Connect Sandmaster route collection and saved movement cancellation

Prototype optional one-spice collection from distinct entered territories along exact legal ground routes. Share route and collection checks between engine, controls and all four AI profiles. Preserve per-pile opt-out, multiple source sectors, physical force/spice custody and unchanged legacy moves. Apply the documented per-movement Hajr scope inference; special relocation, combined modules and ambiguous multiple-pile collection remain unfinished.

Bind Fremen declarations to their actual chosen route even when a shorter route reaches the endpoint. Preserve that commitment across saved responses, collect only on successful movement, and hide its internal proof from every player projection. Independent source, rules and persistence review completed.

Validation: 52 focused tests; typecheck, lint, 4504 offline tests, production build and 43 HTTP tests passed. SQLite restart, exact concurrent settlement, cancellation and legacy continuation passed. Browser exercised genuine assignment, route editing, collection opt-out/reselect, three moved forces, two collected spice, automatic notices and refresh with unchanged private cards. Two genuine four-profile Basic/Advanced samples completed in 196/89 actions with 6/3 JSON restorations and no rejected candidates; neither used Sandmaster collection, so targeted tests establish the effect.

Preserved all 495 opening rooms and original seat/recovery rows (529 rooms after QA/HTTP). SQLite integrity and foreign keys passed. The healthy server was reused; no restart, reset or automation.

Verified source tree: aec472f2dacdd49a13216a92bb4fb715af9d7ee028de6dd007cd496142eb06b1

docs/COMPONENT_INVENTORY.md

@@ -309,3 +309,7 @@ Root browser review in isolated table QPNV5XJJ confirmed the full Guild row5/3/3
 ## Bene Gesserit portrait checkpoint (2026-09-06)
 
 Four original portraits complete Alia, Wanna Marcus, Reverend Mother Ramallo and Margot Lady Fenring alongside the existing Princess Irulan. All six base-faction rosters now have portraits, totaling30/60 ordinary identities. Thirty ordinary expansion portraits and separate special-disc artwork remain. The new1254px opaqueRGB files, exact prompts/corrections and hashes are in BENE_GESSERIT_PORTRAITS.md and the generation manifest. Root inspected all four final images; the agent inspected full,192px and80px circular views. The four existing asset tests are now registered and verify all six base rosters, identity privacy, physical files and manifest consistency. The final combined1258-case suite passes; this artwork checkpoint does not certify unfinished expansion mechanics.
+
+The [Sandmaster ground-movement follow-up](SANDMASTER_MOVEMENT.md) adds explicit
+routes, optional collection, human/AI controls and saved cancellation. Special
+relocation and combined modules remain unfinished.

docs/CURRENT_STATUS.md

@@ -4,6 +4,11 @@ Updated 13 September 2026. This is the short navigation dashboard; detailed evid
 
 ## Evidence and source of truth
 
+- [Sandmaster movement collection](SANDMASTER_MOVEMENT.md) connects explicit
+  ground routes, optional board-spice collection, controls, legal AI and saved
+  Fremen cancellation. Special relocation and combined modules remain missing;
+  multiple-pile collection stays guarded. No mode gate is opened.
+
 - [Spice Banker battle spending](SPICE_BANKER_RUNTIME.md) connects sealed own
   spice, separate support funding, survivor strength, traitor payment precedence,
   private controls, all four AI profiles and saved resolution. Normal income

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,20 @@
 # Dune implementation status
 
+## 13 September 2026 — Sandmaster movement collection prototype
+
+[Sandmaster](SANDMASTER_MOVEMENT.md) now collects optional spice from distinct
+territories entered along explicit legal ground routes. Shared human/AI choices
+retain each source sector, path and selected pile. A Fremen movement response
+preserves the original declaration; cancellation collects nothing and successful
+completion transfers each board spice once before arrival reactions. Internal
+saved proofs remain outside player projections.
+
+Independent rules and persistence review, focused legality/custody/privacy tests
+and SQLite continuation cover this boundary. Broad checks, browser and sample-game
+evidence and saved-game preservation are recorded in the checkpoint commit.
+Special relocation, combined modules and multiple-pile collection remain missing;
+no public mode or publication gate is opened.
+
 ## 13 September 2026 — Spice Banker battle commitment prototype
 
 [Spice Banker](SPICE_BANKER_RUNTIME.md) connects one through three sealed own

docs/LEADER_SKILLS_RUNTIME.md

@@ -149,3 +149,7 @@ game restoration was performed.
 Checkpoint-wide check/build/HTTP results and the final source fingerprint are
 recorded in the commit and private verification report. Full module and combined
 game acceptance remain unfinished.
+
+The [Sandmaster ground-movement follow-up](SANDMASTER_MOVEMENT.md) adds explicit
+routes, optional collection, human/AI controls and saved cancellation. Special
+relocation and combined modules remain unfinished.

