Preflight Guild transport arrival candidates before bot play

docs/BOT_ARRIVAL_PREFLIGHT.md

@@ -72,3 +72,27 @@ genuine-setup replay completes in 786 accepted attempts, zero rejections,
 21 JSON continuations and the same fourth-turn shared victory. This repairs
 candidate legality, not the unsupported arrival-rule composition or public
 expansion start gate.
+
+## 29 September: Guild cross-planet transport and Terror
+
+An unmodified six-seat Advanced Moritani sample at base seed `20260930`
+completed 1,262 actions and 34 JSON restores but proposed six illegal
+cross-planet Guild transports into a placed Terror while Guild income was
+pending. The existing bot preflight covered ordinary shipments, not the
+single-source `guildShip` action.
+
+The owner-view adapter now quotes those transports with the submitted source,
+physical count, Guild tariff and selected ally payment. It excludes only
+publicly unsupported arrival combinations; payment entirely funded by the
+Guild ally has no Guild income response and remains eligible. Multi-source,
+Nexus and special routes still use their separate adapters. No Terror face or
+rival private field is read. The authoritative engine still decides every
+actual transport.
+
+The focused engine regression first reproduced the rejected Guild action,
+then exercised all four profile filters and a Guild-funded accepted action.
+Same-seed genuine setup replay completed the same 1,262 accepted actions with
+zero rejected candidates and 34 JSON continuations. Both actual
+assassination opportunities were declined; this is not a natural reveal or
+replacement sample. The unsupported reaction combination and public
+expansion gate remain unchanged.

docs/CURRENT_STATUS.md

@@ -6,6 +6,16 @@ Expansion starts and full rules/publication acceptance remain gated.**
 
 ## Current checkpoint and work
 
+A six-seat Advanced Moritani sample exposed six illegal bot Guild
+cross-planet transport candidates into a placed Terror while Guild income
+was pending. [Arrival preflight](BOT_ARRIVAL_PREFLIGHT.md#29-september-guild-cross-planet-transport-and-terror)
+now quotes the submitted single-source transport and payment using public
+arrival triggers. The same genuine game completes 1,262 accepted actions,
+zero rejected candidates and 34 JSON restores; both assassination choices
+were declined. This repairs AI candidate legality, not the unsupported
+arrival composition, natural assassination reveal coverage, normal
+expansion starts or deployed acceptance.
+
 The owner-only [administrator accounts](ADMIN_ACCOUNTS.md) prototype now
 lists accounts, provisions a browser-generated one-time personal key, changes
 another account’s role and disables access. Server actions repeat live owner

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,26 @@
 # Dune implementation status
 
+## 29 September 2026 — Guild transport arrival preflight
+
+The [arrival preflight](BOT_ARRIVAL_PREFLIGHT.md#29-september-guild-cross-planet-transport-and-terror)
+now filters single-source Guild cross-planet transport candidates before
+they enter a publicly unsupported Terror/Guild-income reaction combination.
+A six-seat Advanced Moritani game at base seed `20260930` first completed
+1,262 accepted actions, six rejected Guild candidates and 34 JSON
+continuations. Same-seed replay after the fix completed 1,262 accepted
+actions, no rejected candidates and 34 JSON continuations. Two real
+assassination offers were declined; neither sample shows a natural reveal.
+
+A focused engine test reproduced the illegal action before the fix, then
+covered all four bot filters and accepted Guild-funded transport with no
+income response. No card face, hidden rival data or unsupported arrival
+ordering enters the quote. Existing expansion start and publication gates
+stay closed.
+
+`npm run check` passes typecheck, lint and 5,781/5,781 offline cases.
+No app route or persisted database changed; the production build and HTTP
+suite were not repeated for this bot-only correction.
+
 ## 29 September 2026 — owner account management prototype
 
 The [account page](ADMIN_ACCOUNTS.md) lists only safe metadata to a live