Dune/docs/RICHESE_ORNITHOPTER_ENGINE_AUDIT.md

# Richese Ornithopter: movement integration audit

## Imperial Homeworld movement — 27 October 2026

E3printed10 permits Advanced Emperor to use its Movement between Kaitain and
Salusa; supplied Advanced physical22/printed20 explicitly calls it Force
Movement of any number of own forces. The recorded physical card grants two
normal movements with different forces. Under standing recommended-option
authority, provisionally compose them: either group may be an independently
legal Imperial transfer or ground move, in either order; both may be transfers.
Normal and Sardaukar cohorts remain distinct across all three stores.

Homeworlds are not territories. Range3 grants no route or range to them; spending
its replacement entitlement on the independently permitted Imperial transfer is
a separate explicit provisional composition. Targeted GF9/designer searching
found no dedicated combined answer. The earlier photographed card contract is
retained; its old crop was unavailable, so no fresh card-face reread is claimed.
Native route permission and Homeworld Karama immunity stay (E3p10); no shipment
or spice cost is added. Moving first retains the native passed-shipment rule.

Fresh Imperial flights stamp `homeworldCohort:true` and snapshot actual typed
board and native-World custody. Arriving moved counters never increase remaining
quotas. An older unstamped active flight was created while World transfers were
blocked; the selected compatibility interpretation treats its then-untouched
native World pools as unmoved, without rebuilding its recorded board cohort.
That inference is not historical-save certification. No reserve total creates a
World force. An uncompleted first attempt needs no cohort until an actual first
group commits; its current card event may use the native transfer once controls
are clear.

Both groups completing earns one existing extra-move credit; early ending earns
none. A later actual Hajr has its own allowance and may reuse moved counters.
Final World movement uses a distinct `homeworld` discard continuation, binds
the actual World custody and discards the original card once without an Arrakis
arrival replay or automatic turn end. Ground-final disposal retains its native
arrival continuation. The Imperial panel and shared legal AI adapter expose
both modes/current continuation with provisional guidance and typed maxima.
Broader modules, native Semuta reaction journeys and full acceptance remain open.

### Scoped native evidence

Frozen12-file union109/109, types/lint/build and seven original programmes pass.
Public Advanced R/E/A +CHOAM with Homeworld opt-in before Ready/start retains
printed15 normal Kaitain/5 starred Salusa. Emperor buys original cache card1;
optional real normal1 shipment2 creates Basin9 army and leaves14/5 native stocks.
Original Hajr is actually dealt when selected. World→ground, ground→World,
two typed Worlds, range3 native World, early end, later Hajr and star-first
World→ground preserve aggregate stocks/spice, actual movement and single discard.

Runtime records28 GameTable SSR,14 Imperial panels,7 actual Finish callbacks and
10 shared-adapter World packets; source/further arrays276/21. World selectors,
count inputs and card buttons were not operated; panels use their actual zero
defaults, with World/ground/Hajr actions applied through adapter/native packets.
Shared flight quota rows label Worlds by name. No played hand/purse/army/World
stock/phase/card/progress is installed. Controlled cases separately cover older
cohort inference, replacement first group and exact typed limits. Existing
related Semuta paths pass; no native World-final Semuta/Skills or old saved-flight
journey is claimed. Browser hydration/navigation, deployed and full combined-mode
acceptance remain open.

Feedback preserved shipment priority while adding later legal World-card bot
choices, repaired lossless rejection snapshots and type annotations. Failed
v1/v2 is preserved. V3 uses one frozen source followed by three-document evidence
prose only. Existing server HTTP200, no restart or saved-game/database operation.
Proof: `/home/quintine/.local/share/dune/checkpoints/20261027-ornithopter-emperor-world-proof-v3/`;
runtime: adjacent `20261027-ornithopter-emperor-world-runtime/run-v2/`.

## Planetologist movement composition — 26 October 2026

Both physical modes now compose provisionally with either Planetologist
alternative. Fixed range stays3; twoGroups uses current normal range with
optional +1/cap3 or normal-range gathering. Each accepted gather counts as one
card movement. Its full selected map leaves the original unmoved cohort, and
the second move cannot reuse transported counters/marker after merging.
Card custody, one discard, existing credits, early ending and Hajr remain.
[Selected matrix, source and contract](PLANETOLOGIST_RULES.md#physical-and-discovery-flight-composition--26-october-2026)
also distinguishes the separate Discovery token and its signed two-origin quote.
This is explicit composition, not a joint FAQ or complete-mode acceptance.