docs/RULE_DECISIONS.md

@@ -8,6 +8,7 @@ Updated 13 September 2026. This is the authoritative navigation index for existi
 | --- | --- | --- |
 | Spice Banker battle spending | Secret own-spice commitment is separate from support; only the surviving selected disc gains strength. Core Battle Plan payment rules spend it on death/loss and waive it for a sole traitor-call winner. This payment composition is explicit; upper deferred-income custody remains pending. | [Source contract and prototype](SPICE_BANKER_RUNTIME.md) |
 | Smuggler shipping | Optional free companion is included in the actual total; apply Guild rounding to the reduced priced count. Ordinary Fremen reserves are on planet. No-Field plus a separate free force is officially permitted but still awaits integration. Legacy unstamped declarations keep their quoted full price. | [Source contract and prototype](SMUGGLER_SHIPMENT.md) |
+| Sandmaster movement | One optional board spice per distinct entered territory on an explicit legal route; source-only repositioning earns none. Per-movement Hajr reset is a documented grammatical inference. Canceled moves earn nothing; multiple-pile collection remains guarded. | [Source and connected prototype](SANDMASTER_MOVEMENT.md) |
 | Leader battle effects | Rihani normal peek and reshuffle precede a separate committed optional draw; ordering is an explicit printed-order inference. Unused excludes actual calls, not mere disclosure. Mentat/Bureaucrat change scores; Sandmaster adds board spice. Multiple piles and Face Dancer composition stay guarded. | [Source contract and prototype](LEADER_BATTLE_EFFECTS.md) |
 | Source and readiness | Separate published rules, explicit implementation choices and unfinished interpretations; Advanced/expansion gates stay closed. | [Base/Advanced audit](BASE_ADVANCED_READINESS_20260907.md), [checklist](../game/reference.ts) |
 | Setup and Fremen movement | Preserve source-ordered setup and the distinct declared-movement cancellation; do not recreate fixed historical gaps. | [Setup contract](ADVANCED_SETUP_TEST_SEAM.md), [Fremen Karama](FREMEN_MOVEMENT_KARAMA_RULES.md) |

docs/SANDMASTER_MOVEMENT.md

@@ -0,0 +1,75 @@
+# Sandmaster movement collection
+
+13 September 2026. **Prototyped**, with **Partial** rules coverage. Ordinary
+ground movement now connects the normal band through explicit routes, optional
+collection, player controls, all four AI profiles and saved continuation.
+This does not open public Leader Skills starts or publication.
+
+## Source contract
+
+The physical card and [Jack Reda's designer walkthrough, 15:48–16:08](https://www.youtube.com/watch?v=XT_azRVLq_0&t=948s)
+allow immediate collection of one spice when forces move into or through a
+territory containing spice, once per territory. The [GF9 CHOAM & Richese rules,
+pages 8–9 and 12](https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf)
+require a living native trainer for this normal band; a captive supplies only
+the lower battle band. Common skill resolution precedes faction abilities.
+The [existing source archive](LEADER_SKILLS_RULES.md#sources-and-local-evidence)
+contains the checked physical face and timestamped designer transcript.
+
+The route's initial territory earns nothing merely for being the source.
+Crossing into an intermediate or final territory qualifies, independently of
+the number of moving forces. A later legal re-entry into the source can qualify;
+each distinct entered territory still grants at most one collection. Moving
+between sectors without leaving the source territory earns nothing. The card
+says territory, so the route need not touch the spice pile's particular sector.
+Storm and stronghold passage restrictions still apply.
+
+**Recorded scope inference:** the once-per-territory limit belongs to the
+movement that triggers it. A distinct Hajr movement starts another collection
+opportunity. No publisher or designer clarification specifically discussing
+Hajr was located; this follows the card's movement-triggered grammar rather
+than introducing a once-per-phase limit that the card does not state.
+
+Collection commits when the legal move completes, before arrival reactions.
+Canceled or rejected declarations move neither forces nor spice. If several
+positive sector piles exist in a territory, that collection remains unavailable
+because the source does not specify which pile to debit. Movement and collection
+from other eligible territories remain available.
+
+## Implementation and verification boundary
+
+The optional movement choice declares a connected sector route from every
+selected source sector and the individual territories to collect from. The
+engine validates the exact paths against actual range, storm and occupancy.
+It records the native skilled leader, original movement and pile quantities.
+The same shared helper supplies default routes and collection choices to humans
+and bots. Players may edit each route and decline any or all collection;
+ordinary Move retains its existing behavior with no Sandmaster collection.
+
+A Fremen route using its two-territory advantage keeps the choice in the saved
+movement response, even when a shorter direct route reaches the same endpoint.
+The response is bound to the original choice across interruptions. Changing or
+removing the commitment, response or original board spice fails validation.
+Internal proofs are excluded from player projections. Existing versioned writes
+settle the physical board-to-player transfer once, with automatic explanatory
+history. Legacy declarations without a choice continue as ordinary movements.
+
+Focused tests cover Basic/Advanced collection, per-territory opt-out, malformed
+and blocked routes, custody, Fremen cancellation and recovery, saved corruption,
+private views and legal candidates across four AI profiles. SQLite checks include concurrent final allowance, exact payment, canceled
+declarations and legacy movement. Two genuine four-profile Basic/Advanced
+samples finished in 196/89 actions with 6/3 JSON restorations and no rejected
+candidates; neither encountered Sandmaster collection. Targeted tests establish
+that effect. A fresh browser room assigned the offered skill through genuine
+setup, then used a conserved staged movement. The player edited the route from
+Red Chasm through South Mesa to Pasty Mesa, exercised per-pile opt-out and moved
+three forces. Both selected piles lost one spice; own spice rose from five to
+seven. Refresh retained three Pasty Mesa forces, one Arrakeen force, sixteen
+reserves, no Tanks and the same private Crysknife and Caid. Movement completion
+awaited the human. This is targeted browser evidence, not a complete human game.
+Broad checkpoint results are recorded with the checkpoint. These checks do not certify every skill or combined module.
+
+Remaining work includes worm riding and other nonordinary relocation, special
+movement cards, expansion/module integration, multiple-pile adjudication and
+wider interaction and strategy acceptance. The lower battle band remains in
+[the battle-effects contract](LEADER_BATTLE_EFFECTS.md).