Connect bounded Diplomat retreat and record live deployment

docs/CURRENT_STATUS.md

@@ -1,11 +1,22 @@
 # Current development status
 
-Updated 26 September 2026. **The full twelve-faction goal is unfinished. Basic
+Updated 27 September 2026. **The full twelve-faction goal is unfinished. Basic
 is playable and the six classic factions have a user-authorized Advanced preview.
 Expansion starts and full rules/publication acceptance remain gated.**
 
 ## Current checkpoint and work
 
+The live NAS Apps `dune` image is now the immutable
+`ghcr.io/quintine/dune:sha-4801ce003bd28d5f0aaf26c3bcded3dcfea4df07`
+from successful container workflow `36355611201`. The public homepage displays
+that full revision. After the update, owner sign-in succeeded and the nine
+existing rooms remained in the directory, including a playing room at version
+54. A 0600 online SQLite backup in the persistent app volume passed
+`PRAGMA quick_check` before the update; the temporary remote plaintext owner
+key and provisioning SQL were removed afterward. Private saved-seat
+reconnection and complete historical-data comparison were not exercised.
+The pending Diplomat retreat work is not in this deployed image.
+
 The bounded [Fremen Nexus Cunning](NEXUS_FREMEN_RULES.md#connected-native-cunning-path)
 prototype connects an initially empty worm's public offer, one spent private
 card, a Karama response, a typed remote ride after the Nexus, human controls
@@ -40,9 +51,9 @@ bulk actions and backup/operations tools remain unfinished.
 
 [Participant AI](ADMIN_PARTICIPANT_AI.md) checkpoint `2cddf03` is pushed. Types/lint,
 5,408 offline tests, 52 HTTP tests, build, twenty-two administrator HTTP groups
-and desktop/mobile browser acceptance passed. Deployment request delivery remains
-unconfirmed; the latest confirmed production revision is `e918e2e`. No strategic
-AI refinement was added.
+and desktop/mobile browser acceptance passed. Deployment delivery was
+unconfirmed at that checkpoint; the current production revision is recorded
+above. No strategic AI refinement was added.
 
 Readable-notice checkpoint `137f922` is pushed. Types/lint, 5,381 offline tests,
 52 HTTP tests, build and delayed-response desktop/mobile browser QA passed.
@@ -230,7 +241,7 @@ These links define bounded working behavior, not complete module certification.
 | --- | --- |
 | Base/Advanced setup | [Normal Advanced preview](ADVANCED_PREVIEW.md), [genuine setup](ADVANCED_SETUP_TEST_SEAM.md), [Advanced study](AI_ADVANCED_SETUP_CALIBRATION_20260907.md), [Fremen cancellation](FREMEN_MOVEMENT_KARAMA_RULES.md), [Atreides full-plan audit](ATREIDES_FULL_PLAN_TIMING.md). Earlier Basic-then-flip fixtures do not establish current setup coverage. |
 | Expansion factions | [Ixians/Tleilaxu](IX_PROTOTYPE.md) and [all seven faction selections](EXPANSION_FACTIONS_PROTOTYPE.md): genuine setup, Ecaz six-force placement and [Advanced Loyalty](ECAZ_LOYALTY.md), separate optional card variants, private controls and saved per-lot Ixian/Richese decline. Actual special-lot exchange remains pending. |
-| Leader Skills | [Common lifecycle](LEADER_SKILLS_RUNTIME.md), [known skilled capture](LEADER_SKILLS_CAPTURE.md), [Mentat question preview](MENTAT_QUESTION.md), [Bureaucrat payments](BUREAUCRAT_PAYMENTS.md), five battle disciplines, [Planetologist](PLANETOLOGIST_RULES.md), [Suk Graduate](SUK_GRADUATE_RULES.md), [Rihani and other battle effects](LEADER_BATTLE_EFFECTS.md), [Smuggler shipment](SMUGGLER_SHIPMENT.md), [No-Field](SMUGGLER_NO_FIELD.md) and [battle collection](SMUGGLER_BATTLE.md), [Sandmaster routes](SANDMASTER_MOVEMENT.md) and [worm rides](SANDMASTER_WORM.md), [Banker spending](SPICE_BANKER_RUNTIME.md), [Diplomat defense](DIPLOMAT_DEFENSE.md). Remaining bands and combinations are explicit in those contracts. |
+| Leader Skills | [Common lifecycle](LEADER_SKILLS_RUNTIME.md), [known skilled capture](LEADER_SKILLS_CAPTURE.md), [Mentat question preview](MENTAT_QUESTION.md), [Bureaucrat payments](BUREAUCRAT_PAYMENTS.md), five battle disciplines, [Planetologist](PLANETOLOGIST_RULES.md), [Suk Graduate](SUK_GRADUATE_RULES.md), [Rihani and other battle effects](LEADER_BATTLE_EFFECTS.md), [Smuggler shipment](SMUGGLER_SHIPMENT.md), [No-Field](SMUGGLER_NO_FIELD.md) and [battle collection](SMUGGLER_BATTLE.md), [Sandmaster routes](SANDMASTER_MOVEMENT.md) and [worm rides](SANDMASTER_WORM.md), [Banker spending](SPICE_BANKER_RUNTIME.md), [Diplomat defense](DIPLOMAT_DEFENSE.md) and [bounded retreat](LEADER_SKILLS_RULES.md#bounded-diplomat-retreat-interpretation). Remaining bands and combinations are explicit in those contracts. |
 | Discoveries | [Prototype](DISCOVERY_PROTOTYPE.md): genuine setup, Great Maker, seven cards/eight tokens, inspection and stash rewards, nested sites, signed later free entry, carried Ornithopter, sole Cistern, bounded Jacurutu income, Testing Station and Shrine. Orgiz and contested/mixed cases remain pending. |
 | Nexus/Homeworlds | [Decision index](RULE_DECISIONS.md) links each integrated faction family, native/borrowed effects, physical custody, private choices, payments and transport. [CHOAM Collection trade](NEXUS_CHOAM_SECRET_ALLY.md) and [Emperor extra revival](NEXUS_EMPEROR_SECRET_ALLY_RUNTIME.md) are connected; CHOAM inspection and Emperor purchase remain pending. A source audit or helper alone is not a completed effect. |
 | Truthtrance | [Spice facts](TRUTHTRANCE_SPICE_FACTS.md), [card counts](TRUTHTRANCE_CARD_COUNT.md), [hand inventory](TRUTHTRANCE_HAND_INVENTORY.md), [recorded knowledge](TRUTHTRANCE_KNOWLEDGE.md), and [Basic/no-Guild Advanced reserve-shipment promises](TRUTHTRANCE_SHIPMENT_PROMISES.md) use authoritative private state. Earlier readiness audits do not supersede these follow-ups. |

