Offer Semuta after clean private Distrans transfer

docs/CURRENT_STATUS.md

@@ -8,18 +8,20 @@ Expansion starts and full rules/publication acceptance remain gated.**
 
 The explicit [Semuta development preview](SEMUTA_SOURCE_UPDATE_20260907.md#30-september-2026--bounded-clean-discard-runtime)
 now pauses a clean public ordinary-card discard, the used Box after
-a completed paid search, or an Ornithopter retired on early movement
-ending with the same neutral offer for every seat, independently of
-hidden Semuta possession. A holder with a free hand slot can commit
-to the one fresh other-player card; its physical claim and Semuta
-disposal resume the original effect, Box parent or movement queue once.
-All-seat decline, four minimal legal AI profiles, exact JSON/SQLite
-continuation and competing-room CAS are connected. Phone width
-showed the owned Commit control and the identical rival Continue
-event without a private card face. Completed-flight arrival, multi-card
-and most other discard producers, full-hand ordering, normal Richese
-starts and deployed acceptance remain unfinished; neutral passes and
-the free-slot guard are product safety choices, not publisher rulings.
+a completed paid search, an Ornithopter retired on early movement
+ending, or the public used Distrans after a clean private transfer.
+Every seat sees the same neutral offer independently of hidden Semuta
+possession; the transferred card remains private with its recipient.
+A holder with a free hand slot can commit to the fresh other-player
+discard; its physical claim and Semuta disposal resume the original
+effect, Box parent or movement queue once. All-seat decline, four
+minimal legal AI profiles, exact JSON/SQLite continuation and
+competing-room CAS are connected. Phone width showed the owned
+Commit control and identical rival Continue event without a private
+card face. Completed-flight arrival, competing transactions,
+multi-card and most other producers, full-hand ordering, normal
+Richese starts and deployed acceptance remain unfinished; neutral
+passes and free-slot guard are product safety choices, not rulings.
 
 One [natural Advanced Moritani assassination](MORITANI_ASSASSINATE_LEADERS.md#29-september-2026--natural-revealed-card-game)
 now proceeds from genuine battle loss to a dead-target Traitor reveal,

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,37 @@
 # Dune implementation status
 
+## 30 September 2026 — Semuta after a completed private Distrans transfer
+
+An explicitly opted-in Richese preview now pauses after a clean
+Distrans action physically gives one privately selected card to its
+recipient and publicly discards the used Distrans. Every seat sees
+the same neutral fresh-discard event, not the transferred card. A
+legal holder may recover only the public used Distrans, discarding
+Semuta; all-seat decline leaves Distrans in the ordinary pile. The
+recipient keeps its transferred card on either path. Existing
+pending gifts, bid or response contexts remain outside this bounded
+reaction; ordinary transfers retain their previous completion.
+
+Genuine setup and isolated migrated SQLite room cases cover physical
+custody, owner-only commit and legal AI participation, all-seat
+decline, private recipient card projection, saved restart without
+auto-advance, exact authenticated claim and unchanged seat rows.
+Incomplete producer families, full-hand ordering, normal Richese
+starts and deployed acceptance remain gated.
+
+Independent privacy review found no scoped leak. Rules review found
+that a duplicated transferred card in removed Richese custody escaped
+the initial saved receipt check; a failing-before/passing-after
+regression now requires the recipient's card to be unique across
+all physical non-discard zones. Follow-up review found no remaining
+scoped defect. A throwaway direct engine run completed genuine AI
+setup, private transfer, neutral offer and bot claim; the nonrecipient
+view omitted the given card and the recipient retained it. The
+phone-width rules guide visibly marks this path Partial. `npm run check`
+passed typecheck, lint and 5,804/5,804 offline cases after the custody
+fix; `npm run build` and all 55 Vite development HTTP cases passed. No
+production deployment was verified.
+
 ## 30 September 2026 — Semuta after an early-ended Ornithopter flight
 
 The explicit Richese Semuta preview now interrupts the one public

docs/RICHESE_COMPONENTS.md

@@ -12,7 +12,7 @@ Audited 6 September 2026. The ten physical identities and their readable face in
 
 - Player controls show both original plans, exact undialed counts or honest possible totals, the mode choice and a complete internal guide. No victim/death confirmation is added. The card stays physically reserved until standard cleanup; stale events, duplicate requests and corrupted source custody fail before resources change. All four AI profiles use public force possibilities, legal low-dial plans and revealed leader/bounty information. They preserve leader value when Artillery suppresses bounty and leave traitor/explosion precedence intact.
 
-- Semuta Drug now has an explicit bounded development preview for clean public ordinary-card, completed paid Box and early-ended Ornithopter discards; it does not implement other producers, full-hand ordering or normal Richese starts. Mirror Weapon and Juice of Sapho have separate bounded paths, not complete combined-mode certification. Other unfinished faction/module systems, mobile acceptance, difficulty-strength calibration and complete Advanced/expansion games still prevent goal completion. No start gate was removed.
+- Semuta Drug now has an explicit bounded development preview for clean public ordinary-card, completed paid Box, early-ended Ornithopter and completed private Distrans transfer discards; the private transferred card is not a fresh target. Other producers, full-hand ordering and normal Richese starts remain unfinished. Mirror Weapon and Juice of Sapho have separate bounded paths, not complete combined-mode certification. Other unfinished faction/module systems, mobile acceptance, difficulty-strength calibration and complete Advanced/expansion games still prevent goal completion. No start gate was removed.
 
