Connect owned multi-pile battle skill choices

docs/CURRENT_STATUS.md

@@ -29,6 +29,20 @@ optional skill bands, combinations and public expansion starts remain open.
 Rules implementation continues; comprehensive assurance and administration
 remain deferred until all rules are implemented.
 
+**Multi-pile battle skills prototype — 9 October.** A surviving Smuggler
+controller can allocate its fixed reveal-time collection across existing
+sectors; a surviving Sandmaster winner selects one remaining pile for +3.
+Single-pile, forced all/none and void collections remain automatic.
+Owner selection is explicitly provisional, not a publisher ruling.
+Both mode smokes preserve frozen spice until the choices finish, then settle
+Smuggler before Sandmaster and resume the original battle. All four legal
+bot policies finish the same path. A 390px isolated production-control
+surface collects six spice as 2/4, then adds three to sector 15, leaving
+Wind Pass piles 2/4 and the Smuggler holder at 26 spice. See
+[Smuggler allocation](SMUGGLER_BATTLE.md#multi-pile-allocation-policy-and-pure-api--9-october-2026)
+and [Sandmaster placement](LEADER_BATTLE_EFFECTS.md#source-contract).
+
+
 **Kulon/Ornithopter coexistence prototype — 9 October.** Active Kulon no
 longer blocks the card's fixed-range mode in either rules mode. The labeled
 provisional policy retains its three-territory maximum and extends both

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,35 @@
 # Dune implementation status
 
+## 9 October 2026 — owned multi-pile Smuggler and Sandmaster choices
+
+The multi-pile guards now have working choices in supported Basic/Advanced
+skill profiles. Smuggler retains a signed reveal-time aggregate and exact
+per-pile capacities. Only a surviving partial collection needs an owned
+allocation; death, all/none and a single pile remain automatic. Sandmaster
+then offers the winner one existing positive pile for +3, with no new pile
+or direct faction income. The sector-selection policies are explicitly
+provisional, not publisher adjudications.
+
+The final-outcome gateway waits for both choices before physical settlement,
+then retains existing retreat, casualties, card cleanup and later effects.
+Malformed/foreign choices and stale replays reject; JSON preserves the
+event and signed allocation. Modified Smuggler strength, unrelated module
+guards and public starts remain unchanged.
+
+Actual-engine smoke runs in both modes: collect six as 2/4 from original
+4/5 piles, select sector 15 for +3, leave piles 2/4 and credit the collector
+20→26 once. All four profiles finish the path through legal owned actions.
+A standalone Sandmaster selects 9→12 in sector 15 without changing sector
+14 or personal spice. Seven focused allocation/transition cases pass.
+Chromium at 390px used both production components, actual styles and the
+real engine in isolated in-memory QA; it produced the same final values.
+No existing room or deployed acceptance result is claimed.
+
+Frozen checks: `check:quick` passes and 52 affected receipt, battle,
+control, retreat and cancellation cases pass. No full suite, HTTP/recovery
+campaign, whole-database comparison or deployment was run. Temporary QA
+scripts and the dedicated in-memory service were removed.
+
 ## 9 October 2026 — two Occupy failures isolated to test contracts and staging
 
 Deterministic seed 8 reproduces the recorded missing-immediate-plan failure.