## Guild Cunning and earned Hajr movement — 18 October 2026

The [printed Guild Nexus](NEXUS_GUILD_RULES.md#primary-evidence) grants only a
second shipment, with Hajr required for subsequent movement. This checkpoint
connects the existing unused-entitlement replacement policy: either physical
Ornithopter mode may replace an earned unused Hajr allowance after Cunning.
Earlier completed flight credits remain counted, and an active two-group flight
retains its original second group without speculative credit. Only completion of
both groups earns the extra physical-move credit. Declaring Cunning during an
unfinished flight discards it before the original Nexus response resumes; ending
a later partial flight completes the turn without abandoned-group credit.

This composition is explicitly provisional. It does not assert a card-specific
publisher clarification, grant an ordinary move or alter Advanced Hajr timing.
See the [runtime contract](NEXUS_GUILD_CUNNING_RUNTIME.md#physical-ornithopter-composition--18-october-2026)
for v3 original-count receipts, compatible old formats and continuation scope.
Earlier “separate/unavailable” observations below are historical within this
named combination. Wider modules, full modes and final assurance remain open.
The frozen13-file125/125 batch, types/lint/build and eight original-action/
rendered-table continuations pass. Actual paid cards, worm/alliance/Nexus draw,
first2/second1 shipments and both modes preserve all earned counts. Eight minimal
policy proposals are legal; no frozen repair. Exact source binding and runtime
limits are recorded in the linked contract. New Semuta grammar has no direct
combined claim/capture programme; browser/deployed acceptance stays open.


Audit: 2026-09-06. Document-only source and engine review. The canonical component is `richese-ornithopter`; this is distinct from ordinary Arrakeen/Carthag ornithopter access and the later Ecaz discovery token. No runtime effect or complete expansion compliance is claimed here.

## Advanced advisor card movement — 18 October 2026

**Prototyped / Partial.** The authorized supplied Advanced source,
physical28/logical26, says advisors do not count as occupying a stronghold for
ornithopter access. Physical10/logical8 likewise excludes advisors from granting
city access, while permitting a player with eligible city forces to move forces
elsewhere. Neither passage gives the prior blanket ban on an advisor using the
separately named physical card. The photographed card supplies its own
three-territory move or two different normal moves without a faction/stance
exclusion. This cutover supersedes the older advisor guard and source assessment
below; it is not a newly located publisher-specific card FAQ.

Both modes now permit advisor groups. The range3 mode supplies its printed
independent maximum. Two-group mode uses current normal range at each actual
move: advisors alone in a city grant no access; fighters do. An advisor arriving
alone automatically becomes a fighter and can therefore enable the second group.
Leaving the last city fighter removes that access even if advisors remain in
another city. Existing advisor/fighter arrival, new-advisor locks, same-territory
stance, native response windows, storm/entry and distinct original force quotas
continue to govern. This is no new shipment, stance privilege or free replay.

The isolated control gives persistent Advanced BG guidance. Minimal bot card
candidates use the shared advisor-aware route and native entry checks, alongside
current fighter-city access and original group quotas. No strategy tuning.
Two disjoint implementation lanes plus owner integration pass frozen **10
files87/87**, types/lint/build and three original-action/rendered-table
programmes. Each starts with58 actual source actions: original Advanced host,
BG advisorSetup in native Atreides Arrakeen, cache1 purchase, Richese1 shipment,
actual free accompaniment and BG2 Polar Sink or1 Carthag reinforcement. Only
original scalar lotteries and unopened first-turn Spice positions are selected;
no postdeal hand, wallet, force, stance or clock is installed.

Range3 has2 continuation actions; advisor/fighter twoGroups and last-city-fighter
variants each have3. The real advisor source cannot use an ordinary three-range
move without city fighters. Card range3 succeeds and empty arrival flips.
TwoGroups retains original advisor/fighter quotas after automatic face changes;
leaving the last Carthag fighter recomputes the second advisor group to1 even
while advisors remain in Arrakeen. Four minimal policies supply eight legal
initial/second-group proposals. Four controlled rule cases separately exercise
empty-city access, occupied-city nonaccess, existing fighter-city ordinary use
and locked advisor entry among two other factions. Six isolated control cases
cover modes, guidance, original cohorts and disabled states.

