host

type ClosedPrivacyContract struct {
	// Options is the registry's base options; the contract sets LoadDeck
	// (decks "bot" and "human"), Seats, ThinkTimeout, MaxIntents and the
	// unbounded-search knobs over it.
	Options Options
	// Policy is the registered closed-list policy under test; its seats are
	// built with bots.New(Policy, ...).
	Policy string
	// Belief is the belief the policy was enabled with: its corpus is
	// public knowledge, so a card in it is never secret.
	Belief *searchprobe.Belief
	// BotDeck is the policy's own deck; HumanDeck and HumanSideboard the
	// human's. Every card of the human's that is in neither the belief nor
	// BotDeck is secret; the fixture must yield at least 8 secret names.
	BotDeck, HumanDeck, HumanSideboard []*cards.Card
	// Seeds are the games played, one single-shot human table each.
	Seeds []uint64
}

type ContractRun struct {
	Info protocol.MatchInfo
	// Log is a copy of the match's event log (seed, events, intents).
	Log *events.Log
	// Reason is the match's end or crash reason.
	Reason string
	// RootRefusals counts the honest roots the host refused (BP-08).
	RootRefusals int
	// Feeds reports whether the match kept observation feeds (an Env seat).
	Feeds bool
}

type ContractT interface {
	Helper()
	Logf(format string, args ...any)
	Errorf(format string, args ...any)
	Fatalf(format string, args ...any)
	Cleanup(func())
}

type Deck struct {
	Name      string
	Cards     []*cards.Card
	Sideboard []*cards.Card
	// Archetype is the deck file's authoring archetype (deck.File.Archetype),
	// "" when it declares none. The loader carries it so a seat's own prior
	// rides rules.Config.Archetypes into deck.Manifest and reaches
	// view.View.OwnDeck. It never reaches an event.
	Archetype string

	Commanders []int
}

type EnvLeakContract struct {
	// Options builds the registries the row drives (a deck loader serving
	// "a" and "b" at least). The row overrides nothing in it.
	Options Options
	// Policy names the policy in messages.
	Policy string
	// NewSeat builds a FRESH seat of the policy for one match (a hosted bot
	// carries its own RNG state, so the two driven matches never share one).
	NewSeat func(actor uint64) seat.Seat
	// ViewPath selects the View-path spy, for a policy that implements no
	// heuristic.BoardSeat (sb-tactical and the SpellBench adapters): a spy
	// with a DecideBoard would send the host down a branch the policy never
	// takes in production. It forwards seat.PaymentPlanConsumer and
	// bots.RefusalAnswerer.
	ViewPath bool
	// Probe, when non-nil, places the swap at the first decision the seat
	// actually SEARCHED (found by a deterministic unswapped pre-pass of the
	// same seed and seats) and re-verifies that both matches searched it:
	// a search that skips a decision without consulting its world source
	// would otherwise make the row vacuous.
	Probe *SearchProbe
	// PlannerOf, when non-nil, returns the planner the policy's seat (the
	// one NewSeat built) holds after answering; at the asserted boundary it
	// must be the honest root the Env carried, in both matches (the §5.1
	// SetPlanner routing). It returns the planner as an any so this
	// signature names no engine type.
	PlannerOf func(seat.Seat) any
}

type ErrBeyondHead struct{ Head uint64 }

type FeedbackLog struct {
	events.Log
	Head        string         `json:"head"`
	IntentCount int            `json:"intent_count"`
	Turn        int32          `json:"turn"`
	Step        string         `json:"step"`
	Priority    state.PlayerID `json:"priority"`
	Active      state.PlayerID `json:"active"`
}

