Dune — Arrakis Table

An unofficial multiplayer adaptation of Gale Force Nine’s classic 2019 Dune, built with React, TypeScript, Vinext, and Cloudflare Workers/D1. Development is ongoing; this is not yet a complete rules implementation. Basic and clearly labelled Advanced-preview games can start with selected expansion factions and supported optional modules. Unsupported module combinations still reject at start. Start with current status for implemented systems, remaining requirements and release gates; detailed historical evidence remains in the implementation log.

Run locally

Use Node.js 22.13 or newer and npm. Install the locked dependencies and apply local migrations before starting the server:

npm ci
npm run db:local
npm run dev -- --host 0.0.0.0

Open http://localhost:3000. Create a room, share its eight-character invitation, and add human or AI seats. The host can configure Easy, Medium, Hard and Brutal AI opponents. Current calibration demonstrates a substantially weaker Easy policy; it does not yet demonstrate a consistent ordering among the upper three levels.

For Advanced play, choose Rules → Advanced preview before creating a room, or use the same selector as host in an existing lobby. Everyone must ready again after changing rules, then the host chooses Begin Advanced preview. This mode is unfinished; see preview scope and limits.

New Advanced Revival phases follow First Player order counterclockwise. Finish your native force and leader choices with Finish Revival turn before the next player acts; support responses keep their own authorized actors. Basic and already-opened older Revival phases retain their current readiness timing. See Revival source and preview scope.

Choose expansion families when creating the room. Before starting, the host can select Leader Skills, Ecaz Treachery Cards (the independent three-card variant), Nexus Cards, Discoveries, Homeworlds, Tech Tokens or Stronghold Cards in the lobby. These are unfinished previews, not complete combination support: setup rejects unsupported selections rather than silently dropping an option. Tech Tokens require three or more seats; Stronghold Cards require Advanced. Changing a selection clears human readiness. Existing games are not converted.

Advanced uses the user-authorized revised rules: every newly opened Storm after the first draws the Storm Deck, even without Fremen. Finishing your Shipment and Movement sends your own shared allied fighters to Tanks; advisors, Polar Sink and native Ecaz coexistence retain their exceptions. Basic and an already recorded current Storm keep their existing protocol. See Advanced source boundaries and allied separation. Advanced Hajr is played immediately after a completed Force Movement and its required arrival decisions. Basic keeps its broader own-turn timing. The Ornithopter combination uses one unused movement entitlement and retains Hajr's separate move. The single physical Hajr can be played again after legitimate paid Box recovery. Advanced still requires a fresh post-movement opportunity. After Guild Cunning, either physical Ornithopter mode may provisionally replace an earned unused Hajr movement. Cunning itself adds no ordinary move; abandoned card groups grant no extra credit. See the combination contract. Advanced advisors may use both physical Ornithopter modes. Advisors do not grant city access; normal-range groups use current fighter occupancy. See the advisor source cutover.

Before starting, open Configure on an AI seat to change its difficulty, faction or player circle without replacing it. Changes save immediately and clear human readiness. See lobby AI configuration.

Full AI implementation and tuning wait until all non-AI game features are complete. The AI development plan then targets approximately 75% higher-tier wins for Medium/Easy, Hard/Medium and Brutal/Hard. Until that stage, AI work focuses on minimal legal participation and critical playability fixes.

Choose Learn to play for the interactive introduction at /learn. Practice storm dials, spice blows, alliances, charity, bidding, revival, shipping, movement, battle plans, Traitor calls and collection before entering a room; lesson progress stays in your browser and does not change saved games.

Local games persist in .wrangler/state. Keep this directory across restarts. Apply new additive migrations before running code that depends on them. Never delete the local database to resolve a connection or rules problem. .openai/hosting.json belongs to the existing Sites project; do not recreate the hosting project.

For private NAS hosting and manually applied checkpoint image updates, see the TrueNAS container guide. Its separate persistent storage starts with new games; the requested host port is 33046.