Source-bound proof is outside Git at
`~/.local/share/dune/checkpoints/20261018-ornithopter-advisors/frozen-integrated-2/report.json`:
base `884a09fa92c8604c943979ef2a4c29990399c0fc`, source tree
`62adeab78469339886640fa0e852a8532f7e03d80da052a687576fc4e7110c83`.
The narrow native case corrected only its expected-error matcher; type feedback
added a nonnull annotation for the controlled fixture’s known movement list.
The frozen related union and required checks then passed on identical source.
Only checkpoint prose/reference evidence changed afterward.

GameTable snapshots use genuine views; isolated controls render the actual
accepted first/second movement drafts. SSR does not click select/submit, and
framework aliases/CSS stubs do not establish visual/browser/deployed acceptance.
Other card/module combinations, full modes and comprehensive assurance remain
due. No saved-room/database/reset/restart or deployment operation occurred.

## Recovered Hajr replay — 18 October 2026

**Prototyped / Partial.** The earlier multiple-physical-Hajr boundary had an
incorrect premise: the original inventory has only one Hajr. A real missing
case is recovering that discarded card with the original paid
[Nullentropy Box](NULLENTROPY_BOX_ENGINE_AUDIT.md) and playing it again.
The supplied physical p39/logical p37 paragraph gives each Hajr play one extra
normal move and immediate-after-Force-Movement timing, but establishes no
once-per-turn cap. Under choose-recommended, a genuinely recovered held card
may be played again for one further allowance. This replay interpretation is
explicit; it is not a newly retrieved publisher FAQ or permission to duplicate
the printed card. Basic retains broader timing; Advanced requires a fresh
completed movement after the preceding Hajr consumed its opportunity.

Actual accepted Hajr plays are counted separately from the unique legacy
has-used marker. The physical card must be back in hand: repeating a consumed
first-use ID before recovery, or after its second discard, grants nothing.
The original Box pays two bank spice and retrieves the one eligible discard
automatically when no selection is needed. Searching grants no movement or
Advanced timing opportunity. Basic may replay after retrieval; Advanced's
programme retrieves while one earned move remains, completes that movement,
then plays the same Hajr at the fresh opportunity. Both finish three ordinary
movements with one physical Hajr and one paid Box.

The shared movement ceiling and owned control count accepted plays, preserving
Ornithopter's separate completed-group credit. Ordinary/flight disposal binds
the new count without altering legacy signatures when the field is absent.
The count resets with the original turn/movement counters; old marker-only
positions mean one play, without reconstructing saved history. Guild Cunning
now carries counted unused Hajr allowances while forfeiting the ordinary slot.
New declarations use v2 count receipts; legacy v1 boolean bytes stay valid.
Signed current/final counts bound the native continuation after the second
shipment and remain in completed history. Advanced Cunning now uses the same
held-card/fresh-window timing. Physical Ornithopter/Cunning remains separate.

Two exclusive fixture/pure lanes plus owner integration and bounded review pass
frozen **12 files102/102**, types/lint/build and **two** original-action/
actual-GameTable programmes. Real cache Box1, ordinary Hajr1 and paid three-counter
desert shipment reach the source in38 Basic/45 Advanced actions; seven subsequent
actions include first use, the original two-spice search, same-ID second use,
three ordinary moves and actual turn ending. Advanced retains two originally
shipped Sardaukar. Both sole-discard searches are automatic, with no fabricated
second card or manual selection claim. Four minimal policies retain the third
move in each mode (eight proposals); strategy/calibration is deferred.

Pure cases additionally cover old receipt bytes, counted before/after grants,
ordinary forfeiture, spent counters and invalid mixed formats. Related Cunning,
Box, disposal and prior flight regressions pass. One historical Advanced Cunning
case now earns Hajr after the real first move before carrying it through a
stopped shipment; its later route respects lost city access. Fixture type
feedback corrected a nullable private search reference. No printed number changed.

