Adopt authorized Advanced Storm and alliance separation defaults

docs/ALLIED_TRANSIT_RULES.md

@@ -2,6 +2,63 @@
 
 Audit: 7 September 2026. Read-only source and code audit, retained by the coordinating agent. Scope is classic GF9 base rules and the applicable November 2020 FAQ, not tournament or movie-game rules.
 
+## Authorized Advanced source cutover — 1 October 2026
+
+The user-supplied root `UNOFFICIAL_Revised_Dune_Rulebook_v.2.3_web.pdf`
+is now authorized for Advanced, including its marked unofficial departures.
+It has 44 physical PDF pages and SHA-256
+`7077aa87a973221d86d4bd2da945b40c4dec3d371caa6a68cb209758ddf1e516`;
+metadata says v.2.3, but the visible editorial heading on physical page 3
+says Version 2.2. The PDF remains user-owned and is not republished.
+
+**Alliance Constraint, physical PDF page 15:** at the end of either
+player's Shipment and Movement, its own forces in a territory shared with
+its ally go to Tanks, except Polar Sink. Advisors do not trigger the
+constraint. The footnote identifies both per-player timing and advisor
+coexistence as intentional departures from the original rules and November
+2020 FAQ. **Questions and Answers, physical page 40** explains the aim:
+advisor occupation should not lock allies out, and the first acting player
+should bear its own departure obligation.
+
+Accordingly, normal Advanced ends no longer wait for the ally's later turn
+or exempt an alliance formed this turn. Advisor exemption works in both
+directions: sharing with advisors kills neither the advisors nor allied
+fighters. BG fighters are not exempt. Native Ecaz peaceful coexistence and
+its existing Karama conditions remain unchanged. Homeworlds are not Dune
+territories and keep their native allied-entry prohibitions. Basic retains
+the existing later-player and formation-turn conditions, including its
+non-exempt advisor treatment.
+
+This resolves the **Advanced** timing/advisor and end-turn consequence
+questions below. It does not remove the current allied-entry guard, grant
+new shipments or extra moves, alter alliance formation/breaking windows,
+or settle every optional arrival composition. A forced end consequence
+does not require a new loss confirmation; the existing `endMovement`
+action remains legal even when no escape is available. The native force,
+elite and No-Field custody paths remove the ending player's group once,
+not its ally's group.
+
+The own clean-turn warning uses the canonical engine quote via
+`GameView.advancedAllySeparation: { territories: string[] } | null`.
+It contains public territory names only, not force counts, concealed
+values or raw source receipts. Pending response/decision controls retain
+priority. Already completed turns are not reevaluated.
+
+**Verification: Partial development verified.** The selected source-wave
+checks pass 339/339 across seventeen files; full types/lint and 6,169
+offline cases pass. Authenticated SQLite covers restart/CAS/privacy and
+unchanged Basic behavior. Genuine unallied Basin groups separated by
+Storm subsequently ally at a natural Nexus; native ending sends only the
+actor's two physical forces, including one elite, to Tanks. Hajr and
+advisor/Ecaz/Polar cases retain their own continuation. Actual 390-pixel
+first/later human ending in backed-up `CA6FVKVD` and `U5335T2L` changes
+Emperor Tanks from zero to two, leaves Atreides at zero and survives refresh.
+Saved physical inventory and all original authenticated seats remain intact.
+No allied-entry guard was removed to create the fixture. Basic and wider
+public/faction/module gates remain unchanged. The September publisher audit
+below is historical comparison, not the current Advanced authority.
+The supplied revision is unofficial, not a later publisher FAQ.
+
 ## Publisher sources and established facts
 
 **Base rulebook**, printed pp9–10,12,18,23: https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf . Read local publisher text `/tmp/dune-rules/base.txt`; official indexed p12 independently corroborates it.
@@ -20,7 +77,7 @@ Audit: 7 September 2026. Read-only source and code audit, retained by the coordi
 
 Exact retrieval queries included the official PDF path plus `"ship into a territory" "ally"` and `"What is the difference between an advisor"`. Searches also checked allied territory, next-turn, Tanks, and advisor/alliance terms. The relevant later clarification is November, not the older April FAQ. Search results for the 2021 movie edition and non-rule forum content were excluded. No later relevant official clarification was located in these bounded searches; that is not proof none exists.
 
