Honor allied Fremen victory and prevent deferred shipment deadlocks

Reciprocal allied Ecaz and Fremen with fighters in Sietch Tabr now satisfy that part of the Fremen final-turn victory, as explicitly clarified by the GF9 Ecaz/Moritani p15 FAQ. One public board quote drives automatic victory and the table guide; the chronicle explains the result. Other blockers, ordinary stronghold/BG prediction precedence, Guild fallback, advisor posture and concealed marker privacy remain intact. Habbanya symmetry and full mode/publication acceptance remain unfinished.

A genuine Advanced sample also exposed a pre-existing accepted Guild shipment which could never finish: allowance opened BG accompaniment and then hit the Ambassador arrival guard. Prior HEAD replay reproduced the exact 90-action failure. Fresh shipment preflight now rejects unsupported arrival combinations before accepting their pending windows. A valid legacy ordinary Guild allowance can return its unspent declaration to choose another destination; special parent/card receipts retain their separate gates. The change does not invent simultaneous reaction order or refund spent cards.

Independent rules/privacy/persistence review and focused engine/controls tests pass. Seventeen Fremen/Ecaz tests include all four profiles and authenticated final readiness/restart/concurrent writes. Shipment regressions cover pre-declaration immutability, supported arrival, malformed saved declarations and authenticated unspent return/replacement/reconnect/concurrency. All 4716 offline tests, types, lint, production build and 43 HTTP tests passed against unchanged source.

The original fixed seeds were repeated after repair and the exact failed snapshot resumed with documented new continuation seed 202609147: resume-advanced-202609147: 842 accepted, 109 guarded rejections, 22 periodic JSON restores; genuine-basic-202609145: 563 accepted, 14 guarded rejections, 15 periodic JSON restores; genuine-advanced-202609146: 806 accepted, 81 guarded rejections, 21 periodic JSON restores. All three finish and preserve physical custody/private views. These samples do not establish naturally reached allied Fremen special wins; a separate conserved browser final-turn fixture verifies the actual Ready-to-win transition, public guide/log, private hand and pending/finished refresh.

All 835 opening games and original seat/recovery records remain unchanged (902 after checks). All 869 rooms and records present after the reported outage also remain unchanged; database integrity and foreign keys pass. The healthy server and finished browser seat recovered without restart, reset or recurring automation. Full rules coverage and release gates remain open work.

Verified source tree: 1d9fcf30b54132f66be5f994f410dec6ec019683ee66b24fd4efb7a6aa7f7bbd

docs/CURRENT_STATUS.md

@@ -6,10 +6,10 @@ gated.** Prototypes do not open completion or publication gates.
 
 ## Current checkpoint and work
 
-Latest verified checkpoint: `8906b41`, Truthtrance recorded knowledge.
-Types, lint, **4,662 offline tests**, build and **43 HTTP tests** passed.
-All 767 opening rooms and original seat/recovery records were preserved
-(801 after HTTP checks); all 768 present immediately before verification also
+Previous verified checkpoint: `58ae84f`, Moritani Assassinate Leaders preview.
+Types, lint, **4,690 offline tests**, build and **43 HTTP tests** passed.
+All 801 opening rooms and original seat/recovery records were preserved
+(835 after HTTP checks); all 802 present immediately before verification also
 remained unchanged. The healthy server was reused.
 
 [Mentat](MENTAT_QUESTION.md) connects private naming/disclosure before posture
@@ -56,7 +56,7 @@ the healthy server is reused. A new snapshot protects all 768 rooms before broad
 verification. Final checks, preservation totals and Git delivery are recorded in
 the checkpoint commit and private report; full mode/publication gates remain.
 
-Current checkpoint: [Moritani Assassinate Leaders](MORITANI_ASSASSINATE_LEADERS.md)
+Completed prototype: [Moritani Assassinate Leaders](MORITANI_ASSASSINATE_LEADERS.md)
 connects a qualifying battle loss to a private reveal/continue choice, living/dead
 targets, bank bounty, public markers and automatic Mentat replacement. All four
 AI profiles and saved continuation are connected in the bounded Advanced preview.
@@ -70,6 +70,37 @@ All 801 opening games remain unchanged after the reported outage; the healthy
 server is reused. Required broad checks, source fingerprint, final preservation
 and Git delivery are recorded in the checkpoint commit and private report.
 