docs/DIPLOMAT_DEFENSE.md

@@ -2,7 +2,8 @@
 
 13 September 2026. **Prototyped**, with **Partial** rules coverage. This connects
 the Diplomat's normal band for canonical base Shield and Snooper defenses only.
-The lower retreat band, combined modules and other defense cards remain
+The lower [retreat prototype](LEADER_SKILLS_RULES.md#bounded-diplomat-retreat-interpretation)
+is now connected separately; combined modules and other defense cards remain
 unfinished. Public Leader Skills starts and publication remain gated.
 
 ## Source and interpretation
@@ -86,10 +87,11 @@ eligible copy; targeted tests and the browser establish the effect. Required
 broad check results and final saved-game preservation are recorded in the
 checkpoint commit and private source-bound report.
 
-The lower Diplomat retreat remains pending with its recorded strength and
-resolution-order questions. Shield Snooper, Chemistry, defensive Weirding Way,
-Portable Snooper, Carthag-added protection and any future copied or modified
-defense need a separate contract for whether generic roles or named exceptions
-are inherited. Homeworlds, Nexus, Discoveries, Stronghold Cards, Tech Tokens and
-other combined modules remain guarded. These limits preserve the existing
-public gates.
+The bounded [lower retreat](LEADER_SKILLS_RULES.md#bounded-diplomat-retreat-interpretation)
+now follows a documented conservative strength and outcome order; this does not
+settle a publisher priority ruling. Shield Snooper, Chemistry, defensive
+Weirding Way, Portable Snooper, Carthag-added protection and any future copied
+or modified defense still need a separate contract for whether generic roles or
+named exceptions are inherited. Homeworlds, Nexus, Discoveries, Stronghold
+Cards, Tech Tokens and other combined modules remain guarded. These limits
+preserve the existing public gates.

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,11 @@
 # Dune implementation status
 
+## 27 September 2026 — Bounded skilled Diplomat retreat
+
+The standalone [Leader Skills retreat interpretation](LEADER_SKILLS_RULES.md#bounded-diplomat-retreat-interpretation) now offers a surviving losing trained leader an event-bound, saved decision before ordinary loser casualties. The server quotes destination-specific undialed normal/elite counts using dial commitments, occupied strongholds, sector adjacency and the storm; accepted choices transfer those exact physical counters, while a decline or dead leader follows ordinary losses. Human controls and all four AI profiles use the same projected choices. Nine focused engine, controls and concurrent in-memory SQLite cases passed, including JSON restoration, split-sector custody, legacy-battle continuation and rejected-action immutability. An isolated browser view from a genuine revealed battle rendered the destination/count selectors and decline; POST was blocked, so no room was changed. The scoped type check and production build passed. This is a provisional strength/outcome-order interpretation, not a complete skill or combined-module ruling, and it is not yet deployed.
+
+The complete offline regression suite passed 5,545 tests across 696 files after the retreat changes. The unrelated in-progress Nexus/Fremen draft still blocks the repository-wide type/lint check; the scoped type check covers this retreat slice. The live `4801ce0` image predates this slice.
+
 ## 27 September 2026 — Ixian/Tleilaxu with Nexus Cards
 
