Add repeatable verification and establish fresh save checkpoint

Consolidate current readiness and existing rule decisions, preserve selective
subagents and automatic verified Git pushes, and record the efficiency pilot.
Add source-bound compact checks, private saved-game snapshots/online backups,
and bounded HTTP seat-restoration checks with 15 meaningful regressions.

At the user's explicit request, archive and clear 3,644 old local rooms and
related records while retaining schema/migrations; preserve future games from
a fresh empty baseline. Private backups and credentials are outside Git.

Validation: npm run check passes types, lint and all 4,177 offline tests.
Full report: 20260913-efficiency-check-3, 130.147 seconds; source fingerprint
344ce1d44475b0cd4ff10a915f28331cb4e2fcacbc7595636fbaa645c0568f64.
Two earlier broad attempts stopped at new type/lint errors before tests;
both were fixed. Independent review found cancellation falsely passing;
SIGINT/SIGTERM regressions and review confirm the fix. Documentation links,
example test selection, private backup integrity and empty baseline verified.
No app/build/dependency/HTTP implementation changed; no production build,
HTTP suite, browser acceptance or AI calibration claimed for this checkpoint.
The full game goal and existing release gates remain unfinished.

docs/CURRENT_STATUS.md

@@ -0,0 +1,37 @@
+# Current development status
+
+Updated 13 September 2026. This is the short navigation dashboard; detailed evidence remains in the linked records. **The complete twelve-faction goal is unfinished. Basic is playable; Advanced and unfinished expansion starts remain gated.** No completion or publication gate is opened by this document.
+
+## Evidence and source of truth
+
+- [Rules implementation checklist](../game/reference.ts): `RULE_TOPICS`, topic `implementation-checklist`, and each feature's implementation, controls, AI, documentation and verification entries. Coverage is per stated boundary, not an implicit whole-game certificate.
+- [Latest historical checkpoint](IMPLEMENTATION_STATUS.md): Guild Nexus Secret Ally, 10 September 2026 (checkpoint `06d0a66`), records types, lint, **4,162 offline tests**, production build and **40 HTTP/session tests** passing, two browser rooms and preserved opening saved games. These are recorded results, not checks rerun for this dashboard.
+- [Development guide](DEVELOPMENT.md) defines focused verification; [rule decisions](RULE_DECISIONS.md) locates settled contracts and pending interpretations. Read the newest checkpoint and relevant feature document before consulting older log entries.
+
+The user authorized a one-time local reset on 13 September: the 3,644 historical
+rooms were archived privately and cleared. [Fresh checkpoint and preservation
+policy](VERIFICATION_WORKFLOW.md#authorized-reset-13-september-2026) now apply to
+new games; historical room IDs are no longer active local fixtures.
+
+## Remaining readiness
+
+| Area | Established evidence | Remaining gate |
+| --- | --- | --- |
+| Basic core | Playable loop; shared setup, Fremen movement cancellation, structured Truthtrance spice/card facts and bounded reserve-shipment promises. | Ordinary Guild rate/transport cancellation; wider truthful questions/action commitments; integrated rules and human/AI acceptance. |
+| Six-faction Advanced | Genuine offline setup across 456 configurations; four-profile full-game simulations and JSON continuations. | Base gaps plus provisional special-Karama outcomes, remaining timing audits and authentic multiplayer/browser acceptance. Public starts remain disabled. |
+| Twelve factions and optional modules | Many bounded faction, card, Homeworld and Nexus slices have controls, bots and recovery evidence. | Every unfinished effect and interaction, occupation entitlement, Discoveries and complete combined games. Inventory or fixture coverage does not enable a module. |
+| AI difficulty | Four profiles consume private legal views; recorded Basic and Advanced studies complete. | Demonstrate a consistent Medium → Hard → Brutal strength ordering, improve strategic gaps, and repeat targeted studies after relevant policy/rule changes. |
+| Multiplayer | Versioned writes, saved seats, owner recovery kits, uncertain-request retry and voluntary own-seat AI control. | Intentional transfer, unprepared abandoned-seat recovery, unattended continuation and remaining network-failure acceptance. Preserve privacy and existing games. |
+| Player experience | Internal component inspectors and many desktop/phone feature journeys verified. | Complete end-to-end games, accessible controls, responsive layout, clear rules/errors and recovery across all supported combinations. |
+
+The [base/Advanced audit](BASE_ADVANCED_READINESS_20260907.md) includes historical missing-feature rows. Its follow-ups supersede the Fremen cancellation and BG setup findings; [genuine setup](ADVANCED_SETUP_TEST_SEAM.md) and the [Advanced study](AI_ADVANCED_SETUP_CALIBRATION_20260907.md) supersede the old Basic-then-flip testing concern. They do not settle the remaining rules.
+
+Likewise, the [Truthtrance readiness audit](TRUTHTRANCE_NONBATTLE_READINESS_20260907.md) predates [spice facts](TRUTHTRANCE_SPICE_FACTS.md), [card-count facts](TRUTHTRANCE_CARD_COUNT.md) and [Basic shipment promises](TRUTHTRANCE_SHIPMENT_PROMISES.md). Current `TruthFact` already includes these facts; do not rebuild them. Broader facts, earlier-phase promises, Advanced/expansion commitment scope and freeform interpretation remain incomplete.
+
+## Next milestone: core readiness
+
+1. Reconcile the remaining base-only gaps against current helpers, consumers and tests, using the existing [Guild cancellation contract](GUILD_RATE_KARAMA_RULES.md) and [special-Karama findings](BASE_ADVANCED_READINESS_20260907.md#explicit-unresolved-base-interpretations). Keep already-asked interpretations pending; tests are not rulings.
+2. First gameplay batch: ordinary Guild cancellation around an exact saved shipment intent. Keep discount, cross/return permission and income separate; preserve contributors, independent Karama rates and original typed forces. Establish the unresolved affordability/settlement contract before implementing those outcomes. Verify sufficient-funds paths, nested responses, rejected-action immutability, private controls, all four bots and saved continuations together.
+3. Close remaining core Truthtrance and Advanced timing gaps, then run genuine Basic/Advanced setup-to-finish multiplayer and browser acceptance before reconsidering mode gates. Expansion completion remains a subsequent part of the same overall goal.
+
+Consult [AI calibration](AI_CALIBRATION.md), [multiplayer audit](MULTIPLAYER_AUDIT.md), [autopilot](AUTOPILOT.md), [component inventory](COMPONENT_INVENTORY.md) and [visual playtest](VISUAL_PLAYTEST.md) for their measured scope and follow-ups. Use current code and later checkpoints to interpret historical results. Publication still requires the completion and integrated verification gates in [README](../README.md).

