Connect owned Sandmaster destination pile choices

docs/CURRENT_STATUS.md

@@ -29,6 +29,20 @@ optional skill bands, combinations and public expansion starts remain open.
 Rules implementation continues; comprehensive assurance and administration
 remain deferred until all rules are implemented.
 
+**Owned Sandmaster destination piles — 9 October.** Native worm rides and
+physical Fremen Ambassador relocation now select an exact positive pile
+when several exist. Collection remains optional and capped at one spice;
+invalid/omitted ambiguous keys reject before transfer. Stored Ambassador
+reconstruction retains the selected key. Basic/Advanced native smokes and
+all four existing legal policies pass without destination-strategy changes.
+At390px, actual worm controls debit Pasty Mesa6 while landing four forces
+in Mesa5 (spice5→6); Ambassador controls reset on a destination change and
+debit South Mesa5 while landing two forces in Mesa4 (spice20→21).
+Types/lint and 91 affected cases pass. HMS multi-pile controls remain open.
+See [worm](SANDMASTER_WORM.md#connected-behavior) and
+[physical Ambassador](SANDMASTER_MOVEMENT.md#physical-ambassador-owned-destination-allocation--9-october-2026).
+
+
 **Owned Sandmaster ground-pile choice — 9 October.** Ordinary route
 collection now offers every positive pile, but permits only one selected
 sector per entered territory. The checkbox group supports switching piles

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,35 @@
 # Dune implementation status
 
+## 9 October 2026 — owned worm and physical Ambassador destination piles
+
+The shared destination quote exposes all legal positive piles and an exact
+selection. Native worm and physical Fremen Ambassador declarations add
+`sandmasterPile` when collecting; ambiguity requires a supplied key.
+Single-pile boolean declarations remain valid. One ride/relocation earns
+only one spice, regardless of forces or piles, before arrival reactions.
+Owner allocation is visibly provisional, not publisher adjudication.
+
+The actual UI selectors reset stale destination selection, retain optional
+opt-out and show before/after quantities. Existing native/profile,
+same-territory and concealed-marker guards stay. Stored Ambassador movement
+reconstructs its exact frozen key through the original receipt.
+
+Basic/Advanced native smoke chooses Pasty Mesa6 (3→2), preserves Mesa5 at2,
+lands four forces in Mesa5 and credits5→6 without changing normal movement.
+Physical Ambassador smoke chooses South Mesa5 (2→1), preserves Mesa4 at4,
+lands two forces in Mesa4 and credits20→21 with moved0/shippedfalse.
+All four existing policies retain legal continuation and send explicit keys
+when they choose collection; optional destination strategy is unchanged.
+Isolated 390px production controls reproduce both results, including
+Ambassador destination reset and opt-out/reselection. No existing game store
+or deployed acceptance is claimed.
+
+`check:quick` passes; 91 affected native, quote, control, bot, cancellation
+and movement cases pass. The selected-pile Intrusion/JSON cases settle once.
+A duplicate control case that enabled an undealt card variant was removed;
+existing valid profile guards remain covered. Temporary scripts and the
+dedicated service were removed. No broad recovery/HTTP campaign or deployment.
+
 ## 9 October 2026 — owned Sandmaster ground-movement pile selection
 
 The shared ground quote now groups all positive pile keys by entered

docs/RULE_DECISIONS.md

@@ -21,7 +21,7 @@ They supersede earlier software-absence claims only within their named scope.
 | Full-hand Nullentropy Box | Basic and Advanced permit an atomic retrieval/Box-disposal exchange with final hand within its actual limit; Box remains last/on top. Intermediate capacity is not adjudicated. | [Box runtime](NULLENTROPY_BOX_ENGINE_AUDIT.md) |
 | Kulon with Richese Ornithopter | Both modes coexist in Basic/Advanced. The fixed one-group card maximum remains three; Kulon extends each normal-range group. Explicitly provisional, not a publisher ruling. | [Movement policy](RICHESE_ORNITHOPTER_ENGINE_AUDIT.md#provisional-kulon-coexistence--9-october-2026) |
 | Multi-pile battle skills | In both modes, surviving Smuggler allocates the fixed unmodified-strength-capped collection among reveal-time positive piles; Sandmaster winner then selects one remaining pile for +3. Single-pile/all/none/void effects stay automatic. Owner sector selection is provisional, not a publisher allocation ruling. | [Smuggler](SMUGGLER_BATTLE.md#multi-pile-allocation-policy-and-pure-api--9-october-2026), [Sandmaster](LEADER_BATTLE_EFFECTS.md#source-contract) |
-| Multi-pile Sandmaster ground movement | The owner chooses one existing positive debit sector per entered territory, or declines its one-spice collection. Duplicate territory collection rejects. Worm/Ambassador destination and HMS multi-pile paths remain separate. Explicitly provisional, not a publisher allocation ruling. | [Ground-route policy](SANDMASTER_MOVEMENT.md#owned-ground-route-pile-selection--9-october-2026) |
+| Multi-pile Sandmaster movement | Ground movement chooses one existing positive debit sector per entered territory; worm and physical Fremen Ambassador relocation choose one at their entered destination, or decline collection. Duplicate territory collection rejects; destination multi-pile requests need an explicit key. HMS multi-pile controls remain separate. Provisional owner allocation, not a publisher ruling. | [Ground](SANDMASTER_MOVEMENT.md#owned-ground-route-pile-selection--9-october-2026), [Ambassador](SANDMASTER_MOVEMENT.md#physical-ambassador-owned-destination-allocation--9-october-2026), [worm](SANDMASTER_WORM.md#connected-behavior) |
 | Basic occupied Homeworld lifecycle | Current sole foreign garrison controls occupied income, Bidding effects, defenses, percentage shares and the Ecaz-victory holding; the entitlement ends immediately on departure, contest or native repopulation. A recorded source observation is still required. Basic Tupile slot leasing keeps the conservative original-epoch gate. Visibly provisional, not a publisher or numerical user ruling. | [Occupation](HOMEWORLD_OCCUPATION_RULES.md#basic-current-sole-benefit-policy--9-october-2026) |
 