 The complete integrated validation checkpoint is recorded in [IMPLEMENTATION_STATUS.md](IMPLEMENTATION_STATUS.md).
 

docs/SEMUTA_DISCARD_CONTINUATIONS.md

@@ -4,6 +4,16 @@ Read-only engine audit, 2026-09-07. Read the complete `docs/SEMUTA_DRUG_ENGINE_A
 
 Update: the exchange producers, three battle producers, Sabotage, Robbery overflow and completed Nullentropy Box searches, Ornithopter escrow retirement, definite Truthtrance answers and the five ordinary completed-card effects below now have production automatic continuation frames; see [exchange checkpoint](TREACHERY_DISCARD_CONTINUATIONS.md), [battle checkpoint](BATTLE_DISCARD_CONTINUATIONS.md), [forced Terror checkpoint](TERROR_DISCARD_CONTINUATIONS.md), [Box checkpoint](BOX_DISCARD_CONTINUATIONS.md), [Ornithopter checkpoint](ORNITHOPTER_DISCARD_CONTINUATIONS.md), [Truthtrance checkpoint](TRUTHTRANCE_DISCARD_CONTINUATIONS.md) and [ordinary-card checkpoint](ORDINARY_CARD_DISCARD_CONTINUATIONS.md). The remaining table is an implementation inventory, not a claim that Semuta is active.
 
+30 September 2026 checkpoint: the explicit Semuta development preview
+now stages a `distransDiscard` receipt only after a clean completed
+private transfer. Its fresh batch contains the public played Distrans,
+not the private card already transferred to its recipient. Neutral
+all-seat acknowledgement precedes closure; claim or decline retires
+the saved receipt without redoing the hand transfer. Pending responses,
+gifts and competing parents retain the original direct transfer
+behavior without this Semuta reaction. The table below remains the
+broader producer/continuation inventory, not a claim of complete coverage.
+
 ## Main findings
 
 A post-`applyAction` pile diff cannot implement immediate Semuta. Ix Ambassador and Ixian ally replacement discard then draw directly. Ordinary Karama cancellation/purchase can reach replacement, Harkonnen bonus or a new auction pool indirectly. A stopped frame must resume at a named stage, never rerun its original public action.

docs/SEMUTA_SOURCE_UPDATE_20260907.md

@@ -64,31 +64,34 @@ Do not ask again about normal targets, forced-discard owner bookkeeping, simulta
 The explicit `semuta` development profile starts a fresh Richese roster
 without opening ordinary expansion starts. It now interrupts **one public
 ordinary-card discard, the used Box after a completed paid Nullentropy
-search, or an Ornithopter retired by ending movement early**, provided
-the parent transaction is clean, with a neutral fresh-discard opportunity
-for every seat regardless of hidden Semuta possession. The flight's
-already committed movement and physical escrow remain intact; a claim
-or all-seat decline advances the saved movement queue exactly once.
-Each seat can Continue; only the canonical holder with a free hand slot
-and a card discarded by another player can commit. The sole eligible
-fresh card transfers automatically in the same accepted action, then
-Semuta goes to the normal discard pile. The saved ordinary effect or
-Box parent resumes once; passing by every seat preserves the original
-discard and effect. No face from an undisclosed event is projected
-before commitment. Owner-only multi-candidate selection support exists
-in the reaction component and bot adapter, but no multi-discard
-producer is activated in this bounded runtime.
+search, an Ornithopter retired by ending movement early, or the used
+Distrans after a clean completed private transfer**, provided the parent
+transaction is clean, with a neutral fresh-discard opportunity for every
+seat regardless of hidden Semuta possession. The flight's already
+committed movement and physical escrow remain intact; a claim or
+all-seat decline advances the saved movement queue exactly once.
+Distrans's transferred card stays privately with its recipient and
+cannot be claimed; only the played public Distrans enters this fresh
+batch. Each seat can Continue; only the canonical holder with a free
+hand slot and a card discarded by another player can commit. The sole
+eligible fresh card transfers automatically in the same accepted action,
+then Semuta goes to the normal discard pile. The saved ordinary effect
+or Box parent resumes once; passing by every seat preserves the
+original discard and effect. No face from an undisclosed event is
+projected before commitment. Owner-only multi-candidate selection
+support exists in the reaction component and bot adapter, but no
+multi-discard producer is activated in this bounded runtime.
 
 This neutral all-seat acknowledgement is a conservative **application
 policy**, not a newly discovered publisher timing rule. The explicit
 free-slot requirement is a provisional safety guard, not the printed
 resolution of full-hand take-before-discard. Auction, CHOAM market,
 pending gifts, competing responses, completed Ornithopter flights with
-arrival follow-up and other typed discard producers retain their existing
-automatic continuation; Semuta cannot claim those events yet. The
-completed Box's selected search card stays private and its paid shuffle
-is not repeated when another seat takes the used Box. No source ruling
-is inferred from this omission. The
+arrival follow-up and other typed discard producers retain their
+existing automatic continuation; Semuta cannot claim those events yet.
+The completed Box's selected search card stays private and its paid
+shuffle is not repeated when another seat takes the used Box. No source
+ruling is inferred from this omission. The
 separate [reaction privacy audit](SEMUTA_PRIVACY_REVIEW.md) explains why
 auto-closing only when nobody secretly holds the card would leak
 possession. The main game and public expansion gates remain closed.