Prototype voluntary seat handover with durable private retries

Let a current owner issue, cancel or replace a private 24-hour one-time offer.
Recipients accept the same faction and saved game while old browser sessions,
recovery keys and entry receipts lose authority. Preserve exact claim retries
across refresh, restart and later offers, with private tab-scoped continuation.

Fence every claim mutation to its winning transaction. Add durable receipts
and additive backfill for already-issued offers without changing game JSON or
existing seat authority. Block competing navigation during unresolved owner
operations; remove invalidated owner kits on confirmed recovery.

Record the pending CHOAM Nexus after-victory secrecy/window decision without
inventing the unresolved gameplay or opening mode/publication gates.

Validation: types/lint and 4,364 offline tests passed; production build passed;
43 HTTP tests passed. Added 19 offline and 3 HTTP regressions. Independent
privacy/persistence review passed, including deterministic CAS interleavings,
rollback, legacy migration and exact receipt restoration. Browser room 2EMYG4CY
retained private setup choices after handover/refresh and continued into Storm;
follow-up recovery removed its invalid offer with cards/forces/spice unchanged.
All 218 opening rooms preserved (291 after QA and both broad runs). The opening
456 seat, 49 recovery-key, 56 recovery-receipt and 106 entry-receipt rows were
also verified unchanged. Server reused; no restart or recurring automation.

Final private report: ~/.local/share/dune/checkpoints/20260913-seat-handover/
verification-final/report.json. Source fingerprint:
8949cdf58eb8bc8bd33f2657c6b21352b3ee5e17e2a556c684a89073015632f4.
Check/build/HTTP duration: 140565/6689/24835 ms. The earlier broad run passed;
a final recovery-UI review fix required the second source-bound run.
Goal aggregate counter 64,301,976 -> 65,031,751 before Git (729,775) for this
bounded capability and its concurrency/recovery review; full goal remains active.

game/reference.ts

@@ -213,12 +213,36 @@ export const RULE_TOPICS: RuleTopic[] = [
       'automatic-responses',
       'automatic-decisions',
       'ai-pacing',
+      'seat-handover',
       'ecaz-modules',
       'discoveries',
       'homeworlds',
       'advanced-combat',
     ],
   },
+  {
+    id: 'seat-handover',
+    title: 'Pass a seat to another player',
+    category: 'Getting started',
+    coverage: 'Partial',
+    developmentStage: 'Prototyped',
+    summary: 'A current human owner can offer their own seat through a private one-time kit without changing the faction or game progress.',
+    steps: [
+      'Open Pass your seat to another player below the table and create a private handover. Send the complete kit only to your intended recipient. It expires after 24 hours; play can continue until acceptance.',
+      'The recipient chooses Accept a seat handover on the home page and confirms the room and seat. Acceptance preserves private cards, resources, decisions and AI-control settings. It revokes the previous owner’s browser sessions and recovery kits. The recipient should protect their seat with a new recovery kit.',
+      'An owner may cancel or replace an offer. A confirmed replacement invalidates the old kit. Recovering the issuing seat also invalidates its pending offer. A browser already controlling another seat in that room must use a separate browser profile.',
+      'Keep the tab open after an uncertain result and retry the same request. Private retry details survive refresh in that tab. They are removed after both acceptance and the new browser session are confirmed. Closing the tab or abandoning its details can lose access to a completed transfer.',
+      'Host status and inactivity do not authorize taking another player’s seat. Broader disconnected-seat and hosted acceptance remains unfinished.',
+    ],
+    related: ['privacy', 'ai-players', 'implementation-checklist'],
+    checklist: [
+      { area: 'Implementation', status: 'Implemented', detail: 'Bounded voluntary owner issue/cancel/replace and one-time recipient claim with persistent private custody and exact retry receipts.' },
+      { area: 'Player controls', status: 'Implemented', detail: 'Private owner kit controls and a separate recipient acceptance/retry screen, including refresh continuation and deliberate abandonment.' },
+      { area: 'AI', status: 'Implemented', detail: 'Transfer preserves the human seat’s existing autopilot setting; bots cannot issue or claim someone else’s handover.' },
+      { area: 'Documentation', status: 'Implemented', detail: 'This guide explains expiry, revoked access, retry proof and the need for a new owner recovery kit.' },
+      { area: 'Verification', status: 'Partial', detail: 'Focused private state, custody, concurrency, HTTP and browser checks. Complete network-failure acceptance remains open.', evidence: ['tests/seat-handover-client.test.ts', 'tests/seat-handover-store.test.ts', 'tests/seat-handover-http.test.ts'] },
+    ],
+  },
   {
     id: 'richese-cards',
     title: 'Richese card collection',