Prototype voluntary seat handover with durable private retries

Let a current owner issue, cancel or replace a private 24-hour one-time offer.
Recipients accept the same faction and saved game while old browser sessions,
recovery keys and entry receipts lose authority. Preserve exact claim retries
across refresh, restart and later offers, with private tab-scoped continuation.

Fence every claim mutation to its winning transaction. Add durable receipts
and additive backfill for already-issued offers without changing game JSON or
existing seat authority. Block competing navigation during unresolved owner
operations; remove invalidated owner kits on confirmed recovery.

Record the pending CHOAM Nexus after-victory secrecy/window decision without
inventing the unresolved gameplay or opening mode/publication gates.

Validation: types/lint and 4,364 offline tests passed; production build passed;
43 HTTP tests passed. Added 19 offline and 3 HTTP regressions. Independent
privacy/persistence review passed, including deterministic CAS interleavings,
rollback, legacy migration and exact receipt restoration. Browser room 2EMYG4CY
retained private setup choices after handover/refresh and continued into Storm;
follow-up recovery removed its invalid offer with cards/forces/spice unchanged.
All 218 opening rooms preserved (291 after QA and both broad runs). The opening
456 seat, 49 recovery-key, 56 recovery-receipt and 106 entry-receipt rows were
also verified unchanged. Server reused; no restart or recurring automation.

Final private report: ~/.local/share/dune/checkpoints/20260913-seat-handover/
verification-final/report.json. Source fingerprint:
8949cdf58eb8bc8bd33f2657c6b21352b3ee5e17e2a556c684a89073015632f4.
Check/build/HTTP duration: 140565/6689/24835 ms. The earlier broad run passed;
a final recovery-UI review fix required the second source-bound run.
Goal aggregate counter 64,301,976 -> 65,031,751 before Git (729,775) for this
bounded capability and its concurrency/recovery review; full goal remains active.

docs/NEXUS_CHOAM_SECRET_ALLY.md

@@ -40,6 +40,44 @@ combinations remain part of the later integration pass.
   server restart is required. Recovery validates the already-paid outcome and
   retires the discard; it never credits spice a second time.
 
+## After-victory inspection audit
+
+The other printed Secret Ally choice applies only after its holder wins a
+battle. It inspects exactly one random Treachery Card held by the opposing
+combatant that the opponent did not use in that battle. Normal and traitor
+wins qualify. Mutual-traitor and Lasgun-shield explosion results have no winner
+and do not. “Used” is the physical set already produced by the battle quote for
+the opponent, including a Cheap Hero, cards played in weapon or defense slots
+and a late Portable Snooper. A used card remains excluded if another effect
+later retains it. The effect neither transfers nor discards the inspected card.
+
+The battle engine must preserve the opposing used-card IDs with the resolved
+battle event before mandatory loser disposal. The existing Auditor candidate
+filter is reusable because it removes exact physical used IDs from the current
+opposing hand. The Nexus effect still needs its own one-card sampler and receipt;
+it must not borrow Auditor survival, payment or cancellation behavior. A
+successful use discards the held CHOAM Nexus card once, records the sampled
+snapshot once and projects the face only to its holder. The public chronicle may
+name the use, winner and opponent, but not the inspected face.
+
+The safe continuation point is the existing final `finishBattle` board boundary:
+after mandatory and optional battle-card cleanup, Moritani retention, battle
+income, technology, capture, Auditor, Face Dance and Caladan reinforcement, and
+before another battle or phase begins. No existing choice occurs at that point
+for every possible winner. Opening a pause only when the winner secretly holds
+the CHOAM Nexus card would reveal that hidden identity. Precommitting a
+conditional use before the result would remove the printed after-victory choice.
+A universal use-or-pass window would preserve secrecy and the full choice, but
+would also ask winners without the card to pass. The user has been asked which
+product exception to adopt; no timing policy is implemented while that answer
+is pending.
+
+The retrieved Nexus sources neither establish an ordinary Karama response to
+this Secret Ally play nor grant blanket Nexus immunity. The Collection trade is
+currently direct and this inspection must not inherit the native Auditor's
+Karama/payment window by analogy. Cancellation remains an explicit later audit
+boundary rather than an invented prototype rule.
+
 ## Focused evidence and remaining scope
 
 Run `npm test -- nexus-choam-trade`. Focused cases cover Basic/Advanced payment,