v0.5.2 — the splash's multiplayer door opens, and knows whether it should

The "Play multiplayer" door on index.html had sat disabled, labelled
"Coming soon", since before the server existed — Phases 2 through 4 built
a working lobby and nothing ever linked to it. Loading the site landed on
the same solitaire splash whether a real multiplayer server was behind it
or not, with no visible way in. Found packaging Phase 6 for StartOS.

The door is now a live link to ./play.html?lobby, and main.ts's start()
routes ?lobby straight to the lobby screen — the same showScreen('lobby');
runLobby(beginRemote) the in-game Multiplayer button already used —
instead of dealing a solitaire game first.

GET /api/health is new, and exists to be failed. The same dist/ ships both
served by src/server/ and uploaded as flat files by deploy-web.ts, and the
bundle is identical either way (D4), so the page cannot know from its own
build which it is; every other route 404s an unknown path exactly as a
static host does, so nothing distinguished them. The splash probes it on
load and closes the door when nothing names itself in reply.

The door starts open and only ever closes, deliberately: a wrong "no
server" is the bug above again — invisible, and it strands a player who
does have one — while a wrong "there is one" costs a click and a lobby
that says it cannot connect. The reply must name itself rather than merely
return 200, or a host answering every path with its index page would pass.

Verified: tsc clean; 659 tests pass (656 + 3); /api/health exercised live
against a running server — 200 with the right body, unauthenticated, while
an unknown path and a wrong method both still 404, which is what makes the
probe discriminate at all.

The probe's own test was vacuous on the first attempt — both its "closes"
cases reached close() through the .catch arm, so deleting the body-naming
check outright still passed. Caught by mutating splash.ts and re-running;
the test now covers all three closing routes and fails without the check.

.gitignore

@@ -8,8 +8,14 @@ Thumbs.db
 *.swp
 
 # Dependencies / build output
-node_modules/
+#
+# NO TRAILING SLASH on node_modules, deliberately. `node_modules/` matches a directory and not a
+# SYMLINK of that name — so one pointing at a shared install was committed in v0.4.7, and because it
+# pointed at a path that does not exist, a fresh checkout had no TypeScript: `npm run typecheck` said
+# "tsc: not found" and 20 tests failed for a reason that had nothing to do with the code.
+node_modules
 dist/
+dist-test/
 build/
 target/
 __pycache__/

CHANGELOG.md

@@ -19,6 +19,604 @@ page as `v0.1.0 · <sha> · <date>`, so what is deployed can always be identifie
 
 ---
 
+## 0.5.2 — 2026-08-21
+
+Found packaging Phase 6 for StartOS: the splash's "Play multiplayer" door had sat `disabled`,
+labelled "Coming soon," since before the server existed — Phases 2 through 4 built a working
+lobby and nobody ever pointed a link at it. Loading the site landed on the exact same solitaire
+splash whether a real multiplayer server was behind it or not, with no visible way in.
+
+`index.html`'s door is now a real link to `./play.html?lobby`, matching the other two doors.
+`main.ts`'s `start()` checks for `?lobby` and routes straight into the lobby screen — the same
+`showScreen('lobby'); runLobby(beginRemote)` the in-game Multiplayer button already used — instead
+of dealing a solitaire game first and leaving the player to find that button themselves.
+
+### The page can now tell whether a server is behind it
+
+The same `dist/` ships two ways — served by `src/server/`, or uploaded as flat files by
+`scripts/deploy-web.ts` with no server at all — and the bundle is byte-identical in both, because
+there is one client and the mode is decided at runtime (D4). So the splash could not know from its
+own build which it was, and nothing else distinguished them either: every route in `http.ts`
+answers a 404 for a path it does not have, exactly as a static host does.
+
+`GET /api/health` is new, and exists to be failed: `{ ok, service, engineVersion }`, no
+authentication (it says only that a Station Master server is answering, which is what the door is
+about to offer anyway — no game, no seat). The splash probes it on load and closes the door when
+nothing names itself in reply.
+
+**The door starts open and only ever closes**, deliberately. A wrong "no server here" is the bug
+above all over again — invisible, and it strands a player who *does* have a server. A wrong "there
+is one" costs a click and a lobby that says it cannot reach a server, which is legible and
+recoverable. So a slow or flaky probe leaves the door alone; only a definite answer closes it. The
+reply has to name itself rather than merely return 200, since a host that answers every path with
+its own index page would otherwise pass.
+
+Bug fix: the lobby machinery was already complete and tested (Phase 4, v0.5.1); this only
+re-enables the door to it, and teaches the splash when to.
+
+Worth recording about the tests: the first version of the probe's test passed with the naming
+check deleted outright. Both of its "door closes" cases happened to reach `close()` through the
+`.catch` arm, so the branch that actually reads the body was never run — and the comment claimed
+otherwise. Caught by mutating `splash.ts` and re-running rather than by reading it.
+
+---
+
+## 0.5.1 — 2026-08-21
+
+Multiplayer Phase 4 — lobby, sessions, reconnection (`docs/architecture/multiplayer.md` §12 steps
+17-20, fully specified in `docs/architecture/lobby-and-sessions.md`). Phases 0-3 shipped in v0.4.0
+and v0.5.0; a real server existed but nobody could reach it without a hand-built URL. This is what
+makes it a game you can actually create or join.
+
+### The server hosts more than one game, and knows who you are across a reconnect
+
+`src/server/lobby.ts` is new: pure logic, no sockets, no filesystem, the same split `session.ts`
+draws for a running game. `createLobby`/`joinLobby`/`setBotSeat`/`reassignHost`/`startLobby`, plus a
+speakable game code (`RAIL-4471` style) and the player cap.
+
+`persistence.ts` gained one directory per `gameId` and a top-level index, so `index.ts` resumes
+every saved game on boot, not just one. `/api/stream` and `/api/intent` now authenticate by session
+**token** instead of `?seat=&secret=` — `lobby-and-sessions.md` §1: the token alone proves identity,
+so the join secret's job ends at the lobby door (`/api/lobby/create`/`/api/lobby/join`).
+
+### Bots fill empty seats, never take over a disconnected human (D8)
+
+`session.ts` gained `driveBots()` — after any accepted intent, and once at construction for a
+resume that lands exactly on a bot's turn, it plays `developerBot` forward through every
+consecutive bot seat before the push goes out. Reuses `legalActions`/`developerBot` wholesale.
+`SavedGame` gained `botSeats` so a bot seat survives a restart. Bots are assigned once, at
+`Lobby.Start`, and never afterward — a disconnected human's seat waits, exactly as before.
+
+### Disconnect keeps the seat and says so; reconnect gets a full view, not a tail
+
+`Push` gained an optional `presence` field — connection news about another seat, built entirely by
+`http.ts` (which owns the connection table) and never routed through `session.ts` or the engine: a
+disconnect is transport news, not a `GameEvent`, and the engine must stay replayable from a seed.
+The page shows a small banner naming who has dropped and clears it the moment they reconnect.
+Host rights pass to the earliest-joined remaining player if the host's own connection drops before
+`Lobby.Start` — tracked by join order rather than seat, since a bot-filled seat never joined at all.
+
+### The client: an actual lobby, not a URL you hand-build
+
+`src/web/lobby.ts`, wired from `main.ts`: create-or-join forms, a live seating screen (host-only bot
+toggles and Start button, updated over its own SSE stream), and `localStorage` in place of `?seat=`
+for "was I already in a game" — found on load, it reconnects straight through and skips the lobby
+screen entirely. A `Multiplayer` button sits beside `New game`; the New Game dialog itself is
+untouched and still solitaire-only, its old "needs a server" note repointed at the new button.
+
+### Found only by the live smoke test, not by typechecking
+
+`/api/intent` read its token from the JSON body; `web/session.ts`'s `submit()` — unchanged since
+Phase 2 — sends it in the query string, the same as `/api/stream`. Every intent failed `no such
+game`. Both sides typecheck cleanly on their own (an HTTP body is `unknown` on the wire), which is
+exactly the gap a curl-level smoke test exists to catch: create a lobby, join a second player,
+start, submit from both seats (including a wrong-actor rejection and an idempotent resend),
+kill and restart the server and reconnect both tokens, start a bot-filled coop lobby and confirm it
+never stalls waiting on the bot, and watch a live stream receive a disconnect/reconnect presence
+notice for another seat.
+
+### Doc fix
+
+`multiplayer.md`'s decision table (D18) said the player cap was 6; `lobby-and-sessions.md` §2 —
+more detailed, and what `test/multiplayer.test.ts` actually exercises — says 2-4 with the reasoning
+for it. The two had quietly drifted apart; "6" was never implemented or tested anywhere. D18 now
+reads 2-4.
+
+**Not verified: an actual browser** walking through the lobby screens — none is available in this
+environment, the same limitation Phase 2's `RemoteSession` shipped under. 656 tests, 0 failures.
+
+---
+
+## 0.5.0 — 2026-08-21
+
+Multiplayer Phases 2 and 3 (`docs/architecture/multiplayer.md` §12): a real server exists now, one
+game at a time, and it survives being restarted mid-game. Phases 0 and 1 shipped in v0.4.0; Phases
+4–6 (lobby/reconnection, the 22 opponent-directed cards, StartOS packaging) are still ahead. Also
+folds in the three playtest fixes already released as v0.4.9b/c/d on the patch line, plus two rules
+bugs and a victory-condition redesign found along the way.
+
+### Phase 2 — server core, one game, no lobby
+
+- `src/server/session.ts` — the game session host: pure logic, no sockets, built entirely on
+  `game.ts`'s existing `Game`/`submit`/`currentActor`/`actionMenu` rather than re-deriving intent
+  application or narration. **Found while building it:** `submit()` derives the acting player from
+  `currentActor(game)` and never checks who is actually calling it — harmless for `LocalSession`
+  (only one possible caller) but not safe for a server, so the session host now verifies `seat ===
+  currentActor(game)` itself before calling `submit`, rejecting with `NOT_YOUR_TURN` otherwise.
+  Idempotent resend (a repeated `seq`) and the illegal-intent path (checked via `check()` directly,
+  so a rejection never pollutes the shared narration log with text meant only for the submitter) are
+  both handled here.
+- `src/server/http.ts` / `src/server/index.ts` — plain `node:http`, no framework: `POST /api/game`,
+  `GET /api/stream` (SSE, per-seat, 20s heartbeat, `id:` line per push), `POST /api/intent`, and
+  static serving of `dist/` so the server is same-origin with itself.
+- `src/sim/frame-delta.ts` — the live per-seat board delta (`deltaFrame`/`applyDelta`), a smaller
+  replacement purpose-built for a single live push rather than reusing `replay.ts`'s `compress()`,
+  which interns strings across a whole recorded array with nothing here to intern against; only its
+  one-step-back "null if unchanged" idea carried over.
+- **Found and fixed:** `actionMenu(game, seat)` only used `seat` for the `hand` field — everything
+  else came from `currentActor(game)` regardless of who asked, so a server computing every connected
+  seat's Menu would have handed the acting player's legal moves to a waiting seat, paired with the
+  wrong seat's cards. Fixed with a guard in `game.ts`; tested in `multiplayer.test.ts`.
+- The redaction test (§7, `test/redaction.test.ts`) passed on the first run against the existing
+  `snapshot()`, confirming it was already correct rather than just apparently so.
+- `src/web/session.ts` gained `createRemoteSession`; `main.ts`'s `start()` switches on `?seat=`
+  presence (one bundle, unchanged). Every `LocalSession`-only call site in `main.ts` now goes through
+  an `isLocal()` type guard instead of assuming.
+- Verified two ways: `test/server/session.test.ts` exercises the session host directly, and a live
+  end-to-end smoke test (server started, a 2-player game created, two SSE streams opened, an intent
+  rejected from the non-acting seat, accepted from the acting seat and broadcast to both, a resent
+  `seq` producing no second push, the board correctly nulled on the second push). **Not verified: an
+  actual browser** — no browser binary in this environment, so `RemoteSession`'s DOM-facing code
+  compiled and typechecks but was never clicked through visually.
+
+### Phase 3 — persistence and resumption
+
+- `src/server/persistence.ts` — `game.json` (`{engineVersion, seed, config, playerNames, history,
+  status, createdAt}`) and `turn-timings.json`, both atomic-rewrite-then-rename.
+- `game.ts` gained `fromMultiplayerSave`, `fromSave`'s multi-player sibling. **Found while testing
+  it:** `fromSave`'s replay loop calls `record(game, result.events)` without the `actor` argument
+  `submit()` always passes, so every replayed line loses its "Player X" attribution — invisible for
+  solitaire, immediately visible for multiplayer, where anonymous "Chose to…" lines are unreadable
+  the moment there is more than one seat. Fixed in the new function; `fromSave` itself still has the
+  gap, deliberately untouched here since it's used far more widely (undo, save/restore, the replay
+  viewer) and deserves its own pass.
+- `session.ts` gained `exportSave()`, `resumeSession()`, and turn-timing tracking — a span (player,
+  phase, day, stage, start/end wall-clock) that closes and reopens whenever the acting player, phase,
+  Day or Stage changes, recorded entirely in the session host and never inside `history` (a replay
+  must reproduce a game from decisions alone).
+- `index.ts` loads `game.json` on boot before starting the listener: version match → resumed and
+  replayed straight through; mismatch → refused explicitly and loudly, file left untouched, server
+  starts with no active game rather than replaying under the wrong rules.
+- Verified live: server started against a fresh data directory, a 2-player game created, intents
+  submitted from both seats, **the server process killed and restarted**, both `?seat=` streams
+  reconnected and picked up exactly where they left off — same Day/Stage/phase, correct whose-turn,
+  correct narration attribution. Separately confirmed the version-mismatch path with a hand-edited
+  `engineVersion`.
+- **Found and fixed an infrastructure bug along the way:** adding `test/server/` broke `npm test`'s
+  glob. `"test": "node --test test/**/*.test.ts"` relied on the shell passing the literal,
+  unexpanded pattern through whenever it matched no files at the shell level — the moment a
+  subdirectory existed, the shell expanded it to just that one file, and `npm test` silently ran only
+  the new suite. Fixed by listing both depths explicitly.
+
+### Two rules bugs found while building this
+
+- **New Train phase car-placement is one player's job even in competitive mode — it should be a
+  round.** §7 is explicit: starting with the Superintendent and working left, each player places one
+  car, and the round repeats until the consist is full. `newTrainPhase` never implemented the round —
+  `enterPhase` resets `actorOffset` to 0 on entry and nothing ever incremented it the way Local Ops
+  does — so the actor was always the Superintendent alone, for every car of every train, in every
+  mode. Fixed by reading the round position off `tray.consist.length`, which already counts
+  placements toward that tray and resets per train with no new state needed.
+- **Victory conditions unified across solitaire, competitive and coop.** One shared, configurable
+  `GameConfig` set (`days`, `minCombinedRevenue`, `maxCollisionsPerDay`, `maxCollisionsTotal`,
+  `pvpCardsAllowed`) replaces the old fixed `LENGTH_PROFILES.target`, a dead `firstToTarget` victory
+  condition, and a flat collision-floor constant. Collision caps stay flat rather than scaling with
+  player count — Jesse's call: more players means more independent chances to collide, not a bigger
+  shared budget, so multiplayer is deliberately riskier than solitaire at the same default. One New
+  Game dialog now covers all three modes, with fields greyed out wherever a mode forces a value.
+
+### The three v0.4.9b/c/d playtest fixes, folded in
+
+Already shipped on the patch line — see 0.4.9d below for the full writeup of each. Summarized: a
+switching train's crew badge failed to draw once it left the Office square (display only, game state
+was never affected); unloading a freight car always took the westmost one regardless of which car
+was picked; and a legal decision (`newTrain.startExtra`) could render with zero buttons, which was
+indistinguishable from a hang. 635 tests, 0 failures.
+
+---
+
+## 0.4.9d — 2026-08-21
+
+Three bugs from the same playtest session, patched directly onto 0.4.9a rather than the in-progress
+0.5.0 line: a display bug that made a switching train look like it had vanished, an engine bug that
+silently ignored which car the player chose to unload, and a UI bug that could render a legal
+decision with zero buttons — indistinguishable from a hang.
+
+### A switching train vanished from the board the moment it left the Office
+
+**REPORTED:** Train 3 stood at the Office; dropping the loaded boxcar off the back at the Freight
+House made the train "vanish off the face of the earth," regardless of which way it moved
+afterward. The game state was never wrong — replaying the reported save
+(`docs/station-master-seed116956197-day2.json`) through the engine directly showed `tray3` fully
+intact, in the right place, with the right consist, for the rest of the game. Nothing was ever lost
+from `state.trays`.
+
+The bug was in `officeSvg` (`board-svg.ts`): `selectedTrain` — the value that decides whether a
+card draws a train's crew badge (its label, engine arrow, and cars) — was assigned only inside the
+`cell.adTracks !== null` branch, which is true for the Office card and nothing else. A train
+standing on any other card, which is every card it stands on while actually being switched, got no
+badge at all. It disappeared on the very first move off the Office, not only at the Freight House —
+that was simply the first place a player was likely to pause and look. Traced to the Roster Pass
+(37b1e5b), which rewrote `CellView.train` into `CellView.trains[]` to show every train sharing the
+Office's A/D tracks and, in doing so, nested the general consist-drawing logic inside that
+Office-only branch instead of leaving it to run for any card with a train on it.
+
+**Fixed** by hoisting the `selectedTrain` assignment out of the `adTracks !== null` guard so it
+runs for every card; the A/D roster-chip loop itself stays inside the guard, since only the Office
+has more than one A/D track to draw chips for. New test: a train parked on an ordinary facility
+card, `adTracks: null`, now has to draw its crew badge — it did not before this fix.
+
+### Unloading always took the westmost car, whichever one was picked
+
+**REPORTED:** three loaded cars stood at a Freight House; asking to unload the east (right-hand)
+car unloaded the west one instead, every time, no matter which car was actually chosen.
+
+`laborer.beginUnload` already carried the player's choice as `carIndex`, and `check()` validated
+that specific car — but the event it produced, `unloadBegan`, carried only the car's `carType`, not
+which one it was. The reducer that actually performs the swap re-derived the target itself with
+`industryTrack.cars.findIndex(c => c.loaded)`, which always answers the first loaded car in track
+order regardless of what was requested — so the player's choice was thrown away between `check` and
+the reducer, and the westmost loaded car came off every time.
+
+**Fixed** by adding `carIndex` to the `unloadBegan` event and using it directly in the reducer
+(`src/engine/apply.ts`, `case 'unloadBegan'`), instead of re-deriving a car by scanning for
+`loaded`. New test in `apply.test.ts`: three loaded cars of three different types, asking to unload
+index 2 (east) now leaves indices 0 and 1 alone and empties exactly the one requested — it did not
+before this fix.
+
+### A legal decision could render with zero buttons — the game looked hung
+
+**REPORTED:** working the Freight House mid-cycle (unloading three cars, then reloading them), the
+game "seemed to have hung up. Cannot advance." No trains were on the Division or the Limits.
+
+Replaying the reported save turned up no engine deadlock at any point — every step had a legal
+action — but the exact final state (an Extra train due to start, no tray yet being made up) exposed
+a UI bug: `newTrain.startExtra`'s action group is titled by `trainCardTitle`, which begins "Making
+up Extra X22…" — the same prefix `renderActions()` (`main.ts`) used to strip from the action list on
+the assumption it always belonged to the separate yard-chip car-placement panel. With no tray being
+filled yet, that panel (`menu.makeUp`) is `null`, so nothing else rendered the Extra's "choose where
+it starts" decision either — a legal, present, correctly-computed option with no button anywhere on
+the page. Clicking nothing did nothing, which is indistinguishable from a hang.
+
+**Fixed** by matching the exact title of the one group `menu.makeUp` actually covers
+(`g.title !== menu.makeUp?.title`) instead of a title-prefix regex, so any other group that happens
+to start "Making up …" — however it got that title — stays on screen. The existing softlock
+regression test (`never strands the player with a legal move and no way to make it`) now mirrors the
+real render filter instead of only checking the raw menu, so this class of bug fails that test
+directly; a new deterministic test constructs the exact reported scenario (a pending Extra, no
+active make-up) and asserts its group survives the filter.
+
+590 tests, 0 failures.
+
+---
+
+## 0.4.9a — 2026-08-20
+
+Four small tweaks to the splash page (`index.html`, `splash.ts`), no engine changes.
+
+### Box art opens full size on click
+
+The thumbnail beside the title was too small to read. Clicking (or Enter/Space on keyboard focus)
+now opens it in a full-size lightbox overlay; click the overlay or press Escape to close.
+
+### A third card balances the bottom row
+
+The doors row was nested beside the box art, two cards wide, leaving the width under the box art
+unused. Moved to a full-width row below the hero (three columns at roughly the same card width as
+before) and added **Play multiplayer**, modeled on the Play Solitaire card but describing the
+not-yet-built feature, with "Coming soon" in place of a link. Its text is shorter than Play
+Solitaire's so the row height — and the page's vertical size — doesn't change.
+
+### Footer's "runs in your browser" claim scoped to solitaire
+
+Now reads "solitaire runs entirely in your browser" rather than an unqualified claim that would no
+longer hold once multiplayer needs a server.
+
+---
+
+## 0.4.9 — 2026-08-19
+
+A playtest review of seed 58228926 (day 6), plus one long-standing display complaint and the first
+real audio beyond a placeholder. Six changes: one display fix, two rules corrections, one engine bug
+found while explaining a report rather than reported directly, three new sound cues, and the splash
+page's box art.
+
+### Office coordinates read X,Y now, not Y,X
+
+Reported as confusing for anyone reading them the ordinary way: "at game start the office is 0,0;
+the western limit should be -1,0, the eastern +1,0; a restaurant due north should be 0,1." The
+engine's internal `GridCoord{row,col}` already has exactly that geometry — row increases north, col
+increases east (`track.ts:59`) — so this was a **display-only fix**, not a data-model change: every
+place a coordinate is shown to a player now prints `(col,row)` instead of `(row,col)`. The on-card
+label in `board-svg.ts` (the one everyone sees), the switching-crew tooltip and button label in
+`main.ts`, the rejected-option and switching-group text in `game.ts` and `view.ts`, and the
+blocked-move text in `narrate.ts`. Internal `Map` keys built from `${row},${col}` are untouched —
+nothing reads them but lookup code.
+
+### "No switching" now means no adding or dropping cars — not "never touch it"
+
+Reported from play: a train sitting at the Office with NO SWITCHING printed on its card (the two
+expresses, Light Engine, Campaign, Circus, Military) could not be moved onto Secondary Track to
+clear the mainline for other traffic, even though nothing on the card says that. `switchingRefusal()`
+(`apply.ts`) blocked `switch.move` outright for these six cards; it now only refuses a move that
+would COUPLE a fresh car — the same way `rules.dropOnly` was already handled for X13 — so the crew
+can still be shunted clear, it just cannot pick up, set out or sort. `switch.dropCars` and
+`switch.sortConsist` stay blocked. The switching-moves list (`view.ts`) no longer excludes these
+trains, and the card description text was rewritten from "it runs the Division and does not shunt"
+to "may not add or drop cars, but may still be moved clear of the mainline."
+
+### Q3, corrected: Expedite is about WHERE a train may be left, not WHEN it leaves
+
+**The reported symptom:** Train 1 arrived at an Office and was forced out at the end of the same
+Stage — the read since v0.4.2 — leaving no Local Operations turn to switch it. **The rule question
+underneath it:** why should "Expedite" mean a train is rushed out early at all, rather than simply
+never being left parked off the station?
+
+Corrected to the latter. An expedited train now arrives and stands exactly like any other train,
+released by the ordinary §8.1 "stood a full Stage at the Office" rule — it can be switched normally
+in between. Deleted entirely: `arriveAtOffice`'s `departsThisStage` flag and the whole
+expedited-departures pass that used to run in `shiftChange`, plus the now-dead `pass: 'mainline' |
+'expedite'` parameter on `moveTrain`.
+
+In its place: a new fault. At the top of every Mainline Phase, any expedited train sitting on the
+grid but not on the Office square itself — left on Secondary Track to clear a switching move, say —
+costs 1 Revenue (`EXPEDITE_FAULT_PENALTY`, `expediteFault`), charged again every Phase it is still
+caught there. A train the ordinary rules are legitimately holding AT the station — even one §8.1 is
+asking the Superintendent to rule on — is not a fault; only being left elsewhere in the district is.
+
+**This resolves "3/4 EXPRESS PRINTS A RULE IT CAN NEVER USE"** (`TODO.md`) as a side effect: the
+Express can now actually reach a Local Operations turn to use its printed "may drop or pick up one
+freight car at every location," which the old same-stage departure made structurally impossible.
+
+**Measured (30 fresh bot games, standard length):** the fault fires, but the bot has no strategy for
+it yet — one game left Train 4 (3/4 Express) parked off the station from Day 3 Stage 10 to the end of
+the game, taking the -1 penalty 26 times. Not an engine bug: the mechanism is working as designed and
+correctly reveals that the bot doesn't know to bring an expedited train home before ending a
+switching turn. Logged in `TODO.md` under Bot Performance for a future pass.
+
+### `evaluateClearance` now checks every occupant, not just the first one it finds
+
+Found while explaining a second playtest report from the same game: the Superintendent was asked to
+rule on a same-direction train instead of being automatically held against an opposite-direction one
+also occupying the card. Root cause: the occupant loop (`advance.ts`) returned on whichever occupant
+it examined first, in `node.transits` insertion order — correct while a Subdivision held at most one
+train, but a card can now legitimately hold two at once, which is exactly what the
+Telegraph/Telephone/Radio dispatch exception creates (a facing train dispatched past another sits on
+the same card as it). Fixed to two passes: every occupant is checked for an opposite-direction
+absolute bar first (subject to the dispatch exception) before any same-direction judgment call is
+offered. Pinned with a regression test that fails against the old single-pass code
+(`enhancements.test.ts`).
+
+### Three more sounds, synthesised like the rest
+
+`arrive`, `depart` and `crash` join `stage`/`couple`/`drop`/`schedule`/`completed`/`day`/`train` in
+`sound.ts` — a train pulling into an Office (decelerating chuffs, a soft bell tap), one highballing
+out of one (accelerating chuffs, a falling horn note), and a collision (dissonant tones bent sharply
+down over a noise boom and a sub-bass thump), wired to `trainArrived`, `trainHighballed` (Office
+departures only, so it doesn't double up with a fresh make-up's "All aboard" or a full division run's
+`completed`), and `trainsDestroyed`. Three real WAV clips were sourced for this and considered, but
+carried no license information anywhere — no `LICENSE` file, no embedded metadata, no note of where
+they came from — so they were not committed; the synthesised versions are good enough to keep as the
+real thing rather than a placeholder.
+
+### The splash page has its box art
+
+`docs/StationMasterSplashScreen.png` (1122×1402, 3.0 MB) is now a 560×700 JPEG at 145 KB
+(`public/images/`, copied verbatim into `dist/images/` by a small addition to `build-web.ts`) and
+sits beside the title, tagline, blurb and both buttons in a side-by-side hero on `index.html`,
+stacking to image-above-text under the existing mobile breakpoint.
+
+---
+
+## 0.4.8 — 2026-08-19
+
+Four reports from the same game, all about squares: which ones a card may go on, which one a button
+in the action list means, when there is more than one legal road to the same square which one a
+train actually takes, and — when more than one train is standing at the same Office — which is
+which.
+
+### The Limits bound the district, not just the Running Track
+
+**Reported:**
+
+> "Sidings should not be allowed to be built outside the limits."
+
+The Limits sign "denotes the limit of your control area" (§2.1) and §3 defines Secondary Track as
+"all tracks **in your limits** that are not the Running Track" — but the bound was only ever enforced
+on the Running Track row itself, with a comment in `canPlaceAt` stating outright that "the district
+below the Running Track is unbounded". So a siding could run east past a player's own sign, take
+industries with it, and put cars on track that §8.1 and §10 do not consider his territory at all: the
+rules reason about "the track between the train and the Limits", and running past another player's
+Limits is what makes a collision his fault.
+
+`withinLimits` is now the district's rule at **every row**, and a Facility is bounded by it too —
+§11.2 is explicit that "Facility cards carry their own rails: placing a Facility places track". The
+refusal is its own code, `OUTSIDE_LIMITS`, rather than `NOT_CONNECTED`, for the same reason
+`BREAKS_RUNNING_TRACK` is: the card would join perfectly well, and is refused for a different reason.
+
+**Inclusive of the sign's own column**, which is the half that keeps the game playable. Jesse's call.
+The sign stands *on* the boundary rather than beyond it, and a district opens with signs at ±1 around
+the Office — so the strict reading would leave exactly one buildable column and break §11.3's promise
+that both Secondary rows, and the nine-spot Modifier neighbourhood, are usable from the first Stage.
+A siding may run under the sign; nothing may go past it.
+
+**What it costs the bot: nothing measurable.** Out-of-limits building was rare for it to begin with —
+5 cards across 100 games, in 4 of them, never more than two columns over — and paired over 200 seeds
+the bound moved 4 games and −0.015 Revenue (t = −0.26). It is a human building deliberately who hits
+this, which is exactly how it was found.
+
+### The nine spots really are nine — the four diagonals were legal and unofferable
+
+**Reported:**
+
+> "Modifiers should be able to go on any diagonal — we were unable to place it to the south-east."
+
+§9 places a Modifier "adjacent to a Facility, on any of the nine nearby spots", and `check` has
+always accepted all eight neighbours. The fault was upstream in `placementCandidates`, which walks
+north, south, east and west from every occupied square: a diagonal square with no *orthogonal*
+occupied neighbour was never generated, so it was never offered. Measured on a facility below the
+Office: `check` says legal at all four diagonals, the menu offered the three orthogonal ones. At a
+stub industry — the case in the report — every diagonal is in that position.
+
+Generated in a **second pass, only around a Facility**. Track has to *join* and a diagonal shares no
+edge, so a Modifier is the only card those squares can ever take; generating diagonals around every
+card instead costs 54% more simulation time producing candidates `check` then rejects. Appending
+rather than interleaving leaves the existing candidate order untouched, which matters because the bot
+breaks ties by first-best — measured over 200 seeded games, **0 played differently**, so every figure
+in `TODO.md` still stands.
+
+### A Modifier may hang outside the Limits — but not in the Running Track's row
+
+Jesse's call, both halves. A Modifier is not track (§9), so unlike a siding it keeps all nine of its
+spots when its host stands at the limit: refusing the outer three would make the card unplayable
+exactly where the district ends. What it may not do is stand in the row the Running Track grows
+along. Inside the Limits that row is always full, so the rule bites only beyond the sign — and that
+is the ground the main extends onto, where a parked Modifier would block the player's own sign from
+moving outward (§2.1) with nothing on screen to warn him. Industries have been barred from the
+Running Track since the "Placed" column was read properly; this is the same rule for the same reason.
+
+### The board draws where the district ends
+
+Two signs on one row cannot say that nothing may be built outside their columns at *any* row: a
+player looking at open ground beyond a sign had no way to know it was unbuildable until the square
+failed to light up. `officeSvg` now draws a quiet dashed edge down the whole canvas at each limit,
+labelled, and just **outside** the sign's own column so the picture agrees with the rule — a siding
+may run under the sign. It moves outward on its own as the Running Track is extended, which is the
+reward for extending made visible. The Frame carries `limits` for it, resolved server-side like
+everything else a remote client cannot look up (`multiplayer.md` §5).
+
+The margin on the viewBox is not cosmetic: the west sign is usually the leftmost card on the canvas,
+so the line outside its column lands at x = −1.5 and simply is not there on a canvas starting at 0.
+Caught by drawing one, not by reading the code.
+
+### Hovering an action points at the square it means
+
+**Reported:**
+
+> "When I have my mouse over the action for a particular square, could the corresponding square in
+> the office area be highlighted to minimize my mistakes of selecting the wrong square — 1,3 versus
+> −1,3? In a solitaire game with Undo it is not fatal. In a multiplayer game that could be a major
+> disaster."
+
+The action list is a column of near-identical sentences separated by a coordinate, and the board
+beside it said nothing about which was which. Every action that names a square now carries it as
+`data-square`, and hovering — or focusing, so the keyboard route is not a lesser one — lights that
+square on the board, ghost targets included, which is precisely the moment a player is choosing
+between coordinates.
+
+The coordinate rides on the **menu**, resolved from the intent by `coordOf`, rather than being parsed
+back out of the label: a remote client holds no `GameState` and cannot look up where a tray is
+standing, which is the same reason the menu already carries card descriptions. Checked over 12 bot
+games: 870 direct actions name a square, and all 870 carry it.
+
+### Two routes to the same square
+
+**Reported:**
+
+> "There are times when a train can take two different paths to get to a destination. See game at
+> undo 379. Train 11 can go from Eastern limits to the straight at 1,1 two different ways. It can go
+> through the refinery and pick up the tanker on its nose, or it could go straight and then make the
+> curve and skip the refinery and not pick up the car. The player should have the two different
+> options."
+
+A district with a passing loop — turnout off the main, curve down to an industry, curve back up —
+offers two legal routes between the same two squares, and `exploreMoves` (`track.ts`) only ever found
+one: it keyed its visited set on destination and entry port, both routes rejoin through the same
+port, and the shorter one won the race before the longer one could be recorded. Which route survived
+was an artifact of search order, not a choice.
+
+**Ruling (Jesse, docs/rules/open-questions.md Gap 14):** the player may choose the path. §A.4 says
+"cars **on your track**" — the industry spur is a different track, and declining to enter it is not
+going around the car standing there. The mandatory half still bites in full once a route is chosen:
+every car standing on it couples.
+
+**The walk now enumerates every simple route** — a per-path visited set replaces the old global one,
+so a card may be revisited across different routes but never twice within one — capped at 4,000
+frontier nodes so a dense district cannot blow the walk up combinatorially; BFS order means the cap
+loses only the longest routes first. Routes are deduped on **outcome**, not on reaching the square:
+`(destination, entry side, [(origin card, car)…])`, so two routes coupling identical car *types* off
+*different* cards are both offered and each sweeps its own card, while two routes with nothing to
+tell apart collapse to one.
+
+**`switch.move` gained an optional `via: GridCoord`** — one intermediate square on the chosen route,
+never the start or the destination. `legal.ts` emits one intent per distinct route with a `via` that
+distinguishes it from its siblings; `via` absent resolves exactly as before (the first route
+enumerated), so every existing save and every bot decision replays identically. Checked against
+`public/replays/*.json` and the full suite: 575 pass, 0 fail, unchanged.
+
+Threaded through the label (`describeIntent` finds the route `via` names, so "couples 1 tanker"
+reports the cars *that* route actually lifts), the action-list dedupe (two routes to one square would
+otherwise print the identical button twice), the hover highlight (`data-route` lights every square a
+route runs over, not just its destination), and the history (`trayMoved.via`, when the move was
+ambiguous, names which road the crew took).
+
+**Balance impact: none expected, and none measured able to be attributed to this.** Instrumented over
+60 developer-bot games (17,884 destinations enumerated): squares reachable by 2+ distinct paths are
+~1.2% (208), and in every one of those 208 the routes coupled identically — the bot has never yet
+built a district where the discarded route would have mattered. 400 full games (200 developer bot,
+200 random bot) completed 200/200 with no exceptions on the reworked walk. `compare.ts` needs an
+ablation flag to run at all and this is not a bot heuristic, so paired A/B was not applicable here;
+the enumeration-based argument above is the actual evidence.
+
+### The Roster Pass — every train at the Office visible
+
+**The Office is the one square where more than one train may legally stand at once** — it has
+several A/D tracks, each holding one — and the board drew it as if only one ever could. Two trays
+at a Station couple onto the identical `officeCoord`; `trainOnCard()` returned on the first match
+and `CellView.train` had room for exactly one, so a second train was counted in the old A/D pips
+and never drawn at all. Reported directly, and analysed in "Two Trains, One Card": the pips and the
+picture were reading different fields.
+
+**`CellView.train` is now `CellView.trains: TrainView[]`** — every train standing on the card, each
+carrying its own `trayId`. The A/D pips are gone; in their place is one roster chip per A/D track,
+always (`adTracks` of them, not one per train), free tracks reading a dashed, dimmed "free" rather
+than vanishing. The selected train's chip is lit the same amber the crew strip and action buttons
+use, and its consist is the one drawn at the rail — clicking any occupied chip sets `selectedCrew`,
+the same value the "Which train are you switching?" picker already wrote, so the board and the
+action panel drive one value in both directions.
+
+**`standingWest` moved from `CrewTray` to `TrackCard`.** The split still means what it always meant
+— west/east of the row of standing cars — and it is still only meaningful while an engine stands on
+the card (an unattended cut has no near or far side; that reasoning did not change). What forced the
+move: two trays sharing one Office card could otherwise hold two different splits of the identical
+row, and there is no such thing as "west of one particular A/D track" — a cut lies west or east of
+the *whole block* of A/D tracks, so there has to be exactly one number for the card to carry. No
+save migration: `Save = {seed, history, rules?}` replays through the engine rather than being
+loaded, and a stale value on an emptied card is inert because nothing reads a split with no train
+standing there.
+
+**The Division map stopped drawing trains on their neighbours.** The Office's Running Track cell was
+a fixed 78px regardless of how many A/D tracks it had, so two chips centre-spread wider than the
+cell and spilled onto the Limits cards either side. The cell is now sized by **capacity**
+(`max(78, adTracks·54+12)`), not by how many tracks are occupied — sized by occupancy instead, the
+board would have shifted the East Division Point sideways every time a train arrived or left — and
+chips are laid into fixed slots, one per A/D track, so none can ever overhang the cell.
+
+**Verified:** two trays at a Station are both drawn, each with its own chip; a Terminal's four
+tracks all fit; a bare cut with a stale `standingWest` still draws left-aligned; every roster chip's
+x-extent lies inside its Office cell at full occupancy; and a packed replay row from before this
+feature — a lone train object, not an array — rehydrates into a one-train roster rather than
+throwing. 584 tests, 0 failures.
+
+### Also
+
+- The three published replays were re-recorded. A save is a seed and its intents, so tightening a
+  placement rule kills every replay containing one — `harness.test.ts` catches it rather than letting
+  them go quietly dead, which has happened twice before. Old saves are not preserved across rule
+  changes and are not meant to be yet.
+- `node_modules` was a **tracked symlink pointing at a path that does not exist**, so `tsc` was
+  missing and 20 tests failed before any of this was written. Replaced with the real dependencies.
+
 ## 0.4.7 — 2026-08-19
 
 Eight play reports and one design that had been written up and not built. The through-line is the

README.md

@@ -10,7 +10,7 @@ train into an occupied Subdivision. Get that wrong and two trains meet at speed.
 
 ## Status
 
-**v0.4.3 — solitaire is playable in a browser.** The whole game runs client-side: the engine is pure,
+**v0.4.8 — solitaire is playable in a browser.** The whole game runs client-side: the engine is pure,
 imports nothing outside itself, and never touches `Math.random`, so a static host is all it needs.
 
 - **Rules** — specified, with **three open questions** left. Thirteen gaps in the original prototype

