Connect revealed Harass force allocation and exact casualties

Harass & Withdraw now admits legal Basic/Advanced mixed ordinary/elite commitments and multi-sector returns. A shared physical quote validates every returned counter against one exact legal dial/support complement. After both plans are revealed, the owner selects an ambiguous allocation; unique returns remain automatic. Selected counters become public before Traitor declarations, while physical transfer waits for atomic settlement and opposing-Traitor cancellation. This information is never added to a sealed Battle Plan or complete-plan inspection. Existing optional-module and Richese/Ecaz-allied gates remain.

The player panel, four AI profiles and saved event use the same quote. A versioned receipt binds the revealed plans, current typed location pools, battle and owner. Missing or altered receipts fail before reads, normalization and writes; concurrent choices select once. Previously valid legacy unique plans continue without reopening. Winner casualties now equal the selected dialed group, preventing a second smaller physical commitment after its undialed complement has returned.

Independent source and implementation review passed. Pure, engine, control and SQLite regressions cover typed/sector legality, exact complement, private pre-reveal views, public selected views, stale/malformed state, cross-owner actions, raced allocations, selected restoration, automatic exact casualties, opposing-Traitor cancellation and mandatory disposal. Types, lint and 4850 offline tests, production build and 43 HTTP/session tests pass. The first broad check caught the exhaustive decision registry and test union-narrowing omissions; those were fixed before the final stable checks. Browser testing corrected the incomplete-allocation selector label before verification.

Eight genuine card-variant Basic/Advanced games across all four homogeneous AI profiles completed with 9956 accepted actions, 266 periodic JSON restores and zero rejected candidates. Three Harass plans/returns and two Recruits plays occurred; no ambiguous allocation arose in these seeds. The new choice is exercised by targeted engine, authenticated recovery and browser cases, not inferred from those full-game samples. Full variant and combined-expansion acceptance remains incomplete.

A fresh isolated browser room used genuine Advanced card-variant setup followed by a conserved two-sector battle fixture. Actual controls rejected a partial return, selected two ordinary counters from sector nine, and preserved the selected state after refresh. Following actual owner and engine-driven opponent Traitor declines, two counters returned, the exact remaining ordinary/elite pair went to the Tanks, support cost one, and Harass discarded once. Final refresh restored 18 reserves, two Tanks, 29 spice and the same private Traitor. This is targeted browser evidence, not a complete human game.

All 1038 opening games and original seat/recovery/entry/handover records are unchanged; 1072 rooms remain including new QA. SQLite integrity and foreign keys pass. The healthy development server was reused without restart or reset. No mode/publication gate was opened.

Verified source tree: 61ee78f6e2bce47cb322b04f896db27fef28c56ba2097571a1d85bad5c121156

docs/CURRENT_STATUS.md

@@ -6,19 +6,19 @@ gated.** Prototypes do not open completion or publication gates.
 
 ## Current checkpoint and work
 
-Latest verified checkpoint: `368a7a5`, [reusable game samples](VERIFICATION_WORKFLOW.md#reusable-base-and-faction-sample-games).
-Types, lint and **4,823 offline tests** passed. Ten genuine base samples and
-six expansion samples completed in 6,746 accepted actions with 175 periodic
-save/restore checks. Base samples had no rejected candidates; expansion samples
-retained 82 guarded arrival candidates before legal alternatives. The tooling
-checkpoint changed no application, dependency, HTTP or database code.
-All 1,038 opening games and original seat/recovery records were unchanged.
+Latest verified checkpoint: `6403425`, [AI arrival preflight](BOT_ARRIVAL_PREFLIGHT.md).
+Types, lint and **4,829 offline tests** passed. Eighteen genuine base and expansion
+samples completed in 9,470 accepted actions with 247 periodic save/restore checks
+and no rejected candidates. Accepted gameplay matched the prior same-seed runs
+apart from random event identifiers. All 1,038 opening games and original
+seat/recovery records were unchanged; the browser test seat reconnected.
 Earlier evidence remains in the [implementation history](IMPLEMENTATION_STATUS.md).
 
 The connected [Harass & Withdraw prototype](HARASS_WITHDRAW_RUNTIME.md) supports either
 battle-card slot, private category inspections, exact undialed normal/elite
 returns, opponent-Traitor cancellation, mandatory disposal, controls and all
-four AI profiles. Physical allocation must be unique. Richese card combinations
+four AI profiles. New battles also have [revealed physical allocation](HARASS_ALLOCATION.md) for
+ordinary/elite mixtures and multi-sector returns. Richese card combinations
 and additional optional modules stay gated. Withdrawal before explosion and
 card-specific discard precedence are explicitly labeled inferences. The Stone
 Burner timing question is pending; no user answer is assumed. Reinforcements
@@ -30,12 +30,11 @@ and foreign-key checks passed, and refresh restored the test seat. No restart,
 database reset or recurring automation was needed. Exact verification, source
 fingerprints and delivery are recorded in the private report and Git message.
 
-Current work: [AI arrival preflight](BOT_ARRIVAL_PREFLIGHT.md) reuses the engine's
-existing reaction quote to avoid repeatedly proposing guarded ordinary entries.
-The adapter preserves legal single reactions, faction exemptions, contribution
-routing and private information; specialized routes retain their own adapters.
-The Moritani Secret Ally audit retains the shared pending hidden-reaction UX
-question. No arrival-order ruling or module/publication gate is changed.
+Current work: [Harass force allocation](HARASS_ALLOCATION.md) connects the missing
+player choice after reveal, with shared legal AI, exact winner losses and saved
+continuation. Unique returns stay automatic and sealed plans stay unchanged.
+The remaining Leader Skill bands retain their existing pending rulings; this
+checkpoint introduces no new arrival-order or hidden-reaction policy.
 
