v0.7.9.8 — the test command did not typecheck, and the plan had gone stale

Housekeeping before v0.8.0: the answer to "anything else that should be
looked at first". One real hole, one stale document, and my own leavings.

#102 — `npm test` passed green on a type error. `pretest` ran
`scripts/build-web.ts`, which invokes `tsc --ignoreConfig` against three
web entry points, so it saw only what those three transitively import and
under a WEAKER configuration than tsconfig.json — no
`noUncheckedIndexedAccess`, no `exactOptionalPropertyTypes`,
`--types ''`. It never saw `src/server/` or a single file under `test/`.

Demonstrated rather than argued: a planted
`const DELIBERATE_TYPE_ERROR: number = 'not a number';` in
src/server/session.ts gives `npm run typecheck` a TS2322 and `npm test` a
clean `# fail 0`. `pretest` is `tsc --noEmit && node
scripts/build-web.ts` now, and the same error exits 1 with the tests
never running.

This mattered THIS week rather than generally: v0.8.0 is steps 2-7 of the
common board — display stream, credentials, persistence, Chromium
supervisor — which is almost entirely src/server/, exactly the half the
test command could not see.

#103 — the plan had drifted from the code it is the source for.
docs/plans/jitsi-common-board.md was written 2026-08-27, still said "No
implementation has been performed", and is what steps 2-7 get built from.
Step 1 shipped across four releases since, so every "current code
finding" under it described a fault that is now fixed — a document
reading as present tense and nine days stale sends the next reader to fix
things twice.

Measured: its PublicFrame sketch lists four properties never built
(protocolVersion, config, scoring, deckCounts) and omits 28 that exist,
and the shape is the real difference — the implementation is FLAT where
the plan grouped things into objects, so a renderer written from the
sketch would not compile. The plan now says so at the top and at step 1,
names src/sim/view.ts and the redaction allow-list as the authority,
keeps the original sketch for its reasoning, and calls out
`protocolVersion` as unbuilt rather than dropping it quietly — step 2 is
the reconnecting display stream and is the first thing that would want
one.

One step-1 item is STRUCK OFF rather than built: "add the Red Flag holder
to the public player projection". The premise does not hold here.
`decks.redFlags` is written once, in setup.ts, from
`optionalRules.emergencyToolbox`, and never again — `redFlag.play` emits
`phaseEnded` and does not spend it — so every player holds one or none
does, decided before the deal. A per-player `redFlagHeld` would be one
already-public option copied N times, while telling every reader of the
common board that it varies by player and might change mid-game. Worse
than the absence. Pinned by test so it is not re-raised from the plan.

Four dead imports removed, all mine: `HAND_LIMIT` left unused in
apply.ts, view.ts and web/game.ts when 0.7.9.6 consolidated the three
copies of the §6.2 test, and `actingPlayer` in web/game.ts, dead since
0.7.9.5 made `currentActor` delegate. Finding them re-measured #46:
`tsc --noUnusedLocals` now reports 40, up from 29 on 2026-08-30. That
entry's "without the flag this list simply regrows" is a measurement
rather than a forecast now. The other 36 and the flag stay open.

946 tests pass, up from 943. No behaviour changes: three new tests pin an
invariant, and the rest is a build command, dead imports and a document.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y5boPxP6JHRYMm8adXaF5R

.gitignore

@@ -50,3 +50,9 @@ __pycache__/
 # one that is worth publishing.
 /playtests/*
 !/playtests/README.md
+
+# The Jitsi harness is NOT scrubbed — four of its files carry a real domain and real
+# participant names (workspace AGENTS.local.md). Ignored so that a `git add -A` cannot sweep it
+# into a history that would be permanently exposed if this repo is ever made public. When it is
+# promoted in Phase 1, scrub it FIRST, then `git add -f tools/`.
+tools/

CHANGELOG.md

@@ -19,6 +19,578 @@ page as `v0.1.0 · <sha> · <date>`, so what is deployed can always be identifie
 
 ---
 
+## 0.7.9.8 — 2026-09-07
+
+Housekeeping before v0.8.0 — the answer to "anything else that should be looked at first", which
+turned up one real hole and one stale document.
+
+### `npm test` did not typecheck, and passed green on a type error (#102)
+
+`pretest` ran `scripts/build-web.ts`, which invokes `tsc --ignoreConfig` against three web entry
+points. So it saw only what those three transitively import, under a **weaker** configuration than
+`tsconfig.json` — no `noUncheckedIndexedAccess`, no `exactOptionalPropertyTypes`, `--types ''` — and
+never saw `src/server/` or a single file under `test/`.
+
+Demonstrated rather than argued. Planting `const DELIBERATE_TYPE_ERROR: number = 'not a number';` in
+`src/server/session.ts`:
+
+```
+npm run typecheck → src/server/session.ts(441,7): error TS2322
+npm test          → # fail 0
+```
+
+`pretest` is `tsc --noEmit && node scripts/build-web.ts` now, and the same planted error exits 1 with
+the tests never running.
+
+**Why this week rather than generally.** v0.8.0 is steps 2-7 of the common board — a display stream,
+credentials, persistence, a Chromium supervisor — which is almost entirely `src/server/`, exactly the
+half the test command could not see.
+
+### The common-board plan had drifted from the code it is the source for (#103)
+
+`docs/plans/jitsi-common-board.md` was written on 2026-08-27, still said "No implementation has been
+performed", and is what steps 2-7 will be built from. Step 1 has since shipped across four releases,
+so every "current code finding" under it described a fault that is now fixed. A document that reads
+as present tense and is nine days stale sends the next reader to fix things twice.
+
+Measured: the plan's `PublicFrame` sketch lists four properties never built (`protocolVersion`,
+`config`, `scoring`, `deckCounts`) and omits **28** that exist. The shape is the real difference —
+the implementation is flat where the plan grouped things into `clock`, `config`, `scoring` and
+`deckCounts` objects, so a renderer written from the sketch would not compile against the projection.
+
+The plan now says all of this at the top and at step 1, names `src/sim/view.ts` and
+`test/redaction.test.ts`'s allow-list as the authority, keeps the original sketch for its reasoning,
+and lists what has been gained since. `protocolVersion` is called out as unbuilt rather than quietly
+dropped — step 2 is the reconnecting display stream and is the first thing that would want one.
+
+**And one step-1 item is struck off rather than built.** The plan asks for the Red Flag holder on the
+public player projection, "public game state but currently absent from `Frame`". The premise does not
+hold here: `decks.redFlags` is written once, in `setup.ts`, from `optionalRules.emergencyToolbox`,
+and never again — `redFlag.play` emits `phaseEnded` and does not spend it — so every player holds one
+or none does, decided before the deal. A per-player `redFlagHeld` would be one already-public option
+copied N times, while telling every reader of the common board that it varies by player and might
+change mid-game. That is worse than the absence. The invariant is pinned by test so the item is not
+re-raised from the plan text.
+
+### Four dead imports, and a measurement for #46
+
+Removed: `HAND_LIMIT`, left unused in `apply.ts`, `view.ts` and `web/game.ts` when 0.7.9.6
+consolidated the three copies of the §6.2 test into one, and `actingPlayer` in `web/game.ts`, dead
+since 0.7.9.5 made `currentActor` delegate. All four were mine.
+
+Finding them re-measured #46: **`tsc --noUnusedLocals` now finds 40, up from 29 on 2026-08-30.** That
+entry's prediction — "without the flag this list simply regrows — it is regrowing now" — is a
+measurement rather than a forecast. The remaining 36 and the flag itself are still open; ten of them
+still wait on #48 settling what `sim/replay.ts` is for.
+
+### Proof
+
+946 tests pass, up from 943. Nothing in this release changes behaviour: the three new tests pin an
+invariant and the rest is the build command, dead imports and a document.
+
+---
+
+## 0.7.9.7 — 2026-09-07
+
+The last item off 0.7.9.6's sweep — the one parked as a maybe, which turned out to have a second half
+worth more than the first.
+
+### A dispatch device now says whether it is still available (#101)
+
+Telegraph (+4), Telephone (+8) and Radio (+12) are "once a day, when dispatching facing trains, add
++N to the other train's number". `enhancementText(key)` takes only the key, so the tooltip could not
+vary with anything — a spent Radio read "Once a day, add +12…" for the rest of the Day, advertising a
+bonus that was not there. `trainRules` before #100, in another corner of the same view.
+
+**The half that actually surprises.** `spendDispatchBonus` reads `areaOf(s, s.clock.superintendent)`
+— the **Superintendent's own** devices, not the train owner's — and the Fedora moves every
+`STAGES_PER_SHIFT` (3) Stages, four times a Day. So a player's Radio does nothing at all for
+three-quarters of the Day, and is spent automatically, without its owner being asked, during the
+quarter it is theirs to use. Neither half was anywhere on the board.
+
+The card now reads as one of three states — available and dispatching, unspent but idle while
+somebody else holds the Fedora, or spent until the next Day — and names the shift length, because
+"not now" without "for how long" is half an answer. A spent device is struck through on the board.
+
+**On every district, not only your own** (Jesse's call): it is public, and a rival's spent Radio is
+exactly what you want to know before forcing a meet. `projectDistrict` serves the player's own cells
+and the common board's districts alike, so one change covers both.
+
+What counts as a device is `enhancementRule(key)?.dispatchBonus`, not three keys written out in the
+view — the ladder lives in `ENHANCEMENT_RULES`, and a fourth rung would otherwise be silently exempt.
+
+### A stale comment corrected, and turned into a test
+
+`advance.ts` warned that indexing a seat-keyed Office Area with the player holding the Fedora "is
+right only while seating is the identity map". It reads as a live Employee Rotation bug and is not
+one: `areaOf(s, p)` **is** `areaAtSeat(s, seatOf(s, p))`. A comment that sends the next reader
+chasing a bug that does not exist costs about what the bug would. It is rewritten, and the claim is
+now pinned by a test — seating set to a real permutation, and the Superintendent's own district, not
+the seat with the same index, is the one that reads as dispatching.
+
+### Two things caught by mutation rather than by passing
+
+**A test that passed for the wrong reason.** "Leaves a non-dispatch enhancement alone" asserted the
+absence of /spent|Fedora/ with the Fedora held — and a mutant with the `dispatchBonus` guard deleted
+**passed it**, because the leaked text in that case reads "Available today, and this district is
+dispatching", which contains neither word. A test that something was left alone has to compare it
+against what it should be; it asserts equality with `enhancementText` now, in both Fedora states.
+
+**The replay wire format needed the field.** Cells are packed positionally and the round-trip test
+caught the loss immediately. The flag is index 9 and reads `?? []`, the same tolerance `standingWest`
+uses, so recordings made before it existed report no device spent — exactly what they drew at the
+time, leaving every published replay unchanged.
+
+### Proof
+
+943 tests pass, up from 934. The 9 new ones were written red. Mutation: using the raw player index
+for the Fedora check fails 1, ignoring the spent record fails 3, and treating every enhancement as a
+dispatch device fails 1 — that last one only after the test above was tightened, which is how the
+hole was found.
+
+**Not verified at a table**, like 0.7.9.6. #39 and #35 still stand, and the pre-0.8.0 session is
+where they get closed.
+
+---
+
+## 0.7.9.6 — 2026-09-07
+
+Three things the engine knew and the screen did not, found by looking for them rather than by
+waiting to be told — plus the dead-field audit from 0.7.9 finished off.
+
+### The method, first, because it is the part that generalises
+
+Gitea#21, Gitea#22, #94 and #96 were four instances of one fault in a row: the engine gains something
+that changes what a train may do, and nothing draws it. Every one was found by a player hitting it.
+So rather than wait for the fifth, every field of `GameState` and its nested types was enumerated and
+checked for a reader in `sim/view.ts`, `src/web/` and `sim/narrate.ts` — and the survivors were then
+**verified by running the engine**, not by trusting the grep. Four fields had no reader anywhere.
+`movedThisPhase` is set and cleared inside a single `advance` call and is nobody's business. The
+other three are below.
+
+Saying what was ruled out matters as much: `freightWorked`, `drawnThisTurn`, `freightAgentUsed`,
+`switchedSince` and `movesUsed` are all invisible on purpose — their effect already shows as
+legality, or as a complement already on the Frame. A field is not a display gap merely because
+nothing renders it. `dispatchUsedToday` is the one genuine maybe left, and is not done.
+
+### The Crew Tray pool is a mechanic you can now see (#98)
+
+`state.ts` calls §7's tray scarcity "an explicit mechanic" and it was explicit only in the engine.
+The blocked panel — the one that answers "why is nothing moving?" — had exactly one tray rule, keyed
+off the train due out this Stage. So a player who had spent a card on an Extra, or ordered a second
+section, got a **completely empty** panel while their train sat behind an exhausted pool. Both had
+been announced once in the log, in a line that promised a future event — "it runs once as soon as a
+Crew Tray frees up", "an identical train will run right behind it" — which nothing ever confirmed.
+
+`projectSharedTable` carries `crewTrays` and `queued` now, so the common board gets it too, and the
+panel reports all three cases with the count beside them: "no free Crew Tray" on its own reads like a
+permanent fact about the game rather than a state that will pass.
+
+The first draft of that count derived the pool size as `trays.size + freeTrays.length`. That is
+invariant in play — `retireTrain` puts the tray back — and reads **"0 of 0"** the moment it meets a
+state where a tray is neither free nor carrying a train. `crewTrayCount` already owned the number.
+
+### A train held at the Limits had been vanishing off the board (#99)
+
+The most serious of the three, and it had been shipped. The Interlocking is the designed answer to a
+full Office: rather than Gap 2d's automatic collision, the train is stopped on the Limit Track and
+takes the first A/D track that frees, ahead of any newcomer.
+
+`arriveAtOffice` removes the tray from the Mainline node's `transits`, and the Interlocking branch
+pushes it onto `area.heldAtLimits` **without assigning `tray.position`**. The map draws mainline
+nodes from `transits` and district squares from `position.at === 'grid'` — so between the two, the
+train was drawn in neither. It disappeared from the board on arrival and reappeared in the Office
+some Stages later, with a single log line as the whole account of it.
+
+Measured rather than reasoned: with the tray in `transits` the Interchange node carries its chip;
+moved to `heldAtLimits` exactly as the engine moves it, that node's `trains` is `[]` and no grid
+square has gained it.
+
+Fixed in the **view**, not the engine. The engine is right — a held train is inside the Limits and
+not on an A/D track — and `position` is deliberately left alone so nothing may treat the train as
+standing on a square it could be switched from. The map draws it on the Limits square it came in by
+(eastbound at `limitsWest`, westbound at `limitsEast`), flagged so it does not read as an ordinary
+arrival, with the reason on the chip and in the blocked panel.
+
+### The Campaign Train now says whether its speeches are made (#100)
+
+X17 is "one turn at station (speeches) then expedite" — two states, not one sentence. Its first
+Office arrival is an ordinary stop; every arrival after runs expedited, and an expedited train left
+off the Office square when the next Mainline Phase begins is a fault costing 1 Revenue.
+
+`trainRules()` took `{ trainNumber, trainIsExtra }`, so it could not see `speechMade` even though
+both of its tray-side callers hand it a whole `CrewTray` that has it. The chip read identically
+before and after. Worse, the "EXPEDITED … costs 1 Revenue" warning is printed only under
+`rules.expedite` — so X17 became subject to a fault whose warning the game shows to every other
+expedited train and never to it. It now says which half it is in, and borrows `isExpedited` from
+`advance.ts` rather than restating the test.
+
+### The 0.7.9 dead-field audit, finished (#45)
+
+Deferred by Jesse on 2026-08-30 with the decision framed as delete-or-document. The answer turned out
+to be different for each, and neither was a patch.
+
+**`overHandLimit` is wired, because its consumer existed all along and was guessing.** `main.ts`
+already draws a disabled "End Local Operations" button explaining the hand limit — but decided to
+draw it from the *absence* of `draw.end` in the menu. That is sound only because `check('draw.end')`
+refuses for exactly three reasons and the two guards beside it rule out the other two; a fourth
+reason would have made the panel explain a refusal by describing something else entirely, which is
+#90 verbatim. It reads `f.overHandLimit` now — which is what the field was built for in the first
+place. Behaviour is unchanged; the screen states its reason instead of inferring it.
+
+**`viewerSeat` is documented, with a condition.** Gitea#20's common board keys districts by seat and
+resolves the player through `playerAtSeat`, so a client picking its own district out of a seat-keyed
+board needs this and cannot get it from `viewer`. The declaration says so — and says to delete it if
+step 2 ships without using it.
+
+**And the audit had missed a third limb.** `game.mustPlayCard` was assigned from `overHandLimit` on
+every submit and read by nothing at all: deleted. Chasing it turned up the thing actually worth
+fixing — the §6.2 hand-limit test existed in **three** places (`check('draw.end')`, an inline
+recomputation inside `snapshot()`, and `web/game.ts`'s own). All three agreed, which is precisely the
+state #96's disagreement started from. There is one `overHandLimit(state, player)` in `state.ts` now
+and the other two ask it. `Session.overHandLimit()` — declared on the interface and implemented
+twice — is deleted rather than kept, the Frame already carrying the fact.
+
+### Proof
+
+934 tests pass, up from 917. The 17 new ones were written red and each fix was then checked by
+mutation: reverting `speechMade` fails 2, dropping the held-train projection fails 4, and forgetting
+the two tray queues fails 2. The blocked panel returning nothing for the queues is reported alongside
+its positive control — the same state with a timetabled train due, which correctly says "no free Crew
+Tray" — because an empty result from a function that is simply broken proves nothing.
+
+**Not verified at a table.** All of this is engine and view work checked by tests and by running the
+engine; no part of it has been met by a person at a board. #39 and #35 still stand.
+
+---
+
+## 0.7.9.5 — 2026-09-07
+
+Two faults in what 0.7.9.4 had just built, both of the same shape: a second copy of an answer that
+agreed with the first until it didn't.
+
+### The §3.3 vote had no actor, and the screen named one anyway (#96)
+
+Extended play's vote is **parallel**. Every un-voted seat may vote at any moment, in any order, and
+one refusal ends it — `apply.ts` says in as many words where it accepts a vote that there is no actor
+to be. So the honest answer to "whose turn is it" is nobody, and the honest answer to "who are we
+waiting on" is every un-voted seat, which is exactly what the tally beside the turn chart already
+drew.
+
+The chart disagreed with the tally directly above it. It named the last seat to move before the
+timetable ran out — a seat with no more claim on the vote than anybody else — while the tally
+correctly showed three outstanding.
+
+The cause is worth more than the symptom. `currentActor(game)` in `web/game.ts` guarded on
+`status !== 'active'` and returned null. `currentActorOfState(state)` in `sim/view.ts` — added the
+same day in #95, and the function the frame actually calls — had no such guard, so it handed back
+whatever `clock.currentActor` was left holding after the game stopped being `active`. Two functions
+answering one question, correct in every state anybody had looked at.
+
+`currentActorOfState` carries the status guard now and `currentActor` delegates to it, so there is
+one answer. That matters more than the tidiness: **`currentActor` is what refuses an intent**, so a
+screen answering differently is telling the table to wait on a player the server would turn away.
+
+This is the fourth of this class in a row after Gitea#21, #22 and #94. It is the first found by
+asking a view helper its question in a state the game is **not** `active` in — which is the
+generalisation, and cheaper than finding the fifth the same way.
+
+### Narration reaches a seat once, by one path (#97)
+
+`Frame.lines` carried the whole narration log on every push, to every seat, and nothing read it.
+`RemoteSession` (`web/session.ts`) accumulates `lines` from `push.lines` alone, and its `lines()`
+returns that accumulator — so the log was serialised into every frame, grew all game, and was
+discarded on arrival, while `linesSince` sent the same text correctly beside it.
+
+**The duplicate was masking a bug rather than merely wasting bandwidth.** `connect()` cleared
+`lastFrame` but not `sentLines`, so a reconnecting seat was told "nothing new since your last push"
+— while the browser it was answering had just reloaded and started from an empty accumulator. The
+history panel came back blank, mid-game, with the server holding the whole log and shipping it in the
+one field nobody reads.
+
+So the two halves are one change, and the plan's instruction taken alone — "stop passing the full
+game log into `frameFor()`" — would have deleted a real behaviour instead of a duplicate. A
+(re)connect now resets the seat's watermark, and `Push.lines` on a connect **is** the history, which
+is what lets the Frame stop carrying a second copy.
+
+Every remaining reader of `Frame.lines` was checked before the field was emptied: all of them
+(`sim/replay.ts`, `web/replays.ts`, and the sim and replay tests) are the solitaire and replay path,
+which builds its Frames through `snapshot()` directly and never goes near a session.
+
+**One test was wrong before the code was.** The first draft of the reconnect test connected inside
+its own fixture, so both sides of the comparison were the empty array and it passed against the
+broken server — two empty arrays are `deepEqual`. Each of these tests now asserts its premise is
+non-empty before comparing.
+
+### Also
+
+`docs/plans/jitsi-common-board.md` is committed. It was never added — not ignored, just missed —
+while `TODO.md` cites it twice as the plan for all of v0.8.0 and the last two releases were built
+from it, so a clone got a TODO pointing at a file that did not exist.
+
+917 tests pass, up from 909.
+
+---
+
+## 0.7.9.4 — 2026-09-07
+
+Gitea#20 step 1, done as its own release rather than as the first hour of 0.8.0 — and a Red Flag you
+can now see.
+
+### A Red Flag standing at the Limits is on the map (#94)
+
+`maneuver.redFlags` sets a flag on an Office's Division node, and from then on the next train
+arriving from that side is held short until the flag is spent. It is a token standing on the board —
+the same kind of object as a train — and it was announced once in the log and drawn nowhere. Three
+Stages later a train stops and the only explanation has scrolled out of the panel.
+
+`DivisionView`'s office node carries `redFlag` now, and the map draws a staff and pennant **at the
+end it guards** — west on the left, east on the right, since east is right on this map. Which
+approach it covers is the whole of the information: a flag in the middle of the cell would say a
+flag is out and leave the reader to hover for the half that decides whether to run a train. The
+tooltip leads with it, ahead of everything that merely describes the cell.
+
+**The third of these in a row**, after Gitea#21 and #22. When the engine gains something that
+changes what a train may do, the question to ask is where it is drawn, not whether it works.
+
+### The public projection helpers (#95)
+
+`projectDistrict(state, seat)`, `projectDivision(state)`, `projectSharedTable(state)`,
+`publicSnapshot(state)` and `currentActorOfState(state)` — and **`snapshot()` rebuilt to compose
+from the same helpers** rather than keeping a second copy of the shared table. A player's frame and
+a spectator's now cannot come to disagree about the clock, the phase, whose turn it is or the score.
+Behaviour-neutral: the existing 897 tests passing unchanged is the proof.
+
+**The public view is composed upward, never by calling `snapshot()` once per seat.** That shortcut
+is the trap the plan warns about: `snapshot` exists to assemble one player's view, so a public view
+made of player views starts by building every private field and then has to remember to strip it —
+and it defaults its viewer to player zero, so a careless spectator call today would have served seat
+0's hand. Composing upward means a private field cannot arrive by accident; it would have to be
+added to a projection that has no business holding one.
+
+**Districts are keyed by seat, with the player resolved through `playerAtSeat`.** Employee Rotation
+moves players between districts, so seat and player index are not interchangeable — a board that
+assumed they were would relabel every district the first time anybody rotated.
+
+One finding from the plan is struck off rather than fixed: it warns that a display reading
+`clock.currentActor` could highlight the wrong district during a decision, since that field is null
+while an interruption stands. Measured across six seeds and 3,600 decision points, it and
+`actingPlayer` never disagreed — both are only consulted when somebody is genuinely acting.
+`currentActorOfState` exists anyway, as one place for the next reader to ask.
+
+### The redaction net, systematically (#91)
+
+v0.7.9.2 closed two leaks. Both were found by reading a plan rather than by a test, which is the
+whole argument for this: a suite made of the leaks somebody happened to notice proves nothing about
+the next one.
+
+Serialise a seat's `Frame`, the `PublicFrame` a spectator gets, and the narration they receive, then
+search all three for every opponent card id, every card name unique to one opponent's hand, the
+seed, and any private decision or menu data — across a fresh game, a blind draw, mid-game, a pending
+decision, Employee Rotation before and after the seating moves, a reconnect push (a full Frame, not
+a delta, and its own opportunity to leak) and a played-out game.
+
+**And the allow-list, which is the plan's stated acceptance bar rather than the tests.** Every
+property of `publicSnapshot` is written down with the reason it is public and compared on every run,
+so adding a field fails the suite until somebody has said out loud that a spectator may see it. Both
+v0.7.9.2 leaks were fields nobody had ever asked that question about.
+
+**Two false failures were worth the lesson. A card NAME is a type, not an identity:** "right-hand
+curve" names a dozen cards and one is legitimately drawn as a cell label the moment anybody lays
+track, so searching for it fails on correct code — which is worse than not searching. A name counts
+as evidence only when every card bearing it is in the one hand. **And a one-digit seed makes the
+seed check meaningless**: seed 7 matched "Train 7" and reported a leak that was not one. The seeds
+here are nine digits deliberately.
+
+Proved by mutation rather than by passing: restoring the seed line fails 6 tests, restoring the
+blind-draw card name fails 1, adding a private field to the public projection fails 7, and making
+`players[]` carry hand contents instead of a count fails 5.
+
+One item on the plan's list has no test because it has no referent: **there is no secret objective in
+this game.** `objectiveOf` derives from `config.minCombinedRevenue` and the player's own Revenue,
+both public. Recorded so the next reader does not go looking for the gap.
+
+909 tests pass, up from 897.
+
+---
+
+## 0.7.9.3 — 2026-09-07
+
+Documentation and the build script behind it. No engine change; 897 tests pass, unchanged.
+
+### The generated reference covers what only the implementation knows
+
+TODO #15a asked for this in 2026-08-22 and specified more than a table of card faces: every
+Enhancement carries a `live` / `dormantSolo` / `unbuilt` status in `content.ts` saying **whether its
+printed effect actually resolves yet**, and the opponent-directed Action and Space-use cards are held
+out of every deck until the attacks are implemented. A transcription cannot carry either fact. Both
+are in the generated page, which is the argument for generating it.
+
+**No card counts appear, as ruled** — the counts move with play balance, so a document that prints
+them is stale on the next retune. Where a count matters it is rendered as a yes/no "is this dealt at
+all", which is a fact about the design rather than about the current tuning. #88 closes with it: it
+asked whether `card-reference.md`'s industry rows were stale, deliberately without rewriting them
+since Laborer counts are a balance decision. They are stale, nothing in the engine changed, and that
+file is simply no longer where anyone looks. The balance question it was guarding is #70.
+
+### Save compatibility is a rule now, not a per-version note
+
+`README.md` § Design notes carries it: a save is a list of moves and reopens by being re-played
+through the *current* rules, so any change that makes a once-legal move illegal stops an older one
+there — **a deck change being the likeliest breaker**, since a history naming a card the deck no
+longer deals has no legal answer at all. It fails safe every time. #40 is generalised to match and
+#32 closed; per-version compatibility facts are no longer tracked (Jesse, 2026-09-07). Versioned,
+migratable replays are a post-1.0 question, deliberately deferred — every migration would be written
+against rules that change again next release.
+
+---
+
+## 0.7.9.2 — 2026-09-07
+
+Two multiplayer information leaks, and the documentation problem that let a wrong table sit in
+`docs/rules/` for several releases with the code pointing at it.
+
+### The shared narration log was telling every seat things only one seat should know
+
+Both found while planning the public common board (Gitea#20 step 1), and **both are live multiplayer
+bugs with or without that display** — which is why they are fixed here rather than waiting for
+0.8.0.
+
+`game.log` is ONE list. `linesSince(seat)` (`server/session.ts:181`) slices it with no per-seat
+filter at all, so every line written there reaches every player. Two things were being written into
+it that should never have left the seat that caused them:
+
+**The seed, in the opening line of every multiplayer game.** `competitive · 3 players · seed 4242`
+handed each player the entire future of the deal — every card order, every die roll.
+
+**The name of a card drawn blind from the Home Office deck.** `Player Cy drew Red Flags from the
+Home Office deck`, to the whole table, from a face-down deck.
+
+**Solitaire deliberately keeps both, and that is the rule rather than an exception.** A one-seat
+table has nobody to leak to; the seed in the log is what a bug report quotes — both of the issues
+fixed in 0.7.9.1 opened by naming it — and a solo player's own history naming their own draw is the
+record, not a leak. The rule is *do not tell the OTHER seats*, not *write less down*. A Department
+slot stays named for the same reason: those piles are face up, a discard goes onto one precisely so
+a rival can take it, so the card was public before it was drawn.
+
+The drawing seat still learns what it got. `justDrawn` is the owner-only channel and `session.ts`
+already sends it to that seat alone, so hiding the name from the shared log costs the drawer nothing.
+The seed remains in `game.seed`, in every save and in the lobby record, so nothing administrative or
+replayable loses it.
+
+**These were not found by a test. They were found by reading a plan.** Every test in
+`redaction.test.ts` passes `[]` for the narration log, so the whole of it has sat outside the
+redaction net since the net was built. Tests for both now live there, but two strings are not a net —
+TODO #91 carries what is still owed, and supersedes #78, which described a gap that had already been
+closed and never mentioned this one.
+
+### `docs/rules/` had no current description of the game, and `content.ts` pointed at a superseded one
+
+`content.ts` named `docs/rules/card-reference.md` as "the place that now carries what the cards say".
+That file opens with its own banner — **"⚠ SUPERSEDED… Do not use its numbers"** — and describes the
+v0.4.5 deck: twelve numbered trains, `3 / 4 | Mail-Express | 3 coaches, no caboose`, against a
+`content.ts` whose train 3 is the Express, two freight cars, `oneFreightPerLocation`. The code was
+sending readers to a table it had itself replaced.
+
+Every file in `docs/rules/` turns out to be a historical record and says so: `rules-v0.1.md` is a
+faithful transcription of the prototype PDFs, `open-questions.md` is the gap tracker, `rules-v0.2.md`
+and `card-reference.md` both carry superseded banners. **So the fix is not to rewrite one of them** —
+the record is worth more intact than patched, and there was simply no current reference at all.
+
+`docs/rules/as-built.md` is new and is **generated** — trains, Mainline cards, Offices, freight
+facilities, modifiers and track, emitted from the same exported catalogues the engine instantiates
+from, by `scripts/build-card-reference.ts` (`npm run build:cards`).
+`test/card-reference.test.ts` re-runs the generator and asserts the checked-in file matches, so
+changing a card face without regenerating turns the suite red.
+
+**A hand-written replacement would have drifted exactly the same way**, and for the same reason:
+nothing fails when a table falls behind a constant. That is the whole lesson of the file it replaces.
+
+897 tests pass, up from 891.
+
+---
+
+## 0.7.9.1 — 2026-09-07
+
+Two playtest bugs from one session (seed 550943578). Both were reported as the game getting a rule
+wrong; in both the engine was right and what failed was what the screen said about it.
+
+### The map drew westbound trains in the wrong half of the card (Gitea#22)
+
+Reported as a collision that hit the wrong train: "the display graphically showed train 17 further
+west than train 5… I allowed train 3 and it collided w/train 17, not train 5 as expected."
+
+`regionOfTransit` answers **how far along its crossing a train is**, counted from the end it
+entered — everything still to run is region 0. That is the question the collision rules ask, both
+directions share the one index space, and it was correct throughout. The Division map was asking a
+different question with the same number: **which printed box, left to right.** East is right on
+this map (Gitea#18), so for an eastbound train the two coincide by luck — it enters at the west end,
+so "just entered" and "leftmost box" are the same box. A westbound train enters at the **east** end,
+so its region 0 is the right-hand box, and using the travel index directly drew the whole card
+mirrored.
+
+Replayed from the attached save at intent 186, which is the position the ruling was made in: T5 was
+a Stage from the far end (travel index 1) and TX17 had just entered behind it (index 0). Both
+westbound, so TX17 was physically **east** of T5 — behind it, in the direction they had both come
+from. The map drew TX17 at the left, which reads as further west, which reads as further ahead. Asked
+whether Train 3 could follow Train 5 onto the card, the Superintendent said yes, and Train 3 entered
+behind — into TX17, exactly where the rules had always had it.
+
+**So the fix is one mirror in `view.ts`, at the boundary the map is drawn from, and the collision
+rules are untouched.** `regionOfTransit` keeps its meaning. This is the same class of bug as the
+consist row at the Whistle Post (seed 270861860), which came out mirrored for the same reason: a
+number that means "distance run" used where the screen means "place".
+
+The tooltip carried the same number and now says which way it is counted — "region 2 of 2, counted
+west to east". Beside "2 Stages still to run" the bare number reads as a contradiction, and the
+reporter quoted the tooltip as part of what misled them.
+
+Proved by mutation rather than by assertion: reverting the mirror fails two tests in
+`mainline-cards.test.ts`, and making the renderer ignore the region fails the SVG placement test in
+`web.test.ts`. The existing region tests all ran eastbound, where the mirror is the identity, which
+is why the bug survived them.
+
+### A refusal the Blocked panel explained wrongly (Gitea#21)
+
+Reported as "could not drop second tank car at refinery… I dropped the first tank car, but that was
+all I was allowed to do."
+
+Replayed from the attached save: the crew was **Train 3**, and the engine's answer was
+`FREIGHT_WORKED_HERE`. Train 3 is the Express, which prints *"May drop or pick up one freight car at
+every location"* — **the refusal was correct**, and the budget is per location rather than per turn,
+so the same train may work another car at the next square it reaches. No rule changed.
+
+What failed is that nothing said so. The player checked "Blocked — why nothing is moving" and got
+`refinery 1,0 — green box empty — nothing to load (needs a Freight Agent action)`. That is a true
+statement about the facility and has nothing to do with why the drop was refused — so it sent them
+to spend a Freight Agent action that could not have helped. **A panel that answers the wrong
+question is worse than one that stays silent**, because it looks like an answer. The rule was on the
+train card's own tooltip, which is not where anyone looks when a button they expected is absent.
+
+The panel now names it, and only when the crew still has a freight car it could otherwise set out —
+a spent budget on a train with nothing to drop is blocking nothing, and this panel earns its keep by
+staying short enough to read. It asks `freightBudgetLeft`, the same predicate the reducer refuses
+on, through a new exported `freightRuleSpentHere`, so the words cannot drift from the rule.
+
+Against the reporter's own save the panel now reads:
+
+```
+[waiting] refinery 1,0 — green box empty — nothing to load (needs a Freight Agent action)
+[waiting] Train 3 at (0,1) — ONE FREIGHT CAR PER LOCATION — this train has already worked a
+          freight car on this square, so no more come off or on here until next turn.
+```
+
+### Both were verified against the saves attached to the issues
+
+Not against a reconstruction. Each save was replayed through `fromSave` to the exact intent the
+report names, and the fix checked in that state — which is what the process item added after v0.7.5
+through v0.7.8 asks for, three releases that each reported the same bug fixed and each fixed
+something that was not the reported fault.
+
+891 tests pass, up from 884.
+
+---
+
 ## 0.7.9 — 2026-08-30
 
 Four pieces of feedback on the solitaire setup screen, plus the rules bug the second one exposed.