The Administration link opens /admin, with separate administrator sign-in, session controls and a searchable room directory. Room controls lets owners and operators pause/resume rooms and lock/unlock new joins. The NAS container prints a newly generated initial owner access key in its log only if there are no administrator accounts. Save it privately: log readers can use it, and later starts do not print it again. See room controls and initial owner setup. Owners can manage administrator accounts with one-time personal keys, role changes, disabling and fresh-key rotation that can safely re-enable a disabled account. Save a new key privately before clearing its tab-scoped recovery record; an old key cannot be reused. Owners/operators can create a configured lobby with an explicitly owned new host seat and initial AI players. Configure lobby manages supported rules, AI seats and host assignment without private seat access. Remove or restore recoverably removes selected rooms; use the Directory filter to find them for restoration. Close or reopen stops further play while preserving readable tables and history, then resumes the same saved position. Archive or unarchive organizes closed rooms while retaining their tables and history; unarchiving leaves play closed. Participant AI supports an absent human in a paused game while preserving their seat and takeback control. Discussion controls mute or unmute new messages from a human seat while preserving history and gameplay. Owner-only backups capture and download private room snapshots without changing play. Import/restore, permanent deletion and further participant support remain unfinished. Action history searches recorded admin operations, with role-limited reasons and public before/after settings.

Saved seats and reconnecting

The room cookie identifies your seat. Refreshing or reopening the invitation with that cookie restores your private hand and pending decisions. A failed restoration offers an explicit retry. Requests time out after 15 seconds; uncertain game actions are reconciled with a read rather than automatically repeated.

Use Protect your saved seat to generate and privately save a recovery kit before enabling its key. Keep the complete kit separate from the invitation. Recover a saved seat uses that kit to restore the same faction after cookie loss and revokes the previous browser sessions for that seat. Recovery keeps existing forces, resources and sealed commitments. Anyone holding the kit can control that seat and see its private information.

If recovery receives no confirmed response, keep the page open and retry the same recovery request. The server recognizes the receipt and does not rotate twice. Replacing the recovery key invalidates the older kit. Host-initiated takeover remains unfinished. An owning human seat can enable or disable its own AI control during a started game.

For a planned absence, Let a player start AI for your seat grants one named human player permission to start your chosen difficulty once within 24 hours. They can activate it while you are online, but receive no private seat access. You can revoke unused permission or take back control. Recovering or transferring either seat invalidates the grant. See AI permission for saved retries and limits.

New create/join requests save a private, tab-scoped retry record before sending. If the response is uncertain, keep the tab open and use the explicit retry; refresh preserves the same request. Confirmed success removes that record. Clearly rejected first requests return to the form for correction. A retry can recover the original room and seat without creating duplicates, but closing the tab or clearing its data can lose the proof. This record is separate from the long-term seat recovery kit.

Normal creation/join shows brief progress; recovery instructions stay open when attention is needed. Completed-action notices wait for Continue so their text can be read at your pace. Seat recovery and handover confirmations also wait for Continue; admin and seat-control requests show recovery instructions only when needed. See readable notices.

An uncertain saved-kit recovery keeps its exact retry details in memory and prevents conflicting navigation. If that recovery has become obsolete, deliberate abandonment releases the controls after explaining that it cannot undo a completed recovery. Keep a valid saved kit before discarding retry details.

Use Pass your seat to another player for a voluntary one-time transfer. The private offer lasts 24 hours; acceptance preserves progress and revokes the old owner’s sessions and recovery kits. The recipient uses Accept a seat handover on the home page, then creates their own recovery kit. Keep the tab open until acceptance is confirmed; exact private retry details survive refresh in that tab. See seat handover for cancellation, retry behavior and current limits.

Use Table discussion below the board for public conversation or private messages to another human seat. Messages survive refresh; exact retries avoid duplicates. Private history follows the seat through recovery or handover. Messages do not execute game actions, and AI opponents do not answer them yet. See table discussion.

Use Bribes beneath the table to pay a non-allied faction. The recipient's share becomes spendable at the next Mentat Pause; the panel shows your own incoming bribes and the current payment limit. See bribe controls.

At a Nexus, an unanswered alliance offer names its recipient and offers Withdraw your alliance offer. Formed alliances keep the separate Break alliance action. See Nexus offers.

