Add one-use consent for a named player to start seat AI

Let a human owner authorize another human in the started room to start a fixed difficulty once within 24 hours. The owner retains the seat, cookie, private hand, recovery setup and takeback control. Consent is explicit even while online; neither host status nor inactivity authorizes a takeover. Activation enters the existing paced private-view AI path without strategic changes.

Add additive migration 0006, both exact session fences, owner/delegate-only metadata in the authenticated room snapshot, atomic CAS activation and consumption, expiry and terminal retry receipts. Replacement hides older consent; own AI changes invalidate unused consent. Recovery or handover of either bound seat invalidates the grant. Future-version guards prevent stale computed state from overwriting a racing action. Exact browser retry records retain the original operation/version across refresh and cannot rearm old consent. Shared HTTP continuation preserves coalescing across ordinary and control routes.

Independent review found no material remaining issue. Revoke messaging accurately handles activation winning the race. Browser QA exercised grant/revoke, preserved consent after refresh, reciprocal fixed-profile activation, consumed receipts, keyboard takeback and private ownership. The panel now remains expanded after success and action buttons are at least 44px. Responsive screenshot acceptance remains open because the browser viewport override targeted a failed secondary-origin tab; desktop controls and no-overflow width were verified. The QA room is stopped at a genuine human setup decision with both seats taken back.

Types, lint, all 4906 offline tests, production build and all 45 HTTP tests pass on the stable source fingerprint. Seven new offline cases cover client consent/retry validation and real SQLite privacy, restart, one-use races, future versions, takeback, expiry and both-seat recovery/handover; two new HTTP cases cover authentication, injection, fixed-profile continuation and takeback. The first broad run exposed 68 legacy VM fixtures missing the new production dependency; their mappings were updated and the real shared continuation remains exercised. The historical 0005 migration test verifies backfill before applying 0006 for current code.

All 1174 original rooms, 2456 seats and every prior recovery/entry/handover/migration row remain unchanged. SQLite integrity and foreign keys pass; migration and QA added 88 rooms and 188 seats. No reset, server restart, usage check or automation was performed.

The current Sites integration has no supported durable Cron/DO provisioning path. Document this platform blocker rather than adding an inert scheduled export; unattended resumption and broader network-failure acceptance remain unfinished. Full rules, component, AI strength and publication gates remain closed.

Verified source tree: 2d86fc611e9ef4f5a10db10f96687a31db1ec238908ecf1e9333c50fac9ccaa8

docs/AUTOPILOT.md

@@ -18,7 +18,31 @@ An accepted API action processes a bounded AI batch. If more work is pending, th
 
 The current continuation has a sixteen-batch budget. It is **best effort, not a durable scheduler**. Cloudflare permits work after response/disconnect for a bounded period; runtime interruption or exhaustion can leave the persisted `botsPending` flag for a later explicit continuation. The existing browser reconnect/resume flow can resume it. No automatic platform alarm resumes a room after an unattended server restart. That remaining reliability requirement must be implemented and verified before claiming fully unattended operation. [Cloudflare duration limits](https://developers.cloudflare.com/workers/platform/limits/#duration), [module waitUntil export](https://blog.cloudflare.com/nodejs-workers-2025/).
 
-GET remains a private read and does not advance a game. The all-controlled HTTP acceptance case polls only GET after the final delegation request, proving the observed completion came from the request's server continuation.
+GET returns the caller's private view and can schedule pending automatic/AI work
+through the same bounded continuation used by POST. Polling or reopening can
+therefore wake persisted work. It does not establish unattended recovery after
+all requests stop.
+
+### Platform audit, 20 September 2026
+
+The current Sites integration exposes no supported Cron Trigger or Durable
+Object provisioning contract. Vinext can compile a custom Worker entry with a
+`scheduled` handler, but that export does nothing without an installed trigger.
+The generated local Wrangler configuration is not a Sites deployment contract.
+No inert handler or pretend scheduler has been added.
+
+Cloudflare Cron requires a separately configured trigger and has minute-level
+scheduling. It could enforce a minimum interval, but cannot provide regular
+1.5-second wakeups. Durable Object alarms provide finer scheduling, but this
+project has no supported binding/provisioning path. D1 due metadata alone cannot
+wake a Worker. This milestone is blocked on an available durable scheduler;
+independent multiplayer work continues. See [Cron configuration](https://developers.cloudflare.com/workers/configuration/cron-triggers/)
+and [Durable Object alarms](https://developers.cloudflare.com/durable-objects/api/alarms/).
+
+The optional [named-player permission](SEAT_AI_PERMISSION.md) now connects a
+one-use, fixed-difficulty activation without transferring the owner's seat or
+private information. It uses the same best-effort continuation and does not
+remove the scheduling limitation.
 