docs/architecture/multiplayer.md

@@ -245,9 +245,16 @@ special handling: `pump` stops, and the next push simply carries a `Menu` contai
 POST /api/lobby/create, /api/lobby/join      lobby
 POST /api/intent          { gameId, seq, intent }
 GET  /api/stream          EventSource — per-seat frames, with Last-Event-ID resume
+GET  /api/health          { ok, service, engineVersion } — unauthenticated; see below
 GET  /                    the client
 ```
 
+`/api/health` exists because the client cannot otherwise tell a server from a static host. The same
+`dist/` is served both ways and the bundle is identical (D4), and every other route 404s an unknown
+path exactly as a static host does — so the splash asks, and closes its multiplayer door only when
+nothing names itself in reply. It is unauthenticated on purpose: it reveals that a Station Master
+server is answering and nothing else, no game and no seat.
+
 Chosen over WebSocket because this game is **idle most of the time** — turn-based with human
 think-time means a connection sits silent for minutes, exactly when proxies reap sockets. SSE's
 reconnection and `Last-Event-ID` resume are handled by the browser, and it needs no `Upgrade` support
@@ -338,7 +345,7 @@ all it needs.
 | **D15** | **Build to `deployment.md`'s five portability rules; package as an `.s9pk`** | This is a StartOS packaging workspace and the toolchain is on disk. |
 | **D16** | **The server serves the client** | Required for same-origin, which is what makes multiple access addresses work without CORS. |
 | **D17** | **Undo is solitaire-only** | Other players have seen the result. |
-| **D18** | **Player cap 6** | Per `lobby-and-sessions.md` §2. |
+| **D18** | **Player cap 2-4** for competitive/coop (solitaire is 1) | Per `lobby-and-sessions.md` §2 — sized to what is actually exercised (`test/multiplayer.test.ts` plays 2, 3 and 4 to a finish), not to a guess. This entry read "6" until Phase 4 (v0.5.1); that number was never implemented or tested anywhere and the two docs had drifted apart. Raise it once somebody has played a bigger game and reported back, not before. |
 | **D19** | **Per-player turn state now; parallel turns deferred** | The model change is behaviour-neutral and cheap today. Whether local work should run off-cursor depends on how often humans choose to switch — 13% for the bot, and the benefit ranges from ~8 minutes to ~27 off an hour-long game between 13% and 50%. Measure with real players, then flip one function. |
 | **D20** | **Replay reveals everything once the game ends** | Most useful for learning and for arguing about it afterwards; costs nothing extra to retain. |
 

docs/plans/switching-paths.md

@@ -0,0 +1,207 @@
+# Plan — Train Switching Paths: two routes to the same square
+
+**Status:** built, v0.4.8. Written against `461c4d9`; see `docs/rules/open-questions.md` Gap 14 and
+the CHANGELOG's "Two routes to the same square" for the ruling and what shipped.
+**Reported by Jesse:** *"There are times when a train can take two different paths to get to a
+destination. See game at undo 379. Train 11 can go from Eastern limits to the straight at 1,1 two
+different ways. It can go through the refinery and pick up the tanker on its nose, or it could go
+straight straight and then make the curve and skip the refinery and not pick up the car. The player
+should have the two different options."*
+
+---
+
+## 1. The defect
+
+A district with a passing loop — turnout down off the main, curve, industry, curve, turnout back up —
+offers two routes from one end to the rejoin square. Both are legal under §2.4 (a Move runs any
+distance without changing direction; neither route ever leaves a card by the port it entered). They
+differ in what they couple.
+
+**The engine offers only one of them, and which one is an artifact of search order.**
+
+`exploreMoves` (`src/engine/track.ts:386`) keys its visited set on destination *and entry port*:
+
+```ts
+// src/engine/track.ts:492
+const key = `${coordKey(node.coord)}|${node.entry}`;
+if (seen.has(key)) continue;
+```
+
+Both routes arrive at the rejoin square through the **same port**, so they collide on that key. The
+walk is breadth-first, so the shorter route is recorded and the longer one is discarded before it can
+become a destination.
+
+### Reproduction
+
+Fixture — Running Track on row 0, industry spur on row −1:
+
+| | col 0 | col 1 | col 2 | col 3 | col 4 |
+|---|---|---|---|---|---|
+| **row 0** | straight | turnout `{w,e,s}` | straight | turnout `{e,w,s}` | Limits (east) |
+| **row −1** | — | curve `ne` | **Refinery + tanker** | curve `nw` | — |
+
+Walking west from `(0,4)`, today's engine returns:
+
+```
+(0,2)  entry=e  couples=[]        path=(0,3)
+(-1,3) entry=n  couples=[]        path=(0,3)
+(-1,2) entry=e  couples=[tanker]  path=(0,3)->(-1,3)
+(0,0)  entry=e  couples=[]        path=(0,3)->(0,2)->(0,1)      ← only one route to (0,0)
+(-1,1) entry=e  couples=[tanker]  path=(0,3)->(-1,3)->(-1,2)
+```
+
+The refinery route to `(0,0)` — which couples the tanker — is absent. A simple-path prototype on the
+same fixture returns both. Verified identical on v0.4.7 and v0.4.8.
+
+### It is not cosmetic
+
+`dest.path` feeds `carsCoupled.from` (`src/engine/apply.ts`, the `switch.move` execute branch at
+`:1303`) — the list of cards swept clean when cars are lifted. The route reaches the reducer, so
+"which route" must be part of the intent, not just the button text.
+
+### How often
+
+Instrumented over 60 developer-bot games (17,884 destinations enumerated):
+
+| measure | count |
+|---|---|
+| destinations enumerated | 17,884 |
+| squares reachable by 2+ **distinct paths** | 208 (~1.2%) |
+| squares where the routes **differed in what they couple** | **0** |
+
+So the geometry occurs and today's engine silently discards a route about 1% of the time — but the
+bot never builds a district where the discarded route *matters*. Two consequences:
+
+- **Balance impact is expected to be nil.** Still confirm with `compare.ts` (see §6).
+- **The bot will never regression-test this.** It needs explicit unit tests.
+
+---
+
+## 2. The rules question, and Jesse's ruling
+
+§A.4 says: *"If you move your Crew Tray into cars on your track, you **MUST** pick them up. You may
+not go around them."* Whether taking the main instead of the siding counts as "going around" decides
+whether this feature is legal at all.
+
+**Ruling (Jesse):** the player may choose the path. Different paths may pick up different cars, or
+none.
+
+The permissive reading is well-supported by the text: §A.4 says *"cars on your track"*, and the
+industry spur is a different track. Declining to enter it is not going around the tanker — it is not
+going to the tanker's track at all, which is ordinary railroading. The mandatory half still bites in
+full: once a route is chosen, every car standing on it couples, and there is no route that passes a
+car and leaves it.
+
+**Doc changes:** add the clarifying sentence to §A.4 in `docs/rules/rules-v0.2.md`, and record the
+ruling in `docs/rules/open-questions.md`.
+
+---
+
+## 3. Design decisions
+
+**The discriminator is `via`: one intermediate `GridCoord` on the chosen route** (Jesse's call).
+Not an index into the destination list — intents are the canonical record and `undo` replays history
+minus one intent, so an order-dependent field would silently reinterpret saved games.
+
+```ts
+// src/engine/intents.ts:19
+| { type: 'switch.move'; trayId: TrayId; to: GridCoord; reverse: boolean; via?: GridCoord }
+```
+
+- `via` names an **intermediate** card — never the start, never the destination.
+- **Resolution:** among destinations at `to` matching `reverse`, take the first enumerated route whose
+  path contains `via`. Enumeration stays shortest-first.
+- **`via` absent resolves exactly as today** (first route at `to`), so existing histories replay
+  unchanged. Note v0.4.8 already established that saves are *not* preserved across rule changes —
+  this is belt-and-braces, not a hard constraint.
+- **`legal.ts` emits a distinguishing `via`** per route, so a generated intent is never ambiguous.
+
+**Collapse routes whose outcome is identical.** Two routes that lift the same cars from the same
+cards are not a choice; offering both is noise in the action list and doubles the bot's branching
+factor for nothing.
+
+**The dedupe key must include the origin cards, not just car types.** Two routes can couple an
+identical car *multiset* lifted from *different* cards. Keying on type alone would collapse them and
+sweep the wrong card clean. Key on `(coord, entry, [(origin card, car)...])`.
+
+**Simple-path walk with an enumeration cap.** Relaxing `seen` to a per-path visited set keeps
+termination (no card twice within one path), but the number of simple paths is worst-case exponential
+in a dense district. Cap enumeration and prefer shortest routes when the cap bites.
+
+> Note: the 45°-diagonal matching rule appears to make closed loops geometrically impossible — a
+> rectangle of four curves cannot close, because the slopes do not match at the corners. **Do not
+> rely on this.** Use a path-local visited set and a cap regardless.
+
+---
+
+## 4. Change list
+
+| File | Site | Change |
+|---|---|---|
+| `src/engine/track.ts` | `exploreMoves` :386, `seen` :492 | Per-path visited set; dedupe on outcome; cap. Preserve shortest-first ordering. |
+| `src/engine/intents.ts` | :19 | Add `via?: GridCoord`. |
+| `src/engine/apply.ts` | `check` :623 | Select destination by `via`, not first-by-coord. |
+| `src/engine/apply.ts` | `execute` :1303 | Same selection; `carsCoupled.from` follows the chosen path. |
+| `src/engine/apply.ts` | `destinationsFor` :1210, `movesFor` :1260 | Unchanged signatures; `movesFor` still collapses to one square per coord for the board. |
+| `src/engine/legal.ts` | :90 | Emit one intent per distinct route, each with a distinguishing `via`. |
+| `src/sim/view.ts` | `describeIntent` :724 | Find the destination by `via` so the label names the cars *that route* couples. |
+| `src/web/game.ts` | `coordOf` :113, label dedupe ~:229 | Labels must differ per route or the label-dedupe drops one button. |
+| `src/web/main.ts` | `cellRef` :660 | Route-on-hover — see §5. |
+| `src/sim/narrate.ts` | move narration | Name the route when it is not the only one. |
+
+**`ownCutFor` (`apply.ts:1241`) needs no change** — it depends only on the exit port, not the route.
+
+---
+
+## 5. UI — route on hover (Jesse's choice)
+
+v0.4.8 already built the mechanism: `coordOf(intent)` → `cellRef` → `data-square="r,c"` on each
+action button, and hovering or focusing lights that square. This feature extends it from one square
+to a route.
+
+- Carry the path on the **menu**, resolved server-side, for the same reason `coordOf` is: a remote
+  client holds no `GameState`.
+- Emit the route as a second attribute (`data-route="r,c r,c …"`); hovering or focusing lights every
+  card the route runs over, with the destination keeping its existing stronger mark.
+- **On focus as well as hover**, matching v0.4.8 — the keyboard route is not a lesser one.
+
+Target rendering:
+
+```
+Switching Train 11, standing at (1, 4)
+  [ move to (1,1) ]
+  [ move to (1,1) — couples 1 tanker on the way (onto the nose) ]   ← hover
+```
+
+---
+
+## 6. Verification
+
+- **Unit test the fixture in §1** — both routes offered, one coupling the tanker and one not.
+- **`via` round-trip** — each intent `legal.ts` emits resolves back to the route it was generated for.
+- **Back-compat** — replay `public/replays/*.json` and assert identical outcomes with `via` absent.
+- **Origin-card dedupe** — two routes coupling identical car *types* from *different* cards must both
+  be offered, and each must sweep its own card.
+- **Cap** — a dense district must terminate and stay bounded.
+- **Balance** — `node src/sim/compare.ts 1600`. Expect no movement (the bot never builds this
+  geometry); keep only at t ≥ 3 per `README.md`, and read the better/worse/identical split.
+
+**Run the suite serially: `node --test --test-concurrency=1`.** The `npm test` script runs files in
+parallel and several of them invoke the static build against a shared `dist/`, which produces ~20
+spurious failures. Measured on `461c4d9`: parallel 20 fail / serial **575 pass, 0 fail**.
+
+> v0.4.8's CHANGELOG attributes those 20 failures to the tracked `node_modules` symlink. That fix was
+> real and worth making, but it is **not** the whole cause: on this checkout `tsc` resolves and
+> typecheck exits 0, yet the same 20 fail under parallel execution and pass under
+> `--test-concurrency=1`. The `dist/` race is still there. Worth fixing separately — give each
+> build-invoking test its own output directory.
+
+---
+
+## 7. Open question for Jesse
+
+A route's cards may be reachable only as a *subset* of a longer route's cards. If that ever happens,
+no single `via` uniquely selects the shorter route, and it is addressable only by the
+shortest-first tiebreak. It did not arise in any fixture or in 60 bot games, and it may be
+geometrically impossible — but if it does arise, the alternatives are to reject the ambiguous intent
+or to let shortest-first stand. **Shortest-first is assumed here.**

docs/rules/card-reference.md

@@ -42,17 +42,28 @@ Operational Rail wheel icon, an industry track of the stated length, Laborer ico
 | --- | --- | --- | ---: | ---: | ---: | ---: | ---: |
 | Mine Tipple | Hopper | Outbound only | 3 | 3 | — | 4 | 2 |
 | Produce Shed | Reefer | Outbound only | 2 | 2 | — | 3 | 2 |
-| Grocer's Warehouse | Boxcar | Both | 2 | 2 | 2 | 3 | 2 |
-| Oil Refinery | Tank car | Both | 3 | 2 | 2 | 4 | 2 |
+| Grocer's Warehouse | Boxcar | Both | 1 | 1 | 1 | 3 | 3 |
+| Oil Refinery | Tank car | Both | 1 | 1 | 1 | 4 | 3 |
 | Power Plant | Hopper | Inbound only | 3 | — | 3 | 4 | 2 |
+| Freight House | Boxcar | Both | 1 | 1 | 1 | — | 6 |
 
 Directions follow the commodity: coal originates at a Mine Tipple and is consumed at a Power Plant;
 produce ships out; a warehouse and a refinery do both. This gives §9 all three of its cases —
 outbound-only, inbound-only, and both.
 
-**"Freight House"** (§9.3, Appendix A) is not a card. It is the collective term for a freight facility
-that loads *and* unloads — the Grocer's Warehouse and the Oil Refinery. §9.3's "Passenger Facilities
-and Freight Houses permit cars to move each direction" therefore names exactly those two.
+**"Freight House" IS a card** (corrected v0.5.0) — a sixth industry, dealt 6 copies, one Laborer and
+one slot each direction. An earlier pass here read §9.3/Appendix A's "Passenger Facilities and
+Freight Houses permit cars to move each direction" as meaning "Freight House" was only ever a
+*collective term* for the Grocer's Warehouse and the Oil Refinery, never a card of its own — that
+reading was wrong; the engine deals it as a real sixth industry (`content.ts`'s `freightHouse`
+profile) and this table follows the engine.
+<!-- TODO v0.5.0: Mine Tipple, Produce Shed and Power Plant above (3/3/4, 2/2/3, 3/3/4) were NOT
+     re-verified against the engine in this pass — only Grocer's Warehouse, Oil Refinery and Freight
+     House were. `mineTipple` and `powerPlant` in `content.ts` are also base 1/1/1, same as the three
+     corrected here, so these three rows and the "Throughput" reasoning below (built on the OLD
+     2–3-Laborer numbers) may be stale too. Flagged in TODO.md rather than silently rewritten — this
+     needs the same kind of decision Jesse made for Grocer's/Refinery/Freight House, not an assumption
+     that the same correction applies. -->
 
 ### Throughput — why these Laborer counts
 
@@ -138,8 +149,14 @@ above and below. Upgrades are drop-in and must never disturb a connection.
 ## 5. Modifier cards
 
 Five cards, one each. A Modifier is **not track**. It is placed adjacent to a Facility, on any of the
-nine nearby spots, and if adjacent to two Facilities its effect may be used on only one per Stage
-(§9).
+nine nearby spots — **diagonals included** — and if adjacent to two Facilities its effect may be used
+on only one per Stage (§9).
+
+Two placement rules follow from it not being track. It is **not bounded by the Limits**: a host
+standing at the edge of the district keeps all nine of its spots, or the card would be unplayable
+exactly where the district ends. And it may **never stand in the Running Track's row**, which inside
+the Limits is always full anyway — beyond the sign that row is the ground the main grows onto, and a
+Modifier parked there would block the Limits sign from moving outward (§2.1).
 
 | Card | Effect | Applies to |
 | --- | --- | --- |

docs/rules/glossary.md

@@ -24,8 +24,8 @@ Every defined term, alphabetized for lookup. The core comes from the Definitions
 | **Extra Platform** | Modifier card: +1 green and +1 red slot at a Passenger Facility. | §12.5 |
 | **Extra Train** | A one-and-done train; its card returns to the Salvage Yard on completion. Head-on card image, so the drawing player picks its direction. Numbered with an "X" prefix; the following number gives its seniority, and it yields to the Timetabled train of that number. | §2.3, §8 |
 | **Facility** | A business which loads/unloads cargo and freight. | §2.5 |
-| **Freight Facility** | Mine Tipples, Produce Sheds, Grocer's Warehouses, Oil Refineries, Power Plants. Some allow only outbound, some only inbound, some both. Per-card values in §12.5. | §9, §12.5 |
-| **Freight House** | Not a card — the collective term for a freight facility permitting both directions, namely the Grocer's Warehouse and the Oil Refinery. | §9.3, §12.5 |
+| **Freight Facility** | Mine Tipples, Produce Sheds, Grocer's Warehouses, Oil Refineries, Power Plants, Freight Houses. Some allow only outbound, some only inbound, some both. Per-card values in §12.5. | §9, §12.5 |
+| **Freight House** | A sixth Freight Facility card (corrected v0.5.0 — an earlier pass here read it as a collective term for the Grocer's Warehouse and the Oil Refinery rather than a card of its own; it is dealt like any other industry). Permits both directions, the same as a Grocer's Warehouse or Oil Refinery. | §9.3, §12.5 |
 | **Highball** | When a train holding at an Office automatically departs. | §2.4 |
 | **Home Office** | The primary face-down deck cards are drawn from. 52 cards. | §2.6, §12.1 |
 | **Hopper** | Coal rolling stock (brown = loaded, white = empty). | §2.2 |

docs/rules/implications.md

@@ -82,10 +82,12 @@ direction. `DivisionNode.gradeUp` records the direction a train travels when **c
 going the other way is descending. Brakeman and Airbrakes apply to the descent, Helpers to the
 climb, so turning the card around swaps which trains each card helps.
 
-One gap remains, and it is a **setup** gap rather than a rules one: `createGame` is synchronous and
-returns a ready state, so there is no point at which a player can be asked. Orientation is currently
-**rolled** — deterministic from the seed, and roughly even (51/49 east/west across 400 games) — and
-should become a real player choice when setup gains an interactive phase.
+**Settled (v0.5.0): orientation is never a player choice, and this overrides the card's own printed
+"Player sets orientation."** A Heavy Grade sits on the shared west-to-east Division chain, between
+two players (§4.2) or beyond an end Division Point next to one — never inside a single player's own
+district — so whichever direction climbs advantages one neighbour over the other, and no one player
+has a fair claim to the decision. Orientation is **rolled** from the seed instead — deterministic,
+and roughly even (51/49 east/west across 400 games) — identically for solitaire and multiplayer.
 
 **Still not implemented**: the Action (10) and Space-use (12) cards, which are genuinely
 multiplayer-only. Playing them is rejected with `NOT_IMPLEMENTED`.

docs/rules/open-questions.md

@@ -28,6 +28,7 @@ left open, with the consequence noted.
 | 11 | Track card orientation | **SUPERSEDED** — handedness is printed; both hands supplied |
 | 12 | Balance targets | **INVALIDATED** — measured against a placeholder ruleset |
 | 13 | Deck scaling by player count | **LARGELY DISSOLVED** — track is per-player by design |
+| 14 | Two routes to the same square | **DECIDED** |
 
 ---
 
@@ -717,10 +718,12 @@ leave no way at all to speed up a slow facility. Section Gang is the sole worker
 keeps that power scarce. Capacity modifiers are stronger than they sound, since banking room rather
 than worker count is what limits output.
 
-**Sub-decision — what a "Freight House" is.** §9.3 and Appendix A refer to Freight Houses, but §9's
-facility list never defines one. It is **not a card**: it is the collective term for a freight
-facility that both loads and unloads — under 10a, the Grocer's Warehouse and the Oil Refinery. This
-reconciles every reference without adding a card type or disturbing Gap 4a's deck composition.
+**Sub-decision — what a "Freight House" is. SUPERSEDED (v0.5.0).** §9.3 and Appendix A refer to
+Freight Houses, but §9's facility list never defines one. This originally concluded it was **not a
+card** — the collective term for a freight facility that both loads and unloads, under 10a the
+Grocer's Warehouse and the Oil Refinery. That reading was wrong: it **is** a card, a sixth Freight
+Facility dealt 6 copies (`content.ts`'s `freightHouse` profile), which the engine has implemented
+all along. Left here for the reasoning; do not read this entry as current.
 
 ### 10e — Revenue/Day revalidated, and the Gap 6 targets revised
 
@@ -1003,3 +1006,28 @@ needs to get started, while giving each player material to build with.
 
 **Not yet decided**, because it interacts with Gap 12's variance question: more facilities per player
 would raise the ceiling on the runaway mode as well as the floor.
+
+## Gap 14 — Two routes to the same square
+
+**Status:** DECIDED.
+
+**Reported by Jesse:** "There are times when a train can take two different paths to get to a
+destination. See game at undo 379. Train 11 can go from Eastern limits to the straight at 1,1 two
+different ways. It can go through the refinery and pick up the tanker on its nose, or it could go
+straight and then make the curve and skip the refinery and not pick up the car. The player should
+have the two different options."
+
+**The question:** a passing loop — turnout off the main, curve down, industry, curve back up — offers
+two legal routes between the same two squares, and they couple different cars. Does §A.4's "you may
+not go around" a car standing on your track forbid taking the bypass?
+
+**Ruling: the player may choose the path.** Different paths may pick up different cars, or none.
+§A.4 says "cars **on your track**", and the industry spur is a different track — declining to enter
+it is not going around the car standing on it, it is not going to that car's track at all, which is
+ordinary railroading. The mandatory half still bites in full once a route is chosen: every car
+standing on the chosen route couples, and there is no route that passes a car and leaves it.
+
+**Built in v0.4.8** — see `docs/plans/switching-paths.md`. The engine enumerates every distinct
+simple route, dedupes by outcome (destination, entry side, and origin-tagged cars) rather than by
+destination alone, and an intent that would otherwise be ambiguous carries a `via` naming one
+intermediate square on the chosen route.

docs/rules/rules-v0.2.md

@@ -452,9 +452,10 @@ Loading and unloading of Rolling Stock (passengers and freight) takes place in t
   (§11). A Whistle Post is not a Passenger Facility, so a player who has not upgraded has no
   passenger business at all.
 - **Freight Facilities:** Mine Tipples, Produce Sheds, Grocer's Warehouses, Oil Refineries, Power
-  Plants. Per-card values in §12.5.
-- **Freight House:** **[Gap 10d]** not a facility type of its own, but the collective term for a
-  freight facility permitting both directions — the Grocer's Warehouse and the Oil Refinery.
+  Plants, Freight Houses. Per-card values in §12.5.
+- **Freight House:** a Freight Facility card in its own right (corrected v0.5.0 — **[Gap 10d]**
+  previously read this as a collective term for the Grocer's Warehouse and the Oil Refinery rather
+  than a card of its own). Permits both directions, the same as those two.
 - **Modifier Facilities:** Cards that, placed adjacent (on any of the nine nearby spots), increase a
   passenger or freight facility's capacities. If two Facilities are adjacent to the Modifier, its
   effects may only be used on one Facility per **Stage** **[Gap 7]**.
@@ -593,10 +594,16 @@ horizontal row through the Office, Limit-to-Limit; everything else is Secondary
 - Plain track, turnouts and Facility cards are all played from hand into an empty adjacent grid spot,
   and **must connect to existing track**. Facility cards carry their own rails — placing a Facility
   places track.
+- Track stays **inside the Limits at every row**, not only on the Running Track. §2.1 makes the sign
+  "the limit of your control area" and §3 defines Secondary Track as "all tracks in your limits", so
+  a siding may run *under* a sign — the sign stands on the boundary — and never past it. Widening a
+  district therefore means extending the main first.
 - Extending the **Running Track** horizontally moves that player's Limits sign outward with it (§2.1).
   Growth is uncapped in the prototype.
 - Modifier Facility cards are not track. They are placed adjacent to a Facility, on any of the nine
-  nearby spots (§9).
+  nearby spots (§9) — diagonals included, and not bounded by the Limits, since a host at the edge of
+  the district would otherwise have nowhere to put one. The one square they may not take is in the
+  Running Track's own row, which is where the main grows.
 
 A longer Running Track is more track to keep clear of arriving trains, so territory carries its own
 collision risk.
@@ -747,8 +754,9 @@ Modifier effects, and track geometries — is catalogued in
 | Extra Platform | +1 green and +1 red slot (passenger) |
 | Section Gang | +1 Laborer or +1 Porter |
 
-**"Freight House"** (§9.3, Appendix A) is not a card — it is the collective term for a freight
-facility that both loads and unloads, namely the Grocer's Warehouse and the Oil Refinery.
+**"Freight House"** (§9.3, Appendix A) is a Freight Facility card (corrected v0.5.0 — previously
+read as not a card, only a collective term for a facility that both loads and unloads). It permits
+both directions, the same as the Grocer's Warehouse and the Oil Refinery.
 
 ---
 
@@ -795,7 +803,10 @@ same order they originally held, left-to-right.
 - The exception is your Office track, which has the number of A/D tracks listed (§11.1). As long as
   fewer trains are holding there than A/D tracks, you may enter and pass through.
 - If you move your Crew Tray into cars on your track, you **MUST** pick them up. You may not go around
-  them.
+  them. Where a passing loop offers two routes to the same square, choosing not to enter a siding is
+  not "going around" a car standing on it — that car is on a different track, and declining to run
+  onto it is ordinary railroading. Once a route is chosen, every car standing on it still must be
+  coupled in full.
 - A Crew Tray must always have an engine, and may move a maximum of four Rolling Stock — cabooses
   included **[Gap 4c]**.
 - You automatically couple to cars you meet during your Moves. The same is **not** true of trains

docs/station-master-seed116956197-day2.json

@@ -0,0 +1,301 @@
+{
+ "seed": 116956197,
+ "history": [
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 0
+  },
+  {
+   "type": "card.play",
+   "cardId": "c27"
+  },
+  {
+   "type": "card.play",
+   "cardId": "c30"
+  },
+  {
+   "type": "card.play",
+   "cardId": "c4"
+  },
+  {
+   "type": "card.play",
+   "cardId": "c2"
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 2
+  },
+  {
+   "type": "card.play",
+   "cardId": "c197",
+   "placement": {
+    "row": 0,
+    "col": -1
+   },
+   "variant": 1
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 2
+  },
+  {
+   "type": "card.play",
+   "cardId": "c163",
+   "placement": {
+    "row": 1,
+    "col": -1
+   },
+   "variant": 0
+  },
+  {
+   "type": "card.play",
+   "cardId": "c41",
+   "placement": {
+    "row": 1,
+    "col": 0
+   },
+   "variant": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 0
+  },
+  {
+   "type": "card.play",
+   "cardId": "c127",
+   "placement": {
+    "row": 0,
+    "col": 1
+   },
+   "variant": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.play",
+   "cardId": "c183",
+   "placement": {
+    "row": 0,
+    "col": 2
+   },
+   "variant": 1
+  },
+  {
+   "type": "card.play",
+   "cardId": "c150",
+   "placement": {
+    "row": 1,
+    "col": 2
+   },
+   "variant": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 1
+  },
+  {
+   "type": "card.play",
+   "cardId": "c136",
+   "placement": {
+    "row": 1,
+    "col": 1
+   },
+   "variant": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.discard",
+   "cardId": "c77",
+   "toSlot": 1
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.discard",
+   "cardId": "c171",
+   "toSlot": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray3",
+   "carType": "boxcar",
+   "loaded": false
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray3",
+   "carType": "boxcar",
+   "loaded": true
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.discard",
+   "cardId": "c153",
+   "toSlot": 1
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.play",
+   "cardId": "c9"
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray2",
+   "carType": "coach",
+   "loaded": true
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray2",
+   "carType": "coach",
+   "loaded": true
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "switch"
+  }
+ ],
+ "rules": {
+  "startingHand": "sixRandom",
+  "revenue": {
+   "passengerPerCoach": 1,
+   "freightPerLoad": 1,
+   "trainPerTransit": 0
+  }
+ }
+}

docs/station-master-seed116956197-day2b.json

@@ -0,0 +1,714 @@
+{
+ "seed": 116956197,
+ "history": [
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 0
+  },
+  {
+   "type": "card.play",
+   "cardId": "c27"
+  },
+  {
+   "type": "card.play",
+   "cardId": "c30"
+  },
+  {
+   "type": "card.play",
+   "cardId": "c4"
+  },
+  {
+   "type": "card.play",
+   "cardId": "c2"
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 2
+  },
+  {
+   "type": "card.play",
+   "cardId": "c197",
+   "placement": {
+    "row": 0,
+    "col": -1
+   },
+   "variant": 1
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 2
+  },
+  {
+   "type": "card.play",
+   "cardId": "c163",
+   "placement": {
+    "row": 1,
+    "col": -1
+   },
+   "variant": 0
+  },
+  {
+   "type": "card.play",
+   "cardId": "c41",
+   "placement": {
+    "row": 1,
+    "col": 0
+   },
+   "variant": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 0
+  },
+  {
+   "type": "card.play",
+   "cardId": "c127",
+   "placement": {
+    "row": 0,
+    "col": 1
+   },
+   "variant": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.play",
+   "cardId": "c183",
+   "placement": {
+    "row": 0,
+    "col": 2
+   },
+   "variant": 1
+  },
+  {
+   "type": "card.play",
+   "cardId": "c150",
+   "placement": {
+    "row": 1,
+    "col": 2
+   },
+   "variant": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 1
+  },
+  {
+   "type": "card.play",
+   "cardId": "c136",
+   "placement": {
+    "row": 1,
+    "col": 1
+   },
+   "variant": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromDepartment",
+   "slot": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.discard",
+   "cardId": "c77",
+   "toSlot": 1
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.discard",
+   "cardId": "c171",
+   "toSlot": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray3",
+   "carType": "boxcar",
+   "loaded": false
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray3",
+   "carType": "boxcar",
+   "loaded": true
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.discard",
+   "cardId": "c153",
+   "toSlot": 1
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.play",
+   "cardId": "c9"
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray2",
+   "carType": "coach",
+   "loaded": true
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray2",
+   "carType": "coach",
+   "loaded": true
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "switch"
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray3",
+   "to": {
+    "row": 0,
+    "col": -2
+   },
+   "reverse": false
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray3",
+   "to": {
+    "row": 1,
+    "col": 0
+   },
+   "reverse": true
+  },
+  {
+   "type": "switch.dropCars",
+   "trayId": "tray3",
+   "count": 1
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray3",
+   "to": {
+    "row": 0,
+    "col": -2
+   },
+   "reverse": false
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray3",
+   "to": {
+    "row": 0,
+    "col": 0
+   },
+   "reverse": true
+  },
+  {
+   "type": "switch.end"
+  },
+  {
+   "type": "laborer.beginUnload",
+   "at": {
+    "row": 1,
+    "col": 0
+   },
+   "carIndex": 0
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.discard",
+   "cardId": "c162",
+   "toSlot": 2
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "porter.detrain",
+   "at": {
+    "row": 0,
+    "col": 0
+   }
+  },
+  {
+   "type": "porter.detrain",
+   "at": {
+    "row": 0,
+    "col": 0
+   }
+  },
+  {
+   "type": "laborer.advanceLoad",
+   "at": {
+    "row": 1,
+    "col": 0
+   },
+   "box": 2
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "freightAgent"
+  },
+  {
+   "type": "freightAgent.clearInbound",
+   "at": {
+    "row": 0,
+    "col": 0
+   },
+   "index": 0
+  },
+  {
+   "type": "laborer.advanceLoad",
+   "at": {
+    "row": 1,
+    "col": 0
+   },
+   "box": 1
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "freightAgent"
+  },
+  {
+   "type": "freightAgent.clearInbound",
+   "at": {
+    "row": 0,
+    "col": 0
+   },
+   "index": 0
+  },
+  {
+   "type": "laborer.advanceLoad",
+   "at": {
+    "row": 1,
+    "col": 0
+   },
+   "box": 0
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "freightAgent"
+  },
+  {
+   "type": "freightAgent.stockOutbound",
+   "at": {
+    "row": 1,
+    "col": 0
+   },
+   "carType": "boxcar"
+  },
+  {
+   "type": "laborer.startLoad",
+   "at": {
+    "row": 1,
+    "col": 0
+   }
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "freightAgent"
+  },
+  {
+   "type": "freightAgent.stockOutbound",
+   "at": {
+    "row": 0,
+    "col": 0
+   },
+   "carType": "coach"
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray2",
+   "carType": "boxcar",
+   "loaded": true
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray2",
+   "carType": "boxcar",
+   "loaded": true
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray2",
+   "carType": "boxcar",
+   "loaded": true
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray2",
+   "carType": "caboose",
+   "loaded": true
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "freightAgent"
+  },
+  {
+   "type": "freightAgent.clearInbound",
+   "at": {
+    "row": 1,
+    "col": 0
+   },
+   "index": 0
+  },
+  {
+   "type": "laborer.advanceLoad",
+   "at": {
+    "row": 1,
+    "col": 0
+   },
+   "box": 0
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "freightAgent"
+  },
+  {
+   "type": "freightAgent.stockOutbound",
+   "at": {
+    "row": 0,
+    "col": 0
+   },
+   "carType": "coach"
+  },
+  {
+   "type": "laborer.advanceLoad",
+   "at": {
+    "row": 1,
+    "col": 0
+   },
+   "box": 1
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "draw"
+  },
+  {
+   "type": "draw.fromHomeOffice"
+  },
+  {
+   "type": "card.discard",
+   "cardId": "c50",
+   "toSlot": 0
+  },
+  {
+   "type": "draw.end"
+  },
+  {
+   "type": "laborer.advanceLoad",
+   "at": {
+    "row": 1,
+    "col": 0
+   },
+   "box": 2
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "switch"
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray2",
+   "to": {
+    "row": 0,
+    "col": -2
+   },
+   "reverse": true
+  },
+  {
+   "type": "switch.dropCars",
+   "trayId": "tray2",
+   "count": 1
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray2",
+   "to": {
+    "row": 0,
+    "col": 3
+   },
+   "reverse": false,
+   "via": {
+    "row": 0,
+    "col": 0
+   }
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray2",
+   "to": {
+    "row": 1,
+    "col": 0
+   },
+   "reverse": true
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray2",
+   "to": {
+    "row": 0,
+    "col": 3
+   },
+   "reverse": false
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray2",
+   "to": {
+    "row": 0,
+    "col": 1
+   },
+   "reverse": true
+  },
+  {
+   "type": "switch.dropCars",
+   "trayId": "tray2",
+   "count": 1
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray2",
+   "to": {
+    "row": 0,
+    "col": 3
+   },
+   "reverse": false
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray3",
+   "carType": "tank",
+   "loaded": false
+  },
+  {
+   "type": "newTrain.placeCar",
+   "trayId": "tray3",
+   "carType": "tank",
+   "loaded": false
+  },
+  {
+   "type": "loadUnload.end"
+  },
+  {
+   "type": "localOps.choose",
+   "option": "switch"
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray2",
+   "to": {
+    "row": 1,
+    "col": 0
+   },
+   "reverse": true
+  },
+  {
+   "type": "switch.dropCars",
+   "trayId": "tray2",
+   "count": 3
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray2",
+   "to": {
+    "row": 0,
+    "col": 3
+   },
+   "reverse": false
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray2",
+   "to": {
+    "row": 0,
+    "col": -2
+   },
+   "reverse": true,
+   "via": {
+    "row": 0,
+    "col": 1
+   }
+  },
+  {
+   "type": "switch.move",
+   "trayId": "tray2",
+   "to": {
+    "row": 0,
+    "col": 0
+   },
+   "reverse": false
+  },
+  {
+   "type": "switch.end"
+  }
+ ],
+ "rules": {
+  "startingHand": "sixRandom",
+  "revenue": {
+   "passengerPerCoach": 1,
+   "freightPerLoad": 1,
+   "trainPerTransit": 0
+  }
+ }
+}

docs/testing/0.5.0-test-plan.md

@@ -0,0 +1,195 @@
+# Station Master 0.5.0 — Test Plan
+
+Written 2026-08-21, against an uncommitted working tree. Covers only the changes made in this
+session's work — victory-condition unification, the New Train phase fix, and the multiplayer server
+(Phases 2-3). Nothing here is committed yet; see the Coordination Note below before running any of it
+against a tree that has since moved.
+
+## Coordination note — shared working tree
+
+Another thread is bug-fixing the 0.4.9 series **in this same uncommitted working tree**, concurrently.
+`git status` shows changes I did not make in: `apply.ts`, `events.ts`, `track.ts`, `board-svg.ts`,
+`docs/rules/*.md`, `package-lock.json`, `scripts/build-web.ts`, `.gitignore`, plus new
+`docs/station-master-seed*.json` files still appearing as of this writing. **This plan does not cover
+any of that** — it is scoped to the files below, which are the ones I actually touched.
+
+Practical implications:
+- Before running this plan, confirm the files under "Files this plan covers" still read the way this
+  document describes them — the other thread's commits could in principle touch the same functions
+  (`apply.ts`'s `check()` is used directly by `src/server/session.ts`, for instance).
+- Run the full regression gate (`npm run typecheck && npm test`) fresh, not from a memory of an earlier
+  green run — both threads are editing live.
+- The two bodies of work are unrelated in intent (0.4.9 patch fixes vs. 0.5.0 multiplayer groundwork)
+  but share a tree, so a clean split into separate commits before either is finalized is worth doing
+  deliberately rather than by accident.
+
+### Files this plan covers
+
+```
+Engine:  src/engine/advance.ts, src/engine/content.ts, src/engine/setup.ts, src/engine/state.ts
+Web:     src/web/game.ts, src/web/main.ts, src/web/play.html, src/web/session.ts
+Sim:     src/sim/view.ts, src/sim/frame-delta.ts (new), src/sim/compare.ts, src/sim/harness.ts,
+         src/sim/replay.ts
+Server:  src/server/ (new — index.ts, http.ts, session.ts, persistence.ts)
+Tests:   test/advance.test.ts, test/multiplayer.test.ts, test/web.test.ts, test/setup.test.ts,
+         test/redaction.test.ts (new), test/frame-delta.test.ts (new), test/server/ (new)
+Docs:    TODO.md, package.json (test script only)
+```
+
+---
+
+## 0. Automated regression gate — run first, every time
+
+```
+npm run typecheck
+npm test
+```
+
+Expected: typecheck clean, **all tests passing** (632 at the time this plan was written — the exact
+number will drift as the other thread's work lands; what matters is zero failures). If either command
+is red, stop and diagnose before doing anything below — a red gate means the manual steps are testing
+against a broken build.
+
+**If you only have time for one thing before the break ends, run this.** Everything else in this
+document is either already covered by it, or is the manual/live verification that can't be — flagged
+per-section below.
+
+---
+
+## 1. Regression baseline — solitaire must play exactly as before
+
+The engine and dialog changes touch shared code paths solitaire also uses. None of this should have
+changed solitaire's actual behavior.
+
+| # | Test | Steps | Expected |
+|---|---|---|---|
+| 1.1 | Fresh deal | `npm run serve:web`, open `/play.html`, no URL params | A new random-seed solitaire game deals normally, board and hand render |
+| 1.2 | Full game to completion | Play (or let a bot/harness play) a solitaire game to Day 5 | Game ends with a win/loss exactly as it would have before — `minCombinedRevenue` defaults to `collectiveRevenueFloor(1,5)=15`, not the old fixed `20`; a game scoring 15-19 that used to lose now wins (**intentional** — see §3, not a bug) |
+| 1.3 | Save / restore | Play a few turns, reload the page (auto-restores from `localStorage`) | Game resumes exactly where it left off, house rules and victory dials intact |
+| 1.4 | Save file download | Click "Save replay" mid-game | Downloads a small JSON; re-opening it in the replay viewer plays back identically |
+| 1.5 | Undo | Play a few turns, click Undo repeatedly to the start | Each step back is clean; log never shows a move that "un-happened" |
+| 1.6 | Existing published replays | Open each file under `public/replays/` in the replay viewer | All three still play back — `LEGACY_HOUSE_RULES` fallback for saves with no `houseRules` field is unaffected by this session's changes |
+
+Automated coverage: `test/advance.test.ts`, `test/web.test.ts`, `test/session.test.ts` already assert
+most of this at the unit level. §1 is about confirming nothing *visibly* changed for a solitaire
+player, which only a live playthrough shows.
+
+---
+
+## 2. New Train phase car-placement rotation (engine fix)
+
+**What changed:** the Superintendent used to place every car of every train alone, even in
+competitive mode, against §7's written rule. Now the round rotates Superintendent-then-left, one car
+per player, per `tray.consist.length`.
+
+Automated: `test/multiplayer.test.ts`, "the New Train phase car-placement round rotates (§7, Gap 9)" —
+asserts the exact actor sequence for 2p (wraps: 0,1,0) and 3p (no wrap: 0,1,2) against a real train
+profile.
+
+| # | Test | Steps | Expected |
+|---|---|---|---|
+| 2.1 | Manual multi-seat check | Drive a 3-4 player competitive game via the bot harness (`node src/sim/harness.ts`) or by hand through `src/server/`, and watch a Timetabled train get made up | Car-placement decisions visibly move between seats rather than one player filling the whole consist |
+| 2.2 | Solitaire unaffected | Play any solitaire game where a train is made up | No visible change — one player, nothing to rotate, `tray.consist.length % 1 === 0` always |
+
+Not covered, flagged in `TODO.md` (do not re-test, it's expected to be unreachable): `newTrain.passCar`
+still has a dormant `check()`/`reduce()` gap, harmless because `trainNeedingCars` never offers a tray
+with nothing suitable in the yard.
+
+---
+
+## 3. Victory conditions unified (`GameConfig` dials)
+
+**What changed:** `days`, `minCombinedRevenue`, `maxCollisionsPerDay`, `maxCollisionsTotal`,
+`pvpCardsAllowed` replace the old `length`-preset/`target`/flat collision constant, across all three
+modes. Automated coverage: `test/advance.test.ts`'s "victory conditions (§3, Gap 10e) — unified
+2026-08-20" describe block (8 tests) covers every case below at the engine level already. This section
+is for confirming the *dialog* actually produces the numbers the engine then honors.
+
+| # | Test | Steps | Expected |
+|---|---|---|---|
+| 3.1 | `minCombinedRevenue` — loss | New Game, set it to a number higher than achievable, play to Day N | Loss, reason `revenueFloor`, regardless of individual score |
+| 3.2 | `minCombinedRevenue` — win | Set it to 0, play to Day N with any score | Win — `0` genuinely disables the floor |
+| 3.3 | `maxCollisionsPerDay` — **new solitaire behavior** | Set to 1, deliberately cause 1 collision (e.g. leave every A/D track occupied on an arrival) | Game ends **immediately**, mid-Stage, loss, reason `collisionFloor` — solitaire could never lose this way before this change |
+| 3.4 | `maxCollisionsTotal` | Set `maxCollisionsPerDay=0` (off), `maxCollisionsTotal=2`, cause 2 collisions across different Days | Game ends on the 2nd collision, whichever Day it falls on |
+| 3.5 | Both collision caps at 0 | Set both to 0, cause several collisions | Game does **not** end early — same as pre-change solitaire (collisions still cost Revenue, just don't end the game) |
+| 3.6 | Mode radio defaults | Open New Game, click Competitive | `minCombinedRevenue` suggests `3 × 4 × days` (nominal 4-player assumption — no lobby yet to ask real seat count), `pvpCardsAllowed` checks and enables, Deal disables with a "needs a server" note |
+| 3.7 | Mode radio — Co-op | Click Co-op | `pvpCardsAllowed` unchecks and **greys out** (forced off, not just defaulted off — no valid target when everyone's on one side), Deal disables |
+| 3.8 | Mode radio — back to Solitaire | Click Solitaire again | Deal re-enables, `pvpCardsAllowed` unchecks and greys, all four dials show the numbers the *currently playing* game actually has (not the preset) |
+| 3.9 | URL round-trip | Deal a game with non-default `days`/`minrev`/`colday`/`coltotal`, copy the URL, open it in a new tab | Identical settings — all four now travel via `?days=&minrev=&colday=&coltotal=` alongside the existing `?hand=&passenger=&freight=&transit=` |
+
+**Not yet clicked through in a real browser** (no browser binary in the sandbox this was built in —
+verified only via a simulated-DOM test harness, `test/web.test.ts`'s "the New Game dialog" describe
+block, which drives the actual compiled bundle). §3.6-3.9 specifically should get a real click-through
+before calling this done.
+
+---
+
+## 4. Multiplayer server — Phase 2 (session core)
+
+New in this release: `src/server/` (session host, HTTP/SSE, static serving), `src/web/session.ts`'s
+`createRemoteSession`, `src/sim/frame-delta.ts`. Automated: `test/server/session.test.ts` (12 cases,
+pure logic, no sockets), `test/redaction.test.ts` (4 cases — the exhaustive "no seat sees another
+seat's secrets" check), `test/frame-delta.test.ts` (5 cases).
+
+| # | Test | Steps | Expected |
+|---|---|---|---|
+| 4.1 | Boot | `JOIN_SECRET=x PORT=8081 node src/server/index.ts` | Starts, logs the bind address and `dist/` path |
+| 4.2 | Join secret gate | `curl -X POST localhost:8081/api/game` (no `?secret=`) | `403 bad or missing secret` |
+| 4.3 | Create game | `POST /api/game?secret=x` with `{config, playerNames}` | `200 {ok:true, playerCount:N}`; a second call while a game exists → `409` |
+| 4.4 | Per-seat SSE | Open `/api/stream?seat=0` and `?seat=1` for a 2-player game | Only the current actor's push has a non-null `menu`; the other seat's is `null` |
+| 4.5 | Turn enforcement | `POST /api/intent` as the **non-acting** seat | `{ok:false, code:"NOT_YOUR_TURN"}`, no broadcast, no state change |
+| 4.6 | Accept + broadcast | `POST /api/intent` as the acting seat, a legal intent | `{ok:true}`; **both** SSE streams receive a push with fresh narration |
+| 4.7 | Idempotent resend | Submit the same `{seq, intent}` twice | Second call: `{ok:true}`, **no** new SSE push (already applied, silently ignored) |
+| 4.8 | Illegal intent | Submit something `check()` would reject | `{ok:false, code:"<real RejectionCode>"}`; the rejection text does **not** appear in the *other* seat's narration (private feedback, §session.ts's design note) |
+| 4.9 | Board delta | Submit an intent that doesn't move anything on the board (e.g. `localOps.choose`) | The next push's `frame.division`/`frame.cells` are `null` (unchanged-since-last-push-to-this-seat) |
+| 4.10 | Heartbeat | Hold an SSE connection open >20s idle | A `: ping` comment line appears (EventSource ignores it; keeps a proxy from reaping the socket) |
+| 4.11 | **Real browser — not yet done** | Two actual browser tabs, `?seat=0` and `?seat=1`, playing a shared game by clicking | Confirm the whole loop works through the actual UI, not just curl: turn indicator, disabled controls for the non-acting seat, board updates on both sides, a rejected action shows *something* sensible on screen rather than silently doing nothing |
+
+§4.1-4.10 were run live against a real server process during this session (not just unit-tested) — see
+the session transcript for the actual curl commands and captured output. §4.11 genuinely was not done;
+no browser was available in the environment this was built in.
+
+---
+
+## 5. Multiplayer server — Phase 3 (persistence and resumption)
+
+New: `src/server/persistence.ts`, `game.ts`'s `fromMultiplayerSave`, `session.ts`'s `exportSave`/
+`resumeSession`/turn-timing tracking. Automated: `test/server/persistence.test.ts` (6 cases),
+`test/server/session.test.ts`'s "turn timings" and "persistence hooks" describe blocks.
+
+| # | Test | Steps | Expected |
+|---|---|---|---|
+| 5.1 | Immediate persistence | `POST /api/game`, then check `DATA_DIR/game.json` | Exists immediately, empty `history`, correct `engineVersion` (= `package.json`'s `version`) |
+| 5.2 | History grows | Submit a few intents | `game.json`'s `history` array grows by one entry per accepted intent, in order |
+| 5.3 | Turn timings recorded | Submit enough intents to cross a full turn (player/phase/day/stage change) | `DATA_DIR/turn-timings.json` gains an entry: `{player, phase, day, stage, startedAt, endedAt}`, `endedAt >= startedAt` |
+| 5.4 | **Restart and resume** (the actual "done when" for Phase 3) | Kill the server process mid-game, restart it against the same `DATA_DIR` | Log line: `"Resumed a saved game... N intents replayed"`; reconnecting both `?seat=` streams shows the exact same Day/Stage/phase/whose-turn as before the kill, correct narration attribution ("Player X chose to...", not anonymous) |
+| 5.5 | Version-mismatch refusal | Hand-edit `game.json`'s `engineVersion` to a bogus value, restart | Log line refusing to load, naming both versions; server starts with **no** active game (confirm via `POST /api/game` succeeding, not `409`ing); the file is **not** deleted or modified |
+| 5.6 | Atomic writes, no stray temp files | After several intents, check `DATA_DIR` | Only `game.json`/`turn-timings.json` present — no leftover `.tmp` files from an interrupted write |
+
+§5.1-5.6 were all run live during this session (kill-and-restart included) — see the transcript. This
+is the most thoroughly live-verified section of the whole plan.
+
+---
+
+## 6. Things this session found but did *not* fix — verify they're still correctly deferred
+
+These are logged in `TODO.md`, not bugs to chase here — listed so a tester doesn't rediscover them and
+assume something regressed.
+
+| Item | Where | Current state to confirm |
+|---|---|---|
+| `fromSave`'s replay loses "Player X" narration attribution | `src/web/game.ts` | Still present in `fromSave` (untouched, out of scope); **fixed** in the new `fromMultiplayerSave` — §5.4's narration check is what confirms the fix landed where it needed to |
+| `newTrain.passCar`'s `check()`/`reduce()` gap | `src/engine/apply.ts` | Still dormant/unreachable — confirm no new caller has started exercising it (would only matter if the *other* thread's 0.4.9 work touches this area) |
+| No real browser click-through | This session | §3.6-3.9, §4.11 — the two gaps a human still needs to close |
+
+---
+
+## Summary checklist
+
+- [ ] §0 automated gate green
+- [ ] §1 solitaire regression (six checks)
+- [ ] §2 New Train rotation, manual multi-seat check
+- [ ] §3 victory conditions, especially §3.6-3.9 (dialog, not yet browser-verified)
+- [ ] §4 server core, especially §4.11 (real browser, not yet done)
+- [ ] §5 persistence — already live-verified this session; worth a second independent run
+- [ ] §6 confirm the three known-and-deferred items are still exactly as described

node_modules

@@ -1 +0,0 @@
-../../../node_modules

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "station-master",
-  "version": "0.0.1",
+  "version": "0.5.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "station-master",
-      "version": "0.0.1",
+      "version": "0.5.0",
       "devDependencies": {
         "@types/node": "^26.1.2",
         "typescript": "^7.0.2"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "station-master",
-  "version": "0.4.7",
+  "version": "0.5.2",
   "private": true,
   "type": "module",
   "description": "Station Master — a railroad operations game",
@@ -9,7 +9,8 @@
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "test": "node --test test/**/*.test.ts",
+    "pretest": "node scripts/build-web.ts",
+    "test": "node --test test/*.test.ts test/**/*.test.ts",
     "build:web": "node scripts/build-web.ts",
     "serve:web": "node scripts/build-web.ts && npx --yes http-server dist -p 8080 -c-1",
     "deploy:web": "node scripts/deploy-web.ts"

scripts/build-web.ts

@@ -10,12 +10,18 @@
  */
 
 import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const root = join(dirname(fileURLToPath(import.meta.url)), '..');
-const dist = join(root, 'dist');
+/**
+ * Overridable so a test can point the build at an isolated directory instead of the shared
+ * `dist/` the rest of the suite reads — see `test/web.test.ts`'s "builds, and needs nothing but a
+ * static host". Must be a sibling of `dist/`, not nested inside it: this script's own `rmSync`
+ * below wipes the whole directory it is given, so nesting one inside the other would still race.
+ */
+const dist = join(root, process.env['BUILD_DIST_DIR'] ?? 'dist');
 
 rmSync(dist, { recursive: true, force: true });
 mkdirSync(dist, { recursive: true });
@@ -151,6 +157,17 @@ if (existsSync(replaySrc)) {
 }
 writeFileSync(join(replayOut, 'manifest.json'), JSON.stringify(manifest, null, 1));
 
+/**
+ * Static images — the splash artwork and whatever joins it. Copied verbatim, unlike the replays
+ * above: an image needs no validation, only a place in `dist/` to be served from.
+ */
+const imageSrc = join(root, 'public/images');
+if (existsSync(imageSrc)) {
+  const imageOut = join(dist, 'images');
+  mkdirSync(imageOut, { recursive: true });
+  for (const f of readdirSync(imageSrc)) copyFileSync(join(imageSrc, f), join(imageOut, f));
+}
+
 // A tiny note for whoever unzips this later and wonders what it needs.
 writeFileSync(
   join(dist, 'README.txt'),

src/engine/advance.ts

@@ -18,6 +18,7 @@
 
 import {
   COLLISION_PENALTY,
+  EXPEDITE_FAULT_PENALTY,
   MAINLINE_PROFILES,
   enhancementRule,
   crossingStages,
@@ -26,9 +27,7 @@ import {
   MOVES_PER_LOCAL_OPS_NIGHT,
   STAGES_PER_DAY,
   STAGES_PER_SHIFT,
-  collectiveRevenueFloor,
   houseRules,
-  lengthProfile,
   officeProfile,
   REGIONS_PER_MAINLINE_CARD,
   mainlineProfile,
@@ -272,10 +271,23 @@ function newTrainPhase(s: GameState, events: GameEvent[]): AdvanceResult {
     return { events, needsInput: true };
   }
 
-  // Gap 9 — the car-placement round REPEATS until the consist is full or no suitable car remains.
+  /**
+   * Gap 9 — the car-placement round REPEATS until the consist is full or no suitable car remains,
+   * cycling Superintendent-then-left one car at a time (§7).
+   *
+   * `tray.consist.length` IS the round position: a freshly made-up tray always starts with
+   * `consist: []`, and each `newTrain.placeCar` appends exactly one car to it (`apply.ts`'s
+   * `carPlacedOnTrain` reducer), so it counts placements toward THIS tray without any new state —
+   * and resets to 0 naturally for the next train made up, which a phase-wide `actorOffset` cannot
+   * do. Reproduces the rulebook's worked example exactly: 2 players, 4-coach Limited → seats
+   * 0, 1, 0, 1.
+   */
   const filling = trainNeedingCars(s);
   if (filling) {
-    s.clock.currentActor = actorAt(s, s.clock.actorOffset % s.players.length);
+    const tray = s.trays.get(filling)!;
+    const nextActor = actorAt(s, tray.consist.length % s.players.length);
+    if (s.clock.currentActor !== nextActor) events.push({ type: 'actorChanged', player: nextActor });
+    s.clock.currentActor = nextActor;
     return { events, needsInput: true };
   }
 
@@ -307,6 +319,38 @@ function mainlinePhase(s: GameState, events: GameEvent[]): AdvanceResult {
       return d !== 0 ? d : Number(a.trainIsExtra) - Number(b.trainIsExtra);
     });
 
+  /**
+   * Q3 — A STATION MASTER FAULT: an expedited train not at the station when a Mainline Phase begins
+   * was not kept ready to highball, wherever in the district it has been left — switched onto
+   * Secondary Track to clear a move, say. Checked against positions as they stand BEFORE this phase
+   * moves anything, and charged every Phase it is still caught away: the fault is in leaving it
+   * there, not a one-time slip. A train the ordinary §8.1 rules are holding at the Office itself is
+   * unaffected — this only bites when the train is not even in the queue to leave.
+   */
+  for (const [, tray] of order) {
+    if (!isExpedited(tray) || tray.position.at !== 'grid') continue;
+    const area = areaAtSeat(s, tray.position.seat);
+    const { coord } = tray.position;
+    if (coord.row === area.officeCoord.row && coord.col === area.officeCoord.col) continue;
+    const owner = playerAtSeat(s, tray.position.seat);
+    const p = s.players[owner];
+    if (!p) continue;
+    p.revenue -= EXPEDITE_FAULT_PENALTY;
+    events.push({
+      type: 'expediteFault',
+      player: owner,
+      trainNumber: tray.trainNumber ?? 0,
+      where: `(${coord.col},${coord.row})`,
+    });
+    events.push({
+      type: 'revenueChanged',
+      player: owner,
+      delta: -EXPEDITE_FAULT_PENALTY,
+      total: p.revenue,
+      reason: 'expedited train left off the station',
+    });
+  }
+
   for (const [id, tray] of order) {
     if (s.movedThisPhase.has(id)) continue;
     const where = tray.position;
@@ -329,13 +373,13 @@ function mainlinePhase(s: GameState, events: GameEvent[]): AdvanceResult {
         (tray.position.at !== 'grid' ||
           where.at !== 'grid' ||
           (tray.position.coord.row === where.coord.row && tray.position.coord.col === where.coord.col));
-      if (!tray.departsThisStage && stillThere) {
+      if (stillThere) {
         tray.stopPointClaimed = true;
         // The point goes to whoever is SITTING in the district it stopped in.
         const owner = tray.position.at === 'grid' ? playerAtSeat(s, tray.position.seat) : 0;
         const label =
           tray.position.at === 'grid'
-            ? `(${tray.position.coord.row},${tray.position.coord.col})`
+            ? `(${tray.position.coord.col},${tray.position.coord.row})`
             : tray.position.at === 'mainline'
               ? `Mainline card ${tray.position.index}`
               : `the ${tray.position.side} Division Point`;
@@ -475,14 +519,18 @@ function spendDispatchBonus(
   return 0;
 }
 
-/** Q3 — an expedited train does not spend a Stage standing at the Office. */
 /**
- * Does this train leave in the same Stage it arrives (§7)?
+ * Q3 — is this train subject to the "kept ready" fault (§7)?
+ *
+ * Expedite does not change WHEN a train leaves — it is released by the ordinary §8.1 rules like any
+ * other train, and may be switched normally while it stands. What it means is that it must not be
+ * held anywhere but the station: a train the player parks on Secondary Track to clear a switching
+ * move faults if it is not back on the Office square by the next Mainline Phase (`mainlinePhase`).
  *
  * Two ways to earn it. `expedite` is printed and permanent. `stopThenExpedite` is the X17 Campaign
  * Train — "one turn at station (speeches) then expedite": its FIRST arrival is an ordinary stop while
  * the speeches are made, and every arrival after that is expedited. `speechMade` is set on that first
- * stop, so the train is slow once and fast thereafter.
+ * stop, so the train is exempt once and subject to the fault thereafter.
  */
 function isExpedited(tray: CrewTray): boolean {
   const rules = trainProfile(tray.trainNumber ?? 0, tray.trainIsExtra)?.rules;
@@ -491,18 +539,7 @@ function isExpedited(tray: CrewTray): boolean {
   return rules.stopThenExpedite === true && tray.speechMade === true;
 }
 
-function moveTrain(
-  s: GameState,
-  id: TrayId,
-  tray: CrewTray,
-  events: GameEvent[],
-  /**
-   * Which pass is asking. The Mainline Phase moves every train once; Supervisor Shift then asks the
-   * Expedited arrivals to go again. The train cannot tell the difference, but the player must — see
-   * `trainHighballed.why`.
-   */
-  pass: 'mainline' | 'expedite' = 'mainline',
-): MoveOutcome {
+function moveTrain(s: GameState, id: TrayId, tray: CrewTray, events: GameEvent[]): MoveOutcome {
   const dir = step(tray.direction);
 
   if (tray.position.at === 'divisionPoint') {
@@ -588,10 +625,7 @@ function moveTrain(
         trainNumber: tray.trainNumber ?? 0,
         from: 'the Office',
         to: 'the Mainline',
-        why:
-          pass === 'expedite'
-            ? 'its card prints EXPEDITE, so it leaves at the end of the Stage it arrived in — you got the Cargo phase with it, but no Local Operations turn to switch it'
-            : 'it stood a full Stage at the Office, so §8.1 released it this Mainline Phase',
+        why: 'it stood a full Stage at the Office, so §8.1 released it this Mainline Phase',
       });
       return 'moved';
     }
@@ -751,28 +785,44 @@ function evaluateClearance(
     for (const t of n.transits) if (t.tray) occupants.push({ tray: t.tray, onCard: i });
   }
 
+  /**
+   * TWO PASSES, NOT ONE — an opposite-direction occupant is an absolute bar and has to be checked
+   * against EVERY occupant before any same-direction judgment call is offered.
+   *
+   * A single pass returned on whichever occupant it examined first, in `node.transits` insertion
+   * order — which is fine while a Subdivision holds at most one train, but the dispatch exception
+   * below means it now legitimately can hold two: a Telegraph-cleared facing train sits on the same
+   * card as whatever it was cleared past. Found from a playtest report where the Superintendent was
+   * asked to rule on a same-direction train instead of being auto-held against an uncleared
+   * opposite-direction one also on the card — the loop had reached the same-direction occupant
+   * first simply because it entered the transit list first, and returned before ever looking at
+   * the other.
+   */
+  for (const { tray: other } of occupants) {
+    if (other === id) continue;
+    const otherTray = s.trays.get(other);
+    if (!otherTray || otherTray.direction === tray.direction) continue;
+    // §8.1 — a train moving TOWARDS the considered train is an absolute bar. That stands.
+    //
+    // The exception is dispatching technology. Telegraph/Telephone/Radio exist precisely so the
+    // Superintendent can arrange a meet with a facing train: "once a day, when dispatching
+    // facing trains, add +4/+8/+12 to the other train's number". Without a device there is no
+    // way to pass the order, so the train simply holds.
+    if (spendDispatchBonus(s, tray, otherTray, events) > 0) continue;
+    return 'blocked';
+  }
+
   for (const { tray: other, onCard } of occupants) {
     if (other === id) continue;
     const otherTray = s.trays.get(other);
-    if (!otherTray) continue;
+    if (!otherTray || otherTray.direction !== tray.direction) continue;
     const onNode = s.division.nodes[onCard];
 
-    if (otherTray.direction !== tray.direction) {
-      // §8.1 — a train moving TOWARDS the considered train is an absolute bar. That stands.
-      //
-      // The exception is dispatching technology. Telegraph/Telephone/Radio exist precisely so the
-      // Superintendent can arrange a meet with a facing train: "once a day, when dispatching
-      // facing trains, add +4/+8/+12 to the other train's number". Without a device there is no
-      // way to pass the order, so the train simply holds.
-      if (spendDispatchBonus(s, tray, otherTray, events) > 0) return 'clear';
-      return 'blocked';
-    }
-
     // Red Flags — "a stopped train is prevented from being hit; the approaching train is prevented
     // from moving". Flagging is per-train rather than per-card, so it protects one specific train
     // where ABS Signals protects everything on the card.
     //
-    // Both of these now read the card the OTHER train is standing on rather than the card being
+    // Both of these read the card the OTHER train is standing on rather than the card being
     // entered. They were the same card while this only looked one card ahead; across a Subdivision
     // they are not, and the protection belongs where the train it protects actually is.
     if (onNode?.kind === 'mainline' && (onNode.redFlagged ?? []).includes(other)) return 'blocked';
@@ -854,8 +904,13 @@ function arriveAtOffice(
 
   // §8.3 — cars standing on the Running Track between the Limits and the Office. A train at speed
   // is not expecting them (§A.4), so this is a collision too, not a coupling.
+  //
+  // A coach is the one exception (v0.5.0, §A.4's Office carve-out): it may be legally, deliberately
+  // parked at the Office while its engine switches, so it must not become a hazard to the next
+  // arrival. Anything else standing there is still illegal to have dropped in the first place —
+  // `canDropCarsAt` already refuses it — so this filter only ever excludes a coach in practice.
   const officeCard = area.grid.get(coordKey(area.officeCoord));
-  if (officeCard && officeCard.standing.length > 0) {
