Prototype Discovery free entry, Cistern income and carried flight

Connect next-turn optional entry before storm/HMS movement, with typed
multi-sector groups, normal source-storm/occupancy checks, legal bot and human
choices, signed saved arrivals and Bene Gesserit reaction continuation.
Cistern pays its sole occupant two bank spice through canonical Collection.
A carried Ornithopter grants fixed range three on a later-turn actual movement,
preserves pending responses and independent Treachery/No-Field custody, and is
removed only after the selected group moves.

Independent reviews bind pending entry destination baselines, typed custody and
exact reaction continuations. Browser QA caught and fixed an incorrect decision
heading. Orgiz remains disabled pending the stacked-Blow ruling; Jacurutu battle
income, Ecological Testing Station and Shrine remain missing. Mode and publication
gates stay closed; this checkpoint does not certify full Discovery compliance.

Verification: types/lint and 4,313 offline tests passed (49 added), production
build passed, and 40 HTTP tests passed. Final stable run durations: check
139145ms, build 6530ms, integration 24421ms. An earlier run found one stale
Discovery notice assertion, now updated; the next run was interrupted by a
user-confirmed power outage. No interrupted result is claimed as success.

Targeted browser room CA782FQE used genuine human Atreides and two-AI setup,
then physical QA positioning for partial free entry and a three-territory
Ornithopter move. Refresh preserved its private hand, forces, spice and token
removal. The power outage stopped both server and checks; the absent server was
restarted after a private backup. The same browser seat restored correctly and
all 157 pre-restart rooms were unchanged. Final preservation: all 156 opening
rooms unchanged, 31 added QA/integration rooms, total 187. No database reset.

Source fingerprint:
7b639d7f6559a88b00f3cbf913cfa7e6c400bfabb8c392e7b732e8ea77f6dcbc
Private report:
/home/quintine/.local/share/dune/checkpoints/20260913-discovery-entry-flight/verification-recovered/report.json
Aggregate goal counter 61,819,586 -> 63,110,032 at completed verification:
1,290,446 tokens before final Git overhead for three connected functions,
including helper coordination, reviews, browser QA and interrupted checks.

docs/CURRENT_STATUS.md

@@ -4,11 +4,24 @@ Updated 13 September 2026. This is the short navigation dashboard; detailed evid
 
 ## Evidence and source of truth
 
+- The current [Discovery prototype](DISCOVERY_PROTOTYPE.md) adds
+  signed next-turn entry, sole-occupant Cistern income and later-turn carried
+  Ornithopter movement to the first batch. Focused lifecycle, engine, recovery,
+  private control and AI paths are present. Targeted browser room `CA782FQE`
+  verified partial free entry and a later range-three token move from a genuine
+  Discovery setup after QA state positioning; it was not an unmodified full-game
+  journey. Refresh and a subsequent power-outage restart restored its forces,
+  private hand, spice and spent token; all 157 saved rooms survived unchanged.
+  Required broad results are recorded in the checkpoint commit. Four location abilities
+  remain unavailable, and contested Cistern and Orgiz collection interpretations
+  remain unresolved. This is still **Prototyped**, not complete-module verification.
 - [First Discovery prototype](DISCOVERY_PROTOTYPE.md): genuine base-faction
   Basic/Advanced setup, seven Spice Cards, eight tokens, Great Maker, Collection
-  inspection/rewards and revealed nested locations are connected. Focused checks
-  pass; final broad checkpoint evidence is pending. Free entry, special location
-  benefits and Ornithopter spending remain missing.
+  inspection/rewards and revealed nested locations are connected. Checkpoint
+  `f0256c1` passed 4,264 offline tests, build and 40 HTTP tests; two seeded games
+  finished and the Fremen browser view restored its private token face. All 125
+  opening saved rooms remained unchanged. That checkpoint predates the current
+  free-entry, Cistern and carried-Ornithopter additions.
 - Ix prototype checkpoint `5a76ae0`: types, lint, **4,211 offline tests**, build and **40 HTTP tests** passed. Genuine Basic/Advanced setup and two seeded complete simulations were exercised; a short browser game finished with private hand restoration. All 64 opening saved rooms were preserved; 31 QA rooms were added. This is bounded prototype evidence, not complete Ix compliance.
 