docs/LEADER_BATTLE_EFFECTS.md

@@ -23,9 +23,15 @@ walkthrough supply the individual effects; see the [component inventory](LEADER_
   though combined-module play remains gated.
 - [Sandmaster, 15:48](https://www.youtube.com/watch?v=XT_azRVLq_0&t=948s): a
   surviving skilled winner adds three board spice to an existing pile in the
-  battle territory automatically. This grants no direct income and does not
-  require surviving forces. No pile means no addition. Multiple positive piles
-  are guarded before the final battle vote pending a sector-placement ruling.
+  battle territory. This grants no direct income and does not require surviving
+  forces. No pile means no addition; a single positive pile resolves automatically.
+  With several positive piles, the winning owner must select exactly one existing
+  pile after survival is established and before physical battle settlement. Each
+  option shows its current quantity and the exact +3 result; this mandatory effect
+  has no decline or extra acknowledgement. **Provisional allocation policy:**
+  owner selection is a prototype choice, not a publisher sector-placement ruling.
+  It cannot create a new sector pile. Smuggler collection precedes placement, so
+  exhausted piles are not offered.
 - [Rihani, 12:49](https://www.youtube.com/watch?v=XT_azRVLq_0&t=769s): a face-up
   native trainer grants the normal private inspection after a victory using
   another leader. A surviving selected native skilled winner receives both
@@ -57,11 +63,13 @@ alone. These boundaries are implementation limits, not prohibitions in the game.
 ## Connected behavior and checks
 
 Shared battle quotes calculate score changes; bots use the same public
-stronghold count. Sandmaster resolves automatically. Rihani offers owned
-draw/decline controls, then separate inspectable keep-new and reveal-old
-selections. All four AI profiles use only their permitted view. Only the owner
-receives inspection history and drawn identities. The public log names the
-returned old card, never the kept or unkept new identity.
+stronghold count. Sandmaster resolves automatically for zero or one remaining
+positive pile; multiple piles use an owned, event-bound placement decision with
+one direct button per existing sector. Only supplied public pile quantities appear
+in the controls. Rihani offers owned draw/decline controls, then separate inspectable
+keep-new and reveal-old selections. All four AI profiles use only their permitted
+view. Only the owner receives inspection history and drawn identities. The public
+log names the returned old card, never the kept or unkept new identity.
 
 Physical snapshots, an event-bound obligation and saved stages preserve Rihani
 through casualties, winner cleanup and captive return. Independent review found
@@ -72,6 +80,12 @@ captured eligibility, actual-use exclusion and native Suk rescue preceding a
 captured Rihani exchange. Focused checks also cover score-boundary winners,
 dead/bluffed skills, Sandmaster without surviving forces and UI privacy.
 
+Pure Sandmaster boundary tests cover exact +3 offers, independent sector selection,
+empty and singleton behavior, malformed locations and quantities, overflow,
+unoffered keys and input immutability. Isolated Chromium at 390px exercised
+the production placement control after Smuggler allocation, selected sector
+15 and observed its actual +3 change before the original battle continued.
+
 Fresh browser room `HNGSR8GB` used genuine module setup, then a separately
 staged conserved battle. The human inspected two private cards, drew two
 separate cards, refreshed the pending exchange and selected a keep and public

docs/RULE_DECISIONS.md

@@ -20,6 +20,7 @@ They supersede earlier software-absence claims only within their named scope.
 | Already-active Karama / allied No-Field | Honor the already-played rounded one-force Guild rate and bank routing; no implicit additional card or shipment. | [Allied No-Field payment](RICHESE_ALLIED_SHIPMENT_AUDIT.md) |
 | Full-hand Nullentropy Box | Basic and Advanced permit an atomic retrieval/Box-disposal exchange with final hand within its actual limit; Box remains last/on top. Intermediate capacity is not adjudicated. | [Box runtime](NULLENTROPY_BOX_ENGINE_AUDIT.md) |
 | Kulon with Richese Ornithopter | Both modes coexist in Basic/Advanced. The fixed one-group card maximum remains three; Kulon extends each normal-range group. Explicitly provisional, not a publisher ruling. | [Movement policy](RICHESE_ORNITHOPTER_ENGINE_AUDIT.md#provisional-kulon-coexistence--9-october-2026) |
+| Multi-pile battle skills | In both modes, surviving Smuggler allocates the fixed unmodified-strength-capped collection among reveal-time positive piles; Sandmaster winner then selects one remaining pile for +3. Single-pile/all/none/void effects stay automatic. Owner sector selection is provisional, not a publisher allocation ruling. | [Smuggler](SMUGGLER_BATTLE.md#multi-pile-allocation-policy-and-pure-api--9-october-2026), [Sandmaster](LEADER_BATTLE_EFFECTS.md#source-contract) |
 | Basic occupied Homeworld lifecycle | Current sole foreign garrison controls occupied income, Bidding effects, defenses, percentage shares and the Ecaz-victory holding; the entitlement ends immediately on departure, contest or native repopulation. A recorded source observation is still required. Basic Tupile slot leasing keeps the conservative original-epoch gate. Visibly provisional, not a publisher or numerical user ruling. | [Occupation](HOMEWORLD_OCCUPATION_RULES.md#basic-current-sole-benefit-policy--9-october-2026) |
 