Use Inspect forces under any player to enlarge their counters and read public reserves, Tanks and deployed groups, including Homeworld reserve breakdowns. See force inspection.

Use Inspect faction under any player for public powers and alliance guidance. The sheet starts in the table’s rules mode and offers an Advanced preview without changing the game. Browse all twelve in the faction-sheet gallery.

In new Advanced Ecaz development games, Loyalty shows the publicly set-aside Traitor Card before dealing. Inspect it without making a game choice; its identity persists through refresh. See Ecaz Loyalty.

The local Leader Skills prototype also supports Basic Moritani with base opponents and the full fourteen-card deck. See entry, connected interactions and remaining boundaries. Basic Tleilaxu also supports the full deck, native Rihani exchanges and saved revival choices; see its integration boundary. Basic Ixians now connect cyborg movement, HMS routes and battle aftermath through the same full deck; see Ixian integration. The existing Basic CHOAM setup now connects ordinary skill actions and saved market/revival choices; see CHOAM integration.

Normal Mentat questions now use the user-approved uniform private card-show step in supported Leader Skills development games. Use the existing --profile leader-skills entry; no separate question flag is needed. Exact matching and fallback both use the same private step. Empty-hand interpretation and public start gates remain unfinished; see normal activation and controls.

For local printed Kull Wahad testing, use node --import tsx tools/start-prototype.ts --profile kull on a fresh ready Basic/Advanced CHOAM-plus-classic lobby with choam,ix decks and no optional modules, following the safe prototype workflow. The tool requires the exact room/version and a private backup output directory. The preview reserves the interrupted Karama and permits only a different eligible counter; BG interception is before conversion. New Advanced attempts restrict the specific Karama effect; Basic retains phase-wide prevention. Advanced phase expiry is provisional. Unpayable overbid recovery remains guarded. See the selected policy and boundaries. This does not enable public expansion starts or certify full CHOAM.

For local CHOAM Nexus Cunning Kull, use node --import tsx tools/start-prototype.ts --profile nexus-kull on a fresh ready Basic/Advanced CHOAM-plus-classic lobby with choam,ix Treachery and Nexus alone. It omits physical Sandtrout. The same exact-version/private-backup safeguards apply. Choose printed Kull or a canonical own Treachery fuel: Nexus spends on accepted declaration, fuel only on success; distinct prevention retains fuel while leaving Nexus spent. See verified bounded runtime and limits. Older printed-only games do not gain Nexus choices, and public starts stay gated.

For local Richese Nexus Betrayal testing, use node --import tsx tools/start-prototype.ts --profile richese-betrayal on a fresh ready Basic/Advanced CHOAM/Richese-plus-classic lobby with the choam deck and Nexus only. The same exact-version/private-backup safeguards apply. The preview connects public self-cache purchase veto without payment and other-buyer cache/Black Market sale diversion with unchanged delivery and price. See the cost, private timing, recovery evidence and remaining boundaries. This does not enable public expansion starts or certify the full Nexus family.

For local Guild Nexus Betrayal testing, use node --import tsx tools/start-prototype.ts --profile guild-betrayal on a fresh ready Basic/Advanced classic lobby with native Guild, base decks and Nexus. Enable Homeworlds in the lobby before readiness only when exercising Homeworld/Junction routes; the tool does not add that module to an ordinary room. The exact-version/private-backup safeguards apply. The holder takes one whole funded shipment payment, including their own or income overridden at Junction; this is not a second shipment, free upfront financing or extra Guild income. See payment custody and source boundaries. Existing games and public start gates remain unchanged.

For local Ixian Nexus purchased-card replacement, use node --import tsx tools/start-prototype.ts --profile ixian-replacement on a fresh ready classic Basic/Advanced lobby with base Treachery, or Basic Tleilaxu plus classic opponents with the Ix deck and no Ixians; Nexus alone. The fresh native variant omits optional Sandtrout. Exact-version/private-backup safeguards apply; existing games and public starts are unchanged. A real alliance-qualified Nexus must first give an unallied buyer its card, so effect scenarios need at least three seats. Keep purchased card retains both cards; eligible Use Ixian Nexus discards exactly the normal paid/printed-Karama purchase before drawing the real deck top, with the original payment and auction continuation once. Full hands and same-card redraw from an exhausted deck are supported. Harkonnen buyers and special sale origins remain guarded; see verified source, privacy and runtime boundaries.

