Prevent saved CHOAM movement arrival deadlocks

Preflight ordinary movement through the existing arrival quote before creating new Ornithopter escrow or opening Ixian, Fremen and CHOAM prevention windows. An explicit legacy CHOAM decline can return an uncommitted unsupported arrival for another choice without consuming movement or touching forces, spice, cards or tokens. Preserve an existing Ornithopter and retire it exactly once on a legal replacement move. Keep dedicated Ambassador relocation handling and Karama cancellation validation before cost; unrelated exceptions remain atomic. Simultaneous Ambassador/Terror priority still awaits the recorded material interpretation, with no invented ordering.

Add reusable offline faction-game samples with genuine Basic/Advanced setup, all four AI profiles, physical custody checks, JSON restorations, private traces and failed snapshots. Source-bound reports and input snapshot hashes make fresh and resumed samples repeatable; document that a resumed continuation starts a new seeded stream and does not prove input setup provenance.

Validation: independently reviewed fresh declaration, native cancellation, supported single arrivals, legacy retry and card custody tests. Two production SQLite tests cover authenticated private restoration, stale/duplicate/wrong-owner rejection, resource conservation and concurrent version races. Typecheck, lint, 4583 offline tests, production build and 43 HTTP tests passed. Retain the initial failed check log for the corrected numeric-sort lint issue.

All six fresh samples complete. CHOAM Basic 1054 actions/28 JSON restores, CHOAM Advanced 225/6, Ecaz Basic 91/2, Ecaz Advanced 523/14, all-three Basic 476/12, all-three Advanced 1303/35 with a turn-six CHOAM win. Combined Advanced has 46 guarded arrival candidates with legal alternatives. The exact prior 614-action failed snapshot separately finishes after 691 additional actions/18 restores and 39 guarded candidates. These are bounded paths, not complete faction or combination certification. Gameplay source hashes match the final checkpoint; later evidence-only documentation and recovery-test lint edits are explicit.

After the reported outage, all 632 opening games and original seat/recovery records were preserved (665 after HTTP tests); integrity and foreign keys passed. Existing Ecaz and Ixian browser seats restored their same private hands, resources and pending choices after reload. This is browser restoration evidence, not a staged arrival-return claim. The healthy server was reused; no restart, database reset, recurring automation or publication.

Verified source tree: 550221850f4802c41155f7bbc35d623965bc7db3330825636d50f26bb42868f8

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,40 @@
 # Dune implementation status
 
+## 13 September 2026 — Deferred movement arrival safety and reusable samples
+
+[Deferred movement](DEFERRED_MOVEMENT_ARRIVAL.md) fixes the combined Advanced
+sample's accepted CHOAM decline deadlock. The actual conflict was a qualifying
+Ambassador and Terror at the same destination. Fresh movement checks existing
+arrival guards before native prevention windows or new Ornithopter commitment.
+A saved explicit CHOAM decline can return an uncommitted unsupported move for
+another choice; its existing reserved card remains available and retires once
+when the replacement use finishes. Unrelated exceptions still reject atomically,
+and Karama cancellation still validates arrival before spending its cost.
+No simultaneous-arrival order is invented; that material question remains pending.
+
+Independent review covers rules, custody and private continuation. Focused
+regressions exercise native Ixian/Fremen declarations, ordinary single-token
+arrivals, saved legacy choices and Ornithopter escrow. In-memory production-room
+checks cover authenticated decline, restoration, stale/duplicate ownership and
+concurrent version races. The final checkpoint records actual broad results.
+
+`tools/faction-games.ts` replaces repeated private simulation copies with six
+fixed genuine-setup scenarios, all four profiles, physical custody checks and
+JSON restoration. It records private traces, failed snapshots, source fingerprints
+and explicit nonzero failure. Snapshot resume records provenance and starts a new
+seeded continuation stream. Full-game samples remain evidence of their particular
+paths; rejection counts and any later guards are retained in the checkpoint.
+All six fresh samples completed. Combined Advanced finished at turn six with
+1,303 actions, 35 JSON restores and 46 guarded arrival candidates. The exact
+prior failed save separately finished after 691 additional actions, 18 restores
+and 39 guarded candidates. The detailed feature document records the limitation.
+
+After the reported outage the server was healthy, all 632 opening games and their
+original seat/recovery records matched the private backup, and existing Ecaz and
+Ixian QA seats restored their private hands and pending choices in the browser.
+No restart or reset was needed. Public starts and publication remain gated.
+
+
 ## 13 September 2026 — Expansion faction setup and saved Ixian auction decline
 
 The [faction development profile](EXPANSION_FACTIONS_PROTOTYPE.md) connects