Player-to-player trading

Two co-located players can trade directly — credits, cargo, ships, and equipment — through a bilateral trade window with atomic, all-or-nothing settlement. Distinct from station trading (player ↔ market) and the team treasury (intra-team transfers): a galaxy-wide, cross-team peer exchange. Full design — including the ADR-0008 ship registry this work builds first — is in ADR-0089.

Status: 📐 Design-only — no code yet. Target: services/gameserver/src/services/player_trade_service.py, routes api/routes/player_trade.py, models PlayerTradeSession / PlayerTradeLog / ShipRegistry, table PLAYER_TRADEABLE_PRICES.

Where trades happen

Both players must be in the same sector; a trade including a ship additionally requires both docked at the same port. A player may hold only one open trade session at a time (enforced server-side).

Status: 📐 Design-only.

What can be traded

A fixed whitelist: credits, cargo commodities, quantum shards/crystals, genesis devices, drones, mines, ships, and uninstalled equipment. A ship trades as a bundle — its onboard cargo and installed equipment/upgrades move with the hull and cannot be staged separately, and its insurance voids on transfer. Reputation/acquisition-gated assets (genesis devices, quantum crystals) can only be received by a player who already meets that gate. Never tradable: turns, reputation, medals, a player's currently-piloted or last remaining ship, and stolen-flagged ships.

Status: 📐 Design-only.

The trade window

Open → stage → confirm → settle. Any change to either offer resets both confirmations and bumps a session version, so the deal cannot be altered after the other party agrees — and a deal that cannot currently fit is refused at confirm time, before anyone travels. When both confirm the same version, the server settles in a single locked transaction — every item moves or none do; capacity overflow rolls back rather than truncating.

Status: 📐 Design-only.

Integrity and anti-abuse

Settlement locks every involved player and ship row in one global order, re-validates the full offer (ownership, condition, per-asset capacity) and the confirmed version, so credits and items cannot be duplicated and no confirm-time switch is possible. A value-based transfer tax sinks credits on the appraised value moved (including one-way gifts); a progressive surcharge plus value-windowed caps and a new-account receiving cap — applied to every account regardless of subscription tier — blunt alt-account funnelling; every settled trade is written to an immutable audit log feeding chain-aware multi-account throttling. P2P trades do not change reputation.

Status: 📐 Design-only.