v0.8.4 — the multiplayer transport: server and browser

The second release from the audit. Every fault here was invisible in solitaire, and four of
the five server faults were in the one file no test had ever stood up; `http.ts` now has an
end-to-end suite on a real port. CHANGELOG has the reasoning.

SERVER. Leaving a lobby freed the chair and kept the token, so a leaver could stream and
move for whoever took the seat next — revoked now, in memory and on disk. The browser
numbered intents from 1 per page load while the server remembered the seat's last number,
so the first move after a reload was swallowed as a resend — the connect push carries the
count and the client continues from it. Nothing serialised moves within a game and every
write shared one `.tmp` name, so two moves at once tore `game.json` (measured: 6 of 200),
and the boot's bare `JSON.parse` then took every game down — per-path write queues, a
per-game move queue, and a boot that skips one bad file. An error after the SSE head was
sent crashed the process. Bodies were unbounded before any secret check.

BROWSER. A double-click did the thing twice: one submit in flight at a time. A failed
submit is `false`, not an unhandled rejection. The documentation renderer flattened nested
bullets into a literal "- " mid-sentence on the published home-deck page. The make-up panel
promised cars the engine refuses; it asks `acceptsCar` now.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FrCWubm9GAftYCm2hWdKwK

.gitignore

@@ -41,3 +41,18 @@ __pycache__/
 # website's replay viewer. It was therefore never committed, and a fresh clone was missing a page
 # the build copies unconditionally. Only the throwaway files this directory collects are ignored.
 /replay*.html
+
+# Playtest saves — somebody's game, attached to a bug report.
+#
+# ANCHORED, and with the README exempted: the directory has to exist and say what it is for, while
+# nothing that lands in it is ever committed. A save is a seed plus the moves made, it belongs to
+# whoever sent it, and it goes stale the moment the rules move. `public/replays/` is the place for
+# one that is worth publishing.
+/playtests/*
+!/playtests/README.md
+
+# The Jitsi harness is NOT scrubbed — four of its files carry a real domain and real
+# participant names (workspace AGENTS.local.md). Ignored so that a `git add -A` cannot sweep it
+# into a history that would be permanently exposed if this repo is ever made public. When it is
+# promoted in Phase 1, scrub it FIRST, then `git add -f tools/`.
+tools/

README.md

@@ -10,29 +10,69 @@ train into an occupied Subdivision. Get that wrong and two trains meet at speed.
 
 ## Status
 
-**v0.4.8 — solitaire is playable in a browser.** The whole game runs client-side: the engine is pure,
-imports nothing outside itself, and never touches `Math.random`, so a static host is all it needs.
+**Solitaire is playable in a browser and multiplayer runs against a server.** The solitaire game runs
+entirely client-side — the engine is pure, imports nothing outside itself, and never touches
+`Math.random`, so a static host is all it needs. Multiplayer adds an authoritative server for the
+seats a shared game requires.
 
-- **Rules** — specified, with **three open questions** left. Thirteen gaps in the original prototype
-  rules were found and closed; three more came after, and are in `TODO.md`: where the Local's coach
-  stands while its engine works (a §A.4 question), Poling — the one card in the deck with no defined
-  behaviour — and whether a Heavy Grade's orientation is rolled or chosen at setup.
+The current version is in [`package.json`](package.json), and every page stamps it with the commit
+and build date, so what is deployed can always be identified from the page itself. This section
+deliberately no longer names one: it went stale for six releases.
+
+- **Rules** — specified. Thirteen gaps in the original prototype rules were found and closed, and the
+  three that came after were all settled in v0.5.0: a coach may be set out at the Office (§A.4),
+  Poling stays out of the deck at zero copies since the source records its effect only as "TBD", and
+  **a Heavy Grade's orientation is rolled from the seed, never chosen by a player** — see
+  [`docs/rules/implications.md`](docs/rules/implications.md) §10 for each ruling and its reasoning.
 - **Card faces** — every card's printed values specified.
 - **Architecture** — seven documents, including a 20-component build plan and the multiplayer plan.
-- **Code** — the engine, the bot, the balance harness, the replay viewer and the playable page. A
-  game can be saved, shared, replayed and stepped back through.
-- **Not built** — the multiplayer server (Phases 0 and 1 of the plan are done: seat and player are
-  separate, turn state is per player, and the page talks to a `Session` rather than to the engine, so
-  a remote one drops in without the page changing — but there is no server, no turn submission and no
-  per-player push), the 22 opponent-directed cards, and real audio.
+- **Code** — the engine, the bot, the balance harness, the replay viewer, the playable page, and the
+  server. A game can be saved, shared, replayed and stepped back through.
+- **Multiplayer — built and running.** `src/server/` serves a lobby (create, join, preview, leave,
+  add a bot, start, and a stream), turn submission, per-session state and persistence, with its own
+  tests under `test/server/`. Games survive a release rather than being destroyed by one. A player
+  weighing a join reads the **whole rule set before taking a seat**; a seat survives a browser
+  reload; anybody may leave and the host may clear a chair; and the four transient signals that make
+  a game feel alive — sound, the timetable flash, an announcement, the badge on the card you just
+  drew — reach a remote client, which they did not before v0.7.0. What is still open is in `TODO.md`
+  under Multiplayer — chiefly that a lost
+  session token still locks someone out of a running game from a genuinely fresh browser.
+- **Watching the table — v0.8.0.** Every accepted move, and every automatic phase that does
+  anything, becomes an ordered **presentation step**: the board replays other people's turns instead
+  of arriving already rearranged. This is what closes "a player cannot see what the others did",
+  which stood open through v0.7.x. A bot's whole switching turn used to land in one push, because
+  `driveBots()` plays it out before the push goes back; now it arrives as a run of steps, the
+  district panel follows whoever is acting, and a `[N behind] … [Skip]` row says how far the board is
+  from the game. Dwell is assigned **by kind** — a switching move holds the screen, turn bookkeeping
+  costs nothing — and is tunable per viewer without a rebuild. Solitaire runs the same path, which is
+  where its automatic phases finally get a visible beat.
 
-Balance is *not* where it should be: the developer bot averaged 7.0 Revenue against a target of 20 —
-of which ~5.4 was the "one Revenue per train that completes its run" rule, so the working freight and
-passenger economy is still only ~2. That rule is now a **setting that defaults to off**, along with
-the passenger and freight rates and the opening hand, so the economy can be read on its own and the
-alternatives can be played rather than argued about. Nothing in this file or in `TODO.md` has been
-re-measured at the new defaults; `TODO.md` says why, and says which of it is the bot and which is the
-deck.
+  **The caption and the history panel are not the same list**, since 2026-09-17. Switching is logged
+  in full; a move from the middle of a turn writes its line as tone `trace`, so the step still
+  carries it — the board captions the move and earns its dwell, and `dwellForStep` pays nothing for a
+  step that said nothing — while the history panel filters the tone out. What the panel draws is the
+  line saying somebody switched, the FIRST move, work at an **industry**, the Small Yard sort, and a
+  closing summary. The last move rides in that summary rather than being kept in place: nothing knows
+  a move was the last until the turn is over, by which time the line has been written and streamed to
+  every client, so it cannot be revised.
+  **Not yet checked in a browser:** the mechanism is proven server-side against a live SSE stream and
+  the page is proven not to throw, but nobody has watched a bot switch on screen.
+- **Not built** — the opponent-directed cards (the Action and Space-use categories, held out of every
+  deck until they have an implementation, along with the defensive cards whose only purpose is to
+  answer them), and real audio. No screen offers a control for the opponent cards any more: the
+  toggle could not do anything, so both screens state the fact in words instead.
+
+Balance is *not* where it should be, and this file no longer quotes a figure for it. It used to say
+"the developer bot averages 7.0 Revenue against a target of 20", which stopped being true the moment
+the transit rule it names was defaulted to off — that rule was worth ~5.4 of the 7.0, for traffic
+nobody had to work. Measured at the current defaults the bot meant about **zero** until it began
+planning its switching turns (2026-09-14), which put it near **2.8**.
+
+The three rates — passenger per coach, freight per load, train per transit — are **settings fixed when
+the game is dealt**, along with the opening hand and where an Extra may start, so the economy can be
+read on its own and the alternatives played rather than argued about. Run
+`node src/sim/harness.ts 400 standard` for today's number rather than trusting one written here;
+`TODO.md` says which of the gap is the bot and which is the deck.
 
 Versions follow the convention at the top of [`CHANGELOG.md`](CHANGELOG.md): third digit for fixes,
 second for a set of features, 1.0 for the first release that deserves the name.
@@ -46,14 +86,18 @@ station-master/
 ├── docs/
 │   ├── rules/          ← the ruleset, card reference, glossary, decision record
 │   ├── architecture/   ← how it is built, and what the pieces are
+│   ├── plans/          ← worked plans for a single change, kept for the reasoning
 │   └── design/         ← board layout studies and rendering samples
-├── public/replays/     ← saved games published to the site's replay directory
+├── public/
+│   ├── replays/        ← saved games published to the site's replay directory
+│   └── images/         ← art the build copies into the site
 ├── scripts/            ← build and deploy the static site
 ├── src/
 │   ├── engine/         ← pure rules engine: no I/O, no clock, deterministic from a seed
+│   ├── server/         ← the authoritative multiplayer server: lobby, sessions, persistence
 │   ├── sim/            ← bot, harness, replay, board rendering
-│   └── web/            ← the playable site: splash, game, replay viewer
-└── test/
+│   └── web/            ← the playable site: splash, game, lobby, replay viewer
+└── test/               ← including test/server/ for the server's own suite
 ```
 
 Start with [`docs/design.md`](docs/design.md) — it indexes everything. Commit messages stay high
@@ -62,11 +106,14 @@ level; [`CHANGELOG.md`](CHANGELOG.md) carries the reasoning and the measurements
 
 ## Development
 
-Requires **Node 22.18+**, which runs TypeScript directly by type stripping. There is no build step.
+Requires **Node 22.18+**, which runs TypeScript directly by type stripping — so there is no compile
+step, and the engine, the bot and the tests all run straight from source. (`npm run build:web` is a
+separate thing: it assembles the static SITE into `dist/`.)
 
 ```sh
 npm install
-npm test          # node --test
+npm test          # node --test, everything except the bot simulations — run after every change
+npm run test:sim  # test/sim.test.ts, the bot simulations (~7 min) — run after a bot or balance change
 npm run typecheck # tsc --noEmit
 ```
 
@@ -104,16 +151,68 @@ is the thing this machinery exists to prevent.
   `fromSave` replays it exactly — that one property gives save, share, undo, restart recovery and
   post-game replay. Events are a DERIVED stream: they narrate what happened and drive the display,
   and they do not reconstruct the position. The phase driver mutates state and then describes it, so
-  fourteen of the forty-six event types are never reduced. Anything that needs to rebuild a game
+  roughly a third of the event types are never reduced at all. Anything that needs to rebuild a game
   replays the intents.
+- **A save is only guaranteed to replay on the version that wrote it.** This is the cost of the
+  property above and is not a bug to be fixed case by case: a save is a list of moves, so it reopens
+  by being *re-played through the current rules*. Any rules change that makes a once-legal move
+  illegal will stop an older save at that move — **a change to the deck is the likeliest breaker**,
+  since a history that names a card the deck no longer deals has no legal answer at all, but any
+  narrowing of what is permitted does it. It fails safe in every case: the load is declined, the
+  offending move is named, and the file is left untouched, so nothing a player has is destroyed.
+  Assume an older save may not open, tell players so wherever a build is announced, and read "this
+  save will not load" in a bug report as this before treating it as a fault. **Versioned, migratable
+  replays are a post-1.0 question** — deliberately not worth the effort while the rules are still
+  moving this fast, since every migration would have to be written against rules that changed again
+  next release.
 - **Never call `Math.random()`.** One ambient random call silently breaks replay.
-- **Track is a deck card, but the opening district is dealt.** 96 of the 235 cards are track — the
-  largest category — so a district is built from what you draw, and building it costs you the
-  industry or train you drew instead. The opening hand is the exception, and it is now **chosen when
-  the game is dealt**: three random cards (the default, and the prototype rule), six random cards, or
-  three track and three other from two separately shuffled piles. The last of those is the only one
-  that guarantees you a district to build; deal six and you open over the limit of three, so the
-  first turn is spent choosing. See `TODO.md`.
+- **The Mainline Phase can stop and ask, and there are three questions it asks.** §8.1's clearance
+  ruling goes to the Superintendent; the Yard Office offer and the Red Flag prompt go to the owner of
+  the district a train is arriving at. `pendingDecision` is a discriminated union and `decisionActor`
+  is the single place that maps a question to whoever must answer it — a new question adds a case
+  there and nowhere else. **Ask before the move is committed:** returning `needsClearance` unwinds
+  the whole phase and the driver re-enters from the top, so anything already mutated is applied
+  twice or left half-done.
+- **A game ends by PAUSING, and the first ending is the real one.** Running out of Days, or closing
+  short of the combined Revenue floor, puts the game in `awaitingExtension` rather than `finished`:
+  the table is asked whether to play one more Day, unanimously, and asked again at the end of every
+  Day it grants. `state.official` is written at the first ending and never rewritten, so the winner
+  is always the one decided at `config.days` however long play carries on — `config.days` itself
+  never moves, and `state.extraDays` counts the borrowed ones. A §3.4 collision breach is the
+  exception and finishes outright, during an extended Day exactly as during the scheduled game.
+  Because a save is a replay, the vote is an intent (`game.extend`), and it is the one intent that
+  **carries its own player**: every seat may vote in any order, so a replay cannot derive who did.
+- **Statistics are folded, not recorded.** `state.tally` counts what the event stream says happened —
+  trains through the Division and how many of them did any switching, loads made up and broken — and
+  is hooked
+  at the two boundaries every event crosses exactly once, `applyIntent` and `advance`. It is not
+  hooked in `reduce`, which never sees the phase driver's events at all. Nothing in the rules reads
+  it, so adding a counter is always safe; it rides the `Frame`, so a multiplayer client gets the same
+  numbers as solitaire from one implementation. **What it cannot count is anything the events do not
+  say.** `trainStoodStill` fires once per game for the X18 Circus alone, so "the longest an engine sat
+  on a siding" has no signal behind it — see `TODO.md` #36 rather than assuming an event means what
+  its name suggests.
+- **A game is one of four TYPES, and a type is a set of defaults rather than a ruleset.** Co-op,
+  Competitive, Cutthroat and Solitaire (`src/web/presets.ts`) each name an opening hand, an Extra
+  rule, three revenue rates and the victory conditions; picking one fills the form, and changing any
+  of them selects **Custom**, which keeps the scoring of the type it came from. The type is *derived*
+  from the numbers rather than stored, so a saved game carries no name that can disagree with what it
+  actually is. Both screens that deal a game — the lobby and the New Game dialog — ask the same
+  eleven questions through one shared block (`src/web/settings-form.ts`), because for two releases
+  they each had a question the other lacked. What separates the types: Co-op alone pays for a
+  transit, Cutthroat alone lets an Extra be planted in another player's district and has no shared
+  failure condition at all beyond three collisions in a Day, and the Revenue floor is a formula in
+  the table size and the length (3 per player per Day in Co-op, 2 in Competitive) rather than a
+  number.
+- **Track is a deck card, but the opening district is dealt.** Track is the largest category in the
+  deck by a distance — so a district is built from what you draw, and building it costs you the
+  industry or train you drew instead. The opening hand is the exception, and it is **chosen when the
+  game is dealt**: three random cards (the prototype rule), six random cards, or three track and
+  three other from two separately shuffled piles. The last of those is the only one that guarantees
+  you a district to build; deal six and you open over the limit of three, so the first turn is spent
+  choosing. **Every game type now deals six** (Jesse’s call, v0.7.0) — the engine's own fallback,
+  `SOLO_CONFIG`, deliberately did not move with it, because every sim measurement is taken against
+  that. See `TODO.md`.
 - **What the work pays is a setting too.** Passenger revenue per coach, freight revenue per load and
   train revenue per transit each run 0–5 and are fixed when the game is dealt. The first two default
   to 1 and pay at both ends of a movement — boarding *and* detraining, loading *and* unloading. The
@@ -121,6 +220,14 @@ is the thing this machinery exists to prevent.
   it was worth more than the entire freight and passenger economy put together, for traffic nobody
   has to work. A seed alone therefore no longer names a game — the settings ride in the URL beside
   it, and every save records the rules it was dealt under.
+- **A load may not be broken in the district that made it.** Freight or passengers loaded anywhere in
+  an Office Area cannot be unloaded anywhere in that same Office Area — not at another facility, not
+  in a later Stage. A train has to carry them to a different district first. The printed game turns
+  the chip upside down in the tray; here the load carries the seat that made it (`RollingStock.origin`
+  in `src/engine/state.ts`) and it never expires. Without it a Freight House could unload the boxcar
+  its own Laborers had just loaded and a platform could detrain the passengers it had just boarded,
+  each paying Revenue at both ends for a load that went nowhere: worth **0.60 ± 0.10 Revenue a game**
+  to the developer bot over 400 paired deals, on 78 of them.
 - **A turnout can be laid on top of a card already down.** It upgrades a straight at any rotation, or
   a curve whose arc matches its own diverging leg — both strict port supersets of what they replace,
   so an upgrade can never sever an existing join. Without it a district could only hang off track that

docs/StationMaster-Components-v0.4.5.md

@@ -1,58 +0,0 @@
-# Station Master — Components and Markers
-
-**Rules implementation reference: v0.4.5**  
-**Scope:** non-card physical components and supplies modeled by the v0.4.5 game. Card-created facilities, workers, deck piles, hand state, timetable state, and other markers are documented with their cards or in the rules book.
-
-## Rolling stock
-
-Rolling stock has a type and a load state. In the interface, coloured cars are loaded and white cars are empty. The Division Yard starts with the following supply.
-
-| Type | Loaded | Empty | Total | Use |
-| --- | ---: | ---: | ---: | --- |
-| Coach | 8 | 8 | 16 | Passenger work. |
-| Boxcar | 10 | 10 | 20 | Freight House outbound/inbound; Grocer’s Warehouse inbound. |
-| Hopper | 8 | 8 | 16 | Mine Tipple outbound; Power Plant inbound. |
-| Reefer | 5 | 5 | 10 | Packing Sheds outbound; Grocer’s Warehouse inbound. |
-| Tank car | 6 | 6 | 12 | Refinery outbound; Power Plant inbound. |
-| Caboose | 6 | 0 | 6 | Required or permitted at the rear of the applicable train cards. |
-| **Total** | **43** | **35** | **78** | |
-
-The engine is not rolling stock and does not count against the four-car Crew Tray limit.
-
-## The two yards
-
-### Division Yard
-
-The Division Yard is the active supply. It provides:
-
-- loaded cars to a Freight Agent stocking a green outbound box;
-- empty cars for building up trains;
-- an empty coach when passengers detrain; and
-- an empty matching freight car when a loaded freight car begins unloading.
-
-When a train completes a run or is destroyed, its caboose returns to the Division Yard. When a car is taken from the Division Yard and that yard has become entirely empty, every car from the Classification Yard moves back into the Division Yard immediately.
-
-### Classification Yard
-
-The Classification Yard collects used rolling stock: cars displaced by boarding passengers, cars cleared from inbound red boxes, cars removed by unjamming a facility, ordinary cars from completed or destroyed trains, and empty cars replaced by a completed outbound freight load. It is not a player-selectable source. It returns to service only when the Division Yard is empty.
-
-## Crew Trays and trains
-
-Crew Trays represent an engine and its coupled consist. The game creates **players + 3** free trays at setup. A tray is scarce: a due train without a free tray is held for that Stage, and Extras wait until one becomes free.
-
-Within a tray, the engine can pull, push, or be between cars while switching. To depart an Office for the Mainline, it must be made up with the engine at an outer end; if it has a caboose, the caboose must be at the opposite outer end. A train may have at most four cars. A scheduled train can run under-strength but never with more than its card allows.
-
-## Fedora
-
-The **Fedora** is the physical marker for the Superintendent. The player with it resolves following-train clearance decisions and takes the 5-Revenue penalty for a Mainline collision caused by an unsafe clearance. The initial holder is the first player tied for the highest Superintendent setup D12 roll. The Fedora passes to the next seat to the left at each third-stage shift change.
-
-## D12 and seeded randomness
-
-The D12 is used by the engine for:
-
-- the initial seating roll in a multi-player engine game;
-- the initial Superintendent roll;
-- a timetabled train’s timetable slot; and
-- all shuffled deck order and automatic setup selection through the same seeded random stream.
-
-The rules engine uses a deterministic 32-bit seeded random generator. The same numeric seed, player configuration, house rules, and accepted intent sequence reconstruct the same game. A seed by itself is not enough when house rules differ.

docs/StationMaster-Home-Deck-v0.4.5.md

@@ -1,155 +0,0 @@
-# Station Master — Home Deck
-
-**Rules implementation reference: v0.4.5**  
-**Scope:** every card associated with the Home Office deck, including cards catalogued in the source but deliberately excluded from the dealt deck.
-
-## Dealt card catalogue
-
-The live Home Office deck contains **213 cards** in every currently supported mode. The rules for its setup, drawing, discarding, reshuffling, and hand limit are in the rules book, section 4.2.
-
-| Active category | Cards |
-| --- | ---: |
-| Track | 96 |
-| Office upgrades | 14 |
-| Freight facilities | 27 |
-| Facility modifiers | 23 |
-| Train cards | 22 |
-| Enhancements | 18 |
-| Mainline modifiers | 7 |
-| Maneuvers | 6 |
-| **Total dealt** | **213** |
-
-The catalogue also contains 12 space-use cards and 10 action cards. All 22 are excluded from every v0.4.5 dealt deck because their opponent-directed play rules are not implemented. They are listed at the end of this document for completeness.
-
-## Track cards — 96
-
-Track cards are ordinary Home Office cards, not a separate personal supply. A placed card must connect to existing rail. The Running Track is the horizontal row from Limit to Limit; cards there must carry an east–west through route. Placing track on a Limit extends the Running Track and moves that Limit outward.
-
-| Card | Copies | Implemented placement facts |
-| --- | ---: | --- |
-| Straight track | 32 | East–west Operational Rail. |
-| Curved track, right | 16 | A 45° curve; can rotate 180°, but cannot flip. Right-hand geometry is fixed to the `ne_sw` diagonal. |
-| Curved track, left | 16 | A 45° curve; can rotate 180°, but cannot flip. Left-hand geometry is fixed to the `nw_se` diagonal. |
-| Turnout, right | 16 | East–west through route plus one 45° branch. It may be passed through but is not Operational Rail, so a train cannot end a Move on it. |
-| Turnout, left | 16 | Same operational rules; opposite fixed diagonal. |
-| Sharp curved track, right | 0 | Catalogued but not dealt. |
-| Sharp curved track, left | 0 | Catalogued but not dealt. |
-
-A turnout may upgrade an existing straight, or a curve whose arc is exactly the turnout’s diverging arc. An upgrade is forbidden if the existing card holds standing cars or an enhancement. All other occupied squares are unavailable.
-
-## Offices — 14
-
-Every player begins at a Whistle Post, which is not drawn from the deck. Office cards are upgrades and must be played in sequence; they upgrade the existing Office rather than replacing its card or attached track.
-
-| Card | Copies | A/D tracks | Porters | Passenger outbound/inbound slots | Other effect |
-| --- | ---: | ---: | ---: | ---: | --- |
-| Depot | 8 | 2 | 1 | 1 / 1 | Becomes a Control Point and Passenger Facility. |
-| Station | 4 | 3 | 2 | 2 / 2 | Upgrade Depot only; Control Point and Passenger Facility. |
-| Terminal | 2 | 4 | 3 | 3 / 3 | Upgrade Station only; Control Point and Passenger Facility. |
-
-The Whistle Post has one A/D track, no porters, and no passenger slots. An Office upgrade preserves modifiers already applied to it.
-
-## Freight facilities — 27
-
-An industry may be placed only on a connected straight stub off the Running Track. Each facility begins with one Laborer and a three-box MEN | AT | WORK freight pipeline. Its industry track has capacity equal to its base outbound plus inbound capacity, with a minimum of one car.
-
-No Office Area may contain a duplicate industry, or both ends of a listed lockout pair.
-
-| Card | Copies | Cars handled | Flow | Base boxes | Lockout in same Office Area |
-| --- | ---: | --- | --- | --- | --- |
-| Freight House | 6 | Boxcar | Outbound and inbound | 1 out / 1 in | Freight House; Grocer’s Warehouse |
-| Mine Tipple | 6 | Hopper | Outbound | 1 out / 0 in | Power Plant |
-| Refinery | 3 | Tank car | Outbound | 1 out / 0 in | Power Plant |
-| Power Plant | 6 | Hopper or tank car | Inbound | 0 out / 1 in | Mine Tipple; Refinery |
-| Packing Sheds | 3 | Reefer | Outbound | 1 out / 0 in | Grocer’s Warehouse |
-| Grocer’s Warehouse | 3 | Boxcar or reefer | Inbound | 0 out / 1 in | Packing Sheds; Freight House |
-
-## Facility modifiers — 23
-
-A modifier occupies an empty square adjacent to an eligible facility. It is unique by modifier type within an Office Area. The implementation attaches it permanently to the first eligible adjacent facility found; it does not implement a per-Stage choice when one modifier touches more than one possible facility.
-
-`+ out` adds green outbound capacity only where the host can load; `+ in` adds red inbound capacity only where the host can unload. A capacity increase at a freight facility also lengthens its industry track by the usable number of added slots. Worker increases always apply.
-
-| Modifier | Copies | Eligible host | Actual grant |
-| --- | ---: | --- | --- |
-| Waiting Area | 3 | Any Office | +1 outbound passenger slot; +1 Porter |
-| Restaurant | 2 | Any Office | +1 outbound passenger slot; +1 Porter |
-| Hotel | 1 | Any Office | +1 outbound passenger slot; +1 Porter |
-| Truck Dock | 2 | Freight House, Packing Sheds, Grocer’s Warehouse | +1 **inbound** slot; no Laborer |
-| Railroad Express Agency | 1 | Freight House | +1 outbound slot; +1 Laborer |
-| Forklifts | 2 | Freight House, Packing Sheds | +1 outbound slot; +1 Laborer |
-| Prep Plant | 1 | Mine Tipple | +1 outbound slot; +1 Laborer |
-| Coal Piles | 1 | Mine Tipple | +1 outbound slot; +1 Laborer |
-| Conveyor Belts | 1 | Mine Tipple | +1 outbound slot; +1 Laborer |
-| Pipelines | 1 | Refinery | +1 outbound slot; +1 Laborer |
-| Oil Depot | 1 | Refinery | +1 outbound slot; +1 Laborer |
-| Viscosity Breakers | 1 | Refinery | +1 outbound slot; +1 Laborer |
-| Transmission Lines | 1 | Power Plant | +1 Laborer |
-| Rotary Dumps | 1 | Power Plant | +1 Laborer |
-| Steam Turbines | 1 | Power Plant | +1 Laborer |
-| Ice House | 2 | Packing Sheds or Grocer’s Warehouse | +1 outbound slot; +1 Laborer |
-| Local Small Groceries | 1 | Grocer’s Warehouse | +1 Laborer |
-
-A bonus beside a facility that cannot use its direction is not usable and does not create a slot or lengthen the track — an outbound bonus beside an inbound-only facility, or the Truck Dock's inbound bonus beside the outbound-only Packing Sheds, which leaves that card with no effect at all. Likewise, passenger modifiers beside a Whistle Post add Porters but do not create an outbound slot until the Office becomes a Passenger Facility.
-
-## Train cards — 22
-
-Playing a timetabled train card rolls the seeded D12 and places its number in the first open timetable slot at or after the result, wrapping around the 12-slot chart. It then runs at that Stage every Day. An Extra is queued and made up when a Crew Tray becomes available; v0.4.5 automatically launches Extras eastbound from the Western Division Point.
-
-The listed consist is a maximum, not a minimum: a train may depart with fewer cars, but must not exceed the listed categories, put a car behind a caboose, or leave with the engine buried among cars. A Crew Tray holds no more than four rolling-stock cars.
-
-| Train | Speed | Direction | Listed maximum consist | Implemented special rule |
-| --- | --- | --- | --- | --- |
-| 1/2 Crack Limited | Fast | 1 west / 2 east | 3 coaches | No switching; passenger work only at Terminals; expedited. |
-| 3/4 Express | Fast | 3 west / 4 east | 2 freight | May exchange at most one freight car at each grid location during its switching turn; expedited. |
-| 5/6 The Sparrow | Fast | 5 west / 6 east | 2 coaches | No switching; expedited. |
-| 7/8 Local | Slow | 7 west / 8 east | 1 freight, 1 coach | Its coach may not be set out during switching. |
-| 9/10 Heavy Freight | Slow | 9 west / 10 east | 3 freight, 1 caboose | — |
-| 11/12 Drag Freight | Slow | 11 west / 12 east | 2 freight, 1 caboose | — |
-| X13 Appleseed Extra | Slow | Player choice printed; v0.4.5 launches east | 3 empty freight, 1 caboose | May drop cars but cannot pick up. The engine enforces no pickup, but does not enforce the printed empties-only consist restriction at make-up. |
-| X14 Fruit Growers Express | Fast | Player choice printed; v0.4.5 launches east | 2 reefers, 1 caboose | Expedited. The code enforces reefers-only; the printed extra loaded-reefer pickup is not a separate rule. |
-| X15 Yard Xfer | Slow | Player choice printed; v0.4.5 launches east | 2 freight, 1 caboose | — |
-| X16 Light Engine Move | Fast | Player choice printed; v0.4.5 launches east | No cars | No switching. |
-| X17 Campaign Train | Fast | Player choice printed; v0.4.5 launches east | 1 coach | No switching. First Office arrival lays over for speeches; later arrivals are expedited. |
-| X18 Circus Train | Slow | Player choice printed; v0.4.5 launches east | 2 freight, 1 coach, 1 caboose | No switching. The first Mainline Phase in which it remains stopped awards its current Office’s player 1 Revenue. |
-| X19 Military Train | Slow | Player choice printed; v0.4.5 launches east | 1 freight, 2 coaches | No switching; no passenger work; expedited. |
-| X20 Director’s Private Car | Slow | Player choice printed; v0.4.5 launches east | 2 freight, 1 coach | No passenger work. |
-| X21 Freight Extra | Slow | Player choice printed; v0.4.5 launches east | 3 freight, 1 caboose | — |
-| X22 Pee-Dee | Slow | Player choice printed; v0.4.5 launches east | 1 caboose | May pick up empty cars only. |
-
-## Enhancements — 18
-
-| Card | Copies | Placement | v0.4.5 behavior |
-| --- | ---: | --- | --- |
-| Interlocking | 2 | Bare Running Track straight | When the Office is full, an inbound train is held at the Limits instead of colliding. |
-| Facing Point Locks | 2 | Any card; requires an Interlocking somewhere in the district | Blocks Derail. Derail is unavailable in v0.4.5, so this remains dormant. |
-| Yard Office | 1 | Bare Secondary Track straight | A coachless inbound train is diverted to this track instead of occupying an A/D track. |
-| Small Yard | 1 | Bare Secondary Track straight | A train may spend one switching Move here to reorder its entire consist and put the engine at the nose. |
-| Water Column | 2 | Bare Running Track straight | Removes a Watertower. Watertower cards are unavailable, so this remains dormant. |
-| Overpass | 1 | Any card | No implemented effect. |
-| Telegraph | 3 | Bare Running Track straight | Once per Day, the Superintendent may add 4 to an opposing train’s number when that makes a facing clearance safe. |
-| Telephone | 2 | On a Telegraph | Same dispatch mechanism, +8 once per Day. |
-| Radio | 2 | On a Telephone | Same dispatch mechanism, +12 once per Day. |
-| ABS Signals | 2 | Any Mainline card | Prevents rear-end collisions and holds a following train short. |
-
-An enhancement requiring a bare straight cannot share that straight with another such enhancement. Telephone and Radio are the explicit stackable chain.
-
-## Maneuvers — 6
-
-| Card | Copies | Behavior |
-| --- | ---: | --- |
-| Red Flags | 5 | May be played at any time on a train stopped on a Mainline card. An approaching following train is held instead of moving into it. |
-| Flying Switch | 1 | During the owner’s switching option, spend one Move to roll a tail-end cut into a track-connected freight facility without moving the engine there. |
-| Poling | 0 | Catalogued but not dealt; no rule is implemented. |
-
-## Catalogued but not dealt — 22 opponent-directed cards
-
-### Space-use cards — 12
-
-Bean House (1), Flop House (1), Watertower (1), Hobo Jungle (1), Section House (1), City Blocks (4), Engine Shops (1), Tenderloin District (1), and Engineer Cemetery (1) are excluded. Their source descriptions say they consume table space; Hobo Jungle additionally describes vandalism looting a passing boxcar. No placement or effect is available in v0.4.5.
-
-### Action cards — 10
-
-Derail (2), Broken Coupler (1), Railroad Crossing (1), Per Diem Inventory (1), Demurrage Charge (1), Customer Complaints (1), Vandalism (1), Hotbox (1), and Outlawed (1) are excluded. Their printed target/effect text is catalogued in the code, but `card.play` rejects the categories as not implemented. Consequently, no card can currently be played on another player.
-
-There are also two **Facing Point Locks** listed among Mainline modifiers. They are treated as the same grid enhancement as Facing Point Locks above, require an Interlocking, and are included in the active 213-card total.

docs/StationMaster-Mainline-Deck-v0.4.5.md

@@ -1,71 +0,0 @@
-# Station Master — Mainline Deck
-
-**Rules implementation reference: v0.4.5**  
-**Scope:** the tarot-sized Mainline cards placed between Offices. This is an implementation reference, not a transcription of earlier prototype rules.
-
-## How Mainline cards work
-
-At setup the game places one randomly selected Mainline card between each neighbouring pair of Offices and one beyond each end Office, between it and a Division Point. Thus, a game with *N* players has *N + 1* Mainline cards. The implementation selects types with replacement; it does not deal them from a shuffled finite deck.
-
-A train crossing a Mainline card spends Stages, rather than moving through its printed cells. A 60 mph card costs one Stage and a 30 mph card costs two. A Slow train adds one Stage to every crossing. On Hilly terrain, any train carrying at least one coach uses the passenger rate; a train carrying no coach uses the freight rate. No crossing can take less than one Stage.
-
-The card does not itself determine which player owns the adjacent Office. It is part of the shared Division.
-
-## Physical card inventory in `Mainline Cards.pdf`
-
-The supplied PDF has **ten** tarot-sized terrain cards. Plains appears twice; the other terrain types appear once each. It also includes two Division Point cards.
-
-| Physical card | Copies in the PDF |
-| --- | ---: |
-| Plains | 2 |
-| Curves | 1 |
-| Hilly | 1 |
-| Heavy Grade | 1 |
-| Double Track | 1 |
-| Uncontrolled Siding | 1 |
-| Tunnel | 1 |
-| Trestle | 1 |
-| Interchange | 1 |
-| East Division Point | 1 |
-| West Division Point | 1 |
-
-The PDF art labels this card “Yard”; this reference uses the implementation’s correct name, **Interchange**, to distinguish it from the Division Yard, Classification Yard, Yard Office, and Small Yard.
-
-## Implemented Mainline card reference
-
-| Card | Implemented crossing time and feature |
-| --- | --- |
-| Plains | 60 mph; one Stage for Fast, two for Slow. The implementation has one Plains *type* rather than the PDF’s two physical copies. |
-| Curves | 30 mph; two Stages for Fast, three for Slow. |
-| Hilly | Passenger train: 60 mph. Freight-only train: 30 mph. Add one Stage if Slow. |
-| Heavy Grade | Starts at 30 mph; two Stages for Fast, three for Slow. The card requires the player to select its uphill direction; v0.4.5 instead selects that direction from the game seed during setup. Grade modifiers can reduce the time, to a minimum of one Stage. |
-| Double Track | 60 mph. Printed capability: trains may pass. The traffic-resolution rule is in Rules §4.5. |
-| Uncontrolled Siding | 60 mph. Printed capability: trains may pass. The traffic-resolution rule is in Rules §4.5. |
-| Tunnel | 30 mph. |
-| Trestle | 60 mph. |
-| Interchange | 60 mph. A train may be reordered there only through the card’s printed “sort cars” concept; the current engine does **not** provide a Mainline sorting action for it. |
-
-### PDF/code mismatch requiring correction
-
-`src/engine/content.ts` defines nine `MAINLINE_PROFILES` types: one Plains entry plus the eight other terrain types above. `setup.ts` selects uniformly from that nine-type list. The second Plains card shown in `Mainline Cards.pdf` is therefore not represented as a duplicate card or as extra Plains weight in setup. If the PDF inventory is authoritative, the setup selection needs a second Plains entry (or an equivalent weighted selection).
-
-The executable state represents East and West Division Points as fixed end nodes, not as card records. They are functionally present at the ends of the Division, but are not represented as the two PDF cards in the deck/state model.
-
-## Heavy Grade modifiers
-
-These cards come from the Home Office deck and are played onto a Mainline card during a player’s Draw option.
-
-| Card | Copies | Placement and actual effect |
-| --- | ---: | --- |
-| Brakeman | 1 | Heavy Grade only. Reduces a downhill crossing by one Stage. |
-| Airbrakes | 1 | Heavy Grade only, and Brakeman must already be on that card. Reduces a downhill crossing by one additional Stage. |
-| Helpers | 1 | Heavy Grade only. Reduces an uphill crossing by one Stage. |
-| Realignment | 2 | May be played only onto an unoccupied Mainline card. Changes Plains → Double Track, Curves → Plains, Uncontrolled Siding → Double Track, or Trestle → Uncontrolled Siding. It cannot be played on any other card type. |
-
-For the grade cards, “uphill” should be the direction selected by the player when the card is placed. In v0.4.5 it is the seeded `gradeUp` direction because setup has no player-choice step.
-
-## What is not implemented
-
-- There is no finite draw pile, player choice, or physical placement interaction for Mainline cards; setup selects their types automatically from the seeded random stream.
-- Interchange is catalogued as a “sort cars” card, but v0.4.5 has no operation that reorders a train on the Interchange. The Small Yard in an Office Area is the implemented sorting mechanism.
-- Heavy Grade orientation is seeded automatically rather than chosen by a player. The implementation needs a player-selection step to match the card.

docs/StationMaster-Rules-v0.4.5.md

@@ -1,290 +0,0 @@
-# Station Master — Rules
-
-**First-draft rules reference for v0.4.5**  
-**Authority:** observed v0.4.5 code paths and tests. Where a card face, prototype document, and executable behavior differ, this document reports executable behavior and marks unimplemented material.
-
-## 1. Overview and background
-
-Station Master is a railroad-operations game set in the timetable-and-train-order era. Each player operates an Office Area on a shared east–west Division. The local work is building rail, switching cars, moving passengers and freight through facilities, and keeping the Office clear. The shared work is dispatching scheduled trains across the Division. The player holding the Superintendent’s Fedora decides whether to clear a following train into an occupied Subdivision; an unsafe decision can cause a collision.
-
-Revenue is the score. Passenger boarding and detraining, freight loading and unloading, completed runs, collisions, and victory conditions are all resolved by the rules configured when the game is dealt.
-
-This book is divided as follows:
-
-1. overview and scope;
-2. definitions;
-3. creating, saving, replaying, and configuring games;
-4. the shared basic game mechanics;
-5. the implemented solitaire game;
-6. the implemented multiplayer/engine status; and
-7. FAQs and implementation limits.
-
-The companion references are [Mainline deck](StationMaster-Mainline-Deck-v0.4.5.md), [Home deck](StationMaster-Home-Deck-v0.4.5.md), and [components](StationMaster-Components-v0.4.5.md).
-
-## 2. Definitions
-
-| Term | Meaning in v0.4.5 |
-| --- | --- |
-| A/D track | An Office arrival/departure capacity. A Whistle Post has 1; Depot, Station, and Terminal have 2, 3, and 4. |
-| Card location | A square in an Office Area grid. A train may end a switching Move only on Operational Rail. |
-| Classification Yard | The holding yard for used rolling stock. It refills the Division Yard only when that yard is completely empty. |
-| Control Point | A Depot, Station, or Terminal. It breaks the shared Mainline into Subdivisions. A Whistle Post is not one. |
-| Crew Tray | An engine plus up to four coupled rolling-stock cars. The engine itself does not count as a car. |
-| Department pile | One of three shared face-up card stacks. Draw and discard affect only the top card. |
-| Division Point | The western or eastern end of the shared Division, where trains enter and leave it. |
-| Division Yard | The active source of rolling stock. |
-| Expedited train | A train with the expedite rule. It performs Load/Unload at an Office after arriving, then attempts to depart at the end of that same Stage. |
-| Facility | A Passenger Facility at an upgraded Office or a Freight Facility at an industry. |
-| Freight Agent | The Local Operations option that stocks one outbound box, clears one inbound box, unjams one load, or ends without acting. |
-| Limits | The two signs defining an Office Area’s Running Track. They move outward when that track is extended. |
-| Local Operations | The first player-driven phase of a Stage. A player chooses one: switch, draw, or Freight Agent. |
-| Mainline | The shared cards between Offices and Division Points. |
-| MEN \| AT \| WORK | A three-box freight pipeline. Any load on it locks its industry track. |
-| Operational Rail | A card on which a train may finish a Move. Turnouts are pass-through only; a locked industry is not usable at all. |
-| Running Track | The east–west track between an Office Area’s Limits, including its Office. |
-| Secondary Track | All local rail inside the Limits that is not Running Track. |
-| Stage | One of twelve turns in a Day. Its phases are Local Operations, New Train, Mainline, Load/Unload, and Shift Change. |
-| Subdivision | Mainline between Division Points or Control Points. Clearance checks look through the whole next Subdivision. |
-| Superintendent | The player with the Fedora. The role decides same-direction clearances and rotates every three Stages. |
-| Timetabled train | A numbered train card scheduled to one of the 12 Stage slots, then due at that slot each Day. Odd numbers go west; even numbers go east. |
-
-## 3. Create, save, replay, and game configuration
-
-### 3.1 Starting a new game in the shipped client
-
-The v0.4.5 browser page creates a **one-player solitaire Standard game**. Select **New game**, then choose:
-
-1. a numeric seed, or leave it blank for a fresh browser-generated seed;
-2. a starting hand;
-3. passenger, freight, and train-transit Revenue rates.
-
-The browser writes those choices into the URL. A particular game is defined by the **seed plus these house rules**, not the seed alone.
-
-The three starting-hand choices are:
-
-| Choice | Setup result |
-| --- | --- |
-| Three random cards | Default. Deal three cards from one shuffled deck. |
-| Six random cards | Deal six cards from one shuffled deck. The player begins over the normal hand limit and must play/discard down before ending the first Draw turn. |
-| Three random track and three random non-track cards | Shuffle track and non-track piles separately for the opening deal; then recombine and shuffle their remainders for all later draws. |
-
-The three Revenue values are independently rounded and clamped to 0–5:
-
-- passenger Revenue per coach, paid on boarding and again on detraining;
-- freight Revenue per load, paid on completion of an outbound load and again on completion of an inbound unload; and
-- train Revenue per transit, paid to every player when a train leaves the Division.
-
-Defaults are 1 / 1 / 0. Zero turns that revenue source off; it does not prevent the underlying operation.
-
-### 3.2 Deterministic setup and the seed
-
-The engine uses one seeded random stream for shuffles, Mainline selection, opening D12 rolls, timetable rolls, and automatic Heavy Grade orientation. Given the same seed, configuration, player names/order, and accepted action history, it reconstructs the same state.
-
-At setup it creates each Office Area as `Limit — Whistle Post — Limit`, makes the Division Yard, creates players + 3 Crew Trays, turns up three Department cards, and constructs the shared Division.
-
-In a multi-player engine game, every player receives two seeded D12 rolls:
-
-- The **division roll** orders seats from low west to high east; equal results put the lower player index farther east.
-- The **Superintendent roll** gives the initial Fedora to the first player tied for highest.
-
-The opening deal starts at the Superintendent’s seat and proceeds left (eastward in the engine’s seat ordering).
-
-### 3.3 Saving, resuming, and replaying solitaire
-
-The local save format is JSON containing the seed, the accepted intent history, and the house rules. It does not serialize mutable game state. Loading recreates the game from the seed and replays every action through the rules engine. If an old history reaches an action that is no longer legal, replay stops there instead of forcing an invalid state.
-
-The browser also stores the current local game and resumes it automatically when the page opens without an explicit seed in the URL. A downloaded save is named `station-master-seed<seed>-day<day>.json`.
-
-**Undo is solitaire-only.** It removes the final accepted intent and rebuilds the game from the earlier history. Random outcomes are not rerolled: replaying the same action consumes the same seeded result. Undo can therefore change the player’s decision after seeing an outcome, but cannot fish for a different timetable die roll.
-
-### 3.4 Engine game modes and endings
-
-The engine defines Solitaire, Competitive, and Co-op modes. The browser exposes only Solitaire.
-
-| Length | Target | Days |
-| --- | ---: | ---: |
-| Short | 10 | 3 |
-| Standard | 20 | 5 |
-| Campaign | 45 | 10 |
-
-With `firstToTarget`, competitive mode ends when any individual reaches the target; co-op uses target × player count and total Revenue. With `highestAfterDays`, competitive mode requires the table’s combined Revenue to reach `3 × players × days`; otherwise everyone loses. If that floor is met, the highest individual score wins. Solitaire and co-op win only if their score reaches their target at the end of the length.
-
-Competitive mode also ends in a collective loss after three collisions in one Day.
-
-The configuration contains four optional-rule flags. Only two have engine effects: **Reduced Visibility** gives five rather than six switching Moves in Stages 1, 2, 3, 11, and 12; **Emergency Toolbox** initially sets the Red Flags hand-limit status, allowing four cards. Sister Trains and Employee Rotation are represented in configuration/state design but are not executed by v0.4.5.
-
-### 3.5 Multiplayer setup status
-
-There is no multiplayer lobby, room creation flow, remote server, invitation flow, or network session in v0.4.5. The engine can be called with multiple player names (and rejects a Solitaire configuration with more than one), but the delivered page always calls it for one local player. See section 6.
-
-## 4. Basic game mechanics
-
-### 4.1 The Stage sequence
-
-Each of 12 Stages follows this sequence:
-
-```text
-1. Local Operations — each player, starting with the Superintendent and proceeding left
-2. New Train — make up due timetabled trains, then queued second sections and Extras
-3. Mainline — automatic train movement in numeric order
-4. Load/Unload — each player, starting with the Superintendent and proceeding left
-5. Shift Change — expedited departures, clocks/workers, and possibly the Fedora
-```
-
-At a Shift Change, Laborers and Porters reset. The Fedora moves after Stages 3, 6, 9, and 12. At Day end, dispatch-device use resets, collision count resets, the Day and Stage roll over, and victory is checked.
-
-### 4.2 Local Operations: choose one option
-
-On a player’s Local Operations turn, choose exactly one available option.
-
-**Switch.** Select any Crew Tray currently in that player’s Office Area. It gets six Moves, or five under Reduced Visibility on the listed night Stages. A Move travels any connected distance in one direction and must end on Operational Rail. Reversing is a separate Move. A train may pass through a turnout but cannot stop on it. It may not share or pass through another train except through an Office with a free A/D track.
-
-Standing cars couple automatically when the train reaches them; it may not pass them, and the resulting consist may not exceed four cars. Coupling forward places cars ahead of the engine; coupling while backing places them behind it. Setting out cars does not spend a Move, but the cut must come from an outer end of the consist and may not be left on the Office. A Small Yard can reorder a consist for one Move. Flying Switch spends one Move to roll a tail cut into a connected Freight Facility.
-
-**Draw.** Take one card from the face-down Home Office or the exposed top of one Department pile. During this option, play eligible cards and/or discard cards to Department piles, then finish at the hand limit. Track, facilities, offices, modifiers, enhancements, and train cards have the placement or scheduling rules in the deck references. Mainline modifiers are played from this option as well.
-
-**Freight Agent.** Make one of these operations, then the turn ends: stock one green outbound box from a matching loaded Division Yard car; clear one red inbound box to the Classification Yard; unjam one outbound, inbound, or MEN | AT | WORK load to the Classification Yard; or explicitly end without acting. Freight can be stocked only when an unclaimed empty matching car is already spotted at that industry. Passengers may wait in a green Office box without a train present.
-
-Implementation note: `card.discard` is accepted by the v0.4.5 engine during Local Operations without checking that Draw was chosen. This unusual implementation behavior is not a separate published turn option.
-
-### 4.3 Track, switching, and local safety
-
-The Running Track cannot be broken by a curve or other card lacking its east–west through route. Local branches use turnouts and 45° curves. Cards that touch vertically connect only if their 45° legs share the correct diagonal; mere adjacency is not rail connection.
-
-An industry’s track is locked while any load is on its MEN | AT | WORK pipeline. Trains cannot enter, cross, pick up from, or set cars out there. When it is unlocked, an industry track is ordinary Operating Rail and holds up to four cars, the same as any other non-turnout, non-Limits card: a crew may set out one, two, three or four cars there, whatever it is carrying. An industry’s green and red boxes are how much work it can hold, not how much rail it has, and a Modifier beside it adds a box without adding room for a car.
-
-Train-card restrictions also apply while switching. No-switching trains cannot move, set out, or sort locally. Trains 3/4 share a one-freight-car budget for pickup or setout at each grid location. Trains 7/8 cannot set out their coach. X13 cannot pick up, and X22 may pick up empty cars only.
-
-### 4.4 New Train phase
-
-At the Stage shown on the timetable, the engine makes up the matching timetabled train if a Crew Tray is free. It starts at the Division Point appropriate to its direction. A train may receive matching loaded or empty cars from the Division Yard until its listed maximum consist is reached or no suitable car remains. It is permitted to leave under-strength.
-
-A Second Section order on the due train creates another identical timetabled train behind it when a free tray is available. A played Extra is made up after timetabled trains and Second Sections when a tray is free; v0.4.5 automatically sends every Extra east from the Western Division Point.
-
-### 4.5 Mainline movement and Office arrival
-
-Mainline movement is automatic and processes lower train numbers first; a timetabled train outranks an Extra with the same number. A train at a Division Point, at an Office A/D track, or already crossing a Mainline card attempts its applicable movement.
-
-Crossing time comes from the Mainline card and train speed. On a normal card, a train must check the entire next Subdivision before entering it:
-
-- an opposing train normally blocks entry;
-- a following same-direction train asks the Superintendent to allow or deny clearance;
-- Red Flags or ABS Signals hold the follower automatically; and
-- passing cards allow entry without this occupancy check.
-
-An Office arrival normally takes a free A/D track. If the Office is full, the inbound train collides and the local Office player loses 5 Revenue; Interlocking instead holds it at the Limits. A coachless inbound train may divert to a Yard Office. Cars fouling the Running Track at the Office also cause a collision.
-
-An expedited train remains available for this Stage’s Load/Unload work after arriving, then attempts to depart at Shift Change. A non-expedited arrival waits until a later Mainline phase. A train departing an Office must be correctly made up: engine at one end, caboose at the far end if present.
-
-When a train leaves the far Division Point, its cars are returned to yards, its Crew Tray becomes free, and each player receives the configured train-transit Revenue (zero by default).
-
-### 4.6 Passenger work
-
-Passenger work occurs during Load/Unload, at a Depot, Station, or Terminal. Each Porter may take one action per Stage.
-
-- **Board:** replace an empty coach on an eligible train at the Office with a loaded coach from a green outbound box. The removed empty coach goes to the Classification Yard. Earn configured passenger Revenue.
-- **Detrain:** replace a loaded coach on an eligible train with an empty coach from the Division Yard, placing the loaded coach into an available red inbound box. Earn configured passenger Revenue.
-
-Crack Limited trains permit passenger work at Terminals only. Military Train and Director’s Private Car permit no passenger work. A Whistle Post has no Porters.
-
-### 4.7 Freight work
-
-Freight work also occurs during Load/Unload. Each Laborer can take one action per Stage. Every freight facility has MEN, AT, and WORK boxes.
-
-For an **outbound load**, first use the Freight Agent to put a matching loaded car into the green box, with an unclaimed empty matching car spotted on the industry track. A Laborer starts the load on MEN, then advances it to AT, then WORK, then onto the empty car. Completing the last step changes that car to loaded, sends the replaced empty car to the Classification Yard, and earns configured freight Revenue.
-
-For an **inbound unload**, a matching loaded car must be spotted at an inbound-capable industry and the Division Yard must contain a matching empty car. A Laborer replaces the spotted loaded car with that empty car and starts the load on WORK. Laborers move it backward through AT and MEN into a free red inbound box. That final placement earns configured freight Revenue. Clearing the red box later with the Freight Agent pays no additional Revenue.
-
-## 5. Solitaire
-
-The implemented game is solitaire: one named player, one Office Area, local browser execution, Standard length, highest-after-days victory, and the default house rules unless changed in New Game. The game has no AI opponent. “Multiplayer” gameplay does not occur locally by simulating other players.
-
-Solitaire-specific features are:
-
-- a local browser save, automatic resume, and JSON download/load;
-- unlimited step-by-step Undo back through accepted action history; and
-- a seed/rules URL suitable for sharing or reproducing a game.
-
-The active deck removes all 22 opponent-directed cards. Therefore, the defensive cards whose only purpose is to answer them (Facing Point Locks and Water Column) can be placed but have no opportunity to fire; Overpass has no effect at all. The game still includes shared-rail mechanics such as Mainline clearance, but with one player no other player can occupy the Division.
-
-To win the default game, finish Day 5 with at least 20 Revenue. A result below 20 is a loss. Train-transit Revenue defaults to zero, so the default score must principally come from passenger and freight work.
-
-## 6. Multiplayer
-
-### 6.1 What the engine supports
-
-The engine has player, seat, score, Office Area, Director/Division, phase-order, co-op, and competitive-mode data for multiple named players. It deals each player a hand, creates one Office Area per seat, starts acting order at the Superintendent and proceeds left, and models the following multiplayer-specific outcomes:
-
-- the D12 seating and Superintendent rolls described in section 3;
-- individual Revenue in competitive play and shared total Revenue in co-op;
-- a competitive collective loss after three collisions in one Day;
-- a collective Revenue floor for competitive highest-after-days games; and
-- train-transit Revenue awarded to every player, if that revenue setting is nonzero.
-
-The engine’s setup checks only that there is at least one player and that Solitaire has exactly one player. It does not enforce a maximum player count, although the test and design material exercise two through four players.
-
-### 6.2 What is not delivered in v0.4.5
-
-There is no implemented multiplayer game setup for end users: no server, lobby, invitation, room code, player join flow, authoritative remote state, or remote Session. The browser page creates a local single-player session only. Accordingly, there is no supported procedure for resuming a multiplayer game, and no multiplayer Undo.
-
-The 12 space-use cards and 10 action cards are not dealt in competitive or co-op either. The engine rejects attempts to play either category. Thus, **no card can currently be played on another player**. This includes Derail, Broken Coupler, Railroad Crossing, score-penalty cards, Vandalism, Hotbox, Outlawed, and all table-space cards. Facing Point Locks and Water Column are implemented only as dormant defences for these unavailable effects.
-
-### 6.3 Difference from solitaire, if a multi-player engine session is created
-
-Players have separate local districts, hands, and scores, but they share the Home Office deck, Department piles, yards, timetable, Mainline, and traffic consequences. Turn order is sequential; one current actor acts at a time. The Superintendent role is attached to a player while Offices are attached to fixed seats. Employee Rotation is not active, so players do not actually change seats in v0.4.5.
-
-The deck is still 213 cards and still excludes opponent-directed content. Therefore multi-player engine mode changes shared traffic, scores, turns, and win/loss evaluation—not card attacks or a remote user experience.
-
-## 7. Frequently asked questions
-
-### Is the same seed always the same game?
-
-Only with the same house rules, player configuration/order, and action history. The seed drives all engine randomness, but the starting hand and Revenue settings also change the game.
-
-### Why can’t I end my draw turn?
-
-Your hand exceeds three cards, or four when the Red Flags hand-limit status is active. Play or discard down to the limit.
-
-### Why can’t my train move onto a turnout?
-
-It may move through a turnout but cannot end a Move there because turnouts are not Operational Rail.
-
-### Why can’t a train enter my industry?
-
-Its MEN | AT | WORK pipeline contains a load, which locks the track; the rail geometry does not connect; another train occupies it; mandatory coupling would exceed four cars; or four cars are already standing there, which is as many as any card holds.
-
-### Why won’t an industry accept a new outbound load?
-
-The green box may be full, the Division Yard may lack a matching loaded car, or there is no unclaimed empty matching car already spotted on that industry’s track.
-
-### Why does an inbound freight unload require an empty car in the Division Yard?
-
-The engine immediately replaces the spotted loaded car with a matching empty car. It will not create a new car from nothing.
-
-### Why did an arriving train collide instead of wait?
-
-The Office had no free A/D track and no Interlocking. A full Office is an automatic local collision. An Interlocking holds the arrival at the Limits.
-
-### Why is a train held at an Office even though the Mainline is clear?
-
-It may be on Secondary Track rather than the Office, or be badly made up: its engine is between cars or its caboose is not at the far end.
-
-### Why did an expedited train leave after passenger/freight work?
-
-Expedite means it departs in the Stage it arrived, but v0.4.5 waits until Shift Change so it remains present for that Stage’s Load/Unload phase.
-
-### Can I choose the direction of an Extra or a Heavy Grade?
-
-Not in v0.4.5. The engine launches Extras eastbound from the Western Division Point. Heavy Grade orientation is seeded automatically at setup.
-
-### Can I use an Interchange to reorder a train?
-
-No. The card is catalogued with a sorting concept, but there is no implemented Interchange sorting action. Small Yard is the available local sorting mechanism.
-
-### Can I play attack cards on another player?
-
-No. All action and space-use cards are excluded from every dealt deck in v0.4.5 and their play is rejected.
-
-### Is multiplayer playable?
-
-No. Multi-player state and rules-engine support exist, but the lobby, server, remote client, and opponent-directed card mechanics are not implemented.

docs/architecture/game-state.md

@@ -328,8 +328,10 @@ Outcome
 
 Termination checks, in the order they must be evaluated:
 
-1. **Collision floor** (Competitive only) — `collisionsToday >= 3` ends the game immediately, all
-   players lose (§3.4). Checked the moment a collision resolves, not at end of Stage.
+1. **Collision floor** (every mode) — `collisionsToday >= maxCollisionsPerDay` or
+   `collisionsTotal >= maxCollisionsTotal` ends the game, all players lose (§3.4). Judged at the
+   Shift Change that closes the Stage, on the Stage just played and before the Day rolls over — so
+   Load/Unload still scores in the Stage of the breach, and a breach in Stage 12 counts.
 2. **Target reached** (firstToTarget) — checked whenever Revenue increases.
 3. **Days elapsed** (highestAfterDays) — at the end of the final Day, apply the collective Revenue
    floor `3 × players × Days` for Competitive (§3.5), or the mode target for Solitaire and Co-op

docs/architecture/lobby-and-sessions.md

@@ -36,6 +36,34 @@ and `<ip>:<port>` are both expected — and browser storage is scoped to the ori
 at one address must come back to that address, or they are a stranger with no token. Say so in the
 UI at join time rather than letting someone discover it when they cannot get back in.
 
+**A lost token is recoverable, administratively** (Gitea#33). Everything above makes the token the
+single point of failure: it lives in one browser's storage, and a cleared profile, a private window or
+a different browser ends the seat with the game still running and the session still on disk. Seen at a
+real table — the returning player met an empty lobby while their token sat intact in `sessions.json`,
+and the only way back was an administrator reading the file off the volume and the player pasting it
+into a devtools console.
+
+So there is a supported path, in two halves that are gated differently on purpose:
+
+```
+POST /api/games/<id>/claim  { player }   →  { code, expiresAt, … }   admin secret
+POST /api/claim             { code }     →  { token, gameId, player, gameCode }
+```
+
+**The link carries the code, never the token** — which is the rule three paragraphs up, applied. A
+recovery link is exactly the sort of thing that gets pasted into a chat, so what travels in the URL is
+single-use and expires in thirty minutes (`server/claims.ts`), and the page trades it for the real
+token over a POST as it loads (`?claim=` in `web/main.ts`, which strips it from the address bar either
+way). A leaked code is worthless once spent; a leaked token is the seat for the rest of the game.
+
+**Minting is administrative; spending is not.** Deciding that a particular person has lost a
+particular seat is a judgement no route can make safely — anyone able to mint their own code could
+take any chair at the table. Spending needs no secret because the player following the link is the one
+person in the story who holds none; the code *is* the authorisation, and it is the same shape
+(unguessable, one-time) as the token it hands back. The codes are held in memory: they are minted on
+demand and spent within minutes, so a restart dropping them is the right failure, and persisting them
+would put a credential-equivalent on the volume to solve a problem measured in seconds.
+
 Real accounts can be layered on later without touching the rules engine, which is exactly why
 [`overview.md`](overview.md) keeps that boundary sharp.
 
@@ -44,8 +72,10 @@ Real accounts can be layered on later without touching the rules engine, which i
 ## 2. Creating and joining
 
 ```
-Lobby.Create { secret, config }            →  { gameId, gameCode, token }
-Lobby.Join   { secret, gameCode, displayName }  →  { token, player }
+Lobby.Create  { secret, config, displayName, players, seed }  →  { gameId, gameCode, token, player }
+Lobby.Preview { secret, gameCode }                            →  { gameCode, hostName, config, players, seated }
+Lobby.Join    { secret, gameCode, displayName }               →  { gameId, gameCode, token, player }
+Lobby.Leave   { token, seat? }                                →  { ok, closed? }
 ```
 
 **These four messages are the one family with no types behind them**, because the engine has no
@@ -60,7 +90,30 @@ per-origin, alongside the token.
 
 A **game code** — short, human-speakable, e.g. `RAIL-4471` — is the discovery mechanism *inside* the
 door. No matchmaking, no browsing, no public game list. Players are already talking to each other; the
-code just needs to survive being read aloud.
+code just needs to survive being read aloud. The seating screen also offers it as an invite **link**
+(`…/play.html?lobby&code=RAIL-4471`), which is what a chat message wants — the link carries the code
+and never the join secret, because the secret is the door key and travels out of band by design.
+
+**A player reads the rules before taking a chair.** `Lobby.Preview` answers the same join secret with
+the whole config, the host's name and who is seated, and takes no seat — added 2026-08-23, when the
+alternative was sitting down blind and (until the same pass) having no way back out. **It never
+carries the seed**: the seed decides every shuffle and every roll in the game, so it belongs to the
+host alone.
+
+**Two players may not share a display name.** The name labels the district on the Division map, it is
+what the turn chart means by "waiting on Jesse", and `record()` puts it in front of every line that
+player causes — so two of them make all three ambiguous, and the names lock at `Lobby.Start`. A
+clashing join is refused (`NAME_TAKEN`, compared trimmed and case-insensitively) rather than silently
+suffixed: a player should play under the name they chose, or be asked for another.
+
+**Anybody may leave, and the host may clear a chair.** `Lobby.Leave` frees the seat, drops the token
+from `joinOrder`, **revokes it** — in memory and in `sessions.json`, since v0.8.4; until then the
+leaver's token still opened the seat the next arrival took — and passes host rights on exactly as a
+dropped connection does. Naming somebody
+else's `seat` is host-only. When the last human leaves, the lobby is deleted outright — code, file and
+index row — rather than left as a table of bots waiting for a host who no longer exists. Before this
+existed a mis-join or a player who wandered off wedged the whole table, since Start needs every chair
+filled and a bot may not be dropped onto an occupied seat.
 
 **One game at a time per person is expected usage and is deliberately not enforced** (`multiplayer.md`
 §10). Enforcing it needs cross-game state whose only job is deciding when to release someone, and
@@ -88,15 +141,27 @@ The cap is about what has been played, not about what the game can do.
 
 ## 3. Configuration, and when it locks
 
-Set before start, immutable after:
+Set before start, immutable after — the whole of `GameConfig` (`state.ts`), which the host fills in
+by choosing a **game type** and then editing whatever they like:
 