README.md

@@ -131,6 +131,18 @@ is the thing this machinery exists to prevent.
   and they do not reconstruct the position. The phase driver mutates state and then describes it, so
   roughly a third of the event types are never reduced at all. Anything that needs to rebuild a game
   replays the intents.
+- **A save is only guaranteed to replay on the version that wrote it.** This is the cost of the
+  property above and is not a bug to be fixed case by case: a save is a list of moves, so it reopens
+  by being *re-played through the current rules*. Any rules change that makes a once-legal move
+  illegal will stop an older save at that move — **a change to the deck is the likeliest breaker**,
+  since a history that names a card the deck no longer deals has no legal answer at all, but any
+  narrowing of what is permitted does it. It fails safe in every case: the load is declined, the
+  offending move is named, and the file is left untouched, so nothing a player has is destroyed.
+  Assume an older save may not open, tell players so wherever a build is announced, and read "this
+  save will not load" in a bug report as this before treating it as a fault. **Versioned, migratable
+  replays are a post-1.0 question** — deliberately not worth the effort while the rules are still
+  moving this fast, since every migration would have to be written against rules that changed again
+  next release.
 - **Never call `Math.random()`.** One ambient random call silently breaks replay.
 - **The Mainline Phase can stop and ask, and there are three questions it asks.** §8.1's clearance
   ruling goes to the Superintendent; the Yard Office offer and the Red Flag prompt go to the owner of

TODO.md

@@ -43,13 +43,21 @@ Not items. Things that are true of every change, and that have gone wrong when s
 - **Keep `CHANGELOG.md` current in the same change.** Commit messages stay high level; the
   reasoning, the measurements and the things that turned out to be wrong live there.
 
-30. **Close each Gitea issue by hand, with a comment naming the commit that fixed it** and, where the
-    fix was not what the report implied, the ruling that decided it. Auto-closing leaves an issue with
-    no record of which commit or which release answered it. Done for every issue closed so far: #2,
-    #6, #8, #9 and #10 from v0.7.1; #3, #14, #15, #17 and #18 from v0.7.2 — including #15's REVERSAL
-    on review (the placement is legal; what was confirmed is that no train crosses the gap) and #14's
-    list of the ten unbuilt cards, so they do not vanish with the issue. The token and the API calls
-    are in the workspace's `AGENTS.local.md`.
+30. **Close a Gitea issue with `Closes #<n>` in the commit — not by hand** (Jesse, 2026-08-30).
+    Gitea records the linking commit itself when it auto-closes, so a manual close adds nothing but a
+    step, and the same rule is what the workspace `AGENTS.md` already prescribes.
+
+    **What auto-closing does NOT carry is a RULING, and that still has to be written by hand.** When
+    the fix was not what the report implied, comment on the issue before it closes, saying what was
+    decided and why. That is the half worth keeping: Gitea#15 was REVERSED on review — the placement
+    is legal, and what was actually confirmed is that no train crosses the gap — and Gitea#14's
+    comment lists the ten unbuilt cards so they do not vanish along with the issue. A bare
+    `Closes #<n>` would have lost both.
+
+    This item said the opposite until 2026-08-30 ("close each issue by hand… auto-closing leaves no
+    record"), which was written from how the issues closed in v0.7.1 and v0.7.2 rather than from a
+    decision. The token and the API calls, for reading issues and for leaving a ruling, are in the
+    workspace's `AGENTS.local.md`.
 
 37. **The wrapper release sequence, unchanged since 0.7.2 and worth following exactly.** Tag the app,
     fetch the tag into the wrapper's submodule, bump `current.ts` **in place** (the outgoing `up` has
@@ -66,8 +74,8 @@ Not items. Things that are true of every change, and that have gone wrong when s
 
 ## Sections
 
-1. **Play it at a table** — #39 #35 #42a #40 #32
-2. **The common board, and watching play happen — Gitea#20** — #13 #15 #18 #78 #75
+1. **Play it at a table** — #39 #35 #42a #40
+2. **The common board, and watching play happen — Gitea#20** — #13 #15 #18 #75
 3. **Multiplayer, sessions and operations** — #8 #7 #76 #77 #79
 4. **The screen** — #44 #81 #33 #36
 5. **Replays and saved games** — #14 #47 #48 #49 #50 #51 #52
@@ -86,8 +94,14 @@ ruling or a lesson).
 ## Play it at a table
 
 The largest gap in the project, and none of it is a coding gap. Features are shipped, packed,
-running on `phoenix.local` — and no person has met them at a board. Everything else in this file
-waits behind a release; this waits behind an afternoon.
+running on `phoenix.local` — and the items below name the ones no person has met at a board.
+Everything else in this file waits behind a release; this waits behind an afternoon.
+
+**Test runs WERE made across 0.7.4 through 0.7.9** (Jesse, 2026-09-07) and produced no change
+requests — the two bugs that did come out of them are Gitea#21 and #22, fixed in v0.7.9.1. So this
+section is not "nobody has touched it since 0.7.4"; it is the narrower and still-true claim that the
+specific paths below have not been exercised at a table. **More testing is planned at the end of the
+0.7.9 series, before 0.8.0 starts** — that is the moment to close these, not a separate errand.
 
 - [ ] **#39** — **None of v0.7.4 has been played by a human.** The Yard Office offer, the Red Flag
       hold and its out-of-phase prompt, and the loaded-Extra make-up rules are tested end to end,
@@ -105,15 +119,10 @@ waits behind a release; this waits behind an afternoon.
       the dealt game matches what was chosen. It took three attempts to become reachable at all —
       reachable is not the same as correct. See **Reference · #42a**.
 
-- [ ] **#40** — **A save from before v0.7.4 may not replay, and nobody has been told.** It fails safe
-      — the server declines the save, names the move and leaves the file untouched — so this is a line
-      in a release note rather than code, and worth knowing when a bug report arrives with a save that
-      will not load. See **Reference · #40**.
-
-- [ ] **#32** — **Tell the 0.4.9 playtesters their saves are dead, before they find out.** The same
-      shape as #40 for the playtest line; the saves attached to Gitea#15 and #17 are among them.
-      `PLAYTEST-0.7.4.md` at the repo root is the note drafted for this and leads with it. See
-      **Reference · #32**.
+- [ ] **#40** — **An older save may not replay, and players are not told so anywhere they will see
+      it.** Not a v0.7.4 fact and not a bug: a save is re-played through the current rules, so any
+      narrowing of what is legal can stop one. The rule is written down now (`README.md` § Design
+      notes); what is still owed is a line **wherever a build is announced**. See **Reference · #40**.
 
 ---
 
@@ -121,7 +130,13 @@ waits behind a release; this waits behind an afternoon.
 
 **This is v0.8.0.** One shared, seatless display of the public game, usable on a TV or in OBS on its
 own and publishable into the table's Jitsi meeting. The plan is `docs/plans/jitsi-common-board.md`,
-seven steps, of which 1-4 are the useful release and 5-7 are the Jitsi publisher. Items that look
+seven steps, of which 1-4 are the useful release and 5-7 are the Jitsi publisher.
+
+**Step 1 is BUILT** — v0.7.9.2 through v0.7.9.5 (#91, #92, #95, #97), with one item struck off
+rather than implemented (#103). **The plan was reconciled against the code in v0.7.9.8** and now says
+which of its "current code findings" are history: it had drifted badly enough to send the next reader
+fixing things twice. Steps 2-7 were never implemented and their findings have NOT been re-verified —
+check each before building on it. See **Reference · #103**. Items that look
 like screen polish live here because they need step 4's ordered presentation mechanism and nothing
 cheaper.
 
@@ -140,9 +155,6 @@ cheaper.
       it needs the async stepped pump that Gitea#20 step 4 specifies**, which is why it lives here
       rather than under The screen. See **Reference · #18**.
 
-- [ ] **#78** — The redaction test is more done than the plan suggests, but the remaining gap is real
-      and is Gitea#20 step 1's starting point. See **Reference · #78**.
-
 - [ ] **#75** — Let the game join a call and talk to the table — the chat, audio and nudge half of the
       idea Gitea#20 took the visual half of. Long-term. See **Reference · #75**.
 
@@ -357,11 +369,6 @@ are one section is that each one found the next.
       them. **The flag matters more than the 29** — two are Gitea#18 leftovers in one file, one found
       by hand and the other missed. Do #48 first; it settles ten of them. See **Reference · #46**.
 
-- [ ] **#45** — The Frame carries two things nothing reads — `viewerSeat` and `overHandLimit`.
-      **Deferred by Jesse 2026-08-30** ("leave it for now"); the decision when it comes is
-      delete-or-document, not a patch. The two tally fields found by the same audit are fixed. See
-      **Reference · #45**.
-
 - [ ] **#84** — Five test fixtures pinned a seed and meant "a game like this". All five broke on
       Gitea#14 for that reason. See **Reference · #84**.
 
@@ -438,20 +445,26 @@ below); reachable is not the same as correct. Early item for the next play sessi
 
 #### #40 — A save from before v0.7.4 may not replay, and nobody has been told.
 
-**A save from before v0.7.4 may not replay, and nobody has been told.** The Red Flags intent
-changed shape, a make-up that was legal may now be refused, and a Yard Office arrival asks a
-question no older history has an answer for. It fails safe — the server declines the save, names
-the move and leaves the file untouched — and `WHISTLE-4086` did survive on `phoenix.local`, so it
-is "may not" rather than "will not". Worth a line wherever the build is announced, and worth
-knowing when a bug report arrives with a save that will not load.
+**An older save may not replay, and players are not told so anywhere they will see it.** A save is
+a list of moves and reopens by being re-played through the CURRENT rules, so any change that makes a
+once-legal move illegal stops it there. **A deck change is the likeliest breaker** — a history
+naming a card the deck no longer deals has no legal answer at all — but any narrowing does it. This
+is the design working, not a fault: it fails safe every time, declining the load, naming the move
+and leaving the file untouched.
 
-#### #32 — Tell the 0.4.9 playtesters their saves are dead, before they find out.
+**So this item is no longer "saves before v0.7.4"** and should never be restated per version
+(Jesse, 2026-09-07). The specific 0.7.4 breakages — the Red Flags intent changing shape, a make-up
+that was legal being refused, a Yard Office arrival asking a question no older history answers —
+are recorded here as the ORIGIN of the rule rather than as the rule, and `WHISTLE-4086` did survive
+on `phoenix.local`, which is why it is "may not" rather than "will not".
 
-**Tell the 0.4.9 playtesters their saves are dead, before they find out.** The same shape as #40
-but for the playtest line: the deck change shipped as v0.4.9h, so every save filed before it —
-including the ones attached to Gitea#15 and #17 — stops replaying at its first `card.play`. They
-fail safe and the files are kept, but nobody has been told. `PLAYTEST-0.7.4.md` (untracked, at
-the repo root) is the note drafted for this and leads with it.
+**What is actually owed:** the general rule is written down in `README.md` § Design notes, and a
+line belongs wherever a build is announced. Nothing in code.
+
+**Versioned, migratable replays are a post-1.0 question, deliberately deferred** (Jesse,
+2026-09-07): "once we get to a solid 1.0 release we will consider a system to version the replays so
+they are not as fragile — but not worth any effort right now." The reason it would be wasted effort
+now is that every migration would be written against rules that change again next release.
 
 ### The common board, and watching play happen — Gitea#20
 
@@ -574,23 +587,6 @@ of enforced waiting per Stage, forty-eight per Day, and a player who has seen it
 will want it off. Whatever this becomes probably needs a speed control, or to scale with whether
 anything actually happened in the phase.
 
-#### #78 — The redaction test (multiplayer.md §7) is more done than the plan sugg…
-
-**The redaction test (multiplayer.md §7) is more done than the plan suggests, but the
-
-exhaustive check is still missing.** `test/multiplayer.test.ts`'s "the view shows one seat at
-a time" section (added earlier) already proves `snapshot(s, ..., viewer)` gives each seat its
-own hand, board, Revenue and impediments — traced `snapshot()` itself
-(`src/sim/view.ts:1180-1219`): `hand` reads only `s.decks.hands.get(viewer)`, `deck` is a
-count, other seats' hands appear only as `.length`, and `Frame`'s type has no `seed`,
-`rngState` or card-id-dictionary field for anything to leak through by accident. What exists
-is all spot-checks, though — "this seat's Frame has the right hand length." What's still
-missing is the exhaustive one §7 actually calls for: serialize a seat's `Frame` and assert it
-contains none of another seat's actual card ids and no deck order, so a future careless edit
-is caught rather than assumed safe. Doesn't need a server — buildable now against `snapshot()`
-and the existing `game()`/`playGame` harness already in `multiplayer.test.ts`. Held for now,
-2026-08-20.
-
 #### #75 — Let the game join a call and talk to the table.
 
 **Let the game join a call and talk to the table.** Long-term. If the game could join a Zoom,
@@ -967,6 +963,17 @@ bitten once**: both published replays were dead — one got 42 intents into 360,
 carry a ruleset stamp and the page should say "this replay was recorded under an older
 ruleset and stops at Stage N" rather than presenting a truncated game as a whole one.
 
+**THE FULL FIX IS DEFERRED PAST 1.0, ON JESSE'S CALL 2026-09-07:** "once we get to a solid 1.0
+release we will consider a system to version the replays so they are not as fragile — but not worth
+any effort right now." The reason is sound and worth keeping: every migration would be written
+against rules that change again the next release, so the work would be redone rather than reused.
+
+**What that ruling does NOT defer is the honesty.** A truncated replay presented as a whole game is
+a wrong answer, not a missing feature, and saying "this stops at Stage N" needs no version stamp at
+all — `fromSave` already knows how many intents it replayed of how many it was given
+(`session.ts:454` reports exactly that for multiplayer). That half is small and stands alone. The
+general rule now lives in `README.md` § Design notes; #40 is the "tell the players" half.
+
 ### Rules
 
 #### #12 — PARTLY REPRODUCED: "when I back up to collect standing cars and, furth…
@@ -1520,6 +1527,14 @@ discarded wrongly.
 run it.** Swept 2026-08-30 and deliberately NOT fixed in the same pass, at Jesse's call — it is
 a wide, mechanical change and v0.7.9 had enough in it.
 
+**RE-MEASURED 2026-09-07: 40, up from 29 in eight days.** The prediction below — "without the
+flag this list simply regrows" — is now a measurement rather than a forecast. **Four of the new
+ones were mine and are removed in v0.7.9.8**: `HAND_LIMIT` left unused in `apply.ts`, `view.ts`
+and `web/game.ts` when the three copies of the §6.2 test were consolidated into one (#45), and
+`actingPlayer` in `web/game.ts`, dead since `currentActor` began delegating (#96). Removing my
+own leavings is not doing this item — the remaining 36 and the FLAG are still open, and the
+`sim/replay.ts` ten still wait on #48.
+
 **The recurrence is the point, not the 29.** `SIDE_GAP` and `CHIP_W` in `board-svg.ts` are both
 Gitea#18 leftovers — constants for a wrapped layout that no longer exists. `SIDE_GAP` was
 removed by hand on 2026-08-30 only because someone happened to read the file while closing the
@@ -1578,11 +1593,33 @@ screen. Fixing them turned up something else worth knowing: `resultsHtml` draws
 screen, which is how the first attempt at pinning this failed for a reason unrelated to the
 fix.
 
-**The two plumbing ones — `viewerSeat` and `overHandLimit` — are DEFERRED (Jesse, 2026-08-30):
-"leave it for now."** They cost nothing today and v0.7.9 had enough in it. The decision when it
-comes is delete-or-document, not a patch: either strip the field and the `Session`-interface
-method, or write down what each is being carried ahead of a consumer FOR, so the next audit
-does not re-flag them.
+**The two plumbing ones are DONE — 2026-09-07 in v0.7.9.6, and the answer was different for
+each.** Deferred by Jesse 2026-08-30 ("leave it for now") on the understanding that the decision
+would be delete-or-document rather than a patch.
+
+- **`overHandLimit` — WIRED, because the consumer existed all along and was guessing.** `main.ts`
+  draws a disabled "End Local Operations" button explaining the hand limit, and decided to draw it
+  from `f.option === 'draw' && !menu.options.some(i => i.type === 'draw.end')` — i.e. from the
+  ABSENCE of the move. That is sound only because `check('draw.end')` refuses for exactly three
+  reasons and the two guards beside it rule out the other two; a fourth reason would have made the
+  panel explain a refusal by describing something else entirely, which is #90 verbatim. It now reads
+  `f.overHandLimit`, which is what `web/game.ts` says the field is for: "so the page can DISABLE the
+  button with a reason instead of hiding a move that has simply become illegal." Behaviour-neutral
+  today; what changed is that the screen states its reason instead of inferring it.
+- **`viewerSeat` — DOCUMENTED, with a condition.** Gitea#20's common board keys every district by
+  SEAT and resolves the player through `playerAtSeat`, so a client picking its own district out of a
+  seat-keyed board needs this and cannot derive it from `viewer`. The declaration now says so, and
+  says to delete it if step 2 ships without using it — a note is a reason to survive one audit, not
+  an exemption from the next.
+
+**And the audit's own method found a third limb it had missed.** `game.mustPlayCard` was set from
+`overHandLimit` on every submit and read by nothing at all — deleted. Chasing that turned up the
+thing actually worth fixing: the §6.2 hand-limit test existed in **three** places — `check('draw.end')`
+in `apply.ts`, an inline recomputation in `snapshot()`, and `web/game.ts`'s own. All three agreed,
+which is exactly the state #96's disagreement started from. There is now one `overHandLimit(state,
+player)` in `state.ts` and the other two ask it. `Session.overHandLimit()` — declared on the
+interface and implemented twice, locally and remotely — is deleted rather than kept: the Frame
+already carries the fact, so the method was a second path to it.
 
 #### #84 — FIVE TEST FIXTURES PINNED A SEED AND MEANT "A GAME LIKE THIS".
 
@@ -1657,9 +1694,20 @@ counts move with play balance, so a document that prints them is stale on the ne
 same rule was applied to `content.ts`'s own comments on 2026-08-22 — see the pass recorded in
 CHANGELOG for what came out and what was kept.
 
-Not started. Worth deciding first whether this is a build step writing Markdown into `docs/`,
-or a page on the site beside the replay viewer — the site can render it from the same view-model
-the game uses, which argues for the second.
+**BUILT 2026-09-07 in v0.7.9.2, completed in v0.7.9.3, as the first of the two options** — a build step writing Markdown,
+`scripts/build-card-reference.ts` → `docs/rules/as-built.md`, with `test/card-reference.test.ts`
+re-running the generator and failing when the checked-in file disagrees. All six sections are
+there, and so is the honesty column: every Enhancement carries its `live` / `dormantSolo` /
+`unbuilt` status, and the opponent-directed cards say plainly that none of them is dealt.
+**The counts are omitted as ruled** — where a count matters it is rendered as a yes/no "is this
+dealt at all", which is a fact about the design rather than about the current tuning.
+
+**WHAT REMAINS, and it is the second option rather than a gap in the first:** a page on the site,
+beside the replay viewer, rendered from the same view-model the game uses. The argument for it is
+unchanged — a player cannot read a file in the repo — and it is now cheap, because the projection
+work is done and only the presentation is missing. **Do it with Gitea#20 step 3**, which builds a
+renderer for exactly this kind of read-only public page; building a second one first would be the
+waste.
 
 #### #86 — Real audio, as committed assets.
 
@@ -1691,41 +1739,350 @@ placeholder, not the finished sound. Sound therefore defaults to OFF.
 - Keep the synthesised versions as the fallback for anything not sourced, so a missing file is
   a quieter game rather than a broken one.
 
-#### #88 — card-reference.md's industry table may still be stale beyond Grocer's…
+#### #88 — CLOSED — card-reference.md's industry table is no longer anybody's source.
 
-**`card-reference.md`'s industry table may still be stale beyond Grocer's Warehouse, the Oil
+**CLOSED 2026-09-07 in v0.7.9.3, by removing the question rather than answering it.** This asked
 
-Refinery and Freight House (corrected v0.5.0) — Mine Tipple, Produce Shed and Power Plant were
-NOT re-verified.** The v0.5.0 pass corrected three rows (and the "Freight House is not a card"
-claim across `card-reference.md`, `glossary.md`, `rules-v0.2.md` and `open-questions.md`) on
-Jesse's explicit call. Checking `content.ts` while making that change turned up that
-`mineTipple` and `powerPlant` are ALSO base 1 out/in + 1 Laborer in the engine — the same
-uniform model as the three that were corrected — while `card-reference.md` still prints Mine
-Tipple 3/3/4 and Power Plant 3/3/4, and the "Throughput — why these Laborer counts" section
-right below the table is built entirely on those higher numbers. Flagged inline in
-`card-reference.md` rather than silently rewritten — this needs the same kind of decision Jesse
-made for the other three, not an assumption that the same correction applies, since raising or
-lowering Laborer counts is also a balance question, not only a docs one.
+whether `card-reference.md`'s Mine Tipple, Produce Shed and Power Plant rows were stale — it prints
+3/3/4 for two of them while `content.ts` has every industry at base 1 out / 1 in / 1 Laborer — and
+deliberately did NOT rewrite them, on the grounds that changing a Laborer count is a balance
+decision rather than a documentation one. **That reasoning still stands and nothing was changed in
+the engine.**
 
-**v0.4.9e narrows it.** The Direction column for the Grocer's Warehouse and the Oil Refinery was
-the wrong half of that v0.5.0 pass and has been put back to one-way each, from gameplay testing
-and Jesse's confirmation. The *numbers* in those two rows are still the card reference's own
-(1 Laborer, 3–4 track) and still unverified against the engine, so this entry stands as written
-for all five industries — what changed is only that the two rows the v0.5.0 pass claimed to have
-re-verified turn out to have been re-verified against a premise rather than against a card.
-
----
+What changed is that `card-reference.md` is no longer where anyone looks. `docs/rules/as-built.md`
+is generated from `content.ts` and carries the industry table the game actually runs; the old file
+keeps its SUPERSEDED banner, now pointing forward, and its numbers are read as what the v0.4.5
+placeholder said. **The balance question the entry was really guarding is #70** (the rolling stock
+supply and the uniform 1/1/1 industry model, both marked provisional in `content.ts`) — that is
+where it belongs, and it is still open.
 
 ## Done
 
 Closed items, kept because several are the only record of a ruling or a lesson. Newest first within
 each group.
 
-### Shipped through v0.7.9, from the queue
+### Shipped through v0.7.9.4, from the queue
 
 Closed items, newest first. Kept because several of them are the only record of a ruling or a lesson;
 the numbers stay so cross-references above and below still resolve.
 
+91. ~~**Narration was outside the redaction net, and so was everything else nobody had listed.**~~ —
+    done 2026-09-07 in v0.7.9.4. The systematic pass Gitea#20 step 1 asks for: serialise a seat's
+    Frame, the public board and the narration it receives, and search all three for every opponent
+    card id, every card NAME that is unique to one opponent's hand, the seed, and any private
+    decision or menu data — across a fresh game, a blind draw, mid-game, a pending decision,
+    Employee Rotation before and after the seating moves, a reconnect push and a played-out game.
+    **And the allow-list, which is the plan's actual acceptance bar:** every property of
+    `publicSnapshot` is written down and compared, so adding a field fails the suite until somebody
+    has said out loud that a spectator may see it. That is the check that would have caught both
+    v0.7.9.2 leaks, since both were fields nobody had asked the question about.
+
+    **Worth knowing, and it cost two false failures to learn: a card NAME is a type, not an
+    identity.** "right-hand curve" names a dozen cards and one is legitimately drawn on the board as
+    a cell label the moment anybody lays track, so searching for it fails on correct code. A name
+    counts as evidence only when EVERY card bearing it is in the one hand. Ids need no such care.
+    **And a one-digit seed makes the seed check meaningless** — seed 7 matched "Train 7". The seeds
+    in this file are nine digits deliberately.
+
+    Proved by mutation rather than by passing: restoring the seed line fails 6 tests, restoring the
+    blind-draw name fails 1, adding a private field to the public projection fails 7, and making
+    `players[]` carry hand contents instead of a count fails 5.
+
+    **One item on the plan's list has no test because it has no referent:** there is no secret
+    objective in this game. `objectiveOf` derives from `config.minCombinedRevenue` and the player's
+    own Revenue, both public. Said here so the next reader does not go looking for the gap.
+
+94. ~~**A Red Flag standing at an Office's Limits was drawn nowhere.**~~ — done 2026-09-07 in
+    v0.7.9.4. It is a token set out ON the board that holds the next train arriving from that side;
+    it was announced once in the log and then existed only in the engine, so a train would stop
+    short with its only explanation scrolled out of the panel. `DivisionView`'s office node carries
+    `redFlag` now and the map draws a staff and pennant **at the end it guards** — west on the left,
+    east on the right — because which approach it covers is the whole of the information; a flag in
+    the middle would say one is out and leave the reader to hover for the half that decides whether
+    to run a train. **Worth knowing:** the same class as Gitea#21 and #22, and the third in a row —
+    when the engine gains a thing that CHANGES what a train may do, ask where it is drawn before
+    asking whether it works.
+
+95. ~~**The public projection helpers — Gitea#20 step 1's foundation.**~~ — done 2026-09-07 in
+    v0.7.9.4. `projectDistrict(state, seat)`, `projectDivision(state)`, `projectSharedTable(state)`,
+    `publicSnapshot(state)` and `currentActorOfState(state)`, with `snapshot()` **rebuilt to compose
+    from the same helpers** rather than keeping its own copy — so a player's frame and a spectator's
+    cannot come to disagree about the clock, the phase or the score. Behaviour-neutral, and the
+    existing 897 tests are the proof of that.
+
+    **Districts are keyed by SEAT and the player resolved through `playerAtSeat`**, because Employee
+    Rotation moves players between districts; a public board that assumed seat and player index were
+    interchangeable would relabel every district the first time anybody rotated. **And the public
+    view is composed upward, never by calling `snapshot()` once per seat** — that shortcut builds
+    every private field and then has to remember to strip it, and `snapshot` defaults its viewer to
+    player zero, so a careless spectator call would have served seat 0's hand.
+
+    **One plan finding struck off rather than fixed:** it warns that a public display reading
+    `clock.currentActor` could highlight the wrong district during a decision. Measured across six
+    seeds and 3,600 decision points, that field and `actingPlayer` never disagreed — both are only
+    consulted when somebody is genuinely acting. `currentActorOfState` exists anyway, as one place
+    for the next reader to ask.
+
+96. ~~**The screen named a player nobody was waiting on, all through the §3.3 vote.**~~ — done
+    2026-09-07 in v0.7.9.5. Extended play's vote is PARALLEL — open to every un-voted seat at once,
+    in any order, one refusal ending it — and `apply.ts` says where it accepts one that there is no
+    actor to be. The turn chart named a seat anyway: the last to move before the timetable ran out,
+    who has no more claim on the vote than anybody else, drawn beside a tally that correctly showed
+    three seats outstanding.
+
+    **The cause was two functions that agreed until they didn't.** `currentActor(game)`
+    (`web/game.ts`) guarded on `status !== 'active'` and returned null; `currentActorOfState(state)`
+    (`sim/view.ts`), added the same day in #95, had no such guard and handed back whatever
+    `clock.currentActor` was left holding. The frame took the second. `currentActorOfState` carries
+    the guard now and `currentActor` delegates to it, so there is one answer rather than two.
+
+    **Worth knowing:** the disagreement is the bug, not either answer on its own. `currentActor` is
+    what REFUSES an intent, so a screen answering differently tells the table to wait on a player the
+    server would turn away. And this is the fourth of the same class in a row after Gitea#21, #22 and
+    #94 — but the first found by asking the question of a state the game is not `active` in, which is
+    the generalisation worth keeping: a view helper needs exercising outside the happy phase.
+
+97. ~~**Narration was sent twice by a path nobody read, and the duplicate hid a blank history
+    panel.**~~ — done 2026-09-07 in v0.7.9.5, the second half of Gitea#20 step 1. `Frame.lines`
+    carried the WHOLE log on every push to every seat, grew all game, and was thrown away on arrival:
+    `RemoteSession` (`web/session.ts`) accumulates `lines` from `push.lines` alone and its `lines()`
+    returns that accumulator. `linesSince` was sending the same text, correctly, beside it.
+
+    **The waste was masking a real fault.** `connect()` cleared `lastFrame` but not `sentLines`, so a
+    reconnecting seat was told "nothing new since your last push" — while the browser it was
+    answering had just reloaded and started from an EMPTY accumulator. The history panel came back
+    blank mid-game, with the server holding the whole log and shipping it in the one field nobody
+    reads.
+
+    **So the two halves are one change**, and doing only the half the plan asks for — "stop passing
+    the full game log into `frameFor()`" — would have deleted a real behaviour rather than a
+    duplicate. A (re)connect resets the seat's watermark, and `Push.lines` on a connect IS the
+    history, which is what lets the Frame stop carrying a second copy. Every remaining reader of
+    `Frame.lines` is the solitaire and replay path, which builds its Frames through `snapshot()`
+    directly and is untouched.
+
+98. ~~**The Crew Tray pool was an "explicit mechanic" that only the engine could see.**~~ — done
+    2026-09-07 in v0.7.9.6. §7 scarcity is real — there are fewer trays than trains wanting one — and
+    the view read none of the three things the engine knows about it: how many are free, which Extras
+    are queued for one, which second sections are. The panel that answers "why is nothing moving?"
+    had a single tray rule, keyed off the train due out THIS Stage, so a player who had spent a card
+    on an Extra or ordered a second section got an **empty** panel while their train sat behind an
+    exhausted pool. Both had been announced once in the log, in a line promising a future event ("as
+    soon as a Crew Tray frees up") that nothing then confirmed.
+
+    `projectSharedTable` now carries `crewTrays` and `queued`, so the common board gets it too, and
+    the blocked panel reports all three cases with the count beside them — "no free Crew Tray" alone
+    reads as a permanent fact about the game rather than a state that will pass. An Extra is reported
+    to the player who played the card, because §7 gives the train to them; a second section is the
+    table's, like any Timetabled train.
+
+    **Worth knowing:** the first draft derived the pool size as `trays.size + freeTrays.length`,
+    which is invariant in play (`retireTrain` returns the tray) and read **"0 of 0"** the moment it
+    met a state where a tray was neither free nor carrying a train. `crewTrayCount` already owned
+    that number. A second way to know one fact is the shape of every bug in this release.
+
+    **THE METHOD, which is worth more than the three fixes** (#98, #99, #100 all came out of it, and
+    `test/display-gaps.test.ts` cites this entry for it). Gitea#21, Gitea#22, #94 and #96 were four
+    instances of one fault in a row — the engine gained something that changes what a train may do,
+    and nothing drew it — and every one was found by a player hitting it. So instead of waiting for
+    the fifth: enumerate every field of `GameState` and its nested types, check each for a reader in
+    `sim/view.ts`, `src/web/` and `sim/narrate.ts`, then **verify the survivors by running the engine
+    rather than trusting the grep**. Four fields had no reader. `movedThisPhase` is set and cleared
+    inside one `advance` call and is genuinely nobody's business; the other three are the items
+    above.
+
+    **A field is not a display gap merely because nothing renders it**, and saying so is what keeps
+    the sweep honest. `freightWorked`, `drawnThisTurn`, `freightAgentUsed`, `switchedSince` and
+    `movesUsed` were all ruled out: their EFFECT is already visible as legality, or as a complement
+    already on the Frame (`movesRemaining`). `dispatchUsedToday` was left as the one genuine maybe,
+    and was then **done as #101** — it turned out to have a second half worth more than the first.
+
+    The verification mattered twice. The blocked panel returning `[]` for the two queues is only
+    evidence alongside the positive control — the same state with a timetabled train due, which
+    correctly reports "no free Crew Tray". And #99's "drawn nowhere" was established by watching a
+    chip present on the Interchange node before the move to `heldAtLimits` and absent after.
+
+99. ~~**A train held at the Limits by an Interlocking vanished off the board.**~~ — done 2026-09-07
+    in v0.7.9.6, and the most serious of the three. The Interlocking is the designed answer to a full
+    Office — instead of Gap 2d's automatic collision, "may stop an inbound train on the Limit Track",
+    and it takes the first A/D track that frees ahead of any newcomer.
+
+    `arriveAtOffice` removes the tray from the Mainline node's `transits` and the Interlocking branch
+    pushes it onto `area.heldAtLimits` **without assigning `tray.position`**. The map draws mainline
+    nodes from `transits` and district squares from `position.at === 'grid'`, so between the two it
+    was drawn in NEITHER. Measured: with the tray in `transits` the Interchange node carries its
+    chip; moved to `heldAtLimits` exactly as the engine moves it, the node's `trains` is `[]` and no
+    grid square has gained it. The train disappeared on arrival and reappeared in the Office some
+    Stages later, with one log line as the only account of it.
+
+    **Fixed in the VIEW, not the engine.** The engine's state is right — a held train is inside the
+    Limits and not on an A/D track — and `position` is left alone deliberately, so nothing may treat
+    it as standing on a square it could be switched from. `trainsOnCard` draws it on the Limits
+    square it came in by (eastbound at `limitsWest`, westbound at `limitsEast`), flagged
+    `heldAtLimits` so it does not read as an ordinary arrival, with the reason on the chip and in the
+    blocked panel.
+
+100. ~~**The Campaign Train's speeches changed its rules and the card never said which half it was
+     in.**~~ — done 2026-09-07 in v0.7.9.6. X17 is "one turn at station (speeches) then expedite":
+     its first Office arrival is an ordinary stop, and every arrival after runs EXPEDITED — so if it
+     is not back on the Office square when the next Mainline Phase begins, that is a Station Master
+     fault costing 1 Revenue.
+
+     `trainRules()` took `{ trainNumber, trainIsExtra }` and so could not see `speechMade`, even
+     though both of its tray-side callers hand it a whole `CrewTray` that has it. The chip therefore
+     read identically before and after — and worse, the "EXPEDITED … costs 1 Revenue" warning is
+     printed only under `rules.expedite`, so X17 became subject to a fault whose warning the game
+     shows to every other expedited train and never to it. It now says which half it is in, and
+     borrows `isExpedited` from `advance.ts` rather than restating the test: a card describing a rule
+     the engine does not apply is the failure this sits inside.
+
+101. ~~**A dispatch device never said it had been spent — or that it was somebody else's to
+     spend.**~~ — done 2026-09-07 in v0.7.9.7, the last item off #98's sweep and the only one that
+     had been parked rather than fixed.
+
+     Telegraph (+4), Telephone (+8) and Radio (+12) are "once a day, when dispatching facing trains,
+     add +N to the other train's number". `enhancementText(key)` takes only the KEY, so the tooltip
+     could not vary with anything: a spent Radio read "Once a day, add +12…" for the rest of the Day,
+     advertising a bonus that was not there. That is `trainRules` before #100, in another corner of
+     the same view.
+
+     **THE SECOND HALF IS WORTH MORE THAN THE FIRST, and is why this stopped being a small item.**
+     `spendDispatchBonus` reads `areaOf(s, s.clock.superintendent)` — the SUPERINTENDENT's own
+     devices, not the train owner's — and the Fedora moves every `STAGES_PER_SHIFT` (3) Stages, four
+     times a Day. So a player's Radio does nothing at all for three-quarters of the Day, and is spent
+     automatically, without its owner being asked, during the quarter it is theirs. Neither half was
+     anywhere on the board. The card now says which of the three states it is in, and names the shift
+     length, because "not now" without "for how long" is half an answer.
+
+     **Shown on EVERY district** (Jesse, 2026-09-07), not only the viewer's: it is public, and a
+     rival's spent Radio is what you want to know before forcing a meet. One change covers both, as
+     `projectDistrict` serves the player's own cells and the common board's `districts` alike — note
+     that a player's Frame carries only their own district, so in practice "every district" is the
+     common board, which is pre-existing and not touched here.
+
+     What counts as a device is `enhancementRule(key)?.dispatchBonus`, not a list of three keys
+     written out in the view: the ladder lives in `ENHANCEMENT_RULES`, and a fourth rung added there
+     would otherwise be silently exempt from the whole of this.
+
+     **A stale comment corrected, and pinned.** `advance.ts` warned that indexing a SEAT-keyed area
+     with the PLAYER holding the Fedora "is right only while seating is the identity map". It read as
+     a live Employee Rotation bug and was not one — `areaOf(s, p)` IS `areaAtSeat(s, seatOf(s, p))`.
+     A comment that sends the next reader chasing a bug that does not exist costs about as much as
+     the bug would, so it is rewritten, and the claim is now a test: seating set to a real
+     permutation, and the Superintendent's own district — not the seat with the same index — is the
+     one that reads as dispatching.
+
+     **And a test that passed for the wrong reason, caught by mutation.** "Leaves a non-dispatch
+     enhancement alone" originally asserted the ABSENCE of /spent|Fedora/ with the Fedora held —
+     and a mutant with the `dispatchBonus` guard deleted passed it, because the leaked text in that
+     case says "Available today, and this district is dispatching", which contains neither word. A
+     test that something was left alone has to compare it against what it should be; it asserts
+     equality with `enhancementText` now, in both Fedora states.
+
+     **The replay wire format needed the field too.** Cells are packed positionally, so the new flag
+     is index 9 and reads `?? []` — the same tolerance `standingWest` uses. Recordings made before
+     it existed report no device spent, which is exactly what they drew at the time, so every
+     published replay is unchanged.
+
+102. ~~**`npm test` did not typecheck, and passed green on a type error in the server.**~~ — done
+     2026-09-07 in v0.7.9.8. `pretest` ran `scripts/build-web.ts`, which invokes
+     `tsc --ignoreConfig` against three web entry points — so it saw only what those three
+     transitively import, under a WEAKER configuration than `tsconfig.json` (no
+     `noUncheckedIndexedAccess`, no `exactOptionalPropertyTypes`, `--types ''`). `src/server/` and
+     every file under `test/` were never checked by the test command at all.
+
+     Demonstrated rather than argued: `const DELIBERATE_TYPE_ERROR: number = 'not a number';` in
+     `src/server/session.ts` gives `npm run typecheck` a TS2322 and `npm test` a clean
+     `# fail 0`. `pretest` is `tsc --noEmit && node scripts/build-web.ts` now, and the same planted
+     error exits 1 with the tests never running.
+
+     **Why it mattered THIS week rather than generally.** v0.8.0 is steps 2-7 of the common board —
+     a display stream, credentials, persistence, and a Chromium supervisor — which is almost
+     entirely `src/server/` and is exactly the half the test command could not see. Found while
+     answering "anything else before 0.8.0", which is the only reason it was found at all: nothing
+     about a green suite would ever have said so.
+
+103. ~~**The common-board plan had drifted from the code it is the source for.**~~ — done 2026-09-07
+     in v0.7.9.8. `docs/plans/jitsi-common-board.md` was written 2026-08-27, still said "No
+     implementation has been performed", and is what steps 2-7 will be built from. Step 1 has since
+     shipped across four releases, so every "current code finding" under it described a fault that
+     is now fixed — a document that reads as present tense and is nine days stale sends the next
+     reader to fix things twice.
+
+     Measured: the plan's `PublicFrame` sketch lists four properties that were never built
+     (`protocolVersion`, `config`, `scoring`, `deckCounts`) and omits **28** that exist. The shape
+     is the real difference — the implementation is FLAT where the plan grouped things into `clock`,
+     `config`, `scoring` and `deckCounts` objects. A renderer written from the sketch would not
+     compile against the projection.
+
+     The plan now says so at the top and at step 1, names `src/sim/view.ts` and
+     `test/redaction.test.ts`'s allow-list as the authority, keeps the original sketch for its
+     reasoning, and lists what has been gained since (`crewTrays`, `queued`, `heldAtLimits`,
+     `enhancementsSpent`). **`protocolVersion` is called out as unbuilt** rather than quietly
+     dropped: step 2 is the reconnecting display stream and is the first thing that would want one.
+
+     **One step-1 item is STRUCK OFF rather than deferred:** "add the Red Flag holder to the public
+     player projection." The premise does not hold here. `decks.redFlags` is written once, in
+     `setup.ts`, from `config.optionalRules.emergencyToolbox`, and never again — `redFlag.play`
+     emits `phaseEnded` and does not spend it — so every player holds one or none does, decided
+     before the deal. A per-player `redFlagHeld` would be `optionalRules.emergencyToolbox` copied N
+     times, already public, while telling every reader of the common board that it varies by player
+     and might change mid-game. That is worse than the absence. Pinned by test so it is not
+     re-raised from the plan text: if the rule ever becomes per-player, the test fails.
+
+32. ~~**Tell the 0.4.9 playtesters their saves are dead, before they find out.**~~ — done
+    2026-09-07. `PLAYTEST-0.7.4.md` was written for exactly this and did its job; Jesse, 2026-09-07:
+    "a temporary document to help some of the playtesters out on making the big jump, but that is no
+    longer needed." The jump is made, so the note is retired rather than committed. **No per-version
+    save-compatibility fact is tracked from here**, on Jesse's call 2026-09-07: a save replays
+    through the current rules, so an older one breaking is the design working rather than an event
+    to log each time. The general rule lives in `README.md` § Design notes; #40 is the same shape and
+    has been generalised to match.
+
+92. ~~**Two multiplayer information leaks in the shared narration log.**~~ — done 2026-09-07 in
+    v0.7.9.2, found while planning Gitea#20 step 1. The **seed** was announced in the opening line of
+    every multiplayer game and a **blind Home Office draw named the card** — and `linesSince(seat)`
+    slices one shared `game.log` with no per-seat filter, so both went to every player. **Ruling:
+    solitaire keeps both**, because a one-seat table has nobody to leak to, the seed is what a bug
+    report quotes, and a solo player's history naming their own draw is the record. A Department
+    slot is face up and stays named for the same reason. **Worth knowing:** these were not found by
+    a test, they were found by reading the plan — every redaction test passes `[]` for the log, so
+    the whole of narration was unchecked. #91 is what remains.
+
+93. ~~**`docs/rules/` had no current description of the game, and the code pointed at a superseded
+    one.**~~ — done 2026-09-07 in v0.7.9.2. `content.ts` named `card-reference.md` as "the place
+    that now carries what the cards say" while that file's own banner said not to use its numbers;
+    it describes the v0.4.5 deck, where 3/4 is a Mail-Express with three coaches against a `content.ts`
+    whose train 3 is the Express with two freight cars. **The fix is not a rewritten table** — every
+    file in `docs/rules/` is a deliberate historical record and worth more intact than patched. A new
+    `as-built.md` is GENERATED from the same catalogues the engine instantiates from, by
+    `scripts/build-card-reference.ts` (`npm run build:cards`), and `test/card-reference.test.ts`
+    re-runs the generator and fails if the checked-in file disagrees. **Worth knowing:** a
+    hand-written replacement would have drifted the same way and for the same reason — nothing fails
+    when a table falls behind a constant. Generate it or check it; do not retype it.
+
+89. ~~**The map drew westbound trains in the wrong half of a Mainline card.**~~ — done 2026-09-07 in
+    v0.7.9.1, Gitea#22. `regionOfTransit` counts from the end a train ENTERED, which is what the
+    collision rules want; the map wanted "which printed box, left to right" and used the same number,
+    so every westbound card came out mirrored. It cost a collision: the Superintendent cleared Train 3
+    to follow T5 and it ran into TX17, which the picture had drawn ahead of T5 instead of behind it.
+    **Worth knowing:** the engine was right and only the picture lied, so the fix is one mirror in
+    `view.ts` at the drawing boundary — and every existing region test ran eastbound, where the mirror
+    is the identity, which is exactly why it survived them. The same shape as the mirrored consist row
+    at the Whistle Post (seed 270861860): a number meaning "distance run" used where the screen means
+    "place". **Ask of any new Frame field whether it is a distance or a position.**
+
+90. ~~**The Blocked panel explained a refusal by describing something else entirely.**~~ — done
+    2026-09-07 in v0.7.9.1, Gitea#21. A second tank car would not come off at a refinery; the panel
+    said the refinery's green box was empty. The real answer was Train 3's printed rule — the Express
+    may work one freight car per location — so the refusal was correct and the panel sent the player
+    to spend a Freight Agent action that could not have helped. **The ruling: no rule changed, only
+    what the screen says about it.** The panel asks the reducer's own `freightBudgetLeft` through a
+    new exported `freightRuleSpentHere`, so its words cannot drift from the rule. **Worth knowing:**
+    a panel that answers the wrong question is worse than one that stays silent, because it looks
+    like an answer — and a rule that only lives on a card tooltip is invisible at the moment a player
+    notices a button is missing.
+
 43. ~~**"Waiting on" said nobody while the game was stopped on the Superintendent.**~~ — done
     2026-08-30 in v0.7.9. `Frame.actor` carried `clock.currentActor`, null for the whole Mainline
     Phase, so all three interruptions (clearance, Yard Office, Red Flag) reported that the Division