Proof base `72e77d7f4d96a3eca5987eba5287cc36dea3e99c`, frozen tree
`8c1122bd35446db71d09245dad128be1c8df440392c7d1ac7b0014fca3cadecc`;
private reports/HTML are under
`/home/quintine/.local/share/dune/checkpoints/20261018-hajr-replay/`.
Cunning replay composition has pure/related regression evidence, not a genuine
paid-Box native Nexus replay programme. Framework aliases/CSS stubs mean no
visual/browser/deployed acceptance. Other recovery producers, advisor/card and
wider module combinations, comprehensive assurance and full modes remain open.
No saved room/database mutation, reset, restart or deployment. Earlier one-Hajr
and multiple-copy descriptions below remain dated implementation history.

## Hajr and unused movement entitlements — 18 October 2026

**Prototyped / Partial.** The photographed Ornithopter face supplies its two
alternatives but no Hajr combination procedure. The authorized supplied PDF,
physical p10/logical p8, checks ordinary ornithopter access for each Force
Movement, including Hajr. Its physical p39/logical p37 Hajr errata separately
requires playing immediately after a Force Movement and allows reusing a moved
group or choosing another group. This is the supplied unofficial compilation,
not a new GF9 combination ruling. Bounded official-source follow-up found no
card-specific resolution; the publisher PDF endpoints returned403.

Under the standing choose-recommended instruction, provisionally replace one
**unused** ordinary/Hajr movement entitlement with either a range-three move or
two distinct normal-range groups. One Hajr adds one independent normal move:
one two-group flight plus that Hajr permits three completed group movements.
An earlier ordinary movement stays spent; it cannot be retrospectively counted
as the card's first group. Its counters may join a later newly declared flight.
The two groups within that flight must differ, while a later Hajr move may reuse
the first card group. Range-three stays capped at three and normal range is
recomputed for every other group. No extra shipment or spice fee is created.

Advanced adopts the supplied immediate-after-play timing, correcting the older
broader availability. A completed card group provisionally counts as a Force
Movement for that opportunity. Mandatory arrival/disposal decisions finish first;
other seats' actions and polling do not close it. The owner's next voluntary
non-Hajr game action closes it, and a later actual movement opens a new window.
Basic preserves its original broader own-turn timing. Existing separate Nexus
Guild Cunning timing remains its own adapter; physical-card composition there
is still guarded. The supplied passage neither permits nor forbids stacking
multiple physical Hajr cards; the existing single-Hajr limit is an unfinished
implementation boundary, not a printed once-per-turn rule established here.

Shared movement accounting retains a credit only after the second actual card
group completes, so clearing the played-card frame cannot consume unused Hajr.
Early ending abandons the second group and ends the turn without that credit.
Original event/cohort validation and reaction continuations remain. The private
view projects current Hajr availability separately from the total move count;
human controls and all four minimal bot policies consume those same facts.
New movement fields are additive and cleared with the next movement-phase
counters. Completed legacy flights without a credit are not reconstructed.

One fixture lane plus owner integration and bounded source/implementation review
pass frozen **11 files132/132**, types/lint/build and **12** original-action/
actual-GameTable rendering programmes. Genuine cache Ornithopter1, ordinary
Hajr1 and funded desert shipment reach the source in38 Basic/45 Advanced actions.
Before/during/after Basic and after-group/after-flight Advanced use five
continuations; prior-normal then fresh flight also five, range-three plus Hajr
four. Both modes keep the distinct-group rule and legal later reuse. Early ends
earn no abandoned movement. The native Advanced CHOAM/Baliset pause uses65
source actions; declining it opens Hajr, an original funded bribe closes the
window, and the second typed group reopens it. Four policies retain legal second
groups and earned extra moves (eight proposals), without tuning.

Two older Homeworld/Semuta guard assertions were updated to the new entitlement
and Advanced timing while retaining the fixed maximum-three rejection. Related
original disposal and Guild Cunning regressions pass; this does not certify all
World/Semuta combinations. Framework aliases/CSS stubs mean no visual/browser/
deployed acceptance. Advisor/card use, multiple Hajr cards, wider module
combinations, comprehensive assurance and complete modes remain open. No saved
room/database mutation, reset, restart or deployment.

Proof base `6ccfaa1b4d5198f7e1654d5f4341bd6fc7a5daaa`, frozen tree
`29c081daee908f14d502e1a1adc5d871216c031460e830806e7699720b94dee0`;
private reports/HTML are under
`/home/quintine/.local/share/dune/checkpoints/20261018-ornithopter-hajr/`.
The older Hajr guards below are dated implementation history.

