Prototype Discovery spice encounters, private tokens and stash rewards

Connect real Basic/Advanced base-faction audit setup to all seven Discovery
Spice Cards and eight physical tokens. Add Great Maker's ordered majority
vote and Fremen reserve ride, destructive Discovery blows, private faction
peeks and Collection inspection/reveal, stash rewards and mandatory saved
card overflow, and revealed nested board locations. Share private legal
choices with human controls and all four AI profiles. Preserve normal gates.

Independent review repairs orphaned worm/vote/ride controls, retargeted
reserve arrivals, actor bindings and incomplete overflow discard receipts.
Harden room-aware admission against unrevealed nested locations. Extend the
backed-up local prototype starter with a Discovery profile; preserve seats.

Still missing: next-turn free entry, five special location benefits and
Ornithopter movement spending. Current prototype playthroughs do not certify
those effects or complete module/expansion compliance.

Verification: npm run check passed 4264 offline tests plus types/lint;
npm run build passed; npm run test:integration passed 40 tests. The single
source-bound broad run took 129358ms / 6782ms / 23918ms respectively.
Report: /home/quintine/.local/share/dune/checkpoints/20260913-discovery-prototype/verification/report.json
Source fingerprint: 4ea7b5209a58c369b0b1f8dc239b5dd2f3302bb759d83c32ba5406e80d8ae154

Two seeded Basic/Advanced games complete with component custody intact.
SQLite races pay stashes once and resume committed discards without replay.
Browser 3RJBH26Y verifies genuine human Fremen setup, a Discovery blow from
one reordered physical card, native private Hiereg visibility, enlarged
card/rules reading and refresh. Room remains paused at spice acceptance.
All 125 opening saved rooms unchanged; 31 added, 156 total. No server restart.

Efficiency: three reused bounded helpers; aggregate counter 60591430 to
61812513 after verification, 1221083 tokens before final Git/push overhead.
47 added offline tests. One stable broad run after focused review fixes;
no calibration or exhaustive optional-module interaction matrix.

docs/CURRENT_STATUS.md

@@ -4,6 +4,11 @@ Updated 13 September 2026. This is the short navigation dashboard; detailed evid
 
 ## Evidence and source of truth
 
+- [First Discovery prototype](DISCOVERY_PROTOTYPE.md): genuine base-faction
+  Basic/Advanced setup, seven Spice Cards, eight tokens, Great Maker, Collection
+  inspection/rewards and revealed nested locations are connected. Focused checks
+  pass; final broad checkpoint evidence is pending. Free entry, special location
+  benefits and Ornithopter spending remain missing.
 - Ix prototype checkpoint `5a76ae0`: types, lint, **4,211 offline tests**, build and **40 HTTP tests** passed. Genuine Basic/Advanced setup and two seeded complete simulations were exercised; a short browser game finished with private hand restoration. All 64 opening saved rooms were preserved; 31 QA rooms were added. This is bounded prototype evidence, not complete Ix compliance.
 