 No publication or faction/mode gate is opened. The exact 7 October user

docs/SMUGGLER_BATTLE.md

@@ -12,9 +12,9 @@ against a player view that intentionally lacks private/internal configuration.
 The engine now projects `smugglerCollectionSupported` beside the existing
 saved battle format flag; bots use that authoritative rule result rather than
 reconstructing the module profile. Modified-strength and multiple-positive-pile
-guards still apply to each actual plan. No public mode or strategy tuning is
-added. A real trainer-plan regression fails before and passes after repair;
-all three original captures finish without rejection. Source trees/counts and
+guards applied to each actual plan at that checkpoint; the 9 October allocation
+policy below replaces only the latter. No public mode or strategy tuning is added.
+All three original captures finish without rejection. Source trees/counts and
 limits are in the [native Discovery evidence](DISCOVERY_PROTOTYPE.md#native-skill-runtime-evidence).
 
 ## Rule and timing contract
@@ -25,13 +25,13 @@ selected skilled leader survive. The card does not require winning or retaining
 forces. A captured skilled leader grants its lower effect to its controller.
 
 At public plan reveal the server records the battle, controller, selected leader,
-plans, skill posture and territory's existing spice. The amount is the smaller of
-that single pile and the unmodified disc strength. This pending amount is not
-personal spice and cannot fund a sealed plan or another payment. After survival
-is known, the server transfers it once, including for a surviving loser, before
-Sandmaster adds any after-victory spice. A pile drained to zero cannot receive
-Sandmaster's addition. This deferred settlement and ordering remain explicit
-timing inferences, not a newly discovered publisher ruling.
+plans, skill posture and territory's existing positive spice piles. The amount
+is the smaller of their aggregate total and the unmodified disc strength. This
+pending amount is not personal spice and cannot fund a sealed plan or another
+payment. After survival is known, the server transfers it once, including for a
+surviving loser, before Sandmaster adds any after-victory spice. A pile drained
+to zero cannot receive Sandmaster's addition. This deferred settlement and
+ordering remain explicit timing inferences, not a newly discovered publisher ruling.
 
 A weapon death, opposing or mutual Traitor, or Lasgun–Shield explosion voids the
 collection. A successful sole own Traitor call can leave the Smuggler alive and
@@ -46,13 +46,17 @@ payment, so it does not invoke Banker or Bureaucrat payment handling.
   profiles. Public mode flags and the player's own chosen plan determine the
   guard; an opponent's concealed cards do not control eligibility.
 - Guidance explains the pending amount, survival and spending restriction.
-  Collection is automatic, with the existing faction-colored action notice and
-  an explanatory chronicle entry; there is no confirmation step.
+  Single-pile collection remains automatic with no acknowledgement. Partial
+  multi-pile collection asks only the surviving controller to choose concrete
+  sectors; collecting all or none remains automatic. The choice has no decline.
 - AI candidates omit optional Kwisatz when selecting Smuggler and reject other
   unsupported modified plans. Native face-up skilled discs remain unavailable
   to battle selection; captives and existing mandatory concealment retain their
   legal paths. UI availability and the submitted Kwisatz value share one check.
-- Versioned, signed reveal receipts survive private JSON/SQLite continuation.
+- Existing single-pile signed receipts have JSON/SQLite continuation evidence.
+  Multi-pile choices retain the same battle binding and have changed-path JSON
+  and real-engine control smoke; comprehensive persistence assurance remains
+  deferred until all rules are implemented.
   Reads/actions reject changed plans, receipts, pile or identity. Public views
   expose the selected leader, controller and pending amount only after reveal;
   the internal binding frame is never projected. Concurrent final votes use the
@@ -60,14 +64,59 @@ payment, so it does not invoke Banker or Bureaucrat payment handling.
 - Battles already saved without the new version keep their original behavior.
   Subsequent battles use the new flow. There is no database migration or reset.
 