docs/DEVELOPMENT.md

@@ -4,6 +4,11 @@ Start with [README](../README.md) for installation and saved-game behavior and
 [AGENTS.md](../AGENTS.md) for project invariants. This page is a navigation and
 verification guide, not a second implementation-status log.
 
+Start with [current status](CURRENT_STATUS.md) and [rule decisions](RULE_DECISIONS.md).
+Use [repeatable verification](VERIFICATION_WORKFLOW.md) for compact source-bound
+logs, private saved-game backups/comparisons and HTTP seat restoration.
+The [three-milestone pilot](EFFICIENCY_PILOT.md) records measurement limits.
+
 ## Architecture map
 
 | Concern                            | Entry points                                                                                       |

docs/EFFICIENCY_PILOT.md

@@ -0,0 +1,26 @@
+# Three-milestone efficiency pilot
+
+Preserve the complete game scope and required checks. Use small relevant reads,
+coherent feature batches, selective subagents and compact verification artifacts.
+Git remains mandatory: review, verify, commit, push and confirm remote success at
+each finished implementation checkpoint. Never force-push or commit credentials.
+The removed recurring automation stays removed.
+
+| Milestone | Deliverable | Measurement |
+| --- | --- | --- |
+| 1: setup | Current status, decision index, reusable checks, saved-game snapshots/backups and HTTP seat restoration | Start aggregate goal counter: 57,957,554 tokens. Latest observed pre-continuation counter: 57,986,221; partial delta 28,667 includes planning/context and is not a finished-milestone cost. Two bounded helpers: documentation and independent tooling review. Final checkpoint records actual checks. |
+| 2: core readiness batch | Remaining Basic/Advanced capabilities with rules, controls, bots and recovery together | Record start/end aggregate counters, accepted capability, focused/broad runs, reviewer effort and reopened defects. Pending material rulings remain explicit. |
+| 3: next dependency batch | Next core or connected expansion capability selected from current evidence | Repeat measurements; compare cost per accepted capability and investigate repeated work. |
+
+The aggregate counter may update only between turns. Record a confirmed endpoint
+when available rather than estimating missing usage. It includes coordination and
+conversation overhead and is not a dollar-cost meter. Different capability sizes
+limit direct comparisons; do not promise a savings percentage from this setup.
+Do not count tests alone as accepted faction or mode completion. Scripts consolidate
+existing checks; broad checks still run once source/review is stable and repeat if
+subsequent changes or failures justify them. Browser fixtures remain feature-specific;
+the reusable HTTP restoration helper does not automate browser setup or visual QA.
+
+Use [current status](CURRENT_STATUS.md), [rule decisions](RULE_DECISIONS.md) and
+[verification workflow](VERIFICATION_WORKFLOW.md) as short entry points. Historical
+logs remain references, not mandatory full-context input on every turn.

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,7 @@
 # Dune implementation status
 
+**Efficiency setup and fresh local save checkpoint, 13 September 2026:** [Current status](CURRENT_STATUS.md) and the [rule decision index](RULE_DECISIONS.md) consolidate existing evidence without changing mode gates. [Reusable verification](VERIFICATION_WORKFLOW.md) adds private source-bound check logs, read-only saved-game snapshots/online backups and bounded HTTP seat-restoration checks. Focused regressions cover child failure/cancellation, stale source, output protection, WAL backup and seat privacy; the required full-check result is recorded in this checkpoint’s Git commit and external verification report. The user explicitly authorized clearing old local saves: a verified private backup preceded removal of 3,644 rooms and related records, preserving schema/migrations and creating a fresh empty baseline. Future games remain protected. [Pilot measurements](EFFICIENCY_PILOT.md) retain selective subagents, mandatory verified Git pushes and the full game scope; no gameplay or release gate is enabled. Browser setup remains feature-specific, and no live browser acceptance is claimed for this tooling change.
+
 **Guild Nexus Secret Ally checkpoint, 10 September 2026:** [NEXUS_GUILD_SECRET_ALLY_RUNTIME.md](NEXUS_GUILD_SECRET_ALLY_RUNTIME.md) records one explicitly selected Guild-priced shipment for an unallied holder with Guild absent. Reserve, physical cross/abstract-return and independently legal world-to-world routes preserve actual faction identity, typed custody, ordinary movement and bank payment. Fremen retain their free reinforcement choice; the separate paid southern route reaches beyond its range without storm privileges or off-planet triggers. Private controls and all four bot profiles share source-aware price/permission; binding shipment promises can rely on the card. Exact committed records and an independent outcome marker preserve arrival alliances and later movement without inventing native Guild responses. **Final types, lint, all 4,162 offline tests, production build and 40 HTTP/session tests pass.** Twenty-six new cases include real Moritani arrival alliances and production SQLite races, corruption rejection and private recovery. Review also repaired an older Cunning fixture's post-auction card-availability assumption; ten repeated runs passed 190 cases. Two three-seat browser rooms passed paid Fremen shipment/movement, mixed Emperor Homeworld shipment, desktop/phone controls and six private refreshes. The 03:46 UTC backed-up restart preserved all **3,612** opening games and restored twelve earlier private seats; final comparison preserves every opening version/hash, with two browser and thirty HTTP rooms added. Homeworld-return interpretation was asked of the user; that route, concealed transport, Betrayal and complete module/mode acceptance remain gated. Automation remains removed.
 