+Current checkpoint: [Fremen/Ecaz final-turn victory](ECAZ_VICTORY_RULES.md#fremen-final-turn-runtime-follow-up).
+The explicit Sietch Tabr exception is connected to the same public board quote
+used by automatic victory and the table guide. Reciprocal allies must both be
+present; solitary/non-allied Ecaz and third-party fighters still block. Ordinary
+stronghold/BG precedence, the other protected sietch and Tuek conditions, Guild
+fallback and private No-Field identity remain intact. Independent review and
+17 focused cases pass, including all-profile final readiness and authenticated
+SQLite restart/concurrent writes. Final-turn fixtures are staged after genuine
+setup; they do not establish naturally reached allied special wins. Habbanya
+symmetry and complete mode/expansion acceptance remain unfinished. Broad checks,
+browser/sample evidence, saved-game preservation and Git delivery are recorded
+with the checkpoint.
+
+The same checkpoint repairs a pre-existing [deferred Guild shipment deadlock](DEFERRED_SHIPMENT_ARRIVAL.md)
+found after 90 accepted Advanced actions. Fresh ordinary and No-Field declarations
+preflight unsupported arrivals; an eligible saved ordinary Guild allowance returns
+unspent for another choice. Special card/parent receipts retain their own gates.
+Independent review and its 149-case union pass. The exact failed snapshot now
+finishes in 842 further accepted actions. The original Basic/Advanced seeds finish
+in 563/806 actions, with 14/81 guarded candidates; the resume has 109. All physical
+custody, 58 periodic JSON rounds and 12 terminal private views pass. The Advanced
+runs form Ecaz/Fremen alliances but do not exercise the shared-Tabr exception.
+These are bounded playability checks, not complete arrival-order acceptance.
+
+After the latest reported outage, the server responds normally, all 835 opening
+rooms and original seat/recovery records remain unchanged, and integrity/foreign-key
+checks pass. A new backup protects all 869 rooms before final checks. The completed
+browser game restores its result and private seat; no restart, reset or automation
+is required. Final broad verification, preservation totals and Git delivery are
+recorded with the checkpoint.
+
 ## Authoritative navigation
 
