Add authorized Storm Card inspection

Connect the six numeric reference faces, the existing private Fremen forecast and actual public reveals to a shared enlarged inspector. Create the structured public chronicle component only where beginStormTurn reveals the card. Weather Control and Ecological Testing Station may change effective movement but never rewrite the original receipt. No draw, movement, AI strategy or mode gate changes.

The face reader accepts only exact stormCard metadata with an integer value1 through6. Legacy text-only history still renders normally. Existing JSON saves preserve valid receipts within the normal250-entry chronicle; no card is inferred from a private forecast, current pending distance or old log text. Five new tests use genuine Advanced fixtures to verify forecast allowance/cancellation and privacy, public reveal, JSON/legacy continuation and original-versus-modified distances. The related reference suite also passes (17 focused cases total).

Independent privacy/provenance/UI review found no material findings. The initial check stopped at an accessibility lint rule; replacing the numeric group with a semantic figure resolved it, followed by a fresh final run and mobile recheck. Required types, lint, 4946 offline tests, production build and 46 HTTP tests pass on stable final source. Browser QA opens all six reference faces, uses keyboard Enter/Escape and checks settled modal focus/return. At390px the modal is359px wide and fits the viewport; Close is44px high. The viewport was reset. Screenshot capture remains unavailable, so full visual acceptance is not claimed. Live Advanced browser play and final manufactured-face/artwork verification remain open; fixture privacy checks and gallery controls are narrower evidence.

The existing server remained running. All 1337 original rooms, 2805 seats and existing recovery/entry/handover/delegation/migration rows remain unchanged; SQLite integrity and foreign keys pass. HTTP tests created only their own additional QA records. No database migration/reset, hourly automation, account-usage check or AI calibration. Standing automatic push authorization retained.

Private evidence: 20260921-storm-card-inspection.
Verified source tree: 3856e73f3cc3bb50003b6afda6ab4d08a513191c4e300e7742c2b5179a05cff1

docs/COMPONENT_INVENTORY.md

@@ -1,5 +1,13 @@
 # Component inventory and verification ledger
 
+**Storm Card inspection, 21 September 2026:** six numeric reference faces,
+authorized private Fremen forecasts and structured public reveal receipts now
+share an enlarged inspector. The actual card value survives separately from
+Weather Control or Testing Station movement changes. Existing text-only logs
+remain readable; no private draw is inferred from public movement. This updates
+the historical Storm Card enlargement gap, not complete manufactured-face or
+artwork certification. See [scope and evidence](STORM_CARD_INSPECTION.md).
+
 **Leader Skills update, 13 September 2026:** all fourteen unique physical cards
 now have sourced names and complete paraphrased normal/battle text, shared
 inspectors, private two-card offers and one-card assignment custody. Five role

docs/CURRENT_STATUS.md

@@ -6,22 +6,23 @@ gated.** Prototypes do not open completion or publication gates.
 
 ## Current checkpoint and work
 
-Latest delivered checkpoint: `c4ff75a`, [interactive alliance practice](INTERACTIVE_INTRODUCTION.md).
-Types, lint, **4,934 offline tests** and production build passed. All 1,337 rooms,
+Latest delivered checkpoint: `67e429e`, [Charity and Revival practice](INTERACTIVE_INTRODUCTION.md).
+Types, lint, **4,941 offline tests** and production build passed. All 1,337 rooms,
 2,805 seats and existing recovery/entry/handover/delegation rows stayed unchanged.
-The stopped server was started against existing state; an existing QA seat restored.
-The preceding `b7ec940` connects bidding practice, `b9718ac` connects
+The running server was reused; prior lesson results and paid returns restore.
+The preceding `c4ff75a` connects alliance practice, `b7ec940` connects bidding,
+and `b9718ac` connects
 [lobby AI configuration](LOBBY_AI_CONFIGURATION.md), and `b21b2bc` connects
 [one-use AI permission](SEAT_AI_PERMISSION.md). The `8f7a62c` policy checkpoint
 removed the usage cutoff and deferred AI refinement until feature completion,
 with three adjacent 75% targets. Earlier evidence remains in the
 [implementation history](IMPLEMENTATION_STATUS.md).
 