docs/plans/jitsi-common-board.md

@@ -0,0 +1,978 @@
+# Station Master Jitsi Common Board Implementation Plan
+
+**Status (2026-09-07):** **STEP 1 IS BUILT AND SHIPPED. Steps 2-7 are unimplemented.**
+
+Step 1 landed across four releases rather than one — v0.7.9.2 (the two narration leaks), v0.7.9.4
+(the projection helpers and the redaction net), v0.7.9.5 (the narration path), and v0.7.9.8 (this
+reconciliation). One of its items is struck off rather than built; see § Public game projection.
+
+**This document has drifted from the code and is no longer the authority on what exists.** It was
+written on 2026-08-27 against the code of that date, and the "Current code findings" under each step
+describe faults that were then real — several are now fixed, and reading them as present tense will
+send you to fix things twice. Where a step is marked built, `src/sim/view.ts`, `src/server/`, and the
+tests named in TODO.md are the authority. Steps 2-7 were never implemented and their findings have
+NOT been re-verified against the current code; check each before building on it.
+
+## Summary
+
+Add a privacy-safe common game board that can be viewed in a browser and published into the game’s Jitsi meeting by a server-managed headless Chromium participant.
+
+The publisher represents the game table, not a player or bot. Human and bot actions both update the same public board. No hands, objectives, legal moves, random seed, private draws, or other player-only state may enter the display data path.
+
+The implementation is divided into independently useful stages:
+
+1. Establish a secure public-state projection and close existing narration leaks.
+2. Add a public display stream, credentials, persistence, and reconnect behavior.
+3. Build the reusable 1280×720 common-board renderer.
+4. Preserve individual human and bot actions as display animation steps.
+5. Add a minimal visual-only Jitsi engine.
+6. Supervise one headless Chromium process per published game.
+7. Integrate lifecycle, configuration, packaging, health, and live verification.
+
+The browser display remains useful without Jitsi. The public projection and leak fixes improve multiplayer security even if no visual display is deployed.
+
+## Research incorporated
+
+This plan is based on the current Station Master server, engine, multiplayer view, persistence, and untracked Jitsi harness, plus a read-only review of the sibling `jitsi-transcription` packaging repository at commit `9cae1877a9d9a9f489de8f870dad6ff011521c9d`.
+
+The Jitsi Transcription review materially changes the earlier architecture:
+
+- Use direct `child_process.spawn` Chromium supervision, not Playwright or CDP.
+- Use one Chromium process and temporary browser profile per published game, not multiple contexts in one shared browser.
+- Copy the minimal proven Jitsi/control patterns into Station Master; do not create a runtime dependency on the sibling repository.
+- Treat `conference.authenticationRequired` as a retryable “waiting for moderator” state.
+- Use the exact StartOS-proven Chromium flag set.
+- Explicitly disable third-party requests in `JitsiMeetJS.init`.
+- Gracefully leave Jitsi before terminating Chromium to reduce ghost participants.
+- Package Chromium and `tini`; visual-only publishing needs neither PulseAudio nor Xvfb.
+- Default to one concurrent publisher until target-hardware measurements justify more.
+
+The sibling repository had unrelated local modifications and untracked files. They are not part of this plan.
+
+## Public interfaces and types
+
+### Public game projection
+
+Introduce dedicated allow-listed types. Do not derive them with `Omit<Frame, ...>` because new private `Frame` fields could then leak automatically.
+
+> **RECONCILED 2026-09-07 (v0.7.9.8).** Step 1 is BUILT, and what shipped is not shaped like the
+> sketch below. This block was the design; `PublicFrame` in `src/sim/view.ts` is now the authority,
+> and `test/redaction.test.ts`'s allow-list is the enumeration of it that fails when it changes.
+> **Read those two, not this**, when building steps 2-7. The differences that matter:
+>
+> - **The shape is FLAT, not grouped.** There is no `clock`, `config`, `scoring` or `deckCounts`
+>   object. Their contents sit at the top level — `day`, `stage`, `clock` (a time string), `phase`,
+>   `phaseKey`, `actor`, `superintendent`, `deck`, `departments`, `departmentDepth`, `salvage`,
+>   `yards`, `mode`, `days`, `optionalRules`, `houseRules`, `minCombinedRevenue`,
+>   `maxCollisionsPerDay`, `maxCollisionsTotal`, `collisionsToday`, `collisionsTotal`, `status`,
+>   `outcome`, `extraDays`, `extensionVotes`, `official`, `tally`, `openingRolls`, `timetable`,
+>   `timetableWhat`, `trains`, `players`, `division`, `districts`.
+> - **`protocolVersion` was NOT built** and exists nowhere in the repo. Step 2 is the reconnecting
+>   display stream, which is the first thing that would want one — decide there whether to add it,
+>   rather than assuming it is already on the wire.
+> - **`redFlagHeld` is STRUCK OFF**, not deferred. See below.
+> - **Fields gained since this was written** that the renderer should know about: `crewTrays` and
+>   `queued` (#98, the Crew Tray pool and the trains waiting for one), and on each district's cells
+>   `heldAtLimits` (#99, a train stopped on the Limit Track) and `enhancementsSpent` (#101, a
+>   dispatch device spent for the Day).
+>
+> **Why `redFlagHeld` is struck off rather than built.** The premise does not hold in this codebase.
+> `decks.redFlags` is written in exactly one place — `setup.ts`, from
+> `config.optionalRules.emergencyToolbox` — and never again; `redFlag.play` emits `phaseEnded` and
+> does not spend it. So every player holds one or none does, decided before the deal. A per-player
+> `redFlagHeld` would be `optionalRules.emergencyToolbox` copied N times, already public, while
+> telling every reader of the common board that it varies by player and may change mid-game. The
+> invariant is pinned by test (`test/display-gaps.test.ts`) so this does not get re-raised from the
+> plan text: if the rule ever becomes per-player, that test fails.
+
+The design as originally written, kept for the reasoning:
+
+```ts
+type PublicPlayerView = {
+  index: PlayerIndex;
+  seat: PlayerIndex;
+  name: string;
+  revenue: number;
+  handCount: number;
+  redFlagHeld: boolean;
+};
+
+type PublicDistrictView = {
+  seat: PlayerIndex;
+  player: PlayerIndex;
+  cells: readonly CellView[];
+  facilities: readonly FacilityView[];
+  runningRow: number;
+  limits: unknown;
+};
+
+type PublicFrame = {
+  protocolVersion: 1;
+  status: GameState['status'];
+  clock: PublicClockView;
+  config: PublicConfigView;
+  scoring: PublicScoringView;
+  players: readonly PublicPlayerView[];
+  division: readonly DivisionView[];
+  districts: readonly PublicDistrictView[];
+  deckCounts: PublicDeckCounts;
+  departments: PublicDepartmentsView;
+  salvage: PublicSalvageView;
+  yards: PublicYardsView;
+  timetable: PublicTimetableView;
+};
+```
+
+Reuse existing view types only after verifying every reused field is public. Create narrower public variants where an existing type includes viewer-specific or private data.
+
+The projection must never include:
+
+- `viewer`
+- card identities in any player’s hand
+- `justDrawn`
+- objectives
+- decisions or private prompts
+- menus, actions, legal moves, or blocked reasons
+- seed or RNG state
+- raw `GameState`
+- intent history
+- private event details
+- unresolved internal ordering data
+- full shared narration logs
+
+### Display stream
+
+```ts
+type PublicFrameDelta = PartialPublicFrameDelta;
+
+type DisplayReset = {
+  type: 'display.reset';
+  seq: number;
+  frame: PublicFrame;
+};
+
+type DisplayStep = {
+  type: 'display.step';
+  seq: number;
+  actor: {
+    player: PlayerIndex;
+    seat: PlayerIndex;
+    source: 'human' | 'bot';
+  };
+  frame: PublicFrameDelta;
+  lines: readonly PublicNarrationLine[];
+};
+
+type DisplayMessage = DisplayReset | DisplayStep;
+```
+
+A new or reconnected display client always receives `display.reset`. Subsequent accepted intents produce ordered `display.step` messages. The server does not replay missed steps; reconnecting clients reset to the latest public state.
+
+### Jitsi publisher state
+
+```ts
+type JitsiPublisherState =
+  | 'disabled'
+  | 'queued'
+  | 'launching'
+  | 'connecting'
+  | 'waiting-for-admission'
+  | 'waiting-for-moderator'
+  | 'publishing'
+  | 'reconnecting'
+  | 'stopping'
+  | 'failed';
+```
+
+Expose sanitized state, last transition time, and a safe error summary through the existing session/health surfaces. Never expose meeting credentials, display credentials, Jitsi tokens, XMPP service credentials, or browser launch URLs.
+
+## Step 1 — Secure public-state projection
+
+> **BUILT — v0.7.9.2 through v0.7.9.5.** Everything in "Required changes" below shipped except the
+> Red Flag holder, which is struck off (§ Public game projection). Mapping to the work items in
+> TODO.md: the projection helpers and `currentActorOfState` are **#95**, the systematic redaction
+> net and its allow-list are **#91**, the seed and blind-draw narration leaks are **#92**, and
+> "stop passing the full game log into `frameFor()`" is **#97** — which also fixed a reconnect bug
+> the duplicate had been masking, so read that entry before touching narration in step 2.
+>
+> **The findings below are as of 2026-08-27 and are now HISTORY, not a task list.** Two are worth
+> carrying forward anyway: districts must be keyed by SEAT with ownership resolved through
+> `playerAtSeat` (Employee Rotation), and the public view must be composed UPWARD from shared
+> helpers, never by calling the player `snapshot()` once per seat. Both are load-bearing for step 3.
+>
+> One finding was struck off on measurement rather than fixed: it warns that a display reading
+> `clock.currentActor` could highlight the wrong district during a decision. Across six seeds and
+> 3,600 decision points that field and `actingPlayer` never disagreed. `currentActorOfState` exists
+> anyway as the one place to ask — and **#96** later found a real instance of the same class in a
+> state nobody had checked, the §3.3 vote, where the game is not `active` at all.
+
+### Current code findings
+
+`src/sim/view.ts` currently builds `Frame` for one real viewer and defaults that viewer to player zero. It combines shared table state, one district, and viewer-private fields. Calling it for a spectator would silently expose player zero’s district and private information.
+
+`src/server/session.ts` calls:
+
+```ts
+snapshot(game.state, game.log, ..., seat)
+```
+
+This embeds the complete shared narration log in every `Frame`, while `Push.lines` also sends narration incrementally.
+
+Existing narration has at least two privacy leaks:
+
+- `newMultiplayerGame()` places the seed in the shared log.
+- A blind Home Office draw can resolve the drawn card to its real name in shared narration.
+
+Existing redaction tests pass `[]` for narration and mainly search internal IDs, so they do not detect resolved card names or seed text in the full serialized payload.
+
+`currentActor(game)` accounts for Superintendent/pending decisions, while `snapshot()` reads `state.clock.currentActor`. A public display using the latter could highlight the wrong district.
+
+Employee Rotation means district ownership cannot be assumed to match player index. Districts must be keyed by seat, with current ownership resolved through `playerAtSeat`.
+
+### Required changes
+
+Create explicit projection helpers in the simulation/view layer:
+
+- `projectDistrict(state, seat)`
+- `projectDivision(state)`
+- `projectSharedTable(state)`
+- `publicSnapshot(state)`
+- `currentActorOfState(state)`
+
+Refactor the player snapshot and public snapshot to share only safe lower-level projection helpers. Do not implement the public view by repeatedly calling the player `snapshot()` function.
+
+Make the existing actor logic use the same engine-level helper so player views, bot execution, and the common board agree during decisions and Superintendent actions.
+
+Add the Red Flag holder to the public player projection. It is public game state but is currently absent from `Frame`.
+
+Remove seed narration from multiplayer game creation. Retain the seed only in persistence and administrative/replay data.
+
+Change blind-draw narration to a generic public line such as “Home Office drew a card.” Keep the card identity available only to the drawing player through the existing owner-only `justDrawn` mechanism.
+
+Stop passing the full game log into `frameFor()`. Continue sending sanitized incremental narration through `Push.lines`.
+
+### Tests
+
+Add tests that serialize the entire public frame and player pushes, then search for:
+
+- every opponent hand card ID
+- every opponent hand card display name
+- current objective IDs and names
+- `justDrawn` for the wrong player
+- seed values and seed narration
+- private decision/menu/action data
+
+Cover:
+
+- a newly created multiplayer game
+- a blind Home Office draw
+- a pending decision
+- Superintendent acting
+- Employee Rotation before and after ownership changes
+- reconnect pushes
+- a finished game
+
+Acceptance requires an allow-list review of every `PublicFrame` property. Passing redaction tests alone is insufficient.
+
+## Step 2 — Display credentials, stream, and persistence
+
+### Display metadata
+
+Create separate per-game display metadata rather than extending the authoritative game save:
+
+```ts
+type SavedDisplayMetadata = {
+  schemaVersion: 1;
+  room: string;
+  viewToken: string;
+  publisherToken: string;
+  nextSequence: number;
+  createdAt: number;
+};
+```
+
+Store it in the same per-game data directory as `display.json`, using the persistence layer’s existing atomic-write pattern.
+
+Generate:
+
+- a cryptographically random Jitsi room name
+- a high-entropy `viewToken`
+- a separate high-entropy `publisherToken`
+
+Do not derive any token from game ID, room name, player token, seed, or timestamp.
+
+For older saves without `display.json`, generate the metadata once on resume and persist it. Failure to initialize display metadata must disable display/Jitsi for that game without preventing the underlying game from resuming.
+
+### HTTP endpoints
+
+Add:
+
+- `GET /display.html#token=<viewToken>` — manual common-board page
+- `GET /api/display/stream?token=<viewToken>` — public-board SSE
+- `GET /display-agent.html` — internal headless publisher page
+- WebSocket upgrade at `/api/display/control` — supervisor/agent control
+
+Extend the authenticated game/session response with:
+
+- display URL
+- Jitsi meeting URL
+- sanitized publisher state
+
+The browser display reads the fragment token, removes it from the visible address if practical, and supplies it to the SSE request. Fragments keep the credential out of the initial HTTP request and normal server access logs.
+
+Do not add a publisher-configuration HTTP endpoint. The internal agent receives its meeting configuration and view token over the authenticated control WebSocket.
+
+### SSE behavior
+
+Maintain a display subscriber set per game.
+
+On connection:
+
+1. Authenticate `viewToken`.
+2. Produce the latest `PublicFrame`.
+3. Send `display.reset` with the current sequence.
+4. Continue existing heartbeat behavior.
+5. Send later `display.step` messages in sequence order.
+
+Use a dedicated public-frame delta function rather than the player `Frame` delta. The observed public snapshot grows enough during longer games that full frames for every action would be wasteful.
+
+If an SSE client is slow or disconnected, close it and let EventSource reconnect to a new reset. Do not keep an unbounded replay buffer.
+
+### Security requirements
+
+- Compare tokens without placing them in error messages.
+- Do not log query strings or control registration messages containing tokens.
+- Never accept game intents through display endpoints.
+- Do not let a view token register as a publisher.
+- Apply payload and connection limits independently from player SSE.
+- Keep display failure isolated from player pushes and game persistence.
+
+### Tests
+
+Add HTTP tests after refactoring `startServer()` to return the server/listening handle needed by tests.
+
+Cover:
+
+- valid and invalid view tokens
+- publisher token rejected as a view token
+- reset on first connect and reconnect
+- monotonically increasing sequence IDs
+- public deltas reconstruct the same frame as a fresh reset
+- heartbeat behavior
+- no private fields in raw SSE bytes
+- legacy save migration
+- atomic `display.json` persistence
+- display failure not interrupting `/api/intent` or player SSE
+
+## Step 3 — Reusable common-board renderer
+
+### Renderer structure
+
+Build one renderer shared by:
+
+- the manual browser display
+- the headless Jitsi publisher page
+
+Use a fixed 1280×720 canvas at 10 frames per second. Set the captured video track’s `contentHint` to `"detail"`.
+
+Keep the canvas palette stable. The Jitsi Transcription prototype deliberately changed color themes to prove updates were arriving; that behavior strobes during frequent game actions and must not enter the product.
+
+Separate the renderer into:
+
+- a pure layout/view-model stage
+- image/SVG preparation
+- canvas drawing
+- animation queue management
+
+### Layout
+
+Use this fixed layout:
+
+- Header: game name/status, day/stage/phase, current actor, Red Flag.
+- Main left: persistent Division board.
+- Main right: focused district.
+- Footer/side panels: player standings, hand counts, timetable, public decks/resources, and recent narration.
+- Compact district summaries: every district’s owner, revenue, and operational status.
+
+The focused district is:
+
+1. the acting player’s current seat;
+2. otherwise the most recent actor’s seat;
+3. otherwise seat zero.
+
+Resolve owner from seat on every frame so Employee Rotation updates the labels without moving the district itself.
+
+The complete `PublicFrame` carries all public districts even though the 720p layout focuses one at a time.
+
+### Existing assets
+
+Reuse the existing Division and office SVG generators and exported board CSS. Adapt their APIs so the Division roster can be rendered without a private viewer.
+
+Render SVG output into canvas-safe images. Cache images by serialized SVG/content key and invalidate only when the corresponding public model changes.
+
+Do not recreate game rules or labels inside the renderer. The projection layer supplies display-ready public labels.
+
+### Display behavior
+
+- Human and bot actions use the same animation path.
+- Normal display-step duration: 700 ms.
+- If the queue exceeds 12 steps, use 200 ms catch-up transitions.
+- A reset clears queued animations and renders immediately.
+- Rendering or asset failure keeps the previous good frame and reports a sanitized diagnostic.
+- Recent narration is bounded and uses only sanitized `DisplayStep.lines`.
+- No server-side sleeps are permitted.
+
+Update `scripts/build-web.ts` to explicitly build/copy the new display entry points, HTML pages, styles, and Jitsi vendor asset. The current static build manually lists its artifacts, so relying on automatic discovery will omit the pages.
+
+### Tests
+
+Test the pure layout model for:
+
+- focused-district selection
+- Employee Rotation ownership
+- Superintendent decisions
+- two through four players
+- empty and dense boards
+- long player/facility names
+- finished-game state
+
+Test renderer lifecycle with a fake canvas/image layer:
+
+- reset clears the queue
+- step order is preserved
+- catch-up speed activates at the threshold
+- stopped renderers stop timers and media tracks
+- no private input type is accepted
+
+Perform visual review at 1280×720 and as a reduced Jitsi tile. Text and train positions must remain legible without opening a tooltip.
+
+## Step 4 — Preserve individual human and bot actions
+
+### Current code findings
+
+`GameSession.intent()` applies the human intent, runs `driveBots()`, and only then creates player pushes.
+
+`driveBots()` can call `submit()` many times. Player deltas intentionally collapse those moves into one final state, which is appropriate for gameplay but would make bots appear to teleport through several actions on the common board.
+
+Engine events cannot be replayed into display state. One accepted intent may run automatic `drain()` work and emit several events, and the event list is not a complete reducer.
+
+### Required changes
+
+Introduce a display-step collector inside `GameSession`.
+
+After every successful `submit()`:
+
+1. Resolve the acting player and current seat.
+2. Produce the sanitized narration lines added by that submission.
+3. Create the next `PublicFrame` immediately.
+4. Delta it against the last emitted public frame.
+5. Assign the next display sequence.
+6. Emit one `DisplayStep`.
+
+Apply this both to:
+
+- the human submission in `intent()`
+- every successful bot submission inside `driveBots()`
+
+Capture the frame immediately. Do not retain a mutable `GameState` reference for later projection because every retained reference would otherwise resolve to the final state.
+
+One display step corresponds to one accepted intent, including automatic consequences drained by that intent. Do not create one step per low-level `GameEvent`.
+
+Keep player pushes unchanged: players still receive the final coalesced result after all immediately due bots finish.
+
+Opening bot moves that occur before any client connects do not need replay. Persist the resulting game state and sequence; a later display receives the final reset.
+
+### Failure isolation
+
+Display projection or broadcasting must not invalidate an already accepted game move.
+
+If step generation fails:
+
+- record a sanitized server diagnostic
+- mark the publisher/display state degraded
+- send a fresh reset on the next successful display update
+- continue normal game and player push processing
+
+### Tests
+
+Cover:
+
+- one human intent with no bot response
+- one human intent followed by several bot intents
+- consecutive bot turns
+- bot pending decisions
+- automatic engine work within one intent
+- ordering of narration and frames
+- sequence continuity
+- player pushes remaining coalesced
+- reconstructed display state matching `publicSnapshot()` after the final step
+
+## Step 5 — Minimal visual-only Jitsi engine
+
+### Source strategy
+
+Port the smallest relevant production patterns from `jitsi-transcription` into Station Master with attribution where required. Do not import the sibling repository at runtime, add it as a submodule, or copy its transcription/audio/chat features.
+
+Retain only:
+
+- Jitsi configuration parsing
+- connection/conference lifecycle
+- lobby handling
+- reconnect classification/backoff
+- generated-display track creation
+- generated-display cleanup and republishing
+- normalized state/error events
+- minimal control protocol
+
+Pin the known working `lib-jitsi-meet` release:
+
+```text
+v2192.0.0+d6f3312f
+```
+
+Add `ws` for the Node control broker. Do not add Playwright.
+
+### Agent page
+
+`display-agent.html` must:
+
+1. Validate its opaque session ID and publisher token from the URL fragment.
+2. Connect to `/api/display/control`.
+3. Register as the engine for exactly one session.
+4. Wait for a supervisor command before joining Jitsi.
+5. Connect to the public display SSE using the supplied view token.
+6. Render the same common-board canvas as the manual page.
+7. Capture the canvas stream at 10 fps.
+8. Join Jitsi and publish it as a desktop video track.
+9. Report normalized lifecycle state over the control channel.
+10. Leave and stop all tracks on supervisor command or `pagehide`.
+
+Meeting server, room, XMPP configuration, and view token are delivered over the control WebSocket, not placed in query parameters.
+
+### Jitsi publishing
+
+Use:
+
+```ts
+canvas.captureStream(10)
+JitsiMeetJS.createLocalTracksFromMediaStreams([{
+  mediaType: 'video',
+  sourceType: 'generated',
+  stream,
+  track: stream.getVideoTracks()[0],
+  videoType: 'desktop'
+}])
+```
+
+Require exactly one generated video track. Dispose any unexpected auxiliary tracks.
+
+Wait for the first video frame before publishing and report a diagnostic if it does not arrive. Do not automatically recycle a healthy track merely because a remote participant initially sees a blank publication; the existing harness observed occasional first-publication blankness on the Jitsi side.
+
+On reconnect:
+
+- retain the program-owned canvas stream
+- remove/dispose the stale Jitsi local track
+- reconnect and rejoin
+- create a fresh Jitsi wrapper track around a clone of the retained stream
+- republish it
+
+### Jitsi initialization and privacy
+
+Initialize with:
+
+```ts
+JitsiMeetJS.init({
+  disableAudioLevels: true,
+  enableAnalyticsLogging: false,
+  disableThirdPartyRequests: true
+});
+```
+
+The pinned library declarations confirm `disableThirdPartyRequests` is supported.
+
+Do not initialize microphones, cameras, remote audio sinks, chat, TTS, STT, analytics, or rtcstats endpoints.
+
+Before release, capture browser network destinations during a live session and verify that traffic is limited to:
+
+- Station Master loopback/server endpoints
+- the configured Jitsi deployment and its advertised media infrastructure
+
+Unexpected telemetry destinations fail acceptance.
+
+### Meeting states
+
+Handle these explicitly:
+
+- `waiting-for-admission`: the participant joined a lobby and is waiting for a moderator.
+- `waiting-for-moderator`: the guest cannot create the room because no authenticated moderator has opened it.
+- `reconnecting`: a previously joined publisher lost its connection and is retrying.
+- `failed`: malformed configuration, exhausted retry budget, unrecoverable Jitsi error, or repeated browser failure.
+
+`conference.authenticationRequired` may arrive asynchronously as a conference error after the initial join command appears successful. Handle both synchronous and event paths.
+
+For waiting-for-moderator:
+
+- leave/disconnect the failed attempt
+- retry every 8 seconds
+- stop after `JITSI_WAIT_FOR_MODERATOR_SECONDS`, default 600
+- immediately continue when a human moderator opens the meeting
+
+For lobby admission, remain connected until admitted, stopped, or the configured join deadline expires.
+
+### Tests
+
+Port/adapt the sibling repository’s proven tests for:
+
+- generated-display track contract
+- lifecycle transitions
+- lobby state
+- asynchronous `authenticationRequired`
+- reconnect classification
+- generated-display republish
+- cleanup after publish failure
+- stale callbacks from an old connection
+- initialization privacy flags
+- no audio/camera track creation
+
+## Step 6 — Chromium publisher supervisor
+
+### Process model
+
+Create one Chromium child process per published game.
+
+Do not share one Chromium process across games. Per-game processes provide crash isolation, simple lifecycle ownership, and match the production-proven Jitsi Transcription design.
+
+Default publisher capacity to one:
+
+```text
+JITSI_MAX_PUBLISHERS=1
+```
+
+Games beyond capacity enter `queued` in creation order. Make the cap configurable only after measuring CPU and memory on target Station Master hardware.
+
+### Browser launch
+
+Find Chromium using:
+
+1. `CHROME_BIN`
+2. `/usr/bin/chromium`
+3. `/usr/bin/chromium-browser`
+4. `/usr/bin/google-chrome`
+
+Use a unique temporary user-data directory per publisher and remove it after exit.
+
+Launch with the StartOS-proven flags:
+
+```text
+--headless=new
+--no-sandbox
+--disable-dev-shm-usage
+--autoplay-policy=no-user-gesture-required
+--use-fake-device-for-media-stream
+--use-fake-ui-for-media-stream
+--disable-background-timer-throttling
+--disable-renderer-backgrounding
+--disable-backgrounding-occluded-windows
+```
+
+`--no-sandbox` is acceptable only inside the existing StartOS container boundary and because Chromium loads the Station Master-owned loopback agent page.
+
+Filter noisy Chromium stderr, but retain messages matching fatal conditions, renderer crashes, out-of-memory errors, and “Aw, Snap”.
+
+### Control protocol
+
+Use a versioned, session-keyed JSON protocol over `/api/display/control`.
+
+Registration includes:
+
+- protocol version
+- role `engine`
+- session ID
+- publisher token
+
+The broker must:
+
+- validate every message
+- limit payloads to 64 KiB
+- disable per-message compression
+- route commands/events only to the registered session
+- allow a newer engine to supersede only the same session
+- reject client/engine role changes on an established socket
+- clear pending commands when an engine disconnects
+- reconnect the agent-side WebSocket every two seconds until stopped
+
+Public frames remain on SSE and never traverse this control protocol.
+
+### Lifecycle and recovery
+
+Supervisor flow:
+
+1. Allocate capacity.
+2. Spawn Chromium.
+3. Wait for authenticated engine registration.
+4. Send Jitsi join configuration.
+5. Wait for joined/admitted state.
+6. Command generated-display publication.
+7. Monitor process, control socket, and Jitsi state.
+8. Gracefully stop on game completion, server shutdown, or administrative stop.
+
+For unexpected Chromium exit during an active game:
+
+- mark `reconnecting`
+- clean the old profile
+- relaunch with delays of 1, 2, 4, 8, and 16 seconds
+- reset the consecutive-failure count after five stable minutes
+- enter `failed` after five consecutive launch/registration failures
+- keep the underlying game and browser display operational
+
+### Graceful teardown
+
+On stop:
+
+1. Send the engine a leave command.
+2. Wait up to five seconds for confirmation.
+3. Send Chromium `SIGTERM`.
+4. Wait up to three additional seconds.
+5. Use `SIGKILL` only if it remains alive.
+6. Remove the temporary profile.
+7. Release publisher capacity.
+
+Clean leave matters because Jitsi may show a stale participant for 30–120 seconds after abrupt termination. The board does not consume remote audio, so these ghosts are cosmetic, but duplicate meeting participants remain undesirable.
+
+Publish the final game state for a five-minute completion grace period, then leave the meeting. Server shutdown bypasses this grace period and leaves immediately.
+
+### Tests
+
+Use fake child processes and fake control sockets to test:
+
+- exact required Chromium flags
+- binary discovery
+- profile isolation and cleanup
+- capacity queue ordering
+- engine registration authentication
+- per-session supersession
+- command timeout and disconnection
+- crash relaunch backoff
+- retry exhaustion
+- graceful leave before termination
+- forced kill fallback
+- publisher failure not affecting the game session
+
+## Step 7 — Configuration, lifecycle, packaging, and observability
+
+### Configuration
+
+Support:
+
+```text
+JITSI_SERVER_URL
+JITSI_GUEST_DOMAIN
+JITSI_SERVICE_URL
+JITSI_XMPP_DOMAIN
+JITSI_MUC_DOMAIN
+JITSI_FORCE_JVB=false
+JITSI_MAX_PUBLISHERS=1
+JITSI_WAIT_FOR_MODERATOR_SECONDS=600
+JITSI_JOIN_TIMEOUT_SECONDS=600
+JITSI_FINISHED_GRACE_SECONDS=300
+CHROME_BIN
+```
+
+Require `JITSI_SERVER_URL` to be an HTTP(S) origin without credentials, path, query, or fragment.
+
+Default the XMPP WebSocket to:
+
+```text
+wss://<jitsi-host>/xmpp-websocket
+```
+
+Default MUC to `conference.<xmpp-domain>`. Keep explicit overrides for self-hosted deployments.
+
+If `JITSI_SERVER_URL` is absent:
+
+- browser common-board display remains enabled
+- Jitsi meeting URL and publisher are disabled
+- game creation and play remain unaffected
+
+JWT/authenticated publisher support is out of scope for the first version. Authenticated-room deployments rely on a human moderator opening the room and the publisher’s waiting-for-moderator retry.
+
+### Session integration
+
+Create display metadata when the lobby starts a game.
+
+Return the meeting and display links to every authenticated player. All players receive the same links.
+
+On server startup:
+
+- load active game saves
+- load or migrate display metadata
+- rebuild current public snapshots
+- queue publishers only for active games
+- do not automatically republish completed games
+
+On SIGTERM, including StartOS backup shutdown:
+
+- stop accepting new publisher work
+- command every engine to leave
+- terminate browsers
+- then close HTTP/control services
+
+### Health and logs
+
+Health must distinguish:
+
+- game server availability
+- common display availability
+- Jitsi configuration present
+- Chromium available
+- publishers active/queued/failed
+
+Do not report Jitsi publishing as healthy merely because the supervisor is running.
+
+Use structured logs containing:
+
+- game/session ID
+- publisher state transition
+- safe Jitsi room identifier
+- browser exit code/signal
+- retry attempt
+- sanitized error category
+
+Exclude all tokens, full control frames, player private state, query strings, and browser profile paths.
+
+### Dependencies and packaging
+
+Add runtime dependencies:
+
+- the pinned `lib-jitsi-meet` release
+- `ws`
+
+Add Chromium and `tini` to the Station Master runtime image or companion StartOS packaging repository.
+
+Use `tini` as PID 1 so terminated Chromium children are reaped.
+
+Visual-only Station Master publishing does not require:
+
+- PulseAudio
+- Xvfb
+- xauth
+- ffmpeg
+- Playwright browsers
+- CDP tooling
+
+Run the service as a non-root application user. Chromium still receives `--no-sandbox` because the StartOS subcontainer does not grant the kernel capabilities required by Chromium’s internal sandbox.
+
+Do not raise the package RAM requirement based solely on the Jitsi Transcription measurements. Measure the combined Station Master server plus publisher on actual target hardware first.
+
+## End-to-end test plan
+
+### Automated tests
+
+Run:
+
+- Station Master typecheck
+- all existing engine/server/web tests
+- public-projection and leak tests
+- display delta/reconstruction tests
+- HTTP/SSE authentication tests
+- renderer lifecycle tests
+- control-protocol tests
+- Jitsi adapter tests with a fake runtime
+- Chromium supervisor tests
+- persistence migration tests
+
+### Local integration
+
+With a local or test Jitsi deployment:
+
+1. Start a two-player game with one bot.
+2. Open the manual display and both player screens.
+3. Confirm human moves update all three.
+4. Confirm bot moves appear as distinct ordered animations.
+5. Join the Jitsi meeting from another browser.
+6. Confirm the Station Master board is published as a desktop share.
+7. Force an XMPP/media disconnect.
+8. Confirm reconnect and display-track republish.
+9. Stop the game/server and confirm the publisher leaves.
+
+### Authenticated deployment
+
+On a Jitsi deployment where guests cannot create rooms:
+
+1. Start the Station Master game before opening the meeting.
+2. Confirm publisher state becomes `waiting-for-moderator`.
+3. Open the meeting as a moderator.
+4. Confirm the publisher joins on the next retry.
+5. If lobby is enabled, confirm `waiting-for-admission` until admitted.
+6. Confirm neither state is reported as an immediate terminal failure.
+
+### Privacy verification
+
+Capture:
+
+- raw display SSE
+- rendered canvas screenshots
+- control WebSocket messages
+- Jitsi network destinations
+- server logs
+
+Verify that none contains:
+
+- card identities from hands
+- objectives
+- player-only prompts or moves
+- private draw identities
+- seed
+- view/publisher tokens in logs
+- unintended third-party telemetry
+
+### Soak and target hardware
+
+Run at least a two-hour Station Master integration soak with:
+
+- continual public-board updates
+- human and bot moves
+- two forced connection drops
+- one forced Chromium termination
+- clean service shutdown
+
+Record:
+
+- container RSS
+- Chromium RSS
+- CPU during idle and animation bursts
+- Jitsi reconnect time
+- display queue depth
+- dropped SSE clients
+- stale meeting-participant duration after graceful and forced exits
+
+The sibling repository’s four-hour run validates the underlying headless Jitsi approach, but Station Master still needs this integration-specific measurement.
+
+## Acceptance criteria
+
+The feature is complete when:
+
+- Every player can open one shared browser display.
+- The same display is visible as a desktop share in the game’s Jitsi meeting.
+- Human and bot moves update that board through the same path.
+- Consecutive bot intents remain visibly distinct.
+- A reconnecting display reconstructs the latest state without replay.
+- Jitsi disconnection republishes the existing canvas stream.
+- A guest publisher waits for a moderator rather than failing immediately.
+- Browser/Jitsi failure never prevents normal game play.
+- Shutdown leaves the conference before Chromium termination.
+- No private game information appears in projection, transport, rendering, logs, or Jitsi.
+- No unexpected third-party telemetry connection is observed.
+- Chromium resource use is measured on target hardware before increasing concurrency.
+
+## Assumptions and defaults
+
+- The common board is a separate participant named `Station Master — Common Board`.
+- It represents the table, never a particular human or bot.
+- Jitsi is configurable and self-hosted; meet.jit.si-specific behavior is not assumed.
+- One publisher process is allowed by default.
+- A human moderator may need to open or admit the publisher.
+- Public display and normal multiplayer remain valuable and operational without Jitsi.
+- The sibling Jitsi Transcription repository is a reference implementation, not a shared runtime package.
+- The untracked Station Master harness remains research material and is not promoted wholesale into production.
+- Audio, transcription, speech, chat, camera capture, player screen sharing, and JWT publisher authentication are out of scope.