 ## Coverage ledger
 
@@ -30,7 +54,7 @@ GET remains a private read and does not advance a game. The all-controlled HTTP
 | Background batches cannot overwrite takeback      | Current-state read and version-fenced update per batch                     | Normal reconnect/resume controls                                | Only persisted bot/autopilot seats run        | Five SQLite `bot-continuation.test.ts` cases, including real authenticated takeover race |
 | Complete an all-controlled game                   | POST schedules background continuation                                     | Final outcome remains inspectable                               | Three original human credentials preserved    | HTTP final opt-in returned playing, later GET finished; no subsequent gameplay POST      |
 | Responsive and refresh flow                       | Saved mode read after refresh                                              | Mobile 44px takeback, separate opt-in, keyboard-native controls | Inspection remains readable during delegation | Browser room2SG3ZS3E; details in `VISUAL_PLAYTEST.md`                                    |
-| Durable unattended restart scheduling             | Missing                                                                    | Reopen/resume available                                         | No automatic host takeover                    | Not certified; next reliability work                                                     |
+| Durable unattended restart scheduling             | Blocked on supported platform trigger/binding                              | Reopen/resume available                                         | No automatic host takeover                    | Current Sites capability audit; no unattended certification                               |
 
 ## Validation checkpoint
 

docs/CURRENT_STATUS.md

@@ -6,26 +6,29 @@ gated.** Prototypes do not open completion or publication gates.
 
 ## Current checkpoint and work
 
-Latest delivered gameplay checkpoint: `54c8030`, [Sandmaster worm rides](SANDMASTER_WORM.md).
-Types, lint, **4,894 offline tests**, production build and **43 HTTP tests** passed.
-Optional native Fremen destination collection connects multi-sector forces,
-controls, minimal legal AI and saved Bene Gesserit arrival continuation. All 1,140
-baseline rooms and 2,385 seats stayed unchanged; isolated checks added 34 rooms
-and 71 seats. No restart was needed. The `8f7a62c` policy checkpoint removed the
+Latest delivered checkpoint: `e13ad45`, [movement and Traitor practice](INTERACTIVE_INTRODUCTION.md).
+Types, lint, **4,899 offline tests** and production build passed. Seven lessons
+and five exercises connect shared rules and migrated browser-local saves. All
+1,174 baseline rooms and 2,456 seats stayed unchanged; no restart was needed.
+The preceding `54c8030` connects [Sandmaster worm rides](SANDMASTER_WORM.md).
+The `8f7a62c` policy checkpoint removed the
 usage cutoff and deferred AI refinement until feature completion, with three
 adjacent 75% win-rate targets. Earlier evidence remains in the
 [implementation history](IMPLEMENTATION_STATUS.md).
 
-Current work: the [interactive introduction](INTERACTIVE_INTRODUCTION.md) adds
-movement and Traitor practice through shared rules, legal controls and migrated
-browser-local saves. Broader curriculum remains unfinished. Final verification
-and delivery belong to the source-bound private report and Git message.
+Current work: [one-use AI permission](SEAT_AI_PERMISSION.md) connects optional
+named-player activation at the owner's chosen difficulty, retained ownership,
+both session fences and saved exact retries. Final independent review,
+verification and delivery belong to the source-bound private report and Git
+message. Broader disconnected-seat acceptance remains unfinished.
 
 A bounded remaining-effect audit found that the reviewed faction/Nexus candidates
 still cross recorded pending rulings. Continue independent features rather than
-inventing answers. Durable unattended bot resumption is the next clear backend
-capability: it needs a platform scheduler and saved due-work metadata; current
-request/reconnect continuation does not establish it.
+inventing answers. The [platform audit](AUTOPILOT.md#platform-audit-20-september-2026)
+found no supported Sites scheduler or Durable Object provisioning contract.
+Durable unattended bot resumption remains blocked on that capability; current
+request/reconnect continuation does not establish it. Continue independent
+player-facing features and integration while preserving pending rules questions.
 