 - [Rules checklist](../game/reference.ts), topic `implementation-checklist` and

docs/DEFERRED_SHIPMENT_ARRIVAL.md

@@ -0,0 +1,104 @@
+# Deferred shipment and arrival validation
+
+14 September 2026. A genuine Advanced Ecaz/Fremen/Guild/Bene Gesserit sample
+exposed an already accepted shipment whose Guild allowance could not finish.
+This continuation repair preserves the existing unfinished arrival-order gates.
+
+## Reproduced failure
+
+The fixed seed `202609146` stopped on turn one after 90 accepted actions. Guild
+declared four forces to Carthag, sector 11, where an Ecaz Emperor Ambassador was
+placed. Allowing that shipment created a Bene Gesserit accompaniment choice,
+then the Ambassador overlap guard rejected the arrival. The rejected action was
+immutable, but the earlier accepted declaration left the table unable to proceed.
+
+An isolated archive of prior checkpoint `58ae84f` replayed the same setup seed
+and all 90 accepted actions. The resulting player state and pending shipment
+matched, and Guild allowance failed with the same guard. The defect predates the
+Fremen/Ecaz victory follow-up. Private traces and failed snapshots are retained;
+the failure was not replaced with a successful seed.
+
+The Basic sample with seed `202609145` finished on turn seven in 563 accepted
+actions, using alternatives after 14 guarded shipment candidates. The initial
+Advanced sample did not finish. Neither formed the Fremen/Ecaz alliance or
+exercised its final-turn exception. Staged endgame checks are separate evidence.
+
+## Rules boundary
+
+The [deferred movement contract](DEFERRED_MOVEMENT_ARRIVAL.md) records the
+unresolved ordering of simultaneous Ambassador, Terror and Bene Gesserit arrival
+effects. Shipment prevention precedes payment and arrival; an allowed shipment
+still needs a supported continuation. Refusing an unfinished combination in this
+development build does not mean the physical rules prohibit that shipment.
+
+This work does not choose an Ambassador/Terror priority, suppress an earned
+Bene Gesserit choice, or open Advanced, expansion or publication gates. The
+existing [Ambassador](ECAZ_AMBASSADORS_RULES.md),
+[Terror](MORITANI_TERROR_RULES.md) and
+[Guild payment](GUILD_SHIPMENT_PAYMENTS.md) contracts retain their boundaries.
+
+## Continuation contract
+
+Ordinary shipment now quotes the resulting arrival before opening Guild's
+interception decision and again before settlement. The adapter shares the
+existing arrival guard with movement and includes pending controls, Guild income,
+Bene Gesserit intrusion/accompaniment and Fremen storm protection. It does not
+spend resources or inspect a concealed No-Field value to choose reaction order.
+Own No-Field shipments also preflight before their earlier cancellation window,
+which otherwise bypasses the common shipment offer.
+Ambassador-generated shipments retain their distinct validated parent and return
+path.
+
+An already saved ordinary Guild declaration may return to its shipper when
+explicit allowance encounters this typed unsupported-arrival error. Its original
+declaration, ownership, price, force pools and funding must still validate first.
+Every excluded special-shipment marker must be absent, rather than merely falsy;
+forged, null and empty receipt fields cannot be discarded as an ordinary return.
+Only the pending shipment and decision are released; the log explains the
+unfinished overlap, and the shipper retains its shipment and movement choices.
+Unrelated errors and corrupted declarations still reject without writes.
+
+Legacy declarations tied to an Ambassador, No-Field, Smuggler or spent Nexus receipt do
+not use this return path: their custody and parent continuation need separate
+handling. The repair does not refund or rewrite those receipts. Fresh ordinary
+declarations using the shared offer path receive preflight before the Guild
+decision can be accepted. This is bounded recovery, not complete arrival-order
+implementation or a universal repair for every older pending shipment.
+
+## Focused verification
+
+Six engine regressions cover the original declaration, a supported allowance,
+legacy return and replacement, own No-Field preflight, stale prices and forged
+special markers. Three authenticated SQLite regressions cover pending and
+returned private-seat restoration, exact custody, replacement arrival, wrong
+actor/choice, stale/duplicate requests, corrupted declarations and concurrent
+allowances committing one return. Fixtures use genuine faction setup followed
+by an explicitly staged arrival topology; the historical sample retains its
+separate genuine-game provenance.
+
+Independent review found and resolved the earlier No-Field window bypass and
+falsy special-marker recovery checks. Its focused union passed 149 cases, and
+targeted lint passed. Final broad checks, source correspondence, full samples
+and saved-game preservation are recorded with the checkpoint.
+
+## Integrated samples after repair
+
+The same Basic and Advanced setup seeds and four AI profiles were repeated after
+the code review. The exact failed Advanced snapshot was also resumed without
+editing its state; its first Guild allowance now returns the uncommitted shipment.
+The continuation uses seed `202609147`, a new random stream because the original
+cursor was not saved. Its input hash and provenance are retained privately.
+
+| Run | Accepted actions | Guarded candidates | Periodic JSON rounds | Result |
+| --- | ---: | ---: | ---: | --- |
+| Exact saved continuation | 842 additional | 109 (100 shipment, 9 movement) | 22 | Turn 10, Guild |
+| Original Basic seed `202609145` | 563 | 14 shipment | 15 | Turn 7, Guild |
+| Original Advanced seed `202609146` | 806 | 81 (74 shipment, 7 movement) | 21 | Turn 9, Bene Gesserit |
+
+All games finish using legal alternative candidates after the explicit development
+guards. Physical custody and all twelve terminal private views pass. All 216
+game-file hashes remain unchanged throughout the samples. Both Advanced runs
+form Ecaz/Fremen alliances but never co-occupy Sietch Tabr or exercise its special
+victory. The saved continuation ends with allied Habbanya co-occupation, correctly
+outside the supported Tabr exception. These samples demonstrate bounded repair
+and continuation, not full rules-combination acceptance or AI strength calibration.