 **Guild Nexus Cunning checkpoint, 10 September 2026:** [NEXUS_GUILD_CUNNING_RUNTIME.md](NEXUS_GUILD_CUNNING_RUNTIME.md) records a second paid native Guild shipment within the original combined turn, followed only by unused Hajr movement. Original shipment/movement history, typed Homeworld sources, cross/return routes, interception and later entry effects retain their rules. Private controls and all four bot profiles share availability; new binding shipment promises recognize the extra opportunity. Native Karama and paid BG conversion preserve the original source, and countering conversion restores it. Independent review fixed a later Moritani alliance freezing the remaining Hajr continuation; transport validation also rejects a same-territory cross-shipment. **Final types, lint, all 4,136 offline tests, production build and 40 HTTP/session tests pass.** Thirty-seven new cases include genuine nested interruptions, pending-frame corruption and competing production SQLite requests. Two three-seat browser rooms passed second shipment/Hajr and cancellation, desktop/phone controls and six private refreshes. A raw internal event notice found visually was corrected and verified by final rendering tests; earlier pending screenshots precede that text correction. All **3,580** opening room versions/hashes remain unchanged, with two browser and thirty HTTP rooms added. Guild Secret Ally/Betrayal, the physical Ornithopter combination, remaining native cancellation/arrival gaps and complete module/mode acceptance remain gated. Existing server reused, no restart due; automation remains removed.