 - [Rules implementation checklist](../game/reference.ts): `RULE_TOPICS`, topic `implementation-checklist`, and each feature's implementation, controls, AI, documentation and verification entries. Coverage is per stated boundary, not an implicit whole-game certificate.
@@ -41,7 +54,7 @@ restoration after necessary restarts. No recurring automation is installed.
 | --- | --- | --- |
 | Basic core | Playable loop; shared setup, Fremen movement cancellation, structured Truthtrance facts and bounded Basic/no-Guild Advanced reserve-shipment promises. | Ordinary Guild rate/transport cancellation; wider truthful questions/action commitments; integrated rules and human/AI acceptance. |
 | Six-faction Advanced | Genuine offline setup across 456 configurations; four-profile full-game simulations and JSON continuations. | Base gaps plus provisional special-Karama outcomes, remaining timing audits and authentic multiplayer/browser acceptance. Public starts remain disabled. |
-| Twelve factions and optional modules | Many bounded faction, card, Homeworld and Nexus slices have controls, bots and recovery evidence; the first Discovery actions now have a connected prototype. | Every unfinished effect and interaction, occupation entitlement, remaining Discovery effects and complete combined games. Inventory or fixture coverage does not enable a module. |
+| Twelve factions and optional modules | Many bounded faction, card, Homeworld and Nexus slices have controls, bots and recovery evidence; Discovery now includes free location entry, sole-occupant Cistern income and later-turn carried Ornithopter movement. | Every unfinished effect and interaction, occupation entitlement, four remaining Discovery location abilities, contested collection rulings and complete combined games. Inventory or fixture coverage does not enable a module. |
 | AI difficulty | Four profiles consume private legal views; recorded Basic and Advanced studies complete. | Demonstrate a consistent Medium → Hard → Brutal strength ordering, improve strategic gaps, and repeat targeted studies after relevant policy/rule changes. |
 | Multiplayer | Versioned writes, saved seats, owner recovery kits, uncertain-request retry and voluntary own-seat AI control. | Intentional transfer, unprepared abandoned-seat recovery, unattended continuation and remaining network-failure acceptance. Preserve privacy and existing games. |
 | Player experience | Internal component inspectors and many desktop/phone feature journeys verified. | Complete end-to-end games, accessible controls, responsive layout, clear rules/errors and recovery across all supported combinations. |
@@ -60,10 +73,12 @@ with private controls, all four AI profiles and a saved payment/discard continua
 Its after-victory inspection remains missing. The [first Discovery batch](DISCOVERY_PROTOTYPE.md)
 now connects the [sourced components](DISCOVERY_COMPONENTS.md) to Great Maker,
 destructive Discovery blows, private inspection/reveal, stash rewards, carried
-Ornithopter custody and five revealed nested locations. Only Jacurutu counts
-toward stronghold victory. Next dependencies are free entry at the next turn,
-the five special location benefits, and spending Ornithopter on a later move;
-complete variant acceptance and normal public starts remain gated.
+Ornithopter custody and later-turn movement, five revealed nested locations,
+signed free entry on the following turn and sole-occupant Cistern income. Only
+Jacurutu counts toward stronghold victory. Next dependencies are Jacurutu battle
+income, Ecological Testing Station, Shrine and Orgiz, plus unresolved contested
+Cistern and collected-spice-blow interpretations. Complete variant acceptance
+and normal public starts remain gated.
 
 The user changed the development order on 13 September: get working prototypes
 of all remaining functions into the game, then use integration and play to find

docs/DISCOVERY_PROTOTYPE.md

@@ -52,19 +52,33 @@ to redeal a started game. The default `ix` profile remains available.
   an owned discard choice, including the new card; its saved draw/discard receipt
   prevents replay. Both stashes then retain removed physical custody.
 - **Carried token:** revealing Ornithopter records its owner and acquisition
-  turn. Spending it for movement is not implemented in this batch.
+  turn. On a later turn, its owner may spend it on one ordinary movement action
+  to give the selected group a fixed range of three. It grants no extra action
+  or shipment. The physical token remains carried through pending movement and
+  arrival interactions, then leaves play once the selected movement commits.
 - **Nested locations:** the five revealed location tokens become separate,
   initially empty board territories inside their printed surroundings. Public
   reveal controls admission; a private peek alone cannot create a destination.
   Ordinary movement uses the parent territory, shipment uses stronghold prices,
   no more than two factions enter, and occupants are protected from storm and
   sandworms. Only Jacurutu Sietch contributes a stronghold toward victory.
+- **Next-turn free entry:** before the next Storm phase and Ixian Hidden Mobile
+  Stronghold movement, each eligible faction receives an optional signed choice
+  for a location revealed on the prior turn. It may move any positive subset of
+  ordinary and elite non-advisor forces across eligible sectors of the enclosing
+  territory into sector zero of that location. This spends no spice, shipment or
+  normal movement. Empty, storm-blocked and occupancy-blocked offers skip without
+  holding up the turn. Accepted groups and arrival reactions survive restoration.
+- **Cistern:** during Collection, a sole occupant receives two bank spice. If two
+  factions occupy Cistern, the unresolved benefit is withheld without blocking
+  Collection; this boundary does not decide which occupant should receive it.
 
