Implement private Tupile intelligence and Homeworld occupation evidence

docs/HOMEWORLD_OCCUPATION_LIFECYCLE_AUDIT.md

@@ -1,5 +1,7 @@
 # Homeworld occupation lifecycle integration audit
 
+Runtime follow-up, 10 September 2026: [the implemented observation hooks and Tupile limits](HOMEWORLD_TUPILE_INTELLIGENCE_RUNTIME.md#occupation-observation-boundaries) record the subsequent integration, including why helpers may observe complete Homeworld groups before separate Arrakis/Tanks bookkeeping. This original read-only audit is retained without rewriting its recommendations as completed work.
+
 Read-only code audit, 9 September 2026. This document maps implementation boundaries; it does not settle the occupation interpretations still identified in [the invasion source audit](HOMEWORLD_INVASION_RULES.md#verification-handoff). Root source work must define retention after departure, contested qualification, native high/low coexistence and unique rewards before those consumers are implemented. No runtime, database or deployment changes were made by this audit.
 
 ## Observe semantic force changes, not just actions

docs/HOMEWORLD_OCCUPATION_RULES.md

@@ -1,5 +1,7 @@
 # Homeworld occupation: qualification and unresolved entitlement
 
+Runtime follow-up, 10 September 2026: [Tupile intelligence and qualification history](HOMEWORLD_TUPILE_INTELLIGENCE_RUNTIME.md#occupation-observation-boundaries) implement confirmed observations while retaining the unresolved entitlement and expiry questions below. The source audit remains historical evidence.
+
 Source audit, 9 September 2026. This supplements [Homeworld rules](HOMEWORLD_RULES.md#occupier-lifecycle-and-benefits) and the [invasion audit](HOMEWORLD_INVASION_RULES.md#occupation-evidence-and-unresolved-lifecycle). It defines the evidence that can safely be recorded; it does **not** settle every occupied benefit or authorize a complete occupation release. The [integration audit](HOMEWORLD_OCCUPATION_LIFECYCLE_AUDIT.md) maps the physical mutation and recovery boundaries.
 
 ## Confirmed publisher contract

docs/HOMEWORLD_TUPILE_INTELLIGENCE_RULES.md

@@ -1,6 +1,8 @@
 # Tupile low-population intelligence source contract
 
-Audited 10 September 2026. This checkpoint implements a public eligibility quote only. It does not activate an intelligence action, disclose private information, establish occupation lifecycle rules, or certify Homeworld play. Existing release gates remain.
+Runtime follow-up, 10 September 2026: [private disclosure, durable occupation evidence and verification](HOMEWORLD_TUPILE_INTELLIGENCE_RUNTIME.md) now document the integrated implementation. The source checkpoint below is retained as historical evidence; its future-integration statements describe that earlier inspection.
+
+Audited 10 September 2026; category source follow-up added during the next runtime checkpoint. The original checkpoint implemented a public eligibility quote only. This document supplies the counting contract; it does not certify a disclosure handler, occupation lifecycle or complete Homeworld play. Existing release gates remain.
 
 ## Primary evidence
 
@@ -10,6 +12,8 @@ The [official Ecaz & Moritani rulebook](https://www.gf9games.com/dune/wp-content
 
 The [official November 2020 FAQ](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf), printed p8, permits a Truthtrance question asking whether someone holds a weapon and a defense. It does not provide a held-card category-count algorithm. Its p3 Weirding Way/Chemistry answers describe their conditional roles in a committed battle plan. Those battle roles should not be mistaken for evidence that every card playable in a slot counts in that held-card category.
 
+The fresh category follow-up retrieved **FAQ p5**, which explicitly establishes Weirding Way's default as a projectile weapon and Chemistry's default as a poison defense. Its Voice discussion distinguishes those defaults from optional alternate uses. The original E1 faces were also freshly inspected in [physical component photograph 5495302](https://boardgamegeek.com/image/5495302/dune-ixians-and-tleilaxu), locally `/tmp/dune-ix-cards.jpg`. Weirding Way's printed category lists weapon, defense and special; Chemistry lists defense, weapon and special. Their instructions make the alternate role conditional on playing a complementary card. Therefore the table below is supported by an express publisher default, not merely card color or the order of words in the header.
+
 ## Executable public eligibility
 
 - The native CHOAM player has 0–10 native reserves at the request. Foreign visitors do not contribute to this threshold.
@@ -31,7 +35,42 @@ The appropriate classification composition is physical held cards by their print
 
 Canonical printed identity matters for Richese cards: Stone Burner and Mirror Weapon are printed weapons, Portable Snooper a defense, and Residual Poison a Special card. A transport value such as `kind: special` is insufficient to determine this count. Physical component evidence is recorded in [RICHESE_COMPONENTS.md](RICHESE_COMPONENTS.md).
 