type FeedbackMatch struct {
	Table        string              `json:"table"`
	Match        int                 `json:"match"`
	Seed         uint64              `json:"seed"`
	Seats        []protocol.SeatInfo `json:"seats"`
	Names        []string            `json:"names"`
	PlayerNames  []string            `json:"player_names,omitempty"`
	Decks        []string            `json:"decks"`
	DeckCards    [][]string          `json:"deck_cards"`
	Sideboards   [][]string          `json:"sideboards,omitempty"`
	Spectator    string              `json:"spectator"`
	State        string              `json:"state"`
	Result       string              `json:"result,omitempty"`
	Winner       *uint8              `json:"winner"`
	Head         string              `json:"head,omitempty"`
	Events       int                 `json:"events"`
	Turns        int32               `json:"turns"`
	Reason       string              `json:"reason,omitempty"`
	Mulligans    int                 `json:"mulligans,omitempty"`
	Format       Format              `json:"format,omitempty"`
	StartingLife int32               `json:"starting_life,omitempty"`
	Commanders   [][]int             `json:"commanders,omitempty"`
	// StartChooser mirrors the sidecar's field of the same name: the
	// configured seat posed CR 103.1's starting-player choice in place of
	// the toss winner (E3-2). It is genesis replay input like Mulligans —
	// the genesis Note names the chooser — so a replay rebuilt from
	// match.json alone needs it recorded. Absent = the toss, which every
	// match before E3 used.
	StartChooser *int   `json:"start_chooser,omitempty"`
	BotPolicy    string `json:"bot_policy"`

	// NameUniverse and NameUniverseNames mirror the sidecar's fields of the
	// same names, and for the same reason the deck contents and the token
	// scripts are here: a name-card universe is a match MODE, not data the
	// log can recover. A match played with one poses NameCard asks the
	// legacy no-universe path never poses, so a replay rebuilt from
	// match.json alone with the mode missing finds no decision pending at
	// the recorded intent and refuses. NameUniverseNames is the immutable
	// sorted label list that match actually offered, so a corpus addition
	// or rename after the report was filed cannot renumber a recorded
	// numeric name choice. A capture from a pre-feature match carries
	// neither field, which reads back as the legacy path (R-8.4).
	NameUniverse bool `json:"name_universe,omitempty"`
	// NameUniverseNames is stripped from a COMMITTED fixture (it is ~24k
	// entries, half a megabyte per fixture): the committed shape keeps only
	// the mode bit and the replay re-derives the list from the live corpus,
	// diverging on a corpus pin move exactly the way a token-stripped
	// fixture does, and saying so.
	NameUniverseNames []string `json:"name_universe_names,omitempty"`

	// PaidManaCensus mirrors the sidecar's field of the same name: whether the
	// live match ran with the widened paid-cost mana census. Like the name
	// universe it is a match MODE, not data the log can recover — the census
	// changes the offered option list, so a replay rebuilt from match.json
	// alone without the bit takes a different option list and diverges at the
	// first census-sensitive decision. A pre-flip capture carries no field,
	// which reads back as census OFF (the narrow census those matches ran).
	PaidManaCensus bool `json:"paid_mana_census,omitempty"`

	// Tokens carries the raw token scripts — keyed by file stem, the exact
	// spelling a card's TokenScript$ parameter uses — behind the match's
	// rules.Config.Tokens. rules.Config.Tokens is replay input (rules.New
	// copies it onto Game.Tokens, and events.Apply's TokenCreate case mints
	// from it), so a replay rebuilt from match.json alone needs it exactly
	// as it needed the deck contents: without it, the replayed engine's
	// effToken emits an "unknown token script" Note where the log records a
	// TokenCreate, and the replay diverges at that event.
	//
	// The scripts are shipped as text, not as compiled cards, because a
	// compiled *cards.Card cannot survive a JSON round trip: its derived
	// P/T, CMC and colour-identity fields are unexported (engine/cards/ir.go), so
	// a JSON decode would leave them zero — a 1/1 Goblin replayed as a 0/0.
	// A token Card IS fully determined by its script text, and the repro
	// tool recompiles each entry with cards.ParseBytes + Card.Link +
	// ApplyIntrinsics — the exact pipeline compileScripts runs the corpus
	// through — so the rebuilt cards are the ones the match played with.
	//
	// The whole cfg.Tokens is captured, not only the tokens some deck seems
	// to reference: the engine never enumerates which tokens a deck can
	// create (TokenScript$ reaches effToken through spell abilities,
	// triggers, replacements, keyword expansions and SVar bodies alike), so
	// any filtered capture could miss an indirect creator and reproduce the
	// very unknown-token divergence this field exists to prevent. The whole
	// pinned corpus's token text is ~150 KB, noise beside the snapshot cap.
	Tokens map[string]string `json:"tokens,omitempty"`