docs/ECAZ_VICTORY_RULES.md

@@ -1,5 +1,9 @@
 # Ecaz victory implementation contract
 
+The [14 September runtime follow-up](#fremen-final-turn-runtime-follow-up) connects
+the explicit Fremen/Ecaz Sietch Tabr exception. The original audit and its
+unimplemented Habbanya inference remain below as source context.
+
 Primary-source review, 2026-09-07. This separates the explicit three-stronghold rule from its ordinary control and prediction consequences. No combat-rounding decision is needed for a victory predicate operating on an already-settled board. The unrelated rounding conflict remains as corrected in [Ecaz Occupy rules](ECAZ_OCCUPY_RULES.md).
 
 ## Ordinary victory and the Ecaz exception
@@ -48,6 +52,47 @@ The Habbanya symmetry is well-supported by the common general rule but is not an
 
 Keep the other Fremen checks unchanged: no earlier stronghold winner; final turn; excluded factions in Tuek's Sietch. Advanced Richese is added to Tuek's prohibited list by E2 p.6. Effective No-Field presence matters there too. If the Fremen special condition succeeds, its ally shares that special win; the Guild fallback only follows an unsuccessful earlier victory condition. [Base pp.16,19](https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf), [E2 p.6](https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf#page=6)
 
+## Fremen final-turn runtime follow-up
+
+14 September 2026. The publisher's indexed p.15 FAQ was freshly checked and agrees
+with the original source record. `game/fremen-victory.ts` now supplies one shared,
+public settled-board description to the authoritative victory quote and player
+guide. It applies the explicit Sietch Tabr exception only when reciprocal Ecaz
+and Fremen allies both have fighters there. It preserves third-faction blockers,
+mandatory advisor conversion, accompanied advisors and concealed No-Field presence
+without reading hidden marker value. Habbanya symmetry remains outside this
+implemented exception; that is an implementation limit, not a new printed ban.
+
+The final-turn quote retains ordinary stronghold victory and applicable prediction
+first, then the Fremen special condition, then existing fallback behavior. A
+successful Fremen special win includes its ally and cannot be intercepted by a
+Bene Gesserit prediction. No new action, acknowledgement, saved decision or schema
+is added. The public guide names territory blockers before the check; a successful
+special victory receives an explanatory chronicle entry.
+
+Independent rules/privacy review found no blocker. Seventeen focused cases cover
+Basic/Advanced outcome, earlier-turn and normal-winner precedence, all four AI
+profiles, absent/nonallied/solitary/third-party counterexamples, Habbanya scope,
+advisor and marker handling, identical public controls, JSON and authenticated
+SQLite restoration. Competing final readiness commits once; finished or stale
+actions cannot write again. Cards, Traitors, forces, elites and seat records remain
+unchanged through the final transition. The endgame fixture explicitly stages a
+conserved final-turn board and alliance after genuine setup, including a BG
+prediction of Fremen for turn ten; it does not claim natural arrival at that board.
+
+The checkpoint records browser and complete-sample observations, required broad
+checks, source fingerprint, live saved-game preservation and verified Git delivery.
+Full faction, optional-module and publication gates remain unchanged.
+
+The expanded victory regression union passes 83 cases. The browser exercise uses
+a fresh four-seat lobby and the same explicitly staged genuine-setup final board.
+The public guide displays the permitted Tabr co-occupation, the existing Ready
+action reaches the allied win, and the chronicle gives its reason. Pending and
+finished refresh preserve the human seat, private hand and exact physical state.
+Independent read-only database comparison confirms unchanged spice, cards,
+Traitors, leaders, forces and elites; one victory log is present. This remains a
+targeted endgame exercise, not a ten-turn human game.
+
 ## Bene Gesserit prediction and implementation order
 