-Great Maker vote/ride controls and Discovery token/discard controls use the same
-private legal choices as the four AI profiles. Token backs expose only permitted
-information; authorized faces have readable explanations of all eight effects.
-Busy and autopilot states disable human actions. Those explanations include
-remaining printed effects and explicitly distinguish them from available play.
+Great Maker vote/ride, Discovery token/discard, next-turn entry and carried
+Ornithopter controls use the same private legal choices as the four AI profiles.
+Token backs expose only permitted information; authorized faces have readable
+explanations of all eight effects. Busy and autopilot states disable human
+actions. Those explanations include remaining printed effects and explicitly
+distinguish them from available play.
 
 ## Interpretations retained for refinement
 
@@ -81,6 +95,20 @@ empty-supply resolution remains an implementation interpretation to refine,
 rather than a certified additional rule. Existing unrelated pending rulings in
 the [decision index](RULE_DECISIONS.md) remain pending.
 
+The printed next-turn entry text specifies neither an order among simultaneous
+locations and factions nor whether the ordinary source-sector storm restriction
+applies to this exceptional movement. Processing tokens in reveal order and
+factions in storm order, while excluding source groups in storm, are **source
+inferences** retained for deterministic legal play. They are not publisher
+answers or newly approved table rulings.
+
+The printed Cistern text names an occupant but permits two factions to occupy a
+revealed location. The prototype pays an ordinary sole occupant and withholds
+the contested bonus. Orgiz remains disabled because the source also does not
+settle whether a stacked board deposit represents one or several collected
+spice blows; contested occupancy and unresolved Ecaz shared collection add
+further unanswered cases.
+
 ## Evidence and next dependencies
 
 Focused suites cover component inventory and private projection
@@ -88,9 +116,28 @@ Focused suites cover component inventory and private projection
 (`tests/discovery-runtime.test.ts`), ordered Great Maker continuations
 (`tests/great-maker.test.ts`), nested board and admission rules
 (`tests/discovery-board.test.ts`, `tests/discovery-admission.test.ts`), and private
-human/AI controls (`tests/discovery-controls.test.ts`). They exercise immutable
-rejections, physical custody, hidden information and JSON restoration. They do
-not certify a complete module, all combined routes or difficulty strength ordering.
+human/AI controls (`tests/discovery-controls.test.ts`). Signed free entry and its
+engine, saved interaction and human/AI paths are covered by
+`tests/discovery-entry.test.ts`, `tests/discovery-entry-runtime.test.ts` and
+`tests/discovery-entry-controls.test.ts`. Cistern composition is covered by
+`tests/discovery-collection.test.ts`; carried token selection, delayed spending
+and disposal are covered by `tests/discovery-flight.test.ts`. They exercise
+immutable rejections, physical custody, hidden information and JSON restoration.
+They do not certify a complete module, all combined routes or difficulty strength
+ordering. Required broad checkpoint checks are pending for this expanded batch.
+
+Browser room `CA782FQE` began through the genuine Discovery setup with one human
+and two AI seats, then used a targeted QA state to reach the new controls without
+playing a full game. It verified a partial one-force free entry into Cistern with
+no spice or movement cost and a later three-territory Ornithopter move that spent
+the carried token once. This is targeted browser evidence; it does not represent
+an unmodified complete-game journey. Refresh restored the same forces, private
+hand, ten spice, one spent movement and removed token. All 156 opening saved
+rooms remain part of the preservation baseline. A user-confirmed power outage
+subsequently stopped the server and verification process. After backing up all
+157 current rooms, restarting the absent server restored the same browser seat,
+forces, private Stunner, spice and spent token. All 157 saved rooms were unchanged.
+Required broad results are recorded in the checkpoint commit.
 
 SQLite recovery tests (`tests/discovery-recovery.test.ts`) verify competing
 reveals pay only once, the private overflow choice survives restoration, and an
@@ -111,11 +158,11 @@ The room is paused at acceptance of that blow. No other saved room was changed
 and no server restart was needed. Required broad verification results and the
 source-bound report are recorded in the checkpoint commit.
 