## Provisional Kulon coexistence — 9 October 2026

Both modes now remain usable after Kulon. The one-group card move retains
its explicit maximum of three territories; Kulon extends the normal range
of each distinct group in the two-group mode. This applies in Basic and
Advanced without changing movement quotas, cohort identity, storm/entry
rules or physical card disposal. The owned control labels the policy.

This is a content-first composition choice, **not a publisher ruling**.
The photographed card supplies “up to three”; R2 p7 supplies Kulon's
extra territory. The authorized supplied Advanced PDF repeats “one extra
territory during your Force Movement” on physical p29, but does not resolve
the separately named Richese card's maximum. Choosing the explicit card
cap avoids inventing a four-territory exception. Hajr/prior-move and
Advanced advisor card movement now follows the later supplied-source cutover above; broader combinations remain open.

Changed-path proof: real Kulon activation followed by a three-territory
card move, four-territory rejection, both normal groups moving two
territories, and legal candidates from all four profiles in both modes.
An isolated Chromium surface mounted the production movement component
against the real engine: the enabled control moved two forces from Red
Chasm to Imperial Basin and discarded Ornithopter once. It used in-memory
QA state, not a saved room or deployed application.


## Authority

The photographed GF9 card face was independently inspected at `/tmp/dune-rules/choam-ornithopter-reading.png`, derived from the publisher components shown in [the product gallery](https://www.tabletopfinder.eu/en/boardgame/32692/dune-choam-richese). Full photo provenance and limits are recorded in [RICHESE_ACQUISITION_RULES.md](RICHESE_ACQUISITION_RULES.md) and [RICHESE_COMPONENTS.md](RICHESE_COMPONENTS.md). It is a Special / Movement card. During the holder's movement, it offers either one group moving up to three territories or two different groups using normal movement. It is discarded after use. No spice payment, faction restriction, alliance transfer of the effect, reserve shipment or Karama cancellation is printed.

Relevant publisher rules:

- [Base rulebook p9](https://www.gf9games.com/dunegame/wp-content/uploads/Dune-Rulebook.pdf): an ordinary group comes from one territory; each normal movement has one destination. Ordinary ornithopter access is checked at the start of a force move and gives a maximum three-territory route when the player has forces in Arrakeen or Carthag. It can move forces elsewhere on the map. The card's first mode independently supplies its stated range; it does not require those strongholds.
- Base pp9–10: sectors do not count as extra territories, but the storm and blocked stronghold rules constrain routes and destinations. Base p22 confirms groups spanning sectors in one territory can move together and confirms that forces just shipped to Arrakeen/Carthag can enable ordinary access immediately. Base p23 retains storm restrictions even when the enabling stronghold is storm-covered. Fresh official indexed search verified that p23 passage and [November 2020 FAQ p9](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf)'s immediate-access clarification.
- [R2 pp5–6](https://www.gf9games.com/dune/wp-content/uploads/2021/11/CHOAM-Rulebook-low-res.pdf): Richese-family cards go to normal Treachery discard when discarded; No-Field tokens move as forces while concealed. R2 p7 defines Kulon as one extra territory during CHOAM's movement turn. The readable publisher-authored copy is `/tmp/dune-rules/choam-lelekan-mirror.pdf` and `.txt`.
- [Ixian rulebook p6](https://www.gf9games.com/dunegame/wp-content/uploads/2020/09/IxianAndTleilaxuRulebook.pdf): cyborgs normally move two territories; the printed Karama table cancels that faction movement advantage. The Mobile Stronghold rules give its own entry/exit geography. Local source: `/tmp/dune-rules/ix-official-mirror.txt`.
- Base advanced Bene Gesserit rules p16 say advisors cannot use ornithopters. That passage predates this separately named card and does not expressly distinguish its two modes. Apply the ordinary fighter/advisor rules without silently declaring a new card-specific FAQ interpretation.

Bounded official-domain searches for the Richese card with Hajr, different groups, Karama, advisors and Kulon found no card-specific answer. Results about the Ecaz discovery token, Dune: A Game of Conquest and Diplomacy, or Dune Betrayal are not authority for this card. In particular, [E3 p13](https://www.gf9games.com/dune/wp-content/uploads/EcazMoritani-Rulebook-LOWRES.pdf)'s disposable discovery Ornithopter gives one later three-movement action and is a different physical item.

