Resolve ambiguous Stone battles with sealed physical totals

Add a provisional post-reveal physical-count commitment for new outcome-changing Basic/Advanced Stone and copied Mirror battles. Keep all original sides sealed until complete and retain matching later typed losses. Preserve legacy, ordinary and invariant-winner timing. Carry the same constraint through card cleanup and native casualty consumers.

Validation: frozen 16 files146/146, types/lint/build and14 original-action/rendered-control programmes; four minimal policies make both owned choices legally. Source timing is explicitly provisional. Wider combinations, assurance and deployed acceptance remain open. No saved-game, reset, restart or deployment operation.

docs/CURRENT_STATUS.md

@@ -16,6 +16,28 @@ open mode gates.
 
 
 ## Current checkpoint and work
+**Stone Burner physical allocation — 18 October. Prototyped / Partial.**
+New original Basic/Advanced Stone and copied Mirror battles now finish
+outcome-changing mixed-force comparisons. Only ambiguous sides privately commit
+an undialed physical total; all original required values stay sealed until
+complete. The winner retains compatible later ordinary/elite loss choices.
+Ordinary/invariant battles and unstamped legacy frames retain their prior path.
+Timing is explicitly provisional under the 14 October choose-recommended policy.
+
+Three disjoint lanes and owner integration pass frozen **16 files146/146**,
+types/lint/build and14 finite original-action/rendered-control programmes.
+Original paid Stone uses69 Basic/52 Advanced source actions, actual next-turn
+Mirror90, both native mixed sides95 in either seat order. Both outcomes and
+same-count typed alternatives complete; four minimal policies make both legal
+private choices. Actual Mirror feedback repaired a card-cleanup continuation
+that lost the narrowed physical count; native consumers now retain it too.
+Historical guard tests explicitly keep legacy coverage; no printed number changed.
+
+Framework aliases/CSS stubs mean no visual/browser/deployed acceptance. Wider
+combinations, full modes and final assurance remain open. No saved room/database,
+reset, restart or deployment.
+[Exact source, procedure and proof](STONE_BURNER_ENGINE_AUDIT.md#outcome-changing-physical-totals--18-october-2026).
+
 **Independent cards with Discovery — 18 October. Prototyped / Partial.**
 Fresh classic and selected-deck tables now combine independent36/38/50 with
 Discovery7/8, with or without Nexus12. Original World/all14/Tech3+/Advanced
@@ -5708,7 +5730,7 @@ These links define bounded working behavior, not complete module certification.
 | Area | Current connected work and evidence |
 | --- | --- |
 | Base/Advanced setup | [Normal Advanced preview](ADVANCED_PREVIEW.md), [genuine setup](ADVANCED_SETUP_TEST_SEAM.md), [Advanced study](AI_ADVANCED_SETUP_CALIBRATION_20260907.md), [Fremen cancellation](FREMEN_MOVEMENT_KARAMA_RULES.md), [Atreides full-plan audit](ATREIDES_FULL_PLAN_TIMING.md). Earlier Basic-then-flip fixtures do not establish current setup coverage. |
