v0.5.1 — multiplayer Phase 4: lobby, sessions, reconnection

A real server existed since v0.5.0 but nobody could reach it without a hand-built ?seat=&secret=
URL. This is what makes it a game you can actually create or join.

The server now hosts more than one game: src/server/lobby.ts (new) is pure logic — creating,
joining, bot seats, host transfer, starting — same split session.ts already draws for a running
game. persistence.ts gained one directory per gameId plus a top-level index so index.ts resumes
every saved game on boot. /api/stream and /api/intent now authenticate by session token instead of
?seat=&secret= — the token alone proves identity (lobby-and-sessions.md §1), so the join secret's
job ends at the lobby door.

Bots fill empty seats at Lobby.Start only, never take over a disconnected human (D8): session.ts
gained driveBots(), playing developerBot forward through consecutive bot seats after every accepted
intent. Disconnect keeps the seat and says so — Push gained an optional presence field, built
entirely by http.ts and never routed through the engine, since a disconnect is transport news, not
a GameEvent. Host rights pass to the earliest-joined remaining player if the host drops before
start.

Client: src/web/lobby.ts adds create/join forms and a live seating screen; localStorage replaces
?seat= for reconnecting straight back into a game already joined. A Multiplayer button sits beside
New game; the New Game dialog itself is untouched.

Found only by the live smoke test, not by typechecking: /api/intent read its token from the JSON
body while the client sends it in the query string (matching /api/stream) — every intent failed
"no such game" until caught by curl-level verification.

Doc fix: multiplayer.md's D18 said the player cap was 6; lobby-and-sessions.md §2 says 2-4 with the
reasoning and the test coverage to back it. The two had drifted apart. D18 now reads 2-4.

Not verified: an actual browser walking through the lobby screens — none available in this
environment, same limitation Phase 2's RemoteSession shipped under. 656 tests, 0 failures.

tools/jitsi-harness/ deliberately left untracked — unrelated side-project work, not part of this
release.

src/server/index.ts

@@ -1,5 +1,6 @@
 /**
- * Process bootstrap — Phase 2 §12 step 8, extended for Phase 3 (§12 steps 14-15) load-on-start.
+ * Process bootstrap — Phase 2 §12 step 8, extended for Phase 3 (§12 steps 14-15) load-on-start and
+ * Phase 4 (§12 steps 17-20) to resume every saved game and lobby, not just one.
  *
  * Run with:  node src/server/index.ts
  *
@@ -11,9 +12,10 @@ import { readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { startServer } from './http.ts';
-import { loadGame } from './persistence.ts';
+import { gameDir, loadGame, readIndex, readLobby, readSessions } from './persistence.ts';
 import { resumeSession } from './session.ts';
 import type { GameSession } from './session.ts';
+import type { Lobby, PlayerSession } from './lobby.ts';
 
 const port = Number(process.env['PORT'] ?? 8081);
 const bindAddress = process.env['BIND_ADDRESS'] ?? '0.0.0.0';
@@ -31,21 +33,50 @@ if (!joinSecret) {
 const root = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
 const engineVersion = (JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')) as { version: string }).version;
 
-let initialSession: GameSession | null = null;
+const initialGames = new Map<string, GameSession>();
+const initialLobbies = new Map<string, Lobby>();
+const initialSessions = new Map<string, PlayerSession>();
 
-const loaded = await loadGame(dataDir, engineVersion);
-if (loaded.found && loaded.ok) {
-  initialSession = resumeSession(loaded.saved);
-  console.log(`Resumed a saved game from ${dataDir} (${loaded.saved.history.length} intents replayed).`);
-} else if (loaded.found && !loaded.ok) {
-  // Refused explicitly (§12 step 15) — never silently replayed under rules it wasn't recorded
-  // under. The file is left untouched: rolling the running version back would let it load again.
-  console.error(
-    `Refusing to load ${dataDir}/game.json: it was saved under engine version ` +
-      `${loaded.storedVersion}, this server is running ${engineVersion}. Starting with no active ` +
-      `game. The saved file has not been touched.`,
-  );
+const index = await readIndex(dataDir);
+for (const entry of index) {
+  const sessions = await readSessions(dataDir, entry.gameId);
+  for (const s of sessions) initialSessions.set(s.token, s);
+
+  if (entry.status === 'lobby') {
+    const lobby = await readLobby(dataDir, entry.gameId);
+    if (lobby) initialLobbies.set(entry.gameId, lobby);
+    continue;
+  }
+
+  const loaded = await loadGame(gameDir(dataDir, entry.gameId), engineVersion);
+  if (loaded.found && loaded.ok) {
+    initialGames.set(entry.gameId, resumeSession(loaded.saved));
+    console.log(`Resumed ${entry.gameId} (${entry.gameCode}) — ${loaded.saved.history.length} intents replayed.`);
+  } else if (loaded.found && !loaded.ok) {
+    // Refused explicitly (§12 step 15) — never silently replayed under rules it wasn't recorded
+    // under. The file is left untouched: rolling the running version back would let it load again.
+    console.error(
+      `Refusing to resume ${entry.gameId} (${entry.gameCode}): saved under engine version ` +
+        `${loaded.storedVersion}, this server is running ${engineVersion}. Left untouched, and ` +
+        `will not appear as an active game until the version matches again.`,
+    );
+  }
+  // `entry.status === 'finished'` games are not resumed into memory at all — nothing plays them
+  // forward, and their files stay on disk for post-game replay (`lobby-and-sessions.md` §6).
 }
 
-startServer({ port, bindAddress, joinSecret, distDir, dataDir, engineVersion, initialSession });
-console.log(`Station Master multiplayer server on ${bindAddress}:${port}, serving ${distDir}`);
+startServer({
+  port,
+  bindAddress,
+  joinSecret,
+  distDir,
+  dataDir,
+  engineVersion,
+  initialGames,
+  initialLobbies,
+  initialSessions,
+});
+console.log(
+  `Station Master multiplayer server on ${bindAddress}:${port}, serving ${distDir} — ` +
+    `${initialGames.size} game(s) and ${initialLobbies.size} lobby(ies) resumed.`,
+);