## Confirmed effect and boundaries

The holder chooses one of two modes, not both. One mode supplies a maximum of three territories for one group; it does not add three to the existing range, create permanent stronghold access, or change collection/victory rules that depend on actual occupancy. The other authorizes two **different groups**, each using normal movement. The face does not authorize moving the same forces twice under that option. No extra shipment is created, and the move cannot be assigned to an ally.

This is an ordinary card effect. Do not create a generic faction-power Karama response merely because Ornithopter is played. Independent eligible faction powers and entry reactions remain: Ixian extended normal movement may be canceled; CHOAM may use Baliset; BG intrusion or flipping and supported Terror/Ambassador entries still resolve normally. A fixed three-territory card move does not depend on the Ixian cyborg advantage merely because it contains cyborgs. Canceling that unrelated advantage must not cancel the card's range.

The card changes movement allowance, not geography. Keep storm paths, stronghold occupancy, ally exclusion, destination sector, advisor/fighter status, unit custody, optional elite composition and supported HMS geometry. No-Field movement has direct general support as force movement; use a marker as one concealed group member and preserve its event without reading its hidden value. A marker moved by the first group cannot also be moved by the second group. This does not resolve currently guarded mixed battle, Homeworld or combined arrival cases.

Genuine source interactions not settled by retrieved card-specific authority:

1. **Hajr and prior moves:** does the two-group option replace a normal movement action, increase the turn total to two, or compose into three/four moves with Hajr? Can an earlier completed move be counted retroactively as the first group? Existing Hajr implementation alone is not evidence. A bounded initial adapter may require an unused ordinary move and exclude concurrent Hajr with an explicit unfinished-combination reason, but cannot label that an official prohibition.
2. **Kulon:** no retrieved card-specific answer settles its additive text against the fixed maximum. The provisional coexistence policy above now preserves the three-territory cap and extends both normal-range groups; this no longer blocks declaration.
3. **Advisors:** the printed general prohibition on using ornithopters must not be ignored, but whether the two-normal-group card option is also covered is not expressly resolved. Keep this named boundary rather than silently treating the advisor path flag as permission.
   The following are primarily implementation work, not missing rulings. “Different groups” does not say “different territories”: distinct subsets may share an origin, but no physical unit can be counted in both. A distinct-origin-only shortcut would be an incomplete implementation, not a rule. The same accounting prevents the first group's arrivals from being moved again after merging with another stack. Base rules check stronghold access at the start of a force move, so normal-mode range should be recomputed for each accepted group; freezing both at declaration is not required. The player may end optional movement without a separate acknowledgement; after any actual card use, closing that use discards the card once. An uncommitted illegal route spends no movement. Interruption handling must preserve completed movements and remaining distinct-group custody rather than inventing a rollback. Exact provenance through complicated simultaneous force-removal effects can remain a named implementation limitation without asking for a new rule.

A safe initial supported boundary is both printed modes for ordinary physical fighter groups, an available ordinary move, no concurrent Hajr or Kulon, and current supported terrain/arrival combinations. The three-range mode works without stronghold occupation; the two-group mode uses ordinary per-group range and disjoint physical subsets. Both same-origin subsets and different-origin groups can be modeled from the text. Preserve existing supported arrival reactions and implement their resumptions; do not classify that technical work itself as a source ambiguity. No-Field marker support also has a general force-movement basis, but its cohort/event integration needs focused tests before inclusion. Explicitly guarded advanced advisor/stacking/optional-module contexts do not justify leaving either ordinary mode absent. These are bounds on certification, not reasons to leave the unambiguous modes unimplemented. No additional user question was sent during this audit.