-## Current implementation comparison
+## Historical implementation comparison — 7 September 2026
 
 Line numbers refer to the saved engine read during this audit.
 
@@ -30,7 +87,7 @@ Line numbers refer to the saved engine read during this audit.
 - `game/advisors.ts` distinguishes total presence from fighter count. Using total presence for allied separation matches the advisor FAQ. Using fighter count for stronghold capacity matches the base advisor exception. These are intentionally different questions.
 - A blanket removal of the entry guard would be incomplete: the current formation-turn exemption is player-wide and the end-turn rule allows the first mover to leave shared forces for the second ally. Neither records whether a specific group entered voluntarily this turn or was present when the alliance formed.
 
-## Implementable boundaries and material unanswered cases
+## Historical implementable boundaries and unanswered cases
 
 The clearest supported new behavior is **ship into allied territory, then move the complete visiting group to a legal non-allied destination during the shipper's turn**. A movement path passing through an ally and ending elsewhere is also clear. Permit neither a third fighting faction in a stronghold nor storm traversal under this exception. Preserve Polar Sink's exception. Separate shared territories by their history rather than treating every alliance formed this turn as blanket permission to create new co-occupation.
 
@@ -41,4 +98,12 @@ The following are actual source limits, not established alternative rules:
 3. **New voluntary entry during alliance formation turn.** Distinguish the FAQ departure requirement from the p12 delayed deadline for already shared forces. The precise treatment of mixed old/new cohorts in the same territory is not supplied as a token-level rule. Do not let a blanket `allySinceTurn` check silently waive the new entry's obligation.
 4. **Other arrival mechanisms.** Advisor accompaniment has its explicit separation instruction; its timing can differ from BG's own turn. Worm rides, No-Field materialization, Enemy of My Enemy and competing expansion arrivals need their own composition. Homeworlds are outside this base transit permission.
 
+Under the authorized Advanced cutover above, the ending player's shared
+fighters are lost even if departure was prevented or the alliance formed
+this turn; no old/new cohort exemption is inferred. Thus items 1 and 3 no
+longer leave the ordinary **Advanced end-turn consequence** unresolved.
+Their Basic-policy and prospective entry-permission questions remain.
+Item 4's advisor separation premise is superseded in Advanced, while
+independent arrival timing and unsupported combinations stay bounded.
+
 Recommended bounded checks before changing the entry guard: ordinary path transit with a clean endpoint; paid shipment followed by complete legal exit; no legal exit available; temporary city access and remaining movement range; ally-plus-enemy stronghold capacity; Polar co-occupation; advisors versus fighters; old Nexus co-occupation in formation turn and following turn, both action orders; multiple shared territories; serialized continuation and duplicate requests. Bind the no-exit outcome only after its policy is source-supported or explicitly adjudicated. No runtime or tests were changed by this audit.

docs/BASE_ADVANCED_READINESS_20260907.md

@@ -16,6 +16,63 @@ The coordinator subsequently implemented the two bounded findings concerning Fre
 
 The later implementation now provides the shared, strict offline initializer described in [ADVANCED_SETUP_TEST_SEAM.md](ADVANCED_SETUP_TEST_SEAM.md). New Basic and offline Advanced tables enforce prediction before private traitors, all traitor selections before force placement, Fremen before the Advanced advisor, and Treachery after every placement. Legacy saved setup continues without redealing. All 456 setup combinations pass. The old `tests/bots.test.ts` Basic-then-flip helper discussed below has been replaced: four profiles now complete registered games from genuine Advanced creation through the shared initializer. The older descriptions below remain the original audit snapshot. The larger [456-game Advanced study](AI_ADVANCED_SETUP_CALIBRATION_20260907.md) now also completes with 116,270 accepted actions and zero rejections or checked failures across all base rosters and player counts. Its selected invariants and 5,943 actual JSON continuations broaden the evidence; they do not resolve the named rules, strength-calibration or browser acceptance gaps.
 
