Describe held realms

projects/RPCharacters/docs/estates-and-wills.md

@@ -74,7 +74,9 @@ stations and the stored body.
 
 Some answers make the decision wait rather than guess, and it is tried again every minute: the dead
 character's or the heir's account cannot be read, SimpleFactions has not answered (or gave no answer
-at all), or it cannot say whether the realm still exists. An estate whose lookup throws is logged and
+at all), or it cannot say whether the realm still exists. SimpleFactions does not answer for a realm it
+is holding after its last member died, so such an estate waits until the realm is taken on or closed,
+and a revive cancels it. An estate whose lookup throws is logged and
 tried again; it never stops the other estates from being decided. RPCharacters and SimpleFactions start in a cycle, so decisions due at
 startup usually wait for SimpleFactions; they run again when SimpleFactions enables and when it fires
 its ready event. If SimpleFactions started late, Thievery has already made its lock pass, and the

projects/SimpleFactions/docs/characters.md

@@ -150,7 +150,7 @@ Daily settlement records actual cents paid, including partial payments.
 An ordinary guild leader's successor is the first living remaining member in
 its original join order. When no living member is left to succeed, the guild
 stays open without a leader (see [leaderless guilds](#leaderless-guilds)). A
-completely empty realm is removed while its ledger treasury remains. If the
+realm whose last member died is held for a week (see [held realms](#held-realms)). If the
 ruling guild empties but another guild still has members, the realm and its
 treasuries remain: elective governments start the normal election; a
 nonelective ruler remains vacant for staff resolution. Unresolved quarantined leaders block succession
@@ -168,6 +168,53 @@ and a living seat holder is never replaced; see
 See [treasury recovery](treasuries.md) for journal paths and coordinated backup
 requirements.
 
+### Held realms
+
+When a realm's last member dies, the realm is held rather than removed. The step
+that removes the last member also records the dead character on the realm's main
+guild, in the same save, using the leaderless-guild fields (`dead leader`,
+`leaderless since`, `empty since`). Menus and the public map show the realm's
+leader as "Name (dead)", and the realm keeps its land, treasury, army and
+installations. While it is held:
+
+- the daily settlement charges no army upkeep (mercenary company slots
+  included) or installation upkeep, shrinks no
+  regiment, downgrades no installation, sheds no province over the cap and sells
+  no branch to cover a shortfall;
+- its pool and installation vehicles are charged no upkeep, take no new unpaid
+  day and no upkeep damage; an unpaid marker from before the death stays;
+- it pays no overlord tax or tribute; trade, tariffs, loans and war reparations
+  carry on as usual;
+- its outstanding invitations are cleared and nobody can join it with
+  `/faction join`;
+- no realm can declare war on it.
+
+If the dead character is revived, it rejoins the realm's main guild as its leader,
+on the revive event or at the next hourly check. That happens only while the realm
+has no members, the character has joined no other realm and the closure has not
+begun; a failed save keeps the realm held and the next hour tries again. Staff can hand the realm to someone
+else with `/faction forcejoin <faction> <character>` followed by
+`/faction forceleader <faction> <character>`; filling the seat ends the hold.
+
+The hourly check closes a held realm once it has had no members for 7 days and is
+not at war. The week starts when SimpleFactions records the death, which for a
+death it missed is the reconcile that found it. Letting a member in stops the clock at
+once; the next hourly check after the realm is empty again starts a new week.
+Closing first saves the realm with `closing since`, from when a revive no longer
+gives it back; then it removes every other realm's relation, trade agreement and
+treaty with the realm and saves those realms; then it removes the realm and its
+file. Its ledger treasury remains. A failed step is tried again
+every hour, and a new realm that took the same name in the meantime is left alone.
+Once a closure has begun it always finishes: staff `forcejoin` and `forceleader`
+are refused for that realm.
+
+While the realm is held, and until its closure is finished, estate lookups for it
+are unavailable, so RPCharacters postpones the estates of deaths in it. They pass
+once staff take the realm on or it closes; a revive cancels the dead leader's.
+
+An older SimpleFactions jar drops the held fields on its next save and leaves the
+realm empty with no leader and no closing date. Back up `Data/` before rolling back.
+
 ### Leaderless guilds
 
 A leaderless guild keeps its treasury, branches and settlements. Menus and the