-For Weirding Way and Chemistry, the existing canonical presentation/default battle-role convention is respectively weapon and defense. The official FAQ supports distinguishing the default role from a conditional alternate battle role, but does not expressly answer Tupile held-card counting. This is a documented source composition, not a claimed Tupile-specific FAQ ruling. No category-count function is introduced by this checkpoint. Before a disclosure handler is activated, its canonical category table must be checked against the printed component inventory, including expansion cards; reusing the permissive `isWeaponCard`/`isDefenseCard` slot predicates would incorrectly include Worthless cards and alternate roles. The existing [Truthtrance card-count implementation](TRUTHTRANCE_CARD_COUNT.md) counts named physical identities rather than these categories and is not a substitute.
+The following exact table applies to unplayed cards currently held in hand. `1 / 0` means one weapon and zero defenses **per physical card**, not one per distinct printed name. The canonical identity must match its registered ID, name, kind and effect; a similarly named or effect-tagged fabricated card is not an additional canonical identity.
+
+| Physical cards / canonical classification | Weapon / defense count | Inventory coverage |
+| --- | --- | --- |
+| Crysknife, Maula Pistol, Slip Tip, Stunner; Ix Hunter Seeker (`projectile`) | 1 / 0 | Four base identities; one Ix identity |
+| Chaumas, Chaumurky, Gom Jabbar, Ellaca Drug; Ix Basilia Weapon (`poison`) | 1 / 0 | Four base identities; one Ix identity |
+| Lasgun (`lasgun`) | 1 / 0 | One base identity |
+| Poison Blade (`poisonBlade`) | 1 / 0 | One Ix identity; two attack types still count as one card |
+| Poison Tooth and Artillery Strike (`poisonTooth`, `artillery`) | 1 / 0 | One canonical identity each; E2 replacement faces do not add another physical copy |
+| Weirding Way (`weirdingWay`) | 1 / 0 | One Ix identity; publisher default role |
+| Shield (`shield`) | 0 / 1 | Four base copies and one Ix copy; count every held copy |
+| Snooper (`snooper`) | 0 / 1 | Four base copies and one Ix copy; count every held copy |
+| Shield Snooper (`shieldSnooper`) | 0 / 1 | One Ix identity; two defense types still count as one card |
+| Chemistry (`chemistry`) | 0 / 1 | One Ix identity; publisher default role |
+| Canonical Richese Stone Burner and Mirror Weapon | 1 / 0 | One each; printed weapon category despite saved `kind: special` |
+| Canonical Richese Portable Snooper | 0 / 1 | One; printed defense category despite saved `kind: special` |
+| All Worthless cards, Cheap Hero and Cheap Heroine | 0 / 0 | Five base Worthless, Ix Kull Wahad, two base leader replacements |
+| Other base/Ix Special cards | 0 / 0 | Family Atomics, Weather Control, Hajr, Tleilaxu Ghola, Harvester, Karama, Truthtrance, Thumper and Amal; all their canonical copies |
+| Other Richese Special cards | 0 / 0 | Ornithopter, Residual Poison, Semuta Drug, Distrans, Karama, Juice of Sapho, Nullentropy Box |
+| All three E3 Treachery cards | 0 / 0 | Recruits, Reinforcements, Harass & Withdraw |
+
+Implementation inventory cross-check: the current factories contain 33 base, 14 Ix, ten Richese and three E3 identities. The table accounts for 17 weapon, 13 defense and 30 other identities across that 60-card catalog. These are software catalog totals, **not** a certified combined draw-deck recipe: Richese begins in a separate cache, replacements replace existing cards, and inactive expansion setup remains gated. Sandtrout, Nexus, skill, traitor and other non-Treachery cards are outside this catalog and do not enter the count. The existing [component inventory](COMPONENT_INVENTORY.md) preserves replacement/setup limitations.
+
+The Richese classifications rely on the previously inspected original physical faces documented in [RICHESE_COMPONENTS.md](RICHESE_COMPONENTS.md); this follow-up could not re-fetch that photograph and does not claim a new inspection. Fresh E3 publisher p11 again explicitly excludes Reinforcements and Harass & Withdraw from both categories. Neither category changes because a faction can use a Worthless card as Karama, a skill modifies battle, a hand lacks a complementary card, or an effect is currently disabled in development.
+
+Applying the publisher defaults to Tupile is a source composition, not a Tupile-specific FAQ answer. If a request is admitted after a hybrid has actually been played in a battle, its conditional role is a separate timing context. This audit does not establish whether Tupile then asks for its active battle role or its ordinary held identity. A bounded runtime can exclude the unresolved battle interval through a **public timing rule**, independent of any target's hidden cards. It must not inspect a sealed plan, double-count both possible roles, or disable the action only when a hidden hybrid is present. A retained card returns to its ordinary held default after its battle role ends.
+
+Do not reuse permissive `isWeaponCard`/`isDefenseCard` slot predicates: they admit Worthless cards and alternate roles. The existing [Truthtrance card-count implementation](TRUTHTRANCE_CARD_COUNT.md) counts named physical identities rather than these categories and is not a substitute. Count only the target's actual current hand, excluding caches, draws awaiting assignment, discarded cards and other escrow zones; no future opponent response or subsequent balance change may update a recorded snapshot.
+
+## Establishing unoccupied Tupile without inventing expiry
+
+At this follow-up's code inspection, `Game.homeworlds` is validated as a custody-only object. `homeworldForceGroups` supplies current physical armies; neither it nor `homeworldPopulations` stores prior occupation qualification. There is no current occupation-history record that certifies the absence of an earlier occupier. Logs and an empty current visitor map are not a substitute for that missing lifecycle evidence.
+
+A sole foreign army with no natives is positive current qualification evidence. Current natives beside a visitor do not prove absence of an earlier same-turn qualification; current emptiness likewise cannot settle whether a departed occupier's specific effect persists. The unresolved cases and existing user question remain in [HOMEWORLD_OCCUPATION_RULES.md](HOMEWORLD_OCCUPATION_RULES.md). No duplicate question is introduced here.
+
+A trusted new-setup baseline can establish that no foreign occupation has occurred yet. Future runtime evidence can preserve a conservative no-qualification invariant while all relevant semantic transfers and turn boundaries are observed, then mark it unknown when that invariant can no longer be proved. This is implementation evidence, not a new occupation expiry rule. Any such tracker needs the mutation coverage documented in [HOMEWORLD_OCCUPATION_LIFECYCLE_AUDIT.md](HOMEWORLD_OCCUPATION_LIFECYCLE_AUDIT.md), including intermediate ordered battle losses. Legacy custody lacking the baseline/history must remain unknown; do not initialize it as unoccupied merely because the current board looks clear. The existing pure helper already accepts explicit `unoccupied`, `occupied` or `unknown` from its caller.
 