-1. Add the next-turn free entry into newly revealed locations, preserving typed
-   groups, occupancy, turn order and saved pending choices.
-2. Connect the five special location benefits: Jacurutu battle income, Cistern
-   Collection income, Ecological Testing Station storm adjustment, Shrine card
-   conversion and Orgiz collection transfer. Ordinary Jacurutu victory counting
-   does not implement its battle income.
-3. Connect later-turn Ornithopter spending to one actual movement action, then
-   integrate combined modules and complete games before refining or opening gates.
+1. Connect the four remaining special location benefits: Jacurutu battle income,
+   Ecological Testing Station storm adjustment, Shrine card conversion and Orgiz
+   collection transfer. Ordinary Jacurutu victory counting does not implement its
+   battle income; Orgiz awaits the collected-pile ruling above.
+2. Resolve contested Cistern ownership, then integrate combined modules and
+   complete games before refining or opening gates.
+3. Run the required broad checkpoint, browser and saved-room verification for
+   this expanded prototype. Focused evidence does not open normal public starts.

docs/EFFICIENCY_PILOT.md

@@ -104,3 +104,16 @@ lost saved controls, a retargetable arrival and skipped overflow discard before
 the stable broad check. The implementation adds no calibration study or server
 restart. Final aggregate endpoint, source-bound checks and push belong in the
 checkpoint commit; whole-module completion remains unclaimed.
+
+The following Discovery batch starts at aggregate counter 61,819,586 and connects
+three more functions: next-turn free entry, Cistern Collection income and
+later-turn Ornithopter movement. Three reused helpers build separate quotes and
+controls, then integrate Collection/flight and independently review entry/flight;
+the owner integrates entry, persistence tests and browser acceptance. Entry review
+repaired arrival custody and conflicting saved continuations; targeted browser
+play found an incorrect decision heading. Orgiz's unresolved stacked-blow
+interpretation remains disabled while the independent functions advance. One new
+browser room uses genuine setup followed by explicitly targeted scenarios; the
+156 opening rooms are preserved. Required stable checks and the aggregate endpoint
+are recorded in the checkpoint commit, without counting these prototypes as
+complete Discovery rules compliance.