+## Authorized Advanced source follow-up — 1 October 2026
+
+The user authorized the root `UNOFFICIAL_Revised_Dune_Rulebook_v.2.3_web.pdf`,
+including its marked unofficial rulings. Its SHA-256 is
+`7077aa87a973221d86d4bd2da945b40c4dec3d371caa6a68cb209758ddf1e516`.
+It has 44 physical PDF pages; metadata says v.2.3 while the visible editorial
+heading on physical page 3 says Version 2.2. This is a supplied unofficial
+revision, not publisher provenance or a newly published application rulebook.
+See the [source amendment and cutover](RULE_DECISIONS.md#advanced-core-cutover--1-october-2026).
+
+Physical page 6 makes every newly opened Advanced Storm after the first
+use a random Storm Deck card, even without Fremen. The six canonical faces
+are 1–6; the previous revealed card is eligible again at the next determination.
+First-turn nearby-player 0–20 dials remain unchanged. Native Fremen still
+privately learns its next card through its existing cancellable foresight;
+absence of Fremen grants no player that knowledge. Already recorded current
+Storm dials or cards finish their saved protocol without a reset or reroll.
+The next new Advanced turn uses the Deck. Basic's dial rules are unchanged.
+
+Physical page 15's Alliance Constraint and explicit departure footnote,
+with the rationale on physical page 40, require the ending player's own
+shared allied force groups to go to Tanks at **each** Shipment and Movement
+end. Neither the ally's later turn nor formation this turn postpones that
+Advanced consequence. Advisor coexistence is exempt in both directions:
+neither the advisors nor the allied fighters are lost for sharing with advisors.
+BG fighters remain subject to ordinary separation. Polar Sink and native
+Ecaz peaceful coexistence, including its existing Karama conditions, remain;
+Homeworlds are outside this Dune-territory rule and keep their native alliance
+prohibitions. Basic retains its existing later-player/formation-turn policy.
+These clauses settle the Advanced timing and advisor questions in
+[the earlier allied-transit audit](ALLIED_TRANSIT_RULES.md), not every entry
+permission, optional arrival composition or Basic no-exit remedy.
+
+The engine's canonical allied-separation quote supplies the existing finish
+consequence and the own clean-turn `GameView.advancedAllySeparation` warning,
+whose only payload is affected public territory names. The ordinary
+`endMovement` action is unchanged. Pending responses retain priority; forced
+loss adds no confirmation. Ending remains legal when no escape is available.
+Actual loss custody continues through the native force/elite/No-Field handling,
+without exposing concealed values in that warning or reevaluating completed
+turns. These are core Advanced defaults, not a secret opt-in source profile.
+
+**Verification: Partial development verified.** Selected native source,
+authenticated SQLite, controls and four-profile legal-bot checks pass
+339/339 across seventeen files. Full types/lint, 6,169 offline cases and
+build pass. Standalone native continuation proves exact owned normal/elite
+loss and advisor/Ecaz/Polar exceptions, plus a genuine prior-revision
+Advanced dial save followed by a new no-Fremen card opening.
+Actual 390-pixel human Storm inspection/confirmation, first/later ending
+and expanded guide in three privately backed-up new QA rooms survive
+refresh. Saved native inventory, eight prior rooms and all 33 original
+seats in eleven QA rooms remain preserved after isolated build reloads.
+Local HTTP is 51/55, four POST 503s, not green or deployed acceptance.
+Earlier calibration and subsystem evidence below remain historical.
+Public/faction/optional-module gates and full Advanced certification remain
+unchanged. Duke revival/ghola, Kull and broader secrecy work remain separate.
+
 ## Concrete remaining behavior
 
 | Priority | Finding and evidence                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | Next edit or audit target                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |

docs/CURRENT_STATUS.md

@@ -9,13 +9,39 @@ an [authorized Advanced source of truth](RULE_DECISIONS.md#authorized-source-ame
 including its identified unofficial rulings. The 44-page file has 2.3
 metadata but a visibly retained 2.2 editorial heading; the index records its
 SHA-256 and physical-page citations. Current Guild payment/source passages
-were compared with the wave. Wider Advanced reconciliation is not yet
-implemented, and adoption does not reset games, convert Basic, republish
-the local PDF or open mode gates.
+were compared with the wave. Wider Advanced reconciliation remains open.
+Adoption does not reset games, convert Basic, republish the local PDF or
+open mode gates.
 
