Prototype Discovery spice encounters, private tokens and stash rewards

Connect real Basic/Advanced base-faction audit setup to all seven Discovery
Spice Cards and eight physical tokens. Add Great Maker's ordered majority
vote and Fremen reserve ride, destructive Discovery blows, private faction
peeks and Collection inspection/reveal, stash rewards and mandatory saved
card overflow, and revealed nested board locations. Share private legal
choices with human controls and all four AI profiles. Preserve normal gates.

Independent review repairs orphaned worm/vote/ride controls, retargeted
reserve arrivals, actor bindings and incomplete overflow discard receipts.
Harden room-aware admission against unrevealed nested locations. Extend the
backed-up local prototype starter with a Discovery profile; preserve seats.

Still missing: next-turn free entry, five special location benefits and
Ornithopter movement spending. Current prototype playthroughs do not certify
those effects or complete module/expansion compliance.

Verification: npm run check passed 4264 offline tests plus types/lint;
npm run build passed; npm run test:integration passed 40 tests. The single
source-bound broad run took 129358ms / 6782ms / 23918ms respectively.
Report: /home/quintine/.local/share/dune/checkpoints/20260913-discovery-prototype/verification/report.json
Source fingerprint: 4ea7b5209a58c369b0b1f8dc239b5dd2f3302bb759d83c32ba5406e80d8ae154

Two seeded Basic/Advanced games complete with component custody intact.
SQLite races pay stashes once and resume committed discards without replay.
Browser 3RJBH26Y verifies genuine human Fremen setup, a Discovery blow from
one reordered physical card, native private Hiereg visibility, enlarged
card/rules reading and refresh. Room remains paused at spice acceptance.
All 125 opening saved rooms unchanged; 31 added, 156 total. No server restart.

Efficiency: three reused bounded helpers; aggregate counter 60591430 to
61812513 after verification, 1221083 tokens before final Git/push overhead.
47 added offline tests. One stable broad run after focused review fixes;
no calibration or exhaustive optional-module interaction matrix.

game/board-resolution-quote.ts

@@ -10,7 +10,8 @@ import {
   gameTerritories,
   MOBILE_LOCATION,
   splitLocation,
-  validLocation,
+  TERRITORIES,
+  validGameLocation,
   type MobileBoard,
 } from './board';
 
@@ -29,10 +30,11 @@ export type BoardContext = MobileBoard & {
   players: readonly BoardSeat[];
 };
 export type AdvisorRelease = { player: string; territory: string };
-function validKey(key: string) {
+function validKey(g: MobileBoard, key: string) {
   const p = splitLocation(key);
   return (
-    key === `${p.territory}:${p.sector}` && validLocation(p.territory, p.sector)
+    key === `${p.territory}:${p.sector}` &&
+    validGameLocation(g, p.territory, p.sector)
   );
 }
 /** A public board projection: no leader, hand, secret No-Field value or resource
@@ -48,22 +50,28 @@ export function settledBoard(g: BoardContext) {
       g.players.every((p) => g.order.includes(p.id)),
     'Board resolution needs the current distinct player order and storm sector.',
   );
-  if (g.mobileStronghold?.location)
+  if (g.mobileStronghold?.location) {
+    const pointer = splitLocation(g.mobileStronghold.location);
     requireBoard(
-      validKey(g.mobileStronghold.location) &&
-        g.mobileStronghold.location !== MOBILE_LOCATION,
+      validKey(g, g.mobileStronghold.location) &&
+        TERRITORIES.some(
+          (t) =>
+            t.id === pointer.territory && t.sectors.includes(pointer.sector),
+        ),
       'The mobile stronghold needs its board pointer.',
     );
+  }
   for (const p of g.players) {
     requireBoard(
-      Object.entries(p.forces).every(([key, n]) => validKey(key) && whole(n)) &&
-        whole(Object.values(p.forces).reduce((a, n) => a + n, 0)),
+      Object.entries(p.forces).every(
+        ([key, n]) => validKey(g, key) && whole(n),
+      ) && whole(Object.values(p.forces).reduce((a, n) => a + n, 0)),
       'Board resolution needs valid physical force locations and counts.',
     );
     const marker = p.noField?.deployed?.location;
     if (marker)
       requireBoard(
-        validLocation(marker.territory, marker.sector),
+        validGameLocation(g, marker.territory, marker.sector),
         'The No-Field needs a valid board location.',
       );
   }
@@ -206,7 +214,7 @@ export function quoteSpiceCollection(
           record(p.elites.forces) &&
           Object.entries(p.elites.forces).every(
             ([key, n]) =>
-              validKey(key) && whole(n) && n <= (p.forces[key] ?? 0),
+              validKey(g, key) && whole(n) && n <= (p.forces[key] ?? 0),
           ),
         'Collection needs valid physical elite groups.',
       );
@@ -214,7 +222,7 @@ export function quoteSpiceCollection(
   const { players, released } = settledBoard(g);
   const spice = { ...g.spice };
   requireBoard(
-    Object.entries(spice).every(([key, n]) => validKey(key) && whole(n)),
+    Object.entries(spice).every(([key, n]) => validKey(g, key) && whole(n)),
     'Collection needs valid spice locations and quantities.',
   );
   const capacities = new Map<string, Map<string, number>>();