v0.4.9f — an Extra starts where you put it, a train card is never discarded

The 0.6.2 change, ported to the playtest line. Three from the v0.4.9e gameplay-testing round —
Gitea#4 extras did not start where the player said, #6 train cards could be discarded, #7 four
train cards had the wrong coach counts — plus two bugs found underneath #4. Gitea#2 is diagnosed
but NOT fixed; it needs a ruling, and the reasoning is in TODO.md.

GITEA#4 — AN EXTRA STARTS WHERE THE PLAYER PUTS IT. Both Division Points are offered now, and the
START decides the direction rather than the number: an odd westbound Extra placed at the WEST end
would otherwise leave the Division on its first move having crossed nothing and be paid for the
run. At an Interchange or a Control Point the player picks the direction. The Interchange start is
a YARD, off the running line, which is what makes the Superintendent clause work — placing an
Extra there can never force a collision, a guaranteed one holds it for another Stage, and a
potential one is the Superintendent's to rule on, which are §8.1's two existing answers. Where an
Extra may start is a new setting in the New Game dialog, defaulting to what the engine already did
so this build does not change under its testers mid-line.

FOUND UNDERNEATH IT, both already shipping: an Extra started away from a Division Point could
never be given a consist and ran empty, so the Control Point start has been broken since it was
added; and collide left destroyed trains' transits on the Mainline card, permanently poisoning
that card for every later train.

THE MAINLINE CARDS ARE DEALT FROM THE PRINTED DECK NOW, without replacement. They were drawn from
the nine types with replacement, so a Division could hold two Interchanges — and "an Extra may
start at the Interchange if one is on the board" only reads as a rule if the board holds at most
one. This re-deals every seed, so both published replays were retired and re-recorded.

GITEA#6 — A TRAIN CARD IS NEVER DISCARDED, Timetabled and Extra alike. No forcing mechanism was
needed: nothing discardable plus a hand over the limit leaves exactly one legal way to end the
turn, and playing a train is unconditionally legal, so a hand of four cannot trap anyone. The hand
panel says so on the train, and the blocked end-turn button changes its wording.

GITEA#7 — COACH COUNTS. 1/2 Crack Limited 3 -> 2, 5/6 The Sparrow 2 -> 3.

WHAT DIFFERS FROM THE MAIN LINE. The car-placement round rotation test that accompanies #7 there
arrived with the 0.6 multiplayer work and does not exist here, so there was nothing for the
coach-count change to follow. src/web/main.ts and test/web.test.ts needed hand-resolution: this
line's New Game dialog has neither the mode radios nor the victory dials, so only the Extra-start
parts were taken. The content.ts comment pass came across whole; main's TODO documentation item
did not, since this line keeps its own TODO.

623 tests pass, tsc clean, site builds.

CHANGELOG.md

@@ -19,6 +19,87 @@ page as `v0.1.0 · <sha> · <date>`, so what is deployed can always be identifie
 
 ---
 
+## 0.4.9f — 2026-08-22
+
+Three more from the v0.4.9e gameplay-testing round, filed as Gitea issues: **#4** extras did not start
+where the player said, **#6** train cards could be discarded, **#7** four train cards had the wrong
+coach counts. Two further bugs were found underneath #4 and are fixed with it. **Gitea#2 is diagnosed
+but NOT fixed** — it needs a ruling, and the reasoning is in `TODO.md`.
+
+The same change ships as **0.6.2** on the main line. The full reasoning for every item is in that
+line's CHANGELOG; this entry records what reached the playtest build and what differs.
+
+### Gitea#4 — an Extra starts where the player puts it
+
+Both Division Points are now offered, not the one the train's number dictates, and **the start decides
+the direction** rather than the number — the two cannot both hold, since an odd westbound Extra placed
+at the WEST end would leave the Division on its first move having crossed nothing and be paid for the
+run. At an Interchange or a Control Point, where both ways are real runs, the player picks.
+
+The Interchange start is a **yard**, off the running line, which is what makes the Superintendent
+clause work: placing an Extra there can never force a collision however busy the card is; a guaranteed
+collision holds it in the yard for another Stage and it tries again; a potential one is the
+Superintendent's to rule on. Those are §8.1's two existing answers, so nothing new decides collisions.
+
+Where an Extra may start is a **new setting in the New Game dialog** — Division Points and the
+Interchange only, plus your own Control Point, or plus any player's — defaulting to what the engine
+already did, so this build does not change under its testers mid-line.
+
+**Found underneath it, and both had been shipping:** an Extra started anywhere but a Division Point
+could never be given a consist and ran empty (so the Control Point start has been broken since it was
+added), and `collide` left destroyed trains' transits on the Mainline card, which permanently poisoned
+that card for every later train.
+
+**The Mainline cards are now dealt from the printed deck without replacement.** They were drawn from
+the nine types WITH replacement, so a Division could hold two Interchanges — and "an Extra may start at
+the Interchange if one is on the board" only reads as a rule if the board holds at most one.
+
+### Gitea#6 — a train card is never discarded
+
+Timetabled and Extra alike. Hold one for as many Stages and Days as you like; it never goes onto a
+Department pile. **No forcing mechanism was needed:** nothing discardable plus a hand over the limit
+leaves exactly one legal way to end the turn, and playing a train is unconditionally legal, so a hand
+of four trains cannot trap anyone. The hand panel says so on the train itself, and the blocked
+end-turn button changes its wording when every card held is a train.
+
+### Gitea#7 — coach counts
+
+**1/2 Crack Limited 3 coaches → 2. 5/6 The Sparrow 2 → 3.**
+
+### What differs from the main line
+
+- The **car-placement round rotation test** that accompanies #7 on main was not ported: that test
+  arrived with the 0.6 multiplayer work and does not exist on this line, so there was nothing for the
+  coach-count change to follow.
+- `src/web/main.ts` and `test/web.test.ts` needed hand-resolution — this line's New Game dialog has
+  neither the mode radios nor the victory dials, so only the Extra-start parts were taken.
+- The `content.ts` comment pass came across whole; the `TODO.md` documentation item did not, since
+  this line keeps its own TODO.
+
+**Both published replays were retired by the rules change and re-recorded.** 623 tests pass.
+
+### The deploy script was broken by a host upgrade
+
+Not part of the playtest report — found trying to publish this build. Every deploy died with
+`login failed: 404 404 page not found`, because the File Browser host has been upgraded to
+**FileBrowser Quantum**, a fork whose API differs from the v2.63 one `deploy-web.ts` was written
+against. Three things moved at once, each fatal on its own:
+
+1. **Auth is a session COOKIE**, not a JWT in the response body sent back as `X-Auth:`.
+2. **The password is a header** — `X-Password`, URL-encoded — not a JSON body field.
+3. **The path is a query parameter** (`?path=`), and every resource call must also name a
+   **`source`**: Quantum can serve several named stores and refuses any call that does not say which
+   ("no source provided"). The v2.63 API had no such concept.
+
+Rewritten against the running instance's own bundle rather than guessed — the same discipline the
+v2.63 version was written with — and each path confirmed against the live host by response code: an
+endpoint that exists answers a bad password with **401**, one that does not answers **404**. The
+source is discovered from `GET /api/settings/sources`; one configured source is used silently, and
+several makes the script stop and list them rather than deploy the site into the wrong store.
+`FB_SOURCE` overrides it, and `FB_OTP` carries a two-factor code.
+
+---
+
 ## 0.4.9e — 2026-08-22
 
 Six bugs came back from a gameplay-testing session on 0.4.9d. Five are fixed here; the sixth could not