	// TokensUnread lists the tokens whose script text could not be read
	// back, as "<stem>: <reason>". The live match's cfg.Tokens holds the
	// compiled cards; only each card's own source path needs reading back,
	// and a miss (a corpus file moved or vanished since the match started,
	// or a synthetic token compiled from bytes with no file behind it) is
	// recorded here rather than dropped silently: a replay that later
	// reaches one of these stems will diverge the same way a missing
	// Tokens table would, and match.json says why.
	TokensUnread []string `json:"tokens_unread,omitempty"`
}

type FeedbackSnapshot struct {
	Match   FeedbackMatch
	Log     FeedbackLog
	View    *view.View
	ViewErr string
}

type Format uint8

type FrameType = protocol.FrameType

type HumanSeat struct {
	// contains filtered or unexported fields
}

type OnBurstFunc func(t TableID, k int, evs []events.Event, in *decision.Intent) error

type OnMatchEndFunc func(t TableID, k int, m protocol.MatchInfo) error

type OnRewindFunc func(t TableID, k int, toIntent int, headSeq uint64) error

type Options struct {
	Dir      string
	LoadDeck func(name string) (Deck, error)
	// Tokens is the token corpus the engine needs (rules.Config.Tokens):
	// the token definitions the decks in this match can create. Passed into
	// every rules.Config the host builds — live matches and the replays
	// that serve finished ones from disk — so a persisted match replays
	// with the same token definitions (Ruling FL-40).
	Tokens map[string]*cards.Card
	// NameUniverse is the compiled card corpus a NameCard decision ranges
	// over (rules.Config.NameUniverse): Pithing Needle names any card, a
	// land included, and this is the only source of names a seat has never
	// seen. Passed into every rules.Config the host builds, live and replay
	// alike, for the same reason Tokens is (the replay must offer the same
	// options the live match did).
	NameUniverse *cards.Universe
	// Sleep is the table's only clock read (PL-11): run calls it between
	// matches for Cooldown, and play calls it after every decision for
	// Pace. It must return once d elapses OR stop closes, whichever comes
	// first — that is what lets Close interrupt a table sitting in a long
	// cooldown or a slow pace (Ruling FL-18) instead of blocking up to d.
	// A nil Sleep gets defaultSleep, which does exactly that with a real
	// timer; it is the only place in the package that touches the clock,
	// so a caller wanting a faster-than-realtime test still goes through
	// this field rather than host reading time.Now/time.Sleep itself.
	Sleep func(d time.Duration, stop <-chan struct{})
	// Seats is an explicit embedder controller override. Nil selects the
	// table's named hosted policy through defaultSeats in play.
	Seats    func(names []string, seed uint64) []seat.Seat
	Sync     bool
	Ring     int
	Cooldown time.Duration
	// MaxIntents caps a whole match's total intent count (play's final
	// termination guard, 400000 by default — see match.go). It bounds a
	// match that will not terminate but says nothing about where it is
	// stuck, so it is a different question from MaxDecisionsPerTurn below.
	MaxIntents int
	// MaxDecisionsPerTurn is the host's progress guard for the stall that
	// keeps the SAME turn alive forever — the shape observed in the wild when
	// a bot re-offers one no-op action repeatedly (seed 175's 20000 intents
	// inside 2 turns; the measured 36 of 200 four-seat Commander games frozen
	// on main by a policy that kept re-activating an Equip on the creature
	// already carrying it). play counts decisions answered since the last
	// turn advance and, when the count reaches this limit with the turn
	// still unchanged, crashes the match with a stall reason and halts the
	// table through the ordinary crash path. Before this guard such a match
	// sat TableLive forever — the lobby showed LIVE, no match ever followed —