 No publication or faction/mode gate is opened. The exact 7 October user

docs/SANDMASTER_MOVEMENT.md

@@ -28,11 +28,50 @@ declines/reselects the territory, and commits the same move: personal
 spice10→12, South Mesa4 remains4, South Mesa5 becomes1, Cielago East3
 becomes3, and three forces arrive in Cielago East.
 
-Worm/physical-Ambassador destination choices and native HMS relocation
-retain their separate single-pile scope. No public start or broader
-source adjudication is opened by this ground-route change.
+Destination relocation choices are separate from these ground-route controls;
+physical Fremen Ambassador allocation is recorded below and worm collection
+in [its own contract](SANDMASTER_WORM.md). Native HMS relocation retains its
+single-pile scope. No public start or broader source adjudication is opened
+by this ground-route change.
 
 
+## Physical Ambassador owned-destination allocation — 9 October 2026
+
+Physical Fremen Ambassador relocation now offers every existing positive
+destination-territory pile and collects at most one spice from exactly one
+chosen sector before physical arrival and its reactions. The checkbox remains
+optional. With multiple legal piles, the real relocation control shows their
+sector quantities as before→before−1, defaults to the first legal pile, and
+allows another sector. Changing source or destination resets the selection;
+an unavailable selection cannot strand the draft. Declining sends no pile key
+and transfers no spice.
+
+`sandmasterCollect: true` with multiple positive piles requires an explicit
+`sandmasterPile` key. A single-pile boolean declaration remains valid. Native
+validation rejects missing, malformed, foreign, unknown or exhausted selections
+before force or spice mutation. The shared `sandmasterDestinationCollection`
+quote supplies the legal piles and the selected quantity; `ambassadorSandmaster`
+retains the exact native trainer, key and original quantity as its frozen proof.
+Stored continuation revalidates that same key, not a fresh default; a committed
+arrival interruption resumes without collecting twice.
+
+Choosing the debit sector is **provisional owner allocation**, not a publisher
+ruling: the source grants one spice for entering the territory but does not
+name its sector. Same-territory moves, living-native skill eligibility,
+concealed-marker restrictions, typed forces, ordinary allowances and the
+original Ambassador event remain unchanged. This does not change ground-route
+or native HMS eligibility, add spice or invent intervening sectors.
+
+Focused native-engine cases now cover Basic/Advanced alternate-pile allocation,
+decline, invalid declarations without mutation, living-trainer restrictions and
+collection before a JSON-restored Intrusion continuation. Integrated native
+smoke in both modes chooses South Mesa5 (2→1), preserves Mesa4 at4,
+lands two forces in Mesa4 and credits spice20→21 without ordinary
+shipment/movement use. At390px, the actual control changes destination,
+resets the pile selection, opts out/reselects and commits the same result.
+The 8 October rejection evidence below remains a dated checkpoint, not
+the current multi-pile policy.
+
 ## Physical Fremen Ambassador relocation — 8 October 2026
 
 The Ambassador expressly relocates a board force group. The normal
@@ -129,7 +168,7 @@ Broad checkpoint results are recorded with the checkpoint. These checks do not c
 The [worm-ride follow-up](SANDMASTER_WORM.md) connects native Fremen destination
 collection, including saved arrival reactions. Physical Fremen Ambassador
 relocation is connected above. Other nonordinary relocations, special cards,
-concealed-marker collection, multi-pile destination/HMS collection and wider
+concealed-marker collection, multi-pile HMS collection and wider
 interaction/strategy acceptance remain. The lower battle band is in
 [the battle-effects contract](LEADER_BATTLE_EFFECTS.md).
 

docs/SANDMASTER_WORM.md

@@ -24,35 +24,68 @@ the common skill-before-faction order. Subsequent arrival effects do not undo it
 