 ```
-mode          : solitaire | competitive | coop
-victory       : firstToTarget | highestAfterDays
-length        : short | standard | campaign
-optionalRules : { reducedVisibility, sisterTrains, employeeRotation, emergencyToolbox }
+mode              : solitaire | competitive | coop
+days              : how long the game runs
+minCombinedRevenue, maxCollisionsPerDay, maxCollisionsTotal   (0 = that condition is off)
+pvpCardsAllowed   : a property of the type, not a control — the cards are unbuilt (setup.ts)
+optionalRules     : { reducedVisibility, employeeRotation, emergencyToolbox }
+houseRules        : { startingHand, extraStart, revenue }
 ```
 
+**The four game types** (`src/web/presets.ts`, Jesse's design 2026-08-23) are Co-op, Competitive,
+Cutthroat and Solitaire, plus **Custom** — which is not a fifth type but the state of having edited
+one, and is scored as whichever type it was edited away from. The type is *derived* by comparing a
+config against the four, never stored, so a saved game carries no label that can disagree with its own
+numbers. Seed, player count and Day count sit ABOVE the type on both screens as **parameters**: the
+types are formulas in the table size and the length (the Revenue floor is 3 per player per Day in
+Co-op, 2 in Competitive, nothing in Cutthroat), so changing one re-derives rather than making the game
+Custom.
+
 These must lock at `Lobby.Start`. Changing `length` mid-game would move the finish line; changing
 `mode` would switch which failure floors apply (§3.4, §3.5). Neither has a coherent meaning
 mid-game, so the server should refuse rather than try.
@@ -141,6 +206,12 @@ to hide it. Show the chain forming.
 **Solitaire is unchanged and must stay so:** one player is one seat, seating is trivially `[0]`, and
 every published replay depends on that.
 
+**What a seat is told as the game begins** (2026-08-23). The board used to simply appear, mid-Local
+Operations, with a log already several bot turns deep and nothing marking where the game began. The
+page now holds a deliberate beat on a handoff curtain, announces the game and its type, marks the top
+of the log, and shows the code and the type in the header for the rest of the game — none of which is
+new *data*, only the first time any of it was drawn.
+
 **Employee Rotation** (Appendix B), if enabled, moves every player one seat left at the end of each
 Day, carrying their Revenue and the Fedora with them. **The model supports this as of v0.4.0**:
 offices and districts are keyed by seat, hands and Revenue and the Fedora by player, and `seating[]`
@@ -163,6 +234,16 @@ if it was their turn. Broadcast a disconnect notice so everyone else can see why
 server-layer news about a *connection*, not about the game, so it belongs with the transport rather
 than in `GameEvent`, which must stay replayable from a seed.
 
+**On connect, a client is told about every other seat at once** (2026-08-23). A change notice alone
+answered "who just left", never "who is here" — so a player arriving at a table where two people had
+not opened the game yet was told nothing about them at all, which is precisely the question at the
+moment a game starts. Each entry carries `seen`, separating **was here and dropped** from **has never
+opened the game**: the first will probably be back, the second needs somebody to send them the link.
+`seen` is remembered only for as long as the process runs, so after a restart every absent seat reads
+as "not here yet" — the more cautious of the two. **Bot seats are never reported**: a bot holds no
+connection and never will, and listing one puts "waiting on Bot 1" on every screen for the whole game
+(found by playing a three-seat game, not by reading the code).
+
 **On reconnect:** the client presents its token and the server replies with a **full current view**.
 Not an event tail — a returning client needs the position, not the history of how it got there, and
 the server can always produce the position because it holds the game

docs/architecture/protocol.md

@@ -103,6 +103,17 @@ Two consequences worth knowing before adding an event:
 - **Events are not what goes over the wire.** The server applies the intent and pushes the resulting
   `Frame` (`multiplayer.md` D2/D3). Events are narration and cues, not the protocol — and a reconnect
   gets a fresh `Frame` rather than the tail it missed.
+- **What events EARN does go over the wire, as four transient signals** (2026-08-23): the sound cues,
+  the timetable slot a D12 just filled, a one-line announcement, and the id of the card that just came
+  into this seat's hand. They ride beside the `Frame` rather than on it because they mark a *moment*
+  and are consumed — putting them on the Frame would re-fire them on every redraw. Before this a
+  remote client got none of them, so multiplayer had no sound at all, no flash and no announcements
+  while solitaire had all three. The first three are shared and identical in every seat's push; the
+  fourth is **not** — `game.justDrawn` is one field for the whole game and does not say whose card it
+  is, so the server remembers who drew and sends it to that seat alone
+  (`test/server/session.test.ts`, "the four transient signals"). A reconnect gets none of the shared
+  three: a fresh connection is drawing a state, and replaying the sounds of everything it missed is a
+  burst of noise about the past.
 
 ---
 
@@ -140,8 +151,14 @@ multiplayer work: everything else degrades gracefully, a redaction bug hands a p
 - Events carry a monotonic sequence per game. Clients apply strictly in order and request a replay on
   a gap rather than guessing.
 - Intents carry a client `seq`. The server ignores a repeat of one it has already applied, so a
-  reconnecting client can safely resend anything it is unsure about.
+  reconnecting client can safely resend anything it is unsure about. **The count is the server's,
+  for the life of the game**: the connect push carries the seat's last accepted `seq` (`lastSeq`)
+  and the client continues from it, never from 1 — a page that restarted its own count after a
+  reload re-sent a number the server had already applied, and the move was silently swallowed as
+  a resend (v0.8.4).
 - **The server never applies two intents concurrently within a game.** A per-game queue is sufficient
-  and there is nothing cleverer to do at this scale. Note this is a serialisation rule, not a
+  and there is nothing cleverer to do at this scale. It is a real queue (`http.ts`'s `inTurn`), not a
+  reliance on the single thread: the handler awaits the disk write between applying and answering,
+  and two moves arriving together used to interleave across that await (v0.8.4). Note this is a serialisation rule, not a
   one-actor-at-a-time rule: per-player turn state (`turns: Map<PlayerIndex, TurnState>`) means several
   players may hold an open turn at once, and their intents still land one at a time.

docs/components.md

@@ -0,0 +1,118 @@
+# Station Master — Components and Markers
+
+**Version 0.8.4** · 2026-09-29
+
+**Scope:** non-card physical components and supplies. Card-created facilities, workers, deck piles,
+hand state, timetable state and other markers are documented with their cards or in the
+[rules book](rules.md).
+
+The figures below are checked against `ROLLING_STOCK_SUPPLY` and the supply constants in
+`src/engine/content.ts`. They are physical inventory rather than deck tuning, which is why they are
+printed here at all — per-category CARD counts are not published, because they move with play balance.
+
+## Rolling stock
+
+Rolling stock has a type and a load state. In the interface, coloured cars are loaded and white cars are empty. The Division Yard starts with the following supply.
+
+| Type | Loaded | Empty | Total | Use |
+| --- | ---: | ---: | ---: | --- |
+| Coach | 8 | 8 | 16 | Passenger work. |
+| Boxcar | 10 | 10 | 20 | Freight House outbound/inbound; Grocer’s Warehouse inbound. |
+| Hopper | 8 | 8 | 16 | Mine Tipple outbound; Power Plant inbound. |
+| Reefer | 5 | 5 | 10 | Packing Sheds outbound; Grocer’s Warehouse inbound. |
+| Tank car | 6 | 6 | 12 | Refinery outbound; Power Plant inbound. |
+| Caboose | 6 | 0 | 6 | Required or permitted at the rear of the applicable train cards. |
+| **Total** | **43** | **35** | **78** | |
+
+The engine is not rolling stock and does not count against the four-car Crew Tray limit.
+
+## Other supplies
+
+| Component | Count | Note |
+| --- | ---: | --- |
+| Crew Trays | players + 3 | Engine and tray are one combined resource; there is no "engine without a tray". |
+| Office cards | 4 | Every player starts on one. The starting Office is not drawn from the deck. |
+| Limits signs | 8 | "2N + spares", so relocating one is never a supply question. |
+
+## The two yards
+
+### Division Yard
+
+The Division Yard is the active supply. It provides:
+
+- loaded cars to a Freight Agent stocking a green outbound box;
+- empty cars for building up trains;
+- an empty coach when passengers detrain; and
+- an empty matching freight car when a loaded freight car begins unloading.
+
+When a train completes a run or is destroyed, its caboose returns to the Division Yard. When a car is taken from the Division Yard and that yard has become entirely empty, every car from the Classification Yard moves back into the Division Yard immediately.
+
+### Classification Yard
+
+The Classification Yard collects used rolling stock: cars displaced by boarding passengers, cars
+cleared from inbound red boxes, cars removed by unjamming a facility, ordinary cars from completed
+or destroyed trains, and empty cars replaced by a completed outbound freight load. It is not a
+player-selectable source. It returns to service only when the Division Yard is empty.
+
+> **This is a one-way ratchet for COACHES, and it decides games.** Boarding sends an emptied coach
+> here; detraining takes a fresh empty out of the *Division* Yard. Nothing returns a coach to the
+> Division Yard except the bare-yard refill — and a yard kept topped up with freight cars returning
+> from industries may never run bare. Measured over one three-Day game, every coach was here by the
+> middle of Day 2 and stayed. See [Rules](rules.md) §4.6.
+
+## Crew Trays and trains
+
+Crew Trays represent an engine and its coupled consist. The game creates **players + 3** free trays at setup. A tray is scarce: a due train without a free tray is held for that Stage, and Extras wait until one becomes free.
+
+Within a tray, the engine can pull, push, or be between cars while switching. To depart an Office for the Mainline, it must be made up with the engine at an outer end; if it has a caboose, the caboose must be at the opposite outer end. A train may have at most four cars. A scheduled train can run under-strength but never with more than its card allows.
+
+## Fedora
+
+The **Fedora** is the physical marker for the Superintendent. The player with it resolves
+following-train clearance decisions, takes the Yard Office and Red Flag questions, and is the player
+every round round the table starts with. A Mainline collision is their fault by §10, and costs 5
+Revenue. The initial holder is the first player tied for the highest Superintendent setup D12 roll.
+
+It passes at the end of Stages 3, 6, 9 and 12 — every third Stage, at the Supervisor Shift. The
+handover is **announced on screen and written into the history**: it is the one thing in the game
+that changes hands on the clock rather than because somebody did something, so nobody is watching
+for it. Note that the Supervisor Shift refreshes every Laborer and Porter *every* Stage
+while the Fedora moves only every third.
+
+## D12 and seeded randomness
+
+The D12 is used by the engine for:
+
+- the initial seating roll in a multi-player engine game;
+- the initial Superintendent roll;
+- a timetabled train’s timetable slot; and
+- all shuffled deck order and automatic setup selection through the same seeded random stream.
+
+The rules engine uses a deterministic 32-bit seeded random generator. The same numeric seed, player configuration, house rules, and accepted intent sequence reconstruct the same game. A seed by itself is not enough when house rules differ.
+
+## The Office, tier by tier
+
+Every player has one Office card. It is a property of the district rather than a card that is
+swapped, so an upgrade raises the numbers in place and leaves anything built beside it alone.
+
+| Office | A/D tracks | Porters | Passengers out / in | Control Point |
+| --- | ---: | ---: | --- | :---: |
+| Whistle Post | 1 | 0 | 0 / 0 | — |
+| Depot | 2 | 1 | 1 / 1 | yes |
+| Station | 3 | 2 | 2 / 2 | yes |
+| Terminal | 4 | 3 | 3 / 3 | yes |
+
+**A/D tracks are what decide whether an arrival is a collision.** A train pulling in to an Office
+with every track occupied collides (§8.3) unless an **Interlocking** holds it out on the Limit
+Track. A train held that way takes the first track to free, ahead of anything arriving after it.
+
+**A Whistle Post is not a Passenger Facility.** It has no Porters and no passenger boxes, so nobody
+boards or gets off there however well the district is built, and the passenger Modifiers — Waiting
+Area, Restaurant, Hotel — cannot be played at one.
+
+**A Control Point divides the Mainline into Subdivisions**, which is what §8.1 reasons about. A
+table of Whistle Posts is one Subdivision from end to end; every upgrade splits one in two and buys
+the Division capacity.
+
+**Games open on a Depot** unless the table turns on "Players start with Whistle Posts, not Depots"
+when the game is created. See the Home deck reference.

docs/design.md

@@ -20,13 +20,31 @@ These stay as-is. Everything below is derived from them.
 > placeholder for exactly this material, and the balance measurements in Gap 12 were taken against a
 > ruleset that does not match the design.
 
+## For players and testers
+
+Written to be handed to somebody who is about to play, rather than to somebody building the game.
+
+| Document | What it is |
+| --- | --- |
+| [`quickstart.md`](quickstart.md) | **Start here if you have never played.** The point of the game, how a Stage runs, what is on screen, how you win, a first twenty minutes, and what to report. |
+| [`rules.md`](rules.md) | **The rules in full**, as the engine actually runs them, with a FAQ. |
+| [`home-deck.md`](home-deck.md) | How the Home Office deck is dealt, drawn and played out. |
+| [`mainline-deck.md`](mainline-deck.md) | The Mainline cards, how the deck is dealt, and what a card does to a train crossing it. |
+| [`components.md`](components.md) | Rolling stock, the two yards, Crew Trays, the Fedora, the D12. |
+
+**None of these carry a version in the filename**, and that is deliberate (Jesse, 2026-09-21): they
+are kept current with every release rather than published as editions, so the name is always the
+latest and each says at the top which build it describes. Four of them were stamped `v0.4.5` until
+v0.8.0.17 — the prototype rules edition they were first written against, never the version they
+described — which read as though they documented a build five minor versions old.
+
 ## Rules
 
 | Document | What it is |
 | --- | --- |
 | [`rules/rules-v0.1.md`](rules/rules-v0.1.md) | Faithful markdown transcription of the PDFs. No corrections. The baseline everything diffs against. |
 | [`rules/rules-v0.2.md`](rules/rules-v0.2.md) | **The working ruleset.** v0.1 with all ten gaps resolved, each change marked with its gap number. |
-| [`rules/card-reference.md`](rules/card-reference.md) | What is printed on every card, plus the economy summary. The spec an engine or a print-and-play layout consumes. |
+| [`rules/card-reference.md`](rules/card-reference.md) | **⚠ SUPERSEDED** — an invented 52-card placeholder, kept for its economy summary and its history. For what is printed on every card, read the generated tables in [`home-deck.md`](home-deck.md) and [`mainline-deck.md`](mainline-deck.md). |
 | [`rules/glossary.md`](rules/glossary.md) | Every defined term, alphabetized. |
 | [`rules/open-questions.md`](rules/open-questions.md) | All thirteen gaps, each with the options considered, the decision, and the rationale. |
 | [`rules/implications.md`](rules/implications.md) | **Read this first.** What the four recovered design files (`Deck cards2.xlsx`, `Mainline Cards.pdf`, `Trains3.pdf`, `tracks.png`) change — and which decisions they supersede. |
@@ -49,23 +67,20 @@ must do.
 
 ## Current status
 
-**v0.4.3.** Rules formalized, card faces specified, architecture documented, and the game playable
-solitaire in a browser. See [`../CHANGELOG.md`](../CHANGELOG.md) for what each version changed and
-[`../TODO.md`](../TODO.md) for what is open; this section is the shape of the project, not a
-running tally, because a hand-maintained tally is what drifted last time.
+**v0.8.2.** Rules formalized, card faces specified, architecture documented, and the game
+playable **solitaire and multiplayer** in a browser against an authoritative server. See
+[`../CHANGELOG.md`](../CHANGELOG.md) for what each version changed and [`../TODO.md`](../TODO.md) for
+what is open; this section is the shape of the project, not a running tally, because a
+hand-maintained tally is what drifted last time.
 
-**What is built.** The rules engine, the developer bot, the balance harness, the replay viewer and
-the playable page — components 1–7, 17 and 18 of
-[`architecture/components.md`](architecture/components.md). A game can be saved, shared, replayed and
-stepped back through. **493 tests.**
+**What is built.** The rules engine, the developer bot, the balance harness, the replay viewer, the
+playable page — and the server: lobby, game codes, seating, bots, per-seat reconnection, persistence
+by replaying the intent history, and an ordered replay of other players' turns on each player's own
+screen. It ships as a StartOS package. **999 fast tests and 35 simulation tests.**
 
-**What is not.** The server. Phases 0 and 1 of
-[`architecture/multiplayer.md`](architecture/multiplayer.md) landed in v0.4.0 — seat and player are
-separate, turn state is per player, and the page talks to a `Session` rather than to the engine, so a
-`RemoteSession` drops in without the page changing. Phase 2 onward is **deliberately held** until the
-two provisional rules introduced in v0.3.0 have been played at a table: changing a rule after the wire
-format is live costs far more than changing it before. Also unbuilt: the 22 opponent-directed cards
-and real audio.
+**What is not.** The 22 opponent-directed cards — the Action and Space-use categories — are held out
+of every dealt deck until they have an implementation, along with the two defensive cards whose only
+purpose is to answer them. Real audio: everything the game plays is synthesised from oscillators.
 
 **Balance is not where it should be, and no conclusion should be read from the revenue numbers yet.**
 The rebalance pass is deliberately deferred until the rules stop moving — card counts, industry counts
@@ -85,17 +100,18 @@ on that. [`architecture/protocol.md`](architecture/protocol.md) §3 has the reas
 `test/events.test.ts` pins it.
 
 **The economy, in one line:** Local Operations actions are the main currency — one per Stage, twelve
-per Day — but **inbound work bypasses them**, which is where the game's variance comes from. See
-`card-reference.md` §7.
+per Day — but **inbound work bypasses them**, which is where the game's variance comes from.
 
 **Stack: TypeScript**, chosen so the engine runs in both the server and the browser — one
 implementation of the movement rules, and instant affordances without a round-trip. Node 22 runs
 TypeScript natively, so there is no build step during development, which also means **erasable syntax
 only**: no `enum`, no parameter properties, no namespaces.
 
-Running alongside, and independent of all of it: **print-and-play components.** `card-reference.md`
-specifies every card face, so layout and art are the only remaining work before a table playtest —
-which answers the one question simulation cannot, whether it is fun.
+Running alongside, and independent of all of it: **print-and-play components.**
+The generated tables in [`home-deck.md`](home-deck.md) and [`mainline-deck.md`](mainline-deck.md)
+carry every card face as the game actually deals it, so layout and art are the only remaining work
+before a table playtest — which answers the one question
+simulation cannot, whether it is fun.
 
 Run the harness with `node src/sim/harness.ts [games] [length]`.
 

docs/home-deck.md

@@ -0,0 +1,398 @@
+# Station Master — Home Deck
+
+**Version 0.8.4** · 2026-09-29
+
+**Scope:** the Home Office deck — how it is dealt, drawn, discarded and reshuffled, and what the
+rules are for playing each kind of card out of it.
+
+> **The card tables in this document are GENERATED from `src/engine/content.ts`** and checked by a
+> test, so they cannot disagree with the game. `npm run build:cards` rebuilds them; do not edit a
+> table by hand. The prose around them is how the deck WORKS; the tables are what is in it.
+>
+> **Card counts are not published.** Counts move with play balance, so a printed count answers a
+> question that has a different answer
+> after the next retune. Where a count matters it is rendered as a yes/no — whether the deck deals
+> the card at all — which is a fact about the design.
+
+## The piles
+
+- **Home Office deck** — face down. The pile a Draw comes from.
+- **Three Departments** — face-up discard piles. A discard goes onto one, which is precisely so a
+  rival may take it; a Draw may take the top card of a Department instead of the deck. **Taking the
+  last card off a Department refills it immediately** from the Home Office deck (§6.2), so there
+  are always three piles to choose from; see the Rules.
+- **Salvage Yard** — where a played-out card ends up. An Extra's card goes here after its run.
+
+When the Home Office deck runs out it is rebuilt from the Salvage Yard and **all three Departments
+in full**, reshuffled from the seeded stream. A **spent timetabled train** is not collected — its
+number is on the timetable and it cannot run twice — but a *discarded* train was never played and
+is still runnable, so it comes back.
+
+## Hand and turn
+
+The hand limit is **three**, or four while you hold a Red Flag. You may not end a turn over the
+limit: play a card or discard one to a Department. Some cards cannot be discarded at all — an Extra
+never can, and a timetabled train cannot when the `discardTimetabled` house rule is off — so a hand
+of nothing but those has exactly one way forward, which is to play one.
+
+The opening deal is a house-rule choice made when the game is dealt. The default (`threeRandom`) is
+three cards from one shuffled deck; `threeTrackThreeOther` deals three track and three others from
+two separately shuffled piles, over the hand limit, so the first turn is spent choosing
+which district you can afford to build.
+
+Drawing is one of the three Local Operations options — see [Rules](rules.md)
+§4.2. Taking the option lets you draw **and** play or discard within the same turn.
+
+## Track cards
+
+Track cards are ordinary Home Office cards, not a separate personal supply.
+
+- A placed card must **connect to existing rail**: at least one neighbour must join it.
+- The **Running Track** is the row from Limit to Limit. A card placed there must carry an east–west
+  through route, or it breaks the main.
+- Placing track **on a Limit sign** extends the Running Track and moves that sign outward. The sign
+  is a physical card, so it moves rather than being left stranded mid-track.
+- **Nothing may be placed outside your Limits** — track, industries and Modifiers alike. Your
+  district ends at its sign.
+- Curves and turnouts are printed left- or right-handed. A card may be turned 180° but never flipped
+  over, so its 45° leg never changes diagonal.
+- A **turnout may upgrade** an existing straight, or a curve whose arc is exactly the turnout's
+  diverging arc. An **industry may be built over a straight** off the Running Track, on the same
+  principle. Neither is allowed if the card holds standing cars or an Enhancement, and every other
+  occupied square is unavailable.
+- A turnout may be **run through but not stopped on**: it is not Operational Rail, so a Move may not
+  end there.
+
+<!-- BEGIN CARDS: track -->
+| Track | Geometry | Hand | Operational rail | Move cost | Dealt |
+| --- | --- | --- | :---: | ---: | :---: |
+| Straight track | straight | none | yes | 1 | yes |
+| Curved track (right) | curved | right | yes | 1 | yes |
+| Curved track (left) | curved | left | yes | 1 | yes |
+| Sharp Curved Track (right) | sharpCurved | right | yes | 2 | no |
+| Sharp Curved Track (left) | sharpCurved | left | yes | 2 | no |
+| Turnout (right) | turnout | right | — | 1 | yes |
+| Turnout (left) | turnout | left | — | 1 | yes |
+
+A row marked "no" is a shape the engine understands but the deck does not currently print.
+<!-- END CARDS: track -->
+
+## Office cards
+
+Every player begins at a **Whistle Post**, which is not drawn from the deck: one A/D track, no
+Porters, no passenger slots, and not a Control Point.
+
+Office cards are **upgrades in strict sequence** — Whistle Post → Depot → Station → Terminal — and
+each upgrades the Office in place rather than replacing its card or its attached track. Modifiers
+already beside it are preserved. Each tier adds an A/D track, a Porter, and an outbound and inbound
+passenger slot; a Depot and above is a Control Point and a Passenger Facility.
+
+An upgrade takes no placement: the Office is where it already is.
+
+<!-- BEGIN CARDS: office -->
+Upgrades are strictly sequential — no skipping a tier — so a Terminal needs all three cards in
+order. Green slots are outbound passengers, red are inbound, and the design gives slots **equal**
+to Porters rather than one more.
+
+| Office | Control point | Passenger facility | A/D tracks | Porters | Green | Red |
+| --- | :---: | :---: | ---: | ---: | ---: | ---: |
+| Whistle Post | — | — | 1 | 0 | 0 | 0 |
+| Depot | yes | yes | 2 | 1 | 1 | 1 |
+| Station | yes | yes | 3 | 2 | 2 | 2 |
+| Terminal | yes | yes | 4 | 3 | 3 | 3 |
+
+Whistle Posts are a fixed supply of 4 outside the deck, and Limits signs a
+supply of 8.
+<!-- END CARDS: office -->
+
+## Freight facilities
+
+An industry is placed on a connected straight **stub off the Running Track** — never on the Running
+Track itself, and never outside the Limits. A Facility carries its own rails, so placing one places
+track.
+
+**It may also be built over a straight already laid**, in the same way a turnout may upgrade one, so
+rail can go down before the industry that will serve it. Only a plain straight may be built over: a
+Facility carries east–west track, so replacing a straight cannot break a neighbour's connection,
+while a curve or a turnout carries rails the Facility does not. The square must be clear of standing
+cars and carry no Enhancement — the replaced card leaves play.
+
+Each begins with one Laborer and a three-box **MEN | AT | WORK** pipeline. No Office Area may hold a
+duplicate industry, or both ends of a lockout pair — a producer and the consumer of the same
+commodity cannot be built in one district.
+
+**An industry track holds four cars, like any other card.** It is *not* sized by the industry's box
+count. That distinction was a real bug: box count is how much WORK an industry can hold, not how
+much RAIL it has, and conflating the two invented a printed siding no industry card carries.
+
+<!-- BEGIN CARDS: facilities -->
+Each lists the car types it works, which way its traffic flows, and the industries it may not sit
+beside. **Every lockout pair is a producer and the consumer of the same commodity** — you may
+build one end of a chain or the other, never both, which is what forces traffic to run between
+districts rather than in circles inside one. No two of the same industry may share an Office Area,
+and that rule is enforced for every kind rather than repeated in each row.
+
+| Industry | Cars | Flow | Green | Red | Laborers | Locked out with |
+| --- | --- | --- | ---: | ---: | ---: | --- |
+| Freight House | boxcar | both | 1 | 1 | 1 | Grocer's Warehouse |
+| Mine Tipple | hopper | outbound | 1 | 0 | 1 | Power Plant |
+| Refinery | tank | outbound | 1 | 0 | 1 | Power Plant |
+| Power Plant | hopper, tank | inbound | 0 | 1 | 1 | Mine Tipple, Refinery |
+| Packing Sheds | reefer | outbound | 1 | 0 | 1 | Grocer's Warehouse |
+| Grocer's Warehouse | boxcar, reefer | inbound | 0 | 1 | 1 | Packing Sheds, Freight House |
+<!-- END CARDS: facilities -->
+
+## Facility modifiers
+
+A Modifier sits on an empty square **square against its host Facility — north, south, east or
+west**. It may not go on a diagonal: touching at a corner is not touching. It must be **inside your
+Limits**, like everything else, and may not stand in the Running Track row. One of each kind per
+Office Area.
+
+**A Modifier adds a BOX, never room for a car.** A Truck Dock beside a Grocer's Warehouse gives it a
+second red box — somewhere for one more arriving load to be cleared to — and changes nothing about
+how many cars may be spotted there.
+
+**A passenger Modifier needs a Passenger Facility.** A Waiting Area, Restaurant or Hotel may not be
+played at an Office that is still a **Whistle Post** — a Whistle Post is not a Passenger Facility, so
+there is nothing for the card to add to. Upgrade the Office to a **Depot** or better first.
+
+**A grant the host cannot use does nothing**, and the game says so rather than pretending. An
+outbound bonus beside an inbound-only facility, or the Truck Dock's inbound bonus beside the
+outbound-only Packing Sheds, is discarded — the latter leaving that card with no effect at all.
+
+<!-- BEGIN CARDS: modifiers -->
+Each sits beside a host and raises one of its capacities. `office` as a host means any Passenger
+Facility — so a modifier that adds a green slot to an Office adds nothing to a Whistle Post, which
+is not one.
+
+| Modifier | Hosts | +Green | +Red | +Laborers | +Porters |
+| --- | --- | ---: | ---: | ---: | ---: |
+| Waiting area | any Passenger Facility | 1 | — | — | 1 |
+| Restaurant | any Passenger Facility | 1 | — | — | 1 |
+| Hotel | any Passenger Facility | 1 | — | — | 1 |
+| Truck dock | Freight House, Packing Sheds, Grocer's Warehouse | — | 1 | — | — |
+| Railroad Express Agency | Freight House | 1 | — | 1 | — |
+| Forklifts | Freight House, Packing Sheds | 1 | — | 1 | — |
+| Prep Plant | Mine Tipple | 1 | — | 1 | — |
+| Coal Piles | Mine Tipple | 1 | — | 1 | — |
+| Conveyor Belts | Mine Tipple | 1 | — | 1 | — |
+| Pipelines | Refinery | 1 | — | 1 | — |
+| Oil Depot | Refinery | 1 | — | 1 | — |
+| Viscosity breakers | Refinery | 1 | — | 1 | — |
+| Transmission lines | Power Plant | — | — | 1 | — |
+| Rotary Dumps | Power Plant | — | — | 1 | — |
+| Steam Turbines | Power Plant | — | — | 1 | — |
+| Ice House | Packing Sheds, Grocer's Warehouse | 1 | — | 1 | — |
+| Local small groceries | Grocer's Warehouse | — | — | 1 | — |
+<!-- END CARDS: modifiers -->
+
+## Train cards
+
+Playing a **timetabled** train rolls the seeded D12 and puts its number in the first open timetable
+slot at or after the result, wrapping around the 12-slot chart. It then runs at that Stage **every
+Day**.
+
+Playing an **Extra** queues it; it is made up when a Crew Tray comes free, and **the player who
+played the card chooses where it starts and loads it as they choose** (§7). Where it may start is a
+house rule — `divisionPointsOnly`, `ownOffice`, or `anyOffice` (the default) — and the Interchange is
+also available, because it is the one Mainline card with a yard. An Extra runs once and its card
+goes to the Salvage Yard.
+
+The listed consist is a **maximum, not a minimum**. A train may depart with fewer cars, but not with
+more, not of the wrong category, not with a car behind the caboose, and not with the engine buried
+among its own cars. A Crew Tray holds four pieces, and a caboose counts toward the four.
+
+A train made up short of what its card calls for is reported as such, with what it wanted and why
+the yard could not supply it — see Rules §4.4.
+
+**Per-train consists and printed rules are in the table under § Train cards below.** It
+carries the `empties only`, `reefers only`, `drop only` and `pick up empties only` restrictions,
+every one of which the engine enforces.
+
+<!-- BEGIN CARDS: trains -->
+### Timetabled
+
+| # | Class | Speed | Runs | Consist | Printed rules |
+| ---: | --- | --- | --- | --- | --- |
+| 1 | Crack Limited | fast | west | 2 coaches (2 pieces) | terminals only; no switching; expedite; *"Stop at Terminals only."* |
+| 2 | Crack Limited | fast | east | 2 coaches (2 pieces) | terminals only; no switching; expedite; *"Stop at Terminals only."* |
+| 3 | Express | fast | west | 2 freight (2 pieces) | one freight per location; expedite; *"May drop or pick up one freight car at every location."* |
+| 4 | Express | fast | east | 2 freight (2 pieces) | one freight per location; expedite; *"May drop or pick up one freight car at every location."* |
+| 5 | The Sparrow | fast | west | 3 coaches (3 pieces) | no switching; expedite |
+| 6 | The Sparrow | fast | east | 3 coaches (3 pieces) | no switching; expedite |
+| 7 | Local | slow | west | 1 freight + 1 coach (2 pieces) | coach stays on station track; *"Maximum one freight, one coach."* |
+| 8 | Local | slow | east | 1 freight + 1 coach (2 pieces) | coach stays on station track; *"Maximum one freight, one coach."* |
+| 9 | Heavy Freight | slow | west | 3 freight + 1 caboose (4 pieces) | — |
+| 10 | Heavy Freight | slow | east | 3 freight + 1 caboose (4 pieces) | — |
+| 11 | Drag Freight | slow | west | 2 freight + 1 caboose (3 pieces) | — |
+| 12 | Drag Freight | slow | east | 2 freight + 1 caboose (3 pieces) | — |
+
+### Extras
+
+| # | Class | Speed | Runs | Consist | Printed rules |
+| ---: | --- | --- | --- | --- | --- |
+| X13 | Appleseed Extra | slow | player's choice | 3 freight + 1 caboose (4 pieces), empties only | drop only; *"May drop MTs but not pick up anything."* |
+| X14 | Fruit Growers Express | fast | player's choice | 2 reefers + 1 caboose (3 pieces) | expedite; *"Reefers only. May pick up one extra loaded reefer."* |
+| X15 | Yard Xfer | slow | player's choice | 2 freight + 1 caboose (3 pieces) | — |
+| X16 | Light Engine Move | fast | player's choice | engine only | no switching; *"No cars at all."* |
+| X17 | Campaign Train | fast | player's choice | 1 coach (1 piece) | no switching; stop then expedite; stop earns point; must run loaded; *"One turn at station (speeches) then expedite. Earns a point per Office Area if the candidate is aboard."* |
+| X18 | Circus Train | slow | player's choice | 2 freight + 1 coach + 1 caboose (4 pieces) | no switching; stop earns point; must run loaded; *"One turn stopped in an Office Area (circus set-up) earns 1 point, once per Area, if fully loaded."* |
+| X19 | Military Train | slow | player's choice | 1 freight + 2 coaches (3 pieces) | no switching; no passenger work; expedite; must run loaded; *"Troops and materiel: runs loaded where the yard can supply it."* |
+| X20 | Director's private car | slow | player's choice | 2 freight + 1 coach (3 pieces) | no passenger work |
+| X21 | Freight Extra | slow | player's choice | 3 freight + 1 caboose (4 pieces) | — |
+| X22 | Pee-Dee | slow | player's choice | 1 caboose (1 piece) | pick up empties only; *"Per-diem train. May only pick up MTs."* |
+<!-- END CARDS: trains -->
+
+## Enhancements, Mainline modifiers and Maneuvers
+
+- **Enhancements** are played into your district and change what a square does — the **Small Yard**
+  (re-order a consist for one Move), **Interlocking**, **Yard Office** and the rest. The table below
+  marks each one `live`, `dormantSolo` or `unbuilt`, which is the part only the implementation
+  knows.
+  - **ABS Signals is the exception, and it matters.** It is dealt as an Enhancement but is **not
+    played into your district**: it goes onto a **Mainline card** — any one of them — and stops
+    trains there rear-ending each other. It takes no square and is not part of anybody's Office
+    Area. See [Mainline deck](mainline-deck.md).
+- **Mainline modifiers** are played onto a Mainline card: the Heavy Grade helpers and Realignment.
+  See [Mainline deck](mainline-deck.md).
+- **Maneuvers** are held and spent: **Red Flags** and **Flying Switch** have their own actions.
+  Poling is catalogued but its effect is recorded as "TBD in the source", so there is nothing to
+  implement.
+
+<!-- BEGIN CARDS: enhancements -->
+The column that only the implementation can fill in: **whether the printed effect actually
+resolves yet.** `live` is read during play; `dormantSolo` is implemented at the point of attack
+but the attack is an opponent-directed card held out of every deck, so nothing reaches it in a
+solitaire game; `unbuilt` means the effect is recorded and nothing reads it. A transcription
+cannot carry this column, which is the argument for generating the page rather than writing it.
+
+| Enhancement | Placement | Requires | Effect resolves |
+| --- | --- | --- | :---: |
+| Interlocking | runningTrackStraight | — | **live** |
+| Facing Point Locks | onCard | interlocking in the district | **dormantSolo** |
+| Yard Office | secondaryTrackStraight | — | **live** |
+| Small Yard | secondaryTrackStraight | — | **live** |
+| Water Column | runningTrackStraight | — | **dormantSolo** |
+| Overpass | onCard | — | **unbuilt** |
+| Telegraph | runningTrackStraight | — | **live** |
+| Telephone | onCard | telegraph on the same card | **live** |
+| Radio | onCard | telephone on the same card | **live** |
+| ABS Signals | mainlineCard | — | **live** |
+<!-- END CARDS: enhancements -->
+
+## Opponent-directed cards — not dealt
+
+The **Action** and **Space-use** categories are opponent-directed and are **excluded from every
+dealt deck**, because their play rules are not implemented. They are catalogued in
+the table below so the composition is on record, and `check` refuses to play one. This is deliberate:
+silently accepting them would make a card look playable while doing nothing.
+
+<!-- BEGIN CARDS: opponent -->
+**None of these is dealt in any deck today.** A card that can only be played at another player
+has no legal target in a solitaire game, and a defence with nothing to defend against is as dead
+a draw as the attack — so both halves are held out until the attacks are implemented. They are
+listed because they are the design, and because what a defence answers is the only record of why
+it exists.
+
+### Action cards — opponent-directed
+
+| Card | Played on | Effect | Answers |
+| --- | --- | --- | --- |
+| Derail | a moving train in the Local Phase | That train must stop for the remainder of the turn. | — |
+| Broken coupler | a moving train in the Mainline Phase | That train must stop and not move. | — |
+| Railroad crossing | any Secondary Track Straight | May not be used as a stop point for switching. May not become an Industry. | — |
+| Per Diem inventory | another player | Lose one point per 2 empty cars on Secondary Tracks. | — |
+| Demurrage charge | another player | Lose one point per 2 loaded freight cars on Secondary Tracks. | — |
+| Customer complaints | another player | Lose one point per 2 coaches in loading boxes. | — |
+| Vandalism | another player | A train passing a Hobo Jungle has a boxcar looted (converted to empty). | — |
+| Hotbox | another player | A train just arrived must set one car (chooser’s pick) onto Secondary Track until it departs. | — |
+| Outlawed | another player | A train just arrived may not depart for one turn — the crew’s hours have expired. | — |
+
+### Space-use cards — opponent-directed
+
+| Card | Played on | Effect | Answers |
+| --- | --- | --- | --- |
+| Bean house | adjacent to any straight, curve, turnout, Limit | Burns tablespace. | — |
+| Flop house | adjacent to any straight, curve, turnout | Burns tablespace. | — |
+| Watertower | adjacent to any straight, turnout on Running Track | Burns tablespace. | — |
+| Hobo Jungle | adjacent to any straight, turnout, Limit on Running Track | Burns tablespace. Vandalism can loot a boxcar passing it. | — |
+| Section House | adjacent to any straight, curve, turnout | Burns tablespace. | — |
+| City blocks | adjacent to any straight, curve, turnout, Limit | Burns tablespace. | — |
+| Engine Shops | adjacent to any straight, curve, turnout | Burns tablespace. | — |
+| Tenderloin District | adjacent to any straight, curve, turnout, Limit | Burns tablespace. | — |
+| Engineer cemetery | adjacent to any straight, curve, turnout, Limit | Burns tablespace. | — |
+
+### Maneuver cards
+
+| Card | Played on | Effect | Answers |
+| --- | --- | --- | --- |
+| Red Flags | any time | A stopped train is prevented from being hit; the approaching train is prevented from moving. | — |
+| Flying Switch | any time | Break a cut of cars away from behind the engine and roll them into an industry. | — |
+| Poling | any time | TBD in the source. | — |
+
+Mainline modifier cards, for completeness — these ARE dealt:
+
+| Card | Played on | Effect | Answers |
+| --- | --- | --- | --- |
+| Brakeman | a GRADE Mainline card | Faster passage downhill. | — |
+| Airbrakes | a GRADE Mainline card | Faster passage downhill. Brakeman must be in effect. | — |
+| Helpers | a GRADE Mainline card | Faster passage uphill. | — |
+| Realignment | a Mainline card | Convert one Mainline type to another. Not while a train is on it. | — |
+| Facing Point Locks | adjacent to Interlocking | Prevents Derail being played on you. | Derail |
+<!-- END CARDS: opponent -->
+
+## The Second Section card
+
+**Ordering a Second Section costs the card.** Played on a train that is **due out this Stage**, it
+sends a second, identical train out right behind the first. That second train needs a Crew Tray of
+its own, so there has to be one free.
+
+It is the one card that deliberately creates the **following-train** situation §8.1 makes the
+Superintendent rule on — so playing it is choosing to put that question to them.
+
+One copy in the deck, spent when it is played.
+
+## Trains that pay for stopping
+
+Two Extras pay for **standing still** rather than for running: the **Circus Train** (X18) and the
+**Campaign Train** (X17). Their card is worth nothing if it is run like an ordinary train.
+
+Three conditions, all of them required:
+
+- **Stopped.** The train spent a whole Mainline Phase without moving. Switching around inside a
+  district does not break it — what breaks it is leaving before a Mainline Phase passes.
+- **In an Office Area.** Any square in a player's district. Standing on the Mainline or at a
+  Division Point pays nothing. A **Whistle Post district counts** — the rule is about the area, not
+  the Office's tier.
+- **Fully loaded.** Every car except the caboose is carrying something. A train made up short, or
+  carrying an empty, earns nothing however long it stands.
+
+**One point per district**, and the point goes to whoever sits in the district it stopped in. A
+Circus touring three districts is paid three times; one parked in the same district all game is paid
+once. Neither train may switch, so it cannot load itself — it must be made up loaded before it goes.
+
+## The Office you start on
+
+Every district opens on a **Depot** unless the table chooses otherwise. A Depot has two A/D tracks
+and is a Passenger Facility, so passengers earn from the first Stage and a second train can stand at
+an Office without wrecking.
+
+**"Players start with Whistle Posts, not Depots"** is the harder game, set when the game is created.
+A Whistle Post has **one** A/D track and is not a Passenger Facility: no passenger earns anything
+until somebody draws and plays a Depot upgrade, and a second train arriving is a collision unless an
+Interlocking holds it at the Limits until the track frees.
+
+The deck follows the choice. Starting on Depots, the **Depot upgrade cards are left out** — an
+upgrade must be to the next tier up, so a Depot card at a table that already has Depots is a dead
+draw. Station and Terminal are still upgrades and stay in.
+
+## What a train may pick up
+
+Coupling is mandatory, so a train forbidden to pick cars up may not make the move that would pick
+them up — there is no "move but leave them". A square the rails reach but the train's card forbids
+is shown as blocked, with the rule that forbids it.
+
+**A train may always recover its own caboose.** A caboose at the far end is what makes a train
+ready to leave, so a card that says "may drop but not pick up anything" would otherwise let a train
+strand itself for good the moment it set its caboose down.

docs/mainline-deck.md

@@ -0,0 +1,165 @@
+# Station Master — Mainline Deck
+
+**Version 0.8.4** · 2026-09-29
+
+**Scope:** the tarot-sized Mainline cards placed between Offices — how the deck is dealt, what a
+card does to a train crossing it, and the Home Deck cards played onto one.
+
+> **The card table in this document is GENERATED from `src/engine/content.ts`** and checked by a
+> test, so it cannot disagree with the game. `npm run build:cards` rebuilds it; do not edit it by
+> hand. The prose explains how the deck is used; the table is the record of what is in it.
+
+## How Mainline cards work
+
+At setup the game lays one Mainline card between each neighbouring pair of Offices and one beyond
+each end Office, between it and a Division Point — so a game with *N* players uses **N + 1** cards.
+They are **dealt from a finite deck without replacement**, so no Division can hold
+two of a card printed once. The two Division Points are the fixed ends of the Division and are not
+in the deck: `buildDivision` lays them itself.
+
+A card does not belong to either neighbouring Office. It is shared Division.
+
+### Crossing time is REGIONS, not mph
+
+A card is divided into **regions**, and a train advances **one region per Stage**. Crossing time is
+therefore `regions − startRegion`, and nothing else. **The printed mph is scenery.**
+
+This is the part most likely to be remembered wrong. The printed mph does not set
+the cost and a Slow train added a Stage to *every* card. It does not. Four things move a train's
+start region and nothing else does:
+
+1. **The card's own back region.** The Uncontrolled Siding and the Interchange print a back region
+   that is not part of the road, so a train running through begins past it.
+2. **A card that prints a Fast and a Slow start — and only Hilly does.** A fast train starts one
+   region along and crosses in 1 Stage; a slow one takes 2. **No other card reads a train's
+   Fast/Slow rating at all.**
+3. **The permanent Heavy Grade modifiers**, each moving a train one region up the hill.
+4. **Occupancy**: arriving to find the card occupied can put a train in the siding, a region behind.
+
+No crossing ever takes less than one Stage.
+
+### Traffic
+
+Only **Double Track** lets two trains stand on one card, so a following train is not held behind a
+slower one. Every other card holds one train at a time. The **Uncontrolled Siding** is not a passing
+card: arriving to find a train already there puts you in the siding a region behind it — you do not
+run into it, and it costs you the extra Stage instead.
+
+Whether a following train may enter an occupied card at all is the Superintendent's ruling (§8.1,
+Rules §4.5). Getting it wrong is what causes collisions.
+
+## The deck
+
+Ten drawable cards — Plains twice, the other eight once each — plus the two Division Point cards,
+which are not drawn.
+
+| Card | Copies |
+| --- | ---: |
+| Plains | 2 |
+| Curves | 1 |
+| Hilly | 1 |
+| Heavy Grade | 1 |
+| Double Track | 1 |
+| Uncontrolled Siding | 1 |
+| Tunnel | 1 |
+| Trestle | 1 |
+| Interchange | 1 |
+| East / West Division Point | 1 each, not dealt |
+
+The PDF art labels the Interchange "Yard". This reference uses **Interchange** throughout, to keep
+it apart from the Division Yard, the Classification Yard, the Yard Office and the Small Yard — five
+different things.
+
+**Region counts and entry points per card are in the table under § The deck.**
+
+<!-- BEGIN CARDS: mainline -->
+| Card | Regions | Default entry | Fast / slow entry | Trains may pass | Extra may start |
+| --- | ---: | ---: | --- | :---: | :---: |
+| Plains | 1 | 0 | — | — | — |
+| Curves | 2 | 0 | — | — | — |
+| Hilly | 2 | 0 | 1 / 0 | — | — |
+| Heavy Grade | 3 | 0 | — | — | — |
+| Double Track | 1 | 0 | — | yes | — |
+| Uncontrolled Siding | 2 | 1 | — | — | — |
+| Tunnel | 2 | 0 | — | — | — |
+| Trestle | 1 | 0 | — | — | — |
+| Interchange | 2 | 1 | — | — | yes |
+
+The Mainline deck is 10 cards; the two Division Points are the fixed ends of
+the Division and are not dealt. What each card does, in the words the game uses on screen:
+
+- **Plains** — 1 region — one Stage each. · 1 Stage for every train. · One train at a time — anything following has to wait for it to clear.
+- **Curves** — 2 regions — one Stage each. · 2 Stages for every train. · One train at a time — anything following has to wait for it to clear.
+- **Hilly** — 2 regions — one Stage each. · This card reads the train's FAST/SLOW rating: a fast train starts further along and crosses in 1 Stage, a slow one in 2 Stages. No other card cares which it is. · One train at a time — anything following has to wait for it to clear.
+- **Heavy Grade** — 3 regions — one Stage each. · A grade, climbing eastward. 3 Stages to climb it and 3 Stages to run down, before help. Helpers start an UPHILL train a region further on; Brakeman does the same DOWNHILL and Airbrakes another again, and Airbrakes cannot be played without Brakeman. Never less than one Stage. · One train at a time — anything following has to wait for it to clear.
+- **Double Track** — 1 region — one Stage each. · 1 Stage for every train. · TRAINS MAY PASS — two trains may stand on this card at once, so a following train is not held behind a slower one.
+- **Uncontrolled Siding** — 2 regions — one Stage each. · A train with the card to itself starts past the back region and is across in 1 Stage. · UNCONTROLLED SIDING — arrive to find a train already here and you take the siding, a region behind it. You are not in the same place, so you do not run into it; it costs you the extra Stage instead. · One train at a time — anything following has to wait for it to clear.
+- **Tunnel** — 2 regions — one Stage each. · 2 Stages for every train. · One train at a time — anything following has to wait for it to clear.
+- **Trestle** — 1 region — one Stage each. · 1 Stage for every train. · One train at a time — anything following has to wait for it to clear.
+- **Interchange** — 2 regions — one Stage each. · A train with the card to itself starts past the back region and is across in 1 Stage. · An Extra beginning its run here starts in the back region and takes the extra Stage. · One train at a time — anything following has to wait for it to clear. · This is the one Mainline card with a yard, so an Extra Train may be made up and started here. Its printed car-sorting is NOT implemented — a consist is re-ordered at a Small Yard in a district.
+<!-- END CARDS: mainline -->
+
+## The Interchange, and what it does NOT do
+
+The Interchange prints a car-sorting capability. **It is not implemented, and never has been.** The
+one thing the card's `sortsCars` flag actually gates is that an **Extra Train may be made up and
+started here** — it is the Mainline card with a yard, which is why §7 allows it. An Extra
+starting here begins in the back region and takes the extra Stage.
+
+Re-ordering a consist is done at a **Small Yard** in an Office Area, for one switching Move. See
+Rules §4.3.
+
+## Heavy Grade modifiers
+
+Home Office cards, played onto a Mainline card during a player's Draw option.
+
+| Card | Placement and effect |
+| --- | --- |
+| Brakeman | Heavy Grade only. A **downhill** train starts one region further on. |
+| Airbrakes | Heavy Grade only, and **Brakeman must already be on that card**. A downhill train starts one region further again. |
+| Helpers | Heavy Grade only. An **uphill** train starts one region further on. |
+| Realignment | Only onto an **unoccupied** Mainline card, and only these four conversions: Plains → Double Track, Curves → Plains, Uncontrolled Siding → Double Track, Trestle → Uncontrolled Siding. |
+
+A Heavy Grade is 3 regions, so it is 3 Stages to climb and 3 to run down before help. Modifiers
+never reduce a crossing below one Stage.
+
+> **A Realignment can be a card with no legal target.** Only four of the nine Mainline types convert
+> at all — Plains, Curves, Uncontrolled Siding and Trestle — so a Division dealt Heavy Grade, Tunnel
+> and Double Track has nowhere to play one. A card already converted cannot be converted again, and
+> a card with a train on it is refused while the train is there. The card says which four it can
+> convert when you look at it in hand.
+
+### ABS Signals — an Enhancement, but it lives out here
+
+**ABS Signals is dealt from the Home Office deck as an Enhancement, and it is the one Enhancement
+that is not played into a district.** It goes onto a **Mainline card — any of them**, not only a
+grade — and takes no square in anybody's Office Area.
+
+What it does: trains on that card **will not rear-end each other**. A following train is held short
+of the one ahead instead of running into it, so the Superintendent has no §8.1 judgment to make and
+no collision is scored. It is the only thing besides a Red Flag that prevents a rear-end collision
+out on the Mainline, and unlike a Red Flag it stays on the card for the rest of the game.
+
+On the board a card carrying it draws a **signal mast with a lit lamp** at its top-right corner; the
+three grade helpers draw as **BRK**, **AIR** and **HLP** beside the card's name. Realignment draws
+nothing, because a realigned card simply becomes the card it was converted into.
+
+## Heavy Grade orientation is settled, not missing
+
+Heavy Grade orientation is **rolled from the seed**, not chosen by a player. **This is a decision,
+not a gap.**
+
+The card prints "(Up)" and "Player sets orientation", which assumes the card has an owner. This one
+does not: the Division is laid `DP · Mainline · Office · Mainline · … · DP`, so a Heavy Grade always
+sits **between two districts**, or beyond an end Division Point beside one — never inside a single
+player's district.
+
+Orientation is not cosmetic. Brakeman and Airbrakes help a train running **downhill**, Helpers helps
+one running **uphill**, and odd-numbered trains run west while even run east. Turning the card
+around decides which modifiers are worth anything and which direction of traffic is favoured, for
+the whole game. Handing that to one of two neighbours advantages them over the other, and neither
+has a fair claim to it.
+
+So the orientation is **rolled from the game's seed**. That is deterministic, roughly even
+(51/49 east/west), identical in solitaire and multiplayer, and keeps setup non-interactive: the game
+has no setup phase, so asking would mean interrupting play before the first Local Operations.

docs/quickstart.md

@@ -0,0 +1,211 @@
+# Station Master — Quickstart
+
+**Version 0.8.4** · 2026-09-29
+
+For a player who has never played.
+
+Read this once before you sit down. It is about twenty minutes of reading and will save you an hour
+of confusion. The deeper references are listed at the end.
+
+---
+
+## 1. What the game is
+
+You are a railroad **Office** — a town — on a shared east–west main line called the **Division**.
+Everyone's Office sits in a row along it, west to east, with **Mainline cards** between them.
+
+Two jobs run at once:
+
+**Your own job, in your district.** Build track. Build industries and a passenger platform. Shunt
+cars around with a switching crew to get the right car to the right place, so that freight can be
+loaded and unloaded and passengers can get on and off. Every one of those completed pieces of work
+pays **Revenue**, which is the score.
+
+**The shared job, out on the Division.** Scheduled trains run across everybody's territory on a
+timetable. They arrive at your Office, and you work them. When two trains want the same stretch of
+track, the player wearing the **Superintendent's Fedora** rules on whether the second may follow the
+first. Rule wrong and they collide, which costs 5 Revenue and counts against a limit that can end
+the game.
+
+The tension the game is built around: **the useful work is local and slow, and the trains are shared
+and do not wait.**
+
+---
+
+## 2. How you win
+
+A game runs for a set number of **Days**, chosen when the game is created. Each Day is **12
+Stages**, which you can think of as two-hour clock periods from midnight.
+
+At the end of the last Day, the table's **combined Revenue** is checked against a floor. **Miss it
+and everybody loses**, however well you personally did — this is the number to watch. The floor is
+worked out from the number of players and Days when the game is dealt, and whoever sets the game up
+can raise or lower it.
+
+Clear the floor, and how you win depends on the game type:
+
+- **Co-op** — clearing the floor is the win, together.
+- **Competitive** — clearing the floor puts the game on, and the **highest individual Revenue**
+  wins. Everyone is still working towards the same floor first.
+- **Cutthroat** — competitive, with the opponent-directed cards in play, so players can act against
+  each other directly. Those cards are not implemented yet, so this plays as Competitive today.
+- **Solitaire** — clear the floor by yourself.
+
+**Collisions can end it early and badly.** Breaching the collision limit stops play at once in a
+collective loss: the railroad has been declared unsafe. The limits are configurable, and can be
+switched off entirely.
+
+**Falling short offers another Day** rather than just ending, so a game that misses the floor can be
+played on. A game stopped by collisions cannot.
+
+### Where Revenue comes from
+
+| Work | Pays |
+| --- | --- |
+| A passenger boarding at your platform | 1 |
+| A passenger getting off at your platform | 1 |
+| Completing an outbound freight load | 1 |
+| Completing an inbound freight unload | 1 |
+| A train completing its run across the whole Division | paid to every player; usually set to 0 |
+
+Every rate is set when the game is dealt and can be changed. As they usually stand, **your score
+comes almost entirely from working cars in your own district** — trains passing through pay nothing
+by themselves.
+
+---
+
+## 3. The shape of a Stage
+
+Every Stage runs five phases in this order. Only two of them are your turn.
+
+| # | Phase | What happens |
+| --- | --- | --- |
+| 1 | **Local Operations** | **Your turn.** Choose ONE of three things (below). Each player in turn, starting with the Superintendent and working eastward. |
+| 2 | **New Train** | Trains due this Stage are made up from the Division Yard. The table takes turns adding one car each. |
+| 3 | **Mainline** | Automatic. Trains move, lowest number first. This is where clearance rulings and collisions happen. |
+| 4 | **Cargo** | **Your turn.** Your Laborers and Porters do their work — the loading, unloading, boarding and detraining that actually pays. |
+| 5 | **Supervisor Shift** | Automatic. Laborers and Porters refresh; expedited trains depart. Every third Stage the Fedora passes. |
+
+### Local Operations: you get exactly one of these
+
+- **Switch** — take a crew and shunt. **Six Moves** (five at night under Reduced Visibility). This is
+  how cars physically get from the yard to an industry and back. Cars you run over are coupled up
+  automatically, so plan the route.
+- **Draw** — take a card, then play and/or discard. This is how your district gets built: track,
+  industries, Office upgrades, modifiers, train cards.
+- **Freight Agent** — one clerical act: stock a green outbound box, clear a red inbound box, or
+  unjam a facility.
+
+**You cannot do two of them in one Stage.** Choosing is most of the game. A Stage spent drawing is a
+Stage not spent switching.
+
+> Passengers are **not** the Freight Agent's job. They board and get off in the **Cargo** phase, with
+> a **Porter**. Reaching for the wrong role and finding nothing there is the single most common new
+> player mistake, so each role now says on screen what it is for.
+
+---
+
+## 4. The screen
+
+**Across the top:** your Revenue, the target, the Day and Stage, collisions, and the game code.
+
+**When other players are acting**, their turns are replayed on your board a step at a time rather
+than arriving already rearranged, with a `[N behind]` counter, **Pause** and **Skip**. Your own moves
+are not replayed at you — they are already on your screen.
+
+**The main display, on the left**, top to bottom:
+
+- **The Division — west to east.** The shared main line: every Office and the Mainline cards between
+  them, with trains drawn where they are. **West is always on the left**, and a train's engine is
+  drawn as an arrow (◀ or ▶) showing which way it points.
+- **Your Office Area.** Your own grid of track cards. This is where switching happens. It folds away
+  outside the phases that change it, unless you pin it open.
+- **History.** What has happened, most recent first.
+
+**The right-hand column:**
+
+- **Your Move** — the buttons. If it is not your turn this is empty, and the board tells you who is
+  acting.
+- **Cards in My Hand**, and the **Department decks** — three face-up discard piles anyone may draw
+  the top of.
+- **The Yards.** The **Division Yard** is the live supply of cars. The **Classification Yard** is
+  where used cars go, and it comes back **only when the Division Yard runs completely bare**.
+- **Timetable** — who is due out and when.
+- **Blocked — why nothing is moving.** *Read this panel.* When something will not work, this is
+  where the game explains why, in rules terms.
+- **Facilities** — the load pipelines at each industry.
+- **This Game** — the seed or your seat, the game code, the rules this game was dealt under, and
+  links to this guide and the other references.
+
+---
+
+## 5. Start with solitaire
+
+Play a **solitaire** game first. It needs no server and nobody else, and it is the same rules.
+
+1. Open the site, choose **Play solitaire**, accept the defaults, **Deal**.
+2. **Stage 1 — Draw.** You start on a **Depot** with almost nothing else. Play a track card or two to
+   extend your Running Track. A Depot already works passengers and has two A/D tracks, so a second
+   train can stand at your Office without wrecking; a **Station** upgrade, when one appears, buys a
+   third track and another Porter.
+3. **Build one industry** on a stub off the main — not on the Running Track itself, which the game
+   will not allow.
+4. **Play a train card** when you get one. It rolls onto the timetable and then runs at that Stage
+   **every Day**.
+5. **When a train arrives at your Office**, switch cars to it or from it, and do the paying work in
+   the **Cargo** phase.
+6. Watch the **Blocked** panel whenever you are stuck. It is usually one missing thing: no empty car
+   spotted, no loaded car in the yard, a full box, a locked industry track.
+
+---
+
+## 6. Things that surprise new players
+
+- **A turnout cannot be stopped on.** You may run through it; you may not end a Move there.
+- **Coupling is mandatory.** Run over a standing car and you take it, whether or not you wanted it.
+- **An industry track locks while a load is on its MEN | AT | WORK boxes.** No train can enter,
+  cross or work there until it clears.
+- **A modifier adds a BOX, never room for a car.** It raises how much work an industry can hold, not
+  how much rail it has.
+- **Nothing may be built outside your Limits** — track, industries and modifiers alike. Your district
+  ends at its sign, and the sign moves outward as your Running Track grows.
+- **A train must be made up to leave.** Engine at one end; if it has a caboose, the caboose at the
+  far end. A train shunted out of shape sits at your Office until you fix it — a **Small Yard** will
+  re-order a consist for one Move, and each option tells you whether the result can leave.
+- **Passengers may dry up completely.** Coaches move one way — boarding sends the emptied coach to
+  the Classification Yard, and it only comes back when the Division Yard is bare, which may never
+  happen. When it does, the yard panel warns you and passenger trains are made up empty. **This is
+  the rules working as designed.**
+- **Expedited trains leave the same Stage they arrived**, after the Cargo phase. Ordinary ones wait.
+
+After playing some solitaire, play a day or two of multiplayer with bots or friends to get a feel
+for how players interact. Then you are ready to run a real division.
+
+---
+
+## 7. Issues / Suggestions
+
+Please do report anything that looks like a bug or an area to be improved.
+
+- **What you expected versus what happened**, with the Day and Stage. "Day 2 Stage 9, train 5 had
+  no coaches" is worth more than "passengers seem broken".
+- **Save the game** (the **Save replay** button) and send the file. A save is the seed and the moves
+  made, so it replays exactly and the problem can be looked at directly.
+- **Anything the screen did not explain.** If you had to guess a rule, that is worth saying even
+  when the game was right.
+- **Anything you went looking for and could not find.**
+
+**A save replays under the rules of the build that opens it.** When a rule changes, a save made
+before it may stop part-way — the game says which move it stopped on and leaves your file untouched,
+so the build you played on will still finish it.
+
+---
+
+## 8. Documentation / References
+
+| For | Read |
+| --- | --- |
+| The rules in full, with the FAQ | [Rules](rules.md) |
+| How the Home Office deck is dealt and played | [Home deck](home-deck.md) |
+| The Mainline cards and what they do to a train | [Mainline deck](mainline-deck.md) |
+| Rolling stock, yards, trays, the Fedora | [Components](components.md) |

docs/rules.md

@@ -0,0 +1,476 @@
+# Station Master — Rules
+
+**Version 0.8.4** · 2026-09-29
+
+**Authority:** observed code paths and tests. Where a card face, a prototype document and executable
+behaviour differ, this document reports **executable behaviour** and marks unimplemented material.
+Per-card numbers are not repeated here — the Home deck and Mainline deck references carry tables generated from
+`src/engine/content.ts` and is the table of record.
+
+**New to the game? Start with the [Quickstart](quickstart.md).**
+
+## 1. Overview and background
+
+Station Master is a railroad-operations game set in the timetable-and-train-order era. Each player operates an Office Area on a shared east–west Division. The local work is building rail, switching cars, moving passengers and freight through facilities, and keeping the Office clear. The shared work is dispatching scheduled trains across the Division. The player holding the Superintendent’s Fedora decides whether to clear a following train into an occupied Subdivision; an unsafe decision can cause a collision.
+
+Revenue is the score. Passenger boarding and detraining, freight loading and unloading, completed runs, collisions, and victory conditions are all resolved by the rules configured when the game is dealt.
+
+This book is divided as follows:
+
+1. overview and scope;
+2. definitions;
+3. creating, saving, replaying, and configuring games;
+4. the shared basic game mechanics;
+5. the implemented solitaire game;
+6. the implemented multiplayer/engine status; and
+7. FAQs and implementation limits.
+
+The companion references are the [Quickstart](quickstart.md) for a new player,
+[Mainline deck](mainline-deck.md), [Home deck](home-deck.md),
+[components](components.md), and the generated per-card table
+[Home deck](home-deck.md) and [Mainline deck](mainline-deck.md).
+
+## 2. Definitions
+
+| Term | Meaning |
+| --- | --- |
+| A/D track | An Office arrival/departure capacity. A Whistle Post has 1; Depot, Station, and Terminal have 2, 3, and 4. |
+| Card location | A square in an Office Area grid. A train may end a switching Move only on Operational Rail. |
+| Classification Yard | The holding yard for used rolling stock. It refills the Division Yard only when that yard is completely empty. |
+| Control Point | A Depot, Station, or Terminal. It breaks the shared Mainline into Subdivisions. A Whistle Post is not one. |
+| Crew Tray | An engine plus up to four coupled rolling-stock cars. The engine itself does not count as a car. |
+| Department pile | One of three shared face-up card stacks. Draw and discard affect only the top card. |
+| Division Point | The western or eastern end of the shared Division, where trains enter and leave it. |
+| Division Yard | The active source of rolling stock. |
+| Expedited train | A train with the expedite rule. It performs Load/Unload at an Office after arriving, then attempts to depart at the end of that same Stage. |
+| Facility | A Passenger Facility at an upgraded Office or a Freight Facility at an industry. |
+| Freight Agent | The Local Operations option that stocks one outbound box, clears one inbound box, unjams one load, or ends without acting. |
+| Limits | The two signs defining an Office Area’s Running Track. They move outward when that track is extended. |
+| Local Operations | The first player-driven phase of a Stage. A player chooses one: switch, draw, or Freight Agent. |
+| Mainline | The shared cards between Offices and Division Points. |
+| MEN \| AT \| WORK | A three-box freight pipeline. Any load on it locks its industry track. |
+| Operational Rail | A card on which a train may finish a Move. Turnouts are pass-through only; a locked industry is not usable at all. |
+| Running Track | The east–west track between an Office Area’s Limits, including its Office. |
+| Secondary Track | All local rail inside the Limits that is not Running Track. |
+| Stage | One of twelve turns in a Day. Its phases are Local Operations, New Train, Mainline, Load/Unload and Shift Change. **On screen the last two are labelled "Cargo" and "Supervisor Shift"** — same phases, the names the interface uses. |
+| Subdivision | Mainline between Division Points or Control Points. Clearance checks look through the whole next Subdivision. |
+| Superintendent | The player with the Fedora. The role decides same-direction clearances and rotates every three Stages. |
+| Timetabled train | A numbered train card scheduled to one of the 12 Stage slots, then due at that slot each Day. Odd numbers go west; even numbers go east. |
+
+## 3. Create, save, replay, and game configuration
+
+### 3.1 Starting a new game in the shipped client
+
+The front page has three doors: **Play multiplayer**, **Play solitaire**, and **Browse replays**.
+
+**Solitaire** runs entirely in your own browser and needs nothing from the server. Select **New
+game**, then choose:
+
+1. a numeric seed, or leave it blank for a fresh browser-generated seed;
+2. a starting hand;
+3. passenger, freight, and train-transit Revenue rates;
+4. the number of Days, and the optional rules.
+
+**Multiplayer** goes to the lobby — see §3.5. It needs the server, because the game is authoritative
+there rather than in any one browser.
+
+The browser writes those choices into the URL. A particular game is defined by the **seed plus these house rules**, not the seed alone.
+
+The three starting-hand choices are:
+
+| Choice | Setup result |
+| --- | --- |
+| Three random cards | Default. Deal three cards from one shuffled deck. |
+| Six random cards | Deal six cards from one shuffled deck. The player begins over the normal hand limit and must play/discard down before ending the first Draw turn. |
+| Three random track and three random non-track cards | Shuffle track and non-track piles separately for the opening deal; then recombine and shuffle their remainders for all later draws. |
+
+The three Revenue values are independently rounded and clamped to 0–5:
+
+- passenger Revenue per coach, paid on boarding and again on detraining;
+- freight Revenue per load, paid on completion of an outbound load and again on completion of an inbound unload; and
+- train Revenue per transit, paid to every player when a train leaves the Division.
+
+Defaults are 1 / 1 / 0. Zero turns that revenue source off; it does not prevent the underlying operation.
+
+### 3.2 Deterministic setup and the seed
+
+The engine uses one seeded random stream for shuffles, Mainline selection, opening D12 rolls, timetable rolls, and automatic Heavy Grade orientation. Given the same seed, configuration, player names/order, and accepted action history, it reconstructs the same state.
+
+At setup it creates each Office Area as `Limit — Whistle Post — Limit`, makes the Division Yard, creates players + 3 Crew Trays, turns up three Department cards, and constructs the shared Division.
+
+In a multi-player engine game, every player receives two seeded D12 rolls:
+
+- The **division roll** orders seats from low west to high east; equal results put the lower player index farther east.
+- The **Superintendent roll** gives the initial Fedora to the first player tied for highest.
+
+The opening deal starts at the Superintendent’s seat and proceeds **eastward** — increasing seat index, which is how the Division map draws the table.
+
+### 3.3 Saving, resuming, and replaying solitaire
+
+The local save format is JSON containing the seed, the accepted intent history, and the house rules. It does not serialize mutable game state. Loading recreates the game from the seed and replays every action through the rules engine. If an old history reaches an action that is no longer legal, replay stops there instead of forcing an invalid state.
+
+The browser also stores the current local game and resumes it automatically when the page opens without an explicit seed in the URL. A downloaded save is named `station-master-seed<seed>-day<day>.json`.
+
+**Undo is solitaire-only.** It removes the final accepted intent and rebuilds the game from the earlier history. Random outcomes are not rerolled: replaying the same action consumes the same seeded result. Undo can therefore change the player’s decision after seeing an outcome, but cannot fish for a different timetable die roll.
+
+### 3.4 Game modes and endings
+
+Three modes: **Solitaire**, **Competitive** and **Co-op**. All three are playable.
+
+**Length is a free `days` count**, not a preset — any number of Days may be set. The default is 5.
+
+**How a game ends and who wins:**
+
+1. **The timetable runs out** at the end of the last Day. Then:
+2. **The combined Revenue floor** is checked first — `3 × players × days`. Fall short and
+   **everybody loses**, whatever anyone individually scored.
+3. **Co-op** wins as a table if the floor is met.
+4. **Competitive** is won by the **highest individual Revenue** once the floor is met.
+5. **Collisions end it early.** Breaching the per-Day or total collision limit ends play at once in a
+   collective loss — the railroad has been declared unsafe.
+
+**Extended play (Gitea#11).** Both days-based endings — running out of timetable, and closing short
+of the Revenue floor — offer **another Day**, because they are the same event seen twice: the last
+Day ended, and this is what the books say. A collision ending is **not** extendable, and neither is a
+collision breach during an extended Day. The official result is frozen when the timetable first ran
+out, so a railroad declared unsafe on Day 9 does not retract who won on Day 5.
+
+**Three optional rules, all implemented:**
+
+| Rule | Effect |
+| --- | --- |
+| Reduced Visibility | Five switching Moves instead of six, in Stages 1, 2, 3, 11 and 12 — the night Stages. |
+| Employee Rotation | Every player moves one chair at the end of each Day. Revenue and the Fedora travel with the player; the Office Areas stay with the seats. |
+| Emergency Toolbox | Starts every player holding the Red Flags status, so the hand limit opens at four. |
+
+(There is no "Sister Trains" flag. It appeared in an earlier draft of this document and never in the
+configuration.)
+
+### 3.5 Multiplayer setup
+
+Multiplayer is delivered and is what this package is for. The flow:
+
+1. **Create or join.** The host creates a game and gets a **game code**; everyone else joins with
+   that code. Seats fill as people arrive, and any seat left empty can be **filled with a bot**.
+2. **Start.** Once the host starts, that same page is where every player plays their turns and
+   watches the table. There is nothing else to open.
+3. **The server is authoritative.** The game lives on the server, not in a browser: it survives a
+   page reload, a browser restart and a service update, replaying its intent history to get back to
+   where it was.
+4. **Your seat is a token in YOUR browser**, scoped to the origin you joined at. A reload finds it
+   and puts you straight back. Clearing site data, a private window, or a different browser does not:
+   the seat is still yours and still on the server, but that browser can no longer prove it is you.
+   An administrator can mint a **single-use recovery link** (StartOS action **Restore a Seat**) that
+   trades a code for the token and expires in 30 minutes.
+5. **Watching the table.** Other players' turns arrive as an ordered replay rather than as a board
+   that has silently rearranged itself, with a `[N behind]` counter, Pause and Skip.
+
+Solitaire needs none of this and runs with the page alone.
+
+## 4. Basic game mechanics
+
+### 4.1 The Stage sequence
+
+Each of 12 Stages follows this sequence:
+
+```text
+1. Local Operations — each player, starting with the Superintendent and proceeding eastward
+2. New Train      — make up due timetabled trains, then queued second sections and Extras
+3. Mainline       — automatic train movement in numeric order
+4. Load/Unload    — each player, same order.        On screen: "Cargo"
+5. Shift Change   — expedited departures, workers.  On screen: "Supervisor Shift"
+```
+
+**"Proceeding left" is seat order, west to east**, which is how the Division map draws it — the
+screen says "eastward" for that reason, because a table has no shared left.
+
+At a Shift Change, Laborers and Porters reset. The Fedora moves after Stages 3, 6, 9, and 12. The collision limits are judged on the Stage just played, before anything else. At Day end, dispatch-device use resets, collision count resets, the Day and Stage roll over, and victory is checked.
+
+### 4.2 Local Operations: choose one option
+
+On a player’s Local Operations turn, choose exactly one available option.
+
+**Switch.** Select any Crew Tray currently in that player’s Office Area. It gets six Moves, or five under Reduced Visibility on the listed night Stages. A Move travels any connected distance in one direction and must end on Operational Rail. Reversing is a separate Move. A train may pass through a turnout but cannot stop on it. It may not share or pass through another train except through an Office with a free A/D track.
+
+Standing cars couple automatically when the train reaches them; it may not pass them, and the resulting consist may not exceed four cars. Coupling forward places cars ahead of the engine; coupling while backing places them behind it. Setting out cars does not spend a Move, but the cut must come from an outer end of the consist and may not be left on the Office. A **Small Yard** re-orders a consist for one Move, and may also place cars **ahead
+of the engine** — which is how a cut is set up to be shoved into a facing industry. Each option on
+the menu shows the train it would build, laid out west to east as the board draws it, and says
+whether the result may leave the Office or would be held there. Flying Switch spends one Move to
+roll a tail cut into a connected Freight Facility.
+
+**Draw.** Take one card from the face-down Home Office or the exposed top of one Department pile. During this option, play eligible cards and/or discard cards to Department piles, then finish at the hand limit. Track, facilities, offices, modifiers, enhancements, and train cards have the placement or scheduling rules in the deck references. Mainline modifiers are played from this option as well.
+
+> **A Department that is emptied is refilled at once.** §6.2: *"If any of the Department decks is
+> empty, draw a Home Office card and place it in the empty spot."* So taking the last card off a
+> pile does not leave a gap — a fresh card is turned face up from the Home Office deck to replace
+> it, and there are always three Departments to draw from. The refill happens **only** when the
+> draw actually empties the pile; a pile with cards buried under the one taken is not refilled, or
+> the Departments would grow without limit and drain the deck into themselves.
+>
+**Freight Agent.** Make one of these operations, then the turn ends: stock one green outbound box from a matching loaded Division Yard car; clear one red inbound box to the Classification Yard; unjam one outbound, inbound, or MEN | AT | WORK load — the one you name, when a box holds more than one — to the Classification Yard; or explicitly end without acting. Freight can be stocked only when an unclaimed empty matching car is already spotted at that industry. Passengers may wait in a green Office box without a train present.
+
+> **A car cleared from a red Inbound box comes back empty.** Whatever was in it has arrived — the
+> passengers are out of the station, or the load is in the industry — and the Revenue for it was
+> paid on arrival, not on clearing. What returns to the Classification Yard is the *car*, in the
+> common supply and carrying nothing.
+
+Implementation note: `card.discard` is accepted during Local Operations
+without checking that the Draw option was chosen — unlike `card.play`, which does check. This is an
+implementation quirk rather than a fourth published turn option.
+
+### 4.3 Track, switching, and local safety
+
+The Running Track cannot be broken by a curve or other card lacking its east–west through route. Local branches use turnouts and 45° curves. Cards that touch vertically connect only if their 45° legs share the correct diagonal; mere adjacency is not rail connection.
+
+An industry’s track is locked while any load is on its MEN | AT | WORK pipeline. Trains cannot enter, cross, pick up from, or set cars out there. When it is unlocked, an industry track is ordinary Operating Rail and holds up to four cars, the same as any other non-turnout, non-Limits card: a crew may set out one, two, three or four cars there, whatever it is carrying. An industry’s green and red boxes are how much work it can hold, not how much rail it has, and a Modifier beside it adds a box without adding room for a car.
+
+Train-card restrictions also apply while switching. No-switching trains cannot move, set out, or sort locally. Trains 3/4 share a one-freight-car budget for pickup or setout at each grid location. Trains 7/8 cannot set out their coach. X13 cannot pick up, and X22 may pick up empty cars only.
+
+### 4.4 New Train phase
+
+At the Stage shown on the timetable, the engine makes up the matching timetabled train if a Crew Tray is free. It starts at the Division Point appropriate to its direction. A train may receive matching loaded or empty cars from the Division Yard until its listed maximum consist is reached or no suitable car remains. It is permitted to leave under-strength.
+
+A Second Section order on the due train creates another identical timetabled train behind it when a
+free tray is available. A played Extra is made up after timetabled trains and Second Sections when a
+tray is free, and **the player who played the card chooses where it starts** — either Division
+Point, the Interchange, or an Office, according to the `extraStart` house rule — and loads it as they
+choose rather than going round the table.
+
+A timetabled train's consist is built by the table: **starting with the Superintendent and working
+eastward, each player adds ONE car**, going round again until the train is full or the Division Yard
+holds nothing it can take.
+
+**When the yard can supply nothing, the game says so.** The round is skipped — there is no point
+asking for a car that cannot be given — and the train is reported as made up short, naming what its
+card wanted, how many such cars are waiting in the Classification Yard, and how far the Division Yard
+is from bare. See §4.6 for why that happens to coaches in particular.
+
+### 4.5 Mainline movement and Office arrival
+
+Mainline movement is automatic and processes lower train numbers first; a timetabled train outranks an Extra with the same number. A train at a Division Point, at an Office A/D track, or already crossing a Mainline card attempts its applicable movement.
+
+**Crossing time is the card's REGIONS**, one per Stage — not its printed mph, which is scenery, and
+not the train's Fast/Slow rating, which only **Hilly** reads. See the
+[Mainline deck](mainline-deck.md) reference for what moves a train's entry
+point. On a normal card, a train must check the entire next Subdivision before entering it:
+
+- an opposing train normally blocks entry;
+- a following same-direction train asks the Superintendent to allow or deny clearance;
+- Red Flags or ABS Signals hold the follower automatically; and
+- **Double Track** — the one card two trains may stand on — allows entry without that check. The
+  **Uncontrolled Siding** is not a passing card: a train arriving to find it occupied takes the
+  siding a region behind, which costs it the extra Stage instead of a collision.
+
+An Office arrival normally takes a free A/D track. If the Office is full, the inbound train collides and the local Office player loses 5 Revenue; Interlocking instead holds it at the Limits. A held train takes the first A/D track that frees — whether another train's arrival or a departure freed it — ahead of anything arriving after it, and no later than the end of the Mainline phase in which the track became free. A coachless inbound train may divert to a Yard Office. Cars fouling the Running Track at the Office also cause a collision.
+
+An expedited train is released by the ordinary rules like any other; what Expedite restricts is where it may be left. If it is standing anywhere in the district but the Office when a Mainline phase begins, its owner is fined once for that phase. An arrival waits until a later Mainline phase. A train departing an Office must be correctly made up: engine at one end, caboose at the far end if present.
+
+When a train leaves the far Division Point, its cars are returned to yards, its Crew Tray becomes free, and each player receives the configured train-transit Revenue (zero by default).
+
+### 4.6 Passenger work
+
+Passenger work occurs during Load/Unload, at a Depot, Station, or Terminal. Each Porter may take one action per Stage.
+
+- **Board:** replace an empty coach on an eligible train at the Office with a loaded coach from a green outbound box. The removed empty coach goes to the Classification Yard. Earn configured passenger Revenue.
+- **Detrain:** replace a loaded coach on an eligible train with an empty coach from the Division Yard, placing the loaded coach into an available red inbound box. Earn configured passenger Revenue.
+
+Crack Limited trains permit passenger work at Terminals only. Military Train and Director's Private
+Car permit no passenger work. A Whistle Post has no Porters.
+
+> **Coaches travel one way, and it is worth knowing before you plan around passengers.** Boarding
+> sends the emptied coach to the **Classification** Yard; detraining draws a fresh empty out of the
+> **Division** Yard; and §2.2 returns the Classification Yard only when the Division Yard runs
+> completely bare. Measured over one three-Day game: sixteen coaches in the Division Yard at setup,
+> **none from Day 2 Stage 8 onward**, fifteen piled in Classification while the Division Yard held
+> steady at 46–47 freight cars and stopped draining — so the refill never fired and no passenger
+> could board or detrain anywhere for the rest of the game, while trains whose cards call for coaches
+> were made up empty.
+>
+> **This is the rules working as printed: running out of cars is part of the game.** The yard panel
+> warns while the shortage lasts, and a train made up short reports what it wanted and why none is
+> coming.
+
+### 4.7 Freight work
+
+Freight work also occurs during Load/Unload. Each Laborer can take one action per Stage. Every freight facility has MEN, AT, and WORK boxes.
+
+For an **outbound load**, first use the Freight Agent to put a matching loaded car into the green box, with an unclaimed empty matching car spotted on the industry track. A Laborer starts the load on MEN, then advances it to AT, then WORK, then onto the empty car. Completing the last step changes that car to loaded, sends the replaced empty car to the Classification Yard, and earns configured freight Revenue.
+
+For an **inbound unload**, a matching loaded car must be spotted at an inbound-capable industry and the Division Yard must contain a matching empty car. A Laborer replaces the spotted loaded car with that empty car and starts the load on WORK. Laborers move it backward through AT and MEN into a free red inbound box. That final placement earns configured freight Revenue. Clearing the red box later with the Freight Agent pays no additional Revenue.
+
+## 5. Solitaire
+
+Solitaire is one named player and one Office Area, running entirely in the browser with no server.
+It is **not** the only implemented game any more — see §6 — but it is the one that needs nothing but
+the page.
+
+Solitaire-specific features are:
+
+- a local browser save, automatic resume, and JSON download/load;
+- **unlimited step-by-step Undo** back through accepted action history — multiplayer has none,
+  because a shared game cannot be rewound under the other players; and
+- a seed/rules URL suitable for sharing or reproducing a game.
+
+Automatic phases get a visible beat in solitaire too, so the board plays its own moves out rather
+than jumping.
+
+The active deck removes all 22 opponent-directed cards. Therefore, the defensive cards whose only purpose is to answer them (Facing Point Locks and Water Column) can be placed but have no opportunity to fire; Overpass has no effect at all. The game still includes shared-rail mechanics such as Mainline clearance, but with one player no other player can occupy the Division.
+
+To win the default one-player game, finish Day 5 having met the combined Revenue floor —
+`3 × players × days`, which at one player over five Days is **15**. Below it is a loss, and the game
+offers you another Day rather than simply ending. Train-transit Revenue defaults to zero, so the
+score has to come principally from passenger and freight work.
+
+## 6. Multiplayer
+
+### 6.1 What the engine supports
+
+The rules engine supports multiple named players; the lobby, server and
+client around it are delivered too, so this section now describes a game people actually play. The
+engine has player, seat, score, Office Area, Division, phase-order, co-op and competitive-mode data
+for multiple named players. It deals each player a hand, creates one Office Area per seat, starts acting order at the Superintendent and proceeds eastward, and models the following multiplayer-specific outcomes:
+
+- the D12 seating and Superintendent rolls described in section 3;
+- individual Revenue in competitive play and shared total Revenue in co-op;
+- a collective loss on breaching the collision limits;
+- the combined Revenue floor, `3 × players × days`; and
+- train-transit Revenue awarded to every player, if that revenue setting is nonzero.
+
+The engine’s setup checks only that there is at least one player and that Solitaire has exactly one player. It does not enforce a maximum player count, although the test and design material exercise two through four players.
+
+### 6.2 What IS delivered
+
+Everything in §3.5: a lobby with game codes, seating, bots filling empty chairs, an authoritative
+server that survives restarts and updates by replaying its intent history, per-seat reconnection, an
+administrator's single-use seat-recovery link, and an ordered replay of other players' turns on each
+player's own screen.
+
+The package also exposes administrative **actions** on StartOS — list games in progress, get the
+join secret, manage a game, restore a seat — documented in the wrapper repository rather than here.
+
+### 6.3 What is NOT delivered
+
+**No card may be played at another player.** The 12 space-use and 10 action cards are excluded from
+every dealt deck in every mode, and `check` rejects playing one. That includes Derail, Broken
+Coupler, Railroad Crossing, the score-penalty cards, Vandalism, Hotbox, Outlawed and all
+table-space cards. Facing Point Locks and Water Column exist only as dormant defences against
+effects nothing can currently cause, and Overpass has no effect at all.
+
+**No multiplayer Undo.** A shared game cannot be rewound under the other players.
+
+### 6.4 How multiplayer differs from solitaire
+
+Players have separate districts, hands and scores, and share the Home Office deck, the Department
+piles, the yards, the timetable, the Mainline and every traffic consequence. One player acts at a
+time.
+
+**A seat is not a player**, and the distinction is load-bearing. Offices belong to seats; Revenue,
+hands, the Fedora and identity belong to players. With **Employee Rotation** on, players move one
+chair at the end of each Day and take their Revenue and the Fedora with them, while the districts
+stay where they are.
+
+So multiplayer changes shared traffic, scores, turn order and how the game is won or lost — not card
+attacks, which do not exist in any mode.
+
+## 7. Frequently asked questions
+
+### Is the same seed always the same game?
+
+Only with the same house rules, player configuration/order, and action history. The seed drives all engine randomness, but the starting hand and Revenue settings also change the game.
+
+### Why can’t I end my draw turn?
+
+Your hand exceeds three cards, or four when the Red Flags hand-limit status is active. Play or discard down to the limit.
+
+### Why can’t my train move onto a turnout?
+
+It may move through a turnout but cannot end a Move there because turnouts are not Operational Rail.
+
+### Why can’t a train enter my industry?
+
+Its MEN | AT | WORK pipeline contains a load, which locks the track; the rail geometry does not connect; another train occupies it; mandatory coupling would exceed four cars; or four cars are already standing there, which is as many as any card holds.
+
+### Why won’t an industry accept a new outbound load?
+
+The green box may be full, the Division Yard may lack a matching loaded car, or there is no unclaimed empty matching car already spotted on that industry’s track.
+
+### Why does an inbound freight unload require an empty car in the Division Yard?
+
+The engine immediately replaces the spotted loaded car with a matching empty car. It will not create a new car from nothing.
+
+### Why did an arriving train collide instead of wait?
+
+The Office had no free A/D track and no Interlocking. A full Office is an automatic local collision. An Interlocking holds the arrival at the Limits.
+
+### Why is a train held at an Office even though the Mainline is clear?
+
+It may be on Secondary Track rather than the Office, or be badly made up: its engine is between cars or its caboose is not at the far end.
+
+### Why was I fined for an expedited train?
+
+Expedite does not change when a train leaves — it leaves when the Mainline rules release it, like any
+other. It changes where the train may be left: if a Mainline phase begins with it standing on any
+track in the district but the Office, the owner is fined. The fine is charged once per Mainline
+phase, however many clearance questions that phase asks.
+
+### Can I choose the direction of an Extra or a Heavy Grade?
+
+**An Extra, yes** — the player who played the card chooses where it starts and which way it runs, and
+loads it as they choose. **A Heavy Grade, no**: orientation is rolled from the seed. That is
+a decision rather than a gap — the card sits between two districts and belongs to neither, so handing
+the choice to one neighbour would advantage them permanently. See the Mainline deck reference.
+
+### Can I use an Interchange to reorder a train?
+
+**No.** Its printed car-sorting is not implemented. What the Interchange offers is the one Mainline
+card with a yard, so an **Extra may be made up and started there**. Re-ordering a consist is done at
+a **Small Yard** in a district.
+
+### Can I play attack cards on another player?
+
+No. All action and space-use cards are excluded from every dealt deck in every mode, and playing one
+is rejected.
+
+### Is multiplayer playable?
+
+**Yes.** Lobby, game codes, seating, bots, an authoritative server that survives restarts, per-seat
+reconnection and a replayed view of everyone else's turns — see §3.5 and §6. The opponent-directed
+cards are unimplemented in every mode, so there are no card attacks.
+
+### Why did my passenger train arrive with no coaches?
+
+Almost certainly the coach ratchet in §4.6: every coach has ended up in the Classification Yard,
+which comes back only when the Division Yard runs completely bare. The yard panel warns when this
+has happened, and a train made up short says so in the log.
+
+### Why is every option in the Small Yard marked "HELD at the Office"?
+
+Because that train is **already made up**, so every re-order on offer would break it — most often by
+moving the caboose off the rear, which §8.2 will not let a train depart with. If the train is *not*
+currently fit to run, at least one option will be marked "MADE UP, ready to leave".
+
+### Will an old save still replay?
+
+Not always. A save is a seed and the list of moves, replayed through the rules of whatever build
+opens it — so a change that makes a once-legal move illegal stops the replay at that move. The game
+names the move and leaves the file untouched; the build the game was played on will still finish it.
+
+## §8.1 in practice — what holds a train at the end of the line
+
+A train is held, released or put to the Superintendent by what is in the **Subdivision** ahead of
+it: the run of Mainline cards between two Control Points. Every Office that is not a Control Point
+lies inside one, so a table of Whistle Posts is a single Subdivision from end to end.
+
+- A train coming **towards** it is an absolute bar. The train holds, and the history says which
+  train is coming and that there is no Control Point between them to pass at.
+- A train going the **same way** is the Superintendent's ruling.
+- A card printing **"trains may pass"** excuses only what is standing on **that card**. It does not
+  clear the rest of the Subdivision.
+- A train **standing at an Office with no free A/D track** occupies the Subdivision too: it is about
+  to re-enter and there is nowhere for the two to pass. An Office with a track still free does not
+  hold anyone up.
+
+**An Office never holds more trains than it has A/D tracks.** A train the Interlocking is holding at
+the Limits takes the first track to free, ahead of anything arriving afterwards — and the train that
+arrives to find it taken is held at its own Limits, or collides if there is no Interlocking. A track
+freed by a departure counts too: the held train takes it at the end of that Mainline phase.

docs/rules/card-reference.md

@@ -4,6 +4,11 @@
 > 2026-07-30 in `docs/Deck cards2.xlsx`, `Trains3.pdf` and `Mainline Cards.pdf`, and is transcribed
 > in `src/engine/content.ts`. See [`implications.md`](implications.md) for the full comparison.
 >
+> **For what the cards say today, read [`as-built.md`](as-built.md)** — generated from
+> `content.ts` and checked against it by the test suite, so it cannot fall behind the way this file
+> did. For several releases `content.ts` named *this* page as the current reference while the banner
+> here said otherwise, and a reader following the code landed on the v0.4.5 deck.
+>
 > Kept for the reasoning it records — the economy analysis in §7 was how we knew what questions to
 > ask the design. **Do not use its numbers.**
 
@@ -42,14 +47,14 @@ Operational Rail wheel icon, an industry track of the stated length, Laborer ico
 | --- | --- | --- | ---: | ---: | ---: | ---: | ---: |
 | Mine Tipple | Hopper | Outbound only | 3 | 3 | — | 4 | 2 |
 | Produce Shed | Reefer | Outbound only | 2 | 2 | — | 3 | 2 |
-| Grocer's Warehouse | Boxcar | Both | 1 | 1 | 1 | 3 | 3 |
-| Oil Refinery | Tank car | Both | 1 | 1 | 1 | 4 | 3 |
-| Power Plant | Hopper | Inbound only | 3 | — | 3 | 4 | 2 |
+| Grocer's Warehouse | Boxcar or reefer | Inbound only | 1 | — | 1 | 3 | 3 |
+| Oil Refinery | Tank car | Outbound only | 1 | 1 | — | 4 | 3 |
+| Power Plant | Hopper or tank car | Inbound only | 3 | — | 3 | 4 | 2 |
 | Freight House | Boxcar | Both | 1 | 1 | 1 | — | 6 |
 
 Directions follow the commodity: coal originates at a Mine Tipple and is consumed at a Power Plant;
-produce ships out; a warehouse and a refinery do both. This gives §9 all three of its cases —
-outbound-only, inbound-only, and both.
+produce ships out; a warehouse receives. This gives §9 all three of its cases — outbound-only,
+inbound-only, and both — with the **Freight House the one card that does both**.
 
 **"Freight House" IS a card** (corrected v0.5.0) — a sixth industry, dealt 6 copies, one Laborer and
 one slot each direction. An earlier pass here read §9.3/Appendix A's "Passenger Facilities and
@@ -57,6 +62,15 @@ Freight Houses permit cars to move each direction" as meaning "Freight House" wa
 *collective term* for the Grocer's Warehouse and the Oil Refinery, never a card of its own — that
 reading was wrong; the engine deals it as a real sixth industry (`content.ts`'s `freightHouse`
 profile) and this table follows the engine.
+
+**The Grocer's Warehouse and the Oil Refinery are ONE-WAY** (corrected v0.4.9e). The Direction column
+read "Both" for both of them, and that was the *other half* of the same mistaken reading: if "Freight
+House" named those two, §9.3 had to be describing them, so they had to be two-way. Once the Freight
+House is its own card the argument evaporates, and playtesting settled it — "Grocer's Warehouse
+should be receive only, does not ship anything out"; "Refinery: only ships out tanks, does not
+receive anything" (Jesse). `home-deck.md` prints both that way, and the modifier
+set agrees: all three Refinery modifiers (Pipelines, Oil Depot, Viscosity Breakers) grant **+1
+outbound**, which would be an odd card set for a facility that receives half the time.
 <!-- TODO v0.5.0: Mine Tipple, Produce Shed and Power Plant above (3/3/4, 2/2/3, 3/3/4) were NOT
      re-verified against the engine in this pass — only Grocer's Warehouse, Oil Refinery and Freight
      House were. `mineTipple` and `powerPlant` in `content.ts` are also base 1/1/1, same as the three
@@ -91,9 +105,10 @@ deliberately slower industries, unable to quite keep up with a dedicated player.
 That is why Laborer counts track Outbound capacity: Mine Tipple 3/3, Power Plant 3/3, Produce Shed
 2/2, Grocer's Warehouse 2/2. The numbers are derived from the action budget, not chosen freely.
 
-The Oil Refinery is the exception at 3 Laborers against 2+2 capacity, and deliberately so: it serves
-two flows through one three-box pipeline, so its pipeline stays fuller than a one-way facility's and
-the third Laborer is earning its keep.
+<!-- The paragraph that stood here explained the Oil Refinery's third Laborer as the price of serving
+     two flows through one pipeline. It serves one flow (v0.4.9e), so the explanation is gone with the
+     premise; whether the Laborer count is still right is part of the same unverified block flagged
+     above and in TODO.md. -->
 
 Even so, Laborers are rarely what limits a player — spotting the empty car and hauling the loaded one
 away both cost switching actions from the same budget. See §7.
@@ -269,12 +284,12 @@ with all boxes full:
 | Car | Facility demand | Supply | Headroom |
 | --- | ---: | ---: | --- |
 | Hopper | Mine Tipple 3×2 + Power Plant 3×2 = 12 | 12 | exactly met |
-| Tank | Oil Refinery (2+2)×2 = 8 | 8 | exactly met |
-| Boxcar | Grocer's (2+2)×2 = 8 | 12 | 4 spare |
+| Tank | Oil Refinery 2×2 = 4 | 8 | 4 spare (was "exactly met" while the Refinery was two-way) |
+| Boxcar | Grocer's 2×2 = 4 | 12 | 8 spare (same correction) |
 | Reefer | Produce Shed 2×2 = 4 | 8 | 4 spare |
 | Coach | Terminal 4+4, per Office | 16 | scales with Office count |
 
-Hoppers and tank cars are exactly met in the theoretical worst case, which cannot occur in practice —
+Hoppers are exactly met in the theoretical worst case, which cannot occur in practice —
 only 10 freight facility cards exist across a 52-card deck shared by all players, and the §2.2
 Classification Yard recycle returns stock to the Division Yard whenever it empties. Both are worth
 watching in playtesting.

docs/rules/glossary.md

@@ -25,7 +25,7 @@ Every defined term, alphabetized for lookup. The core comes from the Definitions
 | **Extra Train** | A one-and-done train; its card returns to the Salvage Yard on completion. Head-on card image, so the drawing player picks its direction. Numbered with an "X" prefix; the following number gives its seniority, and it yields to the Timetabled train of that number. | §2.3, §8 |
 | **Facility** | A business which loads/unloads cargo and freight. | §2.5 |
 | **Freight Facility** | Mine Tipples, Produce Sheds, Grocer's Warehouses, Oil Refineries, Power Plants, Freight Houses. Some allow only outbound, some only inbound, some both. Per-card values in §12.5. | §9, §12.5 |
-| **Freight House** | A sixth Freight Facility card (corrected v0.5.0 — an earlier pass here read it as a collective term for the Grocer's Warehouse and the Oil Refinery rather than a card of its own; it is dealt like any other industry). Permits both directions, the same as a Grocer's Warehouse or Oil Refinery. | §9.3, §12.5 |
+| **Freight House** | A sixth Freight Facility card (corrected v0.5.0 — an earlier pass here read it as a collective term for the Grocer's Warehouse and the Oil Refinery rather than a card of its own; it is dealt like any other industry). **The only industry that permits both directions** — the Grocer's Warehouse receives and the Oil Refinery ships, one way each (v0.4.9e). | §9.3, §12.5 |
 | **Highball** | When a train holding at an Office automatically departs. | §2.4 |
 | **Home Office** | The primary face-down deck cards are drawn from. 52 cards. | §2.6, §12.1 |
 | **Hopper** | Coal rolling stock (brown = loaded, white = empty). | §2.2 |

docs/rules/implications.md

@@ -40,8 +40,9 @@ All nine answers are implemented, **170 tests passing**:
 
 | Answer | Implemented as |
 | --- | --- |
-| Q1 crossing time | `crossingStages()` — a 60 card takes 1 Stage, a 30 takes 2. Mainline nodes now carry a **terrain type** dealt at setup, and trains count down Stages instead of stepping through regions. The `Region` model is gone. |
-| Q2 Fast/Slow | Slow adds one Stage to every card. Hilly reads the consist (any coach = passenger). |
+| ~~Q1 crossing time~~ | **SUPERSEDED 2026-08-26 — see Q1a below.** Was: a 60 card takes 1 Stage, a 30 takes 2. |
+| ~~Q2 Fast/Slow~~ | **SUPERSEDED 2026-08-26 — see Q1a below.** Was: Slow adds one Stage to every card; Hilly reads the consist. |
+| Q1a crossing time | `crossingStages()` — a card costs one Stage per **region printed on it**, and where a train STARTS is what varies. Plains 1, Double Track 1, Trestle 1, Curves 2, Tunnel 2, Heavy Grade 3. The printed mph are scenery. Fast/Slow is read on Hilly and nowhere else. |
 | Q3 Expedite | An expedited train departs the Stage it arrives — it gets a second `moveTrain` in the same Mainline Phase, still subject to §8.1 clearance. |
 | Q4 Lockouts | `isLockedOut()` rejects the placement with `FACILITY_LOCKED`. |
 | Q5 Run-around | Nothing to do — reachability is geometric, so a built bypass already works. |
@@ -76,6 +77,39 @@ Crossing time never falls below one Stage — a train cannot cross in no time.
 there is nothing to build. A test asserts it remains TBD, to stop anyone "fixing" it by inventing
 an effect; a silent no-op would be worse than a rejection.
 
+**Q1a, answered by RAR 2026-08-26 (Gitea#3), and it replaces Q1 and Q2 together.**
+
+> "Ignore speed signs. They are just graphics. Regions shown on cards indicate how many stages it
+> takes to cross. Plains is 1. Double track is 1, tunnel is 2, curves is 2, heavy grade is 3 unless
+> you have help… Some cards say fast / slow. This is an indication that if on the train card, the
+> train is listed as fast or slow, that's starting position / how many stages it takes to traverse
+> the card. Fast / Slow does not apply to every card — just those that say fast / slow on them.
+> Currently this is only hilly."
+
+What this changes, against what was recorded before:
+
+- **The printed 60/30 mean nothing.** Q1 read them as crossing time; they are ambiance.
+- **Fast/Slow is not a global penalty.** Q2 added a Stage to every card for a Slow train, which is
+  what made a Slow train take two Stages to clear Double Track — the report that opened the issue.
+  It now applies on Hilly alone, where a fast train starts in the second region.
+- **Hilly no longer reads the consist.** RAR: "I notice that you are basing stages in mainline cards
+  off coach/non-coach. Actually, all trains are rated as FAST and SLOW."
+- **Heavy Grade is three regions, not two**, and the modifiers move the START rather than cutting the
+  clock: Helpers start an uphill train a region on, Brakeman a downhill one, Airbrakes another again.
+- **The Uncontrolled Siding and the Interchange print a back region** that is not part of the road. A
+  train running through starts past it; a train arriving to find the siding occupied takes it and
+  runs a region behind, which is what keeps the two apart, and an Extra beginning its run at an
+  Interchange starts there too.
+- **ABS holds a train off the card** rather than letting it collide, on any Mainline card.
+
+Measured consequence, replacing the one recorded under Q2: on a **3-player Division the Mainline
+cards themselves now cost a fast train ~5.6 Stages and a slow train ~6.0**, against ~5.4 and ~9.4
+before. Fast traffic is unchanged; **slow traffic is about a third quicker**, and the Fast/Slow gap
+across a whole Division collapses from roughly four Stages to less than one. The Q2 note that "every
+Slow train is still on the road when the next Day begins, holding its Crew Tray" no longer holds, so
+the `players + 3` tray count is due a re-examination — RAR's own closing worry: "been worried about
+the time it takes to cross the division. More thunking on this is needed."
+
 **Q11, answered from the source.** The Heavy Grade card prints **"(Up)"** and **"Player sets
 orientation"**, so which way it climbs is a property of the placed card, not a fixed compass
 direction. `DivisionNode.gradeUp` records the direction a train travels when **climbing**; a train
@@ -89,6 +123,28 @@ district — so whichever direction climbs advantages one neighbour over the oth
 has a fair claim to the decision. Orientation is **rolled** from the seed instead — deterministic,
 and roughly even (51/49 east/west across 400 games) — identically for solitaire and multiplayer.
 
+**Re-opened and closed again, 2026-08-23.** The question came back as "did we ever fix Heavy Grade
+to allow user placement of direction?", and the option of handing the choice to the **Superintendent**
+— the neutral office, which rotates with the Fedora every three Stages — was considered and rejected.
+Jesse's call: v0.5.0's ruling stands. What the re-examination surfaced, worth recording so this is not
+asked a third time:
+
+- **The advantage is permanent; the office is not.** Orientation decides which modifier cards pay for
+  the whole game (Brakeman and Airbrakes on the descent, Helpers on the climb) and therefore which
+  direction of traffic is favoured — and odd trains run west while even run east. A rotating office
+  making a one-way, once-and-for-all call does not dissolve the fairness problem, it just moves it.
+- **There is no setup phase to ask in.** `createGame` is pure and synchronous and the game opens at
+  Day 1, Stage 1, Local Operations. The question would have to interrupt play before the first turn,
+  and `clock.pendingDecision` is typed for clearance alone (`SuperintendentClearance | null`, read in
+  19 places), so a second decision kind would be most of the work.
+- **Most games never meet the card.** Since v0.6.2 deals the Mainline deck without replacement there
+  is at most one Heavy Grade in ten cards, drawn `players + 1` times: **20%** of solitaire games,
+  rising to 50% at four players. A pre-game interrupt for a rule four games in five never see.
+
+The docs were the actual defect. `README.md` still listed it among three open rules questions (all
+three closed in v0.5.0) and `mainline-deck.md` still said "the implementation
+needs a player-selection step to match the card". Both now say settled, and why.
+
 **Still not implemented**: the Action (10) and Space-use (12) cards, which are genuinely
 multiplayer-only. Playing them is rejected with `NOT_IMPLEMENTED`.
 
@@ -488,13 +544,19 @@ Hotel) are what grow them.
 
 | # | Name | Speed | Consist | Rule |
 | --- | --- | --- | --- | --- |
-| 1/2 | Crack Limited | Fast | 3 coaches | Stop at Terminals only. No switching. Expedite. |
+| 1/2 | Crack Limited | Fast | 3 coaches † | Stop at Terminals only. No switching. Expedite. |
 | 3/4 | Express | Fast | 2 freight | May drop or pick up one freight car at every location. Expedite. |
-| 5/6 | The Sparrow | Fast | 2 coaches | No switching. Expedite. |
+| 5/6 | The Sparrow | Fast | 2 coaches † | No switching. Expedite. |
 | 7/8 | Local | Slow | 1 freight + 1 coach | Coach must remain on station track if switching. |
 | 9/10 | Heavy Freight | Slow | 3 freight + caboose | |
 | 11/12 | Drag Freight | Slow | 2 freight + caboose | |
 
+† **The two coach counts have since been swapped by Jesse** (Gitea#7, 2026-08-22): the Crack Limited
+now carries **2** coaches and The Sparrow **3**. The table above is left as `Trains3.pdf` prints it,
+because that is what this section is for — what the design SAYS. What the game plays is
+`src/engine/content.ts`, with the per-card table in
+[`../home-deck.md`](../home-deck.md).
+
 ### Extras (X13–X22) — ten distinct trains, not four generic ones
 
 Appleseed Extra (MT freight only, may drop but not pick up), Fruit Growers Express (reefers only),
@@ -536,7 +598,7 @@ We modelled a Mainline card as **2 regions, uniform**. The design has **ten dist
 | Plains | 60 | |
 | Curves | 30 | |
 | Hilly | **P60 / F30** | different speeds for passenger and freight |
-| Heavy Grade (Up) | **G** | player sets orientation; Brakeman/Airbrakes/Helpers unlock better start positions |
+| Heavy Grade (Up) | **G** | player sets orientation †; Brakeman/Airbrakes/Helpers unlock better start positions |
 | Double Track | 60 | **trains may pass** |
 | Uncontrolled Siding | 60 | trains may pass; separate "no pass" and "passing" starts |
 | Tunnel | 30 | |
@@ -544,6 +606,10 @@ We modelled a Mainline card as **2 regions, uniform**. The design has **ten dist
 | Interchange | 60 | **sort cars into any new order**; has a Yard Limit. Printed "Yard" on the prototype card and renamed after play — it shared a word with the Division Yard, the Classification Yard, the Salvage Yard, the Yard Office and the Small Yard, and is none of them |
 | East / West Division Point | — | the ends |
 
+† **"Player sets orientation" is deliberately NOT implemented** — the table records what the card
+prints, which is what this section is for. The game rolls the uphill direction from the seed instead;
+settled v0.5.0, re-confirmed 2026-08-23, reasoning in §10 Q11 above.
+
 Each card shows **Start positions** — where a train enters depending on direction, train type, and
 which modifier cards are in play. The Heavy Grade card has five distinct starts (plain, brakemen,
 airbrakes, plain, helpers), so playing Brakeman literally moves your entry point further along.
@@ -785,3 +851,153 @@ Crossing is counted in Stages (Q1), so both trains simply run their counters dow
 Until this is settled the clearance buttons describe only what the engine actually does — they say
 the train "closes up behind" rather than promising a −5 risk that cannot occur. Wording that invents
 a consequence is worse than wording that under-sells one.
+
+---
+
+## §7 — where an Extra starts, and which way it runs
+
+**Reported from playing v0.4.9e** (Gitea#4): "When extras are played the player doing so may choose
+where the extra starts. They may choose either division point. And if the interchange mainline card
+has been played, they may start the extra on that card and choose the direction from there. If there
+is potential for conflict with other trains in that area the superintendent may hold the extra."
+
+**This supersedes an earlier ruling**, and the supersession is the interesting part. §2.3 gives every
+train its direction from its number — odd runs west, even runs east — and an earlier pass extended
+that to Extras explicitly: *"the number decides, like everything else on the timetable."* That reading
+cannot survive "either Division Point". An odd Extra placed at the WEST end would run west, leave the
+Division on its first move having crossed nothing, and be paid the completion Revenue for the run.
+
+So for **Extras only**, the start decides the direction:
+
+| Start | Direction |
+| --- | --- |
+| Western Division Point | east |
+| Eastern Division Point | west |
+| Interchange | player's choice |
+| Control Point (any Office above a Whistle Post) | player's choice |
+
+A timetabled train is unchanged: its number still decides. The Extra cards were always printed
+`direction: 'playerChoice'` (§5) and the engine had been overriding it; they now mean it.
+
+### The Interchange start is a YARD, not a spot on the running line
+
+§7's last clause — "the superintendent may hold the extra" — is what settles how this is modelled.
+An Extra started at an Interchange stands in that card's **yard**, off the running line, and highballs
+onto the card itself at a later Mainline Phase. Three things follow, all of them Jesse's rule rather
+than an implementation convenience:
+
+1. **Placing it can never force a collision**, however busy the card is. It is not on the road yet.
+2. **A guaranteed collision holds it in the yard** for another Stage, and it tries again next Stage.
+3. **A potential collision is the Superintendent's to rule on.**
+
+Those last two are exactly §8.1's two answers — an absolute bar against a facing train, a judgment
+call against a following one — so the Extra leaves the yard through the same clearance check a train
+leaves a Division Point through. Nothing new decides collisions.
+
+The Interchange keeps its printed "sort cars in new order" concept, still unimplemented (§6). Being
+the card with a Yard Limit is what makes it the one Mainline card a train can be made up on.
+
+### Which starts are offered is a setting
+
+The Division Points and the Interchange sit on shared ground and belong to nobody; starting an Extra
+inside a player's own district does not. That is a table preference rather than a rule, so it is set
+when the game is dealt (`extraStart`): Division Points and Interchange only, plus the playing
+player's own Control Point, or plus any player's Control Point. A **Whistle Post never qualifies at
+any setting** — being a place an Extra can start is part of what upgrading buys (§11).
+
+### Two bugs found underneath it
+
+- **The Mainline cards were rolled, not dealt.** `buildDivision` drew uniformly from the nine card
+  TYPES **with replacement**, so a Division could be dealt two Interchanges or two Tunnels, and
+  Plains — printed twice in the deck — carried the same weight as cards printed once.
+  `docs/mainline-deck.md` had already flagged the mismatch as needing
+  correction; "an Extra may start at the Interchange if one is on the board" is what forced it, since
+  that only reads as a rule if the board holds at most one. Now dealt from the printed ten-card deck
+  without replacement.
+- **An Extra started anywhere but a Division Point ran empty.** `isBeingMadeUp` asked only "is this
+  tray standing at a Division Point", which was the whole truth while that was the only place to
+  build a train — so the Control Point start had shipped since it was added with a train that could
+  never be given a consist, and the Interchange start would have shipped the same way. Found by
+  playing it, not by the tests, which had only ever asserted where the tray landed.
+
+---
+
+## §6.2 — which train cards may be discarded
+
+**SUPERSEDED ONCE. Read both rulings; the second narrows the first.**
+
+**Gitea#6, v0.4.9e playtest:** "Players are not allowed to discard Train cards. They may keep the
+card in their hand for multiple stages and even multiple days, but they may not discard it. If a
+player has three train cards in their hand, and they draw a fourth, then they must play one of those
+cards." Extras counted: an Extra is a train.
+
+**Gitea#9, 2026-08-24 — the ruling in force:** "Timetabled trains are at the choice of the player:
+they can either play or discard. If someone else wants to pick it up, they are more than able to.
+The reason: I don't want, if you decide to play a game longer than five days, to decide that maybe
+there are too many trains, the stations are jammed, and the railroad doesn't need any more. You can
+toss it. Someone else might disagree and pick it up."
+
+So the rule is now:
+
+- a **Timetabled** train may be discarded;
+- an **Extra** may not. It never joins the timetable, so it can never be what jams it, and the only
+  rule it would dodge by being thrown away is the hand limit;
+- **on `main` the Timetabled half is a New Game setting** (`discardTimetabled`, on by default),
+  because Jesse's reasoning is explicitly about LONG games and a five-Day game may well want
+  Gitea#6's pressure. The 0.4.9 playtest line has no scaffolding for a setting and takes the plain
+  rule. Both lines behave identically at their defaults.
+
+**"Someone else might disagree and pick it up" needed no machinery.** A discard already goes face-up
+onto a Department pile, and a Department pile is exactly what a rival draws from. The second half of
+the ruling was already built; only the first half was a change.
+
+§6.2 as transcribed says only "the player must reduce his hand to no more than three cards" with no
+exception for any card type, so both of these are rulings rather than gaps — the prototype rules do
+not address it either way.
+
+### It needs no forcing mechanism, and that is the point
+
+The interesting property of the rule is that the forced play falls out of two rules that already
+exist rather than needing a third:
+
+1. an undiscardable card is not among the ways to shed a card; and
+2. `draw.end` already refuses while the hand is over the limit (§6.2).
+
+A player holding four undiscardable trains therefore has exactly one legal way to conclude the turn —
+play one — without anything in the engine ever computing "you must play a train". The corner cannot
+lock a player in, because **playing a train card is unconditionally legal**: `card.play`'s train case
+refuses only a board placement, and a train card played when the timetable is full still leaves the
+hand (it simply schedules nothing). Confirmed by playing it: such a hand offers zero discards, no
+`draw.end`, and four plays.
+
+**Gitea#9 does not retire that corner, it narrows the way in.** With the setting on, the only hand
+that reaches it is four Extras; with the setting off it is any four trains, exactly as before.
+
+### One place decides, and the card says which rule refused
+
+`keepReason` (`src/engine/apply.ts`) returns the sentence a player should read, or `null` if the card
+may be discarded. `check`, the hand panel and the blocked "End Local Operations" button all ask it,
+so none of them can drift from the rule. It returns a SENTENCE rather than a boolean because there
+are now two distinct reasons — "an Extra is never discarded" and "not in this game" — and a panel
+that hard-codes one of them tells half the players the wrong thing. It reaches the page as the
+Frame's `handKeepWhy`.
+
+The bot needed no rule of its own either. `legal.ts` enumerates candidates and filters them through
+`check`, so the option stops being offered; and the developer bot already reaches for `card.play`
+before it reaches for a discard. Measured over 400 games: 400/400 finished, revenue unmoved, and
+**trains scheduled 1.2 → 1.3** — the rule's intended effect, small because a bot rarely held four.
+
+### Consequences
+
+- **Two of the three published replays discarded train cards** (2 and 15 of them) and were retired
+  and re-recorded. Jesse's call: "I'm okay with retiring the replays that no longer work under those
+  old rules."
+- **The opening six-card hand is not exempt.** Under *six random cards* a player opens holding six
+  against a limit of three; if four or more are trains, they all go onto the timetable on turn one.
+  Jesse's call: "If the opening hand has lots of trains, then lots of trains will be placed on the
+  board." Rare — roughly 1.5% of deals — but deliberate.
+- **The player is told, on the card and on the button.** `handDiscardable` on the Frame marks which
+  cards may be shed, the hand panel says so in the card's own tooltip, and when EVERY card held is a
+  train the blocked end-turn button changes its text to say a train must be played. That is the
+  Gitea#2 lesson applied: a rule the player cannot see is a board with nothing to click and no reason
+  given.

docs/rules/open-questions.md

@@ -670,10 +670,15 @@ balance work was possible.
 | --- | --- | --- | ---: | ---: | ---: | ---: |
 | Mine Tipple | Hopper | Outbound | 3 | 3 | — | 4 |
 | Produce Shed | Reefer | Outbound | 2 | 2 | — | 3 |
-| Grocer's Warehouse | Boxcar | Both | 2 | 2 | 2 | 3 |
-| Oil Refinery | Tank | Both | 3 | 2 | 2 | 4 |
+| Grocer's Warehouse | Boxcar | Inbound | 2 | — | 2 | 3 |
+| Oil Refinery | Tank | Outbound | 3 | 2 | — | 4 |
 | Power Plant | Hopper | Inbound | 3 | — | 3 | 4 |
 
+*Amended v0.4.9e.* The warehouse and the refinery were briefly "Both", on the reading that "Freight
+House" was a collective term for exactly those two and therefore what §9.3's "permit cars to move
+each direction" described. The Freight House turned out to be a card of its own (v0.5.0), and
+playtesting confirmed the one-way reading the sheet always printed.
+
 *Rationale.* Directions follow the commodity and give §9 all three of its stated cases. Bulk
 industries get more Laborers and a 4-car track so the types feel distinct when choosing what to
 build — but the counts stay moderate because Laborers are **not** the binding constraint (see 10e),

docs/rules/rules-v0.2.md

@@ -736,8 +736,8 @@ Modifier effects, and track geometries — is catalogued in
 | --- | --- | --- | ---: | ---: | ---: | ---: |
 | Mine Tipple | Hopper | Outbound | 3 | 3 | — | 4 |
 | Produce Shed | Reefer | Outbound | 2 | 2 | — | 3 |
-| Grocer's Warehouse | Boxcar | Both | 2 | 2 | 2 | 3 |
-| Oil Refinery | Tank | Both | 3 | 2 | 2 | 4 |
+| Grocer's Warehouse | Boxcar | Inbound | 2 | — | 2 | 3 |
+| Oil Refinery | Tank | Outbound | 3 | 2 | — | 4 |
 | Power Plant | Hopper | Inbound | 3 | — | 3 | 4 |
 
 | Office | Porters | Green slots | Red slots |
@@ -755,8 +755,10 @@ Modifier effects, and track geometries — is catalogued in
 | Section Gang | +1 Laborer or +1 Porter |
 
 **"Freight House"** (§9.3, Appendix A) is a Freight Facility card (corrected v0.5.0 — previously
-read as not a card, only a collective term for a facility that both loads and unloads). It permits
-both directions, the same as the Grocer's Warehouse and the Oil Refinery.
+read as not a card, only a collective term for a facility that both loads and unloads). It is the
+**only** industry that permits both directions: the Grocer's Warehouse receives and the Oil Refinery
+ships, one way each (corrected v0.4.9e from playtesting — the "Both" reading was the other half of
+the same mistake about what "Freight House" meant).
 
 ---
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "station-master",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "station-master",
-      "version": "0.5.0",
+      "version": "0.7.0",
       "devDependencies": {
         "@types/node": "^26.1.2",
         "typescript": "^7.0.2"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "station-master",
-  "version": "0.6.0",
+  "version": "0.8.4",
   "private": true,
   "type": "module",
   "description": "Station Master — a railroad operations game",
@@ -9,11 +9,14 @@
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "pretest": "node scripts/build-web.ts",
-    "test": "node --test test/*.test.ts test/**/*.test.ts",
+    "pretest": "tsc --noEmit && node scripts/build-web.ts",
+    "test": "node --test $(ls test/*.test.ts test/**/*.test.ts | grep -v '^test/sim.test.ts$')",
+    "pretest:sim": "tsc --noEmit",
+    "test:sim": "node --test test/sim.test.ts",
     "build:web": "node scripts/build-web.ts",
     "serve:web": "node scripts/build-web.ts && npx --yes http-server dist -p 8080 -c-1",
-    "deploy:web": "node scripts/deploy-web.ts"
+    "deploy:web": "node scripts/deploy-web.ts",
+    "build:cards": "node scripts/build-card-reference.ts"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",

playtests/README.md

@@ -0,0 +1,28 @@
+# Playtest saves
+
+Save files that came in with a bug report, or that were kept from a session worth re-reading.
+
+**Nothing in here is committed** — `.gitignore` keeps the directory empty as far as git is
+concerned, except for this file. They are somebody's game, not part of the project, and they go
+stale the moment the rules move.
+
+## What a save is
+
+A seed and the list of moves made — a few hundred bytes of JSON. That is enough to rebuild the
+whole game, which is why a replay can be emailed like a text file. Written by **Save replay** on the
+play screen; a multiplayer game's copy lives on the server, under its data directory.
+
+## How to open one
+
+Open `replays.html` on the site (or a local `npm run serve:web`) and use **Open a save file** at the
+bottom of the page — it takes a file straight off disk, no upload anywhere. Step through it frame by
+frame to find the position being reported.
+
+A save replays only under the rules it was dealt with; every save records them, and one written
+before a rules change may stop part-way. That is expected, and it is why these are kept beside a
+report rather than in the repository.
+
+## Publishing one
+
+A replay worth keeping for everyone goes in `public/replays/` instead, where the build publishes it
+into the site's replay directory with an index entry.

scripts/build-card-reference.ts

@@ -0,0 +1,227 @@
+/**
+ * Generate the card tables inside `docs/home-deck.md` and `docs/mainline-deck.md`.
+ *
+ * WHY GENERATED RATHER THAN WRITTEN. Nothing fails when a hand-written table falls behind a
+ * constant, so the tables are emitted from the same exported catalogues the engine instantiates
+ * from, and `test/card-reference.test.ts` re-runs this generator and asserts the checked-in docs
+ * match. Change a card face and the suite goes red until the docs are regenerated.
+ *
+ * EACH TABLE LANDS UNDER THE SECTION IT BELONGS TO, between a marker pair the deck documents carry:
+ *
+ *     <!-- BEGIN CARDS: track -->   …generated…   <!-- END CARDS: track -->
+ *
+ * Everything around the markers is hand-written and is never touched. Only the Mainline card table
+ * goes to `mainline-deck.md`; every other table belongs to the Home Office deck.
+ *
+ * `npm run build:cards` writes them. Nothing at runtime reads them; they are for people.
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  ACTION_CARDS, ALL_TRAINS, ENHANCEMENT_CARDS, ENHANCEMENT_RULES, EXTRA_TRAINS, INDUSTRY_PROFILES,
+  LIMITS_SUPPLY, MAINLINE_DECK, MAINLINE_MODIFIER_CARDS, MAINLINE_PROFILES, MANEUVER_CARDS,
+  MODIFIER_PROFILES, OFFICE_PROFILES, SPACE_USE_CARDS, TIMETABLED_TRAINS, TRACK_CARDS,
+  WHISTLE_POST_SUPPLY, consistSize, isOpponentOnly, mainlineDescription,
+} from '../src/engine/content.ts';
+import type { ConsistSpec, SimpleCard, TrainProfile, TrainRules } from '../src/engine/content.ts';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+/** Title Case a camelCase key, so `oneFreightPerLocation` reads as a rule rather than an identifier. */
+const words = (k: string): string => k.replace(/([A-Z])/g, ' $1').toLowerCase().trim();
+
+const consistOf = (c: ConsistSpec): string => {
+  const parts: string[] = [];
+  if (c.freight > 0) {
+    const kinds = c.freightTypes ? c.freightTypes.join(' or ') : 'freight';
+    parts.push(`${c.freight} ${kinds}${c.freight === 1 ? '' : c.freightTypes ? 's' : ''}`);
+  }
+  if (c.coach > 0) parts.push(`${c.coach} coach${c.coach === 1 ? '' : 'es'}`);
+  if (c.caboose > 0) parts.push(`${c.caboose} caboose`);
+  if (!parts.length) return 'engine only';
+  const n = consistSize(c);
+  // "Empties only" qualifies the whole consist rather than adding to it, so it reads after the count.
+  return `${parts.join(' + ')} (${n} piece${n === 1 ? '' : 's'})${c.emptiesOnly ? ', empties only' : ''}`;
+};
+
+const rulesOf = (r: TrainRules): string => {
+  const out: string[] = [];
+  for (const [k, v] of Object.entries(r)) {
+    if (k === 'note' || v === false || v === undefined) continue;
+    out.push(words(k));
+  }
+  if (typeof r.note === 'string') out.push(`*"${r.note}"*`);
+  return out.length ? out.join('; ') : '—';
+};
+
+const trainRow = (t: TrainProfile): string =>
+  `| ${t.isExtra ? 'X' : ''}${t.number} | ${t.name} | ${t.speed} | ` +
+  `${t.direction === 'playerChoice' ? "player's choice" : t.direction} | ${consistOf(t.consist)} | ${rulesOf(t.rules)} |`;
+
+/** Generated blocks, keyed by the marker name the deck documents wrap them in. */
+const blocks = new Map<string, string[]>();
+let current: string[] = [];
+/** Start a new generated block. Everything `w` writes lands here until the next `section`. */
+const section = (key: string): void => {
+  current = [];
+  blocks.set(key, current);
+};
+const w = (s = ''): void => void current.push(s);
+
+section('trains');
+w('### Timetabled');
+w();
+w('| # | Class | Speed | Runs | Consist | Printed rules |');
+w('| ---: | --- | --- | --- | --- | --- |');
+for (const t of TIMETABLED_TRAINS) w(trainRow(t));
+w();
+w('### Extras');
+w();
+w('| # | Class | Speed | Runs | Consist | Printed rules |');
+w('| ---: | --- | --- | --- | --- | --- |');
+for (const t of EXTRA_TRAINS) w(trainRow(t));
+w();
+section('mainline');
+w('| Card | Regions | Default entry | Fast / slow entry | Trains may pass | Extra may start |');
+w('| --- | ---: | ---: | --- | :---: | :---: |');
+for (const m of MAINLINE_PROFILES) {
+  const ss = m.speedStarts ? `${m.speedStarts.fast} / ${m.speedStarts.slow}` : '—';
+  w(`| ${m.name} | ${m.regions} | ${m.defaultStart} | ${ss} | ${m.trainsMayPass ? 'yes' : '—'} | ${m.sortsCars ? 'yes' : '—'} |`);
+}
+w();
+w(`The Mainline deck is ${MAINLINE_DECK.length} cards; the two Division Points are the fixed ends of`);
+w('the Division and are not dealt. What each card does, in the words the game uses on screen:');
+w();
+for (const m of MAINLINE_PROFILES) w(`- **${m.name}** — ${mainlineDescription(m.kind)}`);
+w();
+section('office');
+w('Upgrades are strictly sequential — no skipping a tier — so a Terminal needs all three cards in');
+w('order. Green slots are outbound passengers, red are inbound, and the design gives slots **equal**');
+w('to Porters rather than one more.');
+w();
+w('| Office | Control point | Passenger facility | A/D tracks | Porters | Green | Red |');
+w('| --- | :---: | :---: | ---: | ---: | ---: | ---: |');
+for (const o of OFFICE_PROFILES) {
+  w(`| ${o.name} | ${o.isControlPoint ? 'yes' : '—'} | ${o.isPassengerFacility ? 'yes' : '—'} | ` +
+    `${o.adTracks} | ${o.porters} | ${o.passengerOut} | ${o.passengerIn} |`);
+}
+w();
+w(`Whistle Posts are a fixed supply of ${WHISTLE_POST_SUPPLY} outside the deck, and Limits signs a`);
+w(`supply of ${LIMITS_SUPPLY}.`);
+w();
+section('facilities');
+w('Each lists the car types it works, which way its traffic flows, and the industries it may not sit');
+w('beside. **Every lockout pair is a producer and the consumer of the same commodity** — you may');
+w('build one end of a chain or the other, never both, which is what forces traffic to run between');
+w('districts rather than in circles inside one. No two of the same industry may share an Office Area,');
+w('and that rule is enforced for every kind rather than repeated in each row.');
+w();
+w('| Industry | Cars | Flow | Green | Red | Laborers | Locked out with |');
+w('| --- | --- | --- | ---: | ---: | ---: | --- |');
+for (const f of INDUSTRY_PROFILES) {
+  const lo = f.lockouts.length
+    ? f.lockouts.map((k) => INDUSTRY_PROFILES.find((p) => p.kind === k)?.name ?? k).join(', ')
+    : '—';
+  w(`| ${f.name} | ${f.carTypes.join(', ')} | ${f.flow} | ${f.baseOut} | ${f.baseIn} | ${f.baseLoaders} | ${lo} |`);
+}
+w();
+section('modifiers');
+w('Each sits beside a host and raises one of its capacities. `office` as a host means any Passenger');
+w('Facility — so a modifier that adds a green slot to an Office adds nothing to a Whistle Post, which');
+w('is not one.');
+w();
+w('| Modifier | Hosts | +Green | +Red | +Laborers | +Porters |');
+w('| --- | --- | ---: | ---: | ---: | ---: |');
+for (const m of MODIFIER_PROFILES) {
+  const hosts = m.hosts
+    .map((h) => (h === 'office' ? 'any Passenger Facility' : INDUSTRY_PROFILES.find((p) => p.kind === h)?.name ?? h))
+    .join(', ');
+  w(`| ${m.name} | ${hosts} | ${m.addOut || '—'} | ${m.addIn || '—'} | ${m.addLoaders || '—'} | ${m.addPorters || '—'} |`);
+}
+w();
+section('track');
+w('| Track | Geometry | Hand | Operational rail | Move cost | Dealt |');
+w('| --- | --- | --- | :---: | ---: | :---: |');
+for (const t of TRACK_CARDS) {
+  w(`| ${t.name} | ${t.geometry} | ${t.hand} | ${t.isOperationalRail ? 'yes' : '—'} | ${t.moveCost} | ${t.copiesInDeck ? 'yes' : 'no'} |`);
+}
+w();
+w('A row marked "no" is a shape the engine understands but the deck does not currently print.');
+w();
+section('enhancements');
+w('The column that only the implementation can fill in: **whether the printed effect actually');
+w('resolves yet.** `live` is read during play; `dormantSolo` is implemented at the point of attack');
+w('but the attack is an opponent-directed card held out of every deck, so nothing reaches it in a');
+w('solitaire game; `unbuilt` means the effect is recorded and nothing reads it. A transcription');
+w('cannot carry this column, which is the argument for generating the page rather than writing it.');
+w();
+w('| Enhancement | Placement | Requires | Effect resolves |');
+w('| --- | --- | --- | :---: |');
+for (const r of ENHANCEMENT_RULES) {
+  const card = ENHANCEMENT_CARDS.find((c) => c.key === r.key);
+  const needs = r.requiresOnSameCard
+    ? `${r.requiresOnSameCard} on the same card`
+    : r.requiresInDistrict
+      ? `${r.requiresInDistrict} in the district`
+      : '—';
+  w(`| ${card?.name ?? r.key} | ${r.placement} | ${needs} | **${r.effect}** |`);
+}
+w();
+section('opponent');
+w('**None of these is dealt in any deck today.** A card that can only be played at another player');
+w('has no legal target in a solitaire game, and a defence with nothing to defend against is as dead');
+w('a draw as the attack — so both halves are held out until the attacks are implemented. They are');
+w('listed because they are the design, and because what a defence answers is the only record of why');
+w('it exists.');
+w();
+const pvp = (title: string, cards: readonly SimpleCard[], category: string): void => {
+  w(`### ${title}${isOpponentOnly(category) ? ' — opponent-directed' : ''}`);
+  w();
+  w('| Card | Played on | Effect | Answers |');
+  w('| --- | --- | --- | --- |');
+  for (const c of cards) w(`| ${c.name} | ${c.placement} | ${c.effect} | ${c.answers ?? '—'} |`);
+  w();
+};
+pvp('Action cards', ACTION_CARDS, 'action');
+pvp('Space-use cards', SPACE_USE_CARDS, 'spaceUse');
+pvp('Maneuver cards', MANEUVER_CARDS, 'maneuver');
+w('Mainline modifier cards, for completeness — these ARE dealt:');
+w();
+w('| Card | Played on | Effect | Answers |');
+w('| --- | --- | --- | --- |');
+for (const c of MAINLINE_MODIFIER_CARDS) w(`| ${c.name} | ${c.placement} | ${c.effect} | ${c.answers ?? '—'} |`);
+w();
+
+/**
+ * Splice each block into its document, between the markers that name it.
+ *
+ * Strict on purpose: a block with nowhere to go, or a marker pair with no block, is a mistake that
+ * would otherwise show up as a silently missing table. Both throw.
+ */
+const WHERE: Record<string, string> = {
+  mainline: 'docs/mainline-deck.md',
+};
+const DEFAULT_DOC = 'docs/home-deck.md';
+
+const edited = new Map<string, string>();
+for (const [key, body] of blocks) {
+  const rel = WHERE[key] ?? DEFAULT_DOC;
+  const text = edited.get(rel) ?? readFileSync(join(root, rel), 'utf8');
+  const begin = `<!-- BEGIN CARDS: ${key} -->`;
+  const finish = `<!-- END CARDS: ${key} -->`;
+  const from = text.indexOf(begin);
+  const to = text.indexOf(finish);
+  if (from < 0 || to < 0) throw new Error(`${rel} has no markers for "${key}" — expected ${begin} … ${finish}`);
+  if (to < from) throw new Error(`${rel}: markers for "${key}" are the wrong way round`);
+  // Trailing blank lines are trimmed so the block sits the same way however the section ends.
+  const inner = body.join('\n').replace(/\n+$/, '');
+  edited.set(rel, `${text.slice(0, from + begin.length)}\n${inner}\n${text.slice(to)}`);
+}
+
+for (const [rel, text] of edited) {
+  writeFileSync(join(root, rel), text);
+  console.log(`built -> ${rel}`);
+}

scripts/build-web.ts

@@ -14,6 +14,9 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync,
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { DOC_PAGES, docPage } from './docs-page.ts';
+import { renderMarkdown } from './markdown.ts';
+
 const root = join(dirname(fileURLToPath(import.meta.url)), '..');
 /**
  * Overridable so a test can point the build at an isolated directory instead of the shared
@@ -60,7 +63,27 @@ execFileSync(
  */
 function buildStamp(): string {
   const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')) as { version: string };
-  let git = 'nogit';
+  /**
+   * THE FALLBACK HAS TO BE UNIQUE PER BUILD, because this string is also the cache-bust key.
+   *
+   * It used to be the literal `nogit`, which is exactly what the `.s9pk` build produces — the
+   * Dockerfile copies the working tree in without `.git`, so `git rev-parse` fails there every time.
+   * Every packaged release therefore published `?v=nogit`, byte-identical to the release before it,
+   * and a returning player's browser had no reason to refetch a single module. v0.7.5's setup screen
+   * and v0.7.6's fix to it both shipped correctly to `phoenix.local` and neither reached the browser
+   * that asked for them (Jesse, twice, 2026-08-29 — "setup did not work").
+   *
+   * A marker plus the build's own timestamp is always distinct, needs nothing from the environment,
+   * and stays honest: two builds of the same commit ARE two deploys, and a cache key that says so
+   * costs one refetch, while one that lies costs a release nobody receives.
+   *
+   * NOT THE VERSION, which is what this used to lead with. The stamp below already begins with
+   * `v${pkg.version}`, so on exactly the builds that take this path — every `.s9pk`, which has no
+   * `.git` — the header read "v0.8.0.10 · 0.8.0.10-mfq2p1 · …" and the version appeared twice
+   * (Jesse, playtest 2026-09-16). The timestamp alone carries the uniqueness; the version is
+   * already said once, properly, at the front.
+   */
+  let git = `nogit-${Date.now().toString(36)}`;
   try {
     const sha = execFileSync('git', ['rev-parse', '--short', 'HEAD'], { cwd: root })
       .toString()
@@ -168,6 +191,69 @@ if (existsSync(imageSrc)) {
   for (const f of readdirSync(imageSrc)) copyFileSync(join(imageSrc, f), join(imageOut, f));
 }
 
+/**
+ * The player-facing documentation, RENDERED and published beside the game.
+ *
+ * MARKDOWN IS STILL THE ONE COPY. `docs/*.md` is what is written and reviewed; this turns it into
+ * a page at build time. A hand-written HTML twin would drift from it on the first edit, which is
+ * the whole lesson of TODO #15a and of the documentation pass that found four references a month
+ * out of date.
+ *
+ * WHY RENDER AT ALL. They were served as `text/plain`, which is honest and unreadable: a card
+ * reference is mostly tables, and as plain text a table is rows of pipes. That was TODO #109, taken
+ * deliberately as the short version to get the references in front of testers for one round.
+ *
+ * NO MARKDOWN LIBRARY. `scripts/markdown.ts` covers the subset these five documents use, and this
+ * project has no runtime dependencies at all — one would be a poor first.
+ *
+ * THE `.md` IS PUBLISHED TOO, beside the page. It costs nothing, it is what a reader who wants the
+ * source or a diff actually wants, and it keeps every link that was handed out while the documents
+ * were served as text working rather than 404ing.
+ */
+const GUIDE_DOCS: readonly string[] = DOC_PAGES.map((d) => `${d.slug}.md`);
+
+/** `rules.md` → `rules.html`, so a link between documents lands on the rendered page. */
+const docLink = (href: string): string =>
+  /^https?:/.test(href) || href.startsWith('#') ? href : href.replace(/\.md(#|$)/, '.html$1');
+
+/**
+ * The title and version line, lifted out of the Markdown body.
+ *
+ * The documents open with `# Title` then `**Version x.y.z** · date`, and the page draws both in its
+ * own header — so rendering them again in the body would print each twice. Taken by pattern rather
+ * than by line count, and the body is only trimmed where the pattern actually matched.
+ */
+function splitHead(src: string): { title: string; version: string; body: string } {
+  const m = /^#\s+(.+?)\n+\*\*Version\s+([^*]+)\*\*\s*·\s*([^\n]+)\n/.exec(src);
+  if (!m) return { title: 'Station Master', version: '', body: src };
+  return {
+    title: m[1]!.replace(/^Station Master\s*[—-]\s*/, '').trim(),
+    version: `<b>Version ${m[2]!.trim()}</b> · ${m[3]!.trim()}`,
+    body: src.slice(m[0].length),
+  };
+}
+
+for (const rel of GUIDE_DOCS) {
+  const src = join(root, 'docs', rel);
+  if (!existsSync(src)) {
+    // Loud rather than silent: a missing document is a broken link on a page already published, and
+    // the build is the only place that can still notice.
+    console.error(`WARNING: docs/${rel} is missing — a published link will 404`);
+    continue;
+  }
+  const md = readFileSync(src, 'utf8');
+  const out = join(dist, rel);
+  mkdirSync(dirname(out), { recursive: true });
+  writeFileSync(out, md);
+