 ## Current code boundary and verification
 

docs/HOMEWORLD_TUPILE_INTELLIGENCE_RUNTIME.md

@@ -0,0 +1,84 @@
+# Tupile private intelligence and occupation evidence
+
+Runtime checkpoint, 10 September 2026. Native CHOAM can now request and retain a private Tupile intelligence observation in a game with proven setup history. This implements the bounded disclosure described in the [source contract](HOMEWORLD_TUPILE_INTELLIGENCE_RULES.md); occupation entitlement, expiry and occupied income remain unresolved. Advanced and unfinished expansion starts, publication and complete-rules release retain the gates in [README](../README.md).
+
+## Request and historical answer
+
+The engine accepts `{ type: 'tupileIntelligence', target, category }`, where `target` identifies a seated opposing faction and `category` is `weapons` or `defenses`. The server validates current eligibility before reading the answer or consuming use:
+
+- CHOAM has at most ten native reserves on Tupile and occupation evidence proves that Tupile has never qualified an occupier since setup.
+- CHOAM has positive physical forces on a Homeworld native to the target, or that target has positive physical forces on Tupile. Contact can be contested. Sharing a third faction's world does not qualify either visitor as the other's target.
+- The faction has not already answered a successful Tupile request during this game. Another category, turn, contact direction, departure or reentry does not renew its use. Either Emperor world supplies contact with the same single faction allowance.
+- The game is playing and the current response or committed action permits the request. Pending decisions, responses, Truthtrance, phase openings, supported nested card operations and revealed battles block it. The request does not require CHOAM's ordinary movement turn and creates no opponent confirmation or Karama response.
+
+One accepted action records the target's current spice and the selected held-card count, then consumes that faction's allowance. It does not spend spice, discard a card or move a force. Rejected actions reveal no answer and consume no use. The server's current target projection supplies availability to both the component and bot policy.
+
+Only CHOAM receives the observation. The public chronicle identifies use against a faction without exposing the chosen category, answer, hand identities or private receipt. Other sessions receive no Tupile panel data. The stored answer is historical: a later expenditure or hand change does not update it. A blocked new request, including one blocked by occupation uncertainty, does not hide an already obtained answer.
+
+The [answer helper](../game/tupile-intelligence-answer.ts) counts canonical physical cards in the current hand by printed primary category. Multiple held copies count separately; duplicate physical IDs or malformed identities reject. Caches, discard piles, escrowed cards, leader skills and cards merely compatible with a battle slot are excluded. Richese cards use their verified printed categories despite their transport representation as Special cards. Weirding Way counts as a weapon and Chemistry as a defense using the publisher's default-role FAQ. Applying those defaults to this held-card question is a documented composition, rather than a Tupile-specific FAQ ruling. The unresolved revealed-battle interval is blocked using public timing, independently of anyone's hidden hand. The complete category table and source limitations remain in the [source contract](HOMEWORLD_TUPILE_INTELLIGENCE_RULES.md#private-answer-and-held-card-classification).
+
+## Durable evidence and legacy saves
+
+Genuine completed Homeworld setup creates a paired initialization record:
+
+| Saved field | Purpose |
+| --- | --- |
+| `homeworlds.historyVersion` | Marks the initialized occupation-history format. |
+| `homeworldOccupationHistory` | Binds the setup roster, physical source snapshots, accepted source events and confirmed qualifications. |
+| `tupileIntelligence` when CHOAM is seated | Binds lifetime faction usage and private historical observations. |
+
+The engine requires the marker and history together, and requires the CHOAM ledger for an initialized CHOAM game. Deleting an individual initialized field, removing used receipts, changing an answer or altering the bound occupation evidence rejects views, normalization and actions. Original physical contact, turn, phase, faction and event remain part of each intelligence receipt. Historical validation does not compare an old answer with today's hand or spice.
+
