Connect Sandmaster route collection and saved movement cancellation

Prototype optional one-spice collection from distinct entered territories along exact legal ground routes. Share route and collection checks between engine, controls and all four AI profiles. Preserve per-pile opt-out, multiple source sectors, physical force/spice custody and unchanged legacy moves. Apply the documented per-movement Hajr scope inference; special relocation, combined modules and ambiguous multiple-pile collection remain unfinished.

Bind Fremen declarations to their actual chosen route even when a shorter route reaches the endpoint. Preserve that commitment across saved responses, collect only on successful movement, and hide its internal proof from every player projection. Independent source, rules and persistence review completed.

Validation: 52 focused tests; typecheck, lint, 4504 offline tests, production build and 43 HTTP tests passed. SQLite restart, exact concurrent settlement, cancellation and legacy continuation passed. Browser exercised genuine assignment, route editing, collection opt-out/reselect, three moved forces, two collected spice, automatic notices and refresh with unchanged private cards. Two genuine four-profile Basic/Advanced samples completed in 196/89 actions with 6/3 JSON restorations and no rejected candidates; neither used Sandmaster collection, so targeted tests establish the effect.

Preserved all 495 opening rooms and original seat/recovery rows (529 rooms after QA/HTTP). SQLite integrity and foreign keys passed. The healthy server was reused; no restart, reset or automation.

Verified source tree: aec472f2dacdd49a13216a92bb4fb715af9d7ee028de6dd007cd496142eb06b1

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,20 @@
 # Dune implementation status
 
+## 13 September 2026 — Sandmaster movement collection prototype
+
+[Sandmaster](SANDMASTER_MOVEMENT.md) now collects optional spice from distinct
+territories entered along explicit legal ground routes. Shared human/AI choices
+retain each source sector, path and selected pile. A Fremen movement response
+preserves the original declaration; cancellation collects nothing and successful
+completion transfers each board spice once before arrival reactions. Internal
+saved proofs remain outside player projections.
+
+Independent rules and persistence review, focused legality/custody/privacy tests
+and SQLite continuation cover this boundary. Broad checks, browser and sample-game
+evidence and saved-game preservation are recorded in the checkpoint commit.
+Special relocation, combined modules and multiple-pile collection remain missing;
+no public mode or publication gate is opened.
+
 ## 13 September 2026 — Spice Banker battle commitment prototype
 
 [Spice Banker](SPICE_BANKER_RUNTIME.md) connects one through three sealed own