 - [Rules implementation checklist](../game/reference.ts): `RULE_TOPICS`, topic `implementation-checklist`, and each feature's implementation, controls, AI, documentation and verification entries. Coverage is per stated boundary, not an implicit whole-game certificate.
@@ -36,7 +41,7 @@ restoration after necessary restarts. No recurring automation is installed.
 | --- | --- | --- |
 | Basic core | Playable loop; shared setup, Fremen movement cancellation, structured Truthtrance facts and bounded Basic/no-Guild Advanced reserve-shipment promises. | Ordinary Guild rate/transport cancellation; wider truthful questions/action commitments; integrated rules and human/AI acceptance. |
 | Six-faction Advanced | Genuine offline setup across 456 configurations; four-profile full-game simulations and JSON continuations. | Base gaps plus provisional special-Karama outcomes, remaining timing audits and authentic multiplayer/browser acceptance. Public starts remain disabled. |
-| Twelve factions and optional modules | Many bounded faction, card, Homeworld and Nexus slices have controls, bots and recovery evidence. | Every unfinished effect and interaction, occupation entitlement, Discoveries and complete combined games. Inventory or fixture coverage does not enable a module. |
+| Twelve factions and optional modules | Many bounded faction, card, Homeworld and Nexus slices have controls, bots and recovery evidence; the first Discovery actions now have a connected prototype. | Every unfinished effect and interaction, occupation entitlement, remaining Discovery effects and complete combined games. Inventory or fixture coverage does not enable a module. |
 | AI difficulty | Four profiles consume private legal views; recorded Basic and Advanced studies complete. | Demonstrate a consistent Medium → Hard → Brutal strength ordering, improve strategic gaps, and repeat targeted studies after relevant policy/rule changes. |
 | Multiplayer | Versioned writes, saved seats, owner recovery kits, uncertain-request retry and voluntary own-seat AI control. | Intentional transfer, unprepared abandoned-seat recovery, unattended continuation and remaining network-failure acceptance. Preserve privacy and existing games. |
 | Player experience | Internal component inspectors and many desktop/phone feature journeys verified. | Complete end-to-end games, accessible controls, responsive layout, clear rules/errors and recovery across all supported combinations. |
@@ -52,9 +57,13 @@ genuine setup, both expansion factions, full Ix deck and Sandtrout, shared human
 controls and saved continuation. The checklist now distinguishes its Prototyped
 development stage from Partial rules coverage. The next connected action is the [CHOAM Nexus Collection trade](NEXUS_CHOAM_SECRET_ALLY.md),
 with private controls, all four AI profiles and a saved payment/discard continuation.
-Its after-victory inspection remains missing. [Discovery components](DISCOVERY_COMPONENTS.md)
-now records all seven spice cards, eight tokens and exact card placements;
-Discovery runtime and controls remain missing.
+Its after-victory inspection remains missing. The [first Discovery batch](DISCOVERY_PROTOTYPE.md)
+now connects the [sourced components](DISCOVERY_COMPONENTS.md) to Great Maker,
+destructive Discovery blows, private inspection/reveal, stash rewards, carried
+Ornithopter custody and five revealed nested locations. Only Jacurutu counts
+toward stronghold victory. Next dependencies are free entry at the next turn,
+the five special location benefits, and spending Ornithopter on a later move;
+complete variant acceptance and normal public starts remain gated.
 
 The user changed the development order on 13 September: get working prototypes
 of all remaining functions into the game, then use integration and play to find