+The signatures are canonical consistency data, **not cryptographic authentication**. Independent source receipts let the history validator recompute its qualification records; the outer signature binds their membership and order. They detect the tested inconsistent edits, not an attacker rewriting every field and every matching signature. A wholly absent legacy marker/history/intelligence set remains distinguishable from a partially deleted initialized record only to the extent that those saved fields provide evidence.
+
+Legacy saves without these initialization fields remain readable, with occupation unknown and new Tupile requests blocked. Reads and automatic normalization never adopt the current board as a proven setup, reconstruct departed occupiers, restore a lifetime use or invent an earlier answer. Existing D1 rooms retain their original state; no database reset or bulk history migration installs this feature. Accepted actions use the existing room-version compare-and-swap write, so simultaneous weapon/defense requests against one faction can persist only one answer.
+
+## Occupation observation boundaries
+
+The [occupation-history module](../game/homeworld-occupation-history.ts) records facts rather than choosing a current controller. A sole positive foreign army with no native or other foreign army qualifies immediately. At the end and start of the full game turn, every positive foreign presence gets its own boundary evidence, including contested worlds. Kaitain and Salusa are separate physical locations. Qualification at another Homeworld does not itself remove Tupile's low advantage.
+
+The pure reducer interns public typed-force snapshots, binds each recorded source to its event, turn and cause, and retains the first qualification for each world/player/turn/cause. Replaying a known event with different source facts rejects. A same-turn change call with unchanged physical facts returns unchanged data without appending another empty observation. Returned ledgers are detached from their inputs.
+
+Engine change-event identities derive deterministically from the original setup event and current source-record position. Resolving an action directly or restoring the same committed inner continuation therefore produces the same occupation evidence. Turn-start/end identities derive from their turn and boundary cause. Concurrent branches may propose the same next identity, but the room-version write persists only the winning branch; the reducer still rejects reuse of a recorded identity with different physical facts. Generating a new random change identity during recovery would incorrectly make otherwise identical saved continuations diverge.
+
+The integrated hooks preserve the semantic order of physical changes:
+
+| Boundary | Observation order |
+| --- | --- |
+| Genuine setup | Seed the visitor-free baseline before the first phase opens. |
+| Normal or single-traitor battle | Observe loser elimination before losing-card disposal and separately observe winner casualties. A sole foreign interval remains recorded even if the winner subsequently loses its last force. |
+| Mutual traitor or explosion | Observe the completed simultaneous army-destruction group, avoiding array-order qualifications. A later owned native explosion allocation has its own committed boundary. |
+| Winner aftermath | Observe complete Ix substitution and Face Dancer replacement before later cleanup. |
+| Native departure and revival | Observe after the helper installs all native totals, elite totals and Homeworld custody. The ledger reads only those world groups, so later Arrakis placement or Tanks bookkeeping cannot create an artificial Homeworld interval. |
+| Other transfers | Observe complete Homeworld shipment, Junction transport, Emperor inter-world movement, Ambassador shipment, Sneak Attack, Guild transport, revival deployment and Caladan reinforcement before dependent arrival effects. |
+| No-Field and Trip to Gamont | Observe the real reveal/departure and the later return separately; a single outer-action scan would miss a transient sole occupation between them. |
+| Full-turn rollover | Record the old turn's end before incrementing the turn; record the new turn's start before opening Storm opportunities. |
+
+Action/continuation observation also provides a final check of physical changes. It does not replace the internal battle and transfer hooks. The earlier [lifecycle audit](HOMEWORLD_OCCUPATION_LIFECYCLE_AUDIT.md) remains the historical integration analysis; this checkpoint refines its placement recommendation for helpers that read only complete Homeworld groups.
+
+No history observation grants occupied income, shares spice, awards a unique power or implements expiry. A history complete from setup with no Tupile qualification supplies `unoccupied`; any recorded Tupile qualification supplies `unknown` until the [pending entitlement ruling](HOMEWORLD_OCCUPATION_RULES.md#questions-the-retrieved-sources-do-not-settle) resolves departure, replacement and contested benefits. Departure and native revival preserve that uncertainty rather than declaring a permanent current occupier or silently resetting the advantage. Mere invasion alongside natives does not qualify immediately and is not a blanket block on intelligence before a qualifying boundary.