+  if (officeCard && officeCard.standing.some((c) => c.type !== 'coach')) {
     collide(s, playerAtSeat(s, seat), [id], events, 'cars fouling the Running Track', 'the Running Track');
     return 'moved';
   }
@@ -871,27 +926,9 @@ function arriveAtOffice(
   });
 
   /**
-   * Q3 — AN EXPEDITED TRAIN DEPARTS THE STAGE IT ARRIVED, BUT NOT BEFORE THE WORK IS DONE.
-   *
-   * It used to leave inside this very Mainline Phase — a second `moveTrain` on the spot. That made
-   * "departs the Stage it arrives" true and the coaches worthless: Load/Unload runs AFTER Mainline,
-   * so an expedited train was gone before a single Porter could reach it. Measured over 60 games,
-   * Train 2 arrived 32 times and stood at an Office during Load/Unload exactly none of them, and
-   * every coach-carrying express is expedited (1/2 Crack Limited, 5/6 The Sparrow, 19 Military).
-   * The Crack Limited's own card says "stop at Terminals only", which it could never do.
-   *
-   * So it stands here through Load/Unload and leaves at the end of the Stage instead. It still does
-   * not lay over to the next Stage — the keyword is honoured — and it is still subject to every
-   * §8.1 condition when it goes, so it can be held.
-   */
-  if (isExpedited(tray)) {
-    tray.departsThisStage = true;
-    return 'moved';
-  }
-  /**
-   * X17 Campaign Train — the speeches happen at the first Office it reaches. Recorded AFTER the
-   * expedite test above, so this arrival is the ordinary stop the card pays for and every later one
-   * runs expedited.
+   * X17 Campaign Train — the speeches happen at the first Office it reaches, and every arrival after
+   * that runs expedited (`isExpedited` reads `speechMade`). Setting it here is idempotent on every
+   * later arrival, so it needs no guard against re-firing.
    */
   if (trainProfile(tray.trainNumber ?? 0, tray.trainIsExtra)?.rules.stopThenExpedite) {
     tray.speechMade = true;
@@ -935,6 +972,7 @@ function collide(
   }
 
   s.collisionsToday += 1;
+  s.collisionsTotal += 1;
   const player = s.players[faultPlayer];
   if (player) {
     player.revenue -= COLLISION_PENALTY;
@@ -1018,40 +1056,6 @@ function retireTrain(
 // ---------------------------------------------------------------------------
 
 function shiftChange(s: GameState, events: GameEvent[]): AdvanceResult {
-  /**
-   * EXPEDITED DEPARTURES — the last thing that happens in a Stage (Q3, and `arriveAtOffice`).
-   *
-   * Run here rather than as a phase of its own because there is no decision in it: the trains that
-   * arrived expedited this Stage try to leave, in train-number order like any other movement, and
-   * §8.1 may still hold them. Being after Load/Unload is the whole point — it is what gives the
-   * Porters their one Stage with the train.
-   */
-  const expedited = [...s.trays.entries()]
-    .filter(([, t]) => t.departsThisStage)
-    .sort(([, a], [, b]) => (a.trainNumber ?? 0) - (b.trainNumber ?? 0));
-  for (const [id, tray] of expedited) {
-    tray.departsThisStage = false;
-    /**
-     * An expedited train that would need a §8.1 ruling STAYS, and runs normally from then on.
-     *
-     * Said in the log, because it is the difference between "this train leaves at the end of the
-     * Stage" and "this train is still here next turn", and a player watching one Expedited train
-     * vanish and the next one linger has no way to tell why. Measured on one seed: with ordinary
-     * traffic running, Train 6 was held this way and collected four Local Operations turns.
-     */
-    if (moveTrain(s, id, tray, events, 'expedite') === 'needsClearance') {
-      events.push({
-        type: 'trainHeld',
-        trainNumber: tray.trainNumber ?? 0,
-        reason:
-          'it EXPEDITES and was due out at the end of this Stage, but the Subdivision ahead needs a ' +
-          'clearance ruling and Supervisor Shift has no Superintendent to give one. It stays, and ' +
-          'runs like an ordinary train from now on — so you DO get a Local Operations turn with it',
-      });
-      continue;
-    }
-  }
-
   // §5 — the Fedora passes every three Stages: shift changes at Stages 3, 6, 9 and 12.
   if (s.clock.stage % STAGES_PER_SHIFT === 0) {
     s.clock.superintendent = playerLeftOf(s, s.clock.superintendent);
@@ -1080,63 +1084,58 @@ function shiftChange(s: GameState, events: GameEvent[]): AdvanceResult {
     events.push({ type: 'stageBegan', day: s.clock.day, stage: s.clock.stage });
   }
 
-  // §3.4 — Competitive only: three collisions in one Day and everyone loses.
-  if (s.config.mode === 'competitive' && s.collisionsToday >= 3) {
-    s.status = 'finished';
-    s.outcome = { result: 'loss', winner: null, reason: 'collisionFloor' };
-    return { events, needsInput: false };
+  // §3.4 — every mode but competitive-and-coop-only: a Day's collisions against `maxCollisionsPerDay`
+  // and the game's running total against `maxCollisionsTotal`. `0` disables either check. Flat, not
+  // scaled by player count — Jesse's call, 2026-08-20: more players is more independent chances to
+  // collide, not a bigger shared budget.
+  if (s.config.mode === 'competitive' || s.config.mode === 'coop') {
+    const perDayBreach =
+      s.config.maxCollisionsPerDay > 0 && s.collisionsToday >= s.config.maxCollisionsPerDay;
+    const totalBreach =
+      s.config.maxCollisionsTotal > 0 && s.collisionsTotal >= s.config.maxCollisionsTotal;
+    if (perDayBreach || totalBreach) {
+      s.status = 'finished';
+      s.outcome = { result: 'loss', winner: null, reason: 'collisionFloor' };
+      return { events, needsInput: false };
+    }
   }
 
   return { events: [...events, ...enterPhase(s, 'localOps')], needsInput: false };
 }
 
-/** §3.3 — evaluated at the end of a Day. */
+/**
+ * §3.3 — evaluated at the end of a Day.
+ *
+ * Unified 2026-08-20 across all three modes: play `config.days`, then whoever has the most Revenue
+ * wins — unless the table's combined Revenue missed `config.minCombinedRevenue`, in which case
+ * everyone loses. Solitaire is "everyone" with one player, so this is the same win/lose shape it
+ * always had, just against a configured floor instead of a `length`-preset `target`. Coop keeps its
+ * "the table's score is everyone's Revenue summed" model — winner stays null, the achievement is
+ * shared — now against the same configurable floor.
+ */
 function checkVictory(s: GameState, _events: GameEvent[]): boolean {
-  const profile = lengthProfile(s.config.length);
   const daysElapsed = s.clock.day - 1;
-
-  if (s.config.victory === 'firstToTarget') {
-    const target =
-      s.config.mode === 'coop' ? profile.target * s.players.length : profile.target;
-    const score = s.config.mode === 'coop' ? totalRevenue(s) : Math.max(...s.players.map((p) => p.revenue));
-    if (score >= target) {
-      const winner =
-        s.config.mode === 'coop'
-          ? null
-          : s.players.findIndex((p) => p.revenue === score);
-      s.status = 'finished';
-      s.outcome = { result: 'win', winner: winner === -1 ? null : winner, reason: 'targetReached' };
-      return true;
-    }
-    return false;
-  }
-
-  if (daysElapsed < profile.days) return false;
+  if (daysElapsed < s.config.days) return false;
 
   s.status = 'finished';
 
-  if (s.config.mode === 'competitive') {
-    // §3.5 — all players' Revenue combined must clear the floor, or everyone loses.
-    if (totalRevenue(s) < collectiveRevenueFloor(s.players.length, profile.days)) {
-      s.outcome = { result: 'loss', winner: null, reason: 'revenueFloor' };
-      return true;
-    }
-    const best = Math.max(...s.players.map((p) => p.revenue));
-    s.outcome = {
-      result: 'win',
-      winner: s.players.findIndex((p) => p.revenue === best),
-      reason: 'daysElapsed',
-    };
+  const combined = totalRevenue(s);
+  if (s.config.minCombinedRevenue > 0 && combined < s.config.minCombinedRevenue) {
+    s.outcome = { result: 'loss', winner: null, reason: 'revenueFloor' };
     return true;
   }
 
-  // Solitaire and Co-op: the target doubles as a MINIMUM. Below it you lose regardless of score.
-  const target = s.config.mode === 'coop' ? profile.target * s.players.length : profile.target;
-  const score = s.config.mode === 'coop' ? totalRevenue(s) : (s.players[0]?.revenue ?? 0);
-  s.outcome =
-    score >= target
-      ? { result: 'win', winner: null, reason: 'daysElapsed' }
-      : { result: 'loss', winner: null, reason: 'revenueFloor' };
+  if (s.config.mode === 'coop') {
+    s.outcome = { result: 'win', winner: null, reason: 'daysElapsed' };
+    return true;
+  }
+
+  const best = Math.max(...s.players.map((p) => p.revenue));
+  s.outcome = {
+    result: 'win',
+    winner: s.players.findIndex((p) => p.revenue === best),
+    reason: 'daysElapsed',
+  };
   return true;
 }
 

src/engine/apply.ts

@@ -66,7 +66,7 @@ import {
   trackOrder,
   turnOf,
 } from './state.ts';
-import type { MoveBlock, Occupancy, Port } from './track.ts';
+import type { MoveBlock, MoveDestination, Occupancy, Port } from './track.ts';
 import {
   canDropCarsAt,
   canPlaceAt,
@@ -77,6 +77,7 @@ import {
   opposite,
   reachableDestinations,
   variantsFor,
+  withinLimits,
 } from './track.ts';
 
 export type ApplyResult =
@@ -485,11 +486,14 @@ function freightBudgetLeft(
 }
 
 /**
- * Whether a train may do switching work at all (§7).
+ * Whether a train may set out or sort cars (§7).
  *
  * Six cards print "no switching" — the two expresses, the Light Engine, the Campaign, Circus and
- * Military trains. They run the Division; they do not shunt. This covers moving, setting out and
- * sorting alike, because all three are switching.
+ * Military trains — which means they may not ADD or DROP cars, not that they may never be touched: a
+ * train held at the Office may still need to clear onto Secondary Track ahead of other traffic. So
+ * this covers `switch.dropCars` and `switch.sortConsist` only; `switch.move` handles `noSwitching`
+ * itself, the same way it handles `dropOnly`, because the restriction has to bite on the pick-up a
+ * move would make, not on the move itself.
  */
 function switchingRefusal(tray: CrewTray): RejectionCode | null {
   return rulesOf(tray).noSwitching ? 'NO_SWITCHING' : null;
@@ -625,12 +629,10 @@ export function check(s: GameState, player: PlayerIndex, i: Intent): RejectionCo
       if (turnOf(s, player).movesRemaining < 1) return 'NO_MOVES_REMAINING';
       const tray = s.trays.get(i.trayId);
       if (!tray) return 'NO_SUCH_TRAY';
-      const noSwitch = switchingRefusal(tray);
-      if (noSwitch) return noSwitch;
       const from = trayCoord(s, i.trayId);
       if (!from) return 'ILLEGAL_MOVE';
       const dests = destinationsFor(s, player, i.trayId, from, i.reverse);
-      const dest = dests.find((d) => d.coord.row === i.to.row && d.coord.col === i.to.col);
+      const dest = selectDestination(dests, i.to, i.via);
       if (!dest) return 'ILLEGAL_MOVE';
 
       /**
@@ -651,6 +653,14 @@ export function check(s: GameState, player: PlayerIndex, i: Intent): RejectionCo
        */
       const fresh = dest.couples.slice(ownCutFor(s, player, i.trayId, i.reverse).length);
       if (fresh.length > 0) {
+        /**
+         * "NO SWITCHING" MEANS NO ADDING OR DROPPING CARS, not "never move". A no-switching train
+         * held at the Office may still need to clear onto Secondary Track ahead of other traffic —
+         * §7 governs coupling, setting out and sorting, and a move that picks nothing up is none of
+         * those. Handled here, alongside `dropOnly`, rather than as a blanket refusal on the intent:
+         * the restriction has to bite on the pick-up itself, the same reasoning as the comment above.
+         */
+        if (rules.noSwitching) return 'PICKUP_NOT_ALLOWED';
         if (rules.dropOnly) return 'PICKUP_NOT_ALLOWED';
         if (rules.pickUpEmptiesOnly && fresh.some((c) => c.loaded)) return 'EMPTIES_ONLY';
         const freight = fresh.filter(isFreight).length;
@@ -687,25 +697,24 @@ export function check(s: GameState, player: PlayerIndex, i: Intent): RejectionCo
         ? tray.consist.slice(0, i.count)
         : tray.consist.slice(tray.consist.length - i.count);
       const dropRules = rulesOf(tray);
+      const dropArea = areaOf(s, player);
+      const atOffice = here.row === dropArea.officeCoord.row && here.col === dropArea.officeCoord.col;
       /**
-       * Trains 7/8 Local — "coach must remain on station track if switching", i.e. the coach is
-       * never set out during switching at all.
-       *
-       * The intended reading was "set out only at the Office", but §A.4 makes that unimplementable:
-       * `canDropCarsAt` refuses the Office square outright — "the Office track is Operational Rail,
-       * but Rolling Stock may not be left there" — so "only at the Office" and "nowhere" are the same
-       * rule. What is left is the effect that matters: the Local may shunt its freight car around the
-       * district, and may not abandon its coach at an industry or on a siding while it does.
-       * Flagged in `TODO.md` in case the station track is meant to become a real place to leave one.
+       * Trains 7/8 Local — "coach must remain on station track if switching" — the coach may never
+       * be set out anywhere ELSE while switching. §A.4 now carries an exception for the Office
+       * square (v0.5.0, Jesse's call): any train may cut a coach loose there, which is exactly what
+       * "station track" meant on the card all along. So the coach is refused everywhere except the
+       * Office, rather than everywhere.
        */
-      if (dropRules.coachStaysOnStationTrack && cut.some((c) => c.type === 'coach')) {
+      if (dropRules.coachStaysOnStationTrack && cut.some((c) => c.type === 'coach') && !atOffice) {
         return 'COACH_MUST_STAY';
       }
       const droppedFreight = cut.filter(isFreight).length;
       if (droppedFreight > 0 && !freightBudgetLeft(s, player, tray, here, droppedFreight)) {
         return 'FREIGHT_WORKED_HERE';
       }
-      return canDropCarsAt(areaOf(s, player), here, i.count) ? null : 'CANNOT_DROP_HERE';
+      const coachesOnly = cut.every((c) => c.type === 'coach');
+      return canDropCarsAt(dropArea, here, i.count, coachesOnly) ? null : 'CANNOT_DROP_HERE';
     }
 
     case 'switch.sortConsist': {
@@ -1105,6 +1114,9 @@ function checkPlay(
         if (placement.row === area.runningRow && !carriesThroughTrack(proto)) {
           return 'BREAKS_RUNNING_TRACK';
         }
+        // Same reasoning: a siding reaching past your own sign JOINS perfectly well, and is refused
+        // because it leaves your territory (§2.1). `canPlaceAt` enforces it too — this only names it.
+        if (!withinLimits(area, placement)) return 'OUTSIDE_LIMITS';
         return canPlaceAt(area, placement, proto) ? null : 'NOT_CONNECTED';
       }
 
@@ -1123,6 +1135,10 @@ function checkPlay(
        * main line.
        */
       if (placement.row === area.runningRow) return 'ON_RUNNING_TRACK';
+      // A Facility CARRIES TRACK — "placing a Facility places track" (§11.2) — so it is bounded by
+      // the Limits exactly as a siding is. An industry outside them is how a district used to leave
+      // its own territory.
+      if (!withinLimits(area, placement)) return 'OUTSIDE_LIMITS';
       // Q4 — a lockout prevents BUILDING both in one district: no duplicate, and never a producer
       // alongside the consumer of the same commodity.
       if (isLockedOut(area, card.kind.facility)) return 'FACILITY_LOCKED';
@@ -1133,6 +1149,18 @@ function checkPlay(
     case 'modifier': {
       if (!placement) return 'NO_PLACEMENT';
       if (area.grid.has(coordKey(placement))) return 'NOT_CONNECTED';
+      /**
+       * NOT ON THE RUNNING TRACK ROW — AND NOT BOUNDED BY THE LIMITS EITHER. Jesse's call, both
+       * halves.
+       *
+       * A Modifier is not track (§9), so unlike a siding it may hang outside the Limits: a Facility
+       * standing at the limit has three of its nine spots out there, and refusing them would make
+       * the card unplayable exactly where the district ends. What it may NOT do is stand in the row
+       * the Running Track grows along. Inside the Limits that row is always full, so this bites only
+       * beyond the sign — which is the ground the main extends onto, and a Modifier parked there
+       * would block your own sign from moving outward (§2.1) with nothing on screen to warn you.
+       */
+      if (placement.row === area.runningRow) return 'ON_RUNNING_TRACK';
       // One of a kind per Office Area, as with industries (Q4) — no district gets two Ice Houses.
       if (hasModifierInArea(area, card.kind.modifier)) return 'FACILITY_LOCKED';
       // §9 — a Modifier is not track. It must sit adjacent to a Facility THAT CAN HOST IT (one of
@@ -1187,6 +1215,23 @@ function checkPlay(
   }
 }
 
+/**
+ * Among destinations at `to`, the one `via` names — or the first `legal.ts` enumerated there, if
+ * `via` is absent or names no route on record. That fallback is what makes an old save (or any
+ * caller that never learned about routing) replay exactly as before: the first-enumerated route is
+ * the only one that ever existed until this feature did.
+ */
+export function selectDestination(
+  dests: MoveDestination[],
+  to: GridCoord,
+  via: GridCoord | undefined,
+): MoveDestination | undefined {
+  const atTo = dests.filter((d) => d.coord.row === to.row && d.coord.col === to.col);
+  if (via === undefined) return atTo[0];
+  const chosen = atTo.find((d) => d.path.some((step) => step.coord.row === via.row && step.coord.col === via.col));
+  return chosen ?? atTo[0];
+}
+
 function destinationsFor(
   s: GameState,
   player: PlayerIndex,
@@ -1203,7 +1248,6 @@ function destinationsFor(
       occupancy: occupancyFor(s, player, trayId),
       consistSize: tray.consist.length,
       self: trayId,
-      ...(tray.standingWest === undefined ? {} : { standingWest: tray.standingWest }),
     },
     from,
     exit,
@@ -1224,7 +1268,8 @@ export function ownCutFor(s: GameState, player: PlayerIndex, trayId: TrayId, rev
   const here = tray.position.coord;
   const facing = facingPort(s, trayId);
   const exit: Port = reverse ? reversePort(s, player, here, facing) : facing;
-  return cutTowards(tray, carsOn(areaOf(s, player).grid.get(coordKey(here)) ?? emptyCard()), exit);
+  const card = areaOf(s, player).grid.get(coordKey(here)) ?? emptyCard();
+  return cutTowards(card, carsOn(card), exit);
 }
 
 /**
@@ -1250,7 +1295,6 @@ export function movesFor(
     occupancy: occupancyFor(s, player, trayId),
     consistSize: tray.consist.length,
     self: trayId,
-    ...(tray.standingWest === undefined ? {} : { standingWest: tray.standingWest }),
   };
   const facing = facingPort(s, trayId);
   const forward = exploreMoves(ctx, from, facing);
@@ -1283,7 +1327,7 @@ function execute(s: GameState, player: PlayerIndex, i: Intent): GameEvent[] {
     case 'switch.move': {
       const from = trayCoord(s, i.trayId)!;
       const dests = destinationsFor(s, player, i.trayId, from, i.reverse);
-      const dest = dests.find((d) => d.coord.row === i.to.row && d.coord.col === i.to.col)!;
+      const dest = selectDestination(dests, i.to, i.via)!;
       const tray = s.trays.get(i.trayId)!;
       // The port the crew pulls out THROUGH — the same one `destinationsFor` explored from, so the
       // cut it recouples on the way out is the cut the walk counted.
@@ -1323,6 +1367,7 @@ function execute(s: GameState, player: PlayerIndex, i: Intent): GameEvent[] {
            * Move on one (§A.1) — so there is exactly one way out of it.
            */
           facing: i.reverse ? dest.entry : farPort(areaOf(s, player).grid.get(coordKey(i.to)), dest.entry),
+          ...(i.via ? { via: i.via } : {}),
         },
       ];
       if (dest.couples.length > 0) {
@@ -1336,17 +1381,19 @@ function execute(s: GameState, player: PlayerIndex, i: Intent): GameEvent[] {
          * from `dest.path` plus the destination, neither of which can ever contain the start — so a
          * cut recoupled off your own card was added to the consist and left standing on the board at
          * the same time, one car becoming two. The cars that stay behind (a cut set out off the
-         * OTHER end) ride along on `leaves`, because by the time this is reduced the tray has moved
-         * and `standingWest` no longer describes this card.
+         * OTHER end) ride along on `leaves`, computed here against the card's CURRENT split — the
+         * reducer applying this event goes on to zero `standingWest` on the destination card, never
+         * the origin, so nothing downstream needs this snapshot to have been taken any earlier.
          */
         const grid = areaOf(s, player).grid;
-        const startCut = cutTowards(tray, carsOn(grid.get(coordKey(from)) ?? emptyCard()), exitPort);
+        const startCard = grid.get(coordKey(from)) ?? emptyCard();
+        const startCut = cutTowards(startCard, carsOn(startCard), exitPort);
         const lifted = [
           ...(startCut.length > 0 ? [from] : []),
           ...dest.path.map((step) => step.coord),
           i.to,
         ].filter((c) => carsOn(grid.get(coordKey(c)) ?? emptyCard()).length > 0);
-        const sides = standingSides(tray, carsOn(grid.get(coordKey(from)) ?? emptyCard()));
+        const sides = standingSides(startCard, carsOn(startCard));
         const stayed = exitPort === 'e' ? sides.west : exitPort === 'w' ? sides.east : [];
         // §A.3 — "engines also have couplers on the front end, so a train can pick cars up onto
         // its nose". Running forward the engine meets cars head-on and takes them in front; backing
@@ -1615,7 +1662,13 @@ function execute(s: GameState, player: PlayerIndex, i: Intent): GameEvent[] {
     case 'laborer.beginUnload': {
       const f = facilityAt(s, player, i.at)!;
       return [
-        { type: 'unloadBegan', player, at: i.at, carType: f.industryTrack.cars[i.carIndex]!.type },
+        {
+          type: 'unloadBegan',
+          player,
+          at: i.at,
+          carType: f.industryTrack.cars[i.carIndex]!.type,
+          carIndex: i.carIndex,
+        },
       ];
     }
 
@@ -1684,14 +1737,17 @@ export function reduce(s: GameState, e: GameEvent): void {
       // their turn. The event carries no player of its own.
       turnOf(s, playerAtSeat(s, seat)).movesRemaining = e.movesRemaining;
 
+      const area = areaAtSeat(s, seat);
+
       // A MOVE ENDS ON AN EMPTY CARD, always: coupling is mandatory, so anything standing on the
-      // destination has just been lifted into the tray. Whatever this crew had beside it belonged to
-      // the square it left, so its place in that row is gone with it.
-      tray.standingWest = 0;
+      // destination has just been lifted into the tray. Zero the DESTINATION card's split — the
+      // origin's is left alone rather than cleared, which costs nothing: nothing reads `standingWest`
+      // on a card with no train standing there, so a stale value left behind is inert, not wrong.
+      const destCard = area.grid.get(coordKey(e.to));
+      if (destCard) destCard.standingWest = 0;
 
       // An A/D track is held only while the train is actually standing at the Office (§2.1).
       // Leaving it out of sync means the Office looks permanently full and every arrival collides.
-      const area = areaAtSeat(s, seat);
       const atOffice =
         e.to.row === area.officeCoord.row && e.to.col === area.officeCoord.col;
       area.adOccupancy = area.adOccupancy.filter((t) => t !== e.trayId);
@@ -1739,9 +1795,9 @@ export function reduce(s: GameState, e: GameEvent): void {
         const card = area.grid.get(coordKey(e.leaves.at));
         if (card) carsOn(card).push(...e.leaves.stock.map((c) => ({ ...c })));
       }
-      // A tray that has moved is standing on a card it has just emptied, so nothing of its own is
-      // left beside it. Any cut it did leave behind is on the square it came FROM.
-      tray.standingWest = 0;
+      // `trayMoved`, which always precedes this for the same move, already zeroed the destination
+      // card's `standingWest` — coupling is mandatory, so a tray that has just moved is standing on
+      // a card it has just emptied, and nothing of its own is left beside it there.
       /**
        * Charge only the cars that were ALREADY standing where the crew ran — the own cut at the
        * front of `stock` is a drop being undone, so it is refunded on the square it was left on
@@ -1793,20 +1849,20 @@ export function reduce(s: GameState, e: GameEvent): void {
        *
        * Successive cuts off the same end stack up TOWARDS the engine — the first car set out is left
        * furthest away, and each one after it is left in the gap between the train and the last —
-       * so the insertion point is the train's own position in the row, `standingWest`, from either
-       * side. That is what makes the result batch-invariant: four cars at once, four singles, or two
-       * pairs all park in the same order, which is the reported bug and the regression test.
+       * so the insertion point is the card's own `standingWest`, read against this train's side. That
+       * is what makes the result batch-invariant: four cars at once, four singles, or two pairs all
+       * park in the same order, which is the reported bug and the regression test.
        */
       if (card) {
         const cars = carsOn(card);
         const facing = railFacingOf(tray);
         const onWestSide = e.fromNose ? facing === 'w' : facing === 'e';
-        const k = Math.max(0, Math.min(cars.length, tray.standingWest ?? 0));
+        const k = Math.max(0, Math.min(cars.length, card.standingWest));
         const cut = trackOrder(e.stock, facing);
         cars.splice(k, 0, ...cut);
-        // The train has not moved, so cars set out on its WEST side push its index along the row;
+        // The train has not moved, so cars set out on its WEST side push the split along the row;
         // cars set out to the east leave it where it was.
-        tray.standingWest = onWestSide ? k + cut.length : k;
+        card.standingWest = onWestSide ? k + cut.length : k;
       }
       spendFreightBudget(s, playerAtSeat(s, trayySeat(tray)), tray, e.at, e.stock);
       break;
@@ -1863,9 +1919,10 @@ export function reduce(s: GameState, e: GameEvent): void {
           geometry: { kind: 'modifier', modifier: card.kind.modifier },
           baseOperationalRail: false,
           standing: [],
+          standingWest: 0,
           facility: null,
           modifiers: [],
-    enhancements: [],
+          enhancements: [],
         });
         applyModifier(area, e.placement, card.kind.modifier);
       } else if (card.kind.kind !== 'office') {
@@ -2154,7 +2211,17 @@ export function reduce(s: GameState, e: GameEvent): void {
 
     case 'unloadBegan': {
       const f = facilityAt(s, e.player, e.at)!;
-      const ci = f.industryTrack.cars.findIndex((c) => c.loaded);
+      /**
+       * THE CAR THE PLAYER PICKED, not merely "a loaded one".
+       *
+       * REPORTED: with several loaded cars spotted on one industry track, unloading always took the
+       * WESTMOST car regardless of which one was chosen. This used to re-derive the target with
+       * `industryTrack.cars.findIndex(c => c.loaded)`, which returns the same answer — the first
+       * loaded car in track order — no matter which `carIndex` the intent actually named; `check`
+       * had already validated that specific car, and the choice was thrown away between there and
+       * here. `e.carIndex` is exactly what `laborer.beginUnload`'s reducer read off the intent.
+       */
+      const ci = e.carIndex;
       if (ci >= 0) {
         /**
          * §9.3 — the replacement empty comes out of the Division Yard. Conjuring it here is what
@@ -2206,7 +2273,7 @@ function protoCard(
   kind: { kind: string; geometry?: string; facility?: string; hand?: string },
   variant: number | undefined,
 ): TrackCard | null {
-  const base = { standing: [], facility: null, modifiers: [], enhancements: [] };
+  const base = { standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [] };
 
   if (kind.kind === 'track') {
     const geometry = kind.geometry as TrackGeometry;
@@ -2414,6 +2481,7 @@ function emptyCard(): TrackCard {
     geometry: { kind: 'limits' },
     baseOperationalRail: false,
     standing: [],
+    standingWest: 0,
     facility: null,
     modifiers: [],
     enhancements: [],
@@ -2686,6 +2754,7 @@ function limitsCard(): TrackCard {
     geometry: { kind: 'limits' },
     baseOperationalRail: true,
     standing: [],
+    standingWest: 0,
     facility: null,
     modifiers: [],
     enhancements: [],

src/engine/content.ts

@@ -876,7 +876,13 @@ export function mainlineCardCount(players: number): number {
   return players + 1;
 }
 
-/** Provisional; not in the recovered files. */
+/**
+ * Sourced, not provisional: `rules-v0.2.md`:339, "There are only a limited number of Crew Trays
+ * and engine pieces [Gap 4b: player count + 3]." The rules tie Crew Trays and engine pieces
+ * together as ONE combined resource, not two independently-tracked supplies — an engine is never
+ * conjured separately from the tray it rides in, and the game has no state for "an engine with no
+ * tray" or "a tray with no engine". `state.ts`'s `freeTrays` pool already IS the engine supply.
+ */
 export function crewTrayCount(players: number): number {
   return players + 3;
 }
@@ -1003,20 +1009,39 @@ export const MOVES_PER_LOCAL_OPS = 6;
 export const MOVES_PER_LOCAL_OPS_NIGHT = 5;
 export const LABORER_ACTIONS_PER_LOAD = 4;
 export const COLLISION_PENALTY = 5;
-export const COLLISION_FLOOR_PER_DAY = 3;
+/** Suggested defaults for `GameConfig`'s collision floors — see `state.ts`'s `GameConfig` doc. */
+export const DEFAULT_MAX_COLLISIONS_PER_DAY = 3;
+export const DEFAULT_MAX_COLLISIONS_TOTAL = 5;
+/** Suggested default for `GameConfig.days`, all modes. */
+export const DEFAULT_DAYS = 5;
+/**
+ * Q3 — an expedited train left parked off the Office when a Mainline Phase begins is a Station
+ * Master fault: the train was not kept ready to highball the moment the Subdivision allowed it.
+ * Charged every Phase it is caught there, not just once, since the fault is being left that way.
+ */
+export const EXPEDITE_FAULT_PENALTY = 1;
 
+/**
+ * The suggested default for `GameConfig.minCombinedRevenue` — a caller computes this before
+ * submitting a config; the engine itself never calls it (`state.ts`'s `GameConfig` doc explains why).
+ */
 export function collectiveRevenueFloor(players: number, days: number): number {
   return 3 * players * days;
 }
 
+/**
+ * `GameLength` IS NOT PART OF `GameConfig` ANY MORE (2026-08-20) — `days` is a free variable there
+ * now, replacing the old `target`-bearing preset. This survives only as a convenience for sim/CLI
+ * tooling (`harness.ts`, `compare.ts`, `replay.ts`) that still wants a `short`/`standard`/`campaign`
+ * argument instead of a raw day count; `lengthProfile()` just resolves that argument to `days`.
+ */
 export type GameLength = 'short' | 'standard' | 'campaign';
-export type LengthProfile = { length: GameLength; target: number; days: number };
+export type LengthProfile = { length: GameLength; days: number };
 
-/** Provisional and now unvalidated — the balance run they came from used a placeholder ruleset. */
 export const LENGTH_PROFILES: readonly LengthProfile[] = [
-  { length: 'short', target: 10, days: 3 },
-  { length: 'standard', target: 20, days: 5 },
-  { length: 'campaign', target: 45, days: 10 },
+  { length: 'short', days: 3 },
+  { length: 'standard', days: 5 },
+  { length: 'campaign', days: 10 },
 ];
 
 export function lengthProfile(length: GameLength): LengthProfile {

src/engine/events.ts

@@ -30,7 +30,12 @@ export type GameEvent =
   | { type: 'actorChanged'; player: PlayerIndex | null }
   // -- local operations
   | { type: 'localOpsOptionChosen'; player: PlayerIndex; option: LocalOpsOption }
-  | { type: 'trayMoved'; trayId: TrayId; from: GridCoord; to: GridCoord; movesRemaining: number; facing?: 'n' | 's' | 'e' | 'w' }
+  /**
+   * `via` mirrors the intent's `via` (docs/plans/switching-paths.md) — present only when there was
+   * more than one legal route to `to`, so the history can say which one ran rather than leaving a
+   * choice the player made invisible in their own log.
+   */
+  | { type: 'trayMoved'; trayId: TrayId; from: GridCoord; to: GridCoord; movesRemaining: number; facing?: 'n' | 's' | 'e' | 'w'; via?: GridCoord }
   | {
       type: 'carsCoupled';
       trayId: TrayId;
@@ -119,6 +124,13 @@ export type GameEvent =
   | { type: 'trainHeld'; trainNumber: number; reason: string }
   /** A train whose card pays for standing still (X18 Circus) collected on it. */
   | { type: 'trainStoodStill'; trainNumber: number; where: string }
+  /**
+   * Q3 — A STATION MASTER FAULT. An expedited train is not to be held anywhere but the station: if
+   * it is still off the Office square — parked on Secondary Track, say, to clear a switching move —
+   * when a Mainline Phase begins, that is a failure to keep it ready to highball, and it costs
+   * Revenue. `where` names the square it was found on. Always followed by a `revenueChanged`.
+   */
+  | { type: 'expediteFault'; player: PlayerIndex; trainNumber: number; where: string }
   /**
    * `why` is the RULE that let it go now, not a restatement of the move.
    *
@@ -129,9 +141,9 @@ export type GameEvent =
    */
   | { type: 'trainHighballed'; trainNumber: number; from: string; to: string; why: string }
   /**
-   * `expedited` because it changes what the player must do RIGHT NOW. Q3 — an expedited train
-   * departs the same Stage it arrives, so there is no Local Operations turn in which to work it;
-   * every other train stands until the next Mainline Phase and can be switched in between.
+   * `expedited` flags a train that must not be left standing off the station (Q3) — it may be
+   * switched normally like any other arrival, but it has to be back on the Office square before the
+   * next Mainline Phase begins, or `expediteFault` fires.
    */
   | { type: 'trainArrived'; trainNumber: number; consist: RollingStock[]; office: string; expedited: boolean }
   | { type: 'trainDiverted'; trainNumber: number; to: string; reason: string }
@@ -155,7 +167,11 @@ export type GameEvent =
   | { type: 'loadAdvanced'; player: PlayerIndex; at: GridCoord; fromBox: number; toBox: number }
   | { type: 'unloadCompleted'; player: PlayerIndex; at: GridCoord; carType: CarType }
   | { type: 'loadCompleted'; player: PlayerIndex; at: GridCoord; carType: CarType }
-  | { type: 'unloadBegan'; player: PlayerIndex; at: GridCoord; carType: CarType }
+  /**
+   * `carIndex` carries the SPECIFIC car the player picked off the industry track — see the comment
+   * on `laborer.beginUnload` in `apply.ts` for why the reducer must not re-derive it.
+   */
+  | { type: 'unloadBegan'; player: PlayerIndex; at: GridCoord; carType: CarType; carIndex: number }
   // -- consequences
   | { type: 'revenueChanged'; player: PlayerIndex; delta: number; total: number; reason: string }
   | { type: 'phaseEnded'; player: PlayerIndex; phase: string };

src/engine/intents.ts

@@ -16,7 +16,14 @@ export type LocalOpsOption = 'switch' | 'draw' | 'freightAgent';
 export type Intent =
   | { type: 'localOps.choose'; option: LocalOpsOption }
   // -- switch (§6.1, Appendix A)
-  | { type: 'switch.move'; trayId: TrayId; to: GridCoord; reverse: boolean }
+  /**
+   * `via` names one INTERMEDIATE card on the chosen route, for the rare case where two routes to
+   * `to` couple different cars (see docs/plans/switching-paths.md) — never the start, never `to`
+   * itself. Absent, it resolves exactly as it always has: the first route `legal.ts` enumerated to
+   * `to`. An index into the destination list would do the same job worse — intents are the
+   * canonical record `undo` replays against, and enumeration order is not a stable thing to save.
+   */
+  | { type: 'switch.move'; trayId: TrayId; to: GridCoord; reverse: boolean; via?: GridCoord }
   /**
    * Set out a cut. `fromNose` takes it off the FRONT of the train rather than the back — Appendix A's
    * worked example does exactly this: "Back up and drop off everything on the nose of your train
@@ -143,6 +150,11 @@ export type RejectionCode =
   | 'ON_RUNNING_TRACK'
   /** A card with no east-west road would dead-end the Running Track it was laid in. */
   | 'BREAKS_RUNNING_TRACK'
+  /**
+   * §2.1 — track, and the Facilities that carry it, stay inside your own Limits at every row. A
+   * Modifier is not track and is exempt (§9's nine spots), which is why this is not shared with it.
+   */
+  | 'OUTSIDE_LIMITS'
   /**
    * A turnout may be laid on top of a straight, or of a curve on the same arc as its diverging leg
    * — but only those, and only while the square is idle. See `checkTurnoutUpgrade`.

src/engine/legal.ts

@@ -17,9 +17,38 @@ import { enhancementRule } from './content.ts';
 import { check, areaOf, destinationsFor } from './apply.ts';
 import type { Intent } from './intents.ts';
 import type { GameState, GridCoord, PlayerIndex } from './state.ts';
-import { seatOf } from './state.ts';
+import { coordKey, seatOf } from './state.ts';
+import type { MoveDestination } from './track.ts';
 import { variantsFor } from './track.ts';
 
+/**
+ * A square GridCoord this route passes through that no OTHER route to the same destination does —
+ * the discriminator `switch.move.via` needs so `selectDestination` (apply.ts) never has to guess
+ * which of two routes an intent meant. `siblings` is every route the same `destinationsFor` call
+ * returned at this same square; `route` must be one of them.
+ *
+ * Absent when `route` is the only route there (the overwhelmingly common case — `via` need not be
+ * carried at all), or when the destination is one hop away, which is never ambiguous: the square
+ * immediately before a given entry port is fixed by geometry, so a zero-length path cannot have a
+ * sibling.
+ */
+function distinguishingVia(route: MoveDestination, siblings: readonly MoveDestination[]): GridCoord | undefined {
+  if (route.path.length === 0) return undefined;
+  const otherSquares = new Set<string>();
+  for (const sibling of siblings) {
+    if (sibling === route) continue;
+    for (const step of sibling.path) otherSquares.add(coordKey(step.coord));
+  }
+  for (const step of route.path) {
+    if (!otherSquares.has(coordKey(step.coord))) return step.coord;
+  }
+  // Every square on this route is shared with some sibling — geometrically possible only if the
+  // routes fork and rejoin more than once, which `track.ts`'s doc comment says not to rely on not
+  // happening. Naming the last square before the destination at least matches today's behaviour:
+  // wrong in the same way a route with no `via` at all would be.
+  return route.path[route.path.length - 1]!.coord;
+}
+
 const CAR_TYPES: readonly CarType[] = ['coach', 'boxcar', 'reefer', 'hopper', 'tank', 'caboose'];
 
 /** Every intent `player` may legally submit right now. */
@@ -86,8 +115,20 @@ function localOpsCandidates(s: GameState, player: PlayerIndex): Intent[] {
     if (tray.position.at !== 'grid' || tray.position.seat !== seatOf(s, player)) continue;
     const from = tray.position.coord;
     for (const reverse of [false, true]) {
-      for (const d of destinationsFor(s, player, trayId, from, reverse)) {
-        out.push({ type: 'switch.move', trayId, to: d.coord, reverse });
+      const dests = destinationsFor(s, player, trayId, from, reverse);
+      // Grouped by destination square so `distinguishingVia` only ever compares routes that are
+      // actually racing for the same button — two routes to DIFFERENT squares need no `via` to
+      // tell apart, `to` already does that.
+      const byCoord = new Map<string, MoveDestination[]>();
+      for (const d of dests) {
+        const k = coordKey(d.coord);
+        (byCoord.get(k) ?? byCoord.set(k, []).get(k)!).push(d);
+      }
+      for (const group of byCoord.values()) {
+        for (const d of group) {
+          const via = group.length > 1 ? distinguishingVia(d, group) : undefined;
+          out.push({ type: 'switch.move', trayId, to: d.coord, reverse, ...(via ? { via } : {}) });
+        }
       }
     }
     for (let n = 1; n <= tray.consist.length; n++) {
@@ -313,5 +354,35 @@ function placementCandidates(s: GameState, player: PlayerIndex): GridCoord[] {
       out.push(c);
     }
   }
+
+  /**
+   * THE NINE-SPOT MODIFIER NEIGHBOURHOOD (§9), which the four-square walk above cannot reach.
+   *
+   * A Modifier goes "adjacent to a Facility, on any of the nine nearby spots" — diagonals included —
+   * and `check` has always accepted all eight. It was the CANDIDATES that were orthogonal-only, so a
+   * diagonal square with no orthogonal neighbour was legal and never offered: reported by Jesse as
+   * being unable to place a Modifier to the south-east of his industry.
+   *
+   * Only around a Facility, and only in a second pass. Track has to JOIN, and a diagonal shares no
+   * edge, so a Modifier is the only card these squares can ever take — generating diagonals around
+   * every card instead costs 54% more simulation time for candidates `check` then rejects. Appending
+   * rather than interleaving leaves the existing order untouched, which matters because the bot
+   * breaks ties by first-best: measured over 200 seeded games, 0 played differently.
+   */
+  for (const [key, card] of area.grid) {
+    if (!card.facility) continue;
+    const [row, col] = key.split(',').map(Number);
+    for (const c of [
+      { row: row! + 1, col: col! + 1 },
+      { row: row! + 1, col: col! - 1 },
+      { row: row! - 1, col: col! + 1 },
+      { row: row! - 1, col: col! - 1 },
+    ]) {
+      const k = `${c.row},${c.col}`;
+      if (seen.has(k) || area.grid.has(k)) continue;
+      seen.add(k);
+      out.push(c);
+    }
+  }
   return out;
 }

src/engine/setup.ts

@@ -53,13 +53,16 @@ export type SetupOptions = {
 };
 
 /** Builds the 52-card Home Office deck (§12.1). Unshuffled; caller shuffles with the seeded RNG. */
-export function buildDeck(mode: GameConfig['mode'] = 'competitive'): Card[] {
+export function buildDeck(mode: GameConfig['mode'] = 'competitive', pvpCardsAllowed = false): Card[] {
   /**
-   * THE 22 OPPONENT-DIRECTED CARDS ARE OUT OF EVERY DECK FOR NOW, not just the solitaire one.
+   * THE 22 OPPONENT-DIRECTED CARDS ARE OUT OF EVERY DECK REGARDLESS OF `pvpCardsAllowed`, for now.
    *
    * Q6 took them out of solitaire because they have no legal target in a one-player game. They are
    * out of the competitive deck too because `checkPlay` answers both categories `NOT_IMPLEMENTED`:
    * leaving them in would make ~9% of draws reject outright, which is worse than not dealing them.
+   * `pvpCardsAllowed` (`GameConfig`, wired 2026-08-20) is the player-facing toggle, but ANDing it
+   * with `cardsImplemented` keeps it inert until Phase 5 actually builds the cards — flipping
+   * `pvpCardsAllowed` on today must not turn a working game into one where ~9% of draws reject.
    *
    * AND SO ARE THE SEVEN CARDS THAT ANSWER THEM — see below. They used to be dealt and sit dormant,
    * which is the same dead draw by another name. Recorded in TODO.md as multiplayer work.
@@ -68,7 +71,8 @@ export function buildDeck(mode: GameConfig['mode'] = 'competitive'): Card[] {
    * for these two categories today.
    */
   void mode;
-  const opponentCardsInDeck = false;
+  const cardsImplemented = false;
+  const opponentCardsInDeck = pvpCardsAllowed && cardsImplemented;
   const cards: Card[] = [];
   let n = 0;
   const push = (kind: Card['kind']): void => {
@@ -153,6 +157,7 @@ function buildOfficeArea(seat: SeatIndex): OfficeArea {
     geometry: { kind: 'office' },
     baseOperationalRail: true,
     standing: [],
+    standingWest: 0,
     facility: buildPassengerFacility('whistlePost'),
     modifiers: [],
     enhancements: [],
@@ -162,6 +167,7 @@ function buildOfficeArea(seat: SeatIndex): OfficeArea {
     geometry: { kind: 'limits' },
     baseOperationalRail: true,
     standing: [],
+    standingWest: 0,
     facility: null,
     modifiers: [],
     enhancements: [],
@@ -224,17 +230,15 @@ function buildDivision(players: number, rng: Rng): DivisionNode[] {
   const mainline = (): DivisionNode => {
     const card = kinds[rng.nextInt(kinds.length)]!;
     const node: DivisionNode = { kind: 'mainline', card, transits: [] };
-    // The Heavy Grade card says "Player sets orientation", but setup has no decision point yet —
-    // createGame is synchronous and returns a ready state. Rolled for now so the orientation is at
-    // least deterministic and varies between games; it should become a real player choice when
-    // setup gains an interactive phase. See implications.md §10 Q11.
     if (mainlineProfile(card).speed.kind === 'grade') {
       /**
-       * TEMPORARY, and flagged in TODO. The card prints "(Up)" and "Player sets orientation", so
-       * which way a Heavy Grade climbs is the player's decision — but it is dealt during setup, and
-       * setup has no decision point at all. Rolled from the seed until it gains one, because the
-       * orientation MATTERS: it decides which direction climbs, and therefore what a Brakeman or
-       * Helpers card is worth.
+       * SETTLED, not provisional (v0.5.0, Jesse's call) — this overrides the card's own printed
+       * "Player sets orientation". A Heavy Grade sits on the shared west-to-east chain BETWEEN two
+       * players (§4.2), or beyond an end Division Point next to one — never inside one player's own
+       * district — so whichever direction climbs advantages one neighbour over the other, and there
+       * is no single player who owns that call fairly. Orientation is rolled from the seed instead,
+       * identically for solitaire and multiplayer, and this is not expected to change when setup
+       * eventually gains an interactive phase for other decisions. See implications.md §10 Q11.
        */
       node.gradeUp = rng.nextInt(2) === 0 ? 'east' : 'west';
     }
@@ -315,7 +319,7 @@ export function createGame(opts: SetupOptions): GameState {
    */
   const rules = houseRules(config);
   const deal = OPENING_DEALS[rules.startingHand];
-  const deck = buildDeck(config.mode);
+  const deck = buildDeck(config.mode, config.pvpCardsAllowed);
   const cards = new Map<CardId, Card>();
   for (const c of deck) cards.set(c.id, c);
 
@@ -407,6 +411,7 @@ export function createGame(opts: SetupOptions): GameState {
     turns: freshTurns(playerCount, MOVES_PER_LOCAL_OPS),
     movedThisPhase: new Set(),
     collisionsToday: 0,
+    collisionsTotal: 0,
     status: 'active',
     outcome: null,
   };

src/engine/state.ts

@@ -12,7 +12,6 @@ import type {
   Hand,
   MainlineKind,
   FreightKind,
-  GameLength,
   HouseRuleOverrides,
   ModifierKind,
   OfficeTier,
@@ -137,9 +136,35 @@ export type TrackCard = {
    * WEST-TO-EAST IS THE BOARD'S ORIENTATION, not the train's, which is exactly why it is the right
    * one: it is a property of the card, so it does not change when a different train touches it. The
    * two conversions are stated once, in `apply.ts`'s `carsDropped` and `carsCoupled` reducers, and
-   * `CrewTray.standingWest` records where a train standing here sits among them.
+   * `standingWest` below records where a train standing here sits among them.
    */
   standing: RollingStock[];
+  /**
+   * HOW MANY OF `standing` LIE WEST OF THE TRAIN(S) STANDING HERE.
+   *
+   * `standing` runs west to east and a train sits somewhere IN that row: cars `[0, standingWest)`
+   * are west of it, cars `[standingWest, end)` are east. A train can set out off both ends on the
+   * same square — §A.3 lets a cut come off either outer end — so "which side is this cut on" is not
+   * recoverable from the array alone, and it is the question every remaining rule asks: which cars
+   * are AHEAD of an engine and which BEHIND (combine with `CrewTray.railFacing`), which cut a
+   * departing train must couple back up (the one at the end it leaves by), and which side of the
+   * chip the renderer draws the cut on.
+   *
+   * WITH NO TRAIN STANDING HERE, THIS NUMBER MEANS NOTHING: a card's cars are simply a cut with no
+   * near or far side, and the next train to arrive couples all of them regardless — nothing reads
+   * `standingWest` in that state, so a stale value left over from a train that has since moved on is
+   * inert, not wrong. That reasoning is unchanged from when this lived on `CrewTray`.
+   *
+   * WHAT MOVED IT TO THE CARD: the Office square is the one place more than one train may stand at
+   * once, and only one route lets two trays disagree about the same row of cars — a train already
+   * at the Office sets out a cut in place, without moving, while a second train on another A/D track
+   * still holds whatever split it arrived with. A cut lies west or east of the WHOLE block of A/D
+   * tracks, never of one particular track and never between two trains, so there is exactly one
+   * number for the card to carry and every train standing there reads the same one. Everywhere else
+   * on the board at most one train ever stands on a card, so the two homes for this field are
+   * identical in every other case.
+   */
+  standingWest: number;
   facility: Facility | null;
   modifiers: ModifierKind[];
   /** Enhancement cards laid on this card (§7 of implications.md). */
@@ -300,6 +325,12 @@ export type CrewTray = {
    *
    * The engine is NOT one of the `consist` entries: §8.2 counts the consist as Rolling Stock, and
    * the four-car limit (§A.4) is a limit on cars, not on the locomotive hauling them.
+   *
+   * This only records POSITION, not a supply — and that is not a gap. `rules-v0.2.md`:339 (Gap 4b)
+   * ties Crew Trays and engine pieces together as one combined resource, `player count + 3`
+   * (`crewTrayCount` in `content.ts`), so engine scarcity IS tray scarcity: `freeTrays` running out
+   * already blocks a new train exactly when the engine supply would. There is no state for "a tray
+   * with no engine" because the rules never separate the two.
    */
   engineAt: number;
   /**
@@ -345,25 +376,6 @@ export type CrewTray = {
    * puts the engine on the other end, which is the one thing the arrow exists to show.
    */
   railFacing?: 'e' | 'w';
-  /**
-   * HOW MANY OF THIS CARD'S STANDING CARS LIE WEST OF THIS TRAIN.
-   *
-   * `carsOn(card)` runs west to east and a train standing on the card sits somewhere IN that row:
-   * cars `[0, standingWest)` are west of the engine, cars `[standingWest, end)` are east of it. A
-   * train can set out off both ends on the same square — §A.3 lets a cut come off either outer end —
-   * so "which side is this cut on" is not recoverable from the array alone, and it is the question
-   * every remaining rule asks.
-   *
-   * It answers all three: which cars are AHEAD of the engine and which BEHIND (combine with
-   * `railFacing`), which cut a departing train must couple back up (the one at the end it leaves
-   * by), and which side of the chip the renderer draws the cut on.
-   *
-   * Kept on the TRAY rather than the card because it describes a relationship, not the card: with no
-   * train standing there, a card's cars are simply a cut with no near or far side, and the next
-   * train to arrive couples all of them regardless. Reset to 0 on every move, which is sound because
-   * coupling is mandatory — a train arrives on a card it has just emptied.
-   */
-  standingWest?: number;
   position: NodeRef;
   movesUsed: number;
   /**
@@ -377,17 +389,12 @@ export type CrewTray = {
    * X17 Campaign Train — "one turn at station (speeches) then expedite".
    *
    * It makes its speech at the first Office it reaches: that arrival is an ordinary stop, and from
-   * then on the train runs expedited, departing every Office in the Stage it arrives. Recorded on the
-   * tray for the same reason as `stopPointClaimed` — it is the TRAIN that stops, and an Extra runs
-   * once, so there is no later visit to hang it on.
+   * then on the train is expedited — it may be switched normally, but it faults (Q3) if it is left
+   * off the Office square when a Mainline Phase begins. Recorded on the tray for the same reason as
+   * `stopPointClaimed` — it is the TRAIN that stops, and an Extra runs once, so there is no later
+   * visit to hang it on.
    */
   speechMade?: boolean;
-  /**
-   * Arrived expedited this Stage, so it departs at the END of the Stage rather than laying over to
-   * the next one (Q3). Set on arrival; cleared when `shiftChange` attempts the departure — after
-   * Load/Unload, which is what gives the Porters their one Stage with the train.
-   */
-  departsThisStage?: boolean;
 };
 
 // ---------------------------------------------------------------------------
@@ -538,12 +545,42 @@ export type Player = {
 };
 
 export type GameMode = 'solitaire' | 'competitive' | 'coop';
-export type VictoryCondition = 'firstToTarget' | 'highestAfterDays';
 
+/**
+ * VICTORY CONDITIONS — designed 2026-08-20, unified across all three modes.
+ *
+ * Replaces the old `length`-preset lookup (`LENGTH_PROFILES.target`) and the dead
+ * `VictoryCondition: 'firstToTarget'` (grepped: never selected anywhere in the codebase). Winner is
+ * whoever has the most Revenue when `days` run out — solitaire's own player counts as "everyone" —
+ * unless `minCombinedRevenue` was missed, in which case everyone loses. Coop keeps summing every
+ * player's Revenue into one table score, now against a configurable floor instead of
+ * `profile.target * players.length`.
+ *
+ * `0` means "off" for every numeric field below. `minCombinedRevenue`'s natural default is
+ * `collectiveRevenueFloor(players, days)` (`content.ts`), computed by whoever authors the config —
+ * the engine only ever reads a concrete number here, never resolves one lazily, because player count
+ * is not always known at config-authoring time (a lobby, a CLI flag, a dialog).
+ *
+ * `maxCollisionsPerDay`/`maxCollisionsTotal` are deliberately FLAT, not scaled by player count: more
+ * players means more independent chances to collide, not a bigger shared budget, so a multiplayer
+ * table is genuinely riskier than solitaire at the same default (Jesse's call).
+ */
 export type GameConfig = {
   mode: GameMode;
-  victory: VictoryCondition;
-  length: GameLength;
+  /** How many Days the game runs. */
+  days: number;
+  /** Everyone loses if the table's total Revenue is below this when `days` run out. 0 = off. */
+  minCombinedRevenue: number;
+  /** Everyone loses immediately, mid-game, once collisions in one Day reach this. 0 = off. */
+  maxCollisionsPerDay: number;
+  /** Same, summed across the whole game, never reset. 0 = off. */
+  maxCollisionsTotal: number;
+  /**
+   * Whether the 22 opponent-directed cards are in the deck (`setup.ts`'s `buildDeck`). Forced off in
+   * `solitaire` and `coop` — neither has a valid target for them — on by default in `competitive`.
+   * Has no effect until those cards are built (Phase 5); see `TODO.md`.
+   */
+  pvpCardsAllowed: boolean;
   optionalRules: {
     reducedVisibility: boolean;
     sisterTrains: boolean;
@@ -560,11 +597,7 @@ export type GameConfig = {
   houseRules?: HouseRuleOverrides;
 };
 
-export type OutcomeReason =
-  | 'targetReached'
-  | 'daysElapsed'
-  | 'collisionFloor'
-  | 'revenueFloor';
+export type OutcomeReason = 'daysElapsed' | 'collisionFloor' | 'revenueFloor';
 
 export type Outcome = {
   result: 'win' | 'loss';
@@ -740,8 +773,10 @@ export type GameState = {
   turns: Map<PlayerIndex, TurnState>;
   /** Transient: trains already moved in the current Mainline Phase. Cleared when it ends. */
   movedThisPhase: Set<TrayId>;
-  /** §3.4 — resets at the start of each Day. */
+  /** §3.4 — resets at the start of each Day; checked against `config.maxCollisionsPerDay`. */
   collisionsToday: number;
+  /** §3.4 — never reset; checked against `config.maxCollisionsTotal`. */
+  collisionsTotal: number;
   status: 'setup' | 'active' | 'finished';
   outcome: Outcome | null;
 };

src/engine/track.ts

@@ -316,15 +316,6 @@ export type MoveContext = {
   consistSize: number;
   /** The tray making the move, so it does not block itself. */
   self: TrayId;
-  /**
-   * How many cars on the START card stand west of this train (`CrewTray.standingWest`).
-   *
-   * The walk begins at `neighbour(start, initialExit)` and never looked at the start card at all, so
-   * a train drove straight through the cut it had just set out — in both directions, and without
-   * counting it against the four-car limit. Coupling is mandatory (§A.4) and a cut on your own
-   * square is no exception: pulling out through the end it sits at picks it up again.
-   */
-  standingWest?: number;
 };
 
 function cardAt(area: OfficeArea, c: GridCoord): TrackCard | undefined {
@@ -383,6 +374,28 @@ export type MoveBlock = { coord: GridCoord; kind: MoveBlockKind; why: string };
  * beyond a reachable one whose rails do not meet. Squares the walk never came near are not listed:
  * "there is no track between here and there" is not news.
  */
+/**
+ * How many frontier nodes a single `exploreMoves` walk may enqueue before it stops finding new
+ * routes. A per-path visited set (below) guarantees every individual route terminates, but the
+ * NUMBER of simple paths through a dense district is worst-case exponential — a real board never
+ * gets close, but nothing stops a pathological one from being built. BFS order means the queue
+ * fills shortest-route-first, so hitting the cap loses only the longest, least-likely-to-matter
+ * routes; it never loses a shorter one in favour of a longer one.
+ */
+const MAX_ENUMERATED_FRONTIER = 4000;
+
+/**
+ * The identity of a route's OUTCOME, for dedupe: which square it ends at, which side it entered
+ * by, and exactly which cars it couples, each tagged with the card it came off. Two routes that
+ * couple the same car TYPES from DIFFERENT cards are not the same outcome — sweeping the wrong
+ * card clean is exactly the bug this key exists to avoid — so the origin card rides along with
+ * every car, not just its type.
+ */
+function routeOutcomeKey(coord: GridCoord, entry: Port, couples: RollingStock[], origins: string[]): string {
+  const cars = couples.map((c, idx) => `${origins[idx]}:${c.type}:${c.loaded ? 1 : 0}`).join(',');
+  return `${coordKey(coord)}|${entry}|${cars}`;
+}
+
 export function exploreMoves(
   ctx: MoveContext,
   start: GridCoord,
@@ -403,9 +416,20 @@ export function exploreMoves(
   if (!startCard) return { destinations: results, blocked };
   if (!hasPort(startCard, initialExit)) return { destinations: results, blocked };
 
-  const seen = new Set<string>();
+  const resultKeys = new Set<string>();
 
-  type Frontier = { coord: GridCoord; entry: Port; path: MoveStep[]; couples: RollingStock[] };
+  type Frontier = {
+    coord: GridCoord;
+    entry: Port;
+    path: MoveStep[];
+    couples: RollingStock[];
+    /** Coord key each entry in `couples` came off, aligned by index — see `routeOutcomeKey`. */
+    origins: string[];
+    /** Cards visited on THIS route, start included. A per-path set, not a global one — see the
+     * module doc comment on `MAX_ENUMERATED_FRONTIER` for why a global one would forbid the very
+     * routes this walk exists to find. */
+    visited: Set<string>;
+  };
 
   // The very first hop is checked here because `start`'s card is not itself enqueued; every later
   // hop is checked at the push site below, where both sides of the edge are in hand.
@@ -426,10 +450,19 @@ export function exploreMoves(
    *
    * Ordered nearest-first like every other card's, so it simply seeds the accumulator.
    */
-  const ownCut = cutTowards({ standingWest: ctx.standingWest }, carsOn(startCard), initialExit);
+  const ownCut = cutTowards(startCard, carsOn(startCard), initialExit);
+  const startKey = coordKey(start);
   const queue: Frontier[] = [
-    { coord: first, entry: opposite(initialExit), path: [], couples: ownCut },
+    {
+      coord: first,
+      entry: opposite(initialExit),
+      path: [],
+      couples: ownCut,
+      origins: ownCut.map(() => startKey),
+      visited: new Set([startKey]),
+    },
   ];
+  let enumerated = 1;
 
   while (queue.length > 0) {
     const node = queue.shift()!;
@@ -476,6 +509,8 @@ export function exploreMoves(
      */
     const met = node.entry === 'e' ? [...carsOn(card)].reverse() : carsOn(card);
     const couples = [...node.couples, ...met];
+    const nodeKey = coordKey(node.coord);
+    const origins = [...node.origins, ...met.map(() => nodeKey)];
     if (ctx.consistSize + couples.length > MAX_CONSIST) {
       const own =
         ownCut.length > 0
@@ -489,18 +524,24 @@ export function exploreMoves(
       continue;
     }
 
-    const key = `${coordKey(node.coord)}|${node.entry}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-
     if (isOperationalRail(card) && !sameCoord(node.coord, start)) {
-      results.push({ coord: node.coord, entry: node.entry, path: node.path, couples });
+      // Dedupe on OUTCOME, not on reaching the square: two routes that end here having coupled
+      // different cars (or the same cars off different cards) are a real choice, and both are
+      // offered. Two routes that end here having coupled identically are not a choice — one is
+      // noise doubling the button list and the bot's branching factor for nothing.
+      const rkey = routeOutcomeKey(node.coord, node.entry, couples, origins);
+      if (!resultKeys.has(rkey)) {
+        resultKeys.add(rkey);
+        results.push({ coord: node.coord, entry: node.entry, path: node.path, couples });
+      }
     } else if (!sameCoord(node.coord, start)) {
       // Reached, crossable, but not somewhere a train may STOP — a turnout carries no wheel icon
       // (§A.1). Trains run through one all day; they just cannot finish a Move on it.
       block(node.coord, 'noStopping', 'a train may run through here but not stop — this is not Operational Rail (§A.1), so it cannot be the end of a Move');
     }
 
+    if (enumerated >= MAX_ENUMERATED_FRONTIER) continue;
+
     for (const exit of exitsFrom(card, node.entry)) {
       // Slope is a property of the EDGE, not of either card, so it can only be tested with both in
       // hand. Enqueueing on `hasPort` alone routed trains across a 45° leg that bent back on itself.
@@ -510,8 +551,18 @@ export function exploreMoves(
         if (next) block(to, 'noJoin', 'the rails do not meet — two cards touching is not a join, and on a north or south edge both 45° legs must lie on the same diagonal');
         continue;
       }
+      // A card twice on ONE route is a loop, not a longer route (§2.4 travels without changing
+      // direction; it never says without repeating ground, but a train cannot occupy the same
+      // track twice at once either). Per-path, not global — a DIFFERENT route may legitimately
+      // pass through a card this one already used.
+      const toKey = coordKey(to);
+      if (node.visited.has(toKey)) continue;
+      if (enumerated >= MAX_ENUMERATED_FRONTIER) break;
+      enumerated++;
       const step: MoveStep = { coord: node.coord, entry: node.entry, exit };
-      queue.push({ coord: to, entry: opposite(exit), path: [...node.path, step], couples });
+      const visited = new Set(node.visited);
+      visited.add(toKey);
+      queue.push({ coord: to, entry: opposite(exit), path: [...node.path, step], couples, origins, visited });
     }
   }
 
@@ -559,6 +610,31 @@ export function carriesThroughTrack(card: TrackCard): boolean {
  * a TURNOUT laid on the Running Track — the Office no longer carries a stub of its own, because no
  * office or industry card on the printed sheet does.
  */
+/**
+ * §2.1 — IS THIS SQUARE INSIDE THE DISTRICT AT ALL?
+ *
+ * The Limits sign denotes "the limit of your control area", and §3 defines Secondary Track as "all
+ * tracks IN YOUR LIMITS that are not the Running Track" — so the bound belongs to the district, not
+ * to the one row the sign happens to stand in. This used to guard the Running Track alone, on the
+ * reasoning that the rows above and below were unbounded; the consequence was a siding snaking east
+ * past your own sign, taking industries with it, and a player switching cars on track outside the
+ * territory §8.1 and §10 reason about. Reported by Jesse: sidings must not be built outside the
+ * Limits.
+ *
+ * INCLUSIVE OF THE SIGN'S OWN COLUMN. The sign stands ON the boundary rather than beyond it, and the
+ * opening district is signs at ±1 around the Office — so the strict reading would leave exactly one
+ * buildable column and break §11.3's promise that both Secondary rows, and the nine-spot Modifier
+ * neighbourhood, are usable from the first Stage.
+ *
+ * MODIFIERS ARE NOT SUBJECT TO THIS, and are not track: §9 places one on any of the nine spots
+ * around a Facility, and a Facility standing at the limit has three of its nine outside them.
+ * Jesse's call. `check` bars them from the Running Track ROW instead, which is the ground the main
+ * grows onto.
+ */
+export function withinLimits(area: OfficeArea, coord: GridCoord): boolean {
+  return coord.col >= area.limitsWest.col && coord.col <= area.limitsEast.col;
+}
+
 export function canPlaceAt(area: OfficeArea, coord: GridCoord, card: TrackCard): boolean {
   const existing = cardAt(area, coord);
   // A Limits sign on the Running Track is the GROWTH POINT, not an obstacle. Extending means laying
@@ -575,14 +651,12 @@ export function canPlaceAt(area: OfficeArea, coord: GridCoord, card: TrackCard):
   // the sign itself is the only growth point. Allowing a placement beyond it built track on the far
   // side of the sign and then planted a SECOND sign further out, leaving the board reading
   //   limits · Whistle Post · limits · straight · limits
-  // with a Limits card stranded mid-track. The district below the Running Track is unbounded.
-  if (coord.row === area.runningRow) {
-    if (coord.col < area.limitsWest.col || coord.col > area.limitsEast.col) return false;
-    // And it must not BREAK the Running Track. A curve laid here has no east-west road, so the main
-    // stops dead at it — the bot did exactly this, turning the west end of its own Running Track
-    // into a stub and cutting the Office off from the Limits.
