A member of a room is the engine's: the socket, the clock and the four sentences stop being the shooter's #334

src/rooms/hub.ts becoming the engine's (#321) is one end of a room. This is the other: src/client/session.ts is 178 lines of which only World, Player and Pressed are Counter-Strike. A socket whose binaryType is set, an open/closed/errored lifecycle, a count of ticks sent, a reused frame buffer, how long since the last frame landed, the four sentences a page shows about a connection and the threshold between them — every networked game on this engine needs exactly that, and none of it knows what a rifle is.

Without it, #326 writes the example a second copy of these 178 lines, which is the thing this direction exists to stop.

Waits on #319, which pins the current behaviour with session.test.ts first. This repository pins before it moves (#64, #101); this issue is the move.

Done looks like

• [ ] src/engine/member.ts behind the door: createMember takes connect, url, now and the game's codec — read a text frame into a control message, read a binary frame into the game's world, write one tick of input — and hands back the socket lifecycle, whether it is live, whether it was closed, the milliseconds since the last frame landed, the tick counter, and the connection's sentence.
• [ ] Generic in the world: the engine never names World, Player, Hello, applySnapshot or SNAPSHOT_FRAME. Which frame-kind byte is a snapshot is something the game states.
• [ ] The four sentences and BEHIND_MS are the game's text under the engine's rule, or the engine's default the game may replace — either is defensible, but the docstring says which and a test reads it.
• [ ] Every refusal that exists today survives and is tested behind the door with no browser: a text frame that does not parse, a binary frame whose first byte is not the snapshot kind, any frame before hello, a frame with no world, a press while the socket is not open, and data that is neither ArrayBuffer nor Uint8Array.
• [ ] Proved by a fake game: an engine test plays a whole room of plain objects through it — a hello, a roster, some snapshots, a drop — the way page.test.ts and #321's hub test do.
• [ ] src/client/session.ts keeps only the shooter's half: the world a hello builds, me and its bot = false, the roster onto bodies, the feed and messages with their eight-line caps, and own written onto the body. Its exported names (createSession, Session, Standing, Socket, the sentences) and its behaviour are unchanged, and #319's session.test.ts passes untouched — that is the proof.
• [ ] src/engine/index.ts and src/engine/surface.json gain the names; src/engine/GUIDE.md gains the section, in the shape its other sections have.
• [ ] Boundary, purity and independence tests pass; the shooter's bundle ceiling is unmoved — the code was already in it and only its address changed.
• [ ] bun test green.

Files

src/engine/member.ts and src/engine/member.test.ts (new), src/engine/index.ts, src/engine/surface.json, src/engine/GUIDE.md, src/client/session.ts, src/client/session.test.ts (from #319 — read it, do not rewrite it), src/client/main.ts if the call site moves.

Risks

• The seam is the codec. Keep it plain functions handed in — not a class, not an interface the game implements — or the engine starts owning the shooter's frame shapes through the back door.
• applySnapshot writes into a world and hands back own for the page to apply. That split is deliberate and is what #316's prediction hangs on: preserve it exactly, and do not let the engine decide what to do with own.
• If #316 is in flight it rewrites the same module. Land whichever is first and rebase the other; do not do both in one pull.
• The engine's purity probe fails on anything that touches window while it is evaluated — connect is handed in today and must stay handed in.

Suggested: Torque — it is a boundary, a clock and a list of refusals, and its proof is a headless play-through.