docs/RULE_DECISIONS.md

@@ -15,7 +15,7 @@ Updated 13 September 2026. This is the authoritative navigation index for existi
 | Nexus faction effects | Preserve physical custody, original faction identity and durable effect receipts; use each printed family instead of borrowing another faction's rules by analogy. | [Atreides](NEXUS_ATREIDES_RULES.md), [Harkonnen](NEXUS_HARKONNEN_RULES.md), [BG](NEXUS_BENE_GESSERIT_RULES.md), [Emperor](NEXUS_EMPEROR_RULES.md), [Fremen](NEXUS_FREMEN_RULES.md), [Guild](NEXUS_GUILD_RULES.md) |
 | Expansion Nexus families | Source audit coverage does not imply every panel is playable; consult later runtime records in the status log. | [Ixian Cunning](NEXUS_IXIAN_CUNNING_RULES.md), [Ixian replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Tleilaxu](NEXUS_TLEILAXU_RULES.md), [CHOAM](NEXUS_CHOAM_RULES.md), [Richese](NEXUS_RICHESE_RULES.md), [Ecaz](NEXUS_ECAZ_RULES.md), [Moritani](NEXUS_MORITANI_RULES.md) |
 | CHOAM Secret Ally | Absent-faction Collection trade spends one actual Worthless card and the Nexus for two bank spice. It is separate from native Cunning and Auditor; the battle inspection alternative remains missing. | [Prototype contract](NEXUS_CHOAM_SECRET_ALLY.md) |
-| Discoveries | Preserve seven sourced Spice Cards and eight physical tokens, private faction peeks and Collection choices. Revealed locations are separate territories; only Jacurutu counts toward stronghold victory. First actions are prototyped; free entry, special location benefits and Ornithopter spending remain missing. | [Component authority](DISCOVERY_COMPONENTS.md), [prototype boundary](DISCOVERY_PROTOTYPE.md) |
+| Discoveries | Preserve seven sourced Spice Cards and eight physical tokens, private faction peeks and Collection choices. Revealed locations are separate territories; only Jacurutu counts toward stronghold victory. Next-turn free entry, sole-occupant Cistern income and later-turn Ornithopter spending are prototyped; four special location effects remain missing. | [Component authority](DISCOVERY_COMPONENTS.md), [prototype boundary](DISCOVERY_PROTOTYPE.md) |
 | Guild Secret Ally | One explicit Guild-priced ordinary shipment; borrowed prices/routes preserve native identity. Free Fremen reinforcement remains a separate choice. | [Route contract](NEXUS_GUILD_SECRET_ALLY_RULES.md), [verified runtime](NEXUS_GUILD_SECRET_ALLY_RUNTIME.md) |
 | Homeworld custody and mobility | Physical home/visitor groups, population thresholds, tariffs and transport permissions retain distinct sources; Homeworld immunity is not universal immunity. | [Homeworld rules](HOMEWORLD_RULES.md), [benefits](HOMEWORLD_BENEFITS_RULES.md), [mobility](HOMEWORLD_MOBILITY_RULES.md), [invasion](HOMEWORLD_INVASION_RULES.md), [Guild transport](GUILD_HOMEWORLD_TRANSPORT_RULES.md) |
 | Homeworld effects | Keep original payment/revival/placement identities and qualification observations; observations alone do not choose an occupied-benefit owner. | [Payments](HOMEWORLD_PAYMENT_INCOME_RULES.md), [card economy](HOMEWORLD_CARD_ECONOMY_RULES.md), [Collection](HOMEWORLD_COLLECTION_RULES.md), [revival deployment](HOMEWORLD_REVIVAL_DEPLOYMENT_RULES.md), [victory reinforcement](HOMEWORLD_VICTORY_REINFORCEMENT_RULES.md), [replacement](HOMEWORLD_REPLACEMENT_RULES.md), [Tupile](HOMEWORLD_TUPILE_INTELLIGENCE_RULES.md) |
@@ -31,7 +31,8 @@ These are unresolved in the cited records. Do not infer an answer from elapsed t
 | Guild Secret Ally/Homeworlds | Whether the reserve-return grant overrides the Homeworld return restriction. The question was already sent; that route stays guarded. | [Homeworld return](NEXUS_GUILD_SECRET_ALLY_RULES.md#homeworld-prices-and-the-unresolved-return), [checkpoint](NEXUS_GUILD_SECRET_ALLY_RUNTIME.md) |
 | Occupied Homeworlds | Entitlement/expiry after departure, replacement or contest; unique powers and shared income. The first-occupier/current-occupier question was already sent. | [Occupation questions](HOMEWORLD_OCCUPATION_RULES.md#questions-the-retrieved-sources-do-not-settle), [lifecycle audit](HOMEWORLD_OCCUPATION_LIFECYCLE_AUDIT.md) |
 | Nexus responses and composition | Betrayal private-response timing, partial revival/payment choices, Emperor fewer-than-five, fresh advisor/storm cases, Duke restoration and remaining faction-specific combinations. | [Common boundaries](NEXUS_CARD_RULES.md#remaining-source-questions-and-release-boundaries) and the individual faction source/runtime documents above |
-| Discovery prototype inferences | Great Maker currently follows ordinary first-turn worm skipping and Sandtrout suppression; an exhausted token type creates no replacement token. These preserve current source interpretation and physical inventory but are not separately confirmed rulings or complete combined-module certification. | [Interpretations for refinement](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
+| Orgiz collection | User question pending: take one spice per positive board pile collected, or leave the effect pending? The publisher does not clarify stacked Spice Blows. The draft quote remains opt-in and is not enabled by the engine. Contested Cistern income also remains outside the ordinary sole-occupant prototype. | [Discovery interpretations](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
+| Discovery prototype inferences | Free entry uses storm order and ordinary source-storm restrictions; these are general-rule inferences. Great Maker currently follows ordinary first-turn worm skipping and Sandtrout suppression; an exhausted token type creates no replacement token. These preserve current source interpretation and physical inventory but are not separately confirmed rulings or complete combined-module certification. | [Interpretations for refinement](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
 | Other Homeworld combinations | Population/force splitting, removal custody, replacement shortages, income accounting and placement ordering remain local to their detailed contracts. | [Homeworld rules](HOMEWORLD_RULES.md), [occupation](HOMEWORLD_OCCUPATION_RULES.md) and the effect documents above |
 
 When a decision changes, record the exact source or user ruling in its detailed feature document, update affected implementation guidance/tests, and adjust this index and [current status](CURRENT_STATUS.md). Retain historical evidence without presenting a superseded proposal as current behavior.