docs/RULE_DECISIONS.md

@@ -0,0 +1,33 @@
+# Rule decision index
+
+Updated 13 September 2026. This is the authoritative navigation index for existing decisions, not a replacement rulebook or a new ruling. Detailed linked contracts retain their source citations and exact supported boundaries. Runtime follow-ups supersede historical absence claims; passing tests establish software behavior, not publisher authority.
+
+## Recorded contracts and implementation boundaries
+
+| Topic | Decision to preserve | Detailed authority and evidence |
+| --- | --- | --- |
+| Source and readiness | Separate published rules, explicit implementation choices and unfinished interpretations; Advanced/expansion gates stay closed. | [Base/Advanced audit](BASE_ADVANCED_READINESS_20260907.md), [checklist](../game/reference.ts) |
+| Setup and Fremen movement | Preserve source-ordered setup and the distinct declared-movement cancellation; do not recreate fixed historical gaps. | [Setup contract](ADVANCED_SETUP_TEST_SEAM.md), [Fremen Karama](FREMEN_MOVEMENT_KARAMA_RULES.md) |
+| Guild payment | Rate, transport permission and income are distinct; power owner, shipper, contributors and independent rate-card beneficiary remain distinct. | [Rate/cancellation sources](GUILD_RATE_KARAMA_RULES.md), [implemented payment routing](GUILD_SHIPMENT_PAYMENTS.md) |
+| Truthtrance | Current facts are boolean disclosures, not promises to preserve resources. Structured Basic active-opportunity shipment promises bind within their documented scope; prose is not automatically enforced. | [Spice facts](TRUTHTRANCE_SPICE_FACTS.md), [card facts](TRUTHTRANCE_CARD_COUNT.md), [shipment promises](TRUTHTRANCE_SHIPMENT_PROMISES.md), [remaining audit](TRUTHTRANCE_NONBATTLE_READINESS_20260907.md) |
+| Nexus lifecycle | Twelve physical cards, phase draw/replacement and alliance forfeiture; native Cunning, absent-faction Secret Ally and Betrayal have separate effects. No blanket Karama immunity. | [Common source contract](NEXUS_CARD_RULES.md), [lifecycle runtime](NEXUS_CARD_RUNTIME.md) |
+| Nexus faction effects | Preserve physical custody, original faction identity and durable effect receipts; use each printed family instead of borrowing another faction's rules by analogy. | [Atreides](NEXUS_ATREIDES_RULES.md), [Harkonnen](NEXUS_HARKONNEN_RULES.md), [BG](NEXUS_BENE_GESSERIT_RULES.md), [Emperor](NEXUS_EMPEROR_RULES.md), [Fremen](NEXUS_FREMEN_RULES.md), [Guild](NEXUS_GUILD_RULES.md) |
+| Expansion Nexus families | Source audit coverage does not imply every panel is playable; consult later runtime records in the status log. | [Ixian Cunning](NEXUS_IXIAN_CUNNING_RULES.md), [Ixian replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Tleilaxu](NEXUS_TLEILAXU_RULES.md), [CHOAM](NEXUS_CHOAM_RULES.md), [Richese](NEXUS_RICHESE_RULES.md), [Ecaz](NEXUS_ECAZ_RULES.md), [Moritani](NEXUS_MORITANI_RULES.md) |
+| Guild Secret Ally | One explicit Guild-priced ordinary shipment; borrowed prices/routes preserve native identity. Free Fremen reinforcement remains a separate choice. | [Route contract](NEXUS_GUILD_SECRET_ALLY_RULES.md), [verified runtime](NEXUS_GUILD_SECRET_ALLY_RUNTIME.md) |