 The connected [Harass & Withdraw prototype](HARASS_WITHDRAW_RUNTIME.md) supports either
 battle-card slot, private category inspections, exact undialed normal/elite
@@ -87,7 +90,7 @@ These links define bounded working behavior, not complete module certification.
 | Nexus/Homeworlds | [Decision index](RULE_DECISIONS.md) links each integrated faction family, native/borrowed effects, physical custody, private choices, payments and transport. [CHOAM Collection trade](NEXUS_CHOAM_SECRET_ALLY.md) and [Emperor extra revival](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md) are connected; CHOAM inspection and Emperor purchase remain pending. A source audit or helper alone is not a completed effect. |
 | Truthtrance | [Spice facts](TRUTHTRANCE_SPICE_FACTS.md), [card counts](TRUTHTRANCE_CARD_COUNT.md), [hand inventory](TRUTHTRANCE_HAND_INVENTORY.md), [recorded knowledge](TRUTHTRANCE_KNOWLEDGE.md), and [Basic/no-Guild Advanced reserve-shipment promises](TRUTHTRANCE_SHIPMENT_PROMISES.md) use authoritative private state. Earlier readiness audits do not supersede these follow-ups. |
 | Other cards | [Sapho runtime](JUICE_OF_SAPHO_RUNTIME.md) includes first among remaining unstarted movement turns after Advanced Guild has finished. [Recruits](RECRUITS_RUNTIME.md) connects clean Revival play; [Harass & Withdraw](HARASS_WITHDRAW_RUNTIME.md) connects the bounded battle return in the same independent three-card preview. Richese card contracts and the checklist identify other connected effects and explicit gaps. |
-| Multiplayer | Saved rooms/seats, [recovery](../README.md#saved-seats-and-reconnecting), uncertain-request retry, [own-seat AI](AUTOPILOT.md), and [voluntary seat handover](SEAT_HANDOVER.md) have connected controls and recovery evidence. |
+| Multiplayer | Saved rooms/seats, [recovery](../README.md#saved-seats-and-reconnecting), uncertain-request retry, [own-seat AI](AUTOPILOT.md), [named-player AI permission](SEAT_AI_PERMISSION.md) and [voluntary seat handover](SEAT_HANDOVER.md) have connected controls and recovery evidence. |
 
 ## Remaining readiness
 

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,20 @@
 # Dune implementation status
 
+## 20 September 2026 — One-use named-player AI permission
+
+The [AI permission prototype](SEAT_AI_PERMISSION.md) connects optional owner
+consent to a named human and fixed difficulty for one activation within 24 hours.
+It retains ownership and private information, uses both exact session fences,
+atomic versioned activation/consumption, owner takeback invalidation and saved
+exact retries. Additive migration 0006 preserves existing rooms and seats.
+Independent review, focused SQLite/client/HTTP checks, browser acceptance and
+final source-bound check/build/HTTP/preservation evidence belong to the private
+checkpoint and Git message. No AI strategy or mode/publication gate changes.
+
+The [Sites platform audit](AUTOPILOT.md#platform-audit-20-september-2026) found no
+supported durable trigger or alarm binding. Unattended resumption remains a
+platform blocker; no inert scheduler was added or claimed complete.
+
 ## 20 September 2026 — Movement and Traitor introduction exercises
 
 The [introduction](INTERACTIVE_INTRODUCTION.md) now connects seven lessons and

docs/MULTIPLAYER_AUDIT.md

@@ -61,7 +61,7 @@ Normal waiting for a temporarily disconnected player is legitimate; it should no
 