docs/rules/as-built.md

@@ -0,0 +1,260 @@
+# Station Master — the cards as built
+
+> **Generated from `src/engine/content.ts` by `scripts/build-card-reference.ts`. Do not edit by
+> hand** — `npm run build:cards` rewrites it, and `test/card-reference.test.ts` fails if this file
+> and the code disagree.
+
+This is the one file in `docs/rules/` that describes the game **as it currently is**. Everything
+else in this directory is a historical record and marked as such: [`rules-v0.1.md`](rules-v0.1.md)
+transcribes the prototype PDFs, [`open-questions.md`](open-questions.md) tracks how the gaps in
+them were decided, and [`rules-v0.2.md`](rules-v0.2.md) and
+[`card-reference.md`](card-reference.md) both describe superseded card sets. Read those for the
+reasoning; read this for the numbers.
+
+The engine instantiates from the same constants this is emitted from, so a disagreement between
+this page and the game is a bug in the generator, not a stale table.
+
+**No card counts appear here, deliberately** (TODO #15a, Jesse 2026-08-22): the counts move with
+play balance, so a document that prints them is answering a question that will have a different
+answer next retune. Where a count matters it is a yes/no — whether the deck deals the card at
+all — which is a fact about the design rather than about the current tuning.
+
+---
+
+## Trains
+
+12 timetabled and 10 Extras, 22 in all.
+Odd numbers run west, even run east; a pair shares a class and is the same card face in two
+directions. A Crew Tray holds four pieces and a caboose counts toward the four, which is why no
+train with a caboose carries more than three revenue cars.
+
+### Timetabled
+
+| # | Class | Speed | Runs | Consist | Printed rules |
+| ---: | --- | --- | --- | --- | --- |
+| 1 | Crack Limited | fast | west | 2 coaches (2 pieces) | terminals only; no switching; expedite; *"Stop at Terminals only."* |
+| 2 | Crack Limited | fast | east | 2 coaches (2 pieces) | terminals only; no switching; expedite; *"Stop at Terminals only."* |
+| 3 | Express | fast | west | 2 freight (2 pieces) | one freight per location; expedite; *"May drop or pick up one freight car at every location."* |
+| 4 | Express | fast | east | 2 freight (2 pieces) | one freight per location; expedite; *"May drop or pick up one freight car at every location."* |
+| 5 | The Sparrow | fast | west | 3 coaches (3 pieces) | no switching; expedite |
+| 6 | The Sparrow | fast | east | 3 coaches (3 pieces) | no switching; expedite |
+| 7 | Local | slow | west | 1 freight + 1 coach (2 pieces) | coach stays on station track; *"Maximum one freight, one coach."* |
+| 8 | Local | slow | east | 1 freight + 1 coach (2 pieces) | coach stays on station track; *"Maximum one freight, one coach."* |
+| 9 | Heavy Freight | slow | west | 3 freight + 1 caboose (4 pieces) | — |
+| 10 | Heavy Freight | slow | east | 3 freight + 1 caboose (4 pieces) | — |
+| 11 | Drag Freight | slow | west | 2 freight + 1 caboose (3 pieces) | — |
+| 12 | Drag Freight | slow | east | 2 freight + 1 caboose (3 pieces) | — |
+
+### Extras
+
+| # | Class | Speed | Runs | Consist | Printed rules |
+| ---: | --- | --- | --- | --- | --- |
+| X13 | Appleseed Extra | slow | player's choice | 3 freight + 1 caboose (4 pieces), empties only | drop only; *"May drop MTs but not pick up anything."* |
+| X14 | Fruit Growers Express | fast | player's choice | 2 reefers + 1 caboose (3 pieces) | expedite; *"Reefers only. May pick up one extra loaded reefer."* |
+| X15 | Yard Xfer | slow | player's choice | 2 freight + 1 caboose (3 pieces) | — |
+| X16 | Light Engine Move | fast | player's choice | engine only | no switching; *"No cars at all."* |
+| X17 | Campaign Train | fast | player's choice | 1 coach (1 piece) | no switching; stop then expedite; stop earns point; must run loaded; *"One turn at station (speeches) then expedite. Earns a point per Office Area if the candidate is aboard."* |
+| X18 | Circus Train | slow | player's choice | 2 freight + 1 coach + 1 caboose (4 pieces) | no switching; stop earns point; must run loaded; *"One turn stopped in an Office Area (circus set-up) earns 1 point, once per Area, if fully loaded."* |
+| X19 | Military Train | slow | player's choice | 1 freight + 2 coaches (3 pieces) | no switching; no passenger work; expedite; must run loaded; *"Troops and materiel: runs loaded where the yard can supply it."* |
+| X20 | Director's private car | slow | player's choice | 2 freight + 1 coach (3 pieces) | no passenger work |
+| X21 | Freight Extra | slow | player's choice | 3 freight + 1 caboose (4 pieces) | — |
+| X22 | Pee-Dee | slow | player's choice | 1 caboose (1 piece) | pick up empties only; *"Per-diem train. May only pick up MTs."* |
+
+---
+
+## Mainline cards
+
+A card is divided into **regions**, and a train advances one region per Stage — so the regions a
+card prints are what it costs to cross. Where a train *enters* is what the rules move: a fast
+train on Hilly, a Heavy Grade with Helpers, or a card whose back region is a siding rather than
+part of the road all change the entry point rather than the card's length.
+
+| Card | Regions | Default entry | Fast / slow entry | Trains may pass | Sorts cars |
+| --- | ---: | ---: | --- | :---: | :---: |
+| Plains | 1 | 0 | — | — | — |
+| Curves | 2 | 0 | — | — | — |
+| Hilly | 2 | 0 | 1 / 0 | — | — |
+| Heavy Grade | 3 | 0 | — | — | — |
+| Double Track | 1 | 0 | — | yes | — |
+| Uncontrolled Siding | 2 | 1 | — | — | — |
+| Tunnel | 2 | 0 | — | — | — |
+| Trestle | 1 | 0 | — | — | — |
+| Interchange | 2 | 1 | — | — | yes |
+
+The Mainline deck is 10 cards; the two Division Points are the fixed ends of
+the Division and are not dealt. What each card does, in the words the game uses on screen:
+
+- **Plains** — 1 region — one Stage each. · 1 Stage for every train — the printed speed is scenery. · One train at a time — anything following has to wait for it to clear.
+- **Curves** — 2 regions — one Stage each. · 2 Stages for every train — the printed speed is scenery. · One train at a time — anything following has to wait for it to clear.
+- **Hilly** — 2 regions — one Stage each. · This card reads the train's FAST/SLOW rating: a fast train starts further along and crosses in 1 Stage, a slow one in 2 Stages. No other card cares which it is. · One train at a time — anything following has to wait for it to clear.
+- **Heavy Grade** — 3 regions — one Stage each. · A grade, climbing eastward. 3 Stages to climb it and 3 Stages to run down, before help. Helpers start an UPHILL train a region further on; Brakeman does the same DOWNHILL and Airbrakes another again, and Airbrakes cannot be played without Brakeman. Never less than one Stage. · One train at a time — anything following has to wait for it to clear.
+- **Double Track** — 1 region — one Stage each. · 1 Stage for every train — the printed speed is scenery. · TRAINS MAY PASS — two trains may stand on this card at once, so a following train is not held behind a slower one.
+- **Uncontrolled Siding** — 2 regions — one Stage each. · A train with the card to itself starts past the back region and is across in 1 Stage. · UNCONTROLLED SIDING — arrive to find a train already here and you take the siding, a region behind it. You are not in the same place, so you do not run into it; it costs you the extra Stage instead. · One train at a time — anything following has to wait for it to clear.
+- **Tunnel** — 2 regions — one Stage each. · 2 Stages for every train — the printed speed is scenery. · One train at a time — anything following has to wait for it to clear.
+- **Trestle** — 1 region — one Stage each. · 1 Stage for every train — the printed speed is scenery. · One train at a time — anything following has to wait for it to clear.
+- **Interchange** — 2 regions — one Stage each. · A train with the card to itself starts past the back region and is across in 1 Stage. · An Extra beginning its run here starts in the back region and takes the extra Stage. · One train at a time — anything following has to wait for it to clear. · Cars may be sorted into any new order here.
+
+---
+
+## Office cards
+
+Upgrades are strictly sequential — no skipping a tier — so a Terminal needs all three cards in
+order. Green slots are outbound passengers, red are inbound, and the design gives slots **equal**
+to Porters rather than one more.
+
+| Office | Control point | Passenger facility | A/D tracks | Porters | Green | Red |
+| --- | :---: | :---: | ---: | ---: | ---: | ---: |
+| Whistle Post | — | — | 1 | 0 | 0 | 0 |
+| Depot | yes | yes | 2 | 1 | 1 | 1 |
+| Station | yes | yes | 3 | 2 | 2 | 2 |
+| Terminal | yes | yes | 4 | 3 | 3 | 3 |
+
+Whistle Posts are a fixed supply of 4 outside the deck, and Limits signs a
+supply of 8.
+
+---
+
+## Freight facilities
+
+Each lists the car types it works, which way its traffic flows, and the industries it may not sit
+beside. **Every lockout pair is a producer and the consumer of the same commodity** — you may
+build one end of a chain or the other, never both, which is what forces traffic to run between
+districts rather than in circles inside one. No two of the same industry may share an Office Area,
+and that rule is enforced for every kind rather than repeated in each row.
+
+| Industry | Cars | Flow | Green | Red | Laborers | Locked out with |
+| --- | --- | --- | ---: | ---: | ---: | --- |
+| Freight House | boxcar | both | 1 | 1 | 1 | Grocer's Warehouse |
+| Mine Tipple | hopper | outbound | 1 | 0 | 1 | Power Plant |
+| Refinery | tank | outbound | 1 | 0 | 1 | Power Plant |
+| Power Plant | hopper, tank | inbound | 0 | 1 | 1 | Mine Tipple, Refinery |
+| Packing Sheds | reefer | outbound | 1 | 0 | 1 | Grocer's Warehouse |
+| Grocer's Warehouse | boxcar, reefer | inbound | 0 | 1 | 1 | Packing Sheds, Freight House |
+
+---
+
+## Modifier cards
+
+Each sits beside a host and raises one of its capacities. `office` as a host means any Passenger
+Facility — so a modifier that adds a green slot to an Office adds nothing to a Whistle Post, which
+is not one.
+
+| Modifier | Hosts | +Green | +Red | +Laborers | +Porters |
+| --- | --- | ---: | ---: | ---: | ---: |
+| Waiting area | any Passenger Facility | 1 | — | — | 1 |
+| Restaurant | any Passenger Facility | 1 | — | — | 1 |
+| Hotel | any Passenger Facility | 1 | — | — | 1 |
+| Truck dock | Freight House, Packing Sheds, Grocer's Warehouse | — | 1 | — | — |
+| Railroad Express Agency | Freight House | 1 | — | 1 | — |
+| Forklifts | Freight House, Packing Sheds | 1 | — | 1 | — |
+| Prep Plant | Mine Tipple | 1 | — | 1 | — |
+| Coal Piles | Mine Tipple | 1 | — | 1 | — |
+| Conveyor Belts | Mine Tipple | 1 | — | 1 | — |
+| Pipelines | Refinery | 1 | — | 1 | — |
+| Oil Depot | Refinery | 1 | — | 1 | — |
+| Viscosity breakers | Refinery | 1 | — | 1 | — |
+| Transmission lines | Power Plant | — | — | 1 | — |
+| Rotary Dumps | Power Plant | — | — | 1 | — |
+| Steam Turbines | Power Plant | — | — | 1 | — |
+| Ice House | Packing Sheds, Grocer's Warehouse | 1 | — | 1 | — |
+| Local small groceries | Grocer's Warehouse | — | — | 1 | — |
+
+---
+
+## Track cards
+
+Track is **in the Home Office deck** and is drawn and played like any other card — not a separate
+per-player supply. Operational Rail is the flag that says a train may stop on the card; a turnout
+may be run through but not stopped on.
+
+| Track | Geometry | Hand | Operational rail | Move cost | Dealt |
+| --- | --- | --- | :---: | ---: | :---: |
+| Straight track | straight | none | yes | 1 | yes |
+| Curved track (right) | curved | right | yes | 1 | yes |
+| Curved track (left) | curved | left | yes | 1 | yes |
+| Sharp Curved Track (right) | sharpCurved | right | yes | 2 | no |
+| Sharp Curved Track (left) | sharpCurved | left | yes | 2 | no |
+| Turnout (right) | turnout | right | — | 1 | yes |
+| Turnout (left) | turnout | left | — | 1 | yes |
+
+A row marked "no" is a shape the engine understands but the deck does not currently print.
+
+---
+
+## Enhancements
+
+The column that only the implementation can fill in: **whether the printed effect actually
+resolves yet.** `live` is read during play; `dormantSolo` is implemented at the point of attack
+but the attack is an opponent-directed card held out of every deck, so nothing reaches it in a
+solitaire game; `unbuilt` means the effect is recorded and nothing reads it. A transcription
+cannot carry this column, which is the argument for generating the page rather than writing it.
+
+| Enhancement | Placement | Requires | Effect resolves |
+| --- | --- | --- | :---: |
+| Interlocking | runningTrackStraight | — | **live** |
+| Facing Point Locks | onCard | interlocking in the district | **dormantSolo** |
+| Yard office | secondaryTrackStraight | — | **live** |
+| Small yard | secondaryTrackStraight | — | **live** |
+| Water column | runningTrackStraight | — | **dormantSolo** |
+| Overpass | onCard | — | **unbuilt** |
+| Telegraph | runningTrackStraight | — | **live** |
+| Telephone | onCard | telegraph on the same card | **live** |
+| Radio | onCard | telephone on the same card | **live** |
+| ABS Signals | mainlineCard | — | **live** |
+
+---
+
+## Opponent-directed cards, and what answers them
+
+**None of these is dealt in any deck today.** A card that can only be played at another player
+has no legal target in a solitaire game, and a defence with nothing to defend against is as dead
+a draw as the attack — so both halves are held out until the attacks are implemented. They are
+listed because they are the design, and because what a defence answers is the only record of why
+it exists.
+
+### Action cards — opponent-directed
+
+| Card | Played on | Effect | Answers |
+| --- | --- | --- | --- |
+| Derail | a moving train in the Local Phase | That train must stop for the remainder of the turn. | — |
+| Broken coupler | a moving train in the Mainline Phase | That train must stop and not move. | — |
+| Railroad crossing | any Secondary Track Straight | May not be used as a stop point for switching. May not become an Industry. | — |
+| Per Diem inventory | another player | Lose one point per 2 empty cars on Secondary Tracks. | — |
+| Demurrage charge | another player | Lose one point per 2 loaded freight cars on Secondary Tracks. | — |
+| Customer complaints | another player | Lose one point per 2 coaches in loading boxes. | — |
+| Vandalism | another player | A train passing a Hobo Jungle has a boxcar looted (converted to empty). | — |
+| Hotbox | another player | A train just arrived must set one car (chooser’s pick) onto Secondary Track until it departs. | — |
+| Outlawed | another player | A train just arrived may not depart for one turn — the crew’s hours have expired. | — |
+
+### Space-use cards — opponent-directed
+
+| Card | Played on | Effect | Answers |
+| --- | --- | --- | --- |
+| Bean house | adjacent to any straight, curve, turnout, Limit | Burns tablespace. | — |
+| Flop house | adjacent to any straight, curve, turnout | Burns tablespace. | — |
+| Watertower | adjacent to any straight, turnout on Running Track | Burns tablespace. | — |
+| Hobo Jungle | adjacent to any straight, turnout, Limit on Running Track | Burns tablespace. Vandalism can loot a boxcar passing it. | — |
+| Section House | adjacent to any straight, curve, turnout | Burns tablespace. | — |
+| City blocks | adjacent to any straight, curve, turnout, Limit | Burns tablespace. | — |
+| Engine Shops | adjacent to any straight, curve, turnout | Burns tablespace. | — |
+| Tenderloin District | adjacent to any straight, curve, turnout, Limit | Burns tablespace. | — |
+| Engineer cemetery | adjacent to any straight, curve, turnout, Limit | Burns tablespace. | — |
+
+### Maneuver cards
+
+| Card | Played on | Effect | Answers |
+| --- | --- | --- | --- |
+| Red Flags | any time | A stopped train is prevented from being hit; the approaching train is prevented from moving. | — |
+| Flying Switch | any time | Break a cut of cars away from behind the engine and roll them into an industry. | — |
+| Poling | any time | TBD in the source. | — |
+
+Mainline modifier cards, for completeness — these ARE dealt:
+
+| Card | Played on | Effect | Answers |
+| --- | --- | --- | --- |
+| Brakeman | a GRADE Mainline card | Faster passage downhill. | — |
+| Airbrakes | a GRADE Mainline card | Faster passage downhill. Brakeman must be in effect. | — |
+| Helpers | a GRADE Mainline card | Faster passage uphill. | — |
+| Realignment | a Mainline card | Convert one Mainline type to another. Not while a train is on it. | — |
+| Facing Point Locks | adjacent to Interlocking | Prevents Derail being played on you. | Derail |
+

docs/rules/card-reference.md

@@ -4,6 +4,11 @@
 > 2026-07-30 in `docs/Deck cards2.xlsx`, `Trains3.pdf` and `Mainline Cards.pdf`, and is transcribed
 > in `src/engine/content.ts`. See [`implications.md`](implications.md) for the full comparison.
 >
+> **For what the cards say today, read [`as-built.md`](as-built.md)** — generated from
+> `content.ts` and checked against it by the test suite, so it cannot fall behind the way this file
+> did. For several releases `content.ts` named *this* page as the current reference while the banner
+> here said otherwise, and a reader following the code landed on the v0.4.5 deck.
+>
 > Kept for the reasoning it records — the economy analysis in §7 was how we knew what questions to
 > ask the design. **Do not use its numbers.**
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "station-master",
-  "version": "0.7.9",
+  "version": "0.7.9.8",
   "private": true,
   "type": "module",
   "description": "Station Master — a railroad operations game",
@@ -9,11 +9,12 @@
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "pretest": "node scripts/build-web.ts",
+    "pretest": "tsc --noEmit && node scripts/build-web.ts",
     "test": "node --test test/*.test.ts test/**/*.test.ts",
     "build:web": "node scripts/build-web.ts",
     "serve:web": "node scripts/build-web.ts && npx --yes http-server dist -p 8080 -c-1",
-    "deploy:web": "node scripts/deploy-web.ts"
+    "deploy:web": "node scripts/deploy-web.ts",
+    "build:cards": "node scripts/build-card-reference.ts"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",

scripts/build-card-reference.ts

@@ -0,0 +1,268 @@
+/**
+ * Generate `docs/rules/as-built.md` — what the cards say, as the code actually has them.
+ *
+ * WHY THIS IS GENERATED RATHER THAN WRITTEN.
+ *
+ * Every other file in `docs/rules/` is a historical record and says so: `rules-v0.1.md` is a
+ * faithful transcription of the prototype PDFs, `open-questions.md` is the gap tracker,
+ * `rules-v0.2.md` and `card-reference.md` both carry SUPERSEDED banners. None of them describes the
+ * game as built, and none of them should be edited to — the record is worth more intact than
+ * patched.
+ *
+ * So there was no current reference at all, and `content.ts` spent several releases pointing at
+ * `card-reference.md` as "the place that now carries what the cards say" while that file's own
+ * banner said "do not use its numbers". A reader following the code's advice landed on the v0.4.5
+ * deck: twelve numbered trains, "3 / 4 Mail-Express, 3 coaches", against a `content.ts` whose train
+ * 3 is the Express with two freight cars and a per-location freight rule.
+ *
+ * A HAND-WRITTEN REPLACEMENT WOULD HAVE DRIFTED THE SAME WAY, and for the same reason: nothing
+ * fails when a table falls behind a constant. So the reference is emitted from the same exported
+ * catalogues the engine instantiates from, and `test/card-reference.test.ts` re-runs this generator
+ * and asserts the checked-in file matches byte for byte. Change a card face and the suite goes red
+ * until the doc is regenerated — which is the only mechanism this project has found that keeps a
+ * document honest.
+ *
+ * `npm run build:cards` writes it. Nothing at runtime reads it; it is for people.
+ */
+
+import { writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  ACTION_CARDS, ALL_TRAINS, ENHANCEMENT_CARDS, ENHANCEMENT_RULES, EXTRA_TRAINS, INDUSTRY_PROFILES,
+  LIMITS_SUPPLY, MAINLINE_DECK, MAINLINE_MODIFIER_CARDS, MAINLINE_PROFILES, MANEUVER_CARDS,
+  MODIFIER_PROFILES, OFFICE_PROFILES, SPACE_USE_CARDS, TIMETABLED_TRAINS, TRACK_CARDS,
+  WHISTLE_POST_SUPPLY, consistSize, isOpponentOnly, mainlineDescription,
+} from '../src/engine/content.ts';
+import type { ConsistSpec, SimpleCard, TrainProfile, TrainRules } from '../src/engine/content.ts';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+/** Title Case a camelCase key, so `oneFreightPerLocation` reads as a rule rather than an identifier. */
+const words = (k: string): string => k.replace(/([A-Z])/g, ' $1').toLowerCase().trim();
+
+const consistOf = (c: ConsistSpec): string => {
+  const parts: string[] = [];
+  if (c.freight > 0) {
+    const kinds = c.freightTypes ? c.freightTypes.join(' or ') : 'freight';
+    parts.push(`${c.freight} ${kinds}${c.freight === 1 ? '' : c.freightTypes ? 's' : ''}`);
+  }
+  if (c.coach > 0) parts.push(`${c.coach} coach${c.coach === 1 ? '' : 'es'}`);
+  if (c.caboose > 0) parts.push(`${c.caboose} caboose`);
+  if (!parts.length) return 'engine only';
+  const n = consistSize(c);
+  // "Empties only" qualifies the whole consist rather than adding to it, so it reads after the count.
+  return `${parts.join(' + ')} (${n} piece${n === 1 ? '' : 's'})${c.emptiesOnly ? ', empties only' : ''}`;
+};
+
+const rulesOf = (r: TrainRules): string => {
+  const out: string[] = [];
+  for (const [k, v] of Object.entries(r)) {
+    if (k === 'note' || v === false || v === undefined) continue;
+    out.push(words(k));
+  }
+  if (typeof r.note === 'string') out.push(`*"${r.note}"*`);
+  return out.length ? out.join('; ') : '—';
+};
+
+const trainRow = (t: TrainProfile): string =>
+  `| ${t.isExtra ? 'X' : ''}${t.number} | ${t.name} | ${t.speed} | ` +
+  `${t.direction === 'playerChoice' ? "player's choice" : t.direction} | ${consistOf(t.consist)} | ${rulesOf(t.rules)} |`;
+
+const lines: string[] = [];
+const w = (s = ''): void => void lines.push(s);
+
+w('# Station Master — the cards as built');
+w();
+w('> **Generated from `src/engine/content.ts` by `scripts/build-card-reference.ts`. Do not edit by');
+w('> hand** — `npm run build:cards` rewrites it, and `test/card-reference.test.ts` fails if this file');
+w('> and the code disagree.');
+w();
+w('This is the one file in `docs/rules/` that describes the game **as it currently is**. Everything');
+w('else in this directory is a historical record and marked as such: [`rules-v0.1.md`](rules-v0.1.md)');
+w('transcribes the prototype PDFs, [`open-questions.md`](open-questions.md) tracks how the gaps in');
+w('them were decided, and [`rules-v0.2.md`](rules-v0.2.md) and');
+w('[`card-reference.md`](card-reference.md) both describe superseded card sets. Read those for the');
+w('reasoning; read this for the numbers.');
+w();
+w('The engine instantiates from the same constants this is emitted from, so a disagreement between');
+w('this page and the game is a bug in the generator, not a stale table.');
+w();
+w('**No card counts appear here, deliberately** (TODO #15a, Jesse 2026-08-22): the counts move with');
+w('play balance, so a document that prints them is answering a question that will have a different');
+w('answer next retune. Where a count matters it is a yes/no — whether the deck deals the card at');
+w('all — which is a fact about the design rather than about the current tuning.');
+w();
+w('---');
+w();
+
+w('## Trains');
+w();
+w(`${TIMETABLED_TRAINS.length} timetabled and ${EXTRA_TRAINS.length} Extras, ${ALL_TRAINS.length} in all.`);
+w('Odd numbers run west, even run east; a pair shares a class and is the same card face in two');
+w('directions. A Crew Tray holds four pieces and a caboose counts toward the four, which is why no');
+w('train with a caboose carries more than three revenue cars.');
+w();
+w('### Timetabled');
+w();
+w('| # | Class | Speed | Runs | Consist | Printed rules |');
+w('| ---: | --- | --- | --- | --- | --- |');
+for (const t of TIMETABLED_TRAINS) w(trainRow(t));
+w();
+w('### Extras');
+w();
+w('| # | Class | Speed | Runs | Consist | Printed rules |');
+w('| ---: | --- | --- | --- | --- | --- |');
+for (const t of EXTRA_TRAINS) w(trainRow(t));
+w();
+w('---');
+w();
+
+w('## Mainline cards');
+w();
+w('A card is divided into **regions**, and a train advances one region per Stage — so the regions a');
+w('card prints are what it costs to cross. Where a train *enters* is what the rules move: a fast');
+w('train on Hilly, a Heavy Grade with Helpers, or a card whose back region is a siding rather than');
+w('part of the road all change the entry point rather than the card\'s length.');
+w();
+w('| Card | Regions | Default entry | Fast / slow entry | Trains may pass | Sorts cars |');
+w('| --- | ---: | ---: | --- | :---: | :---: |');
+for (const m of MAINLINE_PROFILES) {
+  const ss = m.speedStarts ? `${m.speedStarts.fast} / ${m.speedStarts.slow}` : '—';
+  w(`| ${m.name} | ${m.regions} | ${m.defaultStart} | ${ss} | ${m.trainsMayPass ? 'yes' : '—'} | ${m.sortsCars ? 'yes' : '—'} |`);
+}
+w();
+w(`The Mainline deck is ${MAINLINE_DECK.length} cards; the two Division Points are the fixed ends of`);
+w('the Division and are not dealt. What each card does, in the words the game uses on screen:');
+w();
+for (const m of MAINLINE_PROFILES) w(`- **${m.name}** — ${mainlineDescription(m.kind)}`);
+w();
+w('---');
+w();
+
+w('## Office cards');
+w();
+w('Upgrades are strictly sequential — no skipping a tier — so a Terminal needs all three cards in');
+w('order. Green slots are outbound passengers, red are inbound, and the design gives slots **equal**');
+w('to Porters rather than one more.');
+w();
+w('| Office | Control point | Passenger facility | A/D tracks | Porters | Green | Red |');
+w('| --- | :---: | :---: | ---: | ---: | ---: | ---: |');
+for (const o of OFFICE_PROFILES) {
+  w(`| ${o.name} | ${o.isControlPoint ? 'yes' : '—'} | ${o.isPassengerFacility ? 'yes' : '—'} | ` +
+    `${o.adTracks} | ${o.porters} | ${o.passengerOut} | ${o.passengerIn} |`);
+}
+w();
+w(`Whistle Posts are a fixed supply of ${WHISTLE_POST_SUPPLY} outside the deck, and Limits signs a`);
+w(`supply of ${LIMITS_SUPPLY}.`);
+w();
+w('---');
+w();
+
+w('## Freight facilities');
+w();
+w('Each lists the car types it works, which way its traffic flows, and the industries it may not sit');
+w('beside. **Every lockout pair is a producer and the consumer of the same commodity** — you may');
+w('build one end of a chain or the other, never both, which is what forces traffic to run between');
+w('districts rather than in circles inside one. No two of the same industry may share an Office Area,');
+w('and that rule is enforced for every kind rather than repeated in each row.');
+w();
+w('| Industry | Cars | Flow | Green | Red | Laborers | Locked out with |');
+w('| --- | --- | --- | ---: | ---: | ---: | --- |');
+for (const f of INDUSTRY_PROFILES) {
+  const lo = f.lockouts.length
+    ? f.lockouts.map((k) => INDUSTRY_PROFILES.find((p) => p.kind === k)?.name ?? k).join(', ')
+    : '—';
+  w(`| ${f.name} | ${f.carTypes.join(', ')} | ${f.flow} | ${f.baseOut} | ${f.baseIn} | ${f.baseLoaders} | ${lo} |`);
+}
+w();
+w('---');
+w();
+
+w('## Modifier cards');
+w();
+w('Each sits beside a host and raises one of its capacities. `office` as a host means any Passenger');
+w('Facility — so a modifier that adds a green slot to an Office adds nothing to a Whistle Post, which');
+w('is not one.');
+w();
+w('| Modifier | Hosts | +Green | +Red | +Laborers | +Porters |');
+w('| --- | --- | ---: | ---: | ---: | ---: |');
+for (const m of MODIFIER_PROFILES) {
+  const hosts = m.hosts
+    .map((h) => (h === 'office' ? 'any Passenger Facility' : INDUSTRY_PROFILES.find((p) => p.kind === h)?.name ?? h))
+    .join(', ');
+  w(`| ${m.name} | ${hosts} | ${m.addOut || '—'} | ${m.addIn || '—'} | ${m.addLoaders || '—'} | ${m.addPorters || '—'} |`);
+}
+w();
+w('---');
+w();
+
+w('## Track cards');
+w();
+w('Track is **in the Home Office deck** and is drawn and played like any other card — not a separate');
+w('per-player supply. Operational Rail is the flag that says a train may stop on the card; a turnout');
+w('may be run through but not stopped on.');
+w();
+w('| Track | Geometry | Hand | Operational rail | Move cost | Dealt |');
+w('| --- | --- | --- | :---: | ---: | :---: |');
+for (const t of TRACK_CARDS) {
+  w(`| ${t.name} | ${t.geometry} | ${t.hand} | ${t.isOperationalRail ? 'yes' : '—'} | ${t.moveCost} | ${t.copiesInDeck ? 'yes' : 'no'} |`);
+}
+w();
+w('A row marked "no" is a shape the engine understands but the deck does not currently print.');
+w();
+w('---');
+w();
+
+w('## Enhancements');
+w();
+w('The column that only the implementation can fill in: **whether the printed effect actually');
+w('resolves yet.** `live` is read during play; `dormantSolo` is implemented at the point of attack');
+w('but the attack is an opponent-directed card held out of every deck, so nothing reaches it in a');
+w('solitaire game; `unbuilt` means the effect is recorded and nothing reads it. A transcription');
+w('cannot carry this column, which is the argument for generating the page rather than writing it.');
+w();
+w('| Enhancement | Placement | Requires | Effect resolves |');
+w('| --- | --- | --- | :---: |');
+for (const r of ENHANCEMENT_RULES) {
+  const card = ENHANCEMENT_CARDS.find((c) => c.key === r.key);
+  const needs = r.requiresOnSameCard
+    ? `${r.requiresOnSameCard} on the same card`
+    : r.requiresInDistrict
+      ? `${r.requiresInDistrict} in the district`
+      : '—';
+  w(`| ${card?.name ?? r.key} | ${r.placement} | ${needs} | **${r.effect}** |`);
+}
+w();
+w('---');
+w();
+
+w('## Opponent-directed cards, and what answers them');
+w();
+w('**None of these is dealt in any deck today.** A card that can only be played at another player');
+w('has no legal target in a solitaire game, and a defence with nothing to defend against is as dead');
+w('a draw as the attack — so both halves are held out until the attacks are implemented. They are');
+w('listed because they are the design, and because what a defence answers is the only record of why');
+w('it exists.');
+w();
+const pvp = (title: string, cards: readonly SimpleCard[], category: string): void => {
+  w(`### ${title}${isOpponentOnly(category) ? ' — opponent-directed' : ''}`);
+  w();
+  w('| Card | Played on | Effect | Answers |');
+  w('| --- | --- | --- | --- |');
+  for (const c of cards) w(`| ${c.name} | ${c.placement} | ${c.effect} | ${c.answers ?? '—'} |`);
+  w();
+};
+pvp('Action cards', ACTION_CARDS, 'action');
+pvp('Space-use cards', SPACE_USE_CARDS, 'spaceUse');
+pvp('Maneuver cards', MANEUVER_CARDS, 'maneuver');
+w('Mainline modifier cards, for completeness — these ARE dealt:');
+w();
+w('| Card | Played on | Effect | Answers |');
+w('| --- | --- | --- | --- |');
+for (const c of MAINLINE_MODIFIER_CARDS) w(`| ${c.name} | ${c.placement} | ${c.effect} | ${c.answers ?? '—'} |`);
+w();
+
+writeFileSync(join(root, 'docs/rules/as-built.md'), `${lines.join('\n')}\n`);
+console.log(`built -> docs/rules/as-built.md (${lines.length} lines)`);