	// because Options.ThinkTimeout covers only a HumanSeat parked on a
	// decision, and a bot loop parks on nothing.
	//
	// The unit is a DECISIONS count, never a duration. A wall-clock watchdog
	// would make a match's outcome depend on how loaded the box was, which
	// destroys the determinism the whole engine is built on: the same seed
	// must produce the same event chain and the same result on every machine
	// and every replay (botbench's own watchdog is a -max-intents count for
	// the same reason). A turn that is merely LONG still passes: the counter
	// resets on every turn advance, and that reset is what distinguishes
	// "one very long turn" from "a turn that never ends". The measured
	// stall did ~10000 decisions per turn without the turn advancing; the
	// largest LEGITIMATE single turn across this repo's whole gate
	// population (2/4/6/8-seat sample-deck and legacy and Commander
	// repo-deck matches, 40+ games, measured for this task's sizing) is 244
	// decisions.
	//
	// DefaultMaxDecisionsPerTurn (25000) is the recommended production value
	// — 100x the measured legit ceiling above, and below the observed
	// stall's own ~10000-per-turn rate, so the stall class that froze the
	// demo trips within its third turn instead of freezing the table. 0 —
	// the zero value — means "no guard": every existing test and embedder
	// that never sets the field keeps exactly today's behaviour, so this
	// option is strictly opt-in. 0 ALSO disables the engine's own livelock
	// watcher (rules.Config.LoopGuard.Disabled, wired in match.go): the two
	// are the same non-terminating-loop protection at two levels, and the
	// engine aborting a game whose stall guard the embedder explicitly
	// turned off would defeat the opt-out.
	MaxDecisionsPerTurn int
	// ThinkTimeout is how long a HumanSeat parks on a decision before its
	// deterministic caretaker bot (the already-seeded bot for that slot) is
	// asked to answer in the player's place (Task M2b-3, D3). 0 — the default
	// — means "no timeout": the seat waits for a human SubmitIntent forever,
	// and only falls back to the caretaker when the table's context is
	// cancelled (a disconnected human seat must never wedge play, FL-17).
	// A non-zero value is a live clock read (host is the package allowed
	// time) that converts an unanswered decision into exactly the intent the
	// slot's bot would have produced, so a timed-out human game replays
	// byte-identically (the caretaker intent is committed to the log like any
	// other). The player may reconnect and answer later decisions via
	// SubmitIntent (D2).
	ThinkTimeout time.Duration
	// DefaultBotAutoPayMana is applied only while restoring a table written
	// before TableConfig recorded bot_auto_pay_mana. New tables always carry
	// their explicit setting, including false, so a restart preserves their
	// configured behaviour. gorged supplies its -bot-auto-mana startup flag
	// here to migrate an existing deployment when it first runs this build.
	DefaultBotAutoPayMana bool
	// DefaultBotCommonSense is the same restore-time migration for
	// TableConfig.BotCommonSense (the bots/sanity CommonSense guard): a table
	// written before TableConfig recorded bot_common_sense adopts the
	// server's -bot-common-sense startup flag when it is first loaded by this
	// build, while a new table's explicit setting — including false — always
	// survives a restart verbatim. Default false leaves every pre-field
	// deployment byte-identical to the unwrapped policies it served.
	DefaultBotCommonSense bool
	// MaxOnDemandTables bounds browser-created private tables retained by a
	// running process. 0 keeps the historical unlimited behaviour. A limit
	// refuses a new game instead of deleting a finished table: its private
	// join URL, feedback capture and replay routes remain valid until the
	// process restarts, when OnDemand's documented process-scoped cleanup
	// removes its config.
	MaxOnDemandTables int

