v0.8.6 — a Competitive seat gets its save when the game is over

Jesse's ruling on TODO #117: accept the leak in Co-op; otherwise, save only at the end of
the game. `/api/save` answers 403 SAVE_AFTER_FINISH to a Competitive seat while the game
runs, and serves a Co-op or one-seat game at any time. The Save replay button says why and
stays disabled until the end. Pinned in the HTTP suite; documented in rules.md §6.4.

Also corrects the 0.8.3 changelog entry: 0.8.2's notes did name the Second Section card
going into the deck; what was missing was the save check after it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FrCWubm9GAftYCm2hWdKwK

test/server/http.test.ts

@@ -151,6 +151,25 @@ describe('the HTTP layer (v0.8.4)', () => {
     assert.equal(reconnect['lastSeq'], 1, 'the reconnect push does not carry the count');
   });
 
+  it('hands a Competitive seat its save only once the game is over, and a Co-op seat at any time', async () => {
+    // Jesse's ruling on TODO #117: the seed in a save is every rival's hand, so a Competitive
+    // download waits for the end; a co-operative table has nothing to hide from itself.
+    const { host } = await table();
+    assert.equal((await post('/api/lobby/start', { token: host.token })).status, 200);
+    const refused = await fetch(base + `/api/save?token=${host.token}`);
+    assert.equal(refused.status, 403, 'a running Competitive game handed out its seed');
+    assert.deepEqual(await refused.json(), { error: 'SAVE_AFTER_FINISH' });
+
+    const coop = await post('/api/lobby/create', { secret: SECRET, config: { ...config, mode: 'coop' }, displayName: 'Host', players: 2 });
+    const coopHost = coop.json as unknown as Seat;
+    assert.equal((await post('/api/lobby/join', { secret: SECRET, gameCode: coopHost.gameCode, displayName: 'Guest' })).status, 200);
+    assert.equal((await post('/api/lobby/start', { token: coopHost.token })).status, 200);
+    const allowed = await fetch(base + `/api/save?token=${coopHost.token}`);
+    assert.equal(allowed.status, 200, 'a Co-op seat could not download its save');
+    const body = (await allowed.json()) as { save: { seed: number } };
+    assert.equal(typeof body.save.seed, 'number');
+  });
+
   it('applies a burst of concurrent moves one at a time and leaves the save readable', async () => {
     const { host, guest } = await table();
     assert.equal((await post('/api/lobby/start', { token: host.token })).status, 200);