src/engine/advance.ts

@@ -688,8 +688,16 @@ function spendDispatchBonus(
   const mine = tray.trainNumber ?? 99;
   const theirs = other.trainNumber ?? 99;
 
-  // The Fedora is held by a PLAYER, and the dispatch devices are installed in an Office Area, which
-  // is keyed by SEAT. Indexing one with the other is right only while seating is the identity map.
+  /**
+   * The Fedora is held by a PLAYER; the devices are installed in an Office Area, which is keyed by
+   * SEAT. `areaOf` is what reconciles the two — it resolves through `seatOf` — so this is correct
+   * under Employee Rotation and not only while seating happens to be the identity map.
+   *
+   * This comment used to say the opposite, warning that indexing one with the other was safe only
+   * while seating was identity. It read as a live bug and was not one: `areaOf(s, player)` IS
+   * `areaAtSeat(s, seatOf(s, player))`. Pinned by test rather than asserted here — see #101's
+   * "spends the Superintendent's own devices under non-identity seating".
+   */
   const area = areaOf(s, s.clock.superintendent);
 
   // Best device first — Radio (+12) beats Telephone (+8) beats Telegraph (+4).
@@ -727,7 +735,11 @@ function spendDispatchBonus(
  * the speeches are made, and every arrival after that is expedited. `speechMade` is set on that first
  * stop, so the train is exempt once and subject to the fault thereafter.
  */
-function isExpedited(tray: CrewTray): boolean {
+export function isExpedited(tray: {
+  trainNumber: number | null;
+  trainIsExtra: boolean;
+  speechMade?: boolean;
+}): boolean {
   const rules = trainProfile(tray.trainNumber ?? 0, tray.trainIsExtra)?.rules;
   if (!rules) return false;
   if (rules.expedite) return true;

src/engine/apply.ts

@@ -16,7 +16,6 @@
 
 import {
   FREIGHT_PROFILES,
-  HAND_LIMIT,
   LABORER_ACTIONS_PER_LOAD,
   MAX_CONSIST,
   REALIGNMENTS,
@@ -61,6 +60,7 @@ import {
   decisionActor,
   officeNodeFor,
   isOperationalRail,
+  overHandLimit,
   playerAtSeat,
   pooled,
   railFacingOf,
@@ -607,7 +607,8 @@ function freightWorkedKey(trayId: TrayId, at: GridCoord): string {
   return `${trayId}@${coordKey(at)}`;
 }
 
-const isFreight = (c: RollingStock): boolean => c.type !== 'coach' && c.type !== 'caboose';
+/** Exported so the Blocked panel counts a freight car the same way the reducers do (Gitea#21). */
+export const isFreight = (c: RollingStock): boolean => c.type !== 'coach' && c.type !== 'caboose';
 
 /**
  * IS THIS CAR CARRYING A LOAD? A CABOOSE NEVER IS, whatever its `loaded` flag says.
@@ -657,6 +658,20 @@ function switchingRefusal(tray: CrewTray): RejectionCode | null {
   return rulesOf(tray).noSwitching ? 'NO_SWITCHING' : null;
 }
 
+/**
+ * WHETHER TRAINS 3/4's PRINTED RULE IS WHAT IS STOPPING THIS CREW WHERE IT STANDS (Gitea#21).
+ *
+ * Exported for the Blocked panel, which needs to say so — and asks `freightBudgetLeft`, the same
+ * predicate the reducer refuses on, rather than rebuilding the key for itself. `narrate.ts` cannot
+ * then drift from the rule it is describing, which is the whole premise of that panel.
+ */
+export function freightRuleSpentHere(s: GameState, player: PlayerIndex, trayId: TrayId): boolean {
+  const tray = s.trays.get(trayId);
+  if (!tray || !rulesOf(tray).oneFreightPerLocation) return false;
+  if (tray.position.at !== 'grid') return false;
+  return !freightBudgetLeft(s, player, tray, tray.position.coord, 1);
+}
+
 /**
  * Charge freight cars against this train's per-location budget (trains 3/4).
  *
@@ -1084,10 +1099,9 @@ export function check(s: GameState, player: PlayerIndex, i: Intent): RejectionCo
     case 'draw.end': {
       if (!inPhase(s, 'localOps')) return 'WRONG_PHASE';
       if (turnOf(s, player).option !== 'draw') return 'OPTION_NOT_CHOSEN';
-      // §6.2 — "the player must reduce his hand to no more than three cards".
-      const hand = s.decks.hands.get(player) ?? [];
-      const limit = s.decks.redFlags.get(player) ? HAND_LIMIT + 1 : HAND_LIMIT;
-      return hand.length > limit ? 'HAND_LIMIT' : null;
+      // §6.2 — "the player must reduce his hand to no more than three cards". `overHandLimit`
+      // (state.ts) is the one copy of that test; the Frame and the page ask the same function.
+      return overHandLimit(s, player) ? 'HAND_LIMIT' : null;
     }
 
     // -- Freight Agent --------------------------------------------------------

src/engine/content.ts

@@ -481,8 +481,11 @@ export const TIMETABLED_TRAINS: readonly TrainProfile[] = [
    * COACH COUNTS ON 1/2 AND 5/6 WERE SWAPPED BY JESSE (Gitea#7, v0.4.9e playtest): the Crack Limited
    * drops from three coaches to two, and The Sparrow rises from two to three. A change to the card
    * faces themselves, not a transcription fix — `Trains3.pdf` and the tables that transcribe it
-   * still print the old numbers, so `docs/rules/card-reference.md` is the place that now carries
-   * what the cards say.
+   * still print the old numbers, so `docs/rules/as-built.md` is the place that now carries what
+   * the cards say — GENERATED from the constants below by `scripts/build-card-reference.ts`, with
+   * `test/card-reference.test.ts` failing if the two disagree. This comment used to name
+   * `card-reference.md`, which describes the v0.4.5 deck and carries a banner saying not to use its
+   * numbers; the code sent readers to a table it had itself superseded.
    */
   ...pair(1, 'Crack Limited', 'fast', { freight: 0, coach: 2, caboose: 0 },
     { terminalsOnly: true, noSwitching: true, expedite: true, note: 'Stop at Terminals only.' }),

src/engine/state.ts

@@ -17,7 +17,7 @@ import type {
   OfficeTier,
   TrackGeometry,
 } from './content.ts';
-import { MAX_CONSIST, officeProfile } from './content.ts';
+import { HAND_LIMIT, MAX_CONSIST, officeProfile } from './content.ts';
 
 // ---------------------------------------------------------------------------
 // Identifiers
@@ -1040,6 +1040,19 @@ export function turnOf(s: GameState, player: PlayerIndex): TurnState {
   return t;
 }
 
+/**
+ * §6.2 — IS THIS PLAYER HOLDING MORE THAN THEY MAY? Three cards, or four while a Red Flag is held.
+ *
+ * ONE answer, because there were three of them: `check('draw.end')` refused on it, `snapshot()`
+ * recomputed it inline for the Frame, and `web/game.ts` kept a third for the page. All three agreed
+ * — which is the state a disagreement starts from, and #96 is what that costs when the two halves
+ * are a screen and the server that refuses what the screen offered.
+ */
+export function overHandLimit(s: GameState, player: PlayerIndex): boolean {
+  const hand = s.decks.hands.get(player) ?? [];
+  return hand.length > (s.decks.redFlags.get(player) ? HAND_LIMIT + 1 : HAND_LIMIT);
+}
+
 export function freshTurn(moves: number): TurnState {
   return {
     option: null,

src/server/session.ts

@@ -174,8 +174,17 @@ function buildSession(
   };
   let open: OpenSpan | null = openSpanFor(Date.now());
 
+  /**
+   * A seat's full Frame, with `lines` deliberately EMPTY (#97).
+   *
+   * Narration reaches a client by ONE path — `Push.lines` — because `RemoteSession`
+   * (`web/session.ts`) accumulates from that field alone and its `lines()` returns the accumulator.
+   * Passing `game.log` here serialised the entire log into every frame for every seat, where it grew
+   * all game and was thrown away on arrival, while `linesSince` correctly sent the same text beside
+   * it. The duplicate was not merely waste: it masked the reconnect bug `connect` fixes below.
+   */
   function frameFor(seat: PlayerIndex): Frame {
-    return snapshot(game.state, game.log, null, null, null, false, seat);
+    return snapshot(game.state, [], null, null, null, false, seat);
   }
 
   function linesSince(seat: PlayerIndex): { text: string; tone: string }[] {
@@ -341,6 +350,11 @@ function buildSession(
       // A (re)connect always starts from a clean slate — no cache to trust across a lost connection
       // (or a server restart, Phase 3) — so the honest thing is a full Frame, not a delta.
       lastFrame.delete(seat);
+      // ...and the NARRATION watermark with it (#97). The browser this answers has just reloaded
+      // from an empty accumulator, so a seat told "nothing new since your last push" came back to a
+      // blank history panel mid-game, with the server holding the whole log. `Push.lines` on a
+      // connect IS the history, which is what lets the Frame stop carrying a second copy.
+      sentLines.delete(seat);
       return pushFor(seat, null);
     },
 

src/sim/board-svg.ts

@@ -144,6 +144,12 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
      * register under the rail (Gitea#18).
      */
     below?: Cell['trains'];
+    /**
+     * Office cells only: a Red Flag standing at this Office's Limits, and which approach it guards
+     * (#94). A token set out ON the board that holds the next train arriving from that side, so it
+     * is drawn like the other things standing on the map rather than left to the log.
+     */
+    redFlag?: string | null;
     /** Mainline cards only: §2.1 divides one into two regions. 0 elsewhere — no bars are drawn. */
     regions: number;
     /**
@@ -223,10 +229,17 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
           (owner?.isYou ? ' — this is your railroad' : '') +
           // "their move" is wrong when the reader is the one being waited on.
           (owner?.isTurn ? (owner.isYou ? ' — it is your move' : ' — it is their move') : '') +
+          // #94 — first, and in full, because it is the one thing here that CHANGES what a train
+          // may do. Everything below it describes the cell; this describes a rule in force.
+          (n.redFlag === 'east' || n.redFlag === 'west'
+            ? `\n\nRED FLAG set out at the ${n.redFlag === 'east' ? 'East' : 'West'} Limits — the ` +
+              `next train arriving from the ${n.redFlag} is held short, and the flag is spent doing it.`
+            : '') +
           `\n\nThe district itself is drawn on the Office map — this cell is the whole of it, with the ` +
           `trains standing in it: those holding an A/D track on the rail, and any crew switching in ` +
           `the district below it.`,
         seat: n.seat ?? null,
+        redFlag: n.redFlag ?? null,
         // No regions in a district: a crew moves by Moves there, not by Stages, so it occupies a
         // card outright rather than a part of one.
         regions: 0,
@@ -364,6 +377,30 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
       out += `<line class="bs-region" x1="${c.x + 6 + RW * r}" y1="${c.y + RAIL_Y - 14}" x2="${c.x + 6 + RW * r}" y2="${c.y + RAIL_Y + 10}"/>`;
     }
 
+    /**
+     * A RED FLAG STANDING AT THE LIMITS (#94).
+     *
+     * Drawn at the END IT GUARDS — west on the left, east on the right, since east is right on this
+     * map — because which approach it covers is the whole of the information. A flag in the middle
+     * of the cell would say a flag is out and leave the reader to hover for the half that decides
+     * whether to run a train.
+     *
+     * A staff with a pennant, at rail height, standing clear of the chips: it is beside the rail,
+     * which is where a flag is. Red is otherwise unused on this map (`bs-full` tints a cell, it does
+     * not draw), so the mark does not compete with anything for meaning.
+     */
+    if (c.redFlag === 'east' || c.redFlag === 'west') {
+      const west = c.redFlag === 'west';
+      const fx = west ? c.x + 9 : c.x + c.w - 9;
+      const top = c.y + RAIL_Y - 22;
+      const dir = west ? 1 : -1;
+      out += `<g class="bs-flag">`;
+      out += `<line x1="${fx}" y1="${top}" x2="${fx}" y2="${c.y + RAIL_Y + 4}"/>`;
+      // The pennant flies INTO the cell, so it can never overhang the card edge at either end.
+      out += `<polygon points="${fx},${top} ${fx + dir * 13},${top + 5} ${fx},${top + 10}"/>`;
+      out += `</g>`;
+    }
+
     /**
      * WHICH WAY A HEAVY GRADE CLIMBS, drawn rather than only said.
      *
@@ -452,6 +489,14 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
      * things the Division map is for — where a train is and which way it is going — and leaves the
      * cars to the tooltip and to the district.
      */
+    /**
+     * THE REGION NUMBER IS A PLACE ON THE MAP, NOT A DISTANCE RUN (Gitea#22).
+     *
+     * `view.ts` mirrors a westbound train before it gets here, so this counts boxes west to east
+     * for every train regardless of which way it is going — and the tooltip says so, because
+     * "region 2 of 2" beside "2 Stages still to run" reads as a contradiction otherwise. It is the
+     * second box from the west end; a westbound train in it has its whole crossing ahead of it.
+     */
     const chip = (t: NonNullable<Cell['trains']>[number], tx: number, ty: number, w: number): void => {
       const cars = t.cars ?? [];
       const arrow = t.facing === 'w' ? '\u25c0' : '\u25b6';
@@ -465,7 +510,7 @@ export function divisionSvg(nodes: DivisionView[], roster?: DivisionRoster | nul
           : '';
       out += `<g class="bs-train" data-tip="${esc(t.label)} \u2014 carrying ${esc(cars.join(', ') || 'no cars')}${
         cars.length ? ` (${loaded} loaded)` : ''
-      }${inRegion ? ` \u00b7 region ${(t.region ?? 0) + 1} of ${c.regions}${dir}` : ''}${esc(stages)}${
+      }${inRegion ? ` \u00b7 region ${(t.region ?? 0) + 1} of ${c.regions}, counted west to east${dir}` : ''}${esc(stages)}${
         // What the card prints. A train on the Mainline is exactly where "why did that leave without
         // me?" gets asked, and EXPEDITED is the answer more often than not.
         t.what ? `\n\n${esc(t.what)}` : ''
@@ -1053,9 +1098,18 @@ export function officeSvg(
       // card, the old y = H-46 baseline printed the label straight along the rail itself.
       // Hover text per enhancement, from the card catalogue — an Interlocking used to be a bare word
       // on the card with nothing to say what it did, or that it does not do it yet.
+      // A SPENT dispatch device is struck through (#101). Telegraph/Telephone/Radio are "once a
+      // day", and the label said the same thing before and after the Superintendent spent one — so
+      // the card advertised a +12 that was not there. Per-`tspan` rather than per-`text` so the
+      // names still read as one row, and `?? []` because `piecePreview` builds a cell literal by
+      // hand and has no flags.
+      const spentFlags = cell.enhancementsSpent ?? [];
+      const names = cell.enhancements
+        .map((n, i) => (spentFlags[i] ? `<tspan class="bs-enh-spent">${esc(n)}</tspan>` : esc(n)))
+        .join(' · ');
       out += `<text class="bs-enh" x="6" y="26" data-tip="${esc(
         (cell.enhancementsWhat ?? []).join(' · '),
-      )}">${esc(cell.enhancements.join(' · '))}</text>`;
+      )}">${names}</text>`;
     }
     if (selectedTrain) {
       /**
@@ -1197,6 +1251,9 @@ export const BOARD_CSS = `
 /* The vertical bars a Mainline card is divided into (§2.1). Drawn faint: they are the ruler the
    train is measured against, not something to look at instead of the train. */
 .bs-region{stroke:#4a5361;stroke-width:1.2;stroke-dasharray:3 3}
+/* #94 — the one red mark on the Division map, so it reads as a stop rather than as decoration. */
+.bs-flag line{stroke:#9aa3b0;stroke-width:1.6}
+.bs-flag polygon{fill:#d2453f;stroke:#7d211d;stroke-width:0.8}
 /* THE HEAVY GRADE WEDGE. Terrain, so it is coloured as terrain rather than as a warning.
    SOLID BROWN, fill and border the same (Jesse, 2026-08-30) — the first pass paired a desaturated
    fill with an amber arrow and the pair read reddish, which on a map that spends amber on "it is
@@ -1288,6 +1345,7 @@ export const BOARD_CSS = `
 .bs-mod{font:10px ui-monospace,monospace}
 text.bs-mod{fill:#c8a04a}
 .bs-enh{fill:#7fb0e6;font:9px ui-monospace,monospace}
+.bs-enh-spent{fill:#5b6b7d;text-decoration:line-through}
 .bs-rowlab{fill:#5f6b7a;font:600 9px ui-monospace,monospace;letter-spacing:.1em}
 /* THE EDGE OF THE DISTRICT. Deliberately quiet — it is a boundary, not an action — and dashed, so it
    reads as a line on the table rather than as rail. Nothing is laid outside it (§2.1). */

src/sim/narrate.ts

@@ -15,10 +15,10 @@
  * panel cannot drift from the rules.
  */
 
-import { MAX_CONSIST } from '../engine/content.ts';
+import { MAX_CONSIST, crewTrayCount } from '../engine/content.ts';
 import { adTrackCount, coordKey, seatOf, turnOf } from '../engine/state.ts';
 import type { GameState, GridCoord, PlayerIndex, RollingStock, SeatIndex, TrayId } from '../engine/state.ts';
-import { areaOf, canAdvanceLoad, canBoard, canDetrain, canStartLoad, facilityCarType, facilityCarTypes, laborersLeft, movesFor, passengerRefusal, portersLeft } from '../engine/apply.ts';
+import { areaOf, canAdvanceLoad, canBoard, canDetrain, canStartLoad, facilityCarType, facilityCarTypes, freightRuleSpentHere, isFreight, laborersLeft, movesFor, passengerRefusal, portersLeft } from '../engine/apply.ts';
 import type { GameEvent } from '../engine/events.ts';
 
 // ---------------------------------------------------------------------------
@@ -746,6 +746,42 @@ export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[]
    * Only while switching, and only the cards actually in the crew's way: `movesFor` reports the
    * squares the movement walk reached and refused, not every square on the board.
    */
+  /**
+   * WHY A CAR WILL NOT COME OFF (Gitea#21).
+   *
+   * "I dropped the first tank car, but that was all I was allowed to do" — and this panel, asked
+   * why, talked about the refinery's green box. The rule that actually refused is printed on the
+   * train: trains 3/4, the Express, "may drop or pick up one freight car at every location". The
+   * refusal was correct. Nothing said it.
+   *
+   * That is a worse failure than a missing button, because the panel did not stay silent — it
+   * offered a true statement about the FACILITY, which sent the player to spend a Freight Agent
+   * action that could not have helped. The rule was on the train card's tooltip, which is not
+   * where anyone looks when a button they expected is simply absent.
+   *
+   * Only when the crew has a freight car it could otherwise set out. A budget spent by a train
+   * with nothing left to drop is not blocking anything, and this panel earns its keep by being
+   * short enough to read.
+   */
+  const turnNow = turnOf(s, player);
+  if (s.clock.phase === 'localOps' && turnNow.option === 'switch') {
+    for (const [id, tray] of s.trays) {
+      if (tray.position.at !== 'grid' || tray.position.seat !== seatOf(s, player)) continue;
+      if (!tray.consist.some(isFreight)) continue;
+      if (!freightRuleSpentHere(s, player, id)) continue;
+      const { row, col } = tray.position.coord;
+      out.push({
+        where: `Train ${tray.trainNumber} at (${col},${row})`,
+        why:
+          'ONE FREIGHT CAR PER LOCATION — this train has already worked a freight car on this ' +
+          'square, so no more come off or on here until next turn. It may still work one at the ' +
+          'next square it reaches.',
+        // The printed rule doing its job, and it lifts by itself. Amber, not red.
+        severity: 'waiting',
+      });
+    }
+  }
+
   const turn = turnOf(s, player);
   if (s.clock.phase === 'localOps' && turn.option === 'switch' && turn.movesRemaining > 0) {
     for (const [id, tray] of s.trays) {
@@ -832,16 +868,72 @@ export function impediments(s: GameState, player: PlayerIndex = 0): Impediment[]
     }
   }
 
-  // Trains held for want of a Crew Tray (§7) — the scarcity mechanic, made visible.
+  /**
+   * TRAINS HELD FOR WANT OF A CREW TRAY (§7) — the scarcity mechanic, made visible (#98).
+   *
+   * This covered the TIMETABLED train due out this Stage and nothing else, which meant the two
+   * other things that queue for the same pool reported nothing at all. A player who spent a card on
+   * an Extra, or ordered a second section, got an EMPTY panel while their train sat behind an
+   * exhausted pool — and each had been announced once in the log in a line that promised a future
+   * event ("as soon as a Crew Tray frees up") which nothing then confirmed.
+   *
+   * All three are one condition, so they are written as one block: no free tray, and something
+   * waiting for one. The count rides along because "no free Crew Tray" reads like a permanent fact
+   * about the game rather than a state that will pass.
+   */
+  // `crewTrayCount` is the pool's size, asked rather than re-derived. `trays.size + freeTrays.length`
+  // gives the same number in play — `retireTrain` moves a tray back — but it is a second way to know
+  // one fact, which is the shape of every bug this release fixed.
+  const trays = `${s.freeTrays.length} of ${crewTrayCount(s.players.length)} Crew Trays free`;
+  if (s.freeTrays.length === 0) {
     const due = s.timetable[s.clock.stage - 1];
-  if (due !== null && due !== undefined && s.freeTrays.length === 0) {
+    if (due !== null && due !== undefined) {
       out.push({
         where: `Train ${due}`,
-      why: 'due to depart but HELD — no free Crew Tray',
+        why: `due to depart but HELD — no free Crew Tray (${trays})`,
         severity: 'stuck',
       });
     }
 
+    // An Extra belongs to the player who played the card (§7), so it is their errand and it is
+    // reported to them. A second section is the table's, like any Timetabled train.
+    for (const x of s.pendingExtras) {
+      if (x.player !== player) continue;
+      out.push({
+        where: `Extra X${x.trainNumber}`,
+        why: `played and waiting to be made up — no free Crew Tray (${trays})`,
+        severity: 'stuck',
+      });
+    }
+
+    for (const n of s.pendingSecondSections) {
+      out.push({
+        where: `Train ${n}`,
+        why: `second section ordered and waiting to be made up — no free Crew Tray (${trays})`,
+        severity: 'stuck',
+      });
+    }
+  }
+
+  /**
+   * A TRAIN HELD AT THE LIMITS BY AN INTERLOCKING (#99).
+   *
+   * It is inside the player's Limits, not on an A/D track, and it takes the first track that frees
+   * ahead of any newcomer. The map now draws it on the Limits square; this says what it is waiting
+   * for, which is the Office emptying rather than anything the held train itself can do.
+   */
+  for (const id of area.heldAtLimits) {
+    const t = s.trays.get(id);
+    if (!t) continue;
+    out.push({
+      where: `Train ${t.trainIsExtra ? 'X' : ''}${t.trainNumber ?? '—'}`,
+      why:
+        'held at your Limits by the Interlocking instead of colliding — it takes the first A/D ' +
+        'track that frees, ahead of any train arriving after it',
+      severity: 'waiting',
+    });
+  }
+
   // A full Office means the next arrival is an automatic collision (Gap 2d).
   const cap = adTrackCount(s, seatOf(s, player));
   if (area.adOccupancy.length >= cap) {

src/sim/replay.ts

@@ -230,7 +230,7 @@ export function compress(frames: Frame[]): Packed {
       const fi = c.facility ? f.facilities.indexOf(c.facility) : -1;
       // `trains` rides whole rather than being interned: it changes almost every frame, so a table
       // of them would be as long as the frames are and buy nothing.
-      return [ci, wi, c.enhancements, c.cars, fi, c.trains, c.adTracks, c.enhancementsWhat, c.standingWest];
+      return [ci, wi, c.enhancements, c.cars, fi, c.trains, c.adTracks, c.enhancementsWhat, c.standingWest, c.enhancementsSpent];
     });
     return { ...f, cells } as unknown as Frame;
   });
@@ -264,7 +264,7 @@ export function rehydrateCells(
   facs: unknown[],
 ): unknown[] {
   return packed.map((row) => {
-    const p = row as [number, number, string[], string[], number, unknown, unknown, string[], number];
+    const p = row as [number, number, string[], string[], number, unknown, unknown, string[], number, boolean[]];
     const c = cards[p[0]] as [number, number, string, string, boolean, string[]];
     // Tolerant the same way `standingWest` below is: an array rides through as-is, a lone object
     // (an older recording's singular `train`) is wrapped into a one-train roster, and null or
@@ -284,6 +284,10 @@ export function rehydrateCells(
       // cut ahead of or behind the engine exactly as the live board does. Absent in older recordings,
       // which read as 0 — the whole cut east of the engine, which is what they used to draw anyway.
       standingWest: p[8] ?? 0,
+      // Which dispatch devices were spent (#101), so a replay strikes a used Radio through exactly
+      // as the live board does. Absent in recordings made before it existed, which read as no
+      // device spent — the same thing they drew at the time, so an old replay is unchanged.
+      enhancementsSpent: p[9] ?? [],
     };
   });
 }