	// SearchSlots bounds how many searched decisions run CONCURRENTLY across
	// the whole registry (BP-10, spec 2026-09-28-hosted-bot-packages §7): a
	// bot seat whose table-policy entry has Search set takes one slot around
	// its DecideEnv call (server/host/match.go parkSeat), and a decision that arrives
	// while every slot is held QUEUES — the host never degrades to another
	// policy, never shortens a search and never times one out, so intents
	// stay a pure function of the seed and the intent stream; only latency
	// varies with load. The queue is FIFO (a mutex plus a slice of waiter
	// channels — Go does not specify FIFO for a buffered-channel semaphore),
	// and the wait selects on the table's context, so Close turns a queued
	// decision into a match abort, not a crash. 0 — the zero value — means
	// unbounded, so embedders and tests that never set the field keep exactly
	// today's behaviour. gorged sets it from -bot-search-slots.
	SearchSlots int
	// MaxSearchTables bounds the LIVE on-demand tables whose policy entry has
	// Search set: AddTable refuses a new on-demand search table when that
	// many are already playing (live, not finished — a table that reached its
	// end frees its capacity), with the explicit refusal "search bots are at
	// capacity; choose a non-search policy". It mirrors the MaxOnDemandTables
	// check above and bounds the second memory term of §7 — each concurrent
	// search holds its honest root for the length of a decision. 0 means
	// unbounded. gorged sets it from -max-search-tables.
	MaxSearchTables int
	// BotSearchParallelism is passed into bots.Options.SearchParallelism for
	// every seat the registry builds from a table's named policy (§7): a
	// search entry's inner worlds fold in sequential order either way, so the
	// flag changes latency only, never intents. 0 leaves the entry's own
	// default. gorged sets it from -bot-search-parallelism.
	BotSearchParallelism int
	// BotDeps is the card dependency every hosted bot factory receives
	// (BP-13, spec §3.2): it rides bots.Options.Deps into every bots.New the
	// registry's table path makes — defaultSeatsWithAutoPayMana and the
	// caretaker (bot_policy.go) — so a policy whose factory reads printed
	// card facts (sb-tactical) can build. A zero Deps keeps every policy
	// already hosted before BP-13 unchanged and makes sb-tactical refuse at
	// seat-build time with its own error. gorged sets Cards to the opened
	// corpus registry.
	BotDeps bots.Deps
	// BotUnboundedDecisions, when true, builds every table bot with a zero
	// per-decision budget (bots.Options.DecisionDeadlineMS 0 = unbounded, the
	// bench/training posture) instead of the served default
	// hostedDecisionDeadlineMS. A determinism harness that compares two runs
	// of one seed must never arm a wall clock: a deadline bail-out answers
	// from the non-searched fallback and the two runs diverge (BP-07 §7
	// rejected a wall-clock budget for exactly this reason). False — every
	// existing caller, gorged included — leaves served behaviour
	// byte-identical.
	BotUnboundedDecisions bool

	// OnBurst, when non-nil, is invoked after every recorded burst of every
	// match created by this registry, including the genesis burst, so an
	// embedder sees the whole chain from its first event (Task M2c-1). It is
	// the SQLite-persistence hook for mtgserve. See OnBurstFunc for the
	// contract — most importantly, the callback runs on the match goroutine
	// holding the match lock and must not re-enter the Registry.
	OnBurst OnBurstFunc
	// OnMatchEnd, when non-nil, is invoked once per match once it reaches a
	// terminal state (finished, aborted or crashed), with that match's final
	// MatchInfo (Task M2c-1). See OnMatchEndFunc.
	OnMatchEnd OnMatchEndFunc
	// Series plans the matches of every table whose TableConfig.Series is
	// set (E3-2): before match k of a series table, run calls this hook with
	// the table's id and k (1 included) and plays the SeriesGame it returns —
	// the deck each SEAT plays (never rotated by k) and the seat posed CR
	// 103.1's starting-player choice (rules.Config.StartChooser; -1 keeps
	// the seeded toss). The hook runs on the table's own goroutine holding
	// no Registry or table lock and may block for minutes between the games
	// of a series — the players are sideboarding — so run takes no lock
	// around the call and a Registry.Close unblocks it through the hook's
	// ctx. ok=false ends the table (state idle) without playing match k; an
	// error halts it. The hook must return promptly once ctx is done and
	// must not call Registry.Close or Registry.Wait. Nil — every caller
	// before E3 — means no table may set TableConfig.Series (AddTable
	// refuses one).
	Series SeriesFunc
	// OnRewind, when non-nil, is invoked exactly once per undo an undo-capable
	// match performs, with the truncation point the match rewound to. See
	// OnRewindFunc (server/host/undo.go) — a sink that persists bursts through OnBurst
	// MUST implement it, or its stored chain keeps events the live match has
	// undone while later bursts re-use the same seq numbers for different
	// events.
	OnRewind OnRewindFunc
	// contains filtered or unexported fields
}

