DivisionNode => {
     const card = kinds[rng.nextInt(kinds.length)]!;
     const node: DivisionNode = { kind: 'mainline', card, transits: [] };
-    // The Heavy Grade card says "Player sets orientation", but setup has no decision point yet —
-    // createGame is synchronous and returns a ready state. Rolled for now so the orientation is at
-    // least deterministic and varies between games; it should become a real player choice when
-    // setup gains an interactive phase. See implications.md §10 Q11.
     if (mainlineProfile(card).speed.kind === 'grade') {
       /**
-       * TEMPORARY, and flagged in TODO. The card prints "(Up)" and "Player sets orientation", so
-       * which way a Heavy Grade climbs is the player's decision — but it is dealt during setup, and
-       * setup has no decision point at all. Rolled from the seed until it gains one, because the
-       * orientation MATTERS: it decides which direction climbs, and therefore what a Brakeman or
-       * Helpers card is worth.
+       * SETTLED, not provisional (v0.5.0, Jesse's call) — this overrides the card's own printed
+       * "Player sets orientation". A Heavy Grade sits on the shared west-to-east chain BETWEEN two
+       * players (§4.2), or beyond an end Division Point next to one — never inside one player's own
+       * district — so whichever direction climbs advantages one neighbour over the other, and there
+       * is no single player who owns that call fairly. Orientation is rolled from the seed instead,
+       * identically for solitaire and multiplayer, and this is not expected to change when setup
+       * eventually gains an interactive phase for other decisions. See implications.md §10 Q11.
        */
       node.gradeUp = rng.nextInt(2) === 0 ? 'east' : 'west';
     }
@@ -317,7 +319,7 @@ export function createGame(opts: SetupOptions): GameState {
    */
   const rules = houseRules(config);
   const deal = OPENING_DEALS[rules.startingHand];
-  const deck = buildDeck(config.mode);
+  const deck = buildDeck(config.mode, config.pvpCardsAllowed);
   const cards = new Map<CardId, Card>();
   for (const c of deck) cards.set(c.id, c);
 
@@ -409,6 +411,7 @@ export function createGame(opts: SetupOptions): GameState {
     turns: freshTurns(playerCount, MOVES_PER_LOCAL_OPS),
     movedThisPhase: new Set(),
     collisionsToday: 0,
+    collisionsTotal: 0,
     status: 'active',
     outcome: null,
   };