 An Ecaz three-co-occupied win is a stronghold victory with a modified threshold. BG prediction applies when the predicted faction is either winning ally on the predicted turn, including BG's own ally; BG then wins alone. Do not place Ecaz's new predicate after the existing prediction check. Base p.18 excludes the distinct Fremen/Guild special endgame wins from prediction; this Ecaz rule is not one of those named exceptions. [Base p.18](https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf#page=18)

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,54 @@
 # Dune implementation status
 
+## 14 September 2026 — Fremen/Ecaz final-turn victory and deferred shipment repair
+
+The [explicit Sietch Tabr FAQ](ECAZ_VICTORY_RULES.md#fremen-final-turn-runtime-follow-up)
+now reaches automatic victory resolution: reciprocal Ecaz/Fremen allies with
+fighters there may satisfy the Fremen final-turn condition. The same public quote
+drives territory/blocker guidance; the chronicle explains a successful special
+win. Solitary/nonallied Ecaz, unrelated fighters and the unsupported Habbanya
+extension retain their existing exclusions. Effective advisor and concealed-marker
+presence, ordinary stronghold/prediction precedence, Guild fallback and existing
+no-Guild behavior are preserved. This adds no mandatory confirmation or schema.
+
+Independent source/privacy review found no blocker. Seventeen focused cases pass,
+including Basic/Advanced outcomes, all four AI profiles, JSON/private views and
+authenticated SQLite restoration before and after final readiness. Concurrent
+last-ready requests commit once; stale/finished requests do not write. Exact cards,
+Traitors, forces, elites and seat records are preserved. Final-turn positions are
+explicitly staged after genuine setup, including the reciprocal alliance and a
+turn-ten Fremen prediction, rather than claimed as natural full-game outcomes.
+The broader existing victory regression union passes 83 cases. A fresh browser
+room verifies the public guide, actual Ready-to-win transition, explanatory log
+and pending/finished refresh. Private read-only comparison confirms unchanged
+spice, cards, Traitors, leaders, forces, elites and seat records.
+
+A genuine Advanced sample also exposed the pre-existing [Guild shipment
+deadlock](DEFERRED_SHIPMENT_ARRIVAL.md): an accepted declaration could not pass
+an Ambassador/BG arrival overlap. Prior HEAD replay reproduced all 90 actions.
+Fresh ordinary/No-Field preflight and narrow, typed saved-declaration recovery
+now avoid the trap while preserving unresolved reaction-order gates. Independent
+review resolved an early No-Field window bypass and malformed special-marker
+handling; its 149-case union passes, including three authenticated SQLite cases.
+
+The exact failed snapshot finishes after 842 further accepted actions, with
+109 guarded candidates, on turn ten for Guild. The original Basic/Advanced seeds
+finish in 563/806 accepted actions with 14/81 guards, on turns seven/nine for
+Guild/BG. All 58 periodic JSON rounds, twelve terminal private views and physical
+custody checks pass against unchanged gameplay source. The Advanced runs form
+Ecaz/Fremen alliances, but neither uses shared Tabr or its special victory.
+The saved continuation uses a documented new random stream; no failed seed or
+snapshot was silently replaced. Simultaneous arrival integration remains open.
+
+The latest reported outage preserved all 835 opening games and original seat
+records. All 869 current rooms are backed up before final verification, and the
+finished browser seat restores correctly. The healthy server is reused.
+
+Browser and complete-sample evidence, types/lint/offline/build/HTTP results,
+source fingerprint, saved-game preservation and verified Git push are recorded
+with this checkpoint. The running server is reused; complete rules coverage,
+all combinations and publication remain gated.
+
 ## 14 September 2026 — Moritani Assassinate Leaders prototype and outage preservation
 