+  const { title, version, body } = splitHead(md);
+  const { html, headings } = renderMarkdown(body, docLink);
+  writeFileSync(
+    join(dist, rel.replace(/\.md$/, '.html')),
+    docPage({ slug: rel.replace(/\.md$/, ''), title, version, body: html, headings }),
+  );
+}
+
 // A tiny note for whoever unzips this later and wonders what it needs.
 writeFileSync(
   join(dist, 'README.txt'),

scripts/deploy-web.ts

@@ -1,11 +1,29 @@
 /**
- * Build the solitaire site and push it to a File Browser instance.
+ * Build the solitaire site and push it to a FileBrowser instance.
  *
- * Written against File Browser v2.63's REST API, read from its own bundle rather than guessed:
+ * REWRITTEN FOR **FileBrowser Quantum** (2026-08-23). The host was upgraded from File Browser v2.63
+ * to the Quantum fork, whose API is different in three ways at once, and every deploy failed with
+ * `login failed: 404 404 page not found` — the old `/api/login` simply is not there any more.
  *
- *   POST /api/login                          {username, password, recaptcha} -> JWT as plain text
- *   POST /api/resources/<dir>/               X-Auth: <jwt>                   -> create a directory
- *   POST /api/resources/<file>?override=true X-Auth: <jwt>, body = bytes     -> upload
+ * Read from the running instance's own bundle rather than guessed, the same way the v2.63 version
+ * was (`/public/static/assets/index-*.js`, gzipped — pipe it through `gunzip` before grepping), and
+ * each path confirmed against the live host by the response code: an endpoint that exists answers a
+ * bad password with **401**, one that does not answers **404**.
+ *
+ *   POST /api/auth/login?username=<u>&recaptcha=
+ *        headers X-Password: <urlencoded>, X-Secret: <otp or empty>   -> sets a session COOKIE
+ *   GET  /api/settings/sources                                        -> the named sources
+ *   POST /api/resources?path=<p>&source=<s>&isDir=true                -> create a directory
+ *   POST /api/resources?path=<p>&source=<s>&override=true  body=bytes -> upload
+ *
+ * THREE THINGS MOVED, and each would break on its own:
+ *   1. AUTH IS A COOKIE, not an `X-Auth: <jwt>` header. Login returns no usable token in its body;
+ *      the session arrives in `Set-Cookie` and every later request has to carry it back.
+ *   2. THE PASSWORD IS A HEADER, `X-Password`, URL-encoded — not a JSON body field.
+ *   3. THE PATH IS A QUERY PARAMETER, `?path=`, not part of the URL, and every resource call also
+ *      needs a **`source`** naming which configured store to write to. Quantum throws "no source
+ *      provided" without it. `FB_SOURCE` names it; left unset, the sole configured source is used,
+ *      and if there is more than one this stops and lists them rather than guessing.
  *
  * File Browser is the STORE, not the server — Start9 Pages serves the uploaded folder as the site.
  * So the job here is simply to land the built files in the right folder, intact.
@@ -18,6 +36,8 @@
  * Optional:
  *   FB_URL       default https://phoenix.local:58157
  *   FB_DEST      default websites/stationmaster — the folder Start9 Pages serves from
+ *   FB_SOURCE    which configured source to write to; discovered automatically when there is one
+ *   FB_OTP       the one-time code, if the account has two-factor enabled
  *   FB_INSECURE  set to 1 for a self-signed certificate (usual for a .local StartOS host)
  *   SITE_URL     default https://65.78.82.12:54697/ — the public address Start9 Pages serves at
  *   --dry-run    list what would be sent, contact nothing
@@ -44,6 +64,8 @@ const URL_BASE = (process.env['FB_URL'] ?? 'https://phoenix.local:58157').replac
 const DEST = `/${(process.env['FB_DEST'] ?? 'websites/stationmaster').replace(/^\/+|\/+$/g, '')}`;
 const USER = process.env['FB_USER'] ?? '';
 const PASS = process.env['FB_PASS'] ?? '';
+const OTP = process.env['FB_OTP'] ?? '';
+const SOURCE_ENV = process.env['FB_SOURCE'] ?? '';
 const DRY = process.argv.includes('--dry-run');
 
 /**
@@ -75,37 +97,80 @@ const CONTENT_TYPES: Record<string, string> = {
   '.txt': 'text/plain',
 };
 
+/**
+ * Log in and return the session cookie every later request must carry.
+ *
+ * The password goes in a HEADER and URL-encoded, which is Quantum's own client does
+ * (`X-Password: encodeURIComponent(password)`). The body carries nothing useful on success — the
+ * session is in `Set-Cookie`, so a deploy that ignored the cookie would authenticate and then be
+ * rejected by every upload.
+ */
 async function login(): Promise<string> {
-  const res = await fetch(`${URL_BASE}/api/login`, {
+  const url = `${URL_BASE}/api/auth/login?username=${encodeURIComponent(USER)}&recaptcha=`;
+  const res = await fetch(url, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ username: USER, password: PASS, recaptcha: '' }),
+    headers: { 'X-Password': encodeURIComponent(PASS), 'X-Secret': OTP },
   });
   const body = await res.text();
-  if (!res.ok) throw new Error(`login failed: ${res.status} ${body || res.statusText}`);
-  if (!body.trim()) throw new Error('login returned an empty token');
-  return body.trim();
-}
-
-async function makeDir(jwt: string, path: string): Promise<void> {
-  // Trailing slash is what marks a directory in this API. A 409 means it already exists, which is
-  // the normal case on every deploy after the first.
-  const res = await fetch(`${URL_BASE}/api/resources${encodePath(path)}/`, {
-    method: 'POST',
-    headers: { 'X-Auth': jwt },
-  });
-  if (!res.ok && res.status !== 409) {
-    throw new Error(`could not create ${path}: ${res.status} ${await res.text()}`);
+  if (!res.ok) {
+    // 401 here is a wrong username/password; 404 would mean this build has moved the API again.
+    throw new Error(`login failed: ${res.status} ${body || res.statusText}`);
   }
+  const cookies = res.headers.getSetCookie();
+  if (cookies.length === 0) throw new Error('login succeeded but set no session cookie');
+  return cookies.map((c) => c.split(';')[0]).join('; ');
 }
 
-async function upload(jwt: string, localPath: string, remotePath: string): Promise<void> {
+/**
+ * WHICH STORE TO WRITE TO. Quantum can serve several named sources and refuses any resource call
+ * that does not name one ("no source provided"), which is the parameter the v2.63 API had no
+ * concept of. One configured source is the normal case and is used without asking; more than one is
+ * ambiguous, and guessing would silently deploy the site into the wrong store.
+ */
+async function resolveSource(cookie: string): Promise<string> {
+  if (SOURCE_ENV) return SOURCE_ENV;
+  const res = await fetch(`${URL_BASE}/api/settings/sources`, { headers: { cookie } });
+  if (!res.ok) throw new Error(`could not list sources: ${res.status} ${await res.text()}`);
+  const names = Object.keys((await res.json()) ?? {});
+  if (names.length === 1) return names[0]!;
+  if (names.length === 0) throw new Error('the server reports no sources at all');
+  throw new Error(`several sources configured (${names.join(', ')}) — pick one with FB_SOURCE=<name>`);
+}
+
+function resourceUrl(source: string, path: string, extra: Record<string, string>): string {
+  const params = new URLSearchParams({ path, source, ...extra });
+  return `${URL_BASE}/api/resources?${params}`;
+}
+
+async function makeDir(cookie: string, source: string, path: string): Promise<void> {
+  const res = await fetch(resourceUrl(source, path, { isDir: 'true' }), {
+    method: 'POST',
+    headers: { cookie },
+  });
+  if (res.ok) return;
+  /**
+   * "Already there" is the normal case on every deploy after the first, and Quantum is not
+   * consistent about which code it reports it with. So the two failures worth stopping for are
+   * named — a rejected session, and a server that broke — and every other 4xx is treated as the
+   * directory already existing. A directory that genuinely is not there fails loudly at the upload
+   * a moment later, which is a better place to find out than a guess here.
+   */
+  const fatal = res.status === 401 || res.status === 403 || res.status >= 500;
+  if (fatal) throw new Error(`could not create ${path}: ${res.status} ${await res.text()}`);
+}
+
+async function upload(
+  cookie: string,
+  source: string,
+  localPath: string,
+  remotePath: string,
+): Promise<void> {
   const bytes = readFileSync(localPath);
   const ext = remotePath.slice(remotePath.lastIndexOf('.'));
-  const res = await fetch(`${URL_BASE}/api/resources${encodePath(remotePath)}?override=true`, {
+  const res = await fetch(resourceUrl(source, remotePath, { override: 'true' }), {
     method: 'POST',
     headers: {
-      'X-Auth': jwt,
+      cookie,
       'Content-Type': CONTENT_TYPES[ext] ?? 'application/octet-stream',
       'Content-Length': String(bytes.byteLength),
     },
@@ -114,11 +179,6 @@ async function upload(jwt: string, localPath: string, remotePath: string): Promi
   if (!res.ok) throw new Error(`upload ${remotePath} failed: ${res.status} ${await res.text()}`);
 }
 
-/** Encode each segment but keep the separators, so a path stays a path. */
-function encodePath(p: string): string {
-  return p.split('/').map(encodeURIComponent).join('/');
-}
-
 // ---------------------------------------------------------------------------
 
 console.log('building…');
@@ -147,15 +207,16 @@ if (DRY) {
     );
   }
 
-  const jwt = await login();
-  console.log('logged in');
+  const cookie = await login();
+  const source = await resolveSource(cookie);
+  console.log(`logged in — writing to source "${source}"`);
 
-  await makeDir(jwt, DEST);
-  for (const d of dirs) await makeDir(jwt, `${DEST}/${d}`);
+  await makeDir(cookie, source, DEST);
+  for (const d of dirs) await makeDir(cookie, source, `${DEST}/${d}`);
 
   let done = 0;
   for (const f of files) {
-    await upload(jwt, join(dist, f), `${DEST}/${f}`);
+    await upload(cookie, source, join(dist, f), `${DEST}/${f}`);
     done++;
     console.log(`  [${String(done).padStart(2)}/${files.length}] ${f}`);
   }

scripts/docs-page.ts

@@ -0,0 +1,197 @@
+/**
+ * The page a documentation file is rendered into.
+ *
+ * ONE TEMPLATE FOR ALL FIVE, so the guide reads as one publication rather than five files that
+ * happen to be linked. It carries the same dark palette, the same type and the same blue as the
+ * game, because a player arrives here from the board and should not feel they have left the site.
+ *
+ * WHAT THE PAGE ADDS OVER THE MARKDOWN, and why each is here rather than in the source:
+ *
+ *   - a **nav** across the five documents, so the set is navigable from any one of them. The
+ *     Markdown cannot carry this: it would have to be repeated in every file and would drift.
+ *   - a **contents list** built from the headings actually rendered, so it cannot fall out of step
+ *     with the document the way a hand-written one does.
+ *   - **anchors** on every heading, so a section can be linked to in a bug report.
+ *   - a **measure** of about 70 characters. Long lines are the single biggest thing making plain
+ *     text hard to read, and these documents are long.
+ *
+ * PRINTS SANELY TOO: the nav and contents drop out, the palette goes to ink on paper, and tables
+ * keep their rules. A rules reference is a thing people print.
+ */
+
+import type { Heading } from './markdown.ts';
+
+export type DocPage = {
+  /** Published filename, without the extension — also the nav's identity for "you are here". */
+  slug: string;
+  /** What the nav calls it. */
+  nav: string;
+};
+
+export const DOC_PAGES: readonly DocPage[] = [
+  { slug: 'quickstart', nav: 'Quickstart' },
+  { slug: 'rules', nav: 'Rules' },
+  { slug: 'home-deck', nav: 'Home deck' },
+  { slug: 'mainline-deck', nav: 'Mainline deck' },
+  { slug: 'components', nav: 'Components' },
+];
+
+export const DOCS_CSS = `
+:root{
+  --bg:#12161c; --panel:#161b22; --line:#2c333d; --fg:#cfd6e0; --dim:#8b94a3;
+  --head:#cfe0f5; --link:#5aa9e6; --accent:#9fb6d8; --rule:#39424e;
+}
+*{box-sizing:border-box}
+html{scroll-behavior:smooth}
+body{
+  margin:0;background:var(--bg);color:var(--fg);
+  font:15px/1.65 ui-sans-serif,system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
+  -webkit-text-size-adjust:100%;
+}
+a{color:var(--link)}
+a:hover{color:#9fd0f5}
+
+/* THE NAV. Sticky, because these documents are long and the set has to stay reachable from the
+   middle of one. Horizontally scrollable on a phone rather than wrapping into three rows. */
+.docnav{
+  position:sticky;top:0;z-index:5;background:var(--panel);border-bottom:1px solid var(--line);
+  display:flex;align-items:center;gap:4px;padding:8px 16px;overflow-x:auto;
+}
+.docnav .home{color:var(--head);font-weight:700;margin-right:10px;text-decoration:none;white-space:nowrap}
+.docnav a.tab{
+  color:var(--dim);text-decoration:none;padding:4px 10px;border-radius:6px;white-space:nowrap;
+  border:1px solid transparent;font-size:13px;
+}
+.docnav a.tab:hover{color:var(--fg);background:#1f2733}
+.docnav a.tab[aria-current="page"]{color:#f2e6cf;background:#2b3444;border-color:#c8912f}
+
+.wrap{max-width:78ch;margin:0 auto;padding:22px 16px 72px}
+
+/* THE HEADER — what this document is and which build it describes, lifted out of the prose so the
+   version is the first thing on the page, as the process rules require. */
+.dochead{border-bottom:1px solid var(--rule);padding-bottom:12px;margin-bottom:8px}
+.dochead h1{margin:0 0 6px;font-size:26px;line-height:1.25;color:var(--head);letter-spacing:.01em}
+.dochead .ver{color:var(--dim);font-size:13px}
+.dochead .ver b{color:#c8912f;font-weight:700}
+
+/* CONTENTS, built from the headings actually rendered. Collapsed by default on a phone. */
+.toc{background:var(--panel);border:1px solid var(--line);border-radius:8px;padding:10px 14px;margin:18px 0 26px}
+.toc summary{cursor:pointer;color:var(--accent);font-size:13px;font-weight:600;letter-spacing:.04em;text-transform:uppercase}
+.toc ol{list-style:none;margin:10px 0 2px;padding:0;columns:2;column-gap:26px}
+.toc li{margin:0 0 4px;break-inside:avoid}
+.toc li.l3{padding-left:14px;font-size:13px}
+.toc a{text-decoration:none;color:var(--fg)}
+.toc a:hover{color:var(--link)}
+@media (max-width:640px){.toc ol{columns:1}}
+
+h2,h3,h4{color:var(--head);line-height:1.3;margin:28px 0 8px}
+h2{font-size:20px;border-bottom:1px solid var(--rule);padding-bottom:5px}
+h3{font-size:16px}
+h4{font-size:14px;color:var(--accent);text-transform:uppercase;letter-spacing:.05em}
+p{margin:0 0 12px}
+strong{color:#e8eef7}
+hr{border:none;border-top:1px solid var(--rule);margin:26px 0}
+
+/* The anchor beside a heading: invisible until the heading is hovered, so it never competes with
+   the words but is always there to copy. */
+.anchor{margin-left:.45em;color:var(--rule);text-decoration:none;font-weight:400;opacity:0}
+h1:hover .anchor,h2:hover .anchor,h3:hover .anchor,h4:hover .anchor{opacity:1}
+.anchor:hover{color:var(--link)}
+
+ul,ol{margin:0 0 12px;padding-left:22px}
+li{margin:0 0 5px}
+li>ul,li>ol{margin-top:5px}
+
+code{background:#1d232c;border:1px solid var(--line);border-radius:4px;padding:1px 5px;
+  font:13px ui-monospace,SFMono-Regular,Menlo,monospace;color:#e0c89a}
+pre{background:#1d232c;border:1px solid var(--line);border-radius:7px;padding:12px 14px;overflow-x:auto}
+pre code{background:none;border:none;padding:0;color:var(--fg)}
+
+blockquote{
+  margin:16px 0;padding:10px 14px;background:#181f28;
+  border-left:3px solid #c8912f;border-radius:0 7px 7px 0;
+}
+blockquote > :last-child{margin-bottom:0}
+
+/* TABLES THAT LOOK LIKE TABLES. This is the whole reason the documentation is rendered rather than
+   served as text: a card reference is mostly tables, and as plain text they are rows of pipes. */
+.tablewrap{overflow-x:auto;margin:0 0 16px;border:1px solid var(--line);border-radius:8px}
+table{border-collapse:collapse;width:100%;font-size:14px}
+thead th{
+  background:#1f2733;color:var(--accent);text-align:left;font-weight:600;
+  padding:8px 12px;border-bottom:1px solid var(--line);white-space:nowrap;
+}
+td{padding:7px 12px;border-bottom:1px solid #222a34;vertical-align:top}
+tbody tr:last-child td{border-bottom:none}
+tbody tr:nth-child(even){background:#151a21}
+tbody tr:hover{background:#1b222b}
+.ta-right{text-align:right;font-variant-numeric:tabular-nums}
+.ta-center{text-align:center}
+th.ta-right,th.ta-center{text-align:inherit}
+
+footer{margin-top:40px;padding-top:14px;border-top:1px solid var(--rule);color:var(--dim);font-size:12px}
+footer a{color:var(--accent)}
+
+@media print{
+  .docnav,.toc,.anchor{display:none}
+  body{background:#fff;color:#111;font-size:11pt}
+  h1,h2,h3,h4,strong{color:#000}
+  a{color:#000;text-decoration:underline}
+  .wrap{max-width:none;padding:0}
+  .tablewrap{border-color:#999}
+  thead th{background:#eee;color:#000;border-bottom-color:#999}
+  td{border-bottom-color:#ccc}
+  tbody tr:nth-child(even){background:#f6f6f6}
+  blockquote{background:#f4f4f4;border-left-color:#888}
+  code,pre{background:#f4f4f4;border-color:#ccc;color:#111}
+}
+`;
+
+/** The contents list, from the headings the renderer actually produced. */
+function toc(headings: readonly Heading[]): string {
+  // h2 and h3 only: h1 is the page title, and h4 is a label inside a section rather than a place.
+  const items = headings.filter((h) => h.level === 2 || h.level === 3);
+  if (items.length < 3) return '';
+  const lis = items
+    .map((h) => `<li class="l${h.level}"><a href="#${h.id}">${h.text.replace(/&/g, '&amp;').replace(/</g, '&lt;')}</a></li>`)
+    .join('');
+  return `<details class="toc" open><summary>On this page</summary><ol>${lis}</ol></details>`;
+}
+
+export function docPage(opts: {
+  slug: string;
+  title: string;
+  version: string;
+  body: string;
+  headings: readonly Heading[];
+}): string {
+  const tabs = DOC_PAGES.map(
+    (d) =>
+      `<a class="tab" href="./${d.slug}.html"${d.slug === opts.slug ? ' aria-current="page"' : ''}>${d.nav}</a>`,
+  ).join('');
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${opts.title} — Station Master</title>
+<style>${DOCS_CSS}</style>
+</head>
+<body>
+<nav class="docnav"><a class="home" href="./index.html">Station Master</a>${tabs}</nav>
+<div class="wrap">
+  <header class="dochead">
+    <h1>${opts.title}</h1>
+    <div class="ver">${opts.version}</div>
+  </header>
+  ${toc(opts.headings)}
+  ${opts.body}
+  <footer>
+    Station Master — <a href="./index.html">back to the game</a> ·
+    these references are kept current with every release.
+  </footer>
+</div>
+</body>
+</html>
+`;
+}

scripts/markdown.ts

@@ -0,0 +1,286 @@
+/**
+ * A small Markdown renderer, for the player-facing documentation only.
+ *
+ * WHY NOT A LIBRARY. This project has no runtime dependencies at all, and the guide uses a small,
+ * known subset of Markdown — headings, paragraphs, lists, tables, links, code spans, block quotes
+ * and rules. A Markdown library would be the first dependency in the tree, pulled in to render five
+ * files whose whole vocabulary fits below. `docs/` is written by hand, not by users, so this does
+ * not have to survive hostile input; it has to render what those five documents actually contain
+ * and fail loudly on anything else.
+ *
+ * WHY NOT HAND-WRITTEN HTML. The Markdown is the one copy (TODO #15a). An HTML twin drifts from it
+ * on the first edit, which is the failure the whole documentation pass was about.
+ *
+ * ESCAPING IS UNCONDITIONAL. Every scrap of text goes through `esc` before any markup is added, and
+ * the inline pass only ever inserts tags around already-escaped content. A `<` in the prose is a
+ * less-than sign, not the start of an element — there is no raw-HTML passthrough, deliberately.
+ */
+
+/** HTML-escape. Ampersand first, or it double-escapes the entities added after it. */
+export function esc(s: string): string {
+  return s
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+}
+
+/** A heading found while rendering, for the contents list the page builds from it. */
+export type Heading = { level: number; text: string; id: string };
+
+/**
+ * `## 3. The shape of a Stage` → `the-shape-of-a-stage`.
+ *
+ * The leading number is dropped: it is a position in the document, and a link that carries it
+ * breaks when a section is inserted above. Duplicate slugs get a numeric suffix rather than
+ * silently pointing at the first one.
+ */
+function slug(text: string, taken: Set<string>): string {
+  const base =
+    text
+      .toLowerCase()
+      // A whole section number, dotted or not: "4.2 Local Operations" and "7. FAQ" both lose it.
+      .replace(/^\d+(?:\.\d+)*[.)]?\s+/, '')
+      .replace(/[^a-z0-9]+/g, '-')
+      .replace(/^-+|-+$/g, '') || 'section';
+  let id = base;
+  for (let n = 2; taken.has(id); n++) id = `${base}-${n}`;
+  taken.add(id);
+  return id;
+}
+
+/**
+ * Inline markup, applied to text that is ALREADY escaped.
+ *
+ * Order matters: code spans are taken out first and put back last, so `**` inside backticks stays
+ * literal. That is not a corner case here — the rules reference quotes field names like
+ * `**Version**` when describing the page header.
+ */
+function inline(escaped: string, linkHref: (href: string) => string): string {
+  const code: string[] = [];
+  let s = escaped.replace(/`([^`]+)`/g, (_m, body: string) => {
+    code.push(`<code>${body}</code>`);
+    return `\u0000${code.length - 1}\u0000`;
+  });
+
+  // Links: [text](target). The target is rewritten so a link between documents lands on the
+  // rendered page rather than the Markdown source.
+  s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_m, text: string, href: string) => {
+    const target = linkHref(href);
+    const external = /^https?:/.test(target);
+    return `<a href="${target}"${external ? ' target="_blank" rel="noopener"' : ''}>${text}</a>`;
+  });
+
+  // Bold before italic, or `**x**` is read as an empty italic wrapping a bold.
+  s = s.replace(/\*\*([^*]+)\*\*/g, '<strong>$1</strong>');
+  s = s.replace(/(^|[\s(])\*([^*\n]+)\*/g, '$1<em>$2</em>');
+
+  return s.replace(/\u0000(\d+)\u0000/g, (_m, i: string) => code[Number(i)]!);
+}
+
+/** One table row's cells, from `| a | b |`. */
+function cells(line: string): string[] {
+  return line
+    .replace(/^\s*\|/, '')
+    .replace(/\|\s*$/, '')
+    .split('|')
+    .map((c) => c.trim());
+}
+
+/** `---`, `:--`, `--:` and `:-:` → the CSS alignment a column wants. */
+function alignments(sep: string): (string | null)[] {
+  return cells(sep).map((c) => {
+    const left = c.startsWith(':');
+    const right = c.endsWith(':');
+    if (left && right) return 'center';
+    if (right) return 'right';
+    if (left) return 'left';
+    return null;
+  });
+}
+
+const isTableSep = (line: string): boolean => /^\s*\|?[\s:|-]+\|[\s:|-]*$/.test(line) && line.includes('-');
+
+export type Rendered = { html: string; headings: Heading[] };
+
+/**
+ * Render a Markdown document to HTML.
+ *
+ * `linkHref` rewrites link targets — the build uses it to send `rules.md` to `rules.html` — and
+ * defaults to leaving them alone so the function is testable on its own.
+ */
+/**
+ * One list at one indent level. An item is its first line plus any lines indented under it; the
+ * more-indented BULLETS among those are the item's own nested list and render recursively, while
+ * plain indented lines are wrapped continuations of its text.
+ */
+function listHtml(block: string[], text: (s: string) => string): string {
+  const first = /^(\s*)([-*+]|\d+[.)])\s+/.exec(block.find((l) => l.trim() !== '') ?? '');
+  if (!first) return '';
+  const ordered = /\d/.test(first[2]!);
+  const base = first[1]!.length;
+  const items: { text: string[]; sub: string[] }[] = [];
+  for (const l of block) {
+    const m = /^(\s*)([-*+]|\d+[.)])\s+(.*)$/.exec(l);
+    const current = items[items.length - 1];
+    if (m && m[1]!.length <= base) {
+      items.push({ text: [m[3]!], sub: [] });
+    } else if (!current) {
+      continue;
+    } else if (current.sub.length > 0 || (m && m[1]!.length > base)) {
+      // Once a nested list has begun, everything further belongs to it, wrapped lines included.
+      current.sub.push(l);
+    } else if (l.trim() !== '') {
+      current.text.push(l.trim());
+    }
+  }
+  const tag = ordered ? 'ol' : 'ul';
+  return (
+    `<${tag}>` +
+    items.map((it) => `<li>${text(it.text.join(' '))}${it.sub.length > 0 ? listHtml(it.sub, text) : ''}</li>`).join('') +
+    `</${tag}>`
+  );
+}
+
+export function renderMarkdown(src: string, linkHref: (href: string) => string = (h) => h): Rendered {
+  const lines = src.replace(/\r\n/g, '\n').split('\n');
+  const out: string[] = [];
+  const headings: Heading[] = [];
+  const taken = new Set<string>();
+  const ln = (s: string): void => void out.push(s);
+  const text = (s: string): string => inline(esc(s), linkHref);
+
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i]!;
+
+    // The generated-card markers, and any other HTML comment: structural, never shown.
+    if (/^\s*<!--/.test(line)) {
+      while (i < lines.length && !lines[i]!.includes('-->')) i++;
+      i++;
+      continue;
+    }
+
+    if (line.trim() === '') {
+      i++;
+      continue;
+    }
+
+    if (/^\s*(---|\*\*\*|___)\s*$/.test(line)) {
+      ln('<hr>');
+      i++;
+      continue;
+    }
+
+    const heading = /^(#{1,6})\s+(.*)$/.exec(line);
+    if (heading) {
+      const level = heading[1]!.length;
+      const raw = heading[2]!.trim();
+      const id = slug(raw, taken);
+      headings.push({ level, text: raw.replace(/[*`]/g, ''), id });
+      // The anchor is a link to itself, so a section can be pointed at without a separate widget.
+      ln(
+        `<h${level} id="${id}">${text(raw)}` +
+          `<a class="anchor" href="#${id}" aria-label="Link to this section">#</a></h${level}>`,
+      );
+      i++;
+      continue;
+    }
+
+    // Fenced code.
+    if (/^\s*```/.test(line)) {
+      i++;
+      const body: string[] = [];
+      while (i < lines.length && !/^\s*```/.test(lines[i]!)) body.push(lines[i++]!);
+      i++;
+      ln(`<pre><code>${esc(body.join('\n'))}</code></pre>`);
+      continue;
+    }
+
+    // Tables: a header row, an alignment row, then body rows.
+    if (line.includes('|') && i + 1 < lines.length && isTableSep(lines[i + 1]!)) {
+      const head = cells(line);
+      const align = alignments(lines[i + 1]!);
+      i += 2;
+      const body: string[][] = [];
+      while (i < lines.length && lines[i]!.includes('|') && lines[i]!.trim() !== '') body.push(cells(lines[i++]!));
+      const th = head
+        .map((c, n) => `<th${align[n] ? ` class="ta-${align[n]}"` : ''}>${text(c)}</th>`)
+        .join('');
+      const rows = body
+        .map(
+          (r) =>
+            '<tr>' +
+            r.map((c, n) => `<td${align[n] ? ` class="ta-${align[n]}"` : ''}>${text(c)}</td>`).join('') +
+            '</tr>',
+        )
+        .join('');
+      // Wrapped so a wide table scrolls inside the page rather than widening it on a phone.
+      ln(`<div class="tablewrap"><table><thead><tr>${th}</tr></thead><tbody>${rows}</tbody></table></div>`);
+      continue;
+    }
+
+    // Block quote: consecutive `>` lines, rendered through this same function so a quote may hold
+    // a list or a table — the rules reference puts both inside one.
+    if (/^\s*>/.test(line)) {
+      const body: string[] = [];
+      while (i < lines.length && /^\s*>/.test(lines[i]!)) body.push(lines[i++]!.replace(/^\s*>\s?/, ''));
+      ln(`<blockquote>${renderMarkdown(body.join('\n'), linkHref).html}</blockquote>`);
+      continue;
+    }
+
+    // Lists. A bullet or a number opens one; continuation lines are indented under their item, and
+    // a more-indented bullet under an item is a nested list, rendered by recursion (v0.8.4 — the
+    // comment said so before and the code appended the nested bullet to its parent as text, so the
+    // published home-deck page carried a literal "- " mid-sentence).
+    const bullet = /^(\s*)([-*+]|\d+[.)])\s+(.*)$/.exec(line);
+    if (bullet) {
+      const baseIndent = bullet[1]!.length;
+      const block: string[] = [];
+      while (i < lines.length) {
+        const l = lines[i]!;
+        if (l.trim() === '') {
+          // A blank line ends the list unless the next line is still inside it.
+          const next = lines[i + 1] ?? '';
+          const continues = /^(\s*)([-*+]|\d+[.)])\s+/.test(next) || /^\s{2,}\S/.test(next);
+          if (!continues) break;
+          block.push('');
+          i++;
+          continue;
+        }
+        const m = /^(\s*)([-*+]|\d+[.)])\s+/.exec(l);
+        if ((m && m[1]!.length <= baseIndent) || (m && m[1]!.length > baseIndent) || /^\s{2,}\S/.test(l)) {
+          block.push(l);
+          i++;
+          continue;
+        }
+        break;
+      }
+      ln(listHtml(block, text));
+      continue;
+    }
+
+    // Anything else is a paragraph, running to the next blank line or block opener.
+    const para: string[] = [];
+    while (i < lines.length) {
+      const l = lines[i]!;
+      if (
+        l.trim() === '' ||
+        /^(#{1,6})\s/.test(l) ||
+        /^\s*>/.test(l) ||
+        /^\s*```/.test(l) ||
+        /^\s*<!--/.test(l) ||
+        /^\s*(---|\*\*\*|___)\s*$/.test(l) ||
+        /^(\s*)([-*+]|\d+[.)])\s+/.test(l) ||
+        (l.includes('|') && isTableSep(lines[i + 1] ?? ''))
+      ) {
+        break;
+      }
+      para.push(l.trim());
+      i++;
+    }
+    if (para.length) ln(`<p>${text(para.join(' '))}</p>`);
+  }
+
+  return { html: out.join('\n'), headings };
+}

src/engine/events.ts

@@ -19,8 +19,8 @@
  * reconstruct the whole board to draw one frame.
  */
 
-import type { CarType, OfficeTier } from './content.ts';
-import type { LocalOpsOption } from './intents.ts';
+import type { CarType, Direction, OfficeTier } from './content.ts';
+import type { ExtraStart, LocalOpsOption } from './intents.ts';
 import type { CardId, GridCoord, PlayerIndex, RollingStock, SeatIndex, TrayId } from './state.ts';
 
 export type GameEvent =
@@ -28,6 +28,15 @@ export type GameEvent =
   | { type: 'stageBegan'; day: number; stage: number }
   /** Employee Rotation (Appendix B) — every player has moved one chair left for the new Day. */
   | { type: 'seatsRotated'; day: number; seating: PlayerIndex[] }
+  /**
+   * §5 — the Fedora passed, at the end of Stage 3, 6, 9 or 12.
+   *
+   * ITS OWN EVENT RATHER THAN THE `actorChanged` THIS USED TO RIDE ON. That one is turn bookkeeping,
+   * fired every time the cursor moves, and `record()` drops it on the floor as noise — so the one
+   * moment it carried that a player actually needed to see went past in silence. Reported from the
+   * table (2026-09-16): the Supervisor Shift appears in the history and the handover never does.
+   */
+  | { type: 'superintendentChanged'; player: PlayerIndex; stage: number }
   | { type: 'phaseBegan'; phase: string }
   | { type: 'actorChanged'; player: PlayerIndex | null }
   // -- local operations
@@ -37,9 +46,10 @@ export type GameEvent =
    * more than one legal route to `to`, so the history can say which one ran rather than leaving a
    * choice the player made invisible in their own log.
    */
-  | { type: 'trayMoved'; trayId: TrayId; from: GridCoord; to: GridCoord; movesRemaining: number; facing?: 'n' | 's' | 'e' | 'w'; via?: GridCoord }
+  | { type: 'trayMoved'; player: PlayerIndex; trayId: TrayId; from: GridCoord; to: GridCoord; movesRemaining: number; movesAllowed: number; facing?: 'n' | 's' | 'e' | 'w'; via?: GridCoord }
   | {
       type: 'carsCoupled';
+      player: PlayerIndex;
       trayId: TrayId;
       at: GridCoord;
       stock: RollingStock[];
@@ -71,8 +81,67 @@ export type GameEvent =
        */
       recoupled?: { at: GridCoord; stock: RollingStock[] };
     }
-  | { type: 'carsDropped'; trayId: TrayId; at: GridCoord; stock: RollingStock[]; fromNose?: boolean }
-  | { type: 'consistSorted'; trayId: TrayId; at: GridCoord; before: RollingStock[]; after: RollingStock[] }
+  | { type: 'carsDropped'; player: PlayerIndex; trayId: TrayId; at: GridCoord; stock: RollingStock[]; fromNose?: boolean }
+  | {
+      type: 'consistSorted';
+      player: PlayerIndex;
+      trayId: TrayId;
+      at: GridCoord;
+      before: RollingStock[];
+      after: RollingStock[];
+      /**
+       * Where the engine ends up in `after`, counted as an index into it — 0 is the nose.
+       *
+       * The Small Yard used to put the engine back on the front unconditionally, which is what the
+       * v0.4.5 card text says ("reorder its entire consist and put the engine at the nose").
+       * `implications.md` records the design source saying the opposite — "may sort itself into any
+       * order, INCLUDING cars ahead of the engine" — and Jesse settled it that way on 2026-09-17.
+       */
+      engineAt: number;
+    }
+  /**
+   * A player finished their switching turn: what it cost, and where the crew was left.
+   *
+   * The history panel keeps a switching turn's FIRST move and drops the ones in the middle, so the
+   * closing line is where "and it ended up here" has to come from. It cannot be recovered by
+   * revealing the last `trayMoved` after the fact: the log streams to clients as it is written
+   * (`server/session.ts` § linesSince), and nobody knows a move was the last one until the turn is
+   * already over and that line has been sent.
+   */
+  | {
+      type: 'switchingEnded';
+      player: PlayerIndex;
+      movesUsed: number;
+      movesAllowed: number;
+      lastMove?: { trayId: TrayId; to: GridCoord };
+    }
+  /**
+   * THE FREIGHT AGENT WAS CHOSEN AND DID NOTHING, which is a decision rather than an absence.
+   *
+   * §6.3 requires no action, and the bot deliberately takes that route — unjamming a healthy box
+   * destroys a load that cost a whole Local Operations action to stock, so an idle Stage is
+   * strictly better. Reported from a table on Day 1 Stage 3 of v0.8.0.16: the log announced
+   * FREIGHT AGENT work and then said nothing at all, so the turn read as a bug.
+   *
+   * Reduces to nothing, like `switchingEnded` above: it reports a choice the state already holds.
+   */
+  | { type: 'freightAgentIdled'; player: PlayerIndex }
+  /**
+   * A train the Interlocking was holding at the Limits has taken the A/D track that just freed.
+   *
+   * It happens as a side effect of ANOTHER train arriving and clearing the Office, so without this
+   * the held train simply appeared at the Office with nothing said — reported from a table as
+   * "wasn't clear what changed and why train 8 was suddenly released". `freedBy` names the train
+   * whose arrival did it, because "why now" is the whole question.
+   */
+  | {
+      type: 'trainReleasedFromLimits';
+      trainNumber: number;
+      office: string;
+      owner: SeatIndex;
+      /** The train whose arrival freed the track — or null when a departure freed it (v0.8.3). */
+      freedBy: number | null;
+    }
   | { type: 'cardDrawn'; player: PlayerIndex; source: 'homeOffice' | 'department'; slot?: number; cardId: CardId }
   /**
    * §6.2 — the Home Office deck ran out, so the Salvage Yard and all three Department decks were
@@ -86,8 +155,19 @@ export type GameEvent =
   | { type: 'deckReshuffled'; order: CardId[]; rngState: number }
   /** `variant` is the chosen orientation (Gap 11); it must be replayable, so it rides the event. */
   | { type: 'cardPlayed'; player: PlayerIndex; cardId: CardId; placement?: GridCoord; variant?: number }
-  | { type: 'mainlineModified'; player: PlayerIndex; cardId: CardId; node: number; key: string; became?: string }
-  | { type: 'redFlagsSet'; player: PlayerIndex; cardId: CardId; trayId: TrayId; node: number }
+  /**
+    * `from` is the card's kind BEFORE the change, carried so the log can say what was realigned
+    * rather than only what it turned into (playtest, 2026-09-15: "it should state that the mainline
+    * card 3 curves was converted to plains"). Events are derived by replaying a save, never stored,
+    * so widening one strands nothing on disk.
+    */
+  | { type: 'mainlineModified'; player: PlayerIndex; cardId: CardId; node: number; key: string; from?: string; became?: string }
+  /** §Q (Gitea#19) — a flag planted on one side of a district's Limits. */
+  | { type: 'redFlagsSet'; player: PlayerIndex; cardId: CardId; seat: SeatIndex; side: Direction }
+  /** §Q (Gitea#19) — the flag stopped a train and came down with it. One card, one train. */
+  | { type: 'redFlagSpent'; seat: SeatIndex; side: Direction; trainNumber: number }
+  /** §Q (Gitea#19) — the district's owner answered the out-of-phase "flag against this train?". */
+  | { type: 'redFlagRuled'; player: PlayerIndex; trainId: TrayId; flag: boolean }
   | {
       type: 'trainsDestroyed';
       player: PlayerIndex;
@@ -102,7 +182,7 @@ export type GameEvent =
   // -- freight agent
   | { type: 'stockToOutbound'; player: PlayerIndex; at: GridCoord; stock: RollingStock }
   | { type: 'inboundCleared'; player: PlayerIndex; at: GridCoord; stock: RollingStock }
-  | { type: 'facilityUnjammed'; player: PlayerIndex; at: GridCoord; from: string; stock: RollingStock }
+  | { type: 'facilityUnjammed'; player: PlayerIndex; at: GridCoord; from: string; index: number; stock: RollingStock }
   // -- trains
   /**
    * §7 — a Timetabled Train card played from hand is scheduled by a 1D12 roll. `rngState` carries
@@ -121,7 +201,7 @@ export type GameEvent =
    */
   | { type: 'enhancementPlaced'; player: PlayerIndex; key: string; at?: GridCoord; node?: number }
   | { type: 'extraQueued'; player: PlayerIndex; trainNumber: number }
-  | { type: 'secondSectionOrdered'; player: PlayerIndex; trainNumber: number }
+  | { type: 'secondSectionOrdered'; player: PlayerIndex; trainNumber: number; cardId: CardId }
   | { type: 'trainMadeUp'; trainNumber: number; isExtra: boolean; at: string; direction: string }
   | { type: 'trainHeld'; trainNumber: number; reason: string }
   /** A train whose card pays for standing still (X18 Circus) collected on it. */
@@ -147,7 +227,13 @@ export type GameEvent =
    * switched normally like any other arrival, but it has to be back on the Office square before the
    * next Mainline Phase begins, or `expediteFault` fires.
    */
-  | { type: 'trainArrived'; trainNumber: number; consist: RollingStock[]; office: string; expedited: boolean }
+  /**
+   * `owner` is WHOSE Office it reached — the district's player, not whoever is acting. The Mainline
+   * Phase has no actor, so nothing else in the line could name the seat, and the narration said only
+   * "ARRIVED at the Whistle Post" — every seat's Office has a tier, and at a four-seat table three of
+   * them are somebody else's (Jesse, playtest 2026-09-16).
+   */
+  | { type: 'trainArrived'; trainNumber: number; consist: RollingStock[]; office: string; owner: PlayerIndex; expedited: boolean }
   | { type: 'trainDiverted'; trainNumber: number; to: string; reason: string }
   /**
    * The train ran the length of the Division and left it. `side` is the Division Point it left by,
@@ -156,15 +242,62 @@ export type GameEvent =
    */
   | { type: 'trainCompleted'; trainNumber: number; isExtra: boolean; side: 'east' | 'west'; consist: RollingStock[] }
   /** An Extra took a Crew Tray and started its run — at a Division Point, or at a Control Point. */
-  | { type: 'extraStarted'; player: PlayerIndex; trainNumber: number; atSeat: SeatIndex | null }
-  | { type: 'carPlacedOnTrain'; player: PlayerIndex; trayId: TrayId; stock: RollingStock }
-  | { type: 'carPassed'; player: PlayerIndex; trayId: TrayId }
+  /**
+   * Carries the RESOLVED start and direction (`resolveExtraStart`), not the raw intent fields, so
+   * the reducer never re-answers a question `check` already answered — the same shape as
+   * `passengersBoarded` carrying its tray and coach index.
+   */
+  | {
+      type: 'extraStarted';
+      player: PlayerIndex;
+      trainNumber: number;
+      at: ExtraStart;
+      direction: Direction;
+    }
+  | { type: 'carPlacedOnTrain'; player: PlayerIndex; trayId: TrayId; stock: RollingStock; trainNumber: number | null; isExtra: boolean }
+  | { type: 'carPassed'; player: PlayerIndex; trayId: TrayId; trainNumber: number | null; isExtra: boolean }
+  /**
+   * A train was made up and the round could give it NOTHING THE CARD CALLS FOR — the Division Yard
+   * holds no car of a category it still wants (§7, §8.2 "may depart with fewer").
+   *
+   * ITS OWN EVENT BECAUSE THE SILENCE WAS THE BUG (playtest, 2026-09-16: "train 5, the sparrow, has
+   * no coaches, which seems strange"). `trainNeedingCars` returns null in exactly this case, so the
+   * phase never stops, nobody is asked for a car, and the only trace was a MADE UP line promising
+   * "now taking cars" with nothing after it. The train then ran the whole Division empty.
+   *
+   * CARRIES WHY, not just that. The shortage is a standing condition rather than a moment — §2.2
+   * returns the Classification Yard only when the Division Yard runs bare — so the counts that
+   * explain it have to travel with the event: what is still wanted, how many such cars are waiting
+   * in Classification, and how far the Division Yard is from empty.
+   */
+  | {
+      type: 'makeUpShort';
+      trainNumber: number;
+      isExtra: boolean;
+      /** How many cars it got, out of what the card calls for. */
+      placed: number;
+      wanted: number;
+      /** The categories the card still wants and the Division Yard cannot supply. */
+      missing: ('freight' | 'coach' | 'caboose')[];
+      /** Cars of those categories sitting in the Classification Yard. */
+      waiting: number;
+      /** §2.2 — Classification comes back only when this reaches zero. */
+      divisionYardHolds: number;
+    }
   | { type: 'dispatchBonusUsed'; key: string; bonus: number; trainNumber: number; againstTrain: number }
   | { type: 'clearanceRequested'; trainId: TrayId; occupiedBy: TrayId }
   | { type: 'clearanceGiven'; trainId: TrayId; allow: boolean }
   // -- load / unload
-  | { type: 'passengersBoarded'; player: PlayerIndex; at: GridCoord }
-  | { type: 'passengersDetrained'; player: PlayerIndex; at: GridCoord }
+  /**
+   * `trayId` and `coachIndex` name the TRAIN and the COACH the Porter worked, rather than leaving the
+   * reducer to find them again — the same lesson as `unloadBegan`'s `carIndex` below. Re-deriving
+   * "the first empty coach on the first train at the Office" is how two trains standing at one
+   * station both answered to one roster chip (v0.4.9d playtest), and how a coach the player had not
+   * chosen got filled. Required, not optional: an event is a fact, and a fact that has to be looked
+   * up against live state cannot render standalone in a replay.
+   */
+  | { type: 'passengersBoarded'; player: PlayerIndex; at: GridCoord; trayId: TrayId; coachIndex: number }
+  | { type: 'passengersDetrained'; player: PlayerIndex; at: GridCoord; trayId: TrayId; coachIndex: number }
   | { type: 'loadStarted'; player: PlayerIndex; at: GridCoord; carType: CarType }
   | { type: 'loadAdvanced'; player: PlayerIndex; at: GridCoord; fromBox: number; toBox: number }
   | { type: 'unloadCompleted'; player: PlayerIndex; at: GridCoord; carType: CarType }
@@ -176,6 +309,25 @@ export type GameEvent =
   | { type: 'unloadBegan'; player: PlayerIndex; at: GridCoord; carType: CarType; carIndex: number }
   // -- consequences
   | { type: 'revenueChanged'; player: PlayerIndex; delta: number; total: number; reason: string }
-  | { type: 'phaseEnded'; player: PlayerIndex; phase: string };
+  | { type: 'phaseEnded'; player: PlayerIndex; phase: string }
+  // -- §3.3, extended play (Gitea#11)
+  /**
+   * One seat's answer to "play one more Day?". Every seat votes; the vote is unanimous, and one
+   * refusal ends it. In the log so that a table can see who is still being waited on, and who
+   * called time.
+   */
+  | { type: 'extensionVoted'; player: PlayerIndex; agree: boolean }
+  /** The table agreed. `day` is the Day the extra one becomes — `config.days + extraDays`. */
+  | { type: 'dayExtended'; day: number }
+  /**
+   * Play is over for good — somebody declined the extension.
+   *
+   * Distinct from the ending itself, which `checkVictory` already announced by way of the result: an
+   * ending that COULD have been played past and was not is a decision the table made, and the log
+   * should say so rather than simply stopping.
+   */
+  | { type: 'playConcluded'; declinedBy: PlayerIndex }
+  /** §11 (Gitea#5) — the district's owner answered the Yard Office offer. */
+  | { type: 'yardOfficeRuled'; player: PlayerIndex; trainId: TrayId; take: boolean };
 
 export type EventType = GameEvent['type'];

src/engine/intents.ts

@@ -13,6 +13,17 @@ import type { CardId, GridCoord, PlayerIndex, SeatIndex, TrayId } from './state.
 
 export type LocalOpsOption = 'switch' | 'draw' | 'freightAgent';
 
+/**
+ * Where an Extra is placed when it is started (§7).
+ *
+ * `mainline` names a node index in `division.nodes` and is only ever an Interchange; `office` names
+ * a SEAT, which is what an Office Area belongs to, and only ever a Control Point.
+ */
+export type ExtraStart =
+  | { kind: 'divisionPoint'; side: Direction }
+  | { kind: 'mainline'; node: number }
+  | { kind: 'office'; seat: SeatIndex };
+
 export type Intent =
   | { type: 'localOps.choose'; option: LocalOpsOption }
   // -- switch (§6.1, Appendix A)
@@ -36,7 +47,19 @@ export type Intent =
    * order, including cars in front of the engine". This is the designed answer to §A.3's
    * come-off-in-seated-order constraint, which is what makes facing-point work possible.
    */
-  | { type: 'switch.sortConsist'; trayId: TrayId; order: number[] }
+  /**
+   * §Enhancements, Small Yard — one Move to re-make a train standing on the yard.
+   *
+   * `order` is a permutation of the current consist, nose first. `engineAt` is where the LOCOMOTIVE
+   * ends up in it: 0 puts it back on the front, which is what the v0.4.5 card text describes and
+   * what this action did unconditionally until 2026-09-17. `implications.md` records the design
+   * source saying a train here "may sort itself into any order, including cars ahead of the engine",
+   * and Jesse ruled that way — so it is a number now, and a train left nose-loaded is one §8.2 will
+   * not let out of the Office until it is sorted again.
+   *
+   * Optional, defaulting to 0, so every save written before this replays exactly as it did.
+   */
+  | { type: 'switch.sortConsist'; trayId: TrayId; order: number[]; engineAt?: number }
   | { type: 'switch.end' }
   // -- draw (§6.2)
   | { type: 'draw.fromHomeOffice' }
@@ -74,12 +97,31 @@ export type Intent =
   | { type: 'newTrain.placeCar'; trayId: TrayId; carType: CarType; loaded: boolean }
   | { type: 'newTrain.passCar'; trayId: TrayId }
   /**
-   * §7 — "the player who played the card may place the Crew Tray in either division point for
-   * immediate departure", extended by Jesse: an Extra starts at the Division Point its NUMBER sends
-   * it to (odd runs west, even east, exactly as a timetabled train), or at any Control Point — any
-   * Office above a Whistle Post — at the player's choice. `atSeat` null means the Division Point.
+   * §7 — "the player who played the card may place the Crew Tray at EITHER Division Point for
+   * immediate departure", plus Jesse's ruling on where else and which way.
+   *
+   * The number does not decide an Extra's direction — the START does. Either Division Point may be
+   * chosen and the train runs away from it (west end runs east, east end runs west, since the other
+   * reading is a train that leaves the Division having crossed nothing). At an Interchange or a
+   * Control Point, which are in the middle of the railroad, both ways are real runs and `direction`
+   * says which; it is required there and ignored at a Division Point.
+   *
+   * WHICH STARTS ARE OFFERED is the `extraStart` house rule (content.ts) — Division Points and the
+   * Interchange always, Offices by setting.
+   *
+   * `atSeat` IS LEGACY AND WRITE-ONCE. Saves written before this choice existed carry only that
+   * field: `null` meant "the Division Point this train's number sends it to" and a seat meant that
+   * Office, both running in the number's direction. `start` absent is exactly what those saves said,
+   * so they replay unchanged; everything written from now on carries `start` and `atSeat` is
+   * omitted. `resolveExtraStart` (apply.ts) is the single place that reads either.
    */
-  | { type: 'newTrain.startExtra'; trainNumber: number; atSeat: SeatIndex | null }
+  | {
+      type: 'newTrain.startExtra';
+      trainNumber: number;
+      atSeat?: SeatIndex | null;
+      start?: ExtraStart;
+      direction?: Direction;
+    }
   /** Q9 — run a second, identical section behind a train that is due out this Stage. */
   | { type: 'newTrain.secondSection'; trainNumber: number }
   // -- Mainline Phase (§8.1) — the Superintendent's clearance ruling
@@ -90,10 +132,24 @@ export type Intent =
    */
   | { type: 'mainline.modify'; cardId: CardId; node: number }
   /**
-   * Red Flags — protect a stopped train. The flagged train cannot be hit; an approaching train is
-   * held instead of colliding.
+   * §Q, RED FLAGS (Gitea#19) — plant a flag on one side of your own district.
+   *
+   * "If played, asked FLAG EAST or FLAG WEST. That stops all trains from entering your limits from
+   * that direction (i.e. Flag East holds westbound trains). You can do this if you see a problem or
+   * wish to complete switching."
+   *
+   * `side` names the side of the district the flag goes on, so a train arriving from that side is
+   * held. It REPLACES the old rule, which was played on a stopped train out on the Mainline and
+   * protected it from a rear-ender: measured at 4,212 offers and 4 plays across 600 games, a
+   * mechanic nobody used. ABS Signals already protects a train standing on a Mainline card.
    */
-  | { type: 'maneuver.redFlags'; cardId: CardId; trayId: TrayId }
+  | { type: 'maneuver.redFlags'; cardId: CardId; side: Direction }
+  /**
+   * The same card, played OUT OF PHASE at the moment of danger (Gitea#19) — "COLLISION RISK! FLAG
+   * AGAINST T2?". Answers a pending `redFlag` decision; `flag: false` declines and lets the
+   * collision happen. The side is not asked for: the train is already coming from one.
+   */
+  | { type: 'mainline.redFlag'; flag: boolean; cardId?: CardId }
   /**
    * Flying Switch — cut cars off behind the engine and roll them into an adjacent industry, without
    * the engine entering it.
@@ -101,13 +157,53 @@ export type Intent =
   | { type: 'maneuver.flyingSwitch'; cardId: CardId; trayId: TrayId; count: number; to: GridCoord }
   | { type: 'redFlag.play' }
   // -- Load/Unload Phase (§9)
-  | { type: 'porter.board'; at: GridCoord }
-  | { type: 'porter.detrain'; at: GridCoord }
+  /**
+   * `trayId` names the train the Porter works — reported from playtesting v0.4.9d as "operating two
+   * trains in a station, the select button does not work: regardless of which you pick, it is always
+   * one train, not the other". It was: neither intent carried a train, so the reducer took the first
+   * one on the A/D tracks and the roster chip the player had clicked changed nothing but the drawing.
+   *
+   * OPTIONAL, like `switch.move`'s `via` and for the same reason: intents are the canonical record
+   * `undo` and every save replay against, and absent means what it has always meant — the first
+   * eligible train at the Office.
+   */
+  | { type: 'porter.board'; at: GridCoord; trayId?: TrayId }
+  | { type: 'porter.detrain'; at: GridCoord; trayId?: TrayId }
   /** §9.3 — the first Laborer step: Green Loading Slot -> MEN. */
   | { type: 'laborer.startLoad'; at: GridCoord }
   | { type: 'laborer.advanceLoad'; at: GridCoord; box: number }
   | { type: 'laborer.beginUnload'; at: GridCoord; carIndex: number }
-  | { type: 'loadUnload.end' };
+  | { type: 'loadUnload.end' }
+  /**
+   * §3.3, EXTENDED PLAY (Gitea#11) — one vote on whether to play one more Day.
+   *
+   * ARRIVES OUT OF TURN, like `mainline.clearance`, and unlike it goes to EVERY seat rather than to
+   * the Superintendent: it is a table decision, not a ruling. Unanimous, and one `agree: false`
+   * ends the game immediately — nobody waits on a player who has already refused.
+   *
+   * It is an intent, rather than a button the client handles by itself, because a save is
+   * `{ seed, config, history }` replayed through the engine: a decision that is not in the history
+   * did not happen, and an extended game would evaporate on the next reload, Undo, or server
+   * restart. This is the record of the table agreeing.
+   *
+   * CARRIES ITS VOTER, uniquely among intents, and it has to. A saved history is a flat `Intent[]`
+   * with no seat recorded against each move: the replay DERIVES who acted from the turn order
+   * (`fromMultiplayerSave`). That works for every other intent, including `mainline.clearance`,
+   * because there is exactly one seat it could have been. Here there is not — every seat may vote,
+   * in any order — so a vote whose voter is not written down cannot be replayed at all, and a
+   * resumed server would refuse the save with `NO_ACTOR`. The server checks this against the seat
+   * it authenticated (`NOT_YOUR_TURN`), so it is a record, never a claim.
+   */
+  | { type: 'game.extend'; player: PlayerIndex; agree: boolean }
+  /**
+   * §11 (Gitea#5) — take the Yard Office, or the standard Office.
+   *
+   * Interrupts the Mainline Phase like `mainline.clearance`, and like it goes to one named player:
+   * whoever sits in the district the train is arriving at. Offered only when a route exists, so
+   * `take: true` always has somewhere to go — though it may still meet cars on the lead and crash,
+   * which is the point of the rule.
+   */
+  | { type: 'mainline.yardOffice'; take: boolean };
 
 export type IntentType = Intent['type'];
 
@@ -199,6 +295,17 @@ export type RejectionCode =
    * the Laborers can move it out of the box.
    */
   | 'NO_EMPTY_CAR_SPOTTED'
+  /**
+   * §9 (Jesse's ruling, v0.4.9e) — freight or passengers loaded anywhere in an Office Area may not
+   * be unloaded anywhere in that same Office Area. The load has to be carried out of the district by
+   * a train first; a Freight House may not break the load it just made, and passengers may not
+   * detrain at the platform they boarded from.
+   *
+   * Distinct from the other refusals because the car IS loaded, the Laborer IS free and the boxes
+   * ARE clear: the only thing wrong with it is where it came from, and a player looking at a loaded
+   * boxcar standing on their own industry track deserves to be told that rather than "wrong car".
+   */
+  | 'LOADED_IN_THIS_DISTRICT'
   | 'NO_PORTERS_HERE'
   | 'NO_PASSENGERS_WAITING'
   | 'NO_EMPTY_COACH'
@@ -206,9 +313,41 @@ export type RejectionCode =
   | 'INBOUND_BOX_FULL'
   | 'NO_EMPTY_COACH_IN_YARD'
   | 'NOT_A_CONTROL_POINT'
+  /**
+   * A passenger Modifier — Waiting Area, Restaurant, Hotel — played at an Office that is still a
+   * Whistle Post. A Whistle Post is not a Passenger Facility (§9), so it has nothing to add to.
+   */
+  | 'OFFICE_NOT_PASSENGER'
   | 'NO_EXTRA_PENDING'
+  /** §7 gives an Extra to the player who played the card; another seat may not place it for them. */
+  | 'NOT_YOUR_EXTRA'
   | 'NO_FREE_TRAY'
-  | 'NO_FREE_AD_TRACK';
+  | 'NO_FREE_AD_TRACK'
+  // -- §7, where an Extra may be started (`resolveExtraStart`)
+  | 'NO_SUCH_DIVISION_POINT'
+  /** Only the Interchange has a yard an Extra can be made up in. */
+  | 'NOT_AN_INTERCHANGE'
+  /** In the middle of the railroad both ways are real runs, so the intent has to say which. */
+  | 'NO_DIRECTION_CHOSEN'
+  /** The `extraStart` house rule is `divisionPointsOnly`. */
+  | 'OFFICE_STARTS_NOT_ALLOWED'
+  /** The `extraStart` house rule is `ownOffice` and this is somebody else's district. */
+  | 'NOT_YOUR_OFFICE'
+  /**
+   * §6.2, Jesse's ruling (Gitea#6) — a train card is never discarded. Hold it as long as you like;
+   * the only way it leaves your hand is onto the timetable.
+   */
+  | 'TRAINS_ARE_NEVER_DISCARDED'
+  /** §3.3 (Gitea#11) — `game.extend` when the game is not waiting on an extension vote. */
+  | 'NOT_AWAITING_EXTENSION'
+  /** §3.3 (Gitea#11) — this seat has already voted on this extension. */
+  | 'ALREADY_VOTED'
+  /** §11 (Gitea#5) — answering a Yard Office offer that is not open. */
+  | 'NO_YARD_OFFICE_OFFER'
+  /** §Q (Gitea#19) — answering a Red Flag prompt that is not open. */
+  | 'NO_RED_FLAG_PROMPT'
+  /** §Q (Gitea#19) — this district already has a flag on that side. */
+  | 'ALREADY_FLAGGED';
 
 export type Rejection = { code: RejectionCode; message: string };
 

src/engine/legal.ts

@@ -13,8 +13,8 @@
  */
 
 import type { CarType, Hand, TrackGeometry } from './content.ts';
-import { enhancementRule } from './content.ts';
-import { check, areaOf, destinationsFor } from './apply.ts';
+import { enhancementRule, mainlineProfile } from './content.ts';
+import { check, areaOf, destinationsFor, withRouteCache } from './apply.ts';
 import type { Intent } from './intents.ts';
 import type { GameState, GridCoord, PlayerIndex } from './state.ts';
 import { coordKey, seatOf } from './state.ts';
@@ -53,64 +53,18 @@ const CAR_TYPES: readonly CarType[] = ['coach', 'boxcar', 'reefer', 'hopper', 't
 
 /** Every intent `player` may legally submit right now. */
 export function legalActions(s: GameState, player: PlayerIndex): Intent[] {
-  return candidates(s, player).filter((i) => check(s, player, i) === null);
-}
-
-export function isLegal(s: GameState, player: PlayerIndex, i: Intent): boolean {
-  return check(s, player, i) === null;
+  // One position, examined many times over: its routes are walked once (`withRouteCache`).
+  return withRouteCache(s, () => candidates(s, player).filter((i) => check(s, player, i) === null));
 }
 
 /**
- * Candidate generation. Over-generates freely — `check` is the authority, so a candidate that
- * turns out to be illegal simply gets filtered. Being generous here is what stops this module
- * from quietly acquiring rules.
+ * §6.1 — the switching half of the Local Operations candidates, in the order `legalActions` offers
+ * them. Split out so the switching planner (`sim/switch-planner.ts`) can ask for just these without
+ * `check` running over every draw and Freight Agent candidate at each of the thousands of positions it
+ * tries — that was about a quarter of all planning time. Still no rules here: `check` decides.
  */
-function candidates(s: GameState, player: PlayerIndex): Intent[] {
+function switchCandidates(s: GameState, player: PlayerIndex): Intent[] {
   const out: Intent[] = [];
-
-  // The clearance ruling arrives out of turn order and goes to the Superintendent (§8.1).
-  if (s.clock.pendingDecision !== null) {
-    out.push({ type: 'mainline.clearance', allow: true });
-    out.push({ type: 'mainline.clearance', allow: false });
-  }
-
-  switch (s.clock.phase) {
-    case 'localOps':
-      out.push(...localOpsCandidates(s, player));
-      break;
-    case 'newTrain':
-      out.push(...newTrainCandidates(s));
-      break;
-    case 'loadUnload':
-      out.push(...loadUnloadCandidates(s, player));
-      break;
-    default:
-      break;
-  }
-
-  // Red Flags — "any time", so they are candidates in every phase, on any train standing out on
-  // the Mainline (the player's own or another's: protecting a train is not an attack).
-  for (const cardId of s.decks.hands.get(player) ?? []) {
-    const k = s.cards.get(cardId)?.kind;
-    if (k?.kind !== 'maneuver' || k.key !== 'redFlags') continue;
-    for (const [trayId] of s.trays) out.push({ type: 'maneuver.redFlags', cardId, trayId });
-  }
-
-  out.push({ type: 'redFlag.play' });
-  return out;
-}
-
-function localOpsCandidates(s: GameState, player: PlayerIndex): Intent[] {
-  const out: Intent[] = [];
-
-  // §6 — the three-way exclusive choice.
-  out.push({ type: 'localOps.choose', option: 'switch' });
-  out.push({ type: 'localOps.choose', option: 'draw' });
-  out.push({ type: 'localOps.choose', option: 'freightAgent' });
-
-  const area = areaOf(s, player);
-
-  // -- switch (§6.1)
   for (const [trayId, tray] of s.trays) {
     if (tray.position.at !== 'grid' || tray.position.seat !== seatOf(s, player)) continue;
     const from = tray.position.coord;
@@ -137,17 +91,79 @@ function localOpsCandidates(s: GameState, player: PlayerIndex): Intent[] {
       // that shoved a cut, and therefore the only way an engine buried mid-train reaches an end.
       out.push({ type: 'switch.dropCars', trayId, count: n, fromNose: true });
     }
-    // Small Yard: enumerating every permutation would explode, so offer the useful ones —
-    // bringing each car to the droppable end, plus a full reversal. `check` validates any order,
-    // so a UI may submit an arbitrary permutation.
+    /**
+     * Small Yard: enumerating every permutation would explode, so offer the useful ones — bringing
+     * each car to the droppable end, plus a full reversal. `check` validates any order, so a UI may
+     * submit an arbitrary permutation.
+     *
+     * NOTHING THAT RE-ORDERS NOTHING. Bringing the LAST car to the end is the identity, and a
+     * two-car train's reversal repeats its only real option — so the menu carried a move that spent
+     * one of six Moves to leave the train exactly as it was, beside a duplicate of the move next to
+     * it. Both were invisible while the labels were index lists (playtest, 2026-09-17); both are
+     * plainly wrong once the label reads as a train. Filtered by the ORDER rather than by the case
+     * that produced it, so a new generator cannot reintroduce either.
+     */
     const n = tray.consist.length;
+    const identity = [...Array(n).keys()];
     if (n > 1) {
+      const orders: number[][] = [];
       for (let k = 0; k < n; k++) {
-        const order = [...Array(n).keys()].filter((x) => x !== k);
+        const order = identity.filter((x) => x !== k);
         order.push(k);
-        out.push({ type: 'switch.sortConsist', trayId, order });
+        orders.push(order);
+      }
+      orders.push([...identity].reverse());
+      // Nothing that re-orders nothing: the current train is the one thing on offer that costs a
+      // Move and changes the board not at all. Keyed by (order, engine position) together, since
+      // since 2026-09-17 the same car order at a different engine position is a different train.
+      const seen = new Set<string>([`${identity.join(',')}|${tray.engineAt}`]);
+      const offer = (order: number[], engineAt: number): void => {
+        const key = `${order.join(',')}|${engineAt}`;
+        if (seen.has(key)) return;
+        seen.add(key);
+        out.push({ type: 'switch.sortConsist', trayId, order, engineAt });
+      };
+      // The car orders, each leaving the engine on the nose — the Small Yard's ordinary use.
+      for (const order of orders) offer(order, 0);
+      /**
+       * A MADE-UP ORDER IS ALWAYS AMONG THESE, which is worth saying because it looks as though it
+       * might not be (Jesse, 2026-09-17: "trains with a caboose have to offer the caboose at the
+       * back").
+       *
+       * A yard sort serves two errands — pulling one car out to an end so it can be spotted, and
+       * putting the train back together to leave — and the orders above are written for the first.
+       * They cover the second as a by-product: "bring car k to the tail" is enumerated for EVERY car,
+       * so bringing the CABOOSE to the tail is always one of them, and with the engine on the nose
+       * that is a train §8.2 will let out of the Office.
+       *
+       * An explicit "make it up to leave" option was written here and deleted: it produced exactly
+       * the k-is-the-caboose order and was dropped by the dedupe every time. The one case where no
+       * made-up order appears is a train that is ALREADY made up, where such an option would be the
+       * identity — and the labels say which is which, so a player can see that every offer would
+       * break a train that is currently fit to run.
+       */
+    }
+    /**
+     * WHERE THE ENGINE GOES, as its own short list rather than multiplied through the one above
+     * (Jesse's call, 2026-09-17: "a separate engine control").
+     *
+     * Offering every car order at every engine position is the honest enumeration and it is
+     * unreadable: a four-car consist would go from four options to twenty, which is the labelling
+     * problem that prompted all of this. So the engine positions are offered against the consist AS
+     * IT STANDS — pick an order, or pick where the engine sits, each one Move. A player who wants
+     * both spends two, which is the same price the yard charges for any second sort.
+     *
+     * OFFERED FOR A ONE-CAR TRAIN TOO, unlike the car orders: a single car ahead of the engine or
+     * behind it is exactly the difference between shoving it into a facing industry and pulling it.
+     */
+    if (n >= 1) {
+      const seenEngine = new Set<string>([`${identity.join(',')}|${tray.engineAt}`]);
+      for (let k = 0; k <= n; k++) {
+        const key = `${identity.join(',')}|${k}`;
+        if (seenEngine.has(key)) continue;
+        seenEngine.add(key);
+        out.push({ type: 'switch.sortConsist', trayId, order: identity, engineAt: k });
       }
-      out.push({ type: 'switch.sortConsist', trayId, order: [...Array(n).keys()].reverse() });
     }
   }
   // Flying Switch — roll a cut into an ADJACENT industry without the engine entering it.
@@ -167,6 +183,97 @@ function localOpsCandidates(s: GameState, player: PlayerIndex): Intent[] {
     }
   }
   out.push({ type: 'switch.end' });
+  return out;
+}
+
+/** The switching intents `player` may legally submit right now — exactly `legalActions`' switching subset. */
+export function legalSwitchingActions(s: GameState, player: PlayerIndex): Intent[] {
+  return withRouteCache(s, () => switchCandidates(s, player).filter((i) => check(s, player, i) === null));
+}
+
+export function isLegal(s: GameState, player: PlayerIndex, i: Intent): boolean {
+  return check(s, player, i) === null;
+}
+
+/**
+ * Candidate generation. Over-generates freely — `check` is the authority, so a candidate that
+ * turns out to be illegal simply gets filtered. Being generous here is what stops this module
+ * from quietly acquiring rules.
+ */
+function candidates(s: GameState, player: PlayerIndex): Intent[] {
+  const out: Intent[] = [];
+
+  /**
+   * §3.3, EXTENDED PLAY (Gitea#11) — the only thing on offer when the timetable has run out and the
+   * table is being asked whether to play on.
+   *
+   * Returned EARLY rather than added to the list, because nothing else is legal in this state and
+   * the phase switch below would otherwise generate a boardful of candidates for `check` to reject
+   * one at a time. It also puts the vote in front of the bot driver through the ordinary path, which
+   * is what lets a bot seat answer without the engine having to know which seats are bots.
+   */
+  if (s.status === 'awaitingExtension') {
+    if (s.extensionVotes[player] === null) {
+      out.push({ type: 'game.extend', player, agree: true });
+      out.push({ type: 'game.extend', player, agree: false });
+    }
+    return out;
+  }
+
+  // The two interruptions of the Mainline Phase. Each goes to one named player — `check` is the
+  // authority on which — so both are generated here and filtered there.
+  if (s.clock.pendingDecision?.kind === 'clearance') {
+    out.push({ type: 'mainline.clearance', allow: true });
+    out.push({ type: 'mainline.clearance', allow: false });
+  }
+  if (s.clock.pendingDecision?.kind === 'yardOffice') {
+    out.push({ type: 'mainline.yardOffice', take: true });
+    out.push({ type: 'mainline.yardOffice', take: false });
+  }
+  if (s.clock.pendingDecision?.kind === 'redFlag') {
+    out.push({ type: 'mainline.redFlag', flag: true });
+    out.push({ type: 'mainline.redFlag', flag: false });
+  }
+
+  switch (s.clock.phase) {
+    case 'localOps':
+      out.push(...localOpsCandidates(s, player));
+      break;
+    case 'newTrain':
+      out.push(...newTrainCandidates(s, player));
+      break;
+    case 'loadUnload':
+      out.push(...loadUnloadCandidates(s, player));
+      break;
+    default:
+      break;
+  }
+
+  // Red Flags — "any time", so they are candidates in every phase, on any train standing out on
+  // the Mainline (the player's own or another's: protecting a train is not an attack).
+  for (const cardId of s.decks.hands.get(player) ?? []) {
+    const k = s.cards.get(cardId)?.kind;
+    if (k?.kind !== 'maneuver' || k.key !== 'redFlags') continue;
+    // §Q (Gitea#19) — a flag goes on one side of your own district, so the only choice is which.
+    for (const side of ['east', 'west'] as const) out.push({ type: 'maneuver.redFlags', cardId, side });
+  }
+
+  out.push({ type: 'redFlag.play' });
+  return out;
+}
+
+function localOpsCandidates(s: GameState, player: PlayerIndex): Intent[] {
+  const out: Intent[] = [];
+
+  // §6 — the three-way exclusive choice.
+  out.push({ type: 'localOps.choose', option: 'switch' });
+  out.push({ type: 'localOps.choose', option: 'draw' });
+  out.push({ type: 'localOps.choose', option: 'freightAgent' });
+
+  const area = areaOf(s, player);
+
+  // -- switch (§6.1)
+  out.push(...switchCandidates(s, player));
 
   // -- draw (§6.2)
   out.push({ type: 'draw.fromHomeOffice' });
@@ -206,12 +313,19 @@ function localOpsCandidates(s: GameState, player: PlayerIndex): Intent[] {
      *
      * Deduplicated because the two lists overlap: `placements` already contains the Limits signs.
      */
+    /**
+     * A TURNOUT AND AN INDUSTRY MAY BOTH BUILD OVER TRACK ALREADY DOWN, so both are offered the
+     * occupied cells as well as the empty ones and `check` decides which it will take. Without this
+     * the rule exists in the engine and is never once presented — which is how the 18 Enhancement
+     * cards came to be permanently dead.
+     */
     const isTurnout = kind?.kind === 'track' && kind.geometry === 'turnout';
+    const isFacility = kind?.kind === 'freightFacility';
     const targets = onMainline
       ? []
       : kind?.kind === 'enhancement'
         ? attachments
-        : isTurnout
+        : isTurnout || isFacility
           ? dedupe([...placements, ...attachments])
           : placements;
     // Orientation is chosen on placement, and a printed card turns but never flips, so the widest
@@ -257,7 +371,7 @@ function localOpsCandidates(s: GameState, player: PlayerIndex): Intent[] {
   return out;
 }
 
-function newTrainCandidates(s: GameState): Intent[] {
+function newTrainCandidates(s: GameState, player: PlayerIndex): Intent[] {
   const out: Intent[] = [];
   for (const [trayId] of s.trays) {
     for (const carType of CAR_TYPES) {
@@ -268,17 +382,37 @@ function newTrainCandidates(s: GameState): Intent[] {
   }
   const due = s.timetable[s.clock.stage - 1];
   if (due !== null && due !== undefined) {
-    out.push({ type: 'newTrain.secondSection', trainNumber: due });
+    // Q9 — the order costs the card, so it is only a candidate while the card is in hand.
+    // `check` is still the authority; this keeps the menu from offering what it will refuse.
+    if ((s.decks.hands.get(player) ?? []).some((id) => s.cards.get(id)?.kind.kind === 'secondSection')) {
+      out.push({ type: 'newTrain.secondSection', trainNumber: due });
+    }
   }
   /**
-   * Where a pending Extra starts: its own Division Point, decided by its number, or any Control
-   * Point. `check` refuses a Whistle Post and a full Office, so every seat is offered and the rules
-   * do the filtering — one implementation of "is this a Control Point", not two.
+   * WHERE A PENDING EXTRA MAY START (§7, Jesse's ruling) — every candidate offered, with `check`
+   * doing the filtering, so "is this a Control Point" and "does the house rule allow it" have one
+   * implementation each rather than two.
+   *
+   * BOTH Division Points, not the one the number dictates: an Extra's direction comes from where it
+   * is placed. In the middle of the railroad — an Interchange, a Control Point — both ways are real
+   * runs, so those are offered twice, once per direction.
    */
-  for (const trainNumber of s.pendingExtras) {
-    out.push({ type: 'newTrain.startExtra', trainNumber, atSeat: null });
+  // Only the player who played it is offered anywhere to put it (§7) — `check` refuses anyone else
+  // with NOT_YOUR_EXTRA, and offering options that are certain to be refused is how a menu lies.
+  for (const { trainNumber } of s.pendingExtras.filter((x) => x.player === player)) {
+    for (const side of ['west', 'east'] as const) {
+      out.push({ type: 'newTrain.startExtra', trainNumber, start: { kind: 'divisionPoint', side } });
+    }
+    for (const [node, n] of s.division.nodes.entries()) {
+      if (n.kind !== 'mainline' || !mainlineProfile(n.card).sortsCars) continue;
+      for (const direction of ['west', 'east'] as const) {
+        out.push({ type: 'newTrain.startExtra', trainNumber, start: { kind: 'mainline', node }, direction });
+      }
+    }
     for (const seat of s.officeAreas.keys()) {
-      out.push({ type: 'newTrain.startExtra', trainNumber, atSeat: seat });
+      for (const direction of ['west', 'east'] as const) {
+        out.push({ type: 'newTrain.startExtra', trainNumber, start: { kind: 'office', seat }, direction });
+      }
     }
   }
   return out;
@@ -288,9 +422,21 @@ function loadUnloadCandidates(s: GameState, player: PlayerIndex): Intent[] {
   const out: Intent[] = [];
   const area = areaOf(s, player);
 
+  /**
+   * ONE OPTION PER TRAIN STANDING AT THE OFFICE, not one per square.
+   *
+   * Reported from playtesting v0.4.9d: "operating two trains in a station, the select button does
+   * not work — regardless of which you pick, it is always one train, not the other". There was only
+   * ever ONE `board passengers` button, because the intent carried no train; the roster chip chose
+   * what the board drew and nothing else. Now each eligible train is its own candidate, and `check`
+   * filters the ones whose card, consist or passengers rule them out.
+   */
+  const traysHere = area.adOccupancy.filter((id) => s.trays.has(id));
   for (const coord of facilityCoords(s, player)) {
-    out.push({ type: 'porter.board', at: coord });
-    out.push({ type: 'porter.detrain', at: coord });
+    for (const trayId of traysHere) {
+      out.push({ type: 'porter.board', at: coord, trayId });
+      out.push({ type: 'porter.detrain', at: coord, trayId });
+    }
     const f = area.grid.get(`${coord.row},${coord.col}`)?.facility;
     if (f) {
       out.push({ type: 'laborer.startLoad', at: coord });

src/engine/setup.ts

@@ -17,17 +17,19 @@ import {
   MODIFIER_PROFILES,
   OFFICE_PROFILES,
   OPENING_DEALS,
-  MAINLINE_PROFILES,
+  MAINLINE_DECK,
   houseRules,
   mainlineProfile,
   TRACK_CARDS,
   ROLLING_STOCK_SUPPLY,
   STAGES_PER_DAY,
+  SECOND_SECTION,
   TIMETABLED_TRAINS,
   crewTrayCount,
   mainlineCardCount,
   officeProfile,
 } from './content.ts';
+import type { StartingOffice } from './content.ts';
 import type { Rng } from './rng.ts';
 import { createRng } from './rng.ts';
 import type {
@@ -43,7 +45,7 @@ import type {
   TrackCard,
   TrayId,
 } from './state.ts';
-import { coordKey, freshTurns } from './state.ts';
+import { coordKey, emptyTally, freshTurns } from './state.ts';
 
 export type SetupOptions = {
   id: string;
@@ -53,7 +55,13 @@ export type SetupOptions = {
 };
 
 /** Builds the 52-card Home Office deck (§12.1). Unshuffled; caller shuffles with the seeded RNG. */
-export function buildDeck(mode: GameConfig['mode'] = 'competitive', pvpCardsAllowed = false): Card[] {
+export function buildDeck(
+  mode: GameConfig['mode'] = 'competitive',
+  pvpCardsAllowed = false,
+  startingOffice: StartingOffice = 'whistlePost',
+  /** False only for a save that predates the card — see `HouseRules.secondSectionCard`. */
+  secondSectionCard = true,
+): Card[] {
   /**
    * THE 22 OPPONENT-DIRECTED CARDS ARE OUT OF EVERY DECK REGARDLESS OF `pvpCardsAllowed`, for now.
    *
@@ -81,7 +89,16 @@ export function buildDeck(mode: GameConfig['mode'] = 'competitive', pvpCardsAllo
 
   for (const t of TIMETABLED_TRAINS) push({ kind: 'timetabledTrain', number: t.number });
   for (const t of EXTRA_TRAINS) push({ kind: 'extraTrain', number: t.number });
+  /**
+   * OFFICE UPGRADES, MINUS THE TIER EVERYBODY ALREADY HAS.
+   *
+   * A table that starts on Depots has no use for a Depot card: `check` refuses it, because an
+   * upgrade must be to the NEXT tier and a Depot is not an upgrade on a Depot. Leaving them in
+   * would deal four dead cards into a 90-odd card deck — the same dead draw the opponent-directed
+   * cards are held out for. Station and Terminal are still upgrades and stay.
+   */
   for (const o of OFFICE_PROFILES) {
+    if (o.tier === startingOffice) continue;
     for (let i = 0; i < o.copiesInDeck; i++) push({ kind: 'office', tier: o.tier });
   }
   for (const f of FREIGHT_PROFILES) {
@@ -90,6 +107,18 @@ export function buildDeck(mode: GameConfig['mode'] = 'competitive', pvpCardsAllo
   for (const m of MODIFIER_PROFILES) {
     for (let i = 0; i < m.copies; i++) push({ kind: 'modifier', modifier: m.kind });
   }
+  /**
+   * Q9 — THE SECOND SECTION CARD, WHICH WAS DECLARED AND NEVER DEALT.
+   *
+   * `content.ts` has carried `SECOND_SECTION` (1 copy) all along and `setup.ts` never built it into
+   * the deck, while `newTrain.secondSection` was offered free on every train due out — so the one
+   * card that is supposed to gate the action did not exist and the action cost nothing. The bot ran
+   * 26 accidental Second Sections in one measured round because of it.
+   *
+   * Jesse's ruling, 2026-09-23: the action requires the card. Dealing it is the other half — gating
+   * on a card the deck never holds would delete the mechanic rather than fix it.
+   */
+  if (secondSectionCard) for (let i = 0; i < SECOND_SECTION.copies; i++) push({ kind: 'secondSection' });
   if (opponentCardsInDeck) {
     for (const c of SPACE_USE_CARDS) {
       for (let i = 0; i < c.copies; i++) push({ kind: 'spaceUse', key: c.key });
@@ -147,7 +176,7 @@ export function buildRollingStock(): RollingStock[] {
  * branch from the opening Stage. The stubs are NOT turnouts: §A.1's directional rule governs
  * drawn turnout cards only.
  */
-function buildOfficeArea(seat: SeatIndex): OfficeArea {
+function buildOfficeArea(seat: SeatIndex, tier: StartingOffice): OfficeArea {
   const row = 0;
   const officeCoord = { row, col: 0 };
   const limitsWest = { row, col: -1 };
@@ -158,7 +187,7 @@ function buildOfficeArea(seat: SeatIndex): OfficeArea {
     baseOperationalRail: true,
     standing: [],
     standingWest: 0,
-    facility: buildPassengerFacility('whistlePost'),
+    facility: buildPassengerFacility(tier),
     modifiers: [],
     enhancements: [],
   };
@@ -180,7 +209,7 @@ function buildOfficeArea(seat: SeatIndex): OfficeArea {
 
   return {
     seat,
-    tier: 'whistlePost',
+    tier,
     grid,
     officeCoord,
     runningRow: row,
@@ -224,13 +253,29 @@ function buildPassengerFacility(tier: Parameters<typeof officeProfile>[0]): NonN
  * placed between each player"), which is what gives the Division its terrain and therefore its
  * crossing times.
  */
+/**
+ * THE MAINLINE CARDS ARE DEALT FROM A DECK, NOT ROLLED.
+ *
+ * `MAINLINE_PROFILES` is a list of card TYPES and this drew from it uniformly WITH replacement, so
+ * a Division could be handed two Interchanges or two Tunnels, and Plains — printed twice in the
+ * deck — carried the same weight as cards printed once. `MAINLINE_DECK` is the printed inventory
+ * (`docs/mainline-deck.md`, which flagged this as needing correction), and the
+ * deal is now a deal: take cards out of it and do not put them back.
+ *
+ * The Extra-start rules are what forced the issue. "An Extra may start at the Interchange if one is
+ * on the board" only reads as a rule if the board can hold at most one.
+ *
+ * A Division needs `players + 1` cards, so four players draw five from ten and the deck is never
+ * close to exhausted; the throw is there because a silent short Division would be very hard to see.
+ */
 function buildDivision(players: number, rng: Rng): DivisionNode[] {
   const nodes: DivisionNode[] = [];
-  const kinds = MAINLINE_PROFILES.map((m) => m.kind);
+  const deck = [...MAINLINE_DECK];
   const mainline = (): DivisionNode => {
-    const card = kinds[rng.nextInt(kinds.length)]!;
+    if (deck.length === 0) throw new Error('the Mainline deck ran out — too many players for it');
+    const card = deck.splice(rng.nextInt(deck.length), 1)[0]!;
     const node: DivisionNode = { kind: 'mainline', card, transits: [] };
-    if (mainlineProfile(card).speed.kind === 'grade') {
+    if (card === 'heavyGrade') {
       /**
        * SETTLED, not provisional (v0.5.0, Jesse's call) — this overrides the card's own printed
        * "Player sets orientation". A Heavy Grade sits on the shared west-to-east chain BETWEEN two
@@ -238,7 +283,11 @@ function buildDivision(players: number, rng: Rng): DivisionNode[] {
        * district — so whichever direction climbs advantages one neighbour over the other, and there
        * is no single player who owns that call fairly. Orientation is rolled from the seed instead,
        * identically for solitaire and multiplayer, and this is not expected to change when setup
-       * eventually gains an interactive phase for other decisions. See implications.md §10 Q11.
+       * eventually gains an interactive phase for other decisions.
+       *
+       * RE-CONFIRMED 2026-08-23, when the question was raised again and giving the choice to the
+       * Superintendent was considered and rejected — the office rotates every three Stages, the
+       * advantage it would hand out does not. See implications.md §10 Q11.
        */
       node.gradeUp = rng.nextInt(2) === 0 ? 'east' : 'west';
     }
@@ -265,6 +314,9 @@ export function createGame(opts: SetupOptions): GameState {
 
   const rng = createRng(seed);
   const playerCount = playerNames.length;
+  // Resolved once, here, because it decides BOTH the Office every area is built on and which office
+  // cards the deck holds — and the two must not be able to disagree.
+  const startingOffice = houseRules(config).startingOffice;
 
   const players = playerNames.map((name, index) => ({ index, name, revenue: 0 }));
 
@@ -272,7 +324,7 @@ export function createGame(opts: SetupOptions): GameState {
   // the players occupying them, and starts as the identity mapping, which is what makes the
   // seat/player split behaviour-neutral. Employee Rotation would rotate this array and nothing else.
   const officeAreas = new Map<SeatIndex, OfficeArea>();
-  for (let seat = 0; seat < playerCount; seat++) officeAreas.set(seat, buildOfficeArea(seat));
+  for (let seat = 0; seat < playerCount; seat++) officeAreas.set(seat, buildOfficeArea(seat, startingOffice));
   // §4.4 - highest D12 takes the Eastern Division Point; §4.5 - highest begins as Superintendent.
   // Both rolls are drawn even in solitaire so the RNG stream stays identical across player counts.
   const divisionRolls = players.map(() => rng.d12());
@@ -319,7 +371,7 @@ export function createGame(opts: SetupOptions): GameState {
    */
   const rules = houseRules(config);
   const deal = OPENING_DEALS[rules.startingHand];
-  const deck = buildDeck(config.mode, config.pvpCardsAllowed);
+  const deck = buildDeck(config.mode, config.pvpCardsAllowed, rules.startingOffice, rules.secondSectionCard);
   const cards = new Map<CardId, Card>();
   for (const c of deck) cards.set(c.id, c);
 
@@ -404,16 +456,21 @@ export function createGame(opts: SetupOptions): GameState {
       phase: 'localOps',
       currentActor: superintendent,
       pendingDecision: null,
-      clearanceRuling: null,
+      decisionAnswer: null,
       superintendent,
       actorOffset: 0,
     },
     turns: freshTurns(playerCount, MOVES_PER_LOCAL_OPS),
     movedThisPhase: new Set(),
     collisionsToday: 0,
+    collisionsPrevDay: 0,
     collisionsTotal: 0,
     status: 'active',
     outcome: null,
+    extraDays: 0,
+    extensionVotes: players.map(() => null),
+    official: null,
+    tally: emptyTally(playerCount),
   };
 }
 

src/engine/state.ts

@@ -17,7 +17,7 @@ import type {
   OfficeTier,
   TrackGeometry,
 } from './content.ts';
-import { MAX_CONSIST, officeProfile } from './content.ts';
+import { HAND_LIMIT, MAX_CONSIST, officeProfile } from './content.ts';
 
 // ---------------------------------------------------------------------------
 // Identifiers
@@ -55,7 +55,47 @@ export function coordKey(c: GridCoord): string {
 // ---------------------------------------------------------------------------
 
 /** §2.2 — a coloured car is loaded, a white car is empty. */
-export type RollingStock = { type: CarType; loaded: boolean };
+export type RollingStock = {
+  type: CarType;
+  loaded: boolean;
+  /**
+   * WHICH OFFICE AREA MADE THIS LOAD — the physical game's chip turned upside down in the tray.
+   *
+   * Reported from playtesting v0.4.9d as two bugs with one cause: a boxcar loaded at a Freight
+   * House could be unloaded at that same Freight House on the next Laborer action, and passengers
+   * who had just boarded could be detrained again before the train turned a wheel. Both paid full
+   * Revenue at each end for a load that never went anywhere.
+   *
+   * Jesse's rule (v0.4.9e): freight or passengers loaded anywhere in an Office Area may not be
+   * unloaded ANYWHERE in that same Office Area — not at another facility, not in a later Stage.
+   * They have to be carried by a train to a different Office Area. So the stamp is the SEAT, which
+   * is what an Office Area belongs to (Employee Rotation moves players between chairs; the district
+   * stays with the chair), and it never expires.
+   *
+   * A SEAT, NOT A PLAYER, and undefined rather than -1 for "no origin": the Division Yard opens with
+   * loaded cars and loaded coaches that were made up off-Division (`ROLLING_STOCK_SUPPLY`), and
+   * those are exactly the inbound traffic a solitaire district lives on. A sentinel inside
+   * `SeatIndex`'s own value range is not a sentinel — see `card.play`'s `node` in intents.ts.
+   *
+   * Stripped by `pooled` whenever a car goes back to a yard: the stamp belongs to the LOAD, and a
+   * car returning to the common supply is carrying nothing.
+   */
+  origin?: SeatIndex;
+};
+
+/**
+ * A car returning to the common pool — the Division or Classification Yard — with its load's origin
+ * stamp taken off.
+ *
+ * Every yard push goes through this. A loaded car CAN reach a yard still loaded (a train retires at
+ * a Division Point with freight aboard, `advance.ts`), and without this it would carry a stamp from
+ * a district it left several Days ago into whatever train is made up from it next.
+ */
+export function pooled(car: RollingStock): RollingStock {
+  if (car.origin === undefined) return car;
+  const { origin: _origin, ...rest } = car;
+  return rest;
+}
 
 // ---------------------------------------------------------------------------
 // Track and Office Area
@@ -314,6 +354,32 @@ export type CrewTray = {
   /** null while a local crew is switching without a train card. */
   trainNumber: number | null;
   trainIsExtra: boolean;
+  /**
+   * STILL BEING ASSEMBLED, somewhere that is not a Division Point.
+   *
+   * `isBeingMadeUp` used to read the position alone — "standing at a Division Point" — which was
+   * true of every train being built when the only place to build one WAS a Division Point. An Extra
+   * may now be started at a Control Point or in an Interchange's yard (§7), and those trains could
+   * not be given a consist at all: they ran empty, and so did every Control Point Extra since that
+   * option was added. Jesse's report says it plainly — an Extra started at the Interchange "would be
+   * loaded with cars".
+   *
+   * Set when such an Extra is placed and cleared the moment it starts running (`enterMainline`), so
+   * it names a train that is being made up rather than one that merely happens to be standing
+   * somewhere. That distinction is load-bearing: a train that ARRIVED at an Office must never be
+   * fillable from the Division Yard, which is the "cars appearing on a train nobody was making up"
+   * bug `isBeingMadeUp` was tightened to kill, and an arriving train never carries this.
+   */
+  beingMadeUp?: boolean;
+  /**
+   * WHOSE TRAIN THIS IS TO BUILD, for an Extra only.
+   *
+   * §7's Extra is loaded by the player who played the card, not by the Superintendent-first round
+   * that fills a Timetabled train — so the tray has to remember them: `pendingExtras` is emptied the
+   * moment the Extra starts, which is before a single car goes on. Undefined on every Timetabled
+   * train, where the round decides instead.
+   */
+  builtBy?: PlayerIndex;
   /**
    * WHERE THE ENGINE SITS IN THE TRAY, as an index into `consist`.
    *
@@ -379,20 +445,27 @@ export type CrewTray = {
   position: NodeRef;
   movesUsed: number;
   /**
-   * X18 Circus Train — "one turn stopped on any track (circus set-up) earns 1 point", claimed once.
+   * X18 Circus / X17 Campaign — Office Areas this train has already been paid for setting up in
+   * (Gitea#13).
    *
-   * Recorded on the tray rather than the player because it is the TRAIN that sets up, and an Extra
-   * runs once and is gone; there is no second visit to claim it on.
+   * "Once per stop in an office area. In a multiplayer game, each player could score if the circus
+   * stops in their area" (Jesse, 2026-08-29). So the claim is per SEAT, not per train: a Circus
+   * touring three districts is paid three times, and one that parks in the same district for six
+   * Stages is paid once.
+   *
+   * Recorded on the tray, which also gives the other half of Jesse's ruling for free — "if the
+   * circus train gets recycled and played a second time as a second extra, then it could again
+   * score points later too". A train is made up onto a FRESH tray object every time, so a re-played
+   * Extra starts with an empty list and no reset code is needed.
    */
-  stopPointClaimed?: boolean;
+  stopPointSeats?: SeatIndex[];
   /**
    * X17 Campaign Train — "one turn at station (speeches) then expedite".
    *
    * It makes its speech at the first Office it reaches: that arrival is an ordinary stop, and from
    * then on the train is expedited — it may be switched normally, but it faults (Q3) if it is left
    * off the Office square when a Mainline Phase begins. Recorded on the tray for the same reason as
-   * `stopPointClaimed` — it is the TRAIN that stops, and an Extra runs once, so there is no later
-   * visit to hang it on.
+   * `stopPointSeats` — it is the TRAIN that stops, and a re-played Extra gets a fresh tray.
    */
   speechMade?: boolean;
 };
@@ -430,6 +503,20 @@ export type DivisionNode =
       kind: 'mainline';
       card: MainlineKind;
       transits: Transit[];
+      /**
+       * TRAINS STANDING IN THE INTERCHANGE'S YARD — not out on the running line.
+       *
+       * Only an Interchange ever has these. An Extra started there (§7, Jesse's ruling) is made up
+       * in the yard beside the Mainline, which is why placing it can never be a collision however
+       * busy the card is: it is not on the road yet. It highballs onto this same card at a later
+       * Mainline Phase, through the ordinary §8.1 clearance check — held automatically against a
+       * facing train, put to the Superintendent against a following one — and becomes a `Transit`
+       * at that moment, exactly like a train leaving a Division Point.
+       *
+       * A tray listed here has `position.at === 'mainline'` with this node's index and NO entry in
+       * `transits`. That pair is what distinguishes standing from crossing.
+       */
+      holding?: TrayId[];
       absSignals?: boolean;
       /** Brakeman / Airbrakes / Helpers / Realignment laid on this card. */
       modifiers?: string[];
@@ -438,10 +525,23 @@ export type DivisionNode =
        * "Player sets orientation", so the direction is chosen when the card is placed.
        */
       gradeUp?: Direction;
-      /** Red Flags protecting a stopped train here, by tray. */
-      redFlagged?: TrayId[];
     }
-  | { kind: 'office'; seat: SeatIndex };
+  | {
+      kind: 'office';
+      seat: SeatIndex;
+      /**
+       * §Q, RED FLAGS (Gitea#19) — the side of this district a flag is planted on.
+       *
+       * "If played, asked FLAG EAST or FLAG WEST. That stops all trains from entering your limits
+       * from that direction (i.e. Flag East holds westbound trains)." So the value names the SIDE,
+       * and a train arriving from that side is held: a westbound train comes from the east.
+       *
+       * SPENT ON THE TRAIN IT STOPS (Jesse's ruling, 2026-08-29). One card, one train — the flag
+       * comes down as it is used, so there is no lifting action to build, nothing to forget, and a
+       * flag cannot quietly strangle the Division.
+       */
+      redFlag?: Direction;
+    };
 
 /** Ordered west to east. For N players: N Office nodes and N+1 Mainline cards. */
 export type Division = { nodes: DivisionNode[] };
@@ -454,6 +554,8 @@ export type CardKind =
   | { kind: 'timetabledTrain'; number: number }
   | { kind: 'extraTrain'; number: number }
   | { kind: 'office'; tier: OfficeTier }
+  /** Q9 — ordered on a train that is due out; a second, identical train runs right behind it. */
+  | { kind: 'secondSection' }
   | { kind: 'freightFacility'; facility: FreightKind }
   | { kind: 'modifier'; modifier: ModifierKind }
   /** Handedness is printed on the card: it is the diagonal the 45° leg lies on. */
@@ -505,10 +607,42 @@ export type Yards = {
 export type Phase = 'localOps' | 'newTrain' | 'mainline' | 'loadUnload' | 'shiftChange';
 
 /** §8.1 fourth condition — the Superintendent rules on a following train. */
-export type SuperintendentClearance = {
-  train: TrayId;
-  occupiedBy: TrayId;
-};
+/**
+ * AN INTERRUPTION TO THE AUTOMATIC MAINLINE PHASE — a question the driver cannot answer itself.
+ *
+ * There was one of these and it was hardcoded to one question asked of one player: the §8.1
+ * clearance ruling, always to the Superintendent. Gitea#5 and Gitea#19 each need to stop the same
+ * phase and ask a DIFFERENT player something different, so the shape is a union and `decisionActor`
+ * below decides who answers.
+ *
+ * Every member names the `train` the question is about, because the answer has to be matched back
+ * to it — see `DecisionAnswer`.
+ */
+export type PendingDecision =
+  /** §8.1 — a following train in the same Subdivision. The Superintendent rules. */
+  | { kind: 'clearance'; train: TrayId; occupiedBy: TrayId }
+  /**
+   * §11 (Gitea#5) — an inbound freight may take the Yard Office instead of the Train Order Office.
+   * Asked of whoever sits in `seat`, on the Mainline Phase the train arrives.
+   */
+  | { kind: 'yardOffice'; train: TrayId; seat: SeatIndex }
+  /**
+   * §Q (Gitea#19) — a train is about to enter this district into a collision, and its owner holds a
+   * Red Flags card. "You can play the card normally or out of phase, but only if you need it."
+   */
+  | { kind: 'redFlag'; train: TrayId; seat: SeatIndex; from: Direction };
+
+/**
+ * The answer, waiting to be consumed by the train that asked.
+ *
+ * Without this the driver would re-evaluate the same train, ask the same question, and never
+ * advance. Keyed by `kind` as well as `train` so an answer can never be mistaken for the reply to a
+ * different question about the same train.
+ */
+export type DecisionAnswer =
+  | { kind: 'clearance'; train: TrayId; allow: boolean }
+  | { kind: 'yardOffice'; train: TrayId; take: boolean }
+  | { kind: 'redFlag'; train: TrayId; flag: boolean };
 
 export type Clock = {
   day: number;
@@ -517,13 +651,10 @@ export type Clock = {
   phase: Phase;
   /** Exactly one player may act at a time. Null during automatic Mainline movement. */
   currentActor: PlayerIndex | null;
-  /** Interrupts the Mainline Phase to ask the Superintendent (§8.1). */
-  pendingDecision: SuperintendentClearance | null;
-  /**
-   * The Superintendent's answer, waiting to be consumed by the train that asked. Without this the
-   * driver would re-evaluate the same train and ask the same question forever.
-   */
-  clearanceRuling: { train: TrayId; allow: boolean } | null;
+  /** Interrupts the Mainline Phase to ask a player something (§8.1, §11). */
+  pendingDecision: PendingDecision | null;
+  /** The answer to `pendingDecision`, waiting to be consumed by the train that asked. */
+  decisionAnswer: DecisionAnswer | null;
   superintendent: PlayerIndex;
   /**
    * How far round the table the current phase has got. Acting order starts at the Superintendent
@@ -604,6 +735,139 @@ export type Outcome = {
   reason: OutcomeReason;
 };
 
+/**
+ * §3.3, EXTENDED PLAY (Gitea#11) — which endings may be played past.
+ *
+ * Both days-based endings offer another Day: running out of timetable, and closing short of the
+ * combined Revenue floor, are the same event seen twice — the last Day ended and this is what the
+ * books say. A `collisionFloor` ending is NOT extendable, and neither is a collision breach that
+ * happens during an extended Day: §3.4 stopped the game because the railroad was declared unsafe,
+ * and carrying on regardless would contradict the rule that stopped it (Jesse's call, 2026-08-28).
+ */
+export function isExtendable(reason: OutcomeReason): boolean {
+  return reason === 'daysElapsed' || reason === 'revenueFloor';
+}
+
+/**
+ * Running counts of everything interesting that has happened, tallied from the event stream
+ * (Gitea#16).
+ *
+ * WHY IT LIVES ON `GameState` rather than being computed by whoever happens to want it. Three
+ * reasons, in ascending order of how much they cost to work around:
+ *
+ *   1. `snapshot()` already takes a `GameState`, so every number here reaches a MULTIPLAYER client
+ *      through the `Frame` it is already being sent — no new server route, no new `Push` field, no
+ *      new `Session` method, and no second implementation that can disagree with the first.
+ *   2. It is REPLAY-EXACT. A save is `{ seed, config, history }` replayed through the engine
+ *      (`web/game.ts`'s `fromSave`), so a tally folded from the events that replay emits is rebuilt
+ *      identically every time — which is what makes Undo and a server restart correct here for free.
+ *   3. The official result freezes a COPY of this at the moment the timetable ran out (`official`
+ *      below), and a frozen copy has to be taken from something that already exists.
+ *
+ * Aggregate counts only. Nothing here is seat-secret — no card ids, no hands — which is why
+ * `test/redaction.test.ts` stays green with the whole thing on the Frame.
+ *
+ * NOT SCORING. Nothing in here feeds a rule; it is read by the results screen and by the badge work
+ * that Gitea#16 leaves to a second pass. Adding a counter is always safe.
+ */
+export type Tally = {
+  /** §8.3 — a train that ran the length of the Division and left it. */
+  trainsCompleted: number;
+  /**
+   * Of those, how many did some switching between being made up and leaving.
+   *
+   * The join Gitea#16 asks for by name ("a player who completes an entire game where every train
+   * that passed through did some switching on"). Counted as the train completes, against whether
+   * that tray has coupled or dropped anything since it was made up — which is why `switchedSince`
+   * below exists rather than this being derivable afterwards.
+   */
+  trainsCompletedWithWork: number;
+  /** §10 — trains lost to a collision, and the cars that went with them. */
+  trainsDestroyed: number;
+  carsDestroyed: number;
+  /** §6 — switching volume, both directions. */
+  carsCoupled: number;
+  carsDropped: number;
+  /** §9.1 — the MEN | AT | WORK pipeline: begun, and carried all the way through. */
+  loadsStarted: number;
+  loadsCompleted: number;
+  unloadsBegun: number;
+  unloadsCompleted: number;
+  /** §9.2 — passenger work. */
+  passengersBoarded: number;
+  passengersDetrained: number;
+  /** Colour, and the vocabulary the badge pass will draw on. */
+  flyingSwitches: number;
+  officeUpgrades: number;
+  dispatchBonusesUsed: number;
+  facilitiesUnjammed: number;
+  expediteFaults: number;
+  trainsHeld: number;
+  trainsDiverted: number;
+  secondSections: number;
+  extrasStarted: number;
+  cardsDrawn: number;
+  cardsPlayed: number;
+  cardsDiscarded: number;
+  clearancesRequested: number;
+  /** §8.1 — rulings that let the other train through. A refusal is a ruling too, but not this one. */
+  clearancesAllowed: number;
+  /**
+   * X18 CIRCUS SET-UPS — a train that spent a Stage standing still and was paid for it (§X18).
+   *
+   * NOT "the longest an engine sat on a siding", which is what Gitea#16 asks for and what the
+   * comment on that issue assumed this was. `trainStoodStill` is emitted ONCE IN A GAME PER SUCH
+   * TRAIN — only for a train whose profile has `stopEarnsPoint`, and `advance.ts` sets
+   * `stopPointClaimed` so it can never fire twice. There is no per-Stage "this train did not move"
+   * signal in the engine at all, so a longest-stand streak cannot be folded from the event stream:
+   * it needs an engine-side signal that does not exist yet. Recorded in `TODO.md` for the badge
+   * pass rather than shipped as a statistic that would read "1 Stage" for ever.
+   */
+  circusStops: { trainNumber: number; where: string }[];
+  /**
+   * Train numbers that have coupled or dropped something since they were made up, for
+   * `trainsCompletedWithWork`. Cleared when the train is made up and when it leaves the Division.
+   */
+  switchedSince: number[];
+  /** Indexed by PLAYER. Only events that name a player reach these. */
+  byPlayer: PlayerTally[];
+};
+
+export type PlayerTally = {
+  loads: number;
+  unloads: number;
+  passengersBoarded: number;
+  passengersDetrained: number;
+  cardsPlayed: number;
+  /** §10 — collisions this player was faulted for, not collisions they were caught in. */
+  collisions: number;
+  /** Revenue gained and Revenue lost, kept apart: the net is already on `players[i].revenue`. */
+  revenueGained: number;
+  revenueLost: number;
+};
+
+/**
+ * THE OFFICIAL RESULT, frozen at the moment the timetable ran out (Gitea#11).
+ *
+ * "The winner is based upon the original game length. In a five-day game, even if it's extended to
+ * eight or nine days, the winner and the official answer is the winner at the end of five days"
+ * (Jesse, 2026-08-28). So this is written ONCE, at the first ending, and never overwritten —
+ * including by a §3.4 collision breach during an extended Day, which ends play without touching it.
+ *
+ * `state.outcome` keeps moving: it is always the CURRENT evaluation, which is what the live game
+ * wants. Once `official` exists, everything after it is informational.
+ */
+export type FinalReport = {
+  /** The Day the game was scheduled to end on — always `config.days`. */
+  day: number;
+  outcome: Outcome;
+  /** Every player's Revenue at that moment, in player order. */
+  revenues: number[];
+  collisionsTotal: number;
+  /** The Tally as it stood when the timetable ran out. */
+  tally: Tally;
+};
+
 /**
  * Per-Stage transient bookkeeping for the acting player. Reset when the actor changes.
  *
@@ -613,6 +877,25 @@ export type Outcome = {
 export type TurnState = {
   option: 'switch' | 'draw' | 'freightAgent' | null;
   movesRemaining: number;
+  /**
+   * What `movesRemaining` started at this Stage — six, or five under Reduced Visibility at night.
+   *
+   * CARRIED RATHER THAN ASSUMED. Every reader of `movesRemaining` that wanted to say "3 of 6" had
+   * hardcoded the 6, which is simply wrong on a night Stage, and the only other way to recover it is
+   * to re-derive `movesForStage` outside the phase driver that owns it. It also makes "is this the
+   * FIRST move of the turn?" a comparison rather than a guess, which is what the history panel needs
+   * to keep the opening move of a switching turn and drop the ones in the middle.
+   */
+  movesAllowed: number;
+  /**
+   * The last square this player's crew moved to this Stage, and which crew it was.
+   *
+   * Switching ends with a summary line, and "where did the train end up" is the half of it a player
+   * actually wants. It cannot be recovered from the log: the line naming the last move is written
+   * before anyone knows it was the last, and the log streams to clients as it is written, so a line
+   * already sent cannot be revised afterwards.
+   */
+  lastMove?: { trayId: TrayId; to: GridCoord };
   drawnThisTurn: boolean;
   freightAgentUsed: boolean;
   /**
@@ -646,6 +929,66 @@ export function freshTurns(players: number, moves: number): Map<PlayerIndex, Tur
   return turns;
 }
 
+/** A Tally with everything at zero — the state every game starts in (Gitea#16). */
+export function emptyTally(players: number): Tally {
+  return {
+    trainsCompleted: 0,
+    trainsCompletedWithWork: 0,
+    trainsDestroyed: 0,
+    carsDestroyed: 0,
+    carsCoupled: 0,
+    carsDropped: 0,
+    loadsStarted: 0,
+    loadsCompleted: 0,
+    unloadsBegun: 0,
+    unloadsCompleted: 0,
+    passengersBoarded: 0,
+    passengersDetrained: 0,
+    flyingSwitches: 0,
+    officeUpgrades: 0,
+    dispatchBonusesUsed: 0,
+    facilitiesUnjammed: 0,
+    expediteFaults: 0,
+    trainsHeld: 0,
+    trainsDiverted: 0,
+    secondSections: 0,
+    extrasStarted: 0,
+    cardsDrawn: 0,
+    cardsPlayed: 0,
+    cardsDiscarded: 0,
+    clearancesRequested: 0,
+    clearancesAllowed: 0,
+    circusStops: [],
+    switchedSince: [],
+    byPlayer: Array.from({ length: players }, () => ({
+      loads: 0,
+      unloads: 0,
+      passengersBoarded: 0,
+      passengersDetrained: 0,
+      cardsPlayed: 0,
+      collisions: 0,
+      revenueGained: 0,
+      revenueLost: 0,
+    })),
+  };
+}
+
+/**
+ * A deep copy, for freezing the official result (`FinalReport`).
+ *
+ * Written out rather than reached for via `structuredClone` because a Tally is a flat bag of numbers
+ * with two containers in it, and spelling the copy out means a field added later that needs deep
+ * copying is a compile error here rather than a shared reference discovered in a results screen.
+ */
+export function cloneTally(t: Tally): Tally {
+  return {
+    ...t,
+    circusStops: t.circusStops.map((c) => ({ ...c })),
+    switchedSince: [...t.switchedSince],
+    byPlayer: t.byPlayer.map((p) => ({ ...p })),
+  };
+}
+
 /**
  * WHICH WAY TO DRAW THE ENGINE — east or west, for every train, everywhere.
  *
@@ -691,22 +1034,25 @@ export function standingSides(
 }
 
 /**
- * The cut a train would run into if it left this card through `exit` — the cars between it and that
- * end of the card.
+ * The cut a train would run into if it left this card by the `exit` END OF THE ROW — the cars
+ * between it and that end. Returned in the order the train MEETS them, nearest first, which is what
+ * `carsCoupled` wants.
  *
- * Only 'e' and 'w' can hold a cut: the array is a west-to-east row, so a train leaving north or
- * south off a curve or a spur is not running along it and meets nothing. Returned in the order the
- * train MEETS them, nearest first, which is what `carsCoupled` wants.
+ * `exit` IS AN END OF THE ROW, NOT A PORT. It used to be a raw `Port`, and answered "you meet
+ * nothing" for north and south on the reasoning that a leg leaving through an edge is not running
+ * along the west-to-east row. It is: a `sw` curve's south leg IS the east end of that row, so a
+ * crew standing on the curve pulled out through the leg and drove away leaving the cars beside it
+ * standing, against §A.4's mandatory coupling (Gitea#17). Callers resolve the leg with `rowEndAt`
+ * (`track.ts`), which lives there because only the card's arc can say which end a leg is — and the
+ * narrowed type is what makes every caller do it.
  */
 export function cutTowards(
   tray: { standingWest?: number | undefined },
   cars: readonly RollingStock[],
-  exit: 'n' | 's' | 'e' | 'w',
+  exit: 'e' | 'w',
 ): RollingStock[] {
   const { west, east } = standingSides(tray, cars);
-  if (exit === 'e') return east;
-  if (exit === 'w') return [...west].reverse();
-  return [];
+  return exit === 'e' ? east : [...west].reverse();
 }
 
 export function turnOf(s: GameState, player: PlayerIndex): TurnState {
@@ -715,10 +1061,24 @@ export function turnOf(s: GameState, player: PlayerIndex): TurnState {
   return t;
 }
 
+/**
+ * §6.2 — IS THIS PLAYER HOLDING MORE THAN THEY MAY? Three cards, or four while a Red Flag is held.
+ *
+ * ONE answer, because there were three of them: `check('draw.end')` refused on it, `snapshot()`
+ * recomputed it inline for the Frame, and `web/game.ts` kept a third for the page. All three agreed
+ * — which is the state a disagreement starts from, and #96 is what that costs when the two halves
+ * are a screen and the server that refuses what the screen offered.
+ */
+export function overHandLimit(s: GameState, player: PlayerIndex): boolean {
+  const hand = s.decks.hands.get(player) ?? [];
+  return hand.length > (s.decks.redFlags.get(player) ? HAND_LIMIT + 1 : HAND_LIMIT);
+}
+
 export function freshTurn(moves: number): TurnState {
   return {
     option: null,
     movesRemaining: moves,
+    movesAllowed: moves,
     drawnThisTurn: false,
     freightAgentUsed: false,
     freightWorked: {},
@@ -760,8 +1120,15 @@ export type GameState = {
   /**
    * §7 — Extra Trains played from hand, waiting for a free Crew Tray. An Extra is not scheduled:
    * it runs once, immediately, then its card goes to the Salvage Yard (§2.3).
+   *
+   * CARRIES WHO PLAYED IT (2026-08-23, Jesse's call). §7 gives an Extra to the player who played the
+   * card — "may place the Crew Tray at either Division Point ... and may load the consist as he
+   * chooses" — which is a different rule from the Timetabled make-up round, where the table goes
+   * round starting at the Superintendent. This was a bare `number[]`, so the engine could not tell
+   * whose Extra it was and asked whoever the acting order happened to be on: correct in solitaire,
+   * where there is only one player, and wrong at every table.
    */
-  pendingExtras: number[];
+  pendingExtras: { trainNumber: number; player: PlayerIndex }[];
   /**
    * Q9 — train numbers ordered to run a second section. The next New Train Phase makes up an
    * identical train behind the first, if a Crew Tray is free.
@@ -774,10 +1141,50 @@ export type GameState = {
   movedThisPhase: Set<TrayId>;
   /** §3.4 — resets at the start of each Day; checked against `config.maxCollisionsPerDay`. */
   collisionsToday: number;
+  /**
+   * What `collisionsToday` held for the Day that just ENDED — captured at the rollover, immediately
+   * before the reset.
+   *
+   * The Day-end dialog exists to report the Day that finished, and it is drawn from the frame AFTER
+   * the rollover, because that is the frame whose `day` went up. So it read `collisionsToday` as 0 no
+   * matter what had happened: Jesse, 2026-09-09, at the end of a Day 1 with two collisions in it —
+   * "it shows a total of two collisions, but zero today ... that does seem to be a contradiction".
+   *
+   * NOT DERIVABLE ON THE CLIENT. A Day turns over inside the phases that run themselves, so in
+   * multiplayer the push that reports the new Day is the same push that reports the reset — a client
+   * may never see the ended Day's final count to remember it.
+   */
+  collisionsPrevDay: number;
   /** §3.4 — never reset; checked against `config.maxCollisionsTotal`. */
   collisionsTotal: number;
-  status: 'setup' | 'active' | 'finished';
+  /**
+   * `awaitingExtension` is Gitea#11: the timetable has run out, the result is recorded, and the
+   * table is being asked whether to play one more Day. It is a PAUSE, not an ending — `advance`
+   * reports `needsInput` there, the server resumes it like any live game, and the only intent the
+   * rules will accept is `game.extend`.
+   */
+  status: 'setup' | 'active' | 'awaitingExtension' | 'finished';
+  /** The CURRENT evaluation, re-decided at the end of every Day including extended ones. */
   outcome: Outcome | null;
+  /**
+   * §3.3 (Gitea#11) — Days granted beyond `config.days`, one vote at a time.
+   *
+   * `config.days` is deliberately never touched: it is what the official result was decided at, so
+   * leaving it alone is what makes "the winner is decided at the original game length" a fact about
+   * the code rather than a comment on it.
+   */
+  extraDays: number;
+  /**
+   * Per PLAYER, while `awaitingExtension`. `null` means they have not voted yet.
+   *
+   * Unanimous, and one refusal is decisive: nobody is made to wait on a player who has already said
+   * no (Jesse's call, 2026-08-28). Solitaire is the same code with one voter.
+   */
+  extensionVotes: (boolean | null)[];
+  /** Frozen at the FIRST ending and never overwritten. See `FinalReport`. */
+  official: FinalReport | null;
+  /** Gitea#16. Folded from the event stream; see `Tally`. */
+  tally: Tally;
 };
 
 // ---------------------------------------------------------------------------
@@ -822,6 +1229,40 @@ export function playerAtSeat(state: GameState, seat: SeatIndex): PlayerIndex {
   return p;
 }
 
+/** This seat's node on the Division — where its Limits, and any Red Flag on them, live. */
+export function officeNodeFor(
+  state: GameState,
+  seat: SeatIndex,
+): Extract<DivisionNode, { kind: 'office' }> | null {
+  for (const n of state.division.nodes) if (n.kind === 'office' && n.seat === seat) return n;
+  return null;
+}
+
+/**
+ * WHO MUST ANSWER the interruption, or null when nothing is pending.
+ *
+ * The one place that knows which player each kind of question goes to. §8.1's clearance is the
+ * Superintendent's ruling wherever it happens; the Yard Office is offered to whoever sits in the
+ * district the train is arriving at, because it is their card and their yard.
+ */
+export function decisionActor(state: GameState): PlayerIndex | null {
+  const d = state.clock.pendingDecision;
+  if (!d) return null;
+  return d.kind === 'clearance' ? state.clock.superintendent : playerAtSeat(state, d.seat);
+}
+
+/**
+ * WHOSE MOVE IT IS RIGHT NOW — a pending interruption's owner if there is one, else the phase's
+ * own actor.
+ *
+ * Written out six times across the engine, the sim, the web client and the tests as
+ * `pendingDecision !== null ? superintendent : currentActor`, which stopped being right the moment
+ * a second kind of question existed. One copy now, so a new decision kind cannot be half-adopted.
+ */
+export function actingPlayer(state: GameState): PlayerIndex | null {
+  return decisionActor(state) ?? state.clock.currentActor;
+}
+
 /** Where this player is sitting, and therefore which Office Area is theirs. */
 /**
  * The player `n` seats to the LEFT of this one, wrapping round the table.

src/engine/tally.ts

@@ -0,0 +1,201 @@
+/**
+ * The event tally — Gitea#16's statistics, folded from the event stream into `GameState.tally`.
+ *
+ * WHERE IT IS HOOKED, and why it is not in `reduce`. `apply.ts`'s `reduce` sees only the events an
+ * INTENT produced; `advance.ts` mutates state directly and pushes its events without reducing them
+ * at all — and `advance` is where `trainCompleted`, `trainsDestroyed` and `trainStoodStill` come
+ * from, which are exactly the numbers this issue asks for. So the fold is hooked at the two places
+ * every event in the game passes through exactly once on its way to a caller:
+ *
+ *   - `applyIntent` (`apply.ts`), beside its `reduce` loop;
+ *   - `advance` (`advance.ts`), which now wraps the phase driver and folds what it returns.
+ *
+ * Exactly once matters in both directions: an event folded twice inflates a count, and an event
+ * folded nowhere is a statistic that silently reads zero. `test/tally.test.ts` pins both by playing
+ * real games and checking the tally against an independent count over the same event array.
+ *
+ * NOTHING HERE IS A RULE. The tally is read by the results screen and by the badge work Gitea#16
+ * leaves to a second pass; no engine decision consults it. That is what makes adding a counter
+ * always safe.
+ *
+ * WHAT IS NOT COUNTED PER PLAYER, and why. `carsCoupled` and `carsDropped` carry a `trayId` and no
+ * `player` — switching is done BY a crew, and the event says which crew rather than which person.
+ * Rather than guess an owner from whose turn it happened to be, those two are table totals only.
+ * The events that do name a player (`loadCompleted`, `passengersBoarded`, `cardPlayed`,
+ * `revenueChanged`, `trainsDestroyed`) are the ones `byPlayer` reports.
+ */
+
+import type { GameEvent } from './events.ts';
+import type { GameState } from './state.ts';
+
+/**
+ * Fold one event into `s.tally`.
+ *
+ * The switch is deliberately not exhaustive — most of the 49 event types say nothing a player would
+ * want counted, and listing them all to `break` would bury the ones that do. A `default` that does
+ * nothing is the honest shape.
+ */
+export function tallyEvent(s: GameState, e: GameEvent): void {
+  const t = s.tally;
+  const mine = 'player' in e && typeof e.player === 'number' ? t.byPlayer[e.player] : undefined;
+
+  switch (e.type) {
+    /**
+     * §X18 — the Circus train set up and was paid for the Stage it spent standing.
+     *
+     * NOT a "longest stand" streak, which is what Gitea#16 wants and what its comment assumed this
+     * event was. It fires once in a game per such train: only trains whose profile sets
+     * `stopEarnsPoint` emit it at all, and `advance.ts` claims it once with `stopPointClaimed`. So
+     * there is nothing to count a run of, and the honest thing to report is the event itself.
+     */
+    case 'trainStoodStill':
+      t.circusStops.push({ trainNumber: e.trainNumber, where: e.where });
+      break;
+
+    /**
+     * DID THIS TRAIN DO ANY SWITCHING — Gitea#16's "switching master" join, kept as it happens
+     * rather than reconstructed afterwards.
+     *
+     * The two halves of the join are in different currencies: switching events name a `trayId` and
+     * completion names a `trainNumber`, and no event carries both. The tray is looked up in LIVE
+     * state, which is sound precisely here — a crew that has just coupled or dropped is still on the
+     * board — where re-deriving it at completion time would not be, the tray having been released by
+     * then. A lookup that misses costs one train its mark on a statistic; it cannot affect a rule.
+     */
+    case 'carsCoupled':
+      t.carsCoupled += e.stock.length;
+      markSwitched(s, e.trayId);
+      break;
+
+    case 'carsDropped':
+      t.carsDropped += e.stock.length;
+      markSwitched(s, e.trayId);
+      break;
+
+    case 'flyingSwitch':
+      t.flyingSwitches += 1;
+      markSwitched(s, e.trayId);
+      break;
+
+    // A tray is reused run after run, so a fresh train starts with a clean sheet.
+    case 'trainMadeUp':
+      t.switchedSince = t.switchedSince.filter((n) => n !== e.trainNumber);
+      break;
+
+    case 'trainCompleted':
+      t.trainsCompleted += 1;
+      if (t.switchedSince.includes(e.trainNumber)) t.trainsCompletedWithWork += 1;
+      t.switchedSince = t.switchedSince.filter((n) => n !== e.trainNumber);
+      break;
+
+    case 'trainsDestroyed':
+      t.trainsDestroyed += e.trains.length;
+      for (const train of e.trains) t.carsDestroyed += train.consist.length;
+      if (mine) mine.collisions += 1;
+      break;
+
+    case 'officeUpgraded':
+      t.officeUpgrades += 1;
+      break;
+
+    case 'dispatchBonusUsed':
+      t.dispatchBonusesUsed += 1;
+      break;
+
+    case 'facilityUnjammed':
+      t.facilitiesUnjammed += 1;
+      break;
+
+    case 'expediteFault':
+      t.expediteFaults += 1;
+      break;
+
+    case 'trainHeld':
+      t.trainsHeld += 1;
+      break;
+
+    case 'trainDiverted':
+      t.trainsDiverted += 1;
+      break;
+
+    case 'secondSectionOrdered':
+      t.secondSections += 1;
+      break;
+
+    case 'extraStarted':
+      t.extrasStarted += 1;
+      break;
+
+    case 'cardDrawn':
+      t.cardsDrawn += 1;
+      break;
+
+    case 'cardPlayed':
+      t.cardsPlayed += 1;
+      if (mine) mine.cardsPlayed += 1;
+      break;
+
+    case 'cardDiscarded':
+      t.cardsDiscarded += 1;
+      break;
+
+    case 'clearanceRequested':
+      t.clearancesRequested += 1;
+      break;
+
+    // §8.1 — a ruling is given either way; only a YES let the other train through.
+    case 'clearanceGiven':
+      if (e.allow) t.clearancesAllowed += 1;
+      break;
+
+    case 'loadStarted':
+      t.loadsStarted += 1;
+      break;
+
+    case 'loadCompleted':
+      t.loadsCompleted += 1;
+      if (mine) mine.loads += 1;
+      break;
+
+    case 'unloadBegan':
+      t.unloadsBegun += 1;
+      break;
+
+    case 'unloadCompleted':
+      t.unloadsCompleted += 1;
+      if (mine) mine.unloads += 1;
+      break;
+
+    case 'passengersBoarded':
+      t.passengersBoarded += 1;
+      if (mine) mine.passengersBoarded += 1;
+      break;
+
+    case 'passengersDetrained':
+      t.passengersDetrained += 1;
+      if (mine) mine.passengersDetrained += 1;
+      break;
+
+    /**
+     * Gained and lost are kept APART because the net is already on `players[i].revenue`. What the
+     * results screen cannot otherwise say is how much of a modest final score was earned and then
+     * handed back at a grade crossing — which is the whole difference between a quiet game and an
+     * eventful one.
+     */
+    case 'revenueChanged':
+      if (mine) {
+        if (e.delta >= 0) mine.revenueGained += e.delta;
+        else mine.revenueLost += -e.delta;
+      }
+      break;
+
+    default:
+      break;
+  }
+}
+
+function markSwitched(s: GameState, trayId: string): void {
+  const n = s.trays.get(trayId)?.trainNumber;
+  if (n === undefined || n === null) return;
+  if (!s.tally.switchedSince.includes(n)) s.tally.switchedSince.push(n);
+}

src/engine/track.ts

@@ -188,6 +188,40 @@ export function joins(a: TrackCard, p: Port, b: TrackCard): boolean {
   return slopeAt(a, p) === slopeAt(b, opposite(p));
 }
 
+/**
+ * WHICH END OF THE WEST-TO-EAST ROW A PORT SITS AT.
+ *
+ * `TrackCard.standing` is ordered west to east (§A.3), so whether a train meets the row front to
+ * back or back to front depends on which end it enters by — and a port is not always at one of
+ * those two extremes. Every 45° leg leaves through the MIDDLE of its north or south edge, so its
+ * end of the run is whichever end the arc does NOT reach: a `sw` curve's south leg is the EAST end
+ * of the row, and an `se` curve's south leg is the WEST end. Same port, opposite answers, which is
+ * why this has to ask the card rather than read the port.
+ *
+ * Gitea#17 is what both callers looked like without it. `exploreMoves` reversed the row for an 'e'
+ * entry and for nothing else, so backing into a cut through a `sw` curve's south leg coupled it up
+ * back to front — the caboose came out next to the engine, which §8.2 then calls badly made up.
+ * `cutTowards` answered "you meet nothing" for a north or south exit, so a crew standing on a curve
+ * pulled out through the leg and left the cars beside it standing, which §A.4 forbids.
+ *
+ * There is no north-south straight anywhere on the printed sheet (see the module comment), so a run
+ * touching a 45° leg always has an east or west port at its other end and the answer is never
+ * undefined. A TURNOUT is the one card whose row has three ends rather than two — and it is also
+ * the one card no cut can ever stand on, since a train may not stop there (§A.1) and so never sets
+ * anything out there. Its stem answers for it.
+ */
+export function rowEndAt(card: TrackCard, p: Port): 'e' | 'w' {
+  if (p === 'e' || p === 'w') return p;
+  for (const [a, b] of connectionsFor(card)) {
+    const other = a === p ? b : b === p ? a : null;
+    if (other === 'e') return 'w';
+    if (other === 'w') return 'e';
+  }
+  // Not a card the printed sheet can produce. Reading the leg as the west end leaves the row in the
+  // order it is stored rather than inventing a reversal on a card nothing knows the shape of.
+  return 'w';
+}
+
 // ---------------------------------------------------------------------------
 // Orientation (Gap 11)
 // ---------------------------------------------------------------------------
@@ -343,7 +377,7 @@ export function reachableDestinations(
   start: GridCoord,
   initialExit: Port,
 ): MoveDestination[] {
-  return exploreMoves(ctx, start, initialExit).destinations;
+  return exploreMoves(ctx, start, initialExit, false).destinations;
 }
 
 /**
@@ -355,7 +389,19 @@ export function reachableDestinations(
  * and only the obstructions are worth listing in the "why nothing is moving" panel, where every
  * turnout in the district would otherwise appear.
  */
-export type MoveBlockKind = 'noJoin' | 'occupied' | 'locked' | 'tooManyCars' | 'noStopping';
+export type MoveBlockKind =
+  | 'noJoin'
+  | 'occupied'
+  | 'locked'
+  | 'tooManyCars'
+  | 'noStopping'
+  /**
+   * The rails go there and the TRAIN'S OWN CARD does not allow it — a no-switching or drop-only
+   * train that would have to couple something, an empties-only train facing a loaded car, or a
+   * freight allowance already spent at that location. Decided by `check` rather than by the walk,
+   * so it is added in `movesFor` rather than emitted by `exploreMoves`.
+   */
+  | 'cardRule';
 export type MoveBlock = { coord: GridCoord; kind: MoveBlockKind; why: string };
 
 /**
@@ -400,12 +446,19 @@ export function exploreMoves(
   ctx: MoveContext,
   start: GridCoord,
   initialExit: Port,
+  /**
+   * False when only the destinations are wanted (`reachableDestinations`, every legality check): the
+   * rejections are then not recorded at all. They never change a destination, and building them was
+   * pure allocation on the hottest path in the engine.
+   */
+  collectBlocks = true,
 ): { destinations: MoveDestination[]; blocked: MoveBlock[] } {
   const { area, occupancy } = ctx;
   const results: MoveDestination[] = [];
   const blocked: MoveBlock[] = [];
   const noted = new Set<string>();
   const block = (coord: GridCoord, kind: MoveBlockKind, why: string): void => {
+    if (!collectBlocks) return;
     const k = coordKey(coord);
     if (noted.has(k)) return;
     noted.add(k);
@@ -425,10 +478,25 @@ export function exploreMoves(
     couples: RollingStock[];
     /** Coord key each entry in `couples` came off, aligned by index — see `routeOutcomeKey`. */
     origins: string[];
-    /** Cards visited on THIS route, start included. A per-path set, not a global one — see the
-     * module doc comment on `MAX_ENUMERATED_FRONTIER` for why a global one would forbid the very
-     * routes this walk exists to find. */
-    visited: Set<string>;
+  };
+
+  /**
+   * Has THIS route already used `to`? Per-path, not global — see the doc comment on
+   * `MAX_ENUMERATED_FRONTIER` for why a global set would forbid the very routes this walk exists to
+   * find.
+   *
+   * Read off the route's own `path` instead of a Set copied at every step, which was a large share of
+   * the walk's garbage. It answers exactly as that Set did: the start square, then every square
+   * enqueued along the route AFTER the first hop, including this node's own — the first hop's square
+   * was never added, and `path[0]` is that square, so the scan begins at 1.
+   */
+  const onRoute = (node: Frontier, to: GridCoord): boolean => {
+    if (sameCoord(to, start)) return true;
+    if (node.path.length > 0 && sameCoord(to, node.coord)) return true;
+    for (let k = 1; k < node.path.length; k++) {
+      if (sameCoord(node.path[k]!.coord, to)) return true;
+    }
+    return false;
   };
 
   // The very first hop is checked here because `start`'s card is not itself enqueued; every later
@@ -450,7 +518,7 @@ export function exploreMoves(
    *
    * Ordered nearest-first like every other card's, so it simply seeds the accumulator.
    */
-  const ownCut = cutTowards(startCard, carsOn(startCard), initialExit);
+  const ownCut = cutTowards(startCard, carsOn(startCard), rowEndAt(startCard, initialExit));
   const startKey = coordKey(start);
   const queue: Frontier[] = [
     {
@@ -459,13 +527,14 @@ export function exploreMoves(
       path: [],
       couples: ownCut,
       origins: ownCut.map(() => startKey),
-      visited: new Set([startKey]),
     },
   ];
   let enumerated = 1;
 
-  while (queue.length > 0) {
-    const node = queue.shift()!;
+  // FIFO by index rather than `shift()`, which re-packs the array on every pop. Same order.
+  let head = 0;
+  while (head < queue.length) {
+    const node = queue[head++]!;
     const card = cardAt(area, node.coord);
     if (!card) continue;
 
@@ -502,12 +571,15 @@ export function exploreMoves(
      * overfill the tray is illegal, not a move that picks up fewer cars.
      *
      * NEAREST FIRST ALONG THE DIRECTION OF TRAVEL. `carsOn` runs west to east, so a train entering
-     * through the card's EAST port meets them back to front and the row has to be reversed. Without
-     * this the same parked cut produced an identical consist whichever way it was approached, when
-     * the two must mirror — which is the difference between a run-around being worth a Move and
-     * being pointless.
+     * at the row's EAST end meets them back to front and the row has to be reversed. Without this
+     * the same parked cut produced an identical consist whichever way it was approached, when the
+     * two must mirror — which is the difference between a run-around being worth a Move and being
+     * pointless.
+     *
+     * `rowEndAt` rather than `node.entry === 'e'`: a 45° leg is an end of the row too, and which
+     * end it is depends on the card's arc (Gitea#17).
      */
-    const met = node.entry === 'e' ? [...carsOn(card)].reverse() : carsOn(card);
+    const met = rowEndAt(card, node.entry) === 'e' ? [...carsOn(card)].reverse() : carsOn(card);
     const couples = [...node.couples, ...met];
     const nodeKey = coordKey(node.coord);
     const origins = [...node.origins, ...met.map(() => nodeKey)];
@@ -555,17 +627,15 @@ export function exploreMoves(
       // direction; it never says without repeating ground, but a train cannot occupy the same
       // track twice at once either). Per-path, not global — a DIFFERENT route may legitimately
       // pass through a card this one already used.
-      const toKey = coordKey(to);
-      if (node.visited.has(toKey)) continue;
+      if (onRoute(node, to)) continue;
       if (enumerated >= MAX_ENUMERATED_FRONTIER) break;
       enumerated++;
       const step: MoveStep = { coord: node.coord, entry: node.entry, exit };
-      const visited = new Set(node.visited);
-      visited.add(toKey);
-      queue.push({ coord: to, entry: opposite(exit), path: [...node.path, step], couples, origins, visited });
+      queue.push({ coord: to, entry: opposite(exit), path: [...node.path, step], couples, origins });
     }
   }
 
+  if (!collectBlocks) return { destinations: results, blocked };
   // A card that turned out to be reachable after all is not a blocker: the walk may meet a square
   // from a bad angle first and a good one later.
   const reached = new Set(results.map((r) => coordKey(r.coord)));
@@ -626,10 +696,19 @@ export function carriesThroughTrack(card: TrackCard): boolean {
  * buildable column and break §11.3's promise that both Secondary rows, and the nine-spot Modifier
  * neighbourhood, are usable from the first Stage.
  *
- * MODIFIERS ARE NOT SUBJECT TO THIS, and are not track: §9 places one on any of the nine spots
- * around a Facility, and a Facility standing at the limit has three of its nine outside them.
- * Jesse's call. `check` bars them from the Running Track ROW instead, which is the ground the main
- * grows onto.
+ * MODIFIERS ARE SUBJECT TO THIS TOO, since 2026-09-17 — REVERSING an earlier call of Jesse's that
+ * exempted them. The exemption reasoned that §9 places a Modifier on any of the nine spots around a
+ * Facility, so a Facility standing at the limit has three of its nine outside them and bounding the
+ * card would make it unplayable exactly where a district ends. Play showed the cost of that the
+ * other way round: a Transmission Lines card went down at (-2,4) with the sign at column 3, which
+ * reads at the table as building outside your own territory, and §8.1 and §10 both reason about
+ * what is inside a player's Limits.
+ *
+ * THE FEARED CASE DID NOT ARISE, and was measured on the move that prompted the change rather than
+ * argued: the Power Plant sat at (-1,3) against a sign at 3, and (-2,2) and (-2,3) were both free,
+ * legal and inside. A Facility at the limit keeps six of its nine spots, and the Limits move outward
+ * as the Running Track grows (§2.1, Gap 4a), so the ground for a Modifier arrives with the district.
+ * `check` bars them from the Running Track ROW as well, which is the ground the main grows onto.
  */
 export function withinLimits(area: OfficeArea, coord: GridCoord): boolean {
   return coord.col >= area.limitsWest.col && coord.col <= area.limitsEast.col;
@@ -658,6 +737,26 @@ export function canPlaceAt(area: OfficeArea, coord: GridCoord, card: TrackCard):
   // into a stub and cutting the Office off from the Limits.
   if (coord.row === area.runningRow && !carriesThroughTrack(card)) return false;
 
+  /**
+   * ONE NEIGHBOUR MUST JOIN. THE OTHERS NEED NOT — AND THIS RULE HAS BEEN BOTH WAYS (Gitea#15).
+   *
+   * A card may be laid with an exit facing a card that has nothing to meet it. The rail stops dead
+   * at that edge, and that is legal.
+   *
+   * The issue was filed the other way round — "if a card is placed in that space, it MUST connect" —
+   * against a right-hand curve laid with its north leg against an Ice House and the turnout below it
+   * pointing at its portless south edge. **RAR reversed it on review (2026-08-26): placing it is
+   * fine, and a stub like that is useful — a siding to park cars on.**
+   *
+   * WHAT MATTERS INSTEAD IS THAT NOTHING CAN DRIVE ACROSS THE GAP, so the real requirement is on
+   * MOVEMENT rather than on placement: two cards touching are not connected, and `exploreMoves` must
+   * refuse the hop. It does — every step is gated on `joins`, never on a bare pair of `hasPort`
+   * calls — and `track.test.ts` pins the reported geometry against exactly that.
+   *
+   * SO DO NOT ADD A PER-EDGE CHECK HERE. One was written and taken out again when the ruling
+   * arrived. What survives is the weaker rule that was always here: the piece must touch the network
+   * SOMEWHERE, which is what stops orphaned track being laid in an empty corner of the board.
+   */
   const ports: Port[] = ['n', 's', 'e', 'w'];
   for (const p of ports) {
     const neighbourCard = cardAt(area, neighbour(coord, p));

src/server/claims.ts

@@ -0,0 +1,83 @@
+/**
+ * SEAT RECOVERY CODES — Gitea#33.
+ *
+ * A session token is the only identity the game has (`lobby-and-sessions.md` §1) and it lives in
+ * exactly one place the player controls: their browser's `localStorage`, scoped to the origin they
+ * joined at. Lose that — a different browser, a cleared profile, a private window — and the seat is
+ * unreachable, because there is nothing else on the server that will accept a claim to it. Seen at a
+ * real table on 2026-09-16: the joining player came back to an empty lobby while their token sat
+ * intact in `sessions.json`, and the only way in was an administrator reading the file off the data
+ * volume and the player pasting it into a devtools console.
+ *
+ * THE CODE IS NOT THE TOKEN, AND THAT IS THE WHOLE POINT. §1 says to keep the token out of URLs so it
+ * is not shoulder-surfed or pasted into a chat — and a recovery link is exactly the kind of thing
+ * that gets pasted into a chat. So an administrator mints a SHORT-LIVED, SINGLE-USE code, the player
+ * opens a link carrying that, and the page trades it for the real token over the same connection it
+ * would have used anyway. A code that leaks after it is spent is worth nothing; a token that leaks is
+ * worth the seat for the rest of the game.
+ *
+ * PURE ON PURPOSE, like `lobby.ts` beside it: no sockets, no filesystem, no clock of its own. `now`
+ * is passed in so expiry is testable without faking timers, which is the only reason this file can be
+ * tested at all — nothing in this repo stands an HTTP server up to make requests against it.
+ *
+ * IN MEMORY, NOT ON DISK, which is a deliberate limit rather than an oversight. A restart drops every
+ * outstanding code, and that is the right failure: the codes are minted on demand and spent within
+ * minutes, the administrator is by definition present, and persisting them would put a credential-
+ * equivalent on the volume to solve a problem measured in seconds.
+ */
+
+import { randomUUID } from 'node:crypto';
+
+/**
+ * Long enough to walk to the other room and read it out; short enough that a link left in a chat
+ * window is useless by the time anyone scrolls back to it.
+ */
+export const CLAIM_TTL_MS = 30 * 60 * 1000;
+
+export type ClaimStore = {
+  /** Mint a code for one seat's token. Returns the code and when it stops working. */
+  mint(token: string, gameId: string, now: number, ttlMs?: number): { code: string; expiresAt: number };
+  /**
+   * Spend a code. Returns the seat it names, or null when the code is unknown, already spent or
+   * expired — deliberately one answer for all three, so a caller cannot probe which it was.
+   */
+  redeem(code: string, now: number): { token: string; gameId: string } | null;
+  /** Outstanding, unexpired codes. For tests and for anything that wants to report the store's size. */
+  outstanding(now: number): number;
+};
+
+export function createClaimStore(): ClaimStore {
+  const claims = new Map<string, { token: string; gameId: string; expiresAt: number }>();
+
+  /** Expiry is lazy: there is no timer to own, start, stop or leak across a server's lifetime. */
+  const prune = (now: number): void => {
+    for (const [code, claim] of claims) if (claim.expiresAt <= now) claims.delete(code);
+  };
+
+  return {
+    mint(token, gameId, now, ttlMs = CLAIM_TTL_MS) {
+      prune(now);
+      // The same primitive the session tokens themselves use (`lobby.ts`), for the same reason: it
+      // has to be unguessable, and inventing a second scheme here would be inventing a weaker one.
+      const code = randomUUID();
+      const expiresAt = now + ttlMs;
+      claims.set(code, { token, gameId, expiresAt });
+      return { code, expiresAt };
+    },
+
+    redeem(code, now) {
+      prune(now);
+      const claim = claims.get(code);
+      if (!claim) return null;
+      // SINGLE USE. Deleted before the caller can do anything with it, so two browsers racing on the
+      // same link cannot both be seated — and a link that stays in someone's history is spent.
+      claims.delete(code);
+      return { token: claim.token, gameId: claim.gameId };
+    },
+
+    outstanding(now) {
+      prune(now);
+      return claims.size;
+    },
+  };
+}

src/server/http.ts

@@ -18,7 +18,7 @@
  */
 
 import { createServer } from 'node:http';
-import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { IncomingMessage, Server, ServerResponse } from 'node:http';
 import { createReadStream } from 'node:fs';
 import { stat } from 'node:fs/promises';
 import { extname, join, normalize } from 'node:path';
@@ -37,10 +37,12 @@ import {
   writeLobby,
   writeSessions,
 } from './persistence.ts';
+import { createClaimStore } from './claims.ts';
 import { createSession } from './session.ts';
 import type { GameSession, Push } from './session.ts';
 import {
   createLobby,
+  leaveLobby,
   freshGameCode,
   playerCountAllowed,
   joinLobby,
@@ -83,24 +85,81 @@ const MIME: Record<string, string> = {
   '.json': 'application/json; charset=utf-8',
   '.png': 'image/png',
   '.svg': 'image/svg+xml',
+  /**
+   * The Quickstart guide, published by `build-web.ts` as `quickstart.md`.
+   *
+   * text/plain ON PURPOSE. The fallback below is `application/octet-stream`, which makes a browser
+   * DOWNLOAD the file instead of showing it — so without this line the splash page's "read the
+   * guide" link hands a tester a file to save rather than a page to read.
+   */
+  '.md': 'text/plain; charset=utf-8',
 };
 
 const HEARTBEAT_MS = 20_000;
 
-async function readJson(req: IncomingMessage): Promise<unknown> {
+/**
+ * THE LARGEST BODY ANY ROUTE HERE HAS A USE FOR, with room to spare (v0.8.4). The biggest thing a
+ * client sends is a `GameConfig` on `/api/lobby/create` — a few hundred bytes. `readJson` used to
+ * buffer whatever arrived, before any secret was checked, so anyone who could reach the port could
+ * exhaust the process's memory with one POST. D14 expects this box to be reachable.
+ */
+const MAX_BODY_BYTES = 64 * 1024;
+
+/** A refusal with a status — thrown from anywhere in a handler and answered by the one catch. */
+class HttpError extends Error {
+  readonly status: number;
+  constructor(status: number, message: string) {
+    super(message);
+    this.status = status;
+  }
+}
+
+async function readJson(req: IncomingMessage): Promise<Record<string, unknown>> {
+  const declared = Number(req.headers['content-length'] ?? 0);
+  if (declared > MAX_BODY_BYTES) throw new HttpError(413, 'body too large');
   const chunks: Buffer[] = [];
-  for await (const chunk of req) chunks.push(chunk as Buffer);
+  let size = 0;
+  for await (const chunk of req) {
+    size += (chunk as Buffer).length;
+    if (size > MAX_BODY_BYTES) throw new HttpError(413, 'body too large');
+    chunks.push(chunk as Buffer);
+  }
   const text = Buffer.concat(chunks).toString('utf8');
-  return text.trim() === '' ? {} : JSON.parse(text);
+  if (text.trim() === '') return {};
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    // A malformed body is the caller's mistake, answered as one — it used to surface as a 500.
+    throw new HttpError(400, 'body is not JSON');
+  }
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) throw new HttpError(400, 'expected a JSON object');
+  return parsed as Record<string, unknown>;
 }
 
 function sendJson(res: ServerResponse, status: number, body: unknown): void {
+  /**
+   * NEVER A SECOND HEAD (v0.8.4). The SSE routes and `serveStatic` write their head and go on; a
+   * throw after that reached the handler's catch, which called this, and `writeHead` on a response
+   * whose head was sent throws `ERR_HTTP_HEADERS_SENT` — inside a `.catch`, with nothing above it,
+   * so Node exited on the unhandled rejection. One bad stream write was a whole-server crash.
+   */
+  if (res.headersSent) {
+    res.end();
+    return;
+  }
   const text = JSON.stringify(body);
   res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': Buffer.byteLength(text) });
   res.end(text);
 }
 
-async function serveStatic(distDir: string, urlPath: string, res: ServerResponse): Promise<void> {
+async function serveStatic(
+  distDir: string,
+  urlPath: string,
+  res: ServerResponse,
+  /** The request's `?v=` build tag, when it has one — see the `Cache-Control` note below. */
+  buildTagged = false,
+): Promise<void> {
   const rel = urlPath === '/' ? '/index.html' : urlPath;
   // `normalize` collapses `..`, and the join is then checked to still be inside `distDir` — a request
   // for `/../../etc/passwd` must not escape the one directory this is allowed to read from.
@@ -112,8 +171,32 @@ async function serveStatic(distDir: string, urlPath: string, res: ServerResponse
   try {
     const info = await stat(full);
     if (!info.isFile()) throw new Error('not a file');
-    res.writeHead(200, { 'Content-Type': MIME[extname(full)] ?? 'application/octet-stream', 'Content-Length': info.size });
-    createReadStream(full).pipe(res);
+    /**
+     * ONLY A URL CARRYING A BUILD TAG MAY BE CACHED, AND NOTHING ELSE MAY BE.
+     *
+     * Nothing here sent a `Cache-Control` at all before, so a browser applied its own heuristic to
+     * the pages as much as the modules. The pages are the one thing that CANNOT be versioned in
+     * their own URL — a player types the address or follows a bookmark — so a cached `play.html`
+     * pins that player to the entire build it names, including every `?v=` tag inside it. That is
+     * half of why v0.7.5 and v0.7.6 did not reach the browser that asked for them; `build-web.ts`
+     * publishing `?v=nogit` on every packaged release was the other half, and neither is enough on
+     * its own.
+     *
+     * `?v=` is the exact condition rather than "not HTML": `build-web.ts` tags the modules and the
+     * script tags that load them, and tags NOTHING else. An untagged URL — an image, the replay
+     * manifest — has no way to announce a change, so a year of `immutable` on one would outlive
+     * several releases of whatever it holds.
+     */
+    res.writeHead(200, {
+      'Content-Type': MIME[extname(full)] ?? 'application/octet-stream',
+      'Content-Length': info.size,
+      'Cache-Control': buildTagged ? 'public, max-age=31536000, immutable' : 'no-cache',
+    });
+    // A read that fails mid-stream (file replaced by a deploy, disk error) closes the response rather
+    // than raising an error nothing listens for.
+    createReadStream(full)
+      .on('error', () => res.destroy())
+      .pipe(res);
   } catch {
     res.writeHead(404, { 'Content-Type': 'text/plain' });
     res.end('not found');
@@ -129,11 +212,30 @@ async function serveStatic(distDir: string, urlPath: string, res: ServerResponse
  * simply ending, indistinguishable from a network hiccup that `EventSource` would otherwise retry.
  */
 type LobbyPush = { lobby: Lobby; you: PlayerIndex; started: boolean };
+/** What `/api/lobby/preview` answers with — everything a player weighing a join needs, and nothing
+ * that would spoil the game. THE SEED IS NOT IN IT: it decides every shuffle and every roll. */
+type LobbyPreview = {
+  gameCode: string;
+  hostName: string;
+  config: GameConfig;
+  players: number;
+  seated: { seat: number; who: string | null; bot: boolean }[];
+};
 
-export function startServer(opts: ServerOptions): void {
+/** Returns the listening server — a test binds port 0 and reads the port back off it. */
+export function startServer(opts: ServerOptions): Server {
   const games = opts.initialGames;
   const lobbies = opts.initialLobbies;
   const sessions = opts.initialSessions;
+  /**
+   * Outstanding seat recovery codes — Gitea#33, `claims.ts`.
+   *
+   * In memory and not on the volume, deliberately: a code is minted on demand and spent within
+   * minutes with the administrator standing right there, so a restart dropping them all is the right