type Registry struct {
	// contains filtered or unexported fields
}

type SearchProbe struct {
	// Mark returns the number of diagnostics observed so far.
	Mark func() int
	// Searched reports whether diagnostics [from, to) record a decision the
	// seat really searched.
	Searched func(from, to int) bool
}

type SeriesFunc func(ctx context.Context, t TableID, k int) (g SeriesGame, ok bool, err error)

type SeriesGame struct {
	Decks   []string
	Chooser int
}

type Session struct {
	ID string
	// contains filtered or unexported fields
}

type TableConfig struct {
	ID    TableID  `json:"id"`
	Name  string   `json:"name"`
	Seats int      `json:"seats"`
	Decks []string `json:"decks"` // deck names for Options.LoadDeck; seat i of match k plays Decks[(i+k)%len]
	Seed  uint64   `json:"seed"`
	// BotPolicy selects the deterministic policy for every non-human seat and
	// human-seat caretaker. Empty is normalized to BotPolicy at registration,
	// so tables written before named policy selection retain production bot
	// behavior when restored.
	BotPolicy string `json:"bot_policy,omitempty"`
	// BotAutoPayMana makes every hosted bot and human-seat caretaker use
	// offered payment plans rather than manually tapping mana. It is part of
	// persisted table configuration so a restart preserves bot behaviour.
	BotAutoPayMana bool `json:"bot_auto_pay_mana"`
	// BotCommonSense opts every hosted bot and human-seat caretaker into the
	// bots/sanity CommonSense guard (bots.Options.CommonSense): hostile
	// removal the engine says can only hit the seat's own permanents or
	// player is dropped from the option list, and the London mulligan ask is
	// answered by botpolicy.MulliganConstructed. The guard changes the
	// intents a seat answers, so it is part of persisted table configuration
	// exactly like BotAutoPayMana: a table resumed after a restart must
	// rebuild the same seats or its replay diverges from the recorded log.
	// Default false, and a false seat is byte-identical to the unwrapped
	// policy, so a table written before the field existed replays unchanged.
	// Serialized explicitly (no omitempty) so the restore-time migration can
	// tell a pre-field file from a deliberate false the same way
	// bot_auto_pay_mana does.
	BotCommonSense bool `json:"bot_common_sense"`
	// AutoMana enables payment-plan publication and the Auto Mana controls for
	// human seats. Disabled is the legacy human path: plans are never sent to
	// a human client and only ordinary casts/manual mana are available.
	AutoMana bool `json:"auto_mana"`
	// WindowDiagnostics opts priority views into first-gate withholding reasons.
	WindowDiagnostics bool `json:"window_diagnostics"`
	// OnDemand marks a browser-created play-vs-bot table. These tables are
	// deliberately process-scoped: their seat credentials live only in the
	// gorged process, and a restart already aborts any game in progress. The
	// registry therefore drops them while loading a new process rather than
	// growing tables.json forever with abandoned one-shot games. Their match
	// logs are not the feedback archive: a submitted feedback report captures
	// its own replayable snapshot before this disposable table is removed.
	OnDemand bool `json:"on_demand,omitempty"`
	// PlayerNames names each seat, independently of its deck, for the wire's
	// player box (view.PlayerView.Name). Seat i of match k uses
	// PlayerNames[i]; a missing or short list falls back to the deterministic
	// "Player 1".."Player N" (seat-indexed, stable under replay). The deck
	// identity stays on Deck and on the engine's own Names.
	PlayerNames []string `json:"player_names,omitempty"`
	// Pace is the sleep after every decision; 0 plays as fast as possible.
	Pace      time.Duration   `json:"pace"`
	Spectator view.Visibility `json:"spectator"` // Public or Omniscient
	Perpetual bool            `json:"perpetual"`
	// Humans is the set of slot indices that are real people: a non-nil,
	// non-empty value makes the table single-shot and seats every listed slot
	// with a HumanSeat (driven from outside via Pending/SubmitIntent) instead