-    if (!carriesThroughTrack(card)) return false;
-  }
+  // with a Limits card stranded mid-track.
+  if (!withinLimits(area, coord)) return false;
+  // And it must not BREAK the Running Track. A curve laid here has no east-west road, so the main
+  // stops dead at it — the bot did exactly this, turning the west end of its own Running Track
+  // into a stub and cutting the Office off from the Limits.
+  if (coord.row === area.runningRow && !carriesThroughTrack(card)) return false;
 
   const ports: Port[] = ['n', 's', 'e', 'w'];
   for (const p of ports) {
@@ -593,12 +667,19 @@ export function canPlaceAt(area: OfficeArea, coord: GridCoord, card: TrackCard):
 }
 
 /**
- * §A.4 — the Office track is Operational Rail, but Rolling Stock may not be left there.
+ * §A.4 — the Office track is Operational Rail, but Rolling Stock may not be left there — WITH ONE
+ * EXCEPTION (Jesse's call, v0.5.0): any train may set out one or more coaches at the Office. It is
+ * the one car type a passenger platform is meant to hold, and it is what makes the ENGINE-boxcar-
+ * coach Local arrangement workable — the coach drops here while the engine and freight car switch
+ * freely. Freight and cabooses stay banned at the Office for every train, no exception.
+ *
  * An industry track also has a finite length (§9.3), so it can be full.
  */
-export function canDropCarsAt(area: OfficeArea, coord: GridCoord, count = 1): boolean {
-  if (sameCoord(coord, area.officeCoord)) return false;
+export function canDropCarsAt(area: OfficeArea, coord: GridCoord, count = 1, coachesOnly = false): boolean {
   const card = cardAt(area, coord);
+  if (sameCoord(coord, area.officeCoord)) {
+    return coachesOnly && !!card && isOperationalRail(card) && spaceOn(card) >= count;
+  }
   if (!card || !isOperationalRail(card)) return false;
   return spaceOn(card) >= count;
 }

src/server/http.ts

@@ -0,0 +1,430 @@
+/**
+ * The HTTP/SSE wiring — Phase 2 of `docs/architecture/multiplayer.md` (§8-9, §12 steps 8 and 12),
+ * extended for Phase 4 (§12 steps 17-20) to a lobby and more than one game.
+ *
+ * Plain `node:http`, no framework: the project has zero runtime dependencies
+ * (`package.json`), and `scripts/build-web.ts` already shells out to `tsc` directly rather than
+ * reaching for a bundler — this matches that everywhere-else choice rather than introducing the
+ * first framework dependency for one route table.
+ *
+ * All the game logic lives in `session.ts` and `lobby.ts`; this file is deliberately thin — routing,
+ * the join-secret gate on the DOOR (create/join), token resolution once a player is through it, SSE
+ * mechanics, and static file serving for the built client (`dist/`, D16: the server serves the
+ * client, which is what makes same-origin work with no CORS).
+ *
+ * TOKENS REPLACE `?seat=&secret=` ON THE RUNNING-GAME ROUTES. `lobby-and-sessions.md` §1: the token
+ * already proves "I am the player who was in this game," which is the only identity claim `/api/stream`
+ * and `/api/intent` need — the join secret's job ends at the lobby door.
+ */
+
+import { createServer } from 'node:http';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { createReadStream } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import { extname, join, normalize } from 'node:path';
+
+import type { Intent } from '../engine/intents.ts';
+import type { GameConfig, PlayerIndex } from '../engine/state.ts';
+import {
+  appendTiming,
+  deleteLobby,
+  gameDir,
+  upsertIndexEntry,
+  writeGame,
+  writeLobby,
+  writeSessions,
+} from './persistence.ts';
+import { createSession } from './session.ts';
+import type { GameSession, Push } from './session.ts';
+import {
+  createLobby,
+  freshGameCode,
+  joinLobby,
+  reassignHost,
+  setBotSeat,
+  startLobby,
+} from './lobby.ts';
+import type { Lobby, PlayerSession } from './lobby.ts';
+
+export type ServerOptions = {
+  port: number;
+  bindAddress: string;
+  /** D14 — a server-wide secret, passed out of band. Gates lobby creation and joining — the door;
+   * once a player is through it and holds a token, the token alone authenticates them. */
+  joinSecret: string;
+  /** The built client (`npm run build:web`'s `dist/`), served at `/` (D16). */
+  distDir: string;
+  /** Where every game's files live, one subdirectory per `gameId` (`persistence.ts`'s `gameDir`). */
+  dataDir: string;
+  /** `package.json`'s version — stamped onto every write, checked on every load (§12 step 15). */
+  engineVersion: string;
+  /** Reconstructed by `index.ts`'s load-on-start. Empty maps for a fresh server. */
+  initialGames: Map<string, GameSession>;
+  initialLobbies: Map<string, Lobby>;
+  initialSessions: Map<string, PlayerSession>;
+};
+
+const MIME: Record<string, string> = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.png': 'image/png',
+  '.svg': 'image/svg+xml',
+};
+
+const HEARTBEAT_MS = 20_000;
+
+async function readJson(req: IncomingMessage): Promise<unknown> {
+  const chunks: Buffer[] = [];
+  for await (const chunk of req) chunks.push(chunk as Buffer);
+  const text = Buffer.concat(chunks).toString('utf8');
+  return text.trim() === '' ? {} : JSON.parse(text);
+}
+
+function sendJson(res: ServerResponse, status: number, body: unknown): void {
+  const text = JSON.stringify(body);
+  res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': Buffer.byteLength(text) });
+  res.end(text);
+}
+
+async function serveStatic(distDir: string, urlPath: string, res: ServerResponse): Promise<void> {
+  const rel = urlPath === '/' ? '/index.html' : urlPath;
+  // `normalize` collapses `..`, and the join is then checked to still be inside `distDir` — a request
+  // for `/../../etc/passwd` must not escape the one directory this is allowed to read from.
+  const full = join(distDir, normalize(rel));
+  if (!full.startsWith(distDir)) {
+    sendJson(res, 400, { error: 'bad path' });
+    return;
+  }
+  try {
+    const info = await stat(full);
+    if (!info.isFile()) throw new Error('not a file');
+    res.writeHead(200, { 'Content-Type': MIME[extname(full)] ?? 'application/octet-stream', 'Content-Length': info.size });
+    createReadStream(full).pipe(res);
+  } catch {
+    res.writeHead(404, { 'Content-Type': 'text/plain' });
+    res.end('not found');
+  }
+}
+
+/**
+ * What a lobby SSE push carries — the whole `Lobby`, since the seat list is small and a delta
+ * mechanism buys nothing at this size (`session.ts`'s `Push` deltas the BOARD, which is not this).
+ *
+ * `started` rides on the FINAL push of a lobby's life, sent the instant before the connection is
+ * closed at `Lobby.Start` — without it, the client's only signal that the game began is the stream
+ * simply ending, indistinguishable from a network hiccup that `EventSource` would otherwise retry.
+ */
+type LobbyPush = { lobby: Lobby; you: PlayerIndex; started: boolean };
+
+export function startServer(opts: ServerOptions): void {
+  const games = opts.initialGames;
+  const lobbies = opts.initialLobbies;
+  const sessions = opts.initialSessions;
+  const gameCodes = new Map<string, string>(); // gameCode -> gameId, for /api/lobby/join
+  for (const [gameId, lobby] of lobbies) gameCodes.set(lobby.gameCode, gameId);
+
+  // One open SSE response per (gameId, seat) for a running game, and per (gameId, token) for a
+  // lobby still being seated — a second connection from the same seat/token replaces the first
+  // rather than fanning out to both (no concept yet of "the same seat from two tabs").
+  const gameConnections = new Map<string, Map<PlayerIndex, ServerResponse>>();
+  const gameEventIds = new Map<string, Map<PlayerIndex, number>>();
+  const lobbyConnections = new Map<string, Map<string, ServerResponse>>();
+
+  function writeSse(res: ServerResponse, id: number, data: unknown): void {
+    res.write(`id: ${id}\ndata: ${JSON.stringify(data)}\n\n`);
+  }
+
+  function nextEventId(gameId: string, seat: PlayerIndex): number {
+    const ids = gameEventIds.get(gameId) ?? new Map<PlayerIndex, number>();
+    const id = (ids.get(seat) ?? 0) + 1;
+    ids.set(seat, id);
+    gameEventIds.set(gameId, ids);
+    return id;
+  }
+
+  function broadcastGame(gameId: string, pushes: Map<PlayerIndex, Push>): void {
+    const conns = gameConnections.get(gameId);
+    if (!conns) return;
+    for (const [seat, push] of pushes) {
+      const res = conns.get(seat);
+      if (res) writeSse(res, nextEventId(gameId, seat), push);
+    }
+  }
+
+  /**
+   * Presence is transport-layer news about a CONNECTION, never a `GameEvent` — it does not go
+   * through `session.ts` at all (`lobby-and-sessions.md` §5). Sent to every OTHER currently
+   * connected seat of the same game as a presence-only push (an empty board delta, no menu, no new
+   * lines) rather than inventing a second SSE event type — one message shape for the client to parse.
+   */
+  function broadcastPresence(gameId: string, seat: PlayerIndex, connected: boolean): void {
+    const conns = gameConnections.get(gameId);
+    if (!conns) return;
+    for (const [other, res] of conns) {
+      if (other === seat) continue;
+      const push: Push = { menu: null, lines: [], presence: { seat, connected } };
+      writeSse(res, nextEventId(gameId, other), push);
+    }
+  }
+
+  function broadcastLobby(gameId: string): void {
+    const lobby = lobbies.get(gameId);
+    const conns = lobbyConnections.get(gameId);
+    if (!lobby || !conns) return;
+    for (const [token, res] of conns) {
+      const ps = sessions.get(token);
+      if (!ps) continue;
+      writeSse(res, 0, { lobby, you: ps.player, started: false } satisfies LobbyPush);
+    }
+  }
+
+  async function persistLobby(lobby: Lobby): Promise<void> {
+    lobbies.set(lobby.gameId, lobby);
+    gameCodes.set(lobby.gameCode, lobby.gameId);
+    await writeLobby(opts.dataDir, lobby);
+    await upsertIndexEntry(opts.dataDir, { gameId: lobby.gameId, gameCode: lobby.gameCode, status: 'lobby' });
+  }
+
+  async function persistSession(ps: PlayerSession): Promise<void> {
+    sessions.set(ps.token, ps);
+    const all = [...sessions.values()].filter((s) => s.gameId === ps.gameId);
+    await writeSessions(opts.dataDir, ps.gameId, all);
+  }
+
+  const server = createServer((req, res) => {
+    void (async () => {
+      const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+
+      // -- Is anyone home? --------------------------------------------------------------------
+
+      /**
+       * THE ONE ROUTE THAT EXISTS TO BE FAILED.
+       *
+       * The same `dist/` is served two ways: by this server, and as a plain static upload with no
+       * server behind it at all (`scripts/deploy-web.ts`). The bundle is byte-identical either way
+       * — one client, mode decided at runtime (D4) — so the page cannot know from its own build
+       * which it is, and every other route here answers a 404 for a path it does not have, exactly
+       * as a static host would. Nothing distinguished them until this did.
+       *
+       * Unauthenticated on purpose: it says only that a Station Master server is answering, which
+       * is what the client is about to offer the player anyway. It reveals no game and no seat.
+       */
+      if (url.pathname === '/api/health' && req.method === 'GET') {
+        sendJson(res, 200, { ok: true, service: 'station-master', engineVersion: opts.engineVersion });
+        return;
+      }
+
+      // -- Lobby: creating and joining (the door — join-secret gated) --------------------------
+
+      if (url.pathname === '/api/lobby/create' && req.method === 'POST') {
+        const body = (await readJson(req)) as { secret?: string; config?: GameConfig; displayName?: string };
+        if (body.secret !== opts.joinSecret) {
+          sendJson(res, 403, { error: 'bad or missing secret' });
+          return;
+        }
+        if (!body.config || typeof body.displayName !== 'string' || body.displayName.trim() === '') {
+          sendJson(res, 400, { error: 'expected { secret, config, displayName }' });
+          return;
+        }
+        const gameCode = freshGameCode((code) => gameCodes.has(code));
+        const { lobby, session } = createLobby(body.config, body.displayName.trim(), gameCode);
+        await persistLobby(lobby);
+        await persistSession(session);
+        sendJson(res, 200, { gameId: lobby.gameId, gameCode: lobby.gameCode, token: session.token, player: session.player });
+        return;
+      }
+
+      if (url.pathname === '/api/lobby/join' && req.method === 'POST') {
+        const body = (await readJson(req)) as { secret?: string; gameCode?: string; displayName?: string };
+        if (body.secret !== opts.joinSecret) {
+          sendJson(res, 403, { error: 'bad or missing secret' });
+          return;
+        }
+        if (typeof body.gameCode !== 'string' || typeof body.displayName !== 'string' || body.displayName.trim() === '') {
+          sendJson(res, 400, { error: 'expected { secret, gameCode, displayName }' });
+          return;
+        }
+        const gameId = gameCodes.get(body.gameCode.trim().toUpperCase());
+        const lobby = gameId ? lobbies.get(gameId) : undefined;
+        if (!lobby) {
+          // A game code that already started is no longer in `lobbies` at all — same NOT_FOUND a
+          // typo gets, which tells a latecomer "that game is gone" without leaking which case it was.
+          sendJson(res, 404, { error: 'no open lobby with that code' });
+          return;
+        }
+        const result = joinLobby(lobby, body.displayName.trim());
+        if (!result.ok) {
+          sendJson(res, 409, { error: result.code });
+          return;
+        }
+        await persistLobby(result.lobby);
+        await persistSession(result.session);
+        broadcastLobby(lobby.gameId);
+        sendJson(res, 200, { gameId: lobby.gameId, token: result.session.token, player: result.session.player });
+        return;
+      }
+
+      // -- Lobby: seating, once inside (token-authenticated) ------------------------------------
+
+      if (url.pathname === '/api/lobby/bot' && req.method === 'POST') {
+        const body = (await readJson(req)) as { token?: string; seat?: number; filled?: boolean };
+        const ps = typeof body.token === 'string' ? sessions.get(body.token) : undefined;
+        const lobby = ps ? lobbies.get(ps.gameId) : undefined;
+        if (!ps || !lobby) {
+          sendJson(res, 404, { error: 'no such lobby' });
+          return;
+        }
+        if (lobby.hostToken !== ps.token) {
+          sendJson(res, 403, { error: 'NOT_HOST' });
+          return;
+        }
+        if (typeof body.seat !== 'number' || typeof body.filled !== 'boolean') {
+          sendJson(res, 400, { error: 'expected { token, seat, filled }' });
+          return;
+        }
+        const updated = setBotSeat(lobby, body.seat as PlayerIndex, body.filled);
+        await persistLobby(updated);
+        broadcastLobby(lobby.gameId);
+        sendJson(res, 200, { ok: true });
+        return;
+      }
+
+      if (url.pathname === '/api/lobby/start' && req.method === 'POST') {
+        const body = (await readJson(req)) as { token?: string };
+        const ps = typeof body.token === 'string' ? sessions.get(body.token) : undefined;
+        const lobby = ps ? lobbies.get(ps.gameId) : undefined;
+        if (!ps || !lobby) {
+          sendJson(res, 404, { error: 'no such lobby' });
+          return;
+        }
+        const result = startLobby(lobby, ps.token);
+        if (!result.ok) {
+          sendJson(res, 409, { error: result.code });
+          return;
+        }
+        const session = createSession(Math.floor(Math.random() * 1e9), lobby.config, result.playerNames, result.botSeats);
+        games.set(lobby.gameId, session);
+        lobbies.delete(lobby.gameId);
+        // Every SSE watcher on the LOBBY stream is done — the game stream is what carries the game
+        // forward from here. `started: true` on one last message, THEN close, is what lets a
+        // still-open lobby tab tell "the game began" apart from a network hiccup `EventSource`
+        // would otherwise silently retry through.
+        for (const [watcherToken, watcherRes] of lobbyConnections.get(lobby.gameId) ?? []) {
+          const watcherPs = sessions.get(watcherToken);
+          if (watcherPs) writeSse(watcherRes, 0, { lobby, you: watcherPs.player, started: true } satisfies LobbyPush);
+          watcherRes.end();
+        }
+        lobbyConnections.delete(lobby.gameId);
+
+        await writeGame(gameDir(opts.dataDir, lobby.gameId), session.exportSave(), opts.engineVersion);
+        await upsertIndexEntry(opts.dataDir, { gameId: lobby.gameId, gameCode: lobby.gameCode, status: 'active' });
+        await deleteLobby(opts.dataDir, lobby.gameId);
+        sendJson(res, 200, { ok: true });
+        return;
+      }
+
+      if (url.pathname === '/api/lobby/stream' && req.method === 'GET') {
+        const token = url.searchParams.get('token') ?? '';
+        const ps = sessions.get(token);
+        const lobby = ps ? lobbies.get(ps.gameId) : undefined;
+        if (!ps || !lobby) {
+          sendJson(res, 404, { error: 'no such lobby' });
+          return;
+        }
+        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', Connection: 'keep-alive' });
+        const conns = lobbyConnections.get(lobby.gameId) ?? new Map<string, ServerResponse>();
+        conns.set(token, res);
+        lobbyConnections.set(lobby.gameId, conns);
+        writeSse(res, 0, { lobby, you: ps.player, started: false } satisfies LobbyPush);
+        const heartbeat = setInterval(() => res.write(': ping\n\n'), HEARTBEAT_MS);
+        req.on('close', () => {
+          clearInterval(heartbeat);
+          const live = lobbyConnections.get(lobby.gameId);
+          if (live?.get(token) === res) live.delete(token);
+          // `lobby-and-sessions.md` §2 — host rights pass to the earliest-joined remaining player
+          // if the host's connection closes before start. `lobbies.get` again, not the captured
+          // `lobby`, because it may have changed (another join, another bot toggle) since connect.
+          const current = lobbies.get(lobby.gameId);
+          if (current && current.hostToken === token) {
+            void persistLobby(reassignHost(current, token)).then(() => broadcastLobby(lobby.gameId));
+          }
+        });
+        return;
+      }
+
+      // -- The running game (token-authenticated) ------------------------------------------------
+
+      if (url.pathname === '/api/stream' && req.method === 'GET') {
+        const token = url.searchParams.get('token') ?? '';
+        const ps = sessions.get(token);
+        const session = ps ? games.get(ps.gameId) : undefined;
+        if (!ps || !session) {
+          sendJson(res, 404, { error: 'no such game' });
+          return;
+        }
+        const { gameId, player: seat } = ps;
+        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', Connection: 'keep-alive' });
+        const conns = gameConnections.get(gameId) ?? new Map<PlayerIndex, ServerResponse>();
+        conns.set(seat, res);
+        gameConnections.set(gameId, conns);
+        writeSse(res, nextEventId(gameId, seat), session.connect(seat));
+        broadcastPresence(gameId, seat, true);
+        // Idle for minutes at a time is the expected shape of this game (multiplayer.md §9) — a
+        // silent SSE connection is exactly what a proxy in the path may reap. A comment line is not a
+        // real event (EventSource ignores lines starting with `:`), so it costs the client nothing.
+        const heartbeat = setInterval(() => res.write(': ping\n\n'), HEARTBEAT_MS);
+        req.on('close', () => {
+          clearInterval(heartbeat);
+          const live = gameConnections.get(gameId);
+          if (live?.get(seat) === res) live.delete(seat);
+          broadcastPresence(gameId, seat, false);
+        });
+        return;
+      }
+
+      if (url.pathname === '/api/intent' && req.method === 'POST') {
+        // Token comes from the QUERY STRING, matching `/api/stream` and matching what
+        // `web/session.ts`'s `RemoteSession.submit` actually sends (`fetch('/api/intent?token=…')`)
+        // — the body carries only what changes per call, `{ seq, intent }`.
+        const token = url.searchParams.get('token') ?? '';
+        const ps = sessions.get(token);
+        const session = ps ? games.get(ps.gameId) : undefined;
+        if (!ps || !session) {
+          sendJson(res, 404, { error: 'no such game' });
+          return;
+        }
+        const body = (await readJson(req)) as { seq?: number; intent?: Intent };
+        if (typeof body.seq !== 'number' || !body.intent) {
+          sendJson(res, 400, { error: 'expected { seq, intent }' });
+          return;
+        }
+        const result = session.intent(ps.player, body.seq, body.intent);
+        if (result.accepted) {
+          // Persisted BEFORE the response goes out — "accepted" should mean "durably on disk" at
+          // this scale, not just "applied in memory" (§12 step 14).
+          const dir = gameDir(opts.dataDir, ps.gameId);
+          await writeGame(dir, session.exportSave(), opts.engineVersion);
+          if (result.timing) await appendTiming(dir, result.timing);
+          if (session.exportSave().status === 'finished') {
+            // `upsertIndexEntry` replaces the WHOLE row for this `gameId`, so the code has to be
+            // carried forward here rather than left blank — `gameCodes` is the only place still
+            // holding it once a lobby's own record is gone.
+            const gameCode = [...gameCodes.entries()].find(([, id]) => id === ps.gameId)?.[0] ?? '';
+            await upsertIndexEntry(opts.dataDir, { gameId: ps.gameId, gameCode, status: 'finished' });
+          }
+        }
+        sendJson(res, 200, result.accepted ? { ok: true } : { ok: false, code: result.code });
+        if (result.accepted) broadcastGame(ps.gameId, result.pushes);
+        return;
+      }
+
+      await serveStatic(opts.distDir, url.pathname, res);
+    })().catch((err: unknown) => {
+      sendJson(res, 500, { error: err instanceof Error ? err.message : 'internal error' });
+    });
+  });
+
+  server.listen(opts.port, opts.bindAddress);
+}

src/server/index.ts

@@ -0,0 +1,82 @@
+/**
+ * Process bootstrap — Phase 2 §12 step 8, extended for Phase 3 (§12 steps 14-15) load-on-start and
+ * Phase 4 (§12 steps 17-20) to resume every saved game and lobby, not just one.
+ *
+ * Run with:  node src/server/index.ts
+ *
+ * Env-configured, no config file — matches how the rest of this project's dev-side tooling reads
+ * `process.env` directly (`scripts/build-web.ts`'s `BUILD_DIST_DIR`).
+ */
+
+import { readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { startServer } from './http.ts';
+import { gameDir, loadGame, readIndex, readLobby, readSessions } from './persistence.ts';
+import { resumeSession } from './session.ts';
+import type { GameSession } from './session.ts';
+import type { Lobby, PlayerSession } from './lobby.ts';
+
+const port = Number(process.env['PORT'] ?? 8081);
+const bindAddress = process.env['BIND_ADDRESS'] ?? '0.0.0.0';
+const joinSecret = process.env['JOIN_SECRET'];
+const distDir = resolve(process.env['DIST_DIR'] ?? 'dist');
+const dataDir = resolve(process.env['DATA_DIR'] ?? 'data');
+
+if (!joinSecret) {
+  console.error('JOIN_SECRET must be set — a server-wide secret, passed out of band (D14).');
+  process.exit(1);
+}
+
+// `package.json`'s version IS `engineVersion` (§12 step 15) — the same reading `scripts/build-web.ts`'s
+// `buildStamp()` already does, just from `src/server/` rather than the repo root script directory.
+const root = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
+const engineVersion = (JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')) as { version: string }).version;
+
+const initialGames = new Map<string, GameSession>();
+const initialLobbies = new Map<string, Lobby>();
+const initialSessions = new Map<string, PlayerSession>();
+
+const index = await readIndex(dataDir);
+for (const entry of index) {
+  const sessions = await readSessions(dataDir, entry.gameId);
+  for (const s of sessions) initialSessions.set(s.token, s);
+
+  if (entry.status === 'lobby') {
+    const lobby = await readLobby(dataDir, entry.gameId);
+    if (lobby) initialLobbies.set(entry.gameId, lobby);
+    continue;
+  }
+
+  const loaded = await loadGame(gameDir(dataDir, entry.gameId), engineVersion);
+  if (loaded.found && loaded.ok) {
+    initialGames.set(entry.gameId, resumeSession(loaded.saved));
+    console.log(`Resumed ${entry.gameId} (${entry.gameCode}) — ${loaded.saved.history.length} intents replayed.`);
+  } else if (loaded.found && !loaded.ok) {
+    // Refused explicitly (§12 step 15) — never silently replayed under rules it wasn't recorded
+    // under. The file is left untouched: rolling the running version back would let it load again.
+    console.error(
+      `Refusing to resume ${entry.gameId} (${entry.gameCode}): saved under engine version ` +
+        `${loaded.storedVersion}, this server is running ${engineVersion}. Left untouched, and ` +
+        `will not appear as an active game until the version matches again.`,
+    );
+  }
+  // `entry.status === 'finished'` games are not resumed into memory at all — nothing plays them
+  // forward, and their files stay on disk for post-game replay (`lobby-and-sessions.md` §6).
+}
+
+startServer({
+  port,
+  bindAddress,
+  joinSecret,
+  distDir,
+  dataDir,
+  engineVersion,
+  initialGames,
+  initialLobbies,
+  initialSessions,
+});
+console.log(
+  `Station Master multiplayer server on ${bindAddress}:${port}, serving ${distDir} — ` +
+    `${initialGames.size} game(s) and ${initialLobbies.size} lobby(ies) resumed.`,
+);

src/server/lobby.ts

@@ -0,0 +1,167 @@
+/**
+ * The lobby — Phase 4 of `docs/architecture/multiplayer.md` (§12 steps 17-20), fully specified in
+ * `docs/architecture/lobby-and-sessions.md`.
+ *
+ * Pure logic, no sockets, no filesystem, no in-memory registry — same split `session.ts` already
+ * draws (`http.ts` wires connections and persistence to this; `persistence.ts` is the only thing
+ * that touches disk). A `Lobby` exists only BEFORE `Lobby.Start`: once the config locks and the
+ * `GameSession` is built, this module is done with that game — everything after is `session.ts`.
+ *
+ * WHY A SEPARATE FILE FROM `session.ts`. `session.ts` is already the "running game" module and is
+ * large; a lobby's concerns — seating, host rights, the join secret's door versus a game code's
+ * discovery, config locking — share almost no code with running a Stage clock, and mixing them would
+ * make both harder to read for no reuse gained.
+ */
+
+import { randomUUID } from 'node:crypto';
+
+import type { GameConfig, PlayerIndex } from '../engine/state.ts';
+
+/** `lobby-and-sessions.md` §1 — names the PLAYER, not the seat. Issued once, at join, and never
+ * reissued: it is what makes reconnection work, so it must outlive the connection that first used
+ * it. */
+export type PlayerSession = {
+  token: string;
+  gameId: string;
+  player: PlayerIndex;
+  displayName: string;
+};
+
+export type LobbySeat = { kind: 'human'; token: string; displayName: string } | { kind: 'bot' } | null;
+
+/** A game that has not started. `hostToken` ends its meaning at `Lobby.Start` — nothing here
+ * survives into the running game except the seat list and the locked `config`. */
+export type Lobby = {
+  gameId: string;
+  gameCode: string;
+  hostToken: string;
+  config: GameConfig;
+  seats: LobbySeat[];
+  /** Tokens in the order they joined — human seats only, host first — so a departed host's
+   * replacement is unambiguous (`lobby-and-sessions.md` §2: "earliest-joined remaining player"). */
+  joinOrder: string[];
+  createdAt: number;
+};
+
+export type CreateResult = { lobby: Lobby; session: PlayerSession };
+export type JoinResult = { ok: true; lobby: Lobby; session: PlayerSession } | { ok: false; code: 'LOBBY_FULL' | 'ALREADY_STARTED' };
+export type StartResult = { ok: true; playerNames: string[]; botSeats: PlayerIndex[] } | { ok: false; code: 'NOT_HOST' | 'BAD_PLAYER_COUNT' };
+
+/**
+ * `lobby-and-sessions.md` §2 — short and speakable, not an account name and not a UUID. A small
+ * fixed word list rather than a dictionary: this is read aloud across a table or a call, not typed
+ * from memory, so a handful of unambiguous railroad words serve better than a large random one.
+ */
+const CODE_WORDS = [
+  'RAIL', 'YARD', 'DEPOT', 'COAL', 'MAIL', 'CABOOSE', 'SIGNAL', 'FREIGHT',
+  'TRESTLE', 'HOPPER', 'TENDER', 'SIDING', 'GRADE', 'SPUR', 'WHISTLE', 'TROLLEY',
+];
+
+function randomCode(): string {
+  const word = CODE_WORDS[Math.floor(Math.random() * CODE_WORDS.length)]!;
+  const digits = Math.floor(Math.random() * 10_000)
+    .toString()
+    .padStart(4, '0');
+  return `${word}-${digits}`;
+}
+
+/** Collision-checked against whatever codes the caller already knows about — `http.ts` holds the
+ * live registry, so the check lives there rather than this module owning a set of its own. */
+export function freshGameCode(taken: (code: string) => boolean): string {
+  let code = randomCode();
+  while (taken(code)) code = randomCode();
+  return code;
+}
+
+/** `lobby-and-sessions.md` §2 — solitaire is exactly 1, competitive/coop are 2-4. Not a rules
+ * limit: the engine will build a Division for any seat count. This is the lobby judgment, sized to
+ * what has actually been played and tested (`test/multiplayer.test.ts` exercises 2, 3 and 4). */
+export function playerCountAllowed(mode: GameConfig['mode'], count: number): boolean {
+  return mode === 'solitaire' ? count === 1 : count >= 2 && count <= 4;
+}
+
+/** The creating player is the host and takes seat 0 (`lobby-and-sessions.md` §2). */
+export function createLobby(config: GameConfig, hostDisplayName: string, gameCode: string): CreateResult {
+  const gameId = randomUUID();
+  const token = randomUUID();
+  const session: PlayerSession = { token, gameId, player: 0, displayName: hostDisplayName };
+  const lobby: Lobby = {
+    gameId,
+    gameCode,
+    hostToken: token,
+    config,
+    seats: [{ kind: 'human', token, displayName: hostDisplayName }],
+    joinOrder: [token],
+    createdAt: Date.now(),
+  };
+  return { lobby, session };
+}
+
+/** Joins the first empty seat, or extends the seat list if every seat so far is filled and the
+ * mode's cap allows one more (`lobby-and-sessions.md` §2's 2-4 is enforced at `Lobby.Start`, not
+ * here — a 5th join before anyone starts is refused outright since there is no seat it could ever
+ * play in, but the running count is checked against `playerCountAllowed` at every join too, so a
+ * lobby can never grow the seats array past what could legally start). */
+export function joinLobby(lobby: Lobby, displayName: string): JoinResult {
+  const cap = lobby.config.mode === 'solitaire' ? 1 : 4;
+  const empty = lobby.seats.findIndex((s) => s === null);
+  const seatIndex = empty >= 0 ? empty : lobby.seats.length;
+  if (seatIndex >= cap) return { ok: false, code: 'LOBBY_FULL' };
+
+  const token = randomUUID();
+  const session: PlayerSession = { token, gameId: lobby.gameId, player: seatIndex, displayName };
+  const seats = [...lobby.seats];
+  seats[seatIndex] = { kind: 'human', token, displayName };
+  return {
+    ok: true,
+    lobby: { ...lobby, seats, joinOrder: [...lobby.joinOrder, token] },
+    session,
+  };
+}
+
+/** Host-only in effect (`http.ts` checks the caller's token against `hostToken` before calling
+ * this) — marks an empty seat as bot-filled, or clears one back to empty. Never touches an occupied
+ * human seat; the host removes a person by them leaving, not by overwriting their seat. */
+export function setBotSeat(lobby: Lobby, seat: PlayerIndex, filled: boolean): Lobby {
+  const seats = [...lobby.seats];
+  while (seats.length <= seat) seats.push(null);
+  if (filled) {
+    if (seats[seat] !== null) return lobby;
+    seats[seat] = { kind: 'bot' };
+  } else {
+    if (seats[seat]?.kind !== 'bot') return lobby;
+    seats[seat] = null;
+  }
+  return { ...lobby, seats };
+}
+
+/**
+ * The host's connection closed before `Lobby.Start`. `lobby-and-sessions.md` §2: rights pass to the
+ * earliest-joined remaining player — remaining means still occupying a seat, not necessarily still
+ * connected, since a momentary drop should not also cost the NEXT person the host chair. Returns
+ * the lobby unchanged if the departing token was not the host, or if no other human seat exists.
+ */
+export function reassignHost(lobby: Lobby, departingToken: string): Lobby {
+  if (lobby.hostToken !== departingToken) return lobby;
+  const stillSeated = new Set(
+    lobby.seats.flatMap((s) => (s?.kind === 'human' ? [s.token] : [])),
+  );
+  const next = lobby.joinOrder.find((t) => t !== departingToken && stillSeated.has(t));
+  return next ? { ...lobby, hostToken: next } : lobby;
+}
+
+/**
+ * Locks the config, checks the player count, and hands back exactly what `session.ts`'s
+ * `createSession` needs — this function does not call it, so `lobby.ts` never depends on
+ * `session.ts` (the dependency runs the other way: `http.ts` calls both).
+ */
+export function startLobby(lobby: Lobby, callerToken: string): StartResult {
+  if (callerToken !== lobby.hostToken) return { ok: false, code: 'NOT_HOST' };
+  const filled = lobby.seats.filter((s) => s !== null);
+  if (filled.length !== lobby.seats.length || !playerCountAllowed(lobby.config.mode, filled.length)) {
+    return { ok: false, code: 'BAD_PLAYER_COUNT' };
+  }
+  const playerNames = filled.map((s) => (s!.kind === 'human' ? s.displayName : 'Bot'));
+  const botSeats = filled.flatMap((s, i) => (s!.kind === 'bot' ? [i as PlayerIndex] : []));
+  return { ok: true, playerNames, botSeats };
+}

src/server/persistence.ts

@@ -0,0 +1,156 @@
+/**
+ * Persistence — Phase 3 of `docs/architecture/multiplayer.md` (§12 steps 14-15), extended for
+ * Phase 4 (§12 steps 17-20) to more than one game (`lobby-and-sessions.md` §6 specifies both
+ * shapes and the reasoning behind them).
+ *
+ * ONE DIRECTORY PER GAME (`games/<gameId>/`), plus one top-level `index.json` naming every game so
+ * `index.ts` can find and resume them all on boot without scanning the filesystem. Every write is
+ * still a full-file atomic rewrite (write to `.tmp`, `rename` over the real path) rather than true
+ * on-disk appending — §6 says the storage mechanism is genuinely open as long as the LOGICAL history
+ * is never rewritten or reordered, which a full rewrite of an always-growing array satisfies, and at
+ * the measured scale (~350 intents, a few hundred bytes per game) there is nothing to optimize yet.
+ */
+
+import { mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import type { SavedGame, TurnTiming } from './session.ts';
+import type { Lobby, PlayerSession } from './lobby.ts';
+
+const GAME_FILE = 'game.json';
+const TIMINGS_FILE = 'turn-timings.json';
+const LOBBY_FILE = 'lobby.json';
+const SESSIONS_FILE = 'sessions.json';
+const INDEX_FILE = 'index.json';
+
+type PersistedGame = SavedGame & { engineVersion: string };
+
+async function atomicWrite(path: string, text: string): Promise<void> {
+  const tmp = `${path}.tmp`;
+  await writeFile(tmp, text);
+  await rename(tmp, path);
+}
+
+export async function writeGame(dataDir: string, saved: SavedGame, engineVersion: string): Promise<void> {
+  await mkdir(dataDir, { recursive: true });
+  const payload: PersistedGame = { engineVersion, ...saved };
+  await atomicWrite(join(dataDir, GAME_FILE), JSON.stringify(payload, null, 1));
+}
+
+export type LoadResult =
+  | { found: false }
+  | { found: true; ok: true; saved: SavedGame }
+  /** §12 step 15 — refused explicitly, never silently replayed under the wrong rules. */
+  | { found: true; ok: false; storedVersion: string; currentVersion: string };
+
+export async function loadGame(dataDir: string, currentVersion: string): Promise<LoadResult> {
+  let text: string;
+  try {
+    text = await readFile(join(dataDir, GAME_FILE), 'utf8');
+  } catch {
+    return { found: false };
+  }
+  const payload = JSON.parse(text) as PersistedGame;
+  if (payload.engineVersion !== currentVersion) {
+    return { found: true, ok: false, storedVersion: payload.engineVersion, currentVersion };
+  }
+  const { engineVersion: _engineVersion, ...saved } = payload;
+  return { found: true, ok: true, saved };
+}
+
+/** Appended once per closed turn span (`GameSession.intent`'s `timing` result) — read-modify-write at
+ * this scale rather than real appending, same reasoning as `writeGame`. */
+export async function appendTiming(dataDir: string, timing: TurnTiming): Promise<void> {
+  await mkdir(dataDir, { recursive: true });
+  const path = join(dataDir, TIMINGS_FILE);
+  let existing: TurnTiming[];
+  try {
+    existing = JSON.parse(await readFile(path, 'utf8')) as TurnTiming[];
+  } catch {
+    existing = [];
+  }
+  existing.push(timing);
+  await atomicWrite(path, JSON.stringify(existing, null, 1));
+}
+
+// ---------------------------------------------------------------------------
+// Phase 4 — more than one game
+// ---------------------------------------------------------------------------
+
+export type GameIndexEntry = { gameId: string; gameCode: string; status: 'lobby' | 'active' | 'finished' };
+
+/** Where one game's own files live. Every function below takes a `gameId` and joins it under here
+ * itself; `writeGame`/`loadGame`/`appendTiming` above do not, and take a directory directly, so a
+ * caller wanting one specific game's `game.json` passes `gameDir(dataDir, gameId)` to those. */
+export function gameDir(dataDir: string, gameId: string): string {
+  return join(dataDir, 'games', gameId);
+}
+
+export async function readIndex(dataDir: string): Promise<GameIndexEntry[]> {
+  try {
+    return JSON.parse(await readFile(join(dataDir, INDEX_FILE), 'utf8')) as GameIndexEntry[];
+  } catch {
+    return [];
+  }
+}
+
+async function writeIndex(dataDir: string, entries: GameIndexEntry[]): Promise<void> {
+  await mkdir(dataDir, { recursive: true });
+  await atomicWrite(join(dataDir, INDEX_FILE), JSON.stringify(entries, null, 1));
+}
+
+/**
+ * Adds or updates exactly one game's row, by `gameId` — every caller that changes one game's status
+ * (created, started, finished) wants precisely this, not "replace the whole index", which would
+ * silently drop every other game's row the moment two writes happened close together.
+ */
+export async function upsertIndexEntry(dataDir: string, entry: GameIndexEntry): Promise<void> {
+  const entries = await readIndex(dataDir);
+  const i = entries.findIndex((e) => e.gameId === entry.gameId);
+  if (i >= 0) entries[i] = entry;
+  else entries.push(entry);
+  await writeIndex(dataDir, entries);
+}
+
+export async function writeLobby(dataDir: string, lobby: Lobby): Promise<void> {
+  const dir = gameDir(dataDir, lobby.gameId);
+  await mkdir(dir, { recursive: true });
+  await atomicWrite(join(dir, LOBBY_FILE), JSON.stringify(lobby, null, 1));
+}
+
+export async function readLobby(dataDir: string, gameId: string): Promise<Lobby | null> {
+  try {
+    return JSON.parse(await readFile(join(gameDir(dataDir, gameId), LOBBY_FILE), 'utf8')) as Lobby;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Removed once a game starts — a `Lobby` and a running `SavedGame` are mutually exclusive for one
+ * `gameId`, and leaving the file behind would let a restart resurrect a lobby for a game already
+ * under way. Missing already is not an error; `Lobby.Start` calls this exactly once, in the same
+ * request that writes `game.json`.
+ */
+export async function deleteLobby(dataDir: string, gameId: string): Promise<void> {
+  try {
+    await unlink(join(gameDir(dataDir, gameId), LOBBY_FILE));
+  } catch {
+    // Already gone — nothing to do.
+  }
+}
+
+/** Session tokens for one game — `lobby-and-sessions.md` §6: persisted so a token still works after
+ * a server restart, the same reason `game.json` itself is persisted. */
+export async function writeSessions(dataDir: string, gameId: string, sessions: PlayerSession[]): Promise<void> {
+  const dir = gameDir(dataDir, gameId);
+  await mkdir(dir, { recursive: true });
+  await atomicWrite(join(dir, SESSIONS_FILE), JSON.stringify(sessions, null, 1));
+}
+
+export async function readSessions(dataDir: string, gameId: string): Promise<PlayerSession[]> {
+  try {
+    return JSON.parse(await readFile(join(gameDir(dataDir, gameId), SESSIONS_FILE), 'utf8')) as PlayerSession[];
+  } catch {
+    return [];
+  }
+}

src/server/session.ts

@@ -0,0 +1,271 @@
+/**
+ * The game session host — Phases 2 and 3 of `docs/architecture/multiplayer.md` (§8, §12 steps 9,
+ * 14-16).
+ *
+ * Pure logic, no sockets, no filesystem — `src/server/http.ts` is the thin wiring that calls into
+ * this, and `src/server/persistence.ts` is what actually reads/writes disk. One `GameSession` per
+ * in-memory game (Phase 2 is one game per process; Phase 4 generalizes to many).
+ *
+ * REUSES `src/web/game.ts`'s `Game`/`submit`/`drain`/`currentActor`/`actionMenu` wholesale — all pure
+ * logic already, with no DOM dependency, exactly as `LocalSession` uses them client-side. Building a
+ * second copy of "apply an intent, narrate it, compute the Menu" here would drift from what solitaire
+ * already does and is tested against.
+ *
+ * ONE THING `game.ts`'s `submit` DOES NOT DO: verify who is calling it. `submit(game, intent)` reads
+ * `currentActor(game)` itself and applies the intent AS that player, regardless of who asked — safe
+ * for `LocalSession` (there is only ever one possible caller: the one browser). A server has more than
+ * one seat submitting, so THIS file is where "is `seat` actually allowed to act right now?" has to be
+ * checked, before `submit` is ever called — see `intent()` below.
+ */
+
+import { check } from '../engine/apply.ts';
+import { legalActions } from '../engine/legal.ts';
+import type { Intent } from '../engine/intents.ts';
+import type { GameConfig, PlayerIndex } from '../engine/state.ts';
+import { actionMenu, currentActor, fromMultiplayerSave, newMultiplayerGame, submit } from '../web/game.ts';
+import type { Game, Menu } from '../web/game.ts';
+import { deltaFrame } from '../sim/frame-delta.ts';
+import type { FrameDelta } from '../sim/frame-delta.ts';
+import { snapshot } from '../sim/view.ts';
+import type { Frame } from '../sim/view.ts';
+import { developerBot } from '../sim/bot.ts';
+
+export type Push = {
+  /**
+   * Absent on a presence-only push (below) — there is no board delta to send when nothing about the
+   * GAME changed, and computing one just to say "unchanged" would mean tracking a last-sent frame
+   * for a seat that may not even be in this game's connection table (a lobby-stage notice has none).
+   */
+  frame?: FrameDelta;
+  /** Non-null only for the seat that may currently act — never guess otherwise (`game.ts`'s `actionMenu` guards this too, but the host must still only compute/send it for the actor). */
+  menu: Menu | null;
+  /** Narration since the LAST push to this specific seat, not the whole game's log. */
+  lines: { text: string; tone: string }[];
+  /**
+   * Connection news about ANOTHER seat — never this push's own recipient. `lobby-and-sessions.md`
+   * §5: a disconnect is server-layer news about a connection, not a `GameEvent`, so it must not go
+   * through the engine or the shared narration log (which must stay replayable from a seed). Built
+   * and broadcast entirely by `http.ts`, which already owns the connection table; `session.ts` never
+   * sets this field itself — every `Push` `session.ts` builds carries a real `frame` and no
+   * `presence`, and `http.ts`'s presence notices carry no `frame` and no `menu`.
+   */
+  presence?: { seat: PlayerIndex; connected: boolean };
+};
+
+/**
+ * `lobby-and-sessions.md` §5 — "wall-clock at the start of a turn, wall-clock at the intent that
+ * ends it, per player per phase." Computed entirely here, never touching the engine (which has no
+ * clock and must stay deterministic) and never stored inside `history` (a replay must reproduce a
+ * game from decisions alone).
+ */
+export type TurnTiming = {
+  player: PlayerIndex;
+  phase: string;
+  day: number;
+  stage: number;
+  startedAt: number;
+  endedAt: number;
+};
+
+/** Everything `persistence.ts` needs to write `game.json` and rebuild a session from it later. */
+export type SavedGame = {
+  seed: number;
+  config: GameConfig;
+  playerNames: string[];
+  history: Intent[];
+  status: 'active' | 'finished';
+  createdAt: number;
+  /**
+   * Seats `developerBot` plays for, filled at `Lobby.Start` (D8 — bots fill EMPTY seats at lobby
+   * time only, never mid-game). Persisted so a bot seat is still a bot after a server restart —
+   * `resumeSession` has no other way to know, and re-deriving it from `playerNames` would mean
+   * guessing from a display name rather than reading a fact.
+   */
+  botSeats: PlayerIndex[];
+};
+
+export type IntentResult =
+  | { accepted: true; pushes: Map<PlayerIndex, Push>; timing: TurnTiming | null }
+  | { accepted: false; code: string };
+
+export type GameSession = {
+  readonly playerCount: number;
+  isBot(seat: PlayerIndex): boolean;
+  /** A new SSE connection (or a reconnect) for `seat` — always a full Frame, never a delta. */
+  connect(seat: PlayerIndex): Push;
+  intent(seat: PlayerIndex, seq: number, i: Intent): IntentResult;
+  /** Everything needed to persist this game and, later, rebuild it via `resumeSession`. */
+  exportSave(): SavedGame;
+};
+
+type OpenSpan = { player: PlayerIndex; phase: string; day: number; stage: number; startedAt: number };
+
+function buildSession(
+  game: Game,
+  playerNames: string[],
+  createdAt: number,
+  botSeats: Set<PlayerIndex>,
+): GameSession {
+  const lastSeq = new Map<PlayerIndex, number>();
+  const lastFrame = new Map<PlayerIndex, Frame>();
+  const sentLines = new Map<PlayerIndex, number>();
+
+  const openSpanFor = (now: number): OpenSpan | null => {
+    const actor = currentActor(game);
+    if (actor === null) return null;
+    return { player: actor, phase: game.state.clock.phase, day: game.state.clock.day, stage: game.state.clock.stage, startedAt: now };
+  };
+  let open: OpenSpan | null = openSpanFor(Date.now());
+
+  function frameFor(seat: PlayerIndex): Frame {
+    return snapshot(game.state, game.log, null, null, null, false, seat);
+  }
+
+  function linesSince(seat: PlayerIndex): { text: string; tone: string }[] {
+    const already = sentLines.get(seat) ?? 0;
+    sentLines.set(seat, game.log.length);
+    return game.log.slice(already);
+  }
+
+  function menuFor(seat: PlayerIndex): Menu | null {
+    return seat === currentActor(game) ? actionMenu(game, seat) : null;
+  }
+
+  function pushFor(seat: PlayerIndex): Push {
+    const frame = frameFor(seat);
+    const delta = deltaFrame(lastFrame.get(seat) ?? null, frame);
+    lastFrame.set(seat, frame);
+    return { frame: delta, menu: menuFor(seat), lines: linesSince(seat) };
+  }
+
+  function pushesForAll(): Map<PlayerIndex, Push> {
+    const out = new Map<PlayerIndex, Push>();
+    for (let seat = 0; seat < playerNames.length; seat++) out.set(seat as PlayerIndex, pushFor(seat as PlayerIndex));
+    return out;
+  }
+
+  /**
+   * Closes the open span if the acting player, phase, Day or Stage moved since it opened, and opens
+   * the next one (or none, in the automatic Mainline Phase). Returns the just-closed span, if any,
+   * for the caller to persist — a "turn" here is exactly the contiguous stretch where none of those
+   * four things changed, which can span several intents (draw, then play, then end) as one span.
+   */
+  function settleTiming(): TurnTiming | null {
+    const now = Date.now();
+    const next = openSpanFor(now);
+    const same =
+      open !== null &&
+      next !== null &&
+      open.player === next.player &&
+      open.phase === next.phase &&
+      open.day === next.day &&
+      open.stage === next.stage;
+    if (same) return null;
+    const closed: TurnTiming | null = open === null ? null : { ...open, endedAt: now };
+    open = next;
+    return closed;
+  }
+
+  /**
+   * PLAY EVERY BOT SEAT FORWARD until a human is due, or the game ends.
+   *
+   * `developerBot` (D8, `lobby-and-sessions.md` §2) fills EMPTY seats at lobby time only — it never
+   * takes over for a disconnected human, so this loop only ever touches seats `botSeats` named at
+   * `Lobby.Start`. Uses `submit` directly rather than the public `intent()` path: a bot is not a
+   * client with a `seq` to dedupe against, and its choice is by construction always legal (`check`
+   * would only ever confirm what `legalActions` already promised).
+   *
+   * Intermediate bot-turn spans are swept through `settleTiming()` but their result is discarded —
+   * `lobby-and-sessions.md` §5's turn clock exists to learn how long HUMANS take, and a bot decides
+   * in zero wall-clock time by definition. Called once at construction (a resume could land exactly
+   * on a bot's turn) and once after every accepted human intent.
+   */
+  function driveBots(): void {
+    let guard = 0;
+    for (;;) {
+      const actor = currentActor(game);
+      if (actor === null || !botSeats.has(actor)) return;
+      if (++guard > 10_000) throw new Error(`driveBots: probable infinite loop at seat ${actor}`);
+      const options = legalActions(game.state, actor);
+      if (options.length === 0) return;
+      const choice = developerBot.choose(game.state, actor, options);
+      const ok = submit(game, choice);
+      /* c8 ignore next -- `options` came from `legalActions`, so `choice` is always legal. */
+      if (!ok) throw new Error(`driveBots: developerBot chose an illegal action for seat ${actor}`);
+      settleTiming();
+    }
+  }
+  driveBots();
+
+  return {
+    playerCount: playerNames.length,
+    isBot: (seat) => botSeats.has(seat),
+
+    connect(seat) {
+      // A (re)connect always starts from a clean slate — no cache to trust across a lost connection
+      // (or a server restart, Phase 3) — so the honest thing is a full Frame, not a delta.
+      lastFrame.delete(seat);
+      return pushFor(seat);
+    },
+
+    intent(seat, seq, i) {
+      // Idempotent resend (protocol.md §5): a repeat of an ALREADY-APPLIED seq is a no-op success,
+      // with no pushes to re-broadcast. A repeat after a REJECTION is not remembered here — it was
+      // never applied, so it is worth trying again (see the `lastSeq.set` below: only on success).
+      if (lastSeq.get(seat) === seq) return { accepted: true, pushes: new Map(), timing: null };
+
+      if (seat !== currentActor(game)) return { accepted: false, code: 'NOT_YOUR_TURN' };
+
+      // Checked directly, rather than via `submit`'s boolean, for two reasons: `submit` writes a
+      // "that is not allowed" line into the SHARED `game.log` on rejection, which would otherwise
+      // broadcast one seat's illegal attempt to the whole table on their next push (rejection
+      // feedback is private, to the submitter only); and calling `check` first means an intent
+      // already known to be illegal never touches the engine at all.
+      const code = check(game.state, seat, i);
+      if (code) return { accepted: false, code };
+
+      const applied = submit(game, i);
+      /* c8 ignore next -- `check` above already proved this intent is legal; `submit` cannot then refuse it. */
+      if (!applied) return { accepted: false, code: 'REJECTED' };
+
+      lastSeq.set(seat, seq);
+      const timing = settleTiming();
+      // Any bot due to act now plays out entirely before this push goes back — the delta mechanism
+      // diffs against whatever was last sent, so it captures the bots' moves along with the human's
+      // in one push regardless of how many turns that took.
+      driveBots();
+      return { accepted: true, pushes: pushesForAll(), timing };
+    },
+
+    exportSave() {
+      return {
+        seed: game.seed,
+        config: game.state.config,
+        playerNames: [...playerNames],
+        history: [...game.history],
+        status: game.state.status === 'finished' ? 'finished' : 'active',
+        createdAt,
+        botSeats: [...botSeats],
+      };
+    },
+  };
+}
+
+export function createSession(
+  seed: number,
+  config: GameConfig,
+  playerNames: string[],
+  botSeats: PlayerIndex[] = [],
+): GameSession {
+  return buildSession(newMultiplayerGame(seed, config, playerNames), playerNames, Date.now(), new Set(botSeats));
+}
+
+/**
+ * Phase 3 — rebuild a session from a persisted `SavedGame` (`persistence.ts`). The engine-version
+ * check happens before this is ever called; by the time `saved.history` reaches here it is already
+ * known to have been recorded under the currently-running rules.
+ */
+export function resumeSession(saved: SavedGame): GameSession {
+  const game = fromMultiplayerSave(saved.seed, saved.config, saved.playerNames, saved.history);
+  return buildSession(game, saved.playerNames, saved.createdAt, new Set(saved.botSeats));
+}

src/sim/board-svg.ts

@@ -51,6 +51,14 @@ export function divisionSvg(nodes: DivisionView[]): string {
   const CW = { dp: 118, ml: 152, run: 78 };
   const CH = 58;
   const GAP = 6;
+  /**
+   * ONE FIXED SLOT PER A/D TRACK, so the Office Running Track cell is drawn wide enough to hold
+   * them without spilling onto its neighbours (docs/plans/switching-paths.md — "The Roster Pass").
+   * Sized by CAPACITY, not by how many are occupied right now: a cell drawn for the trains it HAS
+   * holds still as they come and go, where sizing by occupancy moved the East Division Point (and
+   * everything past it) sideways every time an A/D track filled or cleared.
+   */
+  const CHIP_W = 54;
   /**
    * Room for the buffer stops. THE LABELS NO LONGER LIVE OUT HERE.
    *
@@ -128,7 +136,7 @@ export function divisionSvg(nodes: DivisionView[]): string {
           // No regions inside a district: a crew moves by Moves there, not by Stages, so it
           // occupies a card outright rather than a part of one.
           regions: 0,
-          w: CW.run,
+          w: isOffice && cap !== null ? Math.max(CW.run, cap * CHIP_W + 12) : CW.run,
         });
       }
       // A crew below the Running Track has no position ON it, so it is reported against the
@@ -301,12 +309,24 @@ export function divisionSvg(nodes: DivisionView[]): string {
       const loaded = cars.filter((x) => /^loaded/.test(x) || /caboose/.test(x)).length;
       const label = cars.length === 0 ? `${t.label} ${arrow}` : `${t.label} ${arrow}${cars.length}`;
 
-      const w = Math.min(c.w - 8, label.length * 6.6 + 12);
+      /**
+       * THE OFFICE RUNNING CELL GETS FIXED SLOTS, ONE PER A/D TRACK — never a centre spread.
+       *
+       * Centred spreading pushes its outer chips outward as MORE trains arrive, and the cell was
+       * sized for the cards it holds, not for its trains — so two chips at a Station used to land at
+       * x 215–267 and 271–316 inside a cell spanning only 230–308, spilling onto the Limits cards
+       * either side. A fixed slot per A/D track cannot overflow the cell at any occupancy, because
+       * the cell was sized for exactly that many slots (see `CHIP_W` above).
+       */
+      const isOfficeRun = c.kind === 'run' && c.cap !== null && c.cap > 0;
+      const slotW = isOfficeRun ? (c.w - 12) / c.cap! : 0;
+      const w = isOfficeRun ? Math.min(slotW - 4, label.length * 6.6 + 12) : Math.min(c.w - 8, label.length * 6.6 + 12);
       // A train on a Mainline card sits in ITS region; anywhere else it just sits on the card.
       const inRegion = c.regions > 1 && typeof t.region === 'number';
-      const slotX = inRegion ? c.x + 6 + RW * (t.region ?? 0) + RW / 2 : c.x + c.w / 2;
-      const spread = inRegion ? 0 : (k - (c.trains.length - 1) / 2) * (w + 4);
-      const tx = slotX + spread;
+      const tx = isOfficeRun
+        ? c.x + 6 + slotW * (k + 0.5)
+        : (inRegion ? c.x + 6 + RW * (t.region ?? 0) + RW / 2 : c.x + c.w / 2) +
+          (inRegion ? 0 : (k - (c.trains.length - 1) / 2) * (w + 4));
       const dir = t.direction === 'west' ? ' \u25c0 west' : t.direction === 'east' ? ' east \u25b6' : '';
       const stages =
         typeof t.stagesLeft === 'number'
@@ -383,6 +403,22 @@ export function officeSvg(
    * offered without a word. Reported as the Depot lighting up for no visible reason.
    */
   legal: { row: number; col: number; label: string }[] = [],
+  /**
+   * The columns the Limits signs stand in, drawn as the district's east and west edges.
+   *
+   * Omitted by the previews and by the replay viewers' single-card renders, which have no district
+   * to bound. Where it is given, the boundary is drawn down the WHOLE canvas: track may not be laid
+   * outside these columns at any row (§2.1), and two signs sitting on one row could not say that —
+   * a player looking at open ground past a sign had no way to know nothing of his could ever go
+   * there until the square failed to light up.
+   */
+  limits: { west: number; east: number } | null = null,
+  /**
+   * Which train's consist is drawn at the rail, on an Office card holding more than one — the value
+   * the "Which train are you switching?" picker already carries. Defaults to the first train on the
+   * card, so every call site that has never heard of this feature keeps working unchanged.
+   */
+  selectedTrayId: string | null = null,
 ): string {
   const W = 166;
   const H = 96;
@@ -438,6 +474,65 @@ export function officeSvg(
     return out;
   };
 
+  /**
+   * A 45° LEG, drawn as a smooth curve rather than two straight segments meeting at a hard corner.
+   *
+   * It is an EASEMENT, not an arbitrary curve: tangent to horizontal at `p0` (the east or west edge),
+   * so an abutting straight card's through-rail still reads as one unbroken line, and tangent to
+   * exactly 45° at `p3` (the north or south edge), so two stacked curves still read as one continuous
+   * diagonal and the edge-crossing angle the matching rule depends on is unchanged. `p1`/`p2` are
+   * cubic-Bezier control points chosen to hit those two tangents — see the call site.
+   *
+   * Sampled as a short polyline rather than left as one SVG path command, because the two parallel
+   * rails and the tie marks all need points evenly spaced ALONG THE CURVE with the local tangent at
+   * each one — `rail()`'s straight-line version does the same sampling, just on a line.
+   */
+  const curvedRail = (
+    p0: { x: number; y: number },
+    p1: { x: number; y: number },
+    p2: { x: number; y: number },
+    p3: { x: number; y: number },
+  ): string => {
+    const at = (t: number): { x: number; y: number } => {
+      const u = 1 - t;
+      return {
+        x: u * u * u * p0.x + 3 * u * u * t * p1.x + 3 * u * t * t * p2.x + t * t * t * p3.x,
+        y: u * u * u * p0.y + 3 * u * u * t * p1.y + 3 * u * t * t * p2.y + t * t * t * p3.y,
+      };
+    };
+    const tangentAt = (t: number): { x: number; y: number } => {
+      const u = 1 - t;
+      return {
+        x: 3 * u * u * (p1.x - p0.x) + 6 * u * t * (p2.x - p1.x) + 3 * t * t * (p3.x - p2.x),
+        y: 3 * u * u * (p1.y - p0.y) + 6 * u * t * (p2.y - p1.y) + 3 * t * t * (p3.y - p2.y),
+      };
+    };
+    const N = 24;
+    const left: string[] = [];
+    const right: string[] = [];
+    let ties = '';
+    for (let i = 0; i <= N; i++) {
+      const t = i / N;
+      const pt = at(t);
+      const tan = tangentAt(t);
+      const tlen = Math.hypot(tan.x, tan.y) || 1;
+      const nx = (-tan.y / tlen) * 2.5;
+      const ny = (tan.x / tlen) * 2.5;
+      left.push(`${pt.x + nx} ${pt.y + ny}`);
+      right.push(`${pt.x - nx} ${pt.y - ny}`);
+      // Every third sample — the same rough 9px spacing `rail()` uses for a straight run of similar
+      // length, not tied to `N` itself.
+      if (i % 3 === 0) {
+        ties += `<line class="bs-tie" x1="${pt.x + nx * 1.8}" y1="${pt.y + ny * 1.8}" x2="${pt.x - nx * 1.8}" y2="${pt.y - ny * 1.8}"/>`;
+      }
+    }
+    return (
+      `<path class="bs-rail" fill="none" d="M${left.join(' L')}"/>` +
+      `<path class="bs-rail" fill="none" d="M${right.join(' L')}"/>` +
+      ties
+    );
+  };
+
   // Where each port meets the card edge. East and west sit at the rail height — the card's middle —
   // so a straight run stays straight across the whole row; north and south are centred on the edge.
   const port = (p: string): { x: number; y: number } => {
@@ -447,7 +542,15 @@ export function officeSvg(
     return { x: W / 2, y: H };
   };
 
-  let out = `<svg class="bs" viewBox="0 0 ${width} ${height}" preserveAspectRatio="xMinYMin meet">`;
+  /**
+   * ROOM FOR THE BOUNDARY. The Limits edge is drawn just outside the sign's own column, and the west
+   * sign is usually the leftmost card on the canvas — so at x = −1.5 the line lands outside a viewBox
+   * starting at 0 and is simply not there. The margin is added only when there is a boundary to draw.
+   */
+  const margin = limits ? 3 : 0;
+  let out =
+    `<svg class="bs" viewBox="${-margin} 0 ${width + margin * 2} ${height}" ` +
+    `preserveAspectRatio="xMinYMin meet">`;
   for (const cell of cells) {
     const x = px(cell.col);
     const y = py(cell.row);
@@ -462,10 +565,21 @@ export function officeSvg(
               ? 'mod'
               : 'trk';
 
+    // An Office card's roster band (below) takes the y-band the BOARDS + ALIGHTS flow label used to
+    // print in, so that explanation folds into the card's own tooltip instead of being drawn — it
+    // prints identically on every Office of every tier and is already implied by the card name and
+    // the Porter pill, so nothing is lost by reading it on the card rather than beside it.
+    const isOfficeRoster = cell.adTracks !== null;
+    const flowFold =
+      isOfficeRoster && cell.facility
+        ? '\n\nBOARDS + ALIGHTS: passengers only — no freight is handled here. They wait in a green ' +
+          'box, are boarded onto a coach by Porters, and arrive into a red one.'
+        : '';
+
     // Addressable so a caller can outline a square as a legal destination without re-rendering.
     // The explanation rides on the group as a tooltip rather than being printed: it is reference
     // detail, read once, and printing it costs the space the board itself needs.
-    out += `<g data-cell="${cell.row},${cell.col}" data-tip="${esc(cell.label)} — ${esc(cell.what)}" transform="translate(${x},${y})">`;
+    out += `<g data-cell="${cell.row},${cell.col}" data-tip="${esc(cell.label)} — ${esc(cell.what)}${esc(flowFold)}" transform="translate(${x},${y})">`;
     out += `<rect class="bs-card bs-${kind}${cell.running ? ' bs-run' : ''}" x="0" y="0" width="${W}" height="${H}" rx="4"/>`;
 
     // The rails. A Modifier is not track and deliberately gets none — that is why nothing can be
@@ -479,38 +593,79 @@ export function officeSvg(
         out += rail(port(from).x, port(from).y, port(to).x, port(to).y);
       } else {
         /**
-         * A 45° LEG, drawn as the card prints it: along the centre line from the east or west edge
-         * to the FROG, then out at exactly 45° through the middle of the north or south edge.
+         * A 45° LEG — drawn as a smooth curve (v0.5.0) that still passes through the same FROG the
+         * old two-segment version bent at, so the underlying geometry (and the `frog` position used
+         * elsewhere for the actual joining/matching rules) is unchanged; only the picture is.
          *
          * The frog is `H/2` from the centre because a 45° run climbing half the card's height
-         * travels half its height sideways. This used to be a fixed elbow at (W/2, RAIL+(H-RAIL)/2)
-         * — below the rail on the assumption everything diverged downward — which drew a leg
-         * reaching north as a hook that dropped past the rail and came back up, and drew nothing at
-         * any angle the matching rule cares about.
+         * travels half its height sideways. The control points sit halfway from each endpoint to the
+         * frog, which is what gives the curve a horizontal tangent at the e/w edge (matching an
+         * abutting straight card's through-rail) and an exact 45° tangent at the n/s edge (matching
+         * the card above or below) — see `curvedRail`.
          */
         const side = vertical === from ? to : from;
         const frog = { x: W / 2 + (side === 'e' ? H / 2 : -H / 2), y: RAIL };
+        const start = port(side);
         const edge = port(vertical);
-        out += rail(port(side).x, port(side).y, frog.x, frog.y) + rail(frog.x, frog.y, edge.x, edge.y);
+        const c1 = { x: start.x + 0.5 * (frog.x - start.x), y: start.y };
+        const c2 = { x: edge.x + 0.5 * (frog.x - edge.x), y: edge.y + 0.5 * (frog.y - edge.y) };
+        out += curvedRail(start, c1, c2, edge);
       }
     }
 
     out += `<text class="bs-cn" x="6" y="12">${esc(cell.label)}</text>`;
 
+    // X,Y — east/west then north/south, not the internal row/col storage order.
+    out += `<text class="bs-coord" x="${W - 5}" y="12" text-anchor="end">${cell.col},${cell.row}</text>`;
+
     /**
-     * A/D TRACKS, as pips.
+     * THE ROSTER, one chip per A/D track — not one per train.
      *
-     * The Office tooltip said "3 A/D tracks" and the card showed nothing — so the number that
-     * decides whether the next arrival is an automatic collision (§8.3) was invisible on the card it
-     * belongs to. There is no room to draw more rails, and the count is what matters: one pip per
-     * track, filled for taken.
+     * The Office is the one square where more than one train may legally stand at once (its A/D
+     * tracks, §2.1), and the old single `cell.train` field only ever showed whichever tray
+     * `s.trays` happened to yield first: a second train at a busy Station was counted in the old
+     * A/D pips and never drawn at all. `adTracks` of them, always, whether or not a train is
+     * holding there — the cell is drawn for the tracks it HAS, so a free one reads a dashed,
+     * dimmed chip saying "free" rather than simply vanishing.
+     *
+     * Selected train's chip is lit the same amber the crew strip and action buttons already use,
+     * and it is the one whose consist is drawn at the rail below. Every occupied chip carries
+     * `data-crew`, so the play page can wire a click to switch which train that is.
+     *
+     * COMPUTED FOR EVERY CARD, NOT JUST THE OFFICE. This used to sit inside the `adTracks !== null`