src/sim/view.ts

@@ -10,7 +10,7 @@
  * drift into two different pictures of the same board.
  */
 
-import { regionOfTransit } from '../engine/advance.ts';
+import { isExpedited, regionOfTransit } from '../engine/advance.ts';
 import {
   areaAtSeat,
   areaOf,
@@ -27,7 +27,6 @@ import {
 import {
   ACTION_CARDS,
   ENHANCEMENT_CARDS,
-  HAND_LIMIT,
   MAINLINE_MODIFIER_CARDS,
   MAINLINE_PROFILES,
   MANEUVER_CARDS,
@@ -35,6 +34,8 @@ import {
   REALIGNMENTS,
   OFFICE_ORDER,
   SPACE_USE_CARDS,
+  STAGES_PER_SHIFT,
+  crewTrayCount,
   enhancementRule,
   enhancementText,
   industryProfile,
@@ -46,9 +47,9 @@ import {
   mainlineDescription,
 } from '../engine/content.ts';
 import type { Intent } from '../engine/intents.ts';
-import type { Facility, GameConfig, GameState, PlayerIndex, SeatIndex, TrackCard, TurnoutOrientation } from '../engine/state.ts';
-import { actingPlayer, carsOn, playerAtSeat, railFacingOf, seatOf, turnOf } from '../engine/state.ts';
-import type { Hand, HouseRules, TrackGeometry } from '../engine/content.ts';
+import type { Facility, GameConfig, GameState, OfficeArea, PlayerIndex, SeatIndex, TrackCard, TurnoutOrientation } from '../engine/state.ts';
+import { actingPlayer, carsOn, overHandLimit, playerAtSeat, railFacingOf, seatOf, turnOf } from '../engine/state.ts';
+import type { Direction, Hand, HouseRules, TrackGeometry } from '../engine/content.ts';
 import type { Port } from '../engine/track.ts';
 import { connectionsFor, slopeOfPair, variantsFor } from '../engine/track.ts';
 import type { Impediment } from './narrate.ts';
@@ -73,6 +74,14 @@ export type CellView = {
    * `toString()`), so it cannot reach the card catalogue itself.
    */
   enhancementsWhat: string[];
+  /**
+   * Which of those enhancements is SPENT for today, in the same order (#101).
+   *
+   * Only ever true of a dispatch device — Telegraph, Telephone, Radio — which is "once a day". The
+   * reason and the Fedora caveat are already written into `enhancementsWhat`; this is the flag the
+   * board styles from, because `board-svg.ts` imports nothing and cannot work it out for itself.
+   */
+  enhancementsSpent: boolean[];
   /**
    * EVERY TRAIN STANDING HERE, in order, each with the engine in it and which way it points.
    *
@@ -104,6 +113,15 @@ export type CellView = {
      * standing in front of them — the card is face down in a box somewhere by then.
      */
     what: string;
+    /**
+     * HELD AT THE LIMITS BY AN INTERLOCKING, rather than standing on this square (#99).
+     *
+     * The engine keeps these in `OfficeArea.heldAtLimits` and deliberately does NOT move
+     * `tray.position` onto the grid — a held train is not on a square anything may switch it from.
+     * So the map has to draw it from the held list, and mark it, or it reads as an ordinary arrival
+     * the player could work.
+     */
+    heldAtLimits?: true;
   }[];
   /**
    * Office card only: how many A/D tracks the tier has — null everywhere else.
@@ -320,6 +338,16 @@ export type DivisionView = {
   what?: string;
   /** Mainline cards only: how many regions the card is divided into (§2.1 — two). */
   regions?: number;
+  /**
+   * Office nodes only: a Red Flag standing at this Office's Limits, and which approach it guards
+   * (#94). `null` when none is out.
+   *
+   * PUBLIC STATE, and the reason it has to be here: the flag is a token set out ON the board that
+   * holds the next train arriving from that side until it is spent. It was announced once in the
+   * log and then drawn nowhere, so a train would stop short with its only explanation scrolled out
+   * of the panel.
+   */
+  redFlag?: string | null;
   /** Office nodes only: the Running Track, Limits to Limits, west to east. */
   running?: RunningCardView[];
   /** Office nodes only: whose district this is. */
@@ -447,7 +475,17 @@ export type Frame = {
    * there is only one; the first thing you want to know at a four-player table.
    */
   viewer: number;
-  /** The viewer's position in the west-to-east chain, which is not their player index (§4.4). */
+  /**
+   * The viewer's position in the west-to-east chain, which is not their player index (§4.4).
+   *
+   * CARRIED AHEAD OF ITS CALLER, DELIBERATELY (#45). Nothing renders this today — the 2026-08-30
+   * dead-field audit found it read only by one test, and Jesse deferred the delete-or-document
+   * call. Documenting rather than deleting, because Gitea#20's common board keys every district by
+   * SEAT and resolves the player through `playerAtSeat` (§Employee Rotation moves players between
+   * districts), so a client that must pick its own district out of a seat-keyed board needs exactly
+   * this and cannot derive it from `viewer`. If step 2 ships without using it, delete it then —
+   * this note is the reason it survived one audit, not a permanent exemption from the next.
+   */
   viewerSeat: number;
   /**
    * §4.4's opening D12 per player, and the roll that chose the Superintendent — kept so a client
@@ -740,6 +778,39 @@ function baseOf(
  */
 function trainsOnCard(s: GameState, viewerSeat: SeatIndex, key: string): CellView['trains'] {
   const out: CellView['trains'] = [];
+
+  /**
+   * TRAINS HELD AT THE LIMITS — drawn here or drawn nowhere (#99).
+   *
+   * `arriveAtOffice` takes the tray out of the Mainline node's `transits` and, when an Interlocking
+   * saves it from Gap 2d's collision, pushes it onto `heldAtLimits` without giving it a grid
+   * position. The map draws mainline nodes from `transits` and squares from `position.at === 'grid'`
+   * — so between the two the train was drawn in NEITHER, and simply vanished off the board until an
+   * A/D track freed some Stages later.
+   *
+   * At WHICH Limits: the end it came in by. An eastbound train entered from the west, so it is held
+   * at `limitsWest`; a westbound one at `limitsEast`.
+   */
+  const area = areaAtSeat(s, viewerSeat);
+  for (const id of area.heldAtLimits) {
+    const t = s.trays.get(id);
+    if (!t) continue;
+    const at = t.direction === 'east' ? area.limitsWest : area.limitsEast;
+    if (`${at.row},${at.col}` !== key) continue;
+    out.push({
+      trayId: id,
+      label: t.trainNumber === null ? 'crew' : `T${t.trainIsExtra ? 'X' : ''}${t.trainNumber}`,
+      cars: t.consist.map((c) => carLabel(c, viewerSeat)),
+      engineAt: Math.max(0, Math.min(t.consist.length, t.engineAt)),
+      facing: railFacingOf(t),
+      what:
+        'HELD AT THE LIMITS — the Interlocking stopped it on the Limit Track instead of letting it ' +
+        'collide with a full Office. It takes the first A/D track that frees, ahead of any train ' +
+        `arriving after it. ${trainRules(t)}`,
+      heldAtLimits: true,
+    });
+  }
+
   for (const [id, t] of s.trays) {
     if (t.position.at !== 'grid' || t.position.seat !== viewerSeat) continue;
     if (`${t.position.coord.row},${t.position.coord.col}` !== key) continue;
@@ -1171,28 +1242,76 @@ export function describeIntent(s: GameState, i: Intent): string {
  * replay cannot drift into two different pictures of the same board.
  */
 /**
- * The board as ONE SEAT sees it.
+ * ONE DISTRICT'S BOARD, BY SEAT — the cards on the table and the cars standing on them (Gitea#20
+ * step 1).
  *
- * `viewer` decides whose district, whose hand and whose facilities the Frame carries — everything
- * else (the Division, the timetable, the clock) is common to the table. It defaults to seat 0, which
- * is what solitaire and every replay want, so existing callers are unaffected.
+ * A district's BOARD is public. Everyone at the table can see the cards somebody has laid, the cars
+ * standing on them and the trains in the Office Area; what is private is a player's HAND, their
+ * objective and their Revenue detail, none of which is here. That split is why this can be handed to
+ * a seatless spectator unchanged.
  *
- * This was hardcoded to 0 throughout. That was correct while there was one player and would have
- * been a quiet disaster with more: every seat would have been shown player 0's railroad, including
- * player 0's hand, which is the one thing the state model calls secret.
+ * **KEYED BY SEAT, NOT BY PLAYER, and that is not a detail.** Employee Rotation moves players
+ * between districts, so district ownership cannot be assumed to match player index — the board
+ * belongs to the POSITION on the Division and the player is whoever is currently sitting there
+ * (`playerAtSeat`). Taking a player here would silently draw the wrong district the first time
+ * anybody rotated.
+ *
+ * `seat` is also the "home seat" for `carLabel`, which marks a load THIS district made — the printed
+ * game turns the chip upside down in the tray, and a load may not be broken in the Office Area that
+ * made it. For a player's own view that seat is theirs; for a spectator's view of district N it is
+ * N, which is the same fact asked from outside.
  */
-export function snapshot(
+/**
+ * WHAT AN ENHANCEMENT DOES — AND WHETHER IT CAN DO IT RIGHT NOW (#101).
+ *
+ * `enhancementText(key)` takes only the key, so it says the same thing for ever. That is right for
+ * every enhancement except the three dispatch devices, which are "once a day": a spent Radio read
+ * "Once a day, add +12…" all Day after it was gone, which is `trainRules` before #100 in a different
+ * corner of the same view.
+ *
+ * AND THE FEDORA, which is the half that actually surprises. `spendDispatchBonus` (advance.ts) reads
+ * the SUPERINTENDENT's own devices, not the train owner's, and the Fedora moves every
+ * `STAGES_PER_SHIFT` Stages — so a device does nothing at all while somebody else is dispatching,
+ * and is spent automatically, without its owner being asked, while they are.
+ *
+ * `dispatchBonus` decides what counts as a device, rather than a list of three keys written out
+ * here: the ladder lives in `ENHANCEMENT_RULES` and a fourth rung would otherwise be silently
+ * exempt.
+ */
+function enhancementState(
   s: GameState,
-  lines: { text: string; tone: string }[],
-  where: { row: number; col: number } | null,
-  whereFrom: { row: number; col: number } | null = null,
-  decision: Decision | null = null,
-  wasted = false,
-  viewer: PlayerIndex = 0,
-): Frame {
-  const area = areaOf(s, viewer);
-  const viewerSeat = seatOf(s, viewer);
+  area: OfficeArea,
+  seat: SeatIndex,
+  key: string,
+): { what: string; spent: boolean } {
+  const base = enhancementText(key) ?? prettyKey(key);
+  if (enhancementRule(key)?.dispatchBonus === undefined) return { what: base, spent: false };
 
+  const spent = area.dispatchUsedToday.includes(key);
+  if (spent) {
+    return {
+      what: `${base} SPENT for today — it comes back at the start of the next Day.`,
+      spent: true,
+    };
+  }
+  // Available, but only to whoever is dispatching. Naming the shift length is the difference
+  // between "not now" and knowing how long "not now" lasts.
+  if (seatOf(s, s.clock.superintendent) !== seat) {
+    return {
+      what:
+        `${base} Unspent, but IDLE: a device is only used by the district holding the Fedora, ` +
+        `which moves every ${STAGES_PER_SHIFT} Stages.`,
+      spent: false,
+    };
+  }
+  return { what: `${base} Available today, and this district is dispatching.`, spent: false };
+}
+
+export function projectDistrict(
+  s: GameState,
+  seat: SeatIndex,
+): { cells: CellView[]; facilities: FacilityView[]; runningRow: number; limits: { west: number; east: number } } {
+  const area = areaAtSeat(s, seat);
   const cells: CellView[] = [];
   const facilities: FacilityView[] = [];
   for (const [key, card] of area.grid) {
@@ -1210,7 +1329,7 @@ export function snapshot(
     else if (g.kind === 'spaceUse') label = prettyKey(g.key);
     else label = geometryLabel(g.geometry);
 
-    const fv = facilityView(card as never, officeProfile(area.tier).name, viewerSeat);
+    const fv = facilityView(card as never, officeProfile(area.tier).name, seat);
     if (fv) facilities.push(fv);
 
     cells.push({
@@ -1222,16 +1341,34 @@ export function snapshot(
       what: cellDescription(card, officeProfile(area.tier).name, row === area.runningRow),
       links: connectionsFor(card).map(([a, b]) => `${a}${b}`),
       enhancements: card.enhancements.map(prettyKey),
-      enhancementsWhat: card.enhancements.map((k) => enhancementText(k) ?? prettyKey(k)),
-      trains: trainsOnCard(s, viewerSeat, key),
+      enhancementsWhat: card.enhancements.map((k) => enhancementState(s, area, seat, k).what),
+      enhancementsSpent: card.enhancements.map((k) => enhancementState(s, area, seat, k).spent),
+      trains: trainsOnCard(s, seat, key),
       adTracks: card.geometry.kind === 'office' ? officeProfile(area.tier).adTracks : null,
-      cars: carsOn(card).map((c) => carLabel(c, viewerSeat)),
+      cars: carsOn(card).map((c) => carLabel(c, seat)),
       standingWest: card.standingWest,
       facility: fv,
     });
   }
 
-  const division: DivisionView[] = s.division.nodes.map((n) => {
+  return {
+    cells,
+    facilities,
+    runningRow: area.runningRow,
+    limits: { west: area.limitsWest.col, east: area.limitsEast.col },
+  };
+}
+
+/**
+ * THE DIVISION — every district's cell, the Mainline between them, and both Division Points.
+ *
+ * Wholly public and always was: it reads no hand, no objective and no per-viewer state, so a
+ * spectator's Division map and a player's are the same picture. It is extracted rather than
+ * rewritten for exactly that reason — the public view must not be a second implementation that can
+ * drift from the one players look at.
+ */
+export function projectDivision(s: GameState): DivisionView[] {
+  return s.division.nodes.map((n) => {
     if (n.kind === 'divisionPoint') {
       return {
         kind: 'dp',
@@ -1259,10 +1396,31 @@ export function snapshot(
        * one per Stage — and the entry point is what the rules actually move. There is nothing left
        * to reconstruct.
        */
-      // One region per Stage, straight off the card's own count: what a train has LEFT to run says
-      // where it is standing. `regionOfTransit` is the engine's own answer, so the picture and the
-      // collision rule cannot disagree about who is where.
-      const place = (t: { stagesRemaining: number }): number => regionOfTransit(n.card, t.stagesRemaining);
+      /**
+       * AND WHICH WAY IT CAME IN (Gitea#22). `regionOfTransit` counts from the end the train
+       * ENTERED — everything still to run is region 0 — and both directions share that one index
+       * space, which is what the collision rules want and why the engine asks it directly.
+       *
+       * The map is asking a different question: which printed box, LEFT TO RIGHT. East is right
+       * here and always has been, so for an eastbound train the two questions have the same answer
+       * by luck — it enters at the west end, so "just entered" and "leftmost box" coincide. A
+       * westbound train enters at the EAST end, so its region 0 is the right-hand box, and using
+       * the travel index directly drew the whole card mirrored.
+       *
+       * That cost a collision (seed 550943578, undo 187): a westbound TX17 that had just entered
+       * was drawn WEST of a westbound T5 that was nearly across, so the train physically behind
+       * appeared to be the one in front. Train 3 was cleared to follow T5 and ran into TX17 —
+       * where the rules had always had it.
+       *
+       * So the engine's index is turned into a place on the map here, once, at the boundary the
+       * map is drawn from. `regionOfTransit` keeps its meaning and the collision rules are
+       * untouched; only the picture changes.
+       */
+      const place = (t: { stagesRemaining: number; direction: Direction }): number => {
+        const travelled = regionOfTransit(n.card, t.stagesRemaining);
+        const regions = mainlineProfile(n.card).regions;
+        return t.direction === 'west' ? regions - 1 - travelled : travelled;
+      };
       return {
         kind: 'ml',
         label: name,
@@ -1345,51 +1503,65 @@ export function snapshot(
       modifiers: [],
       gradeUp: null,
       seat: n.seat,
+      // Straight off the node the engine sets (#94). Public to every seat — a flag on the table is
+      // seen by everyone at it — so this is not redacted by viewer and must not become so.
+      redFlag: n.redFlag ?? null,
       running,
       switching: below,
     };
   });
+}
 
+/**
+ * WHO THE GAME IS WAITING ON — the one answer, asked one way (Gitea#20 step 1).
+ *
+ * TWO THINGS HAVE TO BE TRUE AT ONCE, and each was somewhere else before #96 put them together.
+ *
+ * `clock.currentActor` alone is not it: the engine sets that null while an interruption is standing
+ * — a §8.1 clearance goes to the Superintendent, a Yard Office offer to the district's owner — so a
+ * view reading the raw field reports "nobody" during exactly the moments a player is being waited
+ * on. `actingPlayer` knows that rule and is the engine's own answer to it.
+ *
+ * `actingPlayer` alone is not it either, and THIS is what #96 was: it has no status guard, so when
+ * the game is not running it hands back whatever `clock.currentActor` was left holding — the last
+ * seat to move before the timetable ran out. The §3.3 vote is the state that exposed it. That vote
+ * is PARALLEL, open to every un-voted seat at once, and `apply.ts` says in as many words that there
+ * is no actor to be; the screen named the last mover anyway, beside a tally correctly showing three
+ * seats outstanding.
+ *
+ * So: nobody is acting unless the game is `active`, and when it is, `actingPlayer` decides who.
+ *
+ * `currentActor(game)` in `web/game.ts` is this function taking a `Game`, and delegates to it —
+ * ONE answer, not two that agree until they don't. That matters more than it looks: `currentActor`
+ * is what refuses an intent, so a screen answering differently tells the table to wait on a player
+ * the server would turn away.
+ */
+export function currentActorOfState(s: GameState): PlayerIndex | null {
+  if (s.status !== 'active') return null;
+  return actingPlayer(s);
+}
+
+/**
+ * THE TABLE, AS EVERY SEAT SEES IT IDENTICALLY (Gitea#20 step 1).
+ *
+ * The clock, the phase, whose turn it is, the timetable, the yards, the deck COUNTS, the score and
+ * the house rules. Nothing here is redacted, and nothing here may become redacted: the whole point
+ * is that a spectator and a player read the same table state, so a field that has to differ by seat
+ * belongs in the player's own frame instead.
+ *
+ * Deck contents are counts and top-of-pile names only. A Department pile is FACE UP — a discard goes
+ * onto one precisely so a rival can take it — so naming its top card gives nothing away; the Home
+ * Office deck is face down and appears here as a length and nothing else.
+ */
+export function projectSharedTable(s: GameState) {
   return {
     day: s.clock.day,
     stage: s.clock.stage,
     clock: clockTime(s.clock.stage),
     phase: phaseLabel(s.clock.phase),
     phaseKey: s.clock.phase,
-    actor: actingPlayer(s),
-    /**
-     * The three interruptions §8.1 and Gitea#5/#19 can raise, said in the words the prompt itself
-     * uses. `decisionActor` above decides WHO; this is only what they are looking at.
-     */
-    awaiting: (() => {
-      const d = s.clock.pendingDecision;
-      if (!d) return null;
-      const train = trainName(s, d.train);
-      if (d.kind === 'clearance') return { asks: 'a clearance ruling', train };
-      if (d.kind === 'yardOffice') return { asks: 'the Yard Office offer', train };
-      return { asks: 'a Red Flag', train };
-    })(),
+    actor: currentActorOfState(s),
     superintendent: s.clock.superintendent,
-    revenue: s.players[viewer]?.revenue ?? 0,
-    lines,
-    where,
-    whereFrom,
-    division,
-    cells,
-    facilities,
-    /**
-     * NEWEST FIRST, matching the play page (`actionMenu`).
-     *
-     * The engine pushes a drawn card onto the END of the hand, which put the card just turned over
-     * at the far end of a wrapping row. Reversed here rather than in the engine so the bot's hand
-     * iteration — and every revenue measurement taken with it — is left alone.
-     *
-     * Both lines must reverse together or the descriptions come apart from the names.
-     */
-    hand: [...(s.decks.hands.get(viewer) ?? [])].reverse().map((id) => cardName(s, id)),
-    handWhat: [...(s.decks.hands.get(viewer) ?? [])].reverse().map((id) => cardDescription(s, id)),
-    handDiscardable: [...(s.decks.hands.get(viewer) ?? [])].reverse().map((id) => keepReason(s, id) === null),
-    handKeepWhy: [...(s.decks.hands.get(viewer) ?? [])].reverse().map((id) => keepReason(s, id)),
     deck: s.decks.homeOffice.length,
     departments: s.decks.departments.map((pile) => {
       const top = pile[pile.length - 1];
@@ -1414,9 +1586,6 @@ export function snapshot(
     },
     timetable: [...s.timetable],
     timetableWhat: s.timetable.map((n) => (n === null ? null : trainRules({ trainNumber: n, trainIsExtra: false }))),
-    decision,
-    wasted,
-    option: turnOf(s, viewer).option,
     houseRules: houseRules(s.config),
     mode: s.config.mode,
     optionalRules: s.config.optionalRules,
@@ -1437,23 +1606,14 @@ export function snapshot(
       seat: seatOf(s, p.index),
       name: p.name,
       revenue: p.revenue,
+      // A COUNT, never the cards. Hand SIZE is public — you can see how many cards somebody holds
+      // across a table — and this is the only thing about another player's hand that may be here.
       hand: (s.decks.hands.get(p.index) ?? []).length,
     })),
-    viewer,
-    viewerSeat,
     openingRolls: {
       division: [...s.openingRolls.division],
       superintendent: [...s.openingRolls.superintendent],
     },
-    handCount: (s.decks.hands.get(viewer) ?? []).length,
-    overHandLimit:
-      (s.decks.hands.get(viewer) ?? []).length > (s.decks.redFlags.get(viewer) ? HAND_LIMIT + 1 : HAND_LIMIT),
-    objective: objectiveOf(s, viewer),
-    runningRow: area.runningRow,
-    limits: { west: area.limitsWest.col, east: area.limitsEast.col },
-    movesLeft: s.clock.phase === 'localOps' && turnOf(s, viewer).option === 'switch' ? turnOf(s, viewer).movesRemaining : null,
-    moves: switchingMoves(s, viewer),
-    blocked: impediments(s, viewer),
     trains: [...s.trays.values()].map((t) => ({
       label: t.trainNumber === null ? 'local crew' : `Train ${t.trainIsExtra ? 'X' : ''}${t.trainNumber}`,
       where:
@@ -1463,6 +1623,166 @@ export function snapshot(
             ? `Mainline card ${t.position.index}`
             : `Office Area (${t.position.coord.col},${t.position.coord.row})`,
     })),
+    /**
+     * THE CREW TRAY POOL, WHICH IS §7's SCARCITY MECHANIC (#98).
+     *
+     * `state.ts` calls it explicit, and it was explicit only in the engine: there are fewer trays
+     * than there are trains wanting one, and nothing said how many were left. Public without
+     * question — the trays are physical objects in the middle of the table, and this is a count
+     * beside the deck and yard counts already here.
+     */
+    crewTrays: { free: s.freeTrays.length, total: crewTrayCount(s.players.length) },
+    /**
+     * THE TRAINS QUEUED FOR ONE — the other half, and the half that had been promised in words.
+     *
+     * Playing an Extra says "it runs once as soon as a Crew Tray frees up"; ordering a second
+     * section says "an identical train will run right behind it". Both were announced once in the
+     * log and then existed only in the engine, so neither promise was ever visibly kept. Who played
+     * an Extra is public: §7 gives the train to the player who played the card, in the open.
+     */
+    queued: {
+      extras: s.pendingExtras.map((x) => ({ trainNumber: x.trainNumber, player: x.player })),
+      secondSections: [...s.pendingSecondSections],
+    },
+  };
+}
+
+/** One district as a spectator sees it: whose seat it is, who is sitting there, and its board. */
+export type PublicDistrict = {
+  seat: SeatIndex;
+  player: PlayerIndex;
+  name: string;
+  cells: CellView[];
+  facilities: FacilityView[];
+  runningRow: number;
+  limits: { west: number; east: number };
+};
+
+/** What a seatless viewer may be shown: the table, the Division, and every district's board. */
+export type PublicFrame = ReturnType<typeof projectSharedTable> & {
+  division: DivisionView[];
+  districts: PublicDistrict[];
+};
+
+/**
+ * THE WHOLE GAME AS A SPECTATOR MAY SEE IT — no seat, no hand, no secrets (Gitea#20 step 1).
+ *
+ * **Built from the same lower-level projections a player's frame is, and deliberately NOT by calling
+ * `snapshot()` once per seat.** That shortcut is the trap: `snapshot` exists to assemble one
+ * player's view and carries their hand, their objective, their Revenue detail and their legal moves,
+ * so a public view made of player views starts by constructing everything it then has to remember to
+ * strip. It also defaults its viewer to player zero, which means a careless spectator call today
+ * serves seat 0's hand. Composing upward instead means a private field cannot arrive here by
+ * accident: it would have to be added to a projection that has no business holding one.
+ *
+ * **Districts are keyed by SEAT and the player is resolved through `playerAtSeat`.** Employee
+ * Rotation moves players between districts, so seat and player index are not interchangeable, and
+ * a public board that assumed they were would relabel every district the first time anybody rotated.
+ *
+ * What is NOT here, and why each: `hand`/`handWhat`/`handDiscardable`/`handKeepWhy` and `handCount`
+ * (the cards a seat holds), `objective` (a private goal), `option`/`movesLeft`/`moves` (one player's
+ * legal actions, which describe what they are ABOUT to do), `blocked` (computed per viewer and
+ * partly about their own crews), `decision`, `viewer`/`viewerSeat`, and the narration log — which
+ * `session.ts` sends incrementally and which is checked separately, because two of the leaks found
+ * in v0.7.9.2 lived there rather than in any frame.
+ */
+export function publicSnapshot(s: GameState): PublicFrame {
+  return {
+    ...projectSharedTable(s),
+    division: projectDivision(s),
+    districts: [...s.officeAreas.keys()].sort((a, b) => a - b).map((seat) => {
+      const player = playerAtSeat(s, seat);
+      return {
+        seat,
+        player,
+        // Through `seatLabel`, like every other seat a person reads: the internal index is
+        // zero-based and the spoken number is not (`session.test.ts` guards the conversion).
+        name: s.players[player]?.name ?? `Seat ${seatLabel(seat)}`,
+        ...projectDistrict(s, seat),
+      };
+    }),
+  };
+}
+
+/**
+ * The board as ONE SEAT sees it.
+ *
+ * `viewer` decides whose district, whose hand and whose facilities the Frame carries — everything
+ * else (the Division, the timetable, the clock) is common to the table. It defaults to seat 0, which
+ * is what solitaire and every replay want, so existing callers are unaffected.
+ *
+ * This was hardcoded to 0 throughout. That was correct while there was one player and would have
+ * been a quiet disaster with more: every seat would have been shown player 0's railroad, including
+ * player 0's hand, which is the one thing the state model calls secret.
+ */
+export function snapshot(
+  s: GameState,
+  lines: { text: string; tone: string }[],
+  where: { row: number; col: number } | null,
+  whereFrom: { row: number; col: number } | null = null,
+  decision: Decision | null = null,
+  wasted = false,
+  viewer: PlayerIndex = 0,
+): Frame {
+  const viewerSeat = seatOf(s, viewer);
+
+  const { cells, facilities, runningRow, limits } = projectDistrict(s, viewerSeat);
+  const division = projectDivision(s);
+  return {
+    /**
+     * THE SHARED TABLE COMES FROM THE SAME PROJECTION THE COMMON BOARD USES (Gitea#20 step 1).
+     *
+     * Spread rather than restated, so a player's frame and a spectator's cannot come to disagree
+     * about the clock, the phase, whose turn it is or the score. Everything after this point is
+     * either private to `viewer` or a viewer-specific slice; none of it shadows a shared field, and
+     * one that did would be exactly the bug this arrangement exists to make visible.
+     */
+    ...projectSharedTable(s),
+    /**
+     * The three interruptions §8.1 and Gitea#5/#19 can raise, said in the words the prompt itself
+     * uses. `decisionActor` above decides WHO; this is only what they are looking at.
+     */
+    awaiting: (() => {
+      const d = s.clock.pendingDecision;
+      if (!d) return null;
+      const train = trainName(s, d.train);
+      if (d.kind === 'clearance') return { asks: 'a clearance ruling', train };
+      if (d.kind === 'yardOffice') return { asks: 'the Yard Office offer', train };
+      return { asks: 'a Red Flag', train };
+    })(),
+    revenue: s.players[viewer]?.revenue ?? 0,
+    lines,
+    where,
+    whereFrom,
+    division,
+    cells,
+    facilities,
+    /**
+     * NEWEST FIRST, matching the play page (`actionMenu`).
+     *
+     * The engine pushes a drawn card onto the END of the hand, which put the card just turned over
+     * at the far end of a wrapping row. Reversed here rather than in the engine so the bot's hand
+     * iteration — and every revenue measurement taken with it — is left alone.
+     *
+     * Both lines must reverse together or the descriptions come apart from the names.
+     */
+    hand: [...(s.decks.hands.get(viewer) ?? [])].reverse().map((id) => cardName(s, id)),
+    handWhat: [...(s.decks.hands.get(viewer) ?? [])].reverse().map((id) => cardDescription(s, id)),
+    handDiscardable: [...(s.decks.hands.get(viewer) ?? [])].reverse().map((id) => keepReason(s, id) === null),
+    handKeepWhy: [...(s.decks.hands.get(viewer) ?? [])].reverse().map((id) => keepReason(s, id)),
+    decision,
+    wasted,
+    option: turnOf(s, viewer).option,
+    viewer,
+    viewerSeat,
+    handCount: (s.decks.hands.get(viewer) ?? []).length,
+    overHandLimit: overHandLimit(s, viewer),
+    objective: objectiveOf(s, viewer),
+    runningRow,
+    limits,
+    movesLeft: s.clock.phase === 'localOps' && turnOf(s, viewer).option === 'switch' ? turnOf(s, viewer).movesRemaining : null,
+    moves: switchingMoves(s, viewer),
+    blocked: impediments(s, viewer),
   };
 }
 
@@ -1633,6 +1953,12 @@ export function cardDescription(s: GameState, id: string): string {
 export function trainRules(t: {
   trainNumber: number | null;
   trainIsExtra: boolean;
+  /**
+   * X17 only — whether the speeches are made, which is what decides which HALF of its printed rule
+   * the train is currently living under (#100). Optional because the timetable renders a train
+   * number with no tray behind it; absent means "not yet", which is the state a train starts in.
+   */
+  speechMade?: boolean;
 }): string {
   const p = trainProfile(t.trainNumber ?? 0, t.trainIsExtra);
   if (!p) return '';
@@ -1677,11 +2003,25 @@ export function trainRules(t: {
   if (p.rules.pickUpEmptiesOnly) {
     parts.push('EMPTIES ONLY — it may not couple a loaded car. A caboose is not a load.');
   }
+  /**
+   * WHICH HALF OF ITS RULE THE CAMPAIGN TRAIN IS IN (#100).
+   *
+   * "One turn at station (speeches) then expedite" is two states, not one sentence. This used to
+   * print the sentence and stop, so the chip read identically before and after the speeches — while
+   * the fault the second half creates was warned about only under `expedite`, i.e. to every train
+   * EXCEPT the one that had just become subject to it.
+   */
   if (p.rules.stopThenExpedite) {
-    parts.push('STOPS ONCE FOR SPEECHES, then runs expedited from its next Office onward');
+    parts.push(
+      t.speechMade
+        ? 'SPEECHES MADE — it runs EXPEDITED from here on'
+        : 'STOPS ONCE FOR SPEECHES at its first Office, then runs expedited from the next one onward',
+    );
   }
 
-  if (p.rules.expedite) {
+  // `isExpedited` (advance.ts) is the engine's own test, borrowed rather than restated: a card that
+  // described a rule the engine did not apply — or the reverse — is the whole failure this is in.
+  if (isExpedited(t)) {
     // It is released and switched exactly like any other train — the restriction is on where it may
     // be LEFT, not on when it leaves.
     parts.push(

src/web/game.ts

@@ -30,7 +30,7 @@ import type { Intent } from '../engine/intents.ts';
 import { legalActions } from '../engine/legal.ts';
 import { createGame } from '../engine/setup.ts';
 import type { CardId, GameConfig, GameState, PlayerIndex } from '../engine/state.ts';
-import { actingPlayer } from '../engine/state.ts';
+import { overHandLimit as overHandLimitOf } from '../engine/state.ts';
 import { playerAtSeat } from '../engine/state.ts';
 import { cuesFor, narrate } from '../sim/narrate.ts';
 // Import from the view module, NOT replay.ts — replay.ts writes files and reads process.argv,
@@ -38,6 +38,7 @@ import { cuesFor, narrate } from '../sim/narrate.ts';
 import {
   cardDescription,
   cardName,
+  currentActorOfState,
   describeIntent,
   geometryLabel,
   snapshot,
@@ -49,7 +50,6 @@ import {
   DEFAULT_HOUSE_RULES,
   DEFAULT_MAX_COLLISIONS_PER_DAY,
   DEFAULT_MAX_COLLISIONS_TOTAL,
-  HAND_LIMIT,
   LEGACY_HOUSE_RULES,
   collectiveRevenueFloor,
   houseRules,
@@ -245,7 +245,6 @@ export type Game = {
    * had already been played and the hand held three or fewer. Derived from the hand each render, so
    * it cannot drift out of step with what is actually held.
    */
-  mustPlayCard: boolean;
   /**
    * Sounds the last batch of events earned, for the page to play and clear.
    *
@@ -312,7 +311,7 @@ export const SOLO_PLAYER = 'Solitaire';
 
 export function newGame(seed: number, config: GameConfig = SOLO_CONFIG): Game {
   const state = createGame({ id: `web-${seed}`, seed, config, playerNames: [SOLO_PLAYER] });
-  const game: Game = { state, seed, history: [], log: [], mustPlayCard: false, cues: [], scheduled: null, justDrawn: null, announced: null };
+  const game: Game = { state, seed, history: [], log: [], cues: [], scheduled: null, justDrawn: null, announced: null };
   // A history that opens mid-Stage reads as though something was missed. Say what the game IS
   // first, then let the clock take over.
   game.log.push({ text: 'Game Begins', tone: 'start' });
@@ -331,9 +330,23 @@ export function newGame(seed: number, config: GameConfig = SOLO_CONFIG): Game {
  */
 export function newMultiplayerGame(seed: number, config: GameConfig, playerNames: string[]): Game {
   const state = createGame({ id: `mp-${seed}`, seed, config, playerNames });
-  const game: Game = { state, seed, history: [], log: [], mustPlayCard: false, cues: [], scheduled: null, justDrawn: null, announced: null };
+  const game: Game = { state, seed, history: [], log: [], cues: [], scheduled: null, justDrawn: null, announced: null };
   game.log.push({ text: 'Game Begins', tone: 'start' });
-  game.log.push({ text: `${config.mode} · ${playerNames.length} players · seed ${seed}`, tone: 'quiet' });
+  /**
+   * NO SEED AT A TABLE WITH MORE THAN ONE SEAT (Gitea#20 step 1).
+   *
+   * `game.log` is one shared list and `linesSince(seat)` (`server/session.ts`) slices it with no
+   * per-seat filter, so every line here reaches every player. Announcing the seed therefore handed
+   * each of them the whole future of the deal — every card order, every die — in the opening line
+   * of the game. Found while planning the public common board; it is a multiplayer leak with or
+   * without that display, which is why it is fixed here rather than waiting for it.
+   *
+   * `newGame` still records it, deliberately: a solitaire table has nobody to leak to, and the seed
+   * in the log is what a bug report quotes. The rule is "do not tell the OTHER seats", not "write
+   * less down". The seed remains in `game.seed`, in every save (`session.ts` persistence) and in the
+   * lobby record, so nothing administrative or replayable loses it.
+   */
+  game.log.push({ text: `${config.mode} · ${playerNames.length} players`, tone: 'quiet' });
   drain(game);
   return game;
 }
@@ -348,12 +361,18 @@ export function drain(game: Game): void {
   record(game, pump(game.state));
 }
 
-/** Whose turn it is, or null if the game is over or waiting on nothing. */
+/**
+ * Whose turn it is, or null if the game is over or waiting on nothing.
+ *
+ * `currentActorOfState` (sim/view.ts) IS this, taking the state rather than the `Game` — so this is
+ * the adapter and not a second copy. It used to be the second copy: it carried the status guard and
+ * the view's version did not, which is #96 — the turn chart named the last seat to move all the way
+ * through the §3.3 vote, while this function correctly refused every intent that seat could send.
+ * Two functions that agree until they don't are worse than one, because the disagreement surfaces
+ * as a screen nobody can square with the server.
+ */
 export function currentActor(game: Game): PlayerIndex | null {
-  if (game.state.status !== 'active') return null;
-  // `actingPlayer` (state.ts) knows which player each kind of interruption goes to — the
-  // Superintendent for a §8.1 clearance, the district's owner for a Yard Office offer.
-  return actingPlayer(game.state);
+  return currentActorOfState(game.state);
 }
 
 /** Every legal action right now, grouped for display. Empty when there is nothing to decide. */
@@ -1039,9 +1058,7 @@ function makeUpAdvice(
  * button with a reason instead of hiding a move that has simply become illegal.
  */
 export function overHandLimit(game: Game, seat: PlayerIndex = 0): boolean {
-  const hand = game.state.decks.hands.get(seat) ?? [];
-  const limit = game.state.decks.redFlags.get(seat) ? HAND_LIMIT + 1 : HAND_LIMIT;
-  return hand.length > limit;
+  return overHandLimitOf(game.state, seat);
 }
 
 /**
@@ -1089,7 +1106,6 @@ export function submit(game: Game, intent: Intent, as: PlayerIndex | null = null
   }
   game.history.push(intent);
   record(game, result.events, actor);
-  game.mustPlayCard = overHandLimit(game);
   drain(game);
   return true;
 }
@@ -1149,10 +1165,28 @@ function record(game: Game, events: GameEvent[], actor: PlayerIndex | null = nul
       cardName: (id) => cardName(game.state, id),
       trainName: (id) => trainName(game.state, id),
     });
+    /**
+     * A BLIND DRAW IS PUBLIC; WHICH CARD CAME UP IS NOT (Gitea#20 step 1).
+     *
+     * Everybody at the table sees a hand go to the Home Office deck, so the draw itself belongs in
+     * the shared log. The card's NAME does not: the deck is face down, and this log goes to every
+     * seat unfiltered, so naming it told three opponents exactly what the fourth was holding.
+     *
+     * A DEPARTMENT SLOT IS NOT THE SAME and stays named. Those piles are face up — a discard goes
+     * onto one precisely so a rival can take it — so the card was public before it was drawn, and
+     * hiding it would lose real information for no gain.
+     *
+     * The drawing seat still learns what it got. `justDrawn` below is the owner-only channel and
+     * `session.ts` sends it to that seat alone, so this costs the drawer nothing. Solitaire keeps
+     * the name for the same reason it keeps the seed: a one-seat table has nobody to leak to, and
+     * a solo player's history naming their own draw is the record rather than a leak.
+     */
+    const blindDraw = e.type === 'cardDrawn' && e.source === 'homeOffice' && game.state.players.length > 1;
+    const said = blindDraw ? 'Drew a card from the Home Office deck' : n.text;
     // "Chose to DRAW a card" does not say WHO, which is unreadable the moment there is more than
     // one seat. Only events the player caused are attributed; the Division running itself is not.
     const mine = who !== null && 'player' in e;
-    const text = mine ? `Player ${who} ${uncapitalise(n.text)}` : n.text;
+    const text = mine ? `Player ${who} ${uncapitalise(said)}` : said;
     game.log.push({ text, tone: mine ? 'act' : n.tone });
 