 ## Connected behavior
 
-A shared public quote validates the player, destination, skill and single positive
-pile. The checkbox defaults to collection but permits declining it. An empty or
-ambiguous pile suppresses collection without blocking ordinary riding. Legacy
-saved actions without the new field retain their original behavior. No invented
-intermediate route or extra normal movement is consumed. Multi-sector and typed
-elite selections transfer one spice total, not one per force or source sector.
+A shared public quote validates the player, destination, skill and all positive
+destination piles. Collection remains optional and capped at one spice for the
+entire ride. With several valid piles, the owner chooses the exact sector supplying
+that spice; placement of the riding forces does not constrain the chosen pile.
+This allocation policy is **provisional**, not a publisher sector-allocation ruling.
+It does not invent a pile, an intermediate route or extra normal movement.
+Multi-sector and typed elite selections still transfer one spice total, not one
+per force, source sector or destination pile.
+
+The checkbox defaults to collection but permits declining it. A multi-pile
+selector is controlled by the parent's selected quote key and shows each sector's
+before → before − 1 quantity. A single pile needs no selector; an empty destination
+or unsupported quote has no collection checkbox. None of these cases prevents
+ordinary riding without collection, and there is no extra confirmation.
+
+`sandmasterWormCollection(game, player, destination, sector, decision = game.decision,
+selectedPile?: string)` retains its native Fremen, phase, decision, leader and
+configuration guards. Its quote includes `piles: Array<{ key: string; before: number }>`,
+the selected `key` and `before`, and any `blocked` reason. Without `selectedPile`,
+the quote offers the first legal pile; this UI default is not action authorization.
+An invalid selected key blocks the quote, and blocked quotes expose `piles: []`.
+
+An accepted worm-ride action may set `sandmasterCollect: true` and
+`sandmasterPile: "territory:sector"`. Collection from multiple positive destination
+piles requires that explicit key; omitting it rejects the action without mutation.
+Single-pile collection still accepts the legacy boolean-only action. Send the pile
+field only when collecting. Declining collection or omitting both fields preserves
+ordinary riding and leaves board/player spice unchanged.
+
+`SandmasterWormChoice` receives `quote`, `collect`, `onChange(collect)` and the
+required `onPileChange(key)` callback. The parent owns selection state, requotes
+that exact key and includes it in the collecting action.
 
 The engine validates every force before moving spice from the board to the
 player, logs the automatic effect and then opens any Bene Gesserit arrival choice.
 Existing versioned room writes commit that transfer once. A saved pending arrival
 resumes only the remaining reaction and ride queue; no new receipt is needed.
-All four AI profiles attach the optional collection flag to the existing legal
-ride candidates. Destination policy and strength tuning are unchanged.
+All four AI profiles attach the optional collection flag and exact quoted pile key
+to the existing legal ride candidates. Destination policy and strength tuning are
+unchanged.
 
 ## Verification and remaining work
 
-Focused engine, controls and SQLite checks cover Basic/Advanced force custody,
-source exclusion, decline, omitted legacy fields, empty and ambiguous piles,
-illegal requests without mutation, native trainer ownership/visibility, public
-mode guards, private views, duplicate concurrent requests and restart during a
-Bene Gesserit reaction. Separate queued rides and a real special-Karama worm
-through Nexus exercise the production continuation. The fixture preserves the
-Fremen three-elite total rather than assuming the Emperor five-elite total.
-Independent source and implementation review found no material defect in this
-bounded contract. Final check/build/HTTP results, targeted browser continuation,
-sample games, saved-game preservation and Git delivery belong to the private
-source-bound checkpoint and commit message.
+The focused suites include Basic/Advanced force custody, source exclusion, decline,
+omitted legacy fields, empty destinations, explicit allocation between two positive
+piles, ambiguous or invalid requests without mutation, native trainer
+ownership/visibility, public mode guards, private views and JSON restoration during
+a Bene Gesserit reaction. The selected pile loses only one spice, other piles remain
+unchanged, and a pending arrival cannot collect a second time. Separate queued rides
+and a real special-Karama worm through Nexus exercise the production continuation.
+The fixture preserves the Fremen three-elite total rather than assuming the Emperor
+five-elite total. Controls retain eligible-owner and blocked-state coverage rather
+than pinning selector wording, HTML order or callback echoes.
 
-Other expansion factions/modules, the Ecaz card variant and multiple positive
-piles remain guarded. Other special relocation, full Leader Skills integration,
+Integrated native smoke in both modes collects exactly one from selected
+Pasty Mesa6 (3→2), leaves Mesa5 at2 and lands four forces in Mesa5 without
+changing normal movement. An isolated 390px production control selects
+Mesa6 and observes the same live-engine result, personal spice5→6.
+All four existing policies retain legal continuation; collecting declarations
+carry explicit pile keys without changing destination strategy.
+
+Other expansion factions/modules and the Ecaz card variant remain guarded.
+Other special relocation, full Leader Skills integration,
 complete human games and final presentation remain unfinished. Strategy refinement
 waits for the [AI feature-completion gate](AI_DEVELOPMENT_PLAN.md).