+     * branch below, so it was only ever assigned on the Office card — a train standing anywhere else
+     * in the district (which is everywhere it stands while actually being switched) got no chip at
+     * all: no label, no engine arrow, and no cars drawn, though the game state never lost it. REPORTED:
+     * dropping a car at the Freight House made "the train vanish off the face of the earth" — it had
+     * simply left the one square this code drew a crew on. The Office is the only square that can hold
+     * more than one train, so `cell.trains[0]` is exactly right everywhere else too.
      */
-    if (cell.ad) {
-      for (let i = 0; i < cell.ad.of; i++) {
-        out += `<circle class="bs-ad${i < cell.ad.used ? ' bs-occ' : ''}" cx="${W - 9 - i * 9}" cy="10" r="3"/>`;
+    const selectedTrain: CellView['trains'][number] | null =
+      cell.trains.find((t) => t.trayId === selectedTrayId) ?? cell.trains[0] ?? null;
+    if (cell.adTracks !== null) {
+      const adTracks = cell.adTracks;
+      const gaps = Math.max(0, adTracks - 1);
+      const chipW = Math.min(52, (W - 12 - 4 * gaps) / adTracks);
+      for (let i = 0; i < adTracks; i++) {
+        const train = cell.trains[i] ?? null;
+        const cx = 6 + i * (chipW + 4);
+        if (!train) {
+          out +=
+            `<g class="bs-adchip mt"><rect x="${cx}" y="20" width="${chipW}" height="14" rx="3"/>` +
+            `<text x="${cx + chipW / 2}" y="30.5" text-anchor="middle">free</text></g>`;
+          continue;
+        }
+        const arrow = train.facing === 'w' ? '◀' : '▶';
+        const chipLabel = chipW >= 40 ? `${train.label} ${arrow}${train.cars.length}` : `${train.label}${arrow}`;
+        const consistWords = train.cars.length === 0 ? 'no cars' : train.cars.join(', ');
+        const on = train.trayId === selectedTrain?.trayId;
+        out +=
+          `<g class="bs-adchip${on ? ' on' : ''}" data-crew="${esc(train.trayId)}" ` +
+          `data-tip="${esc(`${train.label} — carrying ${consistWords}`)}">` +
+          `<rect x="${cx}" y="20" width="${chipW}" height="14" rx="3"/>` +
+          `<text x="${cx + chipW / 2}" y="30.5" text-anchor="middle">${esc(chipLabel)}</text></g>`;
       }
     }
-    out += `<text class="bs-coord" x="${W - 5}" y="12" text-anchor="end">${cell.row},${cell.col}</text>`;
 
     /**
      * THE LOAD PIPELINE, on the card itself, DRAWN THE WAY IT FLOWS.
@@ -590,15 +745,19 @@ export function officeSvg(
         ? 'BOARDS + ALIGHTS'
         : f.allowsOut && f.allowsIn ? 'SHIPS + RECEIVES' : f.allowsOut ? 'SHIPS OUT' : 'RECEIVES';
       const flowCls = passenger || (f.allowsOut && f.allowsIn) ? 'bs-flow-both' : f.allowsOut ? 'bs-flow-out' : 'bs-flow-in';
-      out += `<text class="bs-flow ${flowCls}" x="${W - 6}" y="26" text-anchor="end" data-tip="${esc(
-        passenger
-          ? 'Passengers only — no freight is handled here. They wait in a green box, are boarded onto a coach by Porters, and arrive into a red one. There is no MEN | AT | WORK sign because that is a Freight Facility fitting.'
-          : f.allowsOut && f.allowsIn
-            ? 'This industry both ships and receives, so it has green boxes AND red ones: loads leave it on a car, and loads arrive on one.'
-            : f.allowsOut
-              ? 'This industry only SHIPS. A load starts in a green box, is worked along MEN | AT | WORK by Laborers, and comes off onto an empty car spotted on its track. It has no red boxes because nothing arrives here.'
-              : 'This industry only RECEIVES. A loaded car is spotted on its track and Laborers work the load back along WORK | AT | MEN into a red box. It has no green boxes because nothing ships from here.',
-      )}">${esc(flow)}</text>`;
+      // An Office card's roster band now occupies this y-band; its tooltip already folded into the
+      // card's own data-tip above, so the label is not printed twice.
+      if (!isOfficeRoster) {
+        out += `<text class="bs-flow ${flowCls}" x="${W - 6}" y="26" text-anchor="end" data-tip="${esc(
+          passenger
+            ? 'Passengers only — no freight is handled here. They wait in a green box, are boarded onto a coach by Porters, and arrive into a red one. There is no MEN | AT | WORK sign because that is a Freight Facility fitting.'
+            : f.allowsOut && f.allowsIn
+              ? 'This industry both ships and receives, so it has green boxes AND red ones: loads leave it on a car, and loads arrive on one.'
+              : f.allowsOut
+                ? 'This industry only SHIPS. A load starts in a green box, is worked along MEN | AT | WORK by Laborers, and comes off onto an empty car spotted on its track. It has no red boxes because nothing arrives here.'
+                : 'This industry only RECEIVES. A loaded car is spotted on its track and Laborers work the load back along WORK | AT | MEN into a red box. It has no green boxes because nothing ships from here.',
+        )}">${esc(flow)}</text>`;
+      }
 
       /**
        * THE WORKERS, ON THE CARD.
@@ -654,14 +813,15 @@ export function officeSvg(
      * means "ahead" or "behind" is the engine's facing, which the tooltip says in words rather than
      * leaving the player to work out from the compass.
      */
-    const split = cell.train ? Math.max(0, Math.min(cell.cars.length, cell.standingWest ?? 0)) : 0;
+    const hasTrain = cell.trains.length > 0;
+    const split = hasTrain ? Math.max(0, Math.min(cell.cars.length, cell.standingWest)) : 0;
     const shown = Math.min(cell.cars.length, 4);
     for (let i = 0; i < shown; i++) {
       // With no train on the card there is no gap to leave, so the whole cut stays left-aligned.
-      const westOfEngine = cell.train ? i < split : true;
-      const side = !cell.train
+      const westOfEngine = hasTrain ? i < split : true;
+      const side = !selectedTrain
         ? 'standing here'
-        : (cell.train.facing === 'e') === westOfEngine
+        : (selectedTrain.facing === 'e') === westOfEngine
           ? 'standing BEHIND the engine — it would couple onto the tail backing up'
           : 'standing AHEAD of the engine — it would couple onto the nose pulling forward';
       const carTip = `${cell.cars[i]} ${side}`;
@@ -722,17 +882,18 @@ export function officeSvg(
         (cell.enhancementsWhat ?? []).join(' · '),
       )}">${esc(cell.enhancements.join(' · '))}</text>`;
     }
-    if (cell.train) {
+    if (selectedTrain) {
       /**
-       * THE TRAIN, DRAWN AS IT SITS IN THE TRAY.
+       * THE SELECTED TRAIN, DRAWN AS IT SITS IN THE TRAY.
        *
        * The badge used to be a name and nothing more, which makes the switching game unplayable:
        * every decision is about car ORDER — which car comes off next, which end a cut couples onto —
        * and none of it was on the board. Now the engine and its cars are drawn in sequence, nose
        * first, with an arrow for which way the engine points, so "set out the caboose off the back"
-       * is a thing you can see before you choose it.
+       * is a thing you can see before you choose it. Where an Office holds more than one train, only
+       * this one is drawn here — the rest are the roster chips above, each with its own tooltip.
        */
-      const t = cell.train;
+      const t = selectedTrain;
       const items: { label: string; kind: string; what: string }[] = t.cars.map((c) => ({
         label: /caboose/.test(c) ? 'cab' : /hopper/.test(c) ? 'hop' : /boxcar/.test(c) ? 'box'
           : /reefer/.test(c) ? 'rfr' : /tank/.test(c) ? 'tnk' : /coach/.test(c) ? 'cch' : '?',
@@ -783,7 +944,7 @@ export function officeSvg(
     out += `<g data-ghost="${g.row},${g.col}" transform="translate(${px(g.col)},${py(g.row)})" class="bs-ghost">` +
       `<rect x="0" y="0" width="${W}" height="${H}" rx="4"/>` +
       `<text x="${W / 2}" y="${H / 2}" text-anchor="middle">place here</text>` +
-      `<text class="bs-coord" x="${W / 2}" y="${H / 2 + 15}" text-anchor="middle">${g.row},${g.col}</text>` +
+      `<text class="bs-coord" x="${W / 2}" y="${H / 2 + 15}" text-anchor="middle">${g.col},${g.row}</text>` +
       `</g>`;
   }
 
@@ -804,6 +965,22 @@ export function officeSvg(
       `<text x="${W / 2}" y="${H - 36}" text-anchor="middle">${esc(l.label)}</text></g>`;
   }
 
+  /**
+   * THE LIMITS, AS THE EDGE OF THE BUILDABLE DISTRICT.
+   *
+   * Drawn just OUTSIDE the sign's own column, because the sign stands on the boundary rather than
+   * beyond it: a siding may run under the sign, and the line has to agree with the rule or it
+   * teaches the wrong one. It moves outward on its own as the Running Track is extended, which is
+   * the reward for extending made visible.
+   */
+  if (limits) {
+    const edge = (x: number, side: string): string =>
+      `<line class="bs-limitline" x1="${x}" y1="0" x2="${x}" y2="${height}"/>` +
+      `<text class="bs-limitlab" x="${x + (side === 'w' ? 4 : -4)}" y="${height - 4}" ` +
+      `text-anchor="${side === 'w' ? 'start' : 'end'}">LIMITS</text>`;
+    out += edge(px(limits.west) - PAD / 2, 'w') + edge(px(limits.east) + W + PAD / 2, 'e');
+  }
+
   // Mark the Running Track so the spine of the district is unmistakable.
   out += `<text class="bs-rowlab" x="2" y="${py(runningRow) + 92}">RUNNING TRACK</text>`;
   out += '</svg>';
@@ -874,10 +1051,16 @@ export const BOARD_CSS = `
 .bs-tcar.bs-t-mt{fill:#6b5a2e}
 .bs-tcar.bs-t-eng{fill:#2b2313;stroke:#e0c060;stroke-width:1.4}
 .bs-tcarlab{font:8px ui-monospace,monospace;fill:#2b2313;font-weight:700}
-/* One pip per A/D track, filled when a train is holding on it. A full Office is why the next
-   arrival collides, so this is the count worth seeing without hovering. */
-.bs-ad{fill:none;stroke:#4d6fa8;stroke-width:1.2}
-.bs-ad.bs-occ{fill:#5aa9e6;stroke:#8fc4ee}
+/* One chip per A/D track, not one per train — a full Office is why the next arrival collides, so
+   the count is worth seeing without hovering, and a free track reads "free" rather than vanishing.
+   The selected train's chip is lit the same amber the crew strip and action buttons use. */
+.bs-adchip rect{fill:#20262e;stroke:#4a5361;stroke-width:1}
+.bs-adchip text{fill:#cfd6e0;font:600 8px ui-monospace,monospace}
+.bs-adchip.on rect{fill:#8a6d1f;stroke:#e0c060;stroke-width:1.4}
+.bs-adchip.on text{fill:#fff4d6}
+.bs-adchip.mt rect{fill:none;stroke:#3d4650;stroke-dasharray:3 2}
+.bs-adchip.mt text{fill:#6b7480}
+.bs-adchip[data-crew]{cursor:pointer}
 .bs-t-mt + .bs-tcarlab,.bs-t-eng + .bs-tcarlab{fill:#f0e6cf}
 .bs-tlab{fill:#eaf6ec;font:600 11px ui-monospace,monospace}
 /* The three letters sit ON the slot, so they invert with it: dark on a loaded car's solid face,
@@ -914,6 +1097,10 @@ export const BOARD_CSS = `
 text.bs-mod{fill:#c8a04a}
 .bs-enh{fill:#7fb0e6;font:9px ui-monospace,monospace}
 .bs-rowlab{fill:#5f6b7a;font:600 9px ui-monospace,monospace;letter-spacing:.1em}
+/* THE EDGE OF THE DISTRICT. Deliberately quiet — it is a boundary, not an action — and dashed, so it
+   reads as a line on the table rather than as rail. Nothing is laid outside it (§2.1). */
+.bs-limitline{stroke:#5f6b7a;stroke-width:1.5;stroke-dasharray:3 5;opacity:.7}
+.bs-limitlab{fill:#5f6b7a;font:600 8px ui-monospace,monospace;letter-spacing:.12em}
 .bs-ghost rect{fill:rgba(90,169,230,.07);stroke:#5aa9e6;stroke-width:2;stroke-dasharray:5 4}
 .bs-ghost text{fill:#5aa9e6;font:11px ui-monospace,monospace}
 /* The caption on a legal square that already carries a card. Same blue as the ghost squares and the
@@ -924,10 +1111,17 @@ text.bs-mod{fill:#c8a04a}
 .bs-ghost,g[data-cell].bs-legal{cursor:pointer}
 g[data-cell].bs-legal .bs-card{stroke:#5aa9e6;stroke-width:2.5}
 g[data-cell].bs-legal:hover .bs-card,.bs-ghost:hover rect{fill:#233246}
+/* THE SQUARE THE ACTION UNDER THE CURSOR MEANS. White, and brighter than anything else the board
+   marks, because it answers a question being asked RIGHT NOW rather than describing a standing
+   state — and it has to win when it lands on a square that is already legal, focused or blocked. */
+g[data-cell].bs-point .bs-card,g[data-ghost].bs-point rect{stroke:#f2f5f8;stroke-width:3.5;stroke-dasharray:none}
+g[data-cell].bs-point .bs-card{fill:#2b3b52}
 /* WHERE THE CREW CAN GO. Amber, the colour this game spends on "you can do this", so a reachable
-   card reads the same way an action button does. bs-from is where it is standing now. */
+   card reads the same way an action button does. bs-from is where it is standing now — marked on
+   the crew STRIP rather than the whole card, because the Office is the one square where a second
+   train may share that card: outlining the card would claim it belongs to both. */
 g[data-cell].bs-focus .bs-card{stroke:#e0c060;stroke-width:2.5}
-g[data-cell].bs-from .bs-card{stroke:#7a6a3a;stroke-width:2;stroke-dasharray:4 3}
+.bs-crew.bs-from rect:first-of-type{stroke:#7a6a3a;stroke-width:2;stroke-dasharray:4 3}
 /* AND WHERE IT CANNOT. Muted red with a barred face — a card that is refusing traffic, not one that
    is merely uninteresting. The reason rides on the card's own tooltip. */
 g[data-cell].bs-blocked .bs-card{stroke:#8a5a5a;stroke-width:2;stroke-dasharray:2 3}

src/sim/compare.ts

@@ -31,6 +31,12 @@
 
 import { pump } from '../engine/advance.ts';
 import { createGame } from '../engine/setup.ts';
+import {
+  DEFAULT_MAX_COLLISIONS_PER_DAY,
+  DEFAULT_MAX_COLLISIONS_TOTAL,
+  collectiveRevenueFloor,
+  lengthProfile,
+} from '../engine/content.ts';
 import type { GameLength } from '../engine/content.ts';
 import type { GameConfig, GameMode } from '../engine/state.ts';
 import type { BotPolicy, BotTweaks } from './bot.ts';
@@ -56,17 +62,24 @@ export type PairedResult = {
   variantStats: GameStats[];
 };
 
-const SOLO = (length: GameLength, mode: GameMode): GameConfig => ({
-  mode,
-  victory: 'highestAfterDays',
-  length,
-  optionalRules: {
-    reducedVisibility: false,
-    sisterTrains: false,
-    employeeRotation: false,
-    emergencyToolbox: false,
-  },
-});
+// Always one bot (`runOne` below), so the revenue floor is `collectiveRevenueFloor(1, days)`.
+const SOLO = (length: GameLength, mode: GameMode): GameConfig => {
+  const days = lengthProfile(length).days;
+  return {
+    mode,
+    days,
+    minCombinedRevenue: collectiveRevenueFloor(1, days),
+    maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
+    maxCollisionsTotal: DEFAULT_MAX_COLLISIONS_TOTAL,
+    pvpCardsAllowed: false,
+    optionalRules: {
+      reducedVisibility: false,
+      sisterTrains: false,
+      employeeRotation: false,
+      emergencyToolbox: false,
+    },
+  };
+};
 
 /**
  * One game, one seed, one policy.

src/sim/frame-delta.ts

@@ -0,0 +1,53 @@
+/**
+ * Live per-seat Frame delta — Phase 2 of `docs/architecture/multiplayer.md`.
+ *
+ * `src/sim/replay.ts`'s `compress()` looked like the thing to reuse here (D2/D3's "2.9 KB per push
+ * with the board omitted when unchanged" cites it) but it solves a different problem: it interns
+ * card/description strings across a WHOLE recorded array of frames, which only pays off when
+ * bundling many frames into one replay file. A live server pushes one frame at a time and has
+ * nothing to intern against. The part that genuinely carries over is much smaller — a one-step-back
+ * "null if unchanged since the last thing sent to THIS seat" check on the three fields that make up
+ * almost all of a Frame's size: `cells`, `facilities`, `division` (`replay.ts`'s own `keys` array).
+ *
+ * Node-free by design, unlike `replay.ts` (which imports `node:fs`) — both the server and a browser
+ * `RemoteSession` import this file directly.
+ */
+
+import type { CellView, DivisionView, FacilityView, Frame } from './view.ts';
+
+/** A `Frame` with the three board-shaped fields replaced by `null` where unchanged since `previous`. */
+export type FrameDelta = Omit<Frame, 'cells' | 'facilities' | 'division'> & {
+  cells: CellView[] | null;
+  facilities: FacilityView[] | null;
+  division: DivisionView[] | null;
+};
+
+const BOARD_KEYS = ['cells', 'facilities', 'division'] as const;
+
+/**
+ * `previous` is the last Frame actually sent to THIS seat, or `null` for a first connect / a
+ * reconnect after a gap — Phase 2 has no persistence to replay a gap against (Phase 3), so a
+ * reconnect always gets a full Frame here rather than a delta.
+ */
+export function deltaFrame(previous: Frame | null, next: Frame): FrameDelta {
+  const out = { ...next } as unknown as FrameDelta;
+  for (const key of BOARD_KEYS) {
+    const unchanged = previous !== null && JSON.stringify(previous[key]) === JSON.stringify(next[key]);
+    (out as Record<string, unknown>)[key] = unchanged ? null : next[key];
+  }
+  return out;
+}
+
+/** The receiving side: merges a delta back onto the last full Frame this seat actually has. */
+export function applyDelta(previous: Frame | null, delta: FrameDelta): Frame {
+  const out = { ...delta } as unknown as Frame;
+  for (const key of BOARD_KEYS) {
+    if (delta[key] === null) {
+      if (previous === null) {
+        throw new Error(`deltaFrame said "${key}" is unchanged, but there is no previous Frame to merge onto`);
+      }
+      (out as Record<string, unknown>)[key] = previous[key];
+    }
+  }
+  return out;
+}

src/sim/harness.ts

@@ -12,7 +12,12 @@
  */
 
 import { pump } from '../engine/advance.ts';
-import { collectiveRevenueFloor, lengthProfile } from '../engine/content.ts';
+import {
+  DEFAULT_MAX_COLLISIONS_PER_DAY,
+  DEFAULT_MAX_COLLISIONS_TOTAL,
+  collectiveRevenueFloor,
+  lengthProfile,
+} from '../engine/content.ts';
 import { createGame } from '../engine/setup.ts';
 import type { GameLength } from '../engine/content.ts';
 import type { GameConfig, GameMode } from '../engine/state.ts';
@@ -60,11 +65,15 @@ function statsOf(xs: number[]): Stats {
   };
 }
 
-function configFor(mode: GameMode, length: GameLength): GameConfig {
+function configFor(mode: GameMode, length: GameLength, players: number): GameConfig {
+  const days = lengthProfile(length).days;
   return {
     mode,
-    victory: 'highestAfterDays',
-    length,
+    days,
+    minCombinedRevenue: collectiveRevenueFloor(players, days),
+    maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
+    maxCollisionsTotal: DEFAULT_MAX_COLLISIONS_TOTAL,
+    pvpCardsAllowed: false,
     optionalRules: {
       reducedVisibility: false,
       sisterTrains: false,
@@ -83,7 +92,7 @@ export function simulate(opts: SimOptions): SimReport {
     const s = createGame({
       id: `sim-${i}`,
       seed,
-      config: configFor(opts.mode, opts.length),
+      config: configFor(opts.mode, opts.length, opts.players.length),
       playerNames: opts.players,
     });
     // The probe watches the game as it is played: the funnel gates are conditions at a moment, not
@@ -154,7 +163,7 @@ export function formatReport(r: SimReport, length: GameLength, players: number):
 
   // The provisional numbers this exists to test.
   out.push('\n  against the provisional targets:');
-  out.push(`    target ${profile.target} over ${profile.days} Days`);
+  out.push(`    ${profile.days} Days`);
   out.push(
     `    predicted ~5-6 revenue/player/Day steady state; observed mean ` +
       `${r.revenuePerPlayerPerDay.mean.toFixed(1)}`,

src/sim/narrate.ts

@@ -126,10 +126,13 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
               : 'Chose FREIGHT AGENT work — one car moved to or from a facility',
       };
     case 'trayMoved':
+      // `via` rides on the event only when there was another legal route to the same square
+      // (docs/plans/switching-paths.md) — so naming it here says which one the crew actually took,
+      // rather than leaving a real choice invisible in the crew's own history.
       return {
         tone: 'plain',
         where: e.to,
-        text: `CREW moved ${at(e.from)} → ${at(e.to)} — ${e.movesRemaining} of 6 Moves left. The crew chip on the grid carries the whole train with it.`,
+        text: `CREW moved ${at(e.from)} → ${at(e.to)}${e.via ? ` via ${at(e.via)}` : ''} — ${e.movesRemaining} of 6 Moves left. The crew chip on the grid carries the whole train with it.`,
       };
     case 'carsCoupled': {
       /**
@@ -277,25 +280,25 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
       };
     case 'trainArrived':
       /**
-       * AN EXPEDITED TRAIN IS NOT COMING BACK ROUND — AND IS NOT GONE YET EITHER.
+       * AN EXPEDITED ARRIVAL IS AN ORDINARY ARRIVAL, WITH ONE STANDING OBLIGATION.
        *
-       * This said "it will highball again next Mainline Phase" to every arrival, which is backwards
-       * for an Expedited train. Corrected once to "it leaves again this same Mainline Phase", which
-       * was ALSO wrong and in a way that cost the player work: the expedited departure was moved to
-       * Supervisor Shift precisely so the Porters and Laborers get their Stage with the train, so
-       * Cargo IS available and only Local Operations is not. Telling a player there is "no turn in
-       * which to work it" talked them out of the one turn they had.
-       *
-       * So both branches now name the phases: what you can still do with this train, and when it
-       * goes. That is the whole of the reported confusion — "some trains seem to be moving before I
-       * can switch or do other operations on them".
+       * This used to say the train stands through Cargo and is forced out at the end of the Stage —
+       * true once, and wrong: Q3 means the train must not be PARKED anywhere but the station, not
+       * that it is rushed out early. It is switched, worked and released exactly like any other
+       * arrival; the only difference is what happens if it is left on Secondary Track when the next
+       * Mainline Phase begins (`expediteFault`).
        */
       return {
         tone: 'plain',
         text: e.expedited
-          ? `Train ${e.trainNumber} ARRIVED at the ${e.office} carrying ${carsLabel(e.consist)} — its card prints EXPEDITE, so it stands through the Cargo phase and departs at the END OF THIS STAGE. Porters and Laborers can work it now; it is normally gone before your next Local Operations turn, so it cannot be switched — unless §8.1 holds it for a ruling, in which case it stays and runs like any other train.`
+          ? `Train ${e.trainNumber} ARRIVED at the ${e.office} carrying ${carsLabel(e.consist)} — its card prints EXPEDITE, so keep it on the Office square: parked anywhere else in the district when the next Mainline Phase begins costs a Revenue point. It works and switches normally in the meantime.`
           : `Train ${e.trainNumber} ARRIVED at the ${e.office} carrying ${carsLabel(e.consist)} — it stands here for the rest of this Stage. You can work it in Cargo now, switch it in the NEXT Stage's Local Operations, and it departs in that Stage's Mainline Phase.`,
       };
+    case 'expediteFault':
+      return {
+        tone: 'bad',
+        text: `Train ${e.trainNumber} was left at ${e.where}, off the station, when the Mainline Phase began — an expedited train must be kept ready to highball. Station Master fault.`,
+      };
     case 'trainDiverted':
       return {
         tone: 'good',
@@ -579,7 +582,7 @@ export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[]
         // the board says it on the card instead.
         if (b.kind === 'noStopping') continue;
         out.push({
-          where: `${tray.trainNumber === null ? 'crew' : `Train ${tray.trainNumber}`} → (${b.coord.row},${b.coord.col})`,
+          where: `${tray.trainNumber === null ? 'crew' : `Train ${tray.trainNumber}`} → (${b.coord.col},${b.coord.row})`,
           why: b.why,
           // Not "stuck": these are the shape of the district and of the other trains in it, which is
           // the puzzle rather than a fault. Amber, not red.
@@ -599,12 +602,10 @@ export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[]
    * said so.
    *
    * Reported again as "passenger trains arrive at my Office and move on before I can load or unload
-   * them", which turned out to be three separate silences. This block only looked at trains carrying
+   * them", which turned out to be two separate silences. This block only looked at trains carrying
    * a LOADED coach, so a train arriving to PICK UP said nothing at all. A Whistle Post's Office card
    * carries a passenger facility with zero Porters, so the engine answered `RESOURCE_SPENT` — "all
-   * Porters used" — to a player who had used none. And an expedited train leaves at the end of the
-   * Stage it arrives, so its one Load/Unload phase is now-or-never and nothing said which trains
-   * those are.
+   * Porters used" — to a player who had used none.
    *
    * §9.2 also requires an empty coach in the DIVISION YARD to swap into the train, which no panel
    * mentioned at all.
@@ -617,8 +618,6 @@ export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[]
       .filter((t): t is NonNullable<typeof t> => !!t && t.consist.some((c) => c.type === 'coach'));
 
     if (coachTrains.length > 0) {
-      const label = (t: (typeof coachTrains)[number]): string =>
-        t.trainNumber === null ? 'the local crew' : `Train ${t.trainIsExtra ? 'X' : ''}${t.trainNumber}`;
       const say = (why: string, severity: Impediment['severity'] = 'waiting'): void => {
         out.push({ where: 'Office — passengers', why, severity });
       };
@@ -655,17 +654,6 @@ export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[]
           say('no EMPTY coach in the Division Yard to swap into the train (§9.2 requires one)');
         }
       }
-
-      // NOW OR NEVER. An expedited train leaves at the end of this Stage, so this is the only
-      // Load/Unload phase it will ever stand for — the exact thing the playtest report was about.
-      for (const t of coachTrains) {
-        if (!t.departsThisStage) continue;
-        say(
-          `${label(t)} is EXPEDITED — it leaves at the END of this Stage, so this is the only ` +
-            'Load/Unload phase it will stand for. Work it now or not at all.',
-          'risk',
-        );
-      }
     }
   }
 
@@ -745,6 +733,15 @@ export function cuesFor(events: readonly GameEvent[]): string[] {
     // A train running the whole length of the Division pays every player, and it is the one event
     // nobody made happen on the turn it lands. It should be heard, not found in the log.
     if (e.type === 'trainCompleted') out.push('completed');
+    // A train pulling into an Office. `trainDiverted` (the Yard Office siding) is deliberately not
+    // included — that one goes straight to a work track without the A/D stop `arrive` depicts.
+    if (e.type === 'trainArrived') out.push('arrive');
+    // Only an OFFICE departure, not every highball: a fresh make-up leaving a Division Point already
+    // sounds `train` ("All aboard"), and a train clearing the whole Division already sounds
+    // `completed` — this is the one case neither of those covers.
+    if (e.type === 'trainHighballed' && e.from === 'the Office') out.push('depart');
+    // §10 — the one event nobody wants to hear and everybody needs to.
+    if (e.type === 'trainsDestroyed') out.push('crash');
     if (e.type === 'stageBegan') {
       // A Stage BEGINNING is the previous one ending — except the first, which is the game opening
       // and has nothing behind it. A Day boundary rings the bell only: sounding both would collide,

src/sim/replay.ts

@@ -21,7 +21,14 @@ import { writeFileSync } from 'node:fs';
 import { advance } from '../engine/advance.ts';
 import { applyIntent, areaOf, facilityCarType, laborersLeft, portersLeft } from '../engine/apply.ts';
 import type { GameLength } from '../engine/content.ts';
-import { MAINLINE_PROFILES, lengthProfile, officeProfile } from '../engine/content.ts';
+import {
+  DEFAULT_MAX_COLLISIONS_PER_DAY,
+  DEFAULT_MAX_COLLISIONS_TOTAL,
+  MAINLINE_PROFILES,
+  collectiveRevenueFloor,
+  lengthProfile,
+  officeProfile,
+} from '../engine/content.ts';
 import type { GameEvent } from '../engine/events.ts';
 import type { Intent } from '../engine/intents.ts';
 import { legalActions } from '../engine/legal.ts';
@@ -51,10 +58,14 @@ import { playCue } from '../web/sound.ts';
 export type Recording = { seed: number; length: GameLength; frames: Frame[]; outcome: string };
 
 export function record(seed: number, length: GameLength, maxSteps = 100_000): Recording {
+  const days = lengthProfile(length).days;
   const config: GameConfig = {
     mode: 'solitaire',
-    victory: 'highestAfterDays',
-    length,
+    days,
+    minCombinedRevenue: collectiveRevenueFloor(1, days),
+    maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
+    maxCollisionsTotal: DEFAULT_MAX_COLLISIONS_TOTAL,
+    pvpCardsAllowed: false,
     optionalRules: {
       reducedVisibility: false,
       sisterTrains: false,
@@ -202,9 +213,9 @@ export function compress(frames: Frame[]): Packed {
       // Identity, not equality: `snapshot` pushes the very same FacilityView object into both the
       // cell and the frame's `facilities`, so this always resolves.
       const fi = c.facility ? f.facilities.indexOf(c.facility) : -1;
-      // `train` rides whole rather than being interned: it changes almost every frame, so a table
+      // `trains` rides whole rather than being interned: it changes almost every frame, so a table
       // of them would be as long as the frames are and buy nothing.
-      return [ci, wi, c.enhancements, c.tray, c.cars, fi, c.train, c.ad, c.enhancementsWhat, c.standingWest];
+      return [ci, wi, c.enhancements, c.cars, fi, c.trains, c.adTracks, c.enhancementsWhat, c.standingWest];
     });
     return { ...f, cells } as unknown as Frame;
   });
@@ -238,27 +249,32 @@ export function rehydrateCells(
   facs: unknown[],
 ): unknown[] {
   return packed.map((row) => {
-    const p = row as [number, number, string[], string | null, string[], number, unknown, unknown, string[], number];
+    const p = row as [number, number, string[], string[], number, unknown, unknown, string[], number];
     const c = cards[p[0]] as [number, number, string, string, boolean, string[]];
+    // Tolerant the same way `standingWest` below is: an array rides through as-is, a lone object
+    // (an older recording's singular `train`) is wrapped into a one-train roster, and null or
+    // undefined reads as no train at all.
+    const rawTrains = p[5];
+    const trains = Array.isArray(rawTrains) ? rawTrains : rawTrains ? [rawTrains] : [];
     return {
       row: c[0], col: c[1], kind: c[2], label: c[3], running: c[4], links: c[5],
-      what: whats[p[1]], enhancements: p[2], tray: p[3], cars: p[4],
-      facility: p[5] < 0 ? null : facs[p[5]],
-      train: p[6] ?? null,
-      ad: p[7] ?? null,
+      what: whats[p[1]], enhancements: p[2], cars: p[3],
+      facility: p[4] < 0 ? null : facs[p[4]],
+      trains,
+      adTracks: (p[6] as number | undefined) ?? null,
       // Carried rather than recomputed: this function is emitted into the page by toString() and so
       // cannot reach the card catalogue that produced the text.
-      enhancementsWhat: p[8] ?? [],
-      // Where the train on this card stands among the cars standing on it, so the replay draws a cut
-      // ahead of or behind the engine exactly as the live board does. Absent in older recordings,
+      enhancementsWhat: p[7] ?? [],
+      // Where the train(s) on this card stand among the cars standing on it, so the replay draws a
+      // cut ahead of or behind the engine exactly as the live board does. Absent in older recordings,
       // which read as 0 — the whole cut east of the engine, which is what they used to draw anyway.
-      standingWest: p[9] ?? 0,
+      standingWest: p[8] ?? 0,
     };
   });
 }
 
 export function renderHtml(rec: Recording): string {
-  const target = lengthProfile(rec.length);
+  const profile = lengthProfile(rec.length);
   return `<!doctype html>
 <html lang="en"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
@@ -355,7 +371,7 @@ kbd{background:#2a3038;border:1px solid var(--line);border-radius:3px;padding:0
 </style></head><body>
 
 <header>
-  <h1>Station Master — replay · seed ${rec.seed} · ${rec.length} (target ${target.target} over ${target.days} Days) · ${esc(rec.outcome)}</h1>
+  <h1>Station Master — replay · seed ${rec.seed} · ${rec.length} (${profile.days} Days) · ${esc(rec.outcome)}</h1>
   <div class="bar">
     <span class="dim">fedora <span id="super">—</span></span>
     <span>revenue <b class="big" id="rev">0</b></span>
@@ -499,7 +515,7 @@ function render() {
 
   $('division').innerHTML = divisionSvg(DIV);
   // The same office renderer the playable app uses, so replay and game draw one board.
-  $('grid').innerHTML = officeSvg(CELLS, f.runningRow);
+  $('grid').innerHTML = officeSvg(CELLS, f.runningRow, [], [], f.limits);
 
   /* Auto-hide: the district is worth its space during the phases that change it, and folded
      otherwise. A summary stays, because a panel that vanishes reads as broken. */

src/sim/view.ts

@@ -19,10 +19,12 @@ import {
   movesFor,
   ownCutFor,
   portersLeft,
+  selectDestination,
 } from '../engine/apply.ts';
 import {
   ACTION_CARDS,
   ENHANCEMENT_CARDS,
+  HAND_LIMIT,
   MAINLINE_MODIFIER_CARDS,
   MAINLINE_PROFILES,
   MANEUVER_CARDS,
@@ -36,14 +38,13 @@ import {
   industryProfile,
   mainlineProfile,
   modifierProfile,
-  lengthProfile,
   officeProfile,
   trainProfile,
   houseRules,
   mainlineDescription,
 } from '../engine/content.ts';
 import type { Intent } from '../engine/intents.ts';
-import type { Facility, GameState, PlayerIndex, TrackCard, TurnoutOrientation } from '../engine/state.ts';
+import type { Facility, GameState, PlayerIndex, SeatIndex, TrackCard, TurnoutOrientation } from '../engine/state.ts';
 import { carsOn, playerAtSeat, railFacingOf, seatOf, turnOf } from '../engine/state.ts';
 import type { Hand, HouseRules, TrackGeometry } from '../engine/content.ts';
 import type { Port } from '../engine/track.ts';
@@ -70,19 +71,25 @@ export type CellView = {
    * `toString()`), so it cannot reach the card catalogue itself.
    */
   enhancementsWhat: string[];
-  tray: string | null;
   /**
-   * THE TRAIN STANDING HERE, in order, with the engine in it and which way it points.
+   * EVERY TRAIN STANDING HERE, in order, each with the engine in it and which way it points.
    *
    * The switching game is entirely about car ORDER — which car is next to come off, which end a cut
    * couples onto — and the board showed a crew badge with a name and nothing else. A player could
    * not plan a move at all: "drop 1 car" tells you nothing when you cannot see what is on the back.
    *
+   * An ARRAY because the Office square is the one place more than one train may legally stand at
+   * once (docs/plans/switching-paths.md — "The Roster Pass"): the old singular `train` field only
+   * ever showed whichever tray `s.trays` happened to yield first, so a second train at a busy
+   * Station was never drawn at all, only counted in the A/D pips. Empty, not absent, when the card
+   * is bare, so callers never need an `?? []`.
+   *
    * `cars` runs nose first, matching the tray; `engineAt` is where the locomotive sits in it, and
    * `facing` is which way the engine points — EAST OR WEST, never north or south, whatever the
    * track under it runs. See `railFacingOf` in state.ts for why, and why the type says so.
    */
-  train: {
+  trains: {
+    trayId: string;
     label: string;
     cars: string[];
     engineAt: number;
@@ -95,26 +102,31 @@ export type CellView = {
      * standing in front of them — the card is face down in a box somewhere by then.
      */
     what: string;
-  } | null;
+  }[];
   /**
-   * Office card only: A/D tracks taken and how many the tier has.
+   * Office card only: how many A/D tracks the tier has — null everywhere else.
    *
-   * The tooltip said "3 A/D tracks" and the card showed nothing, so the number that decides whether
-   * the next arrival collides was invisible on the card it belongs to. Drawn as pips rather than
-   * extra rails — there is no room on the card for more track, and the count is what matters.
+   * Capacity, not occupancy: `board-svg.ts` draws one roster chip per track regardless of how many
+   * are taken (a free one reads "free"), so occupancy is implicit in how many of `trains` land on
+   * it. Used to carry `{used, of}` and draw one pip per track; the pips are gone (the roster band
+   * takes their place) but the count is still needed to know how many chips to lay out.
    */
-  ad: { used: number; of: number } | null;
+  adTracks: number | null;
   cars: string[];
   /**
-   * Cars in `cars` that stand WEST of the train on this card — 0 when no train is here.
+   * Cars in `cars` that stand WEST of the train(s) here — 0 when no train is here, and unsplit if
+   * so: with nobody standing on the card, a cut has no near or far side and the whole row simply
+   * reads west to east (`board-svg.ts` draws the split only while `trains.length > 0`).
    *
    * `cars` runs west to east like the state it comes from, and a train standing on the card sits
    * somewhere IN that row rather than beside it. Reported from play: "right after dropping my cars I
    * need to be able to see if those cars are ahead or behind the train" — and the board drew the
    * whole cut in one left-aligned strip at the bottom of the card, which cannot answer that at all.
    *
-   * Combined with `train.facing` it is the answer: for an east-facing engine the cars east of it are
-   * the ones ahead, and the split is drawn as a gap the chip sits in.
+   * Combined with a train's `facing` it is the answer: for an east-facing engine the cars east of it
+   * are the ones ahead. ONE number for the whole card — every train standing here (there is at most
+   * one, except the Office) reads the same split, taken against the block of A/D tracks rather than
+   * against any one engine, straight off `TrackCard.standingWest`.
    */
   standingWest: number;
   facility: FacilityView | null;
@@ -336,6 +348,18 @@ export type Frame = {
    * must be able to answer. Resolved, never partial, so nobody downstream re-applies defaults.
    */
   houseRules: HouseRules;
+  /**
+   * The victory-condition dials this game was configured with (`GameConfig`, `state.ts`), plus the
+   * running collision counts — same reasoning as `houseRules`: a remote client holds no `GameState`
+   * and needs to show live progress ("2 of 3 collisions today") without guessing a default. `0` on
+   * any `max*`/`minCombinedRevenue` field means that check is off.
+   */
+  days: number;
+  minCombinedRevenue: number;
+  maxCollisionsPerDay: number;
+  maxCollisionsTotal: number;
+  collisionsToday: number;
+  collisionsTotal: number;
   status: GameState['status'];
   outcome: GameState['outcome'];
   /**
@@ -348,6 +372,13 @@ export type Frame = {
   players: { index: number; seat: number; name: string; revenue: number; hand: number }[];
   /** How many cards the VIEWER holds. Other players' counts are in `players`. */
   handCount: number;
+  /**
+   * True when the VIEWER's hand is over §6.2's limit and their turn cannot end until it is played
+   * down. Duplicates `game.ts`'s `overHandLimit(game, seat)` at the engine-data level rather than
+   * importing the web layer here — a `RemoteSession` (Phase 2) has no `GameState` to compute this
+   * from, only a `Frame`, so it has to already be resolved on the wire.
+   */
+  overHandLimit: boolean;
   lines: { text: string; tone: string }[];
   where: { row: number; col: number } | null;
   /** Origin of a Move, so the crew's journey is visible rather than a chip teleporting. */
@@ -356,6 +387,15 @@ export type Frame = {
   cells: CellView[];
   /** Which grid row is the Running Track — the spine the district hangs beneath. */
   runningRow: number;
+  /**
+   * The columns the Limits signs stand in — the district's east and west edges, at EVERY row.
+   *
+   * Track may not be laid outside them (§2.1), so a player looking at open ground beyond a sign is
+   * looking at ground no card of his will ever go on. Two signs on one row could not say that; the
+   * board draws the boundary down the whole district instead. Carried on the Frame rather than read
+   * off the area for the usual reason: a remote client holds no `GameState`.
+   */
+  limits: { west: number; east: number };
   /**
    * Moves left in this Local Operations turn, or null outside a switching turn.
    *
@@ -581,29 +621,31 @@ function baseOf(
  * Zero when there is no train, which is also the right answer for a bare cut: with nobody standing
  * there, a cut has no near or far side and the whole row simply reads west to east.
  */
-function standingWestOn(s: GameState, key: string, cars: number): number {
-  for (const t of s.trays.values()) {
-    if (t.position.at !== 'grid') continue;
-    if (`${t.position.coord.row},${t.position.coord.col}` !== key) continue;
-    return Math.max(0, Math.min(cars, t.standingWest ?? 0));
-  }
-  return 0;
-}
-
-function trainOnCard(s: GameState, key: string): CellView['train'] {
+/**
+ * Every train standing on this card, for THIS viewer's seat.
+ *
+ * KEYED BY COORDINATE, so it must be filtered by seat first — every district uses the same (row,
+ * col) origin, so without the seat check a crew standing at (0,1) in one player's Office Area would
+ * be drawn onto (0,1) of every other player's board too. Collects every match rather than returning
+ * on the first: the Office square is the one place more than one train may legally stand at once
+ * (docs/plans/switching-paths.md), and the old singular version silently drew only whichever tray
+ * `s.trays` happened to yield first.
+ */
+function trainsOnCard(s: GameState, viewerSeat: SeatIndex, key: string): CellView['trains'] {
+  const out: CellView['trains'] = [];
   for (const [id, t] of s.trays) {
-    if (t.position.at !== 'grid') continue;
+    if (t.position.at !== 'grid' || t.position.seat !== viewerSeat) continue;
     if (`${t.position.coord.row},${t.position.coord.col}` !== key) continue;
-    return {
+    out.push({
+      trayId: id,
       label: t.trainNumber === null ? 'crew' : `T${t.trainIsExtra ? 'X' : ''}${t.trainNumber}`,
       cars: t.consist.map(carLabel),
       engineAt: Math.max(0, Math.min(t.consist.length, t.engineAt)),
       facing: railFacingOf(t),
       what: t.trainNumber === null ? 'A local crew — no timetable, no card, no special rules.' : trainRules(t),
-    };
-    void id;
+    });
   }
-  return null;
+  return out;
 }
 
 /** Is a car spotted that a load on WORK could actually come off onto (§9.3)? */
@@ -655,7 +697,8 @@ function sampleDetail(s: GameState, kind: string, list: Intent[]): string {
 
 /** One readable line for a single intent. */
 export function describeIntent(s: GameState, i: Intent): string {
-  const at = (c: { row: number; col: number }): string => `(${c.row},${c.col})`;
+  // X,Y — east/west then north/south, not the internal row/col storage order.
+  const at = (c: { row: number; col: number }): string => `(${c.col},${c.row})`;
   // An intent belongs to whoever is acting, so it is described against THEIR district.
   // The acting PLAYER, not a seat — `describeIntent` describes an intent against the district of
   // whoever is making it. Named `seat` once, and then used as an `officeAreas` key, which is the
@@ -727,9 +770,19 @@ export function describeIntent(s: GameState, i: Intent): string {
       const tray = s.trays.get(i.trayId);
       const here = tray?.position.at === 'grid' ? tray.position.coord : null;
       let picks = '';
+      let routeNote = '';
       if (here) {
-        const dest = destinationsFor(s, tray!.position.at === 'grid' ? playerAtSeat(s, tray!.position.seat) : 0, i.trayId, here, i.reverse)
-          .find((d) => d.coord.row === i.to.row && d.coord.col === i.to.col);
+        const dests = destinationsFor(s, tray!.position.at === 'grid' ? playerAtSeat(s, tray!.position.seat) : 0, i.trayId, here, i.reverse);
+        const dest = selectDestination(dests, i.to, i.via);
+        // Two routes to the same square (docs/plans/switching-paths.md) would otherwise print the
+        // identical button twice — "move to (0,0)" and "move to (0,0)" — and the action list drops
+        // duplicate labels, silently discarding the second choice. `via` is the one thing that
+        // differs in the DATA, so it is the one thing safe to print without guessing at scenery
+        // this function has no other reason to know the name of.
+        const atSameSquare = dests.filter((d) => d.coord.row === i.to.row && d.coord.col === i.to.col);
+        if (dest && i.via && atSameSquare.length > 1) {
+          routeNote = ` via ${at(i.via)}`;
+        }
         if (dest && dest.couples.length > 0) {
           /**
            * NAME THE CARS THE CREW SET OUT HERE SEPARATELY. They are at the front of `couples` — the
@@ -747,7 +800,7 @@ export function describeIntent(s: GameState, i: Intent): string {
               : ` — couples ${carsLabel(dest.couples)} on the way${end}`;
         }
       }
-      return `move to ${at(i.to)}${i.reverse ? ' (reverse)' : ''}${picks}`;
+      return `move to ${at(i.to)}${routeNote}${i.reverse ? ' (reverse)' : ''}${picks}`;
     }
     case 'switch.dropCars': {
       /**
@@ -955,18 +1008,6 @@ export function snapshot(
 ): Frame {
   const area = areaOf(s, viewer);
   const viewerSeat = seatOf(s, viewer);
-  const trayAt = new Map<string, string>();
-  for (const [id, tray] of s.trays) {
-    // KEYED BY COORDINATE, so it must be filtered by seat first. Every district uses the same
-    // (row, col) origin, so without this a crew standing at (0,1) in one player's Office Area is
-    // drawn onto (0,1) of every other player's board — the cells come from `area.grid`, which is
-    // the viewer's, but the train on them came from anybody's.
-    if (tray.position.at === 'grid' && tray.position.seat === viewerSeat) {
-      const label = tray.trainNumber === null ? 'crew' : `T${tray.trainIsExtra ? 'X' : ''}${tray.trainNumber}`;
-      const carrying = tray.consist.length ? ` [${tray.consist.map(carLabel).join(', ')}]` : ' [empty]';
-      trayAt.set(`${tray.position.coord.row},${tray.position.coord.col}`, label + carrying);
-    }
-  }
 
   const cells: CellView[] = [];
   const facilities: FacilityView[] = [];
@@ -998,14 +1039,10 @@ export function snapshot(
       links: connectionsFor(card).map(([a, b]) => `${a}${b}`),
       enhancements: card.enhancements.map(prettyKey),
       enhancementsWhat: card.enhancements.map((k) => enhancementText(k) ?? prettyKey(k)),
-      tray: trayAt.get(key) ?? null,
-      train: trainOnCard(s, key),
-      ad:
-        card.geometry.kind === 'office'
-          ? { used: area.adOccupancy.length, of: officeProfile(area.tier).adTracks }
-          : null,
+      trains: trainsOnCard(s, viewerSeat, key),
+      adTracks: card.geometry.kind === 'office' ? officeProfile(area.tier).adTracks : null,
       cars: carsOn(card).map(carLabel),
-      standingWest: standingWestOn(s, key, carsOn(card).length),
+      standingWest: card.standingWest,
       facility: fv,
     });
   }
@@ -1189,6 +1226,12 @@ export function snapshot(
     wasted,
     option: turnOf(s, viewer).option,
     houseRules: houseRules(s.config),
+    days: s.config.days,
+    minCombinedRevenue: s.config.minCombinedRevenue,
+    maxCollisionsPerDay: s.config.maxCollisionsPerDay,
+    maxCollisionsTotal: s.config.maxCollisionsTotal,
+    collisionsToday: s.collisionsToday,
+    collisionsTotal: s.collisionsTotal,
     status: s.status,
     outcome: s.outcome,
     players: s.players.map((p) => ({
@@ -1199,8 +1242,11 @@ export function snapshot(
       hand: (s.decks.hands.get(p.index) ?? []).length,
     })),
     handCount: (s.decks.hands.get(viewer) ?? []).length,
+    overHandLimit:
+      (s.decks.hands.get(viewer) ?? []).length > (s.decks.redFlags.get(viewer) ? HAND_LIMIT + 1 : HAND_LIMIT),
     objective: objectiveOf(s, viewer),
     runningRow: area.runningRow,
+    limits: { west: area.limitsWest.col, east: area.limitsEast.col },
     movesLeft: s.clock.phase === 'localOps' && turnOf(s, viewer).option === 'switch' ? turnOf(s, viewer).movesRemaining : null,
     moves: switchingMoves(s, viewer),
     blocked: impediments(s, viewer),
@@ -1211,7 +1257,7 @@ export function snapshot(
           ? `${t.position.side} Division Point`
           : t.position.at === 'mainline'
             ? `Mainline card ${t.position.index}`
-            : `Office Area (${t.position.coord.row},${t.position.coord.col})`,
+            : `Office Area (${t.position.coord.col},${t.position.coord.row})`,
     })),
   };
 }
@@ -1406,7 +1452,9 @@ export function trainRules(t: {
    * DOES rather than that it exists, because the restriction is the whole character of the card: a
    * Military train that cannot be worked by Porters plays nothing like a Local.
    */
-  if (p.rules.noSwitching) parts.push('NO SWITCHING — it runs the Division and does not shunt');
+  if (p.rules.noSwitching) {
+    parts.push('NO SWITCHING — may not add or drop cars, but may still be moved clear of the mainline');
+  }
   if (p.rules.terminalsOnly) parts.push('TERMINALS ONLY — Porters may work it at a Terminal and nowhere else');
   if (p.rules.coachStaysOnStationTrack) {
     // Said "may only be set out at the Office", which reads as a place you can do it. You cannot:
@@ -1428,15 +1476,12 @@ export function trainRules(t: {
   }
 
   if (p.rules.expedite) {
-    // The single most-asked question in play — "why did that train leave before I could switch it?"
-    // — so it names the phases rather than the Stage. It stands through Cargo and goes at the end of
-    // the Stage, which is after the Porters and Laborers but before the next Local Operations.
+    // It is released and switched exactly like any other train — the restriction is on where it may
+    // be LEFT, not on when it leaves.
     parts.push(
-      'EXPEDITED — it does not lay over. It stands through the Cargo phase and departs at the END OF ' +
-        'THE STAGE IT ARRIVES IN, so Porters and Laborers can work it but it is normally gone before ' +
-        'your next Local Operations turn and cannot be switched. UNLESS §8.1 wants a clearance ruling ' +
-        'at that moment: there is no Superintendent in Supervisor Shift to give one, so the train ' +
-        'stays and runs like any other from then on.',
+      'EXPEDITED — must be kept ready to highball. It works and switches normally, but if it is not ' +
+        'back on the Office square when the next Mainline Phase begins, that is a Station Master ' +
+        'fault and costs 1 Revenue.',
     );
   }
   if (p.rules.stopEarnsPoint) parts.push('EARNS A POINT for one Stage spent standing still, once');
@@ -1615,21 +1660,36 @@ const SIMPLE_CARDS = [
   ...ACTION_CARDS,
 ];
 
-/** The goal, and whether the VIEWER's score is keeping up with the clock. */
+/**
+ * The goal, and whether the VIEWER's score is keeping up with the clock.
+ *
+ * `target` is `config.minCombinedRevenue` now (2026-08-20) — the floor below which everyone loses,
+ * not a per-player win threshold; `days` and `daysLeft` come off `config.days`. Paced against the
+ * VIEWER's own Revenue, same as before: exact for solitaire (the viewer IS the whole table), an
+ * approximation for competitive/coop until Phase 2 gives the objective panel a combined-progress
+ * view of its own. `0` means no floor is configured — nothing to pace against.
+ */
 function objectiveOf(s: GameState, viewer: PlayerIndex): Frame['objective'] {
-  const profile = lengthProfile(s.config.length);
+  const { days, minCombinedRevenue: target } = s.config;
   const revenue = s.players[viewer]?.revenue ?? 0;
-  const daysLeft = Math.max(0, profile.days - s.clock.day + 1);
-  const elapsed = profile.days - daysLeft + 1;
+  const daysLeft = Math.max(0, days - s.clock.day + 1);
+  const elapsed = days - daysLeft + 1;
+  if (target <= 0) {
+    const note =
+      daysLeft === 0
+        ? 'the last Day is over'
+        : `${revenue} · ${daysLeft} Day${daysLeft === 1 ? '' : 's'} left · no minimum this game`;
+    return { target: 0, days, daysLeft, onPace: true, note };
+  }
   // Straight-line pace: by the end of Day N you want N/days of the target.
-  const expected = (profile.target * elapsed) / profile.days;
+  const expected = (target * elapsed) / days;
   const onPace = revenue >= expected;
   const note =
     daysLeft === 0
       ? 'the last Day is over'
-      : `${revenue} of ${profile.target} · ${daysLeft} Day${daysLeft === 1 ? '' : 's'} left · ` +
+      : `${revenue} of ${target} · ${daysLeft} Day${daysLeft === 1 ? '' : 's'} left · ` +
         (onPace ? 'on pace' : `behind pace (about ${Math.ceil(expected)} by now)`);
-  return { target: profile.target, days: profile.days, daysLeft, onPace, note };
+  return { target, days, daysLeft, onPace, note };
 }
 
 /**
@@ -1718,14 +1778,9 @@ function switchingMoves(s: GameState, player: PlayerIndex): Frame['moves'] {
   const out: Frame['moves'] = [];
   for (const [id, tray] of s.trays) {
     if (tray.position.at !== 'grid' || tray.position.seat !== seatOf(s, player)) continue;
-    /**
-     * A crew that may not switch is not a crew you can be switching.
-     *
-     * `movesFor` is pure track geometry — it answers where a train COULD roll — and six cards print
-     * "no switching", which `check` enforces and it does not. Offering the Circus Train in a "which
-     * train are you switching?" row is offering a train whose every move the rules refuse.
-     */
-    if (trainProfile(tray.trainNumber ?? 0, tray.trainIsExtra)?.rules.noSwitching) continue;
+    // A no-switching train may still be moved clear of the mainline (§7) — only coupling, setting
+    // out and sorting are refused, and `check` rejects those the same way it rejects a pick-up X13
+    // (dropOnly) is not allowed to make, so this row is not filtered any differently for either.
     const { to, blocked } = movesFor(s, player, id);
     out.push({ trayId: id, label: trainName(s, id), from: tray.position.coord, to, blocked });
   }

src/web/game.ts

@@ -30,6 +30,7 @@ import type { Intent } from '../engine/intents.ts';
 import { legalActions } from '../engine/legal.ts';
 import { createGame } from '../engine/setup.ts';
 import type { CardId, GameConfig, GameState, PlayerIndex } from '../engine/state.ts';
+import { playerAtSeat } from '../engine/state.ts';
 import { cuesFor, narrate } from '../sim/narrate.ts';
 // Import from the view module, NOT replay.ts — replay.ts writes files and reads process.argv,
 // which would pull node:fs into a browser bundle.
@@ -43,9 +44,13 @@ import {
   variantLabel,
 } from '../sim/view.ts';
 import {
+  DEFAULT_DAYS,
   DEFAULT_HOUSE_RULES,
+  DEFAULT_MAX_COLLISIONS_PER_DAY,
+  DEFAULT_MAX_COLLISIONS_TOTAL,
   HAND_LIMIT,
   LEGACY_HOUSE_RULES,
+  collectiveRevenueFloor,
   houseRules,
   mainlineProfile,
   trainProfile,
@@ -53,13 +58,22 @@ import {
 import type { Hand, HouseRuleOverrides, TrackGeometry } from '../engine/content.ts';
 import type { Port } from '../engine/track.ts';
 import { connectionsFor, joins, neighbour, variantsFor } from '../engine/track.ts';
-import { areaOf, trainNeedingCars } from '../engine/apply.ts';
+import { areaOf, destinationsFor, selectDestination, trainNeedingCars } from '../engine/apply.ts';
 import type { Frame } from '../sim/view.ts';
 
+/**
+ * The canonical "what does a fresh solitaire game look like" config — also what the New Game
+ * dialog's solitaire defaults are drawn from (`main.ts`). One player, so `minCombinedRevenue` uses
+ * `collectiveRevenueFloor(1, DEFAULT_DAYS)` — the same formula multiplayer configs use, just at
+ * player count 1.
+ */
 export const SOLO_CONFIG: GameConfig = {
   mode: 'solitaire',
-  victory: 'highestAfterDays',
-  length: 'standard',
+  days: DEFAULT_DAYS,
+  minCombinedRevenue: collectiveRevenueFloor(1, DEFAULT_DAYS),
+  maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
+  maxCollisionsTotal: DEFAULT_MAX_COLLISIONS_TOTAL,
+  pvpCardsAllowed: false,
   optionalRules: {
     reducedVisibility: false,
     sisterTrains: false,
@@ -71,9 +85,56 @@ export const SOLO_CONFIG: GameConfig = {
   houseRules: DEFAULT_HOUSE_RULES,
 };
 
+/**
+ * The lobby's (`lobby.ts`) starting point for a Competitive or Co-op `Lobby.Create` — same formula
+ * `SOLO_CONFIG` uses, at a nominal player count. `minCombinedRevenue` is necessarily a guess at
+ * create time: nobody is seated yet, so there is no real headcount to size it against. It stays a
+ * guess rather than being fixed up at `Lobby.Start`, matching what the New Game dialog already told
+ * players before there was a lobby at all ("assumes a 4-player table until there's a lobby to ask
+ * who's actually seated") — Phase 5 or a follow-up can revisit sizing it to the seats actually
+ * filled once that is worth the complexity.
+ */
+export function defaultMultiplayerConfig(mode: 'competitive' | 'coop', players = 4): GameConfig {
+  return {
+    mode,
+    days: DEFAULT_DAYS,
+    minCombinedRevenue: collectiveRevenueFloor(players, DEFAULT_DAYS),
+    maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
+    maxCollisionsTotal: DEFAULT_MAX_COLLISIONS_TOTAL,
+    pvpCardsAllowed: mode === 'competitive',
+    optionalRules: {
+      reducedVisibility: false,
+      sisterTrains: false,
+      employeeRotation: false,
+      emergencyToolbox: false,
+    },
+    houseRules: DEFAULT_HOUSE_RULES,
+  };
+}
+
+/**
+ * Everything the New Game dialog can set for a solitaire game — the opening deal and the three
+ * revenue rates (`houseRules`, unchanged), plus the four victory-condition dials added 2026-08-20.
+ * Solitaire's `pvpCardsAllowed` is not here: it is forced off (`SOLO_CONFIG`), never a player choice.
+ */
+export type NewGameOptions = {
+  houseRules?: HouseRuleOverrides;
+  days?: number;
+  minCombinedRevenue?: number;
+  maxCollisionsPerDay?: number;
+  maxCollisionsTotal?: number;
+};
+
 /** The same config with the New Game dialog's answers in it. */
-export function configWith(rules: HouseRuleOverrides): GameConfig {
-  return { ...SOLO_CONFIG, houseRules: houseRules({ houseRules: rules }) };
+export function configWith(opts: NewGameOptions): GameConfig {
+  return {
+    ...SOLO_CONFIG,
+    days: opts.days ?? SOLO_CONFIG.days,
+    minCombinedRevenue: opts.minCombinedRevenue ?? SOLO_CONFIG.minCombinedRevenue,
+    maxCollisionsPerDay: opts.maxCollisionsPerDay ?? SOLO_CONFIG.maxCollisionsPerDay,
+    maxCollisionsTotal: opts.maxCollisionsTotal ?? SOLO_CONFIG.maxCollisionsTotal,
+    houseRules: houseRules(opts.houseRules ? { houseRules: opts.houseRules } : {}),
+  };
 }
 
 /** A group of legal actions of one kind, ready to put on screen. */
@@ -87,9 +148,65 @@ export type ActionGroup = {
    * from the browser, which needs the whole `GameState`. A remote client has no state, so the menu
    * carries it. See `docs/architecture/multiplayer.md` §5.
    */
-  actions: { index: number; label: string; tip?: string }[];
+  /**
+   * `coord` is the square the action HAPPENS ON, when it happens on one.
+   *
+   * Carried as data rather than left inside the label. Half these buttons are near-identical
+   * sentences distinguished only by a coordinate — "(1,3)" against "(-1,3)" — and picking the wrong
+   * one is recoverable in solitaire, where Undo is a click, and a disaster in a multiplayer game
+   * where it is not. The page hovers the matching square on the board instead of asking the player
+   * to read the row and column off the button. Reported by Jesse.
+   *
+   * Resolved HERE for the same reason `tip` is: a remote client holds no `GameState` and cannot look
+   * up where a tray is standing. See `docs/architecture/multiplayer.md` §5.
+   */
+  actions: {
+    index: number;
+    label: string;
+    tip?: string;
+    coord?: { row: number; col: number };
+    /**
+     * Every square a `switch.move` runs OVER on its way to `coord`, when there is more than one
+     * legal route there (docs/plans/switching-paths.md) — so hovering a route lights the whole
+     * road, not just its destination, which is the only way to tell two buttons reading "move to
+     * (0,0)" apart before clicking one.
+     */
+    route?: { row: number; col: number }[];
+  }[];
 };
 
+/**
+ * The square an intent acts on, or null when it acts on none.
+ *
+ * Only squares the intent NAMES. A card played out on the Mainline (`node`) is not a district
+ * coordinate and must not be treated as one — that confusion is exactly why `placement` and `node`
+ * are separate fields on the intent (see `intents.ts`) — and an action like ending a turn has no
+ * square at all.
+ */
+export function coordOf(i: Intent): { row: number; col: number } | null {
+  if ('at' in i) return i.at;
+  if ('to' in i) return i.to;
+  if (i.type === 'card.play' && i.placement) return i.placement;
+  return null;
+}
+
+/**
+ * Every intermediate square a `switch.move` runs over, resolved the same way `execute` resolves
+ * `via` — so the squares that light up on hover are exactly the squares the move will actually
+ * couple cars from. `undefined` for the overwhelming majority of moves, which run in a straight
+ * line and need nothing beyond the destination `coordOf` already carries.
+ */
+function routeFor(state: GameState, i: Intent): { row: number; col: number }[] | undefined {
+  if (i.type !== 'switch.move') return undefined;
+  const tray = state.trays.get(i.trayId);
+  if (!tray || tray.position.at !== 'grid') return undefined;
+  const actor = playerAtSeat(state, tray.position.seat);
+  const dests = destinationsFor(state, actor, i.trayId, tray.position.coord, i.reverse);
+  const dest = selectDestination(dests, i.to, i.via);
+  if (!dest || dest.path.length === 0) return undefined;
+  return dest.path.map((step) => step.coord);
+}
+
 export type Game = {
   state: GameState;
   seed: number;
@@ -180,6 +297,23 @@ export function newGame(seed: number, config: GameConfig = SOLO_CONFIG): Game {
   return game;
 }
 
+/**
+ * `newGame`'s multi-player sibling — the server session host (Phase 2) needs a `Game` wrapper for
+ * more than one seat, and `newGame` hardcodes `[SOLO_PLAYER]`. Kept as a separate function rather
+ * than a shared parametrized helper: `newGame` is exercised by every solitaire test and save, and
+ * reordering its log-then-drain sequence to share code with this risks nothing for a marginal DRY
+ * gain. `submit`/`drain`/`actionMenu`/`currentActor` all work on either unchanged, since none of them
+ * know or care how many players a `Game` has.
+ */
+export function newMultiplayerGame(seed: number, config: GameConfig, playerNames: string[]): Game {
+  const state = createGame({ id: `mp-${seed}`, seed, config, playerNames });
+  const game: Game = { state, seed, history: [], log: [], mustPlayCard: false, cues: [], scheduled: null, justDrawn: null, announced: null };
+  game.log.push({ text: 'Game Begins', tone: 'start' });
+  game.log.push({ text: `${config.mode} · ${playerNames.length} players · seed ${seed}`, tone: 'quiet' });
+  drain(game);
+  return game;
+}
+
 /**
  * Run the engine forward until it needs a decision.
  *
@@ -212,7 +346,14 @@ export function actionGroups(game: Game): { options: Intent[]; groups: ActionGro
    * to survive every edit to a line nobody would think to check. One stray byte and every crew's
    * moves silently collapsed back into a single group. The tray is data; it travels as data.
    */
-  type Entry = { index: number; label: string; tip?: string; trayId?: string };
+  type Entry = {
+    index: number;
+    label: string;
+    tip?: string;
+    trayId?: string;
+    coord?: { row: number; col: number };
+    route?: { row: number; col: number }[];
+  };
   const byKind = new Map<string, Entry[]>();
   options.forEach((intent, index) => {
     const label = describeIntent(game.state, intent);
@@ -227,14 +368,28 @@ export function actionGroups(game: Game): { options: Intent[]; groups: ActionGro
      * on the crew as well makes the de-duplication per crew, which is what it always meant.
      */
     if (!list.some((a) => a.label === label && a.trayId === trayId)) {
-      list.push({ index, label, ...(tip ? { tip } : {}), ...(trayId ? { trayId } : {}) });
+      const coord = coordOf(intent);
+      const route = routeFor(game.state, intent);
+      list.push({
+        index,
+        label,
+        ...(tip ? { tip } : {}),
+        ...(trayId ? { trayId } : {}),
+        ...(coord ? { coord } : {}),
+        ...(route ? { route } : {}),
+      });
     }
     byKind.set(intent.type, list);
   });
 
   /** Groups take the plain shape; the crew was only ever needed to split them. */
   const plain = (entries: Entry[]): ActionGroup['actions'] =>
-    entries.map(({ index, label, tip }) => ({ index, label, ...(tip ? { tip } : {}) }));
+    entries.map(({ index, label, tip, coord }) => ({
+      index,
+      label,
+      ...(tip ? { tip } : {}),
+      ...(coord ? { coord } : {}),
+    }));
 
   const groups: ActionGroup[] = [];
   const used = new Set<string>();
@@ -266,7 +421,7 @@ export function actionGroups(game: Game): { options: Intent[]; groups: ActionGro
         const tray = game.state.trays.get(trayId);
         const where =
           tray?.position.at === 'grid'
-            ? `, standing at (${tray.position.coord.row}, ${tray.position.coord.col})`
+            ? `, standing at (${tray.position.coord.col}, ${tray.position.coord.row})`
             : '';
         groups.push({
           kind: prefix,
@@ -452,7 +607,16 @@ export type Menu = {
 
 /** The action list as the page shows it: direct actions, plus subject-then-location for the rest. */
 export function actionMenu(game: Game, seat: PlayerIndex = 0): Menu {
-  const { options, groups } = actionGroups(game);
+  /**
+   * SEAT-SAFETY. `actionGroups`/`legalActions` answer for `currentActor(game)`, not for `seat` — there
+   * is exactly one acting player at a time, so a Menu built for anyone else must show no actions at
+   * all, only their own hand (found the hard way: calling this for a non-acting seat used to hand
+   * back the ACTOR's legal moves paired with the WRONG seat's cards). Emptying `options`/`groups` here
+   * degrades every downstream computation (`direct`, `placeable`, `makeUp`) to empty for free — the
+   * hand section below still reads `seat`'s own cards correctly either way.
+   */
+  const isActor = seat === currentActor(game);
+  const { options, groups } = isActor ? actionGroups(game) : { options: [] as Intent[], groups: [] as ActionGroup[] };
   const direct: ActionGroup[] = [];