 The paired-faction Nexus sample path now includes genuine Ixian/Tleilaxu games without opening the public expansion/module starts. At seed 20260927 all ten two-through-six-seat Basic/Advanced [samples](VERIFICATION_WORKFLOW.md#reusable-base-and-faction-sample-games) completed with 3,853 accepted actions, 100 JSON restores, five unallied card choices and no rejected actions. The three-seat Basic and Advanced traces reach Ixian auction decisions and Nexus draws; Basic reaches a Face Dancer decision, Advanced an Ixian Technology decision. A five-seat Basic trace also plays one Atreides Nexus effect, while an interrupted four-seat Advanced game resumes its own roster. The source-bound report is `/tmp/dune-ix-nexus-checkpoint-20260927/report.json`. This does not certify all card effects, combined module configurations or complete expansion rules.

docs/LEADER_SKILLS_RULES.md

@@ -184,6 +184,24 @@ designer expressly presents the latter as useful to Fremen, but does not
 publish a general stacking order for every expansion movement modifier
 ([designer example, 19:13](https://www.youtube.com/watch?v=XT_azRVLq_0&t=1153s)).
 
+### Bounded Diplomat retreat interpretation
+
+A 27 September 2026 online check of the [publisher's CHOAM & Richese
+rulebook](https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf),
+the [designer's walkthrough](https://www.youtube.com/watch?v=XT_azRVLq_0&t=851s)
+and the independent [Landsraad tournament reference](https://www.landsraad-vegas.com/rules)
+did not establish a publisher/designer priority ruling for modified strength
+or the precise casualty order. The publisher's old PDF URL currently redirects
+to its store; the sourced printed-card paraphrase above remains the authority.
+For the playable standalone Leader Skills profile, use the selected disc's
+printed value (Zoal copies the opposing disc), not battle bonuses. Resolve
+weapons and leader survival first; a surviving losing trained leader may then
+move up to that cap in undialed physical counters before the remaining loser
+forces go to the Tanks. A dead leader, traitor loss or explosion cannot retreat.
+This is an explicit conservative implementation interpretation, not a quoted
+FAQ answer. Legacy battles, other optional modules and modified-skill
+interactions retain their existing gates.
+
 ## 20 September Smuggler follow-up
 
 A bounded renewed check of the GF9 CHOAM & Richese rules/Q&A, the

docs/LEADER_SKILLS_RUNTIME.md

@@ -72,8 +72,11 @@ income remains missing. [Banker battle spending](SPICE_BANKER_RUNTIME.md)
 now connects its lower band with separate sealed funds and survivor strength. [Smuggler shipping](SMUGGLER_SHIPMENT.md)
 connects its optional normal reserve bonus and the [owned No-Field companion](SMUGGLER_NO_FIELD.md).
 [Diplomat defense](DIPLOMAT_DEFENSE.md) connects its normal band for a physical
-Worthless card copying a canonical base Shield or Snooper; the lower retreat
-and modified-defense inheritance remain guarded. [Smuggler battle collection](SMUGGLER_BATTLE.md)
+Worthless card copying a canonical base Shield or Snooper. Its bounded lower
+[retreat](LEADER_SKILLS_RULES.md#bounded-diplomat-retreat-interpretation) now moves
+selected undialed normal/elite counters to an empty adjacent non-stronghold
+after a surviving trained leader loses. Modified-defense inheritance remains
+guarded. [Smuggler battle collection](SMUGGLER_BATTLE.md)
 now connects reveal-bound, unmodified collection after survival, including
 losers and captives. Modified strength and combined modules remain guarded.
 Planetologist and Suk Graduate have the connected
@@ -88,8 +91,8 @@ The Basic Tleilaxu follow-up now tests response-driven automatic own revival
 continuation; this does not certify Advanced foreign-ghola custody. The other source-contract timing questions also remain
 open. Planetologist now has bounded movement and battle controls as described below.
 Remaining normal-band payments, ordinary Mentat activation, modified Smuggler collection,
-Diplomat retreat and the other guarded skill combinations still need connected
-effects.
+and the other guarded skill combinations still need connected effects. Diplomat
+retreat is a bounded prototype, not a complete simultaneous-effect ruling.
 