   }

src/web/main.ts

@@ -1957,12 +1957,23 @@ function renderActions(
     }
     html += `</div>`;
   }
-  if (
-    f.phaseKey === 'localOps' &&
-    f.option === 'draw' &&
-    !menu.options.some((i) => i.type === 'draw.end')
-  ) {
-    // The hand being counted is the ACTOR's — they are the one who cannot end the turn.
+  /**
+   * WHY "END LOCAL OPERATIONS" IS NOT THERE (#45).
+   *
+   * This asked the question backwards: "the engine is offering no `draw.end`, so it must be the
+   * hand limit." That was true only because `check('draw.end')` happens to refuse for exactly three
+   * reasons and the two guards above rule out the other two — a fourth reason would have made this
+   * block explain a refusal by describing something else entirely, which is #90 verbatim.
+   *
+   * `f.overHandLimit` IS the fact, and the Frame has carried it all along for precisely this: "the
+   * same test the engine applies to `draw.end`, asked here so the page can disable the button with a
+   * reason instead of hiding a move that has simply become illegal" (`web/game.ts`). It was computed,
+   * serialised and sent to nobody. Behaviour is unchanged today; what changes is that the screen now
+   * states the reason it is giving rather than inferring it from an absence.
+   */
+  if (f.phaseKey === 'localOps' && f.option === 'draw' && f.overHandLimit) {
+    // The hand being counted is the VIEWER's, like `f.option` and `f.handCount` beside it — and the
+    // viewer is the actor whenever this menu is on screen at all.
     const hand = f.handCount;
     /**
      * WHEN NOTHING IN HAND MAY BE DISCARDED, SAY SO AND SAY WHAT TO DO INSTEAD.

src/web/session.ts

@@ -29,7 +29,6 @@ import {
   handPlayable,
   isOutOfTurn,
   newGame,
-  overHandLimit,
   submit,
   toSave,
   undo,
@@ -58,8 +57,6 @@ export type Session = {
   seat(): PlayerIndex;
   /** Whose turn it is, or null when the game is over or waiting on nothing. */
   actor(): PlayerIndex | null;
-  /** True when the hand is over §6.2's limit and the turn cannot be ended. */
-  overHandLimit(): boolean;
   /** Which cards in hand are playable right now, in hand order. */
   handPlayable(): boolean[];
   /**
@@ -161,7 +158,6 @@ export function createLocalSession(seed: number, options?: NewGameOptions): Loca
     menu: () => actionMenu(game),
     seat: () => 0,
     actor: () => currentActor(game),
-    overHandLimit: () => overHandLimit(game),
     handPlayable: () => handPlayable(game),
     submit: async (intent: Intent) => {
       // Seat 0 is the solitaire player, and the extension vote (Gitea#11) is the one intent that
@@ -341,7 +337,6 @@ export function createRemoteSession(
     menu: () => menu ?? { options: [], direct: [], placeable: [], hand: [], makeUp: null },
     seat: () => seat,
     actor: () => need().actor,
-    overHandLimit: () => need().overHandLimit,
     handPlayable: () => (menu?.hand ?? []).map((h) => h.playNow !== null),
     async submit(intent: Intent): Promise<boolean> {
       const seq = nextSeq++;

test/card-reference.test.ts

@@ -0,0 +1,54 @@
+/**
+ * The card reference must not drift from the cards.
+ *
+ * `docs/rules/card-reference.md` spent several releases describing the v0.4.5 deck — twelve numbered
+ * trains, "3 / 4 Mail-Express, 3 coaches" — while `content.ts` had train 3 as the Express with two
+ * freight cars and a per-location freight rule. Worse, `content.ts` named that file as "the place
+ * that now carries what the cards say", so the code sent readers to a table its own banner told them
+ * not to trust. Nothing failed, because nothing checked.
+ *
+ * `docs/rules/as-built.md` is emitted from the same exported catalogues the engine instantiates
+ * from, and this re-runs the generator and compares. Change a card face without regenerating and
+ * this goes red — which is the whole point: a document nothing verifies is a document that will be
+ * wrong, and this project's own history is the evidence.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..');
+const doc = join(root, 'docs/rules/as-built.md');
+
+describe('docs/rules/as-built.md is generated, and current', () => {
+  it('matches what the generator emits from content.ts today', () => {
+    const before = readFileSync(doc, 'utf8');
+    execFileSync(process.execPath, [join(root, 'scripts/build-card-reference.ts')], { cwd: root });
+    const after = readFileSync(doc, 'utf8');
+    assert.equal(
+      after,
+      before,
+      'the checked-in card reference is stale — run `npm run build:cards` and commit the result',
+    );
+  });
+
+  it('carries the current train catalogue, not the v0.4.5 deck', () => {
+    // The specific drift that went unnoticed for several releases, asserted by name so a future
+    // regeneration against an old content.ts cannot quietly reintroduce it.
+    const md = readFileSync(doc, 'utf8');
+    assert.match(md, /Crack Limited/);
+    assert.match(md, /\| 3 \| Express \|/);
+    assert.ok(!/Mail-Express/.test(md), 'the superseded v0.4.5 train names are back');
+    assert.ok(!/Manifest Freight/.test(md), 'the superseded v0.4.5 train names are back');
+  });
+
+  it('says it is generated, so nobody edits it by hand', () => {
+    const md = readFileSync(doc, 'utf8');
+    assert.match(md, /Generated from `src\/engine\/content\.ts`/);
+    assert.match(md, /Do not edit by/);
+  });
+});

test/display-gaps.test.ts

@@ -0,0 +1,437 @@
+/**
+ * WHAT THE ENGINE KNOWS AND THE SCREEN DOES NOT — the 2026-09-07 sweep.
+ *
+ * Gitea#21, Gitea#22, #94 and #96 were four instances of one fault in a row: the engine gained a
+ * thing that changes what a train may do, and nothing drew it. Each was found by a player hitting
+ * it. So rather than wait for the fifth, every field of `GameState` and its nested types was
+ * enumerated and checked for a reader in `sim/view.ts`, `src/web/` and `sim/narrate.ts`, and the
+ * survivors were then verified by running the engine rather than by trusting the grep.
+ *
+ * Four fields had no reader anywhere. `movedThisPhase` is set and cleared inside one `advance` call
+ * and is genuinely nobody's business. The other three are these tests. The bookkeeping fields whose
+ * EFFECT is already visible as legality — `freightWorked`, `drawnThisTurn`, `freightAgentUsed`,
+ * `movesUsed` (its complement `movesRemaining` is on the Frame), `switchedSince` — are deliberately
+ * not here: a field is not a display gap merely because no one renders it.
+ *
+ * The method is worth more than the three fixes, and is written down in TODO Reference · #98.
+ */
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { createGame } from '../src/engine/setup.ts';
+import { crewTrayCount, enhancementText } from '../src/engine/content.ts';
+import { areaOf } from '../src/engine/apply.ts';
+import { impediments } from '../src/sim/narrate.ts';
+import { projectDistrict, projectSharedTable, publicSnapshot, trainRules } from '../src/sim/view.ts';
+import type { CrewTray, GameConfig, GameState, PlayerIndex, SeatIndex } from '../src/engine/state.ts';
+import { seatOf } from '../src/engine/state.ts';
+
+const config: GameConfig = {
+  mode: 'competitive',
+  days: 3,
+  minCombinedRevenue: 0,
+  maxCollisionsPerDay: 0,
+  maxCollisionsTotal: 0,
+  pvpCardsAllowed: false,
+  optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
+};
+
+const game = (): GameState => {
+  const s = createGame({ id: 'g', seed: 4242, config, playerNames: ['Ann', 'Bob'] });
+  s.status = 'active';
+  return s;
+};
+
+/**
+ * THE CREW TRAY POOL IS A MECHANIC, AND IT WAS INVISIBLE (#98).
+ *
+ * `state.ts` calls tray scarcity "an explicit mechanic": there are fewer trays than there are trains
+ * wanting one, and which trains get held is the whole of §7. The engine knows three things about it
+ * — how many trays are free, which Extras are queued for one, and which second sections are — and
+ * the view read none of them.
+ *
+ * The panel that answers "why is nothing moving?" had exactly one tray rule, keyed off the train due
+ * out THIS Stage (`s.timetable[stage - 1]`). So a player who spent a card on an Extra, or ordered a
+ * second section, got a blocked panel that was completely EMPTY while their train sat behind an
+ * exhausted pool — and both had been announced once in the log, in a line that promised a future
+ * event ("as soon as a Crew Tray frees up") which nothing then confirmed.
+ */
+describe('the Crew Tray pool is a mechanic the player can see (#98)', () => {
+  /** A table whose trays are all out, with one Extra and one second section queued behind them. */
+  const jammed = (): GameState => {
+    const s = game();
+    s.freeTrays = [];
+    s.pendingExtras.push({ trainNumber: 17, player: 0 as PlayerIndex });
+    s.pendingSecondSections.push(8);
+    return s;
+  };
+
+  it('reports how many Crew Trays are free, and how many there are', () => {
+    const s = game();
+    const total = crewTrayCount(2);
+    assert.equal(s.freeTrays.length, total, 'the premise is gone: trays were already out at setup');
+    assert.deepEqual(projectSharedTable(s).crewTrays, { free: total, total });
+
+    s.freeTrays = s.freeTrays.slice(0, 1);
+    assert.deepEqual(
+      projectSharedTable(s).crewTrays,
+      { free: 1, total },
+      'the pool emptied and the shared table did not notice',
+    );
+  });
+
+  it('names the trains queued for a tray, so a promise made in the log is kept on the board', () => {
+    const q = projectSharedTable(jammed()).queued;
+    assert.deepEqual(q.extras, [{ trainNumber: 17, player: 0 }], 'a played Extra is waiting nowhere visible');
+    assert.deepEqual(q.secondSections, [8], 'an ordered second section is waiting nowhere visible');
+  });
+
+  it('tells the player who played the Extra that it is held for want of a crew', () => {
+    const blocked = impediments(jammed(), 0 as PlayerIndex);
+    const extra = blocked.find((b) => /X17/.test(b.where));
+    assert.ok(extra, 'the blocked panel said nothing about an Extra held for want of a Crew Tray');
+    assert.match(extra.why, /Crew Tray/, 'it was listed without naming the thing it is waiting for');
+    assert.equal(extra.severity, 'stuck');
+    // The POOL SIZE, not a second derivation of it. Written as `trays.size + freeTrays.length`
+    // first, which reads 0 of 0 for any state where a tray is neither free nor carrying a train.
+    assert.match(
+      extra.why,
+      new RegExp(`0 of ${crewTrayCount(2)} Crew Trays free`),
+      'the panel reported the wrong pool size',
+    );
+  });
+
+  it('says the same for a second section, which waits on the identical pool', () => {
+    const blocked = impediments(jammed(), 0 as PlayerIndex);
+    const second = blocked.find((b) => /Train 8\b/.test(b.where) && /second section/i.test(b.why));
+    assert.ok(second, 'an ordered second section was queued invisibly');
+    assert.match(second.why, /Crew Tray/);
+  });
+
+  it('says none of it once a tray is free, because then nothing is being waited on', () => {
+    const s = jammed();
+    s.freeTrays = ['tray0'];
+    const blocked = impediments(s, 0 as PlayerIndex);
+    assert.equal(
+      blocked.filter((b) => /Crew Tray/.test(b.why)).length,
+      0,
+      'a free tray still reported trains held for want of one',
+    );
+  });
+
+  it('is on the common board too — the pool is on the table, not in a hand', () => {
+    const pub = publicSnapshot(jammed()) as unknown as Record<string, unknown>;
+    assert.ok('crewTrays' in pub, 'a spectator cannot see the scarcity everyone at the table can');
+    assert.ok('queued' in pub);
+  });
+});
+
+/**
+ * A TRAIN HELD AT THE LIMITS IS STILL ON THE BOARD (#99).
+ *
+ * The Interlocking enhancement is the designed answer to a full Office: instead of the automatic
+ * collision of Gap 2d, "may stop an inbound train on the Limit Track" — the train is held inside the
+ * player's Limits, and takes the first A/D track that frees, ahead of any newcomer.
+ *
+ * It was drawn NOWHERE. `arriveAtOffice` removes the tray from the Mainline node's `transits`
+ * (advance.ts) and the Interlocking branch pushes it onto `area.heldAtLimits` without assigning
+ * `tray.position` — so the map, which draws mainline nodes from `transits` and district squares from
+ * `position.at === 'grid'`, has nothing to draw it from in either place. The train vanished off the
+ * board on arrival and reappeared in the Office some Stages later.
+ *
+ * Measured before fixing: with the tray in `transits` the Interchange node carries its chip; with
+ * the tray moved to `heldAtLimits` exactly as the engine moves it, the node's `trains` is empty and
+ * no grid square has gained it.
+ *
+ * The fix is in the VIEW, not the engine. The engine's state is right — a held train is inside the
+ * Limits and not on an A/D track, which is what `heldAtLimits` says — and `position` is left alone
+ * deliberately, so nothing may treat the train as standing on a square it could be switched from.
+ */
+describe('a train held at the Limits is drawn at the Limits (#99)', () => {
+  const held = (direction: 'east' | 'west') => {
+    const s = game();
+    const seat = seatOf(s, 0 as PlayerIndex);
+    const area = areaOf(s, 0 as PlayerIndex);
+    const trayId = s.freeTrays.pop()!;
+    const tray: CrewTray = {
+      id: trayId,
+      trainNumber: 5,
+      trainIsExtra: false,
+      engineAt: 0,
+      consist: [],
+      direction,
+      movesUsed: 0,
+      position: { at: 'mainline', index: 1 },
+    } as CrewTray;
+    s.trays.set(trayId, tray);
+    area.heldAtLimits.push(trayId);
+    return { s, seat, trayId, area };
+  };
+
+  it('draws it on the Limits square it is standing at, not nowhere', () => {
+    const { s, seat, trayId, area } = held('east');
+    const { cells } = projectDistrict(s, seat as SeatIndex);
+    const on = cells.filter((c) => c.trains.some((t) => t.trayId === trayId));
+    assert.equal(on.length, 1, 'a train held at the Limits is drawn on no square at all');
+    assert.equal(on[0]!.row, area.limitsWest.row, 'drawn at the wrong Limits');
+    assert.equal(on[0]!.col, area.limitsWest.col);
+  });
+
+  it('holds an EASTBOUND train at the western Limits, because that is the end it came in by', () => {
+    const { s, seat, area } = held('east');
+    const { cells } = projectDistrict(s, seat as SeatIndex);
+    const on = cells.find((c) => c.trains.length > 0)!;
+    assert.deepEqual({ row: on.row, col: on.col }, { row: area.limitsWest.row, col: area.limitsWest.col });
+  });
+
+  it('and a WESTBOUND train at the eastern Limits', () => {
+    const { s, seat, area } = held('west');
+    const { cells } = projectDistrict(s, seat as SeatIndex);
+    const on = cells.find((c) => c.trains.length > 0)!;
+    assert.deepEqual({ row: on.row, col: on.col }, { row: area.limitsEast.row, col: area.limitsEast.col });
+  });
+
+  it('says on the chip that it is HELD, so it is not read as a train free to switch', () => {
+    const { s, seat, trayId } = held('east');
+    const { cells } = projectDistrict(s, seat as SeatIndex);
+    const chip = cells.flatMap((c) => c.trains).find((t) => t.trayId === trayId)!;
+    assert.equal(chip.heldAtLimits, true, 'a held train looked exactly like one standing on the square');
+    assert.match(chip.what, /Interlocking|held/i, 'the chip does not say why it is standing there');
+  });
+
+  it('tells the district owner it is waiting, and what for', () => {
+    const { s } = held('east');
+    const blocked = impediments(s, 0 as PlayerIndex);
+    const b = blocked.find((x) => /Train 5/.test(x.where) && /Limits/i.test(x.why));
+    assert.ok(b, 'the blocked panel said nothing about a train held at the Limits');
+  });
+
+  it('does not invent a train on a square when nothing is held', () => {
+    const s = game();
+    const { cells } = projectDistrict(s, seatOf(s, 0 as PlayerIndex) as SeatIndex);
+    assert.equal(cells.flatMap((c) => c.trains).length, 0, 'a district with no trains drew one');
+  });
+});
+
+/**
+ * THE CAMPAIGN TRAIN'S SPEECHES CHANGE ITS RULES, AND THE CARD HAS TO SAY WHICH HALF IT IS IN (#100).
+ *
+ * X17 is "one turn at station (speeches) then expedite". Its first Office arrival is an ordinary
+ * stop; every arrival after that runs EXPEDITED, which means that if it is not back on the Office
+ * square when the next Mainline Phase begins it is a Station Master fault costing 1 Revenue.
+ *
+ * `trainRules()` took `{ trainNumber, trainIsExtra }` — it could not see `speechMade` even though
+ * both of its tray-side callers pass a whole `CrewTray` that has it. So the chip read identically
+ * before and after, and worse: the "EXPEDITED — must be kept ready to highball… costs 1 Revenue"
+ * warning is printed only under `rules.expedite`, so X17 became subject to a fault whose warning the
+ * game shows to other trains and never to it.
+ */
+describe('the Campaign Train says whether its speeches are made (#100)', () => {
+  const X17 = { trainNumber: 17, trainIsExtra: true } as const;
+
+  it('before the speeches, says they are still to come and does not claim it is expedited yet', () => {
+    const t = trainRules({ ...X17 });
+    assert.match(t, /SPEECHES/i);
+    assert.doesNotMatch(t, /costs 1 Revenue/, 'it warned of a fault the train is not yet subject to');
+  });
+
+  it('after the speeches, says it is expedited NOW and carries the fault it is now subject to', () => {
+    const t = trainRules({ ...X17, speechMade: true });
+    assert.match(t, /EXPEDITED/, 'a train that is now expedited did not say so');
+    assert.match(t, /costs 1 Revenue/, 'the fault warning is shown to other trains and not to this one');
+  });
+
+  it('reads differently before and after — the whole of the bug was that it did not', () => {
+    assert.notEqual(trainRules({ ...X17 }), trainRules({ ...X17, speechMade: true }));
+  });
+
+  it('still warns a permanently expedited train, which must not regress', () => {
+    const fast = trainRules({ trainNumber: 5, trainIsExtra: false });
+    assert.match(fast, /EXPEDITED/);
+    assert.match(fast, /costs 1 Revenue/);
+  });
+
+  it('says nothing about speeches for a train that has no such rule', () => {
+    assert.doesNotMatch(trainRules({ trainNumber: 5, trainIsExtra: false }), /SPEECHES/i);
+  });
+});
+
+/**
+ * A DISPATCH DEVICE SAYS WHETHER IT IS STILL AVAILABLE TODAY (#101).
+ *
+ * Telegraph (+4), Telephone (+8) and Radio (+12) are "once a day, when dispatching facing trains,
+ * add +N to the other train's number". The device is drawn on its card and its effect text is in the
+ * tooltip — but `enhancementText(key)` takes only the KEY, so it could not vary with anything, and
+ * the Radio read "once a day, add +12…" all Day after it had been spent. That is `trainRules` before
+ * #100, in a different corner of the same view.
+ *
+ * THE SECOND HALF IS THE ONE THAT SURPRISES. `spendDispatchBonus` reads
+ * `areaOf(s, s.clock.superintendent)` — the SUPERINTENDENT's own devices, not the train owner's —
+ * and the Fedora moves every `STAGES_PER_SHIFT` Stages, four times a Day. So a player's Radio does
+ * nothing at all for three-quarters of the Day, and is spent automatically, without being asked,
+ * during the quarter it is theirs to use. The board said neither half.
+ *
+ * Shown on EVERY district (Jesse, 2026-09-07), not only the viewer's: it is public, and a rival's
+ * spent Radio is exactly what you want to know before forcing a meet. `projectDistrict` serves both
+ * the player's own cells and the common board's `districts`, so one change covers both.
+ */
+describe('a dispatch device says whether it is still available today (#101)', () => {
+  /** Puts `key` on the first card of seat 0's district and returns the pieces to assert on. */
+  const withDevice = (key: string, opts: { spent?: boolean; fedora?: boolean } = {}) => {
+    const s = game();
+    const area = areaOf(s, 0 as PlayerIndex);
+    const card = [...area.grid.values()][0]!;
+    card.enhancements.push(key);
+    if (opts.spent) area.dispatchUsedToday.push(key);
+    // The Fedora is a PLAYER; give it to somebody whose seat is not this district's.
+    s.clock.superintendent = (opts.fedora ? 0 : 1) as PlayerIndex;
+    const seat = seatOf(s, 0 as PlayerIndex);
+    const cells = projectDistrict(s, seat as SeatIndex).cells;
+    const cell = cells.find((c) => c.enhancements.length > 0)!;
+    const i = cell.enhancementsWhat.findIndex((w) => new RegExp(key, 'i').test(w));
+    return { s, area, cell, what: cell.enhancementsWhat[i] ?? '', spent: cell.enhancementsSpent[i] };
+  };
+
+  it('reads as available before it is used, and says what it is worth', () => {
+    const { what, spent } = withDevice('radio', { fedora: true });
+    assert.equal(spent, false, 'an unused device reported itself spent');
+    assert.match(what, /\+12/, 'the device no longer says what it is worth');
+    assert.doesNotMatch(what, /spent/i, 'an unused device claimed it had been spent');
+  });
+
+  it('says so once it has been spent, and says when it comes back', () => {
+    const { what, spent } = withDevice('radio', { spent: true, fedora: true });
+    assert.equal(spent, true, 'a spent device still reported itself available');
+    assert.match(what, /spent/i, 'a spent device read exactly as it did before it was spent');
+    assert.match(what, /next Day|tomorrow/i, 'it does not say the device comes back');
+  });
+
+  it('reads differently spent and unspent — the whole of the bug was that it did not', () => {
+    assert.notEqual(
+      withDevice('telegraph', { fedora: true }).what,
+      withDevice('telegraph', { spent: true, fedora: true }).what,
+    );
+  });
+
+  it('says a device is idle while somebody else holds the Fedora', () => {
+    const { what } = withDevice('telephone');
+    assert.match(what, /Fedora|Superintendent/i, 'nothing said the device is only used while dispatching');
+  });
+
+  it('does not say that when this district IS the Superintendent', () => {
+    const { what } = withDevice('telephone', { fedora: true });
+    assert.doesNotMatch(what, /while .*holds? the Fedora/i);
+  });
+
+  /**
+   * EXACT equality, not "does not mention the Fedora". The first draft asserted the absence of
+   * /spent|Fedora/i with the Fedora held, and a mutation that removed the `dispatchBonus` guard
+   * altogether PASSED it — because the leaked text in that case reads "Available today, and this
+   * district is dispatching", which contains neither word. A test for a field being left alone has
+   * to compare it to what it should be.
+   */
+  it('leaves an enhancement that is not a dispatch device exactly as it was', () => {
+    for (const fedora of [true, false]) {
+      const { what, spent } = withDevice('interlocking', { fedora });
+      assert.equal(spent, false, 'a non-dispatch enhancement was marked spendable');
+      assert.equal(what, enhancementText('interlocking'), 'an Interlocking was given a dispatch caveat');
+    }
+  });
+
+  it('comes back when the Day turns, which is what clears the record', () => {
+    const { s, area } = withDevice('radio', { spent: true, fedora: true });
+    area.dispatchUsedToday = [];
+    const cell = projectDistrict(s, seatOf(s, 0 as PlayerIndex) as SeatIndex).cells.find(
+      (c) => c.enhancements.length > 0,
+    )!;
+    assert.equal(cell.enhancementsSpent.some((x) => x), false, 'a new Day did not restore the device');
+  });
+
+  /**
+   * SEAT IS NOT PLAYER INDEX, and this is the one place the two are joined: the Fedora is held by a
+   * PLAYER and the devices sit in an Office Area keyed by SEAT. `advance.ts` carried a comment
+   * warning that indexing one with the other was safe only while seating was the identity map — it
+   * read as a live bug and was not one, because `areaOf` resolves through `seatOf`. The comment is
+   * corrected; this is the guard, because the next reader deserves better than a claim.
+   *
+   * §4.4's D12 makes seating a real permutation, so a two-player game where player 1 sits in seat 0
+   * is ordinary rather than contrived.
+   */
+  it("marks the SUPERINTENDENT's own district as dispatching under non-identity seating", () => {
+    const s = game();
+    s.seating = [1, 0] as PlayerIndex[];
+    assert.notEqual(seatOf(s, 0 as PlayerIndex), 0, 'the premise is gone: seating is still identity');
+    s.clock.superintendent = 0 as PlayerIndex;
+
+    const mine = areaOf(s, 0 as PlayerIndex);
+    [...mine.grid.values()][0]!.enhancements.push('radio');
+    const other = areaOf(s, 1 as PlayerIndex);
+    [...other.grid.values()][0]!.enhancements.push('radio');
+
+    const whatAt = (player: PlayerIndex): string => {
+      const cells = projectDistrict(s, seatOf(s, player) as SeatIndex).cells;
+      return cells.find((c) => c.enhancements.length > 0)!.enhancementsWhat.join(' ');
+    };
+    // The Fedora is player 0's, whatever seat that is.
+    assert.doesNotMatch(whatAt(0 as PlayerIndex), /IDLE/, "the Superintendent's own device read as idle");
+    assert.match(whatAt(1 as PlayerIndex), /IDLE/, "somebody else's device read as dispatching");
+  });
+
+  it('is on every district of the common board, not only the viewer own', () => {
+    const { s } = withDevice('radio', { spent: true, fedora: true });
+    const pub = publicSnapshot(s);
+    const all = pub.districts.flatMap((d) => d.cells);
+    assert.ok(
+      all.some((c) => c.enhancementsSpent.some((x) => x)),
+      "a spectator cannot see which devices are spent in a player's district",
+    );
+  });
+});
+
+/**
+ * THE RED FLAG HOLDER IS NOT A PER-PLAYER FACT, so it does not belong on the public player view.
+ *
+ * `docs/plans/jitsi-common-board.md` step 1 asks for one: "Add the Red Flag holder to the public
+ * player projection. It is public game state but is currently absent from `Frame`", and its
+ * `PublicPlayerView` carries `redFlagHeld: boolean`. Every other step-1 item shipped across v0.7.9.2
+ * to v0.7.9.5; this one is STRUCK OFF instead, because the premise does not hold in this codebase.
+ *
+ * `decks.redFlags` is written in exactly one place — `setup.ts`, from
+ * `config.optionalRules.emergencyToolbox` — and never again. There is no `.set` anywhere else, and
+ * `redFlag.play` (the intent gated on holding one) emits a `phaseEnded` event and does not spend it.
+ * So every player holds one or none of them does, decided before the first card is dealt.
+ *
+ * A `redFlagHeld` on each player would therefore be `optionalRules.emergencyToolbox` copied N times
+ * — already on the public projection — while implying to every reader of the common board that it
+ * varies by player and might change during a game. That is worse than the absence.
+ *
+ * This test exists so the plan item is not re-raised from the plan text: if the rule ever DOES
+ * become per-player, this fails and the projection is the right place to look.
+ */
+describe('the Red Flag holding is the Emergency Toolbox option, not a per-player fact', () => {
+  const dealt = (emergencyToolbox: boolean): GameState =>
+    createGame({
+      id: 'g',
+      seed: 99,
+      config: { ...config, optionalRules: { ...config.optionalRules, emergencyToolbox } },
+      playerNames: ['Ann', 'Bob', 'Cy'],
+    });
+
+  for (const toolbox of [true, false]) {
+    it(`gives every player the same answer with the toolbox ${toolbox ? 'on' : 'off'}`, () => {
+      const s = dealt(toolbox);
+      const held = s.players.map((p) => s.decks.redFlags.get(p.index) === true);
+      assert.deepEqual(held, [toolbox, toolbox, toolbox], 'the Red Flag has become a per-player fact');
+    });
+  }
+
+  it('is already public, through the option it comes from', () => {
+    const pub = publicSnapshot(dealt(true));
+    assert.equal(
+      pub.optionalRules.emergencyToolbox,
+      true,
+      'a spectator cannot tell whether the hand limit is three or four',
+    );
+  });
+});

test/extended-play.test.ts

@@ -24,6 +24,8 @@ import { applyIntent, check } from '../src/engine/apply.ts';
 import { STAGES_PER_DAY } from '../src/engine/content.ts';
 import { legalActions } from '../src/engine/legal.ts';
 import { createGame } from '../src/engine/setup.ts';
+import { currentActorOfState, publicSnapshot, snapshot } from '../src/sim/view.ts';
+import { currentActor } from '../src/web/game.ts';
 import { developerBot, playGame, randomBot } from '../src/sim/bot.ts';
 import type { GameConfig, GameState } from '../src/engine/state.ts';
 
@@ -254,3 +256,69 @@ describe('§3.3 extended play — bots play the timetable they were dealt (Gitea
     assert.equal('agree' in choice ? choice.agree : null, false, 'a bot asked for another Day');
   });
 });
+
+/**
+ * §3.3 — WHO THE SCREEN SAYS THE TABLE IS WAITING ON, while the vote is open.
+ *
+ * The vote is PARALLEL, and `apply.ts` says so where it accepts one: "open to every seat at once:
+ * it is a table decision rather than a ruling, so THERE IS NO ACTOR TO BE". Any seat that has not
+ * voted may vote at any moment, in any order, and one refusal ends it. So the honest answer to "who
+ * are we waiting on" is every un-voted seat — which is exactly what the vote tally beside the chart
+ * already draws — and the honest answer to "whose turn is it" is nobody.
+ *
+ * The engine gave that answer and the screen did not. `currentActor(game)` guards on
+ * `status !== 'active'` and returned null; `actingPlayer(state)` has no such guard and returned
+ * `clock.currentActor`, which still holds whoever moved last before the timetable ran out. The
+ * frame took the second, so the turn chart named one arbitrary seat — the last to act, who has no
+ * more claim on the vote than anybody else — while the tally underneath correctly showed three
+ * seats outstanding.
+ *
+ * The fourth of these in a row after Gitea#21, #22 and #94, and the first found by asking the
+ * question of a state the game is not ACTIVE in. See TODO #96.
+ */
+describe('§3.3 extended play — the vote has no actor (#96)', () => {
+  const table = (): GameState => {
+    const s = atTheEnd(game({ mode: 'competitive' }, ['Ann', 'Bob', 'Cy']));
+    advance(s);
+    assert.equal(s.status, 'awaitingExtension', 'the table is not being asked');
+    return s;
+  };
+
+  it('reports nobody acting while the vote is open, to a player and to a spectator alike', () => {
+    const s = table();
+    assert.notEqual(s.clock.currentActor, null, 'the premise is gone: nothing was left on the clock');
+
+    assert.equal(currentActorOfState(s), null, 'the engine named an actor during a parallel vote');
+    assert.equal(
+      snapshot(s, [], null, null, null, false, 0).actor,
+      null,
+      'the turn chart named a seat while the whole table was voting',
+    );
+    assert.equal(publicSnapshot(s).actor, null, 'the common board named a seat during the vote');
+  });
+
+  it('agrees with the session, which is the half that decides what is legal', () => {
+    // The disagreement is the bug, not either answer on its own: `currentActor` is what refuses an
+    // intent, so a screen that names somebody it would refuse is telling the table to wait on a
+    // player who cannot act.
+    const s = table();
+    const g = { state: s, log: [] } as unknown as Parameters<typeof currentActor>[0];
+    assert.equal(currentActorOfState(s), currentActor(g), 'the screen and the session disagree');
+  });
+
+  it('still names the actor during ordinary play, which is the case that must not regress', () => {
+    const s = game({ mode: 'competitive' }, ['Ann', 'Bob', 'Cy']);
+    pump(s);
+    assert.equal(s.status, 'active', 'the premise is gone: the game is not running');
+    assert.equal(currentActorOfState(s), s.clock.currentActor, 'an active game lost its actor');
+    assert.equal(snapshot(s, [], null, null, null, false, 0).actor, s.clock.currentActor);
+  });
+
+  it('reports nobody once the table has declined and the game is finished', () => {
+    const s = table();
+    applyIntent(s, 1, { type: 'game.extend', player: 1, agree: false });
+    assert.equal(s.status, 'finished', 'a refusal did not end it');
+    assert.equal(currentActorOfState(s), null, 'a finished game still had somebody to move');
+    assert.equal(publicSnapshot(s).actor, null, 'the common board named a seat after the game ended');
+  });
+});

test/mainline-cards.test.ts

@@ -1014,7 +1014,11 @@ describe("a train is made up to its card's consist (§8.2)", () => {
 