-Current work: [Charity and Revival practice](INTERACTIVE_INTRODUCTION.md) adds two
-Basic phase lessons, cumulative free/paid returns, leader eligibility and shared
-spending through existing production calculations. Saved choices migrate every
-earlier lesson and commitment. No AI strategy changes. Final independent review,
-browser/check/build/preservation and Git evidence belong to its private report.
+Current work: [Storm Card inspection](STORM_CARD_INSPECTION.md) connects six
+reference faces, the permitted Fremen forecast and public chronicle receipts to
+enlarged inspection. Original card values stay separate from modified movement;
+legacy text logs remain valid. No rules or AI strategy changes. Independent review,
+browser/check/build/HTTP/preservation and Git evidence belong to its private report.
 A bounded current-state Duke review confirmed revival/loan paths still cross
 recorded custody, return and cycle questions; existing identity/price helpers and
 non-Ecaz guards are already present. No duplicate ruling or invented outcome.

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,17 @@
 # Dune implementation status
 
+## 21 September 2026 — Storm Card inspection
+
+The [Storm Card inspector](STORM_CARD_INSPECTION.md) connects six numeric reference
+faces, the existing private Fremen forecast and actual public reveal receipts in
+the chronicle. Inspection is read-only. Saved public records retain their original
+face after movement or Weather Control, separately from effective storm distance.
+Earlier text-only history remains valid; unknown component metadata fails closed.
+No AI strategy or rules mode changes. Focused projection/provenance checks,
+independent review, browser controls and final check/build/HTTP/preservation/Git
+evidence belong to the private checkpoint. Complete physical face/artwork and
+broader component acceptance remain unfinished.
+
 ## 21 September 2026 — Charity and Revival practice
 
 The [introduction](INTERACTIVE_INTRODUCTION.md) expands to eleven lessons and nine

docs/STORM_CARD_INSPECTION.md

@@ -0,0 +1,38 @@
+# Storm Card inspection
+
+21 September 2026. Prototyped component inspection; Advanced and expansion gates
+remain unchanged. Six numeric Storm Card faces can be enlarged from the internal
+reference. An entitled Fremen player can inspect the existing private forecast,
+and every viewer can inspect a card after its public reveal in the chronicle.
+
+`game/storm-cards.ts` is a face catalog, not a new deck or source of a live draw.
+The inspector accepts one already-authorized value and no game, deck or seat.
+The rules gallery shows all possibilities without selecting a live card.
+The existing `stormForecast` projection remains the sole private authorization.
+
+At the real `beginStormTurn` reveal, the existing public log entry receives an
+optional `{kind:'stormCard', distance}` component. Neither drawing the next card,
+allowing/canceling Fremen foresight, basic dials nor Weather Control creates that
+receipt. The existing saved log preserves it through JSON and the usual
+250-entry history limit. Earlier text-only entries remain valid; no face is
+guessed from old text or current movement. The inspector rejects unknown kinds,
+extra fields and values outside the six faces.
+
+Weather Control replaces movement and Ecological Testing Station adjusts it;
+neither edits the original revealed receipt. The card inspector therefore keeps
+the printed value distinct from the effective distance. No rules calculations,
+AI strategies, save schema migration or network authority change.
+
+Authority: the [classic GF9 rulebook](https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf),
+component inventory p.5 and Fremen sheet p.16. Publisher-indexed text retrieved
+21 September confirms the six-card deck and the private forecast/public reveal,
+return and shuffle sequence. The six values already used by the production engine
+are represented as readable numeric faces with original explanatory prose.
+This does not certify every detail of the manufactured artwork or printed face;
+that remains part of final component verification. No source link enters the app.
+
+Focused tests cover authorization, reveal metadata, legacy saves, continuation,
+modified movement and invalid metadata. Independent review, browser controls,
+required check/build/HTTP results, preservation and Git delivery belong to the
+source-bound private checkpoint. Screenshot limitations are recorded separately;
+DOM bounds do not establish complete visual acceptance.