Apply the printed ordered-action alternative provisionally to the unanswered native Extortion suffix. Preserve collected bank5, completed declines, payer membership, one payment3 and placement-first policy. Replay a public local-order receipt and retain it through ledger answers; expire the old payer event even when the same player remains next. Permit only the exact current Extortion decision as a clean Sapho window. Add persistent remaining-order/card controls and existing minimal policy participation. The typed Semuta suffix parks one updated payer decision and restores it without paying, advancing or recollecting.
Validation:9-file115/115, types/lint/build and six original public Basic/Advanced host/setup/paid-cache1/placed-Terror/paid-entry1/reveal/Mentat-placement-before-bank5 programmes. An actual earlier decline stays finished; first/payment3 and last/payment3 or all-decline preserve native retirement/recovery. Four profiles make eight legal holder/payer proposals and complete. Public order and private payer affordability render in actual GameTable plus enabled/busy controls. Pure replay/no-op/recovered reuse cases are separate. Bounded source/continuation review found no concrete defect.
Extortion/Sapho boundary is provisional. Direct combined Semuta claim/capture, broader combinations, complete modes, final assurance and browser/deployed acceptance remain open. No saved-room/database/reset/restart/deployment operation.
At a clean unstarted non-Guild movement boundary, Sapho FIRST now reorders the remaining turn queue and reopens the native Advanced Guild choice. Guild may take its turn ahead or wait while all non-Guild turns retain their relative order. Protect an already granted current Guild turn, keep canceled timing locked and preserve completed turns, payments and last protection. Existing discard continuations and minimal policy options need no new state or signature format. Explain the provisional precedence in the controls and reference.
Validation:7-file97/97, types/lint/build and six original-action/rendered-table programmes. Actual cache1 Sapho, original Guild wait/take, paid completed Richese prefix, Emperor2/Guild1 shipments and native phase completion. An actually dealt Karama cancels TAKE without its privilege being revived; a granted current turn cannot be displaced. Four profiles make eight legal holder/Guild proposals. Corrected an obsolete first exclusion and a fixture that mistook a later response pass for a repeated movement turn; exact failures and then the whole batch pass.
This nonconflicting composition is provisional. Actual competing first, partly completed turns, other ordered actions, direct combined Semuta claim/capture, full modes, final assurance and browser/deployed acceptance remain open. No saved-room/database/reset/restart/deployment operation.
Fresh Richese-roster battles support clean aggressor changes after plans and revelation. Both combatants explicitly finish a public final opportunity regardless of held cards or result; an actual Sapho use clears both marks with a fresh event. Close priority before physical Stone allocation and other outcome settlement. Preserve plans, votes, participants, Habbanya priority and reserved physical cards. Keep old unstamped timing and discard signature bytes. Route all final vote exits through native Homeworld defense first. Add persistent controls and finite minimal bot readiness.
Validation:16-file177/177, types/lint/build and eight original-action/rendered-table programmes. Actual cache1 and paid forces use40 Basic/47 Advanced source actions; genuine Stone1 turn1/Sapho1 turn2 uses86. Ordinary and mixed count2 ties change through sealed-plan/final-window Sapho, explicit revised acknowledgements and native losses. Sixteen minimal proposals are legal; controlled reservation and pure window/control cases are separate. Bounded review fixed the Harkonnen Nexus final-vote route; frozen feedback corrected four historical fixture assumptions. All checks then passed together.
Final-window protocol is provisional. Direct late Semuta claim/capture, combined World/Nexus/Sapho, wider combinations, full modes, final assurance and browser/deployed acceptance remain open. No saved-room/database/reset/restart/deployment operation.
Provisionally apply first/last to the current ordinary or native Advanced normal Black Market lot. Preserve bids, funding and passes; skip passed seats until a real raise. Use a local full cycle and actual post-discard hand capacity. Keep the original Black Market opener in both settlement consumers and clear ordinary overrides for the next lot. Connect persistent controls, native disposal and existing minimal AI options.
Validation:10-file134/134, types/lint/build and eight original-action/rendered-table continuations. Public setup/cache1, real lobby circle choice, native Black Market and paid full hand preserve prior1,2/3/4 raises, one payment4 and original next opener or final-lot Revival. Eight minimal policies are legal. Corrected fixture opener/completion assumptions and external default-history/final-lot assertions; only runtime was rerun against identical source. Bounded consumer review found no concrete defect. Other timing scopes, direct combined Semuta claim/capture, full modes, final assurance and browser/deployed acceptance remain open. No saved-room/reset/restart/deployment operation.
During the existing public pre-plan opportunity, the holder can discard canonical unreserved Sapho to become aggressor before their readiness or any binding plan/Voice/inspection/Truthtrance commitment. Unchosen preparation prompts remain available. No new confirmation-only or holder-dependent response window is introduced. Later intervention and its allocation/privacy protocol remain unfinished.
A battle/turn/revision-bound history and independent event list preserve accepted priority while keeping attacker, defender and chooser stable. Legitimately recovered cards can change priority again at a fresh event. Reads, actions and normalization reject corrupt histories/custody. Shared tie priority respects Habbanya in either physical slot and reaches pre-commit Stone/Voice checks, public views, bot calculations and actual ordinary/Stone resolution. The final quote previously assumed original attacker priority and now consumes the validated aggressor. Harkonnen capture still follows actual winner/loser.
Owner controls, public aggressor/tie text, automatic notices and internal guidance are connected. Focused tests exercise actual tied results in Basic/Advanced, both Habbanya sides, mixed-force Stone finishability before opposing commitments, a real allied Prescience boundary, stale/late/cross-owner rejection, private rival noninterference, receipt corruption, saved recovered-card revision, actual policies at all four AI levels and authenticated SQLite races/seat restoration. Independent review found no material defect. A prior scheduling test now explicitly readies its human holder to save the card instead of allowing the new legal AI play.