-| Expansion factions | [Ixians/Tleilaxu](IX_PROTOTYPE.md) and [all seven faction selections](EXPANSION_FACTIONS_PROTOTYPE.md): genuine setup, Ecaz six-force placement and [Advanced Loyalty](ECAZ_LOYALTY.md), separate optional card variants, private controls and saved per-lot Ixian/Richese decline. Actual special-lot exchange remains pending. |
+| Expansion factions | [Ixians/Tleilaxu](IX_PROTOTYPE.md) and [all seven faction selections](EXPANSION_FACTIONS_PROTOTYPE.md): genuine setup, Ecaz six-force placement, [Advanced Loyalty](ECAZ_LOYALTY.md), separate optional card variants and private controls. The [adopted Ixians D source](RICHESE_AUCTION_RULES.md#explicit-source-boundaries) excludes Richese auctions from Technology; no special-lot exchange or decline is required. |
 | Leader Skills | [Common lifecycle](LEADER_SKILLS_RUNTIME.md), [known skilled capture](LEADER_SKILLS_CAPTURE.md), [Mentat question preview](MENTAT_QUESTION.md), [Bureaucrat payments](BUREAUCRAT_PAYMENTS.md), five battle disciplines, [Planetologist](PLANETOLOGIST_RULES.md), [Suk Graduate](SUK_GRADUATE_RULES.md), [Rihani and other battle effects](LEADER_BATTLE_EFFECTS.md), [Smuggler shipment](SMUGGLER_SHIPMENT.md), [No-Field](SMUGGLER_NO_FIELD.md) and [battle collection](SMUGGLER_BATTLE.md), [Sandmaster routes](SANDMASTER_MOVEMENT.md) and [worm rides](SANDMASTER_WORM.md), [Banker spending](SPICE_BANKER_RUNTIME.md), [Diplomat defense](DIPLOMAT_DEFENSE.md) and [bounded retreat](LEADER_SKILLS_RULES.md#bounded-diplomat-retreat-interpretation). Remaining bands and combinations are explicit in those contracts. |
 | Discoveries | [Prototype](DISCOVERY_PROTOTYPE.md): genuine setup, Great Maker, seven cards/eight tokens, inspection and stash rewards, nested sites, signed later free entry, carried Ornithopter, sole Cistern, bounded Orgiz transfers, Jacurutu income, Testing Station and Shrine. Orgiz's per-deposit interpretation, contested/shared benefits and mixed physical allocation remain provisional or pending. The Orgiz path in current source is not yet deployed. |
 | Nexus/Homeworlds | [Decision index](RULE_DECISIONS.md) links each integrated faction family, native/borrowed effects, physical custody, private choices, payments and transport. [CHOAM Secret Ally trade and bounded after-victory inspection](NEXUS_CHOAM_SECRET_ALLY.md), [Moritani Secret Ally losing-card retention](NEXUS_MORITANI_RULES.md#secret-ally-losing-card-retention-prototype), [Ecaz private yes/no inquiry and bounded native Duke Cunning](NEXUS_ECAZ_RULES.md#bounded-native-cunning-duke-vidal), [Emperor extra revival and bounded bank-auction purchase](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md) are connected. Uniform CHOAM winner/Moritani loser windows, Ecaz inquiry scope/audience and Ecaz Cunning's Battle-only window are product inferences, not publisher rulings. Source audits or helpers alone do not certify full module games. |