docs/DISCOVERY_PROTOTYPE.md

@@ -0,0 +1,121 @@
+# Discovery functional prototype
+
+13 September 2026. The first connected Discovery batch is **Prototyped**, with
+partial rules coverage. It connects physical components, real actions, private
+controls, AI choices and saved continuation. Normal public Discovery and
+Advanced start gates, and the publication gate, remain closed.
+
+## Source and setup boundary
+
+The [component acquisition record](DISCOVERY_COMPONENTS.md) identifies the
+publisher-authored *Ecaz & Moritani* rulebook, pages 12–13, and the physical card
+scan used for all six placements. Its verified inventory is seven Spice Cards
+(six Discovery territory cards and Great Maker) and eight tokens. This prototype
+uses those identities and effects; it does not treat test outcomes as rulings.
+
+`initializeDiscoveryGameForAudit` enters the real staged setup with two through
+six ready base factions, in Basic or Advanced, with Discoveries enabled before
+components are dealt. It adds the seven cards to the ordinary Spice Deck and
+creates one of each token behind shuffled, opaque physical identities. It rejects
+redealing a started or nonempty game. Other expansion decks and optional modules
+are outside this initializer. No ordinary player action or room endpoint can
+bypass the normal start gate through it. The existing backed-up local starter
+accepts `--profile discovery` for a fresh ready base-faction lobby:
+
+```sh
+node --import tsx tools/start-prototype.ts --profile discovery --db PATH --room CODE --version NUMBER --out /private/new-directory
+```
+
+It preserves all seats and other rooms, requires the current version and refuses
+to redeal a started game. The default `ix` profile remains available.
+
+## Connected behavior
+
+- **Great Maker:** ordinary worm consequences resolve first. Every faction then
+  votes in storm order; a strict majority creates a Nexus and a tie does not.
+  A previous Nexus in the phase is retained. Fremen may then move any legal
+  number of actual reserve forces to one allowed destination without spending
+  spice, shipment or normal movement. Typed Fedaykin custody and storm/occupancy
+  restrictions apply. Canceling protection of Fremen already in the affected
+  territory does not cancel the separate reserve ride.
+- **Discovery blows:** each of the six cards destroys existing forces and spice
+  in its printed blow territory, including Fremen forces, before placing six
+  spice subject to the ordinary storm exclusion. A random available token of
+  the printed type is placed face down at the card's separate token destination.
+- **Inspection and reveal:** Fremen privately see placed Hiereg faces; Guild
+  privately sees placed Smuggler faces. During Collection, non-advisor forces in
+  a token's surrounding territory may inspect it and then choose whether to
+  reveal it. Other seats do not receive that private knowledge or the token's
+  hidden supply order. An inspected token may remain face down.
+- **Immediate rewards:** Spice Stash pays seven bank spice once. Treachery Card
+  Stash draws one private card before checking the hand limit. Overflow requires
+  an owned discard choice, including the new card; its saved draw/discard receipt
+  prevents replay. Both stashes then retain removed physical custody.
+- **Carried token:** revealing Ornithopter records its owner and acquisition
+  turn. Spending it for movement is not implemented in this batch.
+- **Nested locations:** the five revealed location tokens become separate,
+  initially empty board territories inside their printed surroundings. Public
+  reveal controls admission; a private peek alone cannot create a destination.
+  Ordinary movement uses the parent territory, shipment uses stronghold prices,
+  no more than two factions enter, and occupants are protected from storm and
+  sandworms. Only Jacurutu Sietch contributes a stronghold toward victory.
+
+Great Maker vote/ride controls and Discovery token/discard controls use the same
+private legal choices as the four AI profiles. Token backs expose only permitted
+information; authorized faces have readable explanations of all eight effects.
+Busy and autopilot states disable human actions. Those explanations include
+remaining printed effects and explicitly distinguish them from available play.
+
+## Interpretations retained for refinement
+
+The Great Maker text instructs players to treat it as Shai-Hulud with listed
+exceptions. The prototype consequently applies ordinary first-turn worm skipping
+and Sandtrout suppression before opening its special vote and ride. Those two
+interactions are **source inferences**, not separately confirmed publisher
+answers or newly approved table rulings. The Discovery-only setup does not itself
+enable a combined Ix/Sandtrout game.
+
+If the required token type has no physical supply remaining, the blow continues
+without creating another token. This preserves the eight-token inventory; the
+empty-supply resolution remains an implementation interpretation to refine,
+rather than a certified additional rule. Existing unrelated pending rulings in
+the [decision index](RULE_DECISIONS.md) remain pending.
+
+## Evidence and next dependencies
+
+Focused suites cover component inventory and private projection
+(`tests/discoveries.test.ts`), genuine setup and Collection effects
+(`tests/discovery-runtime.test.ts`), ordered Great Maker continuations
+(`tests/great-maker.test.ts`), nested board and admission rules
+(`tests/discovery-board.test.ts`, `tests/discovery-admission.test.ts`), and private
+human/AI controls (`tests/discovery-controls.test.ts`). They exercise immutable
+rejections, physical custody, hidden information and JSON restoration. They do
+not certify a complete module, all combined routes or difficulty strength ordering.
+
+SQLite recovery tests (`tests/discovery-recovery.test.ts`) verify competing
+reveals pay only once, the private overflow choice survives restoration, and an
+already committed discard resumes without another card or reward. Independent
+review regressions bind worm/protection/arrival controls to their original
+encounter and enforce the stash's mandatory overflow discard. Two deterministic
+complete-game smoke tests (`tests/discovery-playthrough.test.ts`, seeds
+2026091303 Basic and 2026091304 Advanced) preserve all components through JSON
+reloads with four AI profiles. These games exercise the current prototype and
+do not certify its explicitly missing effects.
+
+Browser room `3RJBH26Y` completed genuine human Fremen setup. Reordering one
+existing physical Discovery card to the front of this new QA room's deck let
+normal Storm and Spice Blow actions draw Hagga Basin and place a Hiereg token
+at Gara Kulon 8. The owning Fremen view privately identified Shrine, retained it
+face down, and displayed readable enlarged token and full Spice Card guidance.
+The room is paused at acceptance of that blow. No other saved room was changed
+and no server restart was needed. Required broad verification results and the
+source-bound report are recorded in the checkpoint commit.
+
+1. Add the next-turn free entry into newly revealed locations, preserving typed
+   groups, occupancy, turn order and saved pending choices.
+2. Connect the five special location benefits: Jacurutu battle income, Cistern
+   Collection income, Ecological Testing Station storm adjustment, Shrine card
+   conversion and Orgiz collection transfer. Ordinary Jacurutu victory counting
+   does not implement its battle income.
+3. Connect later-turn Ornithopter spending to one actual movement action, then
+   integrate combined modules and complete games before refining or opening gates.