+
+## Client, bot and verification scope
+
+[Tupile controls](../components/tupile-intelligence.tsx) provide explicit opponent and category selection, one request button, the current blocking reason and private historical observations. Busy and ineligible controls cannot submit. The empty-target explanation distinguishes lack of contact from already-used factions. No opponent hand or balance is read to determine eligibility.
+
+[Shared options](../game/tupile-intelligence-options.ts) supply all four bot profiles with the first currently eligible weapon-count request and stop requesting a used faction. This demonstrates a legal common policy. It does not claim that profiles strategically exploit intelligence differently or add AI strength calibration.
+
+The focused evidence is split across [public eligibility](../tests/tupile-intelligence.test.ts), [canonical counts](../tests/tupile-intelligence-answer.test.ts), [private durable state](../tests/tupile-intelligence-state.test.ts), [occupation history](../tests/homeworld-occupation-history.test.ts), [controls](../tests/tupile-intelligence-controls.test.ts), [actual engine flows](../tests/tupile-intelligence-engine.test.ts) and [production SQLite recovery](../tests/tupile-intelligence-recovery.test.ts). The recovery suite uses real session authentication, production room code and all migrations in disposable in-memory databases. It covers concurrent categories, lost-response rereads, private serialized views and logs, unchanged unrelated rooms, corrupt-record rejection without writes, legacy uncertainty and actual occupation/departure. Conserved staged positions and later private-hand fixtures are documented in the tests; they do not fabricate successful disclosures or qualification receipts.
+
+Commands for the integrated verification are:
+
+```sh
+npm test -- tupile-intelligence homeworld-occupation-history
+npm run check
+npm run build
+npm run test:integration
+```
+
+Final verification: **`npm run check` passes types, lint and all 3,755 offline tests** (98.8 seconds for the tests). The change adds 41 cases across new test files and two real-battle cases in [Homeworld battle tests](../tests/homeworld-battle-engine.test.ts), with an existing typed-explosion case also strengthened. **The production build and all 40 HTTP/session integration checks pass.** Existing fixture families now bind their final factions and authenticated seat IDs before genuine setup, preserving roster and history validation. Explicitly staged Basic counter positions record their completed public position before testing normalization purity. The existing Ghola direct-action/inner-continuation comparison verifies the new deterministic observation identity.
+
+The coordinating browser pass used three human sessions in room `ZMA84DY8`, through version 7. Keyboard controls shipped one CHOAM force to Caladan, changing native reserves from ten to nine, then disclosed the target's **17 spice and one weapon only to CHOAM**. A later Atreides shipment reduced its current spice to 16 while the saved observation remained 17. Refreshing all three sessions preserved privacy with no page errors. Desktop 1440-pixel and phone 390-pixel layouts were inspected. After improving the no-eligible-target explanation, the final read-only three-session restoration and phone review passed: Atreides is clearly marked used, Harkonnen lacks contact, and the historical 17-spice/one-weapon answer remains visible to CHOAM. The coordinating inspection artifact is `/tmp/dune-tupile-final-phone.png`; this temporary image is not a committed dependency.
+
+The coordinated 22:42 development-server restart preserved all **3,112** baseline rooms. After the browser work and final HTTP checks, every one of those room versions and state hashes still matches. The database now contains 3,173 rooms: the baseline, this isolated browser room and 60 rooms created by the two integration runs. Read-only restoration also passed for earlier Grumman `HU6YUC7Z` (version 10), Caladan `LV2TNQ88` (version 5), and revival `463GUCY3` (version 7), with all three private seats in each. No saved game was reset or rewritten to install the feature.
+
+Final logs: `/tmp/dune-tupile-verified-check.log`, `/tmp/dune-tupile-verified-build.log`, `/tmp/dune-tupile-verified-http.log`. The browser screenshots and private session files remain outside version control. No goal completion or expansion release is claimed by this checkpoint.