+| Homeworld custody and mobility | Physical home/visitor groups, population thresholds, tariffs and transport permissions retain distinct sources; Homeworld immunity is not universal immunity. | [Homeworld rules](HOMEWORLD_RULES.md), [benefits](HOMEWORLD_BENEFITS_RULES.md), [mobility](HOMEWORLD_MOBILITY_RULES.md), [invasion](HOMEWORLD_INVASION_RULES.md), [Guild transport](GUILD_HOMEWORLD_TRANSPORT_RULES.md) |
+| Homeworld effects | Keep original payment/revival/placement identities and qualification observations; observations alone do not choose an occupied-benefit owner. | [Payments](HOMEWORLD_PAYMENT_INCOME_RULES.md), [card economy](HOMEWORLD_CARD_ECONOMY_RULES.md), [Collection](HOMEWORLD_COLLECTION_RULES.md), [revival deployment](HOMEWORLD_REVIVAL_DEPLOYMENT_RULES.md), [victory reinforcement](HOMEWORLD_VICTORY_REINFORCEMENT_RULES.md), [replacement](HOMEWORLD_REPLACEMENT_RULES.md), [Tupile](HOMEWORLD_TUPILE_INTELLIGENCE_RULES.md) |
+
+## Pending interpretations: preserve existing questions
+
+These are unresolved in the cited records. Do not infer an answer from elapsed time, a fixture, a related card or this index. Check subsequent recorded user/source decisions before proceeding; do not send duplicate questions.
+
+| Boundary | Still unresolved | Existing record |
+| --- | --- | --- |
+| Ordinary Guild cancellation | Unaffordable repricing, replacement/retry/decline, consumed opportunity, contributor adjustment and ordering with special shipment-stop. The affordability question was already sent. | [Material timing](GUILD_RATE_KARAMA_RULES.md#material-unresolved-timing) |
+| Base special Karama | Unfunded auction recovery, stopped-shipment settlement and Atreides full-plan commitment order remain provisional or require interaction audit. | [Explicit base interpretations](BASE_ADVANCED_READINESS_20260907.md#explicit-unresolved-base-interpretations) |
+| Guild Secret Ally/Homeworlds | Whether the reserve-return grant overrides the Homeworld return restriction. The question was already sent; that route stays guarded. | [Homeworld return](NEXUS_GUILD_SECRET_ALLY_RULES.md#homeworld-prices-and-the-unresolved-return), [checkpoint](NEXUS_GUILD_SECRET_ALLY_RUNTIME.md) |
+| Occupied Homeworlds | Entitlement/expiry after departure, replacement or contest; unique powers and shared income. The first-occupier/current-occupier question was already sent. | [Occupation questions](HOMEWORLD_OCCUPATION_RULES.md#questions-the-retrieved-sources-do-not-settle), [lifecycle audit](HOMEWORLD_OCCUPATION_LIFECYCLE_AUDIT.md) |
+| Nexus responses and composition | Betrayal private-response timing, partial revival/payment choices, Emperor fewer-than-five, fresh advisor/storm cases, Duke restoration and remaining faction-specific combinations. | [Common boundaries](NEXUS_CARD_RULES.md#remaining-source-questions-and-release-boundaries) and the individual faction source/runtime documents above |
+| Other Homeworld combinations | Population/force splitting, removal custody, replacement shortages, income accounting and placement ordering remain local to their detailed contracts. | [Homeworld rules](HOMEWORLD_RULES.md), [occupation](HOMEWORLD_OCCUPATION_RULES.md) and the effect documents above |
+
+When a decision changes, record the exact source or user ruling in its detailed feature document, update affected implementation guidance/tests, and adjust this index and [current status](CURRENT_STATUS.md). Retain historical evidence without presenting a superseded proposal as current behavior.