   const placeableByTitle = new Map<string, Map<string, Placeable>>();
 
@@ -592,7 +756,8 @@ function subjectOf(
   node?: number;
   links: string[];
 } | null {
-  const at = (c: { row: number; col: number }): string => `(${c.row}, ${c.col})`;
+  // X,Y — east/west then north/south, not the internal row/col storage order.
+  const at = (c: { row: number; col: number }): string => `(${c.col}, ${c.row})`;
   /**
    * ABS Signals is placed on a MAINLINE card, which is not in the Office Area at all — so it names
    * a Division NODE and carries no coordinate. It used to travel as `{ row: -1, col: node }`, and
@@ -1000,3 +1165,41 @@ export function fromSave(save: Save, config: GameConfig = SOLO_CONFIG): Game {
   }
   return game;
 }
+
+/**
+ * `fromSave`'s multi-player sibling — Phase 3 (`docs/architecture/multiplayer.md`): "a mid-game
+ * server restart is a replay rather than a recovery" (`lobby-and-sessions.md` §6). Built on
+ * `newMultiplayerGame` instead of `newGame` since a saved multiplayer game did not deal to
+ * `[SOLO_PLAYER]`. The engine-version check belongs to the caller (`src/server/persistence.ts`) —
+ * this function only ever reconstructs from history that is already known to have been recorded
+ * under the currently-running rules.
+ *
+ * UNLIKE `fromSave`'s loop, this passes `actor` to `record()` (matching `submit`'s own call,
+ * `game.ts` above) — found while testing Phase 3's resume path: without it, every replayed line loses
+ * its "Player X" attribution and reads as anonymous "Chose to..." narration, which `record`'s own
+ * comment calls "unreadable the moment there is more than one seat" — exactly the multiplayer case a
+ * resumed game hits every time. `fromSave` has the same gap (it predates multiplayer and nothing ever
+ * compares its output against a LIVE-played log, so it has gone unnoticed — `undo`'s rebuilt game is
+ * itself `fromSave`-built, so `test/web.test.ts`'s replay-fidelity test only ever compares one
+ * unattributed replay against another). Flagged in `TODO.md` rather than fixed there in this pass —
+ * out of scope for Phase 3 and used far more widely, so worth its own careful look rather than a
+ * touch-in-passing.
+ */
+export function fromMultiplayerSave(
+  seed: number,
+  config: GameConfig,
+  playerNames: string[],
+  history: Intent[],
+): Game {
+  const game = newMultiplayerGame(seed, config, playerNames);
+  for (const intent of history) {
+    const actor = currentActor(game);
+    if (actor === null) break;
+    const result = applyIntent(game.state, actor, intent);
+    if (!result.ok) break;
+    game.history.push(intent);
+    record(game, result.events, actor);
+    drain(game);
+  }
+  return game;
+}

src/web/index.html

@@ -11,18 +11,30 @@ body{margin:0;background:var(--bg);color:var(--fg);
   font:15px/1.6 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;
   min-height:100vh;display:flex;flex-direction:column;align-items:center;justify-content:center;padding:28px}
 main{width:100%;max-width:760px}
+.hero{display:flex;gap:24px;align-items:flex-start}
+.hero-image{width:230px;flex:none;border-radius:9px;overflow:hidden;border:1px solid var(--line);cursor:zoom-in}
+.hero-image img{display:block;width:100%;height:auto}
+.hero-content{flex:1;min-width:0}
+@media(max-width:640px){.hero{flex-direction:column}.hero-image{width:100%;max-width:280px}}
 h1{font-size:32px;margin:0 0 2px;letter-spacing:.02em}
 .tag{color:var(--dim);margin:0;font-size:14px}
-.blurb{color:#c6ccd6;margin:16px 0 26px;max-width:66ch}
+.blurb{color:#c6ccd6;margin:16px 0 0;max-width:66ch}
 .rule{height:1px;background:var(--line);margin:22px 0}
-.doors{display:grid;grid-template-columns:1fr 1fr;gap:14px}
+.doors{display:grid;grid-template-columns:1fr 1fr 1fr;gap:14px;margin-top:26px}
 @media(max-width:640px){.doors{grid-template-columns:1fr}}
-a.door{display:block;text-decoration:none;color:inherit;background:var(--panel);
+.door{display:block;text-decoration:none;color:inherit;background:var(--panel);
   border:1px solid var(--line);border-radius:9px;padding:18px 18px 16px;transition:.12s}
 a.door:hover{border-color:#4d6fa8;background:#1f2733;transform:translateY(-1px)}
-a.door h2{font-size:17px;margin:0 0 5px;color:#9fb6d8}
-a.door p{margin:0;color:var(--dim);font-size:13px;line-height:1.5}
-a.door .go{display:inline-block;margin-top:11px;font-size:12px;color:#5aa9e6}
+.door h2{font-size:17px;margin:0 0 5px;color:#9fb6d8}
+.door p{margin:0;color:var(--dim);font-size:13px;line-height:1.5}
+.door .go{display:inline-block;margin-top:11px;font-size:12px;color:#5aa9e6}
+.door.disabled .go{color:var(--dim)}
+a.door.disabled{pointer-events:none}
+a.door.disabled:hover{border-color:var(--line);background:var(--panel);transform:none}
+.lightbox{position:fixed;inset:0;background:rgba(8,10,13,.92);display:flex;
+  align-items:center;justify-content:center;padding:32px;z-index:10;cursor:zoom-out}
+.lightbox[hidden]{display:none}
+.lightbox img{display:block;max-width:90vw;max-height:90vh;border-radius:6px;box-shadow:0 12px 40px rgba(0,0,0,.5)}
 /* the rule between title and blurb is drawn as rail, not decorated */
 svg.trackline{width:100%;height:24px;display:block;margin:10px 0 0}
 .rail{stroke:#4a5361;stroke-width:1.6}
@@ -32,24 +44,41 @@ footer{margin-top:26px;color:var(--dim);font-size:11px;display:flex;gap:18px;fle
 </head>
 <body>
 <main>
-  <h1>Station Master</h1>
-  <p class="tag">TimeTable and Train Order (TT&amp;TO) railroading, 1840&ndash;1950.</p>
+  <div class="hero">
+    <div class="hero-image" id="hero-image" tabindex="0" role="button" aria-label="View full-size box art">
+      <img src="./images/station-master-splash.jpg"
+           alt="Station Master — TimeTable &amp; Train Order Railroading, 1840&ndash;1950. Box art: two trains meet at a junction beside a train order office."
+           width="560" height="700">
+    </div>
+    <div class="hero-content">
+      <h1>Station Master</h1>
+      <p class="tag">TimeTable and Train Order (TT&amp;TO) railroading, 1840&ndash;1950.</p>
 
-  <svg class="trackline" viewBox="0 0 700 24" preserveAspectRatio="none" aria-hidden="true">
-    <line class="rail" x1="0" y1="10" x2="700" y2="10"/>
-    <line class="rail" x1="0" y1="15" x2="700" y2="15"/>
-    <g id="ties"></g>
-  </svg>
+      <svg class="trackline" viewBox="0 0 700 24" preserveAspectRatio="none" aria-hidden="true">
+        <line class="rail" x1="0" y1="10" x2="700" y2="10"/>
+        <line class="rail" x1="0" y1="15" x2="700" y2="15"/>
+        <g id="ties"></g>
+      </svg>
 
-  <p class="blurb">
-    As Station Master in your line-side office, you manage the town's railroad connection. You are
-    responsible for all track between your Limits, a district of industries hanging beneath it, and
-    trains that arrive whether or not you are ready for them. Spot the right cars, work the loads,
-    and get every train away again &mdash; a train with nowhere to stand is a collision, and a
-    collision costs more than the freight was worth.
-  </p>
+      <p class="blurb">
+        As Station Master in your line-side office, you manage the town's railroad connection. You are
+        responsible for all track between your Limits, a district of industries hanging beneath it, and
+        trains that arrive whether or not you are ready for them. Spot the right cars, work the loads,
+        and get every train away again &mdash; a train with nowhere to stand is a collision, and a
+        collision costs more than the freight was worth.
+      </p>
+    </div>
+  </div>
 
   <div class="doors">
+    <a class="door" id="door-multiplayer" href="./play.html?lobby">
+      <h2>Play multiplayer</h2>
+      <p id="door-multiplayer-blurb">Play with your friends across the internet. You each run your
+         own office area within the entire division. You can play a normal game, or choose co-op or
+         cutthroat.</p>
+      <span class="go" id="door-multiplayer-go">Set up a game &rarr;</span>
+    </a>
+
     <a class="door" href="./play.html">
       <h2>Play solitaire</h2>
       <p>Play by yourself and run the entire division for five full days. Your goal is 20 Revenue.
@@ -71,10 +100,15 @@ footer{margin-top:26px;color:var(--dim);font-size:11px;display:flex;gap:18px;fle
 
   <footer>
     <span>build <span id="build">__BUILD__</span></span>
-    <span>runs entirely in your browser &mdash; no server code required</span>
+    <span>solitaire runs entirely in your browser &mdash; no server code required</span>
   </footer>
 </main>
 
+<div class="lightbox" id="lightbox" hidden>
+  <img src="./images/station-master-splash.jpg"
+       alt="Station Master — TimeTable &amp; Train Order Railroading, 1840&ndash;1950. Box art: two trains meet at a junction beside a train order office.">
+</div>
+
 <script type="module" src="./web/splash.js"></script>
 </body>
 </html>

src/web/lobby.ts

@@ -0,0 +1,169 @@
+/**
+ * The lobby screen — Phase 4 of `docs/architecture/multiplayer.md` (§12 steps 17-20).
+ *
+ * Everything in `#lobby` (`play.html`) is owned here: the join-secret gate, creating or joining a
+ * game by code, and the seating screen up to `Lobby.Start`. `main.ts` calls `runLobby` once, at
+ * `start()`, only when there is no stored session to reconnect with — see `main.ts`'s own comment
+ * on why a stored `{token, gameId, seat}` skips this module entirely.
+ *
+ * MIRRORS SERVER TYPES RATHER THAN IMPORTING THEM, same choice `web/session.ts` already made for
+ * `Push`: this file must never depend on anything under `src/server/`, even at the type level, since
+ * it ships to the browser and the server does not.
+ */
+
+import type { GameConfig, PlayerIndex } from '../engine/state.ts';
+import { defaultMultiplayerConfig } from './game.ts';
+
+export type LobbyReady = { token: string; gameId: string; seat: PlayerIndex };
+
+type LobbySeat = { kind: 'human'; token: string; displayName: string } | { kind: 'bot' } | null;
+type Lobby = {
+  gameId: string;
+  gameCode: string;
+  hostToken: string;
+  config: GameConfig;
+  seats: LobbySeat[];
+  joinOrder: string[];
+  createdAt: number;
+};
+type LobbyPush = { lobby: Lobby; you: PlayerIndex; started: boolean };
+
+/** Per-origin, same reasoning `lobby-and-sessions.md` §1 gives for the session token itself — a
+ * secret typed at one address means nothing at another. */
+const SECRET_KEY = 'stationmaster-joinsecret';
+
+const $ = <T extends HTMLElement = HTMLElement>(id: string): T => document.getElementById(id) as T;
+
+async function postJson(path: string, body: unknown): Promise<{ status: number; body: Record<string, unknown> }> {
+  const res = await fetch(path, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  return { status: res.status, body: (await res.json()) as Record<string, unknown> };
+}
+
+/**
+ * Shows `#lobby`, drives it through creating or joining a game and then seating, and calls
+ * `onReady` exactly once — the instant `Lobby.Start` fires, from WHICHEVER browser tab started it.
+ * Never calls back more than once; the caller is expected to tear this screen down (`main.ts` hides
+ * `#lobby` and shows `#gameui`) as its very first action inside `onReady`.
+ */
+export function runLobby(onReady: (r: LobbyReady) => void): void {
+  $('lobby').hidden = false;
+  $<HTMLInputElement>('lb-secret').value = localStorage.getItem(SECRET_KEY) ?? '';
+
+  let source: EventSource | null = null;
+
+  function setError(id: string, message: string): void {
+    $(id).textContent = message;
+  }
+
+  function secret(): string {
+    const value = $<HTMLInputElement>('lb-secret').value;
+    localStorage.setItem(SECRET_KEY, value);
+    return value;
+  }
+
+  function renderSeating(lobby: Lobby, you: PlayerIndex, token: string): void {
+    $('lb-gamecode').textContent = `— code ${lobby.gameCode}`;
+    const isHost = lobby.hostToken === token;
+    const cap = lobby.config.mode === 'solitaire' ? 1 : 4;
+
+    let html = '';
+    for (let seat = 0; seat < cap; seat++) {
+      const occupant = lobby.seats[seat] ?? null;
+      const isYou = occupant?.kind === 'human' && occupant.token === token;
+      const isSeatHost = occupant?.kind === 'human' && occupant.token === lobby.hostToken;
+      const who =
+        occupant === null
+          ? '<span class="dim">— empty —</span>'
+          : occupant.kind === 'bot'
+            ? 'Bot'
+            : `${occupant.displayName}${isYou ? ' (you)' : ''}${isSeatHost ? ' — host' : ''}`;
+      let action = '';
+      if (isHost) {
+        if (occupant === null) action = `<button class="lb-bot-add" data-seat="${seat}">+ bot</button>`;
+        else if (occupant.kind === 'bot') action = `<button class="lb-bot-remove" data-seat="${seat}">remove bot</button>`;
+      }
+      html += `<div class="lb-seat"><span class="dim">Seat ${seat}</span><span class="who">${who}</span>${action}</div>`;
+    }
+    $('lb-seats').innerHTML = html;
+
+    for (const btn of Array.from($('lb-seats').querySelectorAll<HTMLButtonElement>('.lb-bot-add'))) {
+      btn.onclick = () => void postJson('/api/lobby/bot', { token, seat: Number(btn.dataset['seat']), filled: true });
+    }
+    for (const btn of Array.from($('lb-seats').querySelectorAll<HTMLButtonElement>('.lb-bot-remove'))) {
+      btn.onclick = () => void postJson('/api/lobby/bot', { token, seat: Number(btn.dataset['seat']), filled: false });
+    }
+
+    const filled = lobby.seats.filter((s) => s !== null).length;
+    const noGaps = filled === lobby.seats.length;
+    const legalCount = lobby.config.mode === 'solitaire' ? filled === 1 : filled >= 2 && filled <= 4;
+    const startBtn = $<HTMLButtonElement>('lb-start');
+    startBtn.hidden = !isHost;
+    startBtn.disabled = !(noGaps && legalCount);
+    $('lb-start-note').textContent = isHost
+      ? noGaps && legalCount
+        ? ''
+        : 'Needs 2–4 seated players (human or bot), no empty seats in between.'
+      : 'Waiting for the host to start the game.';
+    startBtn.onclick = () => {
+      void postJson('/api/lobby/start', { token }).then(({ status, body }) => {
+        if (status !== 200) setError('lb-start-note', String(body['error'] ?? 'could not start'));
+      });
+    };
+  }
+
+  function enterSeating(gameId: string, token: string): void {
+    $('lb-choice-section').hidden = true;
+    $('lb-seating-section').hidden = false;
+    source = new EventSource(`/api/lobby/stream?token=${encodeURIComponent(token)}`);
+    source.onmessage = (ev: MessageEvent<string>) => {
+      const push = JSON.parse(ev.data) as LobbyPush;
+      if (push.started) {
+        source?.close();
+        onReady({ token, gameId, seat: push.you });
+        return;
+      }
+      renderSeating(push.lobby, push.you, token);
+    };
+  }
+
+  $<HTMLButtonElement>('lb-create').onclick = () => {
+    const displayName = $<HTMLInputElement>('lb-name').value.trim();
+    const mode = ($('lb-choice-section').querySelector<HTMLInputElement>('input[name="lb-mode"]:checked')?.value ??
+      'competitive') as 'competitive' | 'coop';
+    if (displayName === '') {
+      setError('lb-create-err', 'enter a display name first');
+      return;
+    }
+    void postJson('/api/lobby/create', { secret: secret(), config: defaultMultiplayerConfig(mode), displayName }).then(
+      ({ status, body }) => {
+        if (status !== 200) {
+          setError('lb-create-err', String(body['error'] ?? 'could not create the game'));
+          return;
+        }
+        setError('lb-create-err', '');
+        enterSeating(body['gameId'] as string, body['token'] as string);
+      },
+    );
+  };
+
+  $<HTMLButtonElement>('lb-join').onclick = () => {
+    const displayName = $<HTMLInputElement>('lb-name').value.trim();
+    const gameCode = $<HTMLInputElement>('lb-code').value.trim();
+    if (displayName === '' || gameCode === '') {
+      setError('lb-join-err', 'enter a display name and a game code');
+      return;
+    }
+    void postJson('/api/lobby/join', { secret: secret(), gameCode, displayName }).then(({ status, body }) => {
+      if (status !== 200) {
+        setError('lb-join-err', String(body['error'] ?? 'could not join that game'));
+        return;
+      }
+      setError('lb-join-err', '');
+      enterSeating(body['gameId'] as string, body['token'] as string);
+    });
+  };
+}

src/web/main.ts

@@ -12,21 +12,98 @@ import type { Menu, Save } from './game.ts';
 import { PANEL_CSS, blockedHtml, facilitiesHtml, pilesHtml, timetableHtml, yardHtml } from './panels.ts';
 import { TOOLTIP_CSS, installTooltips } from './tooltip.ts';
 import { playCue } from './sound.ts';
-import { MOVES_PER_LOCAL_OPS, STARTING_HAND_LABELS, houseRules } from '../engine/content.ts';
+import {
+  DEFAULT_MAX_COLLISIONS_PER_DAY,
+  DEFAULT_MAX_COLLISIONS_TOTAL,
+  MOVES_PER_LOCAL_OPS,
+  STARTING_HAND_LABELS,
+  collectiveRevenueFloor,
+  houseRules,
+} from '../engine/content.ts';
 import type { HouseRuleOverrides, HouseRules, RevenueRules, StartingHand } from '../engine/content.ts';
-import type { LocalSession } from './session.ts';
-import { createLocalSession } from './session.ts';
+import type { NewGameOptions } from './game.ts';
+import type { LocalSession, Session } from './session.ts';
+import { createLocalSession, createRemoteSession } from './session.ts';
+import type { PlayerIndex } from '../engine/state.ts';
+import { runLobby } from './lobby.ts';
+import type { LobbyReady } from './lobby.ts';
 
 const SAVE_KEY = 'station-master.save.v1';
+const SETTINGS_KEY = 'station-master.settings.v1';
+/**
+ * The multiplayer session — `lobby-and-sessions.md` §1's token, plus the `gameId`/`seat` a fresh
+ * `createRemoteSession` needs without waiting on a push to learn its own seat. Separate from
+ * `SAVE_KEY`: a solitaire save is the seed plus intents and is meant to be portable between
+ * browsers; this is a credential for THIS origin's server and must never be treated as one.
+ */
+const REMOTE_KEY = 'station-master.remote.v1';
+/** Preset board zoom levels — a fraction applied to the rendered SVG's own pixel dimensions. */
+const ZOOM_LEVELS = [0.75, 1, 1.25, 1.5] as const;
 
 /**
- * The game, behind the Session boundary.
- *
- * Typed as `LocalSession` because this page is the solitaire client and uses undo, local saves and
- * new-game — all of which are local-only. The parts that draw and submit go through the plain
- * `Session` surface, which is what a remote client will provide unchanged.
+ * Small persisted preferences, kept in a `localStorage` key of their own — separate from
+ * `SAVE_KEY`. A save is the seed plus the intents and has to stay portable; none of this belongs
+ * in it, and in a multiplayer game two players may reasonably want these set differently. Grows as
+ * more of the page's display state earns a preference; `districtMode`/`soundOn`/`zoom` are the
+ * first three.
  */
-let session: LocalSession;
+type Settings = {
+  districtMode: 'auto' | 'open' | 'closed';
+  soundOn: boolean;
+  zoom: number;
+};
+
+const DEFAULT_SETTINGS: Settings = { districtMode: 'auto', soundOn: false, zoom: 1 };
+
+function loadSettings(): Settings {
+  try {
+    const raw = localStorage.getItem(SETTINGS_KEY);
+    const parsed = raw ? (JSON.parse(raw) as Partial<Settings>) : {};
+    // A missing key, a corrupt value, or a level dropped from `ZOOM_LEVELS` since it was saved all
+    // fall back to the default for that one field, rather than rejecting the whole object.
+    return {
+      districtMode:
+        parsed.districtMode === 'open' || parsed.districtMode === 'closed' ? parsed.districtMode : 'auto',
+      soundOn: typeof parsed.soundOn === 'boolean' ? parsed.soundOn : DEFAULT_SETTINGS.soundOn,
+      zoom:
+        typeof parsed.zoom === 'number' && (ZOOM_LEVELS as readonly number[]).includes(parsed.zoom)
+          ? parsed.zoom
+          : DEFAULT_SETTINGS.zoom,
+    };
+  } catch {
+    // A full or disabled localStorage must not take the game down with it — same guard as the save.
+    return { ...DEFAULT_SETTINGS };
+  }
+}
+
+let settings = loadSettings();
+
+function saveSettings(patch: Partial<Settings>): void {
+  settings = { ...settings, ...patch };
+  try {
+    localStorage.setItem(SETTINGS_KEY, JSON.stringify(settings));
+  } catch {
+    /* nothing to do */
+  }
+}
+
+/**
+ * The game, behind the Session boundary — `LocalSession` (solitaire, `?seat=` absent from the URL)
+ * or `RemoteSession` (`?seat=` present, Phase 2). Typed as the common `Session` surface; every
+ * LocalSession-only touch (undo, local saves, dealing a new game) goes through `isLocal` below rather
+ * than assuming, since `session` may now be either.
+ */
+let session: Session;
+
+/**
+ * The three `Capabilities` (`undo`/`saveLocal`/`newGame`) travel together — all `true` for a
+ * `LocalSession`, all `false` for a `RemoteSession` (`session.ts`) — so any one of them is a safe
+ * discriminant. `newGame` is used here since it reads clearly at every call site: "only if this
+ * session can deal locally."
+ */
+function isLocal(s: Session): s is LocalSession {
+  return s.capabilities.newGame;
+}
 /** Which card or track piece is picked, waiting for a location. */
 let selected: string | null = null;
 /**
@@ -49,18 +126,20 @@ let pendingAt: string | null = null;
  *
  * 'auto' follows the phase; 'open' and 'closed' are the player overriding it and stay put until
  * they change it again. Display only — in a multiplayer game two players may reasonably want it
- * set differently, so this must never become part of game state.
+ * set differently, so this must never become part of game state. Persisted in `settings`, not the
+ * save, for exactly that reason.
  */
-let districtMode: 'auto' | 'open' | 'closed' = 'auto';
+let districtMode: 'auto' | 'open' | 'closed' = settings.districtMode;
 /**
- * Sound, OFF until asked for.
+ * Sound, OFF by default until a player asks for it once — then remembered via `settings`.
  *
  * Everything it plays is synthesised rather than recorded, so it is a placeholder for real audio
- * rather than the finished thing — and a playtester who did not ask for noise should not get any.
- * One click in the title bar turns it on, and that click is also the gesture browsers require
- * before any audio may start.
+ * rather than the finished thing. One click in the title bar turns it on, and that click is also
+ * the gesture browsers require before any audio may start.
  */
-let soundOn = false;
+let soundOn = settings.soundOn;
+/** Preset board zoom (see `ZOOM_LEVELS`), persisted in `settings`. */
+let zoom = settings.zoom;
 /**
  * The phase the page last drew, so a change of phase can be announced.
  *
@@ -99,6 +178,23 @@ const $ = (id: string): HTMLElement => {
 const esc = (s: string): string =>
   s.replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[c] ?? c);
 
+/**
+ * Size a freshly-rendered board SVG off its own `viewBox`, at the current `zoom`.
+ *
+ * `#grid` and `#division` already scroll horizontally when their content is wider than the column
+ * (`overflow-x:auto` in `play.html`) — that mechanism is untouched. This only changes how big the
+ * SVG itself renders, in real pixels rather than a CSS `transform` (which would leave the container's
+ * scrollable area the wrong size), so zooming in genuinely grows the scrollable area and zooming out
+ * genuinely shrinks it.
+ */
+function applyZoom(container: HTMLElement): void {
+  const svg = container.querySelector('svg');
+  const box = svg?.viewBox.baseVal;
+  if (!svg || !box || box.width === 0) return;
+  svg.style.width = `${box.width * zoom}px`;
+  svg.style.height = `${box.height * zoom}px`;
+}
+
 /**
  * A DRAWING OF THE PIECE A PLACEMENT WOULD LAY.
  *
@@ -110,8 +206,8 @@ const esc = (s: string): string =>
  */
 function piecePreview(links: string[], label: string): string {
   const cell = {
-    row: 0, col: 0, kind: 'trk', label, running: false, enhancements: [],
-    tray: null, cars: [], facility: null, links, what: '',
+    row: 0, col: 0, kind: 'trk', label, running: false, enhancements: [], enhancementsWhat: [],
+    trains: [], adTracks: null, cars: [], standingWest: 0, facility: null, links, what: '',
   };
   return officeSvg([cell] as never, 99).replace(
     /<text class="bs-(coord|rowlab)"[^>]*>[^<]*<\/text>/g,
@@ -153,19 +249,27 @@ function renderHouseRules(rules: HouseRules): void {
 }
 
 /**
- * THE HOUSE RULES TRAVEL IN THE URL, BESIDE THE SEED.
+ * THE HOUSE RULES AND VICTORY DIALS TRAVEL IN THE URL, BESIDE THE SEED.
  *
  * A seed on its own no longer names a game: `?seed=430` dealt three random cards is a different
  * railroad from `?seed=430` dealt three track and three other, and at 0 Revenue per transit it is a
- * different economy again. The link has to carry all of it or "same link, same deal" stops being
- * true — and the New Game dialog navigates by URL, so this is also how its answers reach `start()`.
+ * different economy again — and now a game with `minrev=15` is a different game from one with
+ * `minrev=0`. The link has to carry all of it or "same link, same deal" stops being true — and the
+ * New Game dialog navigates by URL, so this is also how its answers reach `start()`.
  *
  * Absent parameters mean the DEFAULTS, not the legacy rules: a bare `?seed=430` is a new game at
  * today's settings. It is a save with no rules in it that is old (`game.ts`, `configFor`).
  */
 const RULE_PARAMS = { passenger: 'passengerPerCoach', freight: 'freightPerLoad', transit: 'trainPerTransit' } as const;
+/** The four victory-condition dials added 2026-08-20 (`GameConfig`), same URL-round-trip convention. */
+const VICTORY_PARAMS = {
+  days: 'days',
+  minrev: 'minCombinedRevenue',
+  colday: 'maxCollisionsPerDay',
+  coltotal: 'maxCollisionsTotal',
+} as const;
 
-function rulesFromUrl(params: URLSearchParams): HouseRuleOverrides {
+function gameOptionsFromUrl(params: URLSearchParams): NewGameOptions {
   const rules: HouseRuleOverrides = {};
   const hand = params.get('hand');
   if (STARTING_HAND_LABELS.some((o) => o.value === hand)) rules.startingHand = hand as StartingHand;
@@ -178,29 +282,102 @@ function rulesFromUrl(params: URLSearchParams): HouseRuleOverrides {
     if (raw !== null && raw.trim() !== '' && Number.isFinite(Number(raw))) revenue[key] = Number(raw);
   }
   if (Object.keys(revenue).length > 0) rules.revenue = revenue;
-  return rules;
+
+  const options: NewGameOptions = { houseRules: rules };
+  for (const [param, key] of Object.entries(VICTORY_PARAMS)) {
+    const raw = params.get(param);
+    // Negative or fractional values from a hand-edited URL are clamped the same way `configWith`'s
+    // defaults are — a stray `minrev=-5` should mean "off-ish", not a config the engine never sees.
+    if (raw !== null && raw.trim() !== '' && Number.isFinite(Number(raw))) {
+      options[key] = Math.max(0, Math.round(Number(raw)));
+    }
+  }
+  return options;
 }
 
-function rulesToUrl(rules: HouseRules, seed: string): string {
+function rulesToUrl(rules: HouseRules, options: NewGameOptions, seed: string): string {
   const params = new URLSearchParams();
   if (seed !== '') params.set('seed', seed);
   params.set('hand', rules.startingHand);
   for (const [param, key] of Object.entries(RULE_PARAMS)) params.set(param, String(rules.revenue[key]));
+  for (const [param, key] of Object.entries(VICTORY_PARAMS)) {
+    const value = options[key];
+    if (value !== undefined) params.set(param, String(value));
+  }
   return `?${params}`;
 }
 
+function loadRemote(): LobbyReady | null {
+  try {
+    const raw = localStorage.getItem(REMOTE_KEY);
+    return raw ? (JSON.parse(raw) as LobbyReady) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Toggles the two mutually-exclusive top-level screens `play.html` defines — `#lobby` (Phase 4)
+ * and `#gameui` (the board, whether local or remote). Both start `hidden` in the markup so neither
+ * ever flashes before `start()` decides which one this load actually needs. */
+function showScreen(which: 'lobby' | 'gameui'): void {
+  document.getElementById('lobby')!.hidden = which !== 'lobby';
+  document.getElementById('gameui')!.hidden = which !== 'gameui';
+}
+
+/**
+ * The one place a `RemoteSession` gets built — from a fresh `Lobby.Start` push (`lobby.ts`'s
+ * `runLobby` callback) or from a `{token, gameId, seat}` already sitting in `localStorage` from an
+ * earlier visit. Either way the token is what makes reconnection work (`lobby-and-sessions.md` §1),
+ * so it is always written back here before anything else happens.
+ */
+function beginRemote(ready: LobbyReady): void {
+  localStorage.setItem(REMOTE_KEY, JSON.stringify(ready));
+  showScreen('gameui');
+  session = createRemoteSession(ready.token, ready.seat);
+  applyCapabilities();
+  // A LocalSession has data the instant it is constructed; a RemoteSession does not — its first
+  // real Frame only exists once the SSE connection's first push arrives, so the first render waits
+  // for `subscribe`'s callback rather than firing immediately (`session.ts`'s own doc comment on
+  // `createRemoteSession` explains why `view()` would otherwise throw).
+  session.subscribe(render);
+}
+
+/**
+ * NO `?seat=` SHORTCUT ANY MORE. A remote game is reached by creating or joining one through
+ * `#lobby` (`lobby.ts`), which is what hands out the token `beginRemote` needs — hand-editing a URL
+ * cannot produce one. `start()`'s job is only to decide which of three screens this load is: back
+ * into a remembered multiplayer game, straight into solitaire (the zero-friction default, D11 — the
+ * common case and the only one a bare page load has ever needed a decision for), or the lobby.
+ */
 function start(): void {
   const params = new URLSearchParams(location.search);
-  const requested = params.get('seed');
 
+  const remembered = loadRemote();
+  if (remembered) {
+    beginRemote(remembered);
+    return;
+  }
+
+  // The splash's "Play multiplayer" door (index.html) lands here — straight into the lobby,
+  // rather than dealing a solitaire game first and leaving the player to find the in-game
+  // Multiplayer button themselves.
+  if (params.get('lobby') !== null) {
+    showScreen('lobby');
+    runLobby(beginRemote);
+    return;
+  }
+
+  showScreen('gameui');
+  const requested = params.get('seed');
   // A seed in the URL makes a game shareable and reproducible: same link, same deal.
   const seed = requested !== null ? Number(requested) || 1 : Math.floor(Math.random() * 1e9);
-  session = createLocalSession(seed, rulesFromUrl(params));
+  const local = createLocalSession(seed, gameOptionsFromUrl(params));
+  session = local;
 
   // A saved game carries its OWN rules and re-deals itself under them, whatever the URL says — see
   // `configFor`. That is why the restore happens after the session is built rather than feeding it.
   const saved = load();
-  if (saved && requested === null) session.restore(saved);
+  if (saved && requested === null) local.restore(saved);
 
   applyCapabilities();
   // Every render goes through the session, so the page redraws whenever the game says it changed —
@@ -226,6 +403,23 @@ function applyCapabilities(): void {
   hide('undo', c.undo);
   hide('savefile', c.saveLocal);
   hide('newgame', c.newGame);
+  // Creating or joining ANOTHER multiplayer game from inside a running one is not a thing this
+  // page offers — same reasoning as `newgame`, and the same capability answers both.
+  hide('multiplayer', c.newGame);
+}
+
+/**
+ * `lobby-and-sessions.md` §5 — names every currently-DISCONNECTED other seat, so a stalled table
+ * has a reason on screen instead of silence. Always empty for a `LocalSession` (`presence()` never
+ * has anything to report), and empty again the moment everyone reports back in — `#presence:empty`
+ * collapses the banner rather than leaving a reassuring "all connected" line nobody needs to read.
+ */
+function renderPresence(f: Frame): void {
+  const away = session
+    .presence()
+    .filter((p) => !p.connected)
+    .map((p) => f.players.find((pl) => pl.index === p.seat)?.name ?? `Seat ${p.seat}`);
+  $('presence').textContent = away.length === 0 ? '' : `⚠ waiting on ${away.join(', ')} — disconnected`;
 }
 
 function render(): void {
@@ -251,6 +445,7 @@ function render(): void {
   }
 
   renderTurnChart(f);
+  renderPresence(f);
   $('revenue').textContent = String(f.revenue);
   /**
    * THE OBJECTIVE, WITHOUT THE COMMENTARY.
@@ -263,11 +458,14 @@ function render(): void {
   const obj = $('objective');
   obj.textContent = `${f.revenue} of ${f.objective.target} · ${f.objective.daysLeft} Day${f.objective.daysLeft === 1 ? '' : 's'} left`;
   obj.className = 'pace';
-  $('seed').textContent = String(session.seed());
+  // The seed is never sent to a remote client at all (it would leak every future shuffle and roll,
+  // `multiplayer.md` §7) — `RemoteSession` has no `.seed()` because there is nothing to return.
+  $('seed').textContent = isLocal(session) ? String(session.seed()) : `Seat ${session.seat()}`;
   renderHouseRules(f.houseRules);
 
   // -- division
   $('division').innerHTML = divisionSvg(f.division);
+  applyZoom($('division'));
 
   // -- board. Both renderers are shared with the replay so the two can never draw different
   // pictures of the same position.
@@ -301,7 +499,15 @@ function render(): void {
           : 'ATTACH TO THIS CARD';
     return [{ row: cell.row, col: cell.col, label }];
   });
-  grid.innerHTML = officeSvg(f.cells, f.runningRow, ghostCoords, legalCaps);
+  grid.innerHTML = officeSvg(f.cells, f.runningRow, ghostCoords, legalCaps, f.limits, selectedCrew);
+  applyZoom(grid);
+
+  // Wire the roster chips: clicking one sets `selectedCrew`, the same value the "Which train are
+  // you switching?" picker writes, so the board and the action panel drive one value either way.
+  for (const g of Array.from(grid.querySelectorAll('g[data-crew]'))) {
+    const trayId = (g as HTMLElement).dataset['crew'];
+    if (trayId) (g as unknown as HTMLElement).onclick = () => { selectedCrew = trayId; render(); };
+  }
 
   // Highlighting rides on top of the drawing: outline the legal squares and make them clickable.
   for (const [key, list] of spotsAt) {
@@ -337,8 +543,10 @@ function render(): void {
    */
   const crew = pickedCrew(f);
   if (crew && !forPlay) {
-    const here = grid.querySelector(`g[data-cell="${crew.from.row},${crew.from.col}"]`);
-    if (here) here.classList.add('bs-from');
+    // Marked on the crew strip, not the whole card: the Office is the one square a second train may
+    // share, and outlining the card would claim it belongs to both.
+    const strip = grid.querySelector(`g[data-cell="${crew.from.row},${crew.from.col}"] .bs-crew`);
+    if (strip) strip.classList.add('bs-from');
     for (const c of crew.to) {
       const g = grid.querySelector(`g[data-cell="${c.row},${c.col}"]`);
       if (g) g.classList.add('bs-focus');
@@ -584,14 +792,18 @@ function render(): void {
  */
 function renderUndo(): void {
   const btn = document.getElementById('undo') as HTMLButtonElement | null;
-  if (!btn || !session.capabilities.undo) return;
-  const n = session.steps();
+  if (!btn || !isLocal(session)) return;
+  // Captured as a `const` rather than read as `session` again inside the closure below: `session` is
+  // a mutable module-level `let`, so TypeScript cannot carry the `isLocal` narrowing across a closure
+  // boundary — a local const it can never see reassigned keeps the narrowed `LocalSession` type.
+  const local = session;
+  const n = local.steps();
   btn.disabled = n === 0;
   btn.textContent = n === 0 ? 'Undo' : `Undo (${n})`;
   btn.onclick = () => {
     // The session drops the rebuilt game's cues and draws — replaying the history re-records them,
     // and none of it is news to a player who just stepped back.
-    if (!session.undo()) return;
+    if (!local.undo()) return;
     selected = null;
     mode = null;
     pendingAt = null;
@@ -629,7 +841,9 @@ function renderDistrict(f: Frame): void {
   else sec.classList.add('folded');
 
   const cars = f.cells.reduce((n, c) => n + c.cars.length, 0);
-  const crew = f.cells.filter((c) => c.tray).length;
+  // Trains, not cards-with-a-crew: the Office is the one card that may hold more than one, and a
+  // card-count silently read "1 crew on the board" with two trains standing at a busy Station.
+  const crew = f.cells.reduce((n, c) => n + c.trains.length, 0);
   $('districtsummary').textContent =
     `${f.cells.length} cards · ${f.facilities.length} facilities · ${cars} cars standing` +
     (crew > 0 ? ` · ${crew} crew on the board` : '');
@@ -646,10 +860,64 @@ function renderDistrict(f: Frame): void {
   btn.onclick = () => {
     // auto -> pin it to the opposite of what auto is doing -> back to auto.
     districtMode = districtMode === 'auto' ? (open ? 'closed' : 'open') : 'auto';
+    saveSettings({ districtMode });
     render();
   };
 }
 
+/**
+ * The square an action button acts on, as an attribute the board can be matched against.
+ *
+ * `null` for the actions that act on no square at all — ending a turn, drawing a card, a train card
+ * that goes to the timetable — so those buttons carry nothing and highlight nothing.
+ */
+function cellRef(
+  coord: { row: number; col: number } | null | undefined,
+  route?: { row: number; col: number }[],
+): string {
+  const square = coord ? ` data-square="${coord.row},${coord.col}"` : '';
+  // Only a `switch.move` with more than one legal route carries this (docs/plans/switching-paths.md)
+  // — every intermediate square the chosen route runs over, so hovering lights the whole road, not
+  // just where it ends.
+  const path = route && route.length > 0 ? ` data-route="${route.map((c) => `${c.row},${c.col}`).join(' ')}"` : '';
+  return square + path;
+}
+
+/**
+ * POINT AT THE SQUARE THE BUTTON MEANS.
+ *
+ * The action list is a column of sentences that differ by a coordinate — "(1,3)" against "(-1,3)" —
+ * and the board is right beside it saying nothing about which one is which. Hovering a button now
+ * lights its square up, so the check happens with the eye rather than by reading two numbers off a
+ * button and finding them on a map. Reported by Jesse: recoverable in solitaire, where Undo is a
+ * click; a disaster in multiplayer, where it is not.
+ *
+ * ON FOCUS AS WELL AS HOVER, so tabbing through the list works the same way as pointing at it — the
+ * keyboard route is not a lesser one.
+ *
+ * BOTH KINDS OF SQUARE. A played card is a `data-cell`; a square being placed ONTO is an empty
+ * `data-ghost` target, which is precisely the case where the player is choosing between coordinates.
+ * Matching only one of the two would leave the most mistake-prone moment unhelped.
+ */
+function wirePointing(node: HTMLElement, key: string, routeKeys: readonly string[] = []): void {
+  const grid = $('grid');
+  const keys = [key, ...routeKeys];
+  const marks = (): Element[] =>
+    keys
+      .flatMap((k) => [grid.querySelector(`g[data-cell="${k}"]`), grid.querySelector(`g[data-ghost="${k}"]`)])
+      .filter((g): g is Element => g !== null);
+  const on = (): void => {
+    for (const g of marks()) g.classList.add('bs-point');
+  };
+  const off = (): void => {
+    for (const g of marks()) g.classList.remove('bs-point');
+  };
+  node.onmouseenter = on;
+  node.onmouseleave = off;
+  node.onfocus = on;
+  node.onblur = off;
+}
+
 function renderActions(
   menu: Menu,
   f: Frame,
@@ -694,14 +962,20 @@ function renderActions(
    * the same card in hand explained itself perfectly — reported on "Realignment on Mainline card 3",
    * which had neither a name for the card it meant nor a word about what it would do.
    */
-  const actionButton = (a: { index: number; label: string; tip?: string }): string => {
+  const actionButton = (a: {
+    index: number;
+    label: string;
+    tip?: string;
+    coord?: { row: number; col: number };
+    route?: { row: number; col: number }[];
+  }): string => {
     const { label, index } = a;
     const cut = label.indexOf(' — ');
     const head = cut > 0 ? label.slice(0, cut) : label;
     // The menu resolved the card's description server-side, so the page never needs the state.
     const rest = cut > 0 ? label.slice(cut + 3) : (a.tip ?? '');
     return (
-      `<button class="act" data-i="${index}"${rest ? ` data-tip="${esc(rest)}"` : ''}>${esc(head)}</button>`
+      `<button class="act" data-i="${index}"${cellRef(a.coord, a.route)}${rest ? ` data-tip="${esc(rest)}"` : ''}>${esc(head)}</button>`
     );
   };
 
@@ -748,9 +1022,9 @@ function renderActions(
       f.moves
         .map(
           (m) =>
-            `<button class="act crew${m.trayId === chosen?.trayId ? ' on' : ''}" data-crew="${esc(m.trayId)}" ` +
-            `data-tip="Draw this crew's reachable squares on the board, and show its moves below. ${esc(m.label)} is standing at (${m.from.row}, ${m.from.col}) with ${m.to.length} square${m.to.length === 1 ? '' : 's'} it can reach.">` +
-            `${esc(m.label)} <span class="dim">(${m.from.row}, ${m.from.col})</span></button>`,
+            `<button class="act crew${m.trayId === chosen?.trayId ? ' on' : ''}" data-crew="${esc(m.trayId)}"${cellRef(m.from)} ` +
+            `data-tip="Draw this crew's reachable squares on the board, and show its moves below. ${esc(m.label)} is standing at (${m.from.col}, ${m.from.row}) with ${m.to.length} square${m.to.length === 1 ? '' : 's'} it can reach.">` +
+            `${esc(m.label)} <span class="dim">(${m.from.col}, ${m.from.row})</span></button>`,
         )
         .join('') +
       `</div>`;
@@ -762,9 +1036,19 @@ function renderActions(
    * Everything about a card in hand now lives on the card, and everything about making up a train
    * lives on the yard chip. What remains is the rest of the turn: the Local Operations choice,
    * drawing, switching moves, the Freight Agent, and finishing.
+   *
+   * EXCLUDE BY TITLE, NOT BY PREFIX. This used to be `!/^Making up /.test(g.title)`, on the
+   * assumption only the yard-chip panel's own group is ever titled that way. It is not: "choose
+   * where Extra X22 starts" is titled by `trainCardTitle`, which also begins "Making up Extra
+   * X22…", so the regex swallowed it too — and with no tray yet being filled, `menu.makeUp` is
+   * null, so nothing rendered it anywhere else. REPORTED as the game hanging with the Freight
+   * House mid-cycle: an Extra came due, the action panel had a legal decision and zero buttons,
+   * and nothing short of restarting looked like it would ever move again. Matching the exact
+   * title of the ONE group `menu.makeUp` actually covers leaves every other "Making up …" group,
+   * however it is titled, on screen where a player can act on it.
    */
   html += menu.direct
-    .filter((g) => !/^(Play|Discard) a card from my hand$/.test(g.title) && !/^Making up /.test(g.title))
+    .filter((g) => !/^(Play|Discard) a card from my hand$/.test(g.title) && g.title !== menu.makeUp?.title)
     .map(
       (g) =>
         `<div class="grp"><h3>${esc(g.title)}</h3>` +
@@ -847,7 +1131,7 @@ function renderActions(
                 ? ` data-tip-html="${esc(piecePreview(sp.links, item.subject))}"`
                 : '';
               return (
-                `<button class="act" data-i="${sp.index}"${fig}` +
+                `<button class="act" data-i="${sp.index}"${fig}${cellRef(sp.coord)}` +
                 ` data-tip="${esc(`${item.subject} — ${sp.label}`)}">${esc(sp.label)}</button>`
               );
             })
@@ -882,6 +1166,9 @@ function renderActions(
           render();
         }
       : () => apply(Number(node.dataset['i']));
+    const square = node.dataset['square'];
+    const route = node.dataset['route'];
+    if (square) wirePointing(node, square, route ? route.split(' ') : []);
   }
 }
 
@@ -897,6 +1184,10 @@ function renderActions(
  * where a rendered page would have been megabytes.
  */
 function downloadSave(): void {
+  // The button this fires from is hidden by `applyCapabilities()` for any session that cannot save
+  // (`#savefile`), but nothing stops this function being called directly, so the guard is repeated
+  // here rather than only trusted to the DOM.
+  if (!isLocal(session)) return;
   const data = JSON.stringify(session.save(), null, 1);
   const blob = new Blob([data], { type: 'application/json' });
   const url = URL.createObjectURL(blob);
@@ -908,7 +1199,7 @@ function downloadSave(): void {
 }
 
 function save(): void {
-  if (!session.capabilities.saveLocal) return;
+  if (!isLocal(session)) return;
   try {
     localStorage.setItem(SAVE_KEY, JSON.stringify(session.save()));
   } catch {
@@ -956,36 +1247,97 @@ if (saveBtn) saveBtn.onclick = downloadSave;
  * Navigating rather than re-rendering, so a stale `?seed=` in the URL goes too — leaving it would
  * deal the same game again and look like the button had done nothing.
  */
+const multiplayerBtn = document.getElementById('multiplayer');
+if (multiplayerBtn) {
+  multiplayerBtn.onclick = () => {
+    // Hidden whenever `session` cannot deal (`applyCapabilities`), but repeated here for the same
+    // reason `newBtn`'s handler repeats its own guard: the click handler outlives any one session.
+    if (!isLocal(session)) return;
+    const f = session.view();
+    const started = f.status === 'active' && (f.day > 1 || f.stage > 1);
+    if (started && !confirm(`Leave this game (seed ${session.seed()}, Day ${f.day}) for multiplayer?`)) return;
+    showScreen('lobby');
+    runLobby(beginRemote);
+  };
+}
+
 const newBtn = document.getElementById('newgame');
 const dlg = document.getElementById('newgamedlg') as HTMLDialogElement | null;
 if (newBtn && dlg) {
   const field = <T extends HTMLElement>(id: string): T => document.getElementById(id) as T;
+  type Mode = 'solitaire' | 'competitive' | 'coop';
 
   /**
-   * ASK FOR ALL THREE, rather than documenting URL parameters in the title bar.
+   * PICKING A TYPE JUST SETS THE FIELDS BELOW TO THAT TYPE'S DEFAULTS (Jesse's design, 2026-08-20) —
+   * every number stays editable afterward, so "Competitive" isn't a fixed ruleset, it's a starting
+   * point. `players = 4` for Competitive/Co-op is a nominal stand-in: there's no lobby yet to ask who
+   * is actually seated (Phase 4), so this is a suggestion a real seat count will replace.
+   *
+   * Only Solitaire can be dealt today — Deal disables itself for the other two, with a note, rather
+   * than pretending a click would do something (`RemoteSession` is Phase 2).
+   */
+  function applyModePreset(mode: Mode): void {
+    const days = 5;
+    const players = mode === 'solitaire' ? 1 : 4;
+    field<HTMLInputElement>('ng-days').value = String(days);
+    field<HTMLInputElement>('ng-minrev').value = String(collectiveRevenueFloor(players, days));
+    field<HTMLInputElement>('ng-colday').value = String(DEFAULT_MAX_COLLISIONS_PER_DAY);
+    field<HTMLInputElement>('ng-coltotal').value = String(DEFAULT_MAX_COLLISIONS_TOTAL);
+
+    // No valid target for these cards in Solitaire or Co-op — forced off, not merely defaulted off.
+    const pvp = field<HTMLInputElement>('ng-pvp');
+    pvp.checked = mode === 'competitive';
+    pvp.disabled = mode !== 'competitive';
+
+    field<HTMLButtonElement>('ng-deal').disabled = mode !== 'solitaire';
+    field<HTMLElement>('ng-multiplayer-note').style.visibility = mode === 'solitaire' ? 'hidden' : 'visible';
+  }
+
+  for (const input of dlg.querySelectorAll<HTMLInputElement>('input[name="ng-mode"]')) {
+    input.onchange = () => applyModePreset(input.value as Mode);
+  }
+
+  /**
+   * ASK FOR ALL OF IT, rather than documenting URL parameters in the title bar.
    *
    * It asked for the seed alone, through `prompt()`. The opening hand and the three revenue rates
    * were constants in the source, so trying a variation meant an edit and a rebuild — and balance is
    * the open question this game has (`TODO.md`). A dialog is what lets a playtest be a playtest.
    *
    * The dialog OPENS ON THE RULES IN PLAY rather than on the defaults: dealing a second game to
-   * compare against the first is the common case, and re-entering four settings each time is how a
-   * comparison silently stops comparing.
+   * compare against the first is the common case, and re-entering settings each time is how a
+   * comparison silently stops comparing. Mode always reopens on Solitaire — it's the only one a
+   * previous session could actually have been, since Deal is disabled for the other two.
    */
   newBtn.onclick = () => {
-    const f = session.view();
+    // The button itself is hidden for a session that cannot deal (`applyCapabilities`), but the
+    // dialog's whole answer-reading/URL-navigating flow below assumes a LocalSession throughout, so
+    // the guard is repeated — and `local` is captured as a `const` so the narrowing survives the
+    // closures below it (see `renderUndo`'s identical note on why `session` itself cannot be).
+    if (!isLocal(session)) return;
+    const local = session;
+    const f = local.view();
     const day = f.day;
     const started = f.status === 'active' && (day > 1 || f.stage > 1);
-    if (started && !confirm(`Forget this game (seed ${session.seed()}, Day ${day}) and deal a new one?`)) return;
+    if (started && !confirm(`Forget this game (seed ${local.seed()}, Day ${day}) and deal a new one?`)) return;
 
-    const current = session.view().houseRules;
+    const current = f.houseRules;
     field<HTMLInputElement>('ng-seed').value = '';
+    for (const input of dlg.querySelectorAll<HTMLInputElement>('input[name="ng-mode"]')) {
+      input.checked = input.value === 'solitaire';
+    }
+    applyModePreset('solitaire');
     for (const input of dlg.querySelectorAll<HTMLInputElement>('input[name="ng-hand"]')) {
       input.checked = input.value === current.startingHand;
     }
     field<HTMLInputElement>('ng-passenger').value = String(current.revenue.passengerPerCoach);
     field<HTMLInputElement>('ng-freight').value = String(current.revenue.freightPerLoad);
     field<HTMLInputElement>('ng-transit').value = String(current.revenue.trainPerTransit);
+    // Overwrite the preset with the actual rules in play — solitaire is the only real session today.
+    field<HTMLInputElement>('ng-days').value = String(f.days);
+    field<HTMLInputElement>('ng-minrev').value = String(f.minCombinedRevenue);
+    field<HTMLInputElement>('ng-colday').value = String(f.maxCollisionsPerDay);
+    field<HTMLInputElement>('ng-coltotal').value = String(f.maxCollisionsTotal);
     dlg.showModal();
   };
 
@@ -995,6 +1347,8 @@ if (newBtn && dlg) {
    *
    * The answers go into the URL and the page navigates, which is the same path `?seed=` already
    * took: `start()` reads them back, so there is exactly one place that turns a URL into a game.
+   * Deal is disabled whenever the mode radio isn't Solitaire, so this never actually runs for the
+   * other two — nothing here needs to branch on mode.
    */
   dlg.addEventListener('close', () => {
     if (dlg.returnValue !== 'deal') return;
@@ -1014,9 +1368,15 @@ if (newBtn && dlg) {
         },
       },
     });
+    const victory: NewGameOptions = {
+      days: Math.max(1, Math.round(Number(field<HTMLInputElement>('ng-days').value)) || 5),
+      minCombinedRevenue: Math.max(0, Math.round(Number(field<HTMLInputElement>('ng-minrev').value)) || 0),
+      maxCollisionsPerDay: Math.max(0, Math.round(Number(field<HTMLInputElement>('ng-colday').value)) || 0),
+      maxCollisionsTotal: Math.max(0, Math.round(Number(field<HTMLInputElement>('ng-coltotal').value)) || 0),
+    };
 
     clearSave();
-    const next = rulesToUrl(rules, seed);
+    const next = rulesToUrl(rules, victory, seed);
     // Assigning the search string the page ALREADY has does nothing at all, which reads as a button
     // that did not work — and it is the common case: deal a random seed, decide it was a bad deal,
     // deal another at the same settings. Reload instead, and `start()` rolls a fresh seed.
@@ -1025,6 +1385,35 @@ if (newBtn && dlg) {
   });
 }
 
+const zoomOutBtn = document.getElementById('zoomout') as HTMLButtonElement | null;
+const zoomInBtn = document.getElementById('zoomin') as HTMLButtonElement | null;
+const zoomLabel = document.getElementById('zoomlabel');
+if (zoomOutBtn && zoomInBtn && zoomLabel) {
+  const paintZoom = (): void => {
+    zoomLabel.textContent = `${Math.round(zoom * 100)}%`;
+    zoomOutBtn.disabled = zoom <= ZOOM_LEVELS[0]!;
+    zoomInBtn.disabled = zoom >= ZOOM_LEVELS[ZOOM_LEVELS.length - 1]!;
+  };
+  const setZoom = (level: number): void => {
+    zoom = level;
+    saveSettings({ zoom });
+    paintZoom();
+    // Re-apply to whichever boards are already on the page — no full re-render needed, this is
+    // display-only sizing, same as `render()`'s own calls after each innerHTML assignment.
+    applyZoom($('division'));
+    applyZoom($('grid'));
+  };
+  zoomOutBtn.onclick = () => {
+    const i = ZOOM_LEVELS.indexOf(zoom as (typeof ZOOM_LEVELS)[number]);
+    if (i > 0) setZoom(ZOOM_LEVELS[i - 1]!);
+  };
+  zoomInBtn.onclick = () => {
+    const i = ZOOM_LEVELS.indexOf(zoom as (typeof ZOOM_LEVELS)[number]);
+    if (i >= 0 && i < ZOOM_LEVELS.length - 1) setZoom(ZOOM_LEVELS[i + 1]!);
+  };
+  paintZoom();
+}
+
 const soundBtn = document.getElementById('sound');
 if (soundBtn) {
   const paint = (): void => {
@@ -1032,6 +1421,7 @@ if (soundBtn) {
   };
   soundBtn.onclick = () => {
     soundOn = !soundOn;
+    saveSettings({ soundOn });
     paint();
     // Confirm the change audibly — the one press where a sound is unambiguously wanted, and it
     // doubles as the user gesture the browser needs before any audio may start.

src/web/play.html

@@ -33,6 +33,9 @@ header button:hover{border-color:#4d6fa8}
    stops inviting the press. */
 header button:disabled{opacity:.45;cursor:not-allowed;border-color:#2c333d}
 header button:disabled:hover{border-color:#2c333d}
+.zoom{display:inline-flex;align-items:center;gap:4px}
+.zoom button{padding:3px 9px;line-height:1}
+.zoom #zoomlabel{font-size:11px;color:var(--dim);min-width:32px;text-align:center;display:inline-block}
 .build{margin-left:auto;font-size:10px;opacity:.55;white-space:nowrap}
 .home{color:inherit;text-decoration:none;border-bottom:1px dotted #5f6b7a}
 .home:hover{color:#5aa9e6}
@@ -70,6 +73,14 @@ main{display:grid;grid-template-columns:minmax(0,1fr) 400px;gap:14px;padding:14p
 @media(max-width:1100px){main{grid-template-columns:1fr}}
 section{background:var(--panel);border:1px solid var(--line);border-radius:7px;
   padding:10px 12px;margin-bottom:12px}
+#lobby{max-width:640px;margin:0 auto;padding:14px}
+#lobby h2{margin-top:0}
+#lobby h3{margin-bottom:2px}
+.lb-seat{display:flex;align-items:center;gap:8px;padding:5px 0;border-bottom:1px solid var(--line)}
+.lb-seat:last-child{border-bottom:none}
+.lb-seat .who{flex:1}
+#presence{color:#e0b060;font-size:12px;padding:0 14px;empty-cells:hide}
+#presence:empty{display:none}
 /* division strip */
 #division{display:flex;gap:7px;overflow-x:auto;padding-bottom:4px}
 .node{border:1px solid var(--line);border-radius:6px;padding:6px 9px;min-width:112px;flex:0 0 auto}
@@ -207,6 +218,50 @@ ul.blocked li{padding:2px 0}
 </head>
 <body>
 
+<!-- THE LOBBY (Phase 4) — shown instead of the game UI whenever there is no game yet to play: no
+     stored session token, or a token whose game hasn't started. `lobby.ts` owns everything in here;
+     `main.ts` only decides whether THIS div or `#gameui` below is the one currently visible.
+     `#newgamedlg` at the very end of the body is solitaire-only and untouched by any of this. -->
+<div id="lobby" hidden>
+  <header><b><a href="./index.html" class="home">Station Master</a></b> — <span class="dim">Multiplayer</span></header>
+
+  <section id="lb-secret-section">
+    <h2>Join secret</h2>
+    <p class="ng-note">Whoever is running this server gave you a secret out of band (a chat message, not a public page). It is kept in this browser only, never shown back, and sent with every lobby request.</p>
+    <label class="ng-num"><span>Join secret</span><input id="lb-secret" type="password" autocomplete="off"></label>
+  </section>
+
+  <section id="lb-choice-section">
+    <h2>Create or join a game</h2>
+    <label class="ng-num"><span>Your display name</span><input id="lb-name" type="text" autocomplete="off" maxlength="40"></label>
+
+    <h3>Create a new game</h3>
+    <p class="ng-note">You become the host — you choose the mode and, once everyone's seated, start the game. 2 to 4 players.</p>
+    <label class="ng-radio"><input type="radio" name="lb-mode" value="competitive" checked>
+      <span><b>Competitive</b><br><span class="dim">Highest Revenue wins, unless the table misses the combined minimum — then everyone loses.</span></span></label>
+    <label class="ng-radio"><input type="radio" name="lb-mode" value="coop">
+      <span><b>Co-op</b><br><span class="dim">Everyone's Revenue counts as one table score, against the same kind of combined minimum.</span></span></label>
+    <button id="lb-create">Create game</button>
+    <p class="dim" id="lb-create-err" role="alert"></p>
+
+    <h3>Join a game</h3>
+    <p class="ng-note">Ask whoever created the game for its code.</p>
+    <label class="ng-num"><span>Game code</span><input id="lb-code" type="text" autocomplete="off" placeholder="RAIL-1234"></label>
+    <button id="lb-join">Join game</button>
+    <p class="dim" id="lb-join-err" role="alert"></p>
+  </section>
+
+  <!-- Shown once created or joined, in place of the choice above, until the host starts the game. -->
+  <section id="lb-seating-section" hidden>
+    <h2>Seating <span class="dim" id="lb-gamecode"></span></h2>
+    <p class="ng-note">West to East, in the order everyone joined — this order decides the Superintendent rotation and which Office is adjacent to which. The host may fill an empty seat with a bot, or start once every seat is either a player or a bot.</p>
+    <div id="lb-seats"></div>
+    <button id="lb-start" disabled>Start game</button>
+    <p class="dim" id="lb-start-note"></p>
+  </section>
+</div>
+
+<div id="gameui" hidden>
 <div class="topbar">
 <header>
   <b><a href="./index.html" class="home">Station Master</a></b>
@@ -221,9 +276,16 @@ ul.blocked li{padding:2px 0}
        to keep the header on one line; the tooltip spells it out. -->
   <span class="dim" id="houserules" title="">—</span>
   <button id="sound" title="Whistle at the end of each Stage, the crossing bell at the end of each Day, and the conductor when a train is built. Currently synthesised, not recorded.">🔇 muted</button>
+  <!-- BOARD ZOOM. Applies to the Division map and the Office Area grid alike — both already scroll
+       horizontally (`#division`, `#grid`) when they run wide, so this only ever needs to resize the
+       rendered SVG's own pixel dimensions; the existing scrollbar keeps doing the panning. -->
+  <span class="zoom" title="Zoom the Division map and your Office Area. Both already scroll — this only changes their size.">
+    <button id="zoomout" aria-label="Zoom out">−</button><span id="zoomlabel">100%</span><button id="zoomin" aria-label="Zoom in">+</button>
+  </span>
   <button id="undo" title="Take the last action back. The save is the seed plus the moves made, so this replays the game without the last one — as far back as you like.">Undo</button>
   <button id="savefile" title="Download this game as a save file you can replay or share">Save replay</button>
   <button id="newgame" title="Deal a fresh game. You choose the seed, the opening hand and what the three economies pay. Undo steps back one action at a time; this throws the whole game away, so download the replay first if you want to keep it.">New game</button>
+  <button id="multiplayer" title="Create or join a Competitive or Co-op game on this server, with other players.">Multiplayer</button>
   <a class="home" href="./replays.html" style="font-size:12px">replays</a>
   <span class="dim build" title="what is actually deployed">__BUILD__</span>
 </header>
@@ -238,6 +300,10 @@ ul.blocked li{padding:2px 0}
      what you miss when the automatic phases run between two clicks. -->
 <div id="phasenote"></div>
 <div id="announce"></div>
+<!-- `lobby-and-sessions.md` §5 — a disconnect keeps the seat and the game simply waits; this is
+     what says WHY, instead of the table watching nothing happen with no explanation. Empty and
+     collapsed whenever everyone connected is still connected — a `LocalSession` never fills it. -->
+<div id="presence"></div>
 
 <main>
   <div>
@@ -305,10 +371,21 @@ ul.blocked li{padding:2px 0}
      complete, sensible game. The settings ride in the URL alongside the seed, because a seed alone
      no longer names a game: `?seed=430` with a different opening hand is a different railroad.
      ==================================================================== -->
+</div><!-- /gameui -->
+
 <dialog id="newgamedlg" aria-labelledby="ng-title">
   <form method="dialog" id="newgameform">
     <h2 class="big" id="ng-title">New game</h2>
 
+    <h3>Game type</h3>
+    <p class="ng-note">Picking a type just sets the fields below to that type's defaults — every number stays yours to change afterward. Solitaire is the only type that can be dealt today; Competitive and Co-op need a server (coming soon).</p>
+    <label class="ng-radio"><input type="radio" name="ng-mode" value="solitaire" checked>
+      <span><b>Solitaire</b><br><span class="dim">One railroad, one player. Everything below is real today.</span></span></label>
+    <label class="ng-radio"><input type="radio" name="ng-mode" value="competitive">
+      <span><b>Competitive</b><br><span class="dim">Highest Revenue wins, unless the table misses the combined minimum — then everyone loses.</span></span></label>
+    <label class="ng-radio"><input type="radio" name="ng-mode" value="coop">
+      <span><b>Co-op</b><br><span class="dim">Everyone's Revenue counts as one table score, against the same kind of combined minimum.</span></span></label>
+
     <h3>Seed</h3>
     <p class="ng-note">The same seed and the same settings always deal the same railroad, so a game can be shared, compared or replayed. Leave it blank for a random one.</p>
     <input id="ng-seed" type="text" inputmode="numeric" autocomplete="off" placeholder="blank for a random seed">
@@ -332,7 +409,22 @@ ul.blocked li{padding:2px 0}
       <input id="ng-transit" type="number" min="0" max="5" step="1" value="0"></label>
     <p class="ng-note">A transit pays every player, once, when a train runs off the end of the Division — the one thing nobody has to work for. It defaults to 0 for that reason.</p>
 
+    <h3>Victory conditions</h3>
+    <p class="ng-note">How long the game runs, and the ways it can end. 0 turns any of these off. The combined-Revenue suggestion updates for Competitive/Co-op — it assumes a 4-player table until there's a lobby to ask who's actually seated.</p>
+    <label class="ng-num"><span>Days</span>
+      <input id="ng-days" type="number" min="1" max="20" step="1" value="5"></label>
+    <label class="ng-num"><span>Minimum combined Revenue to avoid a loss</span>
+      <input id="ng-minrev" type="number" min="0" step="1" value="15"></label>
+    <label class="ng-num"><span>Collisions in one Day that end the game</span>
+      <input id="ng-colday" type="number" min="0" step="1" value="3"></label>
+    <label class="ng-num"><span>Collisions across the whole game that end it</span>
+      <input id="ng-coltotal" type="number" min="0" step="1" value="5"></label>
+    <label class="ng-num"><span>Allow the opponent-directed cards</span>
+      <input id="ng-pvp" type="checkbox"></label>
+    <p class="ng-note" id="ng-pvp-note">Not yet built (<code>TODO.md</code>) — this has no effect either way until then.</p>
+
     <menu class="ng-buttons">
+      <span class="ng-note" id="ng-multiplayer-note" style="margin:0 auto 0 0">Use the <b>Multiplayer</b> button instead — it creates or joins a game on this server.</span>
       <button value="cancel" id="ng-cancel" type="submit" formnovalidate>Cancel</button>
       <button value="deal" id="ng-deal" type="submit">Deal</button>
     </menu>

src/web/replays.ts

@@ -122,7 +122,7 @@ function show(i: number): void {
   $('vpos').textContent = `${at} / ${steps.length - 1}`;
   ($('vscrub') as HTMLInputElement).value = String(at);
   $('vdivision').innerHTML = divisionSvg(f.division);
-  $('vgrid').innerHTML = officeSvg(f.cells, f.runningRow);
+  $('vgrid').innerHTML = officeSvg(f.cells, f.runningRow, [], [], f.limits);
 
   // Auto-hide: the district is worth its space during the phases that change it.
   const open = districtMode === 'auto' ? FOCUS_PHASES.has(f.phaseKey) : districtMode === 'open';

src/web/session.ts

@@ -18,8 +18,9 @@
 import type { Intent } from '../engine/intents.ts';
 import type { Frame } from '../sim/view.ts';
 import type { PlayerIndex } from '../engine/state.ts';
-import type { HouseRuleOverrides } from '../engine/content.ts';
-import type { Game, Menu, Save } from './game.ts';
+import { applyDelta } from '../sim/frame-delta.ts';
+import type { FrameDelta } from '../sim/frame-delta.ts';
+import type { Game, Menu, NewGameOptions, Save } from './game.ts';
 import {
   actionMenu,
   configWith,
@@ -92,6 +93,15 @@ export type Session = {
   takeAnnouncement(): string | null;
   /** The card most recently drawn into this seat's hand. Persists until another draw replaces it. */
   justDrawn(): string | null;
+  /**
+   * Which OTHER seats are currently connected, as last reported by the server — always empty for a
+   * `LocalSession` (there is nobody else to track). `lobby-and-sessions.md` §5: a disconnect keeps
+   * the seat and waits; this is what lets the page say why, instead of going quiet with no
+   * explanation. Reflects the last presence push for each seat the server has ever mentioned, not
+   * only the ones currently disconnected — a seat that reconnects updates its own entry rather than
+   * disappearing, so the page can tell "never heard from" apart from "was here, then left."
+   */
+  presence(): { seat: PlayerIndex; connected: boolean }[];
 };
 
 /**
@@ -115,14 +125,14 @@ export type LocalSession = Session & {
  * `Game` is mutated in place by `submit`, so the wrapper keeps a mutable reference rather than
  * copying — `undo` and `restore` replace the whole game, which is why `game` is a getter.
  *
- * It takes `rules` rather than a whole `GameConfig` because DEALING is the only thing on the far
- * side of this that the page is allowed to decide. A config carries the mode, the victory condition
