Add one-use consent for a named player to start seat AI

Let a human owner authorize another human in the started room to start a fixed difficulty once within 24 hours. The owner retains the seat, cookie, private hand, recovery setup and takeback control. Consent is explicit even while online; neither host status nor inactivity authorizes a takeover. Activation enters the existing paced private-view AI path without strategic changes.

Add additive migration 0006, both exact session fences, owner/delegate-only metadata in the authenticated room snapshot, atomic CAS activation and consumption, expiry and terminal retry receipts. Replacement hides older consent; own AI changes invalidate unused consent. Recovery or handover of either bound seat invalidates the grant. Future-version guards prevent stale computed state from overwriting a racing action. Exact browser retry records retain the original operation/version across refresh and cannot rearm old consent. Shared HTTP continuation preserves coalescing across ordinary and control routes.

Independent review found no material remaining issue. Revoke messaging accurately handles activation winning the race. Browser QA exercised grant/revoke, preserved consent after refresh, reciprocal fixed-profile activation, consumed receipts, keyboard takeback and private ownership. The panel now remains expanded after success and action buttons are at least 44px. Responsive screenshot acceptance remains open because the browser viewport override targeted a failed secondary-origin tab; desktop controls and no-overflow width were verified. The QA room is stopped at a genuine human setup decision with both seats taken back.

Types, lint, all 4906 offline tests, production build and all 45 HTTP tests pass on the stable source fingerprint. Seven new offline cases cover client consent/retry validation and real SQLite privacy, restart, one-use races, future versions, takeback, expiry and both-seat recovery/handover; two new HTTP cases cover authentication, injection, fixed-profile continuation and takeback. The first broad run exposed 68 legacy VM fixtures missing the new production dependency; their mappings were updated and the real shared continuation remains exercised. The historical 0005 migration test verifies backfill before applying 0006 for current code.

All 1174 original rooms, 2456 seats and every prior recovery/entry/handover/migration row remain unchanged. SQLite integrity and foreign keys pass; migration and QA added 88 rooms and 188 seats. No reset, server restart, usage check or automation was performed.

The current Sites integration has no supported durable Cron/DO provisioning path. Document this platform blocker rather than adding an inert scheduled export; unattended resumption and broader network-failure acceptance remain unfinished. Full rules, component, AI strength and publication gates remain closed.

Verified source tree: 2d86fc611e9ef4f5a10db10f96687a31db1ec238908ecf1e9333c50fac9ccaa8

game/engine.ts

@@ -25328,4 +25328,6 @@ export function viewGame(state: Game, id: string) {
     })),
   };
 }
-export type GameView = ReturnType<typeof viewGame>;
+export type GameView = ReturnType<typeof viewGame> & {
+  seatAiDelegations?: import('../lib/seat-ai-delegation').SeatAiDelegationView[];
+};

game/reference.ts

@@ -217,6 +217,7 @@ export const RULE_TOPICS: RuleTopic[] = [
       'ai-pacing',
       'table-sounds',
       'seat-handover',
+      'seat-ai-permission',
       'ecaz-modules',
       'discoveries',
       'homeworlds',
@@ -269,6 +270,29 @@ export const RULE_TOPICS: RuleTopic[] = [
       { area: 'Verification', status: 'Partial', detail: 'Focused cursor/audio checks and browser preference controls; physical output and broader browser acceptance remain open.', evidence: ['tests/table-sound.test.tsx'] },
     ],
   },
+  {
+    id: 'seat-ai-permission',
+    title: 'Let a player start AI for your seat',
+    category: 'Getting started',
+    coverage: 'Partial',
+    developmentStage: 'Prototyped',
+    summary: 'Authorize one named human player to start your chosen AI once while keeping your seat and private information.',
+    steps: [
+      'After the game starts, open Let a player start AI for your seat below the table. Choose another human and a difficulty, then grant permission. It expires after 24 hours and can be used even while you are online.',
+      'The named player can start only the authorized difficulty. They do not receive your hand, seat credentials or recovery kit. Public history records who activated AI.',
+      'You can replace or revoke unused permission. Changing your own AI control or recovering or transferring either seat invalidates unused permission. Take back control stops future AI decisions, but completed choices remain.',
+      'An uncertain permission request stays in this tab for exact retry, including after refresh. Retrying cannot renew consent or activate AI twice. Discarding a retry record cannot cancel an operation that reached the server.',
+      'Host status and disconnection alone never grant permission. A lost unprepared seat and unattended server recovery remain outside this feature.',
+    ],
+    related: ['privacy', 'ai-players', 'ai-pacing', 'seat-handover', 'implementation-checklist'],
+    checklist: [
+      { area: 'Implementation', status: 'Implemented', detail: 'One-use, fixed-profile permission with expiry, both credential fences, atomic activation and owner takeback invalidation.' },
+      { area: 'Player controls', status: 'Implemented', detail: 'Named owner consent/replacement/revocation and delegate activation; exact tab-scoped retry continuation.' },
+      { area: 'AI', status: 'Implemented', detail: 'Uses the existing legal private-view autopilot and saved 1.5-second pacing; no strategy changes.' },
+      { area: 'Documentation', status: 'Implemented', detail: 'Explains consent, expiry, retained ownership, private-information boundaries and uncertain replies.' },
+      { area: 'Verification', status: 'Partial', detail: 'Focused SQLite races, recovery, HTTP privacy and browser controls; broader network-failure acceptance remains open.', evidence: ['tests/seat-ai-delegation-client.test.ts', 'tests/seat-ai-delegation-recovery.test.ts', 'tests/seat-ai-delegation-http.test.ts'] },
+    ],
+  },
   {
     id: 'seat-handover',
     title: 'Pass a seat to another player',
@@ -1914,7 +1938,7 @@ export const RULE_TOPICS: RuleTopic[] = [
       'After the game starts, Let AI play for me lets you delegate your own seat to Easy, Medium, Hard or Brutal AI. It uses only your seat’s information and can complete setup, spend resources and commit plans. Your seat, saved choices and recovery kit remain yours. Take back control stops future AI decisions without undoing completed actions.',
       'The table displays which human seats are on autopilot. AI stops when another human must decide. Online progress is saved one AI action at a time; if processing is interrupted, reopen the table and use its reconnect or resume control when offered. Autopilot does not automatically start because a player disconnects.',
     ],
-    related: ['battle', 'alliance-funding', 'ai-pacing'],
+    related: ['battle', 'alliance-funding', 'ai-pacing', 'seat-ai-permission'],
   },
   ...PHASES.map(
     (title, phase): RuleTopic => ({