+   * failure. Persisting them would put a credential-equivalent on disk to solve a problem measured
+   * in seconds.
+   */
+  const claims = createClaimStore();
   const gameCodes = new Map<string, string>(); // gameCode -> gameId, for /api/lobby/join
   for (const [gameId, lobby] of lobbies) gameCodes.set(lobby.gameCode, gameId);
 
@@ -143,6 +245,8 @@ export function startServer(opts: ServerOptions): void {
   const gameConnections = new Map<string, Map<PlayerIndex, ServerResponse>>();
   const gameEventIds = new Map<string, Map<PlayerIndex, number>>();
   const lobbyConnections = new Map<string, Map<string, ServerResponse>>();
+  /** Which seats of a game have ever held a connection in THIS process — see `presenceOfOthers`. */
+  const everConnected = new Map<string, Set<PlayerIndex>>();
 
   function writeSse(res: ServerResponse, id: number, data: unknown): void {
     res.write(`id: ${id}\ndata: ${JSON.stringify(data)}\n\n`);
@@ -176,11 +280,37 @@ export function startServer(opts: ServerOptions): void {
     if (!conns) return;
     for (const [other, res] of conns) {
       if (other === seat) continue;
-      const push: Push = { menu: null, lines: [], presence: { seat, connected } };
+      const push: Push = { menu: null, lines: [], presence: [{ seat, connected, seen: true }] };
       writeSse(res, nextEventId(gameId, other), push);
     }
   }
 
+  /**
+   * EVERY OTHER SEAT'S STATE, for a client that has just connected.
+   *
+   * `broadcastPresence` only ever reports a CHANGE, so a player arriving at a table where two people
+   * had not opened the game yet was told nothing about them at all — and "is everyone here?" is the
+   * question at the moment a game starts. `seen` separates a seat that was here and dropped from one
+   * that has never connected; it is remembered only for as long as this process runs, so after a
+   * restart every absent seat reads as "not here yet", which is the more cautious of the two.
+   */
+  function presenceOfOthers(
+    gameId: string,
+    seat: PlayerIndex,
+    session: GameSession,
+  ): NonNullable<Push['presence']> {
+    const conns = gameConnections.get(gameId);
+    const ever = everConnected.get(gameId) ?? new Set<PlayerIndex>();
+    const out: NonNullable<Push['presence']> = [];
+    for (let other = 0 as PlayerIndex; other < session.playerCount; other++) {
+      // A bot holds no connection and never will, so reporting it would put "waiting on Bot 1 — not
+      // here yet" on every screen for the whole game. Found by playing a real 3-seat game.
+      if (other === seat || session.isBot(other)) continue;
+      out.push({ seat: other, connected: conns?.has(other) === true, seen: ever.has(other) });
+    }
+    return out;
+  }
+
   function broadcastLobby(gameId: string): void {
     const lobby = lobbies.get(gameId);
     const conns = lobbyConnections.get(gameId);
@@ -201,8 +331,29 @@ export function startServer(opts: ServerOptions): void {
 
   async function persistSession(ps: PlayerSession): Promise<void> {
     sessions.set(ps.token, ps);
-    const all = [...sessions.values()].filter((s) => s.gameId === ps.gameId);
-    await writeSessions(opts.dataDir, ps.gameId, all);
+    await persistSessionsOf(ps.gameId);
+  }
+
+  /** Rewrites one game's `sessions.json` from what is in memory — after a token is revoked as much
+   * as after one is issued, or a restart would hand the seat back to a browser that left it. */
+  async function persistSessionsOf(gameId: string): Promise<void> {
+    const all = [...sessions.values()].filter((s) => s.gameId === gameId);
+    await writeSessions(opts.dataDir, gameId, all);
+  }
+
+  /**
+   * ONE INTENT AT A TIME PER GAME — `protocol.md` §5's serialisation rule, which the intent handler
+   * relied on Node's single thread to keep and did not (v0.8.4): the `await` on the disk write is
+   * an interleaving point, so two moves arriving together could both apply in memory, race their
+   * writes to one `.tmp`, and hand their broadcasts to the clients in the wrong order. Everything a
+   * move does — apply, persist, answer, broadcast — now runs as one unit behind the move before it.
+   */
+  const gameQueues = new Map<string, Promise<unknown>>();
+  function inTurn<T>(gameId: string, fn: () => Promise<T>): Promise<T> {
+    const prev = gameQueues.get(gameId) ?? Promise.resolve();
+    const next = prev.then(fn, fn);
+    gameQueues.set(gameId, next.catch(() => undefined));
+    return next;
   }
 
   const server = createServer((req, res) => {
@@ -243,7 +394,7 @@ export function startServer(opts: ServerOptions): void {
         // Unset means the routes are not here — indistinguishable from any other unknown path, so
         // nothing advertises an administrative surface to someone probing for one.
         if (!opts.adminSecret) {
-          await serveStatic(opts.distDir, url.pathname, res);
+          await serveStatic(opts.distDir, url.pathname, res, url.searchParams.has('v'));
           return;
         }
         if (req.headers['x-admin-secret'] !== opts.adminSecret) {
@@ -258,6 +409,17 @@ export function startServer(opts: ServerOptions): void {
             gameId,
             gameCode: codes.get(gameId) ?? null,
             state: 'running' as const,
+            /**
+             * WHICH SEATS A PERSON IS SITTING IN — Gitea#33.
+             *
+             * `playerNames` cannot answer it: a bot's name is just a name, and telling the two apart
+             * by matching "Bot 1" would be guessing at a label. `sessions` holds humans and only
+             * humans, so this is the fact rather than an inference — and it is what lets the seat
+             * recovery action offer real players instead of chairs no token was ever issued for.
+             */
+            seatedPlayers: [...sessions.values()]
+              .filter((s) => s.gameId === gameId)
+              .map((s) => s.player),
             ...g.summary(),
           }));
           // A lobby has no game to summarize yet — it is reported as what it is, so an
@@ -276,14 +438,48 @@ export function startServer(opts: ServerOptions): void {
           return;
         }
 
-        const match = /^\/api\/games\/([^/]+)(\/save)?$/.exec(url.pathname);
+        const match = /^\/api\/games\/([^/]+)(\/save|\/claim)?$/.exec(url.pathname);
         const gameId = match?.[1];
+        // Compared explicitly rather than tested for truthiness: with two suffixes in the group, a
+        // bare `match?.[2]` would let a GET on `/claim` fall into the `/save` branch below.
+        const suffix = match?.[2];
         if (!gameId) {
           sendJson(res, 404, { error: 'no such route' });
           return;
         }
 
-        if (match?.[2] && req.method === 'GET') {
+        /**
+         * MINT A SEAT RECOVERY CODE FOR ONE PLAYER — Gitea#33.
+         *
+         * The token is the only identity this game has and it lives in one browser's `localStorage`;
+         * lose it and the seat is unreachable, because nothing else here will accept a claim to it.
+         * This is the supported way back, and it is administrative on purpose: whoever runs the
+         * server decides that a particular player has lost their seat, which is a judgement no
+         * automated route can make safely.
+         *
+         * IT HANDS BACK A CODE, NOT THE TOKEN. §1 says keep the token out of URLs, and the code is
+         * going into one. Short-lived and single-use (`claims.ts`), so a link left in a chat window
+         * is worth nothing by the time anyone finds it.
+         */
+        if (suffix === '/claim' && req.method === 'POST') {
+          const body = (await readJson(req)) as { player?: number };
+          const ps = [...sessions.values()].find((s) => s.gameId === gameId && s.player === body.player);
+          if (!ps) {
+            sendJson(res, 404, { error: 'no such seat' });
+            return;
+          }
+          const { code, expiresAt } = claims.mint(ps.token, gameId, Date.now());
+          sendJson(res, 200, {
+            code,
+            expiresAt,
+            player: ps.player,
+            displayName: ps.displayName,
+            gameCode: codes.get(gameId) ?? null,
+          });
+          return;
+        }
+
+        if (suffix === '/save' && req.method === 'GET') {
           const session = games.get(gameId);
           if (!session) {
             sendJson(res, 404, { error: 'no such game' });
@@ -389,7 +585,12 @@ export function startServer(opts: ServerOptions): void {
         await persistLobby(result.lobby);
         await persistSession(result.session);
         broadcastLobby(lobby.gameId);
-        sendJson(res, 200, { gameId: lobby.gameId, token: result.session.token, player: result.session.player });
+        sendJson(res, 200, {
+          gameId: lobby.gameId,
+          gameCode: lobby.gameCode,
+          token: result.session.token,
+          player: result.session.player,
+        });
         return;
       }
 
@@ -418,6 +619,101 @@ export function startServer(opts: ServerOptions): void {
         return;
       }
 
+      /**
+       * GIVING UP A SEAT — the player's own, or (host only) somebody else's.
+       *
+       * There was no door out of a lobby before this: a mis-join or a player who wandered off left a
+       * chair that could not be freed, and a table that cannot start until every chair is taken.
+       * The host's "remove" and a player's "Leave" are the same act from opposite ends, so they are
+       * one route — `seat` names somebody else's chair and is refused to anyone but the host.
+       */
+      if (url.pathname === '/api/lobby/leave' && req.method === 'POST') {
+        const body = (await readJson(req)) as { token?: string; seat?: number };
+        const ps = typeof body.token === 'string' ? sessions.get(body.token) : undefined;
+        const lobby = ps ? lobbies.get(ps.gameId) : undefined;
+        if (!ps || !lobby) {
+          sendJson(res, 404, { error: 'no such lobby' });
+          return;
+        }
+        const seat = typeof body.seat === 'number' ? (body.seat as PlayerIndex) : undefined;
+        if (seat !== undefined && seat !== ps.player && lobby.hostToken !== ps.token) {
+          sendJson(res, 403, { error: 'NOT_HOST' });
+          return;
+        }
+        /**
+         * THE SEAT GOES, AND SO DOES THE TOKEN THAT HELD IT (v0.8.4).
+         *
+         * Leaving used to free the chair and keep the session: the token stayed in `sessions` and
+         * on disk, and `joinLobby` hands a vacated chair to the next arrival. So a player who left
+         * (or was removed) still held a token for seat N, and once somebody else sat in seat N and
+         * the game began, `/api/stream` served that token the new occupant's hand and `/api/intent`
+         * let it move for them — and its stream connection displaced theirs. Revoked here, before
+         * the chair is offered to anyone.
+         */
+        const occupant = seat === undefined ? ps : [...sessions.values()].find((s) => s.gameId === lobby.gameId && s.player === seat);
+        const result = leaveLobby(lobby, ps.token, seat);
+        if (result.empty) {
+          // Nobody human is left to start it. Everything about this lobby goes, including the code,
+          // so it cannot be joined into a game that will never begin.
+          lobbies.delete(lobby.gameId);
+          gameCodes.delete(lobby.gameCode);
+          for (const [, watcher] of lobbyConnections.get(lobby.gameId) ?? []) watcher.end();
+          lobbyConnections.delete(lobby.gameId);
+          for (const [token, s] of [...sessions]) if (s.gameId === lobby.gameId) sessions.delete(token);
+          await deleteLobby(opts.dataDir, lobby.gameId);
+          // The row goes with the lobby rather than being marked: a game that never started is not a
+          // game an administrator has any use for a record of.
+          await removeIndexEntry(opts.dataDir, lobby.gameId);
+          sendJson(res, 200, { ok: true, closed: true });
+          return;
+        }
+        if (occupant && result.lobby !== lobby) {
+          sessions.delete(occupant.token);
+          lobbyConnections.get(lobby.gameId)?.get(occupant.token)?.end();
+          lobbyConnections.get(lobby.gameId)?.delete(occupant.token);
+          await persistSessionsOf(lobby.gameId);
+        }
+        await persistLobby(result.lobby);
+        broadcastLobby(lobby.gameId);
+        sendJson(res, 200, { ok: true });
+        return;
+      }
+
+      /**
+       * WHAT AM I ABOUT TO JOIN? Read-only, takes no seat, and gated by the same join secret the
+       * door itself is.
+       *
+       * A player used to have to take a chair before they could see a single rule of the game they
+       * were sitting down to — and until 2026-08-23 there was then no way back out of it.
+       */
+      if (url.pathname === '/api/lobby/preview' && req.method === 'GET') {
+        if (url.searchParams.get('secret') !== opts.joinSecret) {
+          sendJson(res, 403, { error: 'bad or missing secret' });
+          return;
+        }
+        const code = (url.searchParams.get('gameCode') ?? '').trim().toUpperCase();
+        const gameId = gameCodes.get(code);
+        const lobby = gameId ? lobbies.get(gameId) : undefined;
+        if (!lobby) {
+          sendJson(res, 404, { error: 'no open lobby with that code' });
+          return;
+        }
+        const hostSeat = lobby.seats.find((seat) => seat?.kind === 'human' && seat.token === lobby.hostToken);
+        const preview: LobbyPreview = {
+          gameCode: lobby.gameCode,
+          hostName: hostSeat?.kind === 'human' ? hostSeat.displayName : 'unknown',
+          config: lobby.config,
+          players: lobby.seats.length,
+          seated: lobby.seats.map((seat, i) => ({
+            seat: i,
+            who: seat?.kind === 'human' ? seat.displayName : null,
+            bot: seat?.kind === 'bot',
+          })),
+        };
+        sendJson(res, 200, preview);
+        return;
+      }
+
       if (url.pathname === '/api/lobby/start' && req.method === 'POST') {
         const body = (await readJson(req)) as { token?: string };
         const ps = typeof body.token === 'string' ? sessions.get(body.token) : undefined;
@@ -481,7 +777,9 @@ export function startServer(opts: ServerOptions): void {
           // `lobby`, because it may have changed (another join, another bot toggle) since connect.
           const current = lobbies.get(lobby.gameId);
           if (current && current.hostToken === token) {
-            void persistLobby(reassignHost(current, token)).then(() => broadcastLobby(lobby.gameId));
+            persistLobby(reassignHost(current, token))
+              .then(() => broadcastLobby(lobby.gameId))
+              .catch((err: unknown) => console.error(`reassigning the host of ${lobby.gameId} failed:`, err));
           }
         });
         return;
@@ -510,6 +808,57 @@ export function startServer(opts: ServerOptions): void {
         return;
       }
 
+      /**
+       * SPEND A SEAT RECOVERY CODE — Gitea#33, the other half of `/api/games/<id>/claim`.
+       *
+       * NOT GATED BY THE ADMIN SECRET, and it must not be: the player following the link is the one
+       * person in this story who holds no secret at all. The code IS the authorisation — unguessable,
+       * single-use and short-lived — which is the same shape as the session token it hands back, and
+       * why minting one is the administrative act rather than spending one.
+       *
+       * The token travels in the response BODY of a POST, never in a URL (`lobby-and-sessions.md`
+       * §1). One answer for unknown, spent and expired codes, so this cannot be used to probe which.
+       */
+      if (url.pathname === '/api/claim' && req.method === 'POST') {
+        const body = (await readJson(req)) as { code?: string };
+        const claimed = typeof body.code === 'string' ? claims.redeem(body.code, Date.now()) : null;
+        const ps = claimed ? sessions.get(claimed.token) : undefined;
+        const live = ps ? games.get(ps.gameId) : undefined;
+        if (!claimed || !ps || !live) {
+          sendJson(res, 404, { error: 'no such claim' });
+          return;
+        }
+        const codes = new Map((await readIndex(opts.dataDir)).map((e) => [e.gameId, e.gameCode]));
+        sendJson(res, 200, {
+          token: ps.token,
+          gameId: ps.gameId,
+          player: ps.player,
+          gameCode: codes.get(ps.gameId) ?? '',
+        });
+        return;
+      }
+
+      /**
+       * THIS SEAT'S OWN GAME, AS A SAVE (playtest, 2026-09-15: "most of the time, I want to go ahead and
+       * just save it as a JSON file in my Downloads folder").
+       *
+       * The administrative export at `/api/games/<id>/save` is gated on the admin secret, which a player
+       * does not have and should not need: a save is the seed and the moves, and every one of those moves
+       * is already on this player's screen. So the seat's own session token is the gate, exactly as it is
+       * for `/api/stream` and `/api/intent` — it proves which game and which chair, and nothing else is
+       * disclosed. The page turns the JSON into a file (`main.ts`'s `downloadSave`).
+       */
+      if (url.pathname === '/api/save' && req.method === 'GET') {
+        const ps = sessions.get(url.searchParams.get('token') ?? '');
+        const session = ps ? games.get(ps.gameId) : undefined;
+        if (!ps || !session) {
+          sendJson(res, 404, { error: 'no such game' });
+          return;
+        }
+        sendJson(res, 200, { gameId: ps.gameId, save: session.exportSave() });
+        return;
+      }
+
       if (url.pathname === '/api/stream' && req.method === 'GET') {
         const token = url.searchParams.get('token') ?? '';
         const ps = sessions.get(token);
@@ -523,7 +872,13 @@ export function startServer(opts: ServerOptions): void {
         const conns = gameConnections.get(gameId) ?? new Map<PlayerIndex, ServerResponse>();
         conns.set(seat, res);
         gameConnections.set(gameId, conns);
-        writeSse(res, nextEventId(gameId, seat), session.connect(seat));
+        const ever = everConnected.get(gameId) ?? new Set<PlayerIndex>();
+        ever.add(seat);
+        everConnected.set(gameId, ever);
+        // The board, and who else is at the table — the second half used to be missing entirely.
+        const first = session.connect(seat);
+        first.presence = presenceOfOthers(gameId, seat, session);
+        writeSse(res, nextEventId(gameId, seat), first);
         broadcastPresence(gameId, seat, true);
         // Idle for minutes at a time is the expected shape of this game (multiplayer.md §9) — a
         // silent SSE connection is exactly what a proxy in the path may reap. A comment line is not a
@@ -554,31 +909,49 @@ export function startServer(opts: ServerOptions): void {
           sendJson(res, 400, { error: 'expected { seq, intent }' });
           return;
         }
-        const result = session.intent(ps.player, body.seq, body.intent);
-        if (result.accepted) {
-          // Persisted BEFORE the response goes out — "accepted" should mean "durably on disk" at
-          // this scale, not just "applied in memory" (§12 step 14).
-          const dir = gameDir(opts.dataDir, ps.gameId);
-          await writeGame(dir, session.exportSave(), opts.engineVersion);
-          if (result.timing) await appendTiming(dir, result.timing);
-          if (session.exportSave().status === 'finished') {
-            // `upsertIndexEntry` replaces the WHOLE row for this `gameId`, so the code has to be
-            // carried forward here rather than left blank — `gameCodes` is the only place still
-            // holding it once a lobby's own record is gone.
-            const gameCode = [...gameCodes.entries()].find(([, id]) => id === ps.gameId)?.[0] ?? '';
-            await upsertIndexEntry(opts.dataDir, { gameId: ps.gameId, gameCode, status: 'finished' });
+        const { seq, intent } = body;
+        await inTurn(ps.gameId, async () => {
+          const result = session.intent(ps.player, seq, intent);
+          if (result.accepted) {
+            // Persisted BEFORE the response goes out — "accepted" should mean "durably on disk" at
+            // this scale, not just "applied in memory" (§12 step 14).
+            const dir = gameDir(opts.dataDir, ps.gameId);
+            try {
+              await writeGame(dir, session.exportSave(), opts.engineVersion);
+              if (result.timing) await appendTiming(dir, result.timing);
+              if (session.exportSave().status === 'finished') {
+                // `upsertIndexEntry` replaces the WHOLE row for this `gameId`, so the code has to be
+                // carried forward here rather than left blank — `gameCodes` is the only place still
+                // holding it once a lobby's own record is gone.
+                const gameCode = [...gameCodes.entries()].find(([, id]) => id === ps.gameId)?.[0] ?? '';
+                await upsertIndexEntry(opts.dataDir, { gameId: ps.gameId, gameCode, status: 'finished' });
+              }
+            } catch (err) {
+              // The move IS applied — every seat's game has moved on — so the table is told and the
+              // disk's failure is the operator's to see in the log. Answering 500 here told the one
+              // player who moved that their move was refused, while everyone else watched it happen.
+              console.error(`persisting ${ps.gameId} after a move failed:`, err);
+            }
           }
-        }
-        sendJson(res, 200, result.accepted ? { ok: true } : { ok: false, code: result.code });
-        if (result.accepted) broadcastGame(ps.gameId, result.pushes);
+          sendJson(res, 200, result.accepted ? { ok: true } : { ok: false, code: result.code });
+          if (result.accepted) broadcastGame(ps.gameId, result.pushes);
+        });
         return;
       }
 
-      await serveStatic(opts.distDir, url.pathname, res);
+      await serveStatic(opts.distDir, url.pathname, res, url.searchParams.has('v'));
     })().catch((err: unknown) => {
-      sendJson(res, 500, { error: err instanceof Error ? err.message : 'internal error' });
+      if (err instanceof HttpError) {
+        sendJson(res, err.status, { error: err.message });
+        return;
+      }
+      // Logged here, not echoed: an fs error's message carries the absolute path of the data
+      // directory, which is the operator's to know and not the caller's.
+      console.error(`${req.method ?? ''} ${req.url ?? ''} failed:`, err);
+      sendJson(res, 500, { error: 'internal error' });
     });
   });
 
   server.listen(opts.port, opts.bindAddress);
+  return server;
 }

src/server/index.ts

@@ -61,8 +61,22 @@ for (const entry of index) {
   }
 
   const loaded = await loadGame(gameDir(dataDir, entry.gameId));
+  if (!loaded.found && loaded.corrupt) {
+    // One unreadable file is one game lost, not every game (v0.8.4) — see `loadGame`.
+    console.error(`Skipping ${entry.gameId} (${entry.gameCode}): game.json is unreadable — ${loaded.corrupt}. The file is left untouched.`);
+    continue;
+  }
   if (loaded.found) {
-    const resumed = tryResumeSession(loaded.saved);
+    let resumed: ReturnType<typeof tryResumeSession>;
+    try {
+      resumed = tryResumeSession(loaded.saved);
+    } catch (err) {
+      // A save that parses but is not the shape the replay expects (no config, a history entry
+      // that is not an intent) throws inside the engine rather than being refused. Same answer:
+      // this game, not the server.
+      console.error(`Skipping ${entry.gameId} (${entry.gameCode}): the save could not be replayed — ${err instanceof Error ? err.message : String(err)}. The file is left untouched.`);
+      continue;
+    }
     if (resumed.ok) {
       initialGames.set(entry.gameId, resumed.session);
       console.log(`Resumed ${entry.gameId} (${entry.gameCode}) — ${loaded.saved.history.length} intents replayed.`);

src/server/lobby.ts

@@ -50,7 +50,12 @@ export type Lobby = {
 };
 
 export type CreateResult = { lobby: Lobby; session: PlayerSession };
-export type JoinResult = { ok: true; lobby: Lobby; session: PlayerSession } | { ok: false; code: 'LOBBY_FULL' | 'ALREADY_STARTED' };
+export type JoinResult =
+  | { ok: true; lobby: Lobby; session: PlayerSession }
+  | { ok: false; code: 'LOBBY_FULL' | 'ALREADY_STARTED' | 'NAME_TAKEN' };
+/** `empty` when the last human has gone — the caller drops the lobby rather than leaving a table of
+ * bots waiting for a host who no longer exists. */
+export type LeaveResult = { lobby: Lobby; empty: boolean };
 export type StartResult = { ok: true; playerNames: string[]; botSeats: PlayerIndex[] } | { ok: false; code: 'NOT_HOST' | 'BAD_PLAYER_COUNT' };
 
 /**
@@ -140,6 +145,19 @@ export function joinLobby(lobby: Lobby, displayName: string): JoinResult {
   const seatIndex = lobby.seats.findIndex((s) => s === null);
   if (seatIndex < 0) return { ok: false, code: 'LOBBY_FULL' };
 
+  /**
+   * TWO PLAYERS CANNOT SHARE A NAME (2026-08-23).
+   *
+   * The name is not decoration: it labels the district on the Division map, it is what the turn
+   * chart means by "waiting on Jesse", and `record()` puts it in front of every line that player
+   * causes. Two identical names make all three ambiguous, and there is no way to fix it once the
+   * game starts — the names are locked into the session at `Lobby.Start`. Refused rather than
+   * silently suffixed: a player should play under the name they chose, or be told to choose again.
+   */
+  const wanted = displayName.trim().toLowerCase();
+  const clash = lobby.seats.some((s) => s?.kind === 'human' && s.displayName.trim().toLowerCase() === wanted);
+  if (clash) return { ok: false, code: 'NAME_TAKEN' };
+
   const token = randomUUID();
   const session: PlayerSession = { token, gameId: lobby.gameId, player: seatIndex, displayName };
   const seats = [...lobby.seats];
@@ -151,6 +169,35 @@ export function joinLobby(lobby: Lobby, displayName: string): JoinResult {
   };
 }
 
+/**
+ * GIVING UP A SEAT — a player leaving, or the host clearing somebody out of a chair.
+ *
+ * There was no way out of a lobby at all before 2026-08-23: a mis-join or a player who wandered off
+ * wedged the table, because Start needs every chair filled and `setBotSeat` refuses to touch an
+ * occupied human seat. One function serves both, since they differ only in whose seat is named, and
+ * `http.ts` is what checks that a caller naming somebody else's seat is the host.
+ *
+ * Host rights move exactly as they do on a dropped connection (`reassignHost`), and the caller is
+ * told when the last human has gone so the lobby can be dropped rather than left orphaned.
+ */
+export function leaveLobby(lobby: Lobby, token: string, seat?: PlayerIndex): LeaveResult {
+  const index =
+    seat === undefined ? lobby.seats.findIndex((s) => s?.kind === 'human' && s.token === token) : seat;
+  const occupant = index >= 0 ? (lobby.seats[index] ?? null) : null;
+  if (index < 0 || occupant?.kind !== 'human') return { lobby, empty: false };
+
+  const seats = [...lobby.seats];
+  seats[index] = null;
+  const departing = occupant.token;
+  const withoutThem: Lobby = {
+    ...lobby,
+    seats,
+    joinOrder: lobby.joinOrder.filter((t) => t !== departing),
+  };
+  const empty = !seats.some((s) => s?.kind === 'human');
+  return { lobby: reassignHost(withoutThem, departing), empty };
+}
+
 /** Host-only in effect (`http.ts` checks the caller's token against `hostToken` before calling
  * this) — marks an empty seat as bot-filled, or clears one back to empty. Never touches an occupied
  * human seat; the host removes a person by them leaving, not by overwriting their seat. */

src/server/persistence.ts

@@ -24,10 +24,33 @@ const INDEX_FILE = 'index.json';
 
 type PersistedGame = SavedGame & { engineVersion: string };
 
+/**
+ * ONE WRITER AT A TIME PER FILE (v0.8.4).
+ *
+ * Every write here is read-modify-write or write-then-rename with an `await` in the middle, and
+ * Node's single thread is no protection across an `await`: two requests for the same game could
+ * both be inside `atomicWrite` at once. With ONE fixed `.tmp` name per path that tore the file —
+ * measured at 200 rounds of two concurrent writes: every round lost one write to `rename` ENOENT,
+ * and six left `game.json` as invalid JSON, which the boot then died on. So the temp name is unique
+ * per write, and every write to a given path queues behind the one before it, which is also what
+ * makes `upsertIndexEntry`'s "adds or updates exactly one row" claim true under two callers.
+ */
+const queues = new Map<string, Promise<unknown>>();
+let writeSerial = 0;
+
+function serial<T>(key: string, fn: () => Promise<T>): Promise<T> {
+  const prev = queues.get(key) ?? Promise.resolve();
+  const next = prev.then(fn, fn);
+  queues.set(key, next.catch(() => undefined));
+  return next;
+}
+
 async function atomicWrite(path: string, text: string): Promise<void> {
-  const tmp = `${path}.tmp`;
-  await writeFile(tmp, text);
-  await rename(tmp, path);
+  await serial(path, async () => {
+    const tmp = `${path}.${process.pid}.${++writeSerial}.tmp`;
+    await writeFile(tmp, text);
+    await rename(tmp, path);
+  });
 }
 
 export async function writeGame(dataDir: string, saved: SavedGame, engineVersion: string): Promise<void> {
@@ -37,7 +60,8 @@ export async function writeGame(dataDir: string, saved: SavedGame, engineVersion
 }
 
 export type LoadResult =
-  | { found: false }
+  /** `corrupt` names the parse error when the file is there and is not JSON — see `loadGame`. */
+  | { found: false; corrupt?: string }
   /** The version that wrote the file, for diagnostics — it is no longer what decides. */
   | { found: true; saved: SavedGame; storedVersion: string };
 
@@ -61,7 +85,21 @@ export async function loadGame(dataDir: string): Promise<LoadResult> {
   } catch {
     return { found: false };
   }
-  const payload = JSON.parse(text) as PersistedGame;
+  /**
+   * A FILE THAT IS NOT JSON IS REPORTED, NOT THROWN (v0.8.4). This parse was bare, and `index.ts`
+   * awaited it at the top level — so one torn or half-edited `game.json` took the whole process
+   * down before the port opened, and StartOS restarted it into the same file: every game on the
+   * server unreachable because of one. The caller gets a reason to log and moves on.
+   */
+  let payload: PersistedGame;
+  try {
+    payload = JSON.parse(text) as PersistedGame;
+  } catch (err) {
+    return { found: false, corrupt: err instanceof Error ? err.message : String(err) };
+  }
+  if (!payload || typeof payload !== 'object' || !Array.isArray(payload.history)) {
+    return { found: false, corrupt: 'not a saved game (no history array)' };
+  }
   const { engineVersion, ...saved } = payload;
   return { found: true, saved, storedVersion: engineVersion };
 }
@@ -71,14 +109,18 @@ export async function loadGame(dataDir: string): Promise<LoadResult> {
 export async function appendTiming(dataDir: string, timing: TurnTiming): Promise<void> {
   await mkdir(dataDir, { recursive: true });
   const path = join(dataDir, TIMINGS_FILE);
-  let existing: TurnTiming[];
-  try {
-    existing = JSON.parse(await readFile(path, 'utf8')) as TurnTiming[];
-  } catch {
-    existing = [];
-  }
-  existing.push(timing);
-  await atomicWrite(path, JSON.stringify(existing, null, 1));
+  // The read and the write are one unit under the file's queue, or two appends could each read the
+  // same list and one of them would be lost.
+  await serial(`rmw:${path}`, async () => {
+    let existing: TurnTiming[];
+    try {
+      existing = JSON.parse(await readFile(path, 'utf8')) as TurnTiming[];
+    } catch {
+      existing = [];
+    }
+    existing.push(timing);
+    await atomicWrite(path, JSON.stringify(existing, null, 1));
+  });
 }
 
 // ---------------------------------------------------------------------------
@@ -113,11 +155,13 @@ async function writeIndex(dataDir: string, entries: GameIndexEntry[]): Promise<v
  * silently drop every other game's row the moment two writes happened close together.
  */
 export async function upsertIndexEntry(dataDir: string, entry: GameIndexEntry): Promise<void> {
-  const entries = await readIndex(dataDir);
-  const i = entries.findIndex((e) => e.gameId === entry.gameId);
-  if (i >= 0) entries[i] = entry;
-  else entries.push(entry);
-  await writeIndex(dataDir, entries);
+  await serial(`rmw:${join(dataDir, INDEX_FILE)}`, async () => {
+    const entries = await readIndex(dataDir);
+    const i = entries.findIndex((e) => e.gameId === entry.gameId);
+    if (i >= 0) entries[i] = entry;
+    else entries.push(entry);
+    await writeIndex(dataDir, entries);
+  });
 }
 
 /**
@@ -126,11 +170,13 @@ export async function upsertIndexEntry(dataDir: string, entry: GameIndexEntry):
  * it on the next boot or leave `index.json` pointing at nothing.
  */
 export async function removeIndexEntry(dataDir: string, gameId: string): Promise<void> {
-  const entries = await readIndex(dataDir);
-  await writeIndex(
-    dataDir,
-    entries.filter((e) => e.gameId !== gameId),
-  );
+  await serial(`rmw:${join(dataDir, INDEX_FILE)}`, async () => {
+    const entries = await readIndex(dataDir);
+    await writeIndex(
+      dataDir,
+      entries.filter((e) => e.gameId !== gameId),
+    );
+  });
 }
 
 /** Deletes a game's whole directory — its save, its turn timings, its sessions, its lobby file. */

src/server/session.ts

@@ -18,16 +18,19 @@
  * checked, before `submit` is ever called — see `intent()` below.
  */
 
+import { withSavedDeal } from '../engine/content.ts';
 import { check } from '../engine/apply.ts';
 import { legalActions } from '../engine/legal.ts';
 import type { Intent } from '../engine/intents.ts';
 import type { GameConfig, PlayerIndex } from '../engine/state.ts';
-import { actionMenu, currentActor, fromMultiplayerSave, newMultiplayerGame, submit } from '../web/game.ts';
+import { actionMenu, currentActor, fromMultiplayerSave, isOutOfTurn, newMultiplayerGame, submit } from '../web/game.ts';
 import type { Game, Menu } from '../web/game.ts';
 import { deltaFrame } from '../sim/frame-delta.ts';
 import type { FrameDelta } from '../sim/frame-delta.ts';
-import { snapshot, seatLabel } from '../sim/view.ts';
-import type { Frame } from '../sim/view.ts';
+import { publicSnapshot, snapshot, seatLabel } from '../sim/view.ts';
+import type { Frame, PublicFrame } from '../sim/view.ts';
+import { takeSteps } from '../sim/display-step.ts';
+import type { DisplayStep } from '../sim/display-step.ts';
 import { developerBot } from '../sim/bot.ts';
 
 export type Push = {
@@ -42,14 +45,66 @@ export type Push = {
   /** Narration since the LAST push to this specific seat, not the whole game's log. */
   lines: { text: string; tone: string }[];
   /**
-   * Connection news about ANOTHER seat — never this push's own recipient. `lobby-and-sessions.md`
+   * Connection news about OTHER seats — never this push's own recipient. `lobby-and-sessions.md`
    * §5: a disconnect is server-layer news about a connection, not a `GameEvent`, so it must not go
    * through the engine or the shared narration log (which must stay replayable from a seed). Built
    * and broadcast entirely by `http.ts`, which already owns the connection table; `session.ts` never
    * sets this field itself — every `Push` `session.ts` builds carries a real `frame` and no
    * `presence`, and `http.ts`'s presence notices carry no `frame` and no `menu`.
+   *
+   * A LIST, since 2026-08-23: a connecting client is told about every other seat at once. It used to
+   * learn of a seat only when that seat disconnected AFTER it connected, so a player arriving at a
+   * table where two people had not shown up yet was told nothing at all. `seen` distinguishes "was
+   * here and dropped" from "has never opened the game".
    */
-  presence?: { seat: PlayerIndex; connected: boolean };
+  presence?: { seat: PlayerIndex; connected: boolean; seen: boolean }[];
+  /**
+   * THE FOUR TRANSIENT SIGNALS (2026-08-23) — what solitaire has always drawn and multiplayer never
+   * did: sound cues, the timetable slot a D12 just filled, a one-line announcement, and the card
+   * that just came into this seat's hand.
+   *
+   * The first three are SHARED — a collision anywhere on the Division, the Stage bell, a train
+   * running off the end pays everyone — so they are identical in every seat's push and drained once
+   * per broadcast. `justDrawn` is not: it goes ONLY to the seat that drew it (`game.justDrawn` is
+   * one field for the whole game and does not say whose). `test/redaction.test.ts` is the guard.
+   */
+  cues?: string[];
+  scheduled?: number | null;
+  announcement?: string | null;
+  justDrawn?: string | null;
+  /**
+   * THE LAST INTENT `seq` THIS SEAT HAD ACCEPTED — on the connect push only (v0.8.4).
+   *
+   * The client numbers its intents from 1 per page load, and this host remembers the seat's last
+   * accepted number for the life of the game and answers a repeat with "already applied" (§5). So
+   * a seat that had made one move, reloaded, and clicked again sent `seq: 1` a second time: the
+   * server said ok and did nothing, the page redrew nothing, and the click looked dead. Telling the
+   * client where the count stands lets it continue from there instead of starting over.
+   */
+  lastSeq?: number;
+  /**
+   * ORDERED PRESENTATION STEPS — v0.8.0, TODO #13.
+   *
+   * A field on `Push` rather than a second SSE event type, following `presence`'s precedent and for
+   * its stated reason (`http.ts`): one message shape for the client to parse. `http.ts` therefore
+   * needs no change at all — `broadcastGame` forwards whatever this file builds.
+   *
+   * IDENTICAL IN EVERY SEAT'S PUSH, because a step carries the PUBLIC board and nothing else. A
+   * player's own hand, menu and objective are not animated: they arrive on the same push, already
+   * coalesced, exactly as they always have. That is what keeps the redaction surface at zero new
+   * area — `test/redaction.test.ts` guards the projection these are built from.
+   */
+  steps?: DisplayStep[];
+  /**
+   * The public board to start a step queue from — sent on a CONNECT, never on an update.
+   *
+   * Steps carry deltas against one chain shared by the whole table, so a client that has just
+   * arrived (or come back) has nothing to merge the next delta onto and `applyPublicDelta` would
+   * rightly throw. This is that baseline: the exact frame the chain has reached, so the next step
+   * lands on it. A reconnecting client resets rather than replaying what it missed — the history
+   * panel is what carries the words, and it is already sent whole on connect (#97).
+   */
+  publicReset?: PublicFrame;
 };
 
 /**
@@ -141,6 +196,9 @@ function buildSession(
   lastMoveAtInit: number,
 ): GameSession {
   let lastMoveAt = lastMoveAtInit;
+  /** Who drew the card `game.justDrawn` names. The engine records WHICH card came into hand but not
+   * whose hand it went into, and that is the whole difference between a badge and a leak. */
+  let lastDraw: { seat: PlayerIndex; cardId: string } | null = null;
   const lastSeq = new Map<PlayerIndex, number>();
   const lastFrame = new Map<PlayerIndex, Frame>();
   const sentLines = new Map<PlayerIndex, number>();
@@ -152,30 +210,84 @@ function buildSession(
   };
   let open: OpenSpan | null = openSpanFor(Date.now());
 
+  /**
+   * A seat's full Frame, with `lines` deliberately EMPTY (#97).
+   *
+   * Narration reaches a client by ONE path — `Push.lines` — because `RemoteSession`
+   * (`web/session.ts`) accumulates from that field alone and its `lines()` returns the accumulator.
+   * Passing `game.log` here serialised the entire log into every frame for every seat, where it grew
+   * all game and was thrown away on arrival, while `linesSince` correctly sent the same text beside
+   * it. The duplicate was not merely waste: it masked the reconnect bug `connect` fixes below.
+   */
   function frameFor(seat: PlayerIndex): Frame {
-    return snapshot(game.state, game.log, null, null, null, false, seat);
+    return snapshot(game.state, [], null, null, null, false, seat);
   }
 
-  function linesSince(seat: PlayerIndex): { text: string; tone: string }[] {
-    const already = sentLines.get(seat) ?? 0;
-    sentLines.set(seat, game.log.length);
-    return game.log.slice(already);
+  /**
+   * WHAT THIS SEAT HAS NOT BEEN SENT YET, bookmarked by SEQUENCE rather than by position.
+   *
+   * This was `game.log.slice(sentLines.get(seat))` against an array the game trims to `LOG_LIMIT`.
+   * Once a seat's bookmark reached that limit the array stopped growing past it, so the slice
+   * returned an empty list on every push from then on and that seat's history froze permanently —
+   * at a different moment for each seat, because each holds its own bookmark. Reported from a
+   * two-player game that did not reach Day 5.
+   *
+   * A sequence number cannot run past the end: lines that have been trimmed are simply gone, and
+   * everything still held with a higher `seq` is sent. A seat that has missed more than the log
+   * keeps gets what remains rather than nothing.
+   */
+  function linesSince(seat: PlayerIndex): { text: string; tone: string; seq: number }[] {
+    const already = sentLines.get(seat) ?? -1;
+    const fresh = game.log.filter((l) => l.seq > already);
+    const last = game.log[game.log.length - 1];
+    if (last) sentLines.set(seat, last.seq);
+    return fresh;
   }
 
   function menuFor(seat: PlayerIndex): Menu | null {
     return seat === currentActor(game) ? actionMenu(game, seat) : null;
   }
 
-  function pushFor(seat: PlayerIndex): Push {
+  /** What the last batch of events earned, drained from the game exactly once and then handed to
+   * every seat. `null` on a (re)connect: a fresh connection is drawing a STATE, and replaying the
+   * sounds of everything it missed would be a burst of noise about the past. */
+  type Moment = { cues: string[]; scheduled: number | null; announcement: string | null };
+
+  function takeMoment(): Moment {
+    const cues = game.cues.splice(0, game.cues.length);
+    const scheduled = game.scheduled;
+    game.scheduled = null;
+    const announcement = game.announced;
+    game.announced = null;
+    return { cues, scheduled, announcement };
+  }
+
+  function pushFor(seat: PlayerIndex, moment: Moment | null, steps: DisplayStep[] = []): Push {
     const frame = frameFor(seat);
     const delta = deltaFrame(lastFrame.get(seat) ?? null, frame);
     lastFrame.set(seat, frame);
-    return { frame: delta, menu: menuFor(seat), lines: linesSince(seat) };
+    const push: Push = { frame: delta, menu: menuFor(seat), lines: linesSince(seat) };
+    if (steps.length > 0) push.steps = steps;
+    if (moment) {
+      if (moment.cues.length > 0) push.cues = moment.cues;
+      if (moment.scheduled !== null) push.scheduled = moment.scheduled;
+      if (moment.announcement !== null) push.announcement = moment.announcement;
+    }
+    // The drawer's own card, and nobody else's — on a reconnect too, so the badge survives a refresh.
+    if (lastDraw !== null && lastDraw.seat === seat) push.justDrawn = lastDraw.cardId;
+    return push;
   }
 
   function pushesForAll(): Map<PlayerIndex, Push> {
+    const moment = takeMoment();
+    // Drained ONCE for the whole broadcast, not per seat: the steps are public and identical, and
+    // `takeSteps` empties the collector, so draining inside the loop would give them to seat 0 and
+    // an empty list to everybody else.
+    const steps = takeSteps(game.display);
     const out = new Map<PlayerIndex, Push>();
-    for (let seat = 0; seat < playerNames.length; seat++) out.set(seat as PlayerIndex, pushFor(seat as PlayerIndex));
+    for (let seat = 0; seat < playerNames.length; seat++) {
+      out.set(seat as PlayerIndex, pushFor(seat as PlayerIndex, moment, steps));
+    }
     return out;
   }
 
@@ -215,6 +327,52 @@ function buildSession(
    * in zero wall-clock time by definition. Called once at construction (a resume could land exactly
    * on a bot's turn) and once after every accepted human intent.
    */
+/**
+   * §3.3, EXTENDED PLAY (Gitea#11) — the bots' half of a unanimous vote.
+   *
+   * "Bots will not disagree with the human. Humans get to vote first. If all humans vote yes, then
+   * bots vote yes too. If a human votes no, it's not unanimous, it ends right then. If only bots are
+   * playing, they never vote to extend" (Jesse, 2026-08-28).
+   *
+   * Which makes a bot's vote a formality rather than a policy decision, performed once the humans
+   * have already settled it, so that the unanimity the engine checks is a real unanimity rather than
+   * a special case carved into the rules for absent players.
+   *
+   * THE ALL-BOT TABLE IS THE CASE TO GET RIGHT, and getting it wrong hung the game. `driveBots`
+   * cannot reach the vote — it loops on `currentActor`, which is null the moment the game stops —
+   * so if this returns early with no humans to follow, nobody votes at all and a bot-only game sits
+   * on the question for ever. It happened: an all-bot session never reached `finished`. With nobody
+   * to follow, the bots' own answer stands, and it is no.
+   */
+  function driveBotVotes(): void {
+    if (game.state.status !== 'awaitingExtension') return;
+    const humans = [...Array(playerNames.length).keys()].filter((p) => !botSeats.has(p));
+    // A human who has voted `false` has already ended the game, so reaching here with humans still
+    // outstanding means the table is genuinely waiting on a person. Bots wait with it.
+    if (humans.length > 0 && !humans.every((p) => game.state.extensionVotes[p] === true)) return;
+    const agree = humans.length > 0;
+    for (const seat of botSeats) {
+      if (game.state.extensionVotes[seat] === null) {
+        submit(game, { type: 'game.extend', player: seat, agree }, seat);
+      }
+    }
+  }
+
+  /**
+   * Bots play, bots vote, and an agreed extension puts them back to playing — so the two drivers
+   * alternate rather than running once each. Bounded because every pass must consume something: a
+   * turn, or a vote that cannot be cast twice.
+   */
+  function driveBotTurns(): void {
+    for (let pass = 0; pass < 1_000; pass++) {
+      const before = game.history.length;
+      driveBots();
+      driveBotVotes();
+      if (game.history.length === before) return;
+    }
+    throw new Error('driveBotTurns: probable infinite loop');
+  }
+
   function driveBots(): void {
     let guard = 0;
     for (;;) {
@@ -224,13 +382,34 @@ function buildSession(
       const options = legalActions(game.state, actor);
       if (options.length === 0) return;
       const choice = developerBot.choose(game.state, actor, options);
+      const drawnBefore = game.justDrawn;
       const ok = submit(game, choice);
+      if (game.justDrawn !== drawnBefore && game.justDrawn !== null) {
+        lastDraw = { seat: actor, cardId: game.justDrawn };
+      }
       /* c8 ignore next -- `options` came from `legalActions`, so `choice` is always legal. */
       if (!ok) throw new Error(`driveBots: developerBot chose an illegal action for seat ${actor}`);
       settleTiming();
     }
   }
-  driveBots();
+  driveBotTurns();
+  // Whatever the opening bot turns earned belongs to a game nobody was connected to yet — dropped
+  // here rather than fired at the first client to arrive. (It also stops `game.cues` growing without
+  // bound on a server, which nothing was draining before this.)
+  takeMoment();
+  /**
+   * THE PRESENTATION STEPS THOSE TURNS PRODUCED GO WITH THEM (v0.8.0).
+   *
+   * Left in the collector they would be delivered on the FIRST broadcast after somebody connects —
+   * but that client's `publicReset` is the board as it stands AFTER these very moves, so replaying
+   * them onto it would draw positions the game had already left. The plan says as much: opening bot
+   * moves need no replay, and a later display simply receives the final reset.
+   *
+   * This is the only moment the collector holds anything outside an intent. `pushesForAll()` drains
+   * it synchronously at the end of every `intent()`, so between moves it is always empty — which is
+   * what makes dropping here safe rather than a race with a seat that has not been sent them yet.
+   */
+  takeSteps(game.display);
 
   return {
     playerCount: playerNames.length,
@@ -240,7 +419,20 @@ function buildSession(
       // A (re)connect always starts from a clean slate — no cache to trust across a lost connection
       // (or a server restart, Phase 3) — so the honest thing is a full Frame, not a delta.
       lastFrame.delete(seat);
-      return pushFor(seat);
+      // ...and the NARRATION watermark with it (#97). The browser this answers has just reloaded
+      // from an empty accumulator, so a seat told "nothing new since your last push" came back to a
+      // blank history panel mid-game, with the server holding the whole log. `Push.lines` on a
+      // connect IS the history, which is what lets the Frame stop carrying a second copy.
+      sentLines.delete(seat);
+      const push = pushFor(seat, null);
+      push.lastSeq = lastSeq.get(seat) ?? 0;
+      /**
+       * The baseline for this client's step queue (v0.8.0). `game.display.last` is the exact frame
+       * the shared delta chain has reached, so the next step merges onto it; before any step has
+       * been collected there is no chain yet and a fresh projection is the same thing.
+       */
+      push.publicReset = game.display.last ?? publicSnapshot(game.state);
+      return push;
     },
 
     intent(seat, seq, i) {
@@ -249,7 +441,17 @@ function buildSession(
       // never applied, so it is worth trying again (see the `lastSeq.set` below: only on success).
       if (lastSeq.get(seat) === seq) return { accepted: true, pushes: new Map(), timing: null };
 
-      if (seat !== currentActor(game)) return { accepted: false, code: 'NOT_YOUR_TURN' };
+      /**
+       * §3.3, EXTENDED PLAY (Gitea#11) — the vote is the one intent with no actor to be.
+       *
+       * `currentActor` is null once the timetable has run out, so this guard would refuse every
+       * vote with NOT_YOUR_TURN. Every seat may vote, and `check` is still the authority on whether
+       * this particular seat may vote right now (it has voted already; the game is not waiting on a
+       * vote at all), so skipping the turn test here gives nothing away.
+       */
+      if (!isOutOfTurn(i) && seat !== currentActor(game)) {
+        return { accepted: false, code: 'NOT_YOUR_TURN' };
+      }
 
       // Checked directly, rather than via `submit`'s boolean, for two reasons: `submit` writes a
       // "that is not allowed" line into the SHARED `game.log` on rejection, which would otherwise
@@ -259,7 +461,11 @@ function buildSession(
       const code = check(game.state, seat, i);
       if (code) return { accepted: false, code };
 
-      const applied = submit(game, i);
+      const drawnBefore = game.justDrawn;
+      const applied = submit(game, i, isOutOfTurn(i) ? seat : null);
+      if (game.justDrawn !== drawnBefore && game.justDrawn !== null) {
+        lastDraw = { seat, cardId: game.justDrawn };
+      }
       /* c8 ignore next -- `check` above already proved this intent is legal; `submit` cannot then refuse it. */
       if (!applied) return { accepted: false, code: 'REJECTED' };
 
@@ -268,8 +474,9 @@ function buildSession(
       const timing = settleTiming();
       // Any bot due to act now plays out entirely before this push goes back — the delta mechanism
       // diffs against whatever was last sent, so it captures the bots' moves along with the human's
-      // in one push regardless of how many turns that took.
-      driveBots();
+      // in one push regardless of how many turns that took. Votes included, since Gitea#11: a human
+      // agreeing to another Day is exactly the move the bots are waiting on to agree themselves.
+      driveBotTurns();
       return { accepted: true, pushes: pushesForAll(), timing };
     },
 
@@ -279,6 +486,8 @@ function buildSession(
         config: game.state.config,
         playerNames: [...playerNames],
         history: [...game.history],
+        // `awaitingExtension` is a game waiting on its table, not a game that is over — so it maps
+        // to 'active' and `server/index.ts` resumes it on a restart like any other (Gitea#11).
         status: game.state.status === 'finished' ? 'finished' : 'active',
         createdAt,
         botSeats: [...botSeats],
@@ -292,6 +501,8 @@ function buildSession(
         playerCount: playerNames.length,
         playerNames: [...playerNames],
         botSeats: [...botSeats],
+        // `awaitingExtension` is a game waiting on its table, not a game that is over — so it maps
+        // to 'active' and `server/index.ts` resumes it on a restart like any other (Gitea#11).
         status: game.state.status === 'finished' ? 'finished' : 'active',
         createdAt,
         lastMoveAt,
@@ -327,7 +538,11 @@ export function createSession(
 export type ResumeFailure = { stoppedAt: number; of: number; intent: string; code: string };
 
 export function tryResumeSession(saved: SavedGame): { ok: true; session: GameSession } | { ok: false; failure: ResumeFailure } {
-  const { game, stopped } = fromMultiplayerSave(saved.seed, saved.config, saved.playerNames, saved.history);
+  // A save written before `startingOffice` existed opened on a Whistle Post and cannot say so —
+  // replaying it under today's Depot default would deal a different railroad. See `withSavedDeal`.
+  const { game, stopped } = fromMultiplayerSave(
+    saved.seed, withSavedDeal(saved.config), saved.playerNames, saved.history,
+  );
   if (stopped) {
     return {
       ok: false,

src/sim/board-svg.ts

@@ -42,6 +42,12 @@ export type DivisionRoster = {
   actor: number | null;
   /** The player this map is being drawn for. */
   viewer: number;
+  /**
+   * Division nodes to flash — a Mainline card that has just become a different card (Realignment).
+   * Playtest, 2026-09-15: the log said a card had been converted and the map said nothing, so the one
+   * play that changes the Division itself was invisible on the map of it.
+   */
+  flash?: readonly number[];
 };
 
 export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | null): string {
@@ -55,17 +61,57 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
    *
    *   West DP · Mainline · [Limits … Office … Limits] · Mainline · [ … ] · Mainline · East DP
    *
-   * SEATING. Players sit around a table, so the route is laid out the way they do: one row alone,
-   * two rows facing, a horseshoe of three, a square of four. The Division is a LINE and not a loop
-   * — trains enter at one Division Point and leave at the other — so the shape is deliberately left
-   * open, with the two ends drawn as buffer stops facing each other across a marked gap. Closing it
-   * into a ring would promise a connection the rules do not have.
+   * ONE ROW AT EVERY SEAT COUNT (Gitea#18). It used to be laid out the way players sit — two rows
+   * facing, a horseshoe of three, a square of four — and the reasoning for dropping that is at the
+   * layout itself below. The Division is a LINE and not a loop — trains enter at one Division Point
+   * and leave at the other — so the row is deliberately left open, with the two ends drawn as
+   * buffer stops facing outward. Closing it into a ring would promise a connection the rules do
+   * not have.
    *
    * Self-contained on purpose: the replay embeds this by `toString()`, so it may not reach for
    * anything outside its own body.
    */
+  /**
+   * The Mainline modifiers, as the three letters drawn on a card.
+   *
+   * DECLARED INSIDE THIS FUNCTION, like every constant around it, because `sim/replay.ts` emits
+   * `divisionSvg.toString()` into the replay page — a module-scope const it closed over would be
+   * undefined there, and the page threw exactly that way before this was moved.
+   *
+   * Keyed by the name the VIEW builds (`prettyKey`'d in `view.ts`), because that is what arrives
+   * here — not the engine's key, which this file never sees. A modifier with no tag draws nothing
+   * rather than a raw key: `flatMap` over a missing entry yields none, so a card added upstream is
+   * silently unmarked instead of printing "rotaryDumps" at a player.
+   *
+   * ABS Signals is deliberately absent: it has a signal mast of its own.
+   */
+  const MOD_TAGS: Record<string, string> = { Brakeman: 'BRK', Airbrakes: 'AIR', Helpers: 'HLP' };
+
   const CW = { dp: 118, ml: 152, run: 78 };
-  const CH = 58;
+  /**
+   * TALL ENOUGH FOR TWO REGISTERS OF CHIPS, on every cell so the rail runs level across the row.
+   * Was 58, when a cell held one row of trains.
+   */
+  const CH = 76;
+  /**
+   * EVERY DISTRICT THE SAME WIDTH, sized for four chips two-by-two and NOT for its A/D count.
+   *
+   * Measured over 60 games: one office area holds at most 4 distinct trains, and up to 3 of those
+   * can be crews switching below the Running Track — which do not occupy A/D tracks at all. So a
+   * Whistle Post, with its single A/D track, can still have four trains to show, and sizing the cell
+   * by capacity would overflow it. Sizing by OCCUPANCY is worse still: that is what "The Roster
+   * Pass" fixed, because the cell then resizes as trains come and go and shoves the rest of the map
+   * sideways. A fixed two-by-two block holds the map still all game, upgrades included.
+   */
+  const OFFICE_W = 2 * 54 + 12;
+  /**
+   * THE VERTICAL ANATOMY OF A CELL, so the two chip registers and the rail cannot drift apart.
+   * The rail sits above centre; A/D chips straddle it, and the district register hangs below —
+   * which is where those trains are on the real board (Gitea#18).
+   */
+  const RAIL_Y = 34;
+  const CHIP_Y = RAIL_Y - 10;
+  const BELOW_Y = RAIL_Y + 13;
   const GAP = 6;
   /**
    * ONE FIXED SLOT PER A/D TRACK, so the Office Running Track cell is drawn wide enough to hold
@@ -85,7 +131,6 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
    * this is back to what a buffer stop actually needs.
    */
   const PAD = 22;
-  const SIDE_GAP = 34;
 
   const esc = (t: string): string =>
     String(t).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' })[c] ?? c);
@@ -108,29 +153,56 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
       region?: number;
       direction?: string;
       stagesLeft?: number;
+      /** Being made up at a Division Point right now, so the map can mark the train you are loading. */
+      beingMadeUp?: boolean;
     }[];
     cap: number | null;
     tip: string;
+    /** Set on a card that has just changed under the players' feet — drawn with a brief pulse. */
+    flash?: boolean;
+    /** ABS Signals standing on this Mainline card — drawn as a signal mast, not only described. */
+    abs?: boolean;
+    /** The Mainline modifiers on this card, as short tags — see `MOD_TAGS`. */
+    mods?: string[];
     /** Which SEAT's district this cell belongs to, or null for Mainline and Division Points. */
     seat: number | null;
     /** Set on an Office cell when a roster was supplied: whose district this is. */
     owner?: { name: string; isTurn: boolean; isYou: boolean } | null;
+    /**
+     * Office cells only: trains in the district that are NOT holding an A/D track — a crew switching
+     * below the Running Track, or a train standing on it away from the Office. Drawn in a second
+     * register under the rail (Gitea#18).
+     */
+    below?: Cell['trains'];
+    /**
+     * Office cells only: a Red Flag standing at this Office's Limits, and which approach it guards
+     * (#94). A token set out ON the board that holds the next train arriving from that side, so it
+     * is drawn like the other things standing on the map rather than left to the log.
+     */
+    redFlag?: string | null;
     /** Mainline cards only: §2.1 divides one into two regions. 0 elsewhere — no bars are drawn. */
     regions: number;
+    /**
+     * Which way a Heavy Grade climbs, or null on every other card. Drawn as a wedge, because the
+     * tooltip said "climbs east" and the card itself showed nothing — so the one card whose
+     * orientation the PLAYER chooses was the one card you had to hover to read (Jesse, 2026-08-30).
+     */
+    gradeUp?: string | null;
     w: number;
     x: number;
     y: number;
   };
   const cells: Cell[] = [];
-  const sides: number[][] = [];
-  let side: number[] = [];
 
   const push = (c: Omit<Cell, 'x' | 'y'>): void => {
-    side.push(cells.length);
     cells.push({ ...c, x: 0, y: 0 });
   };
 
+  // The node's own index, so a cell can be matched against `roster.flash`. `continue` below skips the
+  // rest of the body, never this.
+  let nodeIndex = -1;
   for (const n of nodes) {
+    nodeIndex++;
     if (n.kind === 'office') {
       const cap = n.capacity;
       const ad = n.trains.flat();
@@ -152,120 +224,128 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
           }
         : null;
 
-      for (const rc of n.running ?? []) {
-        const isOffice = rc.kind === 'office';
-        const adLabel = cap === null ? '' : `A/D ${ad.length}/${cap}`;
-        push({
-          kind: 'run',
-          label: isOffice && owner ? owner.name : rc.label,
-          owner: isOffice ? owner : null,
-          // With an owner on the headline the tier would otherwise vanish, so it joins the A/D
-          // count on the line below.
-          sub: isOffice ? (owner ? [rc.label, adLabel].filter(Boolean).join(' · ') : adLabel) : '',
-          /**
-           * A train standing at the Office occupies an A/D track, which is where it is — but it is
-           * ALSO standing on the Office grid card, so it arrives here in both lists and used to be
-           * drawn twice. Reported as two T10 chips on one Office.
-           */
-          trains: isOffice
-            ? [...rc.trains, ...ad.filter((t) => !rc.trains.some((r) => r.label === t.label))]
-            : rc.trains,
-          cap: isOffice ? cap : null,
-          tip: owner && isOffice
-            ? `${owner.name}'s ${rc.label}` +
-              (owner.isYou ? ' — this is your railroad' : '') +
-              // "their move" is wrong when the reader is the one being waited on.
-              (owner.isTurn ? (owner.isYou ? ' — it is your move' : ' — it is their move') : '')
-            : `${rc.label} — ${rc.kind === 'limits' ? 'the end of this district; the Running Track runs between the Limits' : 'Running Track'}`,
-          seat: n.seat ?? null,
-          // No regions inside a district: a crew moves by Moves there, not by Stages, so it
-          // occupies a card outright rather than a part of one.
-          regions: 0,
-          w: isOffice && cap !== null ? Math.max(CW.run, cap * CHIP_W + 12) : CW.run,
-        });
+      /**
+       * ONE CELL PER DISTRICT — NO OFFICE-AREA DETAIL ON THIS MAP (Gitea#18).
+       *
+       * An Office used to expand into its whole Running Track, Limits to Limits, so this map carried
+       * every straight, turnout, facility and Limits sign of every district. Two things were wrong
+       * with that. It is the OFFICE map's job, and it draws all of it properly, with the rails; and
+       * it made the Division map grow sideways as districts were built, shoving everything east of a
+       * district along every time somebody laid a card.
+       *
+       * TRAINS STAY. "Trains within the office area should definitely be represented on the division
+       * map" — at a glance the number and which way it is pointing, and the consist on the tooltip.
+       * They are split into two registers, because a train holding an A/D track and a crew switching
+       * in the district are not the same thing: A/D occupancy is a hard capacity that causes
+       * collisions, switching is not. The split is drawn as POSITION rather than colour — A/D on the
+       * rail, the rest below it — which is where those trains actually are.
+       */
+      const seen = new Set(ad.map((t) => t.label));
+      const below: typeof ad = [];
+      for (const t of [...(n.running ?? []).flatMap((rc) => rc.trains), ...(n.switching ?? [])]) {
+        if (seen.has(t.label)) continue;
+        seen.add(t.label);
+        below.push(t);
       }
-      // A crew below the Running Track has no position ON it, so it is reported against the
-      // district rather than drawn somewhere it is not.
-      const below = n.switching ?? [];
-      if (below.length > 0) {
-        const last = cells[cells.length - 1];
-        if (last) last.sub = `${below.length} switching below`;
-      }
-      sides.push(side);
-      side = [];
+      const adLabel = cap === null ? '' : `A/D ${ad.length}/${cap}`;
+      push({
+        kind: 'run',
+        label: owner ? owner.name : n.label,
+        owner,
+        sub: [owner ? n.label : '', adLabel, below.length > 0 ? `${below.length} switching` : '']
+          .filter(Boolean)
+          .join(' \u00b7 '),
+        trains: ad,
+        below,
+        cap,
+        tip:
+          (owner ? `${owner.name}'s ${n.label}` : n.label) +
+          (owner?.isYou ? ' — this is your railroad' : '') +
+          // "their move" is wrong when the reader is the one being waited on.
+          (owner?.isTurn ? (owner.isYou ? ' — it is your move' : ' — it is their move') : '') +
+          // #94 — first, and in full, because it is the one thing here that CHANGES what a train
+          // may do. Everything below it describes the cell; this describes a rule in force.
+          (n.redFlag === 'east' || n.redFlag === 'west'
+            ? `\n\nRED FLAG set out at the ${n.redFlag === 'east' ? 'East' : 'West'} Limits — the ` +
+              `next train arriving from the ${n.redFlag} is held short, and the flag is spent doing it.`
+            : '') +
+          `\n\nThe district itself is drawn on the Office map — this cell is the whole of it, with the ` +
+          `trains standing in it: those holding an A/D track on the rail, and any crew switching in ` +
+          `the district below it.`,
+        seat: n.seat ?? null,
+        redFlag: n.redFlag ?? null,
+        // No regions in a district: a crew moves by Moves there, not by Stages, so it occupies a
+        // card outright rather than a part of one.
+        regions: 0,
+        w: OFFICE_W,
+      });
       continue;
     }
     const dp = n.kind === 'dp';
+    /**
+     * A train in the Interchange's yard is drawn on the card but counted against nothing.
+     *
+     * It is not on the running line — that is the whole distinction §7 rests on — so it cannot take
+     * the card's capacity. It still has to be SEEN: an Extra made up here would otherwise be a train
+     * the player just placed that appears nowhere on the map.
+     */
+    const inYard = n.yard ?? [];
+    const onRoad = n.trains.flat();
+    const free = n.capacity === null ? '' : `${Math.max(0, n.capacity - onRoad.length)} of ${n.capacity} free`;
     push({
       kind: dp ? 'dp' : 'ml',
       label: n.label,
-      sub: n.capacity === null ? 'no limit — trains queue' : `${Math.max(0, n.capacity - n.trains.flat().length)} of ${n.capacity} free`,
-      trains: n.trains.flat(),
+      ...(roster?.flash?.includes(nodeIndex) ? { flash: true } : {}),
+      sub: n.capacity === null
+        ? 'no limit — trains queue'
+        : [free, inYard.length > 0 ? `${inYard.length} in the yard` : ''].filter(Boolean).join(' · '),
+      trains: [...onRoad, ...inYard],
       cap: n.capacity,
       tip: dp
         ? 'A Division Point — the end of the line. Trains both enter and leave the Division here (odd numbers run west, even run east), and queue without limit'
         : `${n.label} — Mainline${n.gradeUp ? `, climbs ${n.gradeUp === 'east' ? 'east' : 'west'}` : ''}${n.modifiers.length ? ` · ${n.modifiers.join(' · ')}` : ''}` +
+          (inYard.length > 0
+            ? `\n\n${inYard.length} train${inYard.length === 1 ? '' : 's'} standing in the yard, not on the running line — waiting to highball onto this card`
+            : '') +
           // What the card actually DOES. The name alone left Hilly and Uncontrolled Siding as
           // words with no gameplay attached — reported exactly that way.
           (n.what ? `\n\n${n.what}` : ''),
       seat: null,
+      // Attachments are drawn, not only described: `modifiers` carries ABS Signals alongside the
+      // Mainline modifiers, and the name is the one the view already built for the tooltip.
+      abs: !dp && n.modifiers.includes('ABS Signals'),
+      mods: dp ? [] : n.modifiers.flatMap((m) => MOD_TAGS[m] ?? []),
       // A Division Point is one region — the queue trains enter and leave the Division through.
       regions: dp ? 1 : (n.regions ?? 0),
+      gradeUp: dp ? null : (n.gradeUp ?? null),
       w: dp ? CW.dp : CW.ml,
     });
   }
-  if (side.length > 0) sides.push(side);
 
-  // Each player's side carries their district and the Mainline card leading into it; whatever is
-  // left over (the last Mainline and the East DP) joins the final side.
-  const seats = Math.max(1, Math.min(4, nodes.filter((n) => n.kind === 'office').length));
-  const lanes: number[][] = [];
-  for (let i = 0; i < seats; i++) lanes.push([]);
-  sides.forEach((grp, i) => {
-    const target = Math.min(i, seats - 1);
-    for (const idx of grp) lanes[target]!.push(idx);
-  });
-
-  // -- lay the sides out around the table -------------------------------------------------------
-  // top → right → bottom (reversed) → left (reversed), which gives a row, two facing rows, a
-  // horseshoe open to the west, and a square broken at the same place.
-  const dir: ('top' | 'right' | 'bottom' | 'left')[] =
-    seats === 1 ? ['top'] : seats === 2 ? ['top', 'bottom'] : seats === 3 ? ['top', 'right', 'bottom'] : ['top', 'right', 'bottom', 'left'];
-
-  const runLen = (idxs: number[]): number =>
-    idxs.reduce((n, i) => n + cells[i]!.w + GAP, -GAP);
-  const widest = Math.max(...lanes.map((l) => runLen(l)), 200);
-  const tall = lanes.length > 1 ? Math.max(...lanes.map((l) => l.length), 1) * (CH + GAP) : CH;
-
-  const vertCount = dir.filter((d) => d === 'right' || d === 'left').length;
-  const boardW = PAD * 2 + widest + (vertCount > 0 ? CW.run + SIDE_GAP : 0);
-  const boardH = PAD * 2 + (dir.includes('bottom') ? CH * 2 + SIDE_GAP + (vertCount ? tall : 0) : CH) + 30;
-
-  lanes.forEach((idxs, i) => {
-    const d = dir[i]!;
-    if (d === 'top' || d === 'bottom') {
-      const y = d === 'top' ? PAD : boardH - PAD - CH - 22;
-      const order = d === 'bottom' ? [...idxs].reverse() : idxs;
-      let x = PAD;
-      for (const idx of order) {
-        const c = cells[idx]!;
-        c.x = x;
-        c.y = y;
-        x += c.w + GAP;
-      }
-    } else {
-      const x = d === 'right' ? boardW - PAD - CW.run : PAD;
-      const order = d === 'left' ? [...idxs].reverse() : idxs;
-      let y = PAD + CH + SIDE_GAP;
-      for (const idx of order) {
-        const c = cells[idx]!;
-        c.x = x;
-        c.y = y;
-        c.w = CW.run;
-        y += CH + GAP;
-      }
-    }
-  });
+  /**
+   * ONE ROW, WEST TO EAST (Gitea#18). The West Division Point is at the far left, the East at the
+   * far right, and nothing wraps.
+   *
+   * IT USED TO BE LAID OUT AROUND A TABLE — one row for a single seat, two facing rows for two, a
+   * horseshoe for three, a square for four — on the reasoning that players sit around a table so the
+   * route should too. That cost more than it bought, and three separate reports came out of it: the
+   * buffer stops pointed the wrong way once the route turned a corner, and, the one that decided it,
+   * **east stopped being to the right**. A player's east could be drawn south, west or north
+   * depending on which lane their district landed in, on a map whose whole job is saying which way
+   * a train is going.
+   *
+   * A row is wider than a square — roughly 1,580px at four players against 842 — and that is
+   * accepted: the map scrolls and zooms, and being able to rely on east meaning right is worth the
+   * scroll.
+   */
+  let x = PAD;
+  for (const c of cells) {
+    c.x = x;
+    c.y = PAD;
+    x += c.w + GAP;
+  }
+  const boardW = x - GAP + PAD;
+  const boardH = PAD * 2 + CH + 30;
 
   // -- draw -------------------------------------------------------------------------------------
   const rail = (x1: number, y: number, x2: number): string => {
@@ -280,20 +360,29 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
     return o;
   };
 
-  // The same rail turned through ninety degrees, for the sides of the table.
-  const railV = (x: number, y1: number, y2: number): string => {
-    let o =
-      `<line class="bs-rail" x1="${x - 2.5}" y1="${y1}" x2="${x - 2.5}" y2="${y2}"/>` +
-      `<line class="bs-rail" x1="${x + 2.5}" y1="${y1}" x2="${x + 2.5}" y2="${y2}"/>`;
-    const n = Math.max(2, Math.floor(Math.abs(y2 - y1) / 9));
-    for (let i = 0; i <= n; i++) {
-      const ty = y1 + ((y2 - y1) * i) / n;
-      o += `<line class="bs-tie" x1="${x - 4.5}" y1="${ty}" x2="${x + 4.5}" y2="${ty}"/>`;
-    }
-    return o;
-  };
-
-  let out = `<svg class="bs bs-div" viewBox="0 0 ${Math.ceil(boardW)} ${Math.ceil(boardH)}" preserveAspectRatio="xMinYMin meet">`;
+  /**
+   * DRAWN AT ITS OWN SIZE, SO IT SCROLLS RATHER THAN SHRINKING (Gitea#18).
+   *
+   * An SVG has a viewBox and a drawn size, and the browser scales one to the other. `.bs` is
+   * `width:100%`, so the map is drawn at whatever the panel is wide — which was harmless while the
+   * Division was 842px and wrapped around a table, and is not now that a single row is 1,580px. At
+   * that width in an 800px panel every label renders at half size, on the map that needs reading
+   * most. Setting the width to the viewBox width makes one unit one pixel, and the containers
+   * already scroll (`#division`, `#vdivision`).
+   *
+   * THE PLAYABLE PAGE DOES NOT NEED THIS — `applyZoom` (`main.ts`) sets exactly the same width from
+   * the same viewBox after every render, and overrides this when the zoom is not 100%. THE REPLAYS
+   * DO: neither `replays.ts` nor the standalone `replay.ts` calls it, so without this they get the
+   * `width:100%` shrink. It is inline rather than in `BOARD_CSS` because only this function knows
+   * how wide the row came out.
+   *
+   * `flex:none` because `#division` is a flex container and a flex item may be shrunk below an
+   * explicit width; there is no point pinning it and then letting the panel squeeze it anyway.
+   */
+  let out =
+    `<svg class="bs bs-div" viewBox="0 0 ${Math.ceil(boardW)} ${Math.ceil(boardH)}" ` +
+    `style="width:${Math.ceil(boardW)}px;flex:none" ` +
+    `preserveAspectRatio="xMinYMin meet">`;
 
   // The joins between consecutive cells, drawn as rail so a connection is rail meeting rail. A join
   // that crosses from one player's side to the next is drawn heavier and labelled: that boundary is
@@ -301,28 +390,12 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
   for (let i = 0; i + 1 < cells.length; i++) {
     const a = cells[i]!;
     const b = cells[i + 1]!;
-    const sameRow = Math.abs(a.y - b.y) < 1;
-    const sameCol = Math.abs(a.x - b.x) < 1;
-    if (sameRow && b.x > a.x) out += rail(a.x + a.w, a.y + CH / 2, b.x);
-    else if (sameRow && b.x < a.x) out += rail(b.x + b.w, a.y + CH / 2, a.x);
-    else if (sameCol) {
-      // Stacked down one side of the table: still one straight run of track, not a turn.
-      const top = Math.min(a.y + CH, b.y + CH);
-      const bot = Math.max(a.y, b.y);
-      out += railV(a.x + a.w / 2, top, bot);
-    } else {
-      // A turn between sides: an elbow, so the route is visibly continuous around the table.
-      const ax = a.x + a.w / 2;
-      const bx = b.x + b.w / 2;
-      const ay = a.y + CH;
-      const by = b.y;
-      out += `<path class="bs-turn" d="M${ax} ${ay} L${ax} ${(ay + by) / 2} L${bx} ${(ay + by) / 2} L${bx} ${by}"/>`;
-    }
+    out += rail(a.x + a.w, a.y + RAIL_Y, b.x);
   }
 
   cells.forEach((c) => {
     const full = c.cap !== null && c.trains.length >= c.cap;
-    out += `<g class="bs-dcell bs-d${c.kind}${full ? ' bs-full' : ''}" data-tip="${esc(c.tip)}">`;
+    out += `<g class="bs-dcell bs-d${c.kind}${full ? ' bs-full' : ''}${c.flash ? ' bs-changed' : ''}" data-tip="${esc(c.tip)}">`;
     out += `<rect x="${c.x}" y="${c.y}" width="${c.w}" height="${CH}" rx="5"/>`;
     /**
      * WHOSE IS IT, IS IT THEIR MOVE, AND IS IT MINE — answered by colour and one suffix rather
@@ -333,15 +406,156 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
     const mark = c.owner ? ` bs-owner${c.owner.isTurn ? ' bs-turn' : ''}${c.owner.isYou ? ' bs-you' : ''}` : '';
     const suffix = c.owner?.isYou ? ' (you)' : '';
     out += `<text class="bs-name${mark}" x="${c.x + 7}" y="${c.y + 14}">${esc(c.label + suffix)}</text>`;
-    out += rail(c.x + 6, c.y + 32, c.x + c.w - 6);
+    out += rail(c.x + 6, c.y + RAIL_Y, c.x + c.w - 6);
     if (c.sub) out += `<text class="bs-cap" x="${c.x + 7}" y="${c.y + CH - 6}">${esc(c.sub)}</text>`;
 
-    // REGIONS. §2.1 divides a Mainline card into two, and §8.2 moves a train one region per Stage.
-    // The bars are the card's DISTANCE and never vary; what varies is how fast a train covers them,
-    // so a 60 card is crossed in one Stage and a slow train on a 30 takes three.
+    // REGIONS. A Mainline card is 1 to 3 of them (Gitea#3) and a train advances one per Stage. The
+    // bars are the card's DISTANCE and never vary; where a train STARTS is what does.
     const RW = c.regions > 0 ? (c.w - 12) / c.regions : 0;
     for (let r = 0; r < c.regions; r++) {
-      out += `<line class="bs-region" x1="${c.x + 6 + RW * r}" y1="${c.y + 20}" x2="${c.x + 6 + RW * r}" y2="${c.y + 44}"/>`;
+      out += `<line class="bs-region" x1="${c.x + 6 + RW * r}" y1="${c.y + RAIL_Y - 14}" x2="${c.x + 6 + RW * r}" y2="${c.y + RAIL_Y + 10}"/>`;
+    }
+
+    /**
+     * A RED FLAG STANDING AT THE LIMITS (#94).
+     *
+     * Drawn at the END IT GUARDS — west on the left, east on the right, since east is right on this
+     * map — because which approach it covers is the whole of the information. A flag in the middle
+     * of the cell would say a flag is out and leave the reader to hover for the half that decides
+     * whether to run a train.
+     *
+     * A staff with a pennant, at rail height, standing clear of the chips: it is beside the rail,
+     * which is where a flag is. Red is otherwise unused on this map (`bs-full` tints a cell, it does
+     * not draw), so the mark does not compete with anything for meaning.
+     */
+    if (c.redFlag === 'east' || c.redFlag === 'west') {
+      const west = c.redFlag === 'west';
+      const fx = west ? c.x + 9 : c.x + c.w - 9;
+      const top = c.y + RAIL_Y - 22;
+      const dir = west ? 1 : -1;
+      out += `<g class="bs-flag">`;
+      out += `<line x1="${fx}" y1="${top}" x2="${fx}" y2="${c.y + RAIL_Y + 4}"/>`;
+      // The pennant flies INTO the cell, so it can never overhang the card edge at either end.
+      out += `<polygon points="${fx},${top} ${fx + dir * 13},${top + 5} ${fx},${top + 10}"/>`;
+      out += `</g>`;
+    }
+
+    /**
+     * ABS SIGNALS, DRAWN RATHER THAN ONLY SAID — reported from a table on Day 1 Stage 1 of
+     * v0.8.0.16: "when played on the trestle, there was no on-the-card indication; it's only when
+     * you look at the tooltip for trestle that you see that ABS exists."
+     *
+     * Exactly the complaint the grade wedge below answers, and the card it protects is the one a
+     * player is deciding whether to run a second train onto. A signal is the literal object — ABS
+     * is Automatic Block Signals — so the mark is a mast with a lit lamp rather than a badge
+     * reading "ABS", and it needs no room for text, which is what lets it sit clear of a name as
+     * long as "Uncontrolled Siding" on a 152px card.
+     *
+     * TOP-RIGHT, above the rail and clear of the chip registers: the flag owns the cell ends at
+     * rail height and the grade wedge owns the bottom-right, so this is the corner left.
+     */
+    if (c.abs) {
+      const mx = c.x + c.w - 10;
+      const top = c.y + 5;
+      out += `<g class="bs-abs">`;
+      out += `<line class="bs-abs-mast" x1="${mx}" y1="${top}" x2="${mx}" y2="${top + 15}"/>`;
+      // Two lamps, the upper one lit: a signal showing an aspect, not a bare post.
+      out += `<circle class="bs-abs-lit" cx="${mx}" cy="${top + 3}" r="2.6"/>`;
+      out += `<circle class="bs-abs-dark" cx="${mx}" cy="${top + 9}" r="2.6"/>`;
+      out += `</g>`;
+    }
+
+    /**
+     * THE MAINLINE MODIFIERS, DRAWN RATHER THAN ONLY SAID (Jesse, 2026-09-21) — the other half of
+     * the ABS report above: "Brakeman, Airbrakes, Helpers and Realignment should also be drawn on
+     * the card, not just the tooltip."
+     *
+     * ONLY THREE OF THOSE FOUR CAN EVER BE HERE. Realignment does not sit on a card — `reduce`
+     * takes the `became` branch and CHANGES `node.card`, so a realigned Trestle simply is an
+     * Uncontrolled Siding afterwards and the card face already says so. The other three are
+     * `gradeOnly`, so in practice this is a Heavy Grade's row.
+     *
+     * TAGS, NOT NAMES, and only because the measurements leave no choice: "Brakeman · Airbrakes ·
+     * Helpers" is 30 characters where about eleven fit beside a card name on a 152px cell. Three
+     * letters is the most that fits while still mapping to one card each, and the tooltip — which
+     * has always named them in full — is what expands it. The mark says THAT there is one, which
+     * is the half that was missing.
+     *
+     * Right-aligned on the name row: the only band on the cell that is clear, with the chip
+     * registers starting at `CHIP_Y` below and the capacity line and grade wedge at the foot.
+     * Shifted left of the signal when a card carries both.
+     */
+    if (c.mods && c.mods.length > 0) {
+      out +=
+        `<text class="bs-mod" text-anchor="end" x="${c.x + c.w - (c.abs ? 20 : 7)}" y="${c.y + 14}">` +
+        `${esc(c.mods.join('·'))}</text>`;
+    }
+
+    /**
+     * WHICH WAY A HEAVY GRADE CLIMBS, drawn rather than only said.
+     *
+     * The tooltip has said "climbs east" since the Frame carried `gradeUp`, and the card showed
+     * nothing — so the one Mainline card whose orientation the PLAYER sets, and the one where a
+     * Helpers or Brakeman modifier means opposite things at opposite ends, was the one you had to
+     * hover to read (Jesse, 2026-08-30).
+     *
+     * A wedge rising toward the climb, with an arrow up its slope. Two cues rather than one: the
+     * wedge alone asks the reader to judge which end is taller, which at eleven pixels of rise is a
+     * comparison rather than a glance. Bottom-right, clear of the left-aligned capacity line and
+     * below the region bars, so it never lands under a train chip.
+     *
+     * `east` is RIGHT on this map and always has been (Gitea#18) — that is what makes a wedge
+     * readable without a compass, and it is why the row layout is worth its width.
+     */
+    if (c.gradeUp === 'east' || c.gradeUp === 'west') {
+      const s = c.gradeUp === 'east' ? 1 : -1;
+      const GW = 58;
+      const RISE = 24;
+      const gx1 = c.x + c.w - 9 - GW;
+      const gx2 = c.x + c.w - 9;
+      const yb = c.y + CH - 6;
+      const peakX = s === 1 ? gx2 : gx1;
+      out += `<polygon class="bs-grade" points="${gx1},${yb} ${gx2},${yb} ${peakX},${yb - RISE}"/>`;
+
+      /**
+       * THE ARROW LIES ALONG THE WEDGE'S OWN SLOPE, CENTRED IN IT (Jesse, 2026-08-30).
+       *
+       * Parallel to the hypotenuse is the shape that fits: the perpendicular gap to the slope is
+       * then CONSTANT along the whole arrow, instead of closing at one end the way a steeper line
+       * does. The earlier 30° pass had to be tucked into the fat half to survive, because 30° is
+       * steeper than this wedge climbs — at 58×24 the slope is 22.5°, and the arrow simply lies on
+       * it.
+       *
+       * Centred on the TRIANGLE'S CENTROID (2/3 along the base, 1/3 up), which is the balance point
+       * of the form rather than of its bounding box — centring on the box would push the arrow into
+       * the thin corner where there is no height for it.
+       *
+       * The wedge grew 50×22 → 58×24 to pay for that: the centroid sits only ~7px from the
+       * hypotenuse, so a centred arrow has less room than an off-centre one and needs a bigger form
+       * to keep it. Sizes are the best fit found by search, clearing every edge by 2.88px;
+       * `web.test.ts` re-derives it and fails under 2px.
+       *
+       * Worked in the wedge's own frame — `u` along the base from the thin corner, `h` up from it —
+       * so a westward climb is one sign on `u` rather than a second set of coordinates.
+       */
+      const L = 20;
+      const HL = 6;
+      const HW = 3.5;
+      const T = 1.4;
+      const A = Math.atan2(RISE, GW);
+      const cos = Math.cos(A);
+      const sin = Math.sin(A);
+      const cu = (2 * GW) / 3;
+      const ch = RISE / 3;
+      const pt = (lx: number, ly: number): string => {
+        const u = cu + lx * cos - ly * sin;
+        const h = ch + lx * sin + ly * cos;
+        return `${s === 1 ? gx1 + u : gx2 - u},${yb - h}`;
+      };
+      const H = L / 2;
+      out +=
+        `<polygon class="bs-gradeup" points="${pt(-H, -T)} ${pt(H - HL, -T)} ${pt(H - HL, -HW)} ` +
+        `${pt(H, 0)} ${pt(H - HL, HW)} ${pt(H - HL, T)} ${pt(-H, T)}"/>`;
     }
 
     /**
@@ -356,53 +570,101 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
      * So this keeps the two things the Division map is actually for — where a train is and which way
      * it is going — and leaves the cars to the tooltip and to the district.
      */
-    c.trains.forEach((t, k) => {
+    /**
+     * A TRAIN IS A CHIP — its number, which way it points, and how many cars.
+     *
+     * It was drawn as a full consist here, matching the Office Area card, and reported as too large
+     * and hard to read. The Office card is where a consist is worth drawing, because that is where
+     * the switching decisions are made and where there is room to read it. So this keeps the two
+     * things the Division map is for — where a train is and which way it is going — and leaves the
+     * cars to the tooltip and to the district.
+     */
+    /**
+     * THE REGION NUMBER IS A PLACE ON THE MAP, NOT A DISTANCE RUN (Gitea#22).
+     *
+     * `view.ts` mirrors a westbound train before it gets here, so this counts boxes west to east
+     * for every train regardless of which way it is going — and the tooltip says so, because
+     * "region 2 of 2" beside "2 Stages still to run" reads as a contradiction otherwise. It is the
+     * second box from the west end; a westbound train in it has its whole crossing ahead of it.
+     */
+    const chip = (t: NonNullable<Cell['trains']>[number], tx: number, ty: number, w: number): void => {
       const cars = t.cars ?? [];
       const arrow = t.facing === 'w' ? '\u25c0' : '\u25b6';
       const loaded = cars.filter((x) => /^loaded/.test(x) || /caboose/.test(x)).length;
       const label = cars.length === 0 ? `${t.label} ${arrow}` : `${t.label} ${arrow}${cars.length}`;
-
-      /**
-       * THE OFFICE RUNNING CELL GETS FIXED SLOTS, ONE PER A/D TRACK — never a centre spread.
-       *
-       * Centred spreading pushes its outer chips outward as MORE trains arrive, and the cell was
-       * sized for the cards it holds, not for its trains — so two chips at a Station used to land at
-       * x 215–267 and 271–316 inside a cell spanning only 230–308, spilling onto the Limits cards
-       * either side. A fixed slot per A/D track cannot overflow the cell at any occupancy, because
-       * the cell was sized for exactly that many slots (see `CHIP_W` above).
-       */
-      const isOfficeRun = c.kind === 'run' && c.cap !== null && c.cap > 0;
-      const slotW = isOfficeRun ? (c.w - 12) / c.cap! : 0;
-      const w = isOfficeRun ? Math.min(slotW - 4, label.length * 6.6 + 12) : Math.min(c.w - 8, label.length * 6.6 + 12);
-      // A train on a Mainline card sits in ITS region; anywhere else it just sits on the card.
+      // THE TRAIN THE MAKE-UP PANEL IS TALKING ABOUT. Amber, because that is what the rest of the
+      // page uses for "this is the thing you are acting on" (Jesse, playtest 2026-09-16).
+      const building = t.beingMadeUp === true;
       const inRegion = c.regions > 1 && typeof t.region === 'number';
-      const tx = isOfficeRun
-        ? c.x + 6 + slotW * (k + 0.5)
-        : (inRegion ? c.x + 6 + RW * (t.region ?? 0) + RW / 2 : c.x + c.w / 2) +
-          (inRegion ? 0 : (k - (c.trains.length - 1) / 2) * (w + 4));
       const dir = t.direction === 'west' ? ' \u25c0 west' : t.direction === 'east' ? ' east \u25b6' : '';
       const stages =
         typeof t.stagesLeft === 'number'
-          ? ` \u00b7 ${t.stagesLeft} Stage${t.stagesLeft === 1 ? '' : 's'} still to run across this card` +
-            ' (Stages, not regions: a card is two regions of fixed distance, and how many Stages a' +
-            ' train takes over them depends on the card speed and the train)'
+          ? ` \u00b7 ${t.stagesLeft} Stage${t.stagesLeft === 1 ? '' : 's'} still to run across this card`
           : '';
-      out += `<g class="bs-train" data-tip="${esc(t.label)} \u2014 carrying ${esc(cars.join(', ') || 'no cars')}${
+      out += `<g class="bs-train${building ? ' bs-building' : ''}" data-tip="${esc(t.label)}${
+        building ? ' \u2014 BEING MADE UP NOW: add cars from the Division Yard' : ''
+      } \u2014 carrying ${esc(cars.join(', ') || 'no cars')}${
         cars.length ? ` (${loaded} loaded)` : ''
-      }${inRegion ? ` \u00b7 region ${(t.region ?? 0) + 1} of ${c.regions}${dir}` : ''}${esc(stages)}${
+      }${inRegion ? ` \u00b7 region ${(t.region ?? 0) + 1} of ${c.regions}, counted west to east${dir}` : ''}${esc(stages)}${
         // What the card prints. A train on the Mainline is exactly where "why did that leave without
         // me?" gets asked, and EXPEDITED is the answer more often than not.
         t.what ? `\n\n${esc(t.what)}` : ''
       }">` +
-        `<rect x="${tx - w / 2}" y="${c.y + 22}" width="${w}" height="19" rx="3"/>` +
-        `<text class="bs-tlab" x="${tx}" y="${c.y + 35}" text-anchor="middle">${esc(label)}</text>`;
+        `<rect x="${tx - w / 2}" y="${ty}" width="${w}" height="19" rx="3"/>` +
+        `<text class="bs-tlab" x="${tx}" y="${ty + 13}" text-anchor="middle">${esc(label)}</text>`;
       out += '</g>';
+    };
+
+    const textW = (t: NonNullable<Cell['trains']>[number]): number =>
+      (`${t.label} \u25b6${(t.cars ?? []).length || ''}`).length * 6.6 + 12;
+
+    /**
+     * TWO CHIPS TO A REGISTER ON A DISTRICT, in fixed slots — never a centre spread.
+     *
+     * Centred spreading pushes its outer chips outward as more trains arrive, which is how two chips
+     * at a Station once landed outside the cell that held them. Fixed slots cannot overflow, because
+     * the cell was sized for exactly that many (`OFFICE_W`).
+     */
+    const isDistrict = c.kind === 'run';
+    const SLOTS = 2;
+    const slotW = (c.w - 12) / SLOTS;
+    c.trains.forEach((t, k) => {
+      if (isDistrict) {
+        // Row-major within the A/D register: two across, then wrap under. A district can hold four
+        // trains and only two fit across it.
+        const col = k % SLOTS;
+        const row = Math.floor(k / SLOTS);
+        chip(t, c.x + 6 + slotW * (col + 0.5), c.y + CHIP_Y + row * 21, Math.min(slotW - 4, textW(t)));
+        return;
+      }
+      // A train on a Mainline card sits in ITS region; anywhere else it just sits on the card.
+      const inRegion = c.regions > 1 && typeof t.region === 'number';
+      const w = Math.min(c.w - 8, textW(t));
+      const tx = (inRegion ? c.x + 6 + RW * (t.region ?? 0) + RW / 2 : c.x + c.w / 2) +
+        (inRegion ? 0 : (k - (c.trains.length - 1) / 2) * (w + 4));
+      chip(t, tx, c.y + CHIP_Y, w);
     });
+
+    /**
+     * THE SECOND REGISTER, under the rail: trains in the district that hold no A/D track (Gitea#18).
+     *
+     * A crew switching below the Running Track and a train standing at an A/D track are different
+     * things — A/D occupancy is a hard capacity that causes collisions, switching is not — and the
+     * difference is drawn as POSITION rather than as a colour to learn, because below the rail is
+     * where those trains actually are.
+     */
+    (c.below ?? []).forEach((t, k) => {
+      const col = k % SLOTS;
+      const row = Math.floor(k / SLOTS);
+      chip(t, c.x + 6 + slotW * (col + 0.5), c.y + BELOW_Y + row * 21, Math.min(slotW - 4, textW(t)));
+    });
+
     out += '</g>';
   });
 
-  // THE ENDS. The route stops at both Division Points; drawing buffer stops and naming the gap is
-  // what stops a seated layout being read as a loop.
+  // THE ENDS. The route stops at both Division Points, and the buffer stops say so — a Division is
+  // a LINE, not a loop. With a single row (Gitea#18) they simply face outward at the two ends, west
+  // on the left and east on the right, which is the bug reported twice against the wrapped layout.
   const first = cells[0];
   const last = cells[cells.length - 1];
   /**
@@ -502,7 +764,17 @@ export function officeSvg(
   const c0 = Math.min(...cols);
   const c1 = Math.max(...cols);
   const width = (c1 - c0 + 1) * (W + PAD);
-  const height = (r1 - r0 + 1) * (H + PAD) + 4;
+  /**
+   * A BAND BENEATH THE BOTTOM ROW FOR THE LIMITS LABELS, and only when there are labels to put in it.
+   *
+   * The bottom card's lower edge lands at `height - 7`, and the label's baseline was `height - 4` —
+   * so its 8px glyphs spanned `height - 12` to `height - 4` and the card's own border ran straight
+   * through the middle of the word (Jesse, playtest 2026-09-16: *"the text is split by the bottom
+   * border of the limits card… it should be printed directly beneath the card"*). Raising the text
+   * instead would have pushed it onto the card, over the rails; the room has to be made below.
+   */
+  const limitBand = limits ? 14 : 0;
+  const height = (r1 - r0 + 1) * (H + PAD) + 4 + limitBand;
 
   // Screen position of a card. Rows count DOWN from the top row, so the Running Track sits highest
   // and the district hangs beneath it, as the rules describe it.
@@ -931,9 +1203,18 @@ export function officeSvg(
       // card, the old y = H-46 baseline printed the label straight along the rail itself.
       // Hover text per enhancement, from the card catalogue — an Interlocking used to be a bare word
       // on the card with nothing to say what it did, or that it does not do it yet.
+      // A SPENT dispatch device is struck through (#101). Telegraph/Telephone/Radio are "once a
+      // day", and the label said the same thing before and after the Superintendent spent one — so
+      // the card advertised a +12 that was not there. Per-`tspan` rather than per-`text` so the
+      // names still read as one row, and `?? []` because `piecePreview` builds a cell literal by
+      // hand and has no flags.
+      const spentFlags = cell.enhancementsSpent ?? [];
+      const names = cell.enhancements
+        .map((n, i) => (spentFlags[i] ? `<tspan class="bs-enh-spent">${esc(n)}</tspan>` : esc(n)))
+        .join(' · ');
       out += `<text class="bs-enh" x="6" y="26" data-tip="${esc(
         (cell.enhancementsWhat ?? []).join(' · '),
-      )}">${esc(cell.enhancements.join(' · '))}</text>`;
+      )}">${names}</text>`;
     }
     if (selectedTrain) {
       /**
@@ -978,7 +1259,17 @@ export function officeSvg(
       const tx = W / 2 - tw / 2;
       const facingWord = t.facing === 'e' ? 'east' : 'west';
       const consistWords = t.cars.length === 0 ? 'no cars' : t.cars.join(', ');
-      out += `<g class="bs-crew" data-tip="${esc(
+      /**
+       * HELD AT THE LIMITS, DRAWN RATHER THAN ONLY DESCRIBED (Jesse, 2026-09-23).
+       *
+       * The view has carried this flag since #99 and NO renderer read it, so the train drew like
+       * any other crew and nothing told a player to hover — and hovering was the only way to learn
+       * why a train had stopped short of the Office for several Stages. The tooltip text is already
+       * on `t.what`; this is the mark that sends you to it. Red, the same "stopped, and not by
+       * choice" the Red Flag means elsewhere on this map, and dashed because it is waiting.
+       */
+      const held = t.heldAtLimits === true;
+      out += `<g class="bs-crew${held ? ' bs-held' : ''}" data-tip="${esc(
         `${t.label} — engine pointing ${facingWord}, carrying ${consistWords}` + (t.what ? `\n\n${t.what}` : ''),
             )}"><rect x="${tx}" y="${RAIL - 11}" width="${tw}" height="22" rx="3"/>`;
       out += `<text class="bs-tlab" x="${tx + 4}" y="${RAIL + 4}">${esc(t.label)}</text>`;
@@ -1029,7 +1320,9 @@ export function officeSvg(
   if (limits) {
     const edge = (x: number, side: string): string =>
       `<line class="bs-limitline" x1="${x}" y1="0" x2="${x}" y2="${height}"/>` +
-      `<text class="bs-limitlab" x="${x + (side === 'w' ? 4 : -4)}" y="${height - 4}" ` +
+      // Baseline inside the band below the cards: the glyphs run from `height - 19` to `height - 11`
+      // and the bottom row's edge is at `height - 21`, so the whole word clears the card border.
+      `<text class="bs-limitlab" x="${x + (side === 'w' ? 4 : -4)}" y="${height - 11}" ` +
       `text-anchor="${side === 'w' ? 'start' : 'end'}">LIMITS</text>`;
     out += edge(px(limits.west) - PAD / 2, 'w') + edge(px(limits.east) + W + PAD / 2, 'e');
   }
@@ -1072,9 +1365,29 @@ export const BOARD_CSS = `
    and leave at the other, and a seated layout must not be read as a ring. */
 .bs-stop line{stroke:#e0a060;stroke-width:2.6;stroke-linecap:round}
 .bs-end{fill:#e0a060;font:10px ui-monospace,monospace;letter-spacing:.03em}
-/* The vertical bars a Mainline card is divided into (§2.1). Drawn faint: they are the ruler the
-   train is measured against, not something to look at instead of the train. */
-.bs-region{stroke:#4a5361;stroke-width:1.2;stroke-dasharray:3 3}
+/* A card that has just BECOME a different card (Realignment). The same amber the rest of the page
+   spends on "it is happening here", pulsing only while the step that did it is on screen — so the
+   change is seen on the map rather than only read in the log. */
+.bs-dcell.bs-changed rect{stroke:#e0a060;stroke-width:2.4;animation:bs-changed-pulse 1.1s ease-in-out infinite}
+@keyframes bs-changed-pulse{0%,100%{stroke-opacity:1}50%{stroke-opacity:.35}}
+@media (prefers-reduced-motion: reduce){.bs-dcell.bs-changed rect{animation:none}}
+/* The vertical bars a Mainline card is divided into (§2.1). They are the ruler the train is measured
+   against, not something to look at instead of the train — but they were drawn so faint they could
+   not be made out at all (Jesse, playtest 2026-09-16: "the dividing line is barely visible"). A
+   ruler you cannot read is not restraint, so this is lifted to the tie colour and given a longer
+   dash: still quieter than the rail, and now actually there. */
+.bs-region{stroke:#98a3b2;stroke-width:1.6;stroke-dasharray:4 2}
+/* #94 — the one red mark on the Division map, so it reads as a stop rather than as decoration. */
+.bs-flag line{stroke:#9aa3b0;stroke-width:1.6}
+.bs-flag polygon{fill:#d2453f;stroke:#7d211d;stroke-width:0.8}
+/* THE HEAVY GRADE WEDGE. Terrain, so it is coloured as terrain rather than as a warning.
+   SOLID BROWN, fill and border the same (Jesse, 2026-08-30) — the first pass paired a desaturated
+   fill with an amber arrow and the pair read reddish, which on a map that spends amber on "it is
+   happening here" made a fixed piece of landscape look like a live alert. One flat brown recedes
+   into scenery; the arrow is bone so the DIRECTION, which is the fact being reported, is the part
+   that carries. */
+.bs-grade{fill:#6b5334;stroke:#6b5334;stroke-width:1}
+.bs-gradeup{fill:#f2e8d5}
 .bs-slot{fill:none;stroke:#5f6b7a;stroke-width:1.1;stroke-dasharray:3 2}
 .bs-slot.bs-occ{stroke-dasharray:none;stroke-width:1.6}
 /* CAR TYPE BY COLOUR, LOAD STATE BY FILL — the SAME distinction the train tray draws, because they
@@ -1096,6 +1409,10 @@ export const BOARD_CSS = `
 .bs-slot.bs-car-cch.bs-loaded{fill:rgba(90,169,230,.85)}
 .bs-slot.bs-car-cab.bs-loaded{fill:rgba(192,90,90,.85)}
 .bs-train rect{fill:#2f6b3d;stroke:#8fd6a0;stroke-width:1.2}
+/* The train the New Train phase is loading, in the page's action amber, so the make-up panel on the
+   right and the train on the map at the top left are visibly the same subject. */
+.bs-train.bs-building rect{fill:#4a3a1c;stroke:#c8912f;stroke-width:2}
+.bs-train.bs-building .bs-tlab{fill:#f2d49a}
 .bs-crew rect{fill:#8a6d1f;stroke:#e0c060;stroke-width:1.2}
 /* Each car in the train, in the order it is seated. Loaded is solid, empty is hollow, and the
    engine is the one that carries the arrow — which is what makes "reverse" mean something. */
@@ -1142,7 +1459,10 @@ export const BOARD_CSS = `
 .bs-arrow{fill:#5f6b7a;font:10px ui-monospace,monospace}
 .bs-cn{fill:#e6e9ee;font:600 11px ui-monospace,monospace}
 .bs-coord{fill:#5f6b7a;font:9px ui-monospace,monospace}
-.bs-name{fill:#e6e9ee;font:600 11px ui-monospace,monospace}
+/* stroke:none (Gitea#24). A name takes the class \`bs-turn\` while it is that player's move, and \`.bs-turn\` is
+   also the turn ARROW's rule, which strokes its shape 2.4px grey. Declared after it, this keeps that
+   outline off the letters, which it smeared into an unreadable blur. */
+.bs-name{fill:#e6e9ee;stroke:none;font:600 11px ui-monospace,monospace}
 .bs-name.bs-you{fill:#5aa9e6}
 /* Their move — wins over .bs-you when both apply, because whose turn it is changes every few
    seconds and which railroad is yours never does.
@@ -1157,7 +1477,18 @@ export const BOARD_CSS = `
 .bs-grade{fill:#e08060;font:10px ui-monospace,monospace}
 .bs-mod{font:10px ui-monospace,monospace}
 text.bs-mod{fill:#c8a04a}
+/* A signal standing on a Mainline card carrying ABS Signals. Green is otherwise unused on the
+   Division row apart from the Division Point's dashed border, so a lit lamp does not compete with
+   the amber "it is happening here" or the red flag for meaning. */
+/* A train the Interlocking is holding on the Limit Track. Red, matching the Red Flag's "stopped and
+   not by choice"; dashed, because it is waiting rather than parked. */
+.bs-crew.bs-held rect{fill:#2c1d1d;stroke:#d2453f;stroke-width:1.6;stroke-dasharray:4 2}
+.bs-crew.bs-held .bs-tlab{fill:#f0c2be}
+.bs-abs-mast{stroke:#9aa3b0;stroke-width:1.6}
+.bs-abs-lit{fill:#4fae6a;stroke:#2c6b40;stroke-width:0.8}
+.bs-abs-dark{fill:#2a3038;stroke:#59626f;stroke-width:0.8}
 .bs-enh{fill:#7fb0e6;font:9px ui-monospace,monospace}
+.bs-enh-spent{fill:#5b6b7d;text-decoration:line-through}
 .bs-rowlab{fill:#5f6b7a;font:600 9px ui-monospace,monospace;letter-spacing:.1em}
 /* THE EDGE OF THE DISTRICT. Deliberately quiet — it is a boundary, not an action — and dashed, so it
    reads as a line on the table rather than as rail. Nothing is laid outside it (§2.1). */

src/sim/bot.ts

@@ -22,6 +22,9 @@
 import {
   applyIntent,
   areaOf,
+  extendLimitsIfNeeded,
+  isLockedOut,
+  protoCard,
   canAdvanceLoad,
   destinationsFor,
   facilityCarTypes,
@@ -29,14 +32,15 @@ import {
   ownCutFor,
 } from '../engine/apply.ts';
 import { MAX_CONSIST, nextOfficeTier, officeProfile } from '../engine/content.ts';
-import type { CarType, Hand, TrackGeometry } from '../engine/content.ts';
+import type { CarType, FreightKind, Hand, TrackGeometry } from '../engine/content.ts';
 import type { GameEvent } from '../engine/events.ts';
 import type { Intent } from '../engine/intents.ts';
 import { legalActions } from '../engine/legal.ts';
-import { connectionsFor, exitsFrom, facilityVariants, hasPort, joins, neighbour, opposite, variantsFor } from '../engine/track.ts';
+import { canPlaceAt, connectionsFor, exitsFrom, facilityVariants, hasPort, joins, neighbour, opposite, variantsFor } from '../engine/track.ts';
 import type { Port } from '../engine/track.ts';
-import { coordKey, turnOf } from '../engine/state.ts';
+import { actingPlayer, coordKey, turnOf } from '../engine/state.ts';
 import type { Facility, GameState, GridCoord, OfficeArea, PlayerIndex, RollingStock, TrackCard } from '../engine/state.ts';
+import { planSwitchingTurn, switchFingerprint } from './switch-planner.ts';
 
 export type BotPolicy = {
   name: string;
@@ -106,7 +110,8 @@ function because(reason: string, intent: Intent): Intent {
  * Every flag here turns something OFF. That is the opposite of how this started — the tweaks were
  * candidates to switch on — and it is the right shape once a candidate has been adopted: what a
  * measured heuristic needs afterwards is a way to ask "is this still worth it?" when the deck or
- * the rules move under it. Both of these were worth about +1.5 revenue together when adopted; if a
+ * the rules move under it. The first two were worth about +1.5 revenue together when adopted, and
+ * planning the switching turn (`noPlanSwitching`) +2.89 on its own; if a
  * rebalance changes the economy, that is a claim to re-test rather than to assume.
  *
  * The candidates that did NOT survive are gone rather than left switched off: preferring coaches at
@@ -121,9 +126,78 @@ export type BotTweaks = {
   noTrainCap?: boolean;
   /** Draw whenever nothing is urgent, as the bot did before it preferred operating. */
   noOperateFirst?: boolean;
-
+  /**
+   * Choose switching Moves one at a time from the rule ladder, as the bot did before it planned the
+   * whole turn (`switch-planner.ts`). Measured at adoption, 2026-09-14: planning was worth
+   * +2.89 ± 0.18 revenue a game (t = 15.79) over 1600 paired seeds, 733 better against 21 worse.
+   */
+  noPlanSwitching?: boolean;
+  /**
+   * Take a face-up train or industry card whether or not it could be played, as the bot did before
+   * 2026-09-14. It then took 20.1 trains and 11.9 industries a game off the Departments and discarded
+   * 20.2 and 11.8, retaking the same card 28.8 times a game. Asking first measured +1.52 ± 0.10
+   * (t = 15.59) over 1600 paired seeds — this ablation was worse on 880 of them and better on 211.
+   */
+  noPlayableTakes?: boolean;
+  /**
+   * Choose where track goes by `bestTrackLay`'s piece rules and the fallback's first legal square, as the
+   * bot did before 2026-09-15, instead of by what the district can DO afterwards (`bestValuedLay`).
+   * Scoring the layout measured +0.118 ± 0.029 (t = 4.14) over 6400 paired seeds, and closed run-arounds
+   * in 22 of 60 districts against 9.
+   */
+  noValueLays?: boolean;
+  /**
+   * Let the New Train phase's fallback take `options[0]`, as the bot did before 2026-09-15. Because
+   * `legalActions` lists `newTrain.secondSection` ahead of the Extra starts, all 26 Second Sections the
+   * bot ran in 60 games were that accident, and 6 of the 20 collisions followed one. Taking a car, a pass
+   * or the Extra's start instead measured +0.32 ± 0.09 (t = 3.64) over 400 paired seeds.
+   */
+  noDeliberateNewTrain?: boolean;
 };
 
+/**
+ * A switching turn planned once and then played a step per decision.
+ *
+ * Keyed by the tweaks object, because that is what one policy owns — the server shares a single
+ * `developerBot` across every bot seat, so the plan inside it is kept per player. Each step is
+ * submitted only while the position still matches the fingerprint the plan expected there; anything
+ * else replans. A switching turn has no randomness, so in practice a plan is made once a turn.
+ */
+type ActivePlan = { steps: Intent[]; keys: string[]; next: number; summary: string };
+const activePlans = new WeakMap<BotTweaks, Map<PlayerIndex, ActivePlan>>();
+
+function plannedSwitch(s: GameState, player: PlayerIndex, options: Intent[], tweaks: BotTweaks): Intent | null {
+  let mine = activePlans.get(tweaks);
+  if (!mine) activePlans.set(tweaks, (mine = new Map()));
+  const here = switchFingerprint(s, player);
+  let active = mine.get(player);
+  if (!active || active.keys[active.next] !== here) {
+    const p = planSwitchingTurn(s, player);
+    active = {
+      steps: p.steps,
+      keys: p.keys,
+      next: 0,
+      summary:
+        `position ${p.rootScore.toFixed(2)} → ${p.score.toFixed(2)} over ${p.expanded} positions` +
+        (p.complete ? '' : ', search budget reached'),
+    };
+    mine.set(player, active);
+  }
+  if (active.next >= active.steps.length) {
+    mine.delete(player);
+    const end = options.find((i) => i.type === 'switch.end');
+    return end ? because(`planned switching turn complete — ${active.summary}`, end) : null;
+  }
+  const want = JSON.stringify(active.steps[active.next]);
+  const match = options.find((i) => JSON.stringify(i) === want);
+  if (!match) {
+    mine.delete(player);
+    return null;
+  }
+  active.next++;
+  return because(`step ${active.next} of ${active.steps.length} of a planned switching turn — ${active.summary}`, match);
+}
+
 /** The bot as it plays today. Every knob off. */
 export const developerBot: BotPolicy = makeDeveloperBot({});
 
@@ -138,13 +212,39 @@ export function makeDeveloperBot(tweaks: BotTweaks): BotPolicy {
 
   choose(s, player, options) {
     lastReason = 'no specific reason — first legal option';
+
+    /**
+     * §3.3, EXTENDED PLAY (Gitea#11) — a bot never asks for another Day.
+     *
+     * "If only bots are playing, they never vote to extend" (Jesse, 2026-08-28), which is what keeps
+     * the balance harness and every bot-only game ending at the timetable it was dealt with. It also
+     * makes this the SAFE DEFAULT everywhere else: a bot's agreement in a game with humans in it is
+     * decided by `server/session.ts`, which votes on the bots' behalf only once every human has
+     * already said yes, and never reaches this policy at all.
+     */
+    const extend = options.find((i) => i.type === 'game.extend' && i.agree === false);
+    if (extend) return because('a bot plays the timetable it was dealt and no more', extend);
+
     const clearance = ruleOnClearance(options);
-    if (clearance) return because('the Superintendent must rule on a following train (§8.1)', clearance);
+    if (clearance) return because('the Superintendent must rule on a following train', clearance);
+
+    /**
+     * §11 (Gitea#5) — the bot keeps its trains at the Train Order Office.
+     *
+     * A deliberate policy, not an oversight, and the cautious half of a real choice: the Yard Office
+     * frees an A/D track, which is worth something on a busy district, but the lead into it may be
+     * fouled and the bot does not read its own yard well enough to tell (`TODO.md`, Bot
+     * Performance — it cannot spot a car at a stub industry either). Declining is always safe, and
+     * it keeps the balance harness comparable with every measurement taken before this rule existed.
+     * Worth revisiting when the bot can judge the lead.
+     */
+    const yardOffice = options.find((i) => i.type === 'mainline.yardOffice' && i.take === false);
+    if (yardOffice) return because('the bot does not judge the lead into a yard, so it stays at the Office', yardOffice);
 
     // Red Flags come before anything else — protection is only worth playing at the moment the
     // collision is actually pending, and that moment passes.
     const flags = worthFlagging(s, options);
-    if (flags) return because('a train of ours is stopped on a Mainline card with another train on it — Red Flags now or not at all', flags);
+    if (flags) return because('the engine says this arrival collides, and we hold a Red Flag — now or never', flags);
 
     // --- Load/Unload: spend every worker, then end. Each is a point, or a step toward one.
     //
@@ -183,6 +283,13 @@ export function makeDeveloperBot(tweaks: BotTweaks): BotPolicy {
         );
         if (match) return because(`the ${w.loaded ? 'loaded' : 'empty'} ${w.type} is what a facility is short of`, match);
       }
+      if (!tweaks.noDeliberateNewTrain) {
+        const move =
+          pickFirst(options, 'newTrain.placeCar', 'newTrain.passCar', 'newTrain.startExtra') ??
+          options.find((i) => i.type !== 'newTrain.secondSection' && i.type !== 'maneuver.redFlags') ??
+          options[0]!;
+        return because('no car on offer is one our facilities need', move);
+      }
       return because('no car on offer is one our facilities need', pickFirst(options, 'newTrain.placeCar', 'newTrain.passCar') ?? options[0]!);
     }
 
@@ -412,7 +519,7 @@ function topOfDepartment(s: GameState, slot: number): string | undefined {
  * In a competitive game the same call reads the other way round — burying a card a rival wants is an
  * attack — which is why the choice belongs to the discarding player and not to the rules.
  */
-function bestDiscard(s: GameState, player: PlayerIndex, options: Intent[]): Intent | null {
+function bestDiscard(s: GameState, player: PlayerIndex, options: Intent[], tweaks: BotTweaks): Intent | null {
   let best: Intent | null = null;
   let bestScore = -Infinity;
   for (const i of options) {
@@ -422,7 +529,7 @@ function bestDiscard(s: GameState, player: PlayerIndex, options: Intent[]): Inte
     // two showing whatever they happened to start with. Measured over 100 games — spreading 2.87
     // revenue, concentrating on the deepest 2.67, indifferent 2.67.
     const top = topOfDepartment(s, i.toSlot);
-    const wanted = isWorthTaking(s, player, i.toSlot);
+    const wanted = isWorthTaking(s, player, i.toSlot, tweaks);
     const depth = s.decks.departments[i.toSlot]?.length ?? 0;
     const score = (top === undefined ? 6 : wanted ? -10 : 2) - Math.min(depth, 4) * 0.5;
     if (score > bestScore) {
@@ -434,10 +541,39 @@ function bestDiscard(s: GameState, player: PlayerIndex, options: Intent[]): Inte
 }
 
 /** A face-up card worth spending the draw on rather than gambling on the deck. */
-function isWorthTaking(s: GameState, player: PlayerIndex, slot: number): boolean {
-  return takingRank(s, player, slot) > 0;
+function isWorthTaking(s: GameState, player: PlayerIndex, slot: number, tweaks: BotTweaks): boolean {
+  return takingRank(s, player, slot, tweaks) > 0;
 }
 
+/**
+ * Could an industry of this kind be laid anywhere right now? Asked of the engine's own placement
+ * rule (`canPlaceAt`) and lockout (`isLockedOut`) rather than a copy: an industry is plain east-west
+ * track, so the only squares worth asking about are empty ones east or west of a card already down.
+ */
+function industrySiteExists(s: GameState, player: PlayerIndex, kind: FreightKind): boolean {
+  const area = areaOf(s, player);
+  if (isLockedOut(area, kind)) return false;
+  const probe = {
+    geometry: { kind: 'facility', facility: kind },
+    baseOperationalRail: true,
+    standing: [],
+    standingWest: 0,
+    facility: null,
+    modifiers: [],
+    enhancements: [],
+  } as unknown as TrackCard;
+  for (const key of area.grid.keys()) {
+    const [row, col] = key.split(',').map(Number);
+    for (const dc of [1, -1]) {
+      const at = { row: row!, col: col! + dc };
+      if (at.row === area.runningRow || area.grid.has(coordKey(at))) continue;
+      if (canPlaceAt(area, at, probe)) return true;
+    }
+  }
+  return false;
+}
+
+
 /**
  * HOW BADLY the face-up card is wanted. 0 means not worth the draw.
  *
@@ -445,14 +581,18 @@ function isWorthTaking(s: GameState, player: PlayerIndex, slot: number): boolean
  * happened to be scanned first — a coin flip on the card that decides whether the district ever
  * becomes a Passenger Facility at all.
  */
-function takingRank(s: GameState, player: PlayerIndex, slot: number): number {
+function takingRank(s: GameState, player: PlayerIndex, slot: number, tweaks: BotTweaks): number {
   const id = topOfDepartment(s, slot);
   if (!id) return 0;
   const k = s.cards.get(id)?.kind;
   if (!k) return 0;
   if (k.kind === 'office') return nextOfficeTier(areaOf(s, player).tier) === k.tier ? 3 : 0;
-  if (k.kind === 'timetabledTrain' || k.kind === 'extraTrain') return 2;
-  if (k.kind === 'freightFacility') return 1;
+  if (k.kind === 'timetabledTrain' || k.kind === 'extraTrain') {
+    return !tweaks.noPlayableTakes && trainWouldOverfillTheOffice(s, player, tweaks) ? 0 : 2;
+  }
+  if (k.kind === 'freightFacility') {
+    return !tweaks.noPlayableTakes && !industrySiteExists(s, player, k.facility) ? 0 : 1;
+  }
   return 0;
 }
 
@@ -715,6 +855,104 @@ function bestFacilityPlay(s: GameState, player: PlayerIndex, options: Intent[]):
   return best;
 }
 
+/**
+ * WHAT A DISTRICT'S TRACK IS WORTH FOR WHAT IT LETS HAPPEN NEXT — the default since 2026-09-15;
+ * `noValueLays` turns it off.
+ *
+ * `bestTrackLay` scores the PIECE — its shape and where it sits — and cannot tell one that opens an
+ * industry site or closes a run-around from one that merely fills a square. This scores the LAYOUT the
+ * piece would leave, so a lay is worth the difference it makes. Every term is something the rules turn
+ * into play: a site is somewhere a held industry can go; a run-around lets a crew pass its own cars
+ * (§A.5); a way off the main is the only road to either; a Running Track straight is what Interlocking
+ * needs. The weights are a starting point to measure, not a result.
+ */
+function layoutValue(area: OfficeArea): number {
+  let v = 0;
+  const reachable = reachableOffMain(area);
+  v += Math.min(reachable.size, 12) * 0.2;
+
+  let ways = 0;
+  let loops = 0;
+  for (const side of SIDES) {
+    for (const col of waysOff(area, side)) {
+      ways++;
+      if (descendFrom(area, col, side).rejoins.size > 0) loops++;
+    }
+  }
+  v += [0, 1.5, 2, 2.5][Math.min(ways, 3)]!;
+  if (loops > 0) v += 6 + Math.min(loops - 1, 1) * 2;
+
+  // Squares an industry could legally be laid on, joined to track a crew can reach.
+  const probe = protoCard({ kind: 'freightFacility', facility: 'mineTipple' }, 0)!;
+  const tried = new Set<string>();
+  let sites = 0;
+  for (const key of reachable) {
+    const [row, col] = key.split(',').map(Number);
+    for (const dc of [1, -1]) {
+      const at = { row: row!, col: col! + dc };
+      const k = coordKey(at);
+      if (tried.has(k) || area.grid.has(k) || at.row === area.runningRow) continue;
+      tried.add(k);
+      if (canPlaceAt(area, at, probe)) sites++;
+    }
+  }
+  v += [0, 2, 3, 3.5][Math.min(sites, 3)]!;
+
+  let mainStraight = false;
+  for (const [key, card] of area.grid) {
+    if (Number(key.split(',')[0]) !== area.runningRow || card.geometry.kind !== 'track') continue;
+    if (card.geometry.geometry === 'straight') mainStraight = true;
+    // A turnout on the main whose leg joins nothing is a hole in the Running Track with no road behind it.
+    if (card.geometry.geometry === 'turnout') {
+      const col = Number(key.split(',')[1]);
+      for (const side of SIDES) {
+        if (!hasPort(card, legPort(side))) continue;
+        const beyond = area.grid.get(`${area.runningRow + side},${col}`);
+        if (!beyond || !joins(card, legPort(side), beyond)) v -= 0.5;
+      }
+    }
+  }
+  if (mainStraight) v += 1.5;
+  return v;
+}
+
+/**
+ * The track lay worth most by `layoutValue`, placed on a copy of the district exactly as the reducer
+ * places it (`protoCard`, `extendLimitsIfNeeded`). With `mustBuild`, only a lay that gains something is
+ * offered, which is the slot `bestTrackLay` fills; without it, the best of whatever is legal, which is
+ * the slot the "play what is in hand" fallback fills. Ties go to the square nearer the Office.
+ */
+function bestValuedLay(s: GameState, player: PlayerIndex, options: Intent[], mustBuild: boolean): Intent | null {
+  const area = areaOf(s, player);
+  const base = layoutValue(area);
+  let best: Intent | null = null;
+  let bestScore = -Infinity;
+  for (const i of options) {
+    if (i.type !== 'card.play' || i.placement === undefined) continue;
+    const kind = s.cards.get(i.cardId)?.kind;
+    if (kind?.kind !== 'track') continue;
+    const built = protoCard(kind, i.variant);
+    if (!built) continue;
+    const after: OfficeArea = {
+      ...area,
+      grid: new Map(area.grid),
+      limitsWest: { ...area.limitsWest },
+      limitsEast: { ...area.limitsEast },
+    };
+    after.grid.set(coordKey(i.placement), built);
+    extendLimitsIfNeeded(after, i.placement);
+    const gain = layoutValue(after) - base;
+    if (mustBuild && gain <= 0.1) continue;
+    const distance = Math.abs(i.placement.row - area.officeCoord.row) * 2 + Math.abs(i.placement.col - area.officeCoord.col);
+    const score = gain - distance * 0.01;
+    if (score > bestScore) {
+      bestScore = score;
+      best = i;
+    }
+  }
+  return best;
+}
+
 function bestTrackLay(s: GameState, player: PlayerIndex, options: Intent[]): Intent | null {
   const area = areaOf(s, player);
 
@@ -1017,19 +1255,20 @@ function facilityWantsAt(
 }
 
 /**
- * Red Flags — "any time". Worth spending only when a train of ours is stopped out on the Mainline
- * with another train on the same card, which is the situation that becomes a rear-ender.
+ * §Q, RED FLAGS (Gitea#19) — spent only at the moment of danger.
+ *
+ * The card was redefined: it plants a directional flag on your own Limits rather than protecting a
+ * stopped train out on the Mainline, so the old heuristic ("is a train of ours sharing a Mainline
+ * card") no longer describes anything the card does.
+ *
+ * The bot now flags ONLY through the out-of-phase prompt, which the engine raises exactly when an
+ * arrival would collide (`redFlagStop`). That is a better policy than the old one and a much
+ * simpler one: the engine has already established the danger, so there is nothing for the bot to
+ * judge. It never plants a flag speculatively — it cannot tell whether it wants time to switch, and
+ * a flag spent early is a flag not there when a train is actually bearing down.
  */
-function worthFlagging(s: GameState, options: Intent[]): Intent | null {
-  for (const i of options) {
-    if (i.type !== 'maneuver.redFlags') continue;
-    const tray = s.trays.get(i.trayId);
-    if (!tray || tray.position.at !== 'mainline') continue;
-    const node = s.division.nodes[tray.position.index];
-    if (node?.kind !== 'mainline') continue;
-    if (node.transits.length > 1) return i;
-  }
-  return null;
+function worthFlagging(_s: GameState, options: Intent[]): Intent | null {
+  return options.find((i) => i.type === 'mainline.redFlag' && i.flag === true) ?? null;
 }
 
 /** A one-line account of which Load/Unload action was taken, and why it ranked first. */
@@ -1186,7 +1425,7 @@ function followThrough(
       if (!turnOf(s, player).drawnThisTurn) {
         const piles = options.filter(
           (i): i is Extract<Intent, { type: 'draw.fromDepartment' }> =>
-            i.type === 'draw.fromDepartment' && isWorthTaking(s, player, i.slot),
+            i.type === 'draw.fromDepartment' && isWorthTaking(s, player, i.slot, tweaks),
         );
         // Best-ranked pile rather than the first that qualifies: an Office card and a train card
         // both "qualify", and only one of them stops the collisions.
@@ -1194,7 +1433,7 @@ function followThrough(
         // and a train card are face up together 1.6 decisions a game — but ranking them is what the
         // ranking function is for, and a coin flip on the card that decides whether the district
         // ever becomes a Passenger Facility is not worth keeping for its own sake.
-        const useful = piles.sort((a, b) => takingRank(s, player, b.slot) - takingRank(s, player, a.slot))[0];
+        const useful = piles.sort((a, b) => takingRank(s, player, b.slot, tweaks) - takingRank(s, player, a.slot, tweaks))[0];
         if (useful) return because('a face-up card is worth more than a blind draw right now', useful);
         const blind = options.find((i) => i.type === 'draw.fromHomeOffice');
         if (blind) return because('no face-up card is worth taking — gamble on the deck', blind);
@@ -1255,7 +1494,7 @@ function followThrough(
       // STRAIGHTS that Enhancements require, and no Freight Facility has anywhere to go until a
       // district exists. Measured with track absent, the hand held a playable Enhancement on 4,778
       // turns and could legally place one on 33.
-      const track = bestTrackLay(s, player, options);
+      const track = !tweaks.noValueLays ? bestValuedLay(s, player, options, true) : bestTrackLay(s, player, options);
       if (track) return because('lay track — nothing else creates the straights Enhancements need or the spurs freight needs', track);
 
       // Then real development: a card actually laid into the grid. Freight facilities are scored —
@@ -1280,17 +1519,27 @@ function followThrough(
           s.cards.get(i.cardId)?.kind.kind !== 'track',
       );
       if (placed) return because('develop the district with a card that goes on the board', placed);
-      const play = options.find((i) => i.type === 'card.play');
+      const play = !tweaks.noValueLays
+        ? options.find((i) => i.type === 'card.play' && s.cards.get(i.cardId)?.kind.kind !== 'track') ??
+          bestValuedLay(s, player, options, false)
+        : options.find((i) => i.type === 'card.play');
       if (play) return because('play what is in hand', play);
       const end = options.find((i) => i.type === 'draw.end');
       if (end) return because('nothing in hand can be played anywhere legal', end);
       return because(
         'nothing playable — discard onto the Department whose face-up card is least worth keeping reachable',
-        bestDiscard(s, player, options) ?? pickFirst(options, 'card.discard') ?? options[0]!,
+        bestDiscard(s, player, options, tweaks) ?? pickFirst(options, 'card.discard') ?? options[0]!,
       );
     }
 
     case 'switch': {
+      // The planner decides the whole turn; the rules below are its fallback if the position is ever
+      // not the one it planned for, and the whole of switching under `noPlanSwitching`.
+      if (!tweaks.noPlanSwitching) {
+        const planned = plannedSwitch(s, player, options, tweaks);
+        if (planned) return planned;
+      }
+
       /**
        * A MOVE THAT DRAGS THE CREW'S OWN CUT BACK ON IS A WASTED MOVE, so take those off the table
        * before any heuristic gets to choose one.
@@ -1861,8 +2110,37 @@ export function playGame(
     tally(pumpFn(s));
     if (s.status === 'finished') break;
 
-    const actor =
-      s.clock.pendingDecision !== null ? s.clock.superintendent : s.clock.currentActor;
+    /**
+     * §3.3, EXTENDED PLAY (Gitea#11) — a simulated game plays the timetable it was dealt.
+     *
+     * DECIDED BY THE DRIVER, not by the policy, and that distinction is the whole point. A bot that
+     * is merely handed the two votes among its legal options will sometimes take another Day —
+     * `randomBot` does so half the time — and since the table can go on granting Days for ever, the
+     * game then runs until `maxTurns`. That is not a hypothetical: it turned `test/sim.test.ts` from
+     * under a second into an unbounded hang, because every seeded game in the harness suddenly played
+     * fifty thousand turns instead of two hundred.
+     *
+     * The harness exists to measure games of a configured length against a configured floor, so
+     * "would you like more Days?" has one answer here whatever the policy. `developerBot` declines on
+     * its own account too, which is what the server relies on when a table is all bots; this is the
+     * guarantee that holds for every OTHER policy, including ones not written yet.
+     */
+    if (s.status === 'awaitingExtension') {
+      const voter = s.extensionVotes.findIndex((v) => v === null);
+      if (voter < 0) break;
+      const decline: Intent = { type: 'game.extend', player: voter, agree: false };
+      intents.push(decline.type);
+      history.push(decline);
+      const declined = applyIntent(s, voter, decline);
+      // A broken invariant, not a game ending early: the status says a vote is pending and `voter` is
+      // a seat that has not cast one. Thrown rather than broken out of, matching the illegal-action
+      // check below — silently returning a short game is how a dead replay looks like a real one.
+      if (!declined.ok) throw new Error(`the extension vote was refused with ${declined.code}`);
+      tally(declined.events);
+      continue;
+    }
+
+    const actor = actingPlayer(s);
     if (actor === null) break;
 
     const options = legalActions(s, actor);

src/sim/compare.ts

@@ -23,6 +23,7 @@
  * Run with:
  *   node src/sim/compare.ts 1600 noTrainCap=1        — what the A/D cap is worth today
  *   node src/sim/compare.ts 1600 noOperateFirst=1    — what operating before drawing is worth
+ *   node src/sim/compare.ts 1600 noPlanSwitching=1   — what planning the switching turn is worth
  *
  * The flags are ABLATIONS: they turn off heuristics the bot already plays, so a negative delta is
  * the heuristic earning its place. That is what a measured bot needs going forward — the question
@@ -221,7 +222,7 @@ export function formatPaired(r: PairedResult): string {
  * against itself and report a confident zero, which is the most expensive way this tool could fail.
  */
 export const NUMERIC_TWEAKS = new Set<string>([]);
-export const BOOLEAN_TWEAKS = new Set(['noTrainCap', 'noOperateFirst']);
+export const BOOLEAN_TWEAKS = new Set(['noTrainCap', 'noOperateFirst', 'noPlanSwitching', 'noPlayableTakes', 'noValueLays', 'noDeliberateNewTrain']);
 
 export function parseTweaks(args: string[]): BotTweaks {
   const tweaks: Record<string, number | boolean> = {};

src/sim/display-step.ts

@@ -0,0 +1,134 @@
+/**
+ * THE DISPLAY-STEP COLLECTOR — v0.8.0, `docs/plans/jitsi-common-board.md` § v0.8.0 §§ 1-3.
+ *
+ * One ordered, watchable presentation step per accepted intent, so a player can see what everyone
+ * else did instead of finding the board already rearranged. TODO #13: *"It's not fun to do my turn
+ * and have magic happen in the background and then have to figure out what others did."*
+ *
+ * ONE HOOK, NOT TWO. The design anticipated wiring this into `GameSession.intent()` and
+ * `GameSession.driveBots()` separately, with `LocalSession` doing its own thing for solitaire. It
+ * does not need to: `src/server/session.ts` imports `submit` from `src/web/game.ts`, so solitaire,
+ * live multiplayer and every bot turn already funnel through ONE function. Collecting there is what
+ * makes solitaire a special case of multiplayer rather than a second implementation, which is the
+ * standing design direction for this codebase.
+ *
+ * AND REPLAY IS INERT FOR FREE. `fromSave` and `fromMultiplayerSave` rebuild a game by calling
+ * `applyIntent` + `record` + `drain` directly rather than `submit`, so a resumed server or a rebuilt
+ * undo does NOT re-emit the whole game as steps. That was expected to need an explicit guard — the
+ * plan calls it out as the same class of bug as #97, a mechanism firing on a path nobody pictured
+ * it running on. It needs none, but the property is load-bearing: **if a replay path is ever moved
+ * onto `submit()`, this becomes a real bug**, and `test/watchable.test.ts` pins it.
+ *
+ * WHAT A STEP IS. One accepted intent, or ONE AUTOMATIC PHASE — never one per `GameEvent`, because
+ * the event list is not a complete reducer and a receiver could not rebuild state from it. It gets a
+ * projected frame instead.
+ *
+ * PHASES EARN THEIR OWN STEPS, and that is TODO #18. `pump()` runs every automatic phase between one
+ * click and the next and `drain()` records the whole batch at once, so New Train, the Mainline and
+ * the shift change "look like they are being skipped entirely" — trains cross the Division in one
+ * jump. Folding them into the triggering intent's step reproduces exactly that. So `submit()` steps
+ * `advance()` one call at a time instead, and collects a step for each phase that actually DID
+ * something. A phase that did nothing adds no narration and therefore produces no step at all, which
+ * is Jesse's own rule (2026-09-09): "if nothing happens during a phase then we shouldn't lose time
+ * to it."
+ *
+ * `drain()` is deliberately NOT changed. Replay, undo and `fromSave` all use it, and the
+ * replay-inertness property below depends on their staying off this path. The stepped version lives
+ * in `submit()` and makes the same `advance()` calls in the same order, so the resulting state is
+ * identical — only the collection differs.
+ */
+
+import type { Intent } from '../engine/intents.ts';
+import type { GameState, PlayerIndex, SeatIndex } from '../engine/state.ts';
+import { seatOf } from '../engine/state.ts';
+import { publicSnapshot } from './view.ts';
+import type { PublicFrame } from './view.ts';
+import { deltaPublicFrame } from './public-delta.ts';
+import type { PublicFrameDelta } from './public-delta.ts';
+
+/**
+ * The wire format's version, on the ENVELOPE rather than on the projection.
+ *
+ * The plan's original sketch put `protocolVersion` inside `PublicFrame`. It does not belong there:
+ * `PublicFrame` is a projection of the game and its property list is an allow-list that
+ * `test/redaction.test.ts` enumerates, so a transport concern living in it would have to be
+ * allow-listed as public game state, which it is not. The step is the message; the message carries
+ * the version.
+ */
+export const DISPLAY_PROTOCOL_VERSION = 1;
+
+/** What produced a step: somebody's intent, or the Division advancing a phase by itself. */
+export type StepCause = Intent['type'] | 'phase';
+
+/** One watchable thing that happened, in order. */
+export type DisplayStep = {
+  protocolVersion: typeof DISPLAY_PROTOCOL_VERSION;
+  /** Monotonic per game. 0.8.1's reconnecting display stream needs it to detect a gap; a queue only needs the order. */
+  seq: number;
+  /**
+   * Who acted — NULL for an automatic phase, which nobody did.
+   *
+   * Both are carried because Employee Rotation makes "which seat" and "which player" different
+   * questions.
+   */
+  player: PlayerIndex | null;
+  seat: SeatIndex | null;
+  /** What caused it — the input to pacing's kind classification. */
+  cause: StepCause;
+  /** The public board after this intent and everything it drained, against the previous step. */
+  frame: PublicFrameDelta;
+  /** The narration this intent added, in order, including any phase lines drained behind it. */
+  lines: { text: string; tone: string }[];
+};
+
+/**
+ * Per-game collector state.
+ *
+ * Held on `Game` beside `log`, `cues` and `announced` and drained the same way, which is the
+ * established convention in this codebase for "the model accumulated something, the view takes it".
+ */
+export type DisplayCollector = {
+  /** Undrained steps, oldest first. */
+  steps: DisplayStep[];
+  /** The last public frame a step was built against, so the next delta has something to diff. */
+  last: PublicFrame | null;
+  /** Next sequence number to assign. */
+  seq: number;
+};
+
+export function newCollector(): DisplayCollector {
+  return { steps: [], last: null, seq: 0 };
+}
+
+/**
+ * Record one accepted intent as a step.
+ *
+ * Called from `submit()` AFTER `record()` and `drain()`, so `state` is the position the intent
+ * finally produced and `lines` is everything it caused to be said. The frame is projected
+ * immediately and never from a retained `GameState` reference — a retained reference would resolve
+ * to the FINAL state of a whole bot run, which is exactly the teleporting this exists to prevent.
+ */
+export function collectStep(
+  collector: DisplayCollector,
+  state: GameState,
+  player: PlayerIndex | null,
+  cause: StepCause,
+  lines: { text: string; tone: string }[],
+): void {
+  const next = publicSnapshot(state);
+  collector.steps.push({
+    protocolVersion: DISPLAY_PROTOCOL_VERSION,
+    seq: collector.seq++,
+    player,
+    seat: player === null ? null : seatOf(state, player),
+    cause,
+    frame: deltaPublicFrame(collector.last, next),
+    lines,
+  });
+  collector.last = next;
+}
+
+/** Take everything collected so far, leaving the collector empty — `takeMoment()`'s pattern. */
+export function takeSteps(collector: DisplayCollector): DisplayStep[] {
+  return collector.steps.splice(0, collector.steps.length);
+}

src/sim/narrate.ts

@@ -15,11 +15,13 @@
  * panel cannot drift from the rules.
  */
 
-import { MAX_CONSIST } from '../engine/content.ts';
+import { MAINLINE_PROFILES, MAX_CONSIST, crewTrayCount } from '../engine/content.ts';
 import { adTrackCount, coordKey, seatOf, turnOf } from '../engine/state.ts';
-import type { GameState, GridCoord, PlayerIndex, RollingStock, TrayId } from '../engine/state.ts';
-import { areaOf, canAdvanceLoad, canStartLoad, facilityCarType, facilityCarTypes, laborersLeft, movesFor, portersLeft } from '../engine/apply.ts';
+import type { GameState, GridCoord, PlayerIndex, RollingStock, SeatIndex, TrayId } from '../engine/state.ts';
+import { areaOf, canAdvanceLoad, canBoard, canDetrain, canStartLoad, facilityCarType, facilityCarTypes, freightRuleSpentHere, isFreight, laborersLeft, movesFor, passengerRefusal, portersLeft } from '../engine/apply.ts';
 import type { GameEvent } from '../engine/events.ts';
+import { badlyMadeUp } from '../engine/advance.ts';
+import type { CrewTray } from '../engine/state.ts';
 
 // ---------------------------------------------------------------------------
 // Small formatters
@@ -34,11 +36,37 @@ export function clockTime(stage: number): string {
   return CLOCK[stage - 1] ?? `Stage ${stage}`;
 }
 
-export function carLabel(c: RollingStock): string {
+/**
+ * `homeSeat` is the district the page is being drawn for. Give it, and a load THIS district made
+ * says so — the printed game's answer is to turn the chip upside down in the tray, and this is the
+ * screen's. A load may not be broken in the Office Area that made it (state.ts `RollingStock.origin`),
+ * so "loaded here" is the difference between a boxcar worth switching and one that has to leave the
+ * district first. Omit it and the label is what it always was, which is what the replay viewers and
+ * the history lines want: they describe a board, not a seat's view of one.
+ */
+export function carLabel(c: RollingStock, homeSeat?: SeatIndex): string {
   // A caboose carries the crew, not freight, so "loaded caboose" is nonsense on the page even
   // though the supply marks every caboose loaded. Name it plainly.
   if (c.type === 'caboose') return 'caboose';
-  return `${c.loaded ? 'loaded' : 'empty'} ${c.type}`;
+  const label = `${c.loaded ? 'loaded' : 'empty'} ${c.type}`;
+  return homeSeat !== undefined && c.origin === homeSeat ? `${label} (loaded here)` : label;
+}
+
+/**
+ * "a loaded boxcar", "an empty tank" — the article the word actually takes.
+ *
+ * The make-up line hard-coded "a" and produced "a empty tank" at the table. Vowel-initial is the
+ * whole rule here: every car word is ordinary English ('empty', 'loaded', and the car types), so
+ * there is no 'an hour' case to special-case and inventing one would be the more fragile choice.
+ */
+export function indefinite(label: string): string {
+  return `${/^[aeiou]/i.test(label) ? 'an' : 'a'} ${label}`;
+}
+
+/** "Train 10" / "Extra X18" — one spelling of a train's name for every line that mentions one. */
+export function trainLabel(trainNumber: number | null, isExtra: boolean): string {
+  if (trainNumber === null) return 'the local crew';
+  return isExtra ? `Extra X${trainNumber}` : `Train ${trainNumber}`;
 }
 
 export function carsLabel(cars: RollingStock[]): string {
@@ -46,7 +74,16 @@ export function carsLabel(cars: RollingStock[]): string {
   return cars.map(carLabel).join(', ');
 }
 
-const at = (c: GridCoord): string => `(${c.row},${c.col})`;
+/**
+ * X,Y — EAST/WEST THEN NORTH/SOUTH, exactly as `view.ts` writes it, and NOT the internal row/col
+ * storage order.
+ *
+ * These two disagreed until 2026-09-21: the action menu said "(1,-1)" and the log said "(-1,1)" for
+ * the same square, side by side on the same screen. `view.ts` carried the comment explaining why
+ * the display order is X,Y; this one had no comment at all and was simply the storage order
+ * reaching the page. Jesse's call — the log and the action menu spell a square the same way.
+ */
+const at = (c: GridCoord): string => `(${c.col},${c.row})`;
 
 const BOX_NAMES = ['MEN', 'AT', 'WORK'] as const;
 const boxName = (i: number): string => BOX_NAMES[i] ?? `box ${i}`;
@@ -99,11 +136,39 @@ export type NarrateContext = {
    * events has no roster, and "Player 2" is a truthful fallback rather than a broken one.
    */
   playerName?: (player: PlayerIndex) => string;
+  /**
+   * Names the Facility standing on one of a player's squares, or null where there is none.
+   *
+   * Switching lines used to give the bare coordinate — "Set out a loaded hopper at (-1,1)" — which
+   * is the grid's own notation and means nothing at a table where people are looking at cards. The
+   * industry is the whole point of the move, so it is what the line should say.
+   */
+  facilityAt?: (player: PlayerIndex, at: GridCoord) => string | null;
+  /**
+   * Names the Mainline card at a Division node — "Plains", "Heavy Grade" — or null if it cannot.
+   *
+   * A NODE INDEX IS NOT A NAME. The log said "ENHANCEMENT built: abs Signals on Mainline card 7",
+   * which asks the reader to remember what card 7 was (Jesse, 2026-09-22, playing ABS Signals).
+   * The SLOT still matters and is kept beside it, because a division can hold two Plains and the
+   * number is the only thing that tells them apart.
+   */
+  mainlineAt?: (node: number) => string | null;
+  /** The printed name of an Enhancement or Mainline modifier, by its content key. */
+  enhancementName?: (key: string) => string | null;
 };
 
 export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
   const card = (id: string): string => ctx.cardName?.(id) ?? 'a card';
   const train = (id: TrayId): string => ctx.trainName?.(id) ?? String(id);
+  // The industry on a square when there is one, and the coordinate when there is not — a crew works
+  // plain track too, and "at nowhere" would be worse than the notation.
+  const place = (player: PlayerIndex, c: GridCoord): string => ctx.facilityAt?.(player, c) ?? at(c);
+  /** "Mainline card 7 (Plains)" — the slot, which disambiguates, plus the card, which informs. */
+  const mainlineCard = (node: number | undefined): string => {
+    if (node === undefined) return 'the Mainline';
+    const name = ctx.mainlineAt?.(node) ?? null;
+    return `Mainline card ${node}${name ? ` (${name})` : ''}`;
+  };
 
   switch (e.type) {
     // -- clock
@@ -118,6 +183,18 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
           .map((p) => ctx.playerName?.(p) ?? `Player ${p + 1}`)
           .join(' → ')}`,
       };
+    case 'superintendentChanged':
+      /**
+       * The Fedora is the only thing in the game that changes hands on a clock rather than because
+       * somebody did something, so it is the one handover nobody at the table watches happen.
+       */
+      return {
+        tone: 'clock',
+        text:
+          `SUPERINTENDENT — the Fedora passes to ${ctx.playerName?.(e.player) ?? 'the next player'} ` +
+          `at the end of Stage ${e.stage}. They rule on clearances, take the Yard Office and Red Flag ` +
+          `questions, and every round that goes round the table now starts with them.`,
+      };
     case 'phaseBegan':
       // Its own tone, not `quiet`. A phase marker sat in the same grey as the events inside it, so
       // the log read as one undifferentiated column and you could not see where a phase began.
@@ -125,7 +202,7 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
     case 'actorChanged':
       return {
         tone: 'quiet',
-        text: e.player === null ? 'No player acts — automatic phase' : `Player ${e.player} to act`,
+        text: e.player === null ? 'No player acts — automatic phase' : 'to act',
       };
 
     // -- local operations
@@ -137,7 +214,15 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
             ? 'Chose to SWITCH — six Moves to shunt cars around the yard. Watch the crew chip on the grid: it carries its consist with it, and cars it passes over are coupled automatically.'
             : e.option === 'draw'
               ? 'Chose to DRAW a card'
-              : 'Chose FREIGHT AGENT work — one car moved to or from a facility',
+              /**
+               * SAYS WHAT MAY BE DONE, NOT WHAT WAS. This read "one car moved to or from a
+               * facility" — an assertion — and §6.3 requires no action at all, so when the Freight
+               * Agent went idle the log claimed a car had moved and then fell silent about which.
+               * Reported from a table on Day 1 Stage 3 of v0.8.0.16. The work itself is narrated by
+               * `stockToOutbound`, `inboundCleared` and `facilityUnjammed`, each naming the car and
+               * the industry; an idle Agent is narrated by `freightAgentIdled`.
+               */
+              : 'Chose FREIGHT AGENT work — may stock a green Outbound box, clear a red Inbound one, or free a jam',
       };
     case 'trayMoved':
       // `via` rides on the event only when there was another legal route to the same square
@@ -146,7 +231,11 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
       return {
         tone: 'plain',
         where: e.to,
-        text: `CREW moved ${at(e.from)} → ${at(e.to)}${e.via ? ` via ${at(e.via)}` : ''} — ${e.movesRemaining} of 6 Moves left. The crew chip on the grid carries the whole train with it.`,
+        // NO TUTORIAL TAIL. "The crew chip on the grid carries the whole train with it" was appended
+        // to EVERY move — six times a turn, and the opener (`localOpsOptionChosen`) already says it
+        // once. It also pushed the useful half of the line out of the caption row, which shows one
+        // step at a time and is the place a player reads a move as it happens.
+        text: `Moved ${train(e.trayId)} ${at(e.from)} → ${place(e.player, e.to)}${e.via ? ` via ${at(e.via)}` : ''} — ${e.movesRemaining} of ${e.movesAllowed} Moves left`,
       };
     case 'carsCoupled': {
       /**
@@ -158,22 +247,59 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
       const own = e.recoupled?.stock.length ?? 0;
       const found = e.stock.length - own;
       const parts: string[] = [];
-      if (own > 0) parts.push(`picked its own ${carsLabel(e.recoupled!.stock)} back up off ${at(e.recoupled!.at)} on the way out`);
-      if (found > 0) parts.push(`coupled ${carsLabel(e.stock.slice(own))} standing on the line`);
+      // `a loaded tank` for one, a bare list for several — "took loaded tank" reads as a telegram.
+      const some = (cars: RollingStock[]): string =>
+        cars.length === 1 ? indefinite(carLabel(cars[0]!)) : carsLabel(cars);