- * and the optional rules — table settings a lobby owns — and handing main.ts a `GameConfig` to build
- * meant importing the engine's own defaults into the page, which is the boundary `session.test.ts`
- * guards. The seed and the house rules are the two things a player picks when they press New game.
+ * It takes `NewGameOptions` rather than a whole `GameConfig` because DEALING is the only thing on the
+ * far side of this that the page is allowed to decide. A config carries the mode and the optional
+ * rules — table settings a lobby owns — and handing main.ts a `GameConfig` to build meant importing
+ * the engine's own defaults into the page, which is the boundary `session.test.ts` guards. The seed,
+ * the house rules and the victory-condition dials are what a player picks when they press New game.
  */
-export function createLocalSession(seed: number, rules?: HouseRuleOverrides): LocalSession {
-  let game: Game = rules ? newGame(seed, configWith(rules)) : newGame(seed);
+export function createLocalSession(seed: number, options?: NewGameOptions): LocalSession {
+  let game: Game = options ? newGame(seed, configWith(options)) : newGame(seed);
   const listeners = new Set<() => void>();
   const changed = (): void => {
     for (const fn of [...listeners]) fn();
@@ -162,6 +172,7 @@ export function createLocalSession(seed: number, rules?: HouseRuleOverrides): Lo
       return text;
     },
     justDrawn: () => game.justDrawn,
+    presence: () => [],
 
     seed: () => game.seed,
     save: () => toSave(game),
@@ -187,3 +198,96 @@ export function createLocalSession(seed: number, rules?: HouseRuleOverrides): Lo
     },
   };
 }
+
+/** The push envelope `src/server/session.ts` sends over SSE — mirrored here rather than imported,
+ * so this file never depends on anything under `src/server/` even at the type level. */
+type Push = {
+  frame?: FrameDelta;
+  menu: Menu | null;
+  lines: { text: string; tone: string }[];
+  presence?: { seat: PlayerIndex; connected: boolean };
+};
+
+/**
+ * A session backed by a server (Phase 2, extended Phase 4). Holds no authoritative state — no deck
+ * order, no other seat's hand — only the last `Frame`/`Menu` a push actually told it. `capabilities`
+ * are all `false`: undo would have to un-see what other players already saw, a local save is
+ * meaningless when the server is the store, and dealing a new game is the lobby's job.
+ *
+ * `token` is `lobby-and-sessions.md` §1's session token, issued at `Lobby.Create`/`Lobby.Join` and
+ * stored by the caller (`main.ts`, in `localStorage`) — it alone proves identity to `/api/stream`
+ * and `/api/intent`, so this function no longer takes a join secret at all; that gate belongs to
+ * the lobby endpoints only. `seat` still has to be passed in rather than learned from a push,
+ * because the very FIRST thing this session needs — `seat()` — has to answer before any push has
+ * necessarily arrived; the caller already knows it from the join/create/start response.
+ *
+ * Construction is synchronous (the `Session` interface has no async surface), but the first real
+ * `Frame` only exists once the SSE connection's first push arrives — `main.ts` accounts for this by
+ * not rendering until `subscribe`'s callback fires at least once for a session whose `capabilities`
+ * are all `false` (a `LocalSession` always has data the instant it is constructed; this does not).
+ */
+export function createRemoteSession(token: string, seat: PlayerIndex): Session {
+  let frame: Frame | null = null;
+  let menu: Menu | null = null;
+  let lines: { text: string; tone: string }[] = [];
+  const presence = new Map<PlayerIndex, boolean>();
+  let nextSeq = 1;
+  const listeners = new Set<() => void>();
+  const changed = (): void => {
+    for (const fn of [...listeners]) fn();
+  };
+
+  const qs = `token=${encodeURIComponent(token)}`;
+  const source = new EventSource(`/api/stream?${qs}`);
+  source.onmessage = (ev: MessageEvent<string>) => {
+    const push = JSON.parse(ev.data) as Push;
+    // A presence-only push (no `frame`) carries `menu: null` too, but that is not news about this
+    // seat's turn — only a push that actually came from the game (always carries a real `frame`,
+    // per `session.ts`'s `Push`) updates the board or the menu.
+    if (push.frame) {
+      frame = applyDelta(frame, push.frame);
+      menu = push.menu;
+    }
+    lines = [...lines, ...push.lines];
+    if (push.presence) presence.set(push.presence.seat, push.presence.connected);
+    changed();
+  };
+
+  const need = (): Frame => {
+    if (frame === null) throw new Error('RemoteSession.view() called before the first Frame arrived');
+    return frame;
+  };
+
+  return {
+    view: need,
+    menu: () => menu ?? { options: [], direct: [], placeable: [], hand: [], makeUp: null },
+    seat: () => seat,
+    actor: () => need().actor,
+    overHandLimit: () => need().overHandLimit,
+    handPlayable: () => (menu?.hand ?? []).map((h) => h.playNow !== null),
+    async submit(intent: Intent): Promise<boolean> {
+      const seq = nextSeq++;
+      const res = await fetch(`/api/intent?${qs}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ seq, intent }),
+      });
+      const result = (await res.json()) as { ok: boolean; code?: string };
+      // The visible update arrives via the SSE push (broadcast to every seat, including this one),
+      // not from this response — this only reports whether the rules accepted it.
+      return result.ok;
+    },
+    subscribe(fn: () => void) {
+      listeners.add(fn);
+      return () => listeners.delete(fn);
+    },
+    capabilities: { undo: false, saveLocal: false, newGame: false },
+
+    lines: () => lines,
+    takeCues: () => [],
+    takeScheduled: () => null,
+    takeAnnouncement: () => null,
+    justDrawn: () => null,
+    presence: () => [...presence].map(([s, connected]) => ({ seat: s, connected })),
+  };
+}

src/web/sound.ts

@@ -64,6 +64,38 @@ export function playCue(cue: string): void {
     osc.stop(at + dur + 0.02);
   };
 
+  /**
+   * A burst of filtered noise — the breath of steam behind a whistle, one chuff of a moving
+   * locomotive, or the boom of an impact. Shared by `stage` (one long burst) and the chuffs in
+   * `arrive`/`depart` (several short ones), and the wide-open burst under `crash`.
+   */
+  const noiseBurst = (
+    at: number,
+    dur: number,
+    gain: number,
+    freq: number,
+    q: number,
+    type: BiquadFilterType = 'bandpass',
+  ): void => {
+    const frames = Math.max(1, Math.floor(c.sampleRate * dur));
+    const buf = c.createBuffer(1, frames, c.sampleRate);
+    const data = buf.getChannelData(0);
+    for (let i = 0; i < frames; i++) data[i] = Math.random() * 2 - 1;
+    const src = c.createBufferSource();
+    src.buffer = buf;
+    const filt = c.createBiquadFilter();
+    filt.type = type;
+    filt.frequency.value = freq;
+    filt.Q.value = q;
+    const amp = c.createGain();
+    amp.gain.setValueAtTime(0, at);
+    amp.gain.linearRampToValueAtTime(gain, at + Math.min(0.05, dur / 4));
+    amp.gain.exponentialRampToValueAtTime(0.0001, at + dur);
+    src.connect(filt).connect(amp).connect(c.destination);
+    src.start(at);
+    src.stop(at + dur + 0.02);
+  };
+
   const t = c.currentTime + 0.02;
 
   if (cue === 'stage') {
@@ -73,23 +105,55 @@ export function playCue(cue: string): void {
     for (const fg of [[392, 0.16], [466, 0.13], [587, 0.1], [784, 0.05]]) {
       tone(t, fg[0]!, d, fg[1]!, 'sawtooth', fg[0]! * 0.985);
     }
-    const frames = Math.floor(c.sampleRate * d);
-    const buf = c.createBuffer(1, Math.max(1, frames), c.sampleRate);
-    const data = buf.getChannelData(0);
-    for (let i = 0; i < frames; i++) data[i] = Math.random() * 2 - 1;
-    const src = c.createBufferSource();
-    src.buffer = buf;
-    const band = c.createBiquadFilter();
-    band.type = 'bandpass';
-    band.frequency.value = 1400;
-    band.Q.value = 0.8;
-    const amp = c.createGain();
-    amp.gain.setValueAtTime(0, t);
-    amp.gain.linearRampToValueAtTime(0.05, t + 0.05);
-    amp.gain.exponentialRampToValueAtTime(0.0001, t + d);
-    src.connect(band).connect(amp).connect(c.destination);
-    src.start(t);
-    src.stop(t + d);
+    noiseBurst(t, d, 0.05, 1400, 0.8);
+    return;
+  }
+
+  if (cue === 'arrive') {
+    /**
+     * A LOCOMOTIVE SLOWING TO A STOP: chuffs (one per wheel revolution) spaced FARTHER apart as
+     * road speed drops, then a soft two-partial bell tap as it settles — a lighter cousin of the
+     * `day` bell, not a repeat of it.
+     */
+    let at = t;
+    const gaps = [0.13, 0.17, 0.22, 0.28];
+    for (let i = 0; i < gaps.length; i++) {
+      noiseBurst(at, 0.07, 0.11 - i * 0.015, 190, 1.1, 'bandpass');
+      at += gaps[i]!;
+    }
+    for (const fg of [[1046, 0.07], [1568, 0.04]]) {
+      tone(at + 0.12, fg[0]!, 0.3, fg[1]!, 'sine');
+    }
+    return;
+  }
+
+  if (cue === 'depart') {
+    /**
+     * THE INVERSE OF `arrive`: chuffs starting slow and pulling closer together as the train
+     * gathers speed, then one falling, fading horn note — a single call, not `completed`'s pair,
+     * since this train is only leaving the Office, not clearing the whole Division.
+     */
+    let at = t;
+    const gaps = [0.22, 0.15, 0.1, 0.07, 0.05];
+    for (let i = 0; i < gaps.length; i++) {
+      noiseBurst(at, 0.06, 0.06 + i * 0.012, 210, 1.2, 'bandpass');
+      at += gaps[i]!;
+    }
+    tone(at, 349, 0.45, 0.1, 'sawtooth', 300);
+    return;
+  }
+
+  if (cue === 'crash') {
+    /**
+     * IMPACT, NOT MUSIC: two tones bent sharply downward at a DISSONANT (non-harmonic) interval,
+     * so the ear reads a collision rather than a chord — `couple`'s clank is consonant on purpose,
+     * and this is its opposite. A wide-open noise boom and a percussive sub-bass thump give it
+     * weight under the screech.
+     */
+    tone(t, 311, 0.35, 0.16, 'square', 70);
+    tone(t, 233, 0.4, 0.13, 'sawtooth', 52);
+    noiseBurst(t, 0.4, 0.16, 900, 0.4, 'lowpass');
+    tone(t, 45, 0.3, 0.18, 'sine');
     return;
   }
 

src/web/splash.ts

@@ -7,3 +7,65 @@ if (ties) {
   }
   ties.innerHTML = out;
 }
+
+/** Clicking the box art opens it full size, since the thumbnail is too small to read. */
+const heroImage = document.getElementById('hero-image');
+const lightbox = document.getElementById('lightbox');
+if (heroImage && lightbox) {
+  const open = () => { lightbox.hidden = false; };
+  const close = () => { lightbox.hidden = true; };
+  heroImage.addEventListener('click', open);
+  heroImage.addEventListener('keydown', (e) => {
+    if (e instanceof KeyboardEvent && (e.key === 'Enter' || e.key === ' ')) {
+      e.preventDefault();
+      open();
+    }
+  });
+  lightbox.addEventListener('click', close);
+  document.addEventListener('keydown', (e) => {
+    if (e instanceof KeyboardEvent && e.key === 'Escape') close();
+  });
+}
+
+/**
+ * Is a Station Master server actually behind this page?
+ *
+ * The same `dist/` ships two ways — served by `src/server/`, or uploaded as flat files with no
+ * server at all (`scripts/deploy-web.ts`) — and the bundle is identical in both, so the only
+ * honest way to answer is to ask. `/api/health` is the one route that exists to be failed.
+ *
+ * THE DOOR STARTS OPEN AND ONLY EVER CLOSES. Getting this wrong in the "no server" direction is
+ * the bug this whole change exists to fix: a disabled door is invisible and leaves a player who
+ * DOES have a server with no way in, and nothing on screen to explain it. Getting it wrong the
+ * other way costs a click and a lobby that says it cannot reach a server — which is legible, and
+ * recoverable. So a slow or flaky probe leaves the door alone; only a definite answer closes it.
+ */
+const mpDoor = document.getElementById('door-multiplayer');
+if (mpDoor) {
+  const close = (): void => {
+    mpDoor.classList.add('disabled');
+    mpDoor.removeAttribute('href');
+    const go = document.getElementById('door-multiplayer-go');
+    if (go) go.textContent = 'Requires a Station Master server';
+    const blurb = document.getElementById('door-multiplayer-blurb');
+    if (blurb) {
+      blurb.textContent =
+        'Play with your friends across the internet, each running your own office area within the ' +
+        'entire division. This copy of the game is a plain website with no server behind it, so ' +
+        'there is nowhere to host a table — multiplayer needs a Station Master server.';
+    }
+  };
+
+  // Relative, never absolute: the page must work at whatever address it is reached by, and the
+  // server is always the origin that served it (D16).
+  void fetch('./api/health')
+    .then((r) => (r.ok ? (r.json() as Promise<unknown>) : null))
+    .then((body) => {
+      // A static host that answers unknown paths with 200 and its own index page would sail past
+      // an `r.ok` check, so the body has to name itself before the door is believed.
+      const named =
+        typeof body === 'object' && body !== null && (body as { service?: unknown }).service === 'station-master';
+      if (!named) close();
+    })
+    .catch(() => close());
+}

test/advance.test.ts

@@ -9,17 +9,20 @@ import assert from 'node:assert/strict';
 
 import { advance, pump } from '../src/engine/advance.ts';
 import { applyIntent, areaOf, check } from '../src/engine/apply.ts';
-import { HAND_LIMIT, STAGES_PER_DAY, lengthProfile, TOTAL_ROLLING_STOCK } from '../src/engine/content.ts';
+import { EXPEDITE_FAULT_PENALTY, HAND_LIMIT, STAGES_PER_DAY, TOTAL_ROLLING_STOCK } from '../src/engine/content.ts';
 import { legalActions } from '../src/engine/legal.ts';
 import { createGame } from '../src/engine/setup.ts';
 import { developerBot } from '../src/sim/bot.ts';
 import type { CrewTray, GameConfig, GameState } from '../src/engine/state.ts';
-import { railFacingOf } from '../src/engine/state.ts';
+import { coordKey, railFacingOf } from '../src/engine/state.ts';
 
 const baseConfig = (over: Partial<GameConfig> = {}): GameConfig => ({
   mode: 'solitaire',
-  victory: 'highestAfterDays',
-  length: 'short',
+  days: 3,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
   optionalRules: {
     reducedVisibility: false,
     sisterTrains: false,
@@ -327,6 +330,75 @@ describe('collisions are automatic (Gap 2)', () => {
     assert.ok(!s.trays.has(id), 'the train is removed');
   });
 
+  it('does not collide when a coach is legally parked at the Office (v0.5.0 §A.4 exception)', () => {
+    // A coach may now be set out at the Office (§A.4's carve-out). It must not become a hazard to
+    // the next train in — that would punish exactly the thing the rule was written to allow.
+    const s = game();
+    const area = s.officeAreas.get(0)!;
+    area.adOccupancy = []; // an A/D track is free — only the fouling check is under test
+    const officeCard = area.grid.get(coordKey(area.officeCoord))!;
+    officeCard.standing = [{ type: 'coach', loaded: false }];
+
+    const id = 'inbound';
+    s.trays.set(id, {
+      id,
+      trainNumber: 2,
+      trainIsExtra: false,
+      engineAt: 0,
+      consist: [{ type: 'coach', loaded: true }],
+      direction: 'east',
+      position: { at: 'mainline', index: 1 },
+      movesUsed: 0,
+    });
+    const ml = s.division.nodes[1];
+    if (ml?.kind === 'mainline') {
+      ml.card = 'plains';
+      ml.transits.push({ tray: id, stagesRemaining: 1, stagesTotal: 1, direction: 'east' });
+    }
+
+    s.clock.phase = 'mainline';
+    s.movedThisPhase = new Set();
+    advance(s);
+
+    assert.equal(s.collisionsToday, 0, 'a legally parked coach is not a hazard to the next arrival');
+    assert.ok(s.trays.has(id), 'the train is not written off');
+  });
+
+  it('still collides when a non-coach car is left fouling the Office track', () => {
+    // Reachable only by poking state directly — `canDropCarsAt` already refuses every non-coach
+    // drop at the Office, so this backstops the collision check itself, not a state a legal game
+    // can reach.
+    const s = game();
+    const area = s.officeAreas.get(0)!;
+    area.adOccupancy = [];
+    const officeCard = area.grid.get(coordKey(area.officeCoord))!;
+    officeCard.standing = [{ type: 'boxcar', loaded: false }];
+
+    const id = 'inbound';
+    s.trays.set(id, {
+      id,
+      trainNumber: 2,
+      trainIsExtra: false,
+      engineAt: 0,
+      consist: [{ type: 'coach', loaded: true }],
+      direction: 'east',
+      position: { at: 'mainline', index: 1 },
+      movesUsed: 0,
+    });
+    const ml = s.division.nodes[1];
+    if (ml?.kind === 'mainline') {
+      ml.card = 'plains';
+      ml.transits.push({ tray: id, stagesRemaining: 1, stagesTotal: 1, direction: 'east' });
+    }
+
+    s.clock.phase = 'mainline';
+    s.movedThisPhase = new Set();
+    advance(s);
+
+    assert.equal(s.collisionsToday, 1);
+    assert.ok(!s.trays.has(id), 'the train is removed');
+  });
+
   it('returns cabooses to the Division Yard and other stock to Classification (Gap 2c)', () => {
     const s = game();
     s.officeAreas.get(0)!.adOccupancy = ['blocker'];
@@ -464,11 +536,11 @@ describe('the Superintendent clearance interrupt (§8.1)', () => {
 
 // ---------------------------------------------------------------------------
 
-describe('victory conditions (§3, Gap 10e)', () => {
-  it('loses a timed Solitaire game that misses the target', () => {
-    // The target doubles as a MINIMUM in Solitaire: below it you lose regardless of score.
-    const s = game(1);
-    s.clock.day = lengthProfile('short').days + 1;
+describe('victory conditions (§3, Gap 10e) — unified 2026-08-20', () => {
+  it('loses a timed Solitaire game that misses minCombinedRevenue', () => {
+    // minCombinedRevenue doubles as a MINIMUM in Solitaire: below it you lose regardless of score.
+    const s = game(1, { minCombinedRevenue: 10 });
+    s.clock.day = s.config.days + 1;
     s.clock.stage = STAGES_PER_DAY;
     s.clock.phase = 'shiftChange';
     s.players[0]!.revenue = 0;
@@ -478,25 +550,101 @@ describe('victory conditions (§3, Gap 10e)', () => {
     assert.equal(s.outcome!.reason, 'revenueFloor');
   });
 
-  it('wins a timed Solitaire game that clears the target', () => {
-    const s = game(1);
-    s.clock.day = lengthProfile('short').days + 1;
+  it('wins a timed Solitaire game that clears minCombinedRevenue', () => {
+    const s = game(1, { minCombinedRevenue: 10 });
+    s.clock.day = s.config.days + 1;
     s.clock.stage = STAGES_PER_DAY;
     s.clock.phase = 'shiftChange';
-    s.players[0]!.revenue = lengthProfile('short').target;
+    s.players[0]!.revenue = 10;
     advance(s);
     assert.equal(s.status, 'finished');
     assert.equal(s.outcome!.result, 'win');
   });
 
-  it('ends a first-to-target game the moment the target is reached', () => {
-    const s = game(1, { victory: 'firstToTarget' });
-    s.players[0]!.revenue = lengthProfile('short').target;
+  it('minCombinedRevenue = 0 disables the floor — any score wins once days run out', () => {
+    const s = game(1, { minCombinedRevenue: 0 });
+    s.clock.day = s.config.days + 1;
     s.clock.stage = STAGES_PER_DAY;
     s.clock.phase = 'shiftChange';
+    s.players[0]!.revenue = 0;
+    advance(s);
+    assert.equal(s.status, 'finished');
+    assert.equal(s.outcome!.result, 'win');
+  });
+
+  it('everyone loses in Competitive when the TABLE misses minCombinedRevenue, whoever scored best', () => {
+    const s = createGame({
+      id: 'g', seed: 2, config: baseConfig({ mode: 'competitive', minCombinedRevenue: 20 }),
+      playerNames: ['A', 'B'],
+    });
+    s.clock.day = s.config.days + 1;
+    s.clock.stage = STAGES_PER_DAY;
+    s.clock.phase = 'shiftChange';
+    s.players[0]!.revenue = 5; // best individual score...
+    s.players[1]!.revenue = 3; // ...but combined (8) still misses the floor (20).
+    advance(s);
+    assert.equal(s.status, 'finished');
+    assert.equal(s.outcome!.result, 'loss');
+    assert.equal(s.outcome!.reason, 'revenueFloor');
+  });
+
+  it('Co-op wins as one table score (summed Revenue), winner stays null', () => {
+    const s = createGame({
+      id: 'g', seed: 3, config: baseConfig({ mode: 'coop', minCombinedRevenue: 10 }),
+      playerNames: ['A', 'B'],
+    });
+    s.clock.day = s.config.days + 1;
+    s.clock.stage = STAGES_PER_DAY;
+    s.clock.phase = 'shiftChange';
+    s.players[0]!.revenue = 4;
+    s.players[1]!.revenue = 6; // combined 10 clears the floor, neither alone would.
+    advance(s);
+    assert.equal(s.status, 'finished');
+    assert.equal(s.outcome!.result, 'win');
+    assert.equal(s.outcome!.winner, null, 'Co-op names an individual winner instead of a shared one');
+  });
+
+  it('ends immediately, mid-Stage, when collisions reach maxCollisionsPerDay', () => {
+    // Competitive/coop only, and immediate — not gated on the day boundary the way the revenue
+    // floor is. Stage 1, well short of STAGES_PER_DAY, proves it fires mid-day.
+    const s = game(1, { mode: 'competitive', maxCollisionsPerDay: 2 });
+    s.collisionsToday = 2;
+    s.clock.stage = 1;
+    s.clock.phase = 'shiftChange';
     advance(s);
     assert.equal(s.status, 'finished');
-    assert.equal(s.outcome!.reason, 'targetReached');
+    assert.equal(s.outcome!.result, 'loss');
+    assert.equal(s.outcome!.reason, 'collisionFloor');
+  });
+
+  it('ends immediately when the running total reaches maxCollisionsTotal, even under the per-day cap', () => {
+    const s = game(1, { mode: 'coop', maxCollisionsPerDay: 0, maxCollisionsTotal: 3 });
+    s.collisionsTotal = 3;
+    s.clock.stage = 1;
+    s.clock.phase = 'shiftChange';
+    advance(s);
+    assert.equal(s.status, 'finished');
+    assert.equal(s.outcome!.reason, 'collisionFloor');
+  });
+
+  it('maxCollisionsPerDay = 0 and maxCollisionsTotal = 0 disable the collision floor entirely', () => {
+    const s = game(1, { mode: 'competitive', maxCollisionsPerDay: 0, maxCollisionsTotal: 0 });
+    s.collisionsToday = 99;
+    s.collisionsTotal = 99;
+    s.clock.stage = 1;
+    s.clock.phase = 'shiftChange';
+    advance(s);
+    assert.notEqual(s.status, 'finished');
+  });
+
+  it('solitaire never checks the collision floor, whatever the counts', () => {
+    const s = game(1, { mode: 'solitaire', maxCollisionsPerDay: 1, maxCollisionsTotal: 1 });
+    s.collisionsToday = 99;
+    s.collisionsTotal = 99;
+    s.clock.stage = 1;
+    s.clock.phase = 'shiftChange';
+    advance(s);
+    assert.notEqual(s.status, 'finished');
   });
 });
 
@@ -690,9 +838,16 @@ describe('the history says WHY a train moved, and says it truthfully', () => {
    * them — it may be the rules are wrong, or it may be my perception."
    *
    * It was perception, but the log was actively feeding it. Every departure read alike, and the
-   * arrival line for an Expedited train said there was "no turn in which to work it" — which is
-   * false and cost the player the Cargo turn they did have. These pin the two claims the log now
-   * makes, so a phase-order change cannot leave the narration lying about it.
+   * arrival line for an Expedited train said there was "no turn in which to work it" — which was
+   * false under the OLD (v0.4.8 and earlier) same-stage-departure reading of Q3, and cost the player
+   * the Cargo turn they did have.
+   *
+   * v0.4.9 CORRECTED Q3 ITSELF, not just the narration: Expedite does not change when a train
+   * leaves — it is released by the ordinary §8.1 rules exactly like any other train, and may be
+   * switched normally while it stands. What it means is that the train must not be PARKED anywhere
+   * but the station; leaving it on Secondary Track when a Mainline Phase begins is a Station Master
+   * fault (`expediteFault`, `EXPEDITE_FAULT_PENALTY`). These pin that behaviour, so a phase-order
+   * change cannot silently bring back the old forced departure.
    */
   /**
    * Drop one named train at the Western Division Point and follow it, counting the DISTINCT phases
@@ -701,14 +856,13 @@ describe('the history says WHY a train moved, and says it truthfully', () => {
    * which deadlocks the moment Local Operations wants an option chosen before it can be ended.
    */
   const phasesWith = (trainNumber: number): { localOps: number; loadUnload: number; leftIn: string } => {
-    const s = game(7, { length: 'standard' });
+    const s = game(7, { days: 5 });
     for (const n of s.division.nodes) if (n.kind === 'mainline') n.card = 'plains';
     /**
-     * A DIVISION WITH NOTHING ELSE ON IT. Expedite is not absolute: §8.1 can still hold the train,
-     * and `shiftChange` says so — "an expedited train that would need a ruling simply stays, and
-     * runs normally next Stage". With the bot's own traffic running, Train 6 was held four Stages
-     * and collected four Local Operations turns, which is correct behaviour and the opposite of what
-     * this test is trying to pin. Clearing the timetable isolates the rule from the traffic.
+     * A DIVISION WITH NOTHING ELSE ON IT. §8.1 can still hold any train, Expedited or not, on a
+     * same-direction meet — with the bot's own traffic running, Train 6 was held four Stages and
+     * collected four Local Operations turns. Correct behaviour, but it is traffic noise for what
+     * this test is trying to pin, so clearing the timetable isolates the rule from it.
      */
     s.timetable = s.timetable.map(() => null);
     const id = 'watched';
@@ -779,40 +933,55 @@ describe('the history says WHY a train moved, and says it truthfully', () => {
     assert.equal(r.leftIn, 'mainline', 'an ordinary train should leave in a Mainline Phase');
   });
 
-  it('gives an Expedited train the Cargo phase but never Local Operations', () => {
-    // Train 6 The Sparrow — Expedite. The claim the arrival line makes is precisely this pair:
-    // Porters and Laborers can reach it, a switching turn never comes, and it goes at the end of
-    // the Stage rather than in a Mainline Phase.
+  it('gives an Expedited train a Local Operations turn too, exactly like an ordinary one', () => {
+    // Train 6 The Sparrow — Expedite. v0.4.9 corrected Q3: Expedite no longer forces a same-stage
+    // departure, so an Expedited train is released by the ordinary §8.1 rule and stands for a
+    // Local Operations turn the same as Train 12 above.
     const r = phasesWith(6);
-    assert.equal(r.localOps, 0, 'an Expedited train got a Local Operations turn after all');
+    assert.ok(r.localOps >= 1, `an Expedited train got ${r.localOps} Local Operations turns`);
     assert.ok(r.loadUnload >= 1, 'an Expedited train never stood through a Cargo phase');
-    assert.equal(r.leftIn, 'shiftChange', 'an Expedited train should leave in Supervisor Shift');
+    assert.equal(r.leftIn, 'mainline', 'an Expedited train should leave in a Mainline Phase, like any other');
   });
 
-  it('does NOT expedite when §8.1 wants a ruling — it stays and runs normally', () => {
-    /**
-     * EXPEDITE IS CONDITIONAL, which is most of why it feels arbitrary at the table.
-     *
-     * `shiftChange` says so — "an expedited train that would need a ruling simply stays, and runs
-     * normally next Stage" — and it happens often: driven by the developer bot this was reached by
-     * ordinary traffic, and Train 6 collected FOUR Local Operations turns instead of none. Built by
-     * hand here rather than fished out of a bot game, because whether the bot happens to produce a
-     * meet depends on the deck, and the deck moves.
-     *
-     * So the log and the card must not promise that an Expedited train can never be switched.
-     */
-    const s = game(7, { length: 'standard' });
-    for (const n of s.division.nodes) if (n.kind === 'mainline') n.card = 'plains';
+  it('faults an Expedited train left off the station when a Mainline Phase begins', () => {
+    // What Expedite actually restricts now: not WHEN the train leaves, but WHERE it may be left
+    // standing in the meantime. Parked on Secondary Track — cleared there to make way for other
+    // switching, say — it must not still be there when the next Mainline Phase begins.
+    const s = game(7, { days: 5 });
+    const area = areaOf(s, 0);
+    const id = 'expedited';
+    const secondary = { row: area.officeCoord.row, col: area.officeCoord.col + 1 };
+    s.trays.set(id, {
+      id, trainNumber: 6, trainIsExtra: false, engineAt: 0, consist: [],
+      direction: 'east', facing: 'e',
+      position: { at: 'grid', seat: 0, coord: secondary }, movesUsed: 0,
+    });
 
-    // Train 6 (Expedite) standing at the Office, having just arrived: this is the state
-    // `arriveAtOffice` leaves behind when it sets `departsThisStage`.
+    s.clock.phase = 'mainline';
+    const before = s.players[0]!.revenue;
+    const r = advance(s);
+
+    assert.ok(
+      r.events.some((e) => e.type === 'expediteFault' && e.trainNumber === 6),
+      'no fault was raised for an Expedited train left off the station',
+    );
+    assert.equal(
+      s.players[0]!.revenue,
+      before - EXPEDITE_FAULT_PENALTY,
+      'the fault did not cost Revenue',
+    );
+  });
+
+  it('does not fault an Expedited train legitimately held at the station itself', () => {
+    // A train sitting on the Office square is not "left" anywhere — including one §8.1 is holding
+    // for a same-direction meet, which is an ordinary hold, not a Station Master failure.
+    const s = game(7, { days: 5 });
     const area = areaOf(s, 0);
     const id = 'expedited';
     s.trays.set(id, {
       id, trainNumber: 6, trainIsExtra: false, engineAt: 0, consist: [],
       direction: 'east', facing: 'e',
       position: { at: 'grid', seat: 0, coord: area.officeCoord }, movesUsed: 0,
-      departsThisStage: true,
     });
     area.adOccupancy.push(id);
 
@@ -829,26 +998,22 @@ describe('the history says WHY a train moved, and says it truthfully', () => {
       node.transits.push({ tray: 'ahead', stagesRemaining: 2, stagesTotal: 2, direction: 'east' });
     }
 
-    s.clock.phase = 'shiftChange';
+    s.clock.phase = 'mainline';
+    const before = s.players[0]!.revenue;
     const r = advance(s);
 
     assert.ok(
       r.events.some((e) => e.type === 'clearanceRequested' && e.trainId === id),
-      'the Expedited departure was not put to the Superintendent',
-    );
-    assert.equal(
-      s.trays.get(id)?.position.at,
-      'grid',
-      'the Expedited train left despite needing a ruling nobody could give',
+      'the departure was not put to the Superintendent',
     );
     assert.ok(
-      r.events.some((e) => e.type === 'trainHeld' && /EXPEDITES/.test(e.reason)),
-      'the log does not say why the Expedited train stayed',
+      !r.events.some((e) => e.type === 'expediteFault'),
+      'a train properly parked at the station was faulted anyway',
     );
     assert.equal(
-      s.trays.get(id)?.departsThisStage,
-      false,
-      'it should run as an ordinary train from now on, not retry the expedited departure',
+      s.players[0]!.revenue,
+      before,
+      'Revenue changed for a train legitimately held at the station',
     );
   });
 });

test/apply.test.ts

@@ -17,8 +17,11 @@ import { cardDescription, snapshot } from '../src/sim/view.ts';
 
 const config: GameConfig = {
   mode: 'solitaire',
-  victory: 'highestAfterDays',
-  length: 'standard',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
   optionalRules: {
     reducedVisibility: false,
     sisterTrains: false,
@@ -56,6 +59,7 @@ const straight = (standing: TrackCard['standing'] = []): TrackCard => ({
   geometry: { kind: 'track', geometry: 'straight' },
   baseOperationalRail: true,
   standing,
+  standingWest: 0,
   facility: null,
   modifiers: [],
   enhancements: [],
@@ -445,6 +449,7 @@ describe('Freight Agent operations (§6.3)', () => {
       geometry: { kind: 'facility', facility: 'mineTipple' },
       baseOperationalRail: true,
       standing: [],
+      standingWest: 0,
       facility: {
         kind: 'freight',
         subtype: 'mineTipple',
@@ -576,6 +581,7 @@ describe('Load/Unload: the four-action freight pipeline (§9.3)', () => {
       geometry: { kind: 'facility', facility: 'mineTipple' },
       baseOperationalRail: true,
       standing: [],
+      standingWest: 0,
       facility: {
         kind: 'freight',
         subtype: 'mineTipple',
@@ -682,6 +688,61 @@ describe('Load/Unload: the four-action freight pipeline (§9.3)', () => {
     assert.equal(check(s, 0, { type: 'laborer.startLoad', at: coord }), 'NO_EMPTY_CAR_SPOTTED');
   });
 
+  it('unloads the car the player actually picked, not always the westmost one', () => {
+    // REPORTED FROM PLAY: three loaded cars stood at a Freight House; asking to unload the EAST
+    // (index 2) car unloaded the WEST one instead, every time, regardless of which car was picked.
+    // The reducer for `unloadBegan` used to re-derive the target with
+    // `industryTrack.cars.findIndex(c => c.loaded)`, which always answers the first loaded car in
+    // track order no matter which `carIndex` the intent actually named.
+    const s = game();
+    const coord = at(-1, 0);
+    addCard(s, coord, {
+      geometry: { kind: 'facility', facility: 'freightHouse' },
+      baseOperationalRail: true,
+      standing: [],
+      standingWest: 0,
+      facility: {
+        kind: 'freight',
+        subtype: 'freightHouse',
+        allows: { outbound: true, inbound: true },
+        outboundBox: [],
+        inboundBox: [],
+        capacity: { outbound: 1, inbound: 1 },
+        menAtWork: [null, null, null],
+        industryTrack: {
+          cars: [
+            { type: 'boxcar', loaded: true },
+            { type: 'hopper', loaded: true },
+            { type: 'tank', loaded: true },
+          ],
+        },
+        laborers: 3,
+        porters: 0,
+        usedThisStage: { laborers: 0, porters: 0 },
+      },
+      modifiers: [],
+      enhancements: [],
+    });
+    s.clock.phase = 'loadUnload';
+    // An empty replacement of every type standing on the track, so `check` never refuses for a
+    // reason unrelated to what this test is about.
+    s.yards.divisionYard.push(
+      { type: 'boxcar', loaded: false },
+      { type: 'hopper', loaded: false },
+      { type: 'tank', loaded: false },
+    );
+
+    const r = applyIntent(s, 0, { type: 'laborer.beginUnload', at: coord, carIndex: 2 });
+    assert.ok(r.ok, 'unloading the east (index 2) car should be legal');
+    const f = areaOf(s, 0).grid.get(coordKey(coord))!.facility!;
+    assert.equal(f.industryTrack.cars[0]!.type, 'boxcar', 'the west car must be untouched');
+    assert.equal(f.industryTrack.cars[0]!.loaded, true, 'the west car must still be loaded');
+    assert.equal(f.industryTrack.cars[1]!.type, 'hopper', 'the middle car must be untouched');
+    assert.equal(f.industryTrack.cars[1]!.loaded, true, 'the middle car must still be loaded');
+    assert.equal(f.industryTrack.cars[2]!.type, 'tank', 'the east car — the one picked — must still be there');
+    assert.equal(f.industryTrack.cars[2]!.loaded, false, 'the east car is the one that should be emptied');
+  });
+
   it('takes four Laborer actions in total for one point', () => {
     // The asymmetry the whole economy is calibrated against (card-reference.md §2).
     const s = game();
@@ -757,6 +818,7 @@ describe('legalActions shares its rules with apply (component 6)', () => {
       geometry: { kind: 'facility', facility: 'mineTipple' },
       baseOperationalRail: true,
       standing: [],
+      standingWest: 0,
       facility: {
         kind: 'freight',
         subtype: 'mineTipple',
@@ -930,6 +992,177 @@ describe('a Modifier only goes beside a host that can use it (regression)', () =
 
 // ---------------------------------------------------------------------------
 
+describe('the Limits bound the district, and the nine spots reach round a Facility', () => {
+  /**
+   * A district whose Running Track has been extended one square east, so the sign stands at col 2
+   * and there is a siding hanging below the main to build on:
+   *
+   *   row  0:  [lim] [office] [turnout, leg south] [lim]     <- Running Track, Limits at -1 and 2
+   *   row -1:                 [curve ne]
+   *
+   * Returns the industry-ready square under the sign, at (-1, 2).
+   */
+  function district(s: GameState): GridCoord {
+    const area = areaOf(s, 0);
+    const plain = (geometry: object): TrackCard => ({
+      geometry: geometry as TrackCard['geometry'],
+      baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
+    });
+    const col = area.limitsEast.col;
+    area.grid.set(coordKey(at(area.runningRow, col)), plain({
+      kind: 'track', geometry: 'turnout', turnout: { stem: 'w', through: 'e', diverge: 's' }, hand: 'left',
+    }));
+    area.grid.set(coordKey(at(area.runningRow - 1, col)), plain({
+      kind: 'track', geometry: 'curved', arc: 'ne', hand: 'left',
+    }));
+    area.limitsEast = at(area.runningRow, col + 1);
+    area.grid.set(coordKey(area.limitsEast), plain({ kind: 'limits' }));
+    s.clock.phase = 'localOps';
+    s.clock.currentActor = 0;
+    turnOf(s, 0).option = 'draw';
+    return at(area.runningRow - 1, col + 1);
+  }
+
+  const trackInHand = (s: GameState, geometry: string): string => {
+    for (const [id, card] of s.cards) {
+      if (card.kind.kind === 'track' && card.kind.geometry === geometry) {
+        s.decks.hands.set(0, [id]);
+        return id;
+      }
+    }
+    throw new Error(`no ${geometry} card`);
+  };
+
+  const industryOf = (s: GameState, facility: string): string => {
+    for (const [id, card] of s.cards) {
+      if (card.kind.kind === 'freightFacility' && card.kind.facility === facility) {
+        s.decks.hands.set(0, [id]);
+        return id;
+      }
+    }
+    throw new Error(`no industry card: ${facility}`);
+  };
+
+  const modifierOf = (s: GameState, modifier: string): string => {
+    for (const [id, card] of s.cards) {
+      if (card.kind.kind === 'modifier' && card.kind.modifier === modifier) {
+        s.decks.hands.set(0, [id]);
+        return id;
+      }
+    }
+    throw new Error(`no modifier card: ${modifier}`);
+  };
+
+  /** An industry standing on the board, so a Modifier has a host to hang off. */
+  const buildFacility = (s: GameState, kind: string, coord: GridCoord): void => {
+    areaOf(s, 0).grid.set(coordKey(coord), {
+      geometry: { kind: 'facility', facility: kind, axis: 'ew' },
+      baseOperationalRail: true, standing: [], modifiers: [], enhancements: [],
+      facility: {
+        kind: 'freight', subtype: kind,
+        allows: { outbound: true, inbound: false },
+        outboundBox: [], inboundBox: [], capacity: { outbound: 1, inbound: 0 },
+        menAtWork: [null, null, null],
+        industryTrack: { cars: [] },
+        laborers: 1, porters: 0, usedThisStage: { laborers: 0, porters: 0 },
+      },
+    } as never);
+  };
+
+  it('accepts a siding in the sign\'s own column and refuses one past it', () => {
+    /**
+     * REPORTED by Jesse: "sidings should not be allowed to be built outside the limits". §3 defines
+     * Secondary Track as "all tracks IN YOUR LIMITS that are not the Running Track", so the bound
+     * belongs to the district rather than to the one row the sign stands in — it used to guard the
+     * Running Track alone, and a siding could run east past a player's own sign, taking industries
+     * with it, onto track that §8.1 and §10 do not consider his territory at all.
+     *
+     * INCLUSIVE of the sign's column, which is the half that keeps the game playable: the opening
+     * district is signs at ±1 around the Office, so the strict reading would leave one buildable
+     * column and break §11.3's promise that both Secondary rows are usable from the first Stage.
+     */
+    const s = game();
+    const under = district(s);
+    const cardId = trackInHand(s, 'straight');
+    assert.equal(
+      check(s, 0, { type: 'card.play', cardId, placement: under }),
+      null,
+      'a siding may run under the Limits sign — the sign stands ON the boundary, not beyond it',
+    );
+    assert.equal(
+      check(s, 0, { type: 'card.play', cardId, placement: at(under.row, under.col + 1) }),
+      'OUTSIDE_LIMITS',
+      'a siding was built outside the district it belongs to',
+    );
+  });
+
+  it('refuses an industry outside the Limits — a Facility carries track', () => {
+    // §11.2: "Facility cards carry their own rails — placing a Facility places track." So the bound
+    // is the same one, and said with the same code rather than left to read as NOT_CONNECTED.
+    const s = game();
+    const under = district(s);
+    const cardId = industryOf(s, 'mineTipple');
+    assert.equal(check(s, 0, { type: 'card.play', cardId, placement: under }), null);
+    assert.equal(
+      check(s, 0, { type: 'card.play', cardId, placement: at(under.row, under.col + 1) }),
+      'OUTSIDE_LIMITS',
+    );
+  });
+
+  it('offers a Modifier the DIAGONAL spots around its host, not just the four orthogonal ones', () => {
+    /**
+     * REPORTED by Jesse: a Modifier could not be placed to the south-east of his industry. §9 places
+     * one "adjacent to a Facility, on any of the nine nearby spots" and `check` has always accepted
+     * all eight neighbours — it was `placementCandidates` that walked north, south, east and west
+     * only, so a diagonal square with no orthogonal neighbour was legal and never offered.
+     */
+    const s = game();
+    const under = district(s);
+    buildFacility(s, 'packingSheds', under);
+    const cardId = modifierOf(s, 'iceHouse');
+
+    const offered = legalActions(s, 0)
+      .filter((i) => i.type === 'card.play' && i.cardId === cardId && i.placement !== undefined)
+      .map((i) => coordKey((i as { placement: GridCoord }).placement));
+
+    // South-east of the host, and orthogonally adjacent to nothing at all.
+    const southEast = at(under.row - 1, under.col + 1);
+    assert.ok(
+      offered.includes(coordKey(southEast)),
+      `the south-east spot (${southEast.row}, ${southEast.col}) is legal but was never offered — offered: ${offered.join(' ')}`,
+    );
+    assert.equal(check(s, 0, { type: 'card.play', cardId, placement: southEast }), null);
+  });
+
+  it('lets a Modifier hang outside the Limits, but never in the Running Track row', () => {
+    /**
+     * Jesse's call, both halves. A Modifier is not track (§9), so a host standing at the limit keeps
+     * all nine of its spots — refusing the outer three would make the card unplayable exactly where
+     * the district ends. The Running Track ROW is the exception: inside the Limits that row is
+     * always full, so this bites only beyond the sign, and that is the ground the main grows onto —
+     * a Modifier parked there would block the player's own sign from moving outward (§2.1).
+     */
+    const s = game();
+    const under = district(s);
+    buildFacility(s, 'packingSheds', under);
+    const cardId = modifierOf(s, 'iceHouse');
+    const area = areaOf(s, 0);
+
+    assert.equal(
+      check(s, 0, { type: 'card.play', cardId, placement: at(under.row, under.col + 1) }),
+      null,
+      'a Modifier beside a host at the limit was refused the spot outside it',
+    );
+    assert.equal(
+      check(s, 0, { type: 'card.play', cardId, placement: at(area.runningRow, under.col + 1) }),
+      'ON_RUNNING_TRACK',
+      'a Modifier was allowed to stand in the row the Running Track grows along',
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+
 describe("a Modifier grants only what its host's flow can use", () => {
   const withFacility = (kind: string, out: boolean, into: boolean) => ({
     geometry: { kind: 'facility', facility: kind, axis: 'ew' },
@@ -1111,14 +1344,19 @@ describe('Industry cards go on a stub, and lock each other out', () => {
    * A district with a siding hanging off the Running Track, which is the only place an industry may
    * go. Returns the siding square east of the curve.
    *
-   *   row  0:  [lim] [office] [turnout, leg south] …          <- Running Track
+   *   row  0:  [lim] [office] [turnout, leg south] [lim]      <- Running Track
    *   row -1:                 [curve ne] [siding square]
+   *
+   * The turnout is laid ON the east Limits sign, which is how the Running Track grows — so the sign
+   * MOVES OUT with it (§2.1, Gap 4a), exactly as `extendLimitsIfNeeded` does when the card is played
+   * rather than written straight into the grid. Without that the siding square would be outside the
+   * district's own Limits, which is no longer a place track may go.
    */
   function withSiding(s: GameState): GridCoord {
     const area = areaOf(s, 0);
     const plain = (geometry: object): TrackCard => ({
       geometry: geometry as TrackCard['geometry'],
-      baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [],
+      baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
     });
     const col = area.limitsEast.col;
     area.grid.set(coordKey(at(area.runningRow, col)), plain({
@@ -1127,6 +1365,8 @@ describe('Industry cards go on a stub, and lock each other out', () => {
     area.grid.set(coordKey(at(area.runningRow - 1, col)), plain({
       kind: 'track', geometry: 'curved', arc: 'ne', hand: 'left',
     }));
+    area.limitsEast = at(area.runningRow, col + 1);
+    area.grid.set(coordKey(area.limitsEast), plain({ kind: 'limits' }));
     s.clock.phase = 'localOps';
     s.clock.currentActor = 0;
     turnOf(s, 0).option = 'draw';
@@ -1148,7 +1388,7 @@ describe('Industry cards go on a stub, and lock each other out', () => {
   function build(s: GameState, kind: string, coord: GridCoord): void {
     areaOf(s, 0).grid.set(coordKey(coord), {
       geometry: { kind: 'facility', facility: kind as never },
-      baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [],
+      baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
     });
   }
 
@@ -1443,8 +1683,9 @@ describe('the engine is drawn pointing east or west, whatever track it is standi
     addCard(s, at(0, 0), straight());
     reduce(s, moved(id, 's'));
     const cell = snapshot(s, [], null).cells.find((c) => c.row === 0 && c.col === 0);
-    assert.ok(cell?.train, 'the train should be on the card');
-    assert.ok(cell.train.facing === 'e' || cell.train.facing === 'w', `got ${cell.train.facing}`);
+    const train = cell?.trains[0];
+    assert.ok(train, 'the train should be on the card');
+    assert.ok(train.facing === 'e' || train.facing === 'w', `got ${train.facing}`);
   });
 });
 
@@ -1468,6 +1709,7 @@ describe('a train that rounds a curve points where the curve took it', () => {
     geometry: { kind: 'track', geometry: 'curved', arc, hand: 'right' },
     baseOperationalRail: true,
     standing: [],
+    standingWest: 0,
     facility: null,
     modifiers: [],
     enhancements: [],
@@ -1604,11 +1846,11 @@ describe('the switching job a player actually does: put a car in a siding, take
    */
   const curve = (arc: 'ne' | 'nw' | 'se' | 'sw'): TrackCard => ({
     geometry: { kind: 'track', geometry: 'curved', arc, hand: 'right' },
-    baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [],
+    baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
   });
   const turnout = (o: { stem: 'n' | 's' | 'e' | 'w'; through: 'n' | 's' | 'e' | 'w'; diverge: 'n' | 's' | 'e' | 'w' }): TrackCard => ({
     geometry: { kind: 'track', geometry: 'turnout', turnout: o, hand: 'right' },
-    baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [],
+    baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
   });
 
   it('takes a cut off the Running Track into a siding and sets it out', () => {

test/cut-ordering.test.ts

@@ -18,8 +18,11 @@ import { carsOn, coordKey, turnOf } from '../src/engine/state.ts';
 
 const config: GameConfig = {
   mode: 'solitaire',
-  victory: 'highestAfterDays',
-  length: 'standard',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
   optionalRules: {
     reducedVisibility: false,
     sisterTrains: false,
@@ -36,6 +39,7 @@ const straight = (standing: RollingStock[] = []): TrackCard => ({
   geometry: { kind: 'track', geometry: 'straight' },
   baseOperationalRail: true,
   standing,
+  standingWest: 0,
   facility: null,
   modifiers: [],
   enhancements: [],
@@ -149,7 +153,14 @@ describe('a cut parks in the same order however many cars come off at once', ()
 
     // Facing east: the nose cut (boxcar) is set out east of the engine, the tail cut (tank) west.
     assert.deepEqual(standingAt(s, at(1, 0)), ['tank', 'boxcar']);
-    assert.equal(s.trays.get(id)!.standingWest, 1, 'the engine should be standing between the two cuts');
+    // `standingWest` lives on the CARD now, not the tray (docs/plans/switching-paths.md — "The
+    // Roster Pass"): the Office is the one square more than one train may share, and a cut lies
+    // west or east of the block of A/D tracks rather than of any one engine.
+    assert.equal(
+      areaOf(s, 0).grid.get(coordKey(at(1, 0)))!.standingWest,
+      1,
+      'the engine should be standing between the two cuts',
+    );
   });
 });
 

test/enhancements.test.ts

@@ -18,8 +18,11 @@ import { coordKey, subdivisions, turnOf } from '../src/engine/state.ts';
 
 const config: GameConfig = {
   mode: 'solitaire',
-  victory: 'highestAfterDays',
-  length: 'standard',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
   optionalRules: { reducedVisibility: false, sisterTrains: false, employeeRotation: false, emergencyToolbox: false },
 };
 const game = (seed = 5): GameState => createGame({ id: 'g', seed, config, playerNames: ['p'] });
@@ -29,6 +32,7 @@ const straight = (): TrackCard => ({
   geometry: { kind: 'track', geometry: 'straight' },
   baseOperationalRail: true,
   standing: [],
+  standingWest: 0,
   facility: null,
   modifiers: [],
   enhancements: [],
@@ -467,9 +471,10 @@ describe('§8.1 — a train that just arrived from the mainline stops for the St
    * Nothing states the rule, which makes it exactly the kind of property a later change to the loop
    * would break in silence. These pin it.
    *
-   * It is also what gives the printed **Expedite** rule something to do — an Expedited train departs
-   * at the END of the Stage it arrived, precisely because the general rule forbids it departing at
-   * all. It stands through Load/Unload first, which is what makes its coaches workable.
+   * v0.4.9 CORRECTED Q3 so **Expedite is not an exception to this any more**: an Expedited train
+   * stops for the Stage exactly like any other and may be switched in the Local Operations turn that
+   * follows. What Expedite restricts is where the train may be left standing afterwards, not when it
+   * departs — see `advance.test.ts`'s `expediteFault` coverage for that half.
    */
   const arriving = (s: GameState, trainNumber: number, isExtra = false): string => {
     const id = 'arriving';
@@ -502,12 +507,14 @@ describe('§8.1 — a train that just arrived from the mainline stops for the St
     );
   });
 
-  it('unless its card prints Expedite — but it still stands through Load/Unload first', () => {
+  it('an Expedite train follows the same rule now — no exception any more', () => {
     /**
-     * Q3, as revised in v0.4.2. An Expedite train leaves the Stage it arrives, but at the END of that
-     * Stage rather than inside the Mainline Phase. It used to be gone before Load/Unload ran, which
-     * made the coaches on every coach-carrying express (1/2, 5/6, 19) permanently unworkable —
-     * measured, Train 2 arrived 32 times in 60 games and stood for Load/Unload in none of them.
+     * Q3, as CORRECTED in v0.4.9. Before this, an Expedite train left the Stage it arrived — at the
+     * end of it rather than inside the Mainline Phase (v0.4.2's fix for coaches otherwise never
+     * reaching Load/Unload) — which made it the one exception to "stops for the Stage". That forced
+     * departure is gone: Expedite no longer changes WHEN a train leaves, only where it may be left
+     * standing afterwards (`expediteFault`, pinned in `advance.test.ts`). So it stops for the Stage
+     * exactly like Train 9 above.
      */
     const s = game();
     assert.equal(trainProfile(3, false)?.rules.expedite, true, 'train 3 should be an Expedite train');
@@ -517,19 +524,9 @@ describe('§8.1 — a train that just arrived from the mainline stops for the St
 
     assert.equal(
       s.trays.get(id)!.position.at, 'grid',
-      'an Expedite train left inside the Mainline Phase, before Load/Unload could reach it',
+      'an Expedite train departed again in the same Stage it arrived from a mainline card',
     );
-    assert.equal(s.trays.get(id)!.departsThisStage, true, 'it is not flagged to leave at the end of the Stage');
     assert.ok(areaOf(s, 0).adOccupancy.includes(id), 'it is not standing on an A/D track');
-
-    // Run the end of the Stage directly. Load/Unload waits on the player, and the thing under test
-    // is the departure pass that follows it — not that phase's own input handling.
-    s.clock.phase = 'shiftChange';
-    advance(s);
-    assert.notEqual(
-      s.trays.get(id)?.position.at, 'grid',
-      'an Expedite train should be gone by the end of the Stage it arrived',
-    );
   });
 });
 
@@ -665,6 +662,50 @@ describe('Telegraph, Telephone and Radio dispatch meets', () => {
     assert.deepEqual(s.trays.get('mine')!.position, { at: 'divisionPoint', side: 'west' });
   });
 
+  it('holds against an uncleared facing train even if a same-direction one is checked first', () => {
+    // Reproduces a playtest report: the Superintendent was asked to rule on a same-direction train
+    // instead of being automatically held against an opposite-direction one also occupying the
+    // card. Root cause — `evaluateClearance` returned on whichever occupant it examined first, in
+    // `node.transits` insertion order, rather than checking every occupant. Only visible once a
+    // card can hold two trains at once, which the Telegraph/Telephone/Radio exception is exactly
+    // what creates: a facing train dispatched past another sits on the same card as it.
+    const s = game();
+    const ml = s.division.nodes[1];
+    assert.equal(ml?.kind, 'mainline');
+    if (ml?.kind === 'mainline') {
+      ml.card = 'plains';
+      // SAME direction, entered the transit list FIRST — what the old code asked about.
+      s.trays.set('sameDir', {
+        id: 'sameDir', trainNumber: 3, trainIsExtra: false, engineAt: 0,
+        consist: [], direction: 'east', position: { at: 'mainline', index: 1 }, movesUsed: 0,
+      });
+      ml.transits.push({ tray: 'sameDir', stagesRemaining: 2, stagesTotal: 2, direction: 'east' });
+      // OPPOSITE direction, entered SECOND, no dispatch device on the board — an absolute bar.
+      s.trays.set('facing', {
+        id: 'facing', trainNumber: 5, trainIsExtra: false, engineAt: 0,
+        consist: [], direction: 'west', position: { at: 'mainline', index: 1 }, movesUsed: 0,
+      });
+      ml.transits.push({ tray: 'facing', stagesRemaining: 2, stagesTotal: 2, direction: 'west' });
+    }
+    s.trays.set('mine', {
+      id: 'mine', trainNumber: 9, trainIsExtra: false, engineAt: 0,
+      consist: [], direction: 'east', position: { at: 'divisionPoint', side: 'west' }, movesUsed: 0,
+    });
+    s.clock.phase = 'mainline';
+    s.movedThisPhase = new Set();
+
+    const r = advance(s);
+
+    assert.equal(
+      s.trays.get('mine')!.position.at, 'divisionPoint',
+      'the train entered despite an uncleared opposite-direction occupant on the card',
+    );
+    assert.ok(
+      !r.events.some((e) => e.type === 'clearanceRequested'),
+      'the Superintendent was asked to rule on the same-direction occupant instead of an automatic hold',
+    );
+  });
+
   it('lets a junior train win the meet with a Telegraph', () => {
     // Train 9 against Train 3: +4 makes the other count as 7 — still senior. Radio's +12 wins.
     const s = game();

test/events.test.ts

@@ -46,6 +46,7 @@ const KNOWN_UNREDUCED = [
   'carPassed',
   'clearanceRequested',
   'dispatchBonusUsed',
+  'expediteFault',
   'phaseBegan',
   'stageBegan',
   'trainArrived',

test/frame-delta.test.ts

@@ -0,0 +1,87 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { areaOf } from '../src/engine/apply.ts';
+import { createGame } from '../src/engine/setup.ts';
+import { coordKey } from '../src/engine/state.ts';
+import type { GameConfig, GameState } from '../src/engine/state.ts';
+import { applyDelta, deltaFrame } from '../src/sim/frame-delta.ts';
+import { snapshot } from '../src/sim/view.ts';
+
+const config: GameConfig = {
+  mode: 'solitaire',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
+  optionalRules: {
+    reducedVisibility: false,
+    sisterTrains: false,
+    employeeRotation: false,
+    emergencyToolbox: false,
+  },
+};
+
+const game = (seed = 1): GameState => createGame({ id: 'g', seed, config, playerNames: ['a'] });
+
+describe('deltaFrame — the live one-step-back board diff', () => {
+  it('nulls cells/facilities/division when the board has not changed, keeps everything else', () => {
+    const s = game();
+    const first = snapshot(s, [], null);
+    s.players[0]!.revenue = 42; // a non-board change
+    const second = snapshot(s, [], null);
+
+    const delta = deltaFrame(first, second);
+    assert.equal(delta.cells, null, 'unchanged cells were not nulled');
+    assert.equal(delta.facilities, null, 'unchanged facilities were not nulled');
+    assert.equal(delta.division, null, 'unchanged division was not nulled');
+    assert.equal(delta.revenue, 42, 'a real change was dropped along with the unchanged board');
+  });
+
+  it('sends the real board when it changed', () => {
+    const s = game();
+    const first = snapshot(s, [], null);
+    const area = areaOf(s, 0);
+    area.grid.set(coordKey({ row: area.runningRow - 1, col: 0 }), {
+      geometry: { kind: 'track', geometry: 'straight' },
+      baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
+    });
+    const second = snapshot(s, [], null);
+
+    const delta = deltaFrame(first, second);
+    assert.notEqual(delta.cells, null, 'a real board change was nulled');
+    assert.deepEqual(delta.cells, second.cells);
+  });
+
+  it('never nulls anything on a first connect (no previous Frame)', () => {
+    const s = game();
+    const frame = snapshot(s, [], null);
+    const delta = deltaFrame(null, frame);
+    assert.deepEqual(delta.cells, frame.cells);
+    assert.deepEqual(delta.facilities, frame.facilities);
+    assert.deepEqual(delta.division, frame.division);
+  });
+
+  it('applyDelta round-trips: merge(delta(A, B)) against A reconstructs B exactly', () => {
+    const s = game();
+    const a = snapshot(s, [], null);
+    s.players[0]!.revenue = 7;
+    const area = areaOf(s, 0);
+    area.grid.set(coordKey({ row: area.runningRow - 1, col: 1 }), {
+      geometry: { kind: 'track', geometry: 'straight' },
+      baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
+    });
+    const b = snapshot(s, [], null);
+
+    const merged = applyDelta(a, deltaFrame(a, b));
+    assert.deepEqual(merged, b);
+  });
+
+  it('throws rather than silently reconstructing garbage when previous is missing but the delta says "unchanged"', () => {
+    const s = game();
+    const frame = snapshot(s, [], null);
+    const delta = deltaFrame(frame, frame); // everything nulled, since nothing changed
+    assert.throws(() => applyDelta(null, delta));
+  });
+});

test/harness.test.ts

@@ -29,8 +29,11 @@ const root = join(dirname(fileURLToPath(import.meta.url)), '..');
 
 const config: GameConfig = {
   mode: 'solitaire',
-  victory: 'highestAfterDays',
-  length: 'standard',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
   optionalRules: {
     reducedVisibility: false,
     sisterTrains: false,

test/mainline-cards.test.ts

@@ -32,8 +32,11 @@ import { snapshot } from '../src/sim/view.ts';
 
 const config: GameConfig = {
   mode: 'solitaire',
-  victory: 'highestAfterDays',
-  length: 'standard',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
   optionalRules: { reducedVisibility: false, sisterTrains: false, employeeRotation: false, emergencyToolbox: false },
 };
 const game = (seed = 5): GameState => createGame({ id: 'g', seed, config, playerNames: ['p'] });
@@ -313,6 +316,7 @@ describe('Flying Switch rolls a cut into an industry', () => {
       geometry: { kind: 'track', geometry: 'straight' },
       baseOperationalRail: true,
       standing: [],
+      standingWest: 0,
       facility: null,
       modifiers: [],
       enhancements: [],
@@ -732,7 +736,7 @@ describe('regions on a Mainline card (§2.1, §8.2)', () => {
       id: 'reg',
       seed: 4,
       config: {
-        mode: 'solitaire', victory: 'highestAfterDays', length: 'standard',
+        mode: 'solitaire', days: 5, minCombinedRevenue: 0, maxCollisionsPerDay: 0, maxCollisionsTotal: 0, pvpCardsAllowed: false,
         optionalRules: { reducedVisibility: false, sisterTrains: false, employeeRotation: false, emergencyToolbox: false },
       },
       playerNames: ['Solitaire'],
@@ -795,7 +799,7 @@ describe('Q13 — a train that catches the one ahead runs into it', () => {
     const s = createGame({
       id: 'rear', seed: 3,
       config: {
-        mode: 'solitaire', victory: 'highestAfterDays', length: 'standard',
+        mode: 'solitaire', days: 5, minCombinedRevenue: 0, maxCollisionsPerDay: 0, maxCollisionsTotal: 0, pvpCardsAllowed: false,
         optionalRules: { reducedVisibility: false, sisterTrains: false, employeeRotation: false, emergencyToolbox: false },
       },
       playerNames: ['bot'],

test/multiplayer.test.ts

@@ -11,21 +11,31 @@ import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
 
 import { advance, pump } from '../src/engine/advance.ts';
-import { areaAtSeat, areaOf } from '../src/engine/apply.ts';
+import { applyIntent, areaAtSeat, areaOf } from '../src/engine/apply.ts';
 import { STAGES_PER_SHIFT, crewTrayCount } from '../src/engine/content.ts';
 import { createGame } from '../src/engine/setup.ts';
 import type { GameConfig, GameState, PlayerIndex } from '../src/engine/state.ts';
-import { coordKey, playerAtSeat, seatOf, subdivisions } from '../src/engine/state.ts';
+import { coordKey, playerAtSeat, playerLeftOf, seatOf, subdivisions } from '../src/engine/state.ts';
 import { developerBot, playGame } from '../src/sim/bot.ts';
 import { snapshot } from '../src/sim/view.ts';
 import { impediments } from '../src/sim/narrate.ts';
 import { readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
+import { actionMenu } from '../src/web/game.ts';
+import type { Game } from '../src/web/game.ts';
+
+/** The thin wrapper `actionMenu` expects, built directly around an already-created multi-player state
+ * — `newGame` (game.ts) hardcodes one player, so it cannot construct this for a multi-seat game. */
+const wrap = (s: GameState): Game =>
+  ({ state: s, seed: s.seed, history: [], log: [], mustPlayCard: false, cues: [], scheduled: null, justDrawn: null, announced: null });
 
 const competitive: GameConfig = {
   mode: 'competitive',
-  victory: 'highestAfterDays',
-  length: 'standard',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
   optionalRules: { reducedVisibility: false, sisterTrains: false, employeeRotation: false, emergencyToolbox: false },
 };
 
@@ -450,7 +460,7 @@ describe('the view shows one seat at a time', () => {
       for (let n = 0; n < p; n++) {
         area.grid.set(coordKey({ row: area.runningRow - 1, col: n }), {
           geometry: { kind: 'track', geometry: 'straight' },
-          baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [],
+          baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
         });
       }
       s.decks.hands.set(p, source.slice(0, p + 1));
@@ -474,6 +484,9 @@ describe('the view shows one seat at a time', () => {
      * which is a list of squares that do not exist on the board they are looking at.
      */
     const s = game(3);
+    // A real floor to pace against — the shared `competitive` fixture leaves it off (0) since most
+    // tests in this file don't care, but pacing against "off" is trivially "always on pace" (view.ts).
+    s.config.minCombinedRevenue = 10;
     s.players[0]!.revenue = 1;
     s.players[1]!.revenue = 9;
     s.players[2]!.revenue = 17;
@@ -527,7 +540,7 @@ describe('the view shows one seat at a time', () => {
     readyToLeave(s, 1, 'crew-1', 'east');
 
     const withTray = (p: PlayerIndex): number =>
-      snapshot(s, [], null, null, null, false, p).cells.filter((c) => c.tray != null).length;
+      snapshot(s, [], null, null, null, false, p).cells.filter((c) => c.trains.length > 0).length;
     assert.equal(withTray(1), 1, "the crew is not on its own seat's board");
     assert.deepEqual([withTray(0), withTray(2)], [0, 0], "a crew was drawn onto another seat's board");
   });
@@ -594,9 +607,108 @@ describe('scoring lands on the right seat', () => {
     const sizeBefore = areaAtSeat(s, 2).grid.size;
     mine.grid.set(coordKey({ row: mine.runningRow - 1, col: 0 }), {
       geometry: { kind: 'track', geometry: 'straight' },
-      baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [],
+      baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
     });
     assert.equal(areaAtSeat(s, 2).grid.size, sizeBefore, "one seat's track appeared in another's district");
     assert.notEqual(areaAtSeat(s, 1), areaAtSeat(s, 2), 'two seats share one Office Area object');
   });
 });
+
+describe('the New Train phase car-placement round rotates (§7, Gap 9)', () => {
+  /**
+   * REGRESSION. `newTrainPhase` used to hand the whole car-filling loop to a fixed actor —
+   * `actorOffset` is reset to 0 entering the phase and was never incremented, so `actorAt(s, 0)`
+   * always resolved to the Superintendent, who placed every car of every train alone. The written
+   * rule (`rules-v0.2.md` §7, Gap 9) is explicit: "starting with the Superintendent and working
+   * left, each player may place ONE car... the round repeats... until the consist is full," with a
+   * worked example showing seats alternating. The fix reads the round position off
+   * `tray.consist.length` instead, which is already exactly that counter and resets per train.
+   */
+  it('cycles Superintendent-then-left, one car per player, wrapping as the round repeats', () => {
+    // Train 1, "Crack Limited" — 3 coaches, no freight or caboose (content.ts) — small enough to
+    // exercise both a player count that wraps (2p: seats 0,1,0) and one that doesn't (3p: 0,1,2).
+    for (const players of [2, 3]) {
+      const s = game(players);
+      s.clock.phase = 'newTrain';
+      s.trays.set('t1', {
+        id: 't1',
+        trainNumber: 1,
+        trainIsExtra: false,