docs/VERIFICATION_WORKFLOW.md

@@ -0,0 +1,82 @@
+# Repeatable verification
+
+Use the [development guide](DEVELOPMENT.md) to choose checks appropriate to the
+change. These wrappers retain the existing test runner and simulation harness;
+they do not replace rules, browser or release acceptance.
+
+## Compact checks and source evidence
+
+```sh
+node --import tsx tools/verify.ts --out /tmp/dune-new-focused focused --focus guild-payment
+node --import tsx tools/verify.ts --out /tmp/dune-new-check check
+# Add build for app/build/dependency changes, integration for HTTP/auth/persistence.
+node --import tsx tools/verify.ts --out /tmp/dune-new-release check build integration
+# Only for relevant AI/gameplay work; the existing study covers Basic base factions.
+node --import tsx tools/verify.ts --out /tmp/dune-new-study base-games --games 20 --seed 20260913
+```
+
+Each output must be a new directory outside the checkout, with an existing parent.
+It is created with private permissions. Full command output stays in step logs;
+`report.json` records commands, exit codes, timings, HEAD and a content fingerprint
+of tracked and nonignored untracked files before and after the run. Ignored local
+credentials, saved games and build caches are excluded. Do not supply secrets in
+command arguments. A failed child stops subsequent steps. Changed source or HEAD
+invalidates a successful run; finish all source/doc edits before broad checks.
+This checks the two observed snapshots, not changes made and reverted between them,
+nor the contents of dependencies, ignored files or an external HTTP server.
+An interrupted or incomplete report is never evidence of success.
+
+## Saved games and online backups
+
+```sh
+node --import tsx tools/saved-games.ts snapshot --db /absolute/games.sqlite --out /private/new-baseline --backup
+node --import tsx tools/saved-games.ts compare --db /absolute/games.sqlite --baseline /private/new-baseline/snapshot.json
+```
+
+The source database is opened read-only. Snapshots store room versions and state
+hashes, not private game state. New rooms are allowed; every changed or missing
+original room fails comparison. Legitimate human play can change a room: investigate
+and document it, never overwrite progress to make a comparison pass. Snapshot the
+current set before each maintenance operation so newly created rooms are protected.
+Online backup includes WAL contents and requires Node 22.16 or newer; snapshot and
+comparison retain the project's Node 22.13 minimum. Backup files contain private
+state and session records, remain outside Git, and never overwrite an earlier run.
+This tool does not delete, reset or restore the live database.
+
+### Authorized reset, 13 September 2026
+
+The user requested clearing all old local games and starting a new checkpoint.
+With no development server running, a verified online backup preceded a single
+transaction deleting **3,644 rooms** and cascading their seat/recovery/entry records.
+Schema, migrations and Wrangler state files were preserved. All five application
+tables were empty afterward; foreign-key validation passed.
+
+Private archive: `/home/quintine/.local/share/dune/checkpoints/20260913-before-reset/`.
+Fresh empty database backup and snapshot:
+`/home/quintine/.local/share/dune/checkpoints/20260913-fresh-baseline/`.
+These machine-local paths are operational records, not portable repo artifacts.
+Old room IDs in historical browser evidence no longer identify active local games.
+Future games must be preserved. This was a one-time user-authorized reset, not a
+maintenance strategy or permission to clear future games.
+
+## Private-seat restoration
+
+Create a private JSON file (mode 0600) outside the checkout with this structure;
+substitute credentials only in that private file, never in a command or tracked doc:
+
+```json
+{"baseUrl":"http://127.0.0.1:3000","isolatedQa":true,"seats":[{"code":"ABCDEFGH","playerId":"fixture-seat-id","version":4,"token":"fixture_session_token"}]}
+```
+
+```sh
+node --import tsx tools/restore-seats.ts --config /private/qa-seats.json
+```
+
+Use deliberately isolated, stable human QA rooms. The server's GET route can resume
+bots or automatic work, so this is not a generally side-effect-free read and must
+not probe arbitrary human games. Requests use loopback origins only, reject redirects
+and time out. Checks require the expected room, seat and version, the owning seat's
+private fields, and absence of selected rival private fields. No session tokens,
+response bodies or hands are printed. This is HTTP seat restoration, not recovery-key
+rotation, exact hand-content proof, a complete privacy audit or browser rendering.
+Pair it with saved-game comparison and feature-specific browser acceptance.