For local Ixian Nexus Betrayal, use node --import tsx tools/start-prototype.ts --profile ixian-betrayal on a fresh ready Basic/Advanced lobby with native Ixians, otherwise classic factions or Tleilaxu, the forty-seven-card Ix Treachery Deck and Nexus alone. Exact-version/private-backup safeguards apply; no existing-game retrofit or public start is enabled. Native alliance-qualified Nexus rights still apply. Original Karama counters resolve first; neutral rival acknowledgements then offer Pass or privately eligible Use Ixian Nexus before the original Bidding inspection/draw or Advanced Technology exchange. Use spends one physical Nexus and prevents only that attempt; all-pass keeps its native effect and continuation. See the bounded verified runtime.

For local Harkonnen Nexus Betrayal, use node --import tsx tools/start-prototype.ts --profile harkonnen-betrayal on a fresh ready Basic/Advanced classic lobby with native Harkonnen and Nexus alone. Exact-version/private-backup safeguards and natural alliance-qualified Nexus rights apply; public starts and existing games are unchanged. After any original allied Karama counter allows an actual matching native traitor call, the declared-card acknowledgement offers Pass or privately eligible Use Harkonnen Nexus. Use returns that exact physical traitor immediately and preserves one automatic private actual Mentat replacement, not a draw-now exchange. This is a bounded provisional local timing/privacy convention; bounded verification is Partial/Development Verified; the universal reaction-policy question stays open. See the source contract and excluded modes.

Normal Spice Banker income is mandatory in fresh supported all-fourteen Leader Skills setups. Use the ordinary node --import tsx tools/start-prototype.ts --profile leader-skills entry with the lobby's supported original modules; there is no separate income profile or toggle. Exact-version/private-backup safeguards apply; public starts and existing games are unchanged. Another payer's one actual bank payment of at least four gains one mandatory front-shield spice once per phase; it stays unspendable until automatic native Mentat collection. Original payment, recipient and separate payer legs stay intact. Tleilaxu's own paid revival is a bank payment; another faction's payment to Tleilaxu is not, unless its income is canceled. The separate free-revival bank reward never adds to the original payer's qualifying amount. Earned original-faction retention after death/capture/reassignment remains provisional; existing games are not retrofitted and complete-mode acceptance remains open. See the default setup and source contract.

For local expansion factions + Stronghold Cards, use node --import tsx tools/start-prototype.ts --profile stronghold-factions on a fresh ready Advanced lobby with selected Ixian/Tleilaxu and/or CHOAM/Richese native factions and classic opponents. At least one expansion faction and its distinct ix/choam decks are required. CHOAM-only deck35; Ix or both47; Richese cache10 stays separate. Stronghold Cards alone start unowned and use native end-Mentat control. Other overlays/Ecaz/Moritani, public expansion starts and existing games are unchanged. Paired/mixed E1/E2 rules, legal AI and human phone controls are bounded Development Verified; save/privacy/custody assurance follows all rules. See the bounded integration.

For local Advanced Ecaz combined-army Occupy, use node --import tsx tools/start-prototype.ts --profile ecaz-occupy with the existing --db, --room, --version and private --out arguments on a fresh ready2..6-seat Advanced lobby: native Ecaz with classic, Ixian, Tleilaxu and CHOAM opponents, optional native Moritani. Select distinct ecaz and each native ix/choam family: ordinary33/47/35 cards retain original offers/HMS/Auditor/Face Dancers. Explicit --ecaz-treachery independently adds all three physical cards before setup, making36/50/38. Harass returns only card-user undialed forces while preserving original fixed commitment; Reinforcements costs three own reserves under its documented provisional policy. Richese mixed planning and other overlays remain unfinished. The selected lead owns leaders/cards/ payment; total dial includes mandatory free ceil(E/2) plus native allied strength. Karama switches to the selected lead's own army, other ally zero. Whole participating armies must be clear and connected; BG's voluntary fighter choice remains. Rule/390px controls are bounded Development Verified, not full Ecaz/Basic/public-start acceptance. See the authorized source and native proof.