 
 ## Current checkpoint and work
 
+Five implementation lanes reconciled two source-clear Advanced defaults
+from the authorized revised rulebook: all new post-first Storm openings
+draw the Storm Deck, even without Fremen; each player's own combined-turn
+end applies allied separation without waiting for the ally. Advisor
+coexistence in either direction, native Ecaz and Polar Sink remain exempt.
+Basic is unchanged; a genuine prior-revision recorded Advanced dial save
+finishes its original sum, then uses the Deck on its next new turn.
+Canonical engine quotes supply own public loss-territory names only,
+with unchanged native ending, force/elite/No-Field custody and pending locks.
+Four existing minimal bot policies use native availability, not a second
+separation calculator. Independent rules and storage reviews have no finding.
+Consumer fixture repairs retain original Storm bindings and native progress;
+they do not weaken source validation or remove the allied-entry guard.
+Types, lint, **6,169 offline tests**, **339 selected cases** and build pass.
+Standalone native continuation covers exact owned normal/elite losses,
+advisor/Ecaz/Polar exceptions, unchanged Basic and captured old Storm.
+Three backed-up fresh authenticated Advanced preview rooms exercise actual
+390-pixel public Storm inspection/confirmation, first/later human ending
+and refresh. Read-only proof conserves physical forces/elites/Treachery,
+retains the eight prior Guild rooms, and all **33 seats in 11 QA rooms**
+reauthenticate after necessary isolated-worker build reloads.
+The actual expanded source guide retains Partial gates and exercised evidence.
+Local built-worker HTTP is **51/55**, four POST 503s, not green.
+Full Advanced, wider source differences, strategic AI and live acceptance
+remain open; container publication is not deployment.
+
 Five implementation lanes connected [Guild Nexus Betrayal](NEXUS_GUILD_RULES.md#nexus-guild-betrayal):
 full funded shipment-payment replacement, including own upfront payment
 and the explicit occupied-Junction override. Fresh `guild-betrayal` admits

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,62 @@
 # Dune implementation status
 