Types, lint and 4866 offline tests, production build and 43 HTTP/session tests pass on the unchanged source fingerprint below. Two genuine CHOAM/Richese samples completed with 1279 accepted actions, 34 periodic JSON restores and no rejected candidates. One movement Sapho play occurred; neither sample used aggressor. Targeted tests and browser evidence, not those samples, establish the new effect. Full expansion and module acceptance remain incomplete.
In a new isolated browser room, genuine Advanced faction setup was followed by conserved battle staging. The human Guild used the actual aggressor button, restored the spent card and priority after refresh, readied, selected Master Bewt with zero dial/support, and declined a Traitor call. The staged Emperor opponent used real engine ready/plan/vote actions with Caid and zero dial/support. Guild won the 3-3 tie, retained four forces and 30 spice, and Emperor lost four forces. Final refresh and private JSON views restored the same outcome; the original seat row is unchanged. Screenshot capture timed out, so visual screenshot acceptance is not claimed.
All 1072 original games and original seat/recovery/entry/handover records are unchanged; 1106 rooms remain including isolated QA and HTTP fixtures. SQLite quick-check and foreign keys pass. The healthy server was reused without reset/restart or automation.
The Mirror audit now records why every genuine CHOAM/Richese setup includes unresolved copy candidates: an ordinary-copy-only gate would need hidden eligibility or altered inventory. Mirror stays gated pending the existing disposal ruling and copied-choice work. No mode/publication gate is opened.
Verified source tree: 2fb3160efd713a3f7068aedb474868ba6863bccc420848a56e69e1df1d84441b
Juice of Sapho can change the remaining Battle-phase chooser order at clean boundaries. A chooser may occupy the physical defender slot and select the actual other combatant. Physical storm order, attackers, defenders and tie advantage remain intact. Full-roster phase priority survives aftermath, newly eligible Face Dancers and saved continuation. Controls and all four AI profiles consume the same projected choices.
Independent review verified private options, public geometry, exact physical disposal, rejected-action immutability, phase expiry and boundary-bound saved chooser integrity. Actual Basic/Advanced Face Dance regressions verify later replacement priority. Authenticated SQLite tests cover duplicate concurrent card requests, private restore and battle completion. Chooser/aggressor separation and phase duration remain explicit implementation interpretations; the separate aggressor mode and unresolved timing stay gated. Reinforcements remains disabled pending the documented reserve-cost question.
Types, lint, 4792 offline tests, build and 43 HTTP tests pass with unchanged source. Six fixed genuine Basic/Advanced faction samples finish in 3672 accepted actions and 97 periodic private JSON restores. They retain 82 rejected candidates at existing guarded arrival combinations; subsequent legal candidates finish. This is bounded playability evidence, not complete compliance or AI calibration.
The browser used Sapho first from a later physical circle, chose Emperor, sealed and resolved a battle, then refreshed into its next choice. Emperor retained the tie win. All 9 accepted actions replay exactly using the recorded random battle event; physical custody, all private JSON views and the original seat row pass. A private harness initially needed random-event replay binding and SQLite-row prototype normalization; no production fix or game reset was required.
After the reported outage, the server responded and the staged QA game restored exactly. All 970 opening games and their original seat/recovery records remain preserved (1004 after checks), including all 971 rooms present immediately before checks. SQLite integrity and foreign keys pass. No restart, database reset or recurring automation was needed.
Verified source tree: b699f80600f8e297595a8e756edf367a607ddd99707474c03231e6479bd2f389
Allow a physical Sapho holder to go first among remaining unstarted combined
shipment/movement turns after earlier players have fully finished. Preserve
completed resources, cards, counters and physical order. Keep Advanced Guild
priority guarded until Guild leaves the remaining queue. Reuse private controls,
all four AI profiles and the existing action/CAS continuation.
Add four engine regressions and one independently authored SQLite recovery race;
upgrade the existing Sapho Advanced engine fixture to genuine Advanced setup.
Update player guidance and the rules decision register. Record the fourteen
Leader Skill cards and lifecycle as sourced future work, with unresolved edges.
No mode or publication gates are opened.
Validation: check (types, lint, 4,369 offline tests) and build passed. All 35 focused
Sapho tests passed; independent engine/persistence review found no blocker.
One initial focused Advanced test omitted the existing Guild shipment approval;
it was corrected to resolve that real decision before ending the turn.
No HTTP/auth/schema change; the HTTP suite was not repeated for this checkpoint.
Following the reported power outage, the existing localhost server was healthy,
SQLite integrity/foreign-key checks passed, and the saved QA seat restored the
same private hand, forces, resources and pending Storm decision after refresh.
All 291 opening room versions/state hashes and all application seat/recovery/
entry/handover records match the fresh backup. Cloudflare internal metadata
changed; application data did not. No restart or database reset was needed.
Source fingerprint: de0e0e52ef7b6888792a6e2ec5e8c4745da446ece843bf3092320e915d621266
Private report: /home/quintine/.local/share/dune/checkpoints/20260913-sapho-completed-boundary-checks/report.json
Private backup/comparison: /home/quintine/.local/share/dune/checkpoints/20260913-outage-sapho-before/
Check duration 146645 ms; build 6753 ms. Reported aggregate goal counter at this
milestone opening was 65037986 and before Git was 65524147 (486161 difference,
including outage recovery, parallel source research and coordination; not a
billing measurement or a savings claim).
Quintine