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,7 @@
 # Dune implementation status
 
+**Tupile private intelligence and occupation evidence checkpoint, 10 September 2026:** [HOMEWORLD_TUPILE_INTELLIGENCE_RUNTIME.md](HOMEWORLD_TUPILE_INTELLIGENCE_RUNTIME.md) records current low-population contact checks, one historical spice/category answer per opposing faction, private controls and shared legal bot requests. Genuine setup binds qualification history and lifetime usage; legacy history stays unknown. Ordered battle observations retain brief sole occupation while simultaneous destruction does not invent it. Deterministic source identities make direct actions and restored continuations agree. **3,755 offline tests, types, lint, production build and 40 HTTP/session tests pass.** Three-seat desktop/mobile keyboard shipment, private disclosure, later balance change and refresh passed. The hourly restart and final comparison preserved all 3,112 preexisting room versions/hashes. Occupation entitlement/expiry/income, complete module games and the full expansion goal remain unfinished; no release gate opened. The removed automation stays removed.
+
 **Grumman Collection and stacked Terror checkpoint, 10 September 2026:** [GRUMMAN_STACKED_TERROR_RUNTIME.md](GRUMMAN_STACKED_TERROR_RUNTIME.md) records one hidden-token addition with four bank spice, separate Mentat placement, private stacked-token selection, shared controls/AI and durable discard/alliance continuations. Review fixed selected-choice rewinds and restoration of a consumed Sabotage token during its genuine discard child. **3,712 offline cases, types, lint, production build and 40 HTTP/session cases pass.** Desktop/phone keyboard Collection, shipment, token selection, Robbery payment, public stack count and three-seat private refresh passed. All 3,081 preexisting room versions/hashes remained unchanged. Removal custody, occupation, unfinished effects and complete expansion games remain unresolved; no release gate opened. The existing server was reused and the removed automation stays removed.
 
 **Caladan victory reinforcement checkpoint, 10 September 2026:** [HOMEWORLD_VICTORY_REINFORCEMENT_RUNTIME.md](HOMEWORLD_VICTORY_REINFORCEMENT_RUNTIME.md) records the actual high-Caladan post-victory one-force transfer, current population and survivors, original battle location, exact native/visitor custody, owned controls and all-profile AI. Shared Ambassador arrivals preserve the original reinforcement and its nested children. Independent review reproduced and fixed arrival-to-choice rewinds and a deleted preceding cleanup choice; new revival returns also carry version-bound independent progress, while legacy completed QA saves remain readable. Final types, lint, **3,682 offline cases** (89.9 seconds), production build and **40 HTTP cases** pass. Eight Caladan production SQLite cases cover competing writes, reloads, private projections, nested arrivals and corruption. Two older Face Dance fixtures now explicitly decline the preceding guarded Caladan option, without choosing the unresolved placement order. Desktop and phone keyboard placement and three-seat refresh passed; final restart restoration passed for both Caladan and revival QA games. All **3,051** pre-existing room versions/hashes remain unchanged after restart and additive HTTP work. Low-Tupile public contact/once-per-faction quoting has seven cases but no playable disclosure action. Face Dancer ordering, guarded entry combinations, occupation, other missing effects and complete expansion games remain unfinished; no release gate opened. User workflow optimizations remain in use and automation stays removed.