	// of a bot. nil (the default) means all bots — byte-identical to today.
	// The bot slots are the complement: every index in [0, Seats) that Humans
	// does not list, so a human index is disjoint from the bots by
	// construction once it is in range. A table with Humans must not also be
	// Perpetual (validation rejects that combination); a human-seated table
	// always ends at game over.
	Humans []int `json:"humans,omitempty"`
	// Mulligans is the London mulligan allowance: each player may take up to
	// this many mulligans in the pre-game round between the opening deal and
	// turn 1 (rules.Config.Mulligans). 0 — the zero value, and what every
	// table before M2e-5 played with — skips the round entirely, so a table
	// that never sets it behaves byte-identically to today. It travels on the
	// same TableConfig that seed/decks/names travel on, so both the live
	// match and a restart's replays rebuild the same rules.Config (R-8.4: the
	// replay's Config must carry it too, or a match played with a round stops
	// replaying). Negative values are rejected by validate.
	Mulligans int `json:"mulligans,omitempty"`
	// Format names the table's construction format: constructed (the zero
	// value, and every table before m39) or commander. A commander table
	// plays the CR 903 rules — 40 life (CR 903.6), a command zone built
	// from each seat's deck's commanders, the CR 903.8 tax and the CR
	// 903.10 clock — so every deck it deals must itself name a commander
	// (validate enforces it through the loaded Deck). Named on the wire
	// like Spectator; a tables.json written before the field existed loads
	// as constructed.
	Format Format `json:"format,omitempty"`
	// StartingLife overrides a game's opening life total; 0 (the zero
	// value) means the format's default — 20 constructed, 40 for a
	// commander table (CR 903.6) — so a commander table that never sets it
	// still plays 40. newMatch resolves the default once, on the copy it
	// builds the match from, and the resolved value travels on every
	// rules.Config and on its sidecar, so a replay rebuilds the life the
	// match actually played with.
	StartingLife int32 `json:"starting_life,omitempty"`
	// AllowDecklistBots opts a BOT-ONLY table into a bot policy that reads
	// every seat's real decklist (operator ruling 2026-10-13). An Env policy
	// (bots.Info.Env) builds its search root from every seat's true 40/60 —
	// server/host/botenv.go's envData hands searchseat.HonestRoot the table's
	// m.cfg.Decks — so "honest" redeals the hidden cards but the deck LIST
	// it redeals from is the opponent's real one. Such a policy is refused
	// at any table with a human, always, even with this opt-in; the bit only
	// ever matters on a table whose seats are all bots (a test, bench or
	// spectator game). A table written by an older binary without the field
	// loads as false, and restart skips a persisted table the new rule
	// refuses rather than failing the whole process.
	AllowDecklistBots bool `json:"allow_decklist_bots,omitempty"`
	// SeatBotPolicies names a bot policy per seat index: seat i of every match
	// is played by SeatBotPolicies[i] when that entry is non-empty, else by
	// BotPolicy. Like PlayerNames it never rotates with the decks. An entry
	// may not name a human seat, and may not name a policy that reads
	// opponents' decklists (bots.Info.Env). nil — every table before E1 —
	// builds every bot seat from BotPolicy exactly as before. Human-seat
	// caretakers always use BotPolicy.
	SeatBotPolicies []string `json:"seat_bot_policies,omitempty"`
	// Event names the draft event (eventhost) that owns this table. An event
	// table must be OnDemand and not Perpetual; it is exempt from
	// Options.MaxOnDemandTables because eventhost bounds its own events.
	// "" — every other table — changes nothing.
	Event string `json:"event,omitempty"`
	// Series hands the choice of every match's decks and starting-player
	// chooser to Options.Series; the table plays match after match until the
	// hook says stop. Requires Event. false — every other table — changes
	// nothing.
	Series bool `json:"series,omitempty"`
}

type TableID string