 ## Authoritative navigation
 

docs/HARASS_ALLOCATION.md

@@ -0,0 +1,54 @@
+# Harass & Withdraw physical allocation
+
+14 September 2026. A connected prototype now supports the ordinary/elite and
+multi-sector choices previously rejected as ambiguous. The existing card,
+mode and combination restrictions remain in force.
+
+## Timing and information
+
+The [source contract](ECAZ_TREACHERY_RULES.md) and
+[Harass runtime](HARASS_WITHDRAW_RUNTIME.md) place withdrawal when Battle Plans
+are revealed. Counter identity and sector allocation are not printed Battle
+Plan elements. Before sealing, the engine therefore checks that a legal physical
+allocation exists. It does not ask for or reveal a future allocation through
+Prescience or complete-plan inspection.
+
+After both plans are public, a uniquely determined return proceeds automatically.
+When multiple physical commitments or sector allocations are legal, the owner
+chooses every undialed ordinary and elite counter before Traitor declarations.
+There is no decline or partial-return alternative. The selected allocation then
+becomes public. Physical transfer still waits for the existing atomic Traitor
+settlement, so an opposing successful call cancels the return without rollback.
+This applies the printed reveal timing to a digital choice; it does not establish
+an order among currently excluded optional-module effects.
+
+## Connected behavior
+
+The shared quote validates an exact complement of one legal physical dial/support
+commitment, each location's typed supply, integer counters and complete return.
+The revealed panel selects a physical commitment and permits editing each sector.
+All four AI profiles use the same deterministic legal allocation. Their pre-plan
+estimate is not a binding early choice and is not added to the sealed plan.
+
+New battles carry a version marker. A saved choice binds its battle, owner,
+event, revealed plans and force locations. Missing or inconsistent state rejects
+before views, normalization or action writes. Refresh restores a pending choice;
+concurrent submissions select once through the existing room version check.
+Previously valid unversioned battles keep their unique automatic derivation.
+
+After an executed withdrawal, winner casualties must equal the already chosen
+dialed counters. Recalculating a smaller physical commitment could incorrectly
+leave an ordinary or elite force behind. The resolution quote now restricts its
+casualty options to that exact remaining group. Traitor cancellation retains
+ordinary original-force losses. Card disposal and subsequent Face Dancer cleanup
+reuse the existing continuation.
+
+## Evidence and limits
+
+Pure, real-engine, all-profile, controls and in-memory SQLite cases cover typed
+and sector choices, no early disclosure, exact losses, traitor cancellation,
+legacy continuation, malformed saves, concurrent selection and restoration.
+The final check/build, sample and browser results are recorded in the private
+source-bound checkpoint and Git message. Samples are evidence only for their
+observed configurations and actions. This is not complete Ecaz card-variant or
+combined-expansion certification.

docs/HARASS_WITHDRAW_RUNTIME.md

@@ -46,7 +46,7 @@ plan still contains its exact ID. Complete-plan inspection reveals the actual
 physical plan; Truthtrance's existing literal slot-occupancy promises keep their
 meaning. An empty-category answer is not a promise that the physical slot is empty.
 
-The shared physical quote derives dialed counters from `casualtyOptions`, then
+The shared physical quote validates dialed counters from `casualtyOptions`, then
 returns the undialed normal and elite counters to their owner's reserves. The
 leader resolves normally. An opponent's successful Traitor call, including mutual
 calls, cancels withdrawal. Returned reserves are outside subsequent board losses
@@ -54,7 +54,9 @@ and Face Dancer replacement. Harass is discarded once and excluded from ordinary
 winner retention and Moritani ally retention.
 
 Both selectors enforce the complete pair in either selection order. The private
-guide shows the exact return and a reason for an unsupported choice. All four AI
+guide explains unique returns or the later revealed allocation choice. The
+[physical allocation follow-up](HARASS_ALLOCATION.md) connects typed and sector
+selection after reveal, with exact committed winner losses. All four AI
 profiles use the same physical quote and category-aware inspection comparison;
 the card adds no fictitious weapon or defense value. Stronger profiles value
 saved forces when expecting defeat and discourage use when expecting to win.
@@ -62,10 +64,9 @@ This is a legal strategy path, not strength calibration.
 
 ## Current boundaries
 
-- Basic and Advanced physical allocations must identify one normal/elite
-  commitment and one return allocation among sectors. Zero/all returns and
-  unique typed allocations are supported. Ambiguous allocations reject before
-  sealing; explicit private allocation controls remain unfinished.
+- Basic and Advanced now support explicit ordinary/elite and sector allocation
+  after reveal. Unique returns are automatic; previously valid legacy battles
+  retain unique-only derivation. See the [allocation contract](HARASS_ALLOCATION.md).
 - Additional optional modules remain gated, including Homeworlds, Nexus,
   Leader Skills, Tech Tokens, Stronghold Cards and Discoveries. This includes
   the printed own-Homeworld prohibition without claiming other Homeworld

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,17 @@
 # Dune implementation status
 
+## 14 September 2026 — Harass revealed physical allocation
+
+Connected ordinary/elite and multi-sector choices after public plan reveal,
+before Traitor declarations. Unique returns remain automatic; selected counters
+are public but stay on board until atomic Traitor settlement. The shared quote,
+player controls, four AI profiles and versioned saved decision preserve exact
+custody and existing mode gates. Winner casualties cannot choose a smaller
+physical commitment after its undialed complement has returned. See
+[the allocation contract](HARASS_ALLOCATION.md) for source timing and limits;
+source-bound final evidence and delivery remain in the private report/Git message.
+
+
 
 ## 14 September — AI ordinary arrival preflight