+## Multi-pile allocation policy and pure API — 9 October 2026
+
+The printed collection amount applies to the territory's aggregate existing
+spice, capped by the unmodified leader strength. The available source does not
+specify which sectors supply a partial multi-pile collection. **Owner-selectable
+sectors are a provisional prototype allocation policy, not a publisher ruling.**
+The owner controls only distribution, never the mandatory amount. Controls appear
+after revealed outcome establishes survival and before physical settlement,
+preceding any Sandmaster placement choice. Inputs start with a legal deterministic
+fill and require the exact total within each revealed pile's capacity.
+
+`game/smuggler-battle.ts` preserves legacy receipt fields and signatures:
+
+- `SmugglerBattleReceipt` retains `key`, `before`, `amount`, `stage`, and its
+  original battle binding. Multi-pile receipts add
+  `piles?: Record<string, number>`, use `key: null`, and set `before` to the
+  aggregate total. Signed owner choices add
+  `allocations?: Record<string, number>`. Single-pile and empty receipts retain
+  their original shape.
+- `smugglerBattleAllocationRequired(receipt, survives): boolean` reports a
+  missing choice only for a surviving pending receipt with at least two positive
+  piles and `0 < amount < before`. All/none collection and death need no choice.
+- `chooseSmugglerBattleAllocation(receipt, allocations): SmugglerBattleReceipt`
+  verifies the pending signature, accepts only reveal-time positive keys and
+  nonnegative safe integers within their recorded capacities, requires a total
+  exactly equal to `amount`, omits zero entries, and returns a new signed receipt
+  without mutating its input.
+- `settleSmugglerBattle(receipt, survives, spice)` verifies the signed receipt
+  and unchanged reveal-time positive piles, requires the surviving ambiguous
+  choice, debits those concrete sectors, and returns `{ receipt, amount, spice }`.
+  Death returns a signed `void` receipt with zero transfer; forced all/none
+  collection is automatic. A settled receipt cannot be settled twice.
+- `SmugglerBattleCollectionOffer` is the owner-only public shape
+  `{ event: string, player: string, territory: string, amount: number,
+  piles: Record<string, number> }`.
+  `SmugglerBattleCollection({ offer, busy, act })` inspects only those public
+  piles and submits `{ type: 'decision', event, allocations }`; noninteger,
+  over-limit and incorrect-total selections cannot be submitted.
+
+Focused pure regressions cover differing valid sector debits, immutable
+allocation rejection, omitted zeroes, same-total reveal-pile redistribution,
+choice-signature corruption, death/all/none automation and legacy single-pile
+settlement. These regressions specify prototype allocation boundaries, not new
+printed rulings.
+
 ## Boundaries and evidence
 
 Kwisatz, separate trainer bonuses and Stunner still await the existing modifier
 question; no user answer is assumed. Expansion rosters/cards, the independent
-Ecaz card variant, other optional modules and multiple positive piles remain
-guarded before the Smuggler plan seals. These development restrictions are not
-rules that forbid those combinations in the physical game. Stone Burner and
-other expansion combinations therefore have no connected acceptance claim here.
+Ecaz card variant and other optional modules remain guarded before the Smuggler
+plan seals. These development restrictions are not rules that forbid those
+combinations in the physical game. Stone Burner and other expansion combinations
+therefore have no connected acceptance claim here.
 
 Focused engine tests cover winners/losers in both modes, empty/short piles,
 zero surviving forces, death and Traitor outcomes, explosion, capture custody,