 ## Proposed disconnected-seat contract (historical design)
 
-This broader proposal changes operational control of a seat, not board-game rules. Owner recovery and [voluntary handover](SEAT_HANDOVER.md) now have bounded implementations using exact active-token fencing. The separate generation/delegation schema below is historical design and has not been adopted; unattended or host-driven substitution remains unfinished. The passing test count above predates these additions. Preserve the same player ID, faction, resources, hand, traitors, promises, submitted plans, decision ownership and history throughout every transition. Never restart setup or reveal a sealed plan merely because its controller changes.
+This broader proposal changes operational control of a seat, not board-game rules. Owner recovery and [voluntary handover](SEAT_HANDOVER.md) have bounded implementations using exact active-token fencing. The current [one-use named-player AI permission](SEAT_AI_PERMISSION.md) also uses exact session fences while retaining owner control. The separate generation/ownership schema below remains historical design and has not been adopted; unattended or host-driven substitution remains unfinished. The passing test count above predates these additions. Preserve the same player ID, faction, resources, hand, traitors, promises, submitted plans, decision ownership and history throughout every transition. Never restart setup or reveal a sealed plan merely because its controller changes.
 
 ### Distinguish three cases
 

docs/SEAT_AI_PERMISSION.md

@@ -0,0 +1,65 @@
+# Permission to start another player's AI
+
+An owning human can authorize one named human player in the same started room to
+enable a chosen AI difficulty once, within 24 hours. This is optional operational
+consent. It does not change board-game rules, transfer ownership or disclose the
+owner's private view. It can be used while the owner is online; no inactivity
+detector or host privilege substitutes for consent.
+
+## Connected behavior
+
+Below the table, **Let a player start AI for your seat** offers a named player and
+Easy, Medium, Hard or Brutal. The owner can replace or revoke an unused grant.
+The delegate sees its fixed difficulty and expiry and can activate it once.
+Both retain their existing credentials, recovery kits and private views. Public
+history names the activating delegate. The owner uses the existing **Take back
+control** button; completed AI decisions remain in the game.
+
+The normal `setAutopilot` control branch preserves gameplay and sealed choices.
+Activation queues the existing persisted, 1.5-second AI continuation and does not
+implement new AI strategy. Setup/playing human seats are supported. Lobby,
+finished, permanent-bot and already-controlled owner seats reject new consent or
+activation. A delegate must be a different authenticated human in the room.
+
+## Consent and saved continuation
+
+Migration `0006_thick_imperial_guard.sql` adds a separate consent table. Each grant
+binds its identifier, owner, delegate, chosen difficulty and expiry to both exact
+current seat-session hashes. Only the owner and delegate receive its public
+metadata, through the same SQL read that authenticates the viewer and loads the
+room. Neither hash is projected. Recovering or transferring either seat makes
+old consent unusable; a new owner or delegate must establish fresh consent.
+
+Creation, replacement, revocation and activation use room-version and credential
+predicates. A D1 transaction consumes the grant only after its exact versioned
+room update succeeds. Taking back or changing one's own AI control invalidates
+unused consent in the same transaction. A losing concurrent action cannot leave
+the grant consumed without activation, or reactivate a seat after takeback.
+
+Grant identifiers remain durable receipts. Retrying creation can report its
+original result but never renews or rearms a used, expired, revoked or replaced
+grant. Retrying activation reports prior use without repeating control changes.
+Replacement hides older grants from the current permission list while retaining
+their receipts. Expiry is enforced by server time.
+
+The browser saves the exact operation, grant identifier and original version in
+tab storage before dispatch. An uncertain result offers an explicit exact retry;
+refresh restores it. Retry never substitutes a newer version or a new grant.
+Clearly rejected operations release the retry record. Explicit abandonment
+explains that discarding local details cannot cancel a committed request. No
+cookie, recovery secret or private hand is stored in this record.
+
+## Verification and remaining work
+
+`seat-ai-delegation-recovery.test.ts` exercises real SQLite migrations and the
+production store, including one-use custody, both session fences, rejected-action
+immutability, races and restored continuations. The client tests verify exact
+retry storage and target/profile injection rejection. HTTP tests cover session,
+origin, private projection, fixed-profile activation, background work and
+takeback. Independent review, browser evidence and final check/build/HTTP results
+belong to the private source-bound checkpoint and Git message.
+
+This is a bounded prototype of preauthorized absence handling. An unprepared lost
+seat still cannot be commandeered by a host. Full network-failure acceptance and
+durable unattended scheduling remain unfinished. No mode or publication gate is
+opened, and strategic AI work remains deferred until non-AI feature completion.