Class OfficeApi

Narrow-entry mutation: set the explicit holder of an office (replacing any prior — auditable). Gated to the OfficeController (the office assign verb) via the string-keyed FromModule policy — string-keyed to avoid a value-level static-import cycle. The controller is cloned per execution, and FromModule matches it by its class module id (code provenance), so the cloned instance is admitted directly — no FromTemplate arm needed. The authority is enforced by the requiresFoundingAuthority subcommand validator; this method is the structurally single entry to the handoff write.

The configured founder display handle (offline presentation).

Who holds an office — the explicit handed-off holder if one is stored, else the founder (presented by handle even while offline). Public read.

Does subject (an Avatar) hold officeKey? Explicit-holder match, OR (no explicit holder AND the subject is the founder). Public read. Non-Avatar / null subjects fail closed.

Is subject the founder? Resolves the Avatar → its User → the configured FOUNDER_GOOGLE_EMAIL/FOUNDER_TWITCH_HANDLE credential. False until the founder has logged in. Public read.

Every office subject holds — the founder's full set when no handoffs exist, a single seat for a handed-off holder, none for anyone else. Public read.

The public transparency roster — every office with its branch, origin, and current holder (explicit playerId or the founder default). Publicly readable (Art. VII).

Narrow-entry mutation: clear an office's explicit holder (the seat reverts to the founder default). Office-only — a singular seat has no empty state. Same OfficeController FromModule gate as assign.