Add durable public and private table discussion

Humans can discuss plans publicly or message another human seat privately while
pending game decisions stay intact. The conversation panel provides plain text,
explicit recipient names and factions, saved history, private pagination and
exact retries through refresh. Human AI-control owners can still talk; bots do
not interpret messages or negotiate. Existing game actions execute agreements.

An additive indexed D1 message table stores discussion separately from game JSON,
versioning, readiness and bot continuation. Every read/insert checks active seat
credentials and membership; direct audiences and cursor lookups are filtered
before limiting. Public history has no private activity counts or sequential IDs.
Recovery/handover inherits seat history while fencing old credentials.

Independent review found two retry races: a rotation between a committed insert
and receipt read, and stale unmounted completion deleting a newer retry record.
Both are fixed with regressions. A prior uncertain retry stays pending on later
rejection. The nine focused offline cases and two HTTP cases cover production SQL,
concurrent/altered receipts, audience/cursor privacy, rotation/membership races,
actual saved-kit recovery and unchanged sealed setup state.

Types, lint, all 4963 offline tests, production build and 48 HTTP tests
pass on stable source. An initial check caught an invalid checklist status label;
that was corrected before the successful final2 verification.

Desktop browser checks send public/private messages, receive a peer reply, retain
private history after refresh and remove it on channel switch. Literal markup and
URLs remain text. Recipient and bystander API reads confirm the browser messages'
audiences. Screenshot capture was unavailable and the viewport override did not
take effect; mobile, full keyboard/visual and injected browser network-failure
acceptance remain open. No final rules, mode, AI or publication gate changes.

All 1373 pre-existing rooms, 2883 seats and auxiliary rows
are unchanged. SQLite integrity/foreign keys pass; migration 0007 adds messages
without replacing data. The healthy server was reused without restart.

Private evidence: 20260921-table-talk.
Verified source tree: 236dd55b6c15d55dbced735be67427e5fbd7fa348d583f119e67a03894ec21b0

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,19 @@
 # Dune implementation status
 
+## 21 September 2026 — durable table discussion prototype
+
+Public table conversation and direct human-seat messages now have usable controls,
+plain-text rendering, durable history and exact retries. Message SQL independently
+fences current credentials and membership, filters private channels before paging,
+and leaves game JSON/version, sealed choices and bot continuation unchanged.
+Recovery/handover transfers access to the seat's history; old credentials stop
+working. Independent review found and fixed committed-write/rotation and late
+unmounted-response retry races, with regressions. See [table discussion](TABLE_DISCUSSION.md)
+for the complete boundary. Final source-bound checks, browser observations,
+preservation and delivery records belong to the private checkpoint. AI messaging,
+prose-contract enforcement and full acceptance remain open; no mode gate changes.
+
+
 ## 21 September 2026 — Storm and Spice Blow practice
 
 The [interactive introduction](INTERACTIVE_INTRODUCTION.md) now has thirteen