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,23 @@
 # Dune implementation status
 
+## 18 October 2026 — Outcome-changing Stone physical totals
+
+New original Basic/Advanced Stone and copied Mirror now request sealed physical
+totals only when they can change the winner. Every originally ambiguous side
+commits; the eventual winner keeps all matching later typed loss choices.
+Ordinary/invariant and unstamped legacy battles retain their earlier paths.
+This is explicit provisional timing, with no new numerical rule.
+
+Three exclusive lanes and owner integration pass frozen16-file146/146,
+types/lint/build and14 original-action/rendered-control programmes; four policies
+make both private choices legally. Actual Mirror feedback repaired the mandatory
+card-cleanup constraint and native suffix consumers retain the same count.
+Guard regressions now distinguish old and new frames; fixture expectations
+respect normal city income and closed battle frames.
+[Canonical source, proof and limitations](STONE_BURNER_ENGINE_AUDIT.md#outcome-changing-physical-totals--18-october-2026).
+No complete-mode, comprehensive combination/assurance or deployed claim;
+no saved room/database mutation, reset, restart or deployment.
+
 ## 18 October 2026 — Independent cards with Discovery
 
 Fresh selected36/38/50 and original Discovery7/8 now compose with or without

docs/RULE_DECISIONS.md

@@ -874,7 +874,8 @@ These are unresolved in the cited records. Do not infer an answer from elapsed t
 | Boundary | Still unresolved | Existing record |
 | --- | --- | --- |
 | Reinforcements cost | The earlier all-outcome versus sole-Traitor-winner question remains unanswered. The bounded prototype provisionally charges on every revealed outcome, chooses normal reserves first and counts the transfer as battle losses. Same-plan Harass pays the original quote before returns; future returns cannot fund or change it. Native Advanced Occupy Stone/Mirror composition keeps the fee but ignores +2 normal score in physical-token comparison. These are product interpretations, not a new publisher ruling or user answer. Other profile/module gates remain; eligibility never depends on concealed Traitors. | [Source review](ECAZ_TREACHERY_RULES.md#14-september-reinforcements-cost-review) · [Combined policy](REINFORCEMENTS_RUNTIME.md#combined-utility-plan--16-october-2026) · [Stone composition](REINFORCEMENTS_RUNTIME.md#native-stone-composition--16-october-2026) |
-| Harass / Stone Burner | The earlier keep-gated versus compare-after-withdrawal question is unanswered. Standing choose-recommended provisionally compares counters left after successful withdrawal. Opposing Traitor cancels the return; original fixed Occupy commitment stays. Public preflight considers possible fixed Ecaz withdrawal without hidden custody. Clean Ix priority follows its separate explicitly provisional contract; allocation ambiguity and other profile/module limits remain. This is implementation interpretation, not a new publisher ruling or user answer. | [Withdrawal](HARASS_WITHDRAW_RUNTIME.md#provisional-stone-burner-timing--16-october-2026) · [Clean Ix priority](MIRROR_WEAPON_ENGINE_AUDIT.md#clean-selected-ix-composition--16-october-2026) |
+| Harass / Stone Burner | The earlier keep-gated versus compare-after-withdrawal question is unanswered. Standing choose-recommended provisionally compares counters left after successful withdrawal. Opposing Traitor cancels the return; original fixed Occupy commitment stays. Public preflight considers possible fixed Ecaz withdrawal without hidden custody. Clean Ix priority follows its separate explicitly provisional contract; new physical commitments do not remove other profile/module limits. This is implementation interpretation, not a new publisher ruling or user answer. | [Withdrawal](HARASS_WITHDRAW_RUNTIME.md#provisional-stone-burner-timing--16-october-2026) · [Clean Ix priority](MIRROR_WEAPON_ENGINE_AUDIT.md#clean-selected-ix-composition--16-october-2026) |
+| Stone mixed-force allocation timing | The older timing question remains unanswered by a source. Under 14 October choose-recommended, new original outcome-ambiguous Stone/Mirror battles provisionally commit each ambiguous side's undialed physical total after revealed modes/actual withdrawal and decisive Traitor/explosion branches. Storm-order owners choose privately; every original required value stays sealed until all commit. The eventual winner retains all legal typed casualty choices with the count. Ordinary/invariant and unstamped legacy frames keep their existing path. Publisher physical-count text and supplied Advanced physical12/logical10 casualty timing provide the numerical rules, not this online commitment convention. | [Source, versioned procedure and bounded proof](STONE_BURNER_ENGINE_AUDIT.md#outcome-changing-physical-totals--18-october-2026) |
 | Recruits late accounting and rates | The earlier one/two-further-free question remains unanswered. The prototype preserves paid spice, deducts recorded free usage from the doubled current rate and all returns from the total cap: two-free/one-paid Atreides can take two more free. Clean classic Homeworlds now provisionally recheck native thresholds on separate accepted requests, retaining completed prices/classifications; this is not a numerical user ruling or newly found timing FAQ. Unknown ledgers, pending repricing, later Fremen grants and same-turn replay remain guarded. | [Source alternatives](RECRUITS_RULES.md), [current native runtime](RECRUITS_RUNTIME.md#classic-homeworld-composition--16-october-2026) |
 | Sapho remaining timing | First versus unspent Advanced Guild priority, partly completed combined turns, cyclic auction duration and later battle timing stay guarded. The existing pre-plan opportunity supports [early aggressor](SAPHO_AGGRESSOR.md). Prior questions remain unanswered. | [Source audit](JUICE_OF_SAPHO_SOURCE_UPDATE.md), [battle review](JUICE_OF_SAPHO_BATTLE_REVIEW.md) |
 | Semuta Drug | Full-hand exchange is user-approved; neutral all-seat acknowledgements remain the explicit application policy. Other discard producers, nested continuation coverage and full-game acceptance remain unfinished. | [Source update and selected exchange](SEMUTA_SOURCE_UPDATE_20260907.md), [privacy review](SEMUTA_PRIVACY_REVIEW.md) |

docs/STONE_BURNER_ENGINE_AUDIT.md

@@ -2,6 +2,76 @@
 
 Audit: 2026-09-06. Scope: the canonical weapon, its revealed-plan choice and physical undialed-force comparison. No runtime files were changed in this audit. This is not a full optional-module or expansion certification.
 