## Current engine hooks and concrete risks

| Existing symbol                 | Relevant behavior                                                                                                       | Required integration                                                                                                                                                            |
| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `movementRange`                 | Recomputes normal range from Arrakeen/Carthag, Fremen, Ixian selected elites and Kulon.                                 | Separate normal range from a per-order fixed-card range. Do not mutate occupation or set a permanent speed flag.                                                                |
| `forceGroup`                    | Validates one-origin physical groups across sectors and optional concealed marker; returns typed units and source keys. | Reuse for each group. Add provenance so a second group cannot reuse first-group forces after merging.                                                                           |
| `t === 'move'`                  | Checks active phase5, `p.moved < (hajr ? 2 : 1)`, route/entry and advisor state.                                        | Replace duplicated allowance tests with one movement entitlement helper. Validate the card and chosen mode before effects.                                                      |
| `MovementOrder`                 | Stores exact physical group/elite counts, origin/destination and marker event through reactions.                        | Add explicit card-event/mode/group identity and the range basis. Avoid storing an arbitrary `Action`.                                                                           |
| `resumeChoamMovement`           | Revalidates stale orders using the Hajr count and current normal `movementRange`.                                       | It must preserve card entitlement/range and reserved group identity; otherwise a valid three-range card move can fail after Baliset is declined.                                |
| `ixMovement` response           | Cancellation stamps the current move index and leaves a one-territory move available.                                   | Trigger only for actual reliance on the Ixian normal-range advantage. Cancellation does not spend a card-derived movement or accidentally clear its remaining group.            |
| `completeMove`                  | Moves physical/marker custody, sets shipped, increments `p.moved`, then runs intrusion and entry.                       | Count each accepted group once. Advance the card continuation only after the group's arrival reactions finish. Do not recurse immediately into group two.                       |
| `endMovement` / phase start     | Ends the active player's turn; phase initialization resets Hajr/movement state.                                         | Close/expire any used card entitlement deterministically. Never carry an unbound second group into a later turn.                                                                |
| `viewGame`, bots and game-table | Repeated `movesAllowed = hajr ? 2 : 1`; UI/bot paths independently choose sources and ranges.                           | Project authoritative card options, remaining groups and restricted source/marker custody. Updating only engine permission leaves legal controls disabled or causes AI retries. |

The current `g.hajr` flag is inadequate for the two-group mode: ordinary extra moves allow the same group to move again, contain no distinct-group provenance, and share no card-discard continuation. A simple increment of `p.moved` allowance would violate the explicit distinction. It would also leave `resumeChoamMovement` and Kulon availability using inconsistent limits.

The earlier held-in-hand reservation proposal is superseded: move the played card into one public active-effect custody zone on validated declaration, then discard it once when use ends. Keeping it in the hand would incorrectly let Sabotage select it, or make a reservation block that legal hand-discard effect. Check all existing hand commitments before declaration; afterward gift, Distrans, cash-in and random extraction operate on the remaining actual hand. The active-effect card is neither a hand card nor a discard card and must not be duplicated in either. Extend physical-custody validation to include that zone. A paid Nullentropy search keeps its existing central lock. An active Truthtrance question is answered first. This movement card is not an anytime hand-transfer effect, so it should not start in the middle of an unrelated pending decision merely to overwrite it.

## Proposed minimal state/action contract

Keep card choice and each force movement reviewable, but omit acknowledgements for automatic bookkeeping:

```ts
ornithopter?: {
  event: string;
  player: string;
  card: string;
  turn: number;
  mode: 'range3' | 'twoGroups';
  startingMove: number;
  completed: number;
  movedCohorts: /* typed physical counts and marker identity */;
} | null;

// Bind a declared card move to the existing validated move request.
{ type: 'move', card: ornithopterId,
  ornithopter: 'range3' | 'twoGroups',
  forces, eliteForces, territory, sector, noField?, event? }
// Later card-group request references the server-issued Ornithopter event.
{ type: 'move', ornithopterEvent, forces, eliteForces,
  territory, sector, noField?, event? }
```

Prefer a clear actual API field name such as `movementCard` if `card` is overloaded elsewhere. Do not reuse the No-Field `event` field for the card event. The root adapter can choose a separate declaration action if needed, but must avoid a mandatory confirm step merely to begin an already specified valid first move.

For the range3 mode, validate the complete first movement before reserving the card; carry its bound range through response continuations; discard exactly once after the use. Invalid initial selection leaves the card and board unchanged. For twoGroups, commit each legal group once and persist remaining entitlement across every arrival interruption. Do not preempt genuine reactions or change their ownership. A second selection should use current legal state and constrained distinct-group custody; predeclaring both complete destinations changes information/timing and is not required by the face.