Above the board, Treachery draw pile and Spice draw pile show live card counts separately from hands, auction cards and discards. See draw-pile counts.

Truthtrance's Current physical forces question compares counters in reserves, the Tanks or an exact board location. It supports normal, elite and total counts where recorded; see force questions.

After both battle plans are revealed, Compare revealed battle plans opens the shared dials, leader portraits and played card faces. Inspect any component, then return to the pending decision. See battle components.

In Your private hand, search card names, filter by printed category or change the display order. Show all cards clears filters. Inspectors and card actions stay with each physical card. See hand browsing.

The table header offers optional Sound effects, with mute, volume and a test sample. Short cues mark phase changes and automatic action notices. Sound starts off; preferences stay in your browser. See table sounds for activation, background behavior and prototype limits.

Automatic action notices identify completed actions in house colors and stay visible until Continue. Bursts summarize older notices while retaining their details in the chronicle; see completed-action feedback.

In Advanced development games, Your Harkonnen inspection preserves the cards seen during the special-Karama exchange. A return with only one legal selection completes automatically; see private exchange history.

Verify changes

Use the bounded context index for canonical feature/source paths and the feedback/proof schedule. The 2 October 2026 priority implements all rules before comprehensive review and save/recovery/privacy/custody assurance; those remain final requirements, not per-prototype gates. Keep legal behavior, usable controls, minimal legal AI and actual changed-path smoke. Batch related rules with one integration owner; helpers do not run shared checks while edits are in flight.

# Inspect file selection, then repair the exact failing case first.
npm test -- ecaz-spice --list
npm test -- ecaz-spice --name 'fallback'
# Run the related union once the batch is coherent.
npm test -- ecaz-collection ecaz-spice
npm run check:quick
# Also exercise the actual changed runtime path.
# Full offline proof after all rules or a justified broad integration check.
npm run check
# App/build/dependency changes also need a build.
npm run build

Tests are discovered automatically. The offline suite includes in-memory persistence recovery and needs no server. Run relevant test:integration cases against a development server for changed HTTP/session behavior, not repeated assurance at every rule checkpoint. test:multiplayer retains recovery plus HTTP; test:recovery selects in-memory persistence. Filename fragments form a union; --name REGEX narrows cases. --list previews files, not matching case names. Bad fragments/patterns and zero-executed selections fail. Default output retains failures, diagnostics and counts; use --verbose for full per-pass output. check:quick runs typecheck and lint only; it is not full-suite or release proof. See source-bound verification for private full logs/reports and deferred final audits. Existing games, access controls, secret protection and CI/deployment/publication gates remain protected.

The production build is written to dist. npm start serves that immutable build directly through Miniflare, without Wrangler's development proxy. Apply migrations to the intended storage environment first. Local serving defaults to the existing .wrangler/state and port 3000; DUNE_STATE_PATH and DUNE_PORT select explicit alternatives. The container entrypoint retains /data and applies additive migrations before startup. The local migration command does not target a remote deployment.

Reproduce the current AI study with:

node --import tsx tools/ai-calibration.ts --games 120 --seed 20260907 --out /tmp/dune-ai-calibration.json

See AI calibration, multiplayer audit, component inventory, and visual playtest for scope and limitations. Passing subsystem tests does not certify every rules combination.

Development maintenance

The user-authorized 13 September 2026 local reset established a fresh saved-game baseline; see the reset record. Preserve all games created after that checkpoint.

Reuse the running development server. Restart only for a relevant code/configuration change or observed problem, not an hourly schedule. Preserve database state, warn before interrupting human play and defer to a safe point. Observe health after a necessary local restart; comprehensive restoration assurance follows all rules, while actual production deployments retain their existing safeguards. No recurring automation is installed; leave it removed. Fix crashes and broken rule continuation rather than relying on restarts.

The application bundles its artwork, fonts and rules guidance. Source provenance and third-party notices live in developer documentation; the player-facing reference uses internal links. Publication remains gated on completion and integrated verification of the requested rules, expansions and critical player journeys.