+      if (own > 0) parts.push(`picked its own ${some(e.recoupled!.stock)} back up off ${at(e.recoupled!.at)} on the way out`);
+      if (found > 0) parts.push(`took ${some(e.stock.slice(own))} standing there`);
       return {
         tone: 'plain',
         where: e.at,
         text:
-          `Coupled ${e.stock.length} car(s) at ${at(e.at)} ${e.toNose ? 'ONTO THE NOSE' : 'behind the train'}` +
+          // "1 car(s)" was the plural of a machine. The count is already implied by the cars named
+          // in `parts`, so the sentence leads with where and which end instead.
+          `Coupled at ${place(e.player, e.at)}, ${e.toNose ? 'ONTO THE NOSE' : 'behind the train'}` +
           ` — ${parts.join(', and ')}`,
       };
     }
-    case 'consistSorted':
+    case 'consistSorted': {
+      /**
+       * WHERE THE ENGINE ENDED UP, and whether the train can still run.
+       *
+       * ASKED OF `badlyMadeUp` RATHER THAN RE-DECIDED HERE, which matters because the obvious guess
+       * is wrong: §8.2 is enforced direction-free, so a train with its WHOLE consist ahead of the
+       * engine is a pushing train and perfectly fit to leave. What it may not be is broken-backed,
+       * with the engine buried among its own cars. A copy of that rule in the narrator would have
+       * told a player their pushing train was stranded when it was not.
+       */
+      const ahead = e.engineAt;
+      const unfit = badlyMadeUp({ consist: e.after, engineAt: e.engineAt } as CrewTray);
+      const where =
+        ahead === 0
+          ? 'so the right car is now on the end and can be spotted'
+          : unfit === null
+            ? `with the whole consist AHEAD of the engine — it runs as a pushing train`
+            : `with ${ahead} car${ahead === 1 ? '' : 's'} ahead of the engine — ${unfit}, so it is held at the Office until it is sorted again (§8.2)`;
       return {
         tone: 'good',
         where: e.at,
-        text: `SMALL YARD — consist re-ordered from [${carsLabel(e.before)}] to [${carsLabel(e.after)}], so the right car is now on the end and can be spotted`,
+        text: `Used the SMALL YARD — consist re-ordered from [${carsLabel(e.before)}] to [${carsLabel(e.after)}], ${where}`,
       };
+    }
+    case 'switchingEnded': {
+      /**
+       * The line that closes a switching turn, and the only one the history keeps from the middle of
+       * it: what it cost, and where the crew was left standing.
+       */
+      const used = `${e.movesUsed} of ${e.movesAllowed} Move${e.movesAllowed === 1 ? '' : 's'} used`;
+      if (e.movesUsed === 0) return { tone: 'quiet', text: 'Finished switching without moving a car' };
+      if (!e.lastMove) return { tone: 'plain', text: `Finished switching — ${used}` };
+      return {
+        tone: 'plain',
+        where: e.lastMove.to,
+        text: `Finished switching — ${used}, leaving ${train(e.lastMove.trayId)} at ${place(e.player, e.lastMove.to)}`,
+      };
+    }
     case 'carsDropped':
       // WHICH END. A cut comes off an outer end (§A.3) and the end decides everything that follows:
       // the train may pull away from cars set out behind it and must couple back up to cars set out
@@ -182,7 +308,7 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
         tone: 'plain',
         where: e.at,
         text:
-          `Set out ${carsLabel(e.stock)} at ${at(e.at)}, off the ${e.fromNose ? 'NOSE — ahead of the engine, so pulling forward will couple them again' : 'TAIL — behind the engine, so it may pull away and leave them'}`,
+          `Set out ${carsLabel(e.stock)} at ${place(e.player, e.at)}, off the ${e.fromNose ? 'NOSE — ahead of the engine, so pulling forward will couple them again' : 'TAIL — behind the engine, so it may pull away and leave them'}`,
       };
 
     // -- cards
@@ -202,17 +328,35 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
           ? `Played ${card(e.cardId)} onto ${at(e.placement)}`
           : `Played ${card(e.cardId)}`,
       };
-    case 'mainlineModified':
+    case 'mainlineModified': {
+      // WHICH CARD, NOT JUST WHICH WAY IT WENT. "Mainline card 3 converted to plains" left the reader
+      // to remember what card 3 had been (playtest, 2026-09-15), and the card it WAS is the half that
+      // says what the play was worth.
+      const kindName = (k: string | undefined): string =>
+        MAINLINE_PROFILES.find((m) => m.kind === k)?.name ?? k ?? 'that card';
       return {
         tone: 'plain',
         text: e.became
-          ? `Realignment: Mainline card ${e.node} converted to ${e.became}`
-          : `Played ${e.key} on Mainline card ${e.node}`,
+          ? `Realignment: Mainline card ${e.node}, ${kindName(e.from)}, converted to ${kindName(e.became)}`
+          // Same two faults as `enhancementPlaced` above, in the neighbouring case: a raw key for a
+          // name, and a slot with nothing to say which card it is when `from` is absent.
+          : `Played ${ctx.enhancementName?.(e.key) ?? e.key} on Mainline card ${e.node}` +
+            ` (${e.from ? kindName(e.from) : (ctx.mainlineAt?.(e.node) ?? 'that card')})`,
       };
+    }
+    case 'redFlagSpent':
+      return {
+        tone: 'good',
+        text: `RED FLAG — Train ${e.trainNumber} stopped short of the ${e.side === 'east' ? 'Eastern' : 'Western'} Limits. The flag comes down with it.`,
+      };
+    case 'redFlagRuled':
+      return e.flag
+        ? { tone: 'plain', text: 'Flagged the approaching train' }
+        : { tone: 'plain', text: 'Waved the train through' };
     case 'redFlagsSet':
       return {
         tone: 'good',
-        text: `Red Flags set out to protect train ${e.trayId} on Mainline card ${e.node} — an approaching train must stop`,
+        text: `RED FLAGS set out on the ${e.side === 'east' ? 'Eastern' : 'Western'} Limits — the next train from that way is held short`,
       };
     case 'flyingSwitch':
       return {
@@ -247,38 +391,68 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
         text: `Extra X${e.trainNumber} played — it is NOT scheduled; it runs once as soon as a Crew Tray frees up, then its card is gone`,
       };
     case 'enhancementPlaced': {
-      const name = e.key.replace(/([A-Z])/g, ' $1');
+      /**
+       * THE CARD'S OWN NAME, not a key with spaces wedged into it. This was
+       * `e.key.replace(/([A-Z])/g, ' $1')`, which rendered `absSignals` as "abs Signals" —
+       * uncapitalised, and bypassing the authored names `cardName` started honouring in v0.8.0.17
+       * for exactly this reason: an acronym is not recoverable by splitting on capitals.
+       */
+      const name = ctx.enhancementName?.(e.key) ?? e.key.replace(/([A-Z])/g, ' $1');
       // Out on the Mainline is not a square in anyone's district, so it is named rather than
       // given a coordinate the Office Area does not have.
       if (e.at === undefined) {
-        return { tone: 'good', text: `ENHANCEMENT built: ${name} on Mainline card ${e.node}` };
+        return { tone: 'good', text: `ENHANCEMENT built: ${name} on ${mainlineCard(e.node)}` };
       }
       return { tone: 'good', where: e.at, text: `ENHANCEMENT built: ${name} at ${at(e.at)}` };
     }
     case 'secondSectionOrdered':
       return {
         tone: 'bad',
-        text: `SECOND SECTION ordered on Train ${e.trainNumber} — an identical train will run right behind it, which forces the Superintendent to rule on a following train (§8.1)`,
+        text: `SECOND SECTION ordered on Train ${e.trainNumber} — an identical train will run right behind it, which forces the Superintendent to rule on a following train`,
       };
-    case 'extraStarted':
+    /**
+     * WHERE THE PLAYER PUT IT, not where its number would have sent it.
+     *
+     * An Extra's direction comes from its start now (§7, Jesse's ruling), so the line that used to
+     * explain the number's parity would be explaining a rule that no longer applies to this train.
+     */
+    case 'extraStarted': {
+      const where =
+        e.at.kind === 'divisionPoint'
+          ? `the ${e.at.side === 'west' ? 'Western' : 'Eastern'} Division Point`
+          : e.at.kind === 'mainline'
+            ? "the Interchange's yard"
+            : `the Control Point in seat ${e.at.seat}`;
+      const why =
+        e.at.kind === 'divisionPoint'
+          ? 'the end it runs away from — an Extra may start at either, and the end chooses the run'
+          : e.at.kind === 'mainline'
+            ? 'made up off the running line, so it highballs onto the Mainline once the Subdivision ' +
+              'is clear and may be held in the yard until it is'
+            : 'an Extra may begin at any Office above a Whistle Post, and the player chooses the run';
       return {
         tone: 'good',
-        text:
-          e.atSeat === null
-            ? `EXTRA X${e.trainNumber} started at the ${e.trainNumber % 2 === 0 ? 'Western' : 'Eastern'} Division Point, running ${e.trainNumber % 2 === 0 ? 'east' : 'west'} — odd numbers run west and even run east (§2.3), so its number chose the end`
-            : `EXTRA X${e.trainNumber} started at the Control Point in seat ${e.atSeat}, running ${e.trainNumber % 2 === 0 ? 'east' : 'west'} — an Extra may begin at any Office above a Whistle Post instead of at a Division Point`,
+        text: `EXTRA X${e.trainNumber} started at ${where}, running ${e.direction} — ${why}`,
       };
+    }
     case 'trainMadeUp':
       return {
         tone: 'good',
         text: `${e.isExtra ? `EXTRA X${e.trainNumber}` : `TRAIN ${e.trainNumber}`} MADE UP at the ${e.at}, running ${e.direction} — crew assigned, now taking cars`,
       };
     case 'trainStoodStill':
+      /**
+       * SPELLS OUT WHAT EARNED IT (Jesse, 2026-09-23: "make sure history calls out when point
+       * earned"). The line said the train had stood still and a point arrived; it did not say that
+       * the point is per DISTRICT and can be earned again in the next one, which is the whole of
+       * how the card is played.
+       */
       return {
         tone: 'good',
         text:
-          `Train ${e.trainNumber} stood still for a whole Stage at ${e.where} and earned a point — ` +
-          'its card pays for the stop, not for the run (circus set-up)',
+          `CIRCUS SET-UP — Train ${e.trainNumber} stood still for a whole Stage at ${e.where}, ` +
+          'fully loaded, and earned 1 Revenue. Its card pays for the STOP, not for the run: one ' +
+          'point per district, and it can earn again in the next district it stands a Stage in.',
       };
     case 'trainHeld':
       return {
@@ -302,12 +476,25 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
        * arrival; the only difference is what happens if it is left on Secondary Track when the next
        * Mainline Phase begins (`expediteFault`).
        */
-      return {
-        tone: 'plain',
-        text: e.expedited
-          ? `Train ${e.trainNumber} ARRIVED at the ${e.office} carrying ${carsLabel(e.consist)} — its card prints EXPEDITE, so keep it on the Office square: parked anywhere else in the district when the next Mainline Phase begins costs a Revenue point. It works and switches normally in the meantime.`
-          : `Train ${e.trainNumber} ARRIVED at the ${e.office} carrying ${carsLabel(e.consist)} — it stands here for the rest of this Stage. You can work it in Cargo now, switch it in the NEXT Stage's Local Operations, and it departs in that Stage's Mainline Phase.`,
-      };
+      /**
+       * WHOSE OFFICE, AND WHOSE TRAIN TO WORK — Jesse, playtest 2026-09-16.
+       *
+       * This said "ARRIVED at the Whistle Post" and then "You can work it in Cargo now". Both halves
+       * are wrong at a table of four: every seat has an Office, so the tier alone does not say which
+       * district the train is standing in, and the reader is usually NOT its Station Master — the
+       * line was telling three players they could work a train they cannot touch.
+       */
+      {
+        const name = ctx.playerName?.(e.owner) ?? null;
+        const whose = name === null ? `the ${e.office}` : `${name}'s ${e.office}`;
+        const worker = name === null ? 'Its Station Master' : name;
+        return {
+          tone: 'plain',
+          text: e.expedited
+            ? `Train ${e.trainNumber} ARRIVED at ${whose} carrying ${carsLabel(e.consist)} — its card prints EXPEDITE, so it must stay on the Office square: parked anywhere else in that district when the next Mainline Phase begins costs a Revenue point. It works and switches normally in the meantime.`
+            : `Train ${e.trainNumber} ARRIVED at ${whose} carrying ${carsLabel(e.consist)} — it stands there for the rest of this Stage. ${worker} can work it in Cargo now and switch it in the NEXT Stage's Local Operations, and it departs in that Stage's Mainline Phase.`,
+        };
+      }
     case 'expediteFault':
       return {
         tone: 'bad',
@@ -329,23 +516,58 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
       };
 
     // -- freight agent
+    /**
+     * THE INDUSTRY, NOT THE COORDINATE — `place` over `at`, for the reason its own comment gives:
+     * "(-1,1)" is the grid's notation and means nothing at a table where people are looking at
+     * cards. The switching lines were moved to it and these three were missed, so a Freight Agent
+     * turn was the one place the log still spoke in coordinates. Asked directly from a table on
+     * Day 1 Stage 3 of v0.8.0.16: "can we tell what car, what facility and whether it was to or
+     * from." The car and the direction were already here; the facility was not.
+     */
     case 'stockToOutbound':
       return {
         tone: 'plain',
         where: e.at,
-        text: `Freight Agent put a ${carLabel(e.stock)} into the green Outbound box at ${at(e.at)}`,
+        text: `Freight Agent loaded a ${carLabel(e.stock)} INTO the green Outbound box at ${place(e.player, e.at)}`,
       };
     case 'inboundCleared':
       return {
         tone: 'plain',
         where: e.at,
-        text: `Freight Agent cleared a ${carLabel(e.stock)} from the red Inbound box at ${at(e.at)}`,
+        text: `Freight Agent cleared a ${carLabel(e.stock)} OUT of the red Inbound box at ${place(e.player, e.at)}`,
       };
     case 'facilityUnjammed':
       return {
         tone: 'bad',
+        text: `UNJAMMED ${place(e.player, e.at)} — pulled a ${carLabel(e.stock)} out of ${e.from} to free the facility`,
         where: e.at,
-        text: `UNJAMMED ${at(e.at)} — pulled a ${carLabel(e.stock)} out of ${e.from} to free the facility`,
+      };
+    case 'trainReleasedFromLimits': {
+      /**
+       * WHY NOW, which is the whole question. The train has been sitting at the Limits for however
+       * many Stages, and what changed is that somebody else's train cleared the Office.
+       */
+      const who = ctx.playerName?.(e.owner as never) ?? null;
+      return {
+        tone: 'good',
+        text:
+          `Train ${e.trainNumber} RELEASED from the Limits into the ${e.office}` +
+          `${who ? ` at ${who}'s district` : ''} — the Interlocking had been holding it clear of a ` +
+          `full Office, and ${
+            e.freedBy === null
+              ? 'a departure freed the A/D track it was waiting for'
+              : `Train ${e.freedBy} arriving freed the A/D track it was waiting for`
+          }. ` +
+          'A held train takes the first track to free, ahead of anything arriving after it.',
+      };
+    }
+    case 'freightAgentIdled':
+      return {
+        tone: 'quiet',
+        text:
+          'Freight Agent found nothing worth doing — no green box could be stocked, no red box needed ' +
+          'clearing, and no load was jammed. §6.3 requires no action, and unjamming a healthy box ' +
+          'would destroy a load that cost a whole action to stock.',
       };
 
     // -- trains
@@ -356,14 +578,44 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
       return {
         tone: 'good',
         text: bumped
-          ? `Train ${e.trainNumber} SCHEDULED at Stage ${e.slot + 1} — rolled ${e.roll}, but Stage ${e.roll} was already taken, so it moved down the column to the next free Stage (§7)`
+          ? `Train ${e.trainNumber} SCHEDULED at Stage ${e.slot + 1} — rolled ${e.roll}, but Stage ${e.roll} was already taken, so it moved down the column to the next free Stage`
           : `Train ${e.trainNumber} SCHEDULED to depart at Stage ${e.slot + 1} (rolled ${e.roll}) — it will run at this time EVERY Day from now on`,
       };
     }
     case 'carPlacedOnTrain':
-      return { tone: 'plain', text: `Added a ${carLabel(e.stock)} to the train being made up` };
+      // NAMES THE TRAIN. "the train being made up" was true and useless: a player looking back for
+      // what happened to train 10 found four lines that never said 10 (playtest, 2026-09-16).
+      return {
+        tone: 'plain',
+        text: `Added ${indefinite(carLabel(e.stock))} to ${trainLabel(e.trainNumber, e.isExtra)}`,
+      };
     case 'carPassed':
-      return { tone: 'quiet', text: 'Passed — no suitable car in the Division Yard' };
+      return {
+        tone: 'quiet',
+        text: `Passed on ${trainLabel(e.trainNumber, e.isExtra)} — no suitable car in the Division Yard`,
+      };
+    case 'makeUpShort': {
+      // What it wanted, in the words the card uses, so the line can be checked against the card.
+      const names: Record<'freight' | 'coach' | 'caboose', string> = {
+        freight: 'freight car',
+        coach: 'coach',
+        caboose: 'caboose',
+      };
+      const wants = e.missing.map((m) => names[m]).join(' or ');
+      const got = e.placed === 0 ? 'NO CARS AT ALL' : `only ${e.placed} of the ${e.wanted} its card calls for`;
+      // §2.2 is the whole explanation and it is not guessable from the board: the cars are visible
+      // in the Classification Yard, and why they will not come back is not.
+      const why =
+        e.waiting > 0
+          ? ` ${e.waiting} sit in the Classification Yard, which comes back only when the Division Yard is bare — and it still holds ${e.divisionYardHolds} cars.`
+          : ' There are none in the Classification Yard either.';
+      return {
+        tone: 'bad',
+        text:
+          `${trainLabel(e.trainNumber, e.isExtra).toUpperCase()} WAS MADE UP WITH ${got} — the ` +
+          `Division Yard holds no ${wants} it can take, so nobody was asked for one.${why}`,
+      };
+    }
     case 'dispatchBonusUsed':
       return {
         tone: 'good',
@@ -374,19 +626,38 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
       // player the score had changed and nothing else.
       const why =
         e.reason === 'no free A/D track'
-          ? `it arrived at ${e.where} with every A/D track already occupied — there was nowhere to put it (§8.3)`
+          ? `it arrived at ${e.where} with every A/D track already occupied — there was nowhere to put it`
           : e.reason === 'cars fouling the Running Track'
-            ? `it ran into cars left standing on ${e.where} between the Limits and the Office (§8.3)`
+            ? `it ran into cars left standing on ${e.where} between the Limits and the Office`
             : e.reason;
       const wrecked = e.trains
         .map((t) => `${t.label} (${t.consist.length ? carsLabel(t.consist) : 'no cars'})`)
         .join(' and ');
+      /**
+       * WHOSE OFFICE, AND WHO PAYS (playtest, 2026-09-16: "it doesn't say who suffers the revenue
+       * loss… we need to know which player received the penalty and why").
+       *
+       * `player` is the seat at fault, and for everything that happens inside a district that is the
+       * district's owner — so it names the place as well as the payer. A Mainline collision is the
+       * Superintendent's by rule (§10), which is a different sentence: it happened on open road, not
+       * in anybody's Office. The 5 points ride in a separate `revenueChanged`, which is why the line
+       * never mentioned them; a player should not have to add two log entries together.
+       */
+      const who = ctx.playerName?.(e.player) ?? null;
+      const mainline = e.where === 'the Mainline';
+      const place = who === null || mainline ? e.where : `${who}'s ${e.where.replace(/^the /, '')}`;
+      const cost =
+        who === null
+          ? ' 5 Revenue is lost.'
+          : mainline
+            ? ` ${who} loses 5 Revenue: §10 makes a Mainline collision the Superintendent's fault.`
+            : ` ${who} loses 5 Revenue — it happened in their district.`;
       return {
         tone: 'bad',
         text:
-          `COLLISION — ${wrecked} destroyed: ${why}. Engines and cabooses go back to the Division ` +
-          `Yard, all other cars to the Classification Yard (§10). A Timetabled train card returns ` +
-          `to its slot and runs again next Day; an Extra is gone for good.`,
+          `COLLISION at ${place} — ${wrecked} destroyed: ${why}.${cost} Engines and cabooses go back ` +
+          `to the Division Yard, all other cars to the Classification Yard. A Timetabled train card ` +
+          `returns to its slot and runs again next Day; an Extra is gone for good.`,
       };
     }
 
@@ -394,7 +665,7 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
       return {
         tone: 'bad',
         text:
-          `SUPERINTENDENT MUST RULE (§8.1): ${train(e.trainId)} wants to enter the Mainline card ` +
+          `SUPERINTENDENT MUST RULE: ${train(e.trainId)} wants to enter the Mainline card ` +
           `that ${train(e.occupiedBy)} is still crossing. Allow it and ${train(e.trainId)} may run ` +
           `into the back of ${train(e.occupiedBy)} — a collision costs 5 Revenue. Hold it and it ` +
           `waits where it is, losing time but safe.`,
@@ -414,13 +685,13 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
       return {
         tone: 'good',
         where: e.at,
-        text: `Porter boarded passengers at ${at(e.at)} — one coach per Porter per Stage (§9.2)`,
+        text: `Porter boarded passengers at ${at(e.at)} — one coach per Porter per Stage`,
       };
     case 'passengersDetrained':
       return {
         tone: 'good',
         where: e.at,
-        text: `Porter de-trained passengers at ${at(e.at)} — one coach per Porter per Stage (§9.2)`,
+        text: `Porter de-trained passengers at ${at(e.at)} — one coach per Porter per Stage`,
       };
 
     // -- freight pipeline
@@ -456,12 +727,40 @@ export function narrate(e: GameEvent, ctx: NarrateContext = {}): Narration {
       };
 
     // -- consequences
-    case 'revenueChanged':
+    case 'revenueChanged': {
+      /**
+       * WHOSE REVENUE, NAMED HERE RATHER THAN LEFT TO THE PREFIX.
+       *
+       * Reported from a table: the line gives the change and the running total and no player. The
+       * history's own prefix names the ACTOR, and revenue is not always the actor's — a train
+       * completing its run pays every player with no actor at all, so those lines carried no name
+       * whatsoever. `e.player` is the seat that earned it, which is the only right answer, so the
+       * line resolves its own name and `record` leaves it alone (`SELF_NAMED` in `web/game.ts`).
+       */
+      const whose = ctx.playerName?.(e.player) ?? null;
+      const owner = whose === null ? '' : `${whose} `;
       return e.delta < 0
-        ? { tone: 'bad', text: `${e.reason.toUpperCase()} · ${e.delta} Revenue (now ${e.total})` }
-        : { tone: 'good', text: `+${e.delta} Revenue (now ${e.total}) — ${e.reason}` };
+        ? { tone: 'bad', text: `${e.reason.toUpperCase()} · ${owner}${e.delta} Revenue (now ${e.total})` }
+        : { tone: 'good', text: `${owner}+${e.delta} Revenue (now ${e.total}) — ${e.reason}` };
+    }
     case 'phaseEnded':
-      return { tone: 'quiet', text: `Player ${e.player} finished ${phaseLabel(e.phase)}` };
+      return { tone: 'quiet', text: `Finished ${phaseLabel(e.phase)}` };
+
+    // -- §3.3, extended play (Gitea#11)
+    case 'extensionVoted':
+      return e.agree
+        ? { tone: 'plain', text: 'Would play one more Day' }
+        : { tone: 'plain', text: 'Called time — the game ends here' };
+    case 'dayExtended':
+      return { tone: 'clock', text: `── The table plays on: Day ${e.day} is added to the timetable ──` };
+    case 'playConcluded':
+      return { tone: 'clock', text: '── The railroad is put to bed. Final results stand. ──' };
+
+    // -- §11, the Yard Office (Gitea#5)
+    case 'yardOfficeRuled':
+      return e.take
+        ? { tone: 'plain', text: `Sent ${train(e.trainId)} into the Yard Office` }
+        : { tone: 'plain', text: `Kept ${train(e.trainId)} at the Train Order Office` };
   }
 }
 
@@ -498,14 +797,156 @@ export type Impediment = { where: string; why: string; severity: 'stuck' | 'wait
  * This is the panel that should answer the standing questions: whether facilities jam, whether
  * trains are held for want of a crew, whether the Office is about to cause a collision.
  */
+/** `coordKey`'s inverse — the grid is keyed by string and the engine predicates take coordinates. */
+function uncoordKey(key: string): GridCoord {
+  const [row, col] = key.split(',').map(Number);
+  return { row: row ?? 0, col: col ?? 0 };
+}
+
+/**
+ * One of `passengerRefusal`'s codes, in words a player can act on.
+ *
+ * `NO_EMPTY_COACH_IN_YARD` gets the longest answer because it is the one that looks like a broken
+ * game: the Division Yard is visibly full of cars, and the single type that has run out is the one
+ * §9.2 needs. Where the missing coaches ARE, and the condition that brings them back, is the whole
+ * of what the player needs to know — §2.2 returns the Classification Yard only when the Division
+ * Yard is bare, so a yard with fifty freight cars in it will not refill for a long time.
+ */
+function passengerReason(
+  s: GameState,
+  player: PlayerIndex,
+  at: GridCoord,
+  dir: 'board' | 'detrain',
+): string {
+  const code = passengerRefusal(s, player, at, dir);
+  switch (code) {
+    case 'NO_TRAIN_AT_OFFICE':
+      return dir === 'board'
+        ? 'passengers waiting, no train at the platform to take them'
+        : 'no train at the platform';
+    case 'NOT_A_TERMINAL':
+      return 'the only train here stops at Terminals only — Porters may not work it at this Office';
+    case 'NO_PASSENGER_WORK':
+      return 'the only train here is one its card bars Porters from working';
+    case 'NO_EMPTY_COACH':
+      return 'passengers waiting, but every coach on the train is already full';
+    case 'INBOUND_BOX_FULL':
+      return 'arrivals aboard, but the red Unloading slots are all occupied';
+    case 'LOADED_IN_THIS_DISTRICT':
+      return 'the loaded coaches all boarded here — passengers must be carried to another Office ' +
+        'Area before they can alight';
+    case 'NO_EMPTY_COACH_IN_YARD': {
+      const stuck = s.yards.classificationYard.filter((c) => c.type === 'coach').length;
+      const total = s.yards.divisionYard.length;
+      return (
+        'arrivals aboard, but §9.2 needs a white empty coach from the Division Yard to swap in and ' +
+        `there is none left${stuck > 0 ? ` — ${stuck} ${stuck === 1 ? 'coach is' : 'coaches are'} in the Classification Yard` : ''}. ` +
+        `Classification returns only when the Division Yard is bare, and it still holds ${total} cars.`
+      );
+    }
+    default:
+      return `Porters cannot work here (${code})`;
+  }
+}
+
 export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[] {
   const out: Impediment[] = [];
   const area = areaOf(s, player);
 
   for (const [key, card] of area.grid) {
     const f = card.facility;
-    if (!f || f.kind !== 'freight') continue;
-    const name = card.geometry.kind === 'facility' ? card.geometry.facility : 'facility';
+    if (!f) continue;
+    /**
+     * A Freight Facility names itself off its own card; a Passenger Facility does NOT — it rides on
+     * the `office` card, so `geometry.kind` is `'office'` and it fell through to the literal
+     * "facility". Every passenger impediment therefore read `facility 0,0`, next to a freight row
+     * saying `mineTipple 1,-3`. The Office Area's tier is the name it should carry, and there is
+     * exactly one Office per Area, so `area.tier` is that card's own.
+     */
+    const name =
+      card.geometry.kind === 'facility'
+        ? card.geometry.facility
+        : card.geometry.kind === 'office'
+          ? area.tier
+          : 'facility';
+
+    /**
+     * WHY THE PORTERS ARE STANDING THERE (Gitea#2).
+     *
+     * "Note that the sparrow (with two loaded coaches) pulled into the station. There are two
+     * passengers on the platform. Four porters. My thought was to unload two and load two. I never
+     * get the chance to load the last two."
+     *
+     * The engine was right — §9.2 needs a white coach out of the Division Yard to de-train into,
+     * §2.2 returns the Classification Yard only when the Division Yard is BARE, and the Division
+     * Yard was one empty coach short with eight more sitting in Classification unable to come back.
+     * Jesse's ruling is that the shortage stays: "it is possible to run out — that's part of the
+     * strategy." What was missing was any way to SEE it. A Porter action that cannot be taken is
+     * simply absent from the menu, and this panel — the one that answers "why is nothing moving?" —
+     * covered freight facilities only, so the platform had nothing to say for itself at all.
+     *
+     * The reason comes from `passengerRefusal`, the engine's own, so what is on screen is the rule
+     * that actually refused rather than a second guess at it.
+     */
+    if (f.kind === 'passenger') {
+      /**
+       * NOBODY TO PUT ON THE PLATFORM, AND NO WAY TO SEE WHY (playtest, 2026-09-16).
+       *
+       * "He would like to have two passengers waiting in his depot… but the only option he had was
+       * bringing a tank load into the refinery." His Depot had a Restaurant and a Hotel beside it and
+       * three outbound slots — capacity was never the problem. §6.3 stocking takes a LOADED car of
+       * the facility's type out of the Division Yard, and there was not a loaded coach in it: six
+       * were sitting in Classification, which §2.2 returns only when the Division Yard runs bare.
+       *
+       * Jesse's ruling (2026-09-16) is the same one Gitea#2 got: the shortage stays, because running
+       * out is part of the game. What must not stay is the silence — an action with no legal target
+       * is simply absent from the menu, so the player is left to guess whether they misunderstood the
+       * rules or the game is broken.
+       */
+      if (f.allows.outbound && f.outboundBox.length < f.capacity.outbound) {
+        const loadedCoaches = s.yards.divisionYard.filter((c) => c.type === 'coach' && c.loaded).length;
+        if (loadedCoaches === 0) {
+          const waiting = s.yards.classificationYard.filter((c) => c.type === 'coach' && c.loaded).length;
+          out.push({
+            where: `${name} ${key}`,
+            why:
+              `room for ${f.capacity.outbound - f.outboundBox.length} more passenger` +
+              `${f.capacity.outbound - f.outboundBox.length === 1 ? '' : 's'} to wait, but no loaded ` +
+              `coach in the Division Yard for the Freight Agent to bring over` +
+              (waiting > 0
+                ? ` — ${waiting} ${waiting === 1 ? 'is' : 'are'} in the Classification Yard, which comes ` +
+                  'back only when the Division Yard is bare'
+                : ''),
+            severity: 'waiting',
+          });
+        }
+      }
+      if (portersLeft(f) > 0) {
+        const coord = uncoordKey(key);
+        // Passengers standing on the platform with nothing carrying them away.
+        if (f.outboundBox.some((c) => c.type === 'coach' && c.loaded) && !canBoard(s, player, coord)) {
+          out.push({
+            where: `${name} ${key}`,
+            why: passengerReason(s, player, coord, 'board'),
+            severity: 'waiting',
+          });
+        }
+        // A coach full of arrivals that cannot be emptied.
+        const arriving = area.adOccupancy.some((id) =>
+          s.trays.get(id)?.consist.some((c) => c.type === 'coach' && c.loaded && c.origin !== seatOf(s, player)),
+        );
+        if (arriving && !canDetrain(s, player, coord)) {
+          out.push({
+            where: `${name} ${key}`,
+            why: passengerReason(s, player, coord, 'detrain'),
+            severity: 'stuck',
+          });
+        }
+      }
+      continue;
+    }
+
+    if (f.kind !== 'freight') continue;
     const want = facilityCarType(f);
 
     // A load that cannot move, with Laborers standing by, is the worst state a facility reaches:
@@ -536,7 +977,7 @@ export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[]
         why: blockedByBox
           ? 'green box has a load but MEN is occupied'
           : `a load is staged but no empty ${want} is spotted on this industry's track — it stays ` +
-            'in the green box until a crew sets one out here (§9.3)',
+            'in the green box until a crew sets one out here',
         severity: blockedByBox ? 'waiting' : 'stuck',
       });
     }
@@ -557,7 +998,7 @@ export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[]
         why: spotted
           ? 'green box empty — nothing to load (needs a Freight Agent action)'
           : `green box empty — the Freight Agent can stage a load now, but no empty ${want} is ` +
-            'spotted here, so a crew must set one out before Laborers can work it (§9.3)',
+            'spotted here, so a crew must set one out before Laborers can work it',
         severity: 'waiting',
       });
     }
@@ -585,6 +1026,42 @@ export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[]
    * Only while switching, and only the cards actually in the crew's way: `movesFor` reports the
    * squares the movement walk reached and refused, not every square on the board.
    */
+  /**
+   * WHY A CAR WILL NOT COME OFF (Gitea#21).
+   *
+   * "I dropped the first tank car, but that was all I was allowed to do" — and this panel, asked
+   * why, talked about the refinery's green box. The rule that actually refused is printed on the
+   * train: trains 3/4, the Express, "may drop or pick up one freight car at every location". The
+   * refusal was correct. Nothing said it.
+   *
+   * That is a worse failure than a missing button, because the panel did not stay silent — it
+   * offered a true statement about the FACILITY, which sent the player to spend a Freight Agent
+   * action that could not have helped. The rule was on the train card's tooltip, which is not
+   * where anyone looks when a button they expected is simply absent.
+   *
+   * Only when the crew has a freight car it could otherwise set out. A budget spent by a train
+   * with nothing left to drop is not blocking anything, and this panel earns its keep by being
+   * short enough to read.
+   */
+  const turnNow = turnOf(s, player);
+  if (s.clock.phase === 'localOps' && turnNow.option === 'switch') {
+    for (const [id, tray] of s.trays) {
+      if (tray.position.at !== 'grid' || tray.position.seat !== seatOf(s, player)) continue;
+      if (!tray.consist.some(isFreight)) continue;
+      if (!freightRuleSpentHere(s, player, id)) continue;
+      const { row, col } = tray.position.coord;
+      out.push({
+        where: `Train ${tray.trainNumber} at (${col},${row})`,
+        why:
+          'ONE FREIGHT CAR PER LOCATION — this train has already worked a freight car on this ' +
+          'square, so no more come off or on here until next turn. It may still work one at the ' +
+          'next square it reaches.',
+        // The printed rule doing its job, and it lifts by itself. Amber, not red.
+        severity: 'waiting',
+      });
+    }
+  }
+
   const turn = turnOf(s, player);
   if (s.clock.phase === 'localOps' && turn.option === 'switch' && turn.movesRemaining > 0) {
     for (const [id, tray] of s.trays) {
@@ -642,7 +1119,7 @@ export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[]
 
       if (pf.porters < 1) {
         say(
-          'this Office has NO Porters — a Whistle Post is not a Passenger Facility (§9) and cannot ' +
+          'this Office has NO Porters — a Whistle Post is not a Passenger Facility and cannot ' +
             'work passengers at all. Upgrade it to a Depot or better.',
           'stuck',
         );
@@ -665,19 +1142,75 @@ export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[]
           );
         }
         if (loadedOnTrain && !s.yards.divisionYard.some((c) => c.type === 'coach' && !c.loaded)) {
-          say('no EMPTY coach in the Division Yard to swap into the train (§9.2 requires one)');
+          say('no EMPTY coach in the Division Yard to swap into the train — one is required');
         }
       }
     }
   }
 
-  // Trains held for want of a Crew Tray (§7) — the scarcity mechanic, made visible.
-  const due = s.timetable[s.clock.stage - 1];
-  if (due !== null && due !== undefined && s.freeTrays.length === 0) {
+  /**
+   * TRAINS HELD FOR WANT OF A CREW TRAY (§7) — the scarcity mechanic, made visible (#98).
+   *
+   * This covered the TIMETABLED train due out this Stage and nothing else, which meant the two
+   * other things that queue for the same pool reported nothing at all. A player who spent a card on
+   * an Extra, or ordered a second section, got an EMPTY panel while their train sat behind an
+   * exhausted pool — and each had been announced once in the log in a line that promised a future
+   * event ("as soon as a Crew Tray frees up") which nothing then confirmed.
+   *
+   * All three are one condition, so they are written as one block: no free tray, and something
+   * waiting for one. The count rides along because "no free Crew Tray" reads like a permanent fact
+   * about the game rather than a state that will pass.
+   */
+  // `crewTrayCount` is the pool's size, asked rather than re-derived. `trays.size + freeTrays.length`
+  // gives the same number in play — `retireTrain` moves a tray back — but it is a second way to know
+  // one fact, which is the shape of every bug this release fixed.
+  const trays = `${s.freeTrays.length} of ${crewTrayCount(s.players.length)} Crew Trays free`;
+  if (s.freeTrays.length === 0) {
+    const due = s.timetable[s.clock.stage - 1];
+    if (due !== null && due !== undefined) {
+      out.push({
+        where: `Train ${due}`,
+        why: `due to depart but HELD — no free Crew Tray (${trays})`,
+        severity: 'stuck',
+      });
+    }
+
+    // An Extra belongs to the player who played the card (§7), so it is their errand and it is
+    // reported to them. A second section is the table's, like any Timetabled train.
+    for (const x of s.pendingExtras) {
+      if (x.player !== player) continue;
+      out.push({
+        where: `Extra X${x.trainNumber}`,
+        why: `played and waiting to be made up — no free Crew Tray (${trays})`,
+        severity: 'stuck',
+      });
+    }
+
+    for (const n of s.pendingSecondSections) {
+      out.push({
+        where: `Train ${n}`,
+        why: `second section ordered and waiting to be made up — no free Crew Tray (${trays})`,
+        severity: 'stuck',
+      });
+    }
+  }
+
+  /**
+   * A TRAIN HELD AT THE LIMITS BY AN INTERLOCKING (#99).
+   *
+   * It is inside the player's Limits, not on an A/D track, and it takes the first track that frees
+   * ahead of any newcomer. The map now draws it on the Limits square; this says what it is waiting
+   * for, which is the Office emptying rather than anything the held train itself can do.
+   */
+  for (const id of area.heldAtLimits) {
+    const t = s.trays.get(id);
+    if (!t) continue;
     out.push({
-      where: `Train ${due}`,
-      why: 'due to depart but HELD — no free Crew Tray',
-      severity: 'stuck',
+      where: `Train ${t.trainIsExtra ? 'X' : ''}${t.trainNumber ?? '—'}`,
+      why:
+        'held at your Limits by the Interlocking instead of colliding — it takes the first A/D ' +
+        'track that frees, ahead of any train arriving after it',
+      severity: 'waiting',
     });
   }
 

src/sim/pacing.ts

@@ -0,0 +1,256 @@
+/**
+ * HOW LONG EACH STEP IS SHOWN — v0.8.0, `docs/plans/jitsi-common-board.md` § v0.8.0 § 5.
+ *
+ * Shared rather than living in `src/web/`, so the 0.8.1 seatless board paces identically to a
+ * player's own screen. Two views of one game that disagreed about how fast it looks would be worse
+ * than either alone.
+ *
+ * WHY BY KIND RATHER THAN BY BUDGET. The obvious scheme is to give the whole backlog a time budget
+ * and divide it by the queue length. Measured against real games, that does exactly the wrong
+ * thing. From `public/replays/`: ~60 stages per game and ~5 intents per player per stage, so a
+ * four-player table produces ~15 other-player steps per stage — but 44 of a 307-intent game are
+ * `draw.end` and 60 are `loadUnload.end`, bookkeeping nobody wants to watch, while the thing that
+ * is worth watching is rare and clustered. Two of the three published replays contain no
+ * `switch.move` at all; the third has bursts of 14, 6, 6 and 6, and `trayMoved`'s own narration says
+ * "N of 6 Moves left" because six is the engine's cap per crew. So a uniform budget spends the
+ * player's attention on `draw.end` and rushes the switching.
+ *
+ * Assigning dwell by kind and letting the total fall out costs ~40s of animation across a whole
+ * 60-stage game, against ~3.6 minutes for a flat 700ms — better switching visibility for a fifth of
+ * the time. Jesse, 2026-09-09, on what matters: *"I definitely want to watch other players struggle
+ * with the switching exercises … I don't think reading the switching in the log will be anywhere
+ * nearly as interesting as watching the trains actually move on the board."*
+ *
+ * PACING IS CLIENT-SIDE ONLY. The server emits steps as fast as it likes and the client decides how
+ * to show them, which is what keeps Gitea#20's "do not slow the authoritative game" true.
+ */
+
+import type { StepCause } from './display-step.ts';
+
+export type StepKind = 'switching' | 'action' | 'phase' | 'bookkeeping';
+
+/**
+ * THE TUNING TABLE — dwell in milliseconds per kind.
+ *
+ * Start generous and tune down by playing; Jesse, 2026-09-09: *"start at 1s and tune down."* This is
+ * the committed default and changing it needs a web rebuild, which in the `.s9pk` is a release — so
+ * it is deliberately not the only way to change the pacing. A viewer's own `pace` multiplier
+ * (`Settings`, `localStorage`) and a `?pace=` URL parameter both scale these without one, and
+ * `pace = 0` turns the animation off entirely, which is also TODO #18's "a player who has seen it a
+ * hundred times will want it off". **Multipliers above 1 are supported and expected** — Jesse asked
+ * for 2 and 3 explicitly after the first play — up to `MAX_PACE`, and every tier scales together so
+ * their relative weighting survives.
+ *
+ * NOT IN GAME-CREATION SETTINGS, on Jesse's call 2026-09-09: dwell is presentation, not a rule, and
+ * `config` rides along in saves and replays. If it ever moves there, the config field supplies this
+ * table's multiplier — the table, the classification and the queue do not change.
+ */
+export const DWELL: Record<StepKind, number> = {
+  /** A train physically moving on the board. The thing worth watching, and protected accordingly. */
+  switching: 1000,
+  /**
+   * A card, a car or a load changing hands somewhere visible — and the announcement of what a
+   * player is about to do.
+   *
+   * WAS 250ms, WHICH WAS WRONG, and wrong in the way that mattered most: an early-game bot turn has
+   * no switching in it at all, so it was six steps of 250ms and 0ms — **750ms for a whole turn**.
+   * Jesse, from the first real play on the test server: *"bot play was way too fast. I briefly saw
+   * that it was the bot's office area then their turn was done."* His instruction had been "start at
+   * 1s and tune down", and that was applied only to switching while this number was invented.
+   */
+  action: 700,
+  /**
+   * An automatic phase that DID something — TODO #18.
+   *
+   * Only reached when the phase actually narrated: `submit()` collects no step for a phase that
+   * changed nothing, so this is never spent on the empty ones Jesse is content to guess at. Between
+   * an ordinary action and a switching move, because the Mainline phase moves trains the length of
+   * the Division and is the clearest case of "stuff just happened without being able to see how".
+   */
+  phase: 600,
+  /** Turn and phase bookkeeping. Nothing moved; do not spend the player's attention on it. */
+  bookkeeping: 0,
+};
+
+/**
+ * Which kind an intent is.
+ *
+ * Exhaustive over `Intent['type']` on purpose — a `default` would silently drop a newly added intent
+ * into whatever tier the fallback names, and the failure mode is invisible (a move that never gets
+ * a beat, or bookkeeping that stalls the queue for a second). `test/pacing.test.ts` walks every
+ * member of the union so a new intent cannot land here unclassified.
+ */
+export function kindOf(cause: StepCause): StepKind {
+  switch (cause) {
+    // The Division advancing itself — New Train, the Mainline, the shift change (TODO #18).
+    case 'phase':
+      return 'phase';
+
+    // The crew and its train moving, coupling, setting out and re-ordering — §6.1 and Appendix A.
+    case 'switch.move':
+    case 'switch.dropCars':
+    case 'switch.sortConsist':
+    case 'maneuver.flyingSwitch':
+    case 'maneuver.redFlags':
+      return 'switching';
+
+    // Something visible changed hands or position, but no train drove anywhere.
+    case 'card.play':
+    case 'card.discard':
+    case 'draw.fromHomeOffice':
+    case 'draw.fromDepartment':
+    case 'newTrain.placeCar':
+    case 'newTrain.passCar':
+    case 'newTrain.secondSection':
+    case 'newTrain.startExtra':
+    case 'porter.board':
+    case 'porter.detrain':
+    case 'laborer.startLoad':
+    case 'laborer.advanceLoad':
+    case 'laborer.beginUnload':
+    case 'freightAgent.stockOutbound':
+    case 'freightAgent.clearInbound':
+    case 'freightAgent.unjam':
+    case 'mainline.clearance':
+    case 'mainline.modify':
+    case 'mainline.redFlag':
+    case 'mainline.yardOffice':
+    case 'redFlag.play':
+      return 'action';
+
+    /**
+     * `localOps.choose` IS AN ANNOUNCEMENT, NOT BOOKKEEPING — moved out 2026-09-09 after the first
+     * real play. It is the line that reads "Player Bot 1 chose to SWITCH — six Moves to shunt cars
+     * around the yard": the heading for everything that follows, and at zero dwell nobody ever saw
+     * it, so a bot's turn began with no indication of what it was about to do.
+     */
+    case 'localOps.choose':
+      return 'action';
+
+    // Ending a phase or a turn, and voting. Nothing to see: the consequences were the thing, and
+    // there are more of these than of anything else.
+    case 'loadUnload.end':
+    case 'draw.end':
+    case 'switch.end':
+    case 'freightAgent.end':
+    case 'game.extend':
+      return 'bookkeeping';
+  }
+}
+
+/**
+ * The widest multiplier that is a speed rather than a mistake.
+ *
+ * `pace` has no lower surprise — 0 means off — but an unbounded upper one does: `?pace=300` from
+ * somebody typing 3.00, or a corrupt `localStorage` value, would give a switching move a five-minute
+ * dwell and look exactly like a frozen board. Twenty is far past any speed anyone would choose and
+ * well short of unusable.
+ *
+ * RAISED FROM TEN 2026-09-10, because the ceiling turned out not to be theoretical: Jesse played at
+ * 10× — the top of the ladder — and reported it *"still a bit fast, but followable"*. A control whose
+ * slowest setting is not slow enough for the person using it has the wrong ceiling, not the right one
+ * held firmly.
+ */
+export const MAX_PACE = 20;
+
+/**
+ * The speeds the on-screen control offers, slowest last.
+ *
+ * `0` is off: every move is drawn at once, as it was before v0.8.0 — TODO #18's "a player who has
+ * seen it a hundred times will want it off". The ladder runs well past 1 because that is what the
+ * first real play asked for: Jesse reached for 7×, and although the `?pace=` he used never took
+ * effect (the splash replaces the query string, so the play page only ever saw `?lobby`), the wish
+ * was real. Watching a bot shunt cars is the point of this feature, and it is worth as long as it
+ * takes.
+ */
+export const PACE_LEVELS = [0, 0.5, 1, 2, 3, 5, 7, 10, 15, 20] as const;
+
+/**
+ * How long to show one step, in ms, at a given speed.
+ *
+ * `pace` scales every tier by the same factor, so **the tiers stay in proportion at any speed** — a
+ * switching move outlasts an ordinary action at 0.5× and at 3× alike. That is deliberate: the
+ * relative weighting is the design (a train moving is worth more attention than a card changing
+ * hands), and the multiplier is only how fast the whole thing runs. `0` means do not animate at all.
+ */
+export function dwellFor(cause: StepCause, pace = 1): number {
+  return Math.round(DWELL[kindOf(cause)] * Math.min(MAX_PACE, Math.max(0, pace)));
+}
+
+/**
+ * How much of the speed control a PHASE gets — damped, not the full multiplier.
+ *
+ * Phases were pinned at their tabled beat in v0.8.0.3, because scaling them with everything else put
+ * a wall of clock-ticking after a player's own move. That was right about the cost and wrong about
+ * the need: at 10× the caption row goes past faster than the sentence on it can be read. Jesse,
+ * 2026-09-10: *"phases displayed on the upper line go by too quickly still. Should be 4 times as
+ * long — at a guess. Maybe use the speed multiplier for that too?"*
+ *
+ * So they scale, at a third of the rate. That lands exactly on his guess — 10× gives a phase four
+ * times its tabled beat — while leaving 1× untouched, and it stays affordable because phase beats
+ * cluster rather than accumulate: measured over 60 pushes, a push carries **1.0 phase beat on
+ * average and 4 at worst**, so the wait after a move goes to ~2.4s typical and ~10s at its very
+ * worst rather than the minutes a full multiplier would have cost.
+ *
+ * Below 1× it simply follows the multiplier: somebody asking for everything faster means the phases
+ * too.
+ */
+function phaseSpeed(pace: number): number {
+  return pace <= 1 ? pace : 1 + (pace - 1) / 3;
+}
+
+/**
+ * How long to show one STEP — the form the queue actually uses.
+ *
+ * A step that said nothing gets no dwell, whatever caused it. That is one rule covering two cases
+ * arrived at separately: a phase where nothing happened (Jesse, 2026-09-09 — *"if nothing happens
+ * during a phase then we shouldn't lose time to it"*), and a phase that only handed the turn on,
+ * which changes the board but has nothing on it to look at. Structurally typed so this file does not
+ * have to import `DisplayStep` back from the module that imports `StepCause` from it.
+ */
+export function dwellForStep(
+  step: { cause: StepCause; player: number | null; lines: readonly unknown[]; frame: { table: object } },
+  pace = 1,
+): number {
+  // Off means off, for the clock as much as for anybody's move.
+  if (pace <= 0) return 0;
+  /**
+   * THE SPEED CONTROL IS ABOUT OTHER PEOPLE, NOT ABOUT THE CLOCK.
+   *
+   * A phase keeps its tabled beat at every speed. Measured over 40 turns of a real 3-seat game, the
+   * waiting split almost evenly — 21.0s of other players against 21.0s of phases turning over — so
+   * scaling both put 105 seconds of clock-ticking into a 5× game, all of it after the player's own
+   * move and none of it anything to watch. Jesse, from that game: *"after my turn, when I actually
+   * execute my turn, I'm still subject to that same delay before it moves on. That makes no sense."*
+   *
+   * The phase still gets its beat (TODO #18) — it just does not get longer because somebody wanted
+   * to watch a bot shunt cars.
+   */
+  const speed = step.player === null ? phaseSpeed(pace) : pace;
+  if (step.lines.length > 0) return dwellFor(step.cause, speed);
+  /**
+   * A SILENT STEP EARNS A BEAT ONLY WHEN THE CLOCK TURNED OVER — which is TODO #18 exactly: "give
+   * every phase a visible beat", for New Train, the Mainline and the shift change.
+   *
+   * Measured, because the obvious rule was wrong twice. "No narration, no dwell" looked right and
+   * silently killed #18: a phase can move trains without saying anything, and those steps were being
+   * flashed past. "Anything that changed the board" is wrong the other way: `submit()` steps
+   * `advance()` about 4.6 times per intent and most of those merely hand the turn on, so beating on
+   * all of them would cost a quarter of an hour a game.
+   */
+  const table = step.frame.table as Record<string, unknown>;
+  const turned = 'phase' in table || 'phaseKey' in table || 'stage' in table || 'day' in table;
+  return turned ? dwellFor(step.cause, speed) : 0;
+}
+
+/**
+ * How many steps in a queue are actually going to be WATCHED.
+ *
+ * This is the number the "N behind" counter shows, and it is deliberately not `queue.length`. With
+ * bookkeeping dwelling at zero, a backlog of 17 where 12 are `*.end` would read "17", plummet to 5
+ * the instant it started, and then crawl — which is not the steady countdown the counter is for.
+ * Thirteen dwelling steps means thirteen things you are going to see.
+ */
+export function watchableCount(causes: readonly StepCause[], pace = 1): number {
+  return causes.filter((c) => dwellFor(c, pace) > 0).length;
+}

src/sim/public-delta.ts

@@ -0,0 +1,194 @@
+/**
+ * Delta for the SEATLESS public frame — v0.8.0, `docs/plans/jitsi-common-board.md` § v0.8.0 § 3.
+ *
+ * `frame-delta.ts` solves the same-shaped problem for a seated player's `Frame` and does NOT carry
+ * over, which is worth saying plainly because reusing it looks obvious and is wrong. It nulls three
+ * TOP-LEVEL keys — `cells`, `facilities`, `division` — and a `PublicFrame` has only the last of
+ * those. Its `cells` and `facilities` live one level down, inside `districts[]`, one entry per seat,
+ * and that is where nearly all of the bytes are.
+ *
+ * **So the districts are deltaed PER SEAT rather than as one array.** One accepted intent changes
+ * one district; comparing the whole array as a unit would resend every other player's board on
+ * every step, which is exactly the cost this exists to avoid. On a four-player table that is three
+ * boards of waste per step, and a step is emitted for every bot move as well as every human one.
+ *
+ * It is also a TRUE PARTIAL rather than a full frame with holes in it, which is the other place
+ * `frame-delta.ts` does not carry over. See `PublicFrameDelta` below for the measurement that forced
+ * that; in short, most steps change one field and shipping the other thirty-four cost 16.7 MB a game.
+ *
+ * The convention that does carry over, kept identical so a reader of one file can read the other:
+ * an absent or `null` field means "unchanged since the last thing sent to this receiver", and the
+ * receiving side merges against the last full frame it actually holds. A first connect or a
+ * reconnect after a gap sends a full frame instead — the display stream resets rather than replaying
+ * (§ v0.8.0).
+ *
+ * Node-free by design, like `frame-delta.ts`: the server and the browser both import this directly.
+ */
+
+import type { CellView, DivisionView, FacilityView, PublicDistrict, PublicFrame } from './view.ts';
+
+/**
+ * One district with its two heavy fields nulled when unchanged.
+ *
+ * `seat` is the identity and is always present — it is what the receiver matches on. `player` and
+ * `name` are always sent too, and deliberately: Employee Rotation moves players between districts,
+ * so the pairing of seat to player is itself news, and it costs two small fields to never have to
+ * reason about whether a relabelling was missed.
+ */
+export type PublicDistrictDelta = Omit<PublicDistrict, 'cells' | 'facilities'> & {
+  cells: CellView[] | null;
+  facilities: FacilityView[] | null;
+};
+
+/** The shared-table half of a `PublicFrame` — everything that is not the Division or a district. */
+type PublicTable = Omit<PublicFrame, 'division' | 'districts'>;
+
+/**
+ * A `PublicFrame` reduced to WHAT CHANGED.
+ *
+ * **Partial, not a full frame with holes**, and that distinction was measured rather than assumed.
+ * The first version of this spread `...next` and nulled only the board fields, so every step shipped
+ * all 35 top-level properties even when the sole change was whose turn it was. Once TODO #18 gave
+ * automatic phases their own steps, most steps became exactly that — a turn handed on, nothing to
+ * look at — and a full 6-day game cost **19.4 MB**, of which **16.7 MB was those silent steps at
+ * ~11 KB each**. As a partial they are a few dozen bytes.
+ */
+export type PublicFrameDelta = {
+  /** Only the shared-table fields whose value differs from the previous frame. */
+  table: Partial<PublicTable>;
+  /** The Division, only when it changed. */
+  division: DivisionView[] | null;
+  /** Only the districts that changed, each carrying only the board fields that changed. */
+  districts: PublicDistrictDelta[];
+};
+
+const same = (a: unknown, b: unknown): boolean => JSON.stringify(a) === JSON.stringify(b);
+
+const TABLE_KEYS = (frame: PublicFrame): (keyof PublicTable)[] =>
+  (Object.keys(frame) as (keyof PublicFrame)[]).filter(
+    (k): k is keyof PublicTable => k !== 'division' && k !== 'districts',
+  );
+
+/**
+ * `previous` is the last public frame actually sent to THIS receiver, or `null` for a first connect
+ * or a reset — in which case everything is sent in full.
+ */
+export function deltaPublicFrame(previous: PublicFrame | null, next: PublicFrame): PublicFrameDelta {
+  const before = new Map(previous?.districts.map((d) => [d.seat, d]) ?? []);
+  const table: Partial<PublicTable> = {};
+  for (const key of TABLE_KEYS(next)) {
+    if (previous === null || !same(previous[key], next[key])) {
+      (table as Record<string, unknown>)[key] = next[key];
+    }
+  }
+  const districts: PublicDistrictDelta[] = [];
+  for (const d of next.districts) {
+    const was = before.get(d.seat);
+    const cells = was && same(was.cells, d.cells) ? null : d.cells;
+    const facilities = was && same(was.facilities, d.facilities) ? null : d.facilities;
+    // A district with nothing new is left out entirely rather than sent as a row of nulls: on a
+    // four-player table three of them are unchanged on every single step.
+    if (was && cells === null && facilities === null && same(was, d)) continue;
+    districts.push({ ...d, cells, facilities });
+  }
+  return {
+    table,
+    division: previous !== null && same(previous.division, next.division) ? null : next.division,
+    districts,
+  };
+}
+
+/** The receiving side: merges a delta back onto the last full public frame this receiver holds. */
+export function applyPublicDelta(previous: PublicFrame | null, delta: PublicFrameDelta): PublicFrame {
+  const base = previous ?? (delta.table as PublicTable);
+  const merged = { ...base, ...delta.table } as PublicTable;
+  const bySeat = new Map((previous?.districts ?? []).map((d) => [d.seat, d]));
+  for (const d of delta.districts) {
+    const was = bySeat.get(d.seat);
+    bySeat.set(d.seat, {
+      ...d,
+      cells: d.cells ?? need(was?.cells, `districts[seat ${d.seat}].cells`),
+      facilities: d.facilities ?? need(was?.facilities, `districts[seat ${d.seat}].facilities`),
+    });
+  }
+  return {
+    ...merged,
+    division: delta.division ?? need(previous?.division, 'division'),
+    districts: [...bySeat.values()].sort((a, b) => a.seat - b.seat),
+  };
+}
+
+/**
+ * A delta that says "unchanged" against a receiver that has nothing to merge onto is a bug in the
+ * SENDER's bookkeeping, not a recoverable state — it means the two sides disagree about what has
+ * been delivered, and quietly producing a frame with a missing board would put a blank district in
+ * front of a player. `frame-delta.ts` throws in the same situation and for the same reason.
+ */
+function need<T>(value: T | undefined, what: string): T {
+  if (value === undefined) {
+    throw new Error(`deltaPublicFrame said "${what}" is unchanged, but there is no previous frame to merge onto`);
+  }
+  return value;
+}
+
+/** A face-up or face-down pile a card can move to or from, as the display addresses it. */
+export type PileKey = 'home' | 'salvage' | `dept${number}`;
+
+/**
+ * WHICH PILES A STEP MOVED — derived, never sent.
+ *
+ * The receiver already holds the frame before a step and the frame after it, so which pile changed
+ * is a diff rather than something the wire has to carry. That matters twice over: nothing is added
+ * to the protocol, and it cannot drift out of step with the projection the way a hand-maintained
+ * hint would.
+ *
+ * WHY IT IS NEEDED AT ALL. A player watching somebody else draw a card sees seven seconds of an
+ * unchanged board — the step holds the screen, and the only thing that moved is a number in a panel
+ * they were not looking at. Jesse, playing v0.8.0.4 at 10×: *"many operations still occurred too fast
+ * for me to see"*, which was never about duration. Lighting the pile is what tells the eye where.
+ *
+ * WHAT EACH ACTION MOVES, measured across four seeds rather than reasoned about:
+ *
+ * | intent                  | piles                                                    |
+ * | ----------------------- | -------------------------------------------------------- |
+ * | `draw.fromHomeOffice`   | `home` — the COUNT only; the card itself stays private    |
+ * | `draw.fromDepartment`   | that `dept`, and `home` too when the pile refills from it |
+ * | `card.discard`          | that `dept`                                               |
+ * | `card.play`             | `salvage`, or nothing here when it lands on the board      |
+ * | switching, new trains   | nothing here — those show on the board itself             |
+ */
+/**
+ * Mainline cards that became a different card between two public boards — a Realignment, which is the
+ * one play that changes the Division itself.
+ *
+ * Playtest, 2026-09-15: *"is it possible to flash the mainline card when it gets changed by realignment?
+ * This would be more obvious to see what's happening on the map."* Detected the same way `changedPiles`
+ * detects a pile moving — by comparing the two boards the queue already holds — rather than by reading
+ * the event, so the flash lands with the step that shows it and not when the intent arrived.
+ */
+export function changedDivisionCards(before: PublicFrame | null, after: PublicFrame): number[] {
+  if (before === null) return [];
+  const out: number[] = [];
+  after.division.forEach((node, i) => {
+    const was = before.division[i];
+    if (was && was.kind === 'ml' && node.kind === 'ml' && was.label !== node.label) out.push(i);
+  });
+  return out;
+}
+
+export function changedPiles(before: PublicFrame | null, after: PublicFrame): PileKey[] {
+  if (before === null) return [];
+  const out: PileKey[] = [];
+  if (before.deck !== after.deck) out.push('home');
+  after.departmentDepth.forEach((depth, i) => {
+    // The TOP as well as the depth: taking the face-up card and replacing it leaves the count alone
+    // and changes the card everybody can see, which is the half that matters to a watcher.
+    if (before.departmentDepth[i] !== depth || before.departments[i] !== after.departments[i]) {
+      out.push(`dept${i}`);
+    }
+  });
+  if (before.salvage.depth !== after.salvage.depth || before.salvage.top !== after.salvage.top) {
+    out.push('salvage');
+  }
+  return out;
+}

src/sim/replay.ts

@@ -34,6 +34,8 @@ import type { Intent } from '../engine/intents.ts';
 import { legalActions } from '../engine/legal.ts';
 import { createGame } from '../engine/setup.ts';
 import type { Facility, GameConfig, GameState } from '../engine/state.ts';
+import { actingPlayer } from '../engine/state.ts';
+import { reasonSentence } from '../web/panels.ts';
 import { developerBot, lastChoiceReason } from './bot.ts';
 import { carLabel, cuesFor, idleNote, isVisible, narrate } from './narrate.ts';
 // The view-model lives in its own module so the browser build can import it without dragging in
@@ -77,6 +79,8 @@ export function record(seed: number, length: GameLength, maxSteps = 100_000): Re
   const narrateCtx = {
     cardName: (id: string) => cardName(s, id),
     trainName: (id: string) => trainName(s, id),
+    // A player index is not a seat index, so the fallback names no number at all — see `web/game.ts`.
+    playerName: (p: number) => s.players[p]?.name ?? 'another player',
   };
 
   // Tracks whether a phase did anything, so an empty one can say so rather than ending silently.
@@ -135,7 +139,7 @@ export function record(seed: number, length: GameLength, maxSteps = 100_000): Re
     if (s.status === 'finished') break;
     if (!r.needsInput) continue;
 
-    const actor = s.clock.pendingDecision !== null ? s.clock.superintendent : s.clock.currentActor;
+    const actor = actingPlayer(s);
     if (actor === null) break;
     const options = legalActions(s, actor);
     if (options.length === 0) break;
@@ -147,12 +151,26 @@ export function record(seed: number, length: GameLength, maxSteps = 100_000): Re
     push(applied.events);
   }
 
+  /**
+   * IN WORDS, NOT AS AN ENUM (`TODO.md` #34). This heading read `loss — revenueFloor`, which is
+   * exactly the defect Gitea#16 was filed about on the playable page — it just outlived the fix
+   * here, because nothing player-facing pointed at it. `reasonSentence` is shared rather than
+   * reimplemented, so the replay and the results screen cannot end up explaining the same ending
+   * two different ways.
+   *
+   * Fed the LAST frame, which is the state the outcome was decided in and is already recorded.
+   * Tags are stripped: this lands in an `<h1>` and in a console line, neither of which wants markup.
+   */
   const o = s.outcome;
+  const last = frames[frames.length - 1];
+  const why = o && last ? reasonSentence(last, o, last.day).replace(/<[^>]+>/g, '') : '';
   return {
     seed,
     length,
     frames,
-    outcome: o ? `${o.result} — ${o.reason} · final Revenue ${s.players[0]?.revenue ?? 0}` : 'unfinished',
+    outcome: o
+      ? `${o.result === 'win' ? 'won' : 'lost'} — ${why} Final Revenue ${s.players[0]?.revenue ?? 0}.`
+      : 'unfinished',
   };
 }
 
@@ -214,7 +232,7 @@ export function compress(frames: Frame[]): Packed {
       const fi = c.facility ? f.facilities.indexOf(c.facility) : -1;
       // `trains` rides whole rather than being interned: it changes almost every frame, so a table
       // of them would be as long as the frames are and buy nothing.
-      return [ci, wi, c.enhancements, c.cars, fi, c.trains, c.adTracks, c.enhancementsWhat, c.standingWest];
+      return [ci, wi, c.enhancements, c.cars, fi, c.trains, c.adTracks, c.enhancementsWhat, c.standingWest, c.enhancementsSpent];
     });
     return { ...f, cells } as unknown as Frame;
   });
@@ -248,7 +266,7 @@ export function rehydrateCells(
   facs: unknown[],
 ): unknown[] {
   return packed.map((row) => {
-    const p = row as [number, number, string[], string[], number, unknown, unknown, string[], number];
+    const p = row as [number, number, string[], string[], number, unknown, unknown, string[], number, boolean[]];
     const c = cards[p[0]] as [number, number, string, string, boolean, string[]];
     // Tolerant the same way `standingWest` below is: an array rides through as-is, a lone object
     // (an older recording's singular `train`) is wrapped into a one-train roster, and null or
@@ -268,6 +286,10 @@ export function rehydrateCells(
       // cut ahead of or behind the engine exactly as the live board does. Absent in older recordings,
       // which read as 0 — the whole cut east of the engine, which is what they used to draw anyway.
       standingWest: p[8] ?? 0,
+      // Which dispatch devices were spent (#101), so a replay strikes a used Radio through exactly
+      // as the live board does. Absent in recordings made before it existed, which read as no
+      // device spent — the same thing they drew at the time, so an old replay is unchanged.
+      enhancementsSpent: p[9] ?? [],
     };
   });
 }
@@ -492,7 +514,11 @@ function boxes(items, cap, cls) {
 
 function render() {
   const f = FRAMES[i];
-  $('turnchart').innerHTML = turnChartHtml(f, f.actor === null ? null : 'Player ' + (f.actor + 1));
+  $('turnchart').innerHTML = turnChartHtml(
+    f,
+    f.actor === null ? null : 'Player ' + (f.actor + 1),
+    f.players.length > 1 ? 'Player ' + (f.superintendent + 1) : null,
+  );
   $('super').textContent = 'P' + f.superintendent;
   $('rev').textContent = f.revenue;
   $('rev').className = 'big ' + (f.revenue < 0 ? 't-bad' : f.revenue > 0 ? 't-good' : '');

src/sim/save-replay.ts

@@ -52,6 +52,21 @@ export type PlayedGame = {
 export function playForReplay(seed: number, policy: BotPolicy, maxTurns = 50_000): PlayedGame {
   const game = newGame(seed);
   for (let t = 0; t < maxTurns; t++) {
+    /**
+     * §3.3, EXTENDED PLAY (Gitea#11) — a recorded replay is a game played to its end.
+     *
+     * The timetable running out leaves the game on "play one more Day?", where `currentActor` is
+     * null and this loop would otherwise stop — recording a file that replays to a question nobody
+     * answered rather than to a finished game. A recording bot plays the timetable it was dealt, the
+     * same rule `playGame` follows, so it declines and the file ends where a real game would.
+     */
+    if (game.state.status === 'awaitingExtension') {
+      const voter = game.state.extensionVotes.findIndex((v) => v === null);
+      if (voter < 0) break;
+      if (!submit(game, { type: 'game.extend', player: voter, agree: false }, voter)) break;
+      continue;
+    }
+
     const actor = currentActor(game);
     if (actor === null) break;
     const options = legalActions(game.state, actor);

src/sim/switch-planner.ts

@@ -0,0 +1,347 @@
+/**
+ * Component 17b — planning a whole switching turn before making the first Move.
+ *
+ * Dev-side, like the rest of the bot. The developer bot's switching branch chooses ONE move at a time
+ * from a ladder of rules, and its own comment names what that cannot do: "a strong player would use
+ * the six Moves to re-order the consist — that is the game's central switching puzzle, and this bot
+ * does not attempt it." This attempts it, for one turn at a time.
+ *
+ * WHY SEARCH IS FAIR HERE. A switching turn draws no card and rolls no die, so trying sequences on a
+ * copy of the game is exactly what a player does by looking at the board. The score below reads only
+ * what a player can see — the district, the cars on the trains, the facilities — and never the deck.
+ *
+ * WHY NOT EVERY SEQUENCE. Measured 2026-09-14 over 30 switching turns from bot games: a median turn
+ * reaches 229 distinct positions, but 11 of 30 passed 20,000, because setting cars out is free and a
+ * crew can leave them in a great many places. So the search keeps the best `beam` positions at each
+ * step and stops at `budget` positions tried. Small turns are searched completely inside that.
+ *
+ * THE SCORE IS OF WHERE THE TURN ENDS, not of what it did, and it starts from Jesse's ruling
+ * (2026-09-14): "players will attempt to deliver / pick up cars even if it delays trains." So a car
+ * put where it can be worked is worth a point, and a train left away from the Office costs a quarter
+ * of one. The weights are a starting point to measure, not a result.
+ */
+
+import { areaAtSeat, areaOf, commitEvents, facilityCarTypes, prepareIntent, withRouteCache } from '../engine/apply.ts';
+import { badlyMadeUp, isExpedited } from '../engine/advance.ts';
+import { MAX_CONSIST } from '../engine/content.ts';
+import type { Intent } from '../engine/intents.ts';
+import { legalSwitchingActions } from '../engine/legal.ts';
+import { cloneTally, coordKey, seatOf, turnOf } from '../engine/state.ts';
+import type { Facility, GameState, GridCoord, PlayerIndex, RollingStock, TrackCard } from '../engine/state.ts';
+
+export const SWITCH_WEIGHTS = {
+  /** A car standing where its industry can load or unload it — the point of switching. */
+  spot: 1.0,
+  /** The same, past what the industry's boxes can work at once. */
+  spotBeyondCapacity: 0.25,
+  /** A car the industry cannot work, taking room on its track. */
+  junkOnIndustry: -0.5,
+  /** A finished car — loaded at a shipper, emptied at a receiver — still waiting to be lifted. */
+  finishedLeft: -0.15,
+  /** A car on one of this district's trains that some industry here would work. */
+  carriedWanted: 0.35,
+  /** The same car left on ordinary track, where a later turn can fetch it. */
+  stagedWanted: 0.2,
+  /** A coach kept with its train, or parked at the Office where §A.4 allows it. */
+  coachWithTrain: 0.3,
+  /** A coach left anywhere else, where no Porter can work it. */
+  coachStranded: -0.3,
+  /** Anything but a coach standing on the Office square — the next arrival collides (§8.3). */
+  fouling: -3,
+  /** A train that ends the turn away from the Office and so cannot highball next Mainline Phase. */
+  trainAway: -0.25,
+  /** On top of that, an expedited train — Q3 charges a Revenue point every Phase it is away. */
+  expeditedAway: -1.0,
+  /** A train that could not leave even from the Office — engine buried, caboose mid-train (§8.2). */
+  notMadeUp: -0.6,
+  /** Tie-breaks, so equal outcomes prefer the plan that does less. */
+  perMove: -0.02,
+  perSetOut: -0.005,
+  /** A maneuver card spent — Flying Switch — so the planner plays one only when it buys something. */
+  cardSpent: -0.1,
+} as const;
+
+export type PlanOptions = {
+  budget: number;
+  beam: number;
+  /**
+   * Search Flying Switch alongside Moves, set-outs and sorts. On by default but UNMEASURED: the card
+   * is dealt 0 copies (Jesse, 2026-08-26), so over 400 paired seeds turning it on changed nothing —
+   * it is here so the planner can use the card the day it is dealt again.
+   */
+  flyingSwitch?: boolean;
+};
+/**
+ * Measured 2026-09-14, paired over 400 seeds against 3000/48: 2000/32 cost −0.02 ± 0.01 (t = −1.68,
+ * inside the noise) at half the time per turn; 1000/24 cost −0.06 ± 0.02 (t = −2.65) for little more.
+ */
+export const DEFAULT_PLAN: PlanOptions = { budget: 2000, beam: 32, flyingSwitch: true };
+
+export type SwitchPlan = {
+  /** The intents to submit, in order. Empty when nothing beats stopping where the crew stands. */
+  steps: Intent[];
+  /** `switchFingerprint` before each step, and after the last — so a caller can tell it is on plan. */
+  keys: string[];
+  rootScore: number;
+  score: number;
+  /** Positions tried. */
+  expanded: number;
+  /** False when the budget ran out before the search did. */
+  complete: boolean;
+};
+
+/**
+ * A copy of the game that a switching intent can be applied to without touching the original.
+ *
+ * NOT `structuredClone`, of the state or even of the district. A switching intent writes only the
+ * cars standing on cards, the industry tracks, the district's A/D and held lists, the consist and
+ * position of the trays standing in it, this player's turn and the tally — so exactly those arrays are
+ * copied and everything else is shared by reference. Measured 2026-09-14, deep-cloning the district
+ * was 44% of all planning time.
+ *
+ * `test/switch-planner.test.ts` proves across real games that planning leaves the original
+ * byte-identical — which is what fails first if a reducer ever starts writing somewhere new, or
+ * starts mutating a car or a card in place instead of replacing it.
+ */
+export function forkForSwitching(s: GameState, player: PlayerIndex): GameState {
+  const seat = seatOf(s, player);
+  const area = areaAtSeat(s, seat);
+  const grid = new Map<string, TrackCard>();
+  for (const [key, card] of area.grid) {
+    const f = card.facility;
+    grid.set(key, {
+      ...card,
+      standing: [...card.standing],
+      facility: f ? { ...f, industryTrack: { cars: [...f.industryTrack.cars] } } : f,
+    });
+  }
+  const officeAreas = new Map(s.officeAreas);
+  officeAreas.set(seat, {
+    ...area,
+    grid,
+    adOccupancy: [...area.adOccupancy],
+    heldAtLimits: [...area.heldAtLimits],
+    dispatchUsedToday: [...area.dispatchUsedToday],
+  });
+  const trays = new Map(s.trays);
+  for (const [id, t] of s.trays) {
+    if (t.position.at === 'grid' && t.position.seat === seat) trays.set(id, { ...t, consist: [...t.consist] });
+  }
+  const turns = new Map(s.turns);
+  const turn = s.turns.get(player)!;
+  turns.set(player, { ...turn, freightWorked: { ...turn.freightWorked } });
+  // Flying Switch spends its card (`spendCard`): the hand map is rewritten and the Salvage Yard grows.
+  const decks = { ...s.decks, hands: new Map(s.decks.hands), salvageYard: [...s.decks.salvageYard] };
+  return { ...s, officeAreas, trays, turns, decks, tally: cloneTally(s.tally) };
+}
+
+const carList = (xs: readonly RollingStock[]): string =>
+  xs.map((c) => `${c.type}${c.loaded ? '+' : '-'}${c.origin ?? ''}`).join(',');
+
+/**
+ * Everything a switching intent can change, as a string — two positions with the same fingerprint
+ * are the same position as far as the rest of the turn is concerned. Identical cars are not told
+ * apart, which is right: no intent names a car.
+ */
+export function switchFingerprint(s: GameState, player: PlayerIndex): string {
+  const seat = seatOf(s, player);
+  const parts: string[] = [];
+  for (const [id, t] of s.trays) {
+    if (t.position.at !== 'grid' || t.position.seat !== seat) continue;
+    const { row, col } = t.position.coord;
+    parts.push(`${id}@${row},${col}/${t.facing}/${t.railFacing ?? ''}/${t.engineAt}:${carList(t.consist)}`);
+  }
+  for (const [key, card] of areaOf(s, player).grid) {
+    const track = card.facility?.kind === 'freight' ? card.facility.industryTrack.cars : null;
+    if (card.standing.length === 0 && card.standingWest === 0 && (track?.length ?? 0) === 0) continue;
+    parts.push(`${key}=${carList(card.standing)}|${card.standingWest}|${track ? carList(track) : ''}`);
+  }
+  const turn = turnOf(s, player);
+  parts.push(`m${turn.movesRemaining}`, JSON.stringify(turn.freightWorked), `h${(s.decks.hands.get(player) ?? []).join(',')}`);
+  return parts.join(';');
+}
+
+/**
+ * §9.3 — an outbound industry loads EMPTY cars of its commodity, an inbound one unloads LOADED ones —
+ * but never a load that was made in this same district (v0.4.9e, `LOADED_IN_THIS_DISTRICT`).
+ */
+function works(f: Facility, c: RollingStock, seat: number): boolean {
+  if (f.kind !== 'freight' || !facilityCarTypes(f).includes(c.type)) return false;
+  return (!c.loaded && f.allows.outbound) || (c.loaded && f.allows.inbound && c.origin !== seat);
+}
+
+/**
+ * The car an industry has finished with. Only decidable at a one-way industry: at one that both
+ * ships and receives, a loaded car may be a delivery still waiting to be unloaded.
+ */
+function finished(f: Facility, c: RollingStock): boolean {
+  if (f.kind !== 'freight' || !facilityCarTypes(f).includes(c.type)) return false;
+  if (f.allows.outbound && !f.allows.inbound) return c.loaded;
+  if (f.allows.inbound && !f.allows.outbound) return !c.loaded;
+  return false;
+}
+
+const same = (a: GridCoord, b: GridCoord): boolean => a.row === b.row && a.col === b.col;
+
+/** How good this district's position is for the rest of the game, in rough Revenue points. */
+export function evaluateSwitching(s: GameState, player: PlayerIndex): number {
+  const W = SWITCH_WEIGHTS;
+  const area = areaOf(s, player);
+  const seat = seatOf(s, player);
+  const officeKey = coordKey(area.officeCoord);
+  const passengerOffice = area.grid.get(officeKey)?.facility?.kind === 'passenger';
+  let v = 0;
+
+  const withRoom: Facility[] = [];
+  for (const card of area.grid.values()) {
+    const f = card.facility;
+    if (!f || f.kind !== 'freight') continue;
+    if (f.industryTrack.cars.length < MAX_CONSIST) withRoom.push(f);
+    const cap = Math.max(1, f.capacity.outbound + f.capacity.inbound);
+    let working = 0;
+    for (const c of f.industryTrack.cars) {
+      if (works(f, c, seat)) v += ++working <= cap ? W.spot : W.spotBeyondCapacity;
+      else if (finished(f, c)) v += W.finishedLeft;
+      else v += W.junkOnIndustry;
+    }
+  }
+  const wanted = (c: RollingStock): boolean => withRoom.some((f) => works(f, c, seat));
+
+  for (const [key, card] of area.grid) {
+    if (card.facility?.kind === 'freight') continue;
+    const atOffice = key === officeKey;
+    for (const c of card.standing) {
+      if (c.type === 'coach') v += atOffice && passengerOffice ? W.coachWithTrain : W.coachStranded;
+      else if (atOffice) v += W.fouling;
+      else if (wanted(c)) v += W.stagedWanted;
+    }
+  }
+
+  for (const t of s.trays.values()) {
+    if (t.position.at !== 'grid' || t.position.seat !== seat) continue;
+    for (const c of t.consist) {
+      if (c.type === 'coach') v += passengerOffice ? W.coachWithTrain : 0;
+      else if (wanted(c)) v += W.carriedWanted;
+    }
+    if (t.trainNumber === null) continue;
+    if (!same(t.position.coord, area.officeCoord)) {
+      v += W.trainAway;
+      if (isExpedited(t)) v += W.expeditedAway;
+    }
+    if (badlyMadeUp(t)) v += W.notMadeUp;
+  }
+  return v;
+}
+
+/**
+ * For ORDERING the beam only, never for choosing the plan: a Move toward an industry changes nothing
+ * the score can see until the car is set out, so without this the beam would drop the approach in
+ * favour of positions that merely look tidy.
+ */
+function approach(s: GameState, player: PlayerIndex): number {
+  const area = areaOf(s, player);
+  const seat = seatOf(s, player);
+  const targets: { at: GridCoord; f: Facility }[] = [];
+  for (const [key, card] of area.grid) {
+    const f = card.facility;
+    if (!f || f.kind !== 'freight' || f.industryTrack.cars.length >= MAX_CONSIST) continue;
+    const [row, col] = key.split(',').map(Number);
+    targets.push({ at: { row: row!, col: col! }, f });
+  }
+  let bonus = 0;
+  for (const t of s.trays.values()) {
+    if (t.position.at !== 'grid' || t.position.seat !== seat) continue;
+    const here = t.position.coord;
+    for (const c of t.consist) {
+      let nearest = Infinity;
+      for (const { at, f } of targets) {
+        if (works(f, c, seat)) nearest = Math.min(nearest, Math.abs(at.row - here.row) + Math.abs(at.col - here.col));
+      }
+      if (nearest !== Infinity) bonus += 0.1 / (1 + nearest);
+    }
+  }
+  return bonus;
+}
+
+const SEARCHED = new Set<Intent['type']>(['switch.move', 'switch.dropCars', 'switch.sortConsist']);
+
+type Node = {
+  s: GameState;
+  steps: Intent[];
+  keys: string[];
+  moves: number;
+  setOuts: number;
+  cards: number;
+  score: number;
+  rank: number;
+};
+
+/** The best way found to spend what is left of this switching turn. Never mutates `s`. */
+export function planSwitchingTurn(
+  s: GameState,
+  player: PlayerIndex,
+  opts: PlanOptions = DEFAULT_PLAN,
+): SwitchPlan {
+  const W = SWITCH_WEIGHTS;
+  const scoreOf = (st: GameState, moves: number, setOuts: number, cards: number): number =>
+    evaluateSwitching(st, player) + moves * W.perMove + setOuts * W.perSetOut + cards * W.cardSpent;
+  const searched = (type: Intent['type']): boolean =>
+    SEARCHED.has(type) || (opts.flyingSwitch === true && type === 'maneuver.flyingSwitch');
+
+  const rootKey = switchFingerprint(s, player);
+  const rootScore = scoreOf(s, 0, 0, 0);
+  const root: Node = { s, steps: [], keys: [rootKey], moves: 0, setOuts: 0, cards: 0, score: rootScore, rank: rootScore };
+  let best = root;
+  const seen = new Set([rootKey]);
+  let frontier: Node[] = [root];
+  let expanded = 0;
+  let complete = true;
+
+  search: while (frontier.length > 0) {
+    const next: Node[] = [];
+    for (const node of frontier) {
+      const movesLeft = turnOf(node.s, player).movesRemaining;
+      // Every candidate is decided against THIS position, inside one route cache, and only then applied
+      // to its own copy: deciding on the copy would re-walk routes the listing had just walked.
+      const decided = withRouteCache(node.s, () =>
+        legalSwitchingActions(node.s, player)
+          .filter((i) => searched(i.type) && (i.type === 'switch.dropCars' || movesLeft >= 1))
+          .map((i) => ({ i, r: prepareIntent(node.s, player, i) })),
+      );
+      for (const { i, r } of decided) {
+        if (expanded >= opts.budget) {
+          complete = false;
+          break search;
+        }
+        expanded++;
+        if (!r.ok) continue;
+        const f = forkForSwitching(node.s, player);
+        commitEvents(f, r.events);
+        const key = switchFingerprint(f, player);
+        if (seen.has(key)) continue;
+        seen.add(key);
+        const setOut = i.type === 'switch.dropCars';
+        const moves = node.moves + (setOut ? 0 : 1);
+        const setOuts = node.setOuts + (setOut ? 1 : 0);
+        const cards = node.cards + (i.type === 'maneuver.flyingSwitch' ? 1 : 0);
+        const score = scoreOf(f, moves, setOuts, cards);
+        const child: Node = {
+          s: f,
+          steps: [...node.steps, i],
+          keys: [...node.keys, key],
+          moves,
+          setOuts,
+          cards,
+          score,
+          rank: score + approach(f, player),
+        };
+        if (score > best.score + 1e-9) best = child;
+        next.push(child);
+      }
+    }
+    // A stable sort, so equal ranks keep `legalActions` order and the bot stays deterministic.
+    frontier = next.length > opts.beam ? next.sort((a, b) => b.rank - a.rank).slice(0, opts.beam) : next;
+  }
+
+  return { steps: best.steps, keys: best.keys, rootScore, score: best.score, expanded, complete };
+}

src/sim/turnchart.ts

@@ -19,6 +19,8 @@ export type TurnChartFrame = {
   phase: string;
   phaseKey: string;
   actor: number | null;
+  /** What the game has stopped to ask, when it has. Null while a phase is simply running. */
+  awaiting?: { asks: string; train: string } | null;
 };
 
 /**
@@ -27,7 +29,28 @@ export type TurnChartFrame = {
  * The first three are the rules text; Cargo and Supervisor Shift are written from what the engine
  * does, since the recovered sheet does not spell them out.
  */
-export function turnChartHtml(f: TurnChartFrame, actorName: string | null): string {
+/**
+ * `superName` is the player holding the Fedora, or null for a table where saying so is noise — one
+ * seat, where it is always you.
+ *
+ * REPORTED BY JESSE 2026-08-23, from a two-player game on StartOS: seat 1 played a train card and
+ * seat 2 was asked to build the train, "what's the rule for WHICH player builds a train?" The engine
+ * was right — §7 makes up a consist "starting with the Superintendent and working left" — but the
+ * board did not name the Superintendent ANYWHERE, so the question could not be answered from the
+ * screen. `Frame` has carried `superintendent` all along and the standalone replay printed it; the
+ * live game never did.
+ */
+/**
+ * `yours` is true when the player reading this is the one being waited on. It makes the line flash,
+ * because the commonest way a table stalls is somebody not noticing their own turn has come round
+ * (reported from a playtest). The replay viewers pass nothing: a recording waits on nobody.
+ */
+export function turnChartHtml(
+  f: TurnChartFrame,
+  actorName: string | null,
+  superName: string | null = null,
+  yours = false,
+): string {
   const PHASES: { key: string; label: string; tip: string; icon: string }[] = [
     {
       key: 'localOps',
@@ -39,7 +62,10 @@ export function turnChartHtml(f: TurnChartFrame, actorName: string | null): stri
     {
       key: 'newTrain',
       label: 'New Train',
-      tip: 'Timetabled trains for this Stage are built. New timetabled trains are randomly placed on the timetable. Held trains are built. Extra trains are built.',
+      // Says WHO builds, which is the question this phase actually raises at a table: the round
+      // starts with the Superintendent and works left, one car each, repeating (§7, Gap 9) — not
+      // with whoever played the card. An Extra is the exception: its player loads it as they choose.
+      tip: 'Timetabled trains for this Stage are built: each player adds ONE car at a time, starting with the Superintendent and working eastward, repeating until the consist is full or the Division Yard has nothing suitable. New timetabled trains are rolled onto the timetable. Held trains are built. An Extra is loaded by the player who played it.',
       // a locomotive being made up
       icon: '<rect class="ic" x="2" y="6" width="9" height="7" rx="1"/><path class="ic" d="M11 9h4v4h-4"/><circle class="icf" cx="5" cy="15" r="1.5"/><circle class="icf" cx="13" cy="15" r="1.5"/>',
     },
@@ -79,15 +105,56 @@ export function turnChartHtml(f: TurnChartFrame, actorName: string | null): stri
     );
   }).join('');
 
-  // An automatic phase is waiting on nobody, and saying so is more use than a blank.
-  const who = actorName ?? 'nobody — the Division is running itself';
+  /**
+   * WAITING ON WHOM, AND FOR WHAT.
+   *
+   * "nobody — the Division is running itself" is true of an automatic phase and was being printed
+   * over the top of three interruptions that are emphatically waiting on a person: §8.1's clearance
+   * ruling, the Yard Office offer and the Red Flag prompt. The Frame carried the phase's actor,
+   * which is null throughout the Mainline Phase, so a game stopped on a named player's decision
+   * reported that nobody was holding it up (Jesse, 2026-08-30). `Frame.actor` is `actingPlayer` now
+   * and answers who; `awaiting` says what, because "waiting on Bob" with no more than that is a
+   * game that looks stuck to everyone except Bob.
+   */
+  /**
+   * AN AUTOMATIC PHASE WAITS ON NOBODY, so it says what it is DOING instead of apologising.
+   *
+   * "nobody — the Division is running itself" reached the answer by negation, and left a player
+   * reading a line whose subject was an absence (Jesse, playtest 2026-09-16: it should say "waiting
+   * on <player>", or describe what the engine is doing — "the Division is moving trains during the
+   * mainline phase"). The phase's NAME is already printed on the line directly above this one, so
+   * these describe the work rather than repeating the label.
+   */
+  const DOING: Record<string, string> = {
+    mainline: 'the Division is moving trains',
+    newTrain: "the Division is building this Stage's trains",
+    loadUnload: 'the Division is working cargo',
+    shiftChange: 'the Division is changing shifts',
+  };
+  // Local Operations always has an actor, so its entry is the fallback rather than a case.
+  const who = actorName ?? DOING[f.phaseKey] ?? 'the Division is running itself';
+  // Only a person is WAITED ON. The Division is not waiting; it is working.
+  const waiting = actorName === null ? '' : 'waiting on ';
+  const asked = f.awaiting
+    ? ` <span class="tc-asks">${esc(f.awaiting.asks)} · ${esc(f.awaiting.train)}</span>`
+    : '';
+  const fedora =
+    superName === null
+      ? ''
+      : `<div class="tc-super" data-tip="The Superintendent holds the Fedora. Every third Stage — 3, 6, 9 and 12 — it passes one seat to the left. The office rules on whether a following train may depart, and every round that goes round the table starts here: the New Train make-up round, and the acting order within a phase." tabindex="0">` +
+        `<span aria-hidden="true">🎩</span> Superintendent <b>${esc(superName)}</b></div>`;
 
   return (
     `<div class="tc-when"><b>Day ${f.day}</b><span>Stage ${f.stage} of 12</span>` +
     `<span class="dim">${esc(f.clock)}</span></div>` +
     `<div class="tc-now">phase <b>${esc(f.phase)}</b></div>` +
-    `<div class="tc-who">waiting on <b>${esc(who)}</b></div>` +
-    `<ol class="tc-phases">${chips}</ol>`
+    `<div class="tc-who${yours && actorName !== null ? ' tc-yours' : ''}">` +
+    `${waiting}<b>${esc(who)}</b>${asked}</div>` +
+    // THE FEDORA RIDES AT THE END OF THE PHASE ROW (`TODO.md` #29, Jesse). It sat on its own line
+    // between the phases and everything above them, which put a thing that changes every third
+    // Stage in the middle of the things that change every Stage. The row it belongs beside is the
+    // one whose last chip is Supervisor Shift — the phase that passes it.
+    `<div class="tc-row"><ol class="tc-phases">${chips}</ol>${fedora}</div>`
   );
 }
 
@@ -110,8 +177,34 @@ export const TURNCHART_CSS = `
    says "Player Solitaire", so the chart should agree. In multiplayer this is the thing a table
    glances at most often, so it gets its own chip rather than hiding in the phase text. */
 .tc-who{display:flex;align-items:center;gap:6px;font-size:12px;color:#8b94a3}
+.tc-asks{color:#a99ac4;font-style:italic}
 .tc-who b{color:#b98cf0;background:rgba(150,110,230,.16);border:1px solid #8b6ad0;
   border-radius:11px;padding:1px 9px;font-size:12px}
+/* IT IS YOUR TURN. The commonest way a table stalls is a player not noticing their turn came round,
+   so the chip flashes rather than merely changing colour — motion is what catches an eye that is
+   somewhere else on the board. Amber, because that is what "you can act" means everywhere else on
+   this screen, and it separates "waiting on YOU" from the violet "where we are" news around it.
+   A reduced-motion preference holds it steady and lit instead of dropping the cue. */
+.tc-who.tc-yours{color:#f0b64a}
+.tc-who.tc-yours b{color:#1a1f27;background:#f0b64a;border-color:#f0b64a;font-weight:700;
+  animation:tc-flash 1s steps(1,end) infinite}
+@keyframes tc-flash{
+  0%,49%{background:#f0b64a;border-color:#f0b64a;color:#1a1f27;box-shadow:0 0 0 3px rgba(240,182,74,.25)}
+  50%,100%{background:transparent;border-color:#f0b64a;color:#f0b64a;box-shadow:none}
+}
+@media (prefers-reduced-motion: reduce){
+  .tc-who.tc-yours b{animation:none;box-shadow:0 0 0 3px rgba(240,182,74,.25)}
+}
+/* WHO HOLDS THE FEDORA. Violet like the rest of the chart — this is "where you are" news, not
+   something to press — but unfilled, so the eye still lands on "waiting on" first: that is the one
+   that changes every turn, while this changes four times a Day. */
+/* The phase row and the Fedora on one line, the hat pushed to the far end (TODO.md #29): the row
+   is the Stage, and the Superintendent is who holds it. Wraps under the phases on a narrow screen
+   rather than squeezing the chips. */
+.tc-row{display:flex;align-items:center;gap:12px;flex-wrap:wrap}
+.tc-row ol.tc-phases{flex:1 1 auto}
+.tc-super{margin-left:auto;display:flex;align-items:center;gap:6px;font-size:12px;color:#8b94a3;cursor:help}
+.tc-super b{color:#cbb6f2;border:1px solid #6b5a94;border-radius:11px;padding:1px 9px;font-size:12px}
 ol.tc-phases{display:flex;gap:6px;list-style:none;margin:0;padding:0;flex-wrap:wrap}
 .tc-phase{display:flex;align-items:center;gap:6px;border:1px solid #2c333d;border-radius:14px;
   padding:3px 10px 3px 7px;font-size:11px;color:#8b94a3;background:#1a1f26;cursor:help}

src/web/game.ts

@@ -23,42 +23,38 @@
  * folding events does not rebuild a game — `protocol.md` §3.)
  */
 
-import { pump } from '../engine/advance.ts';
+import { advance, pump } from '../engine/advance.ts';
 import { applyIntent } from '../engine/apply.ts';
 import type { GameEvent } from '../engine/events.ts';
 import type { Intent } from '../engine/intents.ts';
 import { legalActions } from '../engine/legal.ts';
 import { createGame } from '../engine/setup.ts';
-import type { CardId, GameConfig, GameState, PlayerIndex } from '../engine/state.ts';
+import type { CardId, GameConfig, GameState, GridCoord, PlayerIndex } from '../engine/state.ts';
+import { overHandLimit as overHandLimitOf } from '../engine/state.ts';
 import { playerAtSeat } from '../engine/state.ts';
 import { cuesFor, narrate } from '../sim/narrate.ts';
+import { collectStep, newCollector } from '../sim/display-step.ts';
+import type { DisplayCollector } from '../sim/display-step.ts';
 // Import from the view module, NOT replay.ts — replay.ts writes files and reads process.argv,
 // which would pull node:fs into a browser bundle.
-import {
-  cardDescription,
-  cardName,
-  describeIntent,
-  geometryLabel,
-  snapshot,
-  trainName,
-  variantLabel,
-} from '../sim/view.ts';
+import { cardDescription, cardName, currentActorOfState, describeIntent, geometryLabel, simpleCardName, snapshot, trainName, variantLabel } from '../sim/view.ts';
 import {
   DEFAULT_DAYS,
   DEFAULT_HOUSE_RULES,
   DEFAULT_MAX_COLLISIONS_PER_DAY,
   DEFAULT_MAX_COLLISIONS_TOTAL,
-  HAND_LIMIT,
   LEGACY_HOUSE_RULES,
+  withSavedDeal,
   collectiveRevenueFloor,
   houseRules,
+  industryProfile,
   mainlineProfile,
   trainProfile,
 } from '../engine/content.ts';
-import type { Hand, HouseRuleOverrides, TrackGeometry } from '../engine/content.ts';
+import type { CarType, Hand, HouseRuleOverrides, TrackGeometry } from '../engine/content.ts';
 import type { Port } from '../engine/track.ts';
 import { connectionsFor, joins, neighbour, variantsFor } from '../engine/track.ts';
-import { areaOf, destinationsFor, selectDestination, trainNeedingCars } from '../engine/apply.ts';
+import { acceptsCar, areaOf, destinationsFor, selectDestination, trainNeedingCars } from '../engine/apply.ts';
 import type { Frame } from '../sim/view.ts';
 
 /**
@@ -121,16 +117,40 @@ export type NewGameOptions = {
   minCombinedRevenue?: number;
   maxCollisionsPerDay?: number;
   maxCollisionsTotal?: number;
+  /**
+   * Appendix B's three, added 2026-08-23 when the New Game dialog gained them.
+   *
+   * The lobby has offered these since v0.6.0 and the solitaire dialog could not, which meant a
+   * solitaire game could never be played under Employee Rotation or the Emergency Toolbox at all.
+   * Partial like `houseRules`: a caller names only what it is setting.
+   */
+  optionalRules?: Partial<GameConfig['optionalRules']>;
 };
 
 /** The same config with the New Game dialog's answers in it. */
 export function configWith(opts: NewGameOptions): GameConfig {
+  const days = opts.days ?? SOLO_CONFIG.days;
   return {
     ...SOLO_CONFIG,
-    days: opts.days ?? SOLO_CONFIG.days,
-    minCombinedRevenue: opts.minCombinedRevenue ?? SOLO_CONFIG.minCombinedRevenue,
+    days,
+    /**
+     * DERIVED FROM THE DAYS ACTUALLY IN PLAY, not from `SOLO_CONFIG`'s five-Day constant.
+     *
+     * It fell back to the constant until 2026-08-30, so `configWith({ days: 1 })` asked a one-Day
+     * game to clear **15** — a floor a five-Day game averages barely half of — and
+     * `configWith({ days: 10 })` asked for the same 15 a five-Day game does. The two fields silently
+     * disagreed, which is the one thing a "build me a config" helper must not let happen.
+     *
+     * Not a live fault when it was found: `createLocalSession` is the only caller, and the page
+     * always writes `minCombinedRevenue` itself (`solitaireDefaults` re-derives it from the preset).
+     * Found by a throwaway probe that passed only `days` — which is exactly how the next caller
+     * would use this. At the default day count the answer is unchanged, since `SOLO_CONFIG`'s own
+     * floor is this same formula at `DEFAULT_DAYS`.
+     */
+    minCombinedRevenue: opts.minCombinedRevenue ?? collectiveRevenueFloor(1, days),
     maxCollisionsPerDay: opts.maxCollisionsPerDay ?? SOLO_CONFIG.maxCollisionsPerDay,
     maxCollisionsTotal: opts.maxCollisionsTotal ?? SOLO_CONFIG.maxCollisionsTotal,
+    optionalRules: { ...SOLO_CONFIG.optionalRules, ...(opts.optionalRules ?? {}) },
     houseRules: houseRules(opts.houseRules ? { houseRules: opts.houseRules } : {}),
   };
 }
@@ -210,8 +230,19 @@ export type Game = {
   seed: number;
   /** Every intent submitted, in order — the save file. */
   history: Intent[];
-  /** Narrated lines, newest last. */
-  log: { text: string; tone: string }[];
+  /**
+   * Narrated lines, newest last.
+   *
+   * `seq` IS A RUNNING COUNT, NOT A POSITION. The log is trimmed to `LOG_LIMIT` below, and a seat's
+   * "what have I sent you" bookmark used to be an index into this array — so once the array stopped
+   * growing, the bookmark ran past its end and `slice` returned nothing FOREVER. Reported from a
+   * two-player game that did not reach Day 5: the history froze for one player at Day 2 Stage 8 and
+   * the other at Day 2 Stage 4, at different moments because each seat had its own bookmark.
+   *
+   * A sequence number survives trimming, so the bookmark stays meaningful however much is dropped —
+   * and a reader can tell a gap from a quiet spell, which an index could never do.
+   */
+  log: { text: string; tone: string; seq: number }[];
   /**
    * True when the hand is OVER the limit, so the turn cannot end until it is played down.
    *
@@ -220,7 +251,6 @@ export type Game = {
    * had already been played and the hand held three or fewer. Derived from the hand each render, so
    * it cannot drift out of step with what is actually held.
    */
-  mustPlayCard: boolean;
   /**
    * Sounds the last batch of events earned, for the page to play and clear.
    *
@@ -252,11 +282,22 @@ export type Game = {
    * having taken a turn to cause it.
    */
   announced: string | null;
+  /**
+   * ORDERED PRESENTATION STEPS — v0.8.0, TODO #13. One per accepted intent, so a player can WATCH
+   * what everyone else did rather than find the board already rearranged.
+   *
+   * Accumulated here beside `log`, `cues` and `announced` and drained the same way, because that is
+   * how this file already hands things to whatever is displaying the game. Filled by `submit()`
+   * alone, which is what makes it identical for solitaire and multiplayer and inert during replay —
+   * see `sim/display-step.ts`.
+   */
+  display: DisplayCollector;
 };
 
 /** How each intent kind is introduced in the action list, in the order they should appear. */
 const GROUP_ORDER: readonly { prefix: string; title: string }[] = [
   { prefix: 'mainline.clearance', title: 'Superintendent — rule on this train' },
+  { prefix: 'mainline.yardOffice', title: 'Where does this train arrive?' },
   { prefix: 'localOps.choose', title: 'Local Operations — choose ONE' },
   { prefix: 'switch.', title: 'Switching' },
   // Specific before general: `startsWith` means a bare `draw.` would swallow all three, and the
@@ -284,13 +325,30 @@ const GROUP_ORDER: readonly { prefix: string; title: string }[] = [
  */
 export const SOLO_PLAYER = 'Solitaire';
 
+/**
+ * The next sequence number for a game's log, and the only way a line should ever be added.
+ *
+ * Kept off `Game` so the type stays serialisable: the counter is derived from the last line, which
+ * survives a save/restore and a trim alike.
+ */
+/**
+ * How many narrated lines a game keeps in memory. Everything older is dropped; `history` still holds
+ * every intent, so a trimmed game replays in full.
+ */
+export const LOG_LIMIT = 4000;
+
+export function pushLine(game: Game, text: string, tone: string): void {
+  const last = game.log[game.log.length - 1];
+  game.log.push({ text, tone, seq: (last?.seq ?? -1) + 1 });
+}
+
 export function newGame(seed: number, config: GameConfig = SOLO_CONFIG): Game {
   const state = createGame({ id: `web-${seed}`, seed, config, playerNames: [SOLO_PLAYER] });
-  const game: Game = { state, seed, history: [], log: [], mustPlayCard: false, cues: [], scheduled: null, justDrawn: null, announced: null };
+  const game: Game = { state, seed, history: [], log: [], cues: [], scheduled: null, justDrawn: null, announced: null, display: newCollector() };
   // A history that opens mid-Stage reads as though something was missed. Say what the game IS
   // first, then let the clock take over.
-  game.log.push({ text: 'Game Begins', tone: 'start' });
-  game.log.push({ text: `Solitaire · one player · seed ${seed}`, tone: 'quiet' });
+  pushLine(game, 'Game Begins', 'start');
+  pushLine(game, `Solitaire · one player · seed ${seed}`, 'quiet');
   drain(game);
   return game;
 }
@@ -305,9 +363,23 @@ export function newGame(seed: number, config: GameConfig = SOLO_CONFIG): Game {
  */
 export function newMultiplayerGame(seed: number, config: GameConfig, playerNames: string[]): Game {
   const state = createGame({ id: `mp-${seed}`, seed, config, playerNames });
-  const game: Game = { state, seed, history: [], log: [], mustPlayCard: false, cues: [], scheduled: null, justDrawn: null, announced: null };
-  game.log.push({ text: 'Game Begins', tone: 'start' });
-  game.log.push({ text: `${config.mode} · ${playerNames.length} players · seed ${seed}`, tone: 'quiet' });
+  const game: Game = { state, seed, history: [], log: [], cues: [], scheduled: null, justDrawn: null, announced: null, display: newCollector() };
+  pushLine(game, 'Game Begins', 'start');
+  /**
+   * NO SEED AT A TABLE WITH MORE THAN ONE SEAT (Gitea#20 step 1).
+   *
+   * `game.log` is one shared list and `linesSince(seat)` (`server/session.ts`) slices it with no
+   * per-seat filter, so every line here reaches every player. Announcing the seed therefore handed
+   * each of them the whole future of the deal — every card order, every die — in the opening line
+   * of the game. Found while planning the public common board; it is a multiplayer leak with or
+   * without that display, which is why it is fixed here rather than waiting for it.
+   *
+   * `newGame` still records it, deliberately: a solitaire table has nobody to leak to, and the seed
+   * in the log is what a bug report quotes. The rule is "do not tell the OTHER seats", not "write
+   * less down". The seed remains in `game.seed`, in every save (`session.ts` persistence) and in the
+   * lobby record, so nothing administrative or replayable loses it.
+   */
+  pushLine(game, `${config.mode} · ${playerNames.length} players`, 'quiet');
   drain(game);
   return game;
 }
@@ -322,12 +394,18 @@ export function drain(game: Game): void {
   record(game, pump(game.state));
 }
 
-/** Whose turn it is, or null if the game is over or waiting on nothing. */
+/**
+ * Whose turn it is, or null if the game is over or waiting on nothing.
+ *
+ * `currentActorOfState` (sim/view.ts) IS this, taking the state rather than the `Game` — so this is
+ * the adapter and not a second copy. It used to be the second copy: it carried the status guard and
+ * the view's version did not, which is #96 — the turn chart named the last seat to move all the way
+ * through the §3.3 vote, while this function correctly refused every intent that seat could send.
+ * Two functions that agree until they don't are worse than one, because the disagreement surfaces
+ * as a screen nobody can square with the server.
+ */
 export function currentActor(game: Game): PlayerIndex | null {
-  if (game.state.status !== 'active') return null;
-  return game.state.clock.pendingDecision !== null
-    ? game.state.clock.superintendent
-    : game.state.clock.currentActor;
+  return currentActorOfState(game.state);
 }
 
 /** Every legal action right now, grouped for display. Empty when there is nothing to decide. */
@@ -456,13 +534,26 @@ export function actionGroups(game: Game): { options: Intent[]; groups: ActionGro
        */
       if (prefix === 'mainline.clearance') {
         const pending = game.state.clock.pendingDecision;
-        if (pending) {
+        if (pending?.kind === 'clearance') {
           headed =
             `Superintendent — may ${trainName(game.state, pending.train)} follow ` +
             `${trainName(game.state, pending.occupiedBy)} onto the same Mainline card?`;
         }
       }
 
+      /**
+       * §11 (Gitea#5) — the Yard Office offer interrupts the Mainline Phase, so it arrives with no
+       * context around it: the player was not thinking about this train a moment ago.
+       */
+      if (prefix === 'mainline.yardOffice') {
+        const pending = game.state.clock.pendingDecision;
+        if (pending?.kind === 'yardOffice') {
+          headed =
+            `${trainName(game.state, pending.train)} is arriving with no coaches — ` +
+            'take it into the Yard Office, or hold it at the Train Order Office?';
+        }
+      }
+
       /**
        * A PENDING EXTRA IS ITS OWN QUESTION, and its own heading.
        *
@@ -593,6 +684,14 @@ export type Menu = {
   makeUp: {
     trayId: string;
     title: string;
+    /**
+     * What the card still wants, after what is already coupled up — "1 boxcar/hopper + 1 caboose".
+     *
+     * The title says what the card CALLS FOR and never changes as cars go on, so a player had to
+     * diff it against the consist drawn on the Division map, in the other column. Null when the
+     * train is complete and only the send-it-out button is left.
+     */
+    needs: string | null;
     cars: MakeUpAction[];
     pass: number | null;
     /**
@@ -733,6 +832,7 @@ export function actionMenu(game: Game, seat: PlayerIndex = 0): Menu {
       ? {
           trayId: filling,
           title: consistTitle(game, filling) ?? 'Making up the train',
+          needs: consistNeeds(game, filling),
           cars: makeUpCars,
           pass,
           advice: makeUpAdvice(game, filling, makeUpCars),
@@ -885,6 +985,55 @@ function consistTitle(game: Game, trayId: string): string | null {
   return trainCardTitle(tray.trainNumber ?? 0, tray.trainIsExtra);
 }
 
+/**
+ * WHAT THE TRAIN STILL WANTS — the card's demand minus what is already on it.
+ *
+ * The heading says "its card calls for 3 boxcar/hopper + 1 caboose" and goes on saying it whether
+ * you have added none or three; the cars themselves are drawn on the Division map, in the other
+ * column. So the one question a player actually has while clicking — what is left? — was the one
+ * thing on screen that had to be worked out by eye, across two panels (Jesse, playtest 2026-09-16).
+ *
+ * BY CATEGORY, exactly as `acceptsCar` counts them, so this cannot promise a car the engine would
+ * then refuse. Null when nothing is outstanding.
+ */
+function consistNeeds(game: Game, trayId: string): string | null {
+  const tray = game.state.trays.get(trayId);
+  if (!tray) return null;
+  const p = trainProfile(tray.trainNumber ?? 0, tray.trainIsExtra);
+  if (!p) return null;
+
+  const cat = (t: string): 'coach' | 'caboose' | 'freight' =>
+    t === 'coach' ? 'coach' : t === 'caboose' ? 'caboose' : 'freight';
+  const have = (k: 'coach' | 'caboose' | 'freight'): number =>
+    tray.consist.filter((c) => cat(c.type) === k).length;
+
+  /**
+   * ASKED OF `acceptsCar`, NOT RECOUNTED (v0.8.4). Counting by category alone promised cars the
+   * engine would then refuse: with the caboose already coupled, nothing may go on behind it
+   * (§A.3), so "Still needs 2 boxcar" was printed while no yard chip lit and the only offer was
+   * to send the train out as it stands. One sample car per category settles it the same way
+   * `advance.ts`'s make-up report does.
+   */
+  const sample: Record<'coach' | 'caboose' | 'freight', CarType> = {
+    coach: 'coach',
+    caboose: 'caboose',
+    freight: p.consist.freightTypes?.[0] ?? 'boxcar',
+  };
+  const parts: string[] = [];
+  let blocked = false;
+  const want = (k: 'coach' | 'caboose' | 'freight', label: (n: number) => string): void => {
+    const n = (k === 'coach' ? p.consist.coach : k === 'caboose' ? p.consist.caboose : p.consist.freight) - have(k);
+    if (n <= 0) return;
+    if (acceptsCar(tray, sample[k])) parts.push(label(n));
+    else blocked = true;
+  };
+  want('freight', (n) => `${n} ${p.consist.freightTypes?.join('/') ?? 'freight'}${p.consist.emptiesOnly ? ' (empties only)' : ''}`);
+  want('coach', (n) => `${n} coach${n > 1 ? 'es' : ''}`);
+  want('caboose', (n) => `${n} caboose`);
+  if (parts.length > 0) return parts.join(' + ');
+  return blocked ? 'nothing more — the caboose is on, and nothing couples behind it' : null;
+}
+
 /**
  * "Making up Extra X22 “Pee-Dee”: its card calls for 1 caboose — Per-diem train…"
  *
@@ -906,7 +1055,21 @@ function trainCardTitle(number: number, isExtra: boolean): string | null {
   const calls = parts.length > 0 ? parts.join(' + ') : 'no cars at all';
   const note = p.rules.note ? ` — ${p.rules.note}` : '';
   const name = `${p.isExtra ? 'Extra X' : 'Train '}${p.number} “${p.name}”`;
-  return `Making up ${name}: its card calls for ${calls}${note}`;
+  /**
+   * WHAT THE CARD PAYS FOR, ON ITS OWN LINE (Jesse, 2026-09-23: "is it clear from the text
+   * displayed that it earns points only if fully loaded?").
+   *
+   * The card's printed note has always been here, but as a clause trailing the consist — so the one
+   * condition that decides whether the Circus earns anything at all read as flavour. A train whose
+   * card pays for standing still is played completely differently from one that pays for running,
+   * and that is worth its own sentence.
+   */
+  const pays = p.rules.stopEarnsPoint
+    ? '\nTHIS TRAIN PAYS FOR STOPPING, not for running: a full Stage standing still in a district ' +
+      'earns 1 Revenue, once per district — but ONLY if every car except the caboose is loaded. ' +
+      'Made up short or carrying empties, it earns nothing however long it stands.'
+    : '';
+  return `Making up ${name}: its card calls for ${calls}${note}${pays}`;
 }
 
 /**
@@ -1000,28 +1163,116 @@ function makeUpAdvice(
  * button with a reason instead of hiding a move that has simply become illegal.
  */
 export function overHandLimit(game: Game, seat: PlayerIndex = 0): boolean {
-  const hand = game.state.decks.hands.get(seat) ?? [];
-  const limit = game.state.decks.redFlags.get(seat) ? HAND_LIMIT + 1 : HAND_LIMIT;
-  return hand.length > limit;
+  return overHandLimitOf(game.state, seat);
 }
 
-/** Submit an action. Returns false and changes nothing if the engine rejects it. */
-export function submit(game: Game, intent: Intent): boolean {
-  const actor = currentActor(game);
+/**
+ * Intents any seat may send regardless of whose turn it is — and, for `game.extend`, regardless of
+ * whether the game is still running at all (§3.3, Gitea#11).
+ *
+ * `currentActor` is null once the timetable has run out, which is correct for everything else and
+ * exactly wrong for the vote on playing another Day. Rather than teach `currentActor` about a state
+ * where EVERY seat may act at once — which it has no way to express — callers name the seat.
+ */
+export function isOutOfTurn(intent: Intent): intent is Extract<Intent, { type: 'game.extend' }> {
+  return intent.type === 'game.extend';
+}
+
+/**
+ * WHO ACTED, when replaying a saved history.
+ *
+ * A save is a flat `Intent[]` with no seat written beside each move, so a replay normally derives
+ * the actor from the turn order — the same order the live game went round in, reproduced exactly.
+ * That breaks for exactly one intent: the extension vote, which every seat may cast in any order,
+ * and which `currentActor` answers `null` for because the game has stopped. Replaying such a save
+ * used to fail outright with `NO_ACTOR`, which is to say an extended game could not be resumed at
+ * all — found by `test/server/session.test.ts`'s resume test, and the reason `game.extend` carries
+ * its voter (`intents.ts`).
+ */
+function replayActor(game: Game, intent: Intent): PlayerIndex | null {
+  return isOutOfTurn(intent) ? intent.player : currentActor(game);
+}
+
+/**
+ * Submit an action. Returns false and changes nothing if the engine rejects it.
+ *
+ * `as` names the seat for an out-of-turn intent (see `isOutOfTurn`). It cannot be used to smuggle an
+ * ordinary move past the turn order: `check` is still the authority and still asks `isActor`, so a
+ * named seat that is not the actor is refused exactly as it would have been.
+ */
+export function submit(game: Game, intent: Intent, as: PlayerIndex | null = null): boolean {
+  const actor = as ?? currentActor(game);
   if (actor === null) return false;
 
   const result = applyIntent(game.state, actor, intent);
   if (!result.ok) {
-    game.log.push({ text: `That is not allowed: ${result.code}`, tone: 'bad' });
+    pushLine(game, `That is not allowed: ${result.code}`, 'bad');
     return false;
   }
   game.history.push(intent);
+  /**
+   * THE HIGH-WATER MARK FOR THIS STEP'S NARRATION (v0.8.0).
+   *
+   * Taken here rather than read from `session.ts`'s `sentLines`, which is per-seat and is MUTATED
+   * by `linesSince()` as a side effect of building a push — so it cannot answer "what did this one
+   * intent say?". `submit` brackets the whole thing, `record` and `drain` below are the only things
+   * that append, and the slice after them is exactly this intent's narration including whatever
+   * automatic phases it drained.
+   */
+  const saidFrom = game.log.length;
   record(game, result.events, actor);
-  game.mustPlayCard = overHandLimit(game);
-  drain(game);
+  collectStep(game.display, game.state, actor, intent.type, game.log.slice(saidFrom));
+  drainStepping(game);
   return true;
 }
 
+/**
+ * `drain()`'s STEPPED TWIN — TODO #18, and the reason this is not just `drain(game)`.
+ *
+ * `pump()` runs every automatic phase between one click and the next and `drain()` records the whole
+ * batch at once, so New Train, the Mainline and the shift change are never drawn at all: trains
+ * cross the Division in a single jump. Stepping `advance()` one call at a time and collecting after
+ * each is what gives those phases a visible beat, which is exactly what TODO Reference · #18 says is
+ * needed — *"a minimum dwell time on its own therefore fixes nothing"*.
+ *
+ * IDENTICAL BEHAVIOUR TO `drain()`, deliberately. The same `advance()` calls in the same order
+ * produce the same state; `record()` is called per phase rather than per batch, which is equivalent
+ * because `cuesFor` is a pure per-event map with no cross-event state and `record`'s other outputs
+ * (`scheduled`, `justDrawn`, `announced`) are last-wins in event order either way.
+ *
+ * A PHASE THAT DID NOTHING PRODUCES NO STEP. Jesse, 2026-09-09: *"if nothing happens during a phase
+ * then we shouldn't lose time to it."* Narrating nothing is the test for that — an empty phase adds
+ * no lines, so it is skipped rather than given a dwell to sit through.
+ *
+ * `drain()` itself is untouched, and must stay that way: `fromSave`, `fromMultiplayerSave` and
+ * `undo` all use it, and the collector staying off those paths is what keeps a replay from
+ * re-emitting a whole game as steps.
+ */
+function drainStepping(game: Game): void {
+  for (let i = 0; i < 10_000; i++) {
+    const from = game.log.length;
+    const r = advance(game.state);
+    record(game, r.events);
+    /**
+     * THE TEST IS THE EVENT LIST, NOT THE LOG — and getting that wrong drifted the board.
+     *
+     * `record()` deliberately drops `actorChanged` before narrating, so a phase whose only effect is
+     * handing the turn to the next player grows no lines at all. Collecting only when the log grew
+     * therefore skipped those, and the last step's frame was then a position behind the real one:
+     * the animated board ended a turn out of step with the game (`actor: 2` where the game said 1).
+     *
+     * A step whose narration is empty still carries the board. It simply costs no time to show —
+     * `dwellForStep` gives a silent step a dwell of zero — which is the same rule that collapses an
+     * empty phase, arrived at from the other direction.
+     */
+    if (r.events.length > 0) {
+      collectStep(game.display, game.state, null, 'phase', game.log.slice(from));
+    }
+    if (r.needsInput || game.state.status === 'finished') return;
+  }
+  throw new Error('phase driver failed to settle — probable infinite loop');
+}
+
 /**
  * Which cards in hand can be played RIGHT NOW, in hand order.
  *
@@ -1050,6 +1301,99 @@ export function view(game: Game, seat: PlayerIndex = 0): Frame {
   return snapshot(game.state, [], null, null, null, false, seat);
 }
 
+/**
+ * Fold a narration's opening word into the middle of a sentence — "Chose to draw" after a name has
+ * to read "Player Bob chose to draw".
+ *
+ * ONLY A SENTENCE-CASED WORD, which is the whole point. It used to be a flat
+ * `text.charAt(0).toLowerCase()`, so every line opening with an all-caps keyword came out mangled:
+ * `EXTRA X18 started…` rendered as `Player Solitaire eXTRA X18 started…`, and the same happened to
+ * `TRAIN 1 MADE UP` and `COLLISION`. Those words are shouted deliberately.
+ *
+ * `^[A-Z][a-z]` is the test — a capital followed by a lower-case letter is an ordinary word that was
+ * capitalised because it began a sentence, and nothing else is. It leaves all-caps keywords alone,
+ * and it also leaves alone a word whose second character is a digit or a hyphen (`X22 Pee-Dee`),
+ * which a naive "is it uppercase?" check would get wrong because `'2'.toUpperCase() === '2'`.
+ */
+function uncapitalise(text: string): string {
+  return /^[A-Z][a-z]/.test(text) ? text.charAt(0).toLowerCase() + text.slice(1) : text;
+}
+
+/**
+ * The Facility on one of a player's squares, or null — for naming the place a switching line is
+ * about. Shared by the narrator and the filter below, so both agree on what counts as an industry.
+ */
+function facilityOn(game: Game, player: PlayerIndex, at: GridCoord): string | null {
+  const card = areaOf(game.state, player).grid.get(`${at.row},${at.col}`);
+  const f = card?.facility;
+  // The name printed on the card, not the internal key: `industryProfile` is the one place that
+  // knows "grocersWarehouse" reads as "Grocer's Warehouse".
+  if (f) return f.subtype === 'office' ? 'the Office' : `the ${industryProfile(f.subtype).name}`;
+  /**
+   * A SMALL YARD IS A PLACE TOO, though it is an enhancement on a plain card rather than a Facility.
+   *
+   * It is the one square in a district a crew goes to ON PURPOSE without working an industry — the
+   * whole point of the trip is to arrive there and re-make the train — so "leaving Train 10 at
+   * (-1,1)" was the one line most in need of a name. Only this enhancement: the others change what a
+   * square DOES without being somewhere a player aims a crew at.
+   */
+  return card?.enhancements.includes('smallYard') ? 'the Small Yard' : null;
+}
+
+/**
+ * HOW MUCH SWITCHING REACHES THE HISTORY PANEL (Jesse, 2026-09-17).
+ *
+ * All of it did. A six-Move turn wrote a line per move — "Moved Train 10 (0,3) → (-1,-3) — 4 of 6
+ * Moves left" — plus one per mandatory coupling, so two players shunting filled the panel with
+ * coordinates and pushed everything else off the top. His ruling, asked as a question from the
+ * table: a line saying somebody switched, the cars they set out at or picked up from an INDUSTRY,
+ * and the Small Yard sort. Not every move, and not every coupling.
+ *
+ * WHAT STAYS, and why each one earns its line: `localOpsOptionChosen` already says who is switching
+ * and is left alone; work at an industry is the point of switching and changes what can be loaded
+ * next; and `consistSorted` spends a Move and changes what the train can do. A plain move along
+ * one's own track changes nothing anybody needs to read back.
+ *
+ * THE LINE IS STILL WRITTEN, MARKED `trace`, AND THAT IS NOT A DETAIL. Dropping these events on the
+ * floor was the first attempt and the suite caught it: `dwellForStep` gives a step NO dwell when it
+ * produced no narration, so a switching move with no line became a silent step and the board stopped
+ * replaying switching altogether — it would have snapped through the very thing v0.8.0 was built to
+ * let the table watch. The line still rides with its display step and still captions the board as
+ * the move goes up; only the history panel skips it.
+ *
+ * THE REPLAY VIEWER IS UNAFFECTED for the same reason, and it renders through `narrate` directly.
+ */
+function inHistory(game: Game, e: GameEvent): boolean {
+  const industry = (player: PlayerIndex, ...coords: GridCoord[]): boolean =>
+    coords.some((c) => facilityOn(game, player, c) !== null);
+  switch (e.type) {
+    /**
+     * THE FIRST MOVE OF A TURN IS KEPT (Jesse, 2026-09-17: "also keep the first and last move").
+     *
+     * It says a crew set off and from where, which is the half of "somebody switched" that the
+     * opener does not carry. The LAST move cannot be kept the same way — nothing knows a move was
+     * the last until the turn is over, and by then the line has already been written and streamed to
+     * every client (`server/session.ts` § linesSince), so it cannot be revised. `switchingEnded`
+     * carries it instead, as the line that closes the turn.
+     *
+     * Recognised by the MOVE COUNT rather than by tracking state: the first move of a turn is the
+     * one that leaves `movesAllowed - 1` behind it, which the event now carries so this holds on a
+     * five-Move night Stage too.
+     */
+    case 'trayMoved':
+      return e.movesRemaining === e.movesAllowed - 1;
+    // Coupling is mandatory when a crew runs over cars (§A.4), so most of these happen to a player
+    // rather than being chosen. The ones worth reading are where cars left or joined an industry —
+    // `from` names the cards the cars were actually lifted off, which is where they had been spotted.
+    case 'carsCoupled':
+      return industry(e.player, e.at, ...e.from);
+    case 'carsDropped':
+      return industry(e.player, e.at);
+    default:
+      return true;
+  }
+}
+
 function record(game: Game, events: GameEvent[], actor: PlayerIndex | null = null): void {
   const who = actor === null ? null : (game.state.players[actor]?.name ?? null);
   for (const e of events) {
@@ -1058,12 +1402,75 @@ function record(game: Game, events: GameEvent[], actor: PlayerIndex | null = nul
     const n = narrate(e, {
       cardName: (id) => cardName(game.state, id),
       trainName: (id) => trainName(game.state, id),
+      facilityAt: (player, at) => facilityOn(game, player, at),
+      /**
+       * Which Mainline card a Division node holds. The log used to print the node INDEX alone —
+       * "on Mainline card 7" — leaving the reader to remember what card 7 was (Jesse, 2026-09-22).
+       * The index is kept beside the name because a division can deal two Plains, and then the slot
+       * is the only thing that distinguishes them.
+       */
+      mainlineAt: (node) => {
+        const n = game.state.division.nodes[node];
+        return n?.kind === 'mainline' ? mainlineProfile(n.card).name : null;
+      },
+      // The printed name, for the same reason `cardName` stopped trusting `prettyKey` in v0.8.0.17:
+      // no key-splitter recovers "ABS Signals" from `absSignals`.
+      enhancementName: (key) => simpleCardName(key),
+      // Whose district a train reached is not the actor — the Mainline Phase has none — so the
+      // narration resolves the name itself rather than being prefixed with one by the code below.
+      // NO NUMBER IN THE FALLBACK. This is a PLAYER index, and a player is not a seat — seats rotate
+      // under Employee Rotation, which is why `seatOf` exists — so "Seat 3" here would be a wrong
+      // number dressed as a right one, and `session.test.ts` rightly refuses any raw index shown to
+      // a person. Every caller passes real names; an unnamed player is anonymous rather than mislabelled.
+      playerName: (p) => game.state.players[p]?.name ?? 'another player',
     });
+    /**
+     * A BLIND DRAW IS PUBLIC; WHICH CARD CAME UP IS NOT (Gitea#20 step 1).
+     *
+     * Everybody at the table sees a hand go to the Home Office deck, so the draw itself belongs in
+     * the shared log. The card's NAME does not: the deck is face down, and this log goes to every
+     * seat unfiltered, so naming it told three opponents exactly what the fourth was holding.
+     *
+     * A DEPARTMENT SLOT IS NOT THE SAME and stays named. Those piles are face up — a discard goes
+     * onto one precisely so a rival can take it — so the card was public before it was drawn, and
+     * hiding it would lose real information for no gain.
+     *
+     * The drawing seat still learns what it got. `justDrawn` below is the owner-only channel and
+     * `session.ts` sends it to that seat alone, so this costs the drawer nothing. Solitaire keeps
+     * the name for the same reason it keeps the seed: a one-seat table has nobody to leak to, and
+     * a solo player's history naming their own draw is the record rather than a leak.
+     */
+    const blindDraw = e.type === 'cardDrawn' && e.source === 'homeOffice' && game.state.players.length > 1;
+    const said = blindDraw ? 'Drew a card from the Home Office deck' : n.text;
     // "Chose to DRAW a card" does not say WHO, which is unreadable the moment there is more than
     // one seat. Only events the player caused are attributed; the Division running itself is not.
-    const mine = who !== null && 'player' in e;
-    const text = mine ? `Player ${who} ${n.text.charAt(0).toLowerCase()}${n.text.slice(1)}` : n.text;
-    game.log.push({ text, tone: mine ? 'act' : n.tone });
+    /**
+     * A RULING IS MADE AS SUPERINTENDENT, NOT AS YOURSELF (playtest, 2026-09-15: "maybe it could say
+     * 'Superintendent Player Tom', so it's clear they got the move because they're Superintendent").
+     * These three are the only moves a player makes out of turn, by holding the office: §8.1's
+     * clearance, §11's Yard Office offer and §Q's Red Flag prompt. `clearanceGiven` carries no
+     * player at all — the office made it, whoever holds it — so the actor is what names it.
+     */
+    const RULINGS = ['clearanceGiven', 'yardOfficeRuled', 'redFlagRuled'];
+    const ruling = RULINGS.includes(e.type) && who !== null;
+    /**
+     * EVENTS THAT NAME THEIR OWN PLAYER, and so must not be prefixed with the actor's name as well
+     * — Gitea#31's rule that no line names a player twice.
+     *
+     * `revenueChanged` carries the seat that EARNED it, which is not always the seat that acted: a
+     * train completing its run pays everybody, with no actor at all. Prefixing it with the actor
+     * would be wrong on those lines and redundant on the rest, so `narrate` resolves the name.
+     */
+    const SELF_NAMED = ['revenueChanged'];
+    const mine = who !== null && 'player' in e && !SELF_NAMED.includes(e.type);
+    const text = ruling
+      ? `Superintendent Player ${who} ${uncapitalise(said)}`
+      : mine
+        ? `Player ${who} ${uncapitalise(said)}`
+        : said;
+    // `trace` is a tone the history panel does not draw — see `inHistory`. The line exists so the
+    // step that caused it has narration to caption the board with, and a dwell to be watched for.
+    pushLine(game, text, inHistory(game, e) ? (mine || ruling ? 'act' : n.tone) : 'trace');
 
   }
   game.cues.push(...cuesFor(events));
@@ -1080,9 +1487,28 @@ function record(game: Game, events: GameEvent[], actor: PlayerIndex | null = nul
         `Train ${e.isExtra ? 'X' : ''}${e.trainNumber} has completed its run, leaving via the ` +
         `${e.side === 'east' ? 'Eastern' : 'Western'} Division Point. All players get 1 Revenue.`;
     }
+    /**
+     * THE FEDORA MOVING IS ANNOUNCED, NOT JUST LOGGED (playtest, 2026-09-16).
+     *
+     * It is the one thing in the game that changes hands on the clock rather than because somebody
+     * did something, so nobody is watching for it — and it decides who rules on clearances and who
+     * every round starts with. A line in the history is where you find it afterwards; this is what
+     * tells the table as it happens, the same treatment a completed run already gets.
+     */
+    if (e.type === 'superintendentChanged') {
+      const name = game.state.players[e.player]?.name ?? 'the next player';
+      game.announced = `${name} is now the Superintendent — the Fedora passed at the end of Stage ${e.stage}.`;
+    }
   }
-  // Keep the log bounded; the full history lives in `history` and can be replayed.
-  if (game.log.length > 400) game.log.splice(0, game.log.length - 400);
+  /**
+   * Keep the log bounded; the full history lives in `history` and can be replayed.
+   *
+   * SAFE TO TRIM ONLY BECAUSE LINES CARRY `seq`. While a seat's bookmark was an index into this
+   * array, trimming silently froze that seat's history for the rest of the game — see `Game.log`.
+   * The limit is generous because a four-player game over eight or ten Days is several times the
+   * two-player, five-Day game that first hit it.
+   */
+  if (game.log.length > LOG_LIMIT) game.log.splice(0, game.log.length - LOG_LIMIT);
 }
 
 // ---------------------------------------------------------------------------
@@ -1113,7 +1539,7 @@ export function toSave(game: Game): Save {
  * in force then — never the current defaults.
  */
 function configFor(save: Save, config: GameConfig): GameConfig {
-  return { ...config, houseRules: save.rules ?? LEGACY_HOUSE_RULES };
+  return withSavedDeal({ ...config, houseRules: save.rules ?? LEGACY_HOUSE_RULES });
 }
 
 /**
@@ -1136,10 +1562,15 @@ function configFor(save: Save, config: GameConfig): GameConfig {
  *
  * Returns null when there is nothing to undo, so the caller can leave the button disabled.
  */
-export function undo(game: Game, config: GameConfig = SOLO_CONFIG): Game | null {
+export function undo(game: Game, config: GameConfig = game.state.config): Game | null {
   if (game.history.length === 0) return null;
   // `toSave` first, so the rules this game was dealt under come with it. Rebuilding the save by hand
   // here dropped them, and undo re-dealt the game under the defaults instead of its own settings.
+  //
+  // THE VICTORY DIALS COME FROM THE GAME ITSELF for the same reason (2026-08-23). `Save` carries only
+  // the house rules, so defaulting this parameter to `SOLO_CONFIG` meant undoing a game dealt over
+  // eight Days replayed it as a five-Day game — the length, the Revenue floor and both collision
+  // caps all quietly reverting to the defaults.
   return fromSave({ ...toSave(game), history: game.history.slice(0, -1) }, config);
 }
 
@@ -1153,12 +1584,23 @@ export function undo(game: Game, config: GameConfig = SOLO_CONFIG): Game | null
 export function fromSave(save: Save, config: GameConfig = SOLO_CONFIG): Game {
   const game = newGame(save.seed, configFor(save, config));
   for (const intent of save.history) {
-    const actor = currentActor(game);
+    const actor = replayActor(game, intent);
     if (actor === null) break;
     const result = applyIntent(game.state, actor, intent);
     if (!result.ok) break;
     game.history.push(intent);
-    record(game, result.events);
+    /**
+     * `actor` IS PASSED HERE, so a replayed game narrates exactly as the live one did.
+     *
+     * It was omitted, and the omission was invisible in solitaire for a reason worth keeping: the
+     * only test that compares logs ("leaves nothing in the log describing a move that was taken
+     * back") compares one `fromSave`-built log against ANOTHER, so the missing attribution cancelled
+     * out on both sides. Live play attributes (`submit` passes `actor`) and so does multiplayer's
+     * replay (`fromMultiplayerSave`) — this was the one path of the three that did not, which meant
+     * a restored save, an undone game (undo rebuilds through here) and the replay viewer all
+     * described the same moves in different words from the game that produced them.
+     */
+    record(game, result.events, actor);
     drain(game);
   }
   return game;
@@ -1172,16 +1614,18 @@ export function fromSave(save: Save, config: GameConfig = SOLO_CONFIG): Game {
  * this function only ever reconstructs from history that is already known to have been recorded
  * under the currently-running rules.
  *
- * UNLIKE `fromSave`'s loop, this passes `actor` to `record()` (matching `submit`'s own call,
+ * LIKE `fromSave`'s loop, this passes `actor` to `record()` (matching `submit`'s own call,
  * `game.ts` above) — found while testing Phase 3's resume path: without it, every replayed line loses
  * its "Player X" attribution and reads as anonymous "Chose to..." narration, which `record`'s own
  * comment calls "unreadable the moment there is more than one seat" — exactly the multiplayer case a
- * resumed game hits every time. `fromSave` has the same gap (it predates multiplayer and nothing ever
- * compares its output against a LIVE-played log, so it has gone unnoticed — `undo`'s rebuilt game is
- * itself `fromSave`-built, so `test/web.test.ts`'s replay-fidelity test only ever compares one
- * unattributed replay against another). Flagged in `TODO.md` rather than fixed there in this pass —
- * out of scope for Phase 3 and used far more widely, so worth its own careful look rather than a
- * touch-in-passing.
+ * resumed game hits every time.
+ *
+ * `fromSave` HAD THE SAME GAP AND NO LONGER DOES (fixed 2026-08-30). It predated multiplayer, and
+ * nothing ever compared its output against a LIVE-played log: `undo`'s rebuilt game is itself
+ * `fromSave`-built, so `test/web.test.ts`'s replay-fidelity test only ever compared one unattributed
+ * replay against another and the gap cancelled out on both sides. The test that now pins it plays a
+ * game live, restores it from its own save, and asserts the two logs are identical — which is the
+ * comparison that had been missing rather than a new requirement.
  */
 /**
  * Why the intent a replay stopped at is reported rather than swallowed.
@@ -1204,7 +1648,7 @@ export function fromMultiplayerSave(
 ): { game: Game; stopped: ReplayStop | null } {
   const game = newMultiplayerGame(seed, config, playerNames);
   for (const [index, intent] of history.entries()) {
-    const actor = currentActor(game);
+    const actor = replayActor(game, intent);
     if (actor === null) {
       return { game, stopped: { index, intent, code: 'NO_ACTOR' } };
     }

src/web/index.html

@@ -27,6 +27,11 @@ h1{font-size:32px;margin:0 0 2px;letter-spacing:.02em}
 a.door:hover{border-color:#4d6fa8;background:#1f2733;transform:translateY(-1px)}
 .door h2{font-size:17px;margin:0 0 5px;color:#9fb6d8}
 .door p{margin:0;color:var(--dim);font-size:13px;line-height:1.5}
+/* Not a fourth door: reading the guide is not a way to play, and giving it equal weight in the
+   grid would say it is. A line under the doors, where somebody who does not know what to click
+   will already be looking. */
+.newhere{margin:16px 2px 0;color:var(--dim);font-size:13px;line-height:1.55}
+.newhere a{color:#9fb6d8}
 .door .go{display:inline-block;margin-top:11px;font-size:12px;color:#5aa9e6}
 .door.disabled .go{color:var(--dim)}
 a.door.disabled{pointer-events:none}
@@ -79,13 +84,13 @@ footer{margin-top:26px;color:var(--dim);font-size:11px;display:flex;gap:18px;fle
       <span class="go" id="door-multiplayer-go">Set up a game &rarr;</span>
     </a>
 
-    <a class="door" href="./play.html">
+    <a class="door" href="./play.html?solitaire">
       <h2>Play solitaire</h2>
-      <p>Play by yourself and run the entire division for five full days. Your goal is 20 Revenue.
-         Your game data is saved in your browser &mdash; if you close the tab and reopen this site
+      <p>Play by yourself and run the entire division for five full days. Clear the Revenue floor of
+         15 by the end or the game is a loss. Your game data is saved in your browser &mdash; if you close the tab and reopen this site
          without clearing your cache, your game is preserved and you can continue automatically.
          During the game you can also explicitly save your progress for later replay.</p>
-      <span class="go">Start a game &rarr;</span>
+      <span class="go">Set up a game &rarr;</span>
     </a>
 
     <a class="door" href="./replays.html">
@@ -96,11 +101,16 @@ footer{margin-top:26px;color:var(--dim);font-size:11px;display:flex;gap:18px;fle
     </a>
   </div>
 
+  <p class="newhere">New to Station Master?
+    <a href="./quickstart.html">Read the Quickstart guide</a> &mdash; what the game is, how you win,
+    how a Stage runs, what is on the screen, and a first twenty minutes. About twenty minutes to
+    read, and it will save you an hour of guessing.</p>
+
   <div class="rule"></div>
 
   <footer>
     <span>build <span id="build">__BUILD__</span></span>
-    <span>solitaire runs entirely in your browser &mdash; no server code required</span>
+    <span>Multiplayer runs on StartOS server. Solitaire runs entirely in your browser.</span>
   </footer>
 </main>
 

src/web/lobby.ts

@@ -1,10 +1,22 @@
 /**
- * The lobby screen — Phase 4 of `docs/architecture/multiplayer.md` (§12 steps 17-20).
+ * The lobby screen — Phase 4 of `docs/architecture/multiplayer.md` (§12 steps 17-20), rebuilt
+ * 2026-08-23 (Jesse's cleanup pass).
  *
- * Everything in `#lobby` (`play.html`) is owned here: the join-secret gate, creating or joining a
- * game by code, and the seating screen up to `Lobby.Start`. `main.ts` calls `runLobby` once, at
- * `start()`, only when there is no stored session to reconnect with — see `main.ts`'s own comment
- * on why a stored `{token, gameId, seat}` skips this module entirely.
+ * Everything in `#lobby` (`play.html`) is owned here: the join-secret gate, the two doors (join a
+ * game, create one), the read-only preview a player reads BEFORE taking a seat, and the seating
+ * screen up to `Lobby.Start`.
+ *
+ * WHAT CHANGED, and why each one was worth changing:
+ *   - JOINING CAME FIRST. It used to be a heading below the whole create form — fifteen fields a
+ *     player who was handed a code has no use for.
+ *   - A SEAT SURVIVES A RELOAD. The token was held in a closure and only written to `localStorage`
+ *     at `Lobby.Start`, so a refresh before the host started orphaned the chair: the player could
+ *     not get back and the seat could not be freed. `onSeated` hands it to `main.ts` immediately.
+ *   - THERE IS A WAY OUT. `/api/lobby/leave` frees a seat, so a mis-join or a player who wanders off
+ *     no longer wedges a table that cannot start until every chair is taken.
+ *   - THE STREAM CAN FAIL OUT LOUD. `onmessage` was the only handler; a dropped connection left the
+ *     seating screen frozen and silent.
+ *   - THE RULES ARE VISIBLE TO EVERYONE, not just the host who typed them.
  *
  * MIRRORS SERVER TYPES RATHER THAN IMPORTING THEM, same choice `web/session.ts` already made for
  * `Push`: this file must never depend on anything under `src/server/`, even at the type level, since
@@ -12,12 +24,36 @@
  */
 
 import type { GameConfig, PlayerIndex } from '../engine/state.ts';
-import { defaultMultiplayerConfig } from './game.ts';
-import { STARTING_HAND_LABELS, houseRules } from '../engine/content.ts';
-import type { StartingHand } from '../engine/content.ts';
+import {
+  closestPreset,
+  configFromSettings,
+  gameTypeLabel,
+  preset,
+  presetSettings,
+} from './presets.ts';
+import type { GameType, PresetName } from './presets.ts';
+import { rulesListHtml, settingsForm } from './settings-form.ts';
 import { seatLabel } from '../sim/view.ts';
 
-export type LobbyReady = { token: string; gameId: string; seat: PlayerIndex };
+export type LobbyReady = { token: string; gameId: string; seat: PlayerIndex; gameCode: string };
+
+/** What the page must do with a seat this screen takes or gives up. `main.ts` owns the storage; this
+ * module owns the moments. */
+export type LobbyHandlers = {
+  /** The game has begun — tear this screen down and build a `RemoteSession`. Called at most once. */
+  onReady: (r: LobbyReady) => void;
+  /** A seat is now held. Called before the game starts, so a reload can come back to it. */
+  onSeated: (s: { token: string; gameId: string; gameCode: string }) => void;
+  /** The seat is gone — left, removed, or the lobby closed under us. Forget the stored record. */
+  onLeft: (gameId?: string) => void;
+  /** Every game this browser still holds a seat in — the page owns the storage, this screen only
+   * draws it. */
+  known?: () => { gameId: string; gameCode: string; stage: 'lobby' | 'game' }[];
+  /** Re-enter one of them. */
+  rejoin?: (gameId: string) => void;
+  /** Give one up for good: the token is the only proof of identity, so this cannot be undone. */
+  forget?: (gameId: string) => void;
+};
 
 type LobbySeat = { kind: 'human'; token: string; displayName: string } | { kind: 'bot' } | null;
 type Lobby = {
@@ -30,14 +66,49 @@ type Lobby = {
   createdAt: number;
 };
 type LobbyPush = { lobby: Lobby; you: PlayerIndex; started: boolean };
+type Preview = {
+  gameCode: string;
+  hostName: string;
+  config: GameConfig;
+  players: number;
+  seated: { seat: number; who: string | null; bot: boolean }[];
+};
 
 /** Per-origin, same reasoning `lobby-and-sessions.md` §1 gives for the session token itself — a
  * secret typed at one address means nothing at another. */
 const SECRET_KEY = 'stationmaster-joinsecret';
+/** The name is not a credential; it is remembered for the same reason the secret is — nobody should
+ * retype what they typed last time. */
+const NAME_KEY = 'stationmaster-displayname';
 
 const $ = <T extends HTMLElement = HTMLElement>(id: string): T => document.getElementById(id) as T;
+const has = (id: string): boolean => document.getElementById(id) !== null;
 
-async function postJson(path: string, body: unknown): Promise<{ status: number; body: Record<string, unknown> }> {
+/**
+ * A server code turned into a sentence.
+ *
+ * `LOBBY_FULL` and `BAD_PLAYER_COUNT` used to be printed at the player exactly as the server said
+ * them. The codes are the server's vocabulary, not the table's.
+ */
+function explain(code: unknown, fallback: string): string {
+  const messages: Record<string, string> = {
+    LOBBY_FULL: 'That table is already full — every chair is taken.',
+    ALREADY_STARTED: 'That game has already started.',
+    BAD_PLAYER_COUNT: 'That table size cannot start a game — 2 to 4 players.',
+    NOT_HOST: 'Only the host can do that.',
+    NAME_TAKEN: 'Somebody at that table is already using that name — pick another.',
+    'bad or missing secret': 'That join secret was not accepted by this server.',
+    // What a lobby answers once it has become a GAME — most often seen by a host pressing Start
+    // twice, and by a tab left open on a lobby that started somewhere else.
+    'no such lobby': 'That game is no longer waiting to start — it has either begun or been closed.',
+    'no open lobby with that code': 'No game is waiting under that code. Check it, or ask for a new one — a game that has already started cannot be joined.',
+  };
+  const key = typeof code === 'string' ? code : '';
+  return messages[key] ?? (key !== '' ? key : fallback);
+}
+
+/** Exported for `main.ts`'s seat-recovery path (Gitea#33), so there is one JSON POST on this page. */
+export async function postJson(path: string, body: unknown): Promise<{ status: number; body: Record<string, unknown> }> {
   const res = await fetch(path, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -46,21 +117,89 @@ async function postJson(path: string, body: unknown): Promise<{ status: number;