For fungible tokens, a source-quota/cohort model must distinguish ordinary and elite units, multi-sector source locations, first-group arrivals and the concealed marker. It may permit residual units in the same original location, while excluding the transported cohort at its new location. Arrival casualties, force returns and other relocation effects can make cohort assignment ambiguous; preserve the existing combined-effect guards unless those transitions also update provenance. Do not use secret No-Field value to compute the cohort quota.

Owner projection should contain the held canonical card, legal mode options with explicit reasons, event/remaining-group information when active, and authorized source quotas. Other players may see that a card was declared/used and its public movement, but not unchosen planned second destinations or hidden marker identity/value. An enlarged card inspector should explain the two alternatives and unresolved combination guard without presenting it as a printed ban.

Required tests before enabling the adapter: three-range route with no stronghold; unchanged storm/stronghold exclusion; normal two-group base/Fremen/Ixian ranges; no same-unit second movement including first-arrival merging; typed units and separate No-Field event; multi-sector groups; cancellation/decline and stale CHOAM continuation; independent Ixian response versus card-derived range; gift/Distrans/cash-in reservation; JSON/CAS duplicate first and second groups; single discard; end-turn closure; private projection and four AI profiles. Full optional-module and expansion starts remain gated until the wider acceptance requirements are met.

## Played-card custody correction and cohort helper checkpoint

The held-in-hand model above was an implementation proposal, never a printed requirement. The [November 2020 FAQ p8](https://www.gf9games.com/dune/wp-content/uploads/2020/11/Dune-FAQ-Nov-2020.pdf) confirms normal disposal after play and separately states the battle-winner retention exception. Base p10 distinguishes played battle cards held against a wheel. Neither requires this movement card to stay in hand throughout its effect. A separate played-card zone is consistent general-rule composition; no Ornithopter-specific FAQ is asserted. Root has adopted it so legitimate Sabotage can still randomly discard an entrant's remaining hand. Future Semuta reacts to the eventual discard event, not initial placement in the active-effect zone.

The pure `game/ornithopter.ts` helper and eight focused tests now track original unmoved ordinary/elite quotas and an exact optional marker identity/event/location. Same-origin residual subsets are permitted; first-group arrivals never increase quota. The engine remains responsible for phase/range/route rules, actual current marker custody and provenance changes after any intervening losses or relocations. A restored two-group effect with one completed move must require its recorded cohort, never reconstruct it from merged current forces. These pure tests do not certify the whole movement adapter.


## Integrated checkpoint — 2026-09-06

The authoritative engine now supports both movement modes, uses a public played-card zone, and persists typed original-group quotas for the second move. The mode/event travels through CHOAM and Ixian reactions. Concealed markers retain separate physical identities and events; revealing an unmoved marker converts its entitlement to its actual placed forces, while revealing a moved marker cannot grant reuse. Both ordinary subsets from one source and original forces at a first-group destination remain selectable. Independent review found and verified the repair of a missing-quota restore defect: second-group movement and normalization now reject corrupted missing provenance rather than reconstructing it from merged counts.

Eight pure-model, eight root engine, six independent review and six AI cases are registered and pass; four production-persistence cases cover both move commits and recovery. The complete registered checkpoint passes **1,305 rules/client/component tests and 104 persisted/API tests**. Final type checking, lint and production build pass. This is development-fixture support; unresolved named source combinations and expansion start gates remain in place.

Browser QA used only synthetic room QPNV5XJJ. A first two-force move from Red Chasm7 to Pasty Mesa5 advanced version23→24, put the played card outside the hand, and retained exactly three original forces for the second group. Selecting the first group's new stack disabled the second-move control. A fresh invitation restored exact version24, its event and its remaining original quota. Moving the remaining three advanced version24→25, left five forces at Pasty Mesa5, retained eight spice and fifteen reserves, and discarded Ornithopter exactly once. All other1,114 saved rooms retained their prior version/state hashes. Snapshots: `/tmp/dune-ornithopter-browser-pending-v24.json` and `/tmp/dune-ornithopter-browser-complete-v25.json`.

The browser check caught an initial parent/component wiring error: an unavailability message was passed even for valid drafts, disabling the card button. That prop is no longer passed unconditionally; the corrected real browser flow completed both moves. Remaining-group rejection copy now explains that the first group cannot move again. Full mobile and complete Richese-game acceptance remain unfinished.