 ## Planetologist follow-up
 

docs/RULE_DECISIONS.md

@@ -71,7 +71,7 @@ These are unresolved in the cited records. Do not infer an answer from elapsed t
 | Sapho remaining timing | First versus unspent Advanced Guild priority, partly completed combined turns, cyclic auction duration and later battle timing stay guarded. The existing pre-plan opportunity supports [early aggressor](SAPHO_AGGRESSOR.md). Prior questions remain unanswered. | [Source audit](JUICE_OF_SAPHO_SOURCE_UPDATE.md), [battle review](JUICE_OF_SAPHO_BATTLE_REVIEW.md) |
 | Mirror Weapon | Whether copied Tooth/Artillery mandatory-discard rules attach to the physical Mirror remains unanswered. Every genuine Richese setup includes those cards and Stone Burner; an ordinary-copy-only admission gate cannot depend on concealed custody or alter the printed deck. | [Engine audit](MIRROR_WEAPON_ENGINE_AUDIT.md) |
 | Semuta Drug | Full-hand take-before-discard and the privacy-neutral immediate reaction protocol remain unresolved. Typed discard continuations already exist; they are not activation. | [Source update](SEMUTA_SOURCE_UPDATE_20260907.md), [privacy review](SEMUTA_PRIVACY_REVIEW.md) |
-| Leader Skills edge cases | Capture/replacement eligibility, Banker escrow custody (user question sent), Smuggler modifier/allocation boundaries, Mentat empty-hand fallback (private historical observations persist after death), Diplomat lower retreat ordering, modified-defense inheritance and remaining simultaneous optional timing need resolution before those cases are enabled. These are recorded source gaps, not answered user rulings. | [Material boundaries](LEADER_SKILLS_RULES.md#material-boundaries-not-settled-by-the-sources), [Diplomat boundary](DIPLOMAT_DEFENSE.md#evidence-and-remaining-scope) |
+| Leader Skills edge cases | Capture/replacement eligibility, Banker escrow custody, Smuggler modifier/allocation boundaries, Mentat empty-hand fallback, modified Diplomat defenses and simultaneous optional timing remain source gaps. After an online publisher/designer/tournament check found no explicit priority ruling, the bounded standalone Diplomat retreat prototype explicitly chooses printed/copied disc strength and a surviving-loser retreat before ordinary casualties; other combinations remain guarded. This is an implementation interpretation, not an official clarification. | [Material boundaries and selected retreat interpretation](LEADER_SKILLS_RULES.md#bounded-diplomat-retreat-interpretation), [Diplomat defense boundary](DIPLOMAT_DEFENSE.md#evidence-and-remaining-scope) |
 | Smuggler collection strength | A fresh primary-source check found no modifier ruling. The user was asked whether to keep affected combinations gated, use printed/copied disc value, or include leader bonuses with Stunner zero. No answer is assumed. The reveal-bound deferred receipt is supported as an explicit timing inference; unmodified lower collection is now [prototyped](SMUGGLER_BATTLE.md); modified strength, multiple positive piles and combined modules remain gated. | [Smuggler follow-up](LEADER_SKILLS_RULES.md#20-september-smuggler-follow-up) |
 | Suk Graduate / Atreides | Whether rescued dialed casualties count toward the seven-loss Kwisatz Haderach threshold remains unresolved. The user question has been sent; Advanced Atreides rescue stays guarded. | [Source and runtime boundary](SUK_GRADUATE_RULES.md) |
 | Ordinary Guild cancellation | Unaffordable repricing, replacement/retry/decline, consumed opportunity, contributor adjustment and ordering with special shipment-stop. The affordability question was already sent. | [Material timing](GUILD_RATE_KARAMA_RULES.md#material-unresolved-timing) |

docs/VERIFICATION_WORKFLOW.md

@@ -33,6 +33,13 @@ Each pushed application checkpoint also needs a separate live deployment; a
 successful GitHub container publication alone is not a deployment. Follow
 [the manual TrueNAS update](TRUENAS.md#applying-an-update) only after the image
 passes CI, the persistent volume is backed up and play reaches a safe point.
+
+For subsequent checkpoints, delegate the NAS Apps update and live verification
+to a dedicated deployment agent while the integration owner continues other
+work. Supply the exact successful immutable image tag; the agent changes only
+the `dune` app in Apps, retains its `/data` volume, and reports the displayed
+revision and saved-room continuity before the checkpoint is called deployed.
+
 If access, the backup or a safe point is missing, report the push as **not
 deployed** and keep its production verification open rather than claiming the
 Git revision label matches the pushed commit.