   return { status: res.status, body: (await res.json()) as Record<string, unknown> };
 }
 
+async function getJson(path: string): Promise<{ status: number; body: Record<string, unknown> }> {
+  const res = await fetch(path);
+  return { status: res.status, body: (await res.json().catch(() => ({}))) as Record<string, unknown> };
+}
+
 /**
- * Shows `#lobby`, drives it through creating or joining a game and then seating, and calls
- * `onReady` exactly once — the instant `Lobby.Start` fires, from WHICHEVER browser tab started it.
- * Never calls back more than once; the caller is expected to tear this screen down (`main.ts` hides
- * `#lobby` and shows `#gameui`) as its very first action inside `onReady`.
+ * Shows `#lobby` and drives it. `resume` re-enters the seating screen for a browser that already
+ * holds a seat (a reload before the host started) rather than starting at the doors.
  */
-export function runLobby(onReady: (r: LobbyReady) => void): void {
+export function runLobby(handlers: LobbyHandlers, resume?: { token: string; gameId: string; gameCode: string }): void {
+  // Nothing below exists on a page that is not `play.html` — and `main.ts` is imported by tests that
+  // stub only part of the DOM. Bail rather than throwing through the module's caller.
+  if (!has('lobby') || !has('lb-choice-section')) return;
   $('lobby').hidden = false;
-  $<HTMLInputElement>('lb-secret').value = localStorage.getItem(SECRET_KEY) ?? '';
+  /**
+   * THE TWO DOORS COME BACK EVERY TIME THIS SCREEN DOES.
+   *
+   * `enterSeating` hides this section, and until v0.8.1.0 the only things that put it back were the
+   * lobby's OWN leave paths. Leaving a running game is a different route — `main.ts`'s Leave game
+   * button calls `runLobby` again — so the section stayed hidden from the previous seating and the
+   * screen came back holding nothing but "Games you are in". Reported 2026-09-22: "I see the games
+   * that I'm in, and I have the ability to rejoin or forget. But what if I want to join a different
+   * game or start a new one? How do I get back there?" There was no way: the doors were on the
+   * page, display:none, with no control that could reveal them.
+   *
+   * Reset here rather than in the leave handler, because this function is the one thing every route
+   * onto the lobby goes through — which is exactly why the two that did it themselves missed a third.
+   */
+  $('lb-choice-section').hidden = false;
+  if (has('lb-seating-section')) $('lb-seating-section').hidden = true;
 
+  const form = settingsForm('lb-');
   let source: EventSource | null = null;
+  let done = false;
 
-  function setError(id: string, message: string): void {
-    $(id).textContent = message;
+  /**
+   * THE GAMES THIS BROWSER IS ALREADY IN.
+   *
+   * Rejoining is what the stored token is FOR, and until now the only thing that ever used one was a
+   * bare page load — so a player who left a game, or who joined a second, had no way to get back to
+   * the first. Drawn from the page's own storage (`main.ts`), never from this module.
+   */
+  function renderKnown(): void {
+    if (!has('lb-known')) return;
+    const games = handlers.known?.() ?? [];
+    $('lb-known').hidden = games.length === 0;
+    if (games.length === 0) return;
+    $('lb-known-list').innerHTML = games
+      .map(
+        (g) =>
+          `<div class="lb-known-row"><span class="code">${escapeHtml(g.gameCode || g.gameId.slice(0, 8))}</span>` +
+          `<span class="dim">${g.stage === 'lobby' ? 'waiting to start' : 'in play'}</span>` +
+          `<button class="lb-rejoin" data-game="${escapeHtml(g.gameId)}">Rejoin</button>` +
+          `<button class="lb-forget ghost" data-game="${escapeHtml(g.gameId)}">Forget</button></div>`,
+      )
+      .join('');
+    for (const btn of Array.from($('lb-known-list').querySelectorAll<HTMLButtonElement>('.lb-rejoin'))) {
+      btn.onclick = () => handlers.rejoin?.(btn.dataset['game'] ?? '');
+    }
+    for (const btn of Array.from($('lb-known-list').querySelectorAll<HTMLButtonElement>('.lb-forget'))) {
+      btn.onclick = () => {
+        // Confirmed, because it is not recoverable from this browser: the token IS the identity
+        // (`lobby-and-sessions.md` §1), and nothing else on this server will accept a claim to that
+        // seat.
+        const code = btn.previousElementSibling?.previousElementSibling?.textContent ?? 'that game';
+        if (!confirm(`Forget ${code}? This browser will not be able to rejoin it — your seat stays in the game, and only whoever runs the server could let you back in.`)) return;
+        handlers.forget?.(btn.dataset['game'] ?? '');
+        renderKnown();
+      };
+    }
   }
+  renderKnown();
+
+  // -- the join secret ------------------------------------------------------------------------
+
+  function showSecret(saved: boolean): void {
+    $('lb-secret-saved').hidden = !saved;
+    $('lb-secret-ask').hidden = saved;
+  }
+  const storedSecret = localStorage.getItem(SECRET_KEY) ?? '';
+  $<HTMLInputElement>('lb-secret').value = storedSecret;
+  showSecret(storedSecret !== '');
+  $<HTMLButtonElement>('lb-secret-change').onclick = () => showSecret(false);
 
   function secret(): string {
     const value = $<HTMLInputElement>('lb-secret').value;
@@ -68,25 +207,244 @@ export function runLobby(onReady: (r: LobbyReady) => void): void {
     return value;
   }
 
+  /** A rejected secret re-opens the field it is about — the error used to appear a screen away from
+   * the box that caused it. */
+  function secretRejected(status: number): boolean {
+    if (status !== 403) return false;
+    showSecret(false);
+    $<HTMLInputElement>('lb-secret').focus();
+    return true;
+  }
+
+  // -- display name ---------------------------------------------------------------------------
+
+  const nameField = $<HTMLInputElement>('lb-name');
+  nameField.value = localStorage.getItem(NAME_KEY) ?? '';
+  function displayName(): string {
+    const value = nameField.value.trim();
+    if (value !== '') localStorage.setItem(NAME_KEY, value);
+    return value;
+  }
+
+  // -- the two doors --------------------------------------------------------------------------
+
+  function door(which: 'join' | 'create'): void {
+    $('lb-join-panel').hidden = which !== 'join';
+    $('lb-create-panel').hidden = which !== 'create';
+    $('lb-door-join').classList.toggle('active', which === 'join');
+    $('lb-door-create').classList.toggle('active', which === 'create');
+  }
+  $<HTMLButtonElement>('lb-door-join').onclick = () => door('join');
+  $<HTMLButtonElement>('lb-door-create').onclick = () => door('create');
+
+  // -- the create form ------------------------------------------------------------------------
+
+  /** The named type the form is currently measured against — and, for a Custom game, the type it is
+   * scored as. Custom is only ever reached FROM one of these, so there is always an answer. */
+  let base: PresetName = 'coop';
+  let type: GameType = 'coop';
+  /** Once the host types a Revenue floor it is theirs; players and days stop re-deriving it. */
+  let floorTyped = false;
+
+  const players = (): number => Number($<HTMLSelectElement>('lb-players').value) || 4;
+  const days = (): number => {
+    const raw = Number($<HTMLInputElement>('lb-days').value);
+    return Number.isFinite(raw) && raw >= 1 ? Math.round(raw) : 5;
+  };
+
+  function typeRadios(): HTMLInputElement[] {
+    return Array.from(document.querySelectorAll<HTMLInputElement>('input[name="lb-type"]'));
+  }
+
+  /** Reset every rule to a named type. Seed, players and days are parameters, and are left alone. */
+  function selectPreset(name: PresetName): void {
+    base = name;
+    type = name;
+    floorTyped = false;
+    const values = presetSettings(name, players(), days());
+    form.write(values, values);
+    form.setEmployeeRotationAvailable(true);
+    refresh();
+  }
+
+  function refresh(): void {
+    const differing = form.mark(base, players(), days());
+    if (differing.length > 0) type = 'custom';
+    else if (type === 'custom') type = base;
+    for (const r of typeRadios()) r.checked = r.value === type;
+
+    /**
+     * NO SENTENCE UNDER THE RADIOS since 2026-08-30 — it restated the type just chosen to the person
+     * who had just chosen it, and the row is already labelled and already carries its own
+     * description (Jesse: "There's no need to repeat it below"). `form.mark` still puts a hint on
+     * each row that actually differs, which is where a Custom game's differences can be acted on.
+     */
+    // A Custom game is nobody's default: open the block that says how it differs.
+    if (type === 'custom') $<HTMLDetailsElement>('lb-settings').open = true;
+  }
+
+  for (const r of typeRadios()) {
+    // Solitaire is on this screen so the two screens read as one list, but there is nothing here to
+    // deal it with. Dimmed and left to speak for itself: the heading says "Game type
+    // (multi-player)", which is the explanation (Jesse, 2026-08-30).
+    if (r.value === 'solitaire') markUnavailable(r);
+    r.onchange = () => {
+      if (!r.checked) return;
+      if (r.value === 'custom') {
+        // Clicking Custom keeps everything as it stands, and keeps the scoring of the type it came
+        // from (Jesse, 2026-08-23) — it is only ever reached from one of the named types.
+        type = 'custom';
+        refresh();
+        return;
+      }
+      selectPreset(r.value as PresetName);
+    };
+  }
+
+  form.onEdit((key) => {
+    // The floor is derived until somebody sets it; ticking the condition off counts as setting it.
+    if (key === 'minCombinedRevenue') floorTyped = true;
+    type = 'custom';
+    refresh();
+  });
+
+  /** Players and days are parameters, not settings: they re-derive the floor and never make a game
+   * Custom by themselves. */
+  function paramsChanged(): void {
+    if (!floorTyped) {
+      const values = form.read();
+      const want = presetSettings(base, players(), days());
+      form.write({ ...values, minCombinedRevenue: want.minCombinedRevenue }, want);
+    }
+    refresh();
+  }
+  $<HTMLSelectElement>('lb-players').onchange = paramsChanged;
+  $<HTMLInputElement>('lb-days').oninput = paramsChanged;
+
+  selectPreset('coop');
+  door('join');
+
+  // -- creating -------------------------------------------------------------------------------
+
+  $<HTMLButtonElement>('lb-create').onclick = () => {
+    const name = displayName();
+    if (name === '') {
+      $('lb-create-err').textContent = 'Enter a display name first.';
+      return;
+    }
+    const asked = $<HTMLInputElement>('lb-seed').value.trim();
+    // Blank or unparseable both mean "surprise me", which is what leaving the box alone asks for.
+    const seed = asked === '' || !Number.isFinite(Number(asked)) ? null : Math.trunc(Number(asked));
+    const config = configFromSettings(form.read(), preset(base).scoring, days(), preset(base).pvpCards);
+
+    $('lb-create-err').textContent = '';
+    void postJson('/api/lobby/create', {
+      secret: secret(),
+      config,
+      displayName: name,
+      players: players(),
+      seed,
+    }).then(({ status, body }) => {
+      if (status !== 200) {
+        secretRejected(status);
+        $('lb-create-err').textContent = explain(body['error'], 'Could not create the game.');
+        return;
+      }
+      enterSeating(body['gameId'] as string, body['token'] as string, body['gameCode'] as string);
+    });
+  };
+
+  // -- joining --------------------------------------------------------------------------------
+
+  let previewed: Preview | null = null;
+
+  function showPreview(p: Preview): void {
+    previewed = p;
+    $('lb-preview').hidden = false;
+    $('lb-preview-code').textContent = p.gameCode;
+    const near = closestPreset(p.config, p.players, p.config.days);
+    const label = gameTypeLabel(
+      near.differing.length === 0 ? near.name : 'custom',
+      p.config.mode,
+    );
+    $('lb-preview-type').textContent =
+      near.differing.length === 0
+        ? label
+        : `${label} · ${near.differing.length} ${near.differing.length === 1 ? 'setting differs' : 'settings differ'} from ${preset(near.name).label}`;
+    const taken = p.seated.filter((s) => s.who !== null || s.bot).length;
+    const names = p.seated
+      .map((s) => (s.bot ? 'a bot' : (s.who ?? 'empty')))
+      .join(', ');
+    $('lb-preview-who').textContent = `Host: ${p.hostName} · ${taken} of ${p.players} seats taken — ${names}`;
+    $('lb-preview-rules').innerHTML = rulesListHtml(p.config, p.players, p.config.days);
+  }
+
+  $<HTMLButtonElement>('lb-look').onclick = () => {
+    const code = $<HTMLInputElement>('lb-code').value.trim().toUpperCase();
+    $('lb-preview').hidden = true;
+    if (code === '') {
+      $('lb-join-err').textContent = 'Enter the game code you were given.';
+      return;
+    }
+    $('lb-join-err').textContent = '';
+    void getJson(
+      `/api/lobby/preview?gameCode=${encodeURIComponent(code)}&secret=${encodeURIComponent(secret())}`,
+    ).then(({ status, body }) => {
+      if (status !== 200) {
+        secretRejected(status);
+        $('lb-join-err').textContent = explain(body['error'], 'Could not look up that game.');
+        return;
+      }
+      showPreview(body as unknown as Preview);
+    });
+  };
+
+  $<HTMLButtonElement>('lb-join').onclick = () => {
+    const name = displayName();
+    const code = previewed?.gameCode ?? $<HTMLInputElement>('lb-code').value.trim().toUpperCase();
+    if (name === '') {
+      $('lb-join-err').textContent = 'Enter a display name first.';
+      return;
+    }
+    $('lb-join-err').textContent = '';
+    void postJson('/api/lobby/join', { secret: secret(), gameCode: code, displayName: name }).then(
+      ({ status, body }) => {
+        if (status !== 200) {
+          secretRejected(status);
+          $('lb-join-err').textContent = explain(body['error'], 'Could not join that game.');
+          return;
+        }
+        enterSeating(body['gameId'] as string, body['token'] as string, code);
+      },
+    );
+  };
+
+  // -- seating --------------------------------------------------------------------------------
+
   function renderSeating(lobby: Lobby, you: PlayerIndex, token: string): void {
     $('lb-gamecode').textContent = lobby.gameCode;
     const isHost = lobby.hostToken === token;
 
     let html = '';
+    // Bots are numbered here exactly as `startLobby` numbers them at the moment the game starts, so
+    // the table you set up is the table that appears on the board.
+    let botNumber = 0;
     for (let seat = 0; seat < lobby.seats.length; seat++) {
       const occupant = lobby.seats[seat] ?? null;
       const isYou = occupant?.kind === 'human' && occupant.token === token;
       const isSeatHost = occupant?.kind === 'human' && occupant.token === lobby.hostToken;
+      if (occupant?.kind === 'bot') botNumber++;
       const who =
         occupant === null
           ? '<span class="dim">— waiting —</span>'
           : occupant.kind === 'bot'
-            ? 'Bot'
-            : `${occupant.displayName}${isYou ? ' (you)' : ''}${isSeatHost ? ' — host' : ''}`;
+            ? `Bot ${botNumber}`
+            : `${escapeHtml(occupant.displayName)}${isYou ? ' (you)' : ''}${isSeatHost ? ' — host' : ''}`;
       let action = '';
       if (isHost) {
         if (occupant === null) action = `<button class="lb-bot-add" data-seat="${seat}">+ bot</button>`;
         else if (occupant.kind === 'bot') action = `<button class="lb-bot-remove" data-seat="${seat}">remove bot</button>`;
+        else if (!isYou) action = `<button class="lb-kick" data-seat="${seat}">remove</button>`;
       }
       html += `<div class="lb-seat"><span class="dim">Seat ${seatLabel(seat)}</span><span class="who">${who}</span>${action}</div>`;
     }
@@ -94,21 +452,30 @@ export function runLobby(onReady: (r: LobbyReady) => void): void {
 
     /**
      * The code is the whole invitation, so it has to leave this screen by some route other than
-     * being read off it and retyped. `navigator.clipboard` is unavailable on an insecure origin
-     * and can be refused outright, so a failure says the code is there to be selected rather than
-     * silently doing nothing.
+     * being read off it and retyped. Two buttons because they are two different acts: the CODE is
+     * what you read aloud on a call and works at whatever address each player reaches the box by;
+     * the LINK is what you paste into a chat, and only works for someone who can reach this address.
+     * Neither carries the join secret — that is the door key, and it travels out of band.
+     *
+     * `navigator.clipboard` is unavailable on an insecure origin and can be refused outright, so a
+     * failure says the code is there to be selected rather than silently doing nothing.
      */
-    const copyBtn = $<HTMLButtonElement>('lb-copy');
-    copyBtn.onclick = () => {
-      const say = (m: string): void => {
-        $('lb-copied').textContent = m;
-        setTimeout(() => ($('lb-copied').textContent = ''), 4000);
-      };
+    const say = (m: string): void => {
+      $('lb-copied').textContent = m;
+      setTimeout(() => ($('lb-copied').textContent = ''), 4000);
+    };
+    const copy = (text: string, ok: string): void => {
       void navigator.clipboard
-        ?.writeText(lobby.gameCode)
-        .then(() => say('Copied.'))
+        ?.writeText(text)
+        .then(() => say(ok))
         .catch(() => say('Could not copy — select the code above instead.'));
     };
+    $<HTMLButtonElement>('lb-copy').onclick = () => copy(lobby.gameCode, 'Code copied.');
+    $<HTMLButtonElement>('lb-copylink').onclick = () =>
+      copy(
+        `${location.origin}${location.pathname}?lobby&code=${encodeURIComponent(lobby.gameCode)}`,
+        'Invite link copied — the join secret is not in it.',
+      );
 
     for (const btn of Array.from($('lb-seats').querySelectorAll<HTMLButtonElement>('.lb-bot-add'))) {
       btn.onclick = () => void postJson('/api/lobby/bot', { token, seat: Number(btn.dataset['seat']), filled: true });
@@ -116,135 +483,162 @@ export function runLobby(onReady: (r: LobbyReady) => void): void {
     for (const btn of Array.from($('lb-seats').querySelectorAll<HTMLButtonElement>('.lb-bot-remove'))) {
       btn.onclick = () => void postJson('/api/lobby/bot', { token, seat: Number(btn.dataset['seat']), filled: false });
     }
+    for (const btn of Array.from($('lb-seats').querySelectorAll<HTMLButtonElement>('.lb-kick'))) {
+      btn.onclick = () => {
+        void postJson('/api/lobby/leave', { token, seat: Number(btn.dataset['seat']) }).then(({ status, body }) => {
+          if (status !== 200) $('lb-start-note').textContent = explain(body['error'], 'Could not clear that seat.');
+        });
+      };
+    }
+
+    // What everyone at the table is about to play — the host chose it, and until now nobody else
+    // could see any of it.
+    const near = closestPreset(lobby.config, lobby.seats.length, lobby.config.days);
+    const label = gameTypeLabel(near.differing.length === 0 ? near.name : 'custom', lobby.config.mode);
+    $('lb-seating-type').textContent =
+      near.differing.length === 0
+        ? label
+        : `${label} · ${near.differing.length} ${near.differing.length === 1 ? 'setting differs' : 'settings differ'} from ${preset(near.name).label}`;
+    $('lb-seating-rules').innerHTML = rulesListHtml(lobby.config, lobby.seats.length, lobby.config.days);
 
     const waiting = lobby.seats.filter((s) => s === null).length;
     const startBtn = $<HTMLButtonElement>('lb-start');
     startBtn.hidden = !isHost;
     startBtn.disabled = waiting > 0;
-    $('lb-start-note').textContent = isHost
-      ? waiting === 0
-        ? ''
-        : `Waiting on ${waiting} more ${waiting === 1 ? 'player' : 'players'} — add a bot to any empty chair to start now.`
-      : 'Waiting for the host to start the game.';
+    startBtn.textContent = 'Start game';
+    $('lb-start-note').textContent = '';
+    const waitNote = $('lb-stream-note');
+    if (waitNote.dataset['reason'] !== 'stream') {
+      waitNote.hidden = waiting === 0 && isHost;
+      waitNote.textContent = isHost
+        ? waiting === 0
+          ? ''
+          : `Waiting on ${waiting} more ${waiting === 1 ? 'player' : 'players'} — add a bot to any empty chair to start now.`
+        : 'Waiting for the host to start the game.';
+      waitNote.hidden = waitNote.textContent === '';
+    }
     startBtn.onclick = () => {
+      // No busy state used to mean a second press posted a second start, whose 409 landed on screen
+      // as a raw code.
+      startBtn.disabled = true;
+      startBtn.textContent = 'Starting…';
       void postJson('/api/lobby/start', { token }).then(({ status, body }) => {
-        if (status !== 200) setError('lb-start-note', String(body['error'] ?? 'could not start'));
+        if (status !== 200) {
+          startBtn.disabled = false;
+          startBtn.textContent = 'Start game';
+          $('lb-start-note').textContent = explain(body['error'], 'Could not start the game.');
+        }
       });
     };
   }
 
-  function enterSeating(gameId: string, token: string): void {
+  function streamNote(message: string): void {
+    const el = $('lb-stream-note');
+    el.dataset['reason'] = message === '' ? '' : 'stream';
+    el.textContent = message;
+    el.hidden = message === '';
+  }
+
+  function enterSeating(gameId: string, token: string, gameCode: string): void {
+    handlers.onSeated({ token, gameId, gameCode });
     $('lb-choice-section').hidden = true;
     $('lb-seating-section').hidden = false;
+
+    $<HTMLButtonElement>('lb-leave').onclick = () => {
+      void postJson('/api/lobby/leave', { token }).then(() => {
+        source?.close();
+        handlers.onLeft(gameId);
+        $('lb-seating-section').hidden = true;
+        $('lb-choice-section').hidden = false;
+        renderKnown();
+        notice('');
+      });
+    };
+
     source = new EventSource(`/api/lobby/stream?token=${encodeURIComponent(token)}`);
     source.onmessage = (ev: MessageEvent<string>) => {
+      streamNote('');
       const push = JSON.parse(ev.data) as LobbyPush;
       if (push.started) {
         source?.close();
-        onReady({ token, gameId, seat: push.you });
+        if (done) return;
+        done = true;
+        handlers.onReady({ token, gameId, seat: push.you, gameCode: push.lobby.gameCode });
         return;
       }
       renderSeating(push.lobby, push.you, token);
     };
-  }
 
-  const chosenMode = (): 'competitive' | 'coop' =>
-    ($('lb-choice-section').querySelector<HTMLInputElement>('input[name="lb-mode"]:checked')?.value ??
-      'competitive') as 'competitive' | 'coop';
-  const chosenPlayers = (): number => Number($<HTMLSelectElement>('lb-players').value) || 4;
-  const num = (id: string): number => Number($<HTMLInputElement>(id).value);
-
-  /**
-   * Mode and table size only move the DEFAULTS, exactly as the solitaire dialog's own presets do —
-   * every field stays editable afterwards, so "Co-op, 3 players" is a starting point rather than a
-   * fixed ruleset. Re-running this on a change is also what keeps the combined-Revenue floor
-   * honest: it is derived from the player count, and the count is a control on this form.
-   */
-  function applyDefaults(): void {
-    const c = defaultMultiplayerConfig(chosenMode(), chosenPlayers());
-    const rules = houseRules(c);
-    $<HTMLInputElement>('lb-days').value = String(c.days);
-    $<HTMLInputElement>('lb-minrev').value = String(c.minCombinedRevenue);
-    $<HTMLInputElement>('lb-colday').value = String(c.maxCollisionsPerDay);
-    $<HTMLInputElement>('lb-coltotal').value = String(c.maxCollisionsTotal);
-    $<HTMLInputElement>('lb-passenger').value = String(rules.revenue.passengerPerCoach);
-    $<HTMLInputElement>('lb-freight').value = String(rules.revenue.freightPerLoad);
-    $<HTMLInputElement>('lb-transit').value = String(rules.revenue.trainPerTransit);
-    // Co-op has no valid target for the opponent-directed cards, so the toggle is forced off rather
-    // than merely defaulted off — the same rule `buildDeck` applies.
-    const pvp = $<HTMLInputElement>('lb-pvp');
-    pvp.checked = c.pvpCardsAllowed;
-    pvp.disabled = chosenMode() !== 'competitive';
-  }
-  for (const input of Array.from(
-    $('lb-choice-section').querySelectorAll<HTMLInputElement>('input[name="lb-mode"]'),
-  )) {
-    input.onchange = applyDefaults;
-  }
-  $<HTMLSelectElement>('lb-players').onchange = applyDefaults;
-  applyDefaults();
-
-  $<HTMLButtonElement>('lb-create').onclick = () => {
-    const displayName = $<HTMLInputElement>('lb-name').value.trim();
-    const mode = chosenMode();
-    if (displayName === '') {
-      setError('lb-create-err', 'enter a display name first');
-      return;
-    }
-    const players = chosenPlayers();
-    const hand = $('lb-settings').querySelector<HTMLInputElement>('input[name="lb-hand"]:checked')?.value;
-    // Blank or unparseable both mean "surprise me", which is what leaving the box alone asks for.
-    const asked = $<HTMLInputElement>('lb-seed').value.trim();
-    const seed = asked === '' || !Number.isFinite(Number(asked)) ? null : Math.trunc(Number(asked));
-
-    const config: GameConfig = {
-      ...defaultMultiplayerConfig(mode, players),
-      days: Math.max(1, Math.round(num('lb-days')) || 5),
-      minCombinedRevenue: Math.max(0, Math.round(num('lb-minrev')) || 0),
-      maxCollisionsPerDay: Math.max(0, Math.round(num('lb-colday')) || 0),
-      maxCollisionsTotal: Math.max(0, Math.round(num('lb-coltotal')) || 0),
-      pvpCardsAllowed: $<HTMLInputElement>('lb-pvp').checked && mode === 'competitive',
-      optionalRules: {
-        reducedVisibility: $<HTMLInputElement>('lb-visibility').checked,
-        employeeRotation: $<HTMLInputElement>('lb-rotation').checked,
-        emergencyToolbox: $<HTMLInputElement>('lb-toolbox').checked,
-      },
-      houseRules: {
-        ...(STARTING_HAND_LABELS.some((o) => o.value === hand) ? { startingHand: hand as StartingHand } : {}),
-        revenue: {
-          passengerPerCoach: num('lb-passenger'),
-          freightPerLoad: num('lb-freight'),
-          trainPerTransit: num('lb-transit'),
-        },
-      },
-    };
-
-    void postJson('/api/lobby/create', { secret: secret(), config, displayName, players, seed }).then(
-      ({ status, body }) => {
-        if (status !== 200) {
-          setError('lb-create-err', String(body['error'] ?? 'could not create the game'));
+    /**
+     * A DEAD LOBBY AND A BLIP LOOK IDENTICAL HERE, so ask — the same shape `session.ts` already uses
+     * for the game stream, which the lobby never got.
+     *
+     * Three answers matter. The game may have STARTED while we were disconnected (the `started` push
+     * is sent once and then the connection closes, so a drop at the wrong moment loses it) —
+     * `/api/session` knows, and we go straight in. The lobby may still be there, in which case
+     * `EventSource` is already retrying and the note is all that is needed. Or it is gone, and
+     * sitting on a frozen seating screen is the one thing that must not happen.
+     */
+    source.onerror = () => {
+      if (done) return;
+      streamNote('Connection lost — retrying. You can leave and rejoin if this does not clear.');
+      void getJson(`/api/session?token=${encodeURIComponent(token)}`).then(({ status, body }) => {
+        if (done) return;
+        if (status === 200) {
+          done = true;
+          source?.close();
+          handlers.onReady({ token, gameId, seat: body['player'] as PlayerIndex, gameCode });
           return;
         }
-        setError('lb-create-err', '');
-        enterSeating(body['gameId'] as string, body['token'] as string);
-      },
-    );
-  };
+        void getJson(
+          `/api/lobby/preview?gameCode=${encodeURIComponent(gameCode)}&secret=${encodeURIComponent(secret())}`,
+        ).then(({ status: lobbyStatus }) => {
+          if (done || lobbyStatus === 200) return;
+          source?.close();
+          handlers.onLeft(gameId);
+          $('lb-seating-section').hidden = true;
+          $('lb-choice-section').hidden = false;
+          renderKnown();
+          streamNote('');
+          notice('That game is no longer waiting on this server — it was ended, or the last player left.');
+        });
+      });
+    };
+  }
 
-  $<HTMLButtonElement>('lb-join').onclick = () => {
-    const displayName = $<HTMLInputElement>('lb-name').value.trim();
-    const gameCode = $<HTMLInputElement>('lb-code').value.trim();
-    if (displayName === '' || gameCode === '') {
-      setError('lb-join-err', 'enter a display name and a game code');
-      return;
-    }
-    void postJson('/api/lobby/join', { secret: secret(), gameCode, displayName }).then(({ status, body }) => {
-      if (status !== 200) {
-        setError('lb-join-err', String(body['error'] ?? 'could not join that game'));
-        return;
-      }
-      setError('lb-join-err', '');
-      enterSeating(body['gameId'] as string, body['token'] as string);
-    });
-  };
+  if (resume) enterSeating(resume.gameId, resume.token, resume.gameCode);
+}
+
+/** The lobby-wide message slot: why you are looking at this screen, when it was not your own click. */
+export function notice(message: string): void {
+  const el = document.getElementById('lb-notice');
+  if (!el) return;
+  el.textContent = message;
+  el.hidden = message === '';
+}
+
+/** Prefills the code from an invite link and opens the join door on it. */
+export function prefillCode(code: string): void {
+  const field = document.getElementById('lb-code') as HTMLInputElement | null;
+  if (field) field.value = code.toUpperCase();
+}
+
+/**
+ * A CHOICE THAT CANNOT BE TAKEN HAS TO SAY SO.
+ *
+ * Reported by Jesse 2026-08-23: "solitaire is disabled, but really hard to tell." A bare `disabled`
+ * on a radio leaves the whole row at full strength — the dot simply refuses the click, which reads
+ * as a broken control rather than an unavailable one.
+ *
+ * The dimming is the whole signal now. It used to append a reason to the row as well, and dropped
+ * that in 2026-08-30 along with the same text on the solitaire screen: one heading naming which
+ * game the screen deals says it once, where three dimmed rows each said it again.
+ */
+function markUnavailable(radio: HTMLInputElement): void {
+  radio.disabled = true;
+  radio.closest('label')?.classList.add('disabled');
+}
+
+function escapeHtml(s: string): string {
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 }

src/web/panels.ts

@@ -31,8 +31,18 @@ export function cardRow(name: string, why: string, playable: boolean | null): st
 }
 
 export function handHtml(f: Frame, canPlay: (boolean | null)[] = []): string {
+  // §6.2 — say so on the card itself. A player who cannot discard a train needs to read that on the
+  // train, not deduce it from a button that is not there. The sentence comes off the Frame
+  // (`handKeepWhy`) rather than being written here, because since Gitea#9 there are two of them and
+  // which one applies depends on the card AND the game's rules.
   return f.hand.length
-    ? f.hand.map((h, i) => cardRow(h, f.handWhat[i] ?? '', canPlay[i] ?? null)).join('')
+    ? f.hand
+        .map((h, i) => {
+          const what = f.handWhat[i] ?? '';
+          const held = f.handKeepWhy[i];
+          return cardRow(h, held ? [what, held].filter(Boolean).join(' · ') : what, canPlay[i] ?? null);
+        })
+        .join('')
     : '<span class="dim">empty</span>';
 }
 
@@ -42,25 +52,61 @@ export function handHtml(f: Frame, canPlay: (boolean | null)[] = []): string {
  * Only the top card may ever be drawn, so the depth is a count and not a hint: everything below it
  * is out of reach, and choosing where to discard is choosing what to put there.
  */
-export function pilesHtml(f: Frame): string {
-  const pile = (label: string, top: string, depth: number, why: string, extra = '', slot = -1): string => {
+export function pilesHtml(f: Frame, lit: readonly string[] = []): string {
+  const pile = (
+    key: string,
+    label: string,
+    top: string,
+    depth: number,
+    why: string,
+    extra = '',
+    slot = -1,
+    faceDown = false,
+  ): string => {
     const tip = [why, extra].filter(Boolean).join(' · ');
     // A Department is a DROP TARGET for a discard. The attribute is always emitted; only the play
     // page binds a click to it, and only while a card is waiting to be discarded — so the replay
     // viewer draws exactly the same markup and nothing there is clickable.
     const target = slot >= 0 ? ` data-dept="${slot}"` : '';
+    // `lit` marks the pile the move being watched just touched — see `changedPiles`.
+    const cls = `handcard${faceDown ? ' facedown' : ''}${lit.includes(key) ? ' pilelit' : ''}`;
     return (
-      `<div class="handcard"${target}${tip ? ` data-tip="${esc(tip)}"` : ''} tabindex="0">` +
+      `<div class="${cls}"${target}${tip ? ` data-tip="${esc(tip)}"` : ''} tabindex="0">` +
       `<div class="pilehd"><span>${esc(label)}</span><span class="depth">${depth}</span></div>` +
       `<b>${esc(top)}</b></div>`
     );
   };
   return (
+    /**
+     * THE HOME OFFICE DECK, which the screen had never drawn.
+     *
+     * `f.deck` has carried the face-down count since the Frame existed and nothing read it — the
+     * exact shape of display gap `test/display-gaps.test.ts` was written to sweep for, surviving in
+     * the panel that draws every OTHER pile. Asked for by Jesse 2026-09-10 for a second reason: a
+     * player drawing from it is the commonest move nobody can see, so it needs somewhere to flash.
+     *
+     * FIRST, because that is the order a card travels: out of here, into a hand, then onto a
+     * Department or the Salvage Yard. Face down, so the card slot says so rather than naming a card
+     * — the whole point of this pile is that nobody knows what is on top.
+     */
+    pile(
+      'home',
+      'Home Office',
+      'face down',
+      f.deck,
+      'The draw deck. Face down — nobody sees what is on top, and a card drawn from here is private ' +
+        'to whoever drew it. When it runs out, the Salvage Yard and the Departments are swept back ' +
+        'into it.',
+      '',
+      -1,
+      true,
+    ) +
     f.departments
       .map((d, i) => {
         const depth = f.departmentDepth[i] ?? 0;
         const under = depth - 1;
         return pile(
+          `dept${i}`,
           `Dept ${i + 1}`,
           d,
           depth,
@@ -71,6 +117,7 @@ export function pilesHtml(f: Frame): string {
       })
       .join('') +
     pile(
+      'salvage',
       'Salvage',
       f.salvage.top,
       f.salvage.depth,
@@ -143,6 +190,371 @@ export function timetableHtml(f: Frame, justSet: number | null): string {
   return `<div class="tt">${slots}</div>`;
 }
 
+/**
+ * THE DAY THAT JUST ENDED — the body of the dialog `main.ts` puts up at every Day rollover.
+ *
+ * Reported as Gitea#10: "as the game rolls off the end of the day, you get a dialog saying such.
+ * Hard to keep track of time." The clock was on screen the whole time, but a Day turns over inside
+ * the automatic phases — between one click and the next — and neither the phase banner (2.6s) nor
+ * the announcement flash (4.2s) survives long enough to be noticed by someone reading the board.
+ * A modal is the point: it stops, and it waits to be dismissed.
+ *
+ * It is written from the FRAME AFTER the rollover, so `f.day` is the Day about to start and the one
+ * that ended is the Day before it. Standings are in Revenue order rather than seat order: the
+ * question at the end of a Day is who is ahead.
+ */
+export function dayEndHtml(f: Frame): string {
+  const ended = f.day - 1;
+  const left = f.days + f.extraDays - ended;
+
+  const ahead =
+    left <= 0
+      ? '<p>That was the last Day on the timetable.</p>'
+      : `<p><b>Day ${f.day} of ${f.days + f.extraDays}</b> begins now — ${left} ${left === 1 ? 'Day' : 'Days'} left to run.</p>`;
+
+  return (
+    `<h3 class="dayend-h">Day ${ended} has ended</h3>` +
+    ahead +
+    standingsHtml(f) +
+    targetHtml(f) +
+    collisionsHtml(f, ended)
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Shared between the Day-end dialog and the end-of-game results screen.
+//
+// Gitea#16 asked for the results screen and Gitea#10's dialog had already assembled most of it. The
+// three blocks below are the overlap, factored out rather than written twice: the two screens report
+// the same numbers about the same game, and the one thing they must never do is disagree.
+// ---------------------------------------------------------------------------
+
+/**
+ * Every player in Revenue order, the viewer marked.
+ *
+ * `winner` rings the player the OFFICIAL result named, which is not always the player at the top:
+ * in an extended game the standings keep moving after the result is settled, and showing the leader
+ * without saying who actually won would be the screen contradicting itself.
+ */
+function standingsHtml(f: Frame, winner: number | null = null): string {
+  const rows = [...f.players]
+    .sort((a, b) => b.revenue - a.revenue || a.seat - b.seat)
+    .map((p) => {
+      const marks =
+        (p.index === f.viewer ? ' <span class="dim">(you)</span>' : '') +
+        (p.index === winner ? ' <span class="wins">— winner</span>' : '');
+      return (
+        `<tr${p.index === f.viewer ? ' class="you"' : ''}><td>${esc(p.name)}${marks}</td>` +
+        `<td class="num">${p.revenue}</td></tr>`
+      );
+    })
+    .join('');
+  return `<table class="dayend-t"><tbody>${rows}</tbody></table>`;
+}
+
+/**
+ * The target is a COMBINED floor in every mode that sets one, so it is reported against the whole
+ * table's Revenue rather than the viewer's — showing one player's score against a four-player
+ * target reads as a hopeless position when the table may be comfortably ahead.
+ */
+function targetHtml(f: Frame): string {
+  if (f.minCombinedRevenue <= 0) return '';
+  const combined = f.players.reduce((n, p) => n + p.revenue, 0);
+  const met = combined >= f.minCombinedRevenue;
+  return (
+    `<p>Combined Revenue <b>${combined}</b> against a target of <b>${f.minCombinedRevenue}</b>` +
+    `${met ? ' — cleared.' : ' — short.'}</p>`
+  );
+}
+
+/**
+ * Only when the game is actually scored on collisions.
+ *
+ * Two conditions, both of them `advance.ts`'s own: `0` on a dial turns that check off, and the
+ * checks run in COMPETITIVE AND CO-OP ONLY (§3.4). A solitaire game carries the default dials on
+ * its config and enforces neither, so reporting a collision budget there would put a rule on
+ * screen that this game does not have.
+ */
+function collisionsHtml(f: Frame, endedDay?: number): string {
+  const scoredOnCollisions =
+    (f.mode === 'competitive' || f.mode === 'coop') &&
+    (f.maxCollisionsTotal > 0 || f.maxCollisionsPerDay > 0);
+  if (!scoredOnCollisions) return '';
+  /**
+   * "TODAY" IS THE WRONG WORD IN A DAY-END DIALOG, and it read as a contradiction.
+   *
+   * That dialog is drawn from the frame whose `day` went UP — which is the same frame in which
+   * `collisionsToday` was reset — so it reported 0 however many there had been. Jesse, 2026-09-09,
+   * at the end of a Day 1 with two collisions in it: "it shows a total of two collisions, but zero
+   * today ... that does seem to be a contradiction."
+   *
+   * So when the caller knows which Day just ended it says so by name, and reads the count captured at
+   * the rollover. The end-of-game results screen passes nothing and keeps "today", where the Day has
+   * not turned over and the word is accurate.
+   */
+  const [count, when] =
+    endedDay === undefined
+      ? [f.collisionsToday, 'today']
+      : [f.collisionsPrevDay, `on Day ${endedDay}`];
+  return `<p>Collisions: <b>${count}</b> ${when}, <b>${f.collisionsTotal}</b> in all.</p>`;
+}
+
+/**
+ * WHY THE GAME ENDED, as a sentence (Gitea#16).
+ *
+ * The page used to interpolate `outcome.reason` straight into the DOM, so a player who finished a
+ * game read the words `GAME OVER — revenueFloor`: an internal enum value, printed at the one moment
+ * the game has the player's whole attention. Each reason gets a sentence that says what actually
+ * happened, with this game's own numbers in it.
+ *
+ * EXPORTED for the developer replay recorder (`sim/replay.ts`), which was still printing
+ * `loss — revenueFloor` into its own heading a release after this was written — the same defect the
+ * issue was filed about, surviving in the one place nobody had looked (`TODO.md` #34). One
+ * implementation, so the two cannot say the game ended for different reasons.
+ */
+export function reasonSentence(f: Frame, o: NonNullable<Frame['outcome']>, day: number): string {
+  const combined = f.players.reduce((n, p) => n + p.revenue, 0);
+  switch (o.reason) {
+    case 'daysElapsed':
+      return `Day ${day} was the last on the timetable, and it ran out.`;
+    case 'revenueFloor':
+      return (
+        `The Division closed short: <b>${combined}</b> Revenue between everyone, against a floor of ` +
+        `<b>${f.minCombinedRevenue}</b>. §3.3 — miss the floor and the whole table loses, whoever ` +
+        `earned the most.`
+      );
+    case 'collisionFloor':
+      return (
+        `Too many collisions — <b>${f.collisionsToday}</b> in one Day and <b>${f.collisionsTotal}</b> ` +
+        `in all, against limits of ${f.maxCollisionsPerDay || '—'} and ${f.maxCollisionsTotal || '—'}. ` +
+        `§3.4 — the railroad was declared unsafe and the game was stopped.`
+      );
+  }
+}
+
+/** The rules this game was actually dealt under — Gitea#16's "what the rules of the game were". */
+function rulesHtml(f: Frame): string {
+  const mode =
+    f.mode === 'coop' ? 'Co-op — the table scores together' :
+    f.mode === 'competitive' ? 'Competitive — highest Revenue wins' :
+    'Solitaire';
+  const optional = [
+    f.optionalRules.employeeRotation ? 'Employee Rotation' : null,
+    f.optionalRules.reducedVisibility ? 'Reduced Visibility' : null,
+    f.optionalRules.emergencyToolbox ? 'Emergency Toolbox' : null,
+  ].filter((x): x is string => x !== null);
+  const r = f.houseRules.revenue;
+
+  const rows: [string, string][] = [
+    ['Scoring', mode],
+    ['Timetable', f.extraDays > 0
+      ? `${f.days} Days, extended by ${f.extraDays} more`
+      : `${f.days} Day${f.days === 1 ? '' : 's'}`],
+    ['Revenue floor', f.minCombinedRevenue > 0 ? `${f.minCombinedRevenue} combined` : 'none'],
+    ['Collision limits', f.maxCollisionsPerDay > 0 || f.maxCollisionsTotal > 0
+      ? `${f.maxCollisionsPerDay || '—'} per Day, ${f.maxCollisionsTotal || '—'} in all`
+      : 'not scored'],
+    ['Pay rates', `${r.freightPerLoad} per load, ${r.passengerPerCoach} per coach, ${r.trainPerTransit} per transit`],
+    ['Extras start', f.houseRules.extraStart === 'divisionPointsOnly' ? 'Division Points and the Interchange'
+      : f.houseRules.extraStart === 'ownOffice' ? 'those, plus your own Control Point'
+      : 'those, plus any Control Point'],
+    ['Timetabled trains', f.houseRules.discardTimetabled ? 'may be discarded' : 'are never discarded'],
+    ['Optional rules', optional.length ? optional.join(', ') : 'none'],
+  ];
+
+  return `<h4 class="res-h">The rules in play</h4>${factTable(rows)}`;
+}
+
+/**
+ * A two-column table of plain-text facts.
+ *
+ * BOTH HALVES ESCAPED, exactly once, which is the only reason this is a shared helper rather than a
+ * template repeated twice. The rows it is given today are numbers and fixed phrases, but they are
+ * assembled from the Frame — and the day somebody adds a row carrying a player's name, or a facility
+ * label, the escaping has to already be here rather than be remembered.
+ */
+function factTable(rows: [string, string][]): string {
+  return (
+    '<table class="res-t"><tbody>' +
+    rows.map(([k, v]) => `<tr><td>${esc(k)}</td><td>${esc(v)}</td></tr>`).join('') +
+    '</tbody></table>'
+  );
+}
+
+/**
+ * THE RAILROAD — what actually happened out there, from `GameState.tally` (Gitea#16).
+ *
+ * Rows that would read zero for a reason (no passenger work in a game that had none, no collisions
+ * in a clean one) are dropped rather than printed as `0`: a screen of zeroes reads as a bug, and the
+ * absence of a line is the same information more quietly. A zero that is genuinely interesting —
+ * trains through the Division — stays.
+ */
+function tallyHtml(t: Frame['tally']): string {
+  const rows: [string, string][] = [['Trains through the Division', String(t.trainsCompleted)]];
+
+  if (t.trainsCompleted > 0) {
+    rows.push([
+      'Of those, worked en route',
+      `${t.trainsCompletedWithWork} of ${t.trainsCompleted}` +
+        (t.trainsCompletedWithWork === t.trainsCompleted ? ' — every one' : ''),
+    ]);
+  }
+  const push = (label: string, n: number, detail = ''): void => {
+    if (n > 0) rows.push([label, `${n}${detail}`]);
+  };
+  push('Loads made up', t.loadsCompleted);
+  push('Loads broken', t.unloadsCompleted);
+  /**
+   * BOTH HALVES OF THE MEN | AT | WORK PIPELINE, not just the loading one.
+   *
+   * §9.1 makes loading and unloading the same shape — begun, then carried through — and the Tally
+   * has counted both since it was written. The screen reported only the loading side, so a player
+   * with three unloads part-finished at the final whistle was told nothing about them while the
+   * equivalent loads were listed. Found 2026-08-30 auditing which Frame fields nothing reads:
+   * `unloadsBegun` was one of four, and the only one whose absence was visible on screen.
+   */
+  push('Loads still in the pipeline', t.loadsStarted - t.loadsCompleted);
+  push('Unloads still in the pipeline', t.unloadsBegun - t.unloadsCompleted);
+  push('Passengers boarded', t.passengersBoarded);
+  push('Passengers detrained', t.passengersDetrained);
+  push('Cars coupled', t.carsCoupled);
+  push('Cars set out', t.carsDropped);
+  push('Extras run', t.extrasStarted);
+  push('Second sections ordered', t.secondSections);
+  push('Flying switches', t.flyingSwitches);
+  push('Offices upgraded', t.officeUpgrades);
+  push('Facilities unjammed', t.facilitiesUnjammed);
+  push('Trains held', t.trainsHeld);
+  push('Trains diverted', t.trainsDiverted);
+  push('Expedite faults', t.expediteFaults);
+  push('Dispatch bonuses used', t.dispatchBonusesUsed);
+  if (t.clearancesRequested > 0) {
+    rows.push(['Clearances', `${t.clearancesAllowed} allowed of ${t.clearancesRequested} asked`]);
+  }
+  if (t.trainsDestroyed > 0) {
+    rows.push([
+      'Trains destroyed',
+      `${t.trainsDestroyed}, taking ${t.carsDestroyed} car${t.carsDestroyed === 1 ? '' : 's'} with them`,
+    ]);
+  }
+  // §X18 only — the one card in the deck that pays a train for standing still. Reported as what it
+  // is rather than as "the longest an engine sat on a siding", which the engine cannot answer (see
+  // `Tally.circusStops`).
+  if (t.circusStops.length > 0) {
+    rows.push([
+      'Circus set-ups',
+      t.circusStops.map((c) => `Train ${c.trainNumber} at ${c.where}`).join(', '),
+    ]);
+  }
+  push('Cards drawn', t.cardsDrawn);
+  push('Cards played', t.cardsPlayed);
+  // Gitea#9 made throwing a Timetabled train away a legal and deliberate move, so a discard is a
+  // CHOICE the player made rather than an accident of the hand limit — and the engine has counted
+  // it all along while the screen listed only draws and plays beside it.
+  push('Cards discarded', t.cardsDiscarded);
+
+  return `<h4 class="res-h">The railroad</h4>${factTable(rows)}`;
+}
+
+/** Per-player work, for a table that wants to know who did what rather than only who won. */
+function perPlayerHtml(f: Frame): string {
+  const t = f.tally;
+  if (f.players.length < 2) return '';
+  const head =
+    '<tr><th></th><th class="num">Rev</th><th class="num">Loads</th><th class="num">Unloads</th>' +
+    '<th class="num">Pass.</th><th class="num">Cards</th><th class="num">Crashes</th></tr>';
+  const rows = [...f.players]
+    .sort((a, b) => b.revenue - a.revenue || a.seat - b.seat)
+    .map((p) => {
+      const q = t.byPlayer[p.index];
+      if (!q) return '';
+      return (
+        `<tr${p.index === f.viewer ? ' class="you"' : ''}><td>${esc(p.name)}</td>` +
+        `<td class="num">${p.revenue}</td><td class="num">${q.loads}</td>` +
+        `<td class="num">${q.unloads}</td>` +
+        `<td class="num">${q.passengersBoarded + q.passengersDetrained}</td>` +
+        `<td class="num">${q.cardsPlayed}</td><td class="num">${q.collisions}</td></tr>`
+      );
+    })
+    .join('');
+  return `<h4 class="res-h">Who did what</h4><table class="res-t res-wide"><tbody>${head}${rows}</tbody></table>`;
+}
+
+/**
+ * THE END-OF-GAME RESULTS SCREEN — Gitea#16, first pass.
+ *
+ * Everything the Frame already knew plus everything the event tally counted, in the order a player
+ * asks for it: what happened, who won, by how much, under what rules, and then what the railroad
+ * actually did all game. Badges and the "what would make this exciting" brainstorm are the second
+ * pass the issue asks for and are deliberately not here.
+ *
+ * THE OFFICIAL RESULT IS THE ONE AT THE TOP, always. In an extended game (Gitea#11) the standings go
+ * on moving after the winner is settled, so this screen reports the frozen result first and puts
+ * everything that happened afterwards in its own section, marked as informational. "In a five-day
+ * game, even if it's extended to eight or nine days, the winner and the official answer is the
+ * winner at the end of five days" (Jesse, 2026-08-28).
+ */
+export function resultsHtml(f: Frame): string {
+  // `official` is written by the engine the moment any game ends, so it is present on every finished
+  // game. The fallback keeps this rendering something sane for a Frame that predates it — a replay
+  // of a save recorded before this release, which the replay viewer will happily hand us.
+  const report = f.official;
+  const o = report?.outcome ?? f.outcome;
+  if (!o) return '<p class="dim">This game has not ended.</p>';
+
+  const officialDay = report?.day ?? f.days;
+  const winnerName =
+    o.winner === null ? null : (f.players.find((p) => p.index === o.winner)?.name ?? null);
+
+  const headline =
+    o.result === 'loss'
+      ? 'The Division failed'
+      : winnerName === null
+        ? 'The Division ran'
+        : `${esc(winnerName)} takes the Division`;
+
+  /**
+   * The result is reported against the standings AS THEY WERE at the official ending, not as they
+   * are now — in an extended game those are different numbers, and the winner has to be shown
+   * winning. `revenues` is frozen alongside the outcome for exactly this.
+   */
+  const frozen = report
+    ? { ...f, players: f.players.map((p) => ({ ...p, revenue: report.revenues[p.index] ?? p.revenue })) }
+    : f;
+
+  const result =
+    o.result === 'loss'
+      ? '<p>Nobody wins this one.</p>'
+      : o.winner === null
+        ? '<p>The table clears it together — a Co-op game has no individual winner.</p>'
+        : `<p><b>${esc(winnerName ?? '')}</b> finishes ahead on Revenue.</p>`;
+
+  const extended =
+    f.extraDays > 0
+      ? '<h4 class="res-h">After the timetable</h4>' +
+        `<p>The table played on for ${f.extraDays} more Day${f.extraDays === 1 ? '' : 's'}, ` +
+        `through Day ${f.days + f.extraDays}. None of it changed the result above — it is recorded ` +
+        'here because it happened.</p>' +
+        standingsHtml(f) +
+        targetHtml(f) +
+        collisionsHtml(f) +
+        tallyHtml(f.tally)
+      : '';
+
+  return (
+    `<h3 class="dayend-h res-${o.result}">${headline}</h3>` +
+    `<p>${reasonSentence(frozen, o, officialDay)}</p>` +
+    result +
+    standingsHtml(frozen, o.winner) +
+    targetHtml(frozen) +
+    collisionsHtml(frozen) +
+    perPlayerHtml(frozen) +
+    rulesHtml(f) +
+    tallyHtml(report?.tally ?? f.tally) +
+    extended
+  );
+}
+
 export function blockedHtml(f: Frame): string {
   return f.blocked.length === 0
     ? '<li class="dim">nothing blocked</li>'
@@ -281,7 +693,7 @@ export function facilitiesHtml(f: Frame): string {
               : '') +
             `<div class="fstat ${x.jammed ? 'bad' : x.canFinish ? 'good' : 'idle'}" data-tip="${
               x.jammed
-                ? 'A load is sitting on MEN|AT|WORK with no spotted car to receive it. That locks the industry track, which blocks the very car that would clear it (§9.3).'
+                ? 'A load is sitting on MEN|AT|WORK with no spotted car to receive it. That locks the industry track, which blocks the very car that would clear it.'
                 : x.canFinish
                   ? 'A matching empty car is spotted on this industry\'s track, so a load worked here can come off onto it.'
                   : 'No matching car is spotted. Starting a load here would park it on WORK and jam the facility.'
@@ -301,6 +713,30 @@ h3{font-size:11px;text-transform:uppercase;letter-spacing:.07em;color:#8b94a3;ma
 .handcard:focus{outline:2px solid #4d6fa8;outline-offset:1px}
 .cardrow.ref .handcard{background:#1c2129;border-style:dashed;border-color:#39424e;color:#b6bec9}
 .handcard.unplayable{color:#7d8794;border-color:#39424e}
+/* THE HOME OFFICE DECK. Face down, so its card slot names no card — it says so instead, in the
+   dimmed voice the rest of the panel uses for "nothing to read here". */
+.handcard.facedown > b{color:#6f7885;font-style:italic;font-weight:400}
+/* THE PILE A WATCHED MOVE JUST TOUCHED (v0.8.1).
+   A STATE, NOT A FLASH, and that is the whole point. The .tt-slot.fresh rule above animates for a fixed
+   1.5s, which is right for a die roll nobody is waiting on — but a step can hold the screen for
+   seven seconds at 10x, so a fixed animation would be over long before the pause it belongs to and
+   the player would be back to staring at an unchanged board. The flash-in marks the moment; the lit
+   border and background stay for exactly as long as the step is up, because the class is on the
+   element only while that step is the one being shown. */
+.handcard.pilelit{border-color:#8fd6a0;background:#1d3327;box-shadow:0 0 0 2px #2f6b47,0 0 14px rgba(143,214,160,.55);
+  animation:pilepulse 1.15s ease-in-out infinite}
+/* A PULSE FOR THE WHOLE DWELL, not one flash at the start. Measured: at 10x a pile stays lit for
+   just under seven seconds, so the highlight was never brief — but a single 0.45s flash-in and a
+   dark green fill were easy to miss entirely while watching the district. Jesse: "caught one flash
+   deck light up for just a very brief moment, but couldn't see that with what bot was doing in
+   office area and history and catch up area all at same time." Something still moving keeps drawing
+   the eye for as long as the move is up; a state that settles stops asking to be looked at. */
+@keyframes pilepulse{0%,100%{background:#1d3327;box-shadow:0 0 0 2px #2f6b47,0 0 14px rgba(143,214,160,.45)}
+  50%{background:#2f6b47;box-shadow:0 0 0 3px #8fd6a0,0 0 22px rgba(143,214,160,.85)}}
+/* Motion is the point here, so the reduced-motion fallback has to be loud in a different way rather
+   than simply not moving: a solid ring and a brighter fill, held. */
+@media(prefers-reduced-motion:reduce){
+  .handcard.pilelit{animation:none;background:#2f6b47;box-shadow:0 0 0 3px #8fd6a0}}
 .handcard.unplayable::after{content:"";position:absolute;inset:0;border-radius:5px;pointer-events:none;
   background:repeating-linear-gradient(45deg,transparent 0 5px,rgba(150,160,175,.20) 5px 6px)}
 /* THE CARD JUST DRAWN. It sits first in the row, and this says which one that is — three cards that
@@ -341,9 +777,18 @@ h3{font-size:11px;text-transform:uppercase;letter-spacing:.07em;color:#8b94a3;ma
 /* And the piles that are NOT targets step back while a discard is being aimed, so the three that
    are stand out from the Salvage Yard beside them. */
 .cardrow.aiming .handcard:not(.target){opacity:.4}
-.stock .ld.addable,.stock .mt.addable{cursor:pointer;border-radius:3px;padding:0 4px;
-  outline:1px solid #5aa9e6;background:rgba(90,169,230,.16)}
-.stock .ld.addable:hover,.stock .mt.addable:hover{background:rgba(90,169,230,.34)}
+/* A CAR YOU MAY ADD IS AN ACTION, SO IT WEARS THE ACTION COLOUR — Jesse, playtest 2026-09-16: the
+   highlight was "just a small bold and basically the same color as everything else", which is the
+   whole difficulty with making the yard chip the button. #c8912f is the border colour that the
+   action buttons themselves use, so a clickable car looks like every other thing inviting a click,
+   rather than like a number that happens to be outlined.
+
+   THE LOADED/EMPTY TEXT COLOURS ARE LEFT ALONE. Green and blue-grey are what say which of the two
+   numbers is which; the amber answers "may I click this", which is a different question, and
+   painting over the first to answer the second would cost real information. */
+.stock .ld.addable,.stock .mt.addable{cursor:pointer;border-radius:3px;padding:0 4px;font-weight:700;
+  outline:2px solid #c8912f;background:rgba(200,145,47,.20);box-shadow:0 0 0 2px rgba(200,145,47,.16)}
+.stock .ld.addable:hover,.stock .mt.addable:hover{background:rgba(200,145,47,.38)}
 /* Twelve Stages across, so a Day is one glance. The current Stage is lit, Stages already gone are
    dimmed, and a slot the die has just filled flashes once. */
 .tt{display:flex;gap:3px;flex-wrap:wrap}
@@ -397,4 +842,28 @@ ul.blocked{margin:0;padding-left:18px}
 .fstat.good{background:rgba(40,140,60,.28)}
 .fstat.bad{background:rgba(190,50,50,.38);font-weight:700}
 .fstat.idle{opacity:.6}
+/* THE DAY-END DIALOG (Gitea#10). The dialog chrome is play.html's; these are its contents, here
+   because dayEndHtml is here — a panel and its styling stay together. */
+.dayend-h{font-size:15px;text-transform:none;letter-spacing:0;color:#e6e9ee;margin:0 0 8px}
+.dayend-t{border-collapse:collapse;margin:9px 0;min-width:210px}
+.dayend-t td{padding:3px 12px 3px 0;border-top:1px solid #2c333d}
+.dayend-t tr:first-child td{border-top:0}
+.dayend-t .num{text-align:right;font-variant-numeric:tabular-nums;font-weight:700;padding-right:0}
+.dayend-t .you td{color:#8fd6a0}
+.dayend-t .wins{color:#e8c56a;font-weight:700}
+
+/* END-OF-GAME RESULTS (Gitea#16). Same family as the Day-end dialog above, which is the point —
+   the two screens share their standings/target/collision blocks and should look like each other. */
+.res-h{font-size:12px;text-transform:uppercase;letter-spacing:.08em;color:#8b95a3;
+  margin:16px 0 6px;border-top:1px solid #2c333d;padding-top:10px}
+.res-win{color:#8fd6a0}
+.res-loss{color:#d98f8f}
+.res-t{border-collapse:collapse;margin:4px 0;width:100%}
+.res-t td,.res-t th{padding:3px 12px 3px 0;border-top:1px solid #232a33;vertical-align:top}
+.res-t tr:first-child td{border-top:0}
+.res-t td:first-child{color:#8b95a3;white-space:nowrap}
+.res-t th{color:#6d7783;font-weight:600;font-size:11px;text-transform:uppercase;letter-spacing:.05em}
+.res-t .num{text-align:right;font-variant-numeric:tabular-nums}
+.res-wide td:first-child{color:#e6e9ee}
+.res-t .you td{color:#8fd6a0}
 `;

src/web/presets.ts

@@ -0,0 +1,381 @@
+/**
+ * THE FOUR GAME TYPES, and what "Custom" means.
+ *
+ * Jesse's design, 2026-08-23. A game type is not a mode and not a ruleset — it is a NAMED SET OF
+ * DEFAULTS that the host may then edit. Editing any of them selects `custom`, which keeps the
+ * values and inherits the scoring of the type it was edited away from; clicking a named type again
+ * resets every rule back to it.
+ *
+ * WHY THIS FILE EXISTS RATHER THAN A CONSTANT IN EACH SCREEN. The lobby (`lobby.ts`) and the
+ * solitaire New Game dialog (`main.ts`) ask the same questions, and they had already drifted apart
+ * before this was written: the dialog had "where an Extra may start" and no optional rules, the
+ * lobby had the optional rules and no Extra rule — so a multiplayer game silently played the most
+ * permissive Extra rule and nobody was ever asked. One description of the defaults, imported by
+ * both, is what stops that happening a third time.
+ *
+ * PARAMETERS ARE NOT SETTINGS. Seed, player count and Day count sit ABOVE the type radios on both
+ * screens and never select `custom`: the presets are formulas in players and days, so "Co-op, 3
+ * players, 8 days" is still Co-op and its Revenue floor re-derives. Everything below the radios is
+ * a rule, and changing one is what makes a game Custom.
+ */
+
+import {
+  DEFAULT_MAX_COLLISIONS_PER_DAY,
+  DEFAULT_MAX_COLLISIONS_TOTAL,
+  collectiveRevenueFloor,
+  houseRules,
+} from '../engine/content.ts';
+import type { ExtraStartRule, RevenueRules, StartingHand, StartingOffice } from '../engine/content.ts';
+import type { GameConfig, GameMode } from '../engine/state.ts';
+
+export type PresetName = 'solitaire' | 'coop' | 'competitive' | 'cutthroat';
+/** What the radio group answers: one of the four named types, or the state of having edited one. */
+export type GameType = PresetName | 'custom';
+
+/**
+ * Every rule a game type sets, flattened to one value per control.
+ *
+ * Flat rather than shaped like `GameConfig` because this is what the FORM compares against: each key
+ * is one field on screen, so "which fields differ from the preset" is a key-by-key comparison rather
+ * than a walk through nested objects. `configFromSettings` puts the shape back.
+ */
+export type Settings = {
+  startingHand: StartingHand;
+  extraStart: ExtraStartRule;
+  passengerPerCoach: number;
+  freightPerLoad: number;
+  trainPerTransit: number;
+  /** 0 means the condition is off — the engine's convention (`state.ts`). The form draws a checkbox. */
+  minCombinedRevenue: number;
+  maxCollisionsPerDay: number;
+  maxCollisionsTotal: number;
+  reducedVisibility: boolean;
+  employeeRotation: boolean;
+  emergencyToolbox: boolean;
+  /** §6.2 (Gitea#9) — may a Timetabled train be thrown away? An Extra never may, whatever this says. */
+  discardTimetabled: boolean;
+  /** Ticked = everyone opens on a Whistle Post, the harder game. Unticked = a Depot. */
+  startWhistlePosts: boolean;
+};
+
+export const SETTING_KEYS: readonly (keyof Settings)[] = [
+  'startingHand',
+  'extraStart',
+  'passengerPerCoach',
+  'freightPerLoad',
+  'trainPerTransit',
+  'minCombinedRevenue',
+  'maxCollisionsPerDay',
+  'maxCollisionsTotal',
+  'reducedVisibility',
+  'employeeRotation',
+  'emergencyToolbox',
+  'discardTimetabled',
+  'startWhistlePosts',
+];
+
+export type Preset = {
+  name: PresetName;
+  label: string;
+  /** One line under the radio, saying what winning and losing mean in this type. */
+  blurb: string;
+  /** The engine mode this type is scored under — what a `custom` game inherits. */
+  scoring: GameMode;
+  /**
+   * Whether the 22 opponent-directed cards would be dealt, once they exist. Not a form control any
+   * more: it is a property of the type (`TODO.md` — the cards are unbuilt, so `buildDeck` holds them
+   * out regardless, and a checkbox that cannot do anything is worse than a sentence saying so).
+   */
+  pvpCards: boolean;
+  /**
+   * The Revenue floor this type asks for, as a function of the table and the length. Co-op keeps the
+   * engine's own `collectiveRevenueFloor` (3 per player per Day); Competitive asks two thirds of it,
+   * because a table racing each other is not also pulling in one direction; Cutthroat asks nothing.
+   */
+  revenueFloor: (players: number, days: number) => number;
+  rules: Omit<Settings, 'minCombinedRevenue'>;
+};
+
+const NO_OPTIONAL_RULES = {
+  reducedVisibility: false,
+  employeeRotation: false,
+  emergencyToolbox: false,
+  /**
+   * ON in every type (Gitea#9). Jesse's ruling is the rule now, and the setting exists so a table
+   * can put Gitea#6's pressure back rather than so a type can choose for them — the reasoning is
+   * about how long a game runs, which is a dial the table already sets for itself.
+   */
+  discardTimetabled: true,
+  // The default opening is a Depot, so the harder setting is off.
+  startWhistlePosts: false,
+} as const;
+
+/** Every type deals six now (Jesse, 2026-08-23) — the hand limit is three, so the first turn is a
+ * discard whichever three you keep. Solitaire moved with the rest so the two screens agree. */
+const SIX: StartingHand = 'sixRandom';
+
+export const PRESETS: readonly Preset[] = [
+  {
+    name: 'solitaire',
+    label: 'Solitaire',
+    blurb: 'One railroad, one player. The whole Division is yours to run.',
+    scoring: 'solitaire',
+    pvpCards: false,
+    revenueFloor: (players, days) => collectiveRevenueFloor(players, days),
+    rules: {
+      startingHand: SIX,
+      /**
+       * Nobody else's district exists, so "any Control Point" and "your own" are the same rule —
+       * `apply.ts` only ever rejects `ownOffice` when `start.seat !== seatOf(s, player)`, which
+       * cannot happen at one seat. It said `anyOffice` until 2026-08-30, which was true and read
+       * wrong: a solitaire player has no "any player" to contrast themselves with, so the permissive
+       * label described a permission nobody was being granted. Jesse's call; no gameplay effect.
+       */
+      extraStart: 'ownOffice',
+      passengerPerCoach: 1,
+      freightPerLoad: 1,
+      trainPerTransit: 0,
+      maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
+      maxCollisionsTotal: DEFAULT_MAX_COLLISIONS_TOTAL,
+      ...NO_OPTIONAL_RULES,
+    },
+  },
+  {
+    name: 'coop',
+    label: 'Co-op',
+    blurb: 'Everyone’s Revenue is one table score. You win together or lose together.',
+    scoring: 'coop',
+    // Never, even once the cards are built: there is no opponent to point them at when the table is
+    // one side.
+    pvpCards: false,
+    revenueFloor: (players, days) => collectiveRevenueFloor(players, days),
+    rules: {
+      startingHand: SIX,
+      extraStart: 'ownOffice',
+      passengerPerCoach: 1,
+      freightPerLoad: 1,
+      // The one economy that pays every player at once, for work nobody had to do — which is the
+      // co-operative one, so it is the type that switches it on.
+      trainPerTransit: 1,
+      maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
+      maxCollisionsTotal: DEFAULT_MAX_COLLISIONS_TOTAL,
+      ...NO_OPTIONAL_RULES,
+    },
+  },
+  {
+    name: 'competitive',
+    label: 'Competitive',
+    blurb: 'Highest Revenue wins — unless the table misses its combined minimum, and then everyone loses.',
+    scoring: 'competitive',
+    pvpCards: true,
+    revenueFloor: (players, days) => 2 * players * days,
+    rules: {
+      startingHand: SIX,
+      extraStart: 'ownOffice',
+      passengerPerCoach: 1,
+      freightPerLoad: 1,
+      trainPerTransit: 0,
+      maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
+      maxCollisionsTotal: DEFAULT_MAX_COLLISIONS_TOTAL,
+      ...NO_OPTIONAL_RULES,
+    },
+  },
+  {
+    name: 'cutthroat',
+    label: 'Cutthroat',
+    blurb: 'Highest Revenue wins, and nothing is shared — the only way everyone loses is three collisions in one Day.',
+    scoring: 'competitive',
+    pvpCards: true,
+    // Off. Cutthroat has no collective obligation of any kind.
+    revenueFloor: () => 0,
+    rules: {
+      startingHand: SIX,
+      // The one type that lets you plant an Extra in somebody else's district.
+      extraStart: 'anyOffice',
+      passengerPerCoach: 1,
+      freightPerLoad: 1,
+      trainPerTransit: 0,
+      maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
+      // Off, with the per-Day check left standing: a table can bleed collisions all game, but three
+      // in one Day still ends it.
+      maxCollisionsTotal: 0,
+      ...NO_OPTIONAL_RULES,
+    },
+  },
+];
+
+export function preset(name: PresetName): Preset {
+  const found = PRESETS.find((p) => p.name === name);
+  if (!found) throw new Error(`no such preset: ${name}`);
+  return found;
+}
+
+/** Every rule a named type sets, at the table size and length the form currently shows. */
+export function presetSettings(name: PresetName, players: number, days: number): Settings {
+  const p = preset(name);
+  return { ...p.rules, minCombinedRevenue: p.revenueFloor(players, days) };
+}
+
+/** The settings a config is actually carrying — the other half of every comparison below. */
+export function settingsOf(config: GameConfig): Settings {
+  const rules = houseRules(config);
+  return {
+    startingHand: rules.startingHand,
+    extraStart: rules.extraStart,
+    passengerPerCoach: rules.revenue.passengerPerCoach,
+    freightPerLoad: rules.revenue.freightPerLoad,
+    trainPerTransit: rules.revenue.trainPerTransit,
+    minCombinedRevenue: config.minCombinedRevenue,
+    maxCollisionsPerDay: config.maxCollisionsPerDay,
+    maxCollisionsTotal: config.maxCollisionsTotal,
+    reducedVisibility: config.optionalRules.reducedVisibility,
+    employeeRotation: config.optionalRules.employeeRotation,
+    emergencyToolbox: config.optionalRules.emergencyToolbox,
+    discardTimetabled: rules.discardTimetabled,
+    startWhistlePosts: rules.startingOffice === 'whistlePost',
+  };
+}
+
+/** Which controls differ from a named type — what the form paints amber and counts in its summary. */
+export function differencesFrom(
+  name: PresetName,
+  settings: Settings,
+  players: number,
+  days: number,
+): (keyof Settings)[] {
+  const want = presetSettings(name, players, days);
+  return SETTING_KEYS.filter((k) => settings[k] !== want[k]);
+}
+
+/**
+ * WHICH TYPE IS THIS, derived rather than stored.
+ *
+ * Nothing writes a type name into `GameConfig` — a saved game is its numbers, and a name in the save
+ * would be one more thing that can disagree with them. So the screens ask this instead, which means
+ * a hand-tuned game that happens to match Competitive exactly reads as Competitive, and that is the
+ * honest answer: it IS one.
+ *
+ * `mode` is part of the comparison, so a Co-op game whose dials happen to equal Competitive's is
+ * still not Competitive.
+ */
+export function presetOf(config: GameConfig, players: number, days: number): GameType {
+  const settings = settingsOf(config);
+  const match = PRESETS.find(
+    (p) => p.scoring === config.mode && differencesFrom(p.name, settings, players, days).length === 0,
+  );
+  return match?.name ?? 'custom';
+}
+
+/**
+ * A `Frame`'s copy of the config, as a `GameConfig` the functions above can read.
+ *
+ * The page has a Frame, never a `GameState` — a remote client holds no game — and the Frame carries
+ * every field these comparisons need. Structurally typed rather than importing `Frame` so this
+ * module stays free of `sim/view.ts`.
+ */
+export function configFromFrame(f: {
+  mode: GameMode;
+  days: number;
+  minCombinedRevenue: number;
+  maxCollisionsPerDay: number;
+  maxCollisionsTotal: number;
+  optionalRules: GameConfig['optionalRules'];
+  houseRules: { startingHand: StartingHand; extraStart: ExtraStartRule; revenue: RevenueRules; discardTimetabled: boolean; startingOffice?: StartingOffice };
+}): GameConfig {
+  return {
+    mode: f.mode,
+    days: f.days,
+    minCombinedRevenue: f.minCombinedRevenue,
+    maxCollisionsPerDay: f.maxCollisionsPerDay,
+    maxCollisionsTotal: f.maxCollisionsTotal,
+    // Never shown from a Frame — the cards are unbuilt, and the type carries the answer.
+    pvpCardsAllowed: false,
+    optionalRules: f.optionalRules,
+    houseRules: {
+      startingHand: f.houseRules.startingHand,
+      extraStart: f.houseRules.extraStart,
+      // Carried like the rest: this path describes SOMEONE ELSE'S game to a joiner, so a setting
+      // dropped here shows them a rule the table is not playing (§6.2, Gitea#9).
+      discardTimetabled: f.houseRules.discardTimetabled,
+      // Spread rather than assigned: `exactOptionalPropertyTypes` refuses an explicit `undefined`,
+      // and a Frame from a server that predates this setting simply does not carry it.
+      ...(f.houseRules.startingOffice ? { startingOffice: f.houseRules.startingOffice } : {}),
+      revenue: f.houseRules.revenue,
+    },
+  };
+}
+
+/**
+ * The named type a config is NEAREST to, for a screen that has to describe someone else's game.
+ *
+ * The create form always knows which type was clicked, so it compares against that. A join preview
+ * and the seating screen do not — they are handed a finished config and nothing else — and "Custom"
+ * on its own tells a player nothing about what they are joining. Comparing against the same-scoring
+ * type with the fewest differences answers the question they actually have: how far from a normal
+ * game is this, and which normal game?
+ */
+export function closestPreset(
+  config: GameConfig,
+  players: number,
+  days: number,
+): { name: PresetName; differing: (keyof Settings)[] } {
+  const settings = settingsOf(config);
+  const candidates = PRESETS.filter((p) => p.scoring === config.mode);
+  const scored = (candidates.length > 0 ? candidates : PRESETS).map((p) => ({
+    name: p.name,
+    differing: differencesFrom(p.name, settings, players, days),
+  }));
+  return scored.reduce((best, c) => (c.differing.length < best.differing.length ? c : best));
+}
+
+/**
+ * The label a screen shows for the current state of the form — including what a Custom game is being
+ * scored as, which is the one thing a player cannot see from the dials.
+ */
+export function gameTypeLabel(type: GameType, scoring: GameMode): string {
+  if (type !== 'custom') return preset(type).label;
+  const named = PRESETS.find((p) => p.scoring === scoring && p.name !== 'cutthroat');
+  return `Custom — scored as ${named?.label ?? scoring}`;
+}
+
+/** Assembles the config a form's answers describe. `players` reaches the caller separately: it sizes
+ * the lobby's seat array rather than being part of the rules. */
+export function configFromSettings(
+  settings: Settings,
+  scoring: GameMode,
+  days: number,
+  pvpCards: boolean,
+): GameConfig {
+  return {
+    mode: scoring,
+    days,
+    minCombinedRevenue: settings.minCombinedRevenue,
+    maxCollisionsPerDay: settings.maxCollisionsPerDay,
+    maxCollisionsTotal: settings.maxCollisionsTotal,
+    // Inert until the cards are built (`setup.ts`'s `buildDeck` ANDs it with `cardsImplemented`),
+    // and no longer a control on any screen — it is a property of the game type.
+    pvpCardsAllowed: pvpCards,
+    optionalRules: {
+      reducedVisibility: settings.reducedVisibility,
+      employeeRotation: settings.employeeRotation,
+      emergencyToolbox: settings.emergencyToolbox,
+    },
+    houseRules: {
+      startingHand: settings.startingHand,
+      extraStart: settings.extraStart,
+      discardTimetabled: settings.discardTimetabled,
+      startingOffice: settings.startWhistlePosts ? 'whistlePost' : 'depot',
+      revenue: {
+        passengerPerCoach: settings.passengerPerCoach,
+        freightPerLoad: settings.freightPerLoad,
+        trainPerTransit: settings.trainPerTransit,
+      },
+    },
+  };
+}
+
+/** The whole config a named type produces, with nothing edited. */
+export function configFromPreset(name: PresetName, players: number, days: number): GameConfig {
+  const p = preset(name);
+  return configFromSettings(presetSettings(name, players, days), p.scoring, days, p.pvpCards);
+}

src/web/replays.html

@@ -69,6 +69,10 @@ input[type=range]{flex:1;min-width:180px}
       <p class="dim">A Station Master save is a small <code>.json</code> file &mdash; a seed and the list of
       moves made. That is enough to rebuild the whole game, so a replay can be emailed like a text file.
       Save one from inside a game with <b>Save replay</b>.</p>
+      <!-- #40 — the one thing about saves a player has to be told, wherever saves are handled. -->
+      <p class="dim">A save replays under the rules of the build that opens it, so one made on an
+      earlier build may stop part-way. The viewer says which move it stopped on, and your file is
+      never altered.</p>
       <input type="file" id="file" accept=".json,application/json">
       <div id="perr"></div>
     </section>

src/web/replays.ts

@@ -26,6 +26,7 @@ import { createGame } from '../engine/setup.ts';
 import { snapshot } from '../sim/view.ts';
 import type { Intent } from '../engine/intents.ts';
 import { SOLO_CONFIG } from './game.ts';
+import { actingPlayer } from '../engine/state.ts';
 
 type Save = { seed: number; history: Intent[] };
 type Entry = { file: string; title: string; note?: string; seed?: number };
@@ -55,7 +56,12 @@ type Step = {
 function rebuild(save: Save): { steps: Step[]; stoppedEarly: boolean } {
   const s = createGame({ id: `replay-${save.seed}`, seed: save.seed, config: SOLO_CONFIG, playerNames: ['player'] });
   const steps: Step[] = [];
-  const ctx = { cardName: (id: string) => cardName(s, id), trainName: (id: string) => trainName(s, id) };
+  const ctx = {
+    cardName: (id: string) => cardName(s, id),
+    trainName: (id: string) => trainName(s, id),
+    // A player index is not a seat index, so the fallback names no number at all — see `game.ts`.
+    playerName: (p: number) => s.players[p]?.name ?? 'another player',
+  };
   const push = (events: ReturnType<typeof pump>): void => {
     const lines = events
       .filter((e) => e.type !== 'actorChanged')
@@ -69,7 +75,7 @@ function rebuild(save: Save): { steps: Step[]; stoppedEarly: boolean } {
   push(pump(s));
   let stoppedEarly = false;
   for (const intent of save.history) {
-    const actor = s.clock.pendingDecision !== null ? s.clock.superintendent : s.clock.currentActor;
+    const actor = actingPlayer(s);
     if (actor === null || s.status !== 'active') break;
     const r = applyIntent(s, actor, intent);
     if (!r.ok) {
@@ -117,7 +123,10 @@ function show(i: number): void {
   // A replay carries the seat names in the frame's own lines rather than a player table, so the
   // solitaire seat is named directly; a multi-player replay reports the index it has.
   const actorName = f.actor === null ? null : `Player ${f.actor + 1}`;
-  $('turnchart').innerHTML = turnChartHtml(f, actorName);
+  // A replay of a multi-player game gets the Fedora too — it is the answer to "why is it asking
+  // THEM", which a replay raises exactly as a live game does.
+  const superName = f.players.length > 1 ? `Player ${f.superintendent + 1}` : null;
+  $('turnchart').innerHTML = turnChartHtml(f, actorName, superName);
   $('vrev').textContent = String(f.revenue);
   $('vpos').textContent = `${at} / ${steps.length - 1}`;
   ($('vscrub') as HTMLInputElement).value = String(at);

src/web/session.ts

@@ -16,7 +16,10 @@
  */
 
 import type { Intent } from '../engine/intents.ts';
-import type { Frame } from '../sim/view.ts';
+import type { Frame, PublicFrame } from '../sim/view.ts';
+import { publicSnapshot } from '../sim/view.ts';
+import { takeSteps } from '../sim/display-step.ts';
+import type { DisplayStep } from '../sim/display-step.ts';
 import type { PlayerIndex } from '../engine/state.ts';
 import { applyDelta } from '../sim/frame-delta.ts';
 import type { FrameDelta } from '../sim/frame-delta.ts';
@@ -27,8 +30,8 @@ import {
   currentActor,
   fromSave,
   handPlayable,
+  isOutOfTurn,
   newGame,
-  overHandLimit,
   submit,
   toSave,
   undo,
@@ -57,8 +60,6 @@ export type Session = {
   seat(): PlayerIndex;
   /** Whose turn it is, or null when the game is over or waiting on nothing. */
   actor(): PlayerIndex | null;
-  /** True when the hand is over §6.2's limit and the turn cannot be ended. */
-  overHandLimit(): boolean;
   /** Which cards in hand are playable right now, in hand order. */
   handPlayable(): boolean[];
   /**
@@ -99,9 +100,45 @@ export type Session = {
    * the seat and waits; this is what lets the page say why, instead of going quiet with no
    * explanation. Reflects the last presence push for each seat the server has ever mentioned, not
    * only the ones currently disconnected — a seat that reconnects updates its own entry rather than
-   * disappearing, so the page can tell "never heard from" apart from "was here, then left."
+   * disappearing.
+   *
+   * `seen` is what separates the two absences the page must not conflate: a seat that has connected
+   * at some point and dropped, against one that has never opened the game at all. The server now
+   * reports every other seat on connect (2026-08-23), so this is answerable at the moment a game
+   * starts — which is exactly when "is everyone here?" is the question.
    */
-  presence(): { seat: PlayerIndex; connected: boolean }[];
+  presence(): { seat: PlayerIndex; connected: boolean; seen: boolean }[];
+  /**
+   * ORDERED PRESENTATION STEPS — v0.8.0, TODO #13. What everyone else did, in order, so it can be
+   * WATCHED rather than discovered.
+   *
+   * On the interface rather than on `LocalSession`, which is the whole point: solitaire drains its
+   * own collector and a remote session reads the same steps off `Push.steps`, so the page animates
+   * one queue and cannot tell which it has. That is what makes TODO #18 (solitaire's phases flying
+   * past) and TODO #13 (multiplayer's invisible turns) the same code path.
+   *
+   * NOT `steps()` — `LocalSession.steps()` already exists and counts submitted intents for the Undo
+   * button. Different thing entirely, hence the longer name.
+   */
+  takeDisplaySteps(): DisplayStep[];
+  /**
+   * A public frame to start the queue from, once — draining, and non-null only when the queue must
+   * be RESET rather than advanced.
+   *
+   * Steps carry deltas against a chain, so a client with no baseline cannot merge the next one. That
+   * happens on a first connect, on a reconnect, and locally after an undo or a restore — all of
+   * which rebuild from scratch. A reset means "throw away what is queued and draw this".
+   */
+  takeDisplayReset(): PublicFrame | null;
+  /**
+   * Stop listening, for good.
+   *
+   * Only a remote session has anything to close, and only one caller needs it: a player LEAVING a
+   * running game (2026-08-23). Without it the page went back to the lobby with its `EventSource`
+   * still open, so the server — and therefore every other seat — went on reporting them as present
+   * at a table they had walked away from.
+   */
+  close?(): void;
 };
 
 /**
@@ -133,6 +170,12 @@ export type LocalSession = Session & {
  */
 export function createLocalSession(seed: number, options?: NewGameOptions): LocalSession {
   let game: Game = options ? newGame(seed, configWith(options)) : newGame(seed);
+  /**
+   * The baseline the step queue starts from. Set here, and again whenever the game is REPLACED —
+   * `undo` and `restore` rebuild by replaying history, which (by design) collects no steps, so the
+   * queue has to be told to start over rather than left holding a chain that no longer continues.
+   */
+  let pendingReset: PublicFrame | null = publicSnapshot(game.state);
   const listeners = new Set<() => void>();
   const changed = (): void => {
     for (const fn of [...listeners]) fn();
@@ -146,10 +189,11 @@ export function createLocalSession(seed: number, options?: NewGameOptions): Loca
     menu: () => actionMenu(game),
     seat: () => 0,
     actor: () => currentActor(game),
-    overHandLimit: () => overHandLimit(game),
     handPlayable: () => handPlayable(game),
     submit: async (intent: Intent) => {
-      const ok = submit(game, intent);
+      // Seat 0 is the solitaire player, and the extension vote (Gitea#11) is the one intent that
+      // arrives when `currentActor` is null — so it has to name its seat. See `isOutOfTurn`.
+      const ok = submit(game, intent, isOutOfTurn(intent) ? 0 : null);
       if (ok) changed();
       return ok;
     },
@@ -173,6 +217,14 @@ export function createLocalSession(seed: number, options?: NewGameOptions): Loca
     },
     justDrawn: () => game.justDrawn,
     presence: () => [],
+    // Solitaire's own steps, from the same collector `submit()` fills for every seat of a
+    // multiplayer game. No separate code path — see `sim/display-step.ts`.
+    takeDisplaySteps: () => takeSteps(game.display),
+    takeDisplayReset: () => {
+      const reset = pendingReset;
+      pendingReset = null;
+      return reset;
+    },
 
     seed: () => game.seed,
     save: () => toSave(game),
@@ -186,6 +238,8 @@ export function createLocalSession(seed: number, options?: NewGameOptions): Loca
       back.scheduled = null;
       back.justDrawn = null;
       back.announced = null;
+      // The rebuilt game has an empty collector and a chain that starts over, so the queue must too.
+      pendingReset = publicSnapshot(back.state);
       changed();
       return true;
     },
@@ -194,6 +248,7 @@ export function createLocalSession(seed: number, options?: NewGameOptions): Loca
       // Restoring replays the whole history and re-records every draw; none of it is news.
       game.justDrawn = null;
       game.announced = null;
+      pendingReset = publicSnapshot(game.state);
       changed();
     },
   };
@@ -205,7 +260,30 @@ type Push = {
   frame?: FrameDelta;
   menu: Menu | null;
   lines: { text: string; tone: string }[];
-  presence?: { seat: PlayerIndex; connected: boolean };
+  /** One entry for a change; every other seat at once on the connect push. */
+  presence?: { seat: PlayerIndex; connected: boolean; seen: boolean }[];
+  /** Ordered presentation steps — v0.8.0, identical in every seat's push because they are public. */
+  steps?: DisplayStep[];
+  /** The baseline for the step queue, sent on a connect only. */
+  publicReset?: PublicFrame;
+  /**
+   * THE FOUR TRANSIENT SIGNALS, added 2026-08-23.
+   *
+   * A remote session used to return nothing for any of them, so multiplayer had no sound at all, no
+   * timetable flash when the D12 filled a slot, no announcement when a completed run paid the table,
+   * and no highlight on the card you had just drawn — four things solitaire has had all along, and
+   * most of why a multiplayer game felt inert.
+   *
+   * `cues` and `announcement` are SHARED events (a collision anywhere, the Stage bell, a train
+   * leaving the Division) and reach every seat; `justDrawn` is the recipient's own card and nobody
+   * else's — `test/redaction.test.ts` covers exactly that.
+   */
+  cues?: string[];
+  scheduled?: number | null;
+  announcement?: string | null;
+  justDrawn?: string | null;
+  /** Where the server's count of this seat's accepted intents stands — connect push only (v0.8.4). */
+  lastSeq?: number;
 };
 
 /**
@@ -239,8 +317,26 @@ export function createRemoteSession(
   let frame: Frame | null = null;
   let menu: Menu | null = null;
   let lines: { text: string; tone: string }[] = [];
-  const presence = new Map<PlayerIndex, boolean>();
+  const presence = new Map<PlayerIndex, { connected: boolean; seen: boolean }>();
+  let displaySteps: DisplayStep[] = [];
+  let displayReset: PublicFrame | null = null;
+  let cues: string[] = [];
+  let scheduled: number | null = null;
+  let announcement: string | null = null;
+  let justDrawnCard: string | null = null;
+  /**
+   * NUMBERED FROM WHERE THE SERVER SAYS, NOT FROM 1 (v0.8.4).
+   *
+   * This started at 1 on every page load, and the server remembers a seat's last accepted number
+   * for the life of the game and answers a repeat with "already applied" (`protocol.md` §5). So a
+   * seat that had made one move, reloaded, and clicked again sent `seq: 1` twice: the server said
+   * ok, did nothing, pushed nothing, and the click looked dead. The connect push now carries the
+   * server's count and this continues from it — never backwards, in case a submit is in flight
+   * across a reconnect.
+   */
   let nextSeq = 1;
+  /** One submit in flight at a time — see `submit`. */
+  let inFlight = false;
   const listeners = new Set<() => void>();
   const changed = (): void => {
     for (const fn of [...listeners]) fn();
@@ -273,7 +369,15 @@ export function createRemoteSession(
       });
   };
   source.onmessage = (ev: MessageEvent<string>) => {
-    const push = JSON.parse(ev.data) as Push;
+    let push: Push;
+    try {
+      push = JSON.parse(ev.data) as Push;
+    } catch {
+      // A push that is not JSON is dropped rather than thrown out of an event handler nothing
+      // catches; the next push carries a full delta chain from what this seat was last sent.
+      return;
+    }
+    if (push.lastSeq !== undefined) nextSeq = Math.max(nextSeq, push.lastSeq + 1);
     // A presence-only push (no `frame`) carries `menu: null` too, but that is not news about this
     // seat's turn — only a push that actually came from the game (always carries a real `frame`,
     // per `session.ts`'s `Push`) updates the board or the menu.
@@ -282,7 +386,29 @@ export function createRemoteSession(
       menu = push.menu;
     }
     lines = [...lines, ...push.lines];
-    if (push.presence) presence.set(push.presence.seat, push.presence.connected);
+    for (const p of push.presence ?? []) presence.set(p.seat, { connected: p.connected, seen: p.seen });
+    // Accumulated rather than replaced: two pushes can arrive between two renders, and a cue that
+    // was earned is a cue that should be heard.
+    if (push.cues) cues = [...cues, ...push.cues];
+    if (push.scheduled !== undefined && push.scheduled !== null) scheduled = push.scheduled;
+    if (push.announcement !== undefined && push.announcement !== null) announcement = push.announcement;
+    // Persists until another draw replaces it, matching the local session's own `justDrawn`.
+    if (push.justDrawn !== undefined) justDrawnCard = push.justDrawn;
+    /**
+     * A RESET DISCARDS WHAT WAS QUEUED, rather than arriving alongside it.
+     *
+     * `publicReset` comes on a connect, which is also a RECONNECT — and a reconnecting client's
+     * queue holds steps whose deltas chain off a baseline the server has since moved past. Merging
+     * them onto the new baseline would draw a board that never existed. The history panel is what
+     * carries what was missed; the animation does not replay it (§ v0.8.0).
+     */
+    if (push.publicReset) {
+      displayReset = push.publicReset;
+      displaySteps = [];
+    }
+    // Accumulated, like cues: two pushes can land between two renders and every step is one thing
+    // that happened.
+    if (push.steps) displaySteps = [...displaySteps, ...push.steps];
     changed();
   };
 
@@ -296,19 +422,35 @@ export function createRemoteSession(
     menu: () => menu ?? { options: [], direct: [], placeable: [], hand: [], makeUp: null },
     seat: () => seat,
     actor: () => need().actor,
-    overHandLimit: () => need().overHandLimit,
     handPlayable: () => (menu?.hand ?? []).map((h) => h.playNow !== null),
     async submit(intent: Intent): Promise<boolean> {
+      /**
+       * ONE AT A TIME (v0.8.4). The page redraws the SAME menu the instant a submit is sent — the
+       * new one only arrives with the push — so a second click before the round trip posted a
+       * second, fresh `seq` for the same option, and the server, which de-duplicates on `seq`
+       * alone, applied it again when it was still legal: two cards drawn, two Moves spent, two cars
+       * coupled. A click that lands while one is in flight is dropped; the push is milliseconds away.
+       */
+      if (inFlight) return false;
+      inFlight = true;
       const seq = nextSeq++;
-      const res = await fetch(`/api/intent?${qs}`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ seq, intent }),
-      });
-      const result = (await res.json()) as { ok: boolean; code?: string };
-      // The visible update arrives via the SSE push (broadcast to every seat, including this one),
-      // not from this response — this only reports whether the rules accepted it.
-      return result.ok;
+      try {
+        const res = await fetch(`/api/intent?${qs}`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ seq, intent }),
+        });
+        const result = (await res.json()) as { ok?: boolean; code?: string };
+        // The visible update arrives via the SSE push (broadcast to every seat, including this one),
+        // not from this response — this only reports whether the rules accepted it.
+        return result.ok === true;
+      } catch {
+        // A network failure or a non-JSON answer used to reject out of a `void`ed promise — an
+        // unhandled rejection and nothing on screen. False is honest: the move was not confirmed.
+        return false;
+      } finally {
+        inFlight = false;
+      }
     },
     subscribe(fn: () => void) {
       listeners.add(fn);
@@ -317,10 +459,38 @@ export function createRemoteSession(
     capabilities: { undo: false, saveLocal: false, newGame: false },
 
     lines: () => lines,
-    takeCues: () => [],
-    takeScheduled: () => null,
-    takeAnnouncement: () => null,
-    justDrawn: () => null,
-    presence: () => [...presence].map(([s, connected]) => ({ seat: s, connected })),
+    // Draining, exactly as the local session's are: each of these marks a moment, so it plays once
+    // and is gone by the next render rather than re-firing on every redraw.
+    takeCues: () => {
+      const out = cues;
+      cues = [];
+      return out;
+    },
+    takeScheduled: () => {
+      const out = scheduled;
+      scheduled = null;
+      return out;
+    },
+    takeAnnouncement: () => {
+      const out = announcement;
+      announcement = null;
+      return out;
+    },
+    justDrawn: () => justDrawnCard,
+    presence: () => [...presence].map(([seat, p]) => ({ seat, connected: p.connected, seen: p.seen })),
+    takeDisplaySteps: () => displaySteps.splice(0, displaySteps.length),
+    takeDisplayReset: () => {
+      const reset = displayReset;
+      displayReset = null;
+      return reset;
+    },
+    close() {
+      // `reportedGone` first: closing the stream fires `onerror`, and this is a deliberate exit, not
+      // a game that vanished — `onGone` must not be called and land the page in "that game is no
+      // longer on this server".
+      reportedGone = true;
+      source.close();
+      listeners.clear();
+    },
   };
 }

src/web/settings-form.ts

@@ -0,0 +1,362 @@
+/**
+ * THE RULES BLOCK, driven identically on both screens.
+ *
+ * The lobby (`lobby.ts`) and the solitaire New Game dialog (`main.ts`) ask the same twelve questions.
+ * They used to ask them in two hand-written copies and had already drifted — the dialog had "where
+ * an Extra may start" and no optional rules, the lobby the reverse — so this module owns reading,
+ * writing, comparing and annotating the block, and each screen supplies only the id prefix its
+ * markup uses (`lb-` or `ng-`).
+ *
+ * THE MARKUP ITSELF STAYS STATIC IN `play.html`, deliberately. Generating it here would be less
+ * duplication, but `test/web.test.ts` drives the emitted bundle against a hand-built DOM stub with
+ * no HTML parser in it (there is no jsdom in this project, and adding one to test a form is a poor
+ * trade), and the ids in that stub come from scanning the real `play.html`. A test in the same suite
+ * asserts both screens carry every key below, which is the drift guard the shared markup would have
+ * been.
+ */
+
+import { REVENUE_MAX, REVENUE_MIN } from '../engine/content.ts';
+import type { ExtraStartRule, StartingHand } from '../engine/content.ts';
+import { closestPreset, differencesFrom, presetOf, presetSettings, settingsOf } from './presets.ts';
+import type { PresetName, Settings } from './presets.ts';
+import type { GameConfig } from '../engine/state.ts';
+
+/**
+ * How each rule is asked on screen.
+ *
+ * `gated` is the pair introduced 2026-08-23: a checkbox that says whether the condition applies at
+ * all, plus the number it applies at. The engine's convention is that `0` switches these off, which
+ * is exact but unreadable — a Cutthroat game showed two zeroes and left the player to know the
+ * convention. Unchecked still WRITES 0, so nothing under this changed.
+ */
+type Field =
+  | { key: keyof Settings; kind: 'radio'; id: string }
+  | { key: keyof Settings; kind: 'number'; id: string }
+  | { key: keyof Settings; kind: 'checkbox'; id: string }
+  | { key: keyof Settings; kind: 'gated'; id: string };
+
+export const FIELDS: readonly Field[] = [
+  { key: 'startingHand', kind: 'radio', id: 'hand' },
+  { key: 'extraStart', kind: 'radio', id: 'extra' },
+  { key: 'passengerPerCoach', kind: 'number', id: 'passenger' },
+  { key: 'freightPerLoad', kind: 'number', id: 'freight' },
+  { key: 'trainPerTransit', kind: 'number', id: 'transit' },
+  { key: 'minCombinedRevenue', kind: 'gated', id: 'minrev' },
+  { key: 'maxCollisionsPerDay', kind: 'gated', id: 'colday' },
+  { key: 'maxCollisionsTotal', kind: 'gated', id: 'coltotal' },
+  { key: 'reducedVisibility', kind: 'checkbox', id: 'visibility' },
+  { key: 'employeeRotation', kind: 'checkbox', id: 'rotation' },
+  { key: 'emergencyToolbox', kind: 'checkbox', id: 'toolbox' },
+  { key: 'discardTimetabled', kind: 'checkbox', id: 'tossloco' },
+  { key: 'startWhistlePosts', kind: 'checkbox', id: 'whistlestart' },
+];
+
+/**
+ * What `play.html` must contain for a screen to be able to ask all twelve questions — the exact
+ * attribute text, so `test/web.test.ts` can assert it against the built page.
+ *
+ * THIS IS THE DRIFT GUARD. The two blocks are generated from one template today; this is what says
+ * so tomorrow, when someone edits one of them by hand.
+ */
+export function fieldSelectors(prefix: string): string[] {
+  const out: string[] = [];
+  for (const f of FIELDS) {
+    // A radio group is addressed by NAME — there is no one element carrying the field's id.
+    out.push(f.kind === 'radio' ? `name="${prefix}${f.id}"` : `id="${prefix}${f.id}"`);
+    if (f.kind === 'gated') out.push(`id="${prefix}${f.id}-on"`);
+    out.push(`id="${prefix}${f.id}-row"`, `id="${prefix}${f.id}-hint"`);
+  }
+  return out;
+}
+
+/** The label each field goes under in the read-only view below. */
+const FIELD_LABELS: Record<keyof Settings, string> = {
+  startingHand: 'Starting hand',
+  extraStart: 'An Extra may start at',
+  discardTimetabled: 'A Timetabled train may be discarded',
+  startWhistlePosts: 'Players start with Whistle Posts, not Depots',
+  passengerPerCoach: 'Passenger per coach',
+  freightPerLoad: 'Freight per load',
+  trainPerTransit: 'Train per transit',
+  minCombinedRevenue: 'Combined Revenue floor',
+  maxCollisionsPerDay: 'Collisions in one Day',
+  maxCollisionsTotal: 'Collisions in the game',
+  reducedVisibility: 'Reduced Visibility',
+  employeeRotation: 'Employee Rotation',
+  emergencyToolbox: 'Emergency Toolbox',
+};
+
+const esc = (s: string): string =>
+  s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+/**
+ * THE WHOLE RULE SET, READ-ONLY — what a player weighing a join reads before taking a seat, and what
+ * the seating screen keeps showing afterwards.
+ *
+ * Generated rather than a fourth copy of the form: nobody may change these, so form controls would
+ * be a lie, and a `<dl>` says "this is what you are joining" in a third of the space. Fields that
+ * differ from the nearest named type are amber here for the same reason they are amber in the form —
+ * a non-standard game should never be a surprise.
+ */
+export function rulesListHtml(config: GameConfig, players: number, days: number): string {
+  const settings = settingsOf(config);
+  const type = presetOf(config, players, days);
+  const near = closestPreset(config, players, days);
+  const differing = type === 'custom' ? near.differing : [];
+
+  const rows = (keys: (keyof Settings)[]): string =>
+    keys
+      .map((k) => {
+        const changed = differing.includes(k) ? ' class="changed"' : '';
+        return `<dt>${esc(FIELD_LABELS[k])}</dt><dd${changed}>${esc(describe(k, settings[k]))}</dd>`;
+      })
+      .join('');
+
+  const head =
+    `<dl><dt>Players</dt><dd>${players}</dd><dt>Days</dt><dd>${days}</dd>` +
+    `<dt>Opponent-directed cards</dt><dd>not implemented yet</dd></dl>`;
+
+  return (
+    head +
+    `<h4>Opening</h4><dl>${rows(['startingHand', 'extraStart', 'startWhistlePosts'])}</dl>` +
+    `<h4>Train cards</h4><dl>${rows(['discardTimetabled'])}</dl>` +
+    `<h4>Revenue</h4><dl>${rows(['passengerPerCoach', 'freightPerLoad', 'trainPerTransit'])}</dl>` +
+    `<h4>Victory conditions</h4><dl>${rows(['minCombinedRevenue', 'maxCollisionsPerDay', 'maxCollisionsTotal'])}</dl>` +
+    `<h4>Optional rules</h4><dl>${rows(['reducedVisibility', 'employeeRotation', 'emergencyToolbox'])}</dl>`
+  );
+}
+
+/** What a value looks like beside its label — "Co-op default: 75", "Co-op default: six random cards". */
+function describe(key: keyof Settings, value: Settings[keyof Settings]): string {
+  if (typeof value === 'boolean') return value ? 'on' : 'off';
+  if (key === 'startingHand') {
+    const words: Record<StartingHand, string> = {
+      threeRandom: 'three random',
+      sixRandom: 'six random',
+      threeTrackThreeOther: 'three track and three other',
+    };
+    return words[value as StartingHand];
+  }
+  if (key === 'extraStart') {
+    const words: Record<ExtraStartRule, string> = {
+      divisionPointsOnly: 'Division Points only',
+      ownOffice: 'your own Control Point',
+      anyOffice: 'any Control Point',
+    };
+    return words[value as ExtraStartRule];
+  }
+  // A victory condition at 0 is not "0" on screen, it is a condition that does not apply.
+  if (value === 0 && (key === 'minCombinedRevenue' || key === 'maxCollisionsPerDay' || key === 'maxCollisionsTotal')) {
+    return 'off';
+  }
+  return String(value);
+}
+
+export type SettingsForm = {
+  read(): Settings;
+  /** `suggestions` fills the placeholder of a switched-off condition, so ticking it back on has a
+   * number to offer rather than an empty box. */
+  write(values: Settings, suggestions: Settings): void;
+  /**
+   * Paint the block against a named type: every field that differs goes amber and every field gets
+   * its "<Type> default: x" hint. Returns what differs, for the summary line the screen draws.
+   */
+  mark(name: PresetName, players: number, days: number): (keyof Settings)[];
+  /** Custom with no named baseline to compare against — clears the paint rather than lying. */
+  clearMarks(): void;
+  /** Called whenever the player changes any rule; the screen answers by selecting Custom. */
+  onEdit(fn: (key: keyof Settings) => void): void;
+  /** Read-only for the join preview and the seating screen: shown in full, changeable by nobody. */
+  setEditable(on: boolean): void;
+  /** Employee Rotation is meaningless at one player — disabled with a note rather than hidden, so
+   * the two screens still read the same. */
+  setEmployeeRotationAvailable(on: boolean): void;
+};
+
+const $ = <T extends HTMLElement = HTMLElement>(id: string): T | null =>
+  document.getElementById(id) as T | null;
+
+export function settingsForm(prefix: string): SettingsForm {
+  const el = <T extends HTMLElement = HTMLElement>(id: string): T | null => $<T>(`${prefix}${id}`);
+  const radios = (name: string): HTMLInputElement[] =>
+    Array.from(document.querySelectorAll<HTMLInputElement>(`input[name="${prefix}${name}"]`));
+  const checkedRadio = (name: string): string | null =>
+    radios(name).find((r) => r.checked)?.value ?? null;
+
+  let editHandler: ((key: keyof Settings) => void) | null = null;
+  let editable = true;
+
+  function num(id: string, fallback: number): number {
+    const raw = el<HTMLInputElement>(id)?.value ?? '';
+    return raw.trim() === '' || !Number.isFinite(Number(raw)) ? fallback : Math.round(Number(raw));
+  }
+
+  function readGated(id: string): number {
+    // Unchecked IS zero — the engine's "off". The number in the box is kept so re-ticking restores it.
+    if (el<HTMLInputElement>(`${id}-on`)?.checked !== true) return 0;
+    return Math.max(0, num(id, 0));
+  }
+
+  function read(): Settings {
+    return {
+      startingHand: (checkedRadio('hand') ?? 'sixRandom') as StartingHand,
+      extraStart: (checkedRadio('extra') ?? 'anyOffice') as ExtraStartRule,
+      passengerPerCoach: clampRevenue(num('passenger', 1)),
+      freightPerLoad: clampRevenue(num('freight', 1)),
+      trainPerTransit: clampRevenue(num('transit', 0)),
+      minCombinedRevenue: readGated('minrev'),
+      maxCollisionsPerDay: readGated('colday'),
+      maxCollisionsTotal: readGated('coltotal'),
+      reducedVisibility: el<HTMLInputElement>('visibility')?.checked === true,
+      employeeRotation: el<HTMLInputElement>('rotation')?.checked === true,
+      emergencyToolbox: el<HTMLInputElement>('toolbox')?.checked === true,
+      discardTimetabled: el<HTMLInputElement>('tossloco')?.checked === true,
+      startWhistlePosts: el<HTMLInputElement>('whistlestart')?.checked === true,
+    };
+  }
+
+  function write(values: Settings, suggestions: Settings): void {
+    for (const r of radios('hand')) r.checked = r.value === values.startingHand;
+    for (const r of radios('extra')) r.checked = r.value === values.extraStart;
+    setNumber('passenger', values.passengerPerCoach);
+    setNumber('freight', values.freightPerLoad);
+    setNumber('transit', values.trainPerTransit);
+    writeGated('minrev', values.minCombinedRevenue, suggestions.minCombinedRevenue);
+    writeGated('colday', values.maxCollisionsPerDay, suggestions.maxCollisionsPerDay);
+    writeGated('coltotal', values.maxCollisionsTotal, suggestions.maxCollisionsTotal);
+    setChecked('visibility', values.reducedVisibility);
+    setChecked('rotation', values.employeeRotation);
+    setChecked('toolbox', values.emergencyToolbox);
+    setChecked('tossloco', values.discardTimetabled);
+    setChecked('whistlestart', values.startWhistlePosts);
+  }
+
+  function setNumber(id: string, value: number): void {
+    const input = el<HTMLInputElement>(id);
+    if (input) input.value = String(value);
+  }
+
+  function setChecked(id: string, on: boolean): void {
+    const input = el<HTMLInputElement>(id);
+    if (input) input.checked = on;
+  }
+
+  function writeGated(id: string, value: number, suggestion: number): void {
+    const box = el<HTMLInputElement>(`${id}-on`);
+    const input = el<HTMLInputElement>(id);
+    if (box) box.checked = value > 0;
+    if (input) {
+      // A switched-off condition shows an empty box with the suggestion as its placeholder, rather
+      // than a `0` the player has to decode.
+      input.value = value > 0 ? String(value) : '';
+      input.placeholder = String(suggestion);
+      input.disabled = !editable || value === 0;
+    }
+  }
+
+  function mark(name: PresetName, players: number, days: number): (keyof Settings)[] {
+    const want = presetSettings(name, players, days);
+    const differing = differencesFrom(name, read(), players, days);
+    const label = presetLabelOf(name);
+    for (const f of FIELDS) {
+      const row = el(`${f.id}-row`);
+      const hint = el(`${f.id}-hint`);
+      const off = differing.includes(f.key);
+      row?.classList.toggle('changed', off);
+      if (hint) hint.textContent = `${label} default: ${describe(f.key, want[f.key])}`;
+    }
+    return differing;
+  }
+
+  function clearMarks(): void {
+    for (const f of FIELDS) {
+      el(`${f.id}-row`)?.classList.remove('changed');
+      const hint = el(`${f.id}-hint`);
+      if (hint) hint.textContent = '';
+    }
+  }
+
+  function setEditable(on: boolean): void {
+    editable = on;
+    for (const f of FIELDS) {
+      if (f.kind === 'radio') {
+        for (const r of radios(f.id)) r.disabled = !on;
+        continue;
+      }
+      const input = el<HTMLInputElement>(f.id);
+      if (input) {
+        // A gated number stays disabled when its own condition is off, whatever the block's state.
+        const gatedOff = f.kind === 'gated' && el<HTMLInputElement>(`${f.id}-on`)?.checked !== true;
+        input.disabled = !on || gatedOff;
+      }
+      if (f.kind === 'gated') {
+        const box = el<HTMLInputElement>(`${f.id}-on`);
+        if (box) box.disabled = !on;
+      }
+    }
+  }
+
+  function setEmployeeRotationAvailable(on: boolean): void {
+    const input = el<HTMLInputElement>('rotation');
+    if (input) {
+      input.disabled = !on || !editable;
+      if (!on) input.checked = false;
+    }
+    el('rotation-row')?.classList.toggle('unavailable', !on);
+  }
+
+  /** One change handler for every control — the screens all answer it the same way (select Custom). */
+  for (const f of FIELDS) {
+    const fire = (): void => editHandler?.(f.key);
+    if (f.kind === 'radio') {
+      for (const r of radios(f.id)) r.onchange = fire;
+      continue;
+    }
+    const input = el<HTMLInputElement>(f.id);
+    if (input) {
+      input.oninput = fire;
+      input.onchange = fire;
+    }
+    if (f.kind === 'gated') {
+      const box = el<HTMLInputElement>(`${f.id}-on`);
+      if (box) {
+        box.onchange = () => {
+          const number = el<HTMLInputElement>(f.id);
+          if (number) {
+            number.disabled = !box.checked || !editable;
+            // Ticking a condition back on with an empty box takes the suggestion showing in it,
+            // so "on" never means "on, at zero".
+            if (box.checked && number.value.trim() === '') number.value = number.placeholder;
+          }
+          fire();
+        };
+      }
+    }
+  }
+
+  return {
+    read,
+    write,
+    mark,
+    clearMarks,
+    onEdit: (fn) => void (editHandler = fn),
+    setEditable,
+    setEmployeeRotationAvailable,
+  };
+}
+
+function clampRevenue(n: number): number {
+  return Math.max(REVENUE_MIN, Math.min(REVENUE_MAX, n));
+}
+
+/** Kept local rather than imported from `presets.ts`'s `preset()`, which would drag the whole table
+ * in for one word — and this is the only place a hint needs it. */
+function presetLabelOf(name: PresetName): string {
+  const labels: Record<PresetName, string> = {
+    solitaire: 'Solitaire',
+    coop: 'Co-op',
+    competitive: 'Competitive',
+    cutthroat: 'Cutthroat',
+  };
+  return labels[name];
+}

src/web/splash.ts

@@ -40,6 +40,29 @@ if (heroImage && lightbox) {
  * other way costs a click and a lobby that says it cannot reach a server — which is legible, and
  * recoverable. So a slow or flaky probe leaves the door alone; only a definite answer closes it.
  */
+/**
+ * CARRY `?pace=` THROUGH THE DOORS — v0.8.0.3.
+ *
+ * Both doors are static hrefs that REPLACE the query string (`play.html?lobby`,
+ * `play.html?solitaire`), so a `pace` typed on this page was silently dropped on the way in: Jesse
+ * played a whole game believing he was at 7× when the play page had only ever seen `?lobby`. The
+ * durable answer is the speed control on the play screen, which persists per viewer — this keeps the
+ * URL lever honest for handing two playtesters different speeds, which is the only thing it was ever
+ * for.
+ */
+try {
+  const pace = new URLSearchParams(location.search).get('pace');
+  if (pace !== null) {
+    for (const door of Array.from(document.querySelectorAll('a.door'))) {
+      const href = door.getAttribute('href');
+      // Only the doors into the game, and only ones that have not been disabled above.
+      if (href?.startsWith('./play.html?')) door.setAttribute('href', `${href}&pace=${encodeURIComponent(pace)}`);
+    }
+  }
+} catch {
+  // A door that keeps its own href is the status quo, not a broken page.
+}
+
 const mpDoor = document.getElementById('door-multiplayer');
 if (mpDoor) {
   const close = (): void => {

src/web/step-queue.ts

@@ -0,0 +1,260 @@
+/**
+ * THE ANIMATION QUEUE — v0.8.0, `docs/plans/jitsi-common-board.md` § v0.8.0 §§ 4-6.
+ *
+ * Holds the public board the screen is currently showing, which is not always the board the game is
+ * actually on. Steps arrive faster than a person can follow — a bot's whole switching turn lands in
+ * ONE push, because `driveBots()` plays it out before the push goes back — so this is what turns a
+ * burst into something watchable. TODO #13.
+ *
+ * TRANSPORT-AGNOSTIC ON PURPOSE. It takes `DisplayStep`s and does not care whether they came from
+ * the engine in this tab or off an SSE stream, which is what lets solitaire (#18: phases that are
+ * never drawn) and multiplayer (#13: turns you never see) run one implementation. Nothing here
+ * imports the DOM either, so it is testable without one.
+ *
+ * NO TIMERS OF ITS OWN. The caller drives it with `advance(now)` from whatever loop it already has
+ * — a `requestAnimationFrame`, a test's fake clock. A queue that owned a `setInterval` would need
+ * starting, stopping and cleaning up on every game replacement, and would be untestable without
+ * faking timers.
+ */
+
+import type { PublicFrame } from '../sim/view.ts';
+import type { DisplayStep } from '../sim/display-step.ts';
+import { applyPublicDelta, changedDivisionCards, changedPiles } from '../sim/public-delta.ts';
+import type { PileKey } from '../sim/public-delta.ts';
+import { dwellForStep } from '../sim/pacing.ts';
+
+export type StepQueue = {
+  /** Throw away what is queued and show this board — a first connect, a reconnect, an undo. */
+  reset(frame: PublicFrame): void;
+  /** Queue steps to be shown in order. */
+  push(steps: readonly DisplayStep[]): void;
+  /**
+   * Show as much as `now` allows. Returns true if the displayed board changed, so a caller can skip
+   * a redraw when nothing did.
+   */
+  advance(now: number): boolean;
+  /** Show everything immediately. Returns true if anything was skipped. */
+  skip(): boolean;
+  /** The board to draw, or null before any reset has arrived. */
+  current(): PublicFrame | null;
+  /**
+   * How many queued steps the player is still going to WATCH — the number the "N behind" counter
+   * shows. Not the queue length: see `watchableCount` in `sim/pacing.ts`.
+   */
+  behind(): number;
+  /** The last step actually shown, for the caption line (#15). Null before anything has been shown. */
+  showing(): DisplayStep | null;
+  /**
+   * The piles the step now on screen moved, for the display to light.
+   *
+   * Here because this is the only place that holds both the frame before a step and the frame after
+   * it — deriving it anywhere else would mean keeping a second copy of the board in step.
+   */
+  lit(): readonly PileKey[];
+  /** True while there is anything left to show. */
+  busy(): boolean;
+  /**
+   * How many narrated lines belong to steps NOT yet shown.
+   *
+   * The log and the board are two different moments while the queue is behind: a push carries its
+   * narration and its steps together, so every line of a bot's turn is in the history panel before the
+   * board has drawn a single move of it (playtest, 2026-09-15: *"is it possible to stall history so it
+   * stays in sync with the number behind?"*). Those lines are the TAIL of the log — they arrived last —
+   * so the caller holds back exactly this many and reveals each as its step goes up.
+   */
+  pendingLines(): number;
+  /** Division nodes whose card changed in the step now on screen, for the map to flash. */
+  flashing(): readonly number[];
+  /**
+   * HOLD THE PLAYBACK ON THE STEP NOW SHOWING — Jesse, playtest 2026-09-16, asking for a pause
+   * beside Skip.
+   *
+   * Skip is the only control the row has had, and it is one-way and total: the way to look harder at
+   * a move that just went past was to not be too slow about it. Pause is the opposite lever — the
+   * board stops where it is and nothing is consumed, so a player can read the caption, look at the
+   * district and then carry on from exactly that step.
+   *
+   * TAKES `now` BECAUSE THE QUEUE OWNS NO CLOCK (see the note at the top of this file). The dwell
+   * still owing is preserved across the hold rather than being spent while nobody was watching:
+   * `resume` pushes the deadline out by however long the pause lasted, so a step paused with 200ms
+   * left resumes with 200ms left instead of vanishing on the next frame.
+   *
+   * Returns false when there is nothing to hold, or nothing being held.
+   */
+  pause(now: number): boolean;
+  resume(now: number): boolean;
+  paused(): boolean;
+};
+
+/**
+ * WHOSE MOVE THE SCREEN IS SHOWING (Gitea#25).
+ *
+ * The game and the board on screen are two different moments. The server plays every bot move the
+ * instant a human's turn ends (`driveBots`), so the LIVE game is nearly always waiting on the human —
+ * while this queue is still replaying the bots, step by step. The turn chart and the Division map's
+ * move marker read the live actor, so a table of one person and three bots said "waiting on" that
+ * person throughout, against a playback row naming the bot actually moving.
+ *
+ * While the queue is behind or still showing a step, the answer is that step's player — `null` for an
+ * automatic phase, which is "the Division is running itself". Otherwise it is the live actor, and
+ * `replaying` is false so a caller can keep live-only detail, such as a ruling the game is waiting on,
+ * off a screen that has not caught up with it yet.
+ */
+export function actorOnScreen(
+  queue: Pick<StepQueue, 'behind' | 'busy' | 'showing'>,
+  live: number | null,
+): { actor: number | null; replaying: boolean } {
+  if (queue.behind() === 0 && !queue.busy()) return { actor: live, replaying: false };
+  const shown = queue.showing();
+  return shown === null ? { actor: live, replaying: false } : { actor: shown.player, replaying: true };
+}
+
+/**
+ * `pace` is read on every step rather than captured, so changing the setting takes effect at once.
+ *
+ * `viewer` says which seat is watching, so THIS PLAYER'S OWN MOVES COST NO TIME. They are already on
+ * screen: a seated player's own board is drawn from their authoritative `Frame`, not from the queue,
+ * so holding their click for a dwell shows them nothing and delays the thing they actually want to
+ * watch — the 700ms before a bot's turn starts animating is 700ms of their own move being replayed
+ * at them. The step is still APPLIED, because the delta chain runs through it.
+ *
+ * Automatic phases have no player and are unaffected, which is what keeps TODO #18 working in
+ * solitaire where every intent is the viewer's own.
+ */
+export function createStepQueue(
+  pace: () => number = () => 1,
+  viewer: () => number | null = () => null,
+): StepQueue {
+  let shown: PublicFrame | null = null;
+  let last: DisplayStep | null = null;
+  let litPiles: readonly PileKey[] = [];
+  let flashedCards: readonly number[] = [];
+  let pending: DisplayStep[] = [];
+  /** When the step now on screen is due to give way. Null when nothing is waiting. */
+  let dueAt: number | null = null;
+  /** When the player pressed Pause, so `resume` can give the current step back the time it had. */
+  let pausedAt: number | null = null;
+
+  /** How long this step holds the screen — zero for the viewer's own moves; see above. */
+  const dwell = (step: DisplayStep): number =>
+    step.player !== null && step.player === viewer() ? 0 : dwellForStep(step, pace());
+
+  /** Applies one step to the displayed board. A step's delta chains off the previous step's frame. */
+  const show = (step: DisplayStep): void => {
+    const before = shown;
+    shown = applyPublicDelta(shown, step.frame);
+    last = step;
+    /**
+     * NOT FOR YOUR OWN MOVES. You drew that card; you do not need the deck flashed at you. Same rule
+     * that gives your own steps no dwell — the display is for watching everybody else.
+     */
+    litPiles = step.player !== null && step.player === viewer() ? [] : changedPiles(before, shown);
+    // A Realignment changes the Division under everyone, so it is flashed for the player who did it
+    // too — unlike a pile, which only tells the drawer what they already know.
+    flashedCards = changedDivisionCards(before, shown);
+  };
+
+  return {
+    reset(frame) {
+      shown = frame;
+      pending = [];
+      dueAt = null;
+      // A reconnect, an undo or a fresh deal replaces the board outright; a hold on the playback that
+      // no longer exists would leave the row stuck reading "paused" with nothing behind it.
+      pausedAt = null;
+      // Nothing was watched arriving at this board, so nothing on it is lit.
+      litPiles = [];
+      flashedCards = [];
+      // `last` deliberately survives: a reconnect should not blank the caption line, and the
+      // sentence describing the most recent action is still true.
+    },
+
+    push(steps) {
+      pending.push(...steps);
+    },
+
+    advance(now) {
+      // Held. Nothing is shown and, crucially, nothing is CONSUMED — `dueAt` is left where it was
+      // and `resume` moves it, so the hold costs the current step none of its dwell.
+      if (pausedAt !== null) return false;
+      if (pending.length === 0) {
+        // The LAST step of a burst still owes its dwell. Clearing `dueAt` here reported the queue
+        // idle the instant that step was shown, which snapped the district panel home before anyone
+        // could look at it — see `busy()`.
+        if (dueAt !== null && now >= dueAt) dueAt = null;
+        return false;
+      }
+      // First step of a burst: show it immediately rather than waiting out a dwell for a board the
+      // player has not been shown yet.
+      if (dueAt === null) {
+        const first = pending.shift()!;
+        show(first);
+        dueAt = now + dwell(first);
+        return true;
+      }
+      let drew = false;
+      /**
+       * A LOOP, not a single step. A dwell of zero means "do not spend the player's attention on
+       * this" — bookkeeping, and phases where nothing happened (TODO #18) — so a run of them must
+       * collapse within one call instead of costing a frame each. The board still passes through
+       * every state in order; nobody is shown a state that never existed.
+       */
+      while (pending.length > 0 && now >= dueAt) {
+        const next = pending.shift()!;
+        show(next);
+        dueAt = dueAt + dwell(next);
+        drew = true;
+      }
+      if (pending.length === 0 && now >= dueAt) dueAt = null;
+      return drew;
+    },
+
+    skip() {
+      // Skipping while held is a decision to stop watching, so it also lifts the hold — otherwise the
+      // board would jump to the game and then sit there paused, with a Resume button that does nothing.
+      pausedAt = null;
+      if (pending.length === 0) return false;
+      for (const step of pending) show(step);
+      pending = [];
+      dueAt = null;
+      return true;
+    },
+
+    pause(now) {
+      if (pausedAt !== null) return false;
+      // Nothing on screen owes any time and nothing is queued: there is no playback to hold.
+      if (pending.length === 0 && dueAt === null) return false;
+      pausedAt = now;
+      return true;
+    },
+
+    resume(now) {
+      if (pausedAt === null) return false;
+      // Give the step on screen back exactly the dwell it was holding when the player pressed Pause.
+      if (dueAt !== null) dueAt += now - pausedAt;
+      pausedAt = null;
+      return true;
+    },
+
+    paused: () => pausedAt !== null,
+
+    current: () => shown,
+    behind: () => pending.filter((s) => dwell(s) > 0).length,
+    showing: () => last,
+    lit: () => litPiles,
+    /**
+     * STILL SHOWING SOMETHING, not just still holding something back.
+     *
+     * This was `pending.length > 0`, which went false the moment the last step of a burst was
+     * shown — so the animation loop stopped and the district panel snapped back to the viewer's own
+     * board without that step ever being visible. Reported from real play: "I briefly saw that it was
+     * the bot's office area, then their turn was done and it pointed back to my office area."
+     *
+     * `dueAt` is non-null exactly while the step on screen has time left, so the two together mean
+     * "there is more to come, or what is up has not had its moment yet".
+     */
+    pendingLines: () => pending.reduce((n, s) => n + s.lines.length, 0),
+    flashing: () => flashedCards,
+    busy: () => pending.length > 0 || dueAt !== null,
+  };
+}

test/advance.test.ts

@@ -7,13 +7,13 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
 
-import { advance, pump } from '../src/engine/advance.ts';
-import { applyIntent, areaOf, check } from '../src/engine/apply.ts';
-import { EXPEDITE_FAULT_PENALTY, HAND_LIMIT, STAGES_PER_DAY, TOTAL_ROLLING_STOCK } from '../src/engine/content.ts';
+import { advance, badlyMadeUp, pump } from '../src/engine/advance.ts';
+import { applyIntent, areaOf, check, isBeingMadeUp } from '../src/engine/apply.ts';
+import { EXPEDITE_FAULT_PENALTY, HAND_LIMIT, MAX_CONSIST, STAGES_PER_DAY, TOTAL_ROLLING_STOCK } from '../src/engine/content.ts';
 import { legalActions } from '../src/engine/legal.ts';
 import { createGame } from '../src/engine/setup.ts';
 import { developerBot } from '../src/sim/bot.ts';
-import type { CrewTray, GameConfig, GameState } from '../src/engine/state.ts';
+import type { CrewTray, DivisionNode, GameConfig, GameState } from '../src/engine/state.ts';
 import { coordKey, railFacingOf } from '../src/engine/state.ts';
 
 const baseConfig = (over: Partial<GameConfig> = {}): GameConfig => ({
@@ -23,6 +23,10 @@ const baseConfig = (over: Partial<GameConfig> = {}): GameConfig => ({
   maxCollisionsPerDay: 0,
   maxCollisionsTotal: 0,
   pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
   optionalRules: {
     reducedVisibility: false,
     employeeRotation: false,
@@ -66,6 +70,21 @@ function playToCompletion(s: GameState, seed = 1, maxTurns = 20_000): PlayStats
     tally(pump(s));
     if (s.status === 'finished') break;
 
+    /**
+     * §3.3, EXTENDED PLAY (Gitea#11) — this harness plays the timetable it was dealt.
+     *
+     * It picks at random among legal options, and one of the two options here is "play another
+     * Day" — so left alone it would extend the game forever and terminate only on `maxTurns`. That
+     * is not a bug in the feature: a game genuinely does not end now until somebody says stop, and
+     * `developerBot` says stop for exactly this reason. Said explicitly here rather than folded
+     * into the random pick, because "how does this loop terminate" deserves an answer in the loop.
+     */
+    if (s.status === 'awaitingExtension') {
+      const r = applyIntent(s, 0, { type: 'game.extend', player: 0, agree: false });
+      assert.ok(r.ok, 'a solitaire player could not decline an extension');
+      break;
+    }
+
     const actor = s.clock.pendingDecision !== null ? s.clock.superintendent : s.clock.currentActor;
     if (actor === null) break;
 
@@ -480,7 +499,7 @@ describe('the Superintendent clearance interrupt (§8.1)', () => {
     assert.equal(r.needsInput, true, 'the phase must stop and ask');
     assert.notEqual(s.clock.pendingDecision, null);
     assert.equal(s.clock.pendingDecision!.train, 'behind');
-    assert.equal(s.clock.pendingDecision!.occupiedBy, 'ahead');
+    assert.equal((s.clock.pendingDecision as { occupiedBy: string }).occupiedBy, 'ahead');
   });
 
   it('does not ask when the train ahead is coming the other way — that is an absolute bar', () => {
@@ -526,7 +545,7 @@ describe('the Superintendent clearance interrupt (§8.1)', () => {
   it('clears the decision once the Superintendent rules', () => {
     const s = game();
     s.clock.phase = 'mainline';
-    s.clock.pendingDecision = { train: 'a', occupiedBy: 'b' };
+    s.clock.pendingDecision = { kind: 'clearance', train: 'a', occupiedBy: 'b' };
     const r = applyIntent(s, 0, { type: 'mainline.clearance', allow: false });
     assert.ok(r.ok);
     assert.equal(s.clock.pendingDecision, null);
@@ -544,9 +563,13 @@ describe('victory conditions (§3, Gap 10e) — unified 2026-08-20', () => {
     s.clock.phase = 'shiftChange';
     s.players[0]!.revenue = 0;
     advance(s);
-    assert.equal(s.status, 'finished');
+    // PAUSES rather than finishes since Gitea#11: a days-based ending offers another Day, and the
+    // result is recorded either way. `official` is the frozen answer; `status` is only where play
+    // has got to. The two collision tests at the foot of this block are the contrast.
+    assert.equal(s.status, 'awaitingExtension');
     assert.equal(s.outcome!.result, 'loss');
     assert.equal(s.outcome!.reason, 'revenueFloor');
+    assert.equal(s.official!.outcome.reason, 'revenueFloor');
   });
 
   it('wins a timed Solitaire game that clears minCombinedRevenue', () => {
@@ -556,7 +579,7 @@ describe('victory conditions (§3, Gap 10e) — unified 2026-08-20', () => {
     s.clock.phase = 'shiftChange';
     s.players[0]!.revenue = 10;
     advance(s);
-    assert.equal(s.status, 'finished');
+    assert.equal(s.status, 'awaitingExtension');
     assert.equal(s.outcome!.result, 'win');
   });
 
@@ -567,7 +590,7 @@ describe('victory conditions (§3, Gap 10e) — unified 2026-08-20', () => {
     s.clock.phase = 'shiftChange';
     s.players[0]!.revenue = 0;
     advance(s);
-    assert.equal(s.status, 'finished');
+    assert.equal(s.status, 'awaitingExtension');
     assert.equal(s.outcome!.result, 'win');
   });
 
@@ -582,7 +605,7 @@ describe('victory conditions (§3, Gap 10e) — unified 2026-08-20', () => {
     s.players[0]!.revenue = 5; // best individual score...
     s.players[1]!.revenue = 3; // ...but combined (8) still misses the floor (20).
     advance(s);
-    assert.equal(s.status, 'finished');
+    assert.equal(s.status, 'awaitingExtension');
     assert.equal(s.outcome!.result, 'loss');
     assert.equal(s.outcome!.reason, 'revenueFloor');
   });
@@ -598,7 +621,7 @@ describe('victory conditions (§3, Gap 10e) — unified 2026-08-20', () => {
     s.players[0]!.revenue = 4;
     s.players[1]!.revenue = 6; // combined 10 clears the floor, neither alone would.
     advance(s);
-    assert.equal(s.status, 'finished');
+    assert.equal(s.status, 'awaitingExtension');
     assert.equal(s.outcome!.result, 'win');
     assert.equal(s.outcome!.winner, null, 'Co-op names an individual winner instead of a shared one');
   });
@@ -636,13 +659,36 @@ describe('victory conditions (§3, Gap 10e) — unified 2026-08-20', () => {
     assert.notEqual(s.status, 'finished');
   });
 
-  it('solitaire never checks the collision floor, whatever the counts', () => {
+  it('solitaire checks the collision floor too, like every other mode', () => {
+    /**
+     * REVERSED 2026-08-30, and this test previously asserted the opposite ("solitaire never checks
+     * the collision floor, whatever the counts").
+     *
+     * The exclusion was never a stated rule — §3.4 does not carve solitaire out — and nothing on
+     * screen reflected it: `SOLO_CONFIG` carried both limits, the New Game dialog offered them as
+     * live settings, and the text beside them said the game would end in a loss. A solitaire player
+     * could set a limit of 1 and crash all game. Found reviewing that screen's wording; Jesse's
+     * ruling is that the settings do what they say.
+     */
     const s = game(1, { mode: 'solitaire', maxCollisionsPerDay: 1, maxCollisionsTotal: 1 });
     s.collisionsToday = 99;
     s.collisionsTotal = 99;
     s.clock.stage = 1;
     s.clock.phase = 'shiftChange';
     advance(s);
+    assert.equal(s.status, 'finished');
+    assert.equal(s.outcome!.reason, 'collisionFloor');
+  });
+
+  it('still lets a solitaire game switch the collision floor off with 0', () => {
+    // The disable path is what a player who does not want the new ending reaches for, so it has to
+    // work at one seat exactly as it does at four.
+    const s = game(1, { mode: 'solitaire', maxCollisionsPerDay: 0, maxCollisionsTotal: 0 });
+    s.collisionsToday = 99;
+    s.collisionsTotal = 99;
+    s.clock.stage = 1;
+    s.clock.phase = 'shiftChange';
+    advance(s);
     assert.notEqual(s.status, 'finished');
   });
 });
@@ -730,43 +776,156 @@ describe('MILESTONE: a full solitaire game runs headless', () => {
   });
 });
 
-describe('X18 Circus Train — a point for standing still', () => {
-  it('pays once for a Stage spent stopped, and never again', () => {
-    /**
-     * REPORTED: "Circus train TX18 was stopped on a siding for a full Stage and I did not get my
-     * Revenue point." It never could: `stopEarnsPoint` was declared on the profile and read
-     * NOWHERE, along with eight other special-train rules. The one card in the deck that pays for
-     * standing still paid nothing.
-     */
-    const s = game();
+describe('X18 Circus / X17 Campaign — a point for setting up (Gitea#13)', () => {
+  /**
+   * REPORTED originally: "Circus train TX18 was stopped on a siding for a full Stage and I did not
+   * get my Revenue point." It never could: `stopEarnsPoint` was declared on the profile and read
+   * NOWHERE, along with eight other special-train rules.
+   *
+   * REDEFINED by Gitea#13 (Jesse, 2026-08-29), and these tests carry the three parts of that
+   * ruling: the point is paid ONCE PER OFFICE AREA rather than once per game, only when the train
+   * is FULLY LOADED, and only in an Office Area at all.
+   */
+  const circusAt = (s: GameState, seat: number, coord: { row: number; col: number }, consist: unknown[]) => {
     s.clock.phase = 'mainline';
     s.trays.set('circus', {
       id: 'circus', trainNumber: 18, trainIsExtra: true, engineAt: 0,
-      consist: [], direction: 'east',
-      position: { at: 'grid', seat: 0, coord: { row: -1, col: 0 } },
+      consist, direction: 'east',
+      position: { at: 'grid', seat, coord },
       movesUsed: 0,
     } as never);
     // A card under it, so the crew is somewhere real rather than off the grid.
-    areaOf(s, 0).grid.set('-1,0', {
+    areaOf(s, seat as never).grid.set(`${coord.row},${coord.col}`, {
       geometry: { kind: 'track', geometry: 'straight' },
       baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [],
     } as never);
+  };
 
+  const loaded = [
+    { type: 'boxcar', loaded: true },
+    { type: 'boxcar', loaded: true },
+    { type: 'coach', loaded: true },
+    { type: 'caboose', loaded: true },
+  ];
+
+  const runPhase = (s: GameState) => {
+    s.clock.phase = 'mainline';
+    s.movedThisPhase = new Set();
+    return pump(s);
+  };
+
+  it('pays a fully loaded Circus for a Stage spent set up', () => {
+    const s = game();
+    circusAt(s, 0, { row: -1, col: 0 }, loaded);
     const before = s.players[0]!.revenue;
-    const first = pump(s);
     assert.ok(
-      first.some((e) => e.type === 'trainStoodStill' && e.trainNumber === 18),
+      pump(s).some((e) => e.type === 'trainStoodStill' && e.trainNumber === 18),
       'the Circus Train stood still for a Stage and earned nothing',
     );
     assert.equal(s.players[0]!.revenue, before + 1, 'the point was not paid');
+  });
 
-    // "One turn stopped" — once. A train that goes on standing there does not keep earning.
-    const paidAgain = () => {
-      s.clock.phase = 'mainline';
-      s.movedThisPhase = new Set();
-      return pump(s).some((e) => e.type === 'trainStoodStill');
-    };
-    assert.ok(!paidAgain(), 'the Circus Train collected a second time for the same set-up');
+  it('pays once per Office Area, however long it parks there', () => {
+    // "Once per stop in an office area" — a train that goes on standing in the same district does
+    // not keep earning. This is the half that was already true, for a different reason.
+    const s = game();
+    circusAt(s, 0, { row: -1, col: 0 }, loaded);
+    pump(s);
+    assert.ok(!runPhase(s).some((e) => e.type === 'trainStoodStill'),
+      'the Circus collected twice for the same set-up');
+    assert.ok(!runPhase(s).some((e) => e.type === 'trainStoodStill'),
+      'the Circus collected a third time for the same set-up');
+  });
+
+  it('pays AGAIN in a different district — each player can be visited', () => {
+    /**
+     * The half that is new. "In a multiplayer game, each player could score if the circus stops in
+     * their area" — so the claim is per seat, and a touring Circus is paid by each district it sets
+     * up in. Before Gitea#13 this paid once per GAME and the second district got nothing.
+     */
+    const s = createGame({
+      id: 'g', seed: 5, config: baseConfig({ mode: 'competitive' }), playerNames: ['A', 'B'],
+    });
+    circusAt(s, 0, { row: -1, col: 0 }, loaded);
+    pump(s);
+    const paidFirst = s.players.map((p) => p.revenue);
+
+    // The same train, moved into the other player's district.
+    const tray = s.trays.get('circus')!;
+    areaOf(s, 1 as never).grid.set('-1,0', {
+      geometry: { kind: 'track', geometry: 'straight' },
+      baseOperationalRail: true, standing: [], facility: null, modifiers: [], enhancements: [],
+    } as never);
+    tray.position = { at: 'grid', seat: 1, coord: { row: -1, col: 0 } } as never;
+
+    assert.ok(runPhase(s).some((e) => e.type === 'trainStoodStill'),
+      'the Circus set up in a second district and earned nothing');
+    const owner = s.seating[1]!;
+    assert.equal(
+      s.players[owner]!.revenue,
+      paidFirst[owner]! + 1,
+      'the point did not go to whoever sits in the district it stopped in',
+    );
+  });
+
+  it('pays nothing when the cars are empty — "not much of a circus"', () => {
+    const s = game();
+    circusAt(s, 0, { row: -1, col: 0 }, [
+      { type: 'boxcar', loaded: false },
+      { type: 'coach', loaded: true },
+      { type: 'caboose', loaded: true },
+    ]);
+    const before = s.players[0]!.revenue;
+    assert.ok(!pump(s).some((e) => e.type === 'trainStoodStill'),
+      'an empty car aboard still collected the set-up point');
+    assert.equal(s.players[0]!.revenue, before, 'Revenue moved for a train that was not full');
+  });
+
+  it('pays nothing to a train carrying nothing at all', () => {
+    // `every` on an empty list is vacuously true, so the emptiest train of the lot is exactly the
+    // one a careless test would pay.
+    const s = game();
+    circusAt(s, 0, { row: -1, col: 0 }, []);
+    assert.ok(!pump(s).some((e) => e.type === 'trainStoodStill'),
+      'a Circus carrying nothing was paid for setting up');
+  });
+
+  it('pays nothing for standing out on the Mainline', () => {
+    /**
+     * It used to, and it misattributed the point: `playerAtSeat` needs a seat, there is none off
+     * the grid, and the fallback handed it to PLAYER 0 wherever the train was standing. Jesse's
+     * ruling scopes the rule to Office Areas, which removes the bug rather than patching it.
+     */
+    const s = game();
+    s.clock.phase = 'mainline';
+    const index = s.division.nodes.findIndex((n) => n.kind === 'mainline');
+    s.trays.set('circus', {
+      id: 'circus', trainNumber: 18, trainIsExtra: true, engineAt: 0,
+      consist: loaded, direction: 'east',
+      position: { at: 'mainline', index },
+      movesUsed: 0,
+    } as never);
+    const before = s.players[0]!.revenue;
+    pump(s);
+    assert.equal(s.players[0]!.revenue, before, 'a Mainline set-up paid a point');
+  });
+
+  it('pays the Campaign Train only when its candidate is aboard', () => {
+    // X17 carries one coach and no freight, so "fully loaded" is exactly "the coach is occupied".
+    // It earned nothing at all before Gitea#13 — it had `stopThenExpedite` and no scoring rule.
+    const occupied = game();
+    circusAt(occupied, 0, { row: -1, col: 0 }, [{ type: 'coach', loaded: true }]);
+    occupied.trays.get('circus')!.trainNumber = 17;
+    const beforeOccupied = occupied.players[0]!.revenue;
+    pump(occupied);
+    assert.equal(occupied.players[0]!.revenue, beforeOccupied + 1, 'a full Campaign Train earned nothing');
+
+    const empty = game();
+    circusAt(empty, 0, { row: -1, col: 0 }, [{ type: 'coach', loaded: false }]);
+    empty.trays.get('circus')!.trainNumber = 17;
+    const beforeEmpty = empty.players[0]!.revenue;
+    pump(empty);
+    assert.equal(empty.players[0]!.revenue, beforeEmpty, 'an empty Campaign Train was paid for its speech');
   });
 });
 
@@ -986,7 +1145,12 @@ describe('the history says WHY a train moved, and says it truthfully', () => {
 
     // A train ahead of it in the same Subdivision, running the SAME way — §8.1's fourth condition,
     // which is the Superintendent's call rather than an absolute bar.
-    const ahead = s.division.nodes.findIndex((n) => n.kind === 'mainline');
+    //
+    // AHEAD MEANS EAST OF THE OFFICE for this eastbound train. This used to take the FIRST Mainline card
+    // in the Division, which is west of the Office — behind the train — and still expected a ruling,
+    // which is exactly the fault Gitea#26 reported. The card is now one the train would actually follow.
+    const office = s.division.nodes.findIndex((n) => n.kind === 'office' && n.seat === 0);
+    const ahead = s.division.nodes.findIndex((n, i) => i > office && n.kind === 'mainline');
     const node = s.division.nodes[ahead];
     assert.equal(node?.kind, 'mainline');
     s.trays.set('ahead', {
@@ -1019,19 +1183,25 @@ describe('the history says WHY a train moved, and says it truthfully', () => {
 
 // ---------------------------------------------------------------------------
 
-describe('an Extra starts where its number sends it, or at a Control Point', () => {
+describe('an Extra starts where the player puts it (Gitea#4)', () => {
   /**
-   * REPORTED: "Extras should start at Eastern or Western Division point based on their numbers. Even
-   * trains run to the east (start at western DP), odd run to the west (start at eastern DP). They
-   * can also start at a control point (any office except whistlepost) at player's choice."
+   * REPORTED, v0.4.9e: "When extras are played the player doing so may choose where the extra
+   * starts. They may choose either division point. And if the interchange mainline card has been
+   * played, they may start the extra on that card and choose the direction from there. If there is
+   * potential for conflict with other trains in that area the superintendent may hold the extra."
    *
-   * Every Extra used to launch eastbound from the West Division Point, hardcoded, with the
-   * simplification flagged in a comment — so half the Extras ran the wrong way and the Control Point
-   * option did not exist at all.
+   * This SUPERSEDES the earlier ruling these tests used to assert — "the number decides, like
+   * everything else on the timetable" — for Extras only. The number still decides for a timetabled
+   * train. The reason the two cannot both hold: an odd (westbound) Extra placed at the WEST end
+   * would leave the Division on its first move having crossed nothing, and be paid for the run.
+   *
+   * So: the start decides the direction. A Division Point runs the train away from itself; in the
+   * middle of the railroad — an Interchange, a Control Point — the player says which way.
    */
   const pending = (trainNumber: number, tier?: 'depot' | 'station'): GameState => {
     const s = game(11);
-    s.pendingExtras = [trainNumber];
+    // Queued by seat 0, who is therefore the one §7 lets place it.
+    s.pendingExtras = [{ trainNumber, player: 0 }];
     s.timetable = s.timetable.map(() => null);
     if (tier) s.officeAreas.get(0)!.tier = tier;
     s.clock.phase = 'newTrain';
@@ -1045,6 +1215,14 @@ describe('an Extra starts where its number sends it, or at a Control Point', ()
     return tray;
   };
 
+  /** Turn one Mainline card into an Interchange, and say which node it is. */
+  const withInterchange = (s: GameState): number => {
+    const i = s.division.nodes.findIndex((n) => n.kind === 'mainline');
+    const node = s.division.nodes[i]!;
+    if (node.kind === 'mainline') node.card = 'interchange';
+    return i;
+  };
+
   it('stops for the decision instead of launching the train itself', () => {
     const s = pending(17);
     assert.equal(s.clock.phase, 'newTrain');
@@ -1055,36 +1233,46 @@ describe('an Extra starts where its number sends it, or at a Control Point', ()
     );
   });
 
-  it('sends an odd Extra west from the EASTERN Division Point', () => {
-    // §2.3 — odd runs west. It therefore starts at the end it runs away from.
+  it('offers BOTH Division Points, not the one the number would dictate', () => {
     const s = pending(17);
-    assert.ok(applyIntent(s, 0, { type: 'newTrain.startExtra', trainNumber: 17, atSeat: null }).ok);
-    const tray = started(s);
-    assert.equal(tray.direction, 'west');
-    assert.equal(tray.position.at === 'divisionPoint' && tray.position.side, 'east');
+    const sides = legalActions(s, 0)
+      .filter((i) => i.type === 'newTrain.startExtra' && i.start?.kind === 'divisionPoint')
+      .map((i) => (i.type === 'newTrain.startExtra' && i.start?.kind === 'divisionPoint' ? i.start.side : ''));
+    assert.deepEqual([...sides].sort(), ['east', 'west']);
   });
 
-  it('sends an even Extra east from the WESTERN Division Point', () => {
-    const s = pending(18);
-    assert.ok(applyIntent(s, 0, { type: 'newTrain.startExtra', trainNumber: 18, atSeat: null }).ok);
-    const tray = started(s);
-    assert.equal(tray.direction, 'east');
-    assert.equal(tray.position.at === 'divisionPoint' && tray.position.side, 'west');
+  it('runs an Extra AWAY from the Division Point it was placed at, whatever its number', () => {
+    // X17 is odd. Under the superseded rule it could only ever start at the East end and run west.
+    for (const [side, direction] of [['west', 'east'], ['east', 'west']] as const) {
+      const s = pending(17);
+      const r = applyIntent(s, 0, {
+        type: 'newTrain.startExtra', trainNumber: 17, start: { kind: 'divisionPoint', side },
+      });
+      assert.ok(r.ok, `the ${side} Division Point was refused: ${r.ok ? '' : r.code}`);
+      const tray = started(s);
+      assert.equal(tray.direction, direction, `an Extra at the ${side} end must run ${direction}`);
+      assert.equal(tray.position.at === 'divisionPoint' && tray.position.side, side);
+    }
   });
 
-  it('refuses a Whistle Post, which is not a Control Point', () => {
-    const s = pending(18);
-    assert.equal(s.officeAreas.get(0)!.tier, 'whistlePost');
-    assert.equal(
-      check(s, 0, { type: 'newTrain.startExtra', trainNumber: 18, atSeat: 0 }),
-      'NOT_A_CONTROL_POINT',
-    );
+  it('refuses a Whistle Post, which is not a Control Point, at every setting of the house rule', () => {
+    for (const extraStart of ['divisionPointsOnly', 'ownOffice', 'anyOffice'] as const) {
+      const s = pending(18);
+      s.config = { ...s.config, houseRules: { ...s.config.houseRules, extraStart } };
+      assert.equal(s.officeAreas.get(0)!.tier, 'whistlePost');
+      const code = check(s, 0, {
+        type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'office', seat: 0 }, direction: 'east',
+      });
+      assert.ok(code !== null, `a Whistle Post was allowed under ${extraStart}`);
+    }
   });
 
   it('starts at a Control Point when the player picks one, taking an A/D track', () => {
     // Upgrading the Office is what buys this: a Depot is a Control Point, a Whistle Post is not.
     const s = pending(18, 'depot');
-    const r = applyIntent(s, 0, { type: 'newTrain.startExtra', trainNumber: 18, atSeat: 0 });