+## 1 October 2026 — authorized Advanced Storm and allied separation defaults
+
+Five implementation lanes connected the user-supplied revised Advanced
+source's physical pages 6, 15 and 40 without a source-fork profile or reset.
+Every newly opened post-first Advanced Storm draws one of the six canonical
+faces, even without Fremen. First-turn wheels, Basic's protocol and an
+already recorded current opening remain unchanged; native Fremen alone
+keeps cancellable private foresight. Public inspection retains the original
+card face when Weather Control changes actual movement.
+
+A focused canonical policy now quotes the ending player's own shared
+territories in Advanced without the later-ally/formation-turn grace period.
+BG advisors are exempt in both directions; native Ecaz and Polar Sink
+coexistence remain. Basic retains its earlier deadline and formation policy.
+Native ordinary/deferred endings keep force, elite and concealed No-Field
+custody, with preflight before parking a retiring Ornithopter.
+The own clean-turn warning exposes public names only, not counts or source
+receipts, and adds no forced-loss confirmation. It is a block-layout semantic
+output; all existing pending controls retain priority.
+
+Independent frozen rules/storage reviews have no finding. Full verification
+initially found 40 consumers assuming missing original Storm frames or
+superseded Advanced timing/dial protocols. Four repair lanes retained
+counter/SQL/privacy/custody coverage, migrated native phase progression
+and removed an incidental HTML-role pin. Genuine ordinary overlaps use
+paid Emperor/Atreides Basin groups in opposite sectors separated by first
+Storm 10, then a natural Nexus alliance; no allied-entry guard was weakened.
+A permanent captured real `8a562991` Advanced dial save is genuinely
+Advanced, not a Basic-flag flip, and preserves its original continuation.
+
+`npm run check` passes types, lint and **6,169 offline cases**; the selected
+17-file union passes **339/339**, and production build passes.
+Standalone runtime covers seven Advanced loss/exception scenarios, Basic
+new-alliance preservation and prior recorded dials followed by a new
+no-Fremen Deck opening. Authenticated SQLite covers first/next Storm,
+private foresight, restore, concurrency, owned losses, Hajr, exceptions,
+corrupt sources and durable rejected-action immutability.
+
+Actual admitted previews `CA6FVKVD`, `PTSMVMDY` and `U5335T2L` were
+privately backed up before exact-version native preparation, retaining
+the same room, rules, circles, IDs and credentials. Phone-sized human
+first/later ending sends only Emperor's two physical forces, including one
+elite, to Tanks, leaves its ally intact and survives refresh. No-Fremen
+turn-two inspection shows the drawn five-sector face; human confirmation
+moves Storm from one to six and refresh retains Spice Blow. The final
+warning is a 354-pixel block within a 390-pixel viewport. Actual expanded
+guidance exposes the contract and Partial verification boundary.
+Read-only saved proof conserves original native setup inventory and cards;
+eight prior Guild rooms are unchanged. All 33 original authenticated seats
+in those eleven QA rooms restore after required isolated build reloads.
+
+Local HTTP is **51/55**, four known Wrangler-proxy POST 503s, not green.
+No POST retry/auth weakening or database reset was added. The user-owned
+44-page PDF remains local/unpublished, including its retained 2.2 editorial
+heading versus 2.3 filename/metadata. Broader source differences, full modes,
+strategic AI, public gates and final-revision live acceptance remain open.
+
 ## 1 October 2026 — full funded Guild Nexus Betrayal payment
 
 Five implementation lanes integrated engine, pure funding/custody/history,

docs/RULE_DECISIONS.md

@@ -29,14 +29,48 @@ Guild Nexus full-payment/own-payment/Junction override or supply a new
 response order; its bounded prepayment contract remains source-consistent.
 This is a source comparison, not runtime verification.
 
-Future Advanced reconciliation must distinguish the revision's Storm Deck
-simplification even without native Fremen (6), its explicitly revised
-alliance-constraint timing and advisor coexistence (15, 40), secrecy of
-spice/discards and hand counts outside Bidding (16), and Duke Vidal's
-Tleilaxu-ghola exception (30). These are source-led reconciliation targets,
-not claims that existing behavior has already changed. Optional variants
-remain optional, Basic is not silently converted to Advanced, and no saved
-game is reset or redealt by adopting a source.
+## Advanced core cutover — 1 October 2026
+
+The supplied revision now resolves two normal Advanced defaults, not a new
+opt-in profile or a publisher ruling:
+
+- **Storm Movement, physical PDF page 6:** after the first turn, draw a
+  random Storm Deck card and return the last revealed card before the next
+  determination, expressly even without native Fremen. The first Storm
+  still uses the two nearby players' secret 0–20 dials. The implementation
+  reuses the six canonical faces 1–6 and its structured Storm source; native
+  Fremen keeps its private next-card forecast and separate peek cancellation.
+  Without Fremen, nobody gains a forecast or a borrowed Fremen advantage.
+- **Alliance Constraint, physical PDF page 15 and rationale on 40:** at
+  each player's Shipment and Movement end, that ending player's own forces
+  in territories shared with its ally go to Tanks. Advanced does not wait
+  for the ally's later turn or exempt an alliance formed this turn. Bene
+  Gesserit advisors do not trigger this constraint in either direction;
+  fighters remain ordinary forces. Polar Sink and native Ecaz peaceful
+  coexistence remain exceptions. Homeworlds are not Dune territories, and
+  their native allied-entry prohibitions are unchanged.
+
+The page 15 footnote explicitly identifies the changed timing and advisor
+coexistence as departures from the original rules and November 2020 FAQ.
+Page 40 explains that choice; it is the supplied revision's unofficial
+authority, not a later GF9 clarification. See the
+[allied separation source comparison](ALLIED_TRANSIT_RULES.md#authorized-advanced-source-cutover--1-october-2026)
+and [readiness follow-up](BASE_ADVANCED_READINESS_20260907.md#authorized-advanced-source-follow-up--1-october-2026).
+
+Basic retains its existing dials and later-player/formation-turn separation
+policy. A saved current Storm completes its already recorded dial/card
+protocol without resetting, rerolling or redealing; the next new Advanced
+Storm opening uses the Deck. Completed movement consequences are not
+reevaluated. The own-turn warning exposes only affected public territory
+names through `GameView.advancedAllySeparation`; the ordinary `endMovement`
+action stays unchanged, with no confirmation for mandatory losses.
+
+Verification of this cutover is **Planned** pending the coordinator's
+frozen native, authenticated SQLite and phone/browser evidence. Existing
+focused tests and old calibration counts do not verify these new defaults.
+Public, faction, optional-module and full-mode readiness gates are unchanged.
+Secrecy (physical page 16), Duke Vidal's ghola exception (30), Kull and other
+independent decisions are not reconciled by this cutover.
 