docs/EFFICIENCY_PILOT.md

@@ -91,3 +91,16 @@ connects runtime, private controls, AI and SQLite recovery. The battle inspectio
 alternative stays explicitly missing instead of holding the independent trade
 for an exhaustive battle-cleanup design. Final checks, counter endpoint and
 checkpoint scope are recorded in the commit.
+
+The Discovery batch starts at aggregate counter 60,591,430. Three bounded helpers
+cover physical inventory, nested board/admission, and private controls/docs;
+reusing them adds deterministic playthroughs and independent review of the
+owner's encounter/reward integration. New playable functions are Great Maker's
+vote/reserve ride, six Discovery blows, private Collection inspection/reveal,
+and both immediate stash rewards with saved overflow discard. Token custody
+and board destinations prepare the following location/flight batch. Reused
+room-start tooling now selects the Discovery profile. Reviews found and repaired
+lost saved controls, a retargetable arrival and skipped overflow discard before
+the stable broad check. The implementation adds no calibration study or server
+restart. Final aggregate endpoint, source-bound checks and push belong in the
+checkpoint commit; whole-module completion remains unclaimed.

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,31 @@
 # Dune implementation status
 
+## 13 September 2026 — First connected Discovery prototype
+
+Connects genuine base-faction Basic/Advanced audit setup to all seven sourced
+Spice Cards and eight opaque physical tokens. Great Maker resolves worm effects,
+an ordered majority vote and a free Fremen reserve ride. The six Discovery blows
+destroy prior forces/spice before their new blow and separate token placement.
+Private faction peeks and Collection inspection/reveal lead to exact stash
+rewards, a saved full-hand draw/discard choice, carried Ornithopter custody and
+five public nested locations; only Jacurutu contributes stronghold victory.
+Shared human/AI controls and JSON continuations accompany the actions.
+
+This is Prototyped progress with Partial coverage. Next-turn free entry, the
+five special location benefits and Ornithopter spending remain missing. The
+normal public module start gate stays closed. Great Maker first-turn skipping,
+Sandtrout suppression and empty-token-supply behavior remain identified source
+inferences for refinement, not new confirmed rulings. See the
+[prototype boundary and dependency queue](DISCOVERY_PROTOTYPE.md).
+
+Focused component, runtime, Great Maker, board/admission, private-control and
+SQLite recovery checks pass. Two seeded Basic/Advanced games finish while
+preserving components; browser `3RJBH26Y` verifies genuine Fremen setup, a real
+Discovery blow, native private peek and enlarged card guidance. Review repaired
+lost encounter/arrival controls and an unfinished overflow discard. Broad
+verification and preservation results are recorded in the checkpoint commit
+and private source-bound report. No complete-module certification is claimed.
+
 ## 13 September 2026 — CHOAM Nexus Collection prototype and Discovery inventory
 