+        engineAt: 0,
+        consist: [],
+        direction: 'west',
+        position: { at: 'divisionPoint', side: 'east' },
+        movesUsed: 0,
+      });
+      s.yards.divisionYard.push(
+        { type: 'coach', loaded: false },
+        { type: 'coach', loaded: false },
+        { type: 'coach', loaded: false },
+      );
+
+      const expected = [0, 1, 2].map((offset) => playerLeftOf(s, s.clock.superintendent, offset));
+      const seenActors: PlayerIndex[] = [];
+      for (let guard = 0; guard < 10; guard++) {
+        const r = advance(s);
+        if (!r.needsInput) break;
+        const actor = s.clock.currentActor!;
+        seenActors.push(actor);
+        const result = applyIntent(s, actor, {
+          type: 'newTrain.placeCar',
+          trayId: 't1',
+          carType: 'coach',
+          loaded: false,
+        });
+        assert.ok(result.ok, `${players}p: placeCar rejected — ${result.ok ? '' : result.code}`);
+      }
+
+      const wanted = [0, 1, 2].map((i) => expected[i % players]!);
+      assert.deepEqual(
+        seenActors,
+        wanted,
+        `${players}p: actor sequence was [${seenActors}], wanted [${wanted}] (Superintendent-then-left)`,
+      );
+    }
+  });
+});
+
+describe('actionMenu is seat-safe (Phase 2 prep)', () => {
+  /**
+   * REGRESSION. `actionMenu(game, seat)` used `seat` only for the `hand` field — `options`/`direct`/
+   * `placeable`/`makeUp` all came from `currentActor(game)` regardless of which seat was asked. A
+   * server computing every connected seat's Menu would have handed the acting player's legal moves to
+   * a waiting seat, paired with the WRONG seat's hand. Found tracing Phase 2's per-seat Menu step.
+   */
+  it('gives the acting seat its real options, and every other seat none at all', () => {
+    const s = game(3);
+    const g = wrap(s);
+    const actorSeat = s.clock.currentActor!;
+    const waiting = [0, 1, 2].filter((seat) => seat !== actorSeat);
+
+    const actorMenu = actionMenu(g, actorSeat as PlayerIndex);
+    assert.ok(actorMenu.options.length > 0, "the acting seat's Menu had no options at all");
+
+    for (const seat of waiting) {
+      const menu = actionMenu(g, seat as PlayerIndex);
+      assert.deepEqual(menu.options, [], `seat ${seat} (not acting) was given real options`);
+      assert.deepEqual(menu.direct, [], `seat ${seat} (not acting) was given direct actions`);
+      assert.deepEqual(menu.placeable, [], `seat ${seat} (not acting) was given placeable actions`);
+      assert.equal(menu.makeUp, null, `seat ${seat} (not acting) was given a make-up panel`);
+    }
+  });
+
+  it('still shows a waiting seat its own hand, just nothing to do with it', () => {
+    const s = game(3);
+    const g = wrap(s);
+    const actorSeat = s.clock.currentActor!;
+    const waitingSeat = [0, 1, 2].find((seat) => seat !== actorSeat)! as PlayerIndex;
+
+    const menu = actionMenu(g, waitingSeat);
+    const expectedHand = s.decks.hands.get(waitingSeat) ?? [];
+    assert.equal(menu.hand.length, expectedHand.length, "the waiting seat's own hand did not come through");
+    for (const card of menu.hand) {
+      assert.equal(card.playNow, null, 'a waiting seat was offered a way to play a card');
+      assert.equal(card.spots, 0, 'a waiting seat was offered somewhere to place a card');
+    }
+  });
+});

test/redaction.test.ts

@@ -0,0 +1,118 @@
+/**
+ * §7's redaction test — "the single most important test in the plan."
+ *
+ * Everything else about `Frame` degrades gracefully; a redaction bug hands one player's hand to
+ * another and cannot be walked back once it has been seen. `test/multiplayer.test.ts`'s "the view
+ * shows one seat at a time" section already proves `snapshot(s, ..., viewer)` gives each seat its
+ * own hand, board and Revenue — spot-checks that today's code does the right thing. This is the
+ * different, exhaustive check: serialize a seat's whole `Frame` and assert none of some OTHER seat's
+ * actual secret data appears anywhere in it, so a future careless edit is caught rather than assumed
+ * safe. No server needed — `snapshot()` and a multi-player `GameState` are all this exercises.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { pump } from '../src/engine/advance.ts';
+import { createGame } from '../src/engine/setup.ts';
+import type { GameConfig, GameState, PlayerIndex } from '../src/engine/state.ts';
+import { developerBot, playGame } from '../src/sim/bot.ts';
+import { snapshot } from '../src/sim/view.ts';
+
+const config: GameConfig = {
+  mode: 'competitive',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
+  optionalRules: {
+    reducedVisibility: false,
+    sisterTrains: false,
+    employeeRotation: false,
+    emergencyToolbox: false,
+  },
+};
+
+/** Plays a real multi-player game partway — enough for every seat to hold a real, distinct hand. */
+function midGame(players: number, seed: number): GameState {
+  const s = createGame({
+    id: `redact-${players}`,
+    seed,
+    config,
+    playerNames: Array.from({ length: players }, (_, i) => `p${i}`),
+  });
+  const r = playGame(s, developerBot, pump, 400);
+  // A partial or finished game both exercise real hands — either is fine for this check.
+  void r;
+  return s;
+}
+
+describe('redaction — a seat\'s Frame never carries another seat\'s secrets', () => {
+  it('never contains another seat\'s actual hand-card ids', () => {
+    for (const players of [3, 4]) {
+      const s = midGame(players, 1000 + players);
+      for (let viewer = 0 as PlayerIndex; viewer < players; viewer++) {
+        const serialized = JSON.stringify(snapshot(s, [], null, null, null, false, viewer));
+        for (let other = 0 as PlayerIndex; other < players; other++) {
+          if (other === viewer) continue;
+          for (const cardId of s.decks.hands.get(other) ?? []) {
+            assert.ok(
+              !serialized.includes(`"${cardId}"`),
+              `${players}p seed ${1000 + players}: seat ${viewer}'s Frame contains seat ${other}'s ` +
+                `hand card id "${cardId}"`,
+            );
+          }
+        }
+      }
+    }
+  });
+
+  it('never contains the Home Office deck\'s order or contents, only its count', () => {
+    for (const players of [3, 4]) {
+      const s = midGame(players, 2000 + players);
+      // The deck's own card ids are the thing that must never leak — distinct from any hand's ids,
+      // since a card once dealt is removed from `homeOffice` (state.ts).
+      const deckIds = new Set(s.decks.homeOffice);
+      for (let viewer = 0 as PlayerIndex; viewer < players; viewer++) {
+        const frame = snapshot(s, [], null, null, null, false, viewer);
+        assert.equal(frame.deck, s.decks.homeOffice.length, 'deck field is not a plain count');
+        const serialized = JSON.stringify(frame);
+        for (const cardId of deckIds) {
+          assert.ok(
+            !serialized.includes(`"${cardId}"`),
+            `${players}p seed ${2000 + players}: seat ${viewer}'s Frame contains a Home Office deck id "${cardId}"`,
+          );
+        }
+      }
+    }
+  });
+
+  it('never carries the seed or rngState — Frame has no field for either', () => {
+    // A structural guarantee, not a runtime one: confirmed here so a future field addition to Frame
+    // that reintroduces one of these is at least forced past a reader of this test, if not the type
+    // system directly (see Frame in src/sim/view.ts, which carries neither today).
+    const s = midGame(3, 3003);
+    const frame = snapshot(s, [], null, null, null, false, 0);
+    assert.ok(!('seed' in frame), 'Frame gained a seed field');
+    assert.ok(!('rngState' in frame), 'Frame gained an rngState field');
+    const serialized = JSON.stringify(frame);
+    assert.ok(!serialized.includes(String(s.seed)), 'the seed value leaked into the Frame some other way');
+  });
+
+  it('only the viewer\'s own hand and handCount are non-public — everything else matches across seats', () => {
+    // The redaction surface is four fields (§7), not sixty event types. Cross-check that seats agree
+    // on everything else a Frame carries about shared state.
+    const s = midGame(3, 4004);
+    const frames = [0, 1, 2].map((p) => snapshot(s, [], null, null, null, false, p as PlayerIndex));
+    for (const f of frames) {
+      assert.deepEqual(f.timetable, frames[0]!.timetable, 'the public timetable differs by seat');
+      assert.deepEqual(f.deck, frames[0]!.deck, 'the deck count differs by seat');
+      assert.deepEqual(
+        f.players.map((p) => ({ index: p.index, revenue: p.revenue, hand: p.hand })),
+        frames[0]!.players.map((p) => ({ index: p.index, revenue: p.revenue, hand: p.hand })),
+        'public standing (names, Revenue, hand COUNTS) differs by seat',
+      );
+    }
+  });
+});

test/replay.test.ts

@@ -9,6 +9,7 @@ import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
 
 import { pump } from '../src/engine/advance.ts';
+import { DEFAULT_MAX_COLLISIONS_PER_DAY, DEFAULT_MAX_COLLISIONS_TOTAL, collectiveRevenueFloor } from '../src/engine/content.ts';
 import type { GameEvent } from '../src/engine/events.ts';
 import { createGame } from '../src/engine/setup.ts';
 import type { GameConfig } from '../src/engine/state.ts';
@@ -17,10 +18,15 @@ import { impediments, isVisible, narrate, phaseLabel } from '../src/sim/narrate.
 import { compress, rehydrateCells, record, renderHtml } from '../src/sim/replay.ts';
 import { summarize } from '../src/sim/stats.ts';
 
+// Mirrors `record()`'s own default exactly (`replay.ts`) — "does not drift from the engine" below
+// plays the same seed through both paths and compares outcomes, so they must share one floor.
 const config: GameConfig = {
   mode: 'solitaire',
-  victory: 'highestAfterDays',
-  length: 'standard',
+  days: 5,
+  minCombinedRevenue: collectiveRevenueFloor(1, 5),
+  maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
+  maxCollisionsTotal: DEFAULT_MAX_COLLISIONS_TOTAL,
+  pvpCardsAllowed: false,
   optionalRules: {
     reducedVisibility: false,
     sisterTrains: false,
@@ -58,7 +64,7 @@ const SAMPLES: GameEvent[] = [
   { type: 'loadAdvanced', player: 0, at: { row: 1, col: 0 }, fromBox: 0, toBox: 1 },
   { type: 'unloadCompleted', player: 0, at: { row: 1, col: 0 }, carType: 'hopper' },
   { type: 'loadCompleted', player: 0, at: { row: 1, col: 0 }, carType: 'hopper' },
-  { type: 'unloadBegan', player: 0, at: { row: 1, col: 0 }, carType: 'hopper' },
+  { type: 'unloadBegan', player: 0, at: { row: 1, col: 0 }, carType: 'hopper', carIndex: 0 },
   { type: 'revenueChanged', player: 0, delta: 1, total: 3, reason: 'freightLoad' },
   { type: 'phaseEnded', player: 0, phase: 'localOps' },
 ];
@@ -368,6 +374,34 @@ describe('the replay wire format is lossless (regression)', () => {
     assert.ok(checked > 100, `only ${checked} frames checked`);
   });
 
+  it("tolerates an older recording's singular train at the trains slot", () => {
+    // Before "The Roster Pass" (docs/plans/switching-paths.md), the trains slot held one train
+    // object or null — `rehydrateCells` has to make sense of that shape too, with no version flag
+    // anywhere in a packed row to key off.
+    const cards: unknown[] = [[0, 0, 'office', 'Whistle Post', true, ['ew']]];
+    const whats = ['a station'];
+    const facs: unknown[] = [];
+    const oldTrain = { trayId: 'crew', label: 'crew', cars: [], engineAt: 0, facing: 'e', what: '' };
+
+    const [withObject] = rehydrateCells([[0, 0, [], [], -1, oldTrain, 1, [], 0]], cards, whats, facs) as {
+      trains: unknown[];
+    }[];
+    assert.deepEqual(withObject!.trains, [oldTrain], 'a lone train object should wrap into a one-train roster');
+
+    const [withNull] = rehydrateCells([[0, 0, [], [], -1, null, 1, [], 0]], cards, whats, facs) as {
+      trains: unknown[];
+    }[];
+    assert.deepEqual(withNull!.trains, [], 'a null train slot should read as no train at all');
+
+    const [withArray] = rehydrateCells(
+      [[0, 0, [], [], -1, [oldTrain, oldTrain], 1, [], 0]],
+      cards,
+      whats,
+      facs,
+    ) as { trains: unknown[] }[];
+    assert.equal(withArray!.trains.length, 2, 'an array should ride through as-is');
+  });
+
   it('writes each distinct card and description once, not once per frame', () => {
     const rec = record(880009, 'standard', 4000);
     const packed = compress(rec.frames);
@@ -418,6 +452,13 @@ describe('the replay behaves like the game it is replaying', () => {
     assert.ok(kinds.has('couple'), 'coupling a cut never made a sound');
     assert.ok(kinds.has('drop'), 'setting cars out never made a sound');
     assert.ok(kinds.has('schedule'), 'the 1D12 that sets a train\'s departure Stage landed silently');
+    assert.ok(kinds.has('arrive'), 'a train pulling into an Office never made a sound');
+    assert.ok(kinds.has('depart'), 'a train highballing out of an Office never made a sound');
+    // Collisions are rare — measured 2 in 40 games — so this is the one cue this pool is not
+    // guaranteed to contain on every stride; it happens to (seeds 96028 and 159380) at the current
+    // stride and seed count. If this starts failing after either changes, widen the pool rather than
+    // deleting the assertion — §10 is the one event a player most needs to hear.
+    assert.ok(kinds.has('crash'), 'a collision never made a sound');
 
     // One CLOCK cue per Stage boundary, the bell replacing the whistle at a Day — the same
     // accounting the live game is held to. The switching cues are counted separately: they follow

test/server/lobby.test.ts

@@ -0,0 +1,206 @@
+/**
+ * The lobby (`src/server/lobby.ts`) — pure logic, no sockets, no filesystem, exercised directly.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import type { GameConfig } from '../../src/engine/state.ts';
+import {
+  createLobby,
+  freshGameCode,
+  joinLobby,
+  playerCountAllowed,
+  reassignHost,
+  setBotSeat,
+  startLobby,
+} from '../../src/server/lobby.ts';
+
+const competitive: GameConfig = {
+  mode: 'competitive',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
+  optionalRules: {
+    reducedVisibility: false,
+    sisterTrains: false,
+    employeeRotation: false,
+    emergencyToolbox: false,
+  },
+};
+const solitaire: GameConfig = { ...competitive, mode: 'solitaire' };
+
+describe('creating and joining', () => {
+  it('the creator is the host, takes seat 0, and is first in join order', () => {
+    const { lobby, session } = createLobby(competitive, 'Alice', 'RAIL-0001');
+    assert.equal(session.player, 0);
+    assert.equal(lobby.hostToken, session.token);
+    assert.equal(lobby.seats.length, 1);
+    assert.deepEqual(lobby.seats[0], { kind: 'human', token: session.token, displayName: 'Alice' });
+    assert.deepEqual(lobby.joinOrder, [session.token]);
+  });
+
+  it('fills the next empty seat, in order', () => {
+    const { lobby: l1, session: s1 } = createLobby(competitive, 'Alice', 'RAIL-0001');
+    const j2 = joinLobby(l1, 'Bob');
+    assert.ok(j2.ok);
+    if (!j2.ok) return;
+    assert.equal(j2.session.player, 1);
+    const j3 = joinLobby(j2.lobby, 'Carol');
+    assert.ok(j3.ok);
+    if (!j3.ok) return;
+    assert.equal(j3.session.player, 2);
+    assert.deepEqual(j3.lobby.joinOrder, [s1.token, j2.session.token, j3.session.token]);
+  });
+
+  it('refuses a 5th join to a competitive lobby (cap 4)', () => {
+    let lobby = createLobby(competitive, 'Alice', 'RAIL-0001').lobby;
+    for (const name of ['Bob', 'Carol', 'Dave']) {
+      const r = joinLobby(lobby, name);
+      assert.ok(r.ok);
+      if (r.ok) lobby = r.lobby;
+    }
+    const fifth = joinLobby(lobby, 'Eve');
+    assert.deepEqual(fifth, { ok: false, code: 'LOBBY_FULL' });
+  });
+
+  it('refuses a 2nd join to a solitaire lobby (cap 1)', () => {
+    const { lobby } = createLobby(solitaire, 'Alice', 'RAIL-0002');
+    const second = joinLobby(lobby, 'Bob');
+    assert.deepEqual(second, { ok: false, code: 'LOBBY_FULL' });
+  });
+
+  it('rejoins into a seat an earlier player vacated, not past the end', () => {
+    // Joining always fills the FIRST empty seat, so a bot-seat cleared back to empty (setBotSeat)
+    // is exactly as joinable as one nobody ever filled.
+    let lobby = createLobby(competitive, 'Alice', 'RAIL-0003').lobby;
+    lobby = setBotSeat(lobby, 1, true);
+    lobby = setBotSeat(lobby, 1, false);
+    const r = joinLobby(lobby, 'Bob');
+    assert.ok(r.ok);
+    if (!r.ok) return;
+    assert.equal(r.session.player, 1, 'should take the reopened seat 1, not append at seat 1 anyway by coincidence — check seat 2 stays empty');
+    assert.equal(r.lobby.seats.length, 2);
+  });
+});
+
+describe('bot seats', () => {
+  it('fills only an empty seat, and clears only a bot seat', () => {
+    const { lobby: l0 } = createLobby(competitive, 'Alice', 'RAIL-0004');
+    const withBot = setBotSeat(l0, 1, true);
+    assert.deepEqual(withBot.seats[1], { kind: 'bot' });
+
+    // Filling an already-bot seat again is a no-op, not a crash.
+    const stillBot = setBotSeat(withBot, 1, true);
+    assert.deepEqual(stillBot.seats[1], { kind: 'bot' });
+
+    // Clearing seat 0 (a human) does nothing — a host is removed by leaving, not overwritten.
+    const untouched = setBotSeat(withBot, 0, false);
+    assert.deepEqual(untouched.seats[0], l0.seats[0]);
+
+    const cleared = setBotSeat(withBot, 1, false);
+    assert.equal(cleared.seats[1], null);
+  });
+});
+
+describe('host transfer', () => {
+  it('passes to the earliest-joined remaining human seat when the host departs', () => {
+    let lobby = createLobby(competitive, 'Alice', 'RAIL-0005').lobby;
+    const hostToken = lobby.hostToken;
+    const j2 = joinLobby(lobby, 'Bob');
+    assert.ok(j2.ok);
+    if (!j2.ok) return;
+    lobby = j2.lobby;
+    // Alice's own seat is cleared (simulating her leaving the table entirely, not just dropping
+    // her connection) so the transfer target is unambiguous in this test.
+    lobby = { ...lobby, seats: [null, lobby.seats[1]!] };
+    const after = reassignHost(lobby, hostToken);
+    assert.equal(after.hostToken, j2.session.token);
+  });
+
+  it('does nothing when the departing token is not the host', () => {
+    const { lobby } = createLobby(competitive, 'Alice', 'RAIL-0006');
+    const after = reassignHost(lobby, 'not-a-real-token');
+    assert.equal(after, lobby);
+  });
+
+  it('leaves hostToken alone when no other human seat exists', () => {
+    const { lobby, session } = createLobby(competitive, 'Alice', 'RAIL-0007');
+    const after = reassignHost(lobby, session.token);
+    assert.equal(after.hostToken, session.token);
+  });
+});
+
+describe('starting', () => {
+  it('refuses a non-host caller', () => {
+    const { lobby } = createLobby(competitive, 'Alice', 'RAIL-0008');
+    joinLobby(lobby, 'Bob');
+    assert.deepEqual(startLobby(lobby, 'someone-elses-token'), { ok: false, code: 'NOT_HOST' });
+  });
+
+  it('refuses to start with a gap in the seats', () => {
+    let lobby = createLobby(competitive, 'Alice', 'RAIL-0009').lobby;
+    const j2 = joinLobby(lobby, 'Bob');
+    assert.ok(j2.ok);
+    if (!j2.ok) return;
+    const j3 = joinLobby(j2.lobby, 'Carol');
+    assert.ok(j3.ok);
+    if (!j3.ok) return;
+    lobby = { ...j3.lobby, seats: [j3.lobby.seats[0]!, null, j3.lobby.seats[2]!] };
+    assert.deepEqual(startLobby(lobby, lobby.hostToken), { ok: false, code: 'BAD_PLAYER_COUNT' });
+  });
+
+  it('refuses a solo human in a competitive lobby (needs 2-4)', () => {
+    const { lobby } = createLobby(competitive, 'Alice', 'RAIL-0010');
+    assert.deepEqual(startLobby(lobby, lobby.hostToken), { ok: false, code: 'BAD_PLAYER_COUNT' });
+  });
+
+  it('starts a full 2-player lobby, naming bots "Bot" and humans by their display name', () => {
+    let lobby = createLobby(competitive, 'Alice', 'RAIL-0011').lobby;
+    lobby = setBotSeat(lobby, 1, true);
+    const r = startLobby(lobby, lobby.hostToken);
+    assert.deepEqual(r, { ok: true, playerNames: ['Alice', 'Bot'], botSeats: [1] });
+  });
+
+  it('starts a solitaire lobby of exactly 1', () => {
+    const { lobby } = createLobby(solitaire, 'Alice', 'RAIL-0012');
+    const r = startLobby(lobby, lobby.hostToken);
+    assert.deepEqual(r, { ok: true, playerNames: ['Alice'], botSeats: [] });
+  });
+});
+
+describe('playerCountAllowed', () => {
+  it('solitaire is exactly 1', () => {
+    assert.equal(playerCountAllowed('solitaire', 1), true);
+    assert.equal(playerCountAllowed('solitaire', 0), false);
+    assert.equal(playerCountAllowed('solitaire', 2), false);
+  });
+
+  it('competitive and coop are 2-4', () => {
+    for (const mode of ['competitive', 'coop'] as const) {
+      assert.equal(playerCountAllowed(mode, 1), false);
+      assert.equal(playerCountAllowed(mode, 2), true);
+      assert.equal(playerCountAllowed(mode, 4), true);
+      assert.equal(playerCountAllowed(mode, 5), false);
+    }
+  });
+});
+
+describe('game codes', () => {
+  it('skips codes the caller marks taken', () => {
+    let calls = 0;
+    const code = freshGameCode((c) => {
+      calls++;
+      return calls < 3; // taken twice, free on the third
+    });
+    assert.equal(typeof code, 'string');
+    assert.equal(calls, 3);
+  });
+
+  it('is speakable — a word, a dash, four digits', () => {
+    const code = freshGameCode(() => false);
+    assert.match(code, /^[A-Z]+-\d{4}$/);
+  });
+});

test/server/persistence.test.ts

@@ -0,0 +1,102 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type { GameConfig } from '../../src/engine/state.ts';
+import type { SavedGame } from '../../src/server/session.ts';
+import { appendTiming, loadGame, writeGame } from '../../src/server/persistence.ts';
+
+const config: GameConfig = {
+  mode: 'competitive',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
+  optionalRules: {
+    reducedVisibility: false,
+    sisterTrains: false,
+    employeeRotation: false,
+    emergencyToolbox: false,
+  },
+};
+
+const saved: SavedGame = {
+  seed: 42,
+  config,
+  playerNames: ['Alice', 'Bob'],
+  history: [{ type: 'localOps.choose', option: 'draw' }],
+  status: 'active',
+  createdAt: 1000,
+  botSeats: [],
+};
+
+async function withTempDir<T>(fn: (dir: string) => Promise<T>): Promise<T> {
+  const dir = await mkdtemp(join(tmpdir(), 'station-master-persist-'));
+  try {
+    return await fn(dir);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+describe('game persistence (Phase 3)', () => {
+  it('writes and reads back exactly what was written', () =>
+    withTempDir(async (dir) => {
+      await writeGame(dir, saved, '1.2.3');
+      const result = await loadGame(dir, '1.2.3');
+      assert.equal(result.found, true);
+      if (!result.found) return;
+      assert.equal(result.ok, true);
+      if (!result.ok) return;
+      assert.deepEqual(result.saved, saved);
+    }));
+
+  it('refuses a version mismatch explicitly, naming both versions', () =>
+    withTempDir(async (dir) => {
+      await writeGame(dir, saved, '1.2.3');
+      const result = await loadGame(dir, '9.9.9');
+      assert.equal(result.found, true);
+      if (!result.found) return;
+      assert.equal(result.ok, false);
+      if (result.ok) return;
+      assert.equal(result.storedVersion, '1.2.3');
+      assert.equal(result.currentVersion, '9.9.9');
+    }));
+
+  it('reports not-found rather than throwing when nothing has been saved yet', () =>
+    withTempDir(async (dir) => {
+      const result = await loadGame(dir, '1.2.3');
+      assert.deepEqual(result, { found: false });
+    }));
+
+  it('a later writeGame fully replaces the earlier one, not merges with it', () =>
+    withTempDir(async (dir) => {
+      await writeGame(dir, saved, '1.2.3');
+      const grown: SavedGame = { ...saved, history: [...saved.history, { type: 'draw.end' }] };
+      await writeGame(dir, grown, '1.2.3');
+      const result = await loadGame(dir, '1.2.3');
+      assert.equal(result.found, true);
+      if (!result.found) return;
+      assert.equal(result.ok, true);
+      if (!result.ok) return;
+      assert.equal(result.saved.history.length, 2);
+    }));
+
+  it('never leaves a stray .tmp file behind after a write', () =>
+    withTempDir(async (dir) => {
+      await writeGame(dir, saved, '1.2.3');
+      await assert.rejects(() => readFile(join(dir, 'game.json.tmp')));
+    }));
+
+  it('appendTiming accumulates across calls rather than overwriting', () =>
+    withTempDir(async (dir) => {
+      await appendTiming(dir, { player: 0, phase: 'localOps', day: 1, stage: 1, startedAt: 1, endedAt: 2 });
+      await appendTiming(dir, { player: 1, phase: 'localOps', day: 1, stage: 1, startedAt: 2, endedAt: 3 });
+      const text = await readFile(join(dir, 'turn-timings.json'), 'utf8');
+      const timings = JSON.parse(text) as unknown[];
+      assert.equal(timings.length, 2);
+    }));
+});

test/server/session.test.ts

@@ -0,0 +1,236 @@
+/**
+ * The game session host (`src/server/session.ts`) — pure logic, no sockets, exercised directly.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import type { GameConfig, PlayerIndex } from '../../src/engine/state.ts';
+import type { Push } from '../../src/server/session.ts';
+import { createSession, resumeSession } from '../../src/server/session.ts';
+
+const config: GameConfig = {
+  mode: 'competitive',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
+  optionalRules: {
+    reducedVisibility: false,
+    sisterTrains: false,
+    employeeRotation: false,
+    emergencyToolbox: false,
+  },
+};
+
+describe('the game session host', () => {
+  it('gives a fresh connect a full Frame — nothing nulled', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    const push = session.connect(0 as PlayerIndex);
+    assert.notEqual(push.frame!.cells, null, 'a first connect nulled the board');
+    assert.notEqual(push.frame!.division, null, 'a first connect nulled the division');
+  });
+
+  it('only the current actor gets a real Menu; every other seat gets null', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    const a = session.connect(0 as PlayerIndex);
+    const b = session.connect(1 as PlayerIndex);
+    const actorPushes = [a, b].filter((p) => p.menu !== null);
+    assert.equal(actorPushes.length, 1, 'more than one seat (or zero) was given a real Menu');
+  });
+
+  it('rejects an intent from a seat that is not the current actor, with NOT_YOUR_TURN', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    // Whichever seat is NOT the current actor should be refused, regardless of the intent's content.
+    const bPush = session.connect(1 as PlayerIndex);
+    const notActor = (bPush.menu === null ? 1 : 0) as PlayerIndex;
+    const result = session.intent(notActor, 1, { type: 'localOps.choose', option: 'draw' });
+    assert.equal(result.accepted, false);
+    if (!result.accepted) assert.equal(result.code, 'NOT_YOUR_TURN');
+  });
+
+  it('accepts a legal intent from the current actor and pushes every seat', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    const aPush = session.connect(0 as PlayerIndex);
+    const actor = (aPush.menu !== null ? 0 : 1) as PlayerIndex;
+
+    const result = session.intent(actor, 1, { type: 'localOps.choose', option: 'draw' });
+    assert.equal(result.accepted, true);
+    if (result.accepted) assert.equal(result.pushes.size, 2, 'not every connected seat was pushed to');
+  });
+
+  it('rejects an illegal intent with its real RejectionCode, and does not remember the seq', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    const aPush = session.connect(0 as PlayerIndex);
+    const actor = (aPush.menu !== null ? 0 : 1) as PlayerIndex;
+
+    // Discarding before ever drawing is illegal on an opening hand at the limit — a safe "this is
+    // definitely rejected" fixture that does not depend on exactly which cards were dealt.
+    const bad = session.intent(actor, 1, { type: 'card.discard', cardId: 'not-a-real-card', toSlot: 0 });
+    assert.equal(bad.accepted, false);
+    if (!bad.accepted) assert.ok(bad.code.length > 0, 'a rejection carried no code at all');
+
+    // The same seq, now with a legal intent, must still go through — a rejection is not "applied".
+    const retry = session.intent(actor, 1, { type: 'localOps.choose', option: 'draw' });
+    assert.equal(retry.accepted, true, 'a seq burned by an earlier rejection could not be reused');
+  });
+
+  it('treats a repeated seq as an already-applied no-op, not a second application', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    const aPush = session.connect(0 as PlayerIndex);
+    const actor = (aPush.menu !== null ? 0 : 1) as PlayerIndex;
+
+    const first = session.intent(actor, 1, { type: 'localOps.choose', option: 'draw' });
+    assert.equal(first.accepted, true);
+    const second = session.intent(actor, 1, { type: 'localOps.choose', option: 'draw' });
+    assert.equal(second.accepted, true, 'a resend of an already-applied seq was rejected instead of ignored');
+    if (second.accepted) assert.equal(second.pushes.size, 0, 'a resend produced pushes as if newly applied');
+  });
+
+  it('deltas the board on a second push when it has not changed since the first', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    const aPush = session.connect(0 as PlayerIndex);
+    session.connect(1 as PlayerIndex); // both seats need a baseline Frame before a delta means anything
+    const actor = (aPush.menu !== null ? 0 : 1) as PlayerIndex;
+
+    const result = session.intent(actor, 1, { type: 'localOps.choose', option: 'draw' });
+    assert.equal(result.accepted, true);
+    if (!result.accepted) return;
+    // Choosing "draw" doesn't move a single card on the board — the division/cells should be nulled
+    // on this push for a seat that already had them from `connect`.
+    const push = result.pushes.get(actor)!;
+    assert.equal(push.frame!.division, null, 'the board was resent even though nothing on it changed');
+  });
+
+  it('only sends narration NEW since the last push to that specific seat', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    const aPush = session.connect(0 as PlayerIndex);
+    const actor = (aPush.menu !== null ? 0 : 1) as PlayerIndex;
+    // A first connect is this seat's first contact, so it gets everything narrated so far (the
+    // "Game Begins" intro and whatever `drain()` said entering the first Stage) — not an empty log.
+    assert.ok(aPush.lines.length > 0, 'a first connect got no narration at all, not even the game-begins intro');
+
+    const first = session.intent(actor, 1, { type: 'localOps.choose', option: 'draw' });
+    assert.equal(first.accepted, true);
+    if (!first.accepted) return;
+    const firstLines = first.pushes.get(actor)!.lines;
+    assert.ok(firstLines.length > 0, 'the acting seat got no narration for its own action');
+
+    const second = session.intent(actor, 2, { type: 'draw.end' });
+    assert.equal(second.accepted, true);
+    if (!second.accepted) return;
+    const secondLines = second.pushes.get(actor)!.lines;
+    assert.ok(secondLines.length > 0, 'a second real action produced no narration at all');
+    for (const line of firstLines) {
+      assert.ok(!secondLines.includes(line), 'the second push repeated narration already sent in the first');
+    }
+  });
+});
+
+describe('turn timings (lobby-and-sessions.md §5)', () => {
+  it('records a wall-clock span once the acting player, phase, Day or Stage changes', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    let pushes = new Map<PlayerIndex, Push>([
+      [0 as PlayerIndex, session.connect(0 as PlayerIndex)],
+      [1 as PlayerIndex, session.connect(1 as PlayerIndex)],
+    ]);
+    const seq = new Map<PlayerIndex, number>([[0 as PlayerIndex, 1], [1 as PlayerIndex, 1]]);
+    const timings = [];
+
+    for (let step = 0; step < 60 && timings.length === 0; step++) {
+      const acting = [0, 1].find((seat) => pushes.get(seat as PlayerIndex)!.menu !== null) as PlayerIndex | undefined;
+      const menu = acting === undefined ? null : pushes.get(acting)!.menu;
+      if (acting === undefined || !menu || menu.options.length === 0) break;
+
+      const n = seq.get(acting)!;
+      seq.set(acting, n + 1);
+      const result = session.intent(acting, n, menu.options[0]!);
+      assert.equal(result.accepted, true, `step ${step}: ${JSON.stringify(menu.options[0])} rejected`);
+      if (!result.accepted) break;
+      if (result.timing) timings.push(result.timing);
+      pushes = result.pushes;
+    }
+
+    assert.ok(timings.length > 0, 'no turn timing ever closed across 60 real steps of actual play');
+    const [timing] = timings;
+    assert.ok(timing!.endedAt >= timing!.startedAt, 'a span ended before it started');
+    assert.ok([0, 1].includes(timing!.player), 'a timing named a player outside the table');
+  });
+});
+
+describe('bot seats (Phase 4 — D8, lobby-and-sessions.md §2)', () => {
+  it('a bot never becomes the observable current actor — it plays before anyone can see it waiting', () => {
+    // Seat 0 acts first (the opening Superintendent), so marking it a bot exercises `driveBots()`
+    // at CONSTRUCTION time — before any external `intent()` has run at all.
+    const session = createSession(11, config, ['Bot', 'Alice'], [0 as PlayerIndex]);
+    assert.equal(session.isBot(0 as PlayerIndex), true);
+    assert.equal(session.isBot(1 as PlayerIndex), false);
+
+    const botPush = session.connect(0 as PlayerIndex);
+    const humanPush = session.connect(1 as PlayerIndex);
+    assert.equal(botPush.menu, null, 'the bot seat was handed a real decision to make');
+    assert.notEqual(humanPush.menu, null, 'nobody was left with a turn to take — the bot never played');
+  });
+
+  it('botSeats round-trips through exportSave/resumeSession', () => {
+    const session = createSession(11, config, ['Bot', 'Alice'], [0 as PlayerIndex]);
+    const resumed = resumeSession(session.exportSave());
+    assert.equal(resumed.isBot(0 as PlayerIndex), true);
+    assert.equal(resumed.connect(0 as PlayerIndex).menu, null, 'a resumed bot seat still never gets a real decision');
+  });
+
+  it('a bot seat is driven forward after a human intent too, not only at construction', () => {
+    // Two bots and one human: whichever of the two non-human seats comes up next after the human's
+    // own move must be played automatically, with no external `intent()` for either of them.
+    const session = createSession(11, config, ['Alice', 'Bot', 'Bot'], [1 as PlayerIndex, 2 as PlayerIndex]);
+    const before = session.exportSave().history.length;
+    const applied = session.intent(0 as PlayerIndex, 1, { type: 'localOps.choose', option: 'draw' });
+    assert.equal(applied.accepted, true);
+    assert.equal(session.connect(1 as PlayerIndex).menu, null, 'bot seat 1 was left with a real decision');
+    assert.equal(session.connect(2 as PlayerIndex).menu, null, 'bot seat 2 was left with a real decision');
+    // Not a strict proof either bot actually moved (the human's own turn may not have ended yet),
+    // but the history can only ever have grown, never shrunk, and never rejected mid-drive.
+    assert.ok(session.exportSave().history.length >= before + 1);
+  });
+});
+
+describe('persistence hooks — exportSave / resumeSession (Phase 3)', () => {
+  it('exportSave carries enough to reconstruct the exact same game', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    const push = session.connect(0 as PlayerIndex);
+    const actor = (push.menu !== null ? 0 : 1) as PlayerIndex;
+    const applied = session.intent(actor, 1, { type: 'localOps.choose', option: 'draw' });
+    assert.equal(applied.accepted, true);
+
+    const saved = session.exportSave();
+    assert.equal(saved.seed, 42);
+    assert.deepEqual(saved.playerNames, ['Alice', 'Bob']);
+    assert.equal(saved.history.length, 1);
+    assert.equal(saved.status, 'active');
+    assert.ok(saved.createdAt > 0, 'createdAt was not set');
+
+    const resumed = resumeSession(saved);
+    const before = session.connect(actor);
+    const after = resumed.connect(actor);
+    assert.deepEqual(after.frame, before.frame, 'resumeSession did not reconstruct the same board/state');
+  });
+
+  it('a resumed session keeps enforcing whose turn it is', () => {
+    const session = createSession(7, config, ['Alice', 'Bob']);
+    const push = session.connect(0 as PlayerIndex);
+    const actor = (push.menu !== null ? 0 : 1) as PlayerIndex;
+    session.intent(actor, 1, { type: 'localOps.choose', option: 'draw' });
+
+    const resumed = resumeSession(session.exportSave());
+    const notActor = (actor === 0 ? 1 : 0) as PlayerIndex;
+    const rejected = resumed.intent(notActor, 1, { type: 'draw.end' });
+    assert.equal(rejected.accepted, false);
+    if (!rejected.accepted) assert.equal(rejected.code, 'NOT_YOUR_TURN');
+  });
+
+  it('marks status finished only once the game actually is', () => {
+    const session = createSession(42, config, ['Alice', 'Bob']);
+    assert.equal(session.exportSave().status, 'active');
+  });
+});

test/setup.test.ts

@@ -34,8 +34,11 @@ import { subdivisions } from '../src/engine/state.ts';
 
 const solitaireConfig: GameConfig = {
   mode: 'solitaire',
-  victory: 'highestAfterDays',
-  length: 'standard',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
   optionalRules: {
     reducedVisibility: false,
     sisterTrains: false,
@@ -299,12 +302,16 @@ describe('card catalogue (component 1)', () => {
     }
   });
 
-  it('uses the Gap 10e revised victory targets', () => {
+  it('keeps the three day-count presets sim/CLI tooling still relies on', () => {
+    // Gap 10e's fixed targets retired 2026-08-20 — `minCombinedRevenue` is a free `GameConfig`
+    // variable now, not a `length`-keyed lookup. `LENGTH_PROFILES` survives only as a convenience
+    // preset for tools that still want a short/standard/campaign argument (`harness.ts`, `compare.ts`,
+    // `replay.ts`).
     assert.deepEqual(
-      LENGTH_PROFILES.map((p) => [p.target, p.days]),
-      [[10, 3], [20, 5], [45, 10]],
+      LENGTH_PROFILES.map((p) => [p.length, p.days]),
+      [['short', 3], ['standard', 5], ['campaign', 10]],
     );
-    assert.equal(lengthProfile('standard').target, 20);
+    assert.equal(lengthProfile('standard').days, 5);
   });
 
   it('scales fixed supplies with player count', () => {

test/sim.test.ts

@@ -22,8 +22,11 @@ import { anomalies, strategyBuckets } from '../src/sim/stats.ts';
 
 const config: GameConfig = {
   mode: 'solitaire',
-  victory: 'highestAfterDays',
-  length: 'short',
+  days: 3,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
   optionalRules: {
     reducedVisibility: false,
     sisterTrains: false,
@@ -155,7 +158,7 @@ describe('the revenue chain works end to end (regression)', () => {
     // more cars in total (22 vs 19 over forty games). Widened so it fails for the reason it names.
     let spotted = 0;
     for (const seed of [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20]) {
-      const s = createGame({ id: 'g', seed, config: { ...config, length: 'standard' }, playerNames: ['bot'] });
+      const s = createGame({ id: 'g', seed, config: { ...config, days: 5 }, playerNames: ['bot'] });
       playGame(s, developerBot, pump);
       for (const card of s.officeAreas.get(0)!.grid.values()) {
         if (card.facility?.kind === 'freight') spotted += card.facility.industryTrack.cars.length;
@@ -172,7 +175,7 @@ describe('the revenue chain works end to end (regression)', () => {
     // the old 52-card placeholder it was 10 in 52.
     let placed = 0;
     for (const seed of [11, 23, 47, 91, 137, 211]) {
-      const s = createGame({ id: 'g', seed, config: { ...config, length: 'campaign' }, playerNames: ['bot'] });
+      const s = createGame({ id: 'g', seed, config: { ...config, days: 10 }, playerNames: ['bot'] });
       playGame(s, developerBot, pump);
       for (const card of s.officeAreas.get(0)!.grid.values()) {
         if (card.geometry.kind !== 'facility') continue;
@@ -206,7 +209,7 @@ describe('the revenue chain works end to end (regression)', () => {
     // "downward only" is gone, and with it the rule that rejected every square above row 0.
     const rows = new Set<number>();
     for (const seed of [3, 9, 27, 81]) {
-      const s = createGame({ id: 'g', seed, config: { ...config, length: 'campaign' }, playerNames: ['bot'] });
+      const s = createGame({ id: 'g', seed, config: { ...config, days: 10 }, playerNames: ['bot'] });
       playGame(s, developerBot, pump);
       for (const key of s.officeAreas.get(0)!.grid.keys()) rows.add(Number(key.split(',')[0]));
     }
@@ -272,7 +275,7 @@ describe('the deck is closed — no card is created or destroyed', () => {
     // Every card is in exactly one place: the Home Office deck, a Department pile, the Salvage Yard,
     // a hand, or on the board — grid cells, enhancements laid on them, and Mainline modifiers.
     for (const seed of [3, 17, 91]) {
-      const s = createGame({ id: `cc-${seed}`, seed, config: { ...config, length: 'standard' }, playerNames: ['bot'] });
+      const s = createGame({ id: `cc-${seed}`, seed, config: { ...config, days: 5 }, playerNames: ['bot'] });
       const total = s.cards.size;
       playGame(s, developerBot, pump);
 
@@ -294,7 +297,7 @@ describe('the deck is closed — no card is created or destroyed', () => {
     // The sharper form of the same guard. A discard moves a card from a hand to a Department pile
     // and a draw moves one back, so the count across deck + Departments + Salvage Yard + hands can
     // only fall by cards actually placed on the board — never by one being overwritten.
-    const s = createGame({ id: 'cc', seed: 5, config: { ...config, length: 'standard' }, playerNames: ['bot'] });
+    const s = createGame({ id: 'cc', seed: 5, config: { ...config, days: 5 }, playerNames: ['bot'] });
     const before = s.cards.size;
     playGame(s, developerBot, pump);
     const loose =
@@ -345,8 +348,8 @@ describe('end-of-game statistics', () => {
      * BOT no longer gets a crew next to an industry: it builds shallow districts and places 2.2
      * facilities a game, down from 3.8 when industries could sit on the main.
      *
-     * That is the bot's district-building weakness, which is the top item in TODO.md, not a rule
-     * that has become unreachable. Exempted by name so the other forty-odd event checks stay live,
+     * That is the bot's district-building weakness, tracked in TODO.md under Bot Performance, not a
+     * rule that has become unreachable. Exempted by name so the other forty-odd event checks stay live,
      * and so removing this line is what proves the bot has been fixed.
      */
     const KNOWN_UNREACHABLE_BY_THE_BOT = ['event flyingSwitch'];
@@ -541,7 +544,7 @@ describe('the bot builds sidings that are actually sidings (regression)', () =>
       const s = createGame({
         id: `sd-${i}`,
         seed: 1000 + i * 7919,
-        config: { ...config, length: 'standard' },
+        config: { ...config, days: 5 },
         playerNames: ['bot'],
       });
       playGame(s, developerBot, pump);
@@ -639,7 +642,7 @@ describe('the bot builds sidings that are actually sidings (regression)', () =>
       const s = createGame({
         id: `cs-${i}`,
         seed: 1000 + i * 7919,
-        config: { ...config, length: 'standard' },
+        config: { ...config, days: 5 },
         playerNames: ['bot'],
       });
       const r = playGame(s, developerBot, pump);
@@ -723,7 +726,7 @@ describe('the bot does not throw away its own freight (regression)', () => {
       const s = createGame({
         id: `uj-${i}`,
         seed: 1000 + i * 7919,
-        config: { ...config, length: 'standard' },
+        config: { ...config, days: 5 },
         playerNames: ['bot'],
       });
       const r = playGame(s, developerBot, pump);
@@ -752,7 +755,7 @@ describe('the bot does not throw away its own freight (regression)', () => {
     // The other half of the regression above. Gutting the fallback entirely would satisfy "never
     // unjams a green box" while leaving a real jam to block the industry forever — a load stranded
     // on WORK keeps the track locked, which now stops trains passing as well as stopping (§9.3).
-    const s = createGame({ id: 'jam', seed: 5, config: { ...config, length: 'standard' }, playerNames: ['bot'] });
+    const s = createGame({ id: 'jam', seed: 5, config: { ...config, days: 5 }, playerNames: ['bot'] });
     const area = s.officeAreas.get(0)!;
     area.grid.set('-1,0', {
       geometry: { kind: 'facility', facility: 'mineTipple' },
@@ -797,7 +800,7 @@ describe('Enhancements can reach the board at all (regression)', () => {
       const s = createGame({
         id: `st-${i}`,
         seed: 1000 + i * 7919,
-        config: { ...config, length: 'standard' },
+        config: { ...config, days: 5 },
         playerNames: ['bot'],
       });
       playGame(s, developerBot, pump);
@@ -834,7 +837,7 @@ describe('Enhancements can reach the board at all (regression)', () => {
       const s = createGame({
         id: `il-${i}`,
         seed: 1000 + i * 7919,
-        config: { ...config, length: 'standard' },
+        config: { ...config, days: 5 },
         playerNames: ['bot'],
       });
       playGame(s, developerBot, pump);
@@ -872,7 +875,7 @@ describe('rolling stock returns to service (regression)', () => {
     const s = createGame({
       id: 'refill',
       seed: 4,
-      config: { ...config, length: 'standard' },
+      config: { ...config, days: 5 },
       playerNames: ['bot'],
     });
 
@@ -911,7 +914,7 @@ describe('measurement discipline', () => {
     // the observer hook cannot drift from the log, so probes have one trustworthy way in and no
     // reason to hand-roll the drive loop again.
     const seen: string[] = [];
-    const s = createGame({ id: 'obs', seed: 4242, config: { ...config, length: 'standard' }, playerNames: ['b'] });
+    const s = createGame({ id: 'obs', seed: 4242, config: { ...config, days: 5 }, playerNames: ['b'] });
     const out = playGame(s, developerBot, pump, 50_000, (e) => seen.push(e.type));
 
     assert.ok(out.events.length > 0, 'a finished game must produce events');
@@ -923,7 +926,7 @@ describe('measurement discipline', () => {
     // Asserted across several seeds because a single game may never draw a Depot card.
     let upgrades = 0;
     for (let seed = 0; seed < 25; seed++) {
-      const s = createGame({ id: `u${seed}`, seed, config: { ...config, length: 'standard' }, playerNames: ['b'] });
+      const s = createGame({ id: `u${seed}`, seed, config: { ...config, days: 5 }, playerNames: ['b'] });
       const out = playGame(s, developerBot, pump);
       upgrades += out.events.filter((e) => e.type === 'officeUpgraded').length;
     }
@@ -943,7 +946,7 @@ describe('the bot does not lay track that cannot work (regression)', () => {
     const s = createGame({
       id: `lay-${seed}`,
       seed,
-      config: { ...config, length: 'standard' },
+      config: { ...config, days: 5 },
       playerNames: ['Solitaire'],
     });
     const laid: Lay[] = [];
@@ -996,7 +999,7 @@ describe('the bot does not lay track that cannot work (regression)', () => {
     for (const seed of SEEDS) {
       const s = createGame({
         id: `dp-${seed}`, seed,
-        config: { ...config, length: 'standard' },
+        config: { ...config, days: 5 },
         playerNames: ['Solitaire'],
       });
       const spy = {
@@ -1085,7 +1088,7 @@ describe('the freight figures count both halves (regression)', () => {
       const seed = 1000 + i * 7919;
       const s = createGame({
         id: `fu-${seed}`, seed,
-        config: { ...config, length: 'standard' },
+        config: { ...config, days: 5 },
         playerNames: ['bot'],
       });
       const r = playGame(s, developerBot, pump);

test/track.test.ts

@@ -18,6 +18,8 @@ import type {
 import { coordKey, isOperationalRail, turnOf } from '../src/engine/state.ts';
 import { createGame } from '../src/engine/setup.ts';
 import { applyIntent, areaOf } from '../src/engine/apply.ts';
+import { legalActions } from '../src/engine/legal.ts';
+import type { Intent } from '../src/engine/intents.ts';
 import type { MoveContext, Occupancy, Port } from '../src/engine/track.ts';
 import {
   allReachable,
@@ -46,6 +48,7 @@ const straight = (standing: RollingStock[] = []): TrackCard => ({
   geometry: { kind: 'track', geometry: 'straight' },
   baseOperationalRail: true,
   standing,
+  standingWest: 0,
   facility: null,
   modifiers: [],
   enhancements: [],
@@ -60,6 +63,7 @@ const curve = (arc: TrackArc, standing: RollingStock[] = []): TrackCard => ({
   geometry: { kind: 'track', geometry: 'curved', arc },
   baseOperationalRail: true,
   standing,
+  standingWest: 0,
   facility: null,
   modifiers: [],
   enhancements: [],
@@ -71,6 +75,7 @@ const turnout = (o?: TurnoutOrientation): TrackCard => ({
     : { kind: 'track', geometry: 'turnout' },
   baseOperationalRail: false, // no wheel icon — a train may pass through but not stop (§A.1)
   standing: [],
+  standingWest: 0,
   facility: null,
   modifiers: [],
   enhancements: [],
@@ -80,6 +85,7 @@ const officeCard = (): TrackCard => ({
   geometry: { kind: 'office' },
   baseOperationalRail: true,
   standing: [],
+  standingWest: 0,
   facility: null,
   modifiers: [],
   enhancements: [],
@@ -89,6 +95,7 @@ const lockedFacility = (): TrackCard => ({
   geometry: { kind: 'facility', facility: 'mineTipple' },
   baseOperationalRail: true,
   standing: [],
+  standingWest: 0,
   // A load sitting on MEN|AT|WORK locks the industry track down (§9.3).
   facility: {
     kind: 'freight',
@@ -112,7 +119,7 @@ const car = (): RollingStock => ({ type: 'boxcar', loaded: false });
 function straightCard(): TrackCard {
   return {
     geometry: { kind: 'track', geometry: 'straight' },
-    baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [],
+    baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
   };
 }
 
@@ -121,7 +128,7 @@ function gameWith(area: OfficeArea): GameState {
   const s = createGame({
     id: 'g', seed: 5,
     config: {
-      mode: 'solitaire', victory: 'highestAfterDays', length: 'standard',
+      mode: 'solitaire', days: 5, minCombinedRevenue: 0, maxCollisionsPerDay: 0, maxCollisionsTotal: 0, pvpCardsAllowed: false,
       optionalRules: { reducedVisibility: false, sisterTrains: false, employeeRotation: false, emergencyToolbox: false },
     },
     playerNames: ['p'],
@@ -208,6 +215,7 @@ describe('ports and geometry', () => {
       geometry: { kind: 'track', geometry: 'curved', hand: 'left' },
       baseOperationalRail: true,
       standing: [],
+      standingWest: 0,
       facility: null,
       modifiers: [],
       enhancements: [],
@@ -555,6 +563,16 @@ describe('placement and drop-off', () => {
     assert.ok(canDropCarsAt(area, at(0, 1)), 'ordinary Operational Rail');
   });
 
+  it('allows a coach, and only a coach, to be dropped at the Office (v0.5.0 §A.4 exception)', () => {
+    const area = areaFrom(
+      { [coordKey(at(0, 0))]: officeCard(), [coordKey(at(0, 1))]: straight() },
+      at(0, 0),
+    );
+    assert.ok(!canDropCarsAt(area, at(0, 0), 1, false), 'not asking for the coach exception');
+    assert.ok(canDropCarsAt(area, at(0, 0), 1, true), 'one coach');
+    assert.ok(canDropCarsAt(area, at(0, 0), 2, true), 'more than one coach');
+  });
+
   it('forbids dropping cars on a locked industry track', () => {
     const area = areaFrom(
       {
@@ -627,7 +645,7 @@ describe('placement and drop-off', () => {
 describe('curves are arcs, and arcs make sidings possible', () => {
   const arcCard = (arc: 'ne' | 'nw' | 'se' | 'sw', geometry: 'curved' | 'sharpCurved' = 'curved'): TrackCard => ({
     geometry: { kind: 'track', geometry, arc },
-    baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [],
+    baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
   });
 
   it('joins exactly two adjacent edges, with no through track', () => {
@@ -645,7 +663,7 @@ describe('curves are arcs, and arcs make sidings possible', () => {
       c.map((p) => [...p].sort().join('')).sort().join(' ');
     const turnout: TrackCard = {
       geometry: { kind: 'track', geometry: 'turnout', turnout: { stem: 'w', through: 'e', diverge: 's' } },
-      baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [],
+      baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
     };
     for (const arc of ['ne', 'nw', 'se', 'sw'] as const) {
       assert.notEqual(norm(connectionsFor(arcCard(arc))), norm(connectionsFor(turnout)),
@@ -688,11 +706,11 @@ describe('curves are arcs, and arcs make sidings possible', () => {
     const ew = (): TrackCard => straightCard();
     const grid: Record<string, TrackCard> = {
       '0,-2': ew(),
-      '0,-1': { geometry: { kind: 'track', geometry: 'turnout', turnout: { stem: 'w', through: 'e', diverge: 's' }, hand: 'right' }, baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [] },
+      '0,-1': { geometry: { kind: 'track', geometry: 'turnout', turnout: { stem: 'w', through: 'e', diverge: 's' }, hand: 'right' }, baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [] },
       '-1,-1': arcCard('ne'),
       '-1,0': ew(),
       '-1,1': arcCard('nw'),
-      '0,1': { geometry: { kind: 'track', geometry: 'turnout', turnout: { stem: 'e', through: 'w', diverge: 's' }, hand: 'left' }, baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [] },
+      '0,1': { geometry: { kind: 'track', geometry: 'turnout', turnout: { stem: 'e', through: 'w', diverge: 's' }, hand: 'left' }, baseOperationalRail: true, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [] },
       '0,0': ew(),
     };
     const area = areaFrom(grid, { row: 0, col: 0 });
@@ -776,6 +794,7 @@ describe('Operational Rail — where a train may stop and leave cars (Appendix A
     geometry: { kind: 'facility', facility: 'mineTipple' },
     baseOperationalRail: true,
     standing: [],
+    standingWest: 0,
     facility: {
       kind: 'freight', subtype: 'mineTipple',
       allows: { outbound: true, inbound: false },
@@ -917,7 +936,7 @@ describe('a turnout may be laid to face another, making a crossover', () => {
   /** A turnout stated the way the cards read: who may come in, and where they may go. */
   const facing = (stem: Port, through: Port, diverge: Port, hand: 'left' | 'right'): TrackCard => ({
     geometry: { kind: 'track', geometry: 'turnout', turnout: { stem, through, diverge }, hand },
-    baseOperationalRail: false, standing: [], facility: null, modifiers: [], enhancements: [],
+    baseOperationalRail: false, standing: [], standingWest: 0, facility: null, modifiers: [], enhancements: [],
   });
 
   it('joins a south-diverging turnout to the north-diverging one beneath it', () => {
@@ -1025,6 +1044,7 @@ describe('why a square is NOT offered (the same walk, keeping its rejections)',
     geometry: { kind: 'facility', facility: 'mineTipple' },
     baseOperationalRail: true,
     standing: [],
+    standingWest: 0,
     facility: {
       kind: 'freight', subtype: 'mineTipple',
       allows: { outbound: true, inbound: false },
@@ -1110,3 +1130,138 @@ describe('why a square is NOT offered (the same walk, keeping its rejections)',
     }
   });
 });
+
+// ---------------------------------------------------------------------------
+// docs/plans/switching-paths.md — two routes to the same square
+// ---------------------------------------------------------------------------
+
+describe('two routes to one square', () => {
+  const limitsCard = (): TrackCard => ({
+    geometry: { kind: 'limits' },
+    baseOperationalRail: true,
+    standing: [],
+    standingWest: 0,
+    facility: null,
+    modifiers: [],
+    enhancements: [],
+  });
+
+  /**
+   * A passing loop: a turnout diverges off the Running Track, curves down to an industry, and
+   * curves back up to rejoin the main two columns west. Both routes from (0,4) to (0,0) are legal
+   * under §2.4 (neither ever leaves a card by the port it entered); they differ in what they
+   * couple. This is the fixture in the plan's §1, verified identical on v0.4.7 and v0.4.8.
+   */
+  function loopArea(midCard: (col: number) => TrackCard = () => straight()): OfficeArea {
+    return areaFrom(
+      {
+        [coordKey(at(0, 0))]: straight(),
+        [coordKey(at(0, 1))]: turnout({ stem: 'w', through: 'e', diverge: 's' }),
+        [coordKey(at(0, 2))]: midCard(2),
+        [coordKey(at(0, 3))]: turnout({ stem: 'e', through: 'w', diverge: 's' }),
+        [coordKey(at(0, 4))]: limitsCard(),
+        [coordKey(at(-1, 1))]: curve('ne'),
+        [coordKey(at(-1, 2))]: midCard(-1),
+        [coordKey(at(-1, 3))]: curve('nw'),
+      },
+      at(9, 9), // office coord, deliberately away from the fixture
+    );
+  }
+
+  const tanker: RollingStock = { type: 'tank', loaded: false };
+
+  it('offers both routes, and only one couples the tanker on the spur', () => {
+    const area = loopArea((col) => (col === -1 ? straight([tanker]) : straight()));
+    const dests = reachableDestinations(ctxFor(area), at(0, 4), 'w');
+    const atZero = dests.filter((d) => d.coord.row === 0 && d.coord.col === 0);
+    assert.equal(atZero.length, 2, `expected two distinct routes to (0,0), got ${atZero.length}`);
+    const withTanker = atZero.filter((d) => d.couples.some((c) => c.type === 'tank'));
+    const without = atZero.filter((d) => d.couples.length === 0);
+    assert.equal(withTanker.length, 1, 'exactly one route should couple the tanker');
+    assert.equal(without.length, 1, 'exactly one route should couple nothing');
+  });
+
+  it('offers two routes coupling the SAME car type off DIFFERENT cards, and neither is dropped', () => {
+    // The dedupe key must include the origin card, not just the car type (plan §3) — two boxcars,
+    // one on the bypass and one on the main, must not collapse into one destination.
+    const area = loopArea(() => straight([{ type: 'boxcar', loaded: false }]));
+    const dests = reachableDestinations(ctxFor(area), at(0, 4), 'w');
+    const atZero = dests.filter((d) => d.coord.row === 0 && d.coord.col === 0);
+    assert.equal(atZero.length, 2, `expected two distinct routes to (0,0), got ${atZero.length}`);
+    for (const d of atZero) {
+      assert.deepEqual(d.couples.map((c) => c.type), ['boxcar'], 'each route should couple its own boxcar');
+    }
+  });
+
+  it('a `via`-qualified switch.move resolves to the route it names', () => {
+    function freshGame(): GameState {
+      const s = gameWith(loopArea((col) => (col === -1 ? straight([tanker]) : straight())));
+      s.trays.set('crew', {
+        id: 'crew', trainNumber: null, trainIsExtra: false, engineAt: 0, consist: [],
+        direction: 'west', facing: 'w', position: { at: 'grid', seat: 0, coord: at(0, 4) }, movesUsed: 0,
+      });
+      s.clock.phase = 'localOps';
+      s.clock.currentActor = 0;
+      turnOf(s, 0).option = 'switch';
+      turnOf(s, 0).movesRemaining = 6;
+      return s;
+    }
+
+    const probe = freshGame();
+    const options = legalActions(probe, 0).filter(
+      (i): i is Extract<Intent, { type: 'switch.move' }> =>
+        i.type === 'switch.move' && i.to.row === 0 && i.to.col === 0,
+    );
+    assert.equal(options.length, 2, 'expected two distinct switch.move intents to (0,0)');
+    assert.ok(options.every((i) => i.via !== undefined), 'an ambiguous route must carry a distinguishing via');
+    const vias = new Set(options.map((i) => `${i.via!.row},${i.via!.col}`));
+    assert.equal(vias.size, 2, 'the two routes must carry DIFFERENT via');
+
+    const outcomes = options.map((intent) => {
+      const s = freshGame();
+      const r = applyIntent(s, 0, intent);
+      assert.ok(r.ok, 'a via-qualified move to a square the engine offered must be legal');
+      return s.trays.get('crew')!.consist.map((c) => c.type);
+    });
+    assert.ok(outcomes.some((c) => c.includes('tank')), 'one via should have coupled the tanker');
+    assert.ok(outcomes.some((c) => c.length === 0), 'the other via should have coupled nothing');
+
+    // `via` absent still resolves — the first route enumerated, exactly as before this feature.
+    const s = freshGame();
+    const r = applyIntent(s, 0, { type: 'switch.move', trayId: 'crew', to: at(0, 0), reverse: false });
+    assert.ok(r.ok, 'a plain move with no via must still resolve to SOME legal route');
+  });
+
+  it('a dense district terminates and stays bounded, preferring the routes BFS finds first', () => {
+    // Chained passing loops: each one independently offers "through" or "detour", so N of them
+    // offer 2^N routes to the far end with no global memo to stop it — exactly the exponential case
+    // the cap exists for (plan §3). 15 segments is 32,768 routes; the cap is 4,000 frontier nodes.
+    const segments = 15;
+    const start = 3 * segments;
+    const grid: Record<string, TrackCard> = { [coordKey(at(0, start + 1))]: limitsCard() };
+    for (let k = 0; k < segments; k++) {
+      const divergeCol = start - 3 * k;
+      const midCol = divergeCol - 1;
+      const mergeCol = divergeCol - 2;
+      grid[coordKey(at(0, divergeCol))] = turnout({ stem: 'e', through: 'w', diverge: 's' });
+      grid[coordKey(at(0, midCol))] = straight();
+      grid[coordKey(at(0, mergeCol))] = turnout({ stem: 'w', through: 'e', diverge: 's' });
+      grid[coordKey(at(-1, divergeCol))] = curve('nw');
+      grid[coordKey(at(-1, midCol))] = straight();
+      grid[coordKey(at(-1, mergeCol))] = curve('ne');
+    }
+    grid[coordKey(at(0, 0))] = straight();
+    const area = areaFrom(grid, at(9, 9));
+
+    const startedAt = Date.now();
+    const dests = reachableDestinations(ctxFor(area), at(0, start + 1), 'w');
+    const elapsed = Date.now() - startedAt;
+
+    assert.ok(elapsed < 5000, `exploreMoves took ${elapsed}ms — the cap should keep this fast`);
+    assert.ok(dests.length > 0, 'the cap must not eliminate every route');
+    assert.ok(
+      dests.length < 2 ** segments,
+      `${dests.length} destinations found — the cap should have cut off full 2^${segments} enumeration`,
+    );
+  });
+});

test/train-rules.test.ts

@@ -19,8 +19,11 @@ import { trainRules } from '../src/sim/view.ts';
 
 const config: GameConfig = {
   mode: 'solitaire',
-  victory: 'highestAfterDays',
-  length: 'standard',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
   optionalRules: { reducedVisibility: false, sisterTrains: false, employeeRotation: false, emergencyToolbox: false },
 };
 const game = (seed = 5): GameState => createGame({ id: 'g', seed, config, playerNames: ['p'] });
@@ -30,6 +33,7 @@ const straight = (standing: RollingStock[] = []): TrackCard => ({
   geometry: { kind: 'track', geometry: 'straight' },
   baseOperationalRail: true,
   standing,
+  standingWest: 0,
   facility: null,
   modifiers: [],
   enhancements: [],
@@ -45,9 +49,9 @@ function switching(
 ): string {
   const area = areaOf(s, 0);
   const office = area.officeCoord;
-  // The crew stands one square west of the Office and works westward. It may NOT stand on the Office
-  // itself: §A.4 forbids leaving Rolling Stock on the Office track, so every drop there is refused
-  // whatever the train's own card says.
+  // The crew stands one square west of the Office and works westward, away from the Office square's
+  // own special-cased drop rule (§A.4 forbids everything but a coach there, v0.5.0) — tests that want
+  // that exception exercise it directly instead.
   const here = { row: office.row, col: office.col - 1 };
   area.grid.set(coordKey(here), straight());
   area.grid.set(coordKey({ row: office.row, col: office.col - 2 }), straight(westCars));
@@ -75,13 +79,23 @@ const coach = (loaded = false): RollingStock => ({ type: 'coach', loaded });
 // ---------------------------------------------------------------------------
 
 describe('§7 — no switching', () => {
-  it('refuses every switching act to a train whose card forbids it', () => {
+  it('still allows a plain move — "no switching" means no adding or dropping cars', () => {
     // Six cards print it: both expresses, the Light Engine, Campaign, Circus and Military trains.
-    // Moving, setting out and sorting are all switching, so all three are refused.
+    // A train held at the Office may still need to clear onto Secondary Track ahead of other
+    // traffic, so a move that couples nothing is legal.
     const s = game();
     switching(s, 1, false, [boxcar()]);
+    assert.equal(check(s, 0, { type: 'switch.move', trayId: 't', to: west(s), reverse: false }), null);
+  });
 
-    assert.equal(check(s, 0, { type: 'switch.move', trayId: 't', to: west(s), reverse: false }), 'NO_SWITCHING');
+  it('refuses a move that would couple a car, and refuses dropping and sorting outright', () => {
+    const s = game();
+    switching(s, 1, false, [boxcar()], [boxcar()]);
+
+    assert.equal(
+      check(s, 0, { type: 'switch.move', trayId: 't', to: west(s), reverse: false }),
+      'PICKUP_NOT_ALLOWED',
+    );
     assert.equal(check(s, 0, { type: 'switch.dropCars', trayId: 't', count: 1 }), 'NO_SWITCHING');
     assert.equal(check(s, 0, { type: 'switch.sortConsist', trayId: 't', order: [0] }), 'NO_SWITCHING');
   });
@@ -191,6 +205,41 @@ describe('§7 — the Local keeps its coach (trains 7/8)', () => {
     switching(s, 9, false, [boxcar(), coach()]);
     assert.equal(check(s, 0, { type: 'switch.dropCars', trayId: 't', count: 1 }), null);
   });
+
+  it('may set the coach out at the Office — the one place §A.4 now allows it (v0.5.0)', () => {
+    const s = game();
+    const area = areaOf(s, 0);
+    const office = area.officeCoord;
+    s.trays.set('t', {
+      id: 't',
+      trainNumber: 7,
+      trainIsExtra: false,
+      engineAt: 0,
+      consist: [boxcar(), coach()],
+      direction: 'west',
+      facing: 'w',
+      position: { at: 'grid', seat: 0, coord: office },
+      movesUsed: 0,
+    });
+    s.clock.phase = 'localOps';
+    s.clock.currentActor = 0;
+    turnOf(s, 0).option = 'switch';
+    turnOf(s, 0).movesRemaining = 6;
+
+    assert.equal(
+      check(s, 0, { type: 'switch.dropCars', trayId: 't', count: 1 }),
+      null,
+      'the coach may be cut loose at the Office',
+    );
+    assert.ok(applyIntent(s, 0, { type: 'switch.dropCars', trayId: 't', count: 1 }).ok);
+    const officeCard = area.grid.get(coordKey(office))!;
+    assert.deepEqual(
+      officeCard.standing.map((c) => c.type),
+      ['coach'],
+      'the coach is parked on the Office card',
+    );
+    assert.equal(s.trays.get('t')!.consist.length, 1, 'the coach left the tray');
+  });
 });
 
 describe('§7 — trains Porters may not work', () => {