 describe('regions on a Mainline card (§2.1, §8.2)', () => {
   /** Put one train mid-crossing and ask the view where the map should draw it. */
-  const regionFor = (stagesTotal: number, stagesRemaining: number): { region: number; regions: number } => {
+  const regionFor = (
+    stagesTotal: number,
+    stagesRemaining: number,
+    direction: 'east' | 'west' = 'east',
+  ): { region: number; regions: number } => {
     const s = createGame({
       id: 'reg',
       seed: 4,
@@ -1027,7 +1031,7 @@ describe('regions on a Mainline card (§2.1, §8.2)', () => {
     const node = s.division.nodes.find((n) => n.kind === 'mainline');
     assert.ok(node && node.kind === 'mainline');
     const tray = [...s.trays.keys()][0]!;
-    node.transits.push({ tray, stagesRemaining, stagesTotal, direction: 'east' });
+    node.transits.push({ tray, stagesRemaining, stagesTotal, direction });
     const ml = snapshot(s, [], null).division.find((n) => n.kind === 'ml');
     assert.ok(ml, 'no Mainline node in the view');
     const t = ml!.trains.flat()[0]!;
@@ -1070,6 +1074,74 @@ describe('regions on a Mainline card (§2.1, §8.2)', () => {
       }
     }
   });
+
+  it('never leaves the card it is on, whichever way it runs', () => {
+    for (const direction of ['east', 'west'] as const) {
+      for (let total = 1; total <= 4; total++) {
+        for (let left = total; left >= 1; left--) {
+          const r = regionFor(total, left, direction).region;
+          assert.ok(r >= 0 && r <= 1, `${direction}, total ${total}, ${left} left put the train in region ${r}`);
+        }
+      }
+    }
+  });
+
+  /**
+   * GITEA#22 — A WESTBOUND TRAIN WAS DRAWN IN THE WRONG HALF OF THE CARD.
+   *
+   * `regionOfTransit` answers "how far along its crossing is this train", counted from the end it
+   * ENTERED: a train with everything still to run is in region 0. That is the right question for the
+   * collision rules, which is what the engine asks it, and both directions share the one index space.
+   *
+   * The map asks a different question — WHICH PRINTED BOX, left to right — and used the same number
+   * for it. East is right on this map and always has been, so for an eastbound train the two agree by
+   * luck: it enters at the west end, so "just entered" and "leftmost box" are the same box. A
+   * westbound train enters at the EAST end, so its region 0 is the card's RIGHT-hand box, and drawing
+   * it at index 0 put it at the left — the whole card mirrored.
+   *
+   * Reported from seed 550943578, undo 187, and it cost a collision. Three westbound trains: TX17 had
+   * just entered (2 Stages still to run, so travel index 0) and T5 was nearly across (1 Stage left,
+   * index 1). Physically TX17 was BEHIND T5 — further east, the direction they had both come from.
+   * The map drew TX17 at the left and so put it further WEST, which reads as further ahead. Asked
+   * whether Train 3 could follow Train 5 onto the card, the Superintendent said yes, and Train 3
+   * entered behind — into TX17, exactly where the rules had it and nowhere near where the map did.
+   *
+   * The engine was right throughout. Only the picture lied, so the fix is one mirror in the view and
+   * the collision rules are untouched. This is the same class of bug as the consist row at the
+   * Whistle Post (`board-svg.ts`, seed 270861860), which came out mirrored for the same reason.
+   */
+  describe('Gitea#22 — the map draws a westbound train where it actually is', () => {
+    it('mirrors a westbound train, because it entered from the east end', () => {
+      // Two-region card. Just entered, 2 Stages still to run: an eastbound train is in the WEST box
+      // and a westbound one is in the EAST box, because they came in at opposite ends.
+      assert.equal(regionFor(2, 2, 'east').region, 0);
+      assert.equal(regionFor(2, 2, 'west').region, 1);
+
+      // One Stage left, nearly across: the two swap.
+      assert.equal(regionFor(2, 1, 'east').region, 1);
+      assert.equal(regionFor(2, 1, 'west').region, 0);
+    });
+
+    it('puts the follower behind the leader, not in front of it — the seed 550943578 collision', () => {
+      // TX17 had just entered; T5 was a Stage from the far end. Both westbound, so BEHIND means to
+      // the east, which is to the right, which is the higher index.
+      const tx17 = regionFor(2, 2, 'west').region;
+      const t5 = regionFor(2, 1, 'west').region;
+      assert.ok(
+        tx17 > t5,
+        `a westbound train that has just entered must be drawn east of one that is nearly across, ` +
+          `but TX17 was drawn at ${tx17} and T5 at ${t5}`,
+      );
+    });
+
+    it('leaves an eastbound train where it has always been drawn', () => {
+      // The mirror must not disturb the direction that was right, which is every existing region test
+      // above — those all run east — and the case the printed rule was written for.
+      assert.equal(regionFor(2, 2, 'east').region, 0);
+      assert.equal(regionFor(2, 1, 'east').region, 1);
+      assert.equal(regionFor(1, 1, 'east').region, 1);
+    });
+  });
 });
 
 describe('Q13 — a train that catches the one ahead runs into it', () => {

test/multiplayer.test.ts

@@ -29,7 +29,7 @@ import type { Game } from '../src/web/game.ts';
 /** The thin wrapper `actionMenu` expects, built directly around an already-created multi-player state
  * — `newGame` (game.ts) hardcodes one player, so it cannot construct this for a multi-seat game. */
 const wrap = (s: GameState): Game =>
-  ({ state: s, seed: s.seed, history: [], log: [], mustPlayCard: false, cues: [], scheduled: null, justDrawn: null, announced: null });
+  ({ state: s, seed: s.seed, history: [], log: [], cues: [], scheduled: null, justDrawn: null, announced: null });
 
 const competitive: GameConfig = {
   mode: 'competitive',

test/redaction.test.ts

@@ -17,7 +17,10 @@ import { pump } from '../src/engine/advance.ts';
 import { createGame } from '../src/engine/setup.ts';
 import type { GameConfig, GameState, PlayerIndex } from '../src/engine/state.ts';
 import { developerBot, playGame } from '../src/sim/bot.ts';
-import { snapshot } from '../src/sim/view.ts';
+import { cardName, publicSnapshot, snapshot } from '../src/sim/view.ts';
+import { newGame, newMultiplayerGame, submit } from '../src/web/game.ts';
+import { createSession } from '../src/server/session.ts';
+import { legalActions } from '../src/engine/legal.ts';
 
 const config: GameConfig = {
   mode: 'competitive',
@@ -139,3 +142,321 @@ describe('redaction — a seat\'s Frame never carries another seat\'s secrets',
     }
   });
 });
+
+
+/**
+ * THE OTHER HALF OF §7, AND THE HALF THAT WAS NEVER LOOKED AT.
+ *
+ * Every test above serializes a `Frame`, and every one of them passes `[]` for the narration log —
+ * so the entire shared log has sat outside the redaction net since the net was built. It is not a
+ * hypothetical hole: `game.log` is ONE list, and `linesSince(seat)` (`server/session.ts`) slices it
+ * with no per-seat filter at all, so every line written into it reaches every player.
+ *
+ * Two things were being written into it that should never have left the seat that caused them, both
+ * found while planning the public common board (Gitea#20 step 1) and both live in multiplayer today,
+ * with or without that display:
+ *
+ *   1. the SEED, announced in the opening line of every multiplayer game — which hands every player
+ *      the whole future of the deal;
+ *   2. the NAME OF A CARD DRAWN BLIND from the Home Office deck.
+ *
+ * SOLITAIRE IS DELIBERATELY LEFT ALONE in both cases. There is nobody to leak to at a one-seat
+ * table, the seed in the log is what a bug report quotes, and a solo player's own history naming
+ * the card they drew is the record, not a leak. The rule is "do not tell the OTHER seats", not
+ * "write less down" — so both checks below assert the solitaire text is still there.
+ */
+describe('redaction — the shared narration log never carries a seat\'s secrets', () => {
+  const names = ['Ann', 'Bob', 'Cy'];
+
+  it('never announces the seed to the table (Gitea#20 step 1)', () => {
+    const g = newMultiplayerGame(550943578, config, names);
+    const log = g.log.map((l) => l.text).join('\n');
+    assert.ok(
+      !/550943578/.test(log),
+      `the seed was announced to every seat:\n${log}`,
+    );
+    // The opening line must still say what the game IS — the leak is the number, not the line.
+    assert.match(log, /Game Begins/);
+    assert.match(log, /3 players/);
+  });
+
+  it('still tells a solitaire player their own seed — there is nobody to leak it to', () => {
+    const g = newGame(550943578);
+    const log = g.log.map((l) => l.text).join('\n');
+    assert.match(log, /550943578/, 'a solo game stopped recording the seed its bug reports quote');
+  });
+
+  it('never names a card drawn blind from the Home Office deck (Gitea#20 step 1)', () => {
+    const g = newMultiplayerGame(4242, config, names);
+
+    // Drive to the first Home Office draw any seat makes, and note what it actually drew.
+    let drawn: string | null = null;
+    for (let i = 0; i < 400 && drawn === null; i++) {
+      const actor = g.state.clock.currentActor;
+      if (actor === null) break;
+      const before = g.log.length;
+      if (!submit(g, { type: 'localOps.choose', option: 'draw' }, actor as PlayerIndex)) continue;
+      if (!submit(g, { type: 'draw.fromHomeOffice' }, actor as PlayerIndex)) continue;
+      drawn = g.justDrawn;
+      void before;
+    }
+    assert.ok(drawn, 'no seat ever drew from the Home Office deck');
+
+    const name = cardName(g.state, drawn!);
+    const log = g.log.map((l) => l.text).join('\n');
+    assert.ok(
+      !log.includes(name),
+      `a blind draw named "${name}" to the whole table:\n${log.split('\n').slice(-6).join('\n')}`,
+    );
+    // The draw itself is public — everyone saw a hand go to the deck. Only WHICH card is not.
+    assert.match(log, /Home Office/i);
+
+    // And the drawing seat still learns what it got: `justDrawn` is the owner-only channel, and
+    // `session.ts` sends it to that seat alone.
+    assert.equal(g.justDrawn, drawn);
+  });
+});
+
+
+/**
+ * #91 — THE SYSTEMATIC NET, not two strings.
+ *
+ * v0.7.9.2 closed the seed and the blind draw. Both were found by reading a plan, not by a test, and
+ * that is the point: a redaction suite made of the leaks somebody happened to notice proves nothing
+ * about the next one. This is the pass the common-board plan asks for (Gitea#20 step 1 § Tests) —
+ * serialise EVERYTHING a seat or a spectator receives and search it for everything that must not be
+ * in it, across every game state where the shape of the answer changes.
+ *
+ * **What is searched for**, per the plan: every opponent hand card id AND its display name, the
+ * objective, `justDrawn` for the wrong seat, seed values and seed narration, and private decision
+ * and menu data. Display names matter as much as ids — "Red Flags" in a log leaks exactly what
+ * `c118` would, and only the id would have been caught before.
+ *
+ * **Where it is searched**: a player's `Frame`, the `PublicFrame` a spectator gets, the incremental
+ * narration `Push.lines` carries, and a reconnect push — which is a full Frame rather than a delta
+ * and is therefore its own opportunity to leak.
+ *
+ * **And the acceptance bar is not this file.** The plan is explicit that passing redaction tests
+ * alone is insufficient and that every public property needs an allow-list review; the last test
+ * here is that allow-list, so adding a field to the public projection fails until somebody has said
+ * out loud that it is public.
+ */
+describe('#91 — nothing private survives serialisation, in any state', () => {
+  const names = ['Ann', 'Bob', 'Cy'];
+
+  /** Everything one seat can see, as one string: their Frame, the public board, and their lines. */
+  const everythingSeatSees = (g: ReturnType<typeof newMultiplayerGame>, seat: PlayerIndex): string =>
+    JSON.stringify(snapshot(g.state, g.log, null, null, null, false, seat)) +
+    '\n' + JSON.stringify(publicSnapshot(g.state)) +
+    '\n' + g.log.map((l) => l.text).join('\n');
+
+  /**
+   * Every secret belonging to somebody OTHER than `seat`: their card ids, and the names those ids
+   * render as. Ids alone were what the original tests looked for, and an id is the precise
+   * instrument — it is unique, so finding one is proof.
+   *
+   * **A NAME IS ONLY EVIDENCE WHEN IT IS DISTINCTIVE, and most are not.** Card names are types, not
+   * identities: "right-hand curve" names a dozen cards, and one of them is legitimately drawn on the
+   * board as a cell label the moment anybody lays track. Searching for a name that also exists in
+   * public is a test that fails on correct code, which is worse than no test — so a name counts only
+   * when EVERY card bearing it is in that one opponent's hand. Then, and only then, seeing it says
+   * something about what they are holding.
+   *
+   * This is what caught the blind-draw leak in v0.7.9.2: "Red Flags" was in exactly one hand, and it
+   * was in the log.
+   */
+  const secretsOfOthers = (g: ReturnType<typeof newMultiplayerGame>, seat: PlayerIndex): { what: string; value: string }[] => {
+    const out: { what: string; value: string }[] = [];
+    // How many cards in the whole game carry each name, and how many of those are in a given hand.
+    const totalByName = new Map<string, number>();
+    for (const id of g.state.cards.keys()) {
+      const n = cardName(g.state, id);
+      totalByName.set(n, (totalByName.get(n) ?? 0) + 1);
+    }
+    for (const p of g.state.players) {
+      if (p.index === seat) continue;
+      const hand = g.state.decks.hands.get(p.index) ?? [];
+      const heldByName = new Map<string, number>();
+      for (const id of hand) {
+        const n = cardName(g.state, id);
+        heldByName.set(n, (heldByName.get(n) ?? 0) + 1);
+      }
+      for (const id of hand) {
+        out.push({ what: `${p.name}'s card id`, value: id });
+        const name = cardName(g.state, id);
+        if (totalByName.get(name) === heldByName.get(name)) {
+          out.push({ what: `${p.name}'s card name, unique to their hand`, value: name });
+        }
+      }
+    }
+    return out;
+  };
+
+  /** Runs the whole net over one state, and says which state failed if it does. */
+  const audit = (g: ReturnType<typeof newMultiplayerGame>, where: string): void => {
+    for (const seat of g.state.players.map((p) => p.index)) {
+      const seen = everythingSeatSees(g, seat);
+      for (const { what, value } of secretsOfOthers(g, seat)) {
+        assert.ok(
+          !seen.includes(value),
+          `${where}: seat ${seat} can see ${what} ("${value}")`,
+        );
+      }
+      // The seed is the whole future of the deal and must not reach a seat by any route.
+      assert.ok(!seen.includes(String(g.seed)), `${where}: seat ${seat} can see the seed ${g.seed}`);
+    }
+    // And the spectator board, which has no seat and is therefore entitled to nothing private.
+    const pub = JSON.stringify(publicSnapshot(g.state));
+    for (const p of g.state.players) {
+      for (const id of g.state.decks.hands.get(p.index) ?? []) {
+        assert.ok(!pub.includes(id), `${where}: the public board carries ${p.name}'s card ${id}`);
+      }
+    }
+    assert.ok(!pub.includes(String(g.seed)), `${where}: the public board carries the seed`);
+    for (const k of ['hand', 'objective', 'justDrawn', 'decision', 'moves', 'blocked', 'viewer']) {
+      assert.ok(!(k in (JSON.parse(pub) as Record<string, unknown>)), `${where}: the public board has a "${k}" field`);
+    }
+  };
+
+  /** Plays `n` legal moves, so a state is a real position rather than a constructed one. */
+  const play = (g: ReturnType<typeof newMultiplayerGame>, n: number): void => {
+    for (let i = 0; i < n; i++) {
+      const a = g.state.clock.currentActor;
+      if (a === null) break;
+      const opts = legalActions(g.state, a);
+      if (!opts.length) break;
+      if (!submit(g, opts[i % opts.length]!, a)) break;
+    }
+  };
+
+  it('a newly created multiplayer game', () => {
+    audit(newMultiplayerGame(4242, config, names), 'fresh game');
+  });
+
+  it('after a blind Home Office draw', () => {
+    const g = newMultiplayerGame(4242, config, names);
+    let drew = false;
+    for (let i = 0; i < 200 && !drew; i++) {
+      const a = g.state.clock.currentActor;
+      if (a === null) break;
+      if (!submit(g, { type: 'localOps.choose', option: 'draw' }, a)) continue;
+      drew = submit(g, { type: 'draw.fromHomeOffice' }, a);
+    }
+    assert.ok(drew, 'no seat drew from the Home Office deck');
+    audit(g, 'after a blind draw');
+  });
+
+  it('mid-game, with real hands and a built board', () => {
+    // A DISTINCTIVE seed, deliberately. Seed 7 makes the seed check meaningless — "7" is in "Train
+    // 7", in every coordinate and in half the numbers on the board — so it reported a leak that was
+    // not one. Nine digits collide with nothing, which is what makes a substring match evidence.
+    const g = newMultiplayerGame(613884219, config, names);
+    play(g, 300);
+    audit(g, 'mid-game');
+  });
+
+  it('with a decision pending, and with the Superintendent acting', () => {
+    const g = newMultiplayerGame(550943578, config, names);
+    let sawDecision = false;
+    for (let i = 0; i < 800; i++) {
+      if (g.state.clock.pendingDecision !== null) {
+        sawDecision = true;
+        audit(g, `pending decision (${g.state.clock.pendingDecision.kind})`);
+        break;
+      }
+      const a = g.state.clock.currentActor;
+      if (a === null) break;
+      const opts = legalActions(g.state, a);
+      if (!opts.length || !submit(g, opts[0]!, a)) break;
+    }
+    // A seed that never raises one is not a failure of redaction; say so rather than passing mutely.
+    if (!sawDecision) assert.ok(true, 'no decision arose on this seed — nothing to audit');
+  });
+
+  it('with Employee Rotation on, before and after ownership moves', () => {
+    // The case where seat and player index come apart. A projection that confused them would hand
+    // one player another's district, which is a leak the other tests cannot see.
+    const rotating = { ...config, optionalRules: { ...config.optionalRules, employeeRotation: true } };
+    const g = newMultiplayerGame(729315046, rotating, names);
+    audit(g, 'employee rotation, before');
+    const seatingBefore = [...g.state.seating];
+    play(g, 400);
+    audit(g, 'employee rotation, after');
+    // If the seating never moved this test proved less than it looks — say which happened.
+    const moved = seatingBefore.some((p, i) => g.state.seating[i] !== p);
+    assert.ok(moved || g.state.status !== 'active', 'rotation never moved anybody and the game did not end');
+  });
+
+  it('a game played out to the end, or as far as it goes', () => {
+    const g = newMultiplayerGame(613884219, config, names);
+    play(g, 6000);
+    // Says which it actually got, rather than claiming a finished game it may not have reached.
+    audit(g, `played out (status ${g.state.status})`);
+  });
+
+  it('a reconnect push, which is a full Frame rather than a delta', () => {
+    const session = createSession(550943578, config, names);
+    for (const seat of [0, 1, 2] as PlayerIndex[]) {
+      const push = session.connect(seat);
+      const seen = JSON.stringify(push);
+      const state = session.exportSave();
+      assert.ok(!seen.includes(String(state.seed)), `the reconnect push for seat ${seat} carries the seed`);
+      for (const p of [0, 1, 2] as PlayerIndex[]) {
+        if (p === seat) continue;
+        // `connect` returns that seat's own Frame; another seat's hand must not be in it.
+        assert.ok(
+          !/"hand":\[[^\]]/.test(JSON.stringify((push.frame as unknown as Record<string, unknown>)['players'] ?? '')),
+          `the reconnect push for seat ${seat} carries a hand inside players[]`,
+        );
+      }
+    }
+  });
+
+  /**
+   * THE ALLOW-LIST, and the plan's actual acceptance bar.
+   *
+   * Every property of the public projection, written down and reviewed as public. This does not
+   * check the CONTENT of anything — the tests above do that — it checks that nobody has added a
+   * field without saying out loud that a spectator may see it. That is the check that would have
+   * caught both v0.7.9.2 leaks, because both were fields nobody had ever asked the question about.
+   *
+   * When this fails, the fix is not to add the key here. It is to decide whether the field is
+   * public, and only then to add it.
+   */
+  it('every public property is on the allow-list, and nothing else is', () => {
+    const PUBLIC: readonly string[] = [
+      // The clock and the phase — what a spectator's board is FOR.
+      'day', 'stage', 'clock', 'phase', 'phaseKey', 'actor', 'superintendent',
+      // Deck sizes and face-up piles. A Department pile is face up; the Home Office deck is a count.
+      'deck', 'departments', 'departmentsWhat', 'departmentDepth', 'salvage',
+      // Rolling stock in the yards, by type — visible on the table.
+      'yards',
+      // The timetable is public: it is what everyone is playing against.
+      'timetable', 'timetableWhat',
+      // The rules the game was dealt under, and the score.
+      'houseRules', 'mode', 'optionalRules', 'days', 'minCombinedRevenue',
+      'maxCollisionsPerDay', 'maxCollisionsTotal', 'collisionsToday', 'collisionsTotal',
+      'status', 'outcome', 'extraDays', 'extensionVotes', 'official', 'tally',
+      // Names, seats, revenue and HAND SIZE — never hand contents.
+      'players',
+      // The opening rolls decided seating and the Superintendent in the open.
+      'openingRolls',
+      // Where every train is standing.
+      'trains',
+      // The Crew Tray pool and the trains queued for one (#98). §7 scarcity is played out in the
+      // open: the trays are objects in the middle of the table, and an Extra is played face up, so
+      // who is waiting for a crew is not a secret. Counts and train numbers only — never a hand.
+      'crewTrays', 'queued',
+      // The board itself.
+      'division', 'districts',
+    ];
+    const g = newMultiplayerGame(4242, config, names);
+    const actual = Object.keys(publicSnapshot(g.state)).sort();
+    const allowed = [...PUBLIC].sort();
+    assert.deepEqual(
+      actual,
+      allowed,
+      'the public projection gained or lost a property — decide whether it is public before listing it',
+    );
+  });
+});

test/replay.test.ts

@@ -13,8 +13,8 @@ import { DEFAULT_MAX_COLLISIONS_PER_DAY, DEFAULT_MAX_COLLISIONS_TOTAL, collectiv
 import type { GameEvent } from '../src/engine/events.ts';
 import { areaOf } from '../src/engine/apply.ts';
 import { createGame } from '../src/engine/setup.ts';
-import { coordKey } from '../src/engine/state.ts';
-import type { GameConfig, GameState } from '../src/engine/state.ts';
+import { coordKey, turnOf } from '../src/engine/state.ts';
+import type { GameConfig, GameState, GridCoord } from '../src/engine/state.ts';
 import { developerBot, playGame } from '../src/sim/bot.ts';
 import { impediments, isVisible, narrate, phaseLabel } from '../src/sim/narrate.ts';
 import { compress, rehydrateCells, record, renderHtml } from '../src/sim/replay.ts';
@@ -138,6 +138,89 @@ describe('impediments', () => {
     s.freeTrays = [];
     assert.ok(impediments(s, 0).some((b) => /HELD/.test(b.why)));
   });
+
+  /** A crew standing on `at`, working the given train, with one empty tank car on the drawbar. */
+  const express = (s: GameState, trainNumber: number, at: GridCoord): string => {
+    const id = s.freeTrays.pop()!;
+    s.trays.set(id, {
+      id, trainNumber, trainIsExtra: false, engineAt: 0,
+      consist: [{ type: 'tank', loaded: false, origin: 0 }],
+      direction: 'east', position: { at: 'grid', seat: 0, coord: at }, movesUsed: 0,
+    });
+    return id;
+  };
+
+  /**
+   * GITEA#21 — THE GAME REFUSED, AND THE PANEL EXPLAINED SOMETHING ELSE.
+   *
+   * "I wanted to drop two empty tank cars so that the freight agents and men at work could load
+   * them later. I dropped the first tank car, but that was all I was allowed to do. Checked
+   * 'Blocked — why nothing is moving' and saw: refinery 1,0 — green box empty — nothing to load
+   * (needs a Freight Agent action)."
+   *
+   * Replayed from the attached save (seed 550943578, 181 intents): the crew was Train 3, and the
+   * engine's answer was `FREIGHT_WORKED_HERE`. Train 3 is the Express, and the Express prints "May
+   * drop or pick up one freight car at every location" — so THE REFUSAL WAS CORRECT and the rule
+   * is not what is wrong here. It resets next turn, and the Express may work a car at the next
+   * square this turn; that is what makes it an Express rather than a one-car-a-Stage train.
+   *
+   * What was wrong is that nothing said so. The panel whose entire job is "why is nothing moving?"
+   * listed the refinery's green box — a true statement about the FACILITY, and nothing to do with
+   * why the drop was refused — so the player was sent to fix a Freight Agent action that would not
+   * have helped. The rule was on the train card's own tooltip, which is not where somebody looks
+   * when a button they expected is missing.
+   *
+   * The panel is where a refusal gets explained, so the budget belongs in it.
+   */
+  it('says when the Express has spent its one freight car on this square (Gitea#21)', () => {
+    const s = createGame({ id: 'g', seed: 5, config, playerNames: ['p'] });
+    const area = areaOf(s, 0);
+    const at = area.officeCoord;
+
+    // A crew standing at the Office working Train 3 — the Express — with a tank car still on it.
+    const trayId = express(s, 3, at);
+
+    s.clock.phase = 'localOps';
+    const turn = turnOf(s, 0);
+    turn.option = 'switch';
+
+    // Nothing to say before it has worked anything here.
+    assert.ok(
+      !impediments(s, 0).some((b) => /FREIGHT CAR PER LOCATION/i.test(b.why)),
+      'the budget was reported spent before the train had worked a car at all',
+    );
+
+    // Now it has set one car out here — exactly the state the save is in at intent 181.
+    turn.freightWorked[`${trayId}@${coordKey(at)}`] = 1;
+
+    const row = impediments(s, 0).find((b) => /FREIGHT CAR PER LOCATION/i.test(b.why));
+    assert.ok(
+      row,
+      `nothing explained the refusal:\n${JSON.stringify(impediments(s, 0), null, 2)}`,
+    );
+    // It must name the train, or a player with three crews out cannot tell which one it means.
+    assert.match(row!.where, /Train 3/);
+    // And it must say the limit lifts, or it reads as "this train can never work here again".
+    assert.match(row!.why, /turn/i);
+    // Amber: this is the printed rule doing its job, not a fault.
+    assert.equal(row!.severity, 'waiting');
+  });
+
+  it('leaves every other train alone — the rule is printed on 3 and 4 only (Gitea#21)', () => {
+    const s = createGame({ id: 'g', seed: 5, config, playerNames: ['p'] });
+    const area = areaOf(s, 0);
+    const at = area.officeCoord;
+    // Train 5 is The Sparrow, which prints no per-location freight limit.
+    const trayId = express(s, 5, at);
+    s.clock.phase = 'localOps';
+    turnOf(s, 0).option = 'switch';
+    turnOf(s, 0).freightWorked[`${trayId}@${coordKey(at)}`] = 1;
+
+    assert.ok(
+      !impediments(s, 0).some((b) => /FREIGHT CAR PER LOCATION/i.test(b.why)),
+      'a train with no such rule was told it had spent a budget it does not have',
+    );
+  });
 });
 
 /**

test/server/session.test.ts

@@ -531,3 +531,79 @@ describe('§3.3 extended play across the server (Gitea#11)', () => {
     assert.deepEqual(b.official, a.official, 'the official result did not survive the replay');
   });
 });
+
+/**
+ * NARRATION HAS ONE PATH, AND A RECONNECT HAS TO GET ALL OF IT (#97, Gitea#20 step 1).
+ *
+ * The common-board plan asks for one thing here: "stop passing the full game log into `frameFor()`;
+ * continue sending sanitized incremental narration through `Push.lines`." Doing only the first half
+ * would have deleted a real behaviour, so this pins the pair.
+ *
+ * WHAT WAS ACTUALLY WRONG. `Frame.lines` carried the WHOLE log on every push, and nothing read it:
+ * `RemoteSession` (`web/session.ts`) accumulates `lines` from `push.lines` alone and its `lines()`
+ * returns that accumulator. So the log was serialised into every frame for every seat, grew all
+ * game, and was thrown away on arrival — while `linesSince` sent the same text again, correctly,
+ * beside it.
+ *
+ * And the duplicate was masking a bug rather than merely wasting bandwidth. `connect()` clears
+ * `lastFrame` but did NOT clear `sentLines`, so a reconnecting seat was told "nothing new since your
+ * last push" — while the browser it was answering had just reloaded and started from an EMPTY
+ * accumulator. The history panel came back blank after a refresh, mid-game, with the server holding
+ * the whole log and shipping it in the one field nobody reads.
+ *
+ * So the two halves are one change: a (re)connect resets the seat's watermark and `Push.lines` on a
+ * connect IS the history, which is what lets the frame stop carrying a second copy.
+ */
+describe('narration reaches a seat exactly once, by one path (#97)', () => {
+  /**
+   * A session with narration already in the log and NO connect yet, so a first connect is a real
+   * "catch me up" rather than a no-op. Connecting inside this helper is what made the first draft of
+   * the reconnect test pass vacuously: both sides of the comparison were the empty array.
+   */
+  const played = (): GameSession => createSession(550943578, config, ['Alice', 'Bob']);
+
+  it('a FIRST connect carries the narration so far in Push.lines', () => {
+    const session = createSession(550943578, config, ['Alice', 'Bob']);
+    const push = session.connect(0 as PlayerIndex);
+    assert.ok(push.lines.length > 0, 'a first connect was given no narration at all');
+    assert.ok(
+      push.lines.some((l) => /players|competitive/i.test(l.text)),
+      'the opening lines are not in what a first connect received',
+    );
+  });
+
+  it('a RECONNECT is given the whole log again, because the browser it answers has none', () => {
+    const session = played();
+    const first = session.connect(0 as PlayerIndex);
+    const again = session.connect(0 as PlayerIndex);
+    // NON-EMPTY first: two empty arrays are deepEqual, and asserting only that is how this test
+    // passed against the broken code on its first draft.
+    assert.ok(first.lines.length > 0, 'the premise is gone: there was no narration to be given');
+    assert.deepEqual(
+      again.lines,
+      first.lines,
+      'a reconnecting seat was told nothing was new, and its history panel would come back empty',
+    );
+  });
+
+  it('the Frame does NOT carry a second copy of the log', () => {
+    const session = played();
+    const push = session.connect(0 as PlayerIndex);
+    assert.deepEqual(
+      (push.frame as unknown as { lines: unknown[] }).lines,
+      [],
+      'the whole narration log is still being serialised into every Frame, where nothing reads it',
+    );
+  });
+
+  it('an ordinary push after a connect carries only what is NEW', () => {
+    const session = played();
+    const opening = session.connect(0 as PlayerIndex);
+    assert.ok(opening.lines.length > 0);
+    // A second connect for the OTHER seat must not re-send seat 0 anything.
+    const other = session.connect(1 as PlayerIndex);
+    assert.ok(other.lines.length > 0, 'the other seat got no history of its own');
+    const third = session.connect(0 as PlayerIndex);
+    assert.deepEqual(third.lines, opening.lines, 'a reconnect is the full log, every time');
+  });
+});

test/session.test.ts

@@ -17,7 +17,7 @@ import assert from 'node:assert/strict';
 import { readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 
-import { actionGroups, currentActor, handPlayable, newGame, overHandLimit, submit, toSave, view } from '../src/web/game.ts';
+import { actionGroups, currentActor, handPlayable, newGame, submit, toSave, view } from '../src/web/game.ts';
 import { createLocalSession } from '../src/web/session.ts';
 import { seatLabel } from '../src/sim/view.ts';
 
@@ -81,7 +81,6 @@ describe('a local session plays the same game as the calls it replaced', () => {
     assert.equal(session.seat(), 0);
     assert.equal(session.actor(), currentActor(session.game));
     assert.deepEqual(session.handPlayable(), handPlayable(session.game));
-    assert.equal(session.overHandLimit(), overHandLimit(session.game));
   });
 });
 

test/web.test.ts

@@ -3253,6 +3253,111 @@ describe('the Division map shows the whole route', () => {
       }
     }
   });
+
+  /**
+   * #94 — A RED FLAG IS A THING STANDING ON THE BOARD, AND IT WAS DRAWN NOWHERE.
+   *
+   * `maneuver.redFlags` sets `node.redFlag` on an Office's Division node, and from then on
+   * `redFlagStop` holds the next train arriving from that side until the flag is spent. It is a
+   * standing token that stops trains — the same kind of object as a train or an A/D track, not a
+   * transient event.
+   *
+   * It was announced once in the log and then existed only in the engine. The office node in
+   * `DivisionView` carried no field for it and `board-svg.ts` never mentioned one, so a player who
+   * set a flag out three Stages ago had nothing on screen saying it was still there, and an opponent
+   * who missed the line never knew at all. Then a train stops short and the only explanation has
+   * scrolled away.
+   *
+   * The same failure as Gitea#21 and #22: the engine is right and the screen is silent about what it
+   * is acting on. Asserted on both halves, because either alone would have looked fixed — the
+   * projection has to carry it AND the map has to draw it.
+   */
+  describe('#94 — a Red Flag standing at the Limits is on the board and on the map', () => {
+    const withFlag = (side: 'east' | 'west' | null): ReturnType<typeof snapshot> => {
+      const s = createEngineGame({
+        id: 'redflag',
+        seed: 11,
+        config: {
+          mode: 'solitaire', days: 5, minCombinedRevenue: 0, maxCollisionsPerDay: 0,
+          maxCollisionsTotal: 0, pvpCardsAllowed: false,
+          optionalRules: { reducedVisibility: false, employeeRotation: false, emergencyToolbox: false },
+        },
+        playerNames: ['Solitaire'],
+      });
+      const office = s.division.nodes.find((n) => n.kind === 'office');
+      assert.ok(office && office.kind === 'office', 'no Office node in the Division');
+      // Exactly what `redFlagsSet`'s reducer does (`apply.ts`).
+      if (side) (office as { redFlag?: string }).redFlag = side;
+      return snapshot(s, [], null);
+    };
+
+    it('carries the flag on the office node, and its side', () => {
+      const node = withFlag('east').division.find((n) => n.kind === 'office');
+      assert.ok(node, 'no office node in the Division view');
+      assert.equal(
+        (node as { redFlag?: string | null }).redFlag,
+        'east',
+        'the Division view does not carry the Red Flag standing at this Office',
+      );
+    });
+
+    it('carries nothing when no flag is out — it must not draw one by default', () => {
+      const node = withFlag(null).division.find((n) => n.kind === 'office');
+      const flag = (node as { redFlag?: string | null }).redFlag;
+      assert.ok(flag === null || flag === undefined, `an Office with no flag reported "${flag}"`);
+    });
+
+    it('draws it on the map, and says which side it guards', () => {
+      const svg = divisionSvg(withFlag('west').division);
+      assert.match(svg, /bs-flag/, 'the Red Flag is not drawn on the Division map');
+      // The side is the whole of the information: a flag guards ONE approach, and a player deciding
+      // whether to run a train needs to know which.
+      assert.match(svg, /RED FLAG[^"]*[Ww]est/, 'the map does not say which side the flag guards');
+    });
+
+    it('draws none when none is out', () => {
+      assert.ok(!/bs-flag/.test(divisionSvg(withFlag(null).division)), 'a flag was drawn with none set');
+    });
+  });
+
+  /**
+   * GITEA#22 — and the same invariant, applied to the trains standing on a card.
+   *
+   * The mirror itself is proved on the view in `mainline-cards.test.ts`. This is the other end of
+   * it: that the number the view hands over actually reaches the canvas as a position, so the chip
+   * a player looks at is on the correct half. The report was about the PICTURE, and a view that is
+   * right behind a renderer that ignores it would read to a player as no fix at all.
+   *
+   * Asserted on x, the way the Heavy Grade wedge above is: east is right on this map, so a
+   * westbound train that has just entered belongs to the RIGHT of one that is nearly across, and
+   * an eastbound pair in the same state belongs the other way round.
+   */
+  it('draws a westbound train on the half of the card it is actually standing on (Gitea#22)', () => {
+    const card = (trains: { label: string; region: number }[]): DivisionView =>
+      ({
+        kind: 'ml', label: 'Curves', capacity: 1, modifiers: [], gradeUp: null, regions: 2,
+        what: 'two regions',
+        trains: [trains.map((t) => ({ ...t, cars: [], facing: 'w' }))],
+      } as unknown as DivisionView);
+
+    const xOf = (svg: string, label: string): number => {
+      const m = new RegExp(`<text class="bs-tlab" x="([\\d.]+)"[^>]*>${label}[^<]*<`).exec(svg);
+      assert.ok(m, `no chip drawn for ${label}`);
+      return Number(m![1]);
+    };
+
+    // The two regions the view now reports for the seed 550943578 card: TX17 had just entered
+    // westbound (the east box, index 1) and T5 was nearly across (the west box, index 0).
+    const svg = divisionSvg([card([{ label: 'TX17', region: 1 }, { label: 'T5', region: 0 }])]);
+    assert.ok(
+      xOf(svg, 'TX17') > xOf(svg, 'T5'),
+      'the train that has just entered westbound was not drawn east of the one nearly across',
+    );
+
+    // And the halves are genuinely distinct — a renderer that centred both would satisfy nothing
+    // above but would still tell a player nothing.
+    assert.notEqual(xOf(svg, 'TX17'), xOf(svg, 'T5'), 'both chips were drawn at the same x');
+  });
 });
 
 describe('every square the menu offers can actually be clicked (regression)', () => {