 ## Recorded contracts and implementation boundaries
 

docs/STORM_CARD_INSPECTION.md

@@ -5,6 +5,46 @@ remain unchanged. Six numeric Storm Card faces can be enlarged from the internal
 reference. An entitled Fremen player can inspect the existing private forecast,
 and every viewer can inspect a card after its public reveal in the chronicle.
 
+## Authorized Advanced Storm default — 1 October 2026
+
+The user authorized `UNOFFICIAL_Revised_Dune_Rulebook_v.2.3_web.pdf`,
+including marked unofficial rulings. **Storm Movement, physical PDF page 6**
+uses a random Storm Deck card after the first turn, expressly even without
+native Fremen; the last revealed card returns before the next determination.
+The source has 44 physical pages and SHA-256
+`7077aa87a973221d86d4bd2da945b40c4dec3d371caa6a68cb209758ddf1e516`.
+Its metadata says v.2.3, while the visible editorial heading on physical
+page 3 says Version 2.2. This is authorized unofficial provenance, not a
+publisher simplification. The local PDF is not republished or linked in-app.
+
+Every new Advanced opening after the first uses the existing six faces 1–6
+and structured source, rather than a new saved deck array. First Storm
+nearby-player 0–20 dials and Basic dials remain unchanged. A saved current
+dial/card opening finishes as recorded without a reroll; the next new
+Advanced turn uses the Deck. Native Fremen alone retains its actual private
+next-card forecast and separate peek cancellation. Without Fremen there is
+no forecast grant, canceled foresight power or extra private confirmation.
+Public reveals use the existing inspector in either roster; recorded card
+faces stay distinct from Weather Control or Testing Station movement.
+
+**Verification of the new default: Partial development verified.** The
+selected source-wave native/SQLite/control/bot checks pass 339/339 across
+seventeen files; full types/lint, 6,169 offline cases and build pass.
+A captured real prior-revision Advanced dial opening finishes
+its original sum, then the next native no-Fremen opening draws a canonical
+card. Actual new authenticated preview `PTSMVMDY`, privately backed up
+before native preparation, reveals five sectors at turn two. Its
+390-pixel inspector shows that public face, explains the roster-independent
+Deck and native-only forecast, then human confirmation advances Storm
+from one to six; refresh continues Spice Blow without a reroll.
+Saved native inventory and original seats remain intact after isolated
+build reloads. Local built-worker HTTP is 51/55, four POST 503s, not green
+or deployed acceptance. Older inspection evidence below covers its stated
+boundary. Public/faction/module gates and full-mode certification remain
+unchanged; inspection alone did not change rules, this cutover does.
+
+## Existing inspection contract
+
 `game/storm-cards.ts` is a face catalog, not a new deck or source of a live draw.
 The inspector accepts one already-authorized value and no game, deck or seat.
 The rules gallery shows all possibilities without selecting a live card.