 Adds the missing absent-CHOAM Secret Ally Collection trade through the engine,

docs/RULE_DECISIONS.md

@@ -15,6 +15,7 @@ Updated 13 September 2026. This is the authoritative navigation index for existi
 | Nexus faction effects | Preserve physical custody, original faction identity and durable effect receipts; use each printed family instead of borrowing another faction's rules by analogy. | [Atreides](NEXUS_ATREIDES_RULES.md), [Harkonnen](NEXUS_HARKONNEN_RULES.md), [BG](NEXUS_BENE_GESSERIT_RULES.md), [Emperor](NEXUS_EMPEROR_RULES.md), [Fremen](NEXUS_FREMEN_RULES.md), [Guild](NEXUS_GUILD_RULES.md) |
 | Expansion Nexus families | Source audit coverage does not imply every panel is playable; consult later runtime records in the status log. | [Ixian Cunning](NEXUS_IXIAN_CUNNING_RULES.md), [Ixian replacement](NEXUS_IXIAN_REPLACEMENT_RULES.md), [Tleilaxu](NEXUS_TLEILAXU_RULES.md), [CHOAM](NEXUS_CHOAM_RULES.md), [Richese](NEXUS_RICHESE_RULES.md), [Ecaz](NEXUS_ECAZ_RULES.md), [Moritani](NEXUS_MORITANI_RULES.md) |
 | CHOAM Secret Ally | Absent-faction Collection trade spends one actual Worthless card and the Nexus for two bank spice. It is separate from native Cunning and Auditor; the battle inspection alternative remains missing. | [Prototype contract](NEXUS_CHOAM_SECRET_ALLY.md) |
+| Discoveries | Preserve seven sourced Spice Cards and eight physical tokens, private faction peeks and Collection choices. Revealed locations are separate territories; only Jacurutu counts toward stronghold victory. First actions are prototyped; free entry, special location benefits and Ornithopter spending remain missing. | [Component authority](DISCOVERY_COMPONENTS.md), [prototype boundary](DISCOVERY_PROTOTYPE.md) |
 | Guild Secret Ally | One explicit Guild-priced ordinary shipment; borrowed prices/routes preserve native identity. Free Fremen reinforcement remains a separate choice. | [Route contract](NEXUS_GUILD_SECRET_ALLY_RULES.md), [verified runtime](NEXUS_GUILD_SECRET_ALLY_RUNTIME.md) |
 | Homeworld custody and mobility | Physical home/visitor groups, population thresholds, tariffs and transport permissions retain distinct sources; Homeworld immunity is not universal immunity. | [Homeworld rules](HOMEWORLD_RULES.md), [benefits](HOMEWORLD_BENEFITS_RULES.md), [mobility](HOMEWORLD_MOBILITY_RULES.md), [invasion](HOMEWORLD_INVASION_RULES.md), [Guild transport](GUILD_HOMEWORLD_TRANSPORT_RULES.md) |
 | Homeworld effects | Keep original payment/revival/placement identities and qualification observations; observations alone do not choose an occupied-benefit owner. | [Payments](HOMEWORLD_PAYMENT_INCOME_RULES.md), [card economy](HOMEWORLD_CARD_ECONOMY_RULES.md), [Collection](HOMEWORLD_COLLECTION_RULES.md), [revival deployment](HOMEWORLD_REVIVAL_DEPLOYMENT_RULES.md), [victory reinforcement](HOMEWORLD_VICTORY_REINFORCEMENT_RULES.md), [replacement](HOMEWORLD_REPLACEMENT_RULES.md), [Tupile](HOMEWORLD_TUPILE_INTELLIGENCE_RULES.md) |
@@ -30,6 +31,7 @@ These are unresolved in the cited records. Do not infer an answer from elapsed t
 | Guild Secret Ally/Homeworlds | Whether the reserve-return grant overrides the Homeworld return restriction. The question was already sent; that route stays guarded. | [Homeworld return](NEXUS_GUILD_SECRET_ALLY_RULES.md#homeworld-prices-and-the-unresolved-return), [checkpoint](NEXUS_GUILD_SECRET_ALLY_RUNTIME.md) |
 | Occupied Homeworlds | Entitlement/expiry after departure, replacement or contest; unique powers and shared income. The first-occupier/current-occupier question was already sent. | [Occupation questions](HOMEWORLD_OCCUPATION_RULES.md#questions-the-retrieved-sources-do-not-settle), [lifecycle audit](HOMEWORLD_OCCUPATION_LIFECYCLE_AUDIT.md) |
 | Nexus responses and composition | Betrayal private-response timing, partial revival/payment choices, Emperor fewer-than-five, fresh advisor/storm cases, Duke restoration and remaining faction-specific combinations. | [Common boundaries](NEXUS_CARD_RULES.md#remaining-source-questions-and-release-boundaries) and the individual faction source/runtime documents above |
+| Discovery prototype inferences | Great Maker currently follows ordinary first-turn worm skipping and Sandtrout suppression; an exhausted token type creates no replacement token. These preserve current source interpretation and physical inventory but are not separately confirmed rulings or complete combined-module certification. | [Interpretations for refinement](DISCOVERY_PROTOTYPE.md#interpretations-retained-for-refinement) |
 | Other Homeworld combinations | Population/force splitting, removal custody, replacement shortages, income accounting and placement ordering remain local to their detailed contracts. | [Homeworld rules](HOMEWORLD_RULES.md), [occupation](HOMEWORLD_OCCUPATION_RULES.md) and the effect documents above |
 
 When a decision changes, record the exact source or user ruling in its detailed feature document, update affected implementation guidance/tests, and adjust this index and [current status](CURRENT_STATUS.md). Retain historical evidence without presenting a superseded proposal as current behavior.