+## Outcome-changing physical totals — 18 October 2026
+
+**Prototyped / Partial.** New original battles now finish the previously guarded
+Basic Cyborg/Suboid and Advanced mixed-force cases where choosing physical
+casualties can change Stone's winner. The publisher face below compares
+undialed physical counters but supplies no commitment procedure. The authorized
+supplied revision, physical p12/logical p10, retains the winner's later casualty
+choice and the Emperor dial3/support1 example with three-or-five physical
+losses; original E1 pp9–10 supplies Cyborg/Suboid strength and later substitution.
+Neither establishes simultaneous online allocation timing. Under the 14 October
+choose-recommended instruction, the following is an explicit provisional
+procedure, not a retrieved publisher ruling or new numerical rule.
+
+After original reveal modes, actual Harass returns and decisive Traitor/explosion
+branches, the shared calculator identifies whether legal physical totals can
+change the winner. Only then does each ambiguous side privately commit its
+**undialed physical total**. Singleton totals are automatic. Storm order queues
+the original physical owners, including Occupy's variable ally. Every originally
+required side must still commit even when the first private value would already
+fix the winner. Other seats receive no selected value and the public log names
+no count until all commitments are complete. The final comparison reveals them
+together. Ordinary and invariant-winner battles receive no new prompt.
+
+This commits a physical count rather than a full ordinary/elite casualty tuple.
+The eventual winner retains every original legal typed casualty choice with
+that count. For example, genuine Advanced4N2E/dial3/support1 retains both2N1E
+and1N2E losses at physical3. Later native Cyborg substitution remains later.
+Support, fees, Harass complements, fixed Ecaz losses, temporary normal roles,
+No-Field reconstruction and native World pools remain calculator inputs.
+Diplomat retreat must leave at least one compatible typed loss; Jacurutu uses
+a compatible tuple with the committed scalar. Card cleanup, native Homeworld
+losses, Suk and temporary Sardaukar receipts carry the same physical-count
+constraint rather than reopening the original unfiltered loss menu.
+
+New `chooseBattle` frames receive additive `stoneAllocationVersion:1`. Legacy
+unstamped battles retain their conservative public-only guard and no saved
+battle is converted. Precommit validation still checks legal physical pools,
+dial/support and zero-spice compulsion without inspecting hidden opposing plans.
+The private owned control stays visible until a legal commitment. All four bot
+profiles select a legal own offered value; strategy/calibration remains deferred.
+
+Three disjoint helper/fixture/source-review lanes plus owner integration pass
+frozen **16 files146/146**, types/lint/build and **14** finite original-action/
+actual-GameTable rendering programmes. Basic paid Stone reaches its offer in69
+actions; Advanced Sardaukar52; actual paid Stone plus next-turn retained Mirror90.
+Both native mixed sides use95 source actions in either original seating order;
+both extreme outcomes complete after7 actions, and either same-count typed loss
+after8. Ordinary/invariant mixed Ix uses68/69 source actions and retains its
+original later choice. Four minimal policies make both private choices legally
+(eight proposals), with no tuning. Focused pure cases cover fixed Occupy,
+Harass, temporary roles, reconstructed Richese/World pools and decisive outcomes;
+related suffix/default regressions are not complete native-combination proof.
+
+Actual Mirror feedback found that mandatory disposal rejected a correctly
+narrowed casualty menu. The physical constraint now survives that continuation
+and its other native consumers. Iteration also corrected city-income expectations,
+closed-battle projection access and the semantic disabled-button matcher.
+Historical guard tests now explicitly exercise unstamped frames alongside new
+admission. Type feedback added the new decision to both exhaustive registries.
+No printed number was changed to fit a fixture.
+
+Proof base `677ad7aa3ca9833feb6edad82b82487debf340bb`, frozen tree
+`dd7eb5392d6c59a1b7c99a22c439daa48dc1ee7bd84eed62118c0aae91e6e73d`;
+private reports/HTML are under
+`/home/quintine/.local/share/dune/checkpoints/20261018-stone-physical-allocation/`.
+Framework aliases/CSS stubs mean no visual/browser/deployed acceptance. Wider
+optional combinations, comprehensive assurance and complete-mode gates remain
+open. No saved room/database mutation, reset, restart or deployment. The older
+guarded allocation descriptions below remain dated historical evidence.
+
 ## Stone Burner, complete ordinary portraits and recovery checkpoint (2026-09-06)
 
 - Canonical Stone Burner now uses the weapon slot without changing its saved `kind: special` identity. It has a named Voice role, Prescience/Truth-compatible original commitments, a private precommit availability check, and an event-bound owner choice after both plans reveal. Kill mode kills both participating leader discs; ignore mode preserves other weapon attacks. Both replace ordinary strength with undialed physical-token comparison, with the aggressor winning ties. Neither adds the Kwisatz Haderach bonus or kills that companion. Normal support, bounty, traitor/explosion precedence, casualty choices and winner/loser/Moritani retention remain shared with the existing battle flow.