 [Assassinate Leaders](MORITANI_ASSASSINATE_LEADERS.md) connects native Advanced

docs/RULE_DECISIONS.md

@@ -18,9 +18,11 @@ Updated 14 September 2026. This is the authoritative navigation index for existi
 | Source and readiness | Separate published rules, explicit implementation choices and unfinished interpretations; Advanced/expansion gates stay closed. | [Base/Advanced audit](BASE_ADVANCED_READINESS_20260907.md), [checklist](../game/reference.ts) |
 | Setup and Fremen movement | Preserve source-ordered setup and the distinct declared-movement cancellation; do not recreate fixed historical gaps. | [Setup contract](ADVANCED_SETUP_TEST_SEAM.md), [Fremen Karama](FREMEN_MOVEMENT_KARAMA_RULES.md) |
 | Guild payment | Rate, transport permission and income are distinct; power owner, shipper, contributors and independent rate-card beneficiary remain distinct. | [Rate/cancellation sources](GUILD_RATE_KARAMA_RULES.md), [implemented payment routing](GUILD_SHIPMENT_PAYMENTS.md) |
+| Deferred shipment arrival | Quote unsupported ordinary arrivals before saving Guild interception. A validated legacy ordinary declaration may return unspent on the typed arrival error; corrupted declarations and special parent/card receipts are not silently cleared. This repairs continuation without deciding simultaneous reaction priority. | [Reproduction and bounded recovery](DEFERRED_SHIPMENT_ARRIVAL.md) |
 | Truthtrance | Current facts are boolean disclosures, not promises to preserve resources. Structured Basic and base Advanced active-opportunity shipment promises bind within their documented scope (Advanced excludes Guild and optional modules); prose is not automatically enforced. | [Spice facts](TRUTHTRANCE_SPICE_FACTS.md), [card facts](TRUTHTRANCE_CARD_COUNT.md), [shipment promises](TRUTHTRANCE_SHIPMENT_PROMISES.md), [remaining audit](TRUTHTRANCE_NONBATTLE_READINESS_20260907.md) |
 | Truthtrance hand categories | Count current physical hand custody by explicitly named primary role; alternate battle slots and faction powers do not reclassify cards. Only an aggregate answer is disclosed. | [Hand inventory](TRUTHTRANCE_HAND_INVENTORY.md) |
 | Moritani Advanced assassination preview | After an eligible battle loss, a different opposing-faction Traitor Card may be revealed even if its leader is already dead (zero bounty). Face-up set-aside and one private replacement occur during Mentat; one use per faction. Normal-call duration, uniform hidden-eligibility UX and exceptional combinations remain explicit. | [Runtime/source contract](MORITANI_ASSASSINATE_LEADERS.md) |
+| Fremen/Ecaz final-turn victory | Reciprocal allied Ecaz and Fremen with fighters in Sietch Tabr do not block the Fremen special victory. Ecaz alone/non-allied or a third faction still blocks. The Habbanya extension remains unsupported; ordinary winner/prediction and fallback order are preserved. | [Explicit FAQ and runtime](ECAZ_VICTORY_RULES.md#fremen-final-turn-runtime-follow-up) |
 | Truthtrance recorded knowledge | Questions compare an already recorded BG prediction, active submitted storm dial or actually known native Fremen forecast. Missing knowledge is unknown; only the aggregate answer is published. No future promise or unknown deck peek is created. | [Connected predicates and evidence](TRUTHTRANCE_KNOWLEDGE.md) |
 | Nexus lifecycle | Twelve physical cards, phase draw/replacement and alliance forfeiture; native Cunning, absent-faction Secret Ally and Betrayal have separate effects. No blanket Karama immunity. | [Common source contract](NEXUS_CARD_RULES.md), [lifecycle runtime](NEXUS_CARD_RUNTIME.md) |
 | Nexus faction effects | Preserve physical custody, original faction identity and durable effect receipts; use each printed family instead of borrowing another faction's rules by analogy. | [Atreides](NEXUS_ATREIDES_RULES.md), [Harkonnen](NEXUS_HARKONNEN_RULES.md), [BG](NEXUS_BENE_GESSERIT_RULES.md), [Emperor](NEXUS_EMPEROR_RULES.md), [Fremen](NEXUS_FREMEN_RULES.md), [Guild](NEXUS_GUILD_RULES.md) |