+    const r = applyIntent(s, 0, {
+      type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'office', seat: 0 }, direction: 'west',
+    });
     assert.ok(r.ok, `starting at the Depot was refused: ${r.ok ? '' : r.code}`);
     const tray = started(s);
     const area = s.officeAreas.get(0)!;
@@ -1095,16 +1283,495 @@ describe('an Extra starts where its number sends it, or at a Control Point', ()
       'the Extra did not start on the Office card',
     );
     assert.ok(area.adOccupancy.includes(tray.id), 'it did not take an A/D track');
-    assert.equal(tray.direction, 'east', 'an even Extra still runs east from wherever it starts');
+    // The point of the change: an EVEN Extra running WEST, because the player said so.
+    assert.equal(tray.direction, 'west', 'the direction the player chose was not honoured');
+  });
+
+  it('needs a direction anywhere that is not an end of the Division', () => {
+    const s = pending(18, 'depot');
+    assert.equal(
+      check(s, 0, { type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'office', seat: 0 } }),
+      'NO_DIRECTION_CHOSEN',
+    );
+  });
+
+  it('honours the extraStart house rule for Office starts, and never for the shared ground', () => {
+    for (const [extraStart, code] of [
+      ['divisionPointsOnly', 'OFFICE_STARTS_NOT_ALLOWED'],
+      ['anyOffice', null],
+    ] as const) {
+      const s = pending(18, 'depot');
+      s.config = { ...s.config, houseRules: { ...s.config.houseRules, extraStart } };
+      assert.equal(
+        check(s, 0, {
+          type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'office', seat: 0 }, direction: 'east',
+        }),
+        code,
+        `office start under ${extraStart}`,
+      );
+      // The Division Points belong to nobody, so no setting ever closes them.
+      assert.equal(
+        check(s, 0, { type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'divisionPoint', side: 'west' } }),
+        null,
+      );
+    }
+  });
+
+  it('starts at an Interchange in the players yard, not out on the running line', () => {
+    const s = pending(18);
+    const node = withInterchange(s);
+    const r = applyIntent(s, 0, {
+      type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'mainline', node }, direction: 'east',
+    });
+    assert.ok(r.ok, `the Interchange was refused: ${r.ok ? '' : r.code}`);
+    const tray = started(s);
+    const card = s.division.nodes[node]!;
+    assert.equal(tray.direction, 'east');
+    assert.deepEqual(tray.position, { at: 'mainline', index: node });
+    assert.ok(card.kind === 'mainline' && card.holding?.includes(tray.id), 'it is not in the yard');
+    assert.equal(card.kind === 'mainline' && card.transits.length, 0, 'it was put on the running line');
+  });
+
+  it('refuses any Mainline card that is not an Interchange', () => {
+    const s = pending(18);
+    const plains = s.division.nodes.findIndex((n) => n.kind === 'mainline');
+    const node = s.division.nodes[plains]!;
+    if (node.kind === 'mainline') node.card = 'plains';
+    assert.equal(
+      check(s, 0, { type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'mainline', node: plains }, direction: 'east' }),
+      'NOT_AN_INTERCHANGE',
+    );
+  });
+
+  it('may be started at an Interchange however busy the card is — the yard forces no collision', () => {
+    const s = pending(18);
+    const node = withInterchange(s);
+    const card = s.division.nodes[node]!;
+    // Nose to tail with opposing traffic. §7: placing here still must not force a collision.
+    if (card.kind === 'mainline') {
+      card.transits.push({ tray: 'tray9', stagesRemaining: 2, stagesTotal: 2, direction: 'west' });
+    }
+    assert.equal(
+      check(s, 0, { type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'mainline', node }, direction: 'east' }),
+      null,
+    );
+  });
+
+  /**
+   * §7's last clause, and the reason the Interchange start is modelled as a yard at all: "If there
+   * is potential for conflict with other trains in that area the superintendent may hold the extra."
+   *
+   * Jesse's split: a GUARANTEED collision holds the train at the Interchange for another Stage and
+   * it tries again; a POTENTIAL one is the Superintendent's to rule on. Those are exactly §8.1's
+   * two answers, so the Extra highballs out of the yard through `evaluateClearance` — the same
+   * check a train leaving a Division Point goes through — rather than through anything new.
+   */
+  describe('highballing out of the Interchange yard', () => {
+    /** A pending X18 sitting in the yard of an Interchange, with the terrain pinned. */
+    const inYard = (): { s: GameState; node: number; tray: CrewTray } => {
+      const s = pending(18);
+      const node = withInterchange(s);
+      const r = applyIntent(s, 0, {
+        type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'mainline', node }, direction: 'east',
+      });
+      assert.ok(r.ok, `the Interchange was refused: ${r.ok ? '' : r.code}`);
+      s.clock.phase = 'mainline';
+      s.movedThisPhase = new Set();
+      return { s, node, tray: started(s) };
+    };
+
+    const card = (s: GameState, node: number): Extract<DivisionNode, { kind: 'mainline' }> => {
+      const n = s.division.nodes[node]!;
+      assert.equal(n.kind, 'mainline');
+      return n as Extract<DivisionNode, { kind: 'mainline' }>;
+    };
+
+    it('pulls out onto the card at the next Mainline Phase when the Subdivision is clear', () => {
+      const { s, node, tray } = inYard();
+      advance(s);
+      const n = card(s, node);
+      assert.deepEqual(n.holding, [], 'it never left the yard');
+      assert.ok(n.transits.some((t) => t.tray === tray.id), 'it is not on the running line');
+    });
+
+    it('is held in the yard by a facing train, and tries again the next Stage', () => {
+      const { s, node, tray } = inYard();
+      // Westbound, against an eastbound Extra: §8.1 calls that an absolute bar, not a judgment call.
+      card(s, node).transits.push({ tray: 'facing', stagesRemaining: 2, stagesTotal: 2, direction: 'west' });
+      s.trays.set('facing', {
+        id: 'facing', trainNumber: 3, trainIsExtra: false, engineAt: 0, consist: [],
+        direction: 'west', position: { at: 'mainline', index: node }, movesUsed: 0,
+      });
+
+      const r = advance(s);
+      assert.equal(r.needsInput ?? false, false, 'a guaranteed collision is not a question to ask');
+      assert.equal(s.clock.pendingDecision, null);
+      assert.ok(card(s, node).holding?.includes(tray.id), 'it was not held in the yard');
+      assert.ok(
+        !card(s, node).transits.some((t) => t.tray === tray.id),
+        'it pulled out in front of a train coming the other way',
+      );
+      assert.ok(s.trays.has(tray.id), 'the Extra was destroyed rather than held');
+
+      // AND IT TRIES AGAIN. The Extra waits in the yard, not on the pending list, so once the road
+      // clears the next Mainline Phase takes it out with no further intervention.
+      s.trays.delete('facing');
+      card(s, node).transits = [];
+      s.clock.phase = 'mainline';
+      s.movedThisPhase = new Set();
+      advance(s);
+      assert.deepEqual(card(s, node).holding, [], 'it did not try again once the road was clear');
+      assert.ok(card(s, node).transits.some((t) => t.tray === tray.id), 'it never pulled out');
+    });
+
+    it('puts a following train to the Superintendent rather than holding it automatically', () => {
+      const { s, node, tray } = inYard();
+      // Same direction: §8.1's judgment call, which is what "may hold the extra" means.
+      card(s, node).transits.push({ tray: 'ahead', stagesRemaining: 2, stagesTotal: 2, direction: 'east' });
+      s.trays.set('ahead', {
+        id: 'ahead', trainNumber: 4, trainIsExtra: false, engineAt: 0, consist: [],
+        direction: 'east', position: { at: 'mainline', index: node }, movesUsed: 0,
+      });
+
+      const r = advance(s);
+      assert.equal(r.needsInput, true, 'the phase must stop and ask');
+      assert.equal(s.clock.pendingDecision?.train, tray.id);
+      assert.equal((s.clock.pendingDecision as { occupiedBy: string } | null)?.occupiedBy, 'ahead');
+
+      // HOLD keeps it in the yard.
+      assert.ok(applyIntent(s, s.clock.superintendent, { type: 'mainline.clearance', allow: false }).ok);
+      advance(s);
+      assert.ok(card(s, node).holding?.includes(tray.id), 'the Superintendent held it and it left anyway');
+    });
+  });
+
+  /**
+   * FOUND BY PLAYING IT, not by the tests above: an Extra started anywhere but a Division Point was
+   * never offered a car and ran empty.
+   *
+   * `isBeingMadeUp` asked only "is this tray standing at a Division Point", which was the whole
+   * truth while that was the only place to build a train. The Control Point start has therefore
+   * shipped since it was added with a train that could not be loaded, and the Interchange start
+   * would have shipped the same way — against Jesse's report, which says an Extra started at the
+   * Interchange "would be Loaded with cars".
+   */
+  describe('an Extra started away from a Division Point can still be made up', () => {
+    const fill = (s: GameState): string[] => {
+      for (let i = 0; i < MAX_CONSIST + 1; i++) {
+        const options = legalActions(s, s.clock.currentActor ?? 0).filter((a) => a.type === 'newTrain.placeCar');
+        if (options.length === 0) break;
+        assert.ok(applyIntent(s, s.clock.currentActor ?? 0, options[0]!).ok);
+      }
+      return started(s).consist.map((c) => c.type);
+    };
+
+    it('takes a consist in the Interchange yard', () => {
+      const s = pending(18);
+      const node = withInterchange(s);
+      assert.ok(applyIntent(s, 0, {
+        type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'mainline', node }, direction: 'east',
+      }).ok);
+      assert.ok(fill(s).length > 0, 'the Extra was never offered a car and would have run empty');
+    });
+
+    it('takes a consist at a Control Point', () => {
+      const s = pending(18, 'depot');
+      assert.ok(applyIntent(s, 0, {
+        type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'office', seat: 0 }, direction: 'east',
+      }).ok);
+      assert.ok(fill(s).length > 0, 'the Extra was never offered a car and would have run empty');
+    });
+
+    it('stops being made up the moment it starts running', () => {
+      // Otherwise a train out on the Mainline could be handed cars from the Division Yard — the
+      // "cars appearing on a train nobody was making up" bug `isBeingMadeUp` exists to prevent.
+      const s = pending(18);
+      const node = withInterchange(s);
+      assert.ok(applyIntent(s, 0, {
+        type: 'newTrain.startExtra', trainNumber: 18, start: { kind: 'mainline', node }, direction: 'east',
+      }).ok);
+      const tray = started(s);
+      s.clock.phase = 'mainline';
+      s.movedThisPhase = new Set();
+      advance(s);
+      assert.equal(s.trays.get(tray.id)?.beingMadeUp, undefined, 'a running train is still being made up');
+      assert.equal(isBeingMadeUp(s.trays.get(tray.id)!), false);
+    });
+  });
+
+  it('replays a save written before the choice existed exactly as it meant it', () => {
+    /**
+     * A save is a seed and a list of intents, so an intent whose meaning moves is a save that
+     * quietly replays as a different game. The legacy shape carried only `atSeat`: null meant the
+     * Division Point the NUMBER sent it to, running in the number's direction.
+     */
+    const s = pending(17);
+    assert.ok(applyIntent(s, 0, { type: 'newTrain.startExtra', trainNumber: 17, atSeat: null }).ok);
+    const tray = started(s);
+    assert.equal(tray.direction, 'west', 'the legacy intent stopped meaning what it meant');
+    assert.equal(tray.position.at === 'divisionPoint' && tray.position.side, 'east');
   });
 
   it('takes the Extra off the pending list once, whichever end it started from', () => {
     const s = pending(17);
-    assert.ok(applyIntent(s, 0, { type: 'newTrain.startExtra', trainNumber: 17, atSeat: null }).ok);
+    const at = { type: 'newTrain.startExtra', trainNumber: 17, start: { kind: 'divisionPoint', side: 'east' } } as const;
+    assert.ok(applyIntent(s, 0, at).ok);
     assert.deepEqual(s.pendingExtras, []);
-    assert.equal(
-      check(s, 0, { type: 'newTrain.startExtra', trainNumber: 17, atSeat: null }),
-      'NO_EXTRA_PENDING',
+    assert.equal(check(s, 0, at), 'NO_EXTRA_PENDING');
+  });
+});
+
+// ---------------------------------------------------------------------------
+
+describe('§8.1 counts only trains AHEAD of the one departing (Gitea#26)', () => {
+  /**
+   * REPORTED from playtesting v0.8.0.9: two westbound Extras, X15 at an Office and X18 still crossing
+   * the card to its EAST. The Superintendent was asked to rule on X15 against X18 — a train behind it —
+   * and holding X15 kept the Whistle Post's only A/D track full, so X18 arrived into it and was
+   * destroyed. Reproduced by replaying the exported save; the positions below are that situation in a
+   * one-seat Division, where every Office is a Whistle Post and the Subdivision spans them all.
+   */
+  const setup = (occupant: { direction: 'east' | 'west'; side: 'east' | 'west'; number: number }) => {
+    const s = game(7, { days: 5 });
+    const area = areaOf(s, 0);
+    const office = s.division.nodes.findIndex((n) => n.kind === 'office' && n.seat === 0);
+    s.trays.set('departing', {
+      id: 'departing', trainNumber: 15, trainIsExtra: true, engineAt: 0, consist: [],
+      direction: 'west', facing: 'w',
+      position: { at: 'grid', seat: 0, coord: area.officeCoord }, movesUsed: 0,
+    });
+    area.adOccupancy.push('departing');
+    const card = s.division.nodes.findIndex((n, i) =>
+      n.kind === 'mainline' && (occupant.side === 'east' ? i > office : i < office));
+    const node = s.division.nodes[card];
+    assert.equal(node?.kind, 'mainline');
+    s.trays.set('other', {
+      id: 'other', trainNumber: occupant.number, trainIsExtra: true, engineAt: 0, consist: [],
+      direction: occupant.direction, facing: occupant.direction === 'east' ? 'e' : 'w',
+      position: { at: 'mainline', index: card }, movesUsed: 0,
+    });
+    if (node?.kind === 'mainline') {
+      node.transits.push({ tray: 'other', stagesRemaining: 2, stagesTotal: 2, direction: occupant.direction });
+    }
+    s.clock.phase = 'mainline';
+    return s;
+  };
+
+  it('does not put a same-direction train BEHIND the departing one to the Superintendent', () => {
+    const s = setup({ direction: 'west', side: 'east', number: 18 });
+    const r = advance(s);
+    assert.ok(!r.events.some((e) => e.type === 'clearanceRequested'), 'a train behind was put to the Superintendent');
+    assert.ok(
+      r.events.some((e) => e.type === 'trainHighballed' && e.trainNumber === 15),
+      'the departing train did not highball with nothing ahead of it',
+    );
+    assert.ok(!r.events.some((e) => e.type === 'trainsDestroyed'), 'a train was destroyed');
+  });
+
+  it('does not bar a departure over an opposite-direction train BEHIND it, which is moving away', () => {
+    const s = setup({ direction: 'east', side: 'east', number: 18 });
+    const r = advance(s);
+    assert.ok(
+      r.events.some((e) => e.type === 'trainHighballed' && e.trainNumber === 15),
+      'a train moving away behind it held the departure',
+    );
+  });
+
+  it('still puts a same-direction train AHEAD to the Superintendent', () => {
+    const s = setup({ direction: 'west', side: 'west', number: 18 });
+    const r = advance(s);
+    assert.ok(
+      r.events.some((e) => e.type === 'clearanceRequested' && e.trainId === 'departing'),
+      'a train the departing one would follow was not put to the Superintendent',
     );
   });
 });
+
+// ---------------------------------------------------------------------------
+
+/**
+ * §7's make-up round is silent about what it could NOT do, and that silence was reported from a
+ * table (2026-09-16): "train 5, the sparrow, has no coaches, which seems strange."
+ *
+ * The Sparrow's card calls for three coaches and nothing else. Every coach in that game had ended
+ * up in the Classification Yard, which §2.2 returns only when the Division Yard runs bare — and the
+ * Division Yard still held 46 freight cars, so it never would. `trainNeedingCars` therefore answered
+ * "nothing to ask for" exactly as it answers "everything is full", the phase moved on, and the train
+ * ran the length of the Division empty with no line anywhere saying why.
+ */
+describe('a train the Division Yard cannot supply says so', () => {
+  /** Puts one train in the yard-filling state, with a yard holding only `types`. */
+  const readyToFill = (yard: { type: string; loaded: boolean }[]) => {
+    const s = game();
+    // Stage 1's train is 1/2, the Crack Limited — coaches only, which is the shape that goes short.
+    s.timetable = Array(STAGES_PER_DAY).fill(null);
+    s.timetable[0] = 1;
+    s.yards.divisionYard = yard as never;
+    s.yards.classificationYard = [{ type: 'coach', loaded: false }] as never;
+    s.clock.stage = 1;
+    s.clock.phase = 'newTrain';
+    return s;
+  };
+
+  it('reports the shortfall, with the cars, the waiting pile and why it will not come back', () => {
+    // A yard of pure freight: nothing the Crack Limited will take.
+    const s = readyToFill([
+      { type: 'boxcar', loaded: true },
+      { type: 'hopper', loaded: false },
+    ]);
+    const { events } = advance(s);
+    const short = events.find((e) => e.type === 'makeUpShort');
+    assert.ok(short, 'a train that could be given nothing reported nothing');
+    assert.equal(short.type === 'makeUpShort' && short.placed, 0);
+    assert.ok(
+      short.type === 'makeUpShort' && short.missing.includes('coach'),
+      'the report did not name the category the yard could not supply',
+    );
+    assert.ok(
+      short.type === 'makeUpShort' && short.waiting === 1,
+      'the report did not count the cars waiting in the Classification Yard',
+    );
+    assert.ok(
+      short.type === 'makeUpShort' && short.divisionYardHolds === 2,
+      'the report did not say how far the Division Yard is from bare, which is what §2.2 turns on',
+    );
+  });
+
+  it('says nothing when the round can still be asked for a car', () => {
+    // The same train, with coaches available: the phase must STOP for them rather than report.
+    const s = readyToFill([
+      { type: 'coach', loaded: true },
+      { type: 'coach', loaded: true },
+    ]);
+    const { events, needsInput } = advance(s);
+    assert.equal(needsInput, true, 'the phase should be waiting for a car to be placed');
+    assert.equal(
+      events.some((e) => e.type === 'makeUpShort'),
+      false,
+      'a train that can still be filled was reported short',
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+
+/**
+ * §8.2 and the Small Yard's nose sort, together — Jesse's ruling of 2026-09-17 was "any train may
+ * sort to the nose, and it is held if it cannot depart".
+ *
+ * The holding half already existed and needed no new code, which is worth pinning precisely because
+ * it is easy to assume otherwise: `badlyMadeUp` is deliberately DIRECTION-FREE, so a train with its
+ * whole consist ahead of the engine is a PUSHING train and fit to run. What §8.2 refuses is a
+ * broken-backed train — the engine buried among its own cars — and a caboose anywhere but the end
+ * away from the engine.
+ */
+describe('a train sorted to the nose is judged by §8.2, not by where the engine is', () => {
+  const tray = (consist: { type: string; loaded: boolean }[], engineAt: number) =>
+    ({ consist, engineAt }) as unknown as CrewTray;
+
+  it('lets a pushing train run — the whole consist ahead of the engine is made up', () => {
+    const pushing = tray([{ type: 'caboose', loaded: true }, { type: 'boxcar', loaded: true }], 2);
+    assert.equal(
+      badlyMadeUp(pushing),
+      null,
+      'a pushing train was refused; §8.2 is enforced direction-free on purpose',
+    );
+  });
+
+  it('holds a train whose engine is buried among its own cars', () => {
+    const buried = tray(
+      [{ type: 'boxcar', loaded: true }, { type: 'hopper', loaded: true }, { type: 'caboose', loaded: true }],
+      1,
+    );
+    const why = badlyMadeUp(buried);
+    assert.ok(why !== null, 'a broken-backed train was allowed to leave the Office');
+    assert.match(why, /engine is buried/, `the hold did not say why: ${why}`);
+  });
+
+  it('holds a train whose caboose is not at the end away from the engine', () => {
+    // Exactly the arrangement asked for at the table: caboose second from the rear.
+    const wanted = tray(
+      [
+        { type: 'hopper', loaded: true },
+        { type: 'tank', loaded: false },
+        { type: 'caboose', loaded: true },
+        { type: 'boxcar', loaded: true },
+      ],
+      0,
+    );
+    const why = badlyMadeUp(wanted);
+    assert.ok(why !== null, 'a train with its caboose mid-consist was allowed to leave');
+    assert.match(why, /caboose must be at the rear/, `the hold did not say why: ${why}`);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// v0.8.3 — audit findings (2026-09-29)
+// ---------------------------------------------------------------------------
+
+describe('the collision floor at the end of a Day (v0.8.3)', () => {
+  it('fires on a breach reached in Stage 12, before the Day rolls over', () => {
+    /**
+     * `shiftChange` reset `collisionsToday` at the Day rollover and only THEN asked whether the Day
+     * had breached the limit — so a third wreck in Stage 12 was read as zero, and the one Stage of
+     * the Day in which the floor could not fire was the last one. The tests above all set `stage`
+     * to 1, which never crosses the rollover.
+     */
+    const s = game(1, { mode: 'competitive', maxCollisionsPerDay: 2 });
+    s.collisionsToday = 2;
+    s.clock.stage = STAGES_PER_DAY;
+    s.clock.phase = 'shiftChange';
+    advance(s);
+    assert.equal(s.status, 'finished', 'a breach in the last Stage of the Day went unpunished');
+    assert.equal(s.outcome!.result, 'loss');
+    assert.equal(s.outcome!.reason, 'collisionFloor');
+  });
+});
+
+describe('the Expedite fault is charged once per Mainline Phase (v0.8.3)', () => {
+  it('does not charge again when the phase resumes after a clearance ruling', () => {
+    /**
+     * The Q3 fault loop ran unguarded at the top of `mainlinePhase`, and the phase is re-entered
+     * from the top after every clearance, Yard Office or Red Flag question — so an Expedited train
+     * left on a siding was fined once per QUESTION rather than once per Phase.
+     */
+    const s = game(7, { days: 5 });
+    for (const n of s.division.nodes) if (n.kind === 'mainline') n.card = 'plains';
+    const area = areaOf(s, 0);
+    // The Expedited train, parked off the station: one fault is due.
+    s.trays.set('expedited', {
+      id: 'expedited', trainNumber: 6, trainIsExtra: false, engineAt: 0, consist: [],
+      direction: 'east', facing: 'e',
+      position: { at: 'grid', seat: 0, coord: { row: area.officeCoord.row, col: area.officeCoord.col + 1 } }, movesUsed: 0,
+    });
+    // A departing train that will put a clearance question to the Superintendent mid-phase.
+    s.trays.set('leaving', {
+      id: 'leaving', trainNumber: 12, trainIsExtra: false, engineAt: 0, consist: [],
+      direction: 'east', facing: 'e', position: { at: 'grid', seat: 0, coord: area.officeCoord }, movesUsed: 0,
+    });
+    area.adOccupancy.push('leaving');
+    const office = s.division.nodes.findIndex((n) => n.kind === 'office' && n.seat === 0);
+    const ahead = s.division.nodes.findIndex((n, i) => i > office && n.kind === 'mainline');
+    const node = s.division.nodes[ahead];
+    assert.equal(node?.kind, 'mainline');
+    s.trays.set('ahead', {
+      id: 'ahead', trainNumber: 9, trainIsExtra: false, engineAt: 0, consist: [],
+      direction: 'east', facing: 'e', position: { at: 'mainline', index: ahead }, movesUsed: 0,
+    });
+    if (node?.kind === 'mainline') node.transits.push({ tray: 'ahead', stagesRemaining: 2, stagesTotal: 2, direction: 'east' });
+
+    s.clock.phase = 'mainline';
+    const before = s.players[0]!.revenue;
+    const first = advance(s);
+    assert.ok(first.needsInput, 'no clearance question was put, so the phase never resumed');
+    assert.equal(first.events.filter((e) => e.type === 'expediteFault').length, 1);
+
+    // Hold the departing train, so the only Revenue that can move is the fault's.
+    const ruling = legalActions(s, s.clock.superintendent).find((i) => i.type === 'mainline.clearance' && !i.allow);
+    assert.ok(ruling, 'no clearance ruling on offer');
+    assert.ok(applyIntent(s, s.clock.superintendent, ruling).ok);
+    const resumed = advance(s);
+    assert.ok(!resumed.events.some((e) => e.type === 'expediteFault'), 'the fault was charged a second time');
+    assert.equal(s.players[0]!.revenue, before - EXPEDITE_FAULT_PENALTY, 'more than one fault was charged');
+  });
+});

test/card-reference.test.ts

@@ -0,0 +1,78 @@
+/**
+ * The card reference must not drift from the cards.
+ *
+ * `docs/rules/card-reference.md` spent several releases describing the v0.4.5 deck — twelve numbered
+ * trains, "3 / 4 Mail-Express, 3 coaches" — while `content.ts` had train 3 as the Express with two
+ * freight cars and a per-location freight rule. Worse, `content.ts` named that file as "the place
+ * that now carries what the cards say", so the code sent readers to a table its own banner told them
+ * not to trust. Nothing failed, because nothing checked.
+ *
+ * The card tables in `docs/home-deck.md` and `docs/mainline-deck.md` are emitted from the same
+ * exported catalogues the engine instantiates
+ * from, and this re-runs the generator and compares. Change a card face without regenerating and
+ * this goes red — which is the whole point: a document nothing verifies is a document that will be
+ * wrong, and this project's own history is the evidence.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+const DOCS = ['docs/home-deck.md', 'docs/mainline-deck.md'].map((rel) => join(root, rel));
+
+describe('the deck references carry generated card tables, and they are current', () => {
+  it('matches what the generator emits from content.ts today', () => {
+    const before = DOCS.map((d) => readFileSync(d, 'utf8'));
+    execFileSync(process.execPath, [join(root, 'scripts/build-card-reference.ts')], { cwd: root });
+    DOCS.forEach((d, i) => {
+      assert.equal(
+        readFileSync(d, 'utf8'),
+        before[i],
+        `${d} is stale — run \`npm run build:cards\` and commit the result`,
+      );
+    });
+  });
+
+  it('puts every generated block inside a marker pair that exists', () => {
+    /**
+     * The generator throws on a block with nowhere to go, so this guards the other direction: a
+     * marker pair left in a document with no block to fill it would sit there empty and silent.
+     */
+    for (const d of DOCS) {
+      const text = readFileSync(d, 'utf8');
+      const begins = [...text.matchAll(/<!-- BEGIN CARDS: ([a-z]+) -->/g)].map((m) => m[1]!);
+      const ends = [...text.matchAll(/<!-- END CARDS: ([a-z]+) -->/g)].map((m) => m[1]!);
+      assert.deepEqual(begins, ends, `${d}: card markers are unbalanced`);
+      for (const key of begins) {
+        const body = text.slice(
+          text.indexOf(`<!-- BEGIN CARDS: ${key} -->`) + `<!-- BEGIN CARDS: ${key} -->`.length,
+          text.indexOf(`<!-- END CARDS: ${key} -->`),
+        );
+        assert.match(body, /\|/, `${d}: the "${key}" block has no table in it`);
+      }
+    }
+  });
+
+  it('carries the current train catalogue, not the v0.4.5 deck', () => {
+    // The specific drift that went unnoticed for several releases, asserted by name so a future
+    // regeneration against an old content.ts cannot quietly reintroduce it.
+    const md = readFileSync(join(root, 'docs/home-deck.md'), 'utf8');
+    assert.match(md, /Crack Limited/);
+    assert.match(md, /\| 3 \| Express \|/);
+    assert.ok(!/Mail-Express/.test(md), 'the superseded v0.4.5 train names are back');
+    assert.ok(!/Manifest Freight/.test(md), 'the superseded v0.4.5 train names are back');
+  });
+
+  it('says the tables are generated, so nobody edits them by hand', () => {
+    for (const d of DOCS) {
+      const md = readFileSync(d, 'utf8');
+      assert.match(md, /GENERATED from/, `${d} does not say its tables are generated`);
+      assert.match(md, /`npm run build:cards`/, `${d} does not say what regenerates them`);
+    }
+  });
+});

test/cut-ordering.test.ts

@@ -11,9 +11,12 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
 
-import { applyIntent, areaOf, check } from '../src/engine/apply.ts';
+import { applyIntent, areaOf, check, movesFor } from '../src/engine/apply.ts';
+import { legalActions } from '../src/engine/legal.ts';
+import { describeIntent } from '../src/sim/view.ts';
+import { badlyMadeUp } from '../src/engine/advance.ts';
 import { createGame } from '../src/engine/setup.ts';
-import type { CrewTray, GameConfig, GameState, GridCoord, RollingStock, TrackCard } from '../src/engine/state.ts';
+import type { CrewTray, GameConfig, GameState, GridCoord, RollingStock, TrackArc, TrackCard } from '../src/engine/state.ts';
 import { carsOn, coordKey, turnOf } from '../src/engine/state.ts';
 
 const config: GameConfig = {
@@ -23,6 +26,10 @@ const config: GameConfig = {
   maxCollisionsPerDay: 0,
   maxCollisionsTotal: 0,
   pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
   optionalRules: {
     reducedVisibility: false,
     employeeRotation: false,
@@ -53,12 +60,18 @@ function row(s: GameState, n: number): void {
   for (let c = 0; c < n; c++) addCard(s, at(1, c), straight());
 }
 
+/**
+ * `facing` is the PORT the engine points out through, which is not always an east-west one: a train
+ * standing on a curve points along its 45° leg. `railFacing` carries the east-west sense the train
+ * arrived with, so it keeps a straight answer whatever port the nose is on (`railFacingOf`).
+ */
 function placeTray(
   s: GameState,
   coord: GridCoord,
   consist: RollingStock[],
-  facing: 'e' | 'w',
+  facing: 'n' | 's' | 'e' | 'w',
   engineAt = 0,
+  railFacing: 'e' | 'w' = facing === 'w' ? 'w' : 'e',
 ): string {
   const id = s.freeTrays.pop()!;
   s.trays.set(id, {
@@ -67,9 +80,9 @@ function placeTray(
     trainIsExtra: false,
     engineAt,
     consist,
-    direction: facing === 'w' ? 'west' : 'east',
+    direction: railFacing === 'w' ? 'west' : 'east',
     facing,
-    railFacing: facing,
+    railFacing,
     position: { at: 'grid', seat: 0, coord },
     movesUsed: 0,
   } as CrewTray);
@@ -373,3 +386,308 @@ describe('taking your own cut back is undoing the drop, not a fresh pick-up', ()
     );
   });
 });
+
+// ---------------------------------------------------------------------------
+
+describe('a 45° leg is part of the west-to-east row, not outside it (Gitea#17)', () => {
+  /**
+   * Reported: "Cars were West to East Caboose, Loaded boxcar, Loaded boxcar, Loaded boxcar. After
+   * backing into that square cars were attached to the train Loaded boxcar, Loaded boxcar, Loaded
+   * boxcar, Caboose, Engine." The caboose came back next to the engine instead of at the far end,
+   * which also leaves the train badly made up under §8.2.
+   *
+   * The square was a `sw` CURVE and the train backed in through its SOUTH leg. `standing` runs west
+   * to east, and the two places that walk it both asked the PORT which end of the row they were at:
+   * `exploreMoves` reversed the row for an 'e' entry and for nothing else, and `cutTowards` answered
+   * "you meet nothing" for a north or south exit. Neither is a property of the port.
+   *
+   * A 45° leg leaves through the MIDDLE of its edge, so its end of the run is whichever end the arc
+   * does not reach: the south leg of a `sw` curve is the row's EAST end, and the south leg of an
+   * `se` curve is its WEST end. Same port, opposite answers — which is why `rowEndAt` has to ask the
+   * card.
+   */
+  const curve = (arc: TrackArc, standing: RollingStock[] = [], standingWest = 0): TrackCard => ({
+    geometry: { kind: 'track', geometry: 'curved', arc, hand: 'right' },
+    baseOperationalRail: true,
+    standing,
+    standingWest,
+    facility: null,
+    modifiers: [],
+    enhancements: [],
+  });
+
+  /**
+   * The reported board, minimally: a `sw` curve holding the cut, and an `ne` curve below it for the
+   * train to run from. Both legs lie on the `ne_sw` diagonal, so the two cards actually join.
+   */
+  function board(standing: RollingStock[], standingWest = standing.length): GameState {
+    const s = game();
+    addCard(s, at(1, 0), curve('sw', standing, standingWest));
+    addCard(s, at(0, 0), curve('ne'));
+    switching(s);
+    return s;
+  }
+
+  it('backs into a cut through the south leg and meets the EAST end of the row first', () => {
+    const s = board([car('caboose', true), car('boxcar', true), car('boxcar', true), car('boxcar', true)]);
+    // Facing east on the `ne` curve, so reversing pulls out through its north leg and into the
+    // curve above through that card's south leg — the move in the reported save.
+    const id = placeTray(s, at(0, 0), [], 'e');
+    const r = applyIntent(s, 0, { type: 'switch.move', trayId: id, to: at(1, 0), reverse: true });
+    assert.ok(r.ok, `the reverse move was refused: ${r.ok ? '' : r.code}`);
+    // Coupled behind the engine nearest-car-first, and the nearest car is the one at the south end
+    // — the LAST of a west-to-east row on a `sw` curve. The caboose was westmost, so it ends up
+    // furthest from the engine, which is where §8.2 needs it.
+    assert.deepEqual(types(s.trays.get(id)!.consist), ['boxcar', 'boxcar', 'boxcar', 'caboose']);
+  });
+
+  it('meets the WEST end of the row first where the same leg belongs to an `se` curve', () => {
+    // The mirror, and the reason the port alone cannot answer: an `se` curve's south leg is the
+    // west end of its row, so the same reverse move meets the caboose first.
+    const s = game();
+    addCard(s, at(1, 0), curve('se', [car('caboose', true), car('boxcar', true)], 2));
+    addCard(s, at(0, 0), curve('nw'));
+    switching(s);
+    const id = placeTray(s, at(0, 0), [], 'w');
+    const r = applyIntent(s, 0, { type: 'switch.move', trayId: id, to: at(1, 0), reverse: true });
+    assert.ok(r.ok, `the reverse move was refused: ${r.ok ? '' : r.code}`);
+    assert.deepEqual(types(s.trays.get(id)!.consist), ['caboose', 'boxcar']);
+  });
+
+  it('takes its own cut back with it when it pulls out through the south leg (§A.4)', () => {
+    // The other half of the same assumption: `cutTowards` said a train leaving north or south meets
+    // nothing, so a crew standing on a curve drove away and left the cars beside it standing —
+    // exactly what mandatory coupling forbids.
+    const s = board([car('boxcar', true)], 0);
+    // `standingWest` 0 puts the boxcar EAST of the train, which on a `sw` curve is between it and
+    // the south leg it is about to leave by.
+    const id = placeTray(s, at(1, 0), [], 's');
+    const r = applyIntent(s, 0, { type: 'switch.move', trayId: id, to: at(0, 0), reverse: false });
+    assert.ok(r.ok, `the move off the curve was refused: ${r.ok ? '' : r.code}`);
+    assert.deepEqual(types(s.trays.get(id)!.consist), ['boxcar'], 'the cut beside the train was left standing');
+    assert.deepEqual(standingAt(s, at(1, 0)), [], 'the cars should have come off the card');
+  });
+});
+
+// ---------------------------------------------------------------------------
+
+/**
+ * The Small Yard's re-order menu, reported from Day 3 of the 2026-09-17 playtest.
+ *
+ * Jesse had train 10 on his Small Yard — nose first, `[loaded boxcar, loaded hopper, empty tank,
+ * caboose]` — wanted the boxcar on the tail, and could not tell which button did it: every option
+ * read `re-order consist [1,2,3,0]`, the engine's own array indices offered to a person. The move he
+ * wanted was the FIRST of the five. One of the other four re-ordered nothing at all and would still
+ * have spent one of his six Moves.
+ */
+describe('the Small Yard says what each re-order would build', () => {
+  const smallYard = (standing: RollingStock[] = []): TrackCard => ({
+    ...straight(standing),
+    enhancements: ['smallYard'],
+  });
+
+  /** Train 10's consist as it actually stood, on a card carrying a Small Yard. */
+  const onTheYard = (): { s: GameState; trayId: string } => {
+    const s = game();
+    row(s, 3);
+    addCard(s, at(1, 1), smallYard());
+    const trayId = placeTray(s, at(1, 1), [car('boxcar', true), car('hopper', true), car('tank'), car('caboose', true)], 'e');
+    switching(s);
+    return { s, trayId };
+  };
+
+  it('never offers a sort that changes nothing', () => {
+    /**
+     * THE PAIR IS WHAT COUNTS, since the engine position became part of a sort (2026-09-17). The
+     * identity car order is now a perfectly good option when it moves the ENGINE — that is the whole
+     * of the separate engine control — so what must never be offered is the pair that reproduces the
+     * train already standing there, and no pair may appear twice.
+     */
+    const { s, trayId } = onTheYard();
+    const tray = s.trays.get(trayId)!;
+    const offered = legalActions(s, 0)
+      .filter((i) => i.type === 'switch.sortConsist')
+      .map((i) => {
+        const sort = i as { order: number[]; engineAt?: number };
+        return `${sort.order.join(',')}|${sort.engineAt ?? 0}`;
+      });
+    assert.ok(offered.length > 0, 'no sort was offered at all, so this proved nothing');
+    const unchanged = `${[...tray.consist.keys()].join(',')}|${tray.engineAt}`;
+    assert.ok(
+      !offered.includes(unchanged),
+      'the menu offered the train as it already stands — a Move spent to change nothing',
+    );
+    assert.equal(new Set(offered).size, offered.length, 'the menu offered the same sort twice');
+  });
+
+  it('offers the engine every position, including ahead of its own cars', () => {
+    // Jesse's ruling, 2026-09-17, following `implications.md` against the v0.4.5 card text: a train
+    // in a Small Yard "may sort itself into any order, INCLUDING cars ahead of the engine".
+    const { s, trayId } = onTheYard();
+    const n = s.trays.get(trayId)!.consist.length;
+    const positions = legalActions(s, 0)
+      .filter((i) => i.type === 'switch.sortConsist')
+      .map((i) => (i as { engineAt?: number }).engineAt ?? 0);
+    for (let k = 1; k <= n; k++) {
+      assert.ok(positions.includes(k), `the engine was never offered position ${k} of ${n}`);
+    }
+  });
+
+  it('always offers a made-up order to a train that is not in one', () => {
+    /**
+     * Jesse, 2026-09-17: "trains with a caboose have to offer the caboose at the back… sorting all
+     * the cars back in, ready to leave the station."
+     *
+     * A train with its caboose mid-consist is one §8.2 will not let out of the Office, so at least
+     * one offer has to put it right. It comes out of the ordinary curated set — "bring car k to the
+     * tail" is enumerated for every car, and the caboose is one of them.
+     */
+    const s = game();
+    row(s, 3);
+    addCard(s, at(1, 1), smallYard());
+    const trayId = placeTray(s, at(1, 1), [car('boxcar', true), car('caboose', true), car('hopper', true)], 'e');
+    const tray = s.trays.get(trayId)!;
+    tray.trainNumber = 10;
+    switching(s);
+
+    const fit = legalActions(s, 0)
+      .filter((i) => i.type === 'switch.sortConsist')
+      .filter((i) => {
+        const sort = i as { order: number[]; engineAt?: number };
+        const after = sort.order.map((n) => tray.consist[n]!);
+        return badlyMadeUp({ ...tray, consist: after, engineAt: sort.engineAt ?? 0 }) === null;
+      });
+    assert.ok(
+      fit.length > 0,
+      'a train that cannot leave the Office was offered no sort that would make it up',
+    );
+    // And the one that does it says so on the button, rather than leaving it to be discovered.
+    assert.ok(
+      fit.some((i) => describeIntent(s, i).includes('MADE UP, ready to leave')),
+      'the sort that makes the train up does not say so',
+    );
+  });
+
+  it('lays the train out west to east, with the engine where it will be', () => {
+    /**
+     * "You specify above that the order is front to back, but on the screen, if it's eastbound or
+     * westbound, it may look different" — Jesse, 2026-09-17.
+     *
+     * `board-svg.ts` draws the crew strip west on the left, reversing a consist for an east-facing
+     * train so its nose lands at the east end. The button has to read the same way or it describes a
+     * different train from the one on the board.
+     */
+    const s = game();
+    row(s, 3);
+    addCard(s, at(1, 1), smallYard());
+    // Engine points WEST: the consist is stored nose first, so west to east reads engine first.
+    const west = placeTray(s, at(1, 1), [car('boxcar', true), car('hopper', true)], 'w');
+    switching(s);
+    const westLabel = legalActions(s, 0)
+      .filter((i) => i.type === 'switch.sortConsist')
+      .map((i) => describeIntent(s, i))
+      .find((l) => l.startsWith('re-order'));
+    assert.ok(westLabel, 'no re-order was offered for the west-facing train');
+    assert.match(westLabel, /west to east: ◀ ENGINE · /, `a west-facing engine was not drawn leading: ${westLabel}`);
+
+    // The same train pointing EAST puts the engine at the far end of the same sentence.
+    s.trays.get(west)!.railFacing = 'e';
+    s.trays.get(west)!.facing = 'e';
+    const eastLabel = legalActions(s, 0)
+      .filter((i) => i.type === 'switch.sortConsist')
+      .map((i) => describeIntent(s, i))
+      .find((l) => l.startsWith('re-order'));
+    assert.ok(eastLabel, 'no re-order was offered for the east-facing train');
+    assert.match(eastLabel, / · ENGINE ▶($| ·)/, `an east-facing engine was not drawn at the east end: ${eastLabel}`);
+  });
+
+  it('labels each option with the train it would make, not with array indices', () => {
+    const { s } = onTheYard();
+    const labels = legalActions(s, 0)
+      .filter((i) => i.type === 'switch.sortConsist')
+      .map((i) => describeIntent(s, i));
+
+    assert.ok(
+      labels.every((l) => !/\[\d(,\d)*\]/.test(l)),
+      `a re-order option still reads as a permutation: ${labels.find((l) => /\[\d(,\d)*\]/.test(l))}`,
+    );
+    /**
+     * The one Jesse wanted, written the way the board draws it: this crew faces EAST, so the strip
+     * runs west to east and the engine sits at the east end with the boxcar now furthest west.
+     */
+    assert.ok(
+      labels.includes('re-order — west to east: loaded boxcar · caboose · empty tank · loaded hopper · ENGINE ▶'),
+      `the move that puts the boxcar on the tail was not offered in words — got: ${labels.join(' | ')}`,
+    );
+    // And the engine's own positions read as what they do, not as an index.
+    assert.ok(
+      labels.some((l) => l.startsWith('put the whole consist ahead of the engine —')),
+      `the shoving sort was not offered in words — got: ${labels.join(' | ')}`,
+    );
+  });
+});
+
+/**
+ * WHY A SQUARE IS REFUSED, AND THE ONE PICK-UP EVERY TRAIN MAY MAKE.
+ *
+ * Asked from a table, 2026-09-23: "where does it show that you can't make a particular move because
+ * of a rule that's violated… how does a user know what rule is violated and why you can't go
+ * there?" `exploreMoves` decides where the rails go; the train's own card is enforced afterwards in
+ * `check` — so a square the rails reach and the card forbids was reachable, un-offered, and absent
+ * from the block list with no reason given.
+ */
+describe("a train's own card explains the squares it may not enter", () => {
+  /** A drop-only Extra (X13 "may drop MTs but not pick up anything") on row 1, with track beside it. */
+  const dropOnlyAt = (s: GameState, cars: RollingStock[]): { trayId: string; there: GridCoord } => {
+    row(s, 3);
+    switching(s);
+    const trayId = placeTray(s, at(1, 0), [], 'e');
+    const tray = s.trays.get(trayId)!;
+    tray.trainNumber = 13;
+    tray.trainIsExtra = true;
+    const there = at(1, 1);
+    areaOf(s, 0).grid.get(coordKey(there))!.standing = cars;
+    return { trayId, there };
+  };
+
+  it('reports a drop-only train as blocked, in words, rather than silently', () => {
+    const s = game();
+    const { trayId, there } = dropOnlyAt(s, [{ type: 'boxcar', loaded: false }]);
+
+    const { to, blocked } = movesFor(s, 0, trayId);
+    const k = (c: GridCoord): string => `${c.row},${c.col}`;
+    assert.ok(!to.some((c) => k(c) === k(there)), 'a square the card forbids is still offered');
+
+    const b = blocked.find((x) => k(x.coord) === k(there));
+    assert.ok(b, 'the forbidden square is missing from the block list entirely — no reason is shown');
+    assert.equal(b!.kind, 'cardRule', "the block is not attributed to the train's card");
+    assert.match(b!.why, /forbids picking cars up/, `the reason does not name the rule: ${b!.why}`);
+    assert.match(b!.why, /coupling is mandatory/, `the reason does not say why it bites: ${b!.why}`);
+  });
+
+  it('lets a drop-only train recover its OWN caboose', () => {
+    /**
+     * JESSE'S RULING, 2026-09-23. X13 prints "may drop MTs but not pick up anything", and a train
+     * needs its caboose at the far end to be made up (§8.2) — so a train that parted with its
+     * caboose could never legally leave again. It stranded itself, permanently and silently.
+     *
+     * The caboose only, not "your own cars" generally: it is the one car whose absence stops the
+     * train departing, so recovering it repairs a consist rather than doing fresh work.
+     */
+    const s = game();
+    const { trayId, there } = dropOnlyAt(s, [{ type: 'caboose', loaded: false }]);
+    assert.equal(
+      check(s, 0, { type: 'switch.move', trayId, to: there, reverse: false }),
+      null,
+      'a drop-only train may not recover its own caboose, so it can never be made up again',
+    );
+
+    // A boxcar in the same place is still a pick-up and still refused.
+    areaOf(s, 0).grid.get(coordKey(there))!.standing = [{ type: 'boxcar', loaded: false }];
+    assert.equal(
+      check(s, 0, { type: 'switch.move', trayId, to: there, reverse: false }),
+      'PICKUP_NOT_ALLOWED',
+      'the caboose exemption leaked into ordinary cars',
+    );
+  });
+});

test/display-gaps.test.ts

@@ -0,0 +1,441 @@
+/**
+ * WHAT THE ENGINE KNOWS AND THE SCREEN DOES NOT — the 2026-09-07 sweep.
+ *
+ * Gitea#21, Gitea#22, #94 and #96 were four instances of one fault in a row: the engine gained a
+ * thing that changes what a train may do, and nothing drew it. Each was found by a player hitting
+ * it. So rather than wait for the fifth, every field of `GameState` and its nested types was
+ * enumerated and checked for a reader in `sim/view.ts`, `src/web/` and `sim/narrate.ts`, and the
+ * survivors were then verified by running the engine rather than by trusting the grep.
+ *
+ * Four fields had no reader anywhere. `movedThisPhase` is set and cleared inside one `advance` call
+ * and is genuinely nobody's business. The other three are these tests. The bookkeeping fields whose
+ * EFFECT is already visible as legality — `freightWorked`, `drawnThisTurn`, `freightAgentUsed`,
+ * `movesUsed` (its complement `movesRemaining` is on the Frame), `switchedSince` — are deliberately
+ * not here: a field is not a display gap merely because no one renders it.
+ *
+ * The method is worth more than the three fixes, and is written down in TODO Reference · #98.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { createGame } from '../src/engine/setup.ts';
+import { crewTrayCount, enhancementText } from '../src/engine/content.ts';
+import { areaOf } from '../src/engine/apply.ts';
+import { impediments } from '../src/sim/narrate.ts';
+import { projectDistrict, projectSharedTable, publicSnapshot, trainRules } from '../src/sim/view.ts';
+import type { CrewTray, GameConfig, GameState, PlayerIndex, SeatIndex } from '../src/engine/state.ts';
+import { seatOf } from '../src/engine/state.ts';
+
+const config: GameConfig = {
+  mode: 'competitive',
+  days: 3,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
+  optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
+};
+
+const game = (): GameState => {
+  const s = createGame({ id: 'g', seed: 4242, config, playerNames: ['Ann', 'Bob'] });
+  s.status = 'active';
+  return s;
+};
+
+/**
+ * THE CREW TRAY POOL IS A MECHANIC, AND IT WAS INVISIBLE (#98).
+ *
+ * `state.ts` calls tray scarcity "an explicit mechanic": there are fewer trays than there are trains
+ * wanting one, and which trains get held is the whole of §7. The engine knows three things about it
+ * — how many trays are free, which Extras are queued for one, and which second sections are — and
+ * the view read none of them.
+ *
+ * The panel that answers "why is nothing moving?" had exactly one tray rule, keyed off the train due
+ * out THIS Stage (`s.timetable[stage - 1]`). So a player who spent a card on an Extra, or ordered a
+ * second section, got a blocked panel that was completely EMPTY while their train sat behind an
+ * exhausted pool — and both had been announced once in the log, in a line that promised a future
+ * event ("as soon as a Crew Tray frees up") which nothing then confirmed.
+ */
+describe('the Crew Tray pool is a mechanic the player can see (#98)', () => {
+  /** A table whose trays are all out, with one Extra and one second section queued behind them. */
+  const jammed = (): GameState => {
+    const s = game();
+    s.freeTrays = [];
+    s.pendingExtras.push({ trainNumber: 17, player: 0 as PlayerIndex });
+    s.pendingSecondSections.push(8);
+    return s;
+  };
+
+  it('reports how many Crew Trays are free, and how many there are', () => {
+    const s = game();
+    const total = crewTrayCount(2);
+    assert.equal(s.freeTrays.length, total, 'the premise is gone: trays were already out at setup');
+    assert.deepEqual(projectSharedTable(s).crewTrays, { free: total, total });
+
+    s.freeTrays = s.freeTrays.slice(0, 1);
+    assert.deepEqual(
+      projectSharedTable(s).crewTrays,
+      { free: 1, total },
+      'the pool emptied and the shared table did not notice',
+    );
+  });
+
+  it('names the trains queued for a tray, so a promise made in the log is kept on the board', () => {
+    const q = projectSharedTable(jammed()).queued;
+    assert.deepEqual(q.extras, [{ trainNumber: 17, player: 0 }], 'a played Extra is waiting nowhere visible');
+    assert.deepEqual(q.secondSections, [8], 'an ordered second section is waiting nowhere visible');
+  });
+
+  it('tells the player who played the Extra that it is held for want of a crew', () => {
+    const blocked = impediments(jammed(), 0 as PlayerIndex);
+    const extra = blocked.find((b) => /X17/.test(b.where));
+    assert.ok(extra, 'the blocked panel said nothing about an Extra held for want of a Crew Tray');
+    assert.match(extra.why, /Crew Tray/, 'it was listed without naming the thing it is waiting for');
+    assert.equal(extra.severity, 'stuck');
+    // The POOL SIZE, not a second derivation of it. Written as `trays.size + freeTrays.length`
+    // first, which reads 0 of 0 for any state where a tray is neither free nor carrying a train.
+    assert.match(
+      extra.why,
+      new RegExp(`0 of ${crewTrayCount(2)} Crew Trays free`),
+      'the panel reported the wrong pool size',
+    );
+  });
+
+  it('says the same for a second section, which waits on the identical pool', () => {
+    const blocked = impediments(jammed(), 0 as PlayerIndex);
+    const second = blocked.find((b) => /Train 8\b/.test(b.where) && /second section/i.test(b.why));
+    assert.ok(second, 'an ordered second section was queued invisibly');
+    assert.match(second.why, /Crew Tray/);
+  });
+
+  it('says none of it once a tray is free, because then nothing is being waited on', () => {
+    const s = jammed();
+    s.freeTrays = ['tray0'];
+    const blocked = impediments(s, 0 as PlayerIndex);
+    assert.equal(
+      blocked.filter((b) => /Crew Tray/.test(b.why)).length,
+      0,
+      'a free tray still reported trains held for want of one',
+    );
+  });
+
+  it('is on the common board too — the pool is on the table, not in a hand', () => {
+    const pub = publicSnapshot(jammed()) as unknown as Record<string, unknown>;
+    assert.ok('crewTrays' in pub, 'a spectator cannot see the scarcity everyone at the table can');
+    assert.ok('queued' in pub);
+  });
+});
+
+/**
+ * A TRAIN HELD AT THE LIMITS IS STILL ON THE BOARD (#99).
+ *
+ * The Interlocking enhancement is the designed answer to a full Office: instead of the automatic
+ * collision of Gap 2d, "may stop an inbound train on the Limit Track" — the train is held inside the
+ * player's Limits, and takes the first A/D track that frees, ahead of any newcomer.
+ *
+ * It was drawn NOWHERE. `arriveAtOffice` removes the tray from the Mainline node's `transits`
+ * (advance.ts) and the Interlocking branch pushes it onto `area.heldAtLimits` without assigning
+ * `tray.position` — so the map, which draws mainline nodes from `transits` and district squares from
+ * `position.at === 'grid'`, has nothing to draw it from in either place. The train vanished off the
+ * board on arrival and reappeared in the Office some Stages later.
+ *
+ * Measured before fixing: with the tray in `transits` the Interchange node carries its chip; with
+ * the tray moved to `heldAtLimits` exactly as the engine moves it, the node's `trains` is empty and
+ * no grid square has gained it.
+ *
+ * The fix is in the VIEW, not the engine. The engine's state is right — a held train is inside the
+ * Limits and not on an A/D track, which is what `heldAtLimits` says — and `position` is left alone
+ * deliberately, so nothing may treat the train as standing on a square it could be switched from.
+ */
+describe('a train held at the Limits is drawn at the Limits (#99)', () => {
+  const held = (direction: 'east' | 'west') => {
+    const s = game();
+    const seat = seatOf(s, 0 as PlayerIndex);
+    const area = areaOf(s, 0 as PlayerIndex);
+    const trayId = s.freeTrays.pop()!;
+    const tray: CrewTray = {
+      id: trayId,
+      trainNumber: 5,
+      trainIsExtra: false,
+      engineAt: 0,
+      consist: [],
+      direction,
+      movesUsed: 0,
+      position: { at: 'mainline', index: 1 },
+    } as CrewTray;
+    s.trays.set(trayId, tray);
+    area.heldAtLimits.push(trayId);
+    return { s, seat, trayId, area };
+  };
+
+  it('draws it on the Limits square it is standing at, not nowhere', () => {
+    const { s, seat, trayId, area } = held('east');
+    const { cells } = projectDistrict(s, seat as SeatIndex);
+    const on = cells.filter((c) => c.trains.some((t) => t.trayId === trayId));
+    assert.equal(on.length, 1, 'a train held at the Limits is drawn on no square at all');
+    assert.equal(on[0]!.row, area.limitsWest.row, 'drawn at the wrong Limits');
+    assert.equal(on[0]!.col, area.limitsWest.col);
+  });
+
+  it('holds an EASTBOUND train at the western Limits, because that is the end it came in by', () => {
+    const { s, seat, area } = held('east');
+    const { cells } = projectDistrict(s, seat as SeatIndex);
+    const on = cells.find((c) => c.trains.length > 0)!;
+    assert.deepEqual({ row: on.row, col: on.col }, { row: area.limitsWest.row, col: area.limitsWest.col });
+  });
+
+  it('and a WESTBOUND train at the eastern Limits', () => {
+    const { s, seat, area } = held('west');
+    const { cells } = projectDistrict(s, seat as SeatIndex);
+    const on = cells.find((c) => c.trains.length > 0)!;
+    assert.deepEqual({ row: on.row, col: on.col }, { row: area.limitsEast.row, col: area.limitsEast.col });
+  });
+
+  it('says on the chip that it is HELD, so it is not read as a train free to switch', () => {
+    const { s, seat, trayId } = held('east');
+    const { cells } = projectDistrict(s, seat as SeatIndex);
+    const chip = cells.flatMap((c) => c.trains).find((t) => t.trayId === trayId)!;
+    assert.equal(chip.heldAtLimits, true, 'a held train looked exactly like one standing on the square');
+    assert.match(chip.what, /Interlocking|held/i, 'the chip does not say why it is standing there');
+  });
+
+  it('tells the district owner it is waiting, and what for', () => {
+    const { s } = held('east');
+    const blocked = impediments(s, 0 as PlayerIndex);
+    const b = blocked.find((x) => /Train 5/.test(x.where) && /Limits/i.test(x.why));
+    assert.ok(b, 'the blocked panel said nothing about a train held at the Limits');
+  });
+
+  it('does not invent a train on a square when nothing is held', () => {
+    const s = game();
+    const { cells } = projectDistrict(s, seatOf(s, 0 as PlayerIndex) as SeatIndex);
+    assert.equal(cells.flatMap((c) => c.trains).length, 0, 'a district with no trains drew one');
+  });
+});
+
+/**
+ * THE CAMPAIGN TRAIN'S SPEECHES CHANGE ITS RULES, AND THE CARD HAS TO SAY WHICH HALF IT IS IN (#100).
+ *
+ * X17 is "one turn at station (speeches) then expedite". Its first Office arrival is an ordinary
+ * stop; every arrival after that runs EXPEDITED, which means that if it is not back on the Office
+ * square when the next Mainline Phase begins it is a Station Master fault costing 1 Revenue.
+ *
+ * `trainRules()` took `{ trainNumber, trainIsExtra }` — it could not see `speechMade` even though
+ * both of its tray-side callers pass a whole `CrewTray` that has it. So the chip read identically
+ * before and after, and worse: the "EXPEDITED — must be kept ready to highball… costs 1 Revenue"
+ * warning is printed only under `rules.expedite`, so X17 became subject to a fault whose warning the
+ * game shows to other trains and never to it.
+ */
+describe('the Campaign Train says whether its speeches are made (#100)', () => {
+  const X17 = { trainNumber: 17, trainIsExtra: true } as const;
+
+  it('before the speeches, says they are still to come and does not claim it is expedited yet', () => {
+    const t = trainRules({ ...X17 });
+    assert.match(t, /SPEECHES/i);
+    assert.doesNotMatch(t, /costs 1 Revenue/, 'it warned of a fault the train is not yet subject to');
+  });
+
+  it('after the speeches, says it is expedited NOW and carries the fault it is now subject to', () => {
+    const t = trainRules({ ...X17, speechMade: true });
+    assert.match(t, /EXPEDITED/, 'a train that is now expedited did not say so');
+    assert.match(t, /costs 1 Revenue/, 'the fault warning is shown to other trains and not to this one');
+  });
+
+  it('reads differently before and after — the whole of the bug was that it did not', () => {
+    assert.notEqual(trainRules({ ...X17 }), trainRules({ ...X17, speechMade: true }));
+  });
+
+  it('still warns a permanently expedited train, which must not regress', () => {
+    const fast = trainRules({ trainNumber: 5, trainIsExtra: false });
+    assert.match(fast, /EXPEDITED/);
+    assert.match(fast, /costs 1 Revenue/);
+  });
+
+  it('says nothing about speeches for a train that has no such rule', () => {
+    assert.doesNotMatch(trainRules({ trainNumber: 5, trainIsExtra: false }), /SPEECHES/i);
+  });
+});
+
+/**
+ * A DISPATCH DEVICE SAYS WHETHER IT IS STILL AVAILABLE TODAY (#101).
+ *
+ * Telegraph (+4), Telephone (+8) and Radio (+12) are "once a day, when dispatching facing trains,
+ * add +N to the other train's number". The device is drawn on its card and its effect text is in the
+ * tooltip — but `enhancementText(key)` takes only the KEY, so it could not vary with anything, and
+ * the Radio read "once a day, add +12…" all Day after it had been spent. That is `trainRules` before
+ * #100, in a different corner of the same view.
+ *
+ * THE SECOND HALF IS THE ONE THAT SURPRISES. `spendDispatchBonus` reads
+ * `areaOf(s, s.clock.superintendent)` — the SUPERINTENDENT's own devices, not the train owner's —
+ * and the Fedora moves every `STAGES_PER_SHIFT` Stages, four times a Day. So a player's Radio does
+ * nothing at all for three-quarters of the Day, and is spent automatically, without being asked,
+ * during the quarter it is theirs to use. The board said neither half.
+ *
+ * Shown on EVERY district (Jesse, 2026-09-07), not only the viewer's: it is public, and a rival's
+ * spent Radio is exactly what you want to know before forcing a meet. `projectDistrict` serves both
+ * the player's own cells and the common board's `districts`, so one change covers both.
+ */
+describe('a dispatch device says whether it is still available today (#101)', () => {
+  /** Puts `key` on the first card of seat 0's district and returns the pieces to assert on. */
+  const withDevice = (key: string, opts: { spent?: boolean; fedora?: boolean } = {}) => {
+    const s = game();
+    const area = areaOf(s, 0 as PlayerIndex);
+    const card = [...area.grid.values()][0]!;
+    card.enhancements.push(key);
+    if (opts.spent) area.dispatchUsedToday.push(key);
+    // The Fedora is a PLAYER; give it to somebody whose seat is not this district's.
+    s.clock.superintendent = (opts.fedora ? 0 : 1) as PlayerIndex;
+    const seat = seatOf(s, 0 as PlayerIndex);
+    const cells = projectDistrict(s, seat as SeatIndex).cells;
+    const cell = cells.find((c) => c.enhancements.length > 0)!;
+    const i = cell.enhancementsWhat.findIndex((w) => new RegExp(key, 'i').test(w));
+    return { s, area, cell, what: cell.enhancementsWhat[i] ?? '', spent: cell.enhancementsSpent[i] };
+  };
+
+  it('reads as available before it is used, and says what it is worth', () => {
+    const { what, spent } = withDevice('radio', { fedora: true });
+    assert.equal(spent, false, 'an unused device reported itself spent');
+    assert.match(what, /\+12/, 'the device no longer says what it is worth');
+    assert.doesNotMatch(what, /spent/i, 'an unused device claimed it had been spent');
+  });
+
+  it('says so once it has been spent, and says when it comes back', () => {
+    const { what, spent } = withDevice('radio', { spent: true, fedora: true });
+    assert.equal(spent, true, 'a spent device still reported itself available');
+    assert.match(what, /spent/i, 'a spent device read exactly as it did before it was spent');
+    assert.match(what, /next Day|tomorrow/i, 'it does not say the device comes back');
+  });
+
+  it('reads differently spent and unspent — the whole of the bug was that it did not', () => {
+    assert.notEqual(
+      withDevice('telegraph', { fedora: true }).what,
+      withDevice('telegraph', { spent: true, fedora: true }).what,
+    );
+  });
+
+  it('says a device is idle while somebody else holds the Fedora', () => {
+    const { what } = withDevice('telephone');
+    assert.match(what, /Fedora|Superintendent/i, 'nothing said the device is only used while dispatching');
+  });
+
+  it('does not say that when this district IS the Superintendent', () => {
+    const { what } = withDevice('telephone', { fedora: true });
+    assert.doesNotMatch(what, /while .*holds? the Fedora/i);
+  });
+
+  /**
+   * EXACT equality, not "does not mention the Fedora". The first draft asserted the absence of
+   * /spent|Fedora/i with the Fedora held, and a mutation that removed the `dispatchBonus` guard
+   * altogether PASSED it — because the leaked text in that case reads "Available today, and this
+   * district is dispatching", which contains neither word. A test for a field being left alone has
+   * to compare it to what it should be.
+   */
+  it('leaves an enhancement that is not a dispatch device exactly as it was', () => {
+    for (const fedora of [true, false]) {
+      const { what, spent } = withDevice('interlocking', { fedora });
+      assert.equal(spent, false, 'a non-dispatch enhancement was marked spendable');
+      assert.equal(what, enhancementText('interlocking'), 'an Interlocking was given a dispatch caveat');
+    }
+  });
+
+  it('comes back when the Day turns, which is what clears the record', () => {
+    const { s, area } = withDevice('radio', { spent: true, fedora: true });
+    area.dispatchUsedToday = [];
+    const cell = projectDistrict(s, seatOf(s, 0 as PlayerIndex) as SeatIndex).cells.find(
+      (c) => c.enhancements.length > 0,
+    )!;
+    assert.equal(cell.enhancementsSpent.some((x) => x), false, 'a new Day did not restore the device');
+  });
+
+  /**
+   * SEAT IS NOT PLAYER INDEX, and this is the one place the two are joined: the Fedora is held by a
+   * PLAYER and the devices sit in an Office Area keyed by SEAT. `advance.ts` carried a comment
+   * warning that indexing one with the other was safe only while seating was the identity map — it
+   * read as a live bug and was not one, because `areaOf` resolves through `seatOf`. The comment is
+   * corrected; this is the guard, because the next reader deserves better than a claim.
+   *
+   * §4.4's D12 makes seating a real permutation, so a two-player game where player 1 sits in seat 0
+   * is ordinary rather than contrived.
+   */
+  it("marks the SUPERINTENDENT's own district as dispatching under non-identity seating", () => {
+    const s = game();
+    s.seating = [1, 0] as PlayerIndex[];
+    assert.notEqual(seatOf(s, 0 as PlayerIndex), 0, 'the premise is gone: seating is still identity');
+    s.clock.superintendent = 0 as PlayerIndex;
+
+    const mine = areaOf(s, 0 as PlayerIndex);
+    [...mine.grid.values()][0]!.enhancements.push('radio');
+    const other = areaOf(s, 1 as PlayerIndex);
+    [...other.grid.values()][0]!.enhancements.push('radio');
+
+    const whatAt = (player: PlayerIndex): string => {
+      const cells = projectDistrict(s, seatOf(s, player) as SeatIndex).cells;
+      return cells.find((c) => c.enhancements.length > 0)!.enhancementsWhat.join(' ');
+    };
+    // The Fedora is player 0's, whatever seat that is.
+    assert.doesNotMatch(whatAt(0 as PlayerIndex), /IDLE/, "the Superintendent's own device read as idle");
+    assert.match(whatAt(1 as PlayerIndex), /IDLE/, "somebody else's device read as dispatching");
+  });
+
+  it('is on every district of the common board, not only the viewer own', () => {
+    const { s } = withDevice('radio', { spent: true, fedora: true });
+    const pub = publicSnapshot(s);
+    const all = pub.districts.flatMap((d) => d.cells);
+    assert.ok(
+      all.some((c) => c.enhancementsSpent.some((x) => x)),
+      "a spectator cannot see which devices are spent in a player's district",
+    );
+  });
+});
+
+/**
+ * THE RED FLAG HOLDER IS NOT A PER-PLAYER FACT, so it does not belong on the public player view.
+ *
+ * `docs/plans/jitsi-common-board.md` step 1 asks for one: "Add the Red Flag holder to the public
+ * player projection. It is public game state but is currently absent from `Frame`", and its
+ * `PublicPlayerView` carries `redFlagHeld: boolean`. Every other step-1 item shipped across v0.7.9.2
+ * to v0.7.9.5; this one is STRUCK OFF instead, because the premise does not hold in this codebase.
+ *
+ * `decks.redFlags` is written in exactly one place — `setup.ts`, from
+ * `config.optionalRules.emergencyToolbox` — and never again. There is no `.set` anywhere else, and
+ * `redFlag.play` (the intent gated on holding one) emits a `phaseEnded` event and does not spend it.
+ * So every player holds one or none of them does, decided before the first card is dealt.
+ *
+ * A `redFlagHeld` on each player would therefore be `optionalRules.emergencyToolbox` copied N times
+ * — already on the public projection — while implying to every reader of the common board that it
+ * varies by player and might change during a game. That is worse than the absence.
+ *
+ * This test exists so the plan item is not re-raised from the plan text: if the rule ever DOES
+ * become per-player, this fails and the projection is the right place to look.
+ */
+describe('the Red Flag holding is the Emergency Toolbox option, not a per-player fact', () => {
+  const dealt = (emergencyToolbox: boolean): GameState =>
+    createGame({
+      id: 'g',
+      seed: 99,
+      config: { ...config, optionalRules: { ...config.optionalRules, emergencyToolbox } },
+      playerNames: ['Ann', 'Bob', 'Cy'],
+    });
+
+  for (const toolbox of [true, false]) {
+    it(`gives every player the same answer with the toolbox ${toolbox ? 'on' : 'off'}`, () => {
+      const s = dealt(toolbox);
+      const held = s.players.map((p) => s.decks.redFlags.get(p.index) === true);
+      assert.deepEqual(held, [toolbox, toolbox, toolbox], 'the Red Flag has become a per-player fact');
+    });
+  }
+
+  it('is already public, through the option it comes from', () => {
+    const pub = publicSnapshot(dealt(true));
+    assert.equal(
+      pub.optionalRules.emergencyToolbox,
+      true,
+      'a spectator cannot tell whether the hand limit is three or four',
+    );
+  });
+});

test/enhancements.test.ts

@@ -12,9 +12,11 @@ import assert from 'node:assert/strict';
 import { advance } from '../src/engine/advance.ts';
 import { applyIntent, areaOf, check, hasDistrictEnhancement, isProtectedFromDerail } from '../src/engine/apply.ts';
 import { ENHANCEMENT_RULES, enhancementRule, trainProfile } from '../src/engine/content.ts';
+import { officeProfile } from '../src/engine/content.ts';
+import { narrate } from '../src/sim/narrate.ts';
 import { createGame } from '../src/engine/setup.ts';
 import type { GameConfig, GameState, GridCoord, TrackCard } from '../src/engine/state.ts';
-import { coordKey, subdivisions, turnOf } from '../src/engine/state.ts';
+import { coordKey, decisionActor, subdivisions, turnOf } from '../src/engine/state.ts';
 
 const config: GameConfig = {
   mode: 'solitaire',
@@ -23,6 +25,10 @@ const config: GameConfig = {
   maxCollisionsPerDay: 0,
   maxCollisionsTotal: 0,
   pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
   optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
 };
 const game = (seed = 5): GameState => createGame({ id: 'g', seed, config, playerNames: ['p'] });
@@ -279,6 +285,86 @@ describe('Interlocking and Yard Office relieve the Office', () => {
     assert.ok(areaOf(s, 0).heldAtLimits.includes(id), 'train is held at the Limits');
   });
 
+  it('does not let a released train and a newcomer share one A/D track', () => {
+    /**
+     * REPORTED FROM A TABLE, 2026-09-23, and measured on the save: a Whistle Post with ONE A/D
+     * track held Trains 8 and 19 at once. The capacity test passed (nothing standing), the train
+     * the Interlocking had been holding at the Limits was then moved into the free slot, and the
+     * arriving train was pushed in after it without anyone asking again whether there was room.
+     *
+     * The held train has priority — it has been waiting — so the NEWCOMER takes the consequence,
+     * and it is the same consequence it would have met had the held train arrived first: held at
+     * the Limits where there is an Interlocking, a collision where there is not.
+     */
+    const s = game();
+    const area = areaOf(s, 0);
+    const capacity = officeProfile(area.tier).adTracks;
+
+    // One train already waiting at the Limits, and the Office just cleared.
+    s.trays.set('waiting', {
+      id: 'waiting', trainNumber: 8, trainIsExtra: false, engineAt: 0,
+      consist: [], direction: 'east', position: { at: 'mainline', index: 1 }, movesUsed: 0,
+    } as never);
+    area.heldAtLimits = ['waiting'];
+    area.adOccupancy = [];
+
+    const card = straight();
+    card.enhancements.push('interlocking');
+    addCard(s, at(0, 2), card);
+    const arriving = inbound(s, []);
+
+    advance(s);
+
+    assert.ok(
+      area.adOccupancy.length <= capacity,
+      `the Office holds ${area.adOccupancy.length} trains on ${capacity} A/D track(s)`,
+    );
+    assert.ok(area.adOccupancy.includes('waiting'), 'the train that had been waiting did not get the track');
+    assert.ok(!area.adOccupancy.includes(arriving), 'the newcomer squeezed onto an occupied track');
+    // With an Interlocking it waits its turn rather than wrecking.
+    assert.ok(area.heldAtLimits.includes(arriving), 'the newcomer was neither held nor collided');
+  });
+
+  it('collides the newcomer when a released train takes the last track and there is no Interlocking', () => {
+    // Same situation, no Interlocking: §8.3's collision is what should happen, and did not.
+    const s = game();
+    const area = areaOf(s, 0);
+    s.trays.set('waiting', {
+      id: 'waiting', trainNumber: 8, trainIsExtra: false, engineAt: 0,
+      consist: [], direction: 'east', position: { at: 'mainline', index: 1 }, movesUsed: 0,
+    } as never);
+    area.heldAtLimits = ['waiting'];
+    area.adOccupancy = [];
+    inbound(s, []);
+
+    advance(s);
+    assert.equal(s.players[0]!.revenue, -5, 'no collision was scored for the train with nowhere to go');
+    assert.ok(area.adOccupancy.length <= officeProfile(area.tier).adTracks, 'the Office is over capacity');
+  });
+
+  it('says so in the history when a held train takes the track that just freed', () => {
+    // The release used to be a silent side effect of somebody else's arrival — reported as "wasn't
+    // clear what changed and why train 8 was suddenly released".
+    const s = game();
+    const area = areaOf(s, 0);
+    s.trays.set('waiting', {
+      id: 'waiting', trainNumber: 8, trainIsExtra: false, engineAt: 0,
+      consist: [], direction: 'east', position: { at: 'mainline', index: 1 }, movesUsed: 0,
+    } as never);
+    area.heldAtLimits = ['waiting'];
+    area.adOccupancy = [];
+    const card = straight();
+    card.enhancements.push('interlocking');
+    addCard(s, at(0, 2), card);
+    inbound(s, []);
+
+    const released = advance(s).events.find((e) => e.type === 'trainReleasedFromLimits');
+    assert.ok(released, 'the release is still silent');
+    const line = narrate(released as never, { playerName: () => 'A' });
+    assert.match(line.text, /RELEASED from the Limits/, `the line does not say what happened: ${line.text}`);
+    assert.match(line.text, /freed the A\/D track/, `the line does not say why now: ${line.text}`);
+  });
+
   it('still collides without an Interlocking', () => {
     const s = game();
     areaOf(s, 0).adOccupancy = ['blocker'];
@@ -287,17 +373,124 @@ describe('Interlocking and Yard Office relieve the Office', () => {
     assert.equal(s.players[0]!.revenue, -5);
   });
 
-  it('diverts a coachless train to the Yard Office', () => {
+  /**
+   * §11, THE YARD OFFICE (Gitea#5) — offered, not imposed, and only down a route that exists.
+   *
+   * Jesse: "you have to ask if non-coach trains wish to go in there, rather than to the office",
+   * "if the Yard Office is not accessible in one move, you should not get the option", and cars on
+   * the way in "result in a crash". All three were missing: the train was teleported onto the card.
+   */
+  const answer = (s: GameState, take: boolean) => {
+    const who = decisionActor(s);
+    assert.notEqual(who, null, 'nothing was pending, so there was nothing to answer');
+    const r = applyIntent(s, who!, { type: 'mainline.yardOffice', take });
+    assert.ok(r.ok, 'the district owner could not answer the Yard Office offer');
+    advance(s);
+  };
+
+  it('OFFERS the Yard Office to the district owner rather than diverting automatically', () => {
     const s = game();
     const card = straight();
     card.enhancements.push('yardOffice');
-    addCard(s, at(-1, 0), card);
+    addCard(s, at(0, 2), card);
     const id = inbound(s, [{ type: 'hopper', loaded: true }]);
 
     advance(s);
+    assert.equal(s.clock.pendingDecision?.kind, 'yardOffice', 'the phase did not stop to ask');
+    assert.equal(decisionActor(s), 0, 'the question went to the wrong player');
     const pos = s.trays.get(id)!.position;
-    assert.ok(pos.at === 'grid' && pos.coord.row === -1, 'arrived at the Yard Office');
-    assert.ok(!areaOf(s, 0).adOccupancy.includes(id), 'did not take an A/D track');
+    assert.ok(pos.at !== 'grid' || pos.coord.col !== 2, 'the train moved before anyone answered');
+  });
+
+  it('takes the Yard Office when the owner says yes', () => {
+    const s = game();
+    const card = straight();
+    card.enhancements.push('yardOffice');
+    addCard(s, at(0, 2), card);
+    const id = inbound(s, [{ type: 'hopper', loaded: true }]);
+
+    advance(s);
+    answer(s, true);
+    const pos = s.trays.get(id)!.position;
+    assert.ok(pos.at === 'grid' && pos.coord.col === 2, 'did not arrive at the Yard Office');
+    assert.ok(!areaOf(s, 0).adOccupancy.includes(id), 'took an A/D track anyway');
+    assert.equal(s.players[0]!.revenue, 0, 'a clear lead should not have collided');
+  });
+
+  it('goes to the Train Order Office when the owner says no', () => {
+    // "They can of course still choose to have the train go to the standard office."
+    const s = game();
+    const card = straight();
+    card.enhancements.push('yardOffice');
+    addCard(s, at(0, 2), card);
+    const id = inbound(s, [{ type: 'hopper', loaded: true }]);
+
+    advance(s);
+    answer(s, false);
+    assert.ok(areaOf(s, 0).adOccupancy.includes(id), 'declining did not put it on an A/D track');
+  });
+
+  it('does not offer what cannot be reached, and says why in the history', () => {
+    /**
+     * Jesse, 2026-08-29: "make sure this is logged in history — why can't move so user knows why
+     * they can't get to yard." A silent absence is indistinguishable from a broken feature, which
+     * is how the missing reachability check survived this long.
+     */
+    const s = game();
+    const card = straight();
+    card.enhancements.push('yardOffice');
+    // Far off the Running Track, with nothing laid between: no route in one move.
+    addCard(s, at(3, 4), card);
+    inbound(s, [{ type: 'hopper', loaded: true }]);
+
+    const events = advance(s).events;
+    assert.equal(s.clock.pendingDecision, null, 'offered a Yard Office it cannot reach');
+    const said = events.find(
+      (e) => e.type === 'trainDiverted' && e.reason.includes('could not be offered'),
+    );
+    assert.ok(said, `nothing in the history explains why:\n${JSON.stringify(events, null, 1)}`);
+    assert.match(
+      (said as { reason: string }).reason,
+      /one move/,
+      'the reason does not say it is out of reach in one move',
+    );
+  });
+
+  it('offers a fouled lead, and taking it collides', () => {
+    /**
+     * The third missing condition. "Just like other trains finding cars on the tracks you use to
+     * get into either result in a crash" — and Jesse's ruling keeps the OFFER: a route that exists
+     * is offered, and the consequence of taking it is the player's. §8.3 already reads cars in the
+     * path of an arriving train as a collision rather than a coupling.
+     */
+    const s = game();
+    const card = straight();
+    card.enhancements.push('yardOffice');
+    addCard(s, at(0, 2), card);
+    // A car standing on the lead between the Office and the yard.
+    areaOf(s, 0).grid.get(coordKey(at(0, 1)))!.standing = [{ type: 'boxcar', loaded: false }];
+    const id = inbound(s, [{ type: 'hopper', loaded: true }]);
+
+    advance(s);
+    assert.equal(s.clock.pendingDecision?.kind, 'yardOffice', 'a fouled lead was not offered at all');
+
+    answer(s, true);
+    assert.equal(s.players[0]!.revenue, -5, 'running through standing cars did not collide');
+    assert.ok(!s.trays.has(id), 'the train survived the collision');
+  });
+
+  it('declining a fouled lead is safe — the standard Office is unaffected', () => {
+    const s = game();
+    const card = straight();
+    card.enhancements.push('yardOffice');
+    addCard(s, at(0, 2), card);
+    areaOf(s, 0).grid.get(coordKey(at(0, 1)))!.standing = [{ type: 'boxcar', loaded: false }];
+    const id = inbound(s, [{ type: 'hopper', loaded: true }]);
+
+    advance(s);
+    answer(s, false);
+    assert.equal(s.players[0]!.revenue, 0, 'declining the Yard Office still cost a collision');
+    assert.ok(areaOf(s, 0).adOccupancy.includes(id), 'the train did not reach the Office');
   });
 
   it('does not divert a train carrying coaches', () => {
@@ -748,3 +941,60 @@ describe('defensive enhancements', () => {
     assert.equal(hasDistrictEnhancement(areaOf(s, 0), 'waterColumn'), false);
   });
 });
+
+// ---------------------------------------------------------------------------
+// v0.8.3 — audit findings (2026-09-29)
+// ---------------------------------------------------------------------------
+
+describe('a train held at the Limits is released when a track frees (v0.8.3)', () => {
+  it('takes a free A/D track at the end of the Mainline Phase without waiting for another arrival', () => {
+    /**
+     * The only release was inside `arriveAtOffice` for a DIFFERENT train — so an Office that
+     * emptied by departures alone kept the held train at its Limits for the rest of the game,
+     * invisible: no transit, not in `adOccupancy`, not counted by the clearance check.
+     */
+    const s = game();
+    const area = areaOf(s, 0);
+    const card = straight();
+    card.enhancements.push('interlocking');
+    addCard(s, at(0, 2), card);
+    s.trays.set('waiting', {
+      id: 'waiting', trainNumber: 8, trainIsExtra: false, engineAt: 0,
+      consist: [], direction: 'east', position: { at: 'mainline', index: 1 }, movesUsed: 0,
+    } as never);
+    area.heldAtLimits = ['waiting'];
+    area.adOccupancy = []; // the Office cleared, and nothing is arriving
+    s.timetable = s.timetable.map(() => null);
+
+    s.clock.phase = 'mainline';
+    const r = advance(s);
+
+    assert.ok(area.adOccupancy.includes('waiting'), 'the held train is still at the Limits with the Office empty');
+    assert.deepEqual(area.heldAtLimits, []);
+    assert.deepEqual(s.trays.get('waiting')!.position, { at: 'grid', seat: 0, coord: area.officeCoord });
+    const released = r.events.find((e) => e.type === 'trainReleasedFromLimits');
+    assert.ok(released, 'the release is silent');
+    const line = narrate(released as never, { playerName: () => 'A' });
+    assert.match(line.text, /RELEASED from the Limits/, line.text);
+  });
+
+  it('still waits while the Office is full', () => {
+    const s = game();
+    const area = areaOf(s, 0);
+    s.trays.set('waiting', {
+      id: 'waiting', trainNumber: 8, trainIsExtra: false, engineAt: 0,
+      consist: [], direction: 'east', position: { at: 'mainline', index: 1 }, movesUsed: 0,
+    } as never);
+    area.heldAtLimits = ['waiting'];
+    area.adOccupancy = ['blocker'];
+    s.trays.set('blocker', {
+      id: 'blocker', trainNumber: null, trainIsExtra: false, engineAt: 0,
+      consist: [], direction: 'east', position: { at: 'grid', seat: 0, coord: area.officeCoord }, movesUsed: 0,
+    } as never);
+    s.timetable = s.timetable.map(() => null);
+    s.clock.phase = 'mainline';
+    advance(s);
+    assert.deepEqual(area.heldAtLimits, ['waiting']);
+    assert.ok(!area.adOccupancy.includes('waiting'));
+  });
+});

test/events.test.ts

@@ -15,8 +15,9 @@ import assert from 'node:assert/strict';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
-import { fromSave, newGame, submit, toSave, view } from '../src/web/game.ts';
+import { LOG_LIMIT, fromSave, newGame, newMultiplayerGame, pushLine, submit, toSave, view } from '../src/web/game.ts';
 import { actionGroups, currentActor } from '../src/web/game.ts';
+import { narrate } from '../src/sim/narrate.ts';
 
 const src = (rel: string): string => readFileSync(join(import.meta.dirname, '..', 'src', rel), 'utf8');
 
@@ -47,17 +48,56 @@ const KNOWN_UNREDUCED = [
   'clearanceRequested',
   'dispatchBonusUsed',
   'expediteFault',
+  /**
+   * The Freight Agent chose to do nothing (§6.3 requires no action). Emitted by `freightAgent.end`
+   * beside the `phaseEnded` that ends the turn, and reduces to nothing itself — exactly the
+   * `switchingEnded` pattern below.
+   */
+  'freightAgentIdled',
+  /**
+   * The New Train Phase's report that it could give a train nothing (playtest, 2026-09-16, the
+   * Sparrow running empty). Emitted by the phase driver after the make-up round has nothing left to
+   * offer, so it describes rather than reduces, like every entry on this list.
+   */
+  'makeUpShort',
   'phaseBegan',
+  /**
+   * §Q, Red Flags (Gitea#19). The flag comes down inside the phase driver as it stops a train, so
+   * this is described rather than reduced like everything else here.
+   *
+   * ADDED DELIBERATELY, and it cost a bug first: the flag was originally taken down in a `reduce`
+   * case, which never fires for an event `advance.ts` emits — so it stayed up and held every train
+   * that came. That is precisely the failure this list exists to make visible.
+   */
+  'redFlagSpent',
   // Employee Rotation moves `seating` in the phase driver and then describes what it did, which is
   // the pattern every entry on this list follows.
   'seatsRotated',
   'stageBegan',
+  /**
+   * §5's Fedora handover, emitted by `shiftChange` on the same mutate-then-describe path as its
+   * neighbours here: the clock moves the Superintendent and then says so. Added 2026-09-16 because
+   * riding on `actorChanged` meant the log dropped it as turn bookkeeping.
+   */
+  'superintendentChanged',
+  /**
+   * The line that closes a switching turn. Emitted by `switch.end` beside the `phaseEnded` that
+   * actually ends the turn, and reduces to nothing itself: it reports what the Moves were spent on
+   * and where the crew was left, both of which the state already holds.
+   */
+  'switchingEnded',
   'trainArrived',
   'trainCompleted',
   'trainDiverted',
   'trainHeld',
   'trainHighballed',
   'trainMadeUp',
+  /**
+   * A train the Interlocking held at the Limits taking the A/D track that just freed. Emitted by
+   * `arriveAtOffice` in the phase driver, which moves the tray itself — so this describes rather
+   * than reduces, like every entry on this list.
+   */
+  'trainReleasedFromLimits',
   'trainStoodStill',
   'trainsDestroyed',
 ];
@@ -134,3 +174,215 @@ describe('the intents are what reconstructs a game', () => {
     assert.deepEqual(Object.keys(toSave(game)).sort(), ['history', 'rules', 'seed']);
   });
 });
+
+/**
+ * A FREIGHT AGENT TURN, AS THE TABLE READS IT.
+ *
+ * Reported on Day 1 Stage 3 of v0.8.0.16, watching a bot: "one car moved to or from a facility —
+ * can we tell what car, what facility and whether it was to or from." Two separate faults sat
+ * behind that. The choice line ASSERTED a car had moved, which §6.3 does not require and the bot
+ * deliberately declines; and the three lines that do report the work named the grid coordinate
+ * rather than the industry standing on it.
+ */
+describe('a Freight Agent turn says what it did, to what, and where', () => {
+  const ctx = {
+    playerName: () => 'Bot 1',
+    facilityAt: (_p: number, c: { row: number; col: number }) =>
+      c.row === -1 && c.col === 1 ? 'the Freight House' : null,
+  };
+
+  it('announces the OPTION without claiming a car moved', () => {
+    const line = narrate({ type: 'localOpsOptionChosen', player: 0, option: 'freightAgent' } as never, ctx);
+    assert.ok(
+      !/one car moved/.test(line.text),
+      `the choice line still asserts an outcome: ${line.text}`,
+    );
+    // It must still say what the Freight Agent is FOR, or the option is a bare name.
+    assert.match(line.text, /Outbound|Inbound|jam/, `the choice line says nothing about the work: ${line.text}`);
+  });
+
+  it('says so when the Freight Agent deliberately does nothing', () => {
+    // The bot takes this route on purpose: unjamming a healthy box destroys a stocked load. Silence
+    // here is what made the turn read as a dropped turn.
+    const line = narrate({ type: 'freightAgentIdled', player: 0 } as never, ctx);
+    assert.match(line.text, /nothing worth doing/, `an idle Freight Agent is silent: ${line.text}`);
+  });
+
+  it('names the industry and the direction, not a coordinate', () => {
+    const at = { row: -1, col: 1 };
+    const stocked = narrate(
+      { type: 'stockToOutbound', player: 0, at, stock: { type: 'boxcar', loaded: true } } as never,
+      ctx,
+    );
+    assert.match(stocked.text, /the Freight House/, `no industry named: ${stocked.text}`);
+    assert.ok(!/\(1, -1\)/.test(stocked.text), `still speaking in coordinates: ${stocked.text}`);
+    assert.match(stocked.text, /boxcar/, `the car is not named: ${stocked.text}`);
+    assert.match(stocked.text, /INTO/, `the direction is not stated: ${stocked.text}`);
+
+    const cleared = narrate(
+      { type: 'inboundCleared', player: 0, at, stock: { type: 'hopper', loaded: true } } as never,
+      ctx,
+    );
+    assert.match(cleared.text, /the Freight House/, `no industry named: ${cleared.text}`);
+    assert.match(cleared.text, /OUT of/, `the direction is not stated: ${cleared.text}`);
+
+    const jam = narrate(
+      { type: 'facilityUnjammed', player: 0, at, from: 'menAtWork', stock: { type: 'tank', loaded: true } } as never,
+      ctx,
+    );
+    assert.match(jam.text, /the Freight House/, `no industry named: ${jam.text}`);
+
+    /**
+     * Where there is no industry, the coordinate is still the honest fallback rather than "nowhere".
+     *
+     * AND IT IS SPELLED THE WAY THE ACTION MENU SPELLS IT — X,Y, east/west then north/south. The
+     * log printed the internal row/col order until 2026-09-21, so the same square read "(1,-1)" in
+     * the menu and "(-1,1)" in the log, side by side. `test/web.test.ts` pins the two against each
+     * other; this pins the order itself.
+     */
+    const plain = narrate(
+      { type: 'stockToOutbound', player: 0, at: { row: -2, col: 4 }, stock: { type: 'boxcar', loaded: true } } as never,
+      ctx,
+    );
+    assert.match(plain.text, /\(4,-2\)/, `the fallback coordinate is not in X,Y order: ${plain.text}`);
+  });
+});
+
+/**
+ * WHICH MAINLINE CARD, AND WHAT THE CARD IS CALLED.
+ *
+ * Reported 2026-09-22, playing ABS Signals: "In the history, it referred to it as Mainline card 7,
+ * but didn't give the actual card type, which was plains. It should specify both. Note there were
+ * two plains cards dealt in this hand." Both halves matter for that reason — the name informs, the
+ * slot is the only thing telling two Plains apart.
+ */
+describe('the log names the Mainline card an Enhancement was built on', () => {
+  const ctx = {
+    mainlineAt: (node: number) => (node === 7 ? 'Plains' : node === 3 ? 'Heavy Grade' : null),
+    enhancementName: (key: string) => (key === 'absSignals' ? 'ABS Signals' : null),
+  };
+
+  it('gives the slot AND the card type', () => {
+    const line = narrate({ type: 'enhancementPlaced', player: 0, key: 'absSignals', node: 7 } as never, ctx);
+    assert.match(line.text, /Mainline card 7/, `the slot is gone: ${line.text}`);
+    assert.match(line.text, /Plains/, `the card type is missing: ${line.text}`);
+  });
+
+  it('calls the card by its printed name, not a split key', () => {
+    const line = narrate({ type: 'enhancementPlaced', player: 0, key: 'absSignals', node: 7 } as never, ctx);
+    assert.match(line.text, /ABS Signals/, `not the printed name: ${line.text}`);
+    assert.ok(!/abs Signals/.test(line.text), `still splitting the key: ${line.text}`);
+  });
+
+  it('still says something useful when the card cannot be resolved', () => {
+    // No resolver at all — an engine test narrating events has no division to ask.
+    const bare = narrate({ type: 'enhancementPlaced', player: 0, key: 'absSignals', node: 2 } as never, {});
+    assert.match(bare.text, /Mainline card 2/, `the slot must survive with no resolver: ${bare.text}`);
+  });
+
+  it('leaves a grid-square Enhancement naming its coordinate', () => {
+    const line = narrate(
+      { type: 'enhancementPlaced', player: 0, key: 'smallYard', at: { row: -1, col: 2 } } as never,
+      { enhancementName: (k: string) => (k === 'smallYard' ? 'Small Yard' : null) },
+    );
+    assert.match(line.text, /Small Yard/, `not the printed name: ${line.text}`);
+    assert.match(line.text, /\(2,-1\)/, `the square is gone or in the wrong order: ${line.text}`);
+  });
+});
+
+/**
+ * WHOSE REVENUE IT IS.
+ *
+ * Reported from a table: "in the history on +1 revenue and gives the current score, it doesn't list
+ * the player name." The history prefixes lines with the ACTOR, and revenue is not always the
+ * actor's — a train completing its run pays every player with no actor at all, so those lines
+ * carried no name whatsoever.
+ */
+describe('a Revenue line names the player who earned it', () => {
+  const ctx = { playerName: (p: number) => ['Alice', 'Bob'][p] ?? `Seat ${p}` };
+
+  it('names the earner on a gain', () => {
+    const line = narrate({ type: 'revenueChanged', player: 1, delta: 1, total: 12, reason: 'boarding' } as never, ctx);
+    assert.match(line.text, /Bob/, `no player named: ${line.text}`);
+    assert.match(line.text, /\+1 Revenue/, `the change is gone: ${line.text}`);
+    assert.match(line.text, /now 12/, `the running total is gone: ${line.text}`);
+  });
+
+  it('names the earner on a loss', () => {
+    const line = narrate({ type: 'revenueChanged', player: 0, delta: -5, total: 7, reason: 'collision' } as never, ctx);
+    assert.match(line.text, /Alice/, `no player named: ${line.text}`);
+    assert.match(line.text, /now 7/, `the running total is gone: ${line.text}`);
+  });
+
+  it('names the player it belongs to, not the one who acted', () => {
+    // The distinction that matters: a train completing its run pays everybody.
+    const a = narrate({ type: 'revenueChanged', player: 0, delta: 1, total: 3, reason: 'a train completed its run' } as never, ctx);
+    const b = narrate({ type: 'revenueChanged', player: 1, delta: 1, total: 9, reason: 'a train completed its run' } as never, ctx);
+    assert.match(a.text, /Alice/, `the first payee is unnamed: ${a.text}`);
+    assert.match(b.text, /Bob/, `the second payee is unnamed: ${b.text}`);
+    assert.notEqual(a.text, b.text, 'both payees produced the same line');
+  });
+
+  it('is excluded from the history prefix, so no line names a player twice', () => {
+    // Gitea#31. `record` prefixes `Player <actor>` onto events carrying a `player`; this one
+    // resolves its own name, so it must be on the exclusion list or it reads "Player Bob Bob +1".
+    const src = readFileSync(join(import.meta.dirname, '..', 'src', 'web', 'game.ts'), 'utf8');
+    const guard = src.slice(src.indexOf('const SELF_NAMED'), src.indexOf('const SELF_NAMED') + 400);
+    assert.match(guard, /'revenueChanged'/, 'revenueChanged is not excluded from the actor prefix');
+    assert.match(guard, /!SELF_NAMED\.includes\(e\.type\)/, 'the exclusion is not applied to `mine`');
+  });
+});
+
+/**
+ * THE HISTORY MUST NOT FREEZE WHEN THE LOG IS TRIMMED.
+ *
+ * Reported from a two-player game that did not reach Day 5: one player's history stopped gaining
+ * lines at Day 2 Stage 8 and the other's at Day 2 Stage 4. The log is trimmed to a limit, and each
+ * seat's "what have I sent you" bookmark was an INDEX into that array — so once a seat's bookmark
+ * reached the limit, the array never grew past it again and the slice returned nothing for the rest
+ * of the game. Different moments per seat because each holds its own bookmark.
+ */
+describe('a trimmed log still delivers every line', () => {
+  const config = {
+    mode: 'competitive' as const, days: 5, minCombinedRevenue: 0, maxCollisionsPerDay: 0,
+    maxCollisionsTotal: 0, pvpCardsAllowed: false,
+    optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
+  };
+
+  it('numbers lines by sequence, which survives trimming', () => {
+    const g = newMultiplayerGame(7, config as never, ['A', 'B']);
+    const first = g.log[g.log.length - 1]!.seq;
+    pushLine(g, 'one', 'plain');
+    pushLine(g, 'two', 'plain');
+    assert.equal(g.log[g.log.length - 1]!.seq, first + 2, 'sequence numbers do not advance');
+
+    // Trim the front; the survivors keep the numbers they were given.
+    const keep = g.log[g.log.length - 1]!.seq;
+    g.log.splice(0, g.log.length - 1);
+    assert.equal(g.log[0]!.seq, keep, 'trimming renumbered the lines');
+  });
+
+  it('delivers every line to a seat across many trims', () => {
+    const g = newMultiplayerGame(7, config as never, ['A', 'B']);
+    // The same bookmark the server keeps per seat (`linesSince` in server/session.ts).
+    let bookmark = -1;
+    const since = (): number => {
+      const fresh = g.log.filter((l) => l.seq > bookmark);
+      const last = g.log[g.log.length - 1];
+      if (last) bookmark = last.seq;
+      return fresh.length;
+    };
+    since();
+
+    const pushes = LOG_LIMIT * 2;
+    let delivered = 0;
+    for (let i = 0; i < pushes; i++) {
+      pushLine(g, `line ${i}`, 'plain');
+      if (g.log.length > LOG_LIMIT) g.log.splice(0, g.log.length - LOG_LIMIT);
+      delivered += since();
+    }
+    // Every line reaches the seat, though the log holds only the last LOG_LIMIT of them.
+    assert.equal(delivered, pushes, `only ${delivered} of ${pushes} lines were delivered`);
+    assert.equal(g.log.length, LOG_LIMIT, 'the log is not being trimmed at all');
+  });
+});

test/extended-play.test.ts

@@ -0,0 +1,328 @@
+/**
+ * §3.3, EXTENDED PLAY — Gitea#11, "when game ends allow players to continue playing if they wish".
+ *
+ * The rule as Jesse specified it (2026-08-28), which is what these tests are written against:
+ *
+ *   - the OFFICIAL result is decided at the original game length and never changes. "In a five-day
+ *     game, even if it's extended to eight or nine days, the winner and the official answer is the
+ *     winner at the end of five days";
+ *   - extending grants exactly ONE Day, and the question is put again at the end of it;
+ *   - solitaire: the player decides alone. Multiplayer: unanimous, and one refusal ends it there;
+ *   - only days-based endings offer it. A §3.4 collision breach is final, during an extended Day
+ *     just as during the regular game.
+ *
+ * The persistence half matters as much as the rules half: a save is `{ seed, config, history }`
+ * replayed through the engine, so an extension that is not an INTENT does not survive a reload, an
+ * Undo, or a server restart. `replays the extension` below is the test that pins that.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { advance, pump } from '../src/engine/advance.ts';
+import { applyIntent, check } from '../src/engine/apply.ts';
+import { STAGES_PER_DAY } from '../src/engine/content.ts';
+import { legalActions } from '../src/engine/legal.ts';
+import { createGame } from '../src/engine/setup.ts';
+import { currentActorOfState, publicSnapshot, snapshot } from '../src/sim/view.ts';
+import { currentActor } from '../src/web/game.ts';
+import { developerBot, playGame, randomBot } from '../src/sim/bot.ts';
+import type { GameConfig, GameState } from '../src/engine/state.ts';
+
+const baseConfig = (over: Partial<GameConfig> = {}): GameConfig => ({
+  mode: 'solitaire',
+  days: 3,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
+  optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
+  ...over,
+});
+
+const game = (over: Partial<GameConfig> = {}, names = ['Jesse']): GameState =>
+  createGame({ id: 'g', seed: 1, config: baseConfig(over), playerNames: names });
+
+/** Parks a game on the last Stage of its final Day, so one `advance` runs the clock off the end. */
+function atTheEnd(s: GameState): GameState {
+  s.clock.day = s.config.days + s.extraDays + 1;
+  s.clock.stage = STAGES_PER_DAY;
+  s.clock.phase = 'shiftChange';
+  return s;
+}
+
+describe('§3.3 extended play — the ending pauses rather than stopping (Gitea#11)', () => {
+  it('offers another Day on a days-based ending, and records the result anyway', () => {
+    const s = atTheEnd(game());
+    advance(s);
+    assert.equal(s.status, 'awaitingExtension', 'a days-based ending did not offer another Day');
+    assert.ok(s.outcome, 'the result was not decided');
+    assert.ok(s.official, 'the official result was not frozen');
+    assert.equal(s.official!.day, s.config.days, 'the official Day is not the original game length');
+  });
+
+  it('does NOT offer another Day after a collision breach — §3.4 is final', () => {
+    const s = game({ mode: 'competitive', maxCollisionsPerDay: 2 });
+    s.collisionsToday = 2;
+    s.clock.stage = 1;
+    s.clock.phase = 'shiftChange';
+    advance(s);
+    assert.equal(s.status, 'finished', 'a railroad declared unsafe offered to carry on');
+    assert.equal(s.outcome!.reason, 'collisionFloor');
+  });
+
+  it('refuses every ordinary intent while the extension question is open', () => {
+    const s = atTheEnd(game());
+    advance(s);
+    assert.equal(check(s, 0, { type: 'draw.fromHomeOffice' }), 'WRONG_PHASE');
+    assert.equal(check(s, 0, { type: 'game.extend', player: 0, agree: true }), null, 'the vote itself was refused');
+  });
+
+  it('offers only the two votes, and only to a seat that has not voted', () => {
+    const s = atTheEnd(game({ mode: 'competitive' }, ['A', 'B']));
+    advance(s);
+    assert.deepEqual(
+      legalActions(s, 0).map((i) => i.type),
+      ['game.extend', 'game.extend'],
+      'something other than the vote is legal while the game is stopped',
+    );
+    applyIntent(s, 0, { type: 'game.extend', player: 0, agree: true });
+    assert.equal(legalActions(s, 0).length, 0, 'a seat was offered a second vote');
+    assert.equal(check(s, 0, { type: 'game.extend', player: 0, agree: true }), 'ALREADY_VOTED');
+    assert.equal(legalActions(s, 1).length, 2, 'the seat still to vote was not offered the vote');
+  });
+
+  it('refuses the vote when no extension is pending', () => {
+    const s = game();
+    assert.equal(check(s, 0, { type: 'game.extend', player: 0, agree: true }), 'NOT_AWAITING_EXTENSION');
+  });
+});
+
+describe('§3.3 extended play — one Day at a time (Gitea#11)', () => {
+  it('grants exactly one Day in solitaire, then asks again at the end of it', () => {
+    const s = atTheEnd(game());
+    advance(s);
+    const official = { ...s.official!.outcome };
+
+    applyIntent(s, 0, { type: 'game.extend', player: 0, agree: true });
+    assert.equal(s.status, 'active', 'agreeing did not resume play');
+    assert.equal(s.extraDays, 1, 'more or less than one Day was granted');
+    assert.deepEqual(s.extensionVotes, [null], 'the votes were not cleared for the next question');
+
+    // Run the extra Day off the end: the question comes round again.
+    atTheEnd(s);
+    advance(s);
+    assert.equal(s.status, 'awaitingExtension', 'the second ending did not ask again');
+    assert.equal(s.extraDays, 1, 'a second Day was granted without being asked for');
+    assert.deepEqual(s.official!.outcome, official, 'the official result was rewritten');
+    assert.equal(s.official!.day, s.config.days, 'the official Day moved with the extension');
+  });
+
+  it('ends the moment one seat declines, without waiting for the rest', () => {
+    const s = atTheEnd(game({ mode: 'competitive' }, ['A', 'B', 'C']));
+    advance(s);
+    applyIntent(s, 0, { type: 'game.extend', player: 0, agree: true });
+    assert.equal(s.status, 'awaitingExtension', 'one yes ended the vote');
+
+    applyIntent(s, 1, { type: 'game.extend', player: 1, agree: false });
+    assert.equal(s.status, 'finished', 'a refusal did not end the game immediately');
+    assert.equal(s.extraDays, 0, 'a Day was granted despite a refusal');
+    assert.equal(check(s, 2, { type: 'game.extend', player: 2, agree: true }), 'NOT_AWAITING_EXTENSION',
+      'the seat that never voted is still being waited on');
+  });
+
+  it('needs every seat before it grants the Day', () => {
+    const s = atTheEnd(game({ mode: 'competitive' }, ['A', 'B', 'C']));
+    advance(s);
+    applyIntent(s, 0, { type: 'game.extend', player: 0, agree: true });
+    applyIntent(s, 1, { type: 'game.extend', player: 1, agree: true });
+    assert.equal(s.status, 'awaitingExtension', 'two of three votes granted the Day');
+    applyIntent(s, 2, { type: 'game.extend', player: 2, agree: true });
+    assert.equal(s.status, 'active', 'a unanimous table was not given its Day');
+    assert.equal(s.extraDays, 1);
+  });
+
+  it('keeps the official result when a collision ends an EXTENDED Day', () => {
+    // The case the freeze exists for: a railroad declared unsafe on the extra Day does not retract
+    // who won on the last scheduled one.
+    const s = atTheEnd(game({ mode: 'competitive', maxCollisionsPerDay: 2 }, ['A', 'B']));
+    s.players[0]!.revenue = 9;
+    s.players[1]!.revenue = 2;
+    advance(s);
+    const official = { ...s.official!.outcome };
+    assert.equal(official.result, 'win');
+    assert.equal(official.winner, 0);
+
+    applyIntent(s, 0, { type: 'game.extend', player: 0, agree: true });
+    applyIntent(s, 1, { type: 'game.extend', player: 1, agree: true });
+    assert.equal(s.status, 'active');
+
+    s.collisionsToday = 2;
+    s.clock.stage = 1;
+    s.clock.phase = 'shiftChange';
+    advance(s);
+    assert.equal(s.status, 'finished');
+    assert.equal(s.outcome!.reason, 'collisionFloor', 'the current evaluation was not updated');
+    assert.deepEqual(s.official!.outcome, official, 'a late collision rewrote a recorded win');
+  });
+
+  it('decides the winner at the ORIGINAL game length, whoever leads afterwards', () => {
+    const s = atTheEnd(game({ mode: 'competitive' }, ['A', 'B']));
+    s.players[0]!.revenue = 9;
+    s.players[1]!.revenue = 2;
+    advance(s);
+    assert.equal(s.official!.outcome.winner, 0);
+    assert.deepEqual(s.official!.revenues, [9, 2], 'the official standings were not frozen');
+
+    applyIntent(s, 0, { type: 'game.extend', player: 0, agree: true });
+    applyIntent(s, 1, { type: 'game.extend', player: 1, agree: true });
+
+    // B overtakes A during the extra Day, and it changes nothing official.
+    s.players[1]!.revenue = 40;
+    atTheEnd(s);
+    advance(s);
+    assert.equal(s.official!.outcome.winner, 0, 'overtaking after the timetable took the win');
+    assert.deepEqual(s.official!.revenues, [9, 2], 'the frozen standings moved');
+    assert.equal(s.outcome!.winner, 1, 'the informational evaluation did not follow the new leader');
+  });
+});
+
+describe('§3.3 extended play — it survives being replayed (Gitea#11)', () => {
+  it('reproduces an extended game from seed and intents alone', () => {
+    // The reason the vote is an intent at all. A save is a replay, so a decision that is not in the
+    // history did not happen — an extended game would evaporate on the next reload.
+    const play = (): GameState => {
+      const s = atTheEnd(game());
+      advance(s);
+      applyIntent(s, 0, { type: 'game.extend', player: 0, agree: true });
+      return s;
+    };
+    const a = play();
+    const b = play();
+    assert.equal(a.extraDays, b.extraDays);
+    assert.equal(a.status, b.status);
+    assert.deepEqual(a.official!.outcome, b.official!.outcome);
+  });
+
+  it('narrates the vote, so a table can see who called time', () => {
+    const s = atTheEnd(game({ mode: 'competitive' }, ['A', 'B']));
+    advance(s);
+    const yes = applyIntent(s, 0, { type: 'game.extend', player: 0, agree: true });
+    assert.ok(yes.ok);
+    assert.deepEqual(yes.events.map((e) => e.type), ['extensionVoted']);
+    const no = applyIntent(s, 1, { type: 'game.extend', player: 1, agree: false });
+    assert.ok(no.ok);
+    assert.deepEqual(no.events.map((e) => e.type), ['extensionVoted', 'playConcluded']);
+  });
+
+  it('announces the granted Day', () => {
+    const s = atTheEnd(game());
+    advance(s);
+    const r = applyIntent(s, 0, { type: 'game.extend', player: 0, agree: true });
+    assert.ok(r.ok);
+    assert.deepEqual(r.events.map((e) => e.type), ['extensionVoted', 'dayExtended']);
+    const extended = r.events.find((e) => e.type === 'dayExtended');
+    assert.equal(extended && 'day' in extended ? extended.day : null, s.config.days + 1);
+  });
+});
+
+describe('§3.3 extended play — bots play the timetable they were dealt (Gitea#11)', () => {
+  it('REGRESSION: a simulated game terminates whatever the policy would vote', () => {
+    /**
+     * `playGame` declines on the driver's own account rather than leaving it to the policy, and this
+     * is why. `randomBot` picks uniformly among its legal options, so it takes another Day about
+     * half the time — and since a table may go on granting Days for ever, the game then runs to
+     * `maxTurns`. It did: `test/sim.test.ts` went from under a second to an unbounded hang, every
+     * seeded game in the harness playing fifty thousand turns instead of a couple of hundred.
+     *
+     * `randomBot` is the policy that exposes it, but the guarantee has to hold for any policy,
+     * including ones not written yet — hence the fix living in the driver and the test living here.
+     */
+    const s = createGame({ id: 'g', seed: 9, config: baseConfig({ days: 1 }), playerNames: ['Jesse'] });
+    const out = playGame(s, randomBot(7), pump, 4_000);
+    assert.equal(s.status, 'finished', 'a simulated game did not finish');
+    assert.equal(s.extraDays, 0, 'the harness played Days the game was not dealt');
+    assert.ok(out.turns < 4_000, `ran to the turn cap (${out.turns}) instead of ending`);
+  });
+
+  it('developerBot declines, so a bot-only game ends on schedule', () => {
+    // "If only bots are playing, they never vote to extend" (Jesse, 2026-08-28). The server votes
+    // yes on a bot's behalf once every human has already agreed; this policy is what is left when
+    // there are no humans to follow.
+    const s = atTheEnd(game());
+    advance(s);
+    const choice = developerBot.choose(s, 0, legalActions(s, 0));
+    assert.equal(choice.type, 'game.extend');
+    assert.equal('agree' in choice ? choice.agree : null, false, 'a bot asked for another Day');
+  });
+});
+
+/**
+ * §3.3 — WHO THE SCREEN SAYS THE TABLE IS WAITING ON, while the vote is open.
+ *
+ * The vote is PARALLEL, and `apply.ts` says so where it accepts one: "open to every seat at once:
+ * it is a table decision rather than a ruling, so THERE IS NO ACTOR TO BE". Any seat that has not
+ * voted may vote at any moment, in any order, and one refusal ends it. So the honest answer to "who
+ * are we waiting on" is every un-voted seat — which is exactly what the vote tally beside the chart
+ * already draws — and the honest answer to "whose turn is it" is nobody.
+ *
+ * The engine gave that answer and the screen did not. `currentActor(game)` guards on
+ * `status !== 'active'` and returned null; `actingPlayer(state)` has no such guard and returned
+ * `clock.currentActor`, which still holds whoever moved last before the timetable ran out. The
+ * frame took the second, so the turn chart named one arbitrary seat — the last to act, who has no
+ * more claim on the vote than anybody else — while the tally underneath correctly showed three
+ * seats outstanding.
+ *
+ * The fourth of these in a row after Gitea#21, #22 and #94, and the first found by asking the
+ * question of a state the game is not ACTIVE in. See TODO #96.
+ */
+describe('§3.3 extended play — the vote has no actor (#96)', () => {
+  const table = (): GameState => {
+    const s = atTheEnd(game({ mode: 'competitive' }, ['Ann', 'Bob', 'Cy']));
+    advance(s);
+    assert.equal(s.status, 'awaitingExtension', 'the table is not being asked');
+    return s;
+  };
+
+  it('reports nobody acting while the vote is open, to a player and to a spectator alike', () => {
+    const s = table();
+    assert.notEqual(s.clock.currentActor, null, 'the premise is gone: nothing was left on the clock');
+
+    assert.equal(currentActorOfState(s), null, 'the engine named an actor during a parallel vote');
+    assert.equal(
+      snapshot(s, [], null, null, null, false, 0).actor,
+      null,
+      'the turn chart named a seat while the whole table was voting',
+    );
+    assert.equal(publicSnapshot(s).actor, null, 'the common board named a seat during the vote');
+  });
+
+  it('agrees with the session, which is the half that decides what is legal', () => {
+    // The disagreement is the bug, not either answer on its own: `currentActor` is what refuses an
+    // intent, so a screen that names somebody it would refuse is telling the table to wait on a
+    // player who cannot act.
+    const s = table();
+    const g = { state: s, log: [] } as unknown as Parameters<typeof currentActor>[0];
+    assert.equal(currentActorOfState(s), currentActor(g), 'the screen and the session disagree');
+  });
+
+  it('still names the actor during ordinary play, which is the case that must not regress', () => {
+    const s = game({ mode: 'competitive' }, ['Ann', 'Bob', 'Cy']);
+    pump(s);
+    assert.equal(s.status, 'active', 'the premise is gone: the game is not running');
+    assert.equal(currentActorOfState(s), s.clock.currentActor, 'an active game lost its actor');
+    assert.equal(snapshot(s, [], null, null, null, false, 0).actor, s.clock.currentActor);
+  });
+
+  it('reports nobody once the table has declined and the game is finished', () => {
+    const s = table();
+    applyIntent(s, 1, { type: 'game.extend', player: 1, agree: false });
+    assert.equal(s.status, 'finished', 'a refusal did not end it');
+    assert.equal(currentActorOfState(s), null, 'a finished game still had somebody to move');
+    assert.equal(publicSnapshot(s).actor, null, 'the common board named a seat after the game ended');
+  });
+});

test/frame-delta.test.ts

@@ -15,6 +15,10 @@ const config: GameConfig = {
   maxCollisionsPerDay: 0,
   maxCollisionsTotal: 0,
   pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
   optionalRules: {
     reducedVisibility: false,
     employeeRotation: false,

test/harness.test.ts

@@ -34,6 +34,10 @@ const config: GameConfig = {
   maxCollisionsPerDay: 0,
   maxCollisionsTotal: 0,
   pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
   optionalRules: {
     reducedVisibility: false,
     employeeRotation: false,
@@ -228,14 +232,28 @@ describe('the game conserves Rolling Stock', () => {
       for (let t = 0; t < 50_000; t++) {
         const before = census(s);
         const pumped = pump(s);
-        // §10 — a collision destroys both trains and everything they were carrying. That is the one
-        // legitimate way the count falls, so the expectation follows it down.
-        for (const e of pumped) {
-          if (e.type === 'trainsDestroyed') for (const tr of e.trains) expected -= tr.consist.length;
-        }
-        assert.ok(
-          census(s) === before || pumped.some((e) => e.type === 'trainsDestroyed'),
-          `seed ${seed}: the engine changed the census by ${census(s) - before} outside a collision`,
+        /**
+         * A COLLISION DESTROYS NO CAR, and this used to assume it destroyed all of them.
+         *
+         * The subtraction that stood here — `expected -= tr.consist.length` for every train in a
+         * `trainsDestroyed` event — describes a rule the engine does not have. Gap 2c (`advance.ts`,
+         * "TAKE THE WRECK OFF THE CARD") sends the wreck's cabooses back to the Division Yard and
+         * everything else to Classification, so the stock is conserved through a collision like any
+         * other move. The train is destroyed; its cars are not.
+         *
+         * It passed for as long as it did because none of the six seeds below ever collided, so the
+         * branch never ran. Changing the deck to the sheet's counts (Gitea#14) moved the deals, seed
+         * 24757 collided, and the test failed claiming the engine had CONJURED three cars — the
+         * exact opposite of what had happened.
+         *
+         * So the census is now held flat, unconditionally, which is both the real invariant and a
+         * stronger test than the one it replaces: there is no longer any event that excuses a
+         * change, and `expected` cannot drift away from the supply it was dealt.
+         */
+        assert.equal(
+          census(s),
+          before,
+          `seed ${seed}: the engine changed the census by ${census(s) - before} while pumping`,
         );
         if (s.status === 'finished') break;
         const actor = s.clock.pendingDecision !== null ? s.clock.superintendent : s.clock.currentActor;
@@ -290,7 +308,18 @@ describe('every published replay actually replays', () => {
         `${f} is dead — it replays ${back.history.length} of ${save.history.length} intents. ` +
           'Re-record it with save-replay.ts rather than editing the file.',
       );
-      assert.equal(back.state.status, 'finished', `${f} does not reach the end of its game`);
+      /**
+       * `awaitingExtension` counts as the end since Gitea#11 — and for a published file it is the
+       * EXPECTED end. These saves were recorded before extended play existed, so their histories
+       * carry no `game.extend` vote: replaying one runs the timetable out and stops on the question
+       * nobody was there to answer. That is a game that reached the end of its own history, which is
+       * what this test is about. `active` would still be a dead replay.
+       */
+      assert.ok(
+        back.state.status === 'finished' || back.state.status === 'awaitingExtension',
+        `${f} does not reach the end of its game — status ${back.state.status}`,
+      );
+      assert.ok(back.state.official !== null, `${f} ends without recording a result`);
     }
   });
 });

test/mainline-cards.test.ts

@@ -12,6 +12,7 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
 
+import type { MainlineKind } from '../src/engine/content.ts';
 import { advance } from '../src/engine/advance.ts';
 import { applyIntent, areaOf, check } from '../src/engine/apply.ts';
 import { legalActions } from '../src/engine/legal.ts';
@@ -27,7 +28,7 @@ import {
 import { createGame } from '../src/engine/setup.ts';
 import type { GameEvent } from '../src/engine/events.ts';
 import type { GameConfig, GameState, GridCoord, TrackCard } from '../src/engine/state.ts';
-import { coordKey, turnOf } from '../src/engine/state.ts';
+import { coordKey, decisionActor, turnOf } from '../src/engine/state.ts';
 import { snapshot } from '../src/sim/view.ts';
 
 const config: GameConfig = {
@@ -37,12 +38,30 @@ const config: GameConfig = {
   maxCollisionsPerDay: 0,
   maxCollisionsTotal: 0,
   pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
   optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
 };
 const game = (seed = 5): GameState => createGame({ id: 'g', seed, config, playerNames: ['p'] });
 const at = (row: number, col: number): GridCoord => ({ row, col });
 
 /** Puts a card of `kind`/`key` in hand and returns its id. */
+/**
+ * Puts a specific rules card in hand and returns its id, MINTING ONE IF THE DECK NO LONGER DEALS IT.
+ *
+ * A card at `copies: 0` is still a card: the catalogue keeps its row and the engine keeps its rule,
+ * so the design stays visible and the mechanic works the moment it is dealt again. Poling and the
+ * sharp curves have been treated that way for a while, and Gitea#14 put the dispatching ladder,
+ * Facing Point Locks, Flying Switch, Section House and Vandalism there too — none of them are in
+ * `docs/Deck cards5.xlsx`.
+ *
+ * This used to throw when it could not find one, which made "dealt zero copies" and "deleted"
+ * indistinguishable from a test's point of view: zeroing Flying Switch took five passing tests of a
+ * rule that had not changed at all down with it. Minting keeps the rule under test independently of
+ * whether the deck currently deals the card, which is the whole reason for keeping the row.
+ */
 function hand(s: GameState, kind: string, key: string): string {
   for (const [id, card] of s.cards) {
     const k = card.kind as { kind: string; key?: string };
@@ -51,7 +70,10 @@ function hand(s: GameState, kind: string, key: string): string {
       return id;
     }
   }
-  throw new Error(`no ${kind} card: ${key}`);
+  const id = `zero-copy-${kind}-${key}`;
+  s.cards.set(id, { id, kind: { kind, key } } as never);
+  s.decks.hands.set(0, [id]);
+  return id;
 }
 
 /**
@@ -90,53 +112,124 @@ function drawTurn(s: GameState): void {
 
 // ---------------------------------------------------------------------------
 
-describe('grade modifiers change crossing time', () => {
-  it('a Heavy Grade takes two Stages bare', () => {
-    assert.equal(crossingStages('heavyGrade', 'fast', false), 2);
+/**
+ * Crossing time on the region model (Gitea#3). `cross` fills in the parts each test does not care
+ * about, so the numbers below read as the table RAR gave rather than as argument lists.
+ */
+const cross = (
+  kind: Parameters<typeof crossingStages>[0],
+  over: Partial<Parameters<typeof crossingStages>[1]> = {},
+): number =>
+  crossingStages(kind, {
+    trainSpeed: 'fast',
+    direction: 'east',
+    gradeUp: 'east',
+    modifiers: [],
+    ...over,
+  });
+
+describe('a card costs one Stage per printed region (Gitea#3)', () => {
+  /**
+   * RAR, 2026-08-26, and this REPLACES the two rules that were here before — Q1, "the printed 60/30
+   * are mph expressed as crossing time", and Q2, "a Slow train adds one Stage to every card".
+   *
+   * "Ignore speed signs, they are just graphics. Regions shown on cards indicate how many stages it
+   * takes to cross. Plains is 1. Double track is 1, tunnel is 2, curves is 2, heavy grade is 3
+   * unless you have help."
+   *
+   * The report that opened the issue was a Slow train taking two Stages to clear Double Track. Q2 is
+   * what did that, and it is gone.
+   */
+  it('crosses in the number of regions the card prints, whatever the train', () => {
+    for (const speed of ['fast', 'slow'] as const) {
+      assert.equal(cross('plains', { trainSpeed: speed }), 1, `plains, ${speed}`);
+      assert.equal(cross('doubleTrack', { trainSpeed: speed }), 1, `double track, ${speed}`);
+      assert.equal(cross('trestle', { trainSpeed: speed }), 1, `trestle, ${speed}`);
+      assert.equal(cross('curves', { trainSpeed: speed }), 2, `curves, ${speed}`);
+      assert.equal(cross('tunnel', { trainSpeed: speed }), 2, `tunnel, ${speed}`);
+      assert.equal(cross('heavyGrade', { trainSpeed: speed }), 3, `heavy grade, ${speed}`);
+    }
+  });
+
+  it('reads Fast/Slow on Hilly and on nothing else', () => {
+    // "Some cards say fast / slow… Fast / Slow does not apply to every card — just those that say
+    // fast / slow on them. Currently this is only hilly." A fast train starts in the second region.
+    assert.equal(cross('hilly', { trainSpeed: 'fast' }), 1);
+    assert.equal(cross('hilly', { trainSpeed: 'slow' }), 2);
+  });
+
+  it('does not read the consist any more', () => {
+    // Hilly used to take its split off the printed P60/F30 and decide by whether the train carried a
+    // coach, so a fast freight crossed slower than a slow passenger train. RAR: "I notice that you
+    // are basing stages in mainline cards off coach/non-coach. Actually, all trains are rated as
+    // FAST and SLOW." `crossingStages` no longer takes a consist at all — this test is here so the
+    // deletion is deliberate rather than incidental.
+    assert.equal(cross('hilly', { trainSpeed: 'fast' }), cross('hilly', { trainSpeed: 'fast' }));
+  });
+
+  it('runs a train through a siding or an Interchange in one Stage', () => {
+    // Both print a back region that is not part of the road, so a train passing through starts past
+    // it. What that region is FOR is tested below and in the collision tests.
+    assert.equal(cross('uncontrolledSiding'), 1);
+    assert.equal(cross('interchange'), 1);
+  });
+
+  it('costs the extra Stage to anything starting in that back region', () => {
+    // The Uncontrolled Siding with a train already on it, and an Extra beginning its run at an
+    // Interchange. Both start at the back and have the whole card to run.
+    assert.equal(cross('uncontrolledSiding', { startsAtBack: true }), 2);
+    assert.equal(cross('interchange', { startsAtBack: true }), 2);
+  });
+});
+
+describe('grade modifiers move the start, not the clock', () => {
+  it('a Heavy Grade takes three Stages bare', () => {
+    // Three regions, up from the two the old 30mph reading gave it.
+    assert.equal(cross('heavyGrade'), 3);
   });
 
   it('Brakeman speeds the descent but not the climb', () => {
-    // Q11 — the card prints "(Up)" and "Player sets orientation", so the last argument is which
-    // way is UPHILL. With up = east, a westbound train is descending.
-    assert.equal(crossingStages('heavyGrade', 'fast', false, ['brakeman'], 'west', 'east'), 1);
-    assert.equal(crossingStages('heavyGrade', 'fast', false, ['brakeman'], 'east', 'east'), 2);
+    // Q11 — the card prints "(Up)" and "Player sets orientation", so `gradeUp` is which way is
+    // UPHILL. With up = east, a westbound train is descending.
+    assert.equal(cross('heavyGrade', { modifiers: ['brakeman'], direction: 'west' }), 2);
+    assert.equal(cross('heavyGrade', { modifiers: ['brakeman'], direction: 'east' }), 3);
   });
 
-  it('follows the orientation the player chose, not a fixed compass direction', () => {
-    // The same train on the same card, with the card turned around: Brakeman helps a westbound
-    // train on an east-climbing grade, and an eastbound one when the grade climbs west.
-    assert.equal(crossingStages('heavyGrade', 'fast', false, ['brakeman'], 'east', 'west'), 1);
-    assert.equal(crossingStages('heavyGrade', 'fast', false, ['brakeman'], 'west', 'west'), 2);
-    assert.equal(crossingStages('heavyGrade', 'fast', false, ['helpers'], 'west', 'west'), 1);
-    assert.equal(crossingStages('heavyGrade', 'fast', false, ['helpers'], 'east', 'west'), 2);
+  it('follows the orientation the card was dealt, not a fixed compass direction', () => {
+    // The same train on the same card, with the card turned around.
+    assert.equal(cross('heavyGrade', { modifiers: ['brakeman'], direction: 'east', gradeUp: 'west' }), 2);
+    assert.equal(cross('heavyGrade', { modifiers: ['brakeman'], direction: 'west', gradeUp: 'west' }), 3);
+    assert.equal(cross('heavyGrade', { modifiers: ['helpers'], direction: 'west', gradeUp: 'west' }), 2);
+    assert.equal(cross('heavyGrade', { modifiers: ['helpers'], direction: 'east', gradeUp: 'west' }), 3);
   });
 
   it('Helpers speed the climb but not the descent', () => {
-    assert.equal(crossingStages('heavyGrade', 'fast', false, ['helpers'], 'east', 'east'), 1);
-    assert.equal(crossingStages('heavyGrade', 'fast', false, ['helpers'], 'west', 'east'), 2);
+    // RAR: "helpers… helps all trains going up hill by starting 1 region easier — so 2 to traverse,
+    // not 3."
+    assert.equal(cross('heavyGrade', { modifiers: ['helpers'], direction: 'east' }), 2);
+    assert.equal(cross('heavyGrade', { modifiers: ['helpers'], direction: 'west' }), 3);
   });
 
-  it('Airbrakes stack with Brakeman on a slow train', () => {
-    // A slow train pays 3 on a grade; Brakeman and Airbrakes take one Stage each.
-    assert.equal(crossingStages('heavyGrade', 'slow', false, [], 'west', 'east'), 3);
-    assert.equal(crossingStages('heavyGrade', 'slow', false, ['brakeman'], 'west', 'east'), 2);
-    assert.equal(
-      crossingStages('heavyGrade', 'slow', false, ['brakeman', 'airbrakes'], 'west', 'east'),
-      1,
-    );
+  it('Airbrakes stack on top of Brakeman', () => {
+    // "Airbrakes is an upgrade from brakemen (which must be played first)", so a fully-equipped
+    // grade is one Stage downhill — and `check` refuses Airbrakes without Brakeman already there.
+    assert.equal(cross('heavyGrade', { direction: 'west' }), 3);
+    assert.equal(cross('heavyGrade', { modifiers: ['brakeman'], direction: 'west' }), 2);
+    assert.equal(cross('heavyGrade', { modifiers: ['brakeman', 'airbrakes'], direction: 'west' }), 1);
   });
 
   it('never lets a train cross in no time', () => {
+    // Three modifiers on a three-region card would otherwise put the start past the far edge.
     assert.equal(
-      crossingStages('heavyGrade', 'fast', false, ['brakeman', 'airbrakes'], 'west', 'east'),
+      cross('heavyGrade', { modifiers: ['brakeman', 'airbrakes', 'helpers'], direction: 'west' }),
       1,
     );
   });
 
   it('leaves non-grade cards alone', () => {
     // Brakeman on Plains would be an illegal placement anyway; the maths must not move regardless.
-    assert.equal(crossingStages('plains', 'fast', false, ['brakeman'], 'west', 'east'), 1);
-    assert.equal(crossingStages('curves', 'fast', false, ['helpers'], 'east', 'east'), 2);
+    assert.equal(cross('plains', { modifiers: ['brakeman'], direction: 'west' }), 1);
+    assert.equal(cross('curves', { modifiers: ['helpers'] }), 2);
   });
 });
 
@@ -209,8 +302,8 @@ describe('Realignment converts one Mainline type to another', () => {
 
     assert.ok(r.ok);
     assert.equal(node.card, 'plains', 'Curves realigns to Plains');
-    // The point of the card: Curves is a 30 (two Stages), Plains a 60 (one).
-    assert.equal(crossingStages(node.card, 'fast', false), 1);
+    // The point of the card: Curves prints two regions, Plains one, so realigning halves the time.
+    assert.equal(cross(node.card), 1);
   });
 
   it('refuses a card with no conversion listed', () => {
@@ -228,77 +321,177 @@ describe('Realignment converts one Mainline type to another', () => {
   });
 });
 
-describe('Red Flags protect a stopped train', () => {
-  /** A slow train `behind` closing on a stopped train `ahead`, both eastbound on node 1. */
-  function rearEnder(s: GameState) {
-    const node = pinned(s, 1, 'plains');
-    node.transits.push({ tray: 'ahead', stagesRemaining: 2, stagesTotal: 2, direction: 'east' });
-    s.trays.set('ahead', {
-      id: 'ahead', trainNumber: 4, trainIsExtra: false, engineAt: 0,
-      consist: [], direction: 'east', position: { at: 'mainline', index: 1 }, movesUsed: 0,
+describe('Red Flags hold a train out of your Limits (Gitea#19)', () => {
+  /**
+   * REPLACES the old rule outright (Jesse, 2026-08-29). Red Flags used to be played on a stopped
+   * train out on the Mainline and protected it from a rear-ender — measured at 4,212 offers and 4
+   * plays across 600 games, a mechanic nobody used. ABS Signals already does that job better.
+   *
+   * Now: "If played, asked FLAG EAST or FLAG WEST. That stops all trains from entering your limits
+   * from that direction (i.e. Flag East holds westbound trains)." Spent on the train it stops —
+   * one card, one train.
+   */
+
+  /** A westbound train one Stage from entering seat 0's district from the east. */
+  function approaching(s: GameState) {
+    const officeIndex = s.division.nodes.findIndex((n) => n.kind === 'office' && n.seat === 0);
+    const node = pinned(s, officeIndex + 1, 'plains');
+    node.transits.push({ tray: 'inbound', stagesRemaining: 1, stagesTotal: 1, direction: 'west' });
+    s.trays.set('inbound', {
+      id: 'inbound', trainNumber: 9, trainIsExtra: false, engineAt: 0,
+      consist: [{ type: 'hopper', loaded: true }], direction: 'west',
+      position: { at: 'mainline', index: officeIndex + 1 }, movesUsed: 0,
     });
-    s.trays.set('behind', {
-      id: 'behind', trainNumber: 2, trainIsExtra: false, engineAt: 0,
-      consist: [], direction: 'east', position: { at: 'divisionPoint', side: 'west' }, movesUsed: 0,
-    });
-    const dp = s.division.nodes[0];
-    if (dp?.kind === 'divisionPoint') dp.holding.push('behind');
     s.clock.phase = 'mainline';
     s.movedThisPhase = new Set();
-    return node;
+    return s.division.nodes[officeIndex] as Extract<typeof s.division.nodes[0], { kind: 'office' }>;
   }
 
-  it('holds the approaching train instead of letting it close', () => {
+  it('FLAG EAST holds a westbound train short of the Limits', () => {
     const s = game();
-    const node = rearEnder(s);
-    node.redFlagged = ['ahead'];
+    const office = approaching(s);
+    office.redFlag = 'east';
 
     advance(s);
-    assert.deepEqual(
-      s.trays.get('behind')!.position,
-      { at: 'divisionPoint', side: 'west' },
-      'the flagged train must not be approached',
-    );
+    const pos = s.trays.get('inbound')!.position;
+    assert.equal(pos.at, 'mainline', 'the flagged train came in anyway');
+    assert.ok(!areaOf(s, 0).adOccupancy.includes('inbound'), 'it reached an A/D track');
   });
 
-  it('comes in when the protected train rolls', () => {
+  it('is spent on the train it stops — one card, one train', () => {
     const s = game();
-    const node = rearEnder(s);
-    node.redFlagged = ['ahead'];
-    // Bring the protected train to the end of its crossing so it leaves the card.
-    node.transits[0]!.stagesRemaining = 1;
+    const office = approaching(s);
+    office.redFlag = 'east';
 
-    for (let i = 0; i < 12 && (node.redFlagged?.length ?? 0) > 0; i++) advance(s);
-    assert.deepEqual(node.redFlagged, [], 'flags come in once the train moves off');
+    advance(s);
+    assert.equal(office.redFlag, undefined, 'the flag stayed up after stopping a train');
   });
 
-  it('only protects a train out on the Mainline', () => {
+  it('lets the train in on the next Mainline Phase', () => {
+    // "Loses one Mainline Phase" — it buys a Stage to clear the lead, not permanent protection.
+    const s = game();
+    const office = approaching(s);
+    office.redFlag = 'east';
+    advance(s);
+
+    s.clock.phase = 'mainline';
+    s.movedThisPhase = new Set();
+    advance(s);
+    assert.ok(areaOf(s, 0).adOccupancy.includes('inbound'), 'the train never came in');
+  });
+
+  it('does not hold a train coming from the OTHER side', () => {
+    // "Flag East holds westbound trains" — an eastbound train arrives from the west.
+    const s = game();
+    const office = approaching(s);
+    office.redFlag = 'west';
+
+    advance(s);
+    assert.ok(areaOf(s, 0).adOccupancy.includes('inbound'), 'a west flag held a train from the east');
+    assert.equal(office.redFlag, 'west', 'the wrong-side flag was spent');
+  });
+
+  it('is played on a side, not on a train', () => {
     const s = game();
-    rearEnder(s);
     s.clock.phase = 'localOps';
     s.clock.currentActor = 0;
     const cardId = hand(s, 'maneuver', 'redFlags');
 
-    assert.equal(
-      check(s, 0, { type: 'maneuver.redFlags', cardId, trayId: 'behind' }),
-      'NO_PLACEMENT',
-      'a train sitting at a Division Point cannot be rear-ended',
-    );
-    assert.equal(check(s, 0, { type: 'maneuver.redFlags', cardId, trayId: 'ahead' }), null);
+    assert.equal(check(s, 0, { type: 'maneuver.redFlags', cardId, side: 'east' }), null);
+    assert.equal(check(s, 0, { type: 'maneuver.redFlags', cardId, side: 'west' }), null);
   });
 
-  it('will not double-flag the same train', () => {
+  it('will not double-flag the same side', () => {
     const s = game();
-    const node = rearEnder(s);
     s.clock.phase = 'localOps';
     s.clock.currentActor = 0;
     const cardId = hand(s, 'maneuver', 'redFlags');
-    node.redFlagged = ['ahead'];
+    const officeIndex = s.division.nodes.findIndex((n) => n.kind === 'office' && n.seat === 0);
+    const office = s.division.nodes[officeIndex] as { redFlag?: string };
+    office.redFlag = 'east';
 
-    assert.equal(
-      check(s, 0, { type: 'maneuver.redFlags', cardId, trayId: 'ahead' }),
-      'OPTION_ALREADY_CHOSEN',
-    );
+    assert.equal(check(s, 0, { type: 'maneuver.redFlags', cardId, side: 'east' }), 'ALREADY_FLAGGED');
+    assert.equal(check(s, 0, { type: 'maneuver.redFlags', cardId, side: 'west' }), null,
+      'the other side should still be free');
+  });
+});
+
+describe('Red Flags offered at the moment of danger (Gitea#19)', () => {
+  /**
+   * "In actual cases of danger… if there is a train or cars on the track and there will be a
+   * collision, then you break in with a dialog that says COLLISION RISK! FLAG AGAINST T2? This way,
+   * you can play the card normally or out of phase, but only if you need it."
+   *
+   * The engine establishes the danger, so the player is never asked to judge it — which is also why
+   * the bot can now use this card at all. It is offered ONLY to somebody holding one.
+   */
+  function dangerous(s: GameState, giveCard: boolean) {
+    const officeIndex = s.division.nodes.findIndex((n) => n.kind === 'office' && n.seat === 0);
+    const node = pinned(s, officeIndex + 1, 'plains');
+    node.transits.push({ tray: 'inbound', stagesRemaining: 1, stagesTotal: 1, direction: 'west' });
+    s.trays.set('inbound', {
+      id: 'inbound', trainNumber: 9, trainIsExtra: false, engineAt: 0,
+      consist: [{ type: 'hopper', loaded: true }], direction: 'west',
+      position: { at: 'mainline', index: officeIndex + 1 }, movesUsed: 0,
+    });
+    // A hopper fouling the Running Track: §8.3 makes this arrival a collision.
+    const area = areaOf(s, 0);
+    area.grid.get(coordKey(area.officeCoord))!.standing = [{ type: 'hopper', loaded: false }];
+    if (giveCard) hand(s, 'maneuver', 'redFlags');
+    s.clock.phase = 'mainline';
+    s.movedThisPhase = new Set();
+  }
+
+  it('breaks in to offer the flag when an arrival would collide', () => {
+    const s = game();
+    dangerous(s, true);
+    advance(s);
+    assert.equal(s.clock.pendingDecision?.kind, 'redFlag', 'no prompt before a certain collision');
+    assert.equal(decisionActor(s), 0, 'the prompt went to the wrong player');
+  });
+
+  it('flagging holds the train and costs the card', () => {
+    const s = game();
+    dangerous(s, true);
+    advance(s);
+    const before = (s.decks.hands.get(0) ?? []).length;
+
+    const r = applyIntent(s, 0, { type: 'mainline.redFlag', flag: true });
+    assert.ok(r.ok, 'the flag was refused');
+    advance(s);
+
+    assert.equal(s.players[0]!.revenue, 0, 'the collision happened anyway');
+    assert.equal(s.trays.get('inbound')!.position.at, 'mainline', 'the train came in regardless');
+    assert.equal((s.decks.hands.get(0) ?? []).length, before - 1, 'the card was not spent');
+  });
+
+  it('declining lets the collision happen', () => {
+    const s = game();
+    dangerous(s, true);
+    advance(s);
+
+    assert.ok(applyIntent(s, 0, { type: 'mainline.redFlag', flag: false }).ok);
+    advance(s);
+    assert.equal(s.players[0]!.revenue, -5, 'waving it through did not collide');
+  });
+
+  it('does not offer a flag to a player holding none', () => {
+    // A prompt with one button is not a choice, and it leaks that a collision is coming.
+    const s = game();
+    dangerous(s, false);
+    advance(s);
+    assert.equal(s.clock.pendingDecision, null, 'offered a flag to a player with no card');
+    assert.equal(s.players[0]!.revenue, -5, 'the collision should have happened');
+  });
+
+  it('stays quiet when the arrival is safe', () => {
+    const s = game();
+    dangerous(s, true);
+    // Clear the hazard: nothing fouling the Running Track, and room at the Office.
+    const area = areaOf(s, 0);
+    area.grid.get(coordKey(area.officeCoord))!.standing = [];
+    advance(s);
+    assert.equal(s.clock.pendingDecision, null, 'interrupted the phase for a safe arrival');
   });
 });
 
@@ -538,6 +731,18 @@ describe('the Limits sign moves with the Running Track (§2.1, Gap 4a)', () => {
 
 describe('a turnout may be laid on top of a card already down', () => {
   /** Lays a straight inside the Limits and returns where it went. */
+  /** Force an industry card into hand and return its id, the way `trackInHand` does for track. */
+  const facilityInHand = (s: GameState): string => {
+    for (const [id, card] of s.cards) {
+      if ((card.kind as { kind: string }).kind !== 'freightFacility') continue;
+      const hand = s.decks.hands.get(0) ?? [];
+      if (!hand.includes(id)) hand.push(id);
+      s.decks.hands.set(0, hand);
+      return id;
+    }
+    throw new Error('no freight facility card in the deck');
+  };
+
   const layStraight = (s: GameState): GridCoord => {
     const area = areaOf(s, 0);
     const target = { row: area.runningRow, col: area.limitsEast.col };
@@ -610,6 +815,82 @@ describe('a turnout may be laid on top of a card already down', () => {
     assert.deepEqual(matching, ['right/1'], 'exactly the turnout diverging onto `ne` should be accepted');
   });
 
+  it('builds an industry over a straight already laid, off the Running Track', () => {
+    /**
+     * REPORTED FROM A TABLE: "just like you could play a turnout over a straight or a curve, the
+     * game should allow placing an industry over a straight on a non-running track."
+     *
+     * A player who lays the rail first and draws the industry afterwards otherwise has no move,
+     * which punishes building a district in the sensible order. The swap is safe for the same
+     * reason the turnout upgrade is: `protoCard` builds every Facility as plain east-west track, so
+     * replacing a straight is port-for-port and no neighbour loses a join.
+     */
+    const s = game();
+    const area = areaOf(s, 0);
+    turnOf(s, 0).option = 'draw';
+
+    // A stub below the main: a turnout on the Running Track, a straight hanging under it.
+    const turnoutAt = { row: area.runningRow, col: area.limitsEast.col };
+    assert.ok(applyIntent(s, 0, {
+      type: 'card.play', cardId: trackInHand(s, 'turnout', 'right'), placement: turnoutAt, variant: 0,
+    }).ok, 'the turnout should lay on the Limits sign');
+    const curveAt = { row: area.runningRow - 1, col: turnoutAt.col };
+    assert.ok(applyIntent(s, 0, {
+      type: 'card.play', cardId: trackInHand(s, 'curved', 'right'), placement: curveAt, variant: 1,
+    }).ok, 'the matching curve should hang under the turnout');
+    // Laying on the Limits sign moved it outward, so the square east of the curve is now inside.
+    const stub = { row: curveAt.row, col: curveAt.col + 1 };
+    assert.ok(applyIntent(s, 0, {
+      type: 'card.play', cardId: trackInHand(s, 'straight', 'none'), placement: stub, variant: 0,
+    }).ok, 'the straight should run east off the curve');
+
+    const industry = facilityInHand(s);
+    assert.equal(
+      check(s, 0, { type: 'card.play', cardId: industry, placement: stub, variant: 0 }),
+      null,
+      'an industry could not be built over a straight on a stub',
+    );
+
+    // And the menu offers it, or the rule exists and is never presented.
+    const offered = legalActions(s, 0).some(
+      (i) => i.type === 'card.play' && i.cardId === industry &&
+        i.placement?.row === stub.row && i.placement.col === stub.col,
+    );
+    assert.ok(offered, 'the square is legal but never enumerated, so it cannot be chosen');
+
+    // It really replaces the track, rather than being refused after the fact.
+    assert.ok(applyIntent(s, 0, { type: 'card.play', cardId: industry, placement: stub, variant: 0 }).ok);
+    assert.equal(area.grid.get(`${stub.row},${stub.col}`)?.geometry.kind, 'facility');
+  });
+
+  it('will not build an industry over the Running Track, a curve or a turnout', () => {
+    // The Running Track is §11.2's own rule. Curves and turnouts carry ports a Facility does not,
+    // so building over one could sever a neighbour's join — which is why only a straight is allowed.
+    const s = game();
+    const area = areaOf(s, 0);
+    turnOf(s, 0).option = 'draw';
+
+    const turnoutAt = { row: area.runningRow, col: area.limitsEast.col };
+    assert.ok(applyIntent(s, 0, {
+      type: 'card.play', cardId: trackInHand(s, 'turnout', 'right'), placement: turnoutAt, variant: 0,
+    }).ok, 'the turnout should lay on the Limits sign');
+    assert.equal(
+      check(s, 0, { type: 'card.play', cardId: facilityInHand(s), placement: turnoutAt, variant: 0 }),
+      'ON_RUNNING_TRACK',
+      'an industry was allowed onto the Running Track',
+    );
+
+    const curveAt = { row: area.runningRow - 1, col: turnoutAt.col };
+    assert.ok(applyIntent(s, 0, {
+      type: 'card.play', cardId: trackInHand(s, 'curved', 'right'), placement: curveAt, variant: 1,
+    }).ok, 'the curve should hang under the main');
+    assert.equal(
+      check(s, 0, { type: 'card.play', cardId: facilityInHand(s), placement: curveAt, variant: 0 }),
+      'NOT_UPGRADEABLE_TRACK',
+      'an industry was allowed over a curve, whose ports it does not carry',
+    );
+  });
+
   it('refuses to swap the track out from under a car, or out from under an Interlocking', () => {
     const s = game();
     const area = areaOf(s, 0);
@@ -681,6 +962,100 @@ describe('a turnout may be laid on top of a card already down', () => {
   });
 });
 
+describe('extras that must run loaded, and one that must not (Gitea#13)', () => {
+  /**
+   * "I've redefined some of the extra trains that they have to run full boxcars — military trains,
+   * circus trains, etc. If not loaded, then empty, and if none available, run without."
+   *
+   * A PREFERENCE ORDER, so every test here is about what the DIVISION YARD still holds. The rule
+   * has nothing to say about a train once it is running; it decides which car may be taken next.
+   */
+  const madeUp = (trainNumber: number) => {
+    const s = game();
+    s.clock.phase = 'newTrain';
+    s.trays.set('t', {
+      id: 't', trainNumber, trainIsExtra: true, engineAt: 0,
+      consist: [], direction: 'east', position: { at: 'divisionPoint', side: 'west' }, movesUsed: 0,
+    });
+    return s;
+  };
+  const place = (carType: string, loaded: boolean) =>
+    ({ type: 'newTrain.placeCar', trayId: 't', carType, loaded }) as never;
+  /** Leaves the Division Yard holding exactly the cars described. */
+  const stockYard = (s: ReturnType<typeof madeUp>, cars: { type: string; loaded: boolean }[]) => {
+    s.yards.divisionYard.length = 0;
+    s.yards.divisionYard.push(...(cars as never[]));
+  };
+
+  it('refuses an empty while the yard can still supply a loaded one (X18 Circus)', () => {
+    const s = madeUp(18);
+    stockYard(s, [{ type: 'boxcar', loaded: true }, { type: 'boxcar', loaded: false }]);
+    assert.equal(check(s, 0, place('boxcar', false)), 'NO_SUITABLE_CAR',
+      'an empty was accepted while a loaded boxcar was still in the yard');
+    assert.equal(check(s, 0, place('boxcar', true)), null, 'the loaded boxcar was refused');
+  });
+
+  it('accepts an empty once the yard has no loaded car of that kind left', () => {
+    // "If not loaded, then empty." The rule releases as soon as the yard cannot supply.
+    const s = madeUp(18);
+    stockYard(s, [{ type: 'boxcar', loaded: false }]);
+    assert.equal(check(s, 0, place('boxcar', false)), null,
+      'an empty was refused when the yard held no loaded car at all');
+  });
+
+  it('does not let a loaded car of the WRONG category unlock the rule', () => {
+    // A loaded coach is no reason to refuse an empty boxcar: the preference is per category, since
+    // that is the slot the car is competing for.
+    const s = madeUp(18);
+    stockYard(s, [{ type: 'coach', loaded: true }, { type: 'boxcar', loaded: false }]);
+    assert.equal(check(s, 0, place('boxcar', false)), null,
+      'a loaded coach blocked an empty boxcar');
+  });
+
+  it('exempts the caboose, which is never empty in the supply', () => {
+    const s = madeUp(18);
+    stockYard(s, [{ type: 'caboose', loaded: true }, { type: 'boxcar', loaded: true }]);
+    assert.equal(check(s, 0, place('caboose', true)), null, 'the caboose its card calls for was refused');
+  });
+
+  it('applies to the Military train too', () => {
+    const s = madeUp(19);
+    stockYard(s, [{ type: 'coach', loaded: true }, { type: 'coach', loaded: false }]);
+    assert.equal(check(s, 0, place('coach', false)), 'NO_SUITABLE_CAR',
+      'the Military train took an empty coach over a loaded one');
+  });
+
+  it('leaves trains without the rule alone', () => {
+    // X21 Freight Extra has no loading rule: an empty is as good as a loaded one.
+    const s = madeUp(21);
+    stockYard(s, [{ type: 'boxcar', loaded: true }, { type: 'boxcar', loaded: false }]);
+    assert.equal(check(s, 0, place('boxcar', false)), null,
+      'a train with no loading rule was made to prefer loaded cars');
+  });
+
+  it('REGRESSION: X13 Appleseed is empties-only, and now the rules say so too', () => {
+    /**
+     * `ConsistSpec.emptiesOnly` was declared on the card, RENDERED to the player as "(empties only)"
+     * by `web/game.ts` and `sim/view.ts`, and enforced by NOTHING — `acceptsCar` never read it. So
+     * the Appleseed could be made up with loaded cars while its own card said it could not. Found
+     * while building Gitea#13, which is the same rule pointing the other way.
+     */
+    const s = madeUp(13);
+    stockYard(s, [{ type: 'boxcar', loaded: true }, { type: 'boxcar', loaded: false }]);
+    assert.equal(check(s, 0, place('boxcar', true)), 'NO_SUITABLE_CAR',
+      'the Appleseed took a loaded car despite printing "empties only"');
+    assert.equal(check(s, 0, place('boxcar', false)), null, 'the Appleseed refused an empty');
+  });
+
+  it('still lets the Appleseed take the caboose its consist calls for', () => {
+    // Every caboose in ROLLING_STOCK_SUPPLY is minted loaded, so an unexempted empties-only rule
+    // would bar the one car the card explicitly lists.
+    const s = madeUp(13);
+    stockYard(s, [{ type: 'caboose', loaded: true }]);
+    assert.equal(check(s, 0, place('caboose', true)), null, 'the empties-only rule ate the caboose');
+  });
+});
+
 describe("a train is made up to its card's consist (§8.2)", () => {
   it('takes a caboose when the card calls for one, and refuses a fourth freight car', () => {
     // Train 9 "Heavy Freight" is freight 3 + caboose 1. It was being made up with FOUR hoppers and
@@ -731,7 +1106,11 @@ describe("a train is made up to its card's consist (§8.2)", () => {
 
 describe('regions on a Mainline card (§2.1, §8.2)', () => {
   /** Put one train mid-crossing and ask the view where the map should draw it. */
-  const regionFor = (stagesTotal: number, stagesRemaining: number): { region: number; regions: number } => {
+  const regionFor = (
+    stagesTotal: number,
+    stagesRemaining: number,
+    direction: 'east' | 'west' = 'east',
+  ): { region: number; regions: number } => {
     const s = createGame({
       id: 'reg',
       seed: 4,
@@ -744,7 +1123,7 @@ describe('regions on a Mainline card (§2.1, §8.2)', () => {
     const node = s.division.nodes.find((n) => n.kind === 'mainline');
     assert.ok(node && node.kind === 'mainline');
     const tray = [...s.trays.keys()][0]!;
-    node.transits.push({ tray, stagesRemaining, stagesTotal, direction: 'east' });
+    node.transits.push({ tray, stagesRemaining, stagesTotal, direction });
     const ml = snapshot(s, [], null).division.find((n) => n.kind === 'ml');
     assert.ok(ml, 'no Mainline node in the view');
     const t = ml!.trains.flat()[0]!;
@@ -787,6 +1166,74 @@ describe('regions on a Mainline card (§2.1, §8.2)', () => {
       }
     }
   });
+
+  it('never leaves the card it is on, whichever way it runs', () => {
+    for (const direction of ['east', 'west'] as const) {
+      for (let total = 1; total <= 4; total++) {
+        for (let left = total; left >= 1; left--) {
+          const r = regionFor(total, left, direction).region;
+          assert.ok(r >= 0 && r <= 1, `${direction}, total ${total}, ${left} left put the train in region ${r}`);
+        }
+      }
+    }
+  });
+
+  /**
+   * GITEA#22 — A WESTBOUND TRAIN WAS DRAWN IN THE WRONG HALF OF THE CARD.
+   *
+   * `regionOfTransit` answers "how far along its crossing is this train", counted from the end it
+   * ENTERED: a train with everything still to run is in region 0. That is the right question for the
+   * collision rules, which is what the engine asks it, and both directions share the one index space.
+   *
+   * The map asks a different question — WHICH PRINTED BOX, left to right — and used the same number
+   * for it. East is right on this map and always has been, so for an eastbound train the two agree by
+   * luck: it enters at the west end, so "just entered" and "leftmost box" are the same box. A
+   * westbound train enters at the EAST end, so its region 0 is the card's RIGHT-hand box, and drawing
+   * it at index 0 put it at the left — the whole card mirrored.
+   *
+   * Reported from seed 550943578, undo 187, and it cost a collision. Three westbound trains: TX17 had
+   * just entered (2 Stages still to run, so travel index 0) and T5 was nearly across (1 Stage left,
+   * index 1). Physically TX17 was BEHIND T5 — further east, the direction they had both come from.
+   * The map drew TX17 at the left and so put it further WEST, which reads as further ahead. Asked
+   * whether Train 3 could follow Train 5 onto the card, the Superintendent said yes, and Train 3
+   * entered behind — into TX17, exactly where the rules had it and nowhere near where the map did.
+   *
+   * The engine was right throughout. Only the picture lied, so the fix is one mirror in the view and
+   * the collision rules are untouched. This is the same class of bug as the consist row at the
+   * Whistle Post (`board-svg.ts`, seed 270861860), which came out mirrored for the same reason.
+   */
+  describe('Gitea#22 — the map draws a westbound train where it actually is', () => {
+    it('mirrors a westbound train, because it entered from the east end', () => {
+      // Two-region card. Just entered, 2 Stages still to run: an eastbound train is in the WEST box
+      // and a westbound one is in the EAST box, because they came in at opposite ends.
+      assert.equal(regionFor(2, 2, 'east').region, 0);
+      assert.equal(regionFor(2, 2, 'west').region, 1);
+
+      // One Stage left, nearly across: the two swap.
+      assert.equal(regionFor(2, 1, 'east').region, 1);
+      assert.equal(regionFor(2, 1, 'west').region, 0);
+    });
+
+    it('puts the follower behind the leader, not in front of it — the seed 550943578 collision', () => {
+      // TX17 had just entered; T5 was a Stage from the far end. Both westbound, so BEHIND means to
+      // the east, which is to the right, which is the higher index.
+      const tx17 = regionFor(2, 2, 'west').region;
+      const t5 = regionFor(2, 1, 'west').region;
+      assert.ok(
+        tx17 > t5,
+        `a westbound train that has just entered must be drawn east of one that is nearly across, ` +
+          `but TX17 was drawn at ${tx17} and T5 at ${t5}`,
+      );
+    });
+
+    it('leaves an eastbound train where it has always been drawn', () => {
+      // The mirror must not disturb the direction that was right, which is every existing region test
+      // above — those all run east — and the case the printed rule was written for.
+      assert.equal(regionFor(2, 2, 'east').region, 0);
+      assert.equal(regionFor(2, 1, 'east').region, 1);
+      assert.equal(regionFor(1, 1, 'east').region, 1);
+    });
+  });
 });
 
 describe('Q13 — a train that catches the one ahead runs into it', () => {
@@ -796,18 +1243,35 @@ describe('Q13 — a train that catches the one ahead runs into it', () => {
    * then region 1 — so it catches up whichever order the phase happens to process them in.
    */
   const twoTrains = (opts: { absSignals?: boolean } = {}): { s: GameState; events: GameEvent[] } => {
-    const s = createGame({
-      id: 'rear', seed: 3,
-      config: {
-        mode: 'solitaire', days: 5, minCombinedRevenue: 0, maxCollisionsPerDay: 0, maxCollisionsTotal: 0, pvpCardsAllowed: false,
-        optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
-      },
-      playerNames: ['bot'],
-    });
-    const index = s.division.nodes.findIndex(
-      (n) => n.kind === 'mainline' && !mainlineProfile(n.card).trainsMayPass,
-    );
-    assert.ok(index >= 0, 'no single-track Mainline card in this Division');
+    /**
+     * THE SEED IS SEARCHED FOR, NOT WRITTEN DOWN.
+     *
+     * This asked for seed 3 and asserted that its Division held a single-track Mainline card. It
+     * does not any more: the Division is laid out from the same RNG stream the card deck is
+     * shuffled from, so changing the SIZE of that deck re-deals the Division too. Gitea#14's deck
+     * counts moved it, and the test failed on its own precondition — "no single-track Mainline card
+     * in this Division" — which says nothing about the rule under test.
+     *
+     * The fixture needs A Division with a card trains may not pass on, not one particular one, so
+     * it now takes the first seed that provides one. That is stable across any future retune, and
+     * it fails loudly if such a Division stops being reachable at all.
+     */
+    let s!: GameState;
+    let index = -1;
+    for (let seed = 3; seed < 200 && index < 0; seed++) {
+      s = createGame({
+        id: 'rear', seed,
+        config: {
+          mode: 'solitaire', days: 5, minCombinedRevenue: 0, maxCollisionsPerDay: 0, maxCollisionsTotal: 0, pvpCardsAllowed: false,
+          optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
+        },
+        playerNames: ['bot'],
+      });
+      index = s.division.nodes.findIndex(
+        (n) => n.kind === 'mainline' && !mainlineProfile(n.card).trainsMayPass,
+      );
+    }
+    assert.ok(index >= 0, 'no seed under 200 deals a Division holding a single-track Mainline card');
     const node = s.division.nodes[index]!;
     assert.ok(node.kind === 'mainline');
     if (node.kind !== 'mainline') throw new Error('unreachable');
@@ -863,12 +1327,116 @@ describe('Q13 — a train that catches the one ahead runs into it', () => {
     );
   });
 
-  it('leaves trains alone on a card that prints "trains may pass"', () => {
-    // Double Track and Uncontrolled Siding hold two trains because they HAVE two roads. Catching up
-    // there means going past, which is what the card is for. Without this the mechanic fired 0.41
-    // times a game while the bot never once granted clearance — the tell that they were all
-    // passing cards.
+  /**
+   * ENTERING an occupied region, as opposed to catching up inside the card (Gitea#3).
+   *
+   * A card can be ONE region wide — Plains, Double Track and Trestle all are — so a following train
+   * granted clearance is in the same place as the train ahead the moment it arrives. Nothing tested
+   * that: the catch-up check lives inside `stagesRemaining > 1`, which a one-Stage crossing never
+   * reaches, so entering behind another train on a Plains was silently free.
+   */
+  const enteringBehind = (card: MainlineKind, opts: { absSignals?: boolean } = {}) => {
+    const s = game();
+    const index = s.division.nodes.findIndex((n) => n.kind === 'mainline');
+    const node = s.division.nodes[index]!;
+    assert.ok(node.kind === 'mainline');
+    if (node.kind !== 'mainline') throw new Error('unreachable');
+    node.card = card;
+    node.transits = [];
+    if (opts.absSignals) node.absSignals = true;
+
+    /**
+     * THE TRAIN ALREADY THERE IS THE JUNIOR ONE, and that is what makes the situation reachable.
+     *
+     * Trains move lowest number first, so a card's occupant normally clears before anything behind
+     * it is even considered — put train 9 on the card and train 11 at the Division Point and 9 has
+     * gone by the time 11 enters. The conflict is a SUPERIOR train catching an inferior one that has
+     * not got out of the way yet, so the numbers run the other way round here.
+     */
+    const leader = s.freeTrays.pop()!;
+    s.trays.set(leader, {
+      id: leader, trainNumber: 11, trainIsExtra: false, engineAt: 0,
+      consist: [{ type: 'boxcar', loaded: false }], direction: 'east',
+      position: { at: 'mainline', index },
+    } as never);
+    const total = crossingStages(card, { trainSpeed: 'fast', direction: 'east', gradeUp: 'east', modifiers: [] });
+    node.transits.push({ tray: leader, stagesRemaining: total, stagesTotal: total, direction: 'east' });
+
+    // And the one arriving, held at the Division Point west of it.
+    const dp = s.division.nodes[index - 1];
+    assert.ok(dp && dp.kind === 'divisionPoint', 'expected a Division Point west of the first card');
+    if (!dp || dp.kind !== 'divisionPoint') throw new Error('unreachable');
+    const follower = s.freeTrays.pop()!;
+    s.trays.set(follower, {
+      id: follower, trainNumber: 9, trainIsExtra: false, engineAt: 0,
+      consist: [{ type: 'boxcar', loaded: false }], direction: 'east',
+      position: { at: 'divisionPoint', side: dp.side },
+    } as never);
+    dp.holding.push(follower);
+
+    /**
+     * THE SUPERINTENDENT LETS IT IN, which is the whole point.
+     *
+     * A same-direction train in the Subdivision is not an absolute bar — §8.1 makes it a judgment
+     * call, and `advance` stops and asks. Granting it is what puts one train in behind another, and
+     * §10 is then explicit that the wreck is the Superintendent's fault. So the fixture answers
+     * `allow: true` whenever it is asked, and the collision below is the consequence of that
+     * ruling rather than of a rule firing on its own.
+     */
+    s.clock.phase = 'mainline';
+    const events: GameEvent[] = [];
+    for (let i = 0; i < 6; i++) {
+      events.push(...advance(s).events);
+      if (s.clock.pendingDecision !== null) {
+        const who = s.clock.superintendent;
+        const r = applyIntent(s, who, { type: 'mainline.clearance', allow: true });
+        assert.ok(r.ok, `clearance refused: ${r.ok ? '' : r.code}`);
+        events.push(...r.events);
+      }
+    }
+    return { s, node, events, follower };
+  };
+
+  it('runs a train into the one ahead when it ENTERS an occupied region', () => {
+    const { events } = enteringBehind('plains');
+    const smash = events.find((e) => e.type === 'trainsDestroyed');
+    assert.ok(smash, 'a train entered a one-region card behind another and nothing happened');
+  });
+
+  it('holds it short instead when the card carries ABS Signals', () => {
+    // RAR: "ABS. This is played on a mainline card to prevent collisions. If a collision would
+    // normally occur, the train moving onto the card is instead held back."
+    const { events } = enteringBehind('plains', { absSignals: true });
+    assert.ok(!events.some((e) => e.type === 'trainsDestroyed'), 'ABS Signals did not prevent it');
+    assert.ok(
+      events.some((e) => e.type === 'trainHeld' && /ABS Signals/.test(e.reason)),
+      'nothing was held short of the train ahead',
+    );
+  });
+
+  it('takes the siding instead of colliding on an Uncontrolled Siding', () => {
+    // "If a train already exists when you arrive, you go in the second stage back — you are in the
+    // siding and are one behind the other train. This prevents a collision, since you are not in
+    // same exact location." So: no wreck, both trains on the card, and the newcomer paying the
+    // extra Stage for the detour.
+    const { node, events, follower } = enteringBehind('uncontrolledSiding');
+    assert.ok(!events.some((e) => e.type === 'trainsDestroyed'), 'the siding did not prevent a collision');
+    const mine = node.transits.find((t) => t.tray === follower);
+    assert.ok(mine, 'the arriving train never made it onto the card');
+    assert.equal(mine.stagesTotal, 2, 'it should have entered at the back of the card, not the front');
+  });
+
+  it('leaves trains alone on the one card that prints "trains may pass"', () => {
+    // Double Track holds two trains because it HAS two roads. Catching up there means going past,
+    // which is what the card is for.
+    //
+    // THE UNCONTROLLED SIDING USED TO BE IN THIS LIST AND IS NOT ANY MORE (Gitea#3). It holds two
+    // trains as well, but not by letting them share a place: the second one takes the siding and
+    // sits a region behind, which is what keeps them apart — "you are in the siding and are one
+    // behind the other train. This prevents a collision, since you are not in same exact location."
+    // Marked "may pass" it skipped the collision test entirely, so the siding did nothing at all and
+    // two trains could occupy the same region of it unchallenged.
     const passing = MAINLINE_PROFILES.filter((m) => m.trainsMayPass).map((m) => m.kind);
-    assert.deepEqual(passing, ['doubleTrack', 'uncontrolledSiding']);
+    assert.deepEqual(passing, ['doubleTrack']);
   });
 });

test/markdown.test.ts

@@ -0,0 +1,128 @@
+/**
+ * The documentation renderer.
+ *
+ * The five player-facing documents are written in Markdown — that is the one copy, and the whole
+ * reason TODO #15a exists — and rendered to pages at build time. This covers the subset those
+ * documents actually use, and the two properties that matter most: a table comes out as a TABLE
+ * (the entire point of rendering rather than serving text), and nothing in the prose can become
+ * markup by accident.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { renderMarkdown } from '../scripts/markdown.ts';
+
+const html = (src: string): string => renderMarkdown(src).html;
+
+describe('the documentation renderer', () => {
+  it('turns a pipe table into a real table, with its alignment', () => {
+    // This is what rendering is FOR. A card reference is mostly tables, and as plain text a table
+    // is rows of pipes — which is exactly how the guide read when it was served as text/plain.
+    const out = html(
+      ['| Card | Regions | Passes |', '| --- | ---: | :---: |', '| Plains | 1 | no |', '| Tunnel | 2 | yes |'].join('\n'),
+    );
+    assert.match(out, /<table>/, 'the table is not a table');
+    assert.match(out, /<thead><tr><th>Card<\/th>/, 'the header row is not a header');
+    assert.match(out, /<th class="ta-right">Regions<\/th>/, 'a right-aligned column lost its alignment');
+    assert.match(out, /<th class="ta-center">Passes<\/th>/, 'a centred column lost its alignment');
+    assert.match(out, /<td>Plains<\/td><td class="ta-right">1<\/td>/, 'a body row lost its cells');
+    assert.equal((out.match(/<tr>/g) ?? []).length, 3, 'wrong number of rows');
+    // Wrapped, so a wide table scrolls inside the page instead of widening it on a phone.
+    assert.match(out, /<div class="tablewrap">/, 'the table can widen the page on a narrow screen');
+  });
+
+  it('gives every heading an id and an anchor, numbered prefixes stripped', () => {
+    const { html: out, headings } = renderMarkdown('## 4.2 Local Operations\n\ntext\n');
+    assert.deepEqual(headings, [{ level: 2, text: '4.2 Local Operations', id: 'local-operations' }]);
+    assert.match(out, /<h2 id="local-operations">/, 'the heading has no id to link to');
+    assert.match(out, /<a class="anchor" href="#local-operations"/, 'the heading has no anchor');
+  });
+
+  it('numbers a repeated heading rather than pointing two links at one place', () => {
+    const { headings } = renderMarkdown('## Trains\n\na\n\n## Trains\n\nb\n');
+    assert.deepEqual(headings.map((h) => h.id), ['trains', 'trains-2']);
+  });
+
+  it('renders lists, quotes, rules and fenced code', () => {
+    assert.match(html('- one\n- two\n'), /<ul><li>one<\/li><li>two<\/li><\/ul>/);
+    assert.match(html('1. first\n2. second\n'), /<ol><li>first<\/li><li>second<\/li><\/ol>/);
+    assert.match(html('> a note\n> continued\n'), /<blockquote><p>a note continued<\/p><\/blockquote>/);
+    assert.match(html('---\n'), /<hr>/);
+    assert.match(html('```\nconst x = 1;\n```\n'), /<pre><code>const x = 1;<\/code><\/pre>/);
+  });
+
+  it('renders a table inside a block quote', () => {
+    // The rules reference puts one there, so this is not hypothetical.
+    const out = html('> | A | B |\n> | --- | --- |\n> | 1 | 2 |\n');
+    assert.match(out, /<blockquote><div class="tablewrap"><table>/, 'a quoted table did not render');
+  });
+
+  it('handles bold, italic and code spans, and leaves markup inside code alone', () => {
+    assert.match(html('**loud** and *quiet*\n'), /<strong>loud<\/strong> and <em>quiet<\/em>/);
+    // `**` inside backticks is a literal, which matters: the docs quote field names that way.
+    assert.match(html('`**not bold**`\n'), /<code>\*\*not bold\*\*<\/code>/);
+    assert.ok(!/<strong>/.test(html('`**not bold**`\n')), 'markup inside a code span was rendered');
+  });
+
+  it('escapes everything, so prose can never become markup', () => {
+    const out = html('A < B & C > D, and "quoted".\n');
+    assert.match(out, /A &lt; B &amp; C &gt; D/, 'angle brackets or ampersands reached the page raw');
+    assert.ok(!/<script/i.test(html('<script>alert(1)</script>\n')), 'raw HTML passed through');
+    assert.match(html('<script>alert(1)</script>\n'), /&lt;script&gt;/, 'raw HTML was not escaped');
+  });
+
+  it('rewrites links between documents, and opens external ones in a new tab', () => {
+    const out = renderMarkdown(
+      '[Rules](rules.md) and [anchor](rules.md#draw) and [site](https://example.com)\n',
+      (href) => (/^https?:/.test(href) ? href : href.replace(/\.md(#|$)/, '.html$1')),
+    ).html;
+    assert.match(out, /<a href="rules\.html">Rules<\/a>/, 'a link between documents still points at the Markdown');
+    assert.match(out, /<a href="rules\.html#draw">/, 'an anchored link lost its fragment');
+    assert.match(out, /<a href="https:\/\/example\.com" target="_blank" rel="noopener">/, 'an external link is not safe');
+  });
+
+  it('drops HTML comments, so the generated-card markers never show', () => {
+    // `build-card-reference.ts` writes its tables between `<!-- BEGIN CARDS: … -->` markers.
+    const out = html('before\n\n<!-- BEGIN CARDS: track -->\n| A |\n| --- |\n| 1 |\n<!-- END CARDS: track -->\n\nafter\n');
+    assert.ok(!/BEGIN CARDS/.test(out), 'a build marker is visible on the page');
+    assert.match(out, /<table>/, 'the generated table inside the markers was lost with them');
+    assert.match(out, /before/, 'content before the markers was lost');
+    assert.match(out, /after/, 'content after the markers was lost');
+  });
+
+  it('renders each real document without losing its tables or headings', () => {
+    // The documents themselves, not a fixture: what has to render is what is actually written.
+    for (const name of ['quickstart', 'rules', 'home-deck', 'mainline-deck', 'components']) {
+      const src = readFileSync(join(import.meta.dirname, '..', 'docs', `${name}.md`), 'utf8');
+      const { html: out, headings } = renderMarkdown(src);
+      assert.ok(headings.length > 2, `${name}.md rendered only ${headings.length} headings`);
+      assert.ok(out.length > 1000, `${name}.md rendered almost nothing`);
+      // No pipe table survives as text — that would mean a table failed to parse.
+      const stripped = out.replace(/<[^>]+>/g, '');
+      assert.ok(
+        !/^\s*\|\s*---/m.test(stripped),
+        `${name}.md has a table the renderer did not recognise`,
+      );
+      assert.ok(!/BEGIN CARDS/.test(out), `${name}.md leaked a build marker onto the page`);
+    }
+  });
+
+  it('nests a more-indented bullet as a list inside its item (v0.8.4)', () => {
+    /**
+     * The code said "nesting is rendered by recursion" and appended the nested bullet to the parent
+     * as text, so the published home-deck page read "…knows. - ABS Signals is the exception…" with
+     * a literal dash mid-sentence.
+     */
+    const out = html(['- parent', '  continues here.', '  - child one', '    wraps too', '  - child two', '- second'].join('\n'));
+    assert.equal(
+      out.trim(),
+      '<ul><li>parent continues here.<ul><li>child one wraps too</li><li>child two</li></ul></li><li>second</li></ul>',
+    );
+    assert.doesNotMatch(html(readFileSync(join(import.meta.dirname, '..', 'docs', 'home-deck.md'), 'utf8')), /\. - <strong>/);
+  });
+});
+

test/multiplayer.test.ts

@@ -11,11 +11,12 @@ import { describe, it } from 'node:test';
 import assert from 'node:assert/strict';
 
 import { advance, pump } from '../src/engine/advance.ts';
-import { applyIntent, areaAtSeat, areaOf } from '../src/engine/apply.ts';
+import { applyIntent, areaAtSeat, areaOf, check, occupancyFor } from '../src/engine/apply.ts';
 import { STAGES_PER_DAY, STAGES_PER_SHIFT, crewTrayCount } from '../src/engine/content.ts';
 import { createGame } from '../src/engine/setup.ts';
+import { legalActions } from '../src/engine/legal.ts';
 import type { GameConfig, GameState, PlayerIndex } from '../src/engine/state.ts';
-import { coordKey, playerAtSeat, playerLeftOf, seatOf, subdivisions } from '../src/engine/state.ts';
+import { coordKey, playerAtSeat, playerLeftOf, seatOf, subdivisions, turnOf } from '../src/engine/state.ts';
 import { developerBot, playGame } from '../src/sim/bot.ts';
 import { snapshot } from '../src/sim/view.ts';
 import { divisionSvg } from '../src/sim/board-svg.ts';
@@ -23,12 +24,13 @@ import { impediments, narrate } from '../src/sim/narrate.ts';
 import { readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { actionMenu } from '../src/web/game.ts';
+import { newCollector } from '../src/sim/display-step.ts';
 import type { Game } from '../src/web/game.ts';
 
 /** The thin wrapper `actionMenu` expects, built directly around an already-created multi-player state
  * — `newGame` (game.ts) hardcodes one player, so it cannot construct this for a multi-seat game. */
 const wrap = (s: GameState): Game =>
-  ({ state: s, seed: s.seed, history: [], log: [], mustPlayCard: false, cues: [], scheduled: null, justDrawn: null, announced: null });
+  ({ state: s, seed: s.seed, history: [], log: [], cues: [], scheduled: null, justDrawn: null, announced: null, display: newCollector() });
 
 const competitive: GameConfig = {
   mode: 'competitive',
@@ -37,6 +39,10 @@ const competitive: GameConfig = {
   maxCollisionsPerDay: 0,
   maxCollisionsTotal: 0,
   pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
   optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
 };
 
@@ -626,14 +632,16 @@ describe('the New Train phase car-placement round rotates (§7, Gap 9)', () => {
    * `tray.consist.length` instead, which is already exactly that counter and resets per train.
    */
   it('cycles Superintendent-then-left, one car per player, wrapping as the round repeats', () => {
-    // Train 1, "Crack Limited" — 3 coaches, no freight or caboose (content.ts) — small enough to
+    // Train 5, "The Sparrow" — 3 coaches, no freight or caboose (content.ts) — small enough to
     // exercise both a player count that wraps (2p: seats 0,1,0) and one that doesn't (3p: 0,1,2).
+    // It was Train 1 until Gitea#7 swapped the coach counts on 1/2 and 5/6; the test needs a
+    // THREE-car consist and the Crack Limited now carries two, so it follows the three coaches.
     for (const players of [2, 3]) {
       const s = game(players);
       s.clock.phase = 'newTrain';
       s.trays.set('t1', {
         id: 't1',
-        trainNumber: 1,
+        trainNumber: 5,
         trainIsExtra: false,
         engineAt: 0,
         consist: [],
@@ -673,6 +681,105 @@ describe('the New Train phase car-placement round rotates (§7, Gap 9)', () => {
   });
 });
 
+describe('an Extra belongs to the player who played it (§7)', () => {
+  /**
+   * REPORTED BY JESSE 2026-08-23, from a two-player game on StartOS: one seat played a train card
+   * and the OTHER was asked to build the train. For a Timetabled train that is correct — the round
+   * above starts at the Superintendent — but §7 states the Extra rule a paragraph later and it is
+   * the opposite one: "the player who played the card may place the Crew Tray at either Division
+   * Point ... and may load the consist as he chooses."
+   *
+   * The engine could not honour it: `pendingExtras` was a bare `number[]`, so nothing recorded whose
+   * Extra it was and the phase asked whoever the acting order happened to be on. Invisible in
+   * solitaire, where that is always the same person.
+   */
+  const withPendingExtra = (players: number, owner: PlayerIndex) => {
+    const s = game(players);
+    s.clock.phase = 'newTrain';
+    s.timetable = s.timetable.map(() => null);
+    // X22 "Pee-Dee" — a caboose-only Extra, so the consist is short and the round would be visible.
+    s.pendingExtras = [{ trainNumber: 22, player: owner }];
+    return s;
+  };
+
+  it('asks the player who played it where it starts — not whoever the round is on', () => {
+    // The owner is deliberately NOT the Superintendent, which is the case that used to go wrong.
+    const s = withPendingExtra(2, 1 as PlayerIndex);
+    const notSuper = playerLeftOf(s, s.clock.superintendent, 1);
+    s.pendingExtras = [{ trainNumber: 22, player: notSuper }];
+
+    const r = advance(s);
+    assert.equal(r.needsInput, true, 'the phase did not stop to place the Extra');
+    assert.equal(s.clock.currentActor, notSuper, 'the wrong player was asked where the Extra starts');
+  });
+
+  it('refuses another seat placing it, and offers it to nobody else', () => {
+    const s = withPendingExtra(2, 0 as PlayerIndex);
+    const intent = {
+      type: 'newTrain.startExtra' as const,
+      trainNumber: 22,
+      start: { kind: 'divisionPoint' as const, side: 'west' as const },
+    };
+    const theirs = applyIntent(s, 0 as PlayerIndex, intent);
+    assert.ok(theirs.ok, `the owner could not place their own Extra — ${theirs.ok ? '' : theirs.code}`);
+
+    /**
+     * TWO EXTRAS, TWO OWNERS — the case where the guard is actually reachable. The phase stops on
+     * the first pending Extra's owner, so seat 0 is legitimately the current actor; nothing but this
+     * rule stops them placing seat 1's train while they are there.
+     */
+    const both = withPendingExtra(2, 0 as PlayerIndex);
+    both.pendingExtras = [
+      { trainNumber: 22, player: 0 as PlayerIndex },
+      { trainNumber: 24, player: 1 as PlayerIndex },
+    ];
+    advance(both);
+    assert.equal(both.clock.currentActor, 0, 'the first pending Extra should have stopped on its owner');
+    assert.equal(check(both, 0 as PlayerIndex, { ...intent, trainNumber: 24 }), 'NOT_YOUR_EXTRA');
+    const notTheirs = applyIntent(both, 0 as PlayerIndex, { ...intent, trainNumber: 24 });
+    assert.equal(notTheirs.ok, false, 'a seat placed somebody else’s Extra while it was their turn');
+    // And it is not even offered: a menu that lists an action `check` will refuse is a menu lying.
+    assert.equal(
+      legalActions(both, 0 as PlayerIndex).some(
+        (i) => i.type === 'newTrain.startExtra' && i.trainNumber === 24,
+      ),
+      false,
+      'somebody else’s Extra was offered a start point',
+    );
+  });
+
+  it('lets its player load the whole consist, rather than passing the round', () => {
+    // §7: "may load the consist as he chooses" — no going round the table for an Extra.
+    const s = withPendingExtra(2, 0 as PlayerIndex);
+    const owner = 0 as PlayerIndex;
+    const placed = applyIntent(s, owner, {
+      type: 'newTrain.startExtra',
+      trainNumber: 22,
+      start: { kind: 'divisionPoint', side: 'west' },
+    });
+    assert.ok(placed.ok, 'the Extra could not be placed');
+    s.yards.divisionYard.push({ type: 'caboose', loaded: false }, { type: 'caboose', loaded: false });
+
+    const asked: PlayerIndex[] = [];
+    for (let guard = 0; guard < 4; guard++) {
+      const r = advance(s);
+      if (!r.needsInput) break;
+      const actor = s.clock.currentActor!;
+      asked.push(actor);
+      const tray = [...s.trays.values()].find((t) => t.trainIsExtra);
+      assert.ok(tray, 'the Extra has no tray');
+      const result = applyIntent(s, actor, { type: 'newTrain.passCar', trayId: tray.id });
+      if (!result.ok) break;
+    }
+    assert.ok(asked.length > 0, 'nobody was asked to load the Extra');
+    assert.deepEqual(
+      [...new Set(asked)],
+      [owner],
+      `the Extra's consist went round the table (asked ${asked.join(', ')}) instead of staying with its player`,
+    );
+  });
+});
+
 describe('actionMenu is seat-safe (Phase 2 prep)', () => {
   /**
    * REGRESSION. `actionMenu(game, seat)` used `seat` only for the `hand` field — `options`/`direct`/
@@ -872,3 +979,74 @@ describe('Employee Rotation (Appendix B)', () => {
     for (const name of ['Alice', 'Bob', 'Carol']) assert.match(line, new RegExp(name));
   });
 });
+
+// ---------------------------------------------------------------------------
+// v0.8.3 — audit findings (2026-09-29): a player's switching stays in their own district
+// ---------------------------------------------------------------------------
+
+describe("switching is confined to the actor's own district (v0.8.3)", () => {
+  /**
+   * `check` resolved the tray with no seat test at all: the legal-move GENERATOR filtered trays by
+   * seat, `check` did not, and the server validates with `check` alone. Every district opens on the
+   * same coordinates, so a destination legal for a tray of your own at (0,0) was "legal" for a
+   * rival's tray at THEIR (0,0) — and `trayMoved` then charged the Moves to the rival.
+   */
+  const placeOwn = (s: GameState, owner: PlayerIndex, id: string): void => {
+    const area = areaOf(s, owner);
+    s.trays.set(id, {
+      id, trainNumber: null, trainIsExtra: false, engineAt: 0, consist: [],
+      direction: 'east', position: { at: 'grid', seat: seatOf(s, owner), coord: area.officeCoord }, movesUsed: 0,
+    });
+  };
+  const switching = (s: GameState, player: PlayerIndex): void => {
+    s.clock.phase = 'localOps';
+    s.clock.currentActor = player;
+    applyIntent(s, player, { type: 'localOps.choose', option: 'switch' });
+    assert.equal(turnOf(s, player).option, 'switch', 'could not choose Switch');
+  };
+
+  it("refuses a switch.move on a rival's tray that would have been legal on your own", () => {
+    const s = game(2);
+    // Find a move the actor could make with a tray of THEIR OWN standing at the Office.
+    placeOwn(s, 0, 'mine');
+    switching(s, 0);
+    const own = legalActions(s, 0).find((i) => i.type === 'switch.move' && i.trayId === 'mine');
+    assert.ok(own && own.type === 'switch.move', 'no switching move to test with');
+    s.trays.delete('mine');
+    // Now the same move named against seat 1's tray, standing at seat 1's Office.
+    placeOwn(s, 1, 'theirs');
+    const movesBefore = turnOf(s, 0).movesRemaining;
+    const theirMovesBefore = turnOf(s, 1).movesRemaining;
+    const code = check(s, 0, { ...own, trayId: 'theirs' });
+    assert.equal(code, 'NO_SUCH_TRAY', `a rival's tray was accepted (${code ?? 'null'})`);
+    assert.ok(!applyIntent(s, 0, { ...own, trayId: 'theirs' }).ok, 'the move was applied');
+    assert.equal(turnOf(s, 0).movesRemaining, movesBefore);
+    assert.equal(turnOf(s, 1).movesRemaining, theirMovesBefore, "the rival's Moves were charged");
+    assert.deepEqual(s.trays.get('theirs')!.position, { at: 'grid', seat: seatOf(s, 1), coord: areaOf(s, 1).officeCoord });
+  });
+
+  it("refuses dropCars and sortConsist on a rival's tray too", () => {
+    const s = game(2);
+    placeOwn(s, 0, 'mine'); // Switch is only on offer with a tray of your own to switch
+    placeOwn(s, 1, 'theirs');
+    s.trays.get('theirs')!.consist.push({ type: 'boxcar', loaded: false });
+    switching(s, 0);
+    assert.equal(check(s, 0, { type: 'switch.dropCars', trayId: 'theirs', count: 1 }), 'NO_SUCH_TRAY');
+    assert.equal(check(s, 0, { type: 'switch.sortConsist', trayId: 'theirs', order: [0] }), 'NO_SUCH_TRAY');
+  });
+
+  it("does not see a rival's crew as standing in your district", () => {
+    /**
+     * `occupancyFor().trayAt` matched on coordinates alone, so a crew at seat 0's (0,2) blocked
+     * seat 1's (0,2) as "another train standing here". Invisible in solitaire.
+     */
+    const s = game(2);
+    const spot = { row: areaOf(s, 0).officeCoord.row, col: areaOf(s, 0).officeCoord.col + 2 };
+    s.trays.set('crew0', {
+      id: 'crew0', trainNumber: null, trainIsExtra: false, engineAt: 0, consist: [],
+      direction: 'east', position: { at: 'grid', seat: seatOf(s, 0), coord: spot }, movesUsed: 0,
+    });
+    assert.equal(occupancyFor(s, 0, 'other').trayAt(spot), 'crew0', 'the owner cannot see their own crew');
+    assert.equal(occupancyFor(s, 1, 'other').trayAt(spot), null, "a rival's crew is standing in the wrong district");
+  });
+});

test/pacing.test.ts

@@ -0,0 +1,244 @@
+/**
+ * DWELL BY KIND — v0.8.0, `docs/plans/jitsi-common-board.md` § v0.8.0 § 5.
+ *
+ * The classification is exhaustive over `Intent['type']` at COMPILE time: `kindOf` declares a
+ * `StepKind` return and has no `default`, so a new intent breaks the build rather than landing
+ * silently in a fallback tier. These tests add the part the compiler cannot do — they read the
+ * intent union out of the source, so the guard survives someone later adding a `default:` that
+ * would swallow the very thing the exhaustiveness was protecting.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { DWELL, MAX_PACE, PACE_LEVELS, dwellFor, dwellForStep, kindOf, watchableCount } from '../src/sim/pacing.ts';
+import type { StepKind } from '../src/sim/pacing.ts';
+import type { Intent } from '../src/engine/intents.ts';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+/** Every `type: '…'` literal in the Intent union, read from the source rather than hand-listed. */
+function declaredIntents(): string[] {
+  const src = readFileSync(join(root, 'src/engine/intents.ts'), 'utf8');
+  return [...new Set([...src.matchAll(/type: '([a-zA-Z.]+)'/g)].map((m) => m[1]!))].sort();
+}
+
+const KINDS: StepKind[] = ['switching', 'action', 'phase', 'bookkeeping'];
+
+describe('pacing — dwell by kind', () => {
+  it('classifies every intent the engine declares', () => {
+    const declared = declaredIntents();
+    assert.ok(declared.length > 25, `only found ${declared.length} intents — the parse is wrong`);
+    for (const intent of declared) {
+      const kind = kindOf(intent as Intent['type']);
+      assert.ok(
+        KINDS.includes(kind),
+        `${intent} classified as "${kind}", which is not a StepKind — a default case has crept in`,
+      );
+    }
+  });
+
+  it('protects switching and collapses bookkeeping', () => {
+    // The two ends of the measured argument: a switching move is the thing worth watching, and
+    // `*.end` bookkeeping is over half of a real game's intents.
+    assert.equal(kindOf('switch.move'), 'switching');
+    assert.equal(kindOf('switch.dropCars'), 'switching');
+    assert.equal(kindOf('switch.sortConsist'), 'switching');
+    assert.equal(kindOf('draw.end'), 'bookkeeping');
+    assert.equal(kindOf('loadUnload.end'), 'bookkeeping');
+    assert.equal(kindOf('switch.end'), 'bookkeeping');
+    /**
+     * `localOps.choose` IS AN ANNOUNCEMENT, not bookkeeping — moved 2026-09-09 after the first real
+     * play on the test server. It is the line reading "Player Bot 1 chose to SWITCH", the heading for
+     * everything that follows, and at zero dwell a bot's turn began with no sign of what it was about
+     * to do.
+     */
+    assert.equal(kindOf('localOps.choose'), 'action');
+
+    assert.ok(DWELL.switching > DWELL.action, 'switching must outrank an ordinary action');
+    assert.equal(DWELL.bookkeeping, 0, 'bookkeeping must cost the player no time at all');
+  });
+
+  it('starts switching at a full second, per the 2026-09-09 decision', () => {
+    // Jesse: "start at 1s and tune down". Pinned so a later tune is a deliberate edit rather than
+    // a drift, and so the number in the plan and the number in the code cannot disagree.
+    assert.equal(DWELL.switching, 1000);
+    assert.equal(dwellFor('switch.move'), 1000);
+  });
+
+  it('supports multipliers above 1, and keeps the tiers in proportion at every speed', () => {
+    /**
+     * Jesse, 2026-09-09, after the first play: keep switching and ordinary actions at DIFFERENT
+     * delays, and support 2.0 and 3.0 as well as 1.5. So this pins both halves — that the larger
+     * multipliers work at all, and that scaling never flattens the tiers into each other, since the
+     * relative weighting is the design and the multiplier is only how fast it runs.
+     */
+    for (const pace of [0.5, 1, 1.5, 2, 3]) {
+      assert.equal(dwellFor('switch.move', pace), Math.round(DWELL.switching * pace));
+      assert.equal(dwellFor('card.play', pace), Math.round(DWELL.action * pace));
+      assert.ok(
+        dwellFor('switch.move', pace) > dwellFor('card.play', pace),
+        `at ${pace}x a switching move no longer outlasts an ordinary action`,
+      );
+      assert.equal(dwellFor('draw.end', pace), 0, 'bookkeeping stays free at every speed');
+    }
+    // A whole switching exercise at 3x is slow on purpose, and still not absurd.
+    assert.equal(dwellFor('switch.move', 3) * 6, 18_000);
+
+    // And a typo cannot freeze the board: ?pace=300 from somebody meaning 3.00.
+    assert.equal(dwellFor('switch.move', 300), DWELL.switching * MAX_PACE);
+    assert.equal(dwellFor('switch.move', MAX_PACE + 5), dwellFor('switch.move', MAX_PACE));
+  });
+
+  it('scales with the viewer\'s pace, and 0 turns it off', () => {
+    assert.equal(dwellFor('switch.move', 1), 1000);
+    assert.equal(dwellFor('switch.move', 0.5), 500);
+    assert.equal(dwellFor('switch.move', 2), 2000);
+    // TODO #18's "a player who has seen it a hundred times will want it off" — no second mechanism.
+    for (const intent of declaredIntents()) {
+      assert.equal(dwellFor(intent as Intent['type'], 0), 0, `${intent} still dwells at pace 0`);
+    }
+    // A negative pace is a corrupt preference, not a request to run time backwards.
+    assert.equal(dwellFor('switch.move', -3), 0);
+  });
+
+  it('counts only the steps a player will actually watch', () => {
+    /**
+     * The counter's whole point. A backlog of 17 where 12 are bookkeeping must read "5", not "17"
+     * followed by an instant plummet to 5 — the countdown is meant to be steady enough to decide
+     * whether to press Skip.
+     */
+    const queue: Intent['type'][] = [
+      ...Array<Intent['type']>(12).fill('draw.end'),
+      ...Array<Intent['type']>(5).fill('switch.move'),
+    ];
+    assert.equal(queue.length, 17);
+    assert.equal(watchableCount(queue), 5);
+    assert.equal(watchableCount(queue, 0), 0, 'with animation off, nothing is behind');
+  });
+
+  it('offers speeds a player actually reached for, and none the code would clamp', () => {
+    /**
+     * Jesse played a whole game believing he was at 7× and was in fact at 1×: `?pace=` shipped as the
+     * only lever, and `index.html`'s doors are `play.html?lobby` / `play.html?solitaire`, so arriving
+     * from the splash REPLACES the query string. Hence a real control on the play screen, and hence
+     * this ladder — which must reach the speeds people ask for and must not offer one that
+     * `dwellFor` would silently clamp.
+     */
+    assert.equal(PACE_LEVELS[0], 0, 'off must be the first rung — #18 wants it turned off');
+    assert.ok(PACE_LEVELS.includes(1), 'the default must be on the ladder');
+    assert.ok(PACE_LEVELS.includes(7), '7x was asked for by name');
+    /**
+     * The ceiling is not theoretical. Jesse played at 10× — the top of the ladder as it then was —
+     * and called it "still a bit fast, but followable", so the ladder has to go past the speed
+     * somebody actually reached for and found insufficient.
+     */
+    assert.ok(PACE_LEVELS.some((p) => p > 10), 'the ladder must go beyond the speed that was too fast');
+    for (const p of PACE_LEVELS) {
+      assert.ok(p <= MAX_PACE, `${p}x is past MAX_PACE, so the control would lie about it`);
+      assert.equal(dwellFor('switch.move', p), Math.round(DWELL.switching * p));
+    }
+    // Strictly increasing, so stepping the control always changes the speed.
+    for (let i = 1; i < PACE_LEVELS.length; i++) {
+      assert.ok(PACE_LEVELS[i]! > PACE_LEVELS[i - 1]!, 'the ladder must be strictly increasing');
+    }
+    // The slowest rung has to be slow enough to be worth having: six switching moves at the top of
+    // the ladder is a full minute, which is the "watch them struggle" case.
+    const slowest = dwellFor('switch.move', PACE_LEVELS[PACE_LEVELS.length - 1]!) * 6;
+    assert.ok(slowest >= 60_000, `the slowest a switching turn can be watched is ${slowest}ms`);
+  });
+
+  it('a silent step beats only when the clock turns over — TODO #18', () => {
+    /**
+     * Both obvious rules were wrong, so both are pinned. "No narration, no dwell" flashed past
+     * phases that moved trains without saying so, killing the very thing #18 asks for. "Anything
+     * that changed the board" beat on every turn hand-off — `submit()` steps `advance()` about 4.6
+     * times per intent — which came to a quarter of an hour a game.
+     */
+    const silent = { cause: 'phase' as const, player: null, lines: [] as string[] };
+    assert.equal(dwellForStep({ ...silent, frame: { table: { actor: 2 } } }), 0, 'a turn hand-off shows nothing');
+    assert.equal(dwellForStep({ ...silent, frame: { table: {} } }), 0, 'a step that changed nothing shows nothing');
+    assert.equal(dwellForStep({ ...silent, frame: { table: { phase: 'mainline' } } }), DWELL.phase);
+    assert.equal(dwellForStep({ ...silent, frame: { table: { stage: 4 } } }), DWELL.phase);
+    // Narration always earns the dwell of whatever caused it, clock or no clock.
+    assert.equal(
+      dwellForStep({ cause: 'switch.move', player: 1, lines: ['moved'], frame: { table: {} } }),
+      DWELL.switching,
+    );
+  });
+
+  it('the speed control stretches the clock at a THIRD of the rate it stretches people', () => {
+    /**
+     * Two complaints, one from each direction, and the answer is between them.
+     *
+     * v0.8.0.3, from a 5× game: *"after my turn … I'm still subject to that same delay before it
+     * moves on. That makes no sense."* — phases were scaling with everything else and walling off a
+     * player's own turn. So they were pinned at their tabled beat.
+     *
+     * v0.8.0.7, from a 10× game: *"phases displayed on the upper line go by too quickly still.
+     * Should be 4 times as long — at a guess."* — pinned was too short to read the caption.
+     *
+     * Damped scaling satisfies both: 1× unchanged, 10× lands exactly on the four-times guess, and
+     * the cost stays bounded because phase beats cluster rather than accumulate.
+     */
+    const phase = { cause: 'phase' as const, player: null, lines: ['New Train'], frame: { table: { phase: 'newTrain' } } };
+    const theirs = { cause: 'switch.move' as const, player: 1, lines: ['moved'], frame: { table: {} } };
+
+    assert.equal(dwellForStep(phase, 1), DWELL.phase, '1x must be exactly the tabled beat');
+    assert.equal(dwellForStep(phase, 10), DWELL.phase * 4, '10x must be four times it, as asked for');
+
+    for (const pace of [2, 3, 5, 7, 10, 15, 20]) {
+      const p = dwellForStep(phase, pace);
+      const t = dwellForStep(theirs, pace);
+      assert.ok(p > DWELL.phase, `a phase must grow at ${pace}x`);
+      assert.ok(
+        p < DWELL.phase * pace,
+        `a phase must grow SLOWER than the multiplier at ${pace}x, or the clock walls off the turn`,
+      );
+      assert.ok(t > p, `somebody's move must still outlast a phase beat at ${pace}x`);
+    }
+    // Off still means off, for the clock as much as for anybody's move; and below 1x the clock
+    // follows the multiplier straight, because "faster" should mean everything.
+    assert.equal(dwellForStep(phase, 0), 0);
+    assert.equal(dwellForStep(theirs, 0), 0);
+    assert.equal(dwellForStep(phase, 0.5), DWELL.phase * 0.5);
+  });
+
+  it('a real switching turn is watchable in a few seconds, not tens of them', () => {
+    // Six moves is the engine's cap per crew ("N of 6 Moves left"), so this is the worst ordinary
+    // case for one crew: the announcement, six moves, and an end that shows nothing.
+    const turn: Intent['type'][] = [
+      'localOps.choose',
+      ...Array<Intent['type']>(6).fill('switch.move'),
+      'switch.end',
+    ];
+    const total = turn.reduce((ms, i) => ms + dwellFor(i), 0);
+    assert.equal(total, DWELL.action + 6 * DWELL.switching);
+    assert.ok(total > 5_000 && total < 10_000, `a switching turn takes ${total}ms to watch`);
+    assert.equal(watchableCount(turn), 7, 'the six moves and the announcement; not the end');
+  });
+
+  it("a bot's ordinary turn is followable, which is what the first real play was not", () => {
+    /**
+     * MEASURED FROM A REAL GAME, then pinned. Jesse, after installing v0.8.0 on the test server:
+     * *"bot play was way too fast. I briefly saw that it was the bot's office area then their turn
+     * was done."* This is the shape that turn actually had — no switching in it at all, because
+     * switching is not legal until there is track down — and under the original values it came to
+     * 750ms for the whole thing.
+     */
+    const turn: Intent['type'][] = [
+      'localOps.choose',
+      'draw.fromHomeOffice',
+      'card.play',
+      'draw.end',
+      'localOps.choose',
+      'freightAgent.stockOutbound',
+    ];
+    const total = turn.reduce((ms, i) => ms + dwellFor(i), 0);
+    assert.ok(total >= 3_000, `an ordinary bot turn is only ${total}ms — too fast to follow`);
+    assert.equal(watchableCount(turn), 5, 'only the turn-ending bookkeeping is free');
+  });
+});

test/presets.test.ts

@@ -0,0 +1,182 @@
+/**
+ * The four game types (`src/web/presets.ts`) — Jesse's design, 2026-08-23.
+ *
+ * These numbers are a DESIGN, not an implementation detail: they say what Co-op asks of a table and
+ * what Cutthroat refuses to. Pinned here so that changing one is a decision somebody makes on
+ * purpose rather than something a refactor can do quietly.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import {
+  PRESETS,
+  closestPreset,
+  configFromPreset,
+  configFromSettings,
+  differencesFrom,
+  gameTypeLabel,
+  preset,
+  presetOf,
+  presetSettings,
+  settingsOf,
+} from '../src/web/presets.ts';
+import type { PresetName } from '../src/web/presets.ts';
+
+const NAMES: PresetName[] = ['solitaire', 'coop', 'competitive', 'cutthroat'];
+
+describe('what each game type is', () => {
+  it('deals six cards in every type — the hand limit is three, so the first turn is a discard', () => {
+    for (const name of NAMES) {
+      assert.equal(presetSettings(name, 4, 5).startingHand, 'sixRandom', `${name} does not deal six`);
+    }
+  });
+
+  it('scores Cutthroat as Competitive, and Co-op as itself', () => {
+    assert.equal(preset('cutthroat').scoring, 'competitive');
+    assert.equal(preset('competitive').scoring, 'competitive');
+    assert.equal(preset('coop').scoring, 'coop');
+    assert.equal(preset('solitaire').scoring, 'solitaire');
+  });
+
+  it('lets the opponent-directed cards into Competitive and Cutthroat only', () => {
+    // Co-op has no opponent to point them at; solitaire has nobody at all. Inert either way until
+    // the cards are built (`setup.ts`), which is why no screen offers this as a control any more.
+    assert.deepEqual(
+      PRESETS.filter((p) => p.pvpCards).map((p) => p.name),
+      ['competitive', 'cutthroat'],
+    );
+  });
+
+  it('pays for a transit in Co-op alone — the one economy that pays everybody at once', () => {
+    assert.equal(presetSettings('coop', 4, 5).trainPerTransit, 1);
+    for (const name of ['solitaire', 'competitive', 'cutthroat'] as PresetName[]) {
+      assert.equal(presetSettings(name, 4, 5).trainPerTransit, 0, `${name} pays for transits`);
+    }
+  });
+
+  it('lets an Extra be planted in another player’s district in Cutthroat only', () => {
+    assert.equal(presetSettings('cutthroat', 4, 5).extraStart, 'anyOffice');
+    assert.equal(presetSettings('coop', 4, 5).extraStart, 'ownOffice');
+    assert.equal(presetSettings('competitive', 4, 5).extraStart, 'ownOffice');
+    // At one player the two rules ARE the same rule — `apply.ts` only rejects `ownOffice` when the
+    // start is another seat's, which cannot happen. Solitaire said `anyOffice` until 2026-08-30:
+    // true, and it read wrong, since a lone player has no "any player" to be contrasted with. The
+    // label changed and the behaviour did not.
+    assert.equal(presetSettings('solitaire', 1, 5).extraStart, 'ownOffice');
+  });
+
+  it('leaves every optional rule off, in every type', () => {
+    for (const name of NAMES) {
+      const s = presetSettings(name, 4, 5);
+      assert.deepEqual(
+        [s.reducedVisibility, s.employeeRotation, s.emergencyToolbox],
+        [false, false, false],
+        `${name} switches an optional rule on`,
+      );
+    }
+  });
+});
+
+describe('the Revenue floor is a formula, not a number', () => {
+  /**
+   * Jesse gave these at five Days — Co-op 15 × players, Competitive 10 × players — and they scale,
+   * because a ten-Day game with a five-Day target is not a target. The floor follows the table size
+   * AND the length, which is exactly why both sit above the type radios as parameters rather than
+   * below them as rules.
+   */
+  it('asks 15 per player in Co-op at five Days, and 10 in Competitive', () => {
+    for (const players of [2, 3, 4]) {
+      assert.equal(presetSettings('coop', players, 5).minCombinedRevenue, 15 * players);
+      assert.equal(presetSettings('competitive', players, 5).minCombinedRevenue, 10 * players);
+    }
+  });
+
+  it('scales both ways with the Day count', () => {
+    assert.equal(presetSettings('coop', 3, 8).minCombinedRevenue, 3 * 3 * 8);
+    assert.equal(presetSettings('coop', 3, 3).minCombinedRevenue, 3 * 3 * 3);
+    assert.equal(presetSettings('competitive', 4, 10).minCombinedRevenue, 2 * 4 * 10);
+    assert.equal(presetSettings('competitive', 2, 3).minCombinedRevenue, 2 * 2 * 3);
+  });
+
+  it('asks nothing at all in Cutthroat, and leaves only the per-Day collision check standing', () => {
+    const s = presetSettings('cutthroat', 4, 5);
+    assert.equal(s.minCombinedRevenue, 0, 'Cutthroat has a Revenue floor');
+    assert.equal(s.maxCollisionsTotal, 0, 'Cutthroat caps collisions across the game');
+    assert.equal(s.maxCollisionsPerDay, 3, 'three collisions in one Day still ends a Cutthroat game');
+  });
+});
+
+describe('naming a game from its numbers', () => {
+  it('reads every type back as itself, at every table size and length', () => {
+    for (const name of NAMES) {
+      const players = name === 'solitaire' ? 1 : 3;
+      for (const days of [3, 5, 10]) {
+        const config = configFromPreset(name, players, days);
+        assert.equal(presetOf(config, players, days), name, `${name} at ${days} Days did not read back`);
+      }
+    }
+  });
+
+  it('tells Cutthroat and Competitive apart, though they are scored the same way', () => {
+    const cut = configFromPreset('cutthroat', 4, 5);
+    const comp = configFromPreset('competitive', 4, 5);
+    assert.equal(cut.mode, comp.mode, 'these two are meant to share a scoring mode');
+    assert.equal(presetOf(cut, 4, 5), 'cutthroat');
+    assert.equal(presetOf(comp, 4, 5), 'competitive');
+  });
+
+  it('calls a changed rule Custom, and says which rule', () => {
+    const base = configFromPreset('coop', 4, 5);
+    const settings = { ...settingsOf(base), emergencyToolbox: true };
+    const custom = configFromSettings(settings, 'coop', 5, false);
+    assert.equal(presetOf(custom, 4, 5), 'custom');
+    assert.deepEqual(differencesFrom('coop', settings, 4, 5), ['emergencyToolbox']);
+  });
+
+  it('does not call a Co-op game Competitive just because its dials line up', () => {
+    // The scoring mode is part of the comparison: the same numbers under a different mode are a
+    // different game, and the type is what a player reads to know which.
+    const settings = presetSettings('competitive', 4, 5);
+    const coopScored = configFromSettings(settings, 'coop', 5, false);
+    assert.notEqual(presetOf(coopScored, 4, 5), 'competitive');
+    assert.equal(presetOf(coopScored, 4, 5), 'custom');
+  });
+
+  it('measures a Custom game against the nearest type it is scored as', () => {
+    // A join preview is handed a finished config and nothing else — "Custom" alone would tell a
+    // player nothing about what they are sitting down to.
+    const settings = { ...presetSettings('cutthroat', 4, 5), freightPerLoad: 3 };
+    const config = configFromSettings(settings, 'competitive', 5, true);
+    const near = closestPreset(config, 4, 5);
+    assert.equal(near.name, 'cutthroat', 'a tuned Cutthroat game was measured against something else');
+    assert.deepEqual(near.differing, ['freightPerLoad']);
+  });
+
+  it('says what a Custom game is scored as, since the dials cannot', () => {
+    assert.match(gameTypeLabel('custom', 'coop'), /Co-op/);
+    assert.match(gameTypeLabel('custom', 'competitive'), /Competitive/);
+    assert.equal(gameTypeLabel('cutthroat', 'competitive'), 'Cutthroat');
+  });
+});
+
+describe('the config a form produces', () => {
+  it('carries the type’s scoring mode and its stance on the opponent cards', () => {
+    for (const name of NAMES) {
+      const config = configFromPreset(name, name === 'solitaire' ? 1 : 4, 5);
+      assert.equal(config.mode, preset(name).scoring);
+      assert.equal(config.pvpCardsAllowed, preset(name).pvpCards);
+    }
+  });
+
+  it('spells out every house rule rather than leaving one to a default somewhere else', () => {
+    const config = configFromPreset('competitive', 3, 5);
+    assert.ok(config.houseRules?.startingHand, 'the opening hand was left unnamed');
+    assert.ok(config.houseRules?.extraStart, 'the Extra rule was left unnamed');
+    assert.deepEqual(config.houseRules?.revenue, {
+      passengerPerCoach: 1,
+      freightPerLoad: 1,
+      trainPerTransit: 0,
+    });
+  });
+});

test/public-delta.test.ts

@@ -0,0 +1,298 @@
+/**
+ * THE SEATLESS PUBLIC DELTA — v0.8.0, `docs/plans/jitsi-common-board.md` § v0.8.0 § 3.
+ *
+ * The property that matters is RECONSTRUCTION: a receiver that started from one full frame and
+ * merged every delta since must hold exactly what a fresh `publicSnapshot()` would give it. A delta
+ * scheme that is merely smaller is worthless if the two sides drift, and the drift would show up as
+ * a board that is subtly wrong rather than as an error.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { pump } from '../src/engine/advance.ts';
+import { createGame } from '../src/engine/setup.ts';
+import { legalActions } from '../src/engine/legal.ts';
+import type { GameConfig, GameState, PlayerIndex } from '../src/engine/state.ts';
+import { applyIntent } from '../src/engine/apply.ts';
+import { currentActorOfState, publicSnapshot } from '../src/sim/view.ts';
+import type { PublicFrame } from '../src/sim/view.ts';
+import { applyPublicDelta, changedPiles, deltaPublicFrame } from '../src/sim/public-delta.ts';
+
+const config: GameConfig = {
+  mode: 'competitive',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
+  optionalRules: {
+    reducedVisibility: false,
+    employeeRotation: false,
+    emergencyToolbox: false,
+  },
+};
+
+function newState(seed: number, players = 3, rotation = false): GameState {
+  const s = createGame({
+    id: `delta-${seed}`,
+    seed,
+    config: rotation
+      ? { ...config, optionalRules: { ...config.optionalRules, employeeRotation: true } }
+      : config,
+    playerNames: Array.from({ length: players }, (_, i) => `p${i}`),
+  });
+  pump(s);
+  return s;
+}
+
+/** Plays one legal action, preferring a switch move so districts actually change between frames. */
+function step(s: GameState, actor: PlayerIndex): boolean {
+  const options = legalActions(s, actor);
+  if (options.length === 0) return false;
+  const move = options.find((o) => o.type.startsWith('switch.') && o.type !== 'switch.end');
+  const chosen = move ?? options.find((o) => o.type === 'localOps.choose') ?? options[0]!;
+  const r = applyIntent(s, actor, chosen);
+  if (!r.ok) return false;
+  pump(s);
+  return true;
+}
+
+describe('public frame delta', () => {
+  it('reconstructs exactly what a fresh projection produces, over a long chain', () => {
+    for (const seed of [1917398, 4242]) {
+      const s = newState(seed);
+      let sent: PublicFrame | null = null;
+      let held: PublicFrame | null = null;
+      let steps = 0;
+
+      for (let i = 0; i < 300; i++) {
+        const actor = currentActorOfState(s);
+        if (actor === null) break;
+        if (!step(s, actor)) break;
+
+        const next = publicSnapshot(s);
+        const delta = deltaPublicFrame(sent, next);
+        held = applyPublicDelta(held, delta);
+        sent = next;
+        steps++;
+
+        assert.deepEqual(
+          held,
+          next,
+          `merged frame drifted from a fresh projection at step ${steps} (seed ${seed})`,
+        );
+      }
+      assert.ok(steps > 20, `only ${steps} steps for seed ${seed} — the chain proved little`);
+    }
+  });
+
+  it('sends a district board only when that district changed', () => {
+    const s = newState(1917398);
+    const first = publicSnapshot(s);
+    // Nothing has moved, so a delta against an identical frame must null every board.
+    const idle = deltaPublicFrame(first, publicSnapshot(s));
+    assert.equal(idle.division, null, 'the Division was unchanged and must not be resent');
+    assert.equal(idle.districts.length, 0, 'an unchanged district must be omitted, not sent as nulls');
+    assert.deepEqual(idle.table, {}, 'an unchanged table must send no fields at all');
+
+    // Now move one player. Only that seat's board may be sent — this is the whole point of keying
+    // the delta by seat rather than comparing `districts` as one array.
+    let moved: PublicIndexed | null = null;
+    for (let i = 0; i < 200 && moved === null; i++) {
+      const actor = currentActorOfState(s);
+      if (actor === null) break;
+      const before = publicSnapshot(s);
+      if (!step(s, actor)) break;
+      const after = publicSnapshot(s);
+      const changed = after.districts.filter(
+        (d) => JSON.stringify(d.cells) !== JSON.stringify(before.districts.find((b) => b.seat === d.seat)?.cells),
+      );
+      if (changed.length === 1) moved = { seat: changed[0]!.seat, before, after };
+    }
+    assert.ok(moved !== null, 'no single-district change occurred, so this test proved nothing');
+
+    const delta = deltaPublicFrame(moved.before, moved.after);
+    assert.equal(delta.districts.length, 1, 'only the district that changed may be sent');
+    assert.equal(delta.districts[0]!.seat, moved.seat);
+    assert.notEqual(delta.districts[0]!.cells, null, 'the district that changed must carry its board');
+  });
+
+  it('a step that changes one field sends one field — the reason this is a partial', () => {
+    /**
+     * MEASURED, not assumed. The first version spread the whole frame and nulled only the boards, so
+     * a step whose sole change was whose turn it is still shipped all 35 top-level properties. Once
+     * TODO #18 gave automatic phases their own steps, most steps became exactly that, and a full game
+     * cost 19.4 MB of which 16.7 MB was those. This is the guard against that returning.
+     */
+    const s = newState(1917398);
+    const before = publicSnapshot(s);
+    const full = JSON.stringify(deltaPublicFrame(null, before)).length;
+
+    // Hand the turn on without touching a board, which is what an automatic phase mostly does.
+    const after = { ...before, actor: ((before.actor ?? 0) + 1) as PlayerIndex };
+    const delta = deltaPublicFrame(before, after);
+    assert.deepEqual(Object.keys(delta.table), ['actor'], 'only the field that changed may be sent');
+    assert.equal(delta.districts.length, 0);
+    assert.equal(delta.division, null);
+
+    const size = JSON.stringify(delta).length;
+    assert.ok(size < 120, `a one-field delta serialised to ${size} bytes`);
+    assert.ok(size * 100 < full, `a one-field delta (${size}B) is not much smaller than a full frame (${full}B)`);
+  });
+
+  it('always carries seat, player and name, so Employee Rotation cannot be missed', () => {
+    // Rotation moves players between districts, so the seat→player pairing is itself news. Those
+    // fields are small and are never nulled; the boards they label are what the delta saves.
+    const s = newState(777, 3, true);
+    const a = publicSnapshot(s);
+    // A full frame carries every district, each labelled — that is what a receiver matches on later.
+    const full = deltaPublicFrame(null, a);
+    assert.equal(full.districts.length, a.districts.length);
+    for (const d of full.districts) {
+      assert.equal(typeof d.seat, 'number');
+      assert.equal(typeof d.player, 'number');
+      assert.ok(typeof d.name === 'string' && d.name.length > 0, 'every district must stay labelled');
+    }
+    // And a district sent at all always carries its labels, even when only its board moved: rotation
+    // makes the seat→player pairing news in its own right.
+    const rotated = { ...a, districts: a.districts.map((d, i) => (i === 0 ? { ...d, player: ((d.player + 1) % 3) as PlayerIndex } : d)) };
+    const delta = deltaPublicFrame(a, rotated);
+    assert.equal(delta.districts.length, 1, 'a relabelled district must be sent even with no board change');
+    assert.equal(typeof delta.districts[0]!.player, 'number');
+  });
+
+  it('a first frame is sent whole', () => {
+    const s = newState(4242);
+    const full = deltaPublicFrame(null, publicSnapshot(s));
+    assert.notEqual(full.division, null);
+    for (const d of full.districts) {
+      assert.notEqual(d.cells, null, `seat ${d.seat} must be sent in full on a first frame`);
+      assert.notEqual(d.facilities, null);
+    }
+    // And it merges with no previous frame at all.
+    assert.deepEqual(applyPublicDelta(null, full), publicSnapshot(s));
+  });
+
+  it('refuses to merge an "unchanged" board it has nothing to merge onto', () => {
+    // A sender whose bookkeeping has drifted would otherwise hand a player a blank district.
+    const s = newState(4242);
+    const a = publicSnapshot(s);
+    const unchanged = deltaPublicFrame(a, publicSnapshot(s));
+    assert.throws(() => applyPublicDelta(null, unchanged), /no previous frame to merge onto/);
+  });
+});
+
+type PublicIndexed = { seat: number; before: PublicFrame; after: PublicFrame };
+
+describe('which piles a step moved', () => {
+  /**
+   * MEASURED FROM REAL PLAY, then pinned. The table in `changedPiles` claims what each action moves,
+   * and a claim in a comment is worth nothing unless something checks it — so this drives real games
+   * and asserts the mapping holds, action by action.
+   */
+  it('maps each action to the piles it actually touches', () => {
+    const seen = new Map<string, Set<string>>();
+    /**
+     * TWO PASSES, because a single driver cannot reach every case. Left to itself the bot almost
+     * never takes a Department card, and a driver that prefers one then never draws from the deck —
+     * so each preference is played out separately and the assertions below require BOTH to have
+     * been observed rather than passing on whichever happened to occur.
+     */
+    for (const prefer of ['draw.fromDepartment', 'draw.fromHomeOffice'] as const) {
+      for (const seed of [1917398, 191056, 4242]) {
+        const s = newState(seed);
+        for (let i = 0; i < 400; i++) {
+          const actor = currentActorOfState(s);
+          if (actor === null) break;
+          const options = legalActions(s, actor);
+          if (options.length === 0) break;
+          const chosen =
+            options.find((o) => o.type === prefer) ??
+            options.find((o) => o.type === 'card.discard') ??
+            options[i % options.length]!;
+          const before = publicSnapshot(s);
+          const r = applyIntent(s, actor, chosen);
+          if (!r.ok) break;
+          pump(s);
+          const piles = changedPiles(before, publicSnapshot(s)).map((p) => p.replace(/dept\d/, 'dept'));
+          if (!seen.has(chosen.type)) seen.set(chosen.type, new Set());
+          for (const p of piles) seen.get(chosen.type)!.add(p);
+          if (piles.length === 0) seen.get(chosen.type)!.add('(none)');
+        }
+      }
+    }
+
+    const of = (t: string): Set<string> => seen.get(t) ?? new Set();
+    // NOT VACUOUS: the four cases the mapping is actually about must all have happened.
+    for (const needed of ['draw.fromHomeOffice', 'draw.fromDepartment', 'card.discard', 'card.play']) {
+      assert.ok(of(needed).size > 0, `${needed} never occurred, so its rule proved nothing`);
+    }
+
+    // A HOME OFFICE DRAW MOVES THE COUNT AND NOTHING ELSE ON A PILE. The card is private; the deck
+    // getting shorter is not, and it is the only thing a watcher can be shown.
+    assert.deepEqual([...of('draw.fromHomeOffice')].sort(), ['home']);
+    // A DEPARTMENT DRAW touches that Department, and sometimes the deck too — the pile refills from
+    // it. Both are public, so both may light.
+    for (const p of of('draw.fromDepartment')) {
+      assert.ok(p === 'dept' || p === 'home', `a Department draw moved "${p}"`);
+    }
+    assert.ok(of('draw.fromDepartment').has('dept'), 'a Department draw must light its Department');
+    // A DISCARD lands face up on a Department, and which one is public.
+    assert.deepEqual([...of('card.discard')].sort(), ['dept']);
+    // A PLAYED CARD that does not stay on the board lands face up in the Salvage Yard.
+    assert.ok(of('card.play').has('salvage'), 'a played card must be able to light the Salvage Yard');
+    // ENDING A PHASE moves no card anywhere, so nothing should light for it.
+    for (const quiet of ['draw.end', 'loadUnload.end', 'switch.end', 'localOps.choose']) {
+      if (of(quiet).size > 0) assert.deepEqual([...of(quiet)], ['(none)'], `${quiet} lit a pile`);
+    }
+  });
+
+  it('lights nothing without a previous frame to compare against', () => {
+    // A reset has nothing to have watched arriving, so nothing on it is lit.
+    const s = newState(4242);
+    assert.deepEqual(changedPiles(null, publicSnapshot(s)), []);
+  });
+});
+
+describe('a Mainline card that changed under the players (Gitea#28)', () => {
+  it('names the node a Realignment converted, and nothing else', async () => {
+    const { changedDivisionCards } = await import('../src/sim/public-delta.ts');
+    const { REALIGNMENTS } = await import('../src/engine/content.ts');
+
+    const s = newState(4242);
+    const before = publicSnapshot(s);
+
+    // Realignment converts a card to another kind (`content.ts`'s table). Applied to the state directly:
+    // what is being tested is the DETECTOR, not the play that reaches it — which needs the card in hand,
+    // the draw option taken and no train on the card.
+    const at = s.division.nodes.findIndex((n) => n.kind === 'mainline' && REALIGNMENTS.some((r) => r.from === n.card));
+    assert.ok(at >= 0, 'no Mainline card in this Division can be realigned at all');
+    const node = s.division.nodes[at];
+    assert.equal(node?.kind, 'mainline');
+    if (node?.kind === 'mainline') {
+      node.card = REALIGNMENTS.find((r) => r.from === node.card)!.to;
+    }
+    const after = publicSnapshot(s);
+
+    assert.deepEqual(changedDivisionCards(before, after), [at], 'the realigned card was not the one reported');
+    assert.deepEqual(changedDivisionCards(after, after), [], 'an unchanged Division reported a change');
+    assert.deepEqual(changedDivisionCards(null, after), [], 'a first board has nothing to compare against');
+  });
+
+  it('says nothing when only the trains on a card moved', async () => {
+    const { changedDivisionCards } = await import('../src/sim/public-delta.ts');
+    const s = newState(1917398);
+    const before = publicSnapshot(s);
+    const at = s.division.nodes.findIndex((n) => n.kind === 'mainline');
+    const node = s.division.nodes[at];
+    if (node?.kind === 'mainline') {
+      node.transits.push({ tray: 'tray1', stagesRemaining: 1, stagesTotal: 1, direction: 'east' });
+    }
+    assert.deepEqual(changedDivisionCards(before, publicSnapshot(s)), [], 'a train arriving flashed the card');
+  });
+});

test/redaction.test.ts

@@ -17,7 +17,10 @@ import { pump } from '../src/engine/advance.ts';
 import { createGame } from '../src/engine/setup.ts';
 import type { GameConfig, GameState, PlayerIndex } from '../src/engine/state.ts';
 import { developerBot, playGame } from '../src/sim/bot.ts';
-import { snapshot } from '../src/sim/view.ts';
+import { cardName, publicSnapshot, snapshot } from '../src/sim/view.ts';
+import { newGame, newMultiplayerGame, submit } from '../src/web/game.ts';
+import { createSession } from '../src/server/session.ts';
+import { legalActions } from '../src/engine/legal.ts';
 
 const config: GameConfig = {
   mode: 'competitive',
@@ -26,6 +29,10 @@ const config: GameConfig = {
   maxCollisionsPerDay: 0,
   maxCollisionsTotal: 0,
   pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
   optionalRules: {
     reducedVisibility: false,
     employeeRotation: false,
@@ -99,6 +106,30 @@ describe('redaction — a seat\'s Frame never carries another seat\'s secrets',
     assert.ok(!serialized.includes(String(s.seed)), 'the seed value leaked into the Frame some other way');
   });
 
+  it('the tally that rides the Frame is aggregate counts, never a card id (Gitea#16)', () => {
+    // Gitea#16's statistics live on `GameState` and reach a remote client on the Frame, which is
+    // only safe because nothing in a Tally identifies a card. That is a property of what
+    // `tally.ts` chooses to count, and nothing in the type system enforces it — so it is asserted
+    // here, where a future counter that stashed a `cardId` "just for badges" would be caught.
+    for (const players of [3, 4]) {
+      const s = midGame(players, 5000 + players);
+      const secrets = new Set<string>([...s.decks.homeOffice]);
+      for (const hand of s.decks.hands.values()) for (const id of hand) secrets.add(id);
+      for (let viewer = 0 as PlayerIndex; viewer < players; viewer++) {
+        const serialized = JSON.stringify(snapshot(s, [], null, null, null, false, viewer).tally);
+        for (const cardId of secrets) {
+          assert.ok(!serialized.includes(`"${cardId}"`), `the tally carries card id "${cardId}"`);
+        }
+      }
+    }
+  });
+
+  it('every seat sees the SAME tally — it is the table\'s account, not a private one', () => {
+    const s = midGame(3, 5555);
+    const tallies = [0, 1, 2].map((p) => snapshot(s, [], null, null, null, false, p as PlayerIndex).tally);
+    for (const t of tallies) assert.deepEqual(t, tallies[0], 'the tally differs by seat');
+  });
+
   it('only the viewer\'s own hand and handCount are non-public — everything else matches across seats', () => {
     // The redaction surface is four fields (§7), not sixty event types. Cross-check that seats agree
     // on everything else a Frame carries about shared state.
@@ -115,3 +146,412 @@ describe('redaction — a seat\'s Frame never carries another seat\'s secrets',
     }
   });
 });
+
+
+/**
+ * THE OTHER HALF OF §7, AND THE HALF THAT WAS NEVER LOOKED AT.
+ *
+ * Every test above serializes a `Frame`, and every one of them passes `[]` for the narration log —
+ * so the entire shared log has sat outside the redaction net since the net was built. It is not a
+ * hypothetical hole: `game.log` is ONE list, and `linesSince(seat)` (`server/session.ts`) slices it
+ * with no per-seat filter at all, so every line written into it reaches every player.
+ *
+ * Two things were being written into it that should never have left the seat that caused them, both
+ * found while planning the public common board (Gitea#20 step 1) and both live in multiplayer today,
+ * with or without that display:
+ *
+ *   1. the SEED, announced in the opening line of every multiplayer game — which hands every player
+ *      the whole future of the deal;
+ *   2. the NAME OF A CARD DRAWN BLIND from the Home Office deck.
+ *
+ * SOLITAIRE IS DELIBERATELY LEFT ALONE in both cases. There is nobody to leak to at a one-seat
+ * table, the seed in the log is what a bug report quotes, and a solo player's own history naming
+ * the card they drew is the record, not a leak. The rule is "do not tell the OTHER seats", not
+ * "write less down" — so both checks below assert the solitaire text is still there.
+ */
+describe('redaction — the shared narration log never carries a seat\'s secrets', () => {
+  const names = ['Ann', 'Bob', 'Cy'];
+
+  it('never announces the seed to the table (Gitea#20 step 1)', () => {
+    const g = newMultiplayerGame(550943578, config, names);
+    const log = g.log.map((l) => l.text).join('\n');
+    assert.ok(
+      !/550943578/.test(log),
+      `the seed was announced to every seat:\n${log}`,
+    );
+    // The opening line must still say what the game IS — the leak is the number, not the line.
+    assert.match(log, /Game Begins/);
+    assert.match(log, /3 players/);
+  });
+
+  it('still tells a solitaire player their own seed — there is nobody to leak it to', () => {
+    const g = newGame(550943578);
+    const log = g.log.map((l) => l.text).join('\n');
+    assert.match(log, /550943578/, 'a solo game stopped recording the seed its bug reports quote');
+  });
+
+  it('never names a card drawn blind from the Home Office deck (Gitea#20 step 1)', () => {
+    const g = newMultiplayerGame(4242, config, names);
+
+    // Drive to the first Home Office draw any seat makes, and note what it actually drew.
+    let drawn: string | null = null;
+    for (let i = 0; i < 400 && drawn === null; i++) {
+      const actor = g.state.clock.currentActor;
+      if (actor === null) break;
+      const before = g.log.length;
+      if (!submit(g, { type: 'localOps.choose', option: 'draw' }, actor as PlayerIndex)) continue;
+      if (!submit(g, { type: 'draw.fromHomeOffice' }, actor as PlayerIndex)) continue;
+      drawn = g.justDrawn;
+      void before;
+    }
+    assert.ok(drawn, 'no seat ever drew from the Home Office deck');
+
+    const name = cardName(g.state, drawn!);
+    const log = g.log.map((l) => l.text).join('\n');
+    assert.ok(
+      !log.includes(name),
+      `a blind draw named "${name}" to the whole table:\n${log.split('\n').slice(-6).join('\n')}`,
+    );
+    // The draw itself is public — everyone saw a hand go to the deck. Only WHICH card is not.
+    assert.match(log, /Home Office/i);
+
+    // And the drawing seat still learns what it got: `justDrawn` is the owner-only channel, and
+    // `session.ts` sends it to that seat alone.
+    assert.equal(g.justDrawn, drawn);
+  });
+});
+
+
+/**
+ * #91 — THE SYSTEMATIC NET, not two strings.
+ *
+ * v0.7.9.2 closed the seed and the blind draw. Both were found by reading a plan, not by a test, and
+ * that is the point: a redaction suite made of the leaks somebody happened to notice proves nothing
+ * about the next one. This is the pass the common-board plan asks for (Gitea#20 step 1 § Tests) —
+ * serialise EVERYTHING a seat or a spectator receives and search it for everything that must not be
+ * in it, across every game state where the shape of the answer changes.
+ *
+ * **What is searched for**, per the plan: every opponent hand card id AND its display name, the
+ * objective, `justDrawn` for the wrong seat, seed values and seed narration, and private decision
+ * and menu data. Display names matter as much as ids — "Red Flags" in a log leaks exactly what
+ * `c118` would, and only the id would have been caught before.
+ *
+ * **Where it is searched**: a player's `Frame`, the `PublicFrame` a spectator gets, the incremental
+ * narration `Push.lines` carries, and a reconnect push — which is a full Frame rather than a delta
+ * and is therefore its own opportunity to leak.
+ *
+ * **And the acceptance bar is not this file.** The plan is explicit that passing redaction tests
+ * alone is insufficient and that every public property needs an allow-list review; the last test
+ * here is that allow-list, so adding a field to the public projection fails until somebody has said
+ * out loud that it is public.
+ */
+describe('#91 — nothing private survives serialisation, in any state', () => {
+  const names = ['Ann', 'Bob', 'Cy'];
+
+  /**
+   * Everything one seat can see, split into the two halves the checks below treat differently.
+   *
+   * `structural` is the machine-readable state: their Frame, the public board, and the frame of every
+   * presentation step they are sent (v0.8.0, TODO #13). `narration` is what the table was TOLD.
+   *
+   * Steps are folded in here rather than given a test of their own so every case below covers them:
+   * the blind draw, the pending decision, Employee Rotation before and after the seating moves, and
+   * the played-out game. Their `lines` are a slice of `g.log` by construction, so the log covers the
+   * narration half of a step and does not need to be searched twice.
+   */
+  const everythingSeatSees = (g: ReturnType<typeof newMultiplayerGame>, seat: PlayerIndex): {
+    structural: string;
+    history: string;
+    narration: string[];
+  } => ({
+    /**
+     * `[]` for the Frame's own lines, MATCHING PRODUCTION. `frameFor()` (`server/session.ts`) has
+     * passed no log since #97 — narration goes out incrementally through `Push.lines` instead — so
+     * embedding it here audits a path that no longer exists, and worse, it puts the whole log inside
+     * `structural` where the face-up-pile rule below cannot reach it. The log is audited in full as
+     * `narration`; this is a de-duplication, not a relaxation.
+     */
+    structural:
+      JSON.stringify(snapshot(g.state, [], null, null, null, false, seat)) +
+      '\n' + JSON.stringify(publicSnapshot(g.state)),
+    /**
+     * THE STEP FRAMES ARE A RECORD OF WHAT WAS PUBLIC OVER TIME, not a view of the position now —
+     * so they get the PRECISE check and not the fuzzy one, for the same reason the face-up-pile
+     * lines do.
+     *
+     * Every one is built by `deltaPublicFrame` over `publicSnapshot`, which the allow-list test at
+     * the bottom of this file pins property by property; that is what guarantees a step frame is
+     * clean. Searching their accumulation for a card NAME asks "was this ever public?" and answers
+     * a question nobody was posing: Train 6 sat face-up in a Department at step 40 and is in Ann's
+     * hand at step 120, and both facts are correct. A card ID is different — narration never renders
+     * one and no public field carries an opponent's, so finding one anywhere is still proof.
+     */
+    history: JSON.stringify(g.display.steps.map((step) => step.frame)),
+    narration: g.log.map((l) => l.text),
+  });
+
+  /**
+   * A FACE-UP PILE IS ALLOWED TO NAME THE CARD ON IT, and the log is history rather than a view.
+   *
+   * §2.6: the three Department piles and the Salvage Yard are face up, "so players can audit
+   * discards" — a discard goes onto one precisely so a rival can take it. So "Player Ann discarded
+   * Train 6 face-up on top of Department 3" is the record working, and it stays in the log after Ann
+   * takes the card back into her hand. The name-based check below would otherwise read that historical
+   * line as proof of what Ann is holding NOW, which is how it reported a leak against correct code on
+   * seed 1917398.
+   *
+   * These lines are excluded from the NAME check only. The card-id check and the seed check still run
+   * over them, because those are precise: an id is unique, so finding one is proof, and narration
+   * never renders a raw id.
+   *
+   * **This does not weaken the blind-draw detection**, which is the leak this whole net was built
+   * for (v0.7.9.2, "Red Flags"): a blind draw names the HOME OFFICE DECK, which is face down and
+   * matches nothing here.
+   */
+  const namesAFaceUpPile = (line: string): boolean => /Department|Salvage/i.test(line);
+
+  /**
+   * Every secret belonging to somebody OTHER than `seat`: their card ids, and the names those ids
+   * render as. Ids alone were what the original tests looked for, and an id is the precise
+   * instrument — it is unique, so finding one is proof.
+   *
+   * **A NAME IS ONLY EVIDENCE WHEN IT IS DISTINCTIVE, and most are not.** Card names are types, not
+   * identities: "right-hand curve" names a dozen cards, and one of them is legitimately drawn on the
+   * board as a cell label the moment anybody lays track. Searching for a name that also exists in
+   * public is a test that fails on correct code, which is worse than no test — so a name counts only
+   * when EVERY card bearing it is in that one opponent's hand. Then, and only then, seeing it says
+   * something about what they are holding.
+   *
+   * This is what caught the blind-draw leak in v0.7.9.2: "Red Flags" was in exactly one hand, and it
+   * was in the log.
+   */
+  const secretsOfOthers = (
+    g: ReturnType<typeof newMultiplayerGame>,
+    seat: PlayerIndex,
+  ): { what: string; value: string; precise: boolean }[] => {
+    // `precise` marks evidence that is proof on its own — a card id is unique, so finding one
+    // anywhere is a leak. A NAME is circumstantial and is searched over a narrower string; see
+    // `namesAFaceUpPile`.
+    const out: { what: string; value: string; precise: boolean }[] = [];
+    // How many cards in the whole game carry each name, and how many of those are in a given hand.
+    const totalByName = new Map<string, number>();
+    for (const id of g.state.cards.keys()) {
+      const n = cardName(g.state, id);
+      totalByName.set(n, (totalByName.get(n) ?? 0) + 1);
+    }
+    for (const p of g.state.players) {
+      if (p.index === seat) continue;
+      const hand = g.state.decks.hands.get(p.index) ?? [];
+      const heldByName = new Map<string, number>();
+      for (const id of hand) {
+        const n = cardName(g.state, id);
+        heldByName.set(n, (heldByName.get(n) ?? 0) + 1);
+      }
+      for (const id of hand) {
+        out.push({ what: `${p.name}'s card id`, value: id, precise: true });
+        const name = cardName(g.state, id);
+        if (totalByName.get(name) === heldByName.get(name)) {
+          out.push({ what: `${p.name}'s card name, unique to their hand`, value: name, precise: false });
+        }
+      }
+    }
+    return out;
+  };
+
+  /** Runs the whole net over one state, and says which state failed if it does. */
+  const audit = (g: ReturnType<typeof newMultiplayerGame>, where: string): void => {
+    for (const seat of g.state.players.map((p) => p.index)) {
+      const { structural, history, narration } = everythingSeatSees(g, seat);
+      const everything = structural + '\n' + history + '\n' + narration.join('\n');
+      // Names are fuzzy evidence, so they are searched everywhere EXCEPT the lines a face-up pile
+      // is entitled to name a card on. Ids are precise and are searched everywhere.
+      const forNames = structural + '\n' + narration.filter((l) => !namesAFaceUpPile(l)).join('\n');
+      for (const { what, value, precise } of secretsOfOthers(g, seat)) {
+        assert.ok(
+          !(precise ? everything : forNames).includes(value),
+          `${where}: seat ${seat} can see ${what} ("${value}")`,
+        );
+      }
+      // The seed is the whole future of the deal and must not reach a seat by any route.
+      assert.ok(!everything.includes(String(g.seed)), `${where}: seat ${seat} can see the seed ${g.seed}`);
+    }
+    // And the spectator board, which has no seat and is therefore entitled to nothing private.
+    const pub = JSON.stringify(publicSnapshot(g.state));
+    for (const p of g.state.players) {
+      for (const id of g.state.decks.hands.get(p.index) ?? []) {
+        assert.ok(!pub.includes(id), `${where}: the public board carries ${p.name}'s card ${id}`);
+      }
+    }
+    assert.ok(!pub.includes(String(g.seed)), `${where}: the public board carries the seed`);
+    for (const k of ['hand', 'objective', 'justDrawn', 'decision', 'moves', 'blocked', 'viewer']) {
+      assert.ok(!(k in (JSON.parse(pub) as Record<string, unknown>)), `${where}: the public board has a "${k}" field`);
+    }
+  };
+
+  /** Plays `n` legal moves, so a state is a real position rather than a constructed one. */
+  const play = (g: ReturnType<typeof newMultiplayerGame>, n: number): void => {
+    for (let i = 0; i < n; i++) {
+      const a = g.state.clock.currentActor;
+      if (a === null) break;
+      const opts = legalActions(g.state, a);
+      if (!opts.length) break;
+      if (!submit(g, opts[i % opts.length]!, a)) break;
+    }
+  };
+
+  it('a newly created multiplayer game', () => {
+    audit(newMultiplayerGame(4242, config, names), 'fresh game');
+  });
+
+  it('after a blind Home Office draw', () => {
+    const g = newMultiplayerGame(4242, config, names);
+    let drew = false;
+    for (let i = 0; i < 200 && !drew; i++) {
+      const a = g.state.clock.currentActor;
+      if (a === null) break;
+      if (!submit(g, { type: 'localOps.choose', option: 'draw' }, a)) continue;
+      drew = submit(g, { type: 'draw.fromHomeOffice' }, a);
+    }
+    assert.ok(drew, 'no seat drew from the Home Office deck');
+    audit(g, 'after a blind draw');
+  });
+
+  it('the net actually sees the presentation steps it claims to cover (v0.8.0)', () => {
+    /**
+     * Guards the COVERAGE, not the code. `everythingSeatSees` folds `display.steps` into the string
+     * every case above is audited against — which is worth nothing if that array is empty in
+     * practice. So: play a real game, and assert both that steps accumulated and that the audited
+     * string contains them.
+     */
+    const g = newMultiplayerGame(1917398, config, names);
+    play(g, 120);
+    assert.ok(g.display.steps.length > 20, `only ${g.display.steps.length} steps — the net covers little`);
+    const { history, narration } = everythingSeatSees(g, 0 as PlayerIndex);
+    assert.ok(
+      history.includes(JSON.stringify(g.display.steps.map((step) => step.frame))),
+      'the audited string does not actually contain the step frames',
+    );
+    // And a step's own narration is a slice of the log, so the log half covers it.
+    const fromSteps = g.display.steps.flatMap((step) => step.lines.map((l) => l.text));
+    assert.ok(fromSteps.length > 0, 'the steps carried no narration to cover');
+    assert.ok(fromSteps.every((t) => narration.includes(t)), 'a step said something the log did not');
+    audit(g, 'a played game with presentation steps');
+  });
+
+  it('mid-game, with real hands and a built board', () => {
+    // A DISTINCTIVE seed, deliberately. Seed 7 makes the seed check meaningless — "7" is in "Train
+    // 7", in every coordinate and in half the numbers on the board — so it reported a leak that was
+    // not one. Nine digits collide with nothing, which is what makes a substring match evidence.
+    const g = newMultiplayerGame(613884219, config, names);
+    play(g, 300);
+    audit(g, 'mid-game');
+  });
+
+  it('with a decision pending, and with the Superintendent acting', () => {
+    const g = newMultiplayerGame(550943578, config, names);
+    let sawDecision = false;
+    for (let i = 0; i < 800; i++) {
+      if (g.state.clock.pendingDecision !== null) {
+        sawDecision = true;
+        audit(g, `pending decision (${g.state.clock.pendingDecision.kind})`);
+        break;
+      }
+      const a = g.state.clock.currentActor;
+      if (a === null) break;
+      const opts = legalActions(g.state, a);
+      if (!opts.length || !submit(g, opts[0]!, a)) break;
+    }
+    // A seed that never raises one is not a failure of redaction; say so rather than passing mutely.
+    if (!sawDecision) assert.ok(true, 'no decision arose on this seed — nothing to audit');
+  });
+
+  it('with Employee Rotation on, before and after ownership moves', () => {
+    // The case where seat and player index come apart. A projection that confused them would hand
+    // one player another's district, which is a leak the other tests cannot see.
+    const rotating = { ...config, optionalRules: { ...config.optionalRules, employeeRotation: true } };
+    const g = newMultiplayerGame(729315046, rotating, names);
+    audit(g, 'employee rotation, before');
+    const seatingBefore = [...g.state.seating];
+    play(g, 400);
+    audit(g, 'employee rotation, after');
+    // If the seating never moved this test proved less than it looks — say which happened.
+    const moved = seatingBefore.some((p, i) => g.state.seating[i] !== p);
+    assert.ok(moved || g.state.status !== 'active', 'rotation never moved anybody and the game did not end');
+  });
+
+  it('a game played out to the end, or as far as it goes', () => {
+    const g = newMultiplayerGame(613884219, config, names);
+    play(g, 6000);
+    // Says which it actually got, rather than claiming a finished game it may not have reached.
+    audit(g, `played out (status ${g.state.status})`);
+  });
+
+  it('a reconnect push, which is a full Frame rather than a delta', () => {
+    const session = createSession(550943578, config, names);
+    for (const seat of [0, 1, 2] as PlayerIndex[]) {
+      const push = session.connect(seat);
+      const seen = JSON.stringify(push);
+      const state = session.exportSave();
+      assert.ok(!seen.includes(String(state.seed)), `the reconnect push for seat ${seat} carries the seed`);
+      for (const p of [0, 1, 2] as PlayerIndex[]) {
+        if (p === seat) continue;
+        // `connect` returns that seat's own Frame; another seat's hand must not be in it.
+        assert.ok(
+          !/"hand":\[[^\]]/.test(JSON.stringify((push.frame as unknown as Record<string, unknown>)['players'] ?? '')),
+          `the reconnect push for seat ${seat} carries a hand inside players[]`,
+        );
+      }
+    }
+  });
+
+  /**
+   * THE ALLOW-LIST, and the plan's actual acceptance bar.
+   *
+   * Every property of the public projection, written down and reviewed as public. This does not
+   * check the CONTENT of anything — the tests above do that — it checks that nobody has added a
+   * field without saying out loud that a spectator may see it. That is the check that would have
+   * caught both v0.7.9.2 leaks, because both were fields nobody had ever asked the question about.
+   *
+   * When this fails, the fix is not to add the key here. It is to decide whether the field is
+   * public, and only then to add it.
+   */
+  it('every public property is on the allow-list, and nothing else is', () => {
+    const PUBLIC: readonly string[] = [
+      // The clock and the phase — what a spectator's board is FOR.
+      'day', 'stage', 'clock', 'phase', 'phaseKey', 'actor', 'superintendent',
+      // Deck sizes and face-up piles. A Department pile is face up; the Home Office deck is a count.
+      'deck', 'departments', 'departmentsWhat', 'departmentDepth', 'salvage',
+      // Rolling stock in the yards, by type — visible on the table.
+      'yards',
+      // The timetable is public: it is what everyone is playing against.
+      'timetable', 'timetableWhat',
+      // The rules the game was dealt under, and the score.
+      'houseRules', 'mode', 'optionalRules', 'days', 'minCombinedRevenue',
+      'maxCollisionsPerDay', 'maxCollisionsTotal', 'collisionsToday', 'collisionsTotal',
+      // What the Day that just ended finished on. Public for the same reason the running counts are:
+      // a collision happens on the Mainline in front of everybody.
+      'collisionsPrevDay',
+      'status', 'outcome', 'extraDays', 'extensionVotes', 'official', 'tally',
+      // Names, seats, revenue and HAND SIZE — never hand contents.
+      'players',
+      // The opening rolls decided seating and the Superintendent in the open.
+      'openingRolls',
+      // Where every train is standing.
+      'trains',
+      // The Crew Tray pool and the trains queued for one (#98). §7 scarcity is played out in the
+      // open: the trays are objects in the middle of the table, and an Extra is played face up, so
+      // who is waiting for a crew is not a secret. Counts and train numbers only — never a hand.
+      'crewTrays', 'queued',
+      // The board itself.
+      'division', 'districts',
+    ];
+    const g = newMultiplayerGame(4242, config, names);
+    const actual = Object.keys(publicSnapshot(g.state)).sort();
+    const allowed = [...PUBLIC].sort();
+    assert.deepEqual(
+      actual,
+      allowed,
+      'the public projection gained or lost a property — decide whether it is public before listing it',
+    );
+  });
+});

test/remote-session.test.ts

@@ -0,0 +1,81 @@
+/**
+ * The browser's half of the multiplayer transport, driven with a fake `EventSource` and `fetch`.
+ * `createRemoteSession` is pure otherwise — no DOM — so it runs here as it does in the page.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { createRemoteSession } from '../src/web/session.ts';
+
+type Fake = { onmessage: ((ev: { data: string }) => void) | null; emit(data: unknown): void; close(): void };
+
+function fakeTransport(): { source: () => Fake; bodies: () => { seq: number }[]; fail: (on: boolean) => void } {
+  let last: Fake | null = null;
+  const bodies: { seq: number }[] = [];
+  let failing = false;
+  const g = globalThis as unknown as Record<string, unknown>;
+  g['EventSource'] = class {
+    onmessage: ((ev: { data: string }) => void) | null = null;
+    onerror: (() => void) | null = null;
+    constructor() {
+      last = this;
+    }
+    emit(data: unknown): void {
+      this.onmessage?.({ data: JSON.stringify(data) });
+    }
+    close(): void {}
+  };
+  g['fetch'] = async (_url: string, init?: { body?: string }) => {
+    if (init?.body) bodies.push(JSON.parse(init.body) as { seq: number });
+    await new Promise((r) => setTimeout(r, 5));
+    if (failing) throw new Error('network down');
+    return { ok: true, status: 200, json: async () => ({ ok: true }) };
+  };
+  return { source: () => last!, bodies: () => bodies, fail: (on) => (failing = on) };
+}
+
+const connectPush = (lastSeq: number): unknown => ({ frame: null, menu: null, lines: [], lastSeq });
+
+describe('the remote session (v0.8.4)', () => {
+  it('continues the intent count from where the server says, not from 1', async () => {
+    const t = fakeTransport();
+    const s = createRemoteSession('tok', 0);
+    t.source().emit(connectPush(7));
+    await s.submit({ type: 'draw.end' });
+    assert.deepEqual(t.bodies().map((b) => b.seq), [8], 'the first intent after a reload re-used a number the server had already applied');
+    // A later reconnect never moves the count backwards.
+    t.source().emit(connectPush(3));
+    await s.submit({ type: 'draw.end' });
+    assert.deepEqual(t.bodies().map((b) => b.seq), [8, 9]);
+  });
+
+  it('drops a second submit while the first is still in flight', async () => {
+    const t = fakeTransport();
+    const s = createRemoteSession('tok', 0);
+    t.source().emit(connectPush(0));
+    const [a, b] = await Promise.all([s.submit({ type: 'draw.end' }), s.submit({ type: 'draw.end' })]);
+    assert.equal(a, true);
+    assert.equal(b, false, 'a double-click posted twice');
+    assert.equal(t.bodies().length, 1, 'two intents went over the wire for one click');
+    // And the next one, after the round trip, goes through as normal.
+    assert.equal(await s.submit({ type: 'draw.end' }), true);
+    assert.equal(t.bodies().length, 2);
+  });
+
+  it('answers false, not an unhandled rejection, when the network fails', async () => {
+    const t = fakeTransport();
+    const s = createRemoteSession('tok', 0);
+    t.source().emit(connectPush(0));
+    t.fail(true);
+    assert.equal(await s.submit({ type: 'draw.end' }), false);
+    t.fail(false);
+    assert.equal(await s.submit({ type: 'draw.end' }), true, 'the session did not recover after a failed submit');
+  });
+
+  it('drops a push that is not JSON instead of throwing out of the handler', () => {
+    const t = fakeTransport();
+    createRemoteSession('tok', 0);
+    assert.doesNotThrow(() => t.source().onmessage?.({ data: '{not json' }));
+  });
+});

test/replay.test.ts

@@ -6,17 +6,23 @@
  */
 
 import { describe, it } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import assert from 'node:assert/strict';
 
 import { pump } from '../src/engine/advance.ts';
 import { DEFAULT_MAX_COLLISIONS_PER_DAY, DEFAULT_MAX_COLLISIONS_TOTAL, collectiveRevenueFloor } from '../src/engine/content.ts';
 import type { GameEvent } from '../src/engine/events.ts';
+import { areaOf } from '../src/engine/apply.ts';
 import { createGame } from '../src/engine/setup.ts';
-import type { GameConfig } from '../src/engine/state.ts';
+import { coordKey, turnOf } from '../src/engine/state.ts';
+import type { GameConfig, GameState, GridCoord } from '../src/engine/state.ts';
 import { developerBot, playGame } from '../src/sim/bot.ts';
 import { impediments, isVisible, narrate, phaseLabel } from '../src/sim/narrate.ts';
 import { compress, rehydrateCells, record, renderHtml } from '../src/sim/replay.ts';
 import { summarize } from '../src/sim/stats.ts';
+import { officeProfile } from '../src/engine/content.ts';
 
 // Mirrors `record()`'s own default exactly (`replay.ts`) — "does not drift from the engine" below
 // plays the same seed through both paths and compares outcomes, so they must share one floor.
@@ -27,6 +33,8 @@ const config: GameConfig = {
   maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
   maxCollisionsTotal: DEFAULT_MAX_COLLISIONS_TOTAL,
   pvpCardsAllowed: false,
+  // NO house rules, deliberately: `record()` names none either, so both take today's defaults and
+  // "does not drift from the engine" below compares two games that were dealt the same way.
   optionalRules: {
     reducedVisibility: false,
     employeeRotation: false,
@@ -39,10 +47,14 @@ const SAMPLES: GameEvent[] = [
   { type: 'stageBegan', day: 1, stage: 7 },
   { type: 'phaseBegan', phase: 'mainline' },
   { type: 'actorChanged', player: 0 },
+  // Sampled rather than left to swell the unsampled count: this sentence is one a player reads at
+  // the table every third Stage, so its text is worth exercising.
+  { type: 'superintendentChanged', player: 1, stage: 6 },
   { type: 'localOpsOptionChosen', player: 0, option: 'switch' },
-  { type: 'trayMoved', trayId: 't0', from: { row: 0, col: 0 }, to: { row: 0, col: 1 }, movesRemaining: 5 },
-  { type: 'carsCoupled', trayId: 't0', at: { row: 0, col: 1 }, stock: [{ type: 'hopper', loaded: false }], from: [{ row: 0, col: 1 }], toNose: true },
-  { type: 'carsDropped', trayId: 't0', at: { row: 1, col: 0 }, stock: [{ type: 'hopper', loaded: false }] },
+  { type: 'trayMoved', player: 0, trayId: 't0', from: { row: 0, col: 0 }, to: { row: 0, col: 1 }, movesRemaining: 5, movesAllowed: 6 },
+  { type: 'switchingEnded', player: 0, movesUsed: 3, movesAllowed: 6, lastMove: { trayId: 't0', to: { row: 0, col: 1 } } },
+  { type: 'carsCoupled', player: 0, trayId: 't0', at: { row: 0, col: 1 }, stock: [{ type: 'hopper', loaded: false }], from: [{ row: 0, col: 1 }], toNose: true },
+  { type: 'carsDropped', player: 0, trayId: 't0', at: { row: 1, col: 0 }, stock: [{ type: 'hopper', loaded: false }] },
   { type: 'cardDrawn', player: 0, source: 'homeOffice', cardId: 'c1' },
   { type: 'cardPlayed', player: 0, cardId: 'c1', placement: { row: 1, col: 0 }, variant: 0 },
   { type: 'officeUpgraded', player: 0, from: 'whistlePost', to: 'depot' },
@@ -50,15 +62,30 @@ const SAMPLES: GameEvent[] = [
   { type: 'deckReshuffled', order: ['c1', 'c2', 'c3', 'c4'], rngState: 7 },
   { type: 'departmentRefilled', slot: 0, cardId: 'c2' },
   { type: 'stockToOutbound', player: 0, at: { row: 1, col: 0 }, stock: { type: 'hopper', loaded: true } },
+  // Sampled from the start rather than joining the unsampled 25: an idle Freight Agent is the ONE
+  // line whose whole job is to be read when nothing happened, so an empty or fallback sentence
+  // would reproduce the silence it exists to fix.
+  { type: 'freightAgentIdled', player: 0 },
+  { type: 'trainReleasedFromLimits', trainNumber: 8, office: 'Whistle Post', owner: 0, freedBy: 14 },
   { type: 'inboundCleared', player: 0, at: { row: 1, col: 0 }, stock: { type: 'hopper', loaded: true } },
-  { type: 'facilityUnjammed', player: 0, at: { row: 1, col: 0 }, from: 'menAtWork', stock: { type: 'hopper', loaded: true } },
+  { type: 'facilityUnjammed', player: 0, at: { row: 1, col: 0 }, from: 'menAtWork', index: 0, stock: { type: 'hopper', loaded: true } },
   { type: 'trainScheduled', player: 0, trainNumber: 4, roll: 7, slot: 6, rngState: 1 },
-  { type: 'carPlacedOnTrain', player: 0, trayId: 't0', stock: { type: 'coach', loaded: false } },
-  { type: 'carPassed', player: 0, trayId: 't0' },
+  { type: 'carPlacedOnTrain', player: 0, trayId: 't0', stock: { type: 'coach', loaded: false }, trainNumber: 10, isExtra: false },
+  { type: 'carPassed', player: 0, trayId: 't0', trainNumber: 10, isExtra: false },
+  {
+    type: 'makeUpShort',
+    trainNumber: 5,
+    isExtra: false,
+    placed: 0,
+    wanted: 3,
+    missing: ['coach'],
+    waiting: 14,
+    divisionYardHolds: 46,
+  },
   { type: 'clearanceRequested', trainId: 't1', occupiedBy: 't0' },
   { type: 'clearanceGiven', trainId: 't1', allow: false },
-  { type: 'passengersBoarded', player: 0, at: { row: 0, col: 0 } },
-  { type: 'passengersDetrained', player: 0, at: { row: 0, col: 0 } },
+  { type: 'passengersBoarded', player: 0, at: { row: 0, col: 0 }, trayId: 't0', coachIndex: 0 },
+  { type: 'passengersDetrained', player: 0, at: { row: 0, col: 0 }, trayId: 't0', coachIndex: 0 },
   { type: 'loadStarted', player: 0, at: { row: 1, col: 0 }, carType: 'hopper' },
   { type: 'loadAdvanced', player: 0, at: { row: 1, col: 0 }, fromBox: 0, toBox: 1 },
   { type: 'unloadCompleted', player: 0, at: { row: 1, col: 0 }, carType: 'hopper' },
@@ -70,12 +97,56 @@ const SAMPLES: GameEvent[] = [
 
 describe('narration', () => {
   it('covers every event type the engine can emit', () => {
-    // Guards against a new event type slipping in unnarrated.
-    const covered = new Set(SAMPLES.map((e) => e.type));
-    const declared = new Set<string>();
-    for (const e of SAMPLES) declared.add(e.type);
-    assert.equal(covered.size, 30, 'sample list is out of step with GameEvent');
-    assert.equal(declared.size, 30);
+    /**
+     * THIS TEST USED TO BUILD BOTH SETS FROM `SAMPLES` and compare them to each other, so it could
+     * only ever assert that the sample list had 30 distinct entries — the one thing it could not
+     * detect was the thing its comment promised, a new `GameEvent` slipping in unnarrated. Fixed
+     * 2026-09-09 while adding the v0.8.0 step collector, which made the event union load-bearing for
+     * a second reader.
+     *
+     * The union is read out of `src/engine/events.ts` rather than hand-listed, the same way
+     * `test/pacing.test.ts` reads the intent union: a list maintained by hand is a list that goes
+     * stale, which is how this got here.
+     */
+    const here = dirname(fileURLToPath(import.meta.url));
+    const declared = new Set(
+      [...readFileSync(join(here, '../src/engine/events.ts'), 'utf8').matchAll(/type: '([a-zA-Z]+)'/g)]
+        .map((m) => m[1]!),
+    );
+    const narrated = new Set(
+      [...readFileSync(join(here, '../src/sim/narrate.ts'), 'utf8').matchAll(/case '([a-zA-Z]+)':/g)]
+        .map((m) => m[1]!),
+    );
+    assert.ok(declared.size > 40, `only ${declared.size} event types parsed — the parse is wrong`);
+
+    // THE INVARIANT THAT MATTERS: an event the engine can emit and `narrate` has no case for falls
+    // through to a placeholder, in front of a player. This is the check the old version promised.
+    const unnarrated = [...declared].filter((t) => !narrated.has(t));
+    assert.deepEqual(unnarrated, [], 'these event types can be emitted and have no narration case');
+
+    const covered = new Set<string>(SAMPLES.map((e) => e.type));
+    const unknown = [...covered].filter((t) => !declared.has(t));
+    assert.deepEqual(unknown, [], 'these samples name an event the engine no longer declares');
+
+    /**
+     * THE KNOWN GAP, PINNED SO IT CANNOT GROW.
+     *
+     * `SAMPLES` exercises the TEXT of 32 of the 57 declared events; the other 25 have a narration
+     * case (checked above) but no sample, so nothing proves their sentence is any good. Found
+     * 2026-09-09 — the old test built both of its sets from `SAMPLES` and compared them to each
+     * other, so it could only ever assert that the sample list had 30 distinct entries, and the one
+     * thing it could not detect was the thing its comment promised.
+     *
+     * Pinned rather than fixed: writing 25 fixtures is a job of its own, and a bad sentence is worth
+     * finding deliberately rather than in a rush. What this does guarantee is that a NEW event type
+     * cannot join the unsampled set silently.
+     */
+    const unsampled = [...declared].filter((t) => !covered.has(t)).sort();
+    assert.equal(
+      unsampled.length,
+      25,
+      `the unsampled set changed (${unsampled.length}): add a sample for a new event, or update this count`,
+    );
   });
 
   it('gives every event a specific, non-empty sentence', () => {
@@ -97,6 +168,33 @@ describe('narration', () => {
     assert.match(loss.text, /COLLISION/i);
   });
 
+  /**
+   * WHOSE OFFICE, AND WHOSE TRAIN — Jesse, playtest 2026-09-16.
+   *
+   * The line went to every seat reading "ARRIVED at the Whistle Post … You can work it in Cargo now".
+   * At a table of four that is one true sentence and one false one: every seat has an Office, so the
+   * tier alone does not say which district the train is standing in, and three of the four readers
+   * cannot touch it. Constructed here rather than fished out of a game so both halves are pinned
+   * exactly, and the resolver-less path is checked too — the replay viewers pass no names for a
+   * table they do not have.
+   */
+  it('names WHOSE Office a train reached, and never tells the table they can work it', () => {
+    const named = narrate(
+      { type: 'trainArrived', trainNumber: 3, consist: [], office: 'Whistle Post', owner: 1, expedited: false },
+      { playerName: () => 'Tom' },
+    );
+    assert.match(named.text, /Tom's Whistle Post/, `the arrival did not name the Office's owner: ${named.text}`);
+    assert.match(named.text, /Tom can work it/, `the arrival did not say whose train it is to work: ${named.text}`);
+    assert.doesNotMatch(named.text, /\bYou can work it\b/i, `the arrival still addresses every reader: ${named.text}`);
+
+    // No resolver — still English, and still no raw index leaking into a sentence.
+    const anon = narrate({
+      type: 'trainArrived', trainNumber: 3, consist: [], office: 'Whistle Post', owner: 1, expedited: false,
+    });
+    assert.match(anon.text, /at the Whistle Post/, anon.text);
+    assert.doesNotMatch(anon.text, /undefined|\bplayer \d+\b/i, anon.text);
+  });
+
   it('points at the board cell where something happened', () => {
     const n = narrate({ type: 'loadCompleted', player: 0, at: { row: 1, col: 2 }, carType: 'hopper' });
     assert.deepEqual(n.where, { row: 1, col: 2 });
@@ -123,9 +221,12 @@ describe('impediments', () => {
   });
 
   it('warns when every A/D track is occupied', () => {
-    // Gap 2d — the next arrival is an automatic collision.
+    // Gap 2d — the next arrival is an automatic collision. Filled to CAPACITY rather than to one
+    // train, so the fixture says what it means whatever the Office opens as: a Depot has two A/D
+    // tracks and one occupied is not a warning.
     const s = createGame({ id: 'g', seed: 5, config, playerNames: ['p'] });
-    s.officeAreas.get(0)!.adOccupancy = ['t0'];
+    const area = s.officeAreas.get(0)!;
+    area.adOccupancy = Array.from({ length: officeProfile(area.tier).adTracks }, (_, i) => `t${i}`);
     const found = impediments(s, 0);
     assert.ok(found.some((b) => /A\/D/.test(b.why) && b.severity === 'risk'));
   });
@@ -136,6 +237,192 @@ describe('impediments', () => {
     s.freeTrays = [];
     assert.ok(impediments(s, 0).some((b) => /HELD/.test(b.why)));
   });
+
+  /** A crew standing on `at`, working the given train, with one empty tank car on the drawbar. */
+  const express = (s: GameState, trainNumber: number, at: GridCoord): string => {
+    const id = s.freeTrays.pop()!;
+    s.trays.set(id, {
+      id, trainNumber, trainIsExtra: false, engineAt: 0,
+      consist: [{ type: 'tank', loaded: false, origin: 0 }],
+      direction: 'east', position: { at: 'grid', seat: 0, coord: at }, movesUsed: 0,
+    });
+    return id;
+  };
+
+  /**
+   * GITEA#21 — THE GAME REFUSED, AND THE PANEL EXPLAINED SOMETHING ELSE.
+   *
+   * "I wanted to drop two empty tank cars so that the freight agents and men at work could load
+   * them later. I dropped the first tank car, but that was all I was allowed to do. Checked
+   * 'Blocked — why nothing is moving' and saw: refinery 1,0 — green box empty — nothing to load
+   * (needs a Freight Agent action)."
+   *
+   * Replayed from the attached save (seed 550943578, 181 intents): the crew was Train 3, and the
+   * engine's answer was `FREIGHT_WORKED_HERE`. Train 3 is the Express, and the Express prints "May
+   * drop or pick up one freight car at every location" — so THE REFUSAL WAS CORRECT and the rule
+   * is not what is wrong here. It resets next turn, and the Express may work a car at the next
+   * square this turn; that is what makes it an Express rather than a one-car-a-Stage train.
+   *
+   * What was wrong is that nothing said so. The panel whose entire job is "why is nothing moving?"
+   * listed the refinery's green box — a true statement about the FACILITY, and nothing to do with
+   * why the drop was refused — so the player was sent to fix a Freight Agent action that would not
+   * have helped. The rule was on the train card's own tooltip, which is not where somebody looks
+   * when a button they expected is missing.
+   *
+   * The panel is where a refusal gets explained, so the budget belongs in it.
+   */
+  it('says when the Express has spent its one freight car on this square (Gitea#21)', () => {
+    const s = createGame({ id: 'g', seed: 5, config, playerNames: ['p'] });
+    const area = areaOf(s, 0);
+    const at = area.officeCoord;
+
+    // A crew standing at the Office working Train 3 — the Express — with a tank car still on it.
+    const trayId = express(s, 3, at);
+
+    s.clock.phase = 'localOps';
+    const turn = turnOf(s, 0);
+    turn.option = 'switch';
+
+    // Nothing to say before it has worked anything here.
+    assert.ok(
+      !impediments(s, 0).some((b) => /FREIGHT CAR PER LOCATION/i.test(b.why)),
+      'the budget was reported spent before the train had worked a car at all',
+    );
+
+    // Now it has set one car out here — exactly the state the save is in at intent 181.
+    turn.freightWorked[`${trayId}@${coordKey(at)}`] = 1;
+
+    const row = impediments(s, 0).find((b) => /FREIGHT CAR PER LOCATION/i.test(b.why));
+    assert.ok(
+      row,
+      `nothing explained the refusal:\n${JSON.stringify(impediments(s, 0), null, 2)}`,
+    );
+    // It must name the train, or a player with three crews out cannot tell which one it means.
+    assert.match(row!.where, /Train 3/);
+    // And it must say the limit lifts, or it reads as "this train can never work here again".
+    assert.match(row!.why, /turn/i);
+    // Amber: this is the printed rule doing its job, not a fault.
+    assert.equal(row!.severity, 'waiting');
+  });
+
+  it('leaves every other train alone — the rule is printed on 3 and 4 only (Gitea#21)', () => {
+    const s = createGame({ id: 'g', seed: 5, config, playerNames: ['p'] });
+    const area = areaOf(s, 0);
+    const at = area.officeCoord;
+    // Train 5 is The Sparrow, which prints no per-location freight limit.
+    const trayId = express(s, 5, at);
+    s.clock.phase = 'localOps';
+    turnOf(s, 0).option = 'switch';
+    turnOf(s, 0).freightWorked[`${trayId}@${coordKey(at)}`] = 1;
+
+    assert.ok(
+      !impediments(s, 0).some((b) => /FREIGHT CAR PER LOCATION/i.test(b.why)),
+      'a train with no such rule was told it had spent a budget it does not have',
+    );
+  });
+});
+
+/**
+ * Gitea#2 — "four porters, two passengers on the platform, and I never get the chance to work them."
+ *
+ * The engine was faithful at every step; what was missing was any way to SEE why. A Porter action
+ * that cannot be taken is simply absent from the menu, and this panel — the one that answers "why is
+ * nothing moving?" — opened with `f.kind !== 'freight'`, so a platform had never had anything to say
+ * for itself at all.
+ */
+describe('a blocked platform says why (Gitea#2)', () => {
+  /** Raise the Whistle Post to a working Terminal: the tier's printed numbers, applied directly. */
+  function platform(s: GameState) {
+    const area = areaOf(s, 0);
+    area.tier = 'terminal';
+    const card = area.grid.get(coordKey(area.officeCoord))!;
+    const f = card.facility!;
+    f.allows = { outbound: true, inbound: true };
+    f.porters = 3;
+    f.capacity = { outbound: 3, inbound: 3 };
+    return { area, f };
+  }
+
+  /** A tray standing on an A/D track at the Office, carrying whatever it is given. */
+  function atOffice(s: GameState, consist: { type: 'coach'; loaded: boolean; origin?: number }[]): void {
+    const area = areaOf(s, 0);
+    const id = s.freeTrays.pop()!;
+    s.trays.set(id, {
+      id, trainNumber: null, trainIsExtra: false, engineAt: 0, consist,
+      direction: 'east', position: { at: 'grid', seat: 0, coord: area.officeCoord }, movesUsed: 0,
+    });
+    area.adOccupancy.push(id);
+  }
+
+  it('reports passengers standing on a platform with no train to take them', () => {
+    // The whole of the bug's second half: before this, `impediments` returned an EMPTY list here.
+    const s = createGame({ id: 'g', seed: 5, config, playerNames: ['p'] });
+    const { f } = platform(s);
+    f.outboundBox = [{ type: 'coach', loaded: true }];
+    const found = impediments(s, 0);
+    const platformRow = found.find((b) => /platform/.test(b.why));
+    assert.ok(platformRow, `nothing reported for the platform:\n${JSON.stringify(found, null, 2)}`);
+    assert.match(platformRow.why, /passengers waiting, no train at the platform/);
+    assert.equal(platformRow.severity, 'waiting');
+  });
+
+  it('names the Office by its tier rather than the word "facility"', () => {
+    // A Passenger Facility rides on the `office` card, so the freight branch's `geometry.facility`
+    // is not there to read and every passenger row read `facility 0,0` next to `mineTipple 1,-3`.
+    const s = createGame({ id: 'g', seed: 5, config, playerNames: ['p'] });
+    const { f } = platform(s);
+    f.outboundBox = [{ type: 'coach', loaded: true }];
+    const row = impediments(s, 0).find((b) => /platform/.test(b.why))!;
+    assert.match(row.where, /^terminal /, `the Office is unnamed: ${row.where}`);
+  });
+
+  it('explains the coach shortage that made the game look broken', () => {
+    // The reported state: a train in with passengers to set down, red slots free, four porters —
+    // and §9.2 needs a white coach out of the Division Yard to swap in. There was none, with eight
+    // more sitting in the Classification Yard that §2.2 returns only when the Division Yard is BARE.
+    const s = createGame({ id: 'g', seed: 5, config, playerNames: ['p'] });
+    const { f } = platform(s);
+    atOffice(s, [{ type: 'coach', loaded: true, origin: 1 }]);
+    s.yards.divisionYard = s.yards.divisionYard.filter((c) => !(c.type === 'coach' && !c.loaded));
+    s.yards.classificationYard = [
+      { type: 'coach', loaded: false },
+      { type: 'coach', loaded: false },
+    ];
+    const row = impediments(s, 0).find((b) => /§9\.2/.test(b.why));
+    assert.ok(row, `the coach shortage was not explained:\n${JSON.stringify(impediments(s, 0), null, 2)}`);
+    assert.equal(row.severity, 'stuck', 'a train that cannot be emptied is stuck, not merely waiting');
+    assert.match(row.why, /2 coaches are in the Classification Yard/, `where the coaches are is not said: ${row.why}`);
+    assert.match(row.why, /Classification returns only when the Division Yard is bare/);
+    assert.ok(f.inboundBox.length === 0, 'the red slots were free — the shortage is the only cause');
+  });
+
+  it('says why the game ended in words, not as a raw enum (TODO #34)', () => {
+    /**
+     * The heading read `loss — revenueFloor` — the exact defect Gitea#16 was filed about on the
+     * playable page, still alive here a release after that was fixed, because nothing
+     * player-facing pointed at the developer replay. It shares `reasonSentence` with the results
+     * screen now, so the two cannot explain one ending in two ways.
+     */
+    const rec = record(1234, 'standard');
+    for (const raw of ['revenueFloor', 'daysElapsed', 'collisionFloor']) {
+      assert.ok(!rec.outcome.includes(raw), `the summary still prints the raw reason "${raw}"`);
+    }
+    assert.doesNotMatch(rec.outcome, /<[^>]+>/, 'markup leaked into a heading and a console line');
+    assert.match(rec.outcome, /Revenue/, 'the summary says nothing about how the game went');
+    // And the sentence is the shared one, with this game's own numbers in it.
+    assert.match(rec.outcome, /closed short|last on the timetable|declared unsafe/,
+      'the ending is not explained in the words the results screen uses');
+  });
+
+  it('says nothing about a platform that is working fine', () => {
+    // Passengers waiting AND a train with an empty coach to take them: no impediment.
+    const s = createGame({ id: 'g', seed: 5, config, playerNames: ['p'] });
+    const { f } = platform(s);
+    f.outboundBox = [{ type: 'coach', loaded: true }];
+    atOffice(s, [{ type: 'coach', loaded: false }]);
+    const found = impediments(s, 0).filter((b) => /platform|§9\.2|Porters/.test(b.why));
+    assert.deepEqual(found, [], `a working platform reported an impediment:\n${JSON.stringify(found, null, 2)}`);
+  });
 });
 
 describe('replay recording', () => {
@@ -170,7 +457,10 @@ describe('replay recording', () => {
     const last = rec.frames[rec.frames.length - 1]!;
     assert.equal(last.revenue, stats.revenue.net, 'final revenue disagrees with the engine');
     assert.equal(last.day, s.clock.day, 'final Day disagrees with the engine');
-    assert.match(rec.outcome, new RegExp(stats.result));
+    // The summary says "won"/"lost" rather than the engine's `win`/`loss` (TODO #34 — it is a
+    // sentence for a reader now, not an enum). Mapped here so this still checks the two AGREE,
+    // which is what the test is for, rather than checking they are spelled the same.
+    assert.match(rec.outcome, new RegExp(stats.result === 'win' ? 'won' : 'lost'));
   });
 
   it('narrates every frame', () => {
@@ -437,8 +727,14 @@ describe('the replay behaves like the game it is replaying', () => {
      * TWENTY-FOUR, not twelve, and the difference is instructive: on this stride the first game that
      * couples anything is index 13, so a twelve-seed pool still contained none. The rate is what
      * matters, not the count — measured 39 in 200, with couplers at indices 13, 19, 22, 24, 28 …
+     *
+     * SIXTY, not twenty-four, since every player opens on a Depot. Two A/D tracks instead of one is
+     * the single biggest reason a game used to end in a wreck, so collisions went from rare to much
+     * rarer: measured on this stride, no crash cue appears in the first 24 seeds or the first 40,
+     * and the pool needs 60 to contain one. Widened rather than dropped, per the note below — §10
+     * is the one event a player most needs to hear.
      */
-    const recs = Array.from({ length: 24 }, (_, i) => record(1000 + i * 7919, 'standard', 4000));
+    const recs = Array.from({ length: 60 }, (_, i) => record(1000 + i * 7919, 'standard', 4000));
     const withCues = recs.flatMap((rec) => rec.frames.filter((f) => (f.cues?.length ?? 0) > 0));
     assert.ok(withCues.length > 20, `only ${withCues.length} frames carry a cue`);
 
@@ -453,10 +749,10 @@ describe('the replay behaves like the game it is replaying', () => {
     assert.ok(kinds.has('schedule'), 'the 1D12 that sets a train\'s departure Stage landed silently');
     assert.ok(kinds.has('arrive'), 'a train pulling into an Office never made a sound');
     assert.ok(kinds.has('depart'), 'a train highballing out of an Office never made a sound');
-    // Collisions are rare — measured 2 in 40 games — so this is the one cue this pool is not
-    // guaranteed to contain on every stride; it happens to (seeds 96028 and 159380) at the current
-    // stride and seed count. If this starts failing after either changes, widen the pool rather than
-    // deleting the assertion — §10 is the one event a player most needs to hear.
+    // Collisions are rarer still now that every Office opens as a Depot — see the note above. This
+    // is the one cue the pool is not guaranteed to contain on every stride. If it starts failing
+    // after the stride, the seed count or the opening changes, widen the pool rather than deleting
+    // the assertion — §10 is the one event a player most needs to hear.
     assert.ok(kinds.has('crash'), 'a collision never made a sound');
 
     // One CLOCK cue per Stage boundary, the bell replacing the whistle at a Day — the same

test/route-cache.test.ts

@@ -0,0 +1,92 @@
+/**
+ * The engine's speed-ups must not change a single game (2026-09-15).
+ *
+ * `applyIntent` became `prepareIntent` (check and execute, sharing one walk of the position's routes)
+ * followed by `commitEvents` (reduce and tally), so the switching planner can decide every candidate
+ * against one position and apply each to a copy. Two properties hold that together:
+ *
+ * 1. `prepareIntent` never writes the state it reads — including through the route cache it opens.
+ * 2. Preparing on one state and committing to an EQUAL copy lands on exactly what `applyIntent` does.
+ *
+ * Checked at every decision of seeded bot games rather than on hand-built positions, so the intents
+ * exercised are the ones real play submits.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { pump } from '../src/engine/advance.ts';
+import { applyIntent, commitEvents, prepareIntent } from '../src/engine/apply.ts';
+import {
+  DEFAULT_MAX_COLLISIONS_PER_DAY,
+  DEFAULT_MAX_COLLISIONS_TOTAL,
+  collectiveRevenueFloor,
+  lengthProfile,
+} from '../src/engine/content.ts';
+import { legalActions } from '../src/engine/legal.ts';
+import { createGame } from '../src/engine/setup.ts';
+import type { GameConfig, GameState } from '../src/engine/state.ts';
+import { developerBot, playGame } from '../src/sim/bot.ts';
+
+const config = (): GameConfig => {
+  const days = lengthProfile('short').days;
+  return {
+    mode: 'solitaire',
+    days,
+    minCombinedRevenue: collectiveRevenueFloor(1, days),
+    maxCollisionsPerDay: DEFAULT_MAX_COLLISIONS_PER_DAY,
+    maxCollisionsTotal: DEFAULT_MAX_COLLISIONS_TOTAL,
+    pvpCardsAllowed: false,
+    // These fixtures were written against a Whistle Post opening — one A/D track and no
+    // Control Point — and several of them test exactly that. Named explicitly since the
+    // default became a Depot.
+    houseRules: { startingOffice: 'whistlePost' },
+    optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
+  };
+};
+
+const serialise = (s: GameState): string =>
+  JSON.stringify(s, (_k, v) => (v instanceof Map ? [...v] : v instanceof Set ? [...v] : v));
+
+describe('applyIntent split into prepareIntent and commitEvents', () => {
+  it('prepares without writing, and committing to a copy matches applying in place', () => {
+    let decisions = 0;
+    let rejectedSeen = 0;
+    const s = createGame({ id: 'split-8919', seed: 8919, config: config(), playerNames: ['bot'] });
+    const policy = {
+      name: 'split-probe',
+      choose(st: GameState, player: number, options: ReturnType<typeof legalActions>) {
+        const chosen = developerBot.choose(st, player, options);
+        if (decisions < 400) {
+          decisions++;
+          const before = serialise(st);
+          const prepared = prepareIntent(st, player, chosen);
+          assert.equal(serialise(st), before, `decision ${decisions}: prepareIntent wrote into the state it read`);
+          assert.ok(prepared.ok, `decision ${decisions}: a legal choice was refused by prepareIntent`);
+
+          const viaCommit = structuredClone(st);
+          const viaApply = structuredClone(st);
+          commitEvents(viaCommit, prepared.events);
+          const applied = applyIntent(viaApply, player, chosen);
+          assert.ok(applied.ok);
+          assert.deepEqual(applied.events, prepared.events, `decision ${decisions}: the two paths produced different events`);
+          assert.equal(serialise(viaCommit), serialise(viaApply), `decision ${decisions}: committing to a copy diverged from applying`);
+
+          // A refused intent must come back refused from both paths, with nothing written.
+          const refused = { type: 'switch.end' } as const;
+          const r = prepareIntent(st, player, refused);
+          if (!r.ok) {
+            rejectedSeen++;
+            assert.equal(serialise(st), before);
+            assert.equal(applyIntent(structuredClone(st), player, refused).ok, false);
+          }
+        }
+        return chosen;
+      },
+    };
+    const r = playGame(s, policy, pump);
+    assert.ok(r.finished, 'the probed game did not finish');
+    assert.ok(decisions > 0, 'no decision was probed');
+    assert.ok(rejectedSeen > 0, 'no refused intent was exercised');
+  });
+});

test/server/claims.test.ts

@@ -0,0 +1,68 @@
+/**
+ * Seat recovery codes — Gitea#33.
+ *
+ * The properties worth pinning are the ones that make a code safe to put in a link: it is spendable
+ * exactly once, it stops working on its own, and a bad code is indistinguishable from a spent one.
+ * `now` is a parameter rather than a clock, so expiry is tested without faking timers.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { CLAIM_TTL_MS, createClaimStore } from '../../src/server/claims.ts';
+
+describe('seat recovery codes', () => {
+  it('mints a code that names the seat it was minted for', () => {
+    const claims = createClaimStore();
+    const { code, expiresAt } = claims.mint('tok-abc', 'game-1', 1000);
+    assert.equal(expiresAt, 1000 + CLAIM_TTL_MS);
+    assert.deepEqual(claims.redeem(code, 1000), { token: 'tok-abc', gameId: 'game-1' });
+  });
+
+  it('spends a code exactly once — a link in a chat log is worth nothing afterwards', () => {
+    const claims = createClaimStore();
+    const { code } = claims.mint('tok-abc', 'game-1', 0);
+    assert.ok(claims.redeem(code, 1));
+    assert.equal(claims.redeem(code, 2), null, 'the same code was accepted twice');
+  });
+
+  it('stops working once its time is up, without anything having to sweep it', () => {
+    const claims = createClaimStore();
+    const { code } = claims.mint('tok-abc', 'game-1', 0);
+    assert.equal(claims.redeem(code, CLAIM_TTL_MS - 1)?.token, 'tok-abc', 'expired early');
+    const again = claims.mint('tok-abc', 'game-1', 0).code;
+    assert.equal(claims.redeem(again, CLAIM_TTL_MS), null, 'a code outlived its expiry');
+  });
+
+  it('answers the same way for unknown, spent and expired codes', () => {
+    const claims = createClaimStore();
+    const { code } = claims.mint('tok-abc', 'game-1', 0);
+    claims.redeem(code, 1);
+    const expired = claims.mint('tok-abc', 'game-1', 0).code;
+
+    assert.equal(claims.redeem('never-existed', 1), null);
+    assert.equal(claims.redeem(code, 1), null);
+    assert.equal(claims.redeem(expired, CLAIM_TTL_MS + 1), null);
+  });
+
+  it('gives every mint its own code', () => {
+    const claims = createClaimStore();
+    const codes = new Set([0, 1, 2, 3, 4].map(() => claims.mint('tok-abc', 'game-1', 0).code));
+    assert.equal(codes.size, 5, 'two mints produced the same code');
+  });
+
+  it('forgets expired codes rather than accumulating them', () => {
+    const claims = createClaimStore();
+    claims.mint('tok-a', 'game-1', 0);
+    claims.mint('tok-b', 'game-1', 0);
+    assert.equal(claims.outstanding(0), 2);
+    assert.equal(claims.outstanding(CLAIM_TTL_MS), 0, 'expired codes were still being held');
+  });
+
+  it('keeps a short-lived code short-lived when asked for one', () => {
+    const claims = createClaimStore();
+    const { code, expiresAt } = claims.mint('tok-abc', 'game-1', 500, 60_000);
+    assert.equal(expiresAt, 60_500);
+    assert.equal(claims.redeem(code, 60_500), null);
+  });
+});

test/server/http.test.ts

@@ -0,0 +1,171 @@
+/**
+ * The HTTP layer, driven end to end over a real socket. `startServer` binds port 0 on a temp data
+ * directory; nothing here reads the built site, so `distDir` is a directory with nothing in it.
+ *
+ * Added in v0.8.4, when four faults in `http.ts` turned out to be uncovered because no test had ever
+ * stood the server up: a leaver's token surviving the leave, an unbounded body, a torn save under
+ * concurrent moves, and a crash on an error after the SSE head was sent.
+ */
+
+import { describe, it, after, before } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { Server } from 'node:http';
+
+import type { GameConfig } from '../../src/engine/state.ts';
+import { startServer } from '../../src/server/http.ts';
+
+const SECRET = 'test-secret';
+const config: GameConfig = {
+  mode: 'competitive',
+  days: 5,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
+  houseRules: { startingOffice: 'whistlePost' },
+  optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
+};
+
+let server: Server;
+let base = '';
+let dataDir = '';
+
+before(async () => {
+  dataDir = await mkdtemp(join(tmpdir(), 'station-master-http-'));
+  server = startServer({
+    port: 0,
+    bindAddress: '127.0.0.1',
+    joinSecret: SECRET,
+    distDir: dataDir,
+    dataDir,
+    engineVersion: 'test',
+    initialGames: new Map(),
+    initialLobbies: new Map(),
+    initialSessions: new Map(),
+  });
+  await new Promise<void>((resolve) => server.once('listening', resolve));
+  const addr = server.address();
+  if (!addr || typeof addr === 'string') throw new Error('no port');
+  base = `http://127.0.0.1:${addr.port}`;
+});
+
+after(async () => {
+  server.closeAllConnections();
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+  // A write queued behind the last move may still be landing; retry rather than race it.
+  await rm(dataDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 });
+});
+
+const post = async (path: string, body: unknown): Promise<{ status: number; json: Record<string, unknown> }> => {
+  const res = await fetch(base + path, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+  return { status: res.status, json: (await res.json()) as Record<string, unknown> };
+};
+const get = async (path: string): Promise<number> => (await fetch(base + path)).status;
+
+/** The first SSE message on a stream, then the stream is dropped. */
+async function firstPush(path: string): Promise<Record<string, unknown>> {
+  const res = await fetch(base + path);
+  assert.equal(res.status, 200, `${path} answered ${res.status}`);
+  const reader = res.body!.getReader();
+  const decoder = new TextDecoder();
+  let buffer = '';
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (done) throw new Error('stream ended before a push');
+    buffer += decoder.decode(value, { stream: true });
+    const m = /data: (.*)\n\n/.exec(buffer);
+    if (m) {
+      await reader.cancel();
+      return JSON.parse(m[1]!) as Record<string, unknown>;
+    }
+  }
+}
+
+type Seat = { token: string; player: number; gameId: string; gameCode: string };
+
+async function table(): Promise<{ host: Seat; guest: Seat }> {
+  const created = await post('/api/lobby/create', { secret: SECRET, config, displayName: 'Host', players: 2 });
+  assert.equal(created.status, 200, JSON.stringify(created.json));
+  const host = created.json as unknown as Seat;
+  const joined = await post('/api/lobby/join', { secret: SECRET, gameCode: host.gameCode, displayName: 'Guest' });
+  assert.equal(joined.status, 200, JSON.stringify(joined.json));
+  return { host, guest: joined.json as unknown as Seat };
+}
+
+describe('the HTTP layer (v0.8.4)', () => {
+  it('revokes the token of a player who leaves, so it cannot play the seat the next arrival takes', async () => {
+    const { host, guest } = await table();
+    const left = await post('/api/lobby/leave', { token: guest.token });
+    assert.equal(left.status, 200);
+    // The leaver's token is dead at once — for the lobby and for the game that follows.
+    assert.equal(await get(`/api/lobby/stream?token=${guest.token}`), 404, 'a leaver can still watch the lobby');
+    const again = await post('/api/lobby/join', { secret: SECRET, gameCode: host.gameCode, displayName: 'Newcomer' });
+    assert.equal(again.status, 200);
+    assert.equal(again.json['player'], guest.player, 'the vacated chair was not the one re-offered');
+    const started = await post('/api/lobby/start', { token: host.token });
+    assert.equal(started.status, 200, JSON.stringify(started.json));
+    assert.equal(await get(`/api/session?token=${guest.token}`), 404, 'the leaver still holds a seat in the running game');
+    assert.equal(await get(`/api/stream?token=${guest.token}`), 404, "the leaver can read the newcomer's stream");
+    const move = await post(`/api/intent?token=${guest.token}`, { seq: 1, intent: { type: 'localOps.choose', option: 'draw' } });
+    assert.equal(move.status, 404, 'the leaver can move for the newcomer');
+    // And the newcomer's own token works.
+    assert.equal(await get(`/api/session?token=${again.json['token'] as string}`), 200);
+    // On disk too, so a restart does not hand the seat back.
+    const onDisk = JSON.parse(await readFile(join(dataDir, 'games', host.gameId, 'sessions.json'), 'utf8')) as { token: string }[];
+    assert.ok(!onDisk.some((s) => s.token === guest.token), 'the revoked token is still in sessions.json');
+  });
+
+  it('lets the host remove a player, revoking that token the same way', async () => {
+    const { host, guest } = await table();
+    const removed = await post('/api/lobby/leave', { token: host.token, seat: guest.player });
+    assert.equal(removed.status, 200, JSON.stringify(removed.json));
+    assert.equal(await get(`/api/lobby/stream?token=${guest.token}`), 404);
+    assert.equal(await get(`/api/lobby/stream?token=${host.token}`), 200, 'the host lost their own seat');
+  });
+
+  it('refuses an oversized body before reading it, and a malformed one with 400', async () => {
+    const big = await fetch(base + '/api/claim', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ code: 'x'.repeat(200_000) }),
+    });
+    assert.equal(big.status, 413);
+    const bad = await fetch(base + '/api/lobby/join', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{not json' });
+    assert.equal(bad.status, 400);
+    const notObject = await fetch(base + '/api/lobby/join', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: 'null' });
+    assert.equal(notObject.status, 400);
+  });
+
+  it('tells a connecting seat where its intent count stands', async () => {
+    const { host, guest } = await table();
+    assert.equal((await post('/api/lobby/start', { token: host.token })).status, 200);
+    const hostPush = await firstPush(`/api/stream?token=${host.token}`);
+    const actor = hostPush['menu'] !== null ? host : guest;
+    assert.equal(hostPush['lastSeq'], 0);
+    const move = await post(`/api/intent?token=${actor.token}`, { seq: 1, intent: { type: 'localOps.choose', option: 'draw' } });
+    assert.deepEqual(move.json, { ok: true });
+    const reconnect = await firstPush(`/api/stream?token=${actor.token}`);
+    assert.equal(reconnect['lastSeq'], 1, 'the reconnect push does not carry the count');
+  });
+
+  it('applies a burst of concurrent moves one at a time and leaves the save readable', async () => {
+    const { host, guest } = await table();
+    assert.equal((await post('/api/lobby/start', { token: host.token })).status, 200);
+    const hostPush = await firstPush(`/api/stream?token=${host.token}`);
+    const actor = hostPush['menu'] !== null ? host : guest;
+    // Three moves that are legal only in this order, fired together.
+    const intents = [
+      { type: 'localOps.choose', option: 'draw' },
+      { type: 'draw.fromHomeOffice' },
+      { type: 'draw.end' },
+    ];
+    const results = await Promise.all(intents.map((intent, i) => post(`/api/intent?token=${actor.token}`, { seq: i + 1, intent })));
+    assert.ok(results.every((r) => r.status === 200), 'a concurrent move was answered with an error');
+    const save = JSON.parse(await readFile(join(dataDir, 'games', host.gameId, 'game.json'), 'utf8')) as { history: unknown[] };
+    assert.ok(save.history.length >= 1, 'no move reached the save');
+    assert.equal(save.history.length, results.filter((r) => r.json['ok'] === true).length, 'the save and the answers disagree');
+  });
+});

test/server/lobby.test.ts

@@ -10,6 +10,7 @@ import {
   createLobby,
   freshGameCode,
   joinLobby,
+  leaveLobby,
   playerCountAllowed,
   reassignHost,
   setBotSeat,
@@ -23,6 +24,10 @@ const competitive: GameConfig = {
   maxCollisionsPerDay: 0,
   maxCollisionsTotal: 0,
   pvpCardsAllowed: false,
+  // These fixtures were written against a Whistle Post opening — one A/D track and no
+  // Control Point — and several of them test exactly that. Named explicitly since the
+  // default became a Depot.
+  houseRules: { startingOffice: 'whistlePost' },
   optionalRules: {
     reducedVisibility: false,
     employeeRotation: false,
@@ -250,3 +255,96 @@ describe('game codes', () => {
     assert.match(code, /^[A-Z]+-\d{4}$/);
   });
 });
+
+describe('a name nobody else at the table is using', () => {
+  /**
+   * The display name is not decoration: it labels the district on the Division map, it is what the
+   * turn chart means by "waiting on Jesse", and `record()` puts it in front of every line that
+   * player causes. Two identical names make all three ambiguous, and the names lock at
+   * `Lobby.Start` — so the refusal has to happen at the door.
+   */
+  it('refuses a second player using a name already at the table, whatever the case or spacing', () => {
+    const { lobby } = createLobby(competitive, 'Alice', 'RAIL-0001', 4);
+    for (const attempt of ['Alice', 'alice', '  ALICE  ']) {
+      const result = joinLobby(lobby, attempt);
+      assert.equal(result.ok, false, `"${attempt}" was allowed alongside Alice`);
+      if (!result.ok) assert.equal(result.code, 'NAME_TAKEN');
+    }
+  });
+
+  it('frees the name again when that player leaves', () => {
+    const { lobby, session } = createLobby(competitive, 'Alice', 'RAIL-0001', 4);
+    const joined = joinLobby(lobby, 'Bob');
+    assert.ok(joined.ok);
+    if (!joined.ok) return;
+    const after = leaveLobby(joined.lobby, joined.session.token);
+    const again = joinLobby(after.lobby, 'Bob');
+    assert.equal(again.ok, true, 'a departed player’s name was still held against the table');
+    assert.equal(after.empty, false, 'the host is still seated');
+    assert.equal(after.lobby.hostToken, session.token, 'a non-host leaving moved the host chair');
+  });
+});
+
+describe('leaving a lobby', () => {
+  /**
+   * There was no way out at all before 2026-08-23. Start needs every chair filled and `setBotSeat`
+   * refuses to touch an occupied human seat, so a mis-join or a player who wandered off wedged the
+   * whole table.
+   */
+  const table = () => {
+    const { lobby, session } = createLobby(competitive, 'Alice', 'RAIL-0001', 3);
+    const bob = joinLobby(lobby, 'Bob');
+    assert.ok(bob.ok);
+    if (!bob.ok) throw new Error('Bob could not sit down');
+    const carol = joinLobby(bob.lobby, 'Carol');
+    assert.ok(carol.ok);
+    if (!carol.ok) throw new Error('Carol could not sit down');
+    return { lobby: carol.lobby, alice: session, bob: bob.session, carol: carol.session };
+  };
+
+  it('empties the chair and forgets the token, leaving the rest of the table alone', () => {
+    const { lobby, bob } = table();
+    const after = leaveLobby(lobby, bob.token);
+    assert.equal(after.lobby.seats[1], null, 'the seat was not freed');
+    assert.equal(after.lobby.seats.length, 3, 'the table changed size');
+    assert.ok(!after.lobby.joinOrder.includes(bob.token), 'the departed token is still in the join order');
+    assert.equal((after.lobby.seats[0] as { displayName: string }).displayName, 'Alice');
+    assert.equal((after.lobby.seats[2] as { displayName: string }).displayName, 'Carol');
+  });
+
+  it('names a seat to clear somebody else — what the host’s "remove" does', () => {
+    const { lobby, alice, carol } = table();
+    const after = leaveLobby(lobby, alice.token, 2);
+    assert.equal(after.lobby.seats[2], null, 'the named seat was not cleared');
+    assert.ok(!after.lobby.joinOrder.includes(carol.token));
+    // Seat index IS player index (`lobby.ts`), so nothing may shuffle up to fill the hole.
+    assert.equal((after.lobby.seats[0] as { displayName: string }).displayName, 'Alice');
+    assert.equal((after.lobby.seats[1] as { displayName: string }).displayName, 'Bob');
+  });
+
+  it('passes host rights on when the host is the one who leaves', () => {
+    const { lobby, alice, bob } = table();
+    const after = leaveLobby(lobby, alice.token);
+    assert.equal(after.lobby.hostToken, bob.token, 'the earliest-joined remaining player did not become host');
+    assert.equal(after.empty, false);
+  });
+
+  it('reports the table empty when the last human goes, so the caller can drop it', () => {
+    const { lobby, alice, bob, carol } = table();
+    const one = leaveLobby(lobby, bob.token);
+    const two = leaveLobby(one.lobby, carol.token);
+    assert.equal(two.empty, false, 'Alice is still sitting there');
+    const three = leaveLobby(two.lobby, alice.token);
+    assert.equal(three.empty, true, 'a lobby with nobody human in it did not report itself empty');
+  });
+
+  it('leaves a bot seat to the bot controls, and ignores a token holding no seat', () => {
+    const { lobby, alice } = table();
+    const withBot = setBotSeat(leaveLobby(lobby, alice.token, 1).lobby, 1, true);
+    // `leaveLobby` is about people. A bot is removed with the button that put it there.
+    const after = leaveLobby(withBot, alice.token, 1);
+    assert.deepEqual(after.lobby.seats[1], { kind: 'bot' }, 'leaving cleared a bot seat');
+    const stranger = leaveLobby(withBot, 'not-a-token');
+    assert.equal(stranger.lobby